dharma | hxxps://visuals[.]gg/product/memesense-cs2

Resubmissions

01/07/2026, 23:40

260701-3patkshv9s10

01/07/2026, 23:36

260701-3lnk9sfy4j10

Analysis

user interaction
yes
max time kernel
1799s
max time network
1802s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/07/2026, 23:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://visuals.gg/product/memesense-cs2
Sample260701-3patkshv9s

Score

10^/10

credential_access defense_evasion discovery execution dharma wannacry impact persistence ransomware spyware stealer worm

Malware Config

Extracted

Path

C:\Users\Admin\Downloads\!Please Read Me!.txt

wannacry

Ransom Note

Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 15zGqZCTcys6eCjDkE3DypCjXi6QWRV6V1 Next, please find the decrypt software on your desktop, an executable file named "!WannaDecryptor!.exe". If it does not exsit, download the software from the address below. (You may need to disable your antivirus for a while.) rar password: wcry123 Run and follow the instructions! �

Wallets

15zGqZCTcys6eCjDkE3DypCjXi6QWRV6V1

Signatures

Family: Dharma
Dharma is a ransomware that uses security software installation to hide malicious activities.
ransomware dharma
Family: Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Renames multiple (847) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Downloads MZ/PE file 2 IoCs

flow	pid	Process
222	2668	msedge.exe
222	2668	msedge.exe

Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
credential_access stealer

Windows Credential Manager
T1555.004

Drops startup file 7 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	CoronaVirus.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-18804780.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-18804780.[[email protected]].ncov	CoronaVirus.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\~SDCA0A.tmp	WannaCry.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\~SDCA10.tmp	WannaCry.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CoronaVirus.exe	CoronaVirus.exe

Executes dropped EXE 22 IoCs

pid	Process
4532	CoronaVirus.exe
21444	msedge.exe
21384	msedge.exe
34468	msedge.exe
35296	msedge.exe
26088	WannaCry.exe
35464	WannaCry.exe
8940	!WannaDecryptor!.exe
36288	!WannaDecryptor!.exe
36344	!WannaDecryptor!.exe
36456	!WannaDecryptor!.exe
33676	msedge.exe
36736	msedge.exe
33852	msedge.exe
37096	msedge.exe
37728	msedge.exe
38344	msedge.exe
38452	msedge.exe
38952	msedge.exe
38964	msedge.exe
39444	msedge.exe
42604	msedge.exe

Loads dropped DLL 38 IoCs

pid	Process
21444	msedge.exe
21444	msedge.exe
21384	msedge.exe
34468	msedge.exe
34468	msedge.exe
34468	msedge.exe
21384	msedge.exe
21384	msedge.exe
35296	msedge.exe
35296	msedge.exe
35296	msedge.exe
33676	msedge.exe
36736	msedge.exe
36736	msedge.exe
33676	msedge.exe
33852	msedge.exe
33852	msedge.exe
37096	msedge.exe
37096	msedge.exe
37096	msedge.exe
37728	msedge.exe
37728	msedge.exe
37728	msedge.exe
38344	msedge.exe
38344	msedge.exe
38452	msedge.exe
38452	msedge.exe
38952	msedge.exe
38952	msedge.exe
38952	msedge.exe
38964	msedge.exe
38964	msedge.exe
38964	msedge.exe
39444	msedge.exe
39444	msedge.exe
39444	msedge.exe
42604	msedge.exe
42604	msedge.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\CoronaVirus.exe = "C:\\Windows\\System32\\CoronaVirus.exe"	CoronaVirus.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Windows\System32\Info.hta = "mshta.exe \"C:\\Windows\\System32\\Info.hta\""	CoronaVirus.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Users\Admin\AppData\Roaming\Info.hta = "mshta.exe \"C:\\Users\\Admin\\AppData\\Roaming\\Info.hta\""	CoronaVirus.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Update Task Scheduler = "\"C:\\Users\\Admin\\Downloads\\WannaCry.exe\" /r"	WannaCry.exe

Contacts third-party web service commonly abused for C2 1 TTPs 6 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
144	raw.githubusercontent.com
145	raw.githubusercontent.com
146	raw.githubusercontent.com
220	raw.githubusercontent.com
221	raw.githubusercontent.com
222	raw.githubusercontent.com

Drops desktop.ini file(s) 64 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\Favorites\Links\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Public\desktop.ini	CoronaVirus.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Application Shortcuts\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	CoronaVirus.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini	CoronaVirus.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\Contacts\desktop.ini	CoronaVirus.exe
File opened for modification	C:\$Recycle.Bin\S-1-5-21-1797646245-3139070211-3019596475-1000\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Program Files\desktop.ini	CoronaVirus.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn2\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	CoronaVirus.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\Saved Games\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI	CoronaVirus.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\Links\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Program Files (x86)\desktop.ini	CoronaVirus.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\Searches\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Public\AccountPictures\desktop.ini	CoronaVirus.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\Desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	CoronaVirus.exe
File opened for modification	F:\$RECYCLE.BIN\S-1-5-21-1797646245-3139070211-3019596475-1000\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn1\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Public\Libraries\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	CoronaVirus.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\OneDrive\desktop.ini	CoronaVirus.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\System32\Info.hta	CoronaVirus.exe
File created	C:\Windows\System32\CoronaVirus.exe	CoronaVirus.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\!WannaCryptor!.bmp"	!WannaDecryptor!.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe\Assets\WindowsSecuritySplashScreen.scale-200.png	CoronaVirus.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_filter-down_32.svg	CoronaVirus.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\de_FEMININE.pak	CoronaVirus.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files-select\css\main-selector.css.id-18804780.[[email protected]].ncov	CoronaVirus.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\ssv.dll.id-18804780.[[email protected]].ncov	CoronaVirus.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\en-ae\ui-strings.js.id-18804780.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\UIAutomationClient.resources.dll.id-18804780.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Templates\1033\ApothecaryNewsletter.dotx	CoronaVirus.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\WindowsBase.resources.dll.id-18804780.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\System.Xaml.resources.dll.id-18804780.[[email protected]].ncov	CoronaVirus.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\cs-cz\ui-strings.js.id-18804780.[[email protected]].ncov	CoronaVirus.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\de-de\ui-strings.js.id-18804780.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_SubTest-ppd.xrm-ms	CoronaVirus.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.FileSystem.Primitives.dll.id-18804780.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.dll	CoronaVirus.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\export.svg.id-18804780.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-runtime-l1-1-0.dll	CoronaVirus.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\ucrtbase.dll.id-18804780.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Templates\1033\ContemporaryPhotoAlbum.potx.id-18804780.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\PresentationFramework.resources.dll.id-18804780.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\next-arrow-default.svg	CoronaVirus.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\images\themes\dark\warning.png.id-18804780.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Interceptor.dll.id-18804780.[[email protected]].ncov	CoronaVirus.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\MPP\MCIMPP.mpp.id-18804780.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Locales\bs.pak.id-18804780.[[email protected]].ncov	CoronaVirus.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-black_scale-180.png.id-18804780.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\welcome.png.id-18804780.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\fi-fi\ui-strings.js.id-18804780.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\da-dk\ui-strings.js.id-18804780.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\sl-si\ui-strings.js.id-18804780.[[email protected]].ncov	CoronaVirus.exe
File created	C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE.id-18804780.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription3-ppd.xrm-ms	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial1-pl.xrm-ms.id-18804780.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\UIAutomationClient.resources.dll.id-18804780.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Web Server Extensions\16\BIN\1033\FPEXT.MSG.id-18804780.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\sk-sk\ui-strings.js	CoronaVirus.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\eu-es\ui-strings.js.id-18804780.[[email protected]].ncov	CoronaVirus.exe
File created	C:\Program Files\Java\jdk-1.8\bin\ucrtbase.dll.id-18804780.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\images\cstm_brand_preview2x.png	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial3-ul-oob.xrm-ms	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp4-ul-oob.xrm-ms	CoronaVirus.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Trial-pl.xrm-ms.id-18804780.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ONLNTCOMLIB.DLL	CoronaVirus.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\da\LC_MESSAGES\vlc.mo.id-18804780.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\MyriadPro-BoldIt.otf.id-18804780.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Snippets\ShouldNotBeNullOrEmpty.snippets.ps1xml	CoronaVirus.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\VSTOLoaderUI.dll	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.dcfmui.msi.16.en-us.xml.id-18804780.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Printing.dll	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SPRING\PREVIEW.GIF.id-18804780.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe.id-18804780.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\nb-no\ui-strings.js.id-18804780.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft Help\MS.OUTLOOK.16.1033.hxn.id-18804780.[[email protected]].ncov	CoronaVirus.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\ICE\ICE.ELM.id-18804780.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\Common Files\System\msadc\de-DE\msadcer.dll.mui	CoronaVirus.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe.id-18804780.[[email protected]].ncov	CoronaVirus.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\ResiliencyLinks\v8_context_snapshot.bin.DATA.id-18804780.[[email protected]].ncov	CoronaVirus.exe
File created	C:\Program Files\7-Zip\Lang\sw.txt.id-18804780.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vreg\osmux.x-none.msi.16.x-none.vreg.dat	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Extreme Shadow.eftx.id-18804780.[[email protected]].ncov	CoronaVirus.exe
File created	C:\Program Files\Microsoft Office\root\Office16\FORMS\1033\SMIMES.CFG.id-18804780.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\RIPPLE\RIPPLE.INF.id-18804780.[[email protected]].ncov	CoronaVirus.exe
File created	C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\stdole.dll.id-18804780.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Core.dll.id-18804780.[[email protected]].ncov	CoronaVirus.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setupact.log	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setupact.log	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	UserOOBEBroker.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	UserOOBEBroker.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 16 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WannaCry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WannaCry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CoronaVirus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	!WannaDecryptor!.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	!WannaDecryptor!.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	!WannaDecryptor!.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	!WannaDecryptor!.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2668	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Interacts with shadow copies 3 TTPs 2 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
18676	vssadmin.exe
34512	vssadmin.exe

Kills process with taskkill 4 IoCs

defense_evasion

pid	Process
30112	taskkill.exe
29956	taskkill.exe
29932	taskkill.exe
29856	taskkill.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134274228772053694"	msedge.exe

Modifies registry class 13 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1797646245-3139070211-3019596475-1000\{B2759E36-9E50-4F19-97FB-CDD2BAD88903}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1797646245-3139070211-3019596475-1000\{E85EB52A-6F3A-49E8-91CC-6D770358A7A8}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	cscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	cscript.exe
Key created	\REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4532	CoronaVirus.exe
4532	CoronaVirus.exe
4532	CoronaVirus.exe
4532	CoronaVirus.exe
4532	CoronaVirus.exe
4532	CoronaVirus.exe
4532	CoronaVirus.exe
4532	CoronaVirus.exe
4532	CoronaVirus.exe
4532	CoronaVirus.exe
4532	CoronaVirus.exe
4532	CoronaVirus.exe
4532	CoronaVirus.exe
4532	CoronaVirus.exe
4532	CoronaVirus.exe
4532	CoronaVirus.exe
4532	CoronaVirus.exe
4532	CoronaVirus.exe
4532	CoronaVirus.exe
4532	CoronaVirus.exe
4532	CoronaVirus.exe
4532	CoronaVirus.exe
4532	CoronaVirus.exe
4532	CoronaVirus.exe
4532	CoronaVirus.exe
4532	CoronaVirus.exe
4532	CoronaVirus.exe
4532	CoronaVirus.exe
4532	CoronaVirus.exe
4532	CoronaVirus.exe
4532	CoronaVirus.exe
4532	CoronaVirus.exe
4532	CoronaVirus.exe
4532	CoronaVirus.exe
4532	CoronaVirus.exe
4532	CoronaVirus.exe
4532	CoronaVirus.exe
4532	CoronaVirus.exe
4532	CoronaVirus.exe
4532	CoronaVirus.exe
4532	CoronaVirus.exe
4532	CoronaVirus.exe
4532	CoronaVirus.exe
4532	CoronaVirus.exe
4532	CoronaVirus.exe
4532	CoronaVirus.exe
4532	CoronaVirus.exe
4532	CoronaVirus.exe
4532	CoronaVirus.exe
4532	CoronaVirus.exe
4532	CoronaVirus.exe
4532	CoronaVirus.exe
4532	CoronaVirus.exe
4532	CoronaVirus.exe
4532	CoronaVirus.exe
4532	CoronaVirus.exe
4532	CoronaVirus.exe
4532	CoronaVirus.exe
4532	CoronaVirus.exe
4532	CoronaVirus.exe
4532	CoronaVirus.exe
4532	CoronaVirus.exe
4532	CoronaVirus.exe
4532	CoronaVirus.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
36456	!WannaDecryptor!.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 19 IoCs

pid	Process
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe

Suspicious use of AdjustPrivilegeToken 49 IoCs

description	pid	Process
Token: SeBackupPrivilege	18996	vssvc.exe
Token: SeRestorePrivilege	18996	vssvc.exe
Token: SeAuditPrivilege	18996	vssvc.exe
Token: SeDebugPrivilege	29856	taskkill.exe
Token: SeDebugPrivilege	29932	taskkill.exe
Token: SeDebugPrivilege	30112	taskkill.exe
Token: SeDebugPrivilege	29956	taskkill.exe
Token: SeIncreaseQuotaPrivilege	36544	WMIC.exe
Token: SeSecurityPrivilege	36544	WMIC.exe
Token: SeTakeOwnershipPrivilege	36544	WMIC.exe
Token: SeLoadDriverPrivilege	36544	WMIC.exe
Token: SeSystemProfilePrivilege	36544	WMIC.exe
Token: SeSystemtimePrivilege	36544	WMIC.exe
Token: SeProfSingleProcessPrivilege	36544	WMIC.exe
Token: SeIncBasePriorityPrivilege	36544	WMIC.exe
Token: SeCreatePagefilePrivilege	36544	WMIC.exe
Token: SeBackupPrivilege	36544	WMIC.exe
Token: SeRestorePrivilege	36544	WMIC.exe
Token: SeShutdownPrivilege	36544	WMIC.exe
Token: SeDebugPrivilege	36544	WMIC.exe
Token: SeSystemEnvironmentPrivilege	36544	WMIC.exe
Token: SeRemoteShutdownPrivilege	36544	WMIC.exe
Token: SeUndockPrivilege	36544	WMIC.exe
Token: SeManageVolumePrivilege	36544	WMIC.exe
Token: 33	36544	WMIC.exe
Token: 34	36544	WMIC.exe
Token: 35	36544	WMIC.exe
Token: 36	36544	WMIC.exe
Token: SeIncreaseQuotaPrivilege	36544	WMIC.exe
Token: SeSecurityPrivilege	36544	WMIC.exe
Token: SeTakeOwnershipPrivilege	36544	WMIC.exe
Token: SeLoadDriverPrivilege	36544	WMIC.exe
Token: SeSystemProfilePrivilege	36544	WMIC.exe
Token: SeSystemtimePrivilege	36544	WMIC.exe
Token: SeProfSingleProcessPrivilege	36544	WMIC.exe
Token: SeIncBasePriorityPrivilege	36544	WMIC.exe
Token: SeCreatePagefilePrivilege	36544	WMIC.exe
Token: SeBackupPrivilege	36544	WMIC.exe
Token: SeRestorePrivilege	36544	WMIC.exe
Token: SeShutdownPrivilege	36544	WMIC.exe
Token: SeDebugPrivilege	36544	WMIC.exe
Token: SeSystemEnvironmentPrivilege	36544	WMIC.exe
Token: SeRemoteShutdownPrivilege	36544	WMIC.exe
Token: SeUndockPrivilege	36544	WMIC.exe
Token: SeManageVolumePrivilege	36544	WMIC.exe
Token: 33	36544	WMIC.exe
Token: 34	36544	WMIC.exe
Token: 35	36544	WMIC.exe
Token: 36	36544	WMIC.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe

Suspicious use of SendNotifyMessage 28 IoCs

pid	Process
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
8940	!WannaDecryptor!.exe
8940	!WannaDecryptor!.exe
36288	!WannaDecryptor!.exe
36288	!WannaDecryptor!.exe
36344	!WannaDecryptor!.exe
36344	!WannaDecryptor!.exe
36456	!WannaDecryptor!.exe
36456	!WannaDecryptor!.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1320 wrote to memory of 5672	1320	msedge.exe	88
PID 1320 wrote to memory of 1232	1320	msedge.exe	90
PID 1320 wrote to memory of 2668	1320	msedge.exe	89
PID 1320 wrote to memory of 1232	1320	msedge.exe	90
PID 1320 wrote to memory of 1232	1320	msedge.exe	90
PID 1320 wrote to memory of 5820	1320	msedge.exe	91
PID 1320 wrote to memory of 5820	1320	msedge.exe	91
PID 1320 wrote to memory of 5540	1320	msedge.exe	92
PID 1320 wrote to memory of 5584	1320	msedge.exe	93
PID 1320 wrote to memory of 5540	1320	msedge.exe	92
PID 1320 wrote to memory of 5540	1320	msedge.exe	92
PID 1320 wrote to memory of 5584	1320	msedge.exe	93
PID 1320 wrote to memory of 5584	1320	msedge.exe	93
PID 1320 wrote to memory of 3684	1320	msedge.exe	95
PID 1320 wrote to memory of 2284	1320	msedge.exe	96
PID 1320 wrote to memory of 3684	1320	msedge.exe	95
PID 1320 wrote to memory of 3684	1320	msedge.exe	95
PID 1320 wrote to memory of 2284	1320	msedge.exe	96
PID 1320 wrote to memory of 2284	1320	msedge.exe	96
PID 1320 wrote to memory of 2320	1320	msedge.exe	97
PID 1320 wrote to memory of 2320	1320	msedge.exe	97
PID 1320 wrote to memory of 3248	1320	msedge.exe	98
PID 1320 wrote to memory of 3248	1320	msedge.exe	98
PID 1320 wrote to memory of 3032	1320	msedge.exe	100
PID 1320 wrote to memory of 3792	1320	msedge.exe	101
PID 1320 wrote to memory of 3792	1320	msedge.exe	101
PID 1320 wrote to memory of 5360	1320	msedge.exe	102
PID 1320 wrote to memory of 5360	1320	msedge.exe	102
PID 1320 wrote to memory of 3048	1320	msedge.exe	104
PID 1320 wrote to memory of 4460	1320	msedge.exe	107
PID 1320 wrote to memory of 4460	1320	msedge.exe	107
PID 1320 wrote to memory of 4460	1320	msedge.exe	107
PID 1320 wrote to memory of 2100	1320	msedge.exe	109
PID 1320 wrote to memory of 2100	1320	msedge.exe	109
PID 1320 wrote to memory of 2100	1320	msedge.exe	109
PID 1320 wrote to memory of 3320	1320	msedge.exe	110
PID 1320 wrote to memory of 3320	1320	msedge.exe	110
PID 1320 wrote to memory of 3320	1320	msedge.exe	110
PID 1320 wrote to memory of 4756	1320	msedge.exe	111
PID 1320 wrote to memory of 4756	1320	msedge.exe	111
PID 1320 wrote to memory of 4756	1320	msedge.exe	111
PID 1320 wrote to memory of 5600	1320	msedge.exe	113
PID 1320 wrote to memory of 2068	1320	msedge.exe	114
PID 1320 wrote to memory of 5276	1320	msedge.exe	115
PID 1320 wrote to memory of 972	1320	msedge.exe	116
PID 1320 wrote to memory of 972	1320	msedge.exe	116
PID 1320 wrote to memory of 972	1320	msedge.exe	116
PID 1320 wrote to memory of 1580	1320	msedge.exe	117
PID 1320 wrote to memory of 1580	1320	msedge.exe	117
PID 1320 wrote to memory of 1580	1320	msedge.exe	117
PID 1320 wrote to memory of 5484	1320	msedge.exe	118
PID 1320 wrote to memory of 5484	1320	msedge.exe	118
PID 1320 wrote to memory of 4900	1320	msedge.exe	120
PID 1320 wrote to memory of 4900	1320	msedge.exe	120
PID 1320 wrote to memory of 4900	1320	msedge.exe	120
PID 1320 wrote to memory of 2004	1320	msedge.exe	121
PID 1320 wrote to memory of 2004	1320	msedge.exe	121
PID 1320 wrote to memory of 692	1320	msedge.exe	122
PID 1320 wrote to memory of 4532	1320	msedge.exe	123
PID 4532 wrote to memory of 2828	4532	CoronaVirus.exe	124
PID 2828 wrote to memory of 31964	2828	cmd.exe	127
PID 2828 wrote to memory of 18676	2828	cmd.exe	129
PID 1320 wrote to memory of 21384	1320	msedge.exe	132
PID 1320 wrote to memory of 21384	1320	msedge.exe	132

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://visuals.gg/product/memesense-cs2
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7ffe6d45c188,0x7ffe6d45c194,0x7ffe6d45c1a0
  2⤵
  PID:5672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1844,i,6779243408483792244,1177499659372277594,524288 --field-trial-handle=2600,i,15816692008728800383,17113190621159655805,262144 --variations-seed-version --mojo-platform-channel-handle=2988 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:2668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1548,i,16797677312655205016,14212841644537783589,262144 --field-trial-handle=2600,i,15816692008728800383,17113190621159655805,262144 --variations-seed-version --mojo-platform-channel-handle=2596 /prefetch:2
  2⤵
  PID:1232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2284,i,6781530359453553701,14342426125245725247,524288 --field-trial-handle=2600,i,15816692008728800383,17113190621159655805,262144 --variations-seed-version --mojo-platform-channel-handle=3020 /prefetch:13
  2⤵
  PID:5820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3608,i,14448128795253654637,1531749793408330962,2097152 --field-trial-handle=2600,i,15816692008728800383,17113190621159655805,262144 --variations-seed-version --mojo-platform-channel-handle=3692 /prefetch:1
  2⤵
  PID:5540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3612,i,2693843361620231608,14625496455077336108,2097152 --field-trial-handle=2600,i,15816692008728800383,17113190621159655805,262144 --variations-seed-version --mojo-platform-channel-handle=3696 /prefetch:1
  2⤵
  PID:5584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4268,i,2644798897639543868,6514761145605470028,2097152 --field-trial-handle=2600,i,15816692008728800383,17113190621159655805,262144 --variations-seed-version --mojo-platform-channel-handle=4824 /prefetch:1
  2⤵
  PID:3684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4284,i,8103810853977996153,6805791656210508891,2097152 --field-trial-handle=2600,i,15816692008728800383,17113190621159655805,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:9
  2⤵
  PID:2284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5344,i,14498903085097664303,9217820357607917061,524288 --field-trial-handle=2600,i,15816692008728800383,17113190621159655805,262144 --variations-seed-version --mojo-platform-channel-handle=5412 /prefetch:14
  2⤵
  PID:2320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5368,i,4353595733130840045,12973463958517525085,524288 --field-trial-handle=2600,i,15816692008728800383,17113190621159655805,262144 --variations-seed-version --mojo-platform-channel-handle=5432 /prefetch:14
  2⤵
  PID:3248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5852,i,14038409511028255364,14798054275349147740,524288 --field-trial-handle=2600,i,15816692008728800383,17113190621159655805,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:14
  2⤵
  - Modifies registry class
  PID:3032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5868,i,5725409472017029579,721971432503682272,524288 --field-trial-handle=2600,i,15816692008728800383,17113190621159655805,262144 --variations-seed-version --mojo-platform-channel-handle=5860 /prefetch:12
  2⤵
  PID:3792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6516,i,17146948027687213730,3205298635194795843,524288 --field-trial-handle=2600,i,15816692008728800383,17113190621159655805,262144 --variations-seed-version --mojo-platform-channel-handle=6508 /prefetch:14
  2⤵
  PID:5360
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6828,i,735637507213318571,4969033580502422746,524288 --field-trial-handle=2600,i,15816692008728800383,17113190621159655805,262144 --variations-seed-version --mojo-platform-channel-handle=6872 /prefetch:14
  2⤵
  PID:1652
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6828,i,735637507213318571,4969033580502422746,524288 --field-trial-handle=2600,i,15816692008728800383,17113190621159655805,262144 --variations-seed-version --mojo-platform-channel-handle=6872 /prefetch:14
  2⤵
  PID:3048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=7040,i,634696811065251617,10350058541436160484,2097152 --field-trial-handle=2600,i,15816692008728800383,17113190621159655805,262144 --variations-seed-version --mojo-platform-channel-handle=7044 /prefetch:1
  2⤵
  PID:4460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=7320,i,12616782198202803740,4758079250711767983,2097152 --field-trial-handle=2600,i,15816692008728800383,17113190621159655805,262144 --variations-seed-version --mojo-platform-channel-handle=7304 /prefetch:1
  2⤵
  PID:2100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=5184,i,9555054475301596257,9538117902187604968,2097152 --field-trial-handle=2600,i,15816692008728800383,17113190621159655805,262144 --variations-seed-version --mojo-platform-channel-handle=5148 /prefetch:1
  2⤵
  PID:3320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=7316,i,10792702425227594944,13598241944096139606,2097152 --field-trial-handle=2600,i,15816692008728800383,17113190621159655805,262144 --variations-seed-version --mojo-platform-channel-handle=7248 /prefetch:1
  2⤵
  PID:4756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7616,i,18164599404410506451,7109393404870601966,524288 --field-trial-handle=2600,i,15816692008728800383,17113190621159655805,262144 --variations-seed-version --mojo-platform-channel-handle=6908 /prefetch:14
  2⤵
  PID:5600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7548,i,14629347874189048961,9900412793755109320,524288 --field-trial-handle=2600,i,15816692008728800383,17113190621159655805,262144 --variations-seed-version --mojo-platform-channel-handle=7612 /prefetch:14
  2⤵
  PID:2068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7540,i,16924946115543093698,5360603748119768439,524288 --field-trial-handle=2600,i,15816692008728800383,17113190621159655805,262144 --variations-seed-version --mojo-platform-channel-handle=7624 /prefetch:14
  2⤵
  PID:5276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=5392,i,17755778999724665947,8620054036375544527,2097152 --field-trial-handle=2600,i,15816692008728800383,17113190621159655805,262144 --variations-seed-version --mojo-platform-channel-handle=2076 /prefetch:1
  2⤵
  PID:972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=7332,i,4935540931070617139,6064953392008994107,2097152 --field-trial-handle=2600,i,15816692008728800383,17113190621159655805,262144 --variations-seed-version --mojo-platform-channel-handle=3816 /prefetch:1
  2⤵
  PID:1580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5528,i,4745368272101835967,8632485752444882890,524288 --field-trial-handle=2600,i,15816692008728800383,17113190621159655805,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:14
  2⤵
  PID:5484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=5460,i,8422914135264933490,1863567957099211345,2097152 --field-trial-handle=2600,i,15816692008728800383,17113190621159655805,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:1
  2⤵
  PID:4900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5592,i,17889738311390011983,15561658579033618952,524288 --field-trial-handle=2600,i,15816692008728800383,17113190621159655805,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:14
  2⤵
  PID:2004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7944,i,15076479798022369177,11580529214166376125,524288 --field-trial-handle=2600,i,15816692008728800383,17113190621159655805,262144 --variations-seed-version --mojo-platform-channel-handle=7672 /prefetch:14
  2⤵
  PID:692
- C:\Users\Admin\Downloads\CoronaVirus.exe
  "C:\Users\Admin\Downloads\CoronaVirus.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops desktop.ini file(s)
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4532
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2828
  - - C:\Windows\system32\mode.com
      mode con cp select=1251
      4⤵
      PID:31964
  - - C:\Windows\system32\vssadmin.exe
      vssadmin delete shadows /all /quiet
      4⤵
      Interacts with shadow copies
      PID:18676
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe"
    3⤵
    PID:23740
  - - C:\Windows\system32\mode.com
      mode con cp select=1251
      4⤵
      PID:23856
  - - C:\Windows\system32\vssadmin.exe
      vssadmin delete shadows /all /quiet
      4⤵
      Interacts with shadow copies
      PID:34512
- - C:\Windows\System32\mshta.exe
    "C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"
    3⤵
    PID:34580
- - C:\Windows\System32\mshta.exe
    "C:\Windows\System32\mshta.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"
    3⤵
    PID:34632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=5348,i,2957751902356858474,848902875552044160,2097152 --field-trial-handle=2600,i,15816692008728800383,17113190621159655805,262144 --variations-seed-version --mojo-platform-channel-handle=7952 /prefetch:1
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:21384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=600,i,290208356846950848,10279597054764637208,524288 --field-trial-handle=2600,i,15816692008728800383,17113190621159655805,262144 --variations-seed-version --mojo-platform-channel-handle=7852 /prefetch:14
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:21444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6816,i,9890300892152256368,14285189070415964919,262144 --field-trial-handle=2600,i,15816692008728800383,17113190621159655805,262144 --variations-seed-version --mojo-platform-channel-handle=7868 /prefetch:10
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:34468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=7748,i,12034982602644908353,13776363599748349823,2097152 --field-trial-handle=2600,i,15816692008728800383,17113190621159655805,262144 --variations-seed-version --mojo-platform-channel-handle=8324 /prefetch:1
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:35296
- C:\Users\Admin\Downloads\WannaCry.exe
  "C:\Users\Admin\Downloads\WannaCry.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:26088
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c 123781782949399.bat
    3⤵
    - System Location Discovery: System Language Discovery
    PID:35292
  - - C:\Windows\SysWOW64\cscript.exe
      cscript //nologo c.vbs
      4⤵
      System Location Discovery: System Language Discovery
      Modifies registry class
      PID:35720
- - C:\Users\Admin\Downloads\!WannaDecryptor!.exe
    !WannaDecryptor!.exe f
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:8940
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im MSExchange*
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:29856
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im Microsoft.Exchange.*
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:29932
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im sqlserver.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:29956
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im sqlwriter.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:30112
- - C:\Users\Admin\Downloads\!WannaDecryptor!.exe
    !WannaDecryptor!.exe c
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:36288
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c start /b !WannaDecryptor!.exe v
    3⤵
    - System Location Discovery: System Language Discovery
    PID:36292
  - - C:\Users\Admin\Downloads\!WannaDecryptor!.exe
      !WannaDecryptor!.exe v
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:36344
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:36508
      - C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        wmic shadowcopy delete
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:36544
- - C:\Users\Admin\Downloads\!WannaDecryptor!.exe
    !WannaDecryptor!.exe
    3⤵
    - Executes dropped EXE
    - Sets desktop wallpaper using registry
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:36456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1096,i,11411656325815575390,12158327793932218723,524288 --field-trial-handle=2600,i,15816692008728800383,17113190621159655805,262144 --variations-seed-version --mojo-platform-channel-handle=6840 /prefetch:14
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:36736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7664,i,5982212344522753298,14670038044705307457,524288 --field-trial-handle=2600,i,15816692008728800383,17113190621159655805,262144 --variations-seed-version --mojo-platform-channel-handle=7776 /prefetch:14
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:33676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7220,i,871493126548647539,13497582079360457451,524288 --field-trial-handle=2600,i,15816692008728800383,17113190621159655805,262144 --variations-seed-version --mojo-platform-channel-handle=8200 /prefetch:14
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:33852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=5656,i,5269197622176017263,4769622067188730792,2097152 --field-trial-handle=2600,i,15816692008728800383,17113190621159655805,262144 --variations-seed-version --mojo-platform-channel-handle=5652 /prefetch:1
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:37096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=7528,i,4572608969445090058,10168791446394186769,2097152 --field-trial-handle=2600,i,15816692008728800383,17113190621159655805,262144 --variations-seed-version --mojo-platform-channel-handle=3772 /prefetch:1
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:37728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6884,i,14589294333347525245,7361092232452693626,524288 --field-trial-handle=2600,i,15816692008728800383,17113190621159655805,262144 --variations-seed-version --mojo-platform-channel-handle=7160 /prefetch:14
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:38344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5644,i,15615818752060165722,3956223731795842986,524288 --field-trial-handle=2600,i,15816692008728800383,17113190621159655805,262144 --variations-seed-version --mojo-platform-channel-handle=6768 /prefetch:14
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:38452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --metrics-shmem-handle=3484,i,8374353003485313165,7572885333091804757,2097152 --field-trial-handle=2600,i,15816692008728800383,17113190621159655805,262144 --variations-seed-version --mojo-platform-channel-handle=8476 /prefetch:1
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:38952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --always-read-main-dll --metrics-shmem-handle=8544,i,5608446357957351803,13933367266673960830,2097152 --field-trial-handle=2600,i,15816692008728800383,17113190621159655805,262144 --variations-seed-version --mojo-platform-channel-handle=8556 /prefetch:1
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:38964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --always-read-main-dll --metrics-shmem-handle=8708,i,3234489485343084833,2968291480501097627,2097152 --field-trial-handle=2600,i,15816692008728800383,17113190621159655805,262144 --variations-seed-version --mojo-platform-channel-handle=8756 /prefetch:1
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:39444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3712,i,8451697646599742127,16234247377312436923,524288 --field-trial-handle=2600,i,15816692008728800383,17113190621159655805,262144 --variations-seed-version --mojo-platform-channel-handle=5244 /prefetch:14
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:42604

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5436

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4568

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:18996

C:\Users\Admin\Downloads\WannaCry.exe
"C:\Users\Admin\Downloads\WannaCry.exe" /r
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:35464

C:\Windows\System32\oobe\UserOOBEBroker.exe
C:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding
1⤵
- Drops file in Windows directory
PID:40044

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:40652

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:43652

C:\Windows\System32\oobe\UserOOBEBroker.exe
C:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding
1⤵
- Drops file in Windows directory
PID:46040

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Direct Volume Access

T1006

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Windows Credential Manager

T1555.004

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Defacement

T1491

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

msedge_elf.dll

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_elf.dll
Size 3.6MB
SHA256 20f12bf8b9da1d6bab81bd37266e77f246b732ac5be9416cf33f071a71cd8714
MD5 b54a1b184b03b88fe38a1b066c931604
SHA1 10dfe24da7cb6e52785feba94c5e5daf0648282e
SHA512 820fdd3a10778f7156ba09629889530a8b99b09a54b40fde21bd00537761e6e04db8d100f029d4c254534cba28116ca8abb8db93611b3786c64ad4a0b619031a
SSDEEP 49152:ZbSSRZHJmdiiv4uxLpw8aZGCR+HTWhQTRHUJOL5G7jquWdpQZgKwqPKwoC:DRnPivfxVpTWuw+QF5
TLSH
T149062983E3660179D44EC874CE2E562197693C8E57F193EF25E87AE11A72AC8373DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Size 3.9MB
SHA256 6d8e5d6a4d1c147b90b5a394a5054840e19dfa3eae3ea706ffb367477cecb929
MD5 e7107300d20c25a5253022fe6b1e04cf
SHA1 8cf0ad044769d9199a0c53e1b0d471ca081cd475
SHA512 b7cb6dfb60e983bc07e3bedb35296f88d46ce33273ed80b039a93a0391a9f0e90e255dea0eb9805df731d87938d61d70a4635de40e221dfdc005dd0bba9778f9
SSDEEP 49152:5udQuVyBvNszCnSgVdQM3/+TjER7zExldDwUIDtaZHWRdpev2y/Baj:rijnUdYd+RaAj
TLSH
T170164903B29940D8D049D074CE5AD232EB617C8947F162EF3690B7EA2A73AD47B3DB15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppvIsvSubsystems32.dll.id-18804780.[[email protected]].ncov

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems32.dll.id-18804780.[[email protected]].ncov
Size 2.7MB
SHA256 779453590903853780c74ac0d380d0d9d686449f153a305f07a39c5dfecf7941
MD5 3f37cb5ed96247af85cda1b7b00ae35f
SHA1 f079f943131658a00488ed7fe52978cfea15c0aa
SHA512 7cf2ad3868521d950b00b57af3fcebbaec1ae228525e2a5b1ea302d145a7d07172a9f97279bbb2362cdc04197444547c817f04f738a880b7d558dbd279b3bdcb
SSDEEP 24576:BTT//fsZc6rBvWSqfmYFYZdiP5dCUj8eBxht6L+oe2CLjkRUqF+xh5+33gh7m:VIZc6rQSgmYSSrCnevCZikRUqFIR7m
TLSH
T1CDD59F20B69AC13ADBBE06F11D38CA4E512A79A50B7488C7F3D85F2F55B04C39736A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0025a016-f5eb-4845-8c69-eb607fe16b4d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\0025a016-f5eb-4845-8c69-eb607fe16b4d.tmp
Size 392B
SHA256 b3b639da0e6206aaec763078d47e2fa583a431ccf041df63304317cf89384a92
MD5 e1bf191127a8b36d7cf5de415a9d087d
SHA1 f47e62a98f433bbed8d954bc05eb36f123e8d870
SHA512 a48b29db4feb42ac7a6507d56ca6afc90a1499a088d5e27779fd795d1d519151f7a88d88e72e15de44a42054b3ae5fc8a0969d3cef5e3d3534cfc6476e425537
TLSH
T143E00113E74008FAC06C0731009B0F243EF7C1B602F2020A8F30442C6D367587E71E80
MD5 SHA1 SHA512 TLSH

Submit Download

2950a6c5-54e3-453a-a06f-e9c6e8c4a465.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\2950a6c5-54e3-453a-a06f-e9c6e8c4a465.tmp
Size 392B
SHA256 a84045c6456b59f9974c275f32fd305a435b6ed9a355cd671122d97e8fa8af3d
MD5 74d446ba5e7015b28b224f5d8fbae95a
SHA1 0dac7b31603407fba9689f5e7bc6c2342500432d
SHA512 0c176d888589e28a4ff872ee812a7c65585ab28c6fbc2bd8cdef91d20f95232bcf73d68c40b0d4ae2c51e06d22b025772b5c3a335e5904187226b39994fd5e75
TLSH
T1EEE00103A31001BBC06D433400D31B203BF3C12107F7030A4A3145782C633597FB0E80
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 85900118c71217b605d5ac64fa104d9bdf3a2ae1825187ef3a6a9c3ea75946b8
MD5 b694af012c621426ee8e90a8ed586333
SHA1 e839cf90b93d2693f8046fc19ae1373628f0cf99
SHA512 b9142bc76c532d8974de0c5db727ec4870a44225dc222a9fdc138b1278d0f4cb8cef786ed6b936ee6b436177a50e31c07b489d69dd8d25de345ea17638a55e56
TLSH
T188D08055364DB40CC151253254615365F6749651B42B57185460B01CDC78DA173576DF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9ee8b00c5eccab84404f41fa5a938e6b9e2129213bd97cde6c60973bfccf9540
MD5 0a273f57544ca9c385c90abd2fb2f8b8
SHA1 663d351037054236aaa58a924f66180602045244
SHA512 8a731bd22460fb3b026847be48aab957fe90f0ad7e2dcb291305580f3553409cfdff67355886d3d2f95cd8f8ff1d2726447bc2b96bce2cdcc51a8a15cbcb9d0c
TLSH
T1CFD0C010324DB00CC040203214210360F2309610602B47084020F02CCC78DA173466CF
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 357B
SHA256 49d8b0020c1618d7bccf7a712ffe453034376e6dfcbedfe31ae0752341b05058
MD5 5e31966fca8ae1dc5922ba7691201794
SHA1 6f5aa684aee63eacbcd521b58ca1e945a4af78d5
SHA512 1f38061efa7858646480464b3bce8a3728048e96490cbbbc2fd9bcf342545d1e29ed27143dde944958f36a55c55036fd189febd8e012c65cba2093081e2aadaf
TLSH
T1EDE0203D0BA4C1AF5607A457C1FC675845927977DBCC585A32166C9D9400C8B4B34DF2
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 157B
SHA256 2f4960bb248e7f4edcba6198159bf14eaef40b78f0c0bf8b91fd6a76d30b65e6
MD5 f81a0fa55ae73f9bc425352ed572fa3b
SHA1 a9d5c35b07168cac8e5ca9e076f341c25deaebca
SHA512 d7be2a5ee9a24bdaac6f8e676778579b1f8e1b1e4c70182b78e15ccc5e54f0440d58d07b0c8db3678fe387d53a20552653e884f3f65c93a5be9a27f9b8c63bb7
TLSH
T184C080D878C46D5FEBA05BFD567570801E5007C104519E110154ED4132754F00E850B0
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_00008b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008b
Size 62KB
SHA256 df670e09f278fea1d0684afdcd0392a83d7041585ba5996f7b527974d7d98ec3
MD5 c813a1b87f1651d642cdcad5fca7a7d8
SHA1 0e6628997674a7dfbeb321b59a6e829d0c2f4478
SHA512 af0d024ba1faafbd6f950c67977ed126827180a47cea9758ee51a95d13436f753eb5a7aa12a9090048a70328f6e779634c612aebde89b06740ffd770751e1c5b
SSDEEP 1536:Q9pfnSa+E9Az52gNbkYtUtqvUhZRHuLdrx07LXz:uhnSpE9A1EY6tBPix07Lj
TLSH
T1695301D4670EE2A579F2CF23BF59C5C00803162D8E11AA68FFA063878D8430BA793D1D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008c
Size 68KB
SHA256 90e39936fa4a20f0fcdafc8ce17bd53e662b5ac7fe4c810b28ed5356b9da6d02
MD5 8b512e3b59cb89f3f306e9e69f799ab1
SHA1 e0a1c29cf12aa60249c80da1600a2d7778984788
SHA512 d5b39e2618e5cfcde62a34552aa24def071b21cea9913296d33edafc7fb024426ebc8e92550b40f0bb3231c8ddb2945538a7e6c0d4f308c7cdac7d5e53745b87
SSDEEP 1536:phILhlQU1HUf76Z+AGYguWv0KxwhT30N7Xw1RJiuwPy+R3zP5:p6Lhl/1HX9GjuW8KxwhYRXw1z+55
TLSH
T1FC6302008F370176B188A8D9FD49E3B6CAAF58E0914BF595020B188F7F5F8D1A55D2BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008e
Size 63KB
SHA256 caecff4179910ce0ff470f9fa9eb4349e8fb717fa1432cf19987450a4e1ef4a5
MD5 226541550a51911c375216f718493f65
SHA1 f6e608468401f9384cabdef45ca19e2afacc84bd
SHA512 2947b309f15e0e321beb9506861883fde8391c6f6140178c7e6ee7750d6418266360c335477cae0b067a6a6d86935ec5f7acdfdacc9edffa8b04ec71be210516
SSDEEP 1536:tLQFdWY1+jAIuhc5s3JBP2ffX195jJqu1H5g60:qFdv+jA/cizOfTdRJ260
TLSH
T10E5302D829DC2DF4466490C19420E379C6FACED8E4485B6F5B2A2E0DF78DD7527C7242
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008f
Size 19KB
SHA256 af18b3681e8e2a1e8dc34c2aa60530dc8d8a9258c4d562cbe20c898d5de98725
MD5 1bd4ae71ef8e69ad4b5ffd8dc7d2dcb5
SHA1 6dd8803e59949c985d6a9df2f26c833041a5178c
SHA512 b3ff083b669aca75549396250e05344ba2f1c021468589f2bd6f1b977b7f11df00f958bbbd22f07708b5d30d0260f39d8de57e75382b3ab8e78a2c41ef428863
SSDEEP 384:/Und3PKicut4yiFkC9RWzlJpa2/CKYOyDJmCZyXJTW4PO821GyLjSoBwNeS:0UizQDYlJpaQCKYOyDJpI5Kx821DS3Nz
TLSH
T13692E1670BCE314E422EE25FA316A51733E41BE1EFE49640D6AA70D81C38DA243179D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000090

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000090
Size 38KB
SHA256 4392ddde86f22a921269feaf788a13509946046047df6926017041ff33d0293e
MD5 04bd0131c5ce154413f71d20017679e6
SHA1 a83459180dca62eb56edee213409f83e12fa6172
SHA512 5818141afbbc45553e72fc106699d9357437f1c2751751dab4f51ad7127e92a6ff85fb67905073addfdec5dd581c8c22ffc8dd6b85919d6a1d72550ebda5376c
SSDEEP 768:hrGgBfBZrOcgLWz/irLn2nTXzHXP0JsdgCQL1/UAv73nWEjvvuUwp5:hrGA51OQ2naXzP0Jsdns73WEaz
TLSH
T1170302AD7D526331E7FB684CC972AA1340C424498063CB1FBEFF098E9D44A4FE056A23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00009c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009c
Size 380KB
SHA256 c4e946c997140af76e709100c18bfb2a7776c5f85b0fbfcdcd7335b3e2690a52
MD5 c0e601a79abc809bbdf6c7f04a9fd193
SHA1 fed3f108cfd6ba015b75d1e2001408f40a746be3
SHA512 8affdc18af06da9da2cf3d3dcb30b76192029807f49f9e66df69b09ec5adfd7fc2a9d2b980f36f345e1c1bfffd29deb7a75b218de06c3e98b8260ab956dce012
SSDEEP 6144:eYujAYJrXq/erLXpe9VoOtmtmyejo2OqjzQpbV60LjS4eWyMgwFBFyie81xJzDQ+:eYujAirXq/T9vmYJMNWze6T9bMgwJygb
TLSH
T12F84232B4D5E750C347DD5B68009F8C7B0BAF3A81425E8AA57D98FD0D64B4D3846BC35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 8KB
SHA256 78ae1cd4cce82560b40efc8641a637c208f89c26db4efba2c852b9046acdc919
MD5 af7165e2db2a06a6fc538e9d45f992f2
SHA1 e5ee8a5114211b6d1afea9ee6b8932e69aec48e2
SHA512 fa28ed2d029d6a813a205223207ec903c40da883ed9c16e87a4836368a98603911b5ff7eb607e45ebb8e42b2350036a1a484178bb64e2580d7030d898ba200fc
SSDEEP 192:KJzIpqtZ0J12/kESLVkgj7Y5JQFfPrAZVL1+jqQ0wJnX1NNqyJv4h/2q0uI8fD0s:KhIpqtZ0J1YkESLVkVTQFfPrAZVL1+jW
TLSH
T13302C80C97B957ECDB1812B042D69BB17B3C47EE28EB6E5A91106DB5DF4E78C71C1102
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 7KB
SHA256 b1dc827b5ab04096c041deea6e0c7fd91a04814b028ab9611c2616ea899db73a
MD5 15b9b11ed555b572a949199dfa9433a2
SHA1 3740ab10d169ebefa50e0637134f78fc065352de
SHA512 527b67e6fa8a7e07e53faf0985e5f235b28478514ed3fe0621f1502d9c23a0996128213bf014a9cbb7bb927e0a070c76ff994ed93f28ec6bac2200b0063015c5
SSDEEP 192:pgzEpqtw4P1XwkqSJ+JgZUk5YGsfPrAsyR3+/XQ0wYnkRi4bZRv4f1O0uY8F50I5:pqEpqtw4P1AkqSJ+J4eGsfPrAsyR3+/i
TLSH
T184F1940C67B1ABDDDB2452F052DECBF17B3088EB20CB5E8AC611A5B9DF4E78D6251001
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 8KB
SHA256 cc14b0a262fe8d3966d1fa9123470207dcd6f6657047604980e6457a8650fba5
MD5 0c0a5e9a2605fbf7adefaadd3286a5e8
SHA1 ef246c4fcc0933935a133e3917b0ed68bc99b951
SHA512 b6e6d617d8c4725191fcb9aeed2c1d23aafbecfbb6d3d572d6ac89cc2c13c17af3bec55e46faba2bb036d82708d3e294e5ce94f77de16028807d6a1c424f403e
SSDEEP 192:/JzjpqtZ0J12/kESLGkgj7Y5JQFfPrAZVL1+jqQ0wJnX1NNqyJv4h/2q0uI8fD0P:/hjpqtZ0J1YkESLGkVTQFfPrAZVL1+j1
TLSH
T15E02D90C97B957ECDB18127002D69BB17B3C47EE24EB6E5A91106DB5DF4E78C71C1202
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe5e92f7.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5e92f7.TMP
Size 7KB
SHA256 9ecf7fd01e48d31b283f016381e472fd62a8e3a00abb52dc30ff7d43dec8778b
MD5 63ffc843f678a61af25a5ab2b191aae4
SHA1 8a286359cf70281d1bdd9598e409cc1b59561e53
SHA512 db940589e556a7ee8ea3a6fb3615e37097dc0a08a211be18b466cdc4319f7737d207e06db103ea17c3ea8eafa93da3891416b71e6871cda6e9efbb683b5a71b6
SSDEEP 192:znzRpqtZEJ1y/kESLlkgj7Y5JQFfPrAZVX1+jqQ0wJnX1NNq0v4f2q0uI8fD07tp:zzRpqtZEJ10kESLlkVTQFfPrAZVX1+jn
TLSH
T19AF1B60C67B967ECDB28127052D68BB1773C47EE28EB6E4A8210ADB4DF4E78C71C1102
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EdgeHubAppUsageSQLite.db

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db
Size 32KB
SHA256 1588ba2e310bb00cedaca6c5470c9262da0cfb594961a931278d19e89cf90fb0
MD5 62036e8ff7f8c880cfd5433908685132
SHA1 92c0b01a85525346dcda11da8f086dc9b47800c0
SHA512 89de3d6203cf4a10af32dbec087c1ad6a8f42b40e98d9ffbb7b935f66dd25db0419ad508486ad10f88f557950949c166c805b20588d27878f5f239b2055fdc49
SSDEEP 48:TtD4jJ/0UC+lf5ls3CdayPtl9WxjgoZkgApz:hD4jJ/JXs3Cdv9tXdpz
TLSH
T187E2B184E632F7AFCFED1D3EA7D8B2F5C5D8202C91DC1A50137D79EA04A86E8654A01D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_github.com_0.indexeddb.leveldb\000003.log
Size 118KB
SHA256 c17feee2d135c0975b3e387bd7cd4978d1f8d7d6d172d9646238c7fecd737929
MD5 895ae28ebf81157418cbf5e365721158
SHA1 b2de6bf491868c8ca257e1ee9a72bafcdc40a5c2
SHA512 0d1e32030b87ad337ff4f4d5ffa4d42ff9654bb25a06c95a3305c27771f2e6eb8c06f862244b8f2060e6df6eb239046197231d121baf376af99dc70bb3d8026d
SSDEEP 768:sc5nj2k6JzkXWc5nj2ijc5nj261SV2MC0Bu1fV2MC0cm1SV2MCXic5nj205c5nj4:zj16JzkBjTUjHs2yeJjZ+j4
TLSH
T170C3345C3E79CC2B4BAE461378F1751D8863F2269088ECB6D4561CD843EEFC1E15A2A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_github.com_0.indexeddb.leveldb\000003.log
Size 159KB
SHA256 bdd9b2134add702161a78e87ec6753a40bb71302e63d0f31ab0b010be8f54b60
MD5 5e8d198b7cd3b598711f65378d83770a
SHA1 f0507b0550417c54782a23bd584a111102c003c3
SHA512 ceb1bf92a210004afa9ef52116ef2f697364b9d07f56591ac0c79bbd167e910e753267f8e1fd21b762f25d013b5f67d384303cdf3feb911f7dc33e91c3e4b9f0
SSDEEP 384:a98q7tPyHVDfl4Pa7HM0E0Y7P1Y7pmSW79wew7etRrD7GawezR8q7tPyHVDfl4Py:m1SE2MC0xh1SV2MC0f
TLSH
T10AF3C2583E79D87FC7A94233B4E0B5194853E32680C8EDB6D46A18D443EDB81F16B2E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log.id-18804780.[[email protected]].ncov

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_github.com_0.indexeddb.leveldb\000003.log.id-18804780.[[email protected]].ncov
Size 118KB
SHA256 4d69647bd112a08d7ca8d185206852bdeec9a1bb1883c2464f9b45d7e6b73cb3
MD5 dbb4575d1c0637ed060c3168df4b3104
SHA1 8b893e71abc4a5a53850e45b01455011862101ef
SHA512 adce6f4d00529321fdf5aab0d5f4fa583399d1c2485317275491cf35677a3e4853a464073569ebcfe877980921fdbad48bdebffc5b8bcdb0c31f0f3df95badf3
SSDEEP 3072:Io9o7VlNS4ABrVIR+ZCWCLk2f3DaqwLkNBGaVj:IJ7VqBB3ZCNR3FwLCFj
TLSH
T1BEC312D75575D639C2AAD7F563C8159EF315F232301480649C488EFED8BBBF98838446
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_github.com_0.indexeddb.leveldb\LOG
Size 341B
SHA256 e845314d1ac551270b1d56da9370a24682a03e3337a9ec454362a8411bac76bb
MD5 c8cc90740fa383f679f2e5255cc4a09b
SHA1 c6f54b93dd1d37fcb26d4e00d9742a69b99ec24c
SHA512 2090d0cbd62d8e4d3f443afff1fcfe5054fa2446d9734121b8fdf55d24f4110adc5d8529de6f8a2176be865e38d7295ee663e200363b21cc76ad32cd6ce5d8d1
TLSH
T1A6E0D87885C9C56B531454A646687B09D6E7750FD7D86D894E05CC28B086048BA6E2A1
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_github.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

3c2d6c2a-9cb9-4175-b8f6-b37d77c08c86.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\3c2d6c2a-9cb9-4175-b8f6-b37d77c08c86.tmp
Size 11KB
SHA256 50d47c513f66de8f57d4ab3be3c320d40184abe4496c086a938ec164066a18db
MD5 fe3c01e87bb63c0b5dd5227dc464b595
SHA1 6fbce45e4f76e54edfc0bf469d58ed12a487abf8
SHA512 88bc5f02fbba931e34f9f29b5002ac67d7f3045699a0cb30d5c6547d73ddfdaea18912cd4070a51c2bdf8ee6301151e26ffe7286d68b5d319d58a3eee6f928b2
SSDEEP 192:Dy3SF6YGjxix5DubnAYmY8aUqiM1hktBT7WLhjfe/TAj642Nv1pAdJchqmbmF9L/:Dy3SF6YGjxix5DubnAYmY8aUqiM1hkt6
TLSH
T1C6328CF787E8822DD91255F0AB147E2BCE5D0A5483283D2AC9D4EF0BA7F2471E24175E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 10KB
SHA256 18f77c74ddf7f35c307a6b11791b35f844469cc87b58a529bfa11590b082be34
MD5 014a098c411f929cdae171864bfebe45
SHA1 656895fb276debd2eb16d0367e98b68308d384bd
SHA512 ea327c095873e578734471fe1b5aeaa06c7b21f128679b74d4d9da805a7c617556b19c4b2abea687e8c6c894a6020b3eb18df45823c78ade84aada2b737cb761
SSDEEP 192:DWfh8HnMRqFiRAN400mCwwcaUqiZ1hIgBQuWphZKF/APprd+JhqmzmF4hmBmrmtS:DWfh8HnMRqFiRAN400mCwwcaUqiZ1hI2
TLSH
T112226DFB43F5862DE91255F0AA18AE1BCE580524872C397AC9D0FE17E3F2471E241B5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 8fe236d2b047147f804c3b4419eeac0062cfd78175c376ba9fe343bad8144101
MD5 9d2191e8e9bc2ffdf43f53a2abbc7c7c
SHA1 712f133b5fc7879a4d2b05ace72ed0846fd1e48d
SHA512 cbc4038a0c24bd17afbe6963aeeddaa650d1a211cdbd0d51d327d5c8db31e9d75f56e362fef33068cf5403fe4c31c5f8d888b77bcf247505d290d67986e7c095
TLSH
T1B121CDF7C2E845BD890185F876146E1BCE2D0814831C3D5BC5D49B5F93E1471E28095F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 11KB
SHA256 f9620cf593bfd525e4fef072594cefd9438962283a501ea008d39ee81a50eeda
MD5 6f664e0c98cf96228bb082fff06f1d52
SHA1 c00399f2ebad47f26f8a9ed883d0e87d1d710ff7
SHA512 4b43396ca31e881fcebfdfeea3708abf43621d1c14f76c869cd3a783eb1eb5967ac816d6c61903ddafa861bd6469f7f8ab49e4ffcc5be900c192c0d238fdb3fb
SSDEEP 192:Dy3SF6YGjxix5DubnAYmUaUqiM1hktBva7WLhjfe/TAj642Nv1pAdJchqmhOmDmI:Dy3SF6YGjxix5DubnAYmUaUqiM1hktBo
TLSH
T15F327CB7C7E8822DD91255F0AB147E2BCE5D0A5483283D2AC9D4BF4BA7F2471E24174E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 479e6f6b93305430673384bafdd858d29be9b7919f99f135e4354c8fbb514dfb
MD5 10cdfdd3b99f706d8dea218ba6c54b7c
SHA1 8fd4e569e659624cf8d23299f038c6a39d263718
SHA512 bbde4e43e08eea81e1eb599adba103608297934972427c30b82ccc8c58bfdefb148827658795e7705cfa56a278fa237624a04a85e0ec0bb6d2aecfbee81e27fe
TLSH
T1B4D02223220430BABB7C7E91406AEC8FC32640204D52EDEA18D09B9C25364AE662B242
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 18KB
SHA256 d37113f59c011b814a8de5d4b0d4b79c36e3580f79508bbae6b1d0aa9e487f77
MD5 d28e5cc52859770fcf084845367b8bf8
SHA1 135f3b69e1e1aba21ff18156f82e8221e499543d
SHA512 96fb031a3038510210211ce23eda0995a0422d806164ae913d5106f6c1c36484e4f9dbafec9032528c1790280b3a7bcd80fd620f67d12aa570f08ee483ab3edb
SSDEEP 384:sxRqawm48/fos887QUzIy/5fFzXU4j6jpm:s+Vm48/fF7Qo/5VUBm
TLSH
T19E82E8566524997B8DDBD609F961BF23D7F8042396915E48AEFCCA0C01EF6FD220381B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 67bddba1acdbce4043dd4608d27e2c4c40f676593a7446c4cd37516f845deb99
MD5 bda33bcfe790d16a8e7bdf02eb36342c
SHA1 93e8156d14601bcc12b1a125863ec1b792568f63
SHA512 f56a0cc81dd1d5eefe8ae3fc44edf5ed9103a3cf85ce9eb468859dfaf9cc9d34adba384f21f826b635795ecf27f2d699c83171d13da55800f8b0ae7df101b32b
SSDEEP 384:sxRHaHm18/fos880QU3Iv/5rn/I4j69pm:srOm18/fF0Q3/5zILm
TLSH
T12472E7566524997B8CCAC609F965BF23D7F8056396901E4CADFCCA0C01EF6FD220282F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 87350a35e9a813a98e8dd5a777d7b5e7b1d392dc75dfae9f39bdff06e8c303e4
MD5 54884e0b42b034ed802f960271a75326
SHA1 0cd41f3b17f2499d164db4abb22c2b3b57cf9bb8
SHA512 75e3bf357f2c7450c90899d40f6dd2fb95a37746202d787011e99f007acb82e3627da322c644e5f0605d182e4067c6e1969e6531855b67d2ce66aaf1a8bcf695
SSDEEP 192:sxRsRYyM/jK1Ml8wF8/fos089ubswoUsWzoA8pf4/g6+WNdzI/YH0HM5FG2IgIJ:sxRsSb8/fos080QUsLg/5K/L4js
TLSH
T11052EA166638993BCCDBD209F9557F53D6F91573A2905E44AAFCCA0C01E76ED220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 18KB
SHA256 b9d20430cf9de2be5ba9d574a5c4126387d89a9b316610303e02d05a162f43d2
MD5 d77253d57dd01ed18e8434e247955d10
SHA1 6ed0d8a6a52585d342b526e7ed5bd909b3c13341
SHA512 ccf41191cc3977f119325946ec6bc3b95e082562ffd1616a30a78b76d964bf4304b80ad56e2b5f5fca421a441634da8a0905576fce780b874ca2052efcffc259
SSDEEP 384:sxRqaHm48/fos887QUzIy/5fFzX94j6jpm:s+Om48/fF7Qo/5V9Bm
TLSH
T11582E8566524997B8CDBD609F961BF23D7F8042396915E48AEFCCA0C01EF6FD220381B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 18KB
SHA256 4d776c0d8a671f26d39a807a2e4a4bb757f2c472cb68502acee8fa4321c7bb59
MD5 b06a03651ff9f18f67dc55e467f325a9
SHA1 f9f4c5f46451035e0410510bb19a07233024353a
SHA512 4ad998539fdb9df8248dbfbd72279fd7ae62a26c8c1eef43149518e212aa0fb17a3db50225484d00e8a7d61a0a6d9f8e92f7382c60516736a76d49cf009de102
SSDEEP 384:sxRqaqam48/fos887QUzIy/5+lzXnT4j6jpm:s+lam48/fF7Qo/5kTBm
TLSH
T15982E8566524997B8DDBD619F961BF23D7F8042396901E48AEFCCA0C01EB6FD220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 33KB
SHA256 fb4bbebef95d9d62f8920a04c42e40545f4603771b00fc906fc4170c4384dfd0
MD5 8af11e85d27bd90cb6f5cf081e0770b5
SHA1 f28eadcb4659e261111b2113cdd4adc8ecae985a
SHA512 b9cca17e301be8a8013a76d50d88982fca2a1e64d10c6938f63bc653a3951435e2da16ea3ec960650453cf6d5dbdafc5a88a2356450d03f88b67316704e740fd
SSDEEP 384:sxRq4qtm48/fos88a66s8qMpRiYnazAW8pZS15posJWeT+8qQUCIi/5wldHHT4jf:s+ftm48/fFa4Mnc7WeT+8qQP/5mzZm
TLSH
T110F20846A424C8678EC39D18B87D7E33DAAC00525695DEDD5AFCCE0C019E2FDAB07867
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 883d8457ba024bb3c595a399a64db57d943f9f9060f111a7376396428ace60e5
MD5 79f5afb5d5a5a15dfdb6cf4d168f62f7
SHA1 7d8cf0895b1902083de68664e2e5674e01b40390
SHA512 df8f93edad3a72cec348ff16c65628df4d1594e86e2f50c9a167a3871a9ef4cc7ae5dbd18deafffa4af52602ee859f8303f69827f30165d8ec98da73552f9746
SSDEEP 384:sxRqaHm18/fos887QUzIU/5pzXJ4j6vpm:s+Om18/fF7QS/5JJVm
TLSH
T1CB82E85665249D778CDAC608F961BF23D7F8056396915E48AEFCCE0C01EF6FD220282B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 18KB
SHA256 de7611e73e41b99a638fd50191614ce22f79b0f997c6d4fb05f73ec298c2d6b0
MD5 42baa1a9b10fd44ec08861214a1e959c
SHA1 2a3bfb7000e58d52cbe526cabd4e8a57c7f34313
SHA512 d983c250a52afbb814663646501c5ead3375ef734b481b7806e2f958be1c8a1a2d7baf7a2487757611b3e3ee3074e178b12f7175e7dc0d3add8ff38ec2b3ee75
SSDEEP 384:sxRqaqtm48/fos887QUzIy/5+lzXc4j6jpm:s+ltm48/fF7Qo/5kcBm
TLSH
T1C482E8566524997B8CDBD619F961BF23D7F8042396905E48AEFCCA0C01EB6FD220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 33KB
SHA256 4f61c109f71aaf77a32f5e14bad6cd4bc3782d7dcbb2ea0ddec082aee1715a13
MD5 9fac65c1b53b6f54e24ff46b964cc262
SHA1 d99de560495249572fcd6bd4d0beef2336e5bebd
SHA512 dc759226f2dbf650842f8c7c155c4a17028b6a031b10ef24f2406aa4f1e995beb4bd1149bddda611b5b1639b329406fa331b527799670fe146f691f4b20dc0ae
SSDEEP 384:sxRqFqtm48/fos88a66s8qMpRiYnazAW8pZS15posJWeT+8qQUwI4/5wl3d8T4jf:s+Utm48/fFa4Mnc7WeT+8qQ9/56AZm
TLSH
T146E2F846A824C8678EC39D18B87D7E33DAAC00525695DEDD5AFCCE0C019E1FDAB07867
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 be7e0acf867277904a1b4a803f931a5b0adfced19e5c1eb4a5aad51cb4e144ed
MD5 e856965f9cf9215270f849cf19455404
SHA1 662f8cd2ecc960146ab40ac8bf20856f2525d5e1
SHA512 aeba7338304048edbaf2e1db81a6ce1f2092c5b37939447f2bab0ee4260c3bfddd3c7d21d673bd789b4f5ae831c58e97fbbb6191f991cfdcbba79fb4b1c6c6ef
SSDEEP 768:JOVP+1WgesfBQ8F1+UoAYDCx9Tuqh0VfUC9xbog/OVxPE+AroXIhtAP:JOVP+1WgesfBQu1jawc+LitI
TLSH
T13CC2FB2B240CC77E4F844A9DEC2D7EDA6DD802CB5B988D5447EA990C03C77EB521A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000004.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000004.log
Size 1KB
SHA256 cfcd4521f21cf63ec2bb3bb7ba707612b8fda8751dbe1991de8eafaf291ec289
MD5 66198f99d0ec98b06f2e35ffa6516ea4
SHA1 0958803632a88506424e482d506fde8db46ac316
SHA512 c119786d4b76d49f797a3f7a594ec3b85c63a982adf50ceffc19248392929ed0eb3715574324d0e2d1dd02f2114c356824e563ea47c23d91a16d635eb63833d0
TLSH
T1E5215E807ABB5500D4E6203D52E04930F2BE32667698ABEE43A2031A2420584EA50F99
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 4ae54d4a2fb0e95adc80278bf7ead002799ae9ddd84336c36a9a5a845af74a4b
MD5 0636371d38c5c6201cc85d6f8ebf9a76
SHA1 43f1e546f350891e0c890e93ac09ddbe8cffbc3c
SHA512 b6c5ad629fad54a49456ffbd20deb33e41e10cfcedfb858872ad1d304297972f53bb2c0ffd9e0bb6dc181abd64d0db8f7f257c25925f282f6e0882ea741a2777
SSDEEP 96:KoTKKk0eaUQKV+rFSr/VPTXWbAOgHXK42gZXc9lYrj8HstY826b:UZrCFSr/VPTmbAvHN2gZM9lYrj8HstY0
TLSH
T16C919544B1BA2B00387D2C09A164D45A968230E7319AA47B3FF819E65FA7E415FFC5DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

6de95f70-1d7d-4abc-9d3b-1867f728d879.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\6de95f70-1d7d-4abc-9d3b-1867f728d879.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 21dc4a2dd2fb0a10a5a3238f6ac288c42148e4fe55438f2408d6c391409ec8df
MD5 1af96061311affc855ecfcc4ef3b0fa3
SHA1 4741159ca7ef9f159ca779cd2f4b3012b0657c15
SHA512 83817171e3a8880fcf057b88f11b77af2b2697fd145c8e1c0de087842faed620e37bd4ba2481098d313b508737d910bfe59304dc28e5f0de4df46ae981b31474
SSDEEP 384:psrv+89zHqlDNP9oidl38Nei+iK1KgaefQCvB5T9cP0RybqWUb69hVlLzm6ZFsq5:2rv+4UNbdl35OR2BsPYyDPm6MGjzJUyT
TLSH
T15803B031ACA4AE776CB3DA8571477B437FB4914386C51F849ADE2F4D028F96D130B8A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 d601505374b2c164a3b2a475663b65da4b876828661b6b3a79c564f200eeebb6
MD5 a4483139a28aca046d6cf8cbb14db4c3
SHA1 967d2bf7d9a74b882d51e767a9502f8e911da432
SHA512 66b008180a5f707ad556d3f0b6d4570376868ca9dcfa366e7febc481e8403ab45cf60c891a432e1534253919eac8ab915763e0bfa9bc0c5f803a17ecb2f749cf
SSDEEP 768:2j+9L3JLyR2BsPYyDPm6MGjzJUyDl8BvTPa/Z:l9L3OosQyDnMijDl0Wx
TLSH
T159F2BF319C906E771CA2DA8972473B476FE4915392C42E885ADD6F0E01CB72C23478B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 57494da1679820ea7622eff49f4a3c314f64134ba25bae93303e65c3e6cab5df
MD5 a9a30c13bc910c5ce2835e3b0d7a96bb
SHA1 b1a33b99e5f98b88e61dde3b8faaa0611ac6153b
SHA512 cf55f7c8310ca341ffd86538d1114f00cfff285c57c7dd3e779ca3e3ef4c79f72af3ef3075a0af9aacefcb12dd6214a29f70757f175733af226f2499e8a79a6e
SSDEEP 768:Vrv+4UNbdl3DdR2B9PYyDPm6MGjzJ8B3+8rY0n:Vbsbn3Lo9QyDnMigDrY6
TLSH
T18C03C0319C946A73ACF2CA85364B3B077FF4915396C50F8499DE1B4D429FA6D230B8A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 2d126ddbf5623d7fac27b57849deaf8d1ed2dd7aa83fae5ae8c1fac5ff29cdc9
MD5 d91db7781020bb7f26151b307c4101cf
SHA1 825b405a077951e93256aadcddff3195c387e0ef
SHA512 359f5afe04909d9955cb84c03387c8c2811e96b58cdeb44dd5ae1654b8656f1f27779817212a96d96d3f9a8476e91dc302102d814d1b9c227e093019f72adfdb
SSDEEP 768:dFtj+9Q3fwgrLyR2BFPYyDPm6MGjzJUyDl8BvTPa/Z:k9Q32oFQyDnMijDl0Wx
TLSH
T1841349F24CC3997ADC6E8B87633E2E065EBCC153B584299477D85A0DCD8B27FD206861
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 98613a6b8dbdd5946346d9b4511ba9852c6855b6b7069a3532c8a64a0ce6ccd5
MD5 99b71e907d222345a5823fe861410646
SHA1 d5df2d096521ab275614474cd8aebb122ae99ece
SHA512 c6e08e68dae233e78638dbe8bb4e6b66d052461c9c2d85e2af713d114622e271fca82bd3831ac85d4fc858327f1f568f3680b3ff33df8a15e6bf549dbaf52a3b
SSDEEP 768:dF9j+9y3swgGKR2BvPYyDPm6MGjzJUyDl8BvTPa/Z:M9y3yovQyDnMijDl0Wx
TLSH
T1071349F24CC3997ADC6E8B87633E2E065EBCC153B584299477D81A0DCD8B67FD206861
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 f0691106097b9e709ede1b34317c2841b2f64358dda6ebc51d28658ad584323c
MD5 f6f7d3de0bad6dcf9510b124c7e693c7
SHA1 f039fc284029e4cf487c60dbdd37ca247b6af123
SHA512 0ff3311af813a34ec3d7da8362b192d51958e5fc8978e6ae18250cf305f8f1e0c28b22bce20da54911870659298a885b7c4491286c0818c6ef4205009f0496b1
SSDEEP 768:rj+9L3COR2BsPYyDPm6MGjzJUyDl8BvTPa/Z:+9L3hosQyDnMijDl0Wx
TLSH
T115F2BF319C906E771CA2DB8972473B476FF4925396C42E889ADD6F0E01CB76C23478B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 7d263102a5fa9a52b6c0eb48aebd1349eb3b75c30def1567c58a3a882c0ed2b1
MD5 88bc0158061d8b3bc41481a78160d98e
SHA1 22e8d56f5de1548e61b74fefd4d6c2806b53d263
SHA512 89962e9d6a3e9455c987434da2d741eba6bde8835d23fb010b98822a45302a5e5224eac7bf0e1640e62c59b24a9385208923743bbeada03af74e24c2e1321227
SSDEEP 768:dFKj+913YwgnLyR2BSPYyDPm6MGjzJUyDl8BvTPa/Z:F9135oSQyDnMijDl0Wx
TLSH
T1631349F24CC3597ADC6E8B87633E2E065EBCC153B5842A9477D85A0DCD8B27FD206861
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 90d5f8333be1ffeca9126e8ce623b2d0ed5c5e27d5518c39a4d1bf89c150c8ad
MD5 ca74a800d1559889e5cff90420fb3949
SHA1 438d21cae051db16286ea7226f5df92be47282e1
SHA512 a83a9ca81569aa29f70bf6695d0c106c602d0c6d177c87ab33b258611f3e97a95119dc5ea9139f3c8eb854e0b8b7bab5c0d924ff59aa6eaaebba127d1d70c3c2
SSDEEP 768:dF1j+9T3Ywg3LyR2BTPYyDPm6MGjzJUyDl8BvTPa/Z:09T3xoTQyDnMijDl0Wx
TLSH
T1A6039E329C809E7B6CB2CF89B64B3657AEF091A3C5846E9497DD6F0D018B66C1347CB1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 92748a462d78df44902b977018f96785ffcf4ad62f869636cca7046ced24cc3e
MD5 dffa7b59de4f333a164c6bc2189fbc01
SHA1 cc753e9e0d09a30c63807e0373a2b53a349d21d5
SHA512 4696e43dc439be84af5f8e111ca0483c18751aaf6392a5d2ed9c96253f48e52d752660faa652d31a593b5abb1ad437f052d1eacf1ae7c926fb5e8b6eb024aa39
TLSH
T14BE00403A35005FAC06D473540971B2036F382B106F702098E6289682D673596EB0E81
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 fc6c1a73c87bb7b7a5594fbfd3cb97551ba83a2ae89f47f6c9a6ca8590a8787a
MD5 c22992c6424ef0cc434148c2df2add4c
SHA1 de83e1c99f10b13b4fb95a5d23439fdab4aaa7e7
SHA512 6259f1cf140a2d8d0a384fb43866ecaad0d302c7f035955e9292e766ec1a5721f356e931446a519a8d6efbb8644bd5fefb0250ab0d75c84031e73c0da6362139
TLSH
T1EEE00103A31001BAC06D433000931B202BE3C12106F6030A4A2045682C632597FB0E80
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 5780e8364457852e6fcfa44fff42fd181ae5180f326e2695df97b8dbc0224584
MD5 15dc2959e0af56aaa687df3accdf615a
SHA1 5e3f70b7d80bd8fb47f3438f69bff64acf1d16a6
SHA512 9b0619aa8d7899f8afa04f78c2bdb2f2b47b28b7a1f0b383fca50d9dc587f703bf2441cc00e3123ce6fe3de40a70a9300f24ee039d8771fc123f25003e0bef29
TLSH
T15FE00903A31005BBC06D433540971B203AF382B106F7020A4A3185682D633596EB0E80
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 159c5b60412f18ea4f383fcd5d385d93f5753965a75935a365cd248d90607cae
MD5 d1f7ed954af5fee18a8d9767398dbf14
SHA1 f4133280608434b685578a8fc199e1877b2fe053
SHA512 acd45dd9c9c5f56356ae661b009c6fb241e1b38a9523446f6395d2c34ae5fdc9e244f5e30517765f8dd0da4de66c5c2b6afce19feea512d91e2a8dbbb2704af7
TLSH
T180E00103A34004FAC06C0730409B0B243FF3C1B102F2030A4E30442C2D363543E70E80
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 cbcbae8143fde270b32d779b6afd292c4a85806706c7c81a382a51554a01cd4b
MD5 6185c6a8f1e6067396c70a724502bf45
SHA1 665f5ae823258e5e841b0e4417b95a6d3cacab5c
SHA512 0be672a7be0d0eb618aad9234ef0b961edce7c4207f7ca9f8b878c4512cd50383db2aff0d5840528173357317d9c07004445df79a3f631904bf75ca0f8763301
TLSH
T1ADE00103A35405FAC06D473541971B247AF7C17506F6020A4E7145686D767557E70E81
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 bd9e1fda9a33d356c601bb7105f5b0683fb804bfc8f01a312d5ed975e667781c
MD5 e00c87a3f60d8485d78b24cac3764f3b
SHA1 655285c7425b5eff935562c5d1d4d7f5476b793f
SHA512 e2b1590e0d0b287fd7f4bc8fd1f6c46a94905727dc63d13c959a94f443cd63c171898ee6420b9a883f616f014363c6baec2973925a6aa92eafaadb21a7511b90
TLSH
T136E00113A34004FAC06C0730409B0F243EF7C1B102F2020A8F30442C2D363543E70E80
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 d7f598d9f7b75b290b5e0fba43e0442e07b61c40743cb25878bade1d2ea7bd7c
MD5 35463970243ba6d242a2c341997fb8e7
SHA1 9e7b19dc744d63c3fa537b5a0a1fc36d99dc1e27
SHA512 dad245ecfbcff6ca58826ceec68bbaff2642bf0c2d77530e34fe6b3f79a532a9a2b45a1126ffe9cfb738d6bc9536a7ead9e7f14e7e1717750b6ea04fe6a84c9c
TLSH
T1EEE00202A3100195C055033000531B101BD3C121017603064A2041582C233192D60740
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 522da8e5320da18b2bdfb1f8004e7e837e3760629e6b1f518234c313023eaa18
MD5 451c0e38a44eff128048524e512a6f8a
SHA1 903c66c645ead62a4543dd3136e2907abf0bbc54
SHA512 6cd5add6e6cbc32d6d0d54343bc4955bd560f68735dd503fe1457046d2a6a30fb6e265ecce7137d5b6ab806e426659c375e5de5b07ca2aa3677abb8df07f89be
TLSH
T187E00203E31001B5C05D033000531B101BD3C13101F6030B4E3041583C233192D70F40
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe591e8a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe591e8a.TMP
Size 392B
SHA256 d825c022baa9fadf638b7c5a5ab16d8b07fa62173ac916be634c2950964f7952
MD5 c7edb7fbe7304b59a53bac597755929e
SHA1 2f78ec06f4daf9bcb2edc4c35143b797dcdd825e
SHA512 3a3fc30c00bff2bb9a39cefde6e8c4b5390f6504324a5d0cd73f7dbae9fad16bea488add27fd4d1adc9a1c236c0aea1fea1a6c6073b2622007b532ae6738579e
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter~RFe5e219f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5e219f.TMP
Size 392B
SHA256 733ba5a8b39bb524055397b4d4d7db860e635ada877eb376752cdf47579fa7d3
MD5 1a64ed28ff9167242efa89a7c241d895
SHA1 15a16dac1628bc2bb758640a1861a07943cbe8e9
SHA512 71711f23a5bea725fe2c96b097f3bca2443a395c76c1f224d05d414d03bc81d72263a58ab8fff79bf898f008b5686d133559cbd9fe29a969d39dd6c7e668de79
TLSH
T116E00403A35005FAC06D4735409B1F243BF382B106F7030A8E7289682D773597EB0E81
MD5 SHA1 SHA512 TLSH

Submit Download

6279c135-2976-490b-8973-a9ada87fa460.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\6279c135-2976-490b-8973-a9ada87fa460.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

first_party_sets.db

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\first_party_sets.db
Size 48KB
SHA256 f35a4f569a8d6e9a53c7abbb2fdca981cdaaf4108e2934925648d90000b72a42
MD5 29f0806ef1eab44a9cac51d6178104b2
SHA1 da9a041647bf896631ff9a3a1470aec96da1eeb0
SHA512 02d7f20c525765b0a77f7738b19fedba3472edd6c259dff60db5beb1f82ebbef1c72f48fa68ede5aaf452b953f8d1b959494e48c37cde60ada7cef9e322eec56
SSDEEP 24:TLL4/arHRH34kQrq+i7ZYZY5J+Qnj3k0rJXAeL3mkAD6W6Ivrr6Uw/sufL:To/IHRH34kWqB1kQnjhHmr6ITmUuL
TLSH
T14C23896EDA2CB9A1FEE40B3DD7D1D4127B36AA0EC2E4D9F1099B406746C540405EB63F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default.exc

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.exc
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

!Please Read Me!.txt

Path C:\Users\Admin\Downloads\!Please Read Me!.txt
Size 797B
SHA256 227082c719fd4394c1f2311a0877d8a302c5b092bcc49f853a5cf3d2945f42b0
MD5 afa18cf4aa2660392111763fb93a8c3d
SHA1 c219a3654a5f41ce535a09f2a188a464c3f5baf5
SHA512 4161f250d59b7d4d4a6c4f16639d66d21b2a9606de956d22ec00bedb006643fedbbb8e4cde9f6c0c977285918648314883ca91f3442d1125593bf2605f2d5c6b
TLSH
T1DC01F12EAD5572115BB2C572357DA197EA02925F022E0352B907C13917BC13655FE4F1
MD5 SHA1 SHA512 TLSH

Submit Download

CoronaVirus.exe

Path C:\Users\Admin\Downloads\CoronaVirus.exe
Size 1.0MB
SHA256 dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0
MD5 055d1462f66a350d9886542d4d79bc2b
SHA1 f1086d2f667d807dbb1aa362a7a809ea119f2565
SHA512 2c5e570226252bdb2104c90d5b75f11493af8ed1be8cb0fd14e3f324311a82138753064731b80ce8e8b120b3fe7009b21a50e9f4583d534080e28ab84b83fee1
SSDEEP 24576:FRYz/ERA0eMuWfHvgPw/83JI8CorP9qY0:FE/yADMuYvgP93JIc2
TLSH
T18F357D22E6A390F1C0652170BD6EB7FF99273C544F1889E7A3D4361C6AB01D10DFBA96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WannaCry.exe

Path C:\Users\Admin\Downloads\WannaCry.exe
Size 224KB
SHA256 be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844
MD5 5c7fb0927db37372da25f270708103a2
SHA1 120ed9279d85cbfa56e5b7779ffa7162074f7a29
SHA512 a15f97fad744ccf5f620e5aabb81f48507327b898a9aa4287051464019e0f89224c484e9691812e166471af9beaddcfc3deb2ba878658761f4800663beef7206
SSDEEP 3072:Y059femWRwTs/dbelj0X8/j84pcRXPlU3Upt3or4H84lK8PtpLzLsR/EfcZ:+5RwTs/dSXj84mRXPemxdBlPvLzLeZ
TLSH
T1A024015A7A61877FD0B20532746194FB4EFE0DD3F5A89A4FE74D0A501F048884BE3A9B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4532-893-0x0000000000400000-0x000000000056F000-memory.dmp

Download

memory/4532-867-0x0000000000400000-0x000000000056F000-memory.dmp

Download

memory/4532-5379-0x0000000000400000-0x000000000056F000-memory.dmp

Download

memory/26088-28296-0x0000000010000000-0x0000000010012000-memory.dmp

Download