wannacry | hxxps://github[.]com/Da2dalus/The-MALWARE-Repo/archive/refs/heads/master[.]zip

Resubmissions

27/04/2025, 17:31

250427-v34ptaynw64

22/04/2025, 01:57

22/04/2025, 01:52

22/04/2025, 01:43

22/04/2025, 01:29

22/04/2025, 01:28

21/04/2025, 16:14

Analysis

max time kernel
539s
max time network
541s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20250314-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20250314-enlocale:en-usos:windows10-ltsc_2021-x64system
submitted
21/04/2025, 16:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://github.com/Da2dalus/The-MALWARE-Repo/archive/refs/heads/master.zip
Sample250421-tptr1ssmy6

Score

10^/10

wannacry defense_evasion discovery execution impact persistence ransomware worm

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\!Please Read Me!.txt

wannacry

Ransom Note

Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 15zGqZCTcys6eCjDkE3DypCjXi6QWRV6V1 Next, please find the decrypt software on your desktop, an executable file named "!WannaDecryptor!.exe". If it does not exsit, download the software from the address below. (You may need to disable your antivirus for a while.) rar password: wcry123 Run and follow the instructions! �

Wallets

15zGqZCTcys6eCjDkE3DypCjXi6QWRV6V1

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Wannacry family
wannacry
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Renames multiple (63) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\~SD9669.tmp	WannaCry.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\~SD9670.tmp	WannaCry.exe

Executes dropped EXE 4 IoCs

pid	Process
4980	!WannaDecryptor!.exe
3916	!WannaDecryptor!.exe
4696	!WannaDecryptor!.exe
3592	!WannaDecryptor!.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Update Task Scheduler = "\"C:\\Users\\Admin\\Desktop\\The-MALWARE-Repo-master\\Ransomware\\WannaCry.exe\" /r"	WannaCry.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1498259476-758239146-3116387113-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\!WannaCryptor!.bmp"	!WannaDecryptor!.exe

Drops file in Windows directory 45 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1656_2060201918\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3196_452071481\deny_etld1_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3196_452071481\manifest.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1656_2060201918\v1FieldTypes.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1656_1745725416\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3196_290167959\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1656_595137823\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1656_945830203\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1656_945830203\sets.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1656_1747969759\deny_full_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1656_1740030791\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3196_290167959\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3196_290167959\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1656_945830203\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1656_2060201918\autofill_bypass_cache_forms.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1656_1745725416\manifest.fingerprint	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3196_290167959\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3196_452071481\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3196_1667552521\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1656_903545766\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1656_1747969759\deny_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1656_1747969759\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3196_1667552521\arbitration_metadata.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1656_903545766\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1656_1747969759\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1656_2060201918\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1656_1745725416\data.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3196_290167959\sets.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3196_1667552521\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1656_595137823\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1656_595137823\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1656_903545766\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3196_452071481\deny_full_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1656_945830203\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1656_903545766\keys.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1656_2060201918\edge_autofill_global_block_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1656_2060201918\regex_patterns.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1656_1740030791\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1656_1740030791\typosquatting_list.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3196_452071481\deny_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1656_945830203\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1656_903545766\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1656_1747969759\deny_etld1_domains.list	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 15 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WannaCry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	!WannaDecryptor!.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WannaCry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	!WannaDecryptor!.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	!WannaDecryptor!.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	!WannaDecryptor!.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Kills process with taskkill 4 IoCs

defense_evasion

pid	Process
1308	taskkill.exe
4004	taskkill.exe
5612	taskkill.exe
1660	taskkill.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133897256805182595"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1498259476-758239146-3116387113-1000\{33AE78A1-E55B-48B2-9149-D07321B2440A}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1498259476-758239146-3116387113-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1498259476-758239146-3116387113-1000\{D27115EC-F440-4DAF-ACA8-4E7B489D4015}	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3960	msedge.exe
3960	msedge.exe
2204	WMIC.exe
2204	WMIC.exe
2204	WMIC.exe
2204	WMIC.exe
3196	msedge.exe
3196	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3592	!WannaDecryptor!.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe

Suspicious use of AdjustPrivilegeToken 49 IoCs

description	pid	Process
Token: SeDebugPrivilege	1308	taskkill.exe
Token: SeDebugPrivilege	1660	taskkill.exe
Token: SeDebugPrivilege	4004	taskkill.exe
Token: SeDebugPrivilege	5612	taskkill.exe
Token: SeIncreaseQuotaPrivilege	2204	WMIC.exe
Token: SeSecurityPrivilege	2204	WMIC.exe
Token: SeTakeOwnershipPrivilege	2204	WMIC.exe
Token: SeLoadDriverPrivilege	2204	WMIC.exe
Token: SeSystemProfilePrivilege	2204	WMIC.exe
Token: SeSystemtimePrivilege	2204	WMIC.exe
Token: SeProfSingleProcessPrivilege	2204	WMIC.exe
Token: SeIncBasePriorityPrivilege	2204	WMIC.exe
Token: SeCreatePagefilePrivilege	2204	WMIC.exe
Token: SeBackupPrivilege	2204	WMIC.exe
Token: SeRestorePrivilege	2204	WMIC.exe
Token: SeShutdownPrivilege	2204	WMIC.exe
Token: SeDebugPrivilege	2204	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2204	WMIC.exe
Token: SeRemoteShutdownPrivilege	2204	WMIC.exe
Token: SeUndockPrivilege	2204	WMIC.exe
Token: SeManageVolumePrivilege	2204	WMIC.exe
Token: 33	2204	WMIC.exe
Token: 34	2204	WMIC.exe
Token: 35	2204	WMIC.exe
Token: 36	2204	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2204	WMIC.exe
Token: SeSecurityPrivilege	2204	WMIC.exe
Token: SeTakeOwnershipPrivilege	2204	WMIC.exe
Token: SeLoadDriverPrivilege	2204	WMIC.exe
Token: SeSystemProfilePrivilege	2204	WMIC.exe
Token: SeSystemtimePrivilege	2204	WMIC.exe
Token: SeProfSingleProcessPrivilege	2204	WMIC.exe
Token: SeIncBasePriorityPrivilege	2204	WMIC.exe
Token: SeCreatePagefilePrivilege	2204	WMIC.exe
Token: SeBackupPrivilege	2204	WMIC.exe
Token: SeRestorePrivilege	2204	WMIC.exe
Token: SeShutdownPrivilege	2204	WMIC.exe
Token: SeDebugPrivilege	2204	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2204	WMIC.exe
Token: SeRemoteShutdownPrivilege	2204	WMIC.exe
Token: SeUndockPrivilege	2204	WMIC.exe
Token: SeManageVolumePrivilege	2204	WMIC.exe
Token: 33	2204	WMIC.exe
Token: 34	2204	WMIC.exe
Token: 35	2204	WMIC.exe
Token: 36	2204	WMIC.exe
Token: SeBackupPrivilege	5072	vssvc.exe
Token: SeRestorePrivilege	5072	vssvc.exe
Token: SeAuditPrivilege	5072	vssvc.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
4980	!WannaDecryptor!.exe
4980	!WannaDecryptor!.exe
3916	!WannaDecryptor!.exe
3916	!WannaDecryptor!.exe
4696	!WannaDecryptor!.exe
4696	!WannaDecryptor!.exe
3592	!WannaDecryptor!.exe
3592	!WannaDecryptor!.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1656 wrote to memory of 6128	1656	msedge.exe	81
PID 1656 wrote to memory of 6128	1656	msedge.exe	81
PID 1656 wrote to memory of 620	1656	msedge.exe	82
PID 1656 wrote to memory of 620	1656	msedge.exe	82
PID 1656 wrote to memory of 5256	1656	msedge.exe	83
PID 1656 wrote to memory of 5256	1656	msedge.exe	83
PID 1656 wrote to memory of 5256	1656	msedge.exe	83
PID 1656 wrote to memory of 5256	1656	msedge.exe	83
PID 1656 wrote to memory of 5256	1656	msedge.exe	83
PID 1656 wrote to memory of 5256	1656	msedge.exe	83
PID 1656 wrote to memory of 5256	1656	msedge.exe	83
PID 1656 wrote to memory of 5256	1656	msedge.exe	83
PID 1656 wrote to memory of 5256	1656	msedge.exe	83
PID 1656 wrote to memory of 5256	1656	msedge.exe	83
PID 1656 wrote to memory of 5256	1656	msedge.exe	83
PID 1656 wrote to memory of 5256	1656	msedge.exe	83
PID 1656 wrote to memory of 5256	1656	msedge.exe	83
PID 1656 wrote to memory of 5256	1656	msedge.exe	83
PID 1656 wrote to memory of 5256	1656	msedge.exe	83
PID 1656 wrote to memory of 5256	1656	msedge.exe	83
PID 1656 wrote to memory of 5256	1656	msedge.exe	83
PID 1656 wrote to memory of 5256	1656	msedge.exe	83
PID 1656 wrote to memory of 5256	1656	msedge.exe	83
PID 1656 wrote to memory of 5256	1656	msedge.exe	83
PID 1656 wrote to memory of 5256	1656	msedge.exe	83
PID 1656 wrote to memory of 5256	1656	msedge.exe	83
PID 1656 wrote to memory of 5256	1656	msedge.exe	83
PID 1656 wrote to memory of 5256	1656	msedge.exe	83
PID 1656 wrote to memory of 5256	1656	msedge.exe	83
PID 1656 wrote to memory of 5256	1656	msedge.exe	83
PID 1656 wrote to memory of 5256	1656	msedge.exe	83
PID 1656 wrote to memory of 5256	1656	msedge.exe	83
PID 1656 wrote to memory of 5256	1656	msedge.exe	83
PID 1656 wrote to memory of 5256	1656	msedge.exe	83
PID 1656 wrote to memory of 5256	1656	msedge.exe	83
PID 1656 wrote to memory of 5256	1656	msedge.exe	83
PID 1656 wrote to memory of 5256	1656	msedge.exe	83
PID 1656 wrote to memory of 5256	1656	msedge.exe	83
PID 1656 wrote to memory of 5256	1656	msedge.exe	83
PID 1656 wrote to memory of 5256	1656	msedge.exe	83
PID 1656 wrote to memory of 5256	1656	msedge.exe	83
PID 1656 wrote to memory of 5256	1656	msedge.exe	83
PID 1656 wrote to memory of 5256	1656	msedge.exe	83
PID 1656 wrote to memory of 5256	1656	msedge.exe	83
PID 1656 wrote to memory of 5256	1656	msedge.exe	83
PID 1656 wrote to memory of 5256	1656	msedge.exe	83
PID 1656 wrote to memory of 5256	1656	msedge.exe	83
PID 1656 wrote to memory of 5256	1656	msedge.exe	83
PID 1656 wrote to memory of 5256	1656	msedge.exe	83
PID 1656 wrote to memory of 5256	1656	msedge.exe	83
PID 1656 wrote to memory of 5256	1656	msedge.exe	83
PID 1656 wrote to memory of 5256	1656	msedge.exe	83
PID 1656 wrote to memory of 5256	1656	msedge.exe	83
PID 1656 wrote to memory of 5256	1656	msedge.exe	83
PID 1656 wrote to memory of 5256	1656	msedge.exe	83
PID 1656 wrote to memory of 1512	1656	msedge.exe	84
PID 1656 wrote to memory of 1512	1656	msedge.exe	84
PID 1656 wrote to memory of 1512	1656	msedge.exe	84
PID 1656 wrote to memory of 1512	1656	msedge.exe	84
PID 1656 wrote to memory of 1512	1656	msedge.exe	84
PID 1656 wrote to memory of 1512	1656	msedge.exe	84
PID 1656 wrote to memory of 1512	1656	msedge.exe	84
PID 1656 wrote to memory of 1512	1656	msedge.exe	84
PID 1656 wrote to memory of 1512	1656	msedge.exe	84

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/Da2dalus/The-MALWARE-Repo/archive/refs/heads/master.zip
1⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x318,0x7ffc9e68f208,0x7ffc9e68f214,0x7ffc9e68f220
  2⤵
  PID:6128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1888,i,15493863066345252627,15833680963404365152,262144 --variations-seed-version --mojo-platform-channel-handle=2356 /prefetch:3
  2⤵
  PID:620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2328,i,15493863066345252627,15833680963404365152,262144 --variations-seed-version --mojo-platform-channel-handle=2148 /prefetch:2
  2⤵
  PID:5256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2608,i,15493863066345252627,15833680963404365152,262144 --variations-seed-version --mojo-platform-channel-handle=2624 /prefetch:8
  2⤵
  PID:1512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3544,i,15493863066345252627,15833680963404365152,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:1
  2⤵
  PID:4704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3552,i,15493863066345252627,15833680963404365152,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:1
  2⤵
  PID:4712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4880,i,15493863066345252627,15833680963404365152,262144 --variations-seed-version --mojo-platform-channel-handle=5048 /prefetch:8
  2⤵
  PID:3776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4904,i,15493863066345252627,15833680963404365152,262144 --variations-seed-version --mojo-platform-channel-handle=5024 /prefetch:8
  2⤵
  PID:6004
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5676,i,15493863066345252627,15833680963404365152,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:8
  2⤵
  PID:1088
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5676,i,15493863066345252627,15833680963404365152,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:8
  2⤵
  PID:2032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5740,i,15493863066345252627,15833680963404365152,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:8
  2⤵
  PID:4160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5972,i,15493863066345252627,15833680963404365152,262144 --variations-seed-version --mojo-platform-channel-handle=5868 /prefetch:8
  2⤵
  PID:3588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5704,i,15493863066345252627,15833680963404365152,262144 --variations-seed-version --mojo-platform-channel-handle=6084 /prefetch:8
  2⤵
  PID:2416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6244,i,15493863066345252627,15833680963404365152,262144 --variations-seed-version --mojo-platform-channel-handle=6052 /prefetch:8
  2⤵
  PID:4316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --field-trial-handle=5932,i,15493863066345252627,15833680963404365152,262144 --variations-seed-version --mojo-platform-channel-handle=5952 /prefetch:1
  2⤵
  PID:4400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5944,i,15493863066345252627,15833680963404365152,262144 --variations-seed-version --mojo-platform-channel-handle=5860 /prefetch:8
  2⤵
  PID:1924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5192,i,15493863066345252627,15833680963404365152,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:8
  2⤵
  PID:664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --field-trial-handle=3684,i,15493863066345252627,15833680963404365152,262144 --variations-seed-version --mojo-platform-channel-handle=3748 /prefetch:1
  2⤵
  PID:5712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6284,i,15493863066345252627,15833680963404365152,262144 --variations-seed-version --mojo-platform-channel-handle=6328 /prefetch:8
  2⤵
  PID:4680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1668,i,15493863066345252627,15833680963404365152,262144 --variations-seed-version --mojo-platform-channel-handle=6396 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5408,i,15493863066345252627,15833680963404365152,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:8
  2⤵
  PID:5128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3432,i,15493863066345252627,15833680963404365152,262144 --variations-seed-version --mojo-platform-channel-handle=5416 /prefetch:8
  2⤵
  PID:1120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3348,i,15493863066345252627,15833680963404365152,262144 --variations-seed-version --mojo-platform-channel-handle=5424 /prefetch:8
  2⤵
  PID:2640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5176,i,15493863066345252627,15833680963404365152,262144 --variations-seed-version --mojo-platform-channel-handle=6344 /prefetch:8
  2⤵
  PID:4996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=2000,i,15493863066345252627,15833680963404365152,262144 --variations-seed-version --mojo-platform-channel-handle=5460 /prefetch:8
  2⤵
  PID:5476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6324,i,15493863066345252627,15833680963404365152,262144 --variations-seed-version --mojo-platform-channel-handle=3344 /prefetch:8
  2⤵
  PID:4392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=2764,i,15493863066345252627,15833680963404365152,262144 --variations-seed-version --mojo-platform-channel-handle=6328 /prefetch:8
  2⤵
  PID:5116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6520,i,15493863066345252627,15833680963404365152,262144 --variations-seed-version --mojo-platform-channel-handle=4376 /prefetch:8
  2⤵
  PID:4248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3512,i,15493863066345252627,15833680963404365152,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:8
  2⤵
  PID:420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
  2⤵
  - Drops file in Windows directory
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:3196
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x26c,0x270,0x274,0x268,0x260,0x7ffc9e68f208,0x7ffc9e68f214,0x7ffc9e68f220
    3⤵
    PID:1532
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1896,i,1331462738932424762,11790015375041244710,262144 --variations-seed-version --mojo-platform-channel-handle=2264 /prefetch:3
    3⤵
    PID:4568
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2216,i,1331462738932424762,11790015375041244710,262144 --variations-seed-version --mojo-platform-channel-handle=2224 /prefetch:2
    3⤵
    PID:3516
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2008,i,1331462738932424762,11790015375041244710,262144 --variations-seed-version --mojo-platform-channel-handle=2680 /prefetch:8
    3⤵
    PID:4804
- - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4040,i,1331462738932424762,11790015375041244710,262144 --variations-seed-version --mojo-platform-channel-handle=4120 /prefetch:8
    3⤵
    PID:4336
- - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4040,i,1331462738932424762,11790015375041244710,262144 --variations-seed-version --mojo-platform-channel-handle=4120 /prefetch:8
    3⤵
    PID:5244
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3452,i,1331462738932424762,11790015375041244710,262144 --variations-seed-version --mojo-platform-channel-handle=4132 /prefetch:8
    3⤵
    PID:6072
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4472,i,1331462738932424762,11790015375041244710,262144 --variations-seed-version --mojo-platform-channel-handle=4532 /prefetch:8
    3⤵
    PID:3544
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4628,i,1331462738932424762,11790015375041244710,262144 --variations-seed-version --mojo-platform-channel-handle=4576 /prefetch:8
    3⤵
    PID:3156
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4616,i,1331462738932424762,11790015375041244710,262144 --variations-seed-version --mojo-platform-channel-handle=4552 /prefetch:8
    3⤵
    PID:4124
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4612,i,1331462738932424762,11790015375041244710,262144 --variations-seed-version --mojo-platform-channel-handle=4692 /prefetch:8
    3⤵
    PID:5184
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4748,i,1331462738932424762,11790015375041244710,262144 --variations-seed-version --mojo-platform-channel-handle=4564 /prefetch:8
    3⤵
    PID:4160
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=604,i,1331462738932424762,11790015375041244710,262144 --variations-seed-version --mojo-platform-channel-handle=4752 /prefetch:8
    3⤵
    PID:4668
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4632,i,1331462738932424762,11790015375041244710,262144 --variations-seed-version --mojo-platform-channel-handle=4528 /prefetch:8
    3⤵
    PID:4916
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4524,i,1331462738932424762,11790015375041244710,262144 --variations-seed-version --mojo-platform-channel-handle=4892 /prefetch:8
    3⤵
    PID:4008
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4412,i,1331462738932424762,11790015375041244710,262144 --variations-seed-version --mojo-platform-channel-handle=4568 /prefetch:8
    3⤵
    PID:3096
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4808,i,1331462738932424762,11790015375041244710,262144 --variations-seed-version --mojo-platform-channel-handle=4976 /prefetch:8
    3⤵
    PID:1196
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4672,i,1331462738932424762,11790015375041244710,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:8
    3⤵
    PID:5996

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:1492

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
  2⤵
  PID:6000

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5988

C:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\WannaCry.exe
"C:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\WannaCry.exe"
1⤵
- Drops startup file
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:4236
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c 110221745252480.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4456
- - C:\Windows\SysWOW64\cscript.exe
    cscript //nologo c.vbs
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1272
- C:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\!WannaDecryptor!.exe
  !WannaDecryptor!.exe f
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4980
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im MSExchange*
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1308
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im Microsoft.Exchange.*
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4004
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im sqlserver.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1660
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im sqlwriter.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5612
- C:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\!WannaDecryptor!.exe
  !WannaDecryptor!.exe c
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3916
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c start /b !WannaDecryptor!.exe v
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1308
- - C:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\!WannaDecryptor!.exe
    !WannaDecryptor!.exe v
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:4696
  - - C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
      4⤵
      System Location Discovery: System Language Discovery
      PID:3892
    - - C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        wmic shadowcopy delete
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2204
- C:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\!WannaDecryptor!.exe
  !WannaDecryptor!.exe
  2⤵
  - Executes dropped EXE
  - Sets desktop wallpaper using registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:3592

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\WannaCry.exe" /r
1⤵
PID:5780
- C:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\WannaCry.exe
  C:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\WannaCry.exe /r
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6004

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5072

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:2408

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a79c572d52beacfc2dcb06eaceef3f7a5897ce69e351a2d72d27289bb7d7676e
MD5 3e4754740d34a3d2a6a03bc552dcade7
SHA1 f0680599559deab8c0df5bc5e911105481da977d
SHA512 f2af3bf2e8b95a7f5c98a53a6e3305d9727be7fbca2a5864c0693a85914ba4a2f8616955ddc54a43538df4f14a674863fa6dfa4d6e029c9cf44528bdf70c8890
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 30d6fdd88cd1b4d5bb3cce02861f8922b84355d76d81f3888cb32d195b29708a
MD5 317692fecb8d3692438e150d4d60b62d
SHA1 d9aae7d04f2faac9b7912a6cef88f29001b45438
SHA512 6442278fee54d1526fc0d12916d2251d8849377047f504dad3203dfd06052774e8f27c100048d8e352bd13beb2423926314cd9e9e7180efdba87298827beefba
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 44150c3a8ecd45408e7bb17ad9cd38d3191e8ffebfb8e09f9c41b8f59620a5b2
MD5 6c3ba40e438b794a4630cfac27b4855f
SHA1 255cbd9d9013024a359b4ac1187fd0f39b89f46e
SHA512 344ad251942b3e6d2844145607029bfd2439cf5518fbc6e0e82fa6bec9f5ff391ecf38025dcddc8158591bd433b767126b2c7d520b7a97389f31aaff63f3188d
MD5 SHA1 SHA512

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 352B
SHA256 f5b2c5cb57a51cdd33a9ff5e578589ad3a3c0f382f94471cbd4b6ef0b88ef0ab
MD5 76204881c1a4df19a97e8b532929be73
SHA1 80b5b474266c9aa26adb62a9e5071fd7a2c29c8c
SHA512 43305e48a2d078c672db6f4426651951ac9613e44aec6139908801935432edbd1cd790a03202e1676a5958abcd5b0cf3a29a66bd220f1509d0eef2df9c622262
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 5fcb161cb68a9bb0980cf400cbaba9ce82f066b94ea6403c5304d0abb9f72e80
MD5 b7f99ce2fa4242c3669229a13f19324d
SHA1 28d152756912bbdd7aa03869b67cb88be37a43c0
SHA512 c067f22285784455f7f1793f8514fdb666ad2d3d19b658ec102abdf4b3eb7378ca8f5f5a47a04d960e4dca4ecdf03ca2c4aaeb1bb4fe01e14b107b24c3fe5a2e
SSDEEP 384:gcV+el8Hi7Lavj0DBwFEJor+uUaRd2BZ6bwUZBVzYs:5gel8Hi7evj0De6J8lbd2BZ60s
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 7360b5a32d94e01a8b4ae34c74fd8097b04dc8d9d627115b14175a3dad3f2c89
MD5 78dd282efdacfd05aa11fd7c47fde0d5
SHA1 4796f7eb28166ff48deaf85c5fb51fd338477daa
SHA512 690689830a1c1faa6d13ff0c9508e0a63426f7f570ee17ce25b50d7bfa6739da7dbc44ed2f6b0ee970f02a91e7ee92d542a4c41eedcbf5c8e178d18be830cb1f
SSDEEP 1536:/kUIdM34C20nSX1yvvOX0ArqriincNxuPHhst2iIXi7pelz:8aS8cKnmuyoiIXKpe5
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_2
Size 1.0MB
SHA256 0239a02fdb51c4b8692455bcdd2ec031c95449cf7e835fc3870b2a884215d1ce
MD5 c0fb2ec548668366a2a1a97b54d25b74
SHA1 1d05888ddd22859ccd1d9ca390a332e6507c016d
SHA512 69dbe9ec841f999a97267c0df5d7c15ed646e9baa103f72cec747dc58c1256027acc13e03ca41b50da72d6153a2f0ced6d324e0c0d877b43eb9c12c6c76faa00
SSDEEP 3072:wGzn5mEC+HA/z1a4x1Zk6lQFH0HdDk91MW0aIf8SS/lzpMunHeW7FrZ2pT:wg59Cnn1Z9aFCRaSSNlHHewtZ2p
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3
Size 8.0MB
SHA256 9cda59c78b655476fcd44601d8550e49473bc7076624c72ce5b1190a6f68db2b
MD5 428251937370c0661a2d264478120b96
SHA1 aa37fe84f0e93c9ec7bced85c38de9b551bb5d2b
SHA512 9c9d6c62289a84847533b23cc5edb90fb1becef821af782fc64e0f30baeb472bbb59ef247fe0d17585e48310fa283fad636bb3be829a0e06d56e445641b2ac52
SSDEEP 49152:psPb2WMWAWtvWiVnEV1MQoGOV8QiT0ujo:OPZtiMQNOS
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000070

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000070
Size 19KB
SHA256 1ef458d087e95119808d5e5fecbc9604d7805ea4da98170e2c995e967da308f3
MD5 5e5ae2374ea57ea153558afd1c2c1372
SHA1 c1bef73c5b67c8866a607e3b8912ffa532d85ccc
SHA512 46059e4a334e0a5295ebcef8401eb94b8fa0971b200f0f9e788ed61edae5018c917efd30b01631cbd6bdadc5240c9fcad2966ea0aa9c94b538bcc369e10bbbaf
SSDEEP 192:tSTGDXMDPSYAxmemxb5XS/7eh8qMFfWQE4+rmqt5QJq0+Rij3Qaf/KduesiSnP:tu3SXs/J5CXw4+rmqdRiLNKduesic
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 cd2dbba5e75d4db201d354de88fe0f8aeead430e919110291d305cab3e2dda7d
MD5 5883a2fcb5b55df98c2231503fc9eadc
SHA1 04e975fb4085f3f3feeeaf44098cf159ffdf697f
SHA512 d56939493d91fcb9decf4d2eaf6e675ac91527c9a11b443660a49a1e53cd1700fd30d37150230b41acf991453c6605a23662777546957e987f253422cdec6745
SSDEEP 3:MsEllllkEthXllkl2zEjlU/l:/M/xT02zL/l
MD5 SHA1 SHA512 SSDEEP

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_1\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
MD5 SHA1 SHA512 SSDEEP

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 192KB
SHA256 bdf5167bfa6e0e773e615dfdeb107bdf5bdf25c87d1432afb08c5c359475456a
MD5 233088a63eb5dd5c4466f33c0713ba4b
SHA1 0a12c1df9409cb9c84cbf1e41fe161d49c649967
SHA512 cefe0a830008f13fc48f0f79f3d0f5d74722e0d8ec450b6aab4dd5ac56484f559b5a3f215c0a89968a9ad3c4ac4cb94237fc61d3d5ed788da1267bff6f9a4e59
SSDEEP 96:pEMwQU+bGz6LBE3up+UcY3HmDLjVOe9w4tgXVjNHjBHHLDEv/A80jbgI8S:pEME+GmBE3upbIXJlPtwVj7HrDo/A8j
MD5 SHA1 SHA512 SSDEEP

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 107KB
SHA256 d4c064db769b3c109da2ed80a53fbab00987c17421a47921e41e213781d67954
MD5 2b66d93c82a06797cdfd9df96a09e74a
SHA1 5f7eb526ee8a0c519b5d86c845fea8afd15b0c28
SHA512 95e45c0aea0e704be5f512dffaae377d4abef78da99b3bca769264d69be20f2570daf2f47905645217e1b2696e42b101f26149219f148b4d6dd97a6c2868b6f5
SSDEEP 1536:IRWH74eshBGZqW3iPPDuVvpBI/S8tZsA62UYPq:vHjdRiPjU1
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 03031baff99c0d86b011231c655f404baa9d0ddc5a36d1a3faa07e2099df6c8a
MD5 64043d95cfdb34d7052bdff3c536552b
SHA1 6e081ed9a5a8173604bef780ee71b9b29300f26f
SHA512 55c710c9d03e8cff68e97038e85183eec21fa673f9cca11a218b20f539f919c3b2e2f085bd4e8bd5d6c8a332eaa4e22a26c900397e8c898e518a27cf1aee369f
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 58ffd7a93bc70a50b85bb8e9684e27a6ac9a82f219c6499dd6822f75afea81fb
MD5 fa41e420f1a879de62db1a77b2e4deb4
SHA1 4f4974761742c38e38cdb83255e9d53beb761437
SHA512 137d0fd1b06d51b22e1746b1b3899f2481f0e71f9df44160c8bc0dcbb8b586236d92f7a45fd546705fb218bacb0d97f7c8294eb3f32a438cba8fa11e2cc5a879
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 066bcf8ce3153706d5c018e3218a0abc65e7360499fe5466f55b40afceaed567
MD5 fe5a975c1b9c78173fb7f0c80be827fe
SHA1 62f33ada4fe50336bcbd7b146eb5d5e403bf1f33
SHA512 860f4eafb101fcf58e31c27c7f23520aece5ce9ce9e7f244a7e51f19ad5e548e5a083802a00b71fd354f2bcd858de3b04d2a9bab37327eb2a867210b75be46bd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 65e367f7ca14d7a37f1bde15e7cec33125f0ae9cc08f6a15bc500bd556e273a9
MD5 f75bd8b1905201856d233e3128e2bba2
SHA1 fbee77b0c88a515b92c59c8f742ea1009f037a66
SHA512 9b304bc911770cb0b40ceecfab0208b1421039f755a009ea121093e811925e91f3b7911b94d9659c1104e724e4fe011addb4063f1ddf8689122d9a0b5a3fc287
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 21b2377a453d637c5d8b0c0f9a62d99ce6629d9b6ebef82062c027c21651ab65
MD5 3d85d55c48dd882767ec3968efd7b192
SHA1 00a43d0429c1e8815644a789960deea8d9074d7d
SHA512 81c838a56a290a2247bf27939afe03d29a5f0dbed8d2a42f24582ca8f0a3f6e22e0e95909e9ad782dd910ce17b31c388638946feab055f1ac9913b9c2ec65e6a
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 ed661e375bc8c5bd7d2a123d508230521da2a16ab2c1e60c131380a145262982
MD5 7fa9190c5cb4c8830200e7caed6ff1ae
SHA1 2f0c870780152fb5644a8f600554eac70de9d3a7
SHA512 96480b55e2d40790831f7678f9cecda09f72ed0f24f022c0bb9e8fbc7677fdb947f465a6dd83fea30f3eb0b28203ded1adf24e9b8666bd731cc1bab097238914
SSDEEP 384:sVgZEqLksQGXdgST1h/JP6HSAVK/wdST7:suxLomdgSvJiHSQK/HT7
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 18KB
SHA256 e8960671eb7a221a35e426edc11e3ee5cb83203e17be754117930a487ecbaf58
MD5 58608677fa80e1b74b958097ae6d38b2
SHA1 c81419845b0be0f04ddf3839e2103d98ad04ac01
SHA512 9c39cb91566e206101b84b5dd3863d4ce46252cbc7db62e3b9d886dc26597f036af5bab7185d54626a78fb7ef556774b99fcc97e515a8de49e33ab6c37745da3
SSDEEP 384:sVgZEqGksbWcFGXdgST1h/JP6HSAV8/xdoT7:suxGTzFmdgSvJiHSQ8/oT7
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 8410f49162ecb1a0bb7aa9ad54d5e2e0650a61719e96b7f252a1e09ddecb0d25
MD5 76bea5ff3f8010a2f1f3c8940623149c
SHA1 22cfefa4aacf0c86fbfc86137d1297f6532291c5
SHA512 7893f78b5ef5122c951588a607caeb7ff949fea17342ca04fa6cf660ad7b6aa39f837b56445af255d10e547ed66dc6cc3886e806b4a8305414eda1df61b27b59
SSDEEP 384:sVgZEIksD5A+dmWST1h/JP6HSAVB/wdn+:suPdXd7SvJiHSQB/a+
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 4284492c1f79817ca26632a409c4ed8c58ff4c0758b4f3c3ac5209556197a2a3
MD5 cc5564ec57adde15214a3d087505ba62
SHA1 387b7ef1417f6a22547d61482775e8dfd0bda857
SHA512 016615491000975d5d90f6a993a8bf88b0b643603eb4d1258fabdd37e1c97a0998b457e5015dc1e750e157a30c3f9e1820a8d7dcc08a5119b9eca9e73abb8348
SSDEEP 768:ZKRS8NC7pLuLxz9WFFLVb8F1+UoAYDCx9Tuqh0VfUC9xbog/OVMYTwLlS4tWWroY:ZKRS8NaExz9WFFLVbu1jaDYTwLosWtm1
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 c89ea5a4dba7269793da3a0ff028c4c9bf2bbb7263419df6659a3e790b54b002
MD5 24b437b0965491fc8e9f68d5ec1a6039
SHA1 f69924e4de9ffad328f0364bec309e3c02ff9bd5
SHA512 8d02f7c3aa03e1e7a3c9b2f6cc73756dbf0bd86d56db1b3afb1b861941dc08255477c0ee9cd2c19eea12a3a5d9d442e232d8cb055bcbe6b76341be4c5b274297
SSDEEP 768:ZKRS8/C7pLuLxz9WFFLVb8F1+UoAYDCx9Tuqh0VfUC9xbog/OVpMTwLlS4tWWroo:ZKRS8/aExz9WFFLVbu1ja2MTwLosWtmh
MD5 SHA1 SHA512 SSDEEP

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 335B
SHA256 0dcbb232492e9cc9dc1814e77f456445befb9c5686d70f016d977d56f270771a
MD5 e437c2a847a28268936e58d22010f8b7
SHA1 cc286e585462f2c8953b6604c6ff54ddca8ea87a
SHA512 3d3b3ba86c27fc9a853a2773f9793143ac5dcdc255e61eaebc43beab116dc9a959e4923999ec790c32647ffc9015349c42cd863ca1f90ec6ee3422e4b26fd428
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 350B
SHA256 8097fc518d05f157b3efd37ed8af0662a8fc7d916cf436354ce3d99e5bfe5722
MD5 aa9952863a10c3178404261d12c55d29
SHA1 727dd1f362e96b1eca2d5f53e38a5183337c3006
SHA512 4714b6c8b688a7e8b619601cb0fd6892e5787c5f101b062cf98d3db5dae1e665dbe6178a1f8706e78477ba9ec476e2a2fd4111d029662452bd35f8453cf6db29
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 326B
SHA256 2ea4a7f772cd01f1f5404cf6fb23b820c0c3d3c86ec5f7707d3a2b581d701a86
MD5 7ebb5a0b56dc37275c0e08f96349bf09
SHA1 f3cb7618d19bc7204e617cd4c59d1cdf7ccab128
SHA512 2f313ba37e4773bf270bc312bd4175ea015a3fefb4c2affef91532c56964d0c7406b2e2fc75bf8f5d6e280436652b160c05fda0067c159b155e5a2af9906f897
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 22KB
SHA256 e28acc9838fa7cbffae8ecec096659f094d8e5b2eda325cf4b1ff78ba21baa9b
MD5 e8a6dbfecabb8b5cd90777addbd4d79b
SHA1 5526cd95071b166202e0b3dc4a682479bcfa1758
SHA512 2314fca1b35af366cf53e51b23077fac99684d73a3b8b67da46d4ca10daacaaae6e10048128a0876e0a091ddfc9ce73e76d306dde9cb9881933ca5996097efbd
SSDEEP 96:B4KlCnKjwKZu8Kc7K/iZKFVK7ixm1x7jjuBTAhRuKz/vR4fofHETH5hRm/BOnHmy:nx6u2E7ivTWhAcU
MD5 SHA1 SHA512 SSDEEP

Submit Download

CloudConfigLog

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog
Size 467B
SHA256 cb68d89b02d8965e0528be824574e67ccfacb11e4d9b526055db9dc561a228a5
MD5 ac80ed8fc5282b0f445e82ec98458533
SHA1 4d21b00865aaa97f5efd7c35014263b68e7298ec
SHA512 ba3b60675bc7e8d6000b39122eef3fa7b0191be1733b5eb852baca00eceb5f49f89e0d170cf560c56768b41044920d9b7a69c7dd5cac9ecce2a1df5359212e4c
MD5 SHA1 SHA512

Submit Download

CloudConfigLog

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog
Size 464B
SHA256 08ec67c6d02790e38a45e5e0b19e199fec5eb46e46e5a61796bb2f5fe9e22557
MD5 b258685225b01157cb0fa6b04b5539a0
SHA1 3331f6589b8b352b0e4d801119f69ac83da66072
SHA512 b031e0f95fce818522368ca8791af4fffc722549b6255708972e9498eaf78ad94508f0e5d4b4547cf4161e49435a27df552ce408fc4ddf95dcf00aba2bc41b36
MD5 SHA1 SHA512

Submit Download

CloudConfigLog

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog
Size 902B
SHA256 1c32dc7c2ec1fa7b9c3fef7566ec84ebd7b0d9e1ca67347c398630edb4ce7e5d
MD5 f76a18955249f2c9bf4239e07dda701b
SHA1 c199a05ddc8820af21317c6b27aeccf8da753bb4
SHA512 72c6849539e26c529283fe7e585a5f56c480af94ed406da3c145f9793c9b5da9e8ec809599666e273f114a21af4ef57ade546b7eb6ce8ebb58f526f17e809680
MD5 SHA1 SHA512

Submit Download

CloudConfigLog

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog
Size 23KB
SHA256 f62f168827cebb4fda7024b71910f4554fb26c2cca16b4d5ff9c6c1380f735f2
MD5 d529d1bedcee16c0b6b4295dde99344c
SHA1 79675359cc3cd2930b6e69094e9d435478e6de2e
SHA512 c761203d0bf4de169d3aba21781104b94c23e2b70d77a987bf8a32ef4993324d20126efd1e324a44672caf284b3d38cb001ad364ed453d0a867e692d08d09a0c
SSDEEP 384:kXJOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ub:OJOk/FY7/2lagbCtCkQ7wDlH/h+umbAa
MD5 SHA1 SHA512 SSDEEP

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 19KB
SHA256 16cee17a989167242dd7ee2755721e357dd23bcfcb61f5789cc19deafe7ca502
MD5 41c1930548d8b99ff1dbb64ba7fecb3d
SHA1 d8acfeaf7c74e2b289be37687f886f50c01d4f2f
SHA512 a684d61324c71ac15f3a907788ab2150f61e7e2b2bf13ca08c14e9822b22336d0d45d9ff2a2a145aa7321d28d6b71408f9515131f8a1bd9f4927b105e6471b75
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+eW6PQpGMgSVlkFIum1z4tfLTvq/uIvqV:WJOk/FY7/2lagbCtCkQ7wDlH/h+eW6PH
MD5 SHA1 SHA512 SSDEEP

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 13B
SHA256 01a3e5d854762d8fdd01b235ce536fde31bf9a6be0596c295e3cea9aaf40f3dd
MD5 3e45022839c8def44fd96e24f29a9f4b
SHA1 c798352b5a0860f8edfd5c1589cf6e5842c5c226
SHA512 2888982860091421f89f3d7444cacccb1938ef70fc084d3028d8a29021e6e1d83eaef62108eace2f0d590ed41ece0e443d8b564e9c9a860fc48d766edb1dc3d9
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 55KB
SHA256 e43d346c1e1d2f70fd35b814ab22d1e32ed52597ccacf6e3031f91aacfc3a1c7
MD5 774535be55536655c5e6f9d8fb66690e
SHA1 05b2822b4659788813b545db6bb7a92d6feb18c0
SHA512 ad17cca2537fdec015393dfd8a5a0eba5b0871af96ef9d8f6ef45acb61d67412144d98c5e05db4341205b4f1c68ff9882a222b5bf67d0ea05f25a997ecf314e2
SSDEEP 768:+TcE6esE8lDldUGKG4HgfOEx8T545GvRNKf69N+eNOEfpTIC8zuHwrp6oQL2e97Q:BeB85diGKTfNKc+eBYzPp6ouT9AZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 dea1b6e1d99e077855fbb39192ed1d84185649e85f8cc2b78112a71df5c7a98a
MD5 3bda5a64eb3c9743cd59e69d2c7c1a62
SHA1 28beffc4df62a305fc22b8d2d4709e9fef393fbf
SHA512 f5d0088fe8570db22781f90d8c9b06b296d15fcd12a7175b1e24b9c2c37bfb9fec0bf0f71203558ca80feac944d7cf851cc49da4ba30d4490bd337706a65f36b
SSDEEP 768:+TPE6esE8lDldUGjuHgeOIx8g45GvO3L2e976Jo+curp6PR1:ueB85d7BNbT9Axp651
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 49KB
SHA256 a1996423bdbb380d9d3b1ec836b3ca6260f79fb02a2d0114b0d87794ad2e5daf
MD5 7f789ddf475b1c132ce96cfb8099fc2e
SHA1 ba45c11f5276e2bc0ca30314f3ae27e7e5788cfb
SHA512 317a20bcbac25b1acc72e4372babac50caffd17744dfce6a160afafe3e32ee80072df1d89d29ece6bb2f58371c8f33bd0a4a776c39bda6307d4b1ad21a68994a
SSDEEP 768:ETcE6esE8lDldUGKG4HgfObx8T545GH3NKt69lY0OEfpTIC8zuHs4S6XQL2e976p:veB85diGPTRNKuYiYz4S6XuT9AZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 55KB
SHA256 bc506bad80978e683674c1f581572a949ab4d9d74dc321343aa20a4466e921f0
MD5 84fed9c300cee0cb586fd2b7df9bfaa1
SHA1 c0dea5381275b15df36c4662b07c631d9a41d3b0
SHA512 6aa6a396841548b322cf2116f4f1659d46f88d9e5737ab0867105476eb19e092675966143ce513a017c5c6611ff51acd7d8e11fe38b38d14e21bacbdb265a49b
SSDEEP 768:+TcE6esE8lDldUGKG4HgfO7x8T545GvRNKf69N+eNOEfpTIC8zuHwrp6oQL2e97Q:BeB85diGvTfNKc+eBYzPp6ouT9AZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 a0a2dbf1def100346b64b1571965665fd6ba8d7c458988227a87ff58cecc0f61
MD5 10b81ca1bfe7ff3489ec9949832056f1
SHA1 f1c1c7924b823bdaf8ebdb8a4a96100ada0ed613
SHA512 0d4fd78ba5ac669ad3de7262b20247955abac54d06932d5ad12da2f6c92dbdd13f58bacd86ebf910d5f87d9a2be3447bc60a3ae793cc1612b26822a06af66407
SSDEEP 768:+TWE6esE8lDldUGvuHgeOIx8g45GvO3L2e976Jo+curp6PR1:reB85d3BNbT9Axp651
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 398fdf1e88e1e5cdccdff0acf03923132eeda2b6358908deee56eb83f32d441d
MD5 1d24a7348f1b716662244c165b4f52d1
SHA1 2313e4cf68291896243588b9bbefd5dd0cd34acf
SHA512 201a260579a8c87d70f9121a0cf1d785632ea72df0b00e759d83fa9f4cfac8e5e26efede825c72befe5e4d3bee8be376a0409cec5d6a7b8a8d980e067c4b122d
SSDEEP 768:7liE6esE8lDldUGz3rbgROyE8g45GfAaKt69Q4L2e976Jo+curp6Y1:qeB85d73+7aK7WT9Axp6Y1
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 b831cb8f7b6e6751022332be52d8ab1dc910065498b9ee1beb127c9c69e31f8e
MD5 09f559a8b393dd42e4f7b56f3860b378
SHA1 f0b190736f56c3a007b9a81f280d3527464dedc6
SHA512 adafa1b5812fc46061a9722a93951af2d985b6600f6265749de5b2274b97838ca6ef78b9a0544543d379803b29b283c90c98d77865b86bdfa9a2c9ae15e0d58a
SSDEEP 768:pliE6esE8lDldUGz3rbgROYS8g45GNO3L2e976Jo+curp6Y1:oeB85d7361bT9Axp6Y1
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 e479bc664153ae42100d0f9681f72807514afd38b1b68a45609f93c112c78b88
MD5 f75577fae7b819625d58529320206c42
SHA1 836db7011b8824b5973e92351664deeb27eb01be
SHA512 8488f0c15c345a05a03992fadf7a22e5e2ad690abb83ef77c8cdeab32e66eb239a8fba07ce93d88a5c73f7dd735008a9ebb6eaef49760af2c47e695a780c41b8
SSDEEP 768:AliE6esE8lDldUGz3ubgcOlx8g45GNO3L2e976Jo+curp6f1:9eB85dr3I1bT9Axp6f1
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 302885d02b5a6a5fbe8b112eb460f949c5d78c10b0ddf49a992115e55f2a4ca3
MD5 07f10e1234b05915856a3daac95f4ed9
SHA1 63ed21a51339c78a8dc63c6e6f941bbc41f27765
SHA512 89217d5de8c71f82b3f81d9263aaf5a936088647624f925059cfd90c60c3dbededb94ecf18389379a561276c1bdb4b6ef5e0d6cfbd83f3fca36bac74eb0e2755
SSDEEP 768:Al8E6esE8lDldUGK3ubgcOFx8g45GOO3L2e976Jo+curp6f1:heB85dC3IubT9Axp6f1
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 3ca48c0bf911d1d300ae6cb2dbb12d7a134b380e9e30b125a81feb15546f6c4e
MD5 ebae88d7e9c1879f34ca5d4a2b259ff4
SHA1 9ff15070b32d8839f5f7e8b362aef0b9b45f7f14
SHA512 4f0d419c311a9f1803081c24073b860881fd62a90b43d12fa43a6ece98eb1f290f73d594990e86b6328a497c8cf4baf94f404357c7bfd98304bb6f472495391f
SSDEEP 3:MsEllllkEthXllkl2zEQRHjl:/M/xT02zPjl
MD5 SHA1 SHA512 SSDEEP

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
MD5 SHA1 SHA512

Submit Download

first_party_sets.db

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\first_party_sets.db
Size 68KB
SHA256 7f456393457a1aa02eddc37069d74a0a9e19062086a66333763c8127177c5c9c
MD5 c485b2f56d3cd9104905a14de0e6f3ed
SHA1 011c8a86414ef18a36d5501534fd2cad5ae63011
SHA512 7347e4ccf623cc2f3bc05cfe15906e212bd2a1631dbef1cad20dcd8179b7d0184b1f6332116ee9b42f75ebfcdc36aa2dcfcb210c1a31bbcd5bd50a2c1db55498
SSDEEP 768:NMRTTd4uoTUZxhb0UrtWE5o2Lj1xc+KTfdToTjTicKmX:Ne0iJ5JLj1xc+KrdkHmcKA
MD5 SHA1 SHA512 SSDEEP

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 11c341126f42b52614ca3eefa4768700310e82f761863b5847a561757dc10a52
MD5 f7545b24582c0165441ea54616cfb702
SHA1 208ca6744b31d66f9caa9e3ebf43580159cf91ab
SHA512 8c2bb6e96ad9380bd19294ea9b893ae0c1752ef1a9bd6ad419cfe4ac95b44741e0df3d10ff729b6ac2496486b39bdac9469ea5e0093cd217a82b8f497402e957
MD5 SHA1 SHA512

Submit Download

63b1c2a5-be40-4a23-81c2-ab944d93084c.tmp

Path C:\Users\Admin\AppData\Local\Temp\63b1c2a5-be40-4a23-81c2-ab944d93084c.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

!Please Read Me!.txt

Path C:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\!Please Read Me!.txt
Size 797B
SHA256 227082c719fd4394c1f2311a0877d8a302c5b092bcc49f853a5cf3d2945f42b0
MD5 afa18cf4aa2660392111763fb93a8c3d
SHA1 c219a3654a5f41ce535a09f2a188a464c3f5baf5
SHA512 4161f250d59b7d4d4a6c4f16639d66d21b2a9606de956d22ec00bedb006643fedbbb8e4cde9f6c0c977285918648314883ca91f3442d1125593bf2605f2d5c6b
MD5 SHA1 SHA512

Submit Download

!WannaDecryptor!.exe.lnk

Path C:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\!WannaDecryptor!.exe.lnk
Size 837B
SHA256 291c8b66cb510cce8c725db0cd6feeaa15c4c18e5fe54815f32abbcb230b2e98
MD5 f55f36dcc5c9bafc0cc8e205cf635646
SHA1 56a7302d4d54143f20301e54f96fdc72a13e9bff
SHA512 a4c4d2e85f28db22d570d0242a2dfbfcf2ddb82ae18d2a2c7cff47a95e6e81ceaf75ccfa55322f656804347b17fc7c935dcabbd6563bb61d2d7d201ef8812d00
MD5 SHA1 SHA512

Submit Download

00000000.res

Path C:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\00000000.res
Size 136B
SHA256 4dba7fc6cce6009e941cd48c3393282fdbbe35beea88d6e569d1dc7891eefd14
MD5 b3f2de28ce9f3310119a55e74ae319b5
SHA1 28728390ab44e5f042963b240466b14ae63c0087
SHA512 0fd5cb5d2e369faf15e535d199cec252a2e3ef45a3cf3410dca11c19f3970d256ac8772361ccb6e4c467a5bfbd2e3ed78acf90137c84b6b2cb526aa8c9d7f80d
MD5 SHA1 SHA512

Submit Download

00000000.res

Path C:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\00000000.res
Size 136B
SHA256 c5be9cd05c5068319c66096d61f6c746a67a5035f8a1c80b26befe9157a7e3d1
MD5 33971c851da6f65d5a172238c45c35ad
SHA1 e41d1d7e042fba350e077bf5eb0ae6833457f418
SHA512 c7239e8aef207a8d5978234d2c0b2b0d0961482d39559e9c226e44586574ded5fe5ef0fcf23d365911fe2625b9b14862e24ae01f85e46c5a3b1317b055b18ffb
MD5 SHA1 SHA512

Submit Download

110221745252480.bat

Path C:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\110221745252480.bat
Size 384B
SHA256 b81dfa7a25cb24239ca8758d1cb7d95044b628060b35b12d41367a3868c27c04
MD5 097a43ea6a5c6574460686b14e7f0e8a
SHA1 97e67e01811a7e9b267fbd05039608352dbad9ea
SHA512 165c8db22c2dee820ca23ae995a9ebc48c56826ccaffb0a5676bfc907134651aca2b5da92b8999dac1ace42363f5b3aee18f95fa88dbc59a585da21c3bcaadef
MD5 SHA1 SHA512

Submit Download

c.vbs

Path C:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\c.vbs
Size 267B
SHA256 1ad7b80e1081651534ffde15b8a8f41006a47dbd935cd6f7a2bd4a4edf0be487
MD5 1210484c2721550c5a3a84a9e37d111b
SHA1 11bdcf4fe93a1f075bb6d2a49b7f34fe3e5d73fe
SHA512 efd6d66d310c0f6fa0c26eb1ebd649dfce883316959defb1232743a5c8362661d7ff95cbe317794175b844dd9bf95bdbcd2bcaa54c3dea3aeb808dce268e3e55
MD5 SHA1 SHA512

Submit Download

c.wry

Path C:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\c.wry
Size 628B
SHA256 46680f8592a21cb7fe22e12118c9e99cdaf1e8e6b94d96197db731ec02101ac4
MD5 b3d148c73e08a4ddcd9e45b65d55f9f7
SHA1 6c4eecc5a025db10d3996e4e36f5bfedfe5a9b8a
SHA512 c1d8f2f736a2d4fcf97da3d9ebf89669e560f769e0cf4e287df8fafcbfe5c82745e5f8880e9abc1b7ec14d1089d4179a8d581d1c29fa3103fb99e0565e6c4805
MD5 SHA1 SHA512

Submit Download

c.wry

Path C:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\c.wry
Size 628B
SHA256 bf22e8e18db1638673f47591a13d18ee58d8c6019314bab5a90be82ae3dc9538
MD5 663e55df21852bc8870b86bc38e58262
SHA1 1c691bf030ecfce78a9476fbdef3afe61724e6a9
SHA512 6a54be1fa549633a2fd888c559207437b8f6efda98bb18d491c8749f39e9754f1e680fa8e2d623777b5f665b2c04d19385c75ce4e61fb251db16018963a9a6f9
MD5 SHA1 SHA512

Submit Download

m.wry

Path C:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\m.wry
Size 42KB
SHA256 402046ada270528c9ac38bbfa0152836fe30fb8e12192354e53b8397421430d9
MD5 980b08bac152aff3f9b0136b616affa5
SHA1 2a9c9601ea038f790cc29379c79407356a3d25a3
SHA512 100cda1f795781042b012498afd783fd6ff03b0068dbd07b2c2e163cd95e6c6e00755ce16b02b017693c9febc149ed02df9df9b607e2b9cca4b07e5bd420f496
SSDEEP 384:S9sLTK3SWTsPzy3EFejoJQBO21z4oCTeo75Y3kmA31dv61QyU:S9s3mjoJb21zZrS14I
MD5 SHA1 SHA512 SSDEEP

Submit Download

r.wry

Path C:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\r.wry
Size 729B
SHA256 c9e9dc06f500ae39bfeb4671233cc97bb6dab58d97bb94aba4a2e0e509418d35
MD5 880e6a619106b3def7e1255f67cb8099
SHA1 8b3a90b2103a92d9facbfb1f64cb0841d97b4de7
SHA512 c35ca30e0131ae4ee3429610ce4914a36b681d2c406f67816f725aa336969c2996347268cb3d19c22abaa4e2740ae86f4210b872610a38b4fa09ee80fcf36243
MD5 SHA1 SHA512

Submit Download

t.wry

Path C:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\t.wry
Size 68KB
SHA256 a7dd727b4e0707026186fcab24ff922da50368e1a4825350bd9c4828c739a825
MD5 5557ee73699322602d9ae8294e64ce10
SHA1 1759643cf8bfd0fb8447fd31c5b616397c27be96
SHA512 77740de21603fe5dbb0d9971e18ec438a9df7aaa5cea6bd6ef5410e0ab38a06ce77fbaeb8fc68e0177323e6f21d0cee9410e21b7e77e8d60cc17f7d93fdb3d5e
SSDEEP 1536:L/MNGh1blJ3aMfSSPz/chKRb7Z3DK1YwVp2sQ6plKRPNV0BCg:L/sQES7b/jZ3AYgp+Na
MD5 SHA1 SHA512 SSDEEP

Submit Download

u.wry

Path C:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\u.wry
Size 236KB
SHA256 78e3f87f31688355c0f398317b2d87d803bd87ee3656c5a7c80f0561ec8606df
MD5 cf1416074cd7791ab80a18f9e7e219d9
SHA1 276d2ec82c518d887a8a3608e51c56fa28716ded
SHA512 0bb0843a90edacaf1407e6a7273a9fbb896701635e4d9467392b7350ad25a1bec0c1ceef36737b4af5e5841936f4891436eded0533aa3d74c9a54efa42f024c5
SSDEEP 3072:KeJJ0eIVAnbWOECR+uJ/0EJzBelG4t1nXFnQamKNQHFZde5tHEGaa:bqrVOEgZJcYelG4tQamKN2ex
MD5 SHA1 SHA512 SSDEEP

Submit Download

LICENSE

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3196_290167959\LICENSE
Size 1KB
SHA256 3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b
MD5 ee002cb9e51bb8dfa89640a406a1090a
SHA1 49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2
SHA512 d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c
MD5 SHA1 SHA512

Submit Download

deny_domains.list

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3196_452071481\deny_domains.list
Size 12B
SHA256 f51a7acfffec56d6751561966d947d3fd199b74528c07dabdcf5fcb33d5b2e85
MD5 085a334bdb7c8e27b7d925a596bfc19a
SHA1 1e4ad53dc335af5c6a8da2e4b4a175f37fafe2f2
SHA512 c883cb43c97a136825c6fd143f539210c234c66f9b76dfd8431f6ff014094e20b9410d7462aadee2344df8ca158def6b9a807e7cadbdfa947f6f8592e7283e34
MD5 SHA1 SHA512

Submit Download

deny_etld1_domains.list

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3196_452071481\deny_etld1_domains.list
Size 6KB
SHA256 0db8861eb771d2662ecabd8c7125c5453d6f3d976c14401ecb252e1f85b018d6
MD5 93c7fc76f7223d043593c999de1c0bea
SHA1 dd7c906c629466fe53a29d3945e31801065b5b1a
SHA512 55c752b20ebf883adaf0bf696fbe7c3f94b06d5bff907b39e9f43358ee7a58336024145b77ba315393609853c54a701ec25592ffc32b9ed3e2ce4857a4186c8e
SSDEEP 96:7xte1NrHPrY7RqW9in81V6G/VzGmcY8XVTLf5bCKmQ7fnjicP1:ybMHT6jYQVXf5bKufu01
MD5 SHA1 SHA512 SSDEEP

Submit Download

deny_full_domains.list

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3196_452071481\deny_full_domains.list
Size 9KB
SHA256 2edfd6823e18cb7a1e9e6abf571ef33c5be863cb5ea891ffa3df9a06fd0bfe98
MD5 a3b6c4249c181157cf292b749209fb49
SHA1 f3704c2d69b8f1c7738104f2d9fadf5ae644702b
SHA512 113df193b92ac3312b4e983434d0fb61fde5f3675ea00687ab6f9c53f17635bc5dba2970a5af6dc176618d962f982ab514b82d9ffbf894e315a31797887d35f0
SSDEEP 192:tKcgRuWR+Z4BMZYowmGh4dQxNMMMbdbcSW1yZLo4qTQSPvRLvKVFma:ttiul4BM2WqxNiOdUo4qTLP0
MD5 SHA1 SHA512 SSDEEP

Submit Download

manifest.fingerprint

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3196_452071481\manifest.fingerprint
Size 66B
SHA256 3af99da8ebc689d4324a15e3f059e379c9be7e523b5b26efb9261cb507a6f6d3
MD5 a287310073c3b178dc97cb38269847da
SHA1 ab283f53827794fffcfbf8603d33a3d9f6a5bbf2
SHA512 bdd9f96341fc74032c9ae8677e6a06badae1ab60f4ae48ced84853a0a57a16e16c68d636bb821f10fbd06779462ed3fca5d4eb903e5235f519dfdd46b1d7e95c
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3196_452071481\manifest.json
Size 176B
SHA256 37c30639ea04878b9407aecbcea4848b033e4548d5023ce5105ea79cab2c68dd
MD5 6607494855f7b5c0348eecd49ef7ce46
SHA1 2c844dd9ea648efec08776757bc376b5a6f9eb71
SHA512 8cb60725d958291b9a78c293992768cb03ff53ab942637e62eb6f17d80e0864c56a9c8ccafbc28246e9ce1fdb248e8d071d76764bcaf0243397d0f0a62b4d09a
MD5 SHA1 SHA512

Submit Download

memory/4236-589-0x0000000010000000-0x0000000010012000-memory.dmp

Download