dharma | bdd1a33de78618d16ee4ce148b849932c05d0015491c34887846d431d29f308e

Analysis

max time kernel
168s
max time network
165s
platform
windows11-21h2_x64
resource
win11-20250313-en
resource tags

arch:x64arch:x86image:win11-20250313-enlocale:en-usos:windows11-21h2-x64system
submitted
22/03/2025, 07:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7z2409-x64.exe
Size

1.6MB
MD5

6c73cc4c494be8f4e680de1a20262c8a
SHA1

28b53835fe92c3fa6e0c422fc3b17c6bc1cb27e0
SHA256

bdd1a33de78618d16ee4ce148b849932c05d0015491c34887846d431d29f308e
SHA512

2e8b746c51132f933cc526db661c2cb8cee889f390e3ce19dabbad1a2e6e13bed7a60f08809282df8d43c1c528a8ce7ce28e9e39fea8c16fd3fcda5604ae0c85
SSDEEP

24576:hE6TUFJmLWnNo7w3FB/IDmqmhnooXx5bwHRecHNnq8pggpahKhpaAJe0D/Qy4Pq:hEgJL2No7eFBVtoSYRectq8pggJAC/aq

Score

10^/10

dharma credential_access defense_evasion discovery execution impact persistence ransomware spyware stealer

Malware Config

Signatures

Dharma
Dharma is a ransomware that uses security software installation to hide malicious activities.
ransomware dharma
Dharma family
dharma
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Renames multiple (779) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Downloads MZ/PE file 2 IoCs

flow	pid	Process
203	488	msedge.exe
203	488	msedge.exe

Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
credential_access stealer

Windows Credential Manager
T1555.004

Drops startup file 5 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CoronaVirus.exe	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	CoronaVirus.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-38B58184.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-38B58184.[[email protected]].ncov	CoronaVirus.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta	CoronaVirus.exe

Executes dropped EXE 6 IoCs

pid	Process
2128	CoronaVirus.exe
39496	msedge.exe
17556	msedge.exe
17608	msedge.exe
17652	msedge.exe
17744	msedge.exe

Loads dropped DLL 12 IoCs

pid	Process
39496	msedge.exe
39496	msedge.exe
39496	msedge.exe
17556	msedge.exe
17556	msedge.exe
17652	msedge.exe
17652	msedge.exe
17608	msedge.exe
17744	msedge.exe
17744	msedge.exe
17608	msedge.exe
17608	msedge.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Users\Admin\AppData\Roaming\Info.hta = "mshta.exe \"C:\\Users\\Admin\\AppData\\Roaming\\Info.hta\""	CoronaVirus.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\CoronaVirus.exe = "C:\\Windows\\System32\\CoronaVirus.exe"	CoronaVirus.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Windows\System32\Info.hta = "mshta.exe \"C:\\Windows\\System32\\Info.hta\""	CoronaVirus.exe

Drops desktop.ini file(s) 64 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Public\Downloads\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini	CoronaVirus.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\Favorites\Links\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\Links\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini	CoronaVirus.exe
File opened for modification	C:\Program Files\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Public\AccountPictures\desktop.ini	CoronaVirus.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini	CoronaVirus.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\Pictures\Camera Roll\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	CoronaVirus.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\Desktop.ini	CoronaVirus.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini	CoronaVirus.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn1\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Public\Libraries\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\Contacts\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\Pictures\Saved Pictures\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\Searches\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Public\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Program Files (x86)\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Application Shortcuts\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\OneDrive\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini	CoronaVirus.exe
File opened for modification	F:\$RECYCLE.BIN\S-1-5-21-1136229799-3442283115-138161576-1000\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	CoronaVirus.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	CoronaVirus.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	CoronaVirus.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	CoronaVirus.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\Saved Games\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	CoronaVirus.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
201	raw.githubusercontent.com
202	raw.githubusercontent.com
203	raw.githubusercontent.com

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\System32\Info.hta	CoronaVirus.exe
File created	C:\Windows\System32\CoronaVirus.exe	CoronaVirus.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\faf_icons.png.id-38B58184.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\hr-hr\ui-strings.js.id-38B58184.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Paint_10.2104.17.0_x64__8wekyb3d8bbwe\Assets\PaintAppList.targetsize-48.png	CoronaVirus.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\contrast-white\HxMailLargeTile.scale-100.png	CoronaVirus.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.21012.10511.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-black\AppList.scale-100_contrast-black.png	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\JOURNAL\JOURNAL.INF.id-38B58184.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Functions\Mock.ps1	CoronaVirus.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.Emit.ILGeneration.dll.id-38B58184.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\System.Windows.Forms.Primitives.resources.dll.id-38B58184.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\flavormap.properties	CoronaVirus.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.42251.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-black\AppPackageBadgeLogo.scale-125_contrast-black.png	CoronaVirus.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_Subscription-ul-oob.xrm-ms.id-38B58184.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\contrast-white\HxMailSplashLogo.scale-100.png	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\offsymk.ttf.id-38B58184.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_2x.png.id-38B58184.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework.Aero2.dll	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription2-ul-oob.xrm-ms	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Trial-pl.xrm-ms	CoronaVirus.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsStore_12104.1001.1.0_x64__8wekyb3d8bbwe\Assets\AppTiles\StoreAppList.targetsize-24_altform-lightunplated.png	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Word2019VL_KMS_Client_AE-ppd.xrm-ms	CoronaVirus.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Mac\TURKISH.TXT.id-38B58184.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\OWSCLT.DLL	CoronaVirus.exe
File created	C:\Program Files\VideoLAN\VLC\lua\intf\modules\httprequests.luac.id-38B58184.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.2104.12721.0_x64__8wekyb3d8bbwe\System.Numerics.Vectors.WindowsRuntime.dll	CoronaVirus.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_12008.1001.1.0_x64__8wekyb3d8bbwe\Store.Purchase\Controls\WebBlendsControl.xaml	CoronaVirus.exe
File opened for modification	C:\Program Files (x86)\Common Files\System\Ole DB\de-DE\sqloledb.rll.mui	CoronaVirus.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\prefs_enclave_x64.dll	CoronaVirus.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\it-IT\MSFT_PackageManagementSource.schema.mfl.id-38B58184.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\en\Microsoft.PackageManagement.resources.dll	CoronaVirus.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.2103.1172.0_x64__8wekyb3d8bbwe\Assets\questfallback.png	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Trial-ul-oob.xrm-ms.id-38B58184.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\134.0.6985.0\prefs.json	CoronaVirus.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DatabaseServices.dll.id-38B58184.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libkaraoke_plugin.dll.id-38B58184.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_2.2106.2807.0_x64__8wekyb3d8bbwe\Win32Bridge.Server.exe	CoronaVirus.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\ZY______.PFB	CoronaVirus.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-errorhandling-l1-1-0.dll.id-38B58184.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.40978.0_x64__8wekyb3d8bbwe\Assets\contrast-black\WideTile.scale-125_contrast-black.png	CoronaVirus.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\server_issue.gif	CoronaVirus.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\hu-hu\ui-strings.js.id-38B58184.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\DAO\dao360.dll	CoronaVirus.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\System.Windows.Forms.Design.resources.dll.id-38B58184.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\root\ui-strings.js	CoronaVirus.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\rna-main.js.id-38B58184.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\en-ae\ui-strings.js	CoronaVirus.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Download_on_the_App_Store_Badge_nl_135x40.svg	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\en\SpreadsheetCompare_f_col.hxk.id-38B58184.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\AccessVL_KMS_Client-ul.xrm-ms.id-38B58184.[[email protected]].ncov	CoronaVirus.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremDemoR_BypassTrial365-ppd.xrm-ms.id-38B58184.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe.manifest	CoronaVirus.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\zh-cn\ui-strings.js.id-38B58184.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\2.0.1\Diagnostics\Simple\Example3B.Diagnostics.Tests.ps1	CoronaVirus.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Http.dll.id-38B58184.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ScreenSketch_11.2104.2.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SnipSketchLargeTile.scale-125.png	CoronaVirus.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\EmptyShare.scale-100.png	CoronaVirus.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\PresentationCore.resources.dll.id-38B58184.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MEDIA\ARROW.WAV.id-38B58184.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_OEM_Perp-ppd.xrm-ms	CoronaVirus.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\Images\SmallTile.scale-200_contrast-white.png	CoronaVirus.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\az_get.svg.id-38B58184.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.NETCore.App.runtimeconfig.json.id-38B58184.[[email protected]].ncov	CoronaVirus.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Transactions.Local.dll.id-38B58184.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.dll	CoronaVirus.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\jfr.jar	CoronaVirus.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1544_1849343956\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1544_1909305730\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1544_451214976\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1544_451214976\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1544_1849343956\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1544_1849343956\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1544_1909305730\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1544_1909305730\manifest.fingerprint	msedge.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 2 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Rensenware.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\CoronaVirus.exe:Zone.Identifier	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7z2409-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CoronaVirus.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Interacts with shadow copies 3 TTPs 2 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
40448	vssadmin.exe
40412	vssadmin.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133871030801721015"	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1136229799-3442283115-138161576-1000\{30B34160-754B-42F9-9C3B-270EAC4B5BDC}	msedge.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\CoronaVirus.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Rensenware.exe:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2128	CoronaVirus.exe
2128	CoronaVirus.exe
2128	CoronaVirus.exe
2128	CoronaVirus.exe
2128	CoronaVirus.exe
2128	CoronaVirus.exe
2128	CoronaVirus.exe
2128	CoronaVirus.exe
2128	CoronaVirus.exe
2128	CoronaVirus.exe
2128	CoronaVirus.exe
2128	CoronaVirus.exe
2128	CoronaVirus.exe
2128	CoronaVirus.exe
2128	CoronaVirus.exe
2128	CoronaVirus.exe
2128	CoronaVirus.exe
2128	CoronaVirus.exe
2128	CoronaVirus.exe
2128	CoronaVirus.exe
2128	CoronaVirus.exe
2128	CoronaVirus.exe
2128	CoronaVirus.exe
2128	CoronaVirus.exe
2128	CoronaVirus.exe
2128	CoronaVirus.exe
2128	CoronaVirus.exe
2128	CoronaVirus.exe
2128	CoronaVirus.exe
2128	CoronaVirus.exe
2128	CoronaVirus.exe
2128	CoronaVirus.exe
2128	CoronaVirus.exe
2128	CoronaVirus.exe
2128	CoronaVirus.exe
2128	CoronaVirus.exe
2128	CoronaVirus.exe
2128	CoronaVirus.exe
2128	CoronaVirus.exe
2128	CoronaVirus.exe
2128	CoronaVirus.exe
2128	CoronaVirus.exe
2128	CoronaVirus.exe
2128	CoronaVirus.exe
2128	CoronaVirus.exe
2128	CoronaVirus.exe
2128	CoronaVirus.exe
2128	CoronaVirus.exe
2128	CoronaVirus.exe
2128	CoronaVirus.exe
2128	CoronaVirus.exe
2128	CoronaVirus.exe
2128	CoronaVirus.exe
2128	CoronaVirus.exe
2128	CoronaVirus.exe
2128	CoronaVirus.exe
2128	CoronaVirus.exe
2128	CoronaVirus.exe
2128	CoronaVirus.exe
2128	CoronaVirus.exe
2128	CoronaVirus.exe
2128	CoronaVirus.exe
2128	CoronaVirus.exe
2128	CoronaVirus.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
1544	msedge.exe
1544	msedge.exe
1544	msedge.exe
1544	msedge.exe
1544	msedge.exe
1544	msedge.exe
1544	msedge.exe
1544	msedge.exe
1544	msedge.exe
1544	msedge.exe
1544	msedge.exe
1544	msedge.exe
1544	msedge.exe
1544	msedge.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2128	CoronaVirus.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeBackupPrivilege	40456	vssvc.exe
Token: SeRestorePrivilege	40456	vssvc.exe
Token: SeAuditPrivilege	40456	vssvc.exe

Suspicious use of FindShellTrayWindow 18 IoCs

pid	Process
1544	msedge.exe
1544	msedge.exe
1544	msedge.exe
1544	msedge.exe
1544	msedge.exe
1544	msedge.exe
1544	msedge.exe
1544	msedge.exe
1544	msedge.exe
1544	msedge.exe
1544	msedge.exe
1544	msedge.exe
1544	msedge.exe
1544	msedge.exe
1544	msedge.exe
1544	msedge.exe
1544	msedge.exe
1544	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1544 wrote to memory of 1316	1544	msedge.exe	85
PID 1544 wrote to memory of 1316	1544	msedge.exe	85
PID 1544 wrote to memory of 488	1544	msedge.exe	86
PID 1544 wrote to memory of 488	1544	msedge.exe	86
PID 1544 wrote to memory of 3120	1544	msedge.exe	87
PID 1544 wrote to memory of 3120	1544	msedge.exe	87
PID 1544 wrote to memory of 3120	1544	msedge.exe	87
PID 1544 wrote to memory of 3120	1544	msedge.exe	87
PID 1544 wrote to memory of 3120	1544	msedge.exe	87
PID 1544 wrote to memory of 3120	1544	msedge.exe	87
PID 1544 wrote to memory of 3120	1544	msedge.exe	87
PID 1544 wrote to memory of 3120	1544	msedge.exe	87
PID 1544 wrote to memory of 3120	1544	msedge.exe	87
PID 1544 wrote to memory of 3120	1544	msedge.exe	87
PID 1544 wrote to memory of 3120	1544	msedge.exe	87
PID 1544 wrote to memory of 3120	1544	msedge.exe	87
PID 1544 wrote to memory of 3120	1544	msedge.exe	87
PID 1544 wrote to memory of 3120	1544	msedge.exe	87
PID 1544 wrote to memory of 3120	1544	msedge.exe	87
PID 1544 wrote to memory of 3120	1544	msedge.exe	87
PID 1544 wrote to memory of 3120	1544	msedge.exe	87
PID 1544 wrote to memory of 3120	1544	msedge.exe	87
PID 1544 wrote to memory of 3120	1544	msedge.exe	87
PID 1544 wrote to memory of 3120	1544	msedge.exe	87
PID 1544 wrote to memory of 3120	1544	msedge.exe	87
PID 1544 wrote to memory of 3120	1544	msedge.exe	87
PID 1544 wrote to memory of 3120	1544	msedge.exe	87
PID 1544 wrote to memory of 3120	1544	msedge.exe	87
PID 1544 wrote to memory of 3120	1544	msedge.exe	87
PID 1544 wrote to memory of 3120	1544	msedge.exe	87
PID 1544 wrote to memory of 3120	1544	msedge.exe	87
PID 1544 wrote to memory of 3120	1544	msedge.exe	87
PID 1544 wrote to memory of 3120	1544	msedge.exe	87
PID 1544 wrote to memory of 3120	1544	msedge.exe	87
PID 1544 wrote to memory of 3120	1544	msedge.exe	87
PID 1544 wrote to memory of 3120	1544	msedge.exe	87
PID 1544 wrote to memory of 3120	1544	msedge.exe	87
PID 1544 wrote to memory of 3120	1544	msedge.exe	87
PID 1544 wrote to memory of 3120	1544	msedge.exe	87
PID 1544 wrote to memory of 3120	1544	msedge.exe	87
PID 1544 wrote to memory of 3120	1544	msedge.exe	87
PID 1544 wrote to memory of 3120	1544	msedge.exe	87
PID 1544 wrote to memory of 3120	1544	msedge.exe	87
PID 1544 wrote to memory of 3120	1544	msedge.exe	87
PID 1544 wrote to memory of 3120	1544	msedge.exe	87
PID 1544 wrote to memory of 3120	1544	msedge.exe	87
PID 1544 wrote to memory of 3120	1544	msedge.exe	87
PID 1544 wrote to memory of 3120	1544	msedge.exe	87
PID 1544 wrote to memory of 3120	1544	msedge.exe	87
PID 1544 wrote to memory of 3120	1544	msedge.exe	87
PID 1544 wrote to memory of 3120	1544	msedge.exe	87
PID 1544 wrote to memory of 3120	1544	msedge.exe	87
PID 1544 wrote to memory of 3120	1544	msedge.exe	87
PID 1544 wrote to memory of 3120	1544	msedge.exe	87
PID 1544 wrote to memory of 3120	1544	msedge.exe	87
PID 1544 wrote to memory of 1808	1544	msedge.exe	88
PID 1544 wrote to memory of 1808	1544	msedge.exe	88
PID 1544 wrote to memory of 1808	1544	msedge.exe	88
PID 1544 wrote to memory of 1808	1544	msedge.exe	88
PID 1544 wrote to memory of 1808	1544	msedge.exe	88
PID 1544 wrote to memory of 1808	1544	msedge.exe	88
PID 1544 wrote to memory of 1808	1544	msedge.exe	88
PID 1544 wrote to memory of 1808	1544	msedge.exe	88
PID 1544 wrote to memory of 1808	1544	msedge.exe	88

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\7z2409-x64.exe
"C:\Users\Admin\AppData\Local\Temp\7z2409-x64.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4928

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x2e4,0x2e8,0x2ec,0x2e0,0x2f8,0x7ffafb11f208,0x7ffafb11f214,0x7ffafb11f220
  2⤵
  PID:1316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1888,i,2740818766930068357,11779597283841974047,262144 --variations-seed-version --mojo-platform-channel-handle=2092 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  PID:488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2016,i,2740818766930068357,11779597283841974047,262144 --variations-seed-version --mojo-platform-channel-handle=2072 /prefetch:2
  2⤵
  PID:3120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=1704,i,2740818766930068357,11779597283841974047,262144 --variations-seed-version --mojo-platform-channel-handle=1644 /prefetch:13
  2⤵
  PID:1808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3472,i,2740818766930068357,11779597283841974047,262144 --variations-seed-version --mojo-platform-channel-handle=3704 /prefetch:1
  2⤵
  PID:1988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --instant-process --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3504,i,2740818766930068357,11779597283841974047,262144 --variations-seed-version --mojo-platform-channel-handle=3708 /prefetch:1
  2⤵
  PID:4280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=4100,i,2740818766930068357,11779597283841974047,262144 --variations-seed-version --mojo-platform-channel-handle=4128 /prefetch:1
  2⤵
  PID:876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --extension-process --renderer-sub-type=extension --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=4116,i,2740818766930068357,11779597283841974047,262144 --variations-seed-version --mojo-platform-channel-handle=4132 /prefetch:9
  2⤵
  PID:2780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --field-trial-handle=4204,i,2740818766930068357,11779597283841974047,262144 --variations-seed-version --mojo-platform-channel-handle=4248 /prefetch:1
  2⤵
  PID:4608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --extension-process --renderer-sub-type=extension --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --field-trial-handle=4224,i,2740818766930068357,11779597283841974047,262144 --variations-seed-version --mojo-platform-channel-handle=4352 /prefetch:9
  2⤵
  PID:2268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5164,i,2740818766930068357,11779597283841974047,262144 --variations-seed-version --mojo-platform-channel-handle=5132 /prefetch:14
  2⤵
  PID:3484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5300,i,2740818766930068357,11779597283841974047,262144 --variations-seed-version --mojo-platform-channel-handle=5324 /prefetch:14
  2⤵
  PID:3108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5632,i,2740818766930068357,11779597283841974047,262144 --variations-seed-version --mojo-platform-channel-handle=5592 /prefetch:14
  2⤵
  PID:708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5660,i,2740818766930068357,11779597283841974047,262144 --variations-seed-version --mojo-platform-channel-handle=5556 /prefetch:14
  2⤵
  PID:4016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5512,i,2740818766930068357,11779597283841974047,262144 --variations-seed-version --mojo-platform-channel-handle=5484 /prefetch:14
  2⤵
  PID:5388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5360,i,2740818766930068357,11779597283841974047,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:14
  2⤵
  PID:6020
- - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1128
    3⤵
    PID:1484
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5400,i,2740818766930068357,11779597283841974047,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:14
  2⤵
  PID:6032
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5400,i,2740818766930068357,11779597283841974047,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:14
  2⤵
  PID:6072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5448,i,2740818766930068357,11779597283841974047,262144 --variations-seed-version --mojo-platform-channel-handle=5460 /prefetch:14
  2⤵
  PID:4628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6680,i,2740818766930068357,11779597283841974047,262144 --variations-seed-version --mojo-platform-channel-handle=6716 /prefetch:14
  2⤵
  PID:4268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6788,i,2740818766930068357,11779597283841974047,262144 --variations-seed-version --mojo-platform-channel-handle=6836 /prefetch:14
  2⤵
  PID:5136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6776,i,2740818766930068357,11779597283841974047,262144 --variations-seed-version --mojo-platform-channel-handle=6936 /prefetch:14
  2⤵
  PID:5144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6760,i,2740818766930068357,11779597283841974047,262144 --variations-seed-version --mojo-platform-channel-handle=7036 /prefetch:14
  2⤵
  PID:5180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7188,i,2740818766930068357,11779597283841974047,262144 --variations-seed-version --mojo-platform-channel-handle=7184 /prefetch:14
  2⤵
  PID:5248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7356,i,2740818766930068357,11779597283841974047,262144 --variations-seed-version --mojo-platform-channel-handle=7180 /prefetch:14
  2⤵
  PID:5280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --field-trial-handle=7496,i,2740818766930068357,11779597283841974047,262144 --variations-seed-version --mojo-platform-channel-handle=7520 /prefetch:1
  2⤵
  PID:5292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7344,i,2740818766930068357,11779597283841974047,262144 --variations-seed-version --mojo-platform-channel-handle=7688 /prefetch:14
  2⤵
  PID:3484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --field-trial-handle=7004,i,2740818766930068357,11779597283841974047,262144 --variations-seed-version --mojo-platform-channel-handle=6308 /prefetch:1
  2⤵
  PID:5704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --field-trial-handle=7248,i,2740818766930068357,11779597283841974047,262144 --variations-seed-version --mojo-platform-channel-handle=5480 /prefetch:1
  2⤵
  PID:5896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --field-trial-handle=7472,i,2740818766930068357,11779597283841974047,262144 --variations-seed-version --mojo-platform-channel-handle=7688 /prefetch:1
  2⤵
  PID:3160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --field-trial-handle=7820,i,2740818766930068357,11779597283841974047,262144 --variations-seed-version --mojo-platform-channel-handle=7844 /prefetch:1
  2⤵
  PID:2524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4176,i,2740818766930068357,11779597283841974047,262144 --variations-seed-version --mojo-platform-channel-handle=4448 /prefetch:14
  2⤵
  PID:4976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5144,i,2740818766930068357,11779597283841974047,262144 --variations-seed-version --mojo-platform-channel-handle=5256 /prefetch:14
  2⤵
  PID:3844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5228,i,2740818766930068357,11779597283841974047,262144 --variations-seed-version --mojo-platform-channel-handle=7664 /prefetch:14
  2⤵
  PID:5820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=2920,i,2740818766930068357,11779597283841974047,262144 --variations-seed-version --mojo-platform-channel-handle=5664 /prefetch:14
  2⤵
  PID:3532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3712,i,2740818766930068357,11779597283841974047,262144 --variations-seed-version --mojo-platform-channel-handle=5744 /prefetch:14
  2⤵
  PID:5844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --field-trial-handle=5708,i,2740818766930068357,11779597283841974047,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:1
  2⤵
  PID:3204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7240,i,2740818766930068357,11779597283841974047,262144 --variations-seed-version --mojo-platform-channel-handle=3876 /prefetch:14
  2⤵
  PID:2448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7112,i,2740818766930068357,11779597283841974047,262144 --variations-seed-version --mojo-platform-channel-handle=7920 /prefetch:14
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:3800
- C:\Users\Admin\Downloads\CoronaVirus.exe
  "C:\Users\Admin\Downloads\CoronaVirus.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops desktop.ini file(s)
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: RenamesItself
  PID:2128
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe"
    3⤵
    PID:1832
  - - C:\Windows\system32\mode.com
      mode con cp select=1251
      4⤵
      PID:17092
  - - C:\Windows\system32\vssadmin.exe
      vssadmin delete shadows /all /quiet
      4⤵
      Interacts with shadow copies
      PID:40448
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe"
    3⤵
    PID:57324
  - - C:\Windows\system32\mode.com
      mode con cp select=1251
      4⤵
      PID:17432
  - - C:\Windows\system32\vssadmin.exe
      vssadmin delete shadows /all /quiet
      4⤵
      Interacts with shadow copies
      PID:40412
- - C:\Windows\System32\mshta.exe
    "C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"
    3⤵
    PID:40360
- - C:\Windows\System32\mshta.exe
    "C:\Windows\System32\mshta.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"
    3⤵
    PID:16712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4000,i,2740818766930068357,11779597283841974047,262144 --variations-seed-version --mojo-platform-channel-handle=5084 /prefetch:14
  2⤵
  PID:5416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2620,i,2740818766930068357,11779597283841974047,262144 --variations-seed-version --mojo-platform-channel-handle=884 /prefetch:10
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:39496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7312,i,2740818766930068357,11779597283841974047,262144 --variations-seed-version --mojo-platform-channel-handle=7912 /prefetch:14
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:17556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --field-trial-handle=5544,i,2740818766930068357,11779597283841974047,262144 --variations-seed-version --mojo-platform-channel-handle=5432 /prefetch:1
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:17608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=880,i,2740818766930068357,11779597283841974047,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:14
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:17652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4380,i,2740818766930068357,11779597283841974047,262144 --variations-seed-version --mojo-platform-channel-handle=7336 /prefetch:14
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:17744

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:1832

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:40456

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Direct Volume Access

T1006

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Windows Credential Manager

T1555.004

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems64.dll.id-38B58184.[[email protected]].ncov

Filesize
3.2MB

MD5
739b72335cbed98ba0110ce244ed45af

SHA1
5cd249a3200012d5c052f564ba002335a0077c13

SHA256
9eda9d16a501ae956175bb1173229275981cfa56f8883e22adb5ceb11e646886

SHA512
921079c3b4dfbc3d4b221d6c43d689aad79f637e1c6cad9636a4c81bbbd64acf297f7c871b92260781306f42e6735da405c54788fce9961f2771c8760f405727

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\6500331b-4a96-4da3-a0be-c822aa4f60ee.tmp

Filesize
392B

MD5
01aa9c0a86285d75a2bf2edcb859b40c

SHA1
edf08634111e5828b13204e1ddf5ab264f159770

SHA256
a884372d5985d47fa0844ccf797a3850c3bb9561aac8290a099fe3dbdf27b747

SHA512
f651ee2065a6cbc47baf58c67d983aa9cb26dd16f8c278ded3af563bf2db3f11db7d44c2fca7dbe21feccd5576b57211e3b14658d322744f625b918714aae09c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist

Filesize
105KB

MD5
eb84061cc1bbe1bdac5d05852ae08558

SHA1
28849ea0720b92469a6c7adf35a848acfce02320

SHA256
3a05dac734d1f1fd480bf7b1e3675870f5fb02703cbed71f2bbe2f3aaa0e927b

SHA512
54f55f2d3d548a7ed1c220e0a539b26f211748ff9f16ea056c87b1582a24319be481b096f05f6ed1551e64130781671a99bde43c2028da1819f2f2c826f8eb87

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.8\protocols.json

Filesize
3KB

MD5
6bbb18bb210b0af189f5d76a65f7ad80

SHA1
87b804075e78af64293611a637504273fadfe718

SHA256
01594d510a1bbc016897ec89402553eca423dfdc8b82bafbc5653bf0c976f57c

SHA512
4788edcfa3911c3bb2be8fc447166c330e8ac389f74e8c44e13238ead2fa45c8538aee325bd0d1cc40d91ad47dea1aa94a92148a62983144fdecff2130ee120d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
046b1cdbd636e82e7711ea1fde31d7e3

SHA1
f5fa4183cb259a99b4148ee957a5f76e80a77ada

SHA256
40328502d95af4c1db45d98abe8c4e9214d80a8df7f0b8f19f81edd5e121f90a

SHA512
460ba5792f0df64289ff4057d04615973a7844b2fd2c14df554600c141d720fcf13d9e9c8449ac57e50fa074a81887437918970881b4d48f7a7ee3521bac8eb4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
cbc9fc2d9ad2df85283109b48c8e6db0

SHA1
721ea0dfafd882d6354f8b0a35560425a60a8819

SHA256
7c21b286b304b2b42ab3502158aef04892b60c63007b8ed7172dad86a4bcebbe

SHA512
09594b5f33704cf367960376e5abc8cbfa7baead59c3f199ffd365a9a9c2159b45f6596d597ebdd033db5436c000faac3c5b2fb39e97fc17b102d03831265609

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\01db7e2a-20af-42a2-9b93-f3dc9c61a2e9.tmp

Filesize
17KB

MD5
a5db211ab48472264f675c1325e4be43

SHA1
6e9ded2ef99a13589e7833f417d356983767d308

SHA256
472a21e912864d1b55b7ee2fe914ea3eafe5848721dbe3242d805d1e581063a7

SHA512
d53a3b1c9ebdd66ba86ce07660d15bd6655782f45c5ce315072a0e858cf38143fdf7356603b5ab8a3dd64ffe85072449ec7912e22195301a6566c71507c2866a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
7KB

MD5
fc71646a9c4e8bce1628c618af0ad442

SHA1
003ebf66ec437eb5b7ded31cc69f08e4bb8a0550

SHA256
df540690948724d905a4bbbcf61bc847e8803bdda1fc8ca420b66e19bb418f03

SHA512
681814727c522859a3f0550b6d897bb547da6223ffdf990d6c09eb5cae741c8bc5a6a5442e653ff5fc6f22005a248326c8531a3f345e4b4645dd2c715afa4583

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
69KB

MD5
164a788f50529fc93a6077e50675c617

SHA1
c53f6cd0531fd98d6abbd2a9e5fbb4319b221f48

SHA256
b305e470fb9f8b69a8cd53b5a8ffb88538c9f6a9c7c2c194a226e8f6c9b53c17

SHA512
ec7d173b55283f3e59a468a0037921dc4e1bf3fab1c693330b9d8e5826273c917b374c4b802f3234bbb5e5e210d55e52351426867e0eb8c9f6fba1a053cb05d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db

Filesize
32KB

MD5
f429a4a973726389ef3ba0ebc6883aa2

SHA1
fda0230c25d4719a96cbb5170e4ee3f9d7f803c1

SHA256
ecd73b07afbbcd803f9608072f41576b6cf64992ffcd92957d17547c914bb479

SHA512
8d761ba9e252b11cfc103fb1ca7feb0019e3aa180bf1ee88bde3b95a3e5005a8281641dcbb258163eca3ed2a8e665420d687d8699b0313c66ad218285f618f6a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\content.js

Filesize
9KB

MD5
3d20584f7f6c8eac79e17cca4207fb79

SHA1
3c16dcc27ae52431c8cdd92fbaab0341524d3092

SHA256
0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643

SHA512
315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps

Filesize
107KB

MD5
40e2018187b61af5be8caf035fb72882

SHA1
72a0b7bcb454b6b727bf90da35879b3e9a70621e

SHA256
b3efd9d75856016510dd0bdb5e22359925cee7f2056b3cde6411c55ae8ae8ee5

SHA512
a21b8f3f7d646909d6aed605ad5823269f52fda1255aa9bb4d4643e165a7b11935572bf9e0a6a324874f99c20a6f3b6d1e457c7ccd30adcac83c15febc063d12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
5KB

MD5
cd577120c87d54270c920a984cee8f51

SHA1
9e4e7a46a339fb5d72f09555dd4e6b72a4d7f24e

SHA256
34dfc03ec812f780199960874fd7f783e08029583e10b067cec681b2a64a3ca6

SHA512
18a9fc5dd6eea9762da2b67c06e307b5043a0ee3e4fd6014c1b2712b3e8ec53383c5666d373304986d4c9263efaccc902e8636732cdb2baba54facb46ab79c3a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
211B

MD5
62c9f90bb8f7977643000e49ee70ad53

SHA1
89fe015fdd7910ca8e865b8563d76e2b93965633

SHA256
e7ae13a2e9b0efb23e994291323811dc428a989cccbdb6813049112d912974fc

SHA512
78c2baafa23a78959888b851be90c1613486f183b2bd666538a747acf37c6260374c48c7faeec64803faee178f3e93b1393851df21d11a31773a481e72018aef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries~RFe581921.TMP

Filesize
40B

MD5
20d4b8fa017a12a108c87f540836e250

SHA1
1ac617fac131262b6d3ce1f52f5907e31d5f6f00

SHA256
6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

SHA512
507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
17KB

MD5
fd861788f18a99af8e2121e8be4a57d1

SHA1
aac9bb153efc7166bdc1f9e24fea91d1877a51c6

SHA256
5b208106c36eaa8a9863ccab341f2b38c0eea09c6055c93ef9f0620a0631bebe

SHA512
9c3d399128c2c75783ad5291a65424f4516032114b61be29e1dd6eaedcb7548a80654c71b1b910127e7b2208a5385f4d4799df08c5e863ea0e7e8f7c8fcd1276

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
16KB

MD5
1ca02b9722deceeac3a60db40fc2a7e1

SHA1
f34030cf3d0afa9ffbb498e55747b71776b28dad

SHA256
5d1a7940013d81db05285fcdbab4fc10b47ea5c6b52eaacf9f527ba473e8a02b

SHA512
a813bec0210f8fcb022b645e75bfbc25f0260068f41f7094ef75cae4804bdb3e1301f3d65486fce8dcb8278f329c0976c9c2598165ca6dc02559b6231affdf67

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
15KB

MD5
b7bec92dafb332ab1ba29c05b04d71d9

SHA1
b43b2617db09a8984091855b14ec81016e5226db

SHA256
3c2ffe4d24334f96363c6870bcf534bef53226f8b19ab2b9da2fc82e70bc76a0

SHA512
935b24ac1a019a318a215730ecc89889162537ce084af2eb3869d9c43a4fb2123c37885c9365e1a7e19752818415e0d8a6eb4ed6b14873634ee20deafbcdbbd0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
17KB

MD5
b9194ead484e9a99a967f8d0c1fe96da

SHA1
8f7ab109672fe89ca029a22ef4489212bc0d234a

SHA256
2ed57e433ae2dfb6f8dd3424557a7624144cb75b380a014b4b6217bbf38b1814

SHA512
8adc89df0ac0f4f392e0c507140acab915e0175176442b822eeb3852984696569561db36096d7088d4822589ae193a8ca2390d4739d5d94a25f25567c8b07c36

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RFe5a058f.TMP

Filesize
17KB

MD5
dfdb534215a62f3ddabb00e60cc8ee0c

SHA1
719def385166c7cb0fa0048dee1ad098e85b7e1e

SHA256
2bc19c6ea5d6e30649066757dea245e0ada2f049461cea74d7a088ede25a44bd

SHA512
c571da04bbdd4d6e953e87f06402d987da02c63197b8adcc064c5a046a8297121fd043a0bbc8387a35ea8237c4e18e4cfe87cbacd72f413315595b0ef2e9efef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
37KB

MD5
f5b7ecf80d0cf0f7b8851027ff569197

SHA1
429f268ec06597bb6eff1ea7c09cbf5a860148c6

SHA256
f3176e705850ca815baade191bac2f4bff19a4434933b168121944c83da637ab

SHA512
7aa74aea050417973ecf9f48111cf71356646da1e0f36ce6e2cf1e4209c5afa40e418c76fae6c409ba0d5d87fb4f38f722852d9d07712b9c946012f8fb207046

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\8d8084f4-f3f0-4ae2-867f-9bdc75f2710b\index-dir\the-real-index

Filesize
192B

MD5
a0f026122e4f455ea3a9bef8db16c9a1

SHA1
9050ee84e2e04c9269553814fd387e9122da4f91

SHA256
b5a7d70ecde355e70e1923c6df7934398fb7a7e4cf0e792ffa196c18a9d11b2a

SHA512
74cffac884e67d89e379f71a4608a1a522443e98fca68c9de8c89fbd683e4f67678fe04d5c6291d88b4de31d0eeef83ae5b08095c35441a8ba0c694b10bd0b22

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\8d8084f4-f3f0-4ae2-867f-9bdc75f2710b\index-dir\the-real-index

Filesize
2KB

MD5
c415d0d62eb416ff9d5a86b722358a86

SHA1
0922764899c6c26f817152e5530dfb6868df5b96

SHA256
b2593b94e58574e3a8ea612a173295b8a286de1aff9b95de390ee6e55ce9c64f

SHA512
60bff628a6b3739ef55ba496502e71b91f1b4d30632a4c811c83ff1b12779a1fca9fd9bb03f85c527d82fee6daee0019212a082d0867e386dc636317db8a2b86

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\8d8084f4-f3f0-4ae2-867f-9bdc75f2710b\index-dir\the-real-index~RFe57bd93.TMP

Filesize
192B

MD5
483f4d04c4f52f12e1b7f6e0723c1390

SHA1
0b8538fafaa94326a38078e82c2ea3acb1f2ca1a

SHA256
753c977b50e3aace40e4ced85dacd41e3da6b39d72aaa1005f2e80d2dee15037

SHA512
9977688ed85f9f7ee27ad1e55f447bdae8e8dda5c0a21b424918dc2c207dbcc6b7629cf0035ca0ffda6e0a71c2668306048d44d7da0c60be1b2e6989f7dd63f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9dfd6465-7c0f-4139-9ac0-1c7dcd3710fc\index-dir\the-real-index

Filesize
72B

MD5
1ae4df6ad2d9a365721156653b863d7a

SHA1
664c4ba6a4b0c087b673fdd3d9b61de6f737fa58

SHA256
0b0ea6e0244f2bdfbe4768345e8b73f1a69c7f71afa8ed01d4abc59573d52ec2

SHA512
62c91ae0d65006f6fe2794b30e40238ef078bb50df33a524fb9706da1d3727710e0d879e09352b43f8a701db65200589e8bca8bbd1872239273720f3bea6634c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9dfd6465-7c0f-4139-9ac0-1c7dcd3710fc\index-dir\the-real-index~RFe58120c.TMP

Filesize
72B

MD5
49ee6afe9e61773a8901f234a8585ff7

SHA1
6daa99b44c138744e6838aeaa1e44c1a15511c5d

SHA256
7f110c53f71231dd2cf998ed7014cb19d34602e9e8514b08451d444ef83a8bea

SHA512
03eecba98053b5ec3797339ac5b6c35da7cd75bc894cea12d749f1bbb38287cd6985c0b729495114f26e5481c07d88dff06b74dd89746bac56338273fb4ccd98

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt

Filesize
253B

MD5
17548914fd5a810f1aef210bf8a4e136

SHA1
fe51ac2f6236bd96143127c6696e72ff5fa0a98e

SHA256
1a058167109dc5a4cac7cdd6938207a2e3b0b13e77dd2ff71faddec939816835

SHA512
53fc56735ca16cea597e78c7643c266961f0788371e1bf9cddf33233ddab838f4c8dd78b2fa85df868a2d7bc1f81646217df3ae9858a44edb0bebd48dfb3aff7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
241aaf8825be84770105e211c2dbbea7

SHA1
01e7f814817c20a36ea1e5a3de39f2c32f8a99e2

SHA256
841f63bb7ff1eed0c6c537e1e9276a73ee5a12f9900eed3799a09c827c651f1d

SHA512
70dfc3c0643fcf4a708a6f651e594659511e1708a0c8d9d6c7d5e289555b84717b6fdfd1e3e55c1722d786470e17f396bf73a4ffd2539101d7c9b3095d353613

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe581558.TMP

Filesize
48B

MD5
40d09d3d612ad3f8095400e20e11eb0a

SHA1
4d5c66d560362c1741312c3c4987af7d117a8666

SHA256
459502762be83cb260724efce258fa290ae6f71a035a7af74a4c82cfcbc0e96d

SHA512
548150824e3201a3727df61f3053a7ba02e74f594cde911a1f41fb759d7c9df76f197075020c00b4aca6462a40e7d9d86207e6eb3dea4cec3f4fff067c929bd3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

Filesize
4KB

MD5
04ebf9992f0d3ae8766aab0f6a15801f

SHA1
9c29f6b69e5c7c05524a8b8b3f75028921e428de

SHA256
2e0761c3bb443fece170aa25031aa407d3a728466b211a03976f45b4361ca842

SHA512
06253ebadf01cdee7b1e36d4714f6f0ae8e22ec48b0f8dfda73eb0ea8ad706ec1917df1a4f476633aa19fded58108d06160d0bd329daf7169650fdc99831f126

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
876B

MD5
476bf7898cff532dd2d9a3c91ad4f69d

SHA1
71f4abe6a53080d5f47fa6cdd48647ba26dbc607

SHA256
2c40dc1d4b15e2a9eb096babf0323de2b2b36827a8309ea725c6077e6b7b5f06

SHA512
6983dbc608e6460b802999acf05428f832a556d35d998be5b419d65345c5c74d18d1d201341d528890bdd4bb3bc2ced0a005dfda3f5772fdd5d6f52882016464

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
22KB

MD5
9387093d99bbe8d015dd14dfb4b25acc

SHA1
072b6f036f6cc05c6232093676b2cf17208f33f1

SHA256
ed49ed51f549de07a3dfc0c13784e319aede77281bab91732faa2281190191b7

SHA512
2039ab6c2177c26852de4d410afd5c80db975dbb048b4bca37b0b2a31ee94ef699f026c4221cd416657ad77fbc6ca7af993fed76426f26381e4d4d5650e7854c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog~RFe58a42a.TMP

Filesize
467B

MD5
884098482abcc0ee22575f276120848f

SHA1
721ff8cfb991239707f2354a9f08c468933bfdd5

SHA256
18d3c15c525ab8c40dc2957a411716a2a3c87b70f88ed3862d5b8830fbd31e3e

SHA512
052ef8b832c3cb5d11162d528c307e1f04dc5c35491d194509d3e1e115921a133a93597cc3b1c5f7bac9d6a4372f224df1f67f1ef6e7a0a394be4f50a76a2880

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig

Filesize
21KB

MD5
e4dfd0504387a1ebcc4a48846e44a23e

SHA1
a5a91da421e3d8728ae857694dbeb24ea72b7866

SHA256
d3c39babd9652bcdb02ae17f895437ed85f617cb04f7ba4bbaf7ad7e8ab78cb6

SHA512
94a1d4ab7b18763b55c9246d73feb0ed64a7e506572884a2940696b12910d6ff2a03a0b1aca3e4035a81548633acd437e762e758952ba72dafc97f191e46d419

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe58a515.TMP

Filesize
3KB

MD5
c7569efb2fa9fe93c0ea2f0896f54036

SHA1
e231c700b778b624f6065b035e5803fdd8b4db4b

SHA256
2422f055fd21adce7a027c3eaab1bbc474345a26cb1b9762b3d7572ebde67d3f

SHA512
c394da9a75cca87f6e20cb2abbc2e087d3e374b613bbc960f255ebfc8f01d4349fc8a487ec56ff8141f47566cf021dc33196e42b6295ce5399ff78e5ce4b066f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
40KB

MD5
6f44c13edddecf0b72b69b7f3c121a59

SHA1
f225d9bf1f49324b12c0aff68b06cf6ac9e8343d

SHA256
4e1db4223b3ef7d2b439b9a2dade9f36505f86360949ca4d545d13d2e77dfc31

SHA512
af1f30e7c452ba8176aa681c913013eaa651c87664484d8f1722688fe18b2bdcbe3f8cef73fd87a8e84351a132c34194ab17b6bef404191918241717f4635d23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
39KB

MD5
30d7ad5a0e3664bac4d2ab1c87c27f6e

SHA1
330b3a65ef5a5ccf704defadf620a6f062930fff

SHA256
de3ed535c1ad00d52545c632e5fdbc65ab2068b77540d570c0370ccb44c04a99

SHA512
0af973d3c5635aeb17ccbd8e279a686a5bea871fc252904e97bb6f2987fc4a2f0fca1a557b18339f27c6dad1f8c8211f5c9e6806f2812077528b721c1c455167

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
30KB

MD5
1e273d7c03fa7c2dbae590c52460cc6e

SHA1
6468684264bb50e208ecbf46d6ed07db2e519206

SHA256
0b5193926a764b8e85258c3b702797562cdd6455877a6017e3bc5badf5f1b4e6

SHA512
9d7d108f6e7f28de8c618bd24c73e6d1f8332ce8bc8eb7ee35fcaaede873f4ca116e2d55c330b56e5041b890ff112b600e067cc5769332e11df4160069983d04

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
6KB

MD5
d77b8162a195c9533c67f1801871d68f

SHA1
8fbcd3c03d4f822b7619c07a47ffed85394b5054

SHA256
c42ab1dfc70f53bf7953e464c3d718f5888b18bf05f42d579f709653e917f931

SHA512
045b88295fe161250935e0fbe33b10685753b37917bed491048eba7fa9a8e8bf31a039a2fa729946b75f584ecef886fab2c300f06c14d0f5000a3b3cf76ad27c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
7KB

MD5
b97063fed50671f47508d7254fa2cc8a

SHA1
ffcbdf95c54f2674bb2f0c034d9002303824a404

SHA256
dff7f0fc080d43aa335450757cce4d5d05b89d741ac944b4cd21b7139c6ed3fe

SHA512
363d5786c5071b057a0d74203abfd4083b2a2a7fab984c126ff561326ebad118de9dba555186a84899205cf8580f53b89a6018d32332525bda917b606b864c26

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter

Filesize
392B

MD5
b281f129a82d0bebdb7dc44af12d336b

SHA1
551fe7fce91a4633bd95b3fe4bb65a4a394f7fb1

SHA256
637d5ee0950f1f2cf0a29e3190e1796946cd42a5fd31b5b2cebaad6d74822907

SHA512
e18a70ef4bdb5e2b5519dec08e7da124c808b546017c32c3982ce49004b5b0fec2e405a771eefd50da32e8ce6f26472acae350db02dbdfb501556fb619267ae2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter

Filesize
392B

MD5
bb020d77eadeee254f9de7d1aa73ec96

SHA1
86ade90c4859432190d9e7ed51ad535d48c3971b

SHA256
3609cdbf04d95d39c2c27ac1063edbc74dcbd11bf77c85138af972fcae11174e

SHA512
692960bb1343d7e0dcc577de54896e5ba4640329c3ca45fc980a4f90271fbd02110c0c3a42d7bf3e53985c421074ed41080a734e845dc54b4ea709e08552d7ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter

Filesize
392B

MD5
44b964ca3eb5f1b4b057abdadd141ec6

SHA1
ad54ad9b5f3c4852b4a12f3cbc413641f74aedaa

SHA256
73baa9af09bda4bc1c8f645b819177ea10194ebdb78eadc0fafd657709b9703c

SHA512
130013646ee25c9954da7bdbec51839ae24e32bce5abb5d3883c15102402af4e76f7914262fd8ecc8d3fe30ca373009a26e15fdaef0c1a87565990c35eee9d5b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter

Filesize
392B

MD5
714dc132b7cb6f508ee67f9939bd6670

SHA1
e922d3650c80821637cbaf62d428063ec1142dd7

SHA256
c27afc0700d516569349cb13ad3f6c3b3e5a6d7c78286188bb1a589a158cd362

SHA512
0c8b836bd8fb606137857833f8a5b1cecc91a984c648ec9434ba48a909bfe8f203f80f47906c3d144224bd838ece034ebb6ac0af40060f5fa27f2d13bdd98264

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter

Filesize
392B

MD5
0f38c12367192dfcd3c2fb93fca658cd

SHA1
6b6b9c038a45a4ec81409e2a0a07e0366b4f1e79

SHA256
41f51ab9e6cfadcbb6bdeb1728bff0ab68849446669d138398da860b83404c15

SHA512
6e33d21a4dc896f61c3ffa447756d0ac89739d1b0c1095b126a310baa17c55179eb74cf07eedd49ee03f91d91b4d9b32f37d87a495460173b130070a79a29bfa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter

Filesize
392B

MD5
92b65109468148eb1f748ca6963e09b8

SHA1
786996a33906efbcb7374ee42f33bd2e05b75851

SHA256
b4cf25f51bad44272e98ddb0d36401950347752d82d53b0ed07a75b91b0edda9

SHA512
4086edd74553aa7a8f28c90562588061fafb873c97cbecfea89db2ff3831f21b1ebfd9d17ed8d9e2dcf0ce9e05dd84966606a3653e77d83deb4c6d222ce4eb35

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter

Filesize
392B

MD5
5f15dd627b305186d7dd58b823c6d20a

SHA1
d6ee7ade700a47ddd7e90aad7c7b026ae8d711ae

SHA256
2c53ac4a8a502b393da100fcf69b8bd68cdcc068d79736a395694de2d2e0bc67

SHA512
aaaa7f7a1f5318b8ced4530158a89f4067f1c9bcacd438a83a04cc6705f9d1a1b86d48098ed581b6d1886809959b7b93f63bb3692f80f43e091fdb9e410fce9e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter

Filesize
392B

MD5
118a3475974ce4cac2ecc63854a964e2

SHA1
aec4b9f6cea8b1e8969bd8d94e81b2247db2e3a4

SHA256
ee3be059fde50fe75a0d3977ccfa35882a586ca6489603be04b44b52656e5e82

SHA512
1d02aae5cca6a3cec335da62fc9f35221b2e55fb0ed9ea78f84d9cf3425330383b9f730cf320ed2ac8d44765a5caceecefe4d533d044e6fea970ac60b492a3c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter

Filesize
392B

MD5
b6c384eb14767985125946b14085efda

SHA1
1497289d2d2d1f8839f03ab380c3655fe5acd796

SHA256
4ffa3e75e726ac95925859b59df36a4f022ce50d7c1b9ee4d45c621b503f7f47

SHA512
e9c288f942a88cda33aba41beb7aeed92b012abd473f55b5cbfa6be011c09c337df5f3ef24a0d829db8bfd23226a59f4b4b38d4176d6d92522dde448ffba8032

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe59a32c.TMP

Filesize
392B

MD5
c114cdc1215e0eaabbe88b9f19e33e36

SHA1
af8a5533729fd647884c4d399748cd00f115361a

SHA256
2917ba3d3937a54f0d0996650b403584dbfc60ecc451ef75bbb7b9bd2f37fcfd

SHA512
0fdd4b3b5382ea57a4ed49d2df8d1f4312a6fe431c970f9133d6fe37ea1e42a803ea7bdb90a3f102c07584017bcc77cf587707dfa04ea5744e415f72fba3b4e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\WorkspacesNavigationComponent\1.0.0.5\nav_config.json

Filesize
2KB

MD5
499d9e568b96e759959dc69635470211

SHA1
2462a315342e0c09fd6c5fbd7f1e7ff6914c17e6

SHA256
98252dc9f9e81167e893f2c32f08ee60e9a6c43fadb454400ed3bff3a68fbf0d

SHA512
3a5922697b5356fd29ccf8dcc2e5e0e8c1fd955046a5bacf11b8ac5b7c147625d31ade6ff17be86e79c2c613104b2d2aebb11557399084d422e304f287d8b905

Download Submit
C:\Users\Admin\AppData\Local\Temp\9e473844-c37d-4597-a15b-924b434dd34a.tmp

Filesize
10KB

MD5
78e47dda17341bed7be45dccfd89ac87

SHA1
1afde30e46997452d11e4a2adbbf35cce7a1404f

SHA256
67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550

SHA512
9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\dc40810d-6af6-4e35-8bd6-af17ec94bd18.tmp

Filesize
1B

MD5
5058f1af8388633f609cadb75a75dc9d

SHA1
3a52ce780950d4d969792a2559cd519d7ee8c727

SHA256
cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

SHA512
0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir1544_1907816403\54f933f2-1b61-42c0-acb9-a1347a849bfd.tmp

Filesize
152KB

MD5
dd9bf8448d3ddcfd067967f01e8bf6d7

SHA1
d7829475b2bd6a3baa8fabfaf39af57c6439b35e

SHA256
fa2232917a5656ea4f811936561ea6b7c92b3c0004c5e08ecb97636d3afc6f72

SHA512
65347df34378c2bbb34417e2cccfb3251a0b2412422cc190eed9df525b6e0a9948e0295ea3c33b3ad873ce81e369e89a138ac41d6eb7229546c3269107e661de

Download Submit
C:\Users\Admin\Downloads\CoronaVirus.exe

Filesize
1.0MB

MD5
055d1462f66a350d9886542d4d79bc2b

SHA1
f1086d2f667d807dbb1aa362a7a809ea119f2565

SHA256
dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0

SHA512
2c5e570226252bdb2104c90d5b75f11493af8ed1be8cb0fd14e3f324311a82138753064731b80ce8e8b120b3fe7009b21a50e9f4583d534080e28ab84b83fee1

Download Submit
C:\Users\Admin\Downloads\CoronaVirus.exe:Zone.Identifier

Filesize
55B

MD5
0f98a5550abe0fb880568b1480c96a1c

SHA1
d2ce9f7057b201d31f79f3aee2225d89f36be07d

SHA256
2dfb5f4b33e4cf8237b732c02b1f2b1192ffe4b83114bcf821f489bbf48c6aa1

SHA512
dbc1150d831950684ab37407defac0177b7583da0fe13ee8f8eeb65e8b05d23b357722246888189b4681b97507a4262ece96a1c458c4427a9a41d8ea8d11a2f6

Download Submit
C:\Users\Admin\Downloads\Rensenware.exe

Filesize
96KB

MD5
60335edf459643a87168da8ed74c2b60

SHA1
61f3e01174a6557f9c0bfc89ae682d37a7e91e2e

SHA256
7bf5623f0a10dfa148a35bebd899b7758612f1693d2a9910f716cf15a921a76a

SHA512
b4e5e4d4f0b4a52243d6756c66b4fe6f4b39e64df7790072046e8a3dadad3a1be30b8689a1bab8257cc35cb4df652888ddf62b4e1fccb33e1bbf1f5416d73efb

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1544_1849343956\manifest.json

Filesize
134B

MD5
58d3ca1189df439d0538a75912496bcf

SHA1
99af5b6a006a6929cc08744d1b54e3623fec2f36

SHA256
a946db31a6a985bdb64ea9f403294b479571ca3c22215742bdc26ea1cf123437

SHA512
afd7f140e89472d4827156ec1c48da488b0d06daaa737351c7bec6bc12edfc4443460c4ac169287350934ca66fb2f883347ed8084c62caf9f883a736243194a2

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1544_1909305730\manifest.json

Filesize
160B

MD5
c3911ceb35539db42e5654bdd60ac956

SHA1
71be0751e5fc583b119730dbceb2c723f2389f6c

SHA256
31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d

SHA512
d8b2c7c5b7105a6f0c4bc9c79c05b1202bc8deb90e60a037fec59429c04fc688a745ee1a0d06a8311466b4d14e2921dfb4476104432178c01df1e99deb48b331

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1544_451214976\manifest.json

Filesize
43B

MD5
af3a9104ca46f35bb5f6123d89c25966

SHA1
1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8

SHA256
81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea

SHA512
6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1

Download Submit
memory/2128-6211-0x0000000000400000-0x000000000056F000-memory.dmp

Filesize
1.4MB

Download
memory/2128-1882-0x0000000000400000-0x000000000056F000-memory.dmp

Filesize
1.4MB

Download
memory/2128-1842-0x0000000000400000-0x000000000056F000-memory.dmp

Filesize
1.4MB

Download