Analysis
- geolocation tags
nanew-jerseynorth-americaunited-statesususa - user interaction
yes - max time kernel
186s - max time network
183s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
04/08/2026, 12:19
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://github.com/trasherwithadollarsign/Trashers-Malware-Repo/raw/main/Ransomware/CoronaVirus.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
31 signatures
150 seconds
General
- Target https://github.com/trasherwithadollarsign/Trashers-Malware-Repo/raw/main/Ransomware/CoronaVirus.exe
- Sample260804-phpghawwf1
Malware Config
Signatures
- Family: Dharma
Dharma is a ransomware that uses security software installation to hide malicious activities.
- Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Renames multiple (811) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Downloads MZ/PE file 1 IoCs
flow pid Process 25 4548 msedge.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation CoronaVirus.exe - Creates a file in the Startup directory 1 TTPs 5 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CoronaVirus.exe CoronaVirus.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini CoronaVirus.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-C23A67AB.[[email protected]].ncov CoronaVirus.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-C23A67AB.[[email protected]].ncov CoronaVirus.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta CoronaVirus.exe - Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
- Executes dropped EXE 10 IoCs
pid Process 3324 CoronaVirus.exe 1680 CoronaVirus.exe 34672 CoronaVirus.exe 6180 CoronaVirus.exe 53040 msedge.exe 28096 CoronaVirus.exe 30636 msedge.exe 31160 msedge.exe 31136 msedge.exe 31288 msedge.exe - Loads dropped DLL 11 IoCs
pid Process 53040 msedge.exe 53040 msedge.exe 30636 msedge.exe 30636 msedge.exe 30636 msedge.exe 31160 msedge.exe 31160 msedge.exe 31136 msedge.exe 31136 msedge.exe 31288 msedge.exe 31288 msedge.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\CoronaVirus.exe = "C:\\Windows\\System32\\CoronaVirus.exe" CoronaVirus.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Windows\System32\Info.hta = "mshta.exe \"C:\\Windows\\System32\\Info.hta\"" CoronaVirus.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Users\Admin\AppData\Roaming\Info.hta = "mshta.exe \"C:\\Users\\Admin\\AppData\\Roaming\\Info.hta\"" CoronaVirus.exe - Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
flow ioc 23 raw.githubusercontent.com 24 raw.githubusercontent.com 25 raw.githubusercontent.com - Drops desktop.ini file(s) 64 IoCs
description ioc Process File opened for modification C:\Users\Admin\Desktop\desktop.ini CoronaVirus.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini CoronaVirus.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini CoronaVirus.exe File opened for modification C:\Users\Public\Documents\desktop.ini CoronaVirus.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini CoronaVirus.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini CoronaVirus.exe File opened for modification C:\Program Files\desktop.ini CoronaVirus.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini CoronaVirus.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn2\desktop.ini CoronaVirus.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini CoronaVirus.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini CoronaVirus.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini CoronaVirus.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini CoronaVirus.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini CoronaVirus.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini CoronaVirus.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini CoronaVirus.exe File opened for modification C:\Users\Public\Desktop\desktop.ini CoronaVirus.exe File opened for modification C:\Users\Public\Music\desktop.ini CoronaVirus.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini CoronaVirus.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini CoronaVirus.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini CoronaVirus.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini CoronaVirus.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini CoronaVirus.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini CoronaVirus.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini CoronaVirus.exe File opened for modification C:\Users\Public\Libraries\desktop.ini CoronaVirus.exe File opened for modification C:\Users\Admin\Music\desktop.ini CoronaVirus.exe File opened for modification C:\Users\Admin\3D Objects\desktop.ini CoronaVirus.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Application Shortcuts\desktop.ini CoronaVirus.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini CoronaVirus.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini CoronaVirus.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini CoronaVirus.exe File opened for modification C:\Users\Admin\Documents\desktop.ini CoronaVirus.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini CoronaVirus.exe File opened for modification C:\Users\Admin\OneDrive\desktop.ini CoronaVirus.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini CoronaVirus.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini CoronaVirus.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini CoronaVirus.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini CoronaVirus.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini CoronaVirus.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-889581200-2041691093-2048517887-1000\desktop.ini CoronaVirus.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini CoronaVirus.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\desktop.ini CoronaVirus.exe File opened for modification C:\Users\Public\AccountPictures\desktop.ini CoronaVirus.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini CoronaVirus.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini CoronaVirus.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn1\desktop.ini CoronaVirus.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini CoronaVirus.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini CoronaVirus.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI CoronaVirus.exe File opened for modification C:\Program Files (x86)\desktop.ini CoronaVirus.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini CoronaVirus.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini CoronaVirus.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini CoronaVirus.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini CoronaVirus.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini CoronaVirus.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini CoronaVirus.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-889581200-2041691093-2048517887-1000\desktop.ini CoronaVirus.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini CoronaVirus.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini CoronaVirus.exe File opened for modification C:\Users\Admin\Links\desktop.ini CoronaVirus.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini CoronaVirus.exe File opened for modification C:\Users\Public\desktop.ini CoronaVirus.exe File opened for modification C:\Users\Admin\Videos\desktop.ini CoronaVirus.exe - Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\System32\CoronaVirus.exe CoronaVirus.exe File created C:\Windows\System32\Info.hta CoronaVirus.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\cacerts.pem CoronaVirus.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_OEM_Perp-ul-oob.xrm-ms CoronaVirus.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Word2019VL_KMS_Client_AE-ul-oob.xrm-ms.id-C23A67AB.[[email protected]].ncov CoronaVirus.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\api-ms-win-crt-multibyte-l1-1-0.dll CoronaVirus.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-256_altform-fullcolor.png CoronaVirus.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Car\RTL\contrast-black\LargeTile.scale-200.png CoronaVirus.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.contrast-black_targetsize-48_altform-unplated.png CoronaVirus.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-datetime-l1-1-0.dll.id-C23A67AB.[[email protected]].ncov CoronaVirus.exe File created C:\Program Files\VideoLAN\VLC\locale\pt_PT\LC_MESSAGES\vlc.mo.id-C23A67AB.[[email protected]].ncov CoronaVirus.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Locales\ml.pak.id-C23A67AB.[[email protected]].ncov CoronaVirus.exe File opened for modification C:\Program Files\Windows Media Player\wmplayer.exe CoronaVirus.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Runtime.Numerics.dll.id-C23A67AB.[[email protected]].ncov CoronaVirus.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\de\UIAutomationProvider.resources.dll CoronaVirus.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\bg_pattern_RHP.png.id-C23A67AB.[[email protected]].ncov CoronaVirus.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\selector.js.id-C23A67AB.[[email protected]].ncov CoronaVirus.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp3-pl.xrm-ms CoronaVirus.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Retail-ul-phn.xrm-ms.id-C23A67AB.[[email protected]].ncov CoronaVirus.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe.sig.id-C23A67AB.[[email protected]].ncov CoronaVirus.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\edge_game_assist\EdgeGameAssist.msix CoronaVirus.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\zh-CN\tipresx.dll.mui CoronaVirus.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftEdge.Stable_139.0.3405.125_neutral__8wekyb3d8bbwe\Logo.png CoronaVirus.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-64_altform-unplated_contrast-black.png CoronaVirus.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\OneNoteFreeR_Bypass-ul-oob.xrm-ms CoronaVirus.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Shims.dll.id-C23A67AB.[[email protected]].ncov CoronaVirus.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_dts_plugin.dll.id-C23A67AB.[[email protected]].ncov CoronaVirus.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Work\contrast-black\LargeTile.scale-125.png CoronaVirus.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppPackageSmallTile.scale-200_contrast-black.png CoronaVirus.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\TimerLargeTile.contrast-white_scale-200.png CoronaVirus.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\uk-ua\ui-strings.js.id-C23A67AB.[[email protected]].ncov CoronaVirus.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019VL_KMS_Client_AE-ul.xrm-ms CoronaVirus.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libsvcdsub_plugin.dll CoronaVirus.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\ScreenSketchSquare44x44Logo.targetsize-96_contrast-black.png CoronaVirus.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.targetsize-20_altform-unplated.png CoronaVirus.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxCalendarBadge.scale-200.png CoronaVirus.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\css\main.css CoronaVirus.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\sv-se\ui-strings.js.id-C23A67AB.[[email protected]].ncov CoronaVirus.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\en-gb\ui-strings.js CoronaVirus.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\ro-ro\ui-strings.js.id-C23A67AB.[[email protected]].ncov CoronaVirus.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Grace-ppd.xrm-ms.id-C23A67AB.[[email protected]].ncov CoronaVirus.exe File opened for modification C:\Program Files\Java\jdk-1.8\legal\jdk\relaxngcc.md.id-C23A67AB.[[email protected]].ncov CoronaVirus.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ComponentModel.EventBasedAsync.dll.id-C23A67AB.[[email protected]].ncov CoronaVirus.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\PresentationCore.resources.dll.id-C23A67AB.[[email protected]].ncov CoronaVirus.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\ScreenSketchSquare44x44Logo.targetsize-60_altform-lightunplated.png CoronaVirus.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\LinkedInboxLargeTile.scale-200.png CoronaVirus.exe File created C:\Program Files\Microsoft Office\root\Office16\MSVCP140_APP.DLL.id-C23A67AB.[[email protected]].ncov CoronaVirus.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SKY\SKY.ELM CoronaVirus.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.FileUtils.dll.id-C23A67AB.[[email protected]].ncov CoronaVirus.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.tr-tr.dll.id-C23A67AB.[[email protected]].ncov CoronaVirus.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\System.Diagnostics.PerformanceCounter.dll CoronaVirus.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Extensions\external_extensions.json.id-C23A67AB.[[email protected]].ncov CoronaVirus.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\updater.ini CoronaVirus.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ACE.dll.id-C23A67AB.[[email protected]].ncov CoronaVirus.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Data.DataSetExtensions.dll.id-C23A67AB.[[email protected]].ncov CoronaVirus.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\OutlookLogoSmall.contrast-black_scale-180.png.id-C23A67AB.[[email protected]].ncov CoronaVirus.exe File created C:\Program Files\Microsoft Office\root\Office16\OutlookAutoDiscover\YAHOO.COM.BR.XML.id-C23A67AB.[[email protected]].ncov CoronaVirus.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\IRIS\THMBNAIL.PNG.id-C23A67AB.[[email protected]].ncov CoronaVirus.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\server_lg.gif.id-C23A67AB.[[email protected]].ncov CoronaVirus.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription4-ppd.xrm-ms CoronaVirus.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TEXTCONV\WPFT632.CNV.id-C23A67AB.[[email protected]].ncov CoronaVirus.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\linesstylish.dotx.id-C23A67AB.[[email protected]].ncov CoronaVirus.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Security.SecureString.dll.id-C23A67AB.[[email protected]].ncov CoronaVirus.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNotePageMedTile.scale-150.png CoronaVirus.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\resources\strings\LocalizedStrings_fi.json CoronaVirus.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdVL_MAK-ppd.xrm-ms.id-C23A67AB.[[email protected]].ncov CoronaVirus.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CoronaVirus.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CoronaVirus.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CoronaVirus.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CoronaVirus.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CoronaVirus.exe - System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 4548 msedge.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier msedge.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe - Interacts with shadow copies 3 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 28504 vssadmin.exe 29104 vssadmin.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry msedge.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134303196236025163" msedge.exe - Modifies registry class 11 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-889581200-2041691093-2048517887-1000\{2B48574B-7CA3-4BB4-9E25-B64E288E7892} msedge.exe Key created \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902 msedge.exe Set value (str) \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox" msedge.exe Key created \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe msedge.exe Key created \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children msedge.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msedge.exe Key created \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings msedge.exe Set value (str) \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe" msedge.exe Key created \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children msedge.exe Key created \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage msedge.exe Key created \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ msedge.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3324 CoronaVirus.exe 3324 CoronaVirus.exe 3324 CoronaVirus.exe 3324 CoronaVirus.exe 3324 CoronaVirus.exe 3324 CoronaVirus.exe 3324 CoronaVirus.exe 3324 CoronaVirus.exe 3324 CoronaVirus.exe 3324 CoronaVirus.exe 3324 CoronaVirus.exe 3324 CoronaVirus.exe 3324 CoronaVirus.exe 3324 CoronaVirus.exe 3324 CoronaVirus.exe 3324 CoronaVirus.exe 3324 CoronaVirus.exe 3324 CoronaVirus.exe 3324 CoronaVirus.exe 3324 CoronaVirus.exe 3324 CoronaVirus.exe 3324 CoronaVirus.exe 3324 CoronaVirus.exe 3324 CoronaVirus.exe 3324 CoronaVirus.exe 3324 CoronaVirus.exe 3324 CoronaVirus.exe 3324 CoronaVirus.exe 3324 CoronaVirus.exe 3324 CoronaVirus.exe 3324 CoronaVirus.exe 3324 CoronaVirus.exe 3324 CoronaVirus.exe 3324 CoronaVirus.exe 3324 CoronaVirus.exe 3324 CoronaVirus.exe 3324 CoronaVirus.exe 3324 CoronaVirus.exe 3324 CoronaVirus.exe 3324 CoronaVirus.exe 3324 CoronaVirus.exe 3324 CoronaVirus.exe 3324 CoronaVirus.exe 3324 CoronaVirus.exe 3324 CoronaVirus.exe 3324 CoronaVirus.exe 3324 CoronaVirus.exe 3324 CoronaVirus.exe 3324 CoronaVirus.exe 3324 CoronaVirus.exe 3324 CoronaVirus.exe 3324 CoronaVirus.exe 3324 CoronaVirus.exe 3324 CoronaVirus.exe 3324 CoronaVirus.exe 3324 CoronaVirus.exe 3324 CoronaVirus.exe 3324 CoronaVirus.exe 3324 CoronaVirus.exe 3324 CoronaVirus.exe 3324 CoronaVirus.exe 3324 CoronaVirus.exe 3324 CoronaVirus.exe 3324 CoronaVirus.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 560 msedge.exe 560 msedge.exe 560 msedge.exe 560 msedge.exe 560 msedge.exe 560 msedge.exe - Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeBackupPrivilege 28704 vssvc.exe Token: SeRestorePrivilege 28704 vssvc.exe Token: SeAuditPrivilege 28704 vssvc.exe - Suspicious use of FindShellTrayWindow 45 IoCs
pid Process 560 msedge.exe 560 msedge.exe 560 msedge.exe 560 msedge.exe 560 msedge.exe 560 msedge.exe 560 msedge.exe 560 msedge.exe 560 msedge.exe 560 msedge.exe 560 msedge.exe 560 msedge.exe 560 msedge.exe 560 msedge.exe 560 msedge.exe 560 msedge.exe 560 msedge.exe 560 msedge.exe 560 msedge.exe 560 msedge.exe 560 msedge.exe 560 msedge.exe 560 msedge.exe 560 msedge.exe 560 msedge.exe 560 msedge.exe 560 msedge.exe 560 msedge.exe 560 msedge.exe 560 msedge.exe 560 msedge.exe 560 msedge.exe 560 msedge.exe 560 msedge.exe 560 msedge.exe 560 msedge.exe 560 msedge.exe 560 msedge.exe 560 msedge.exe 560 msedge.exe 560 msedge.exe 560 msedge.exe 560 msedge.exe 28468 mshta.exe 28392 mshta.exe - Suspicious use of SendNotifyMessage 32 IoCs
pid Process 560 msedge.exe 560 msedge.exe 560 msedge.exe 560 msedge.exe 560 msedge.exe 560 msedge.exe 560 msedge.exe 560 msedge.exe 560 msedge.exe 560 msedge.exe 560 msedge.exe 560 msedge.exe 560 msedge.exe 560 msedge.exe 560 msedge.exe 560 msedge.exe 560 msedge.exe 560 msedge.exe 560 msedge.exe 560 msedge.exe 560 msedge.exe 560 msedge.exe 560 msedge.exe 560 msedge.exe 560 msedge.exe 560 msedge.exe 560 msedge.exe 560 msedge.exe 560 msedge.exe 560 msedge.exe 560 msedge.exe 560 msedge.exe - Suspicious use of WriteProcessMemory 56 IoCs
description pid Process procid_target PID 560 wrote to memory of 548 560 msedge.exe 87 PID 560 wrote to memory of 4548 560 msedge.exe 88 PID 560 wrote to memory of 5044 560 msedge.exe 89 PID 560 wrote to memory of 5044 560 msedge.exe 89 PID 560 wrote to memory of 5044 560 msedge.exe 89 PID 560 wrote to memory of 4604 560 msedge.exe 90 PID 560 wrote to memory of 4604 560 msedge.exe 90 PID 560 wrote to memory of 3816 560 msedge.exe 91 PID 560 wrote to memory of 3816 560 msedge.exe 91 PID 560 wrote to memory of 3816 560 msedge.exe 91 PID 560 wrote to memory of 1532 560 msedge.exe 92 PID 560 wrote to memory of 1532 560 msedge.exe 92 PID 560 wrote to memory of 1532 560 msedge.exe 92 PID 560 wrote to memory of 916 560 msedge.exe 94 PID 560 wrote to memory of 916 560 msedge.exe 94 PID 560 wrote to memory of 916 560 msedge.exe 94 PID 560 wrote to memory of 3764 560 msedge.exe 95 PID 560 wrote to memory of 3764 560 msedge.exe 95 PID 560 wrote to memory of 3764 560 msedge.exe 95 PID 560 wrote to memory of 4324 560 msedge.exe 98 PID 560 wrote to memory of 4324 560 msedge.exe 98 PID 560 wrote to memory of 3520 560 msedge.exe 99 PID 560 wrote to memory of 3520 560 msedge.exe 99 PID 560 wrote to memory of 4704 560 msedge.exe 101 PID 560 wrote to memory of 816 560 msedge.exe 100 PID 560 wrote to memory of 4704 560 msedge.exe 101 PID 560 wrote to memory of 4704 560 msedge.exe 101 PID 560 wrote to memory of 816 560 msedge.exe 100 PID 560 wrote to memory of 1264 560 msedge.exe 102 PID 560 wrote to memory of 4712 560 msedge.exe 103 PID 560 wrote to memory of 4712 560 msedge.exe 103 PID 560 wrote to memory of 2412 560 msedge.exe 105 PID 560 wrote to memory of 3324 560 msedge.exe 106 PID 560 wrote to memory of 1680 560 msedge.exe 112 PID 3324 wrote to memory of 3164 3324 CoronaVirus.exe 113 PID 560 wrote to memory of 34672 560 msedge.exe 116 PID 560 wrote to memory of 6180 560 msedge.exe 117 PID 560 wrote to memory of 47196 560 msedge.exe 118 PID 560 wrote to memory of 47204 560 msedge.exe 119 PID 560 wrote to memory of 47212 560 msedge.exe 120 PID 3164 wrote to memory of 11432 3164 cmd.exe 125 PID 560 wrote to memory of 53040 560 msedge.exe 127 PID 560 wrote to memory of 53040 560 msedge.exe 127 PID 3324 wrote to memory of 27884 3324 CoronaVirus.exe 129 PID 3324 wrote to memory of 28468 3324 CoronaVirus.exe 133 PID 3324 wrote to memory of 28392 3324 CoronaVirus.exe 134 PID 3164 wrote to memory of 28504 3164 cmd.exe 135 PID 27884 wrote to memory of 28620 27884 cmd.exe 136 PID 27884 wrote to memory of 29104 27884 cmd.exe 141 PID 560 wrote to memory of 30636 560 msedge.exe 146 PID 560 wrote to memory of 31160 560 msedge.exe 147 PID 560 wrote to memory of 31160 560 msedge.exe 147 PID 560 wrote to memory of 31136 560 msedge.exe 148 PID 560 wrote to memory of 31136 560 msedge.exe 148 PID 560 wrote to memory of 31288 560 msedge.exe 149 PID 560 wrote to memory of 31288 560 msedge.exe 149 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/trasherwithadollarsign/Trashers-Malware-Repo/raw/main/Ransomware/CoronaVirus.exe1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:560 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7fff9a44c188,0x7fff9a44c194,0x7fff9a44c1a02⤵PID:548
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1980,i,3688112293917464799,6035857772388963530,524288 --field-trial-handle=2068,i,3254780943549599603,7468794451651341264,262144 --variations-seed-version --mojo-platform-channel-handle=2120 /prefetch:32⤵
- Downloads MZ/PE file
- System Time Discovery
PID:4548
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1660,i,6838665628534723321,18032356394368007555,262144 --field-trial-handle=2068,i,3254780943549599603,7468794451651341264,262144 --variations-seed-version --mojo-platform-channel-handle=2064 /prefetch:22⤵PID:5044
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2596,i,5071989114869091783,5586742133289083504,524288 --field-trial-handle=2068,i,3254780943549599603,7468794451651341264,262144 --variations-seed-version --mojo-platform-channel-handle=2760 /prefetch:82⤵PID:4604
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3464,i,5945797089981119283,15233604896918147303,2097152 --field-trial-handle=2068,i,3254780943549599603,7468794451651341264,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:12⤵PID:3816
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3468,i,12045175468645913188,18443930346486757401,2097152 --field-trial-handle=2068,i,3254780943549599603,7468794451651341264,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:12⤵PID:1532
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4276,i,4733065979261318579,15729466896339356647,2097152 --field-trial-handle=2068,i,3254780943549599603,7468794451651341264,262144 --variations-seed-version --mojo-platform-channel-handle=4320 /prefetch:22⤵PID:916
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4264,i,14897863193492183301,18162924137595015092,2097152 --field-trial-handle=2068,i,3254780943549599603,7468794451651341264,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:12⤵PID:3764
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5136,i,8105175830911094796,10467692466843417840,524288 --field-trial-handle=2068,i,3254780943549599603,7468794451651341264,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:82⤵PID:4324
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5144,i,1717513748056544089,16562310932933853345,524288 --field-trial-handle=2068,i,3254780943549599603,7468794451651341264,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:82⤵PID:3520
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5692,i,543462608243237946,6631237490415426718,524288 --field-trial-handle=2068,i,3254780943549599603,7468794451651341264,262144 --variations-seed-version --mojo-platform-channel-handle=5744 /prefetch:82⤵PID:816
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5716,i,3738319580509584241,10436238473148700010,2097152 --field-trial-handle=2068,i,3254780943549599603,7468794451651341264,262144 --variations-seed-version --mojo-platform-channel-handle=5752 /prefetch:12⤵PID:4704
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6032,i,10568845836445832937,12954376971142960752,524288 --field-trial-handle=2068,i,3254780943549599603,7468794451651341264,262144 --variations-seed-version --mojo-platform-channel-handle=5232 /prefetch:82⤵PID:1264
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6224,i,14852300458593707566,4477424795673154771,524288 --field-trial-handle=2068,i,3254780943549599603,7468794451651341264,262144 --variations-seed-version --mojo-platform-channel-handle=6212 /prefetch:82⤵PID:4712
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6648,i,2029270703857360461,16181902177078949592,524288 --field-trial-handle=2068,i,3254780943549599603,7468794451651341264,262144 --variations-seed-version --mojo-platform-channel-handle=6624 /prefetch:82⤵PID:4904
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6648,i,2029270703857360461,16181902177078949592,524288 --field-trial-handle=2068,i,3254780943549599603,7468794451651341264,262144 --variations-seed-version --mojo-platform-channel-handle=6624 /prefetch:82⤵PID:2412
-
-
C:\Users\Admin\Downloads\CoronaVirus.exe"C:\Users\Admin\Downloads\CoronaVirus.exe"2⤵
- Checks computer location settings
- Creates a file in the Startup directory
- Executes dropped EXE
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3324 -
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:3164 -
C:\Windows\system32\mode.commode con cp select=12514⤵PID:11432
-
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet4⤵
- Interacts with shadow copies
PID:28504
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:27884 -
C:\Windows\system32\mode.commode con cp select=12514⤵PID:28620
-
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet4⤵
- Interacts with shadow copies
PID:29104
-
-
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"3⤵
- Suspicious use of FindShellTrayWindow
PID:28468
-
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"3⤵
- Suspicious use of FindShellTrayWindow
PID:28392
-
-
-
C:\Users\Admin\Downloads\CoronaVirus.exe"C:\Users\Admin\Downloads\CoronaVirus.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1680
-
-
C:\Users\Admin\Downloads\CoronaVirus.exe"C:\Users\Admin\Downloads\CoronaVirus.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:34672
-
-
C:\Users\Admin\Downloads\CoronaVirus.exe"C:\Users\Admin\Downloads\CoronaVirus.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6180
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6312,i,6076665863920591581,3420797946803363798,524288 --field-trial-handle=2068,i,3254780943549599603,7468794451651341264,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:82⤵PID:47196
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6880,i,14966907388571328177,12098555712142849392,524288 --field-trial-handle=2068,i,3254780943549599603,7468794451651341264,262144 --variations-seed-version --mojo-platform-channel-handle=6832 /prefetch:82⤵PID:47204
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6876,i,4716985629232848424,4650575843326490854,524288 --field-trial-handle=2068,i,3254780943549599603,7468794451651341264,262144 --variations-seed-version --mojo-platform-channel-handle=7084 /prefetch:82⤵PID:47212
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5460,i,16031866798135606958,7545619554805517947,524288 --field-trial-handle=2068,i,3254780943549599603,7468794451651341264,262144 --variations-seed-version --mojo-platform-channel-handle=4552 /prefetch:82⤵
- Executes dropped EXE
- Loads dropped DLL
PID:53040
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6852,i,3054080728563797777,13521292159266658041,262144 --field-trial-handle=2068,i,3254780943549599603,7468794451651341264,262144 --variations-seed-version --mojo-platform-channel-handle=6640 /prefetch:82⤵
- Executes dropped EXE
- Loads dropped DLL
PID:30636
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5580,i,7504316274399811351,1494209599197915665,524288 --field-trial-handle=2068,i,3254780943549599603,7468794451651341264,262144 --variations-seed-version --mojo-platform-channel-handle=6032 /prefetch:82⤵
- Executes dropped EXE
- Loads dropped DLL
PID:31160
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3984,i,13674066293892143673,9858533233353069440,524288 --field-trial-handle=2068,i,3254780943549599603,7468794451651341264,262144 --variations-seed-version --mojo-platform-channel-handle=5696 /prefetch:82⤵
- Executes dropped EXE
- Loads dropped DLL
PID:31136
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5612,i,863793607222511260,10966521282126686010,524288 --field-trial-handle=2068,i,3254780943549599603,7468794451651341264,262144 --variations-seed-version --mojo-platform-channel-handle=5484 /prefetch:82⤵
- Executes dropped EXE
- Loads dropped DLL
PID:31288
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵PID:1976
-
C:\Windows\System32\CoronaVirus.exeC:\Windows\System32\CoronaVirus.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:28096
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:28704
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:29576
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Defense Evasion
Direct Volume Access
1Indicator Removal
2File Deletion
2Modify Registry
1Credential Access
Credentials from Password Stores
2Credentials from Web Browsers
1Windows Credential Manager
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
AppvIsvSubsystems64.dll.id-C23A67AB.[[email protected]].ncov
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems64.dll.id-C23A67AB.[[email protected]].ncov
- Size 3.2MB
- SHA256 5796c7b03f44b3fe6054a9dd3de75bf283c7eb35da3ef9cf787e8767ba7e8dde
- MD5 653fd295e028092381399e8e86321269
- SHA1 754f86359ef898caf2849097561edd3b56916b57
- SHA512 35ab1c0c233d8f78ed745e2ae0d9fd166d32c2dfed4e46bbc63ad5fb9d8e57df70fd04d71ed270490f504fef99131070b9abbc1696be1615538857878ddc9f24
- SSDEEP 49152:hyMMVOyDubPCRa35gZfYQuZjlbd5KYHJWLnDHB:avunxQubdxHSrB
- TLSH T167F59D29BBACC1A4C0BAC13959E3C68AF77134550F39F7EB5161425E2E337E1463A722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\34c4160c-28df-4a85-921e-f9559062953c.tmp
- Size 22KB
- SHA256 371ef68c604b15e015eb0c297ae2d1a17272b86ece6713766704e8c4d929d916
- MD5 d3094ece43e4963e4181d4afd504e25a
- SHA1 590ad0bae747d5652329ceca3372949d34204a1e
- SHA512 e11b8878908952e7285314ffc6037fbcb5461df3b38871f226c36887492d47718834e9261cb651f5dced5688500706628893f2f02304b56d4982708258cdfb4a
- SSDEEP 384:IiF0ZcI8sNi8TUNTUlIlDtKzif1UWe+C5ddJrHfXK9Li6Uq58bhP+8vBuh:TFy8BwgaGUhhzhHfwLwdBuh
- TLSH T140B27C72586498BB6DBAA745F80A3217CEF490B7D6C5AE90E6DD5E0C01DB1EC130AC26
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\2c551ae4-ee76-49d6-bf8c-c3d5a35d607d.tmp
- Size 105KB
- SHA256 acf2ca2fd979c7d8ae7b74bb0af4308e4abd3e42e1f32fd1a04b0ca1a2b166c8
- MD5 80eaf72bc0ff9c89a5c23f07f38ee8f5
- SHA1 cbf109666417a1db022b3f49a91481b9755a1b8e
- SHA512 b21d0ebff096128eae96a603cc0e96af95cbca34e613c40faa0cc8c5c17961106d997b66011c3051ead599494bd80939479f2526a2e65ff25600b04b19065afd
- SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7T:fwUQC5VwBIiElEd2K57P7T
- TLSH T15EB3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
- Size 16KB
- SHA256 452a5479b9a2e03612576c30d30e6f51f51274cd30ef576ea1e71d20c657376f
- MD5 cfab81b800edabacbf6cb61aa78d5258
- SHA1 2730d4da1be7238d701dc84eb708a064b8d1cf27
- SHA512 ec188b0ee4d3daabc26799b34ee471bee988bdd7ceb011ed7df3d4cf26f98932bbbb4b70dc2b7fd4df9a3981b3ce22f4b5be4a0db97514d526e521575efb2ec6
- SSDEEP 12:biUXhV0xosU8xCe+JKlkQuMRxCb8ZXfgYJ0IJpP0KLsyW1L7Fx6:bFRqxosU8xWMk8xVZ4YWI30otWn
- TLSH T14F724986B34494EFC883597189BD17903374F6EE5F02839B6A267A0E2E271C44F44220
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 280B
- SHA256 11d3c4c52f9fc9cd2b10a22b48769759f994fd6364f9a0fc145f4cd2c2a22e9d
- MD5 4751cf705a737c4226029624bf43b9a8
- SHA1 fd8cf726ee3f8f75b97147829de5553530caa82c
- SHA512 46e3fedbf7fa14bdc2b3aad129f2879a9d24252f5d7bd9b55766bc32a6b82ea77aaf193bcdbdf4423e3b67ef84955e589b6077609344091ef72204c1d50b0dab
- TLSH T17ED09B307A58A58BD14360F1A4114B4115375557205397757521508E9E98055B3CA057
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 280B
- SHA256 701082e4ac35f878dc5ff6eb27989aae9d20d9b5662643e20b3acd1720b367fc
- MD5 2b3686986ce1fd99f079eb226e8b0a8b
- SHA1 0d2cdee36351378b91ed7f6ecdb43457fe4d7b5d
- SHA512 937da61c495fd21a02bb76a63556dec83ce132f1d1830ff8d9af6212d15f1844766dd4abadd15ea61b48f8ae03b52baca44c99117714c705da840dbff8f116dd
- TLSH T182D09B303A58A98BD54360F1A4104B41153755572053D7757521508E9E99095B3CA057
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 3KB
- SHA256 fce212d1ddb8fb704ed15cc81e6f80d5cb1038094c4804c9ca7812193c450824
- MD5 7e6a13589076a9fed95146c1041ef651
- SHA1 09300a9bfd126af1d4b265cf4a5845ebaba6c7e9
- SHA512 88a030ba3c28d07765f6cd4991f6ce2381500cdaeda778786f86327b785c4bbd6d6e2869c3d0598a7870152c9cda9a03dbf538d9e10883792dfbf4032bc138f5
- TLSH T129614EB449310FA1FBC1807F50F3D249357086D6F9172E7AD050A6785E3EF6AA11AD1D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58ab6e.TMP
- Size 3KB
- SHA256 a7676111eb6201792656e1bde371b16b91c694fa85fe93a89b6f6c168e2a9c1f
- MD5 e27d30f2fac5e5573aa0f81c27d74b85
- SHA1 10ddcf1ab24b4e88156db77ad25dda9efb9009fb
- SHA512 0cf27d2dba60e64b94657afaac70cafd56c81ac5196949c1795d17a2cbadf7cdbf657c67fd666175db65462ae78f90861381d8ed0f2f56222f8b4318fd4836bb
- TLSH T16D614EB449310FA1FBC1807F94F3D209357086D6F8172E7AD05066785E3EF6AA11AD1D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Collections\collectionsSQLite
- Size 72KB
- SHA256 846d4b3ed5153cb6d5176d30d84ce9f5fb9918365d6cbfb5d519a1070ac26094
- MD5 24d04a6ce2b8e31dca9aa73c610683d9
- SHA1 bdc346b650eb755e2d3833a538f5e0a7c2b16fe5
- SHA512 b298abfd55ac38690cad81ab44576fd89d3fb6dfdca3e0316e083ed3296e3bb7bd859081ce7fd3f3b73edbb5356a9fec04723139e5c67d94ae744dd7916567e9
- SSDEEP 96:RR94jweGq2L4H7pgNPdQyoDbel9myJrDVb4:/94ZBS4FgNPdPl9myRDVb4
- TLSH T1CA739D5A29143731C5BEB339CD93A0E21D3DA16ECF90E51178A8D9148DB0AF3A0A795A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
- Size 2B
- SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
- MD5 99914b932bd37a50b983c5e7c90ae93b
- SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
- SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
- Size 70KB
- SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
- MD5 efe54a870e0f5ff28d7e00036b861065
- SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
- SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
- SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
- TLSH T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db
- Size 32KB
- SHA256 5ac72fe98c288cbac77983920e7e9e9b4fe91a8667601f8ee2e4473fc8e9dfa0
- MD5 e67f39b1713d53c263acddbf766bc26e
- SHA1 7273f625c352f8ec7b4e26005c4c28bb85556b3f
- SHA512 d65c7ca5ea443bee1b2377faba747daeb2368be402fe213943da5c921c33722f1665ac8c78982835d5e97b17151a5c1455f6eef25247c5a61372773804ba5189
- SSDEEP 24:TLAga0Zb7OaIbz+UOxUDDNzWjJ0npnyX7y+jLkIwMHW5LKIwMz7K5fKFtI1w7wc+:Tyi+7f+UZD4jJ/BBHWx3/CKFOm0cTpY
- TLSH T156E2F14D3B11F511C8FD773DA0C2C6F05EBC696C864D71B1923C99768D636A2F49E10A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
- Size 204KB
- SHA256 c3a43d979b3ec8adc1e6a3f106f15ba0c8b7f260af194796cee9430f31769f31
- MD5 8d46ae4a21361d94e633ab4b60658019
- SHA1 31219d2a6fda02600a4441d8f16cf2496140a06f
- SHA512 9bca63610a93cf1addd0c064a7c3e6765d3c1c9cea2c746a803ae8c885908ec46fd7114c38045b6e075d2e68d97c100597bb1094a40297852419159c16aefd11
- SSDEEP 96:nXfQ/IU+bGz83uy3+u4tgp4DLjGQLBze9z39jBHMsDEuspU0wbtqrOQpPfR4J+M2:nXfef+G83uy3Ct7XBBKjH7DXspU3i
- TLSH T15E14011E5F342721CDBD917669E644B35D7CF03FCB5366CA68A104B4CEE2652A02C8BE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History-journal
- Size 8KB
- SHA256 a32caf2ea2a4cd9746fa25f4cd318d401f07d431795338d3493a2583ca7360d2
- MD5 310b4d571b209108092baa458bdacfc0
- SHA1 38db886fb8c0e2c469f3239460ca7d93904d5a65
- SHA512 bbbb08c2fc633221e80d4359b0eaaa6aa8b1530e435934dc5bba1e32c2db4eb00201a887fc7599bc645aa382f4326ce98e39de763bf94ebd50ae2ed087ec2427
- SSDEEP 3:Z/2lFlljq7A/mhWJFuQ3sVkWUHEdwenqFtjE9SFcTpz0WWaV1vGrV9RUI0zJ:8E7nVktEd4FS99pzTB1eBY
- TLSH T1910212C18B61A973EC499B3DE28641E82F72290E89A1D802C018CC620E149C8D29895E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
- Size 111B
- SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
- MD5 285252a2f6327d41eab203dc2f402c67
- SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
- SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
- TLSH T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 12KB
- SHA256 a694ff09aca00c3dd7f9c045b1254038c195570df7a9fb41fef00191b9d9a4ad
- MD5 b15d735147d14095707945f6463d30ea
- SHA1 ae26bcaffd48f1aaf2f765b664abbb45f61705a0
- SHA512 14c915f53156c10a9d6797eef4162cc303e2b3b7e47f73d3da873d44e981054c462332e3ea71783da83580889309592fb10ebf11608d3708d6567465e663488f
- SSDEEP 192:sxZ+R3yM/jK1Ml8M9c/fNsCaCzIdpJHW6+WNGY9Io28yZIgrJ:sxZ+T1c/fNsCaPJHbGj9
- TLSH T1BE4209116A346977CCCBD309FA457F53D6F55472A2900E54A9FCDA1C00E7AED220782F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 12KB
- SHA256 2431c16fcd44e9179ccdf32f84deef43b48745e3d62cdfd099a1fdfd5a225594
- MD5 b9c16322990e3abbe28b8a961396d821
- SHA1 f0b5fc359f7c8d3d9d6e2f28ad0cb87e8c54e138
- SHA512 f09ab96ec6deca601742044c68f875c08ee48ab0cb47f847b1b028c8be9f0181cc2cd47e4ee1857f13e01c773d0b622a7a399f54767dd5cba19adce5b8fec2a5
- SSDEEP 192:sxZ+R3yM/jK1Ml8MDc/fNs8gCzIdpJHW6+WNGY9IA2oyZIg5XJ:sxZ+T7c/fNs8gPJHbGH3
- TLSH T1824209116A346977CCCBE209FA457F53D6F55472A2900E58A9FCDA1C00E7AED2217C2F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 13KB
- SHA256 4ee3cb45ba34835ff87ed6c64f1bf45a52c484951178bf1c71bf3f48c1ded43e
- MD5 6ab48b7c1dbbd639a0ec3fb4c055400e
- SHA1 5206f5b022b1c796e28c1357d535e37351e3d779
- SHA512 7e907729def357fb3341a3db70157702d09ddd1801b397b8ea586e2f348391b5944fde6f4813bded5826a647c615be3ec6972b927ce11ba164c7cc486e3e39d8
- SSDEEP 192:sxZ+R3yM/jK1Ml8UQAbc/fNs8gCzIdpLHW6+WNGY9Iw23yZIg5XJ:sxZ+Tq8c/fNs8gPLHbGM3
- TLSH T139521B12AA345977CCCBE20DFA517F53D6F55472A2900E54A9FCDA1C00E7AED221782F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RFe5a567e.TMP
- Size 13KB
- SHA256 69cc4851fab5927bbd49c569024c5505783f08e338f1db1f6b0d3e4b1b310ce0
- MD5 603fdc76b78a8a4e4a9f392c3bd82fb6
- SHA1 da9ae5967060b2990e40cf4cbdf0db9e2732c008
- SHA512 0b16e10007fddcb16520dc1ac2a1c7a619342ce5fd65d755e4d7005a70d419fa882e8c99421c75e007d5f3233f5e4357b83b5747079a93969397045cc0d9d1bd
- SSDEEP 192:sxZ+R3yM/jK1Ml8Mbc/fNs8gCzIdpLHW6+WNGY9Iw23yZIg5XJ:sxZ+TDc/fNs8gPLHbGM3
- TLSH T136521A12AA345977CCCBE20DFA457F53D6F55472A2900E58A9FCDA1C00E7AED220382F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
- Size 30KB
- SHA256 0e972defa1d3cd63c2f42f41235ddc22978ce2e00071bd77f66b4f48eeb67618
- MD5 1109cff9473556bc325a3e999bafd67b
- SHA1 67be41f9de864d40a09e94a1ee14f991f5c794b2
- SHA512 a104569f3f6a1401c7c6d5aabfff0d474f9e7e145132965c999d22222e65971498b1a96fb2c83b18dd227fb89ddf2841885a76dde5397d670402938cd2ba03d2
- SSDEEP 768:lycv21wWvu+Z+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjFLlwmWNEroDg6g:lycv21wWvu+Z+u1jaeFLeRNPDQ
- TLSH T1F3D21B2B280CCB7E4F841E9CED2A6F9A6DD801CB57988D5447FA484C03C77EB511B59B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
- Size 4KB
- SHA256 75af9289f34d6bf2fb28ff7233ba50d662ceed5dfa1c9000808d4b61c10dff6d
- MD5 4a41e8244ed1b3c441236b1e44e3280d
- SHA1 528dfcb4f5865cca050cf3045ec6ee189eabfa8f
- SHA512 72edb21ce2bd1ecabb9ff73dc115a2f39c7a796d4a452c129da559574e25babbd5b0531632740e5e53f6c2a201206fe84ded44681c1bdacef83bac817c2d8254
- SSDEEP 96:KaRklRnHnqlPKZThqKLfTzqHxJSrBDKakKDqCC84KxeY:mT3PTj
- TLSH T11A911406303B128228FD7948A752963A4F4232677818E47F7FB900A56E6BF152DFD4DD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-wal
- Size 3.9MB
- SHA256 9d54fc70b289bc844b51d3c72c7ffcf2025910f3417b9250e5bd76026d1dc660
- MD5 6e6e2171e907870185154cfc05090c3e
- SHA1 590af6610e6555bd44246d2a35fecae33685c229
- SHA512 3e50b1e635b65e4266bcbb015b108fb9cf0da4c2351955e5f786c85250a5bc5eccd52b4ead863c2c1e0cbac433d35da4d48a90f943442f7ffc10dd63623f8826
- SSDEEP 6144:NtOmZ/nIg2nT5DNA3MA9O6ywCvtAZJxxlQgf8vVtjj7+ZFRVKjZUm6Dac5P3joZF:9/nIg2nT5DNA3MA9O6s3
- TLSH T14316A8FF7C1A51AAEACD9038D417EE4550734232B624D8D4AE3D58C3BB78902FDB4989
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 20KB
- SHA256 9b1d0ff9e24398720b8e438a80b60cf763607d73fecec4882c2970f73e19bd0d
- MD5 3f1b1f6bcabe6456e632daa442cff8e2
- SHA1 4350c0fb3a705fb0d4d9551a4db94b1bd3342474
- SHA512 3f4a8d3e3550fd377f1dec6ac7c03e5312b6b8589fea105968f6a200bf1eace05741e4eda82cc1d65e79f929084311fd7063a26cda3331138b808a2bd8503943
- SSDEEP 384:PZcIRsNHhtKziV1UWe+C5ddJrmfXK9Li6Uq58bhP+8vBuh:HRB0UhhzhmfwLwdBuh
- TLSH T10C928D71587428BB59AAF245F80736178EF89077E7C96F80D5ED6F0D01DE6AC230A827
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 20KB
- SHA256 ac0dc0bdd82d9f3d9f384a6ae88520b14f040dcad3499a61eacfd87513209b08
- MD5 492afe7dee6954bae169be993ea7b792
- SHA1 26214ef0c47e6f53dcca724ea23183a1859ec608
- SHA512 5ff370ef276a7173d8e76b23b497a13a09fa63d9e86a0457ba5047760f938d74849b3e9a4a71b6599d40ef8d3a859e978f98603322c274da54cfe0dfb11c0158
- SSDEEP 384:eZcIbsNH/tKzigi1UWe+C5ddJrmfXK9Li6Uq58bhP+8vBuh:cbXPyUhhzhmfwLwdBuh
- TLSH T1A0927D71687428BB59EAF245F80736178EF89077E7C96F80D5ED6F0D01DA6AC2306827
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 20KB
- SHA256 255cb8539c6f550413137d18bc008d2fb30ff7d0a258b9642466eb8f29192f32
- MD5 25db4efa790602474251b8262c2a1141
- SHA1 8045c06ec652405bf043e14f14a2bf106dee1374
- SHA512 5f0f93f6fdb02ccd740395a5a27eab0508f0b250822306fc8c18d3f9ac83381b150b7c0e430f8e3b5db5f98d3e79c79464f6d2c3ee5300e00abef4ca34f6b1ab
- SSDEEP 384:PZcIcsNH0tKziU1UWe+C5ddJrmfXK9Li6Uq58bhP+8vBuh:Hc2/UhhzhmfwLwdBuh
- TLSH T181927D71587428BB59AAF245F80736178EF89077E7C96F80D5ED6F0D02DA2AC2306827
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 8KB
- SHA256 1b96f9cb1d4e323cb244a6adaea1d04d8bf7c52e550b913715362791516ff256
- MD5 78fb15e4c26d6a1414fbce01697c4987
- SHA1 6e8f3f141ca6a63bc3829a842306aca13776bec4
- SHA512 69b298a74df4e2d1946eaeb92de52f4a208f23d4f8f4d5bc96e492d7bc37b3f2f3ed65543166314696abf0ac127cf48840f2fb961a19d1af04b78392105c9e97
- SSDEEP 192:JONw6v+YLNQmiUycBZh+CG3+Fdeqmpvus8OU6:JONw6vz/rZh+C5da/U6
- TLSH T11B02FA35A8782C7B9BB2AE45F48737135FA82177EA912F84DAD82F1D01D775C2302827
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 8KB
- SHA256 daf0afd12cf9999332f1192a5a1606691c0dde1b0d46f9af81c3f3f8f4259763
- MD5 31d1f40e956b6e24189cdde6d9414f70
- SHA1 d59bc8a08746ff76f918d46ea6af8af7d3a58d0d
- SHA512 ec21ef1fd6fb40b2af3c710a67f03f132551b17429a10ae041164a99487e83b09a182cd0d2b01cc872daf2396e86fd577ddcb3664e27bd2646c0fccecfc9563b
- SSDEEP 192:oONi6v+YLpQmiUynBBCh+CG3+Fdeqmpc+pSJrCnCHuqzU6:oONi6vzrIbCh+C5ddJrzfU6
- TLSH T1FA122A3168A86C6F5EA2B545F08735139EA85177EF8A3F90D5DD2F1C01DF6AC2306827
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\23582cb0-f704-43d7-bcd9-31a31c9f86db.tmp
- Size 13B
- SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
- MD5 2aa9e263ee3796d9ce358460a2451b4c
- SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
- SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\first_party_sets.db
- Size 48KB
- SHA256 b07a988f6371a745e8902eabb027907ef58b8e4f90f50ccbbb3b413e20a07100
- MD5 20f74edb3210914de8e7de8330aef7a2
- SHA1 b2188c8a3a086af06e7c62ba627d2146c15cf1ea
- SHA512 4ea6a42c4cda88ba5d87e52462fb8660f6d2ff4afa38fd9e8d89d9ff7a9bd76789d50db0b87fc47118ab77b663be2d11d468dc5e5280ed167aa886896d9c288c
- SSDEEP 24:TLr4/arHRH34kQrq+i7ZYZY5J+Qnj3k0rJXAeL3mkAD6W6Ivrr6Uwr0KfLe:TI/IHRH34kWqB1kQnjhHmr6ITmU0Le
- TLSH T11423896EDA2CBAA2FEE40B3DD7D1D4127B35AA0EC2E4D9F1099B406746C540405EB63E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
- Size 2KB
- SHA256 8199e37e783f08d45414c3bacbfa79be2589898467edfe4813fa619784949750
- MD5 dd6baad7759c2c3f87d6e26b12ce1d75
- SHA1 b297b57ec7173dd1433b1fc2c3c5f3d53b80300d
- SHA512 b3a292518a23d0a58ba19d5e09691d6e8aa11b5336f31b3454d093e49a3c5c846bb8e9f8314624d0f4640b4efeaa854751a2926c3a4b512779ae11b7d18d54de
- TLSH T13F412B5CA6ED1108B3B76F56ABF6A46E487EBD372F0AD09D00110D8E0A62F44C872733
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\Downloads\CoronaVirus.exe
- Size 1.0MB
- SHA256 dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0
- MD5 055d1462f66a350d9886542d4d79bc2b
- SHA1 f1086d2f667d807dbb1aa362a7a809ea119f2565
- SHA512 2c5e570226252bdb2104c90d5b75f11493af8ed1be8cb0fd14e3f324311a82138753064731b80ce8e8b120b3fe7009b21a50e9f4583d534080e28ab84b83fee1
- SSDEEP 24576:FRYz/ERA0eMuWfHvgPw/83JI8CorP9qY0:FE/yADMuYvgP93JIc2
- TLSH T18F357D22E6A390F1C0652170BD6EB7FF99273C544F1889E7A3D4361C6AB01D10DFBA96
- MD5 SHA1 SHA512 SSDEEP TLSH