dharma | hxxp://web[.]archive[.]org

Analysis

max time kernel
158s
max time network
505s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
27-06-2024 17:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://web.archive.org

Score

10^/10

dharma bootkit defense_evasion discovery evasion execution exploit impact persistence ransomware trojan

Malware Config

Signatures

Dharma
Dharma is a ransomware that uses security software installation to hide malicious activities.
ransomware dharma
UAC bypass 3 TTPs 1 IoCs
evasion trojan

Bypass User Account Control
T1548.002

Disable or Modify Tools
T1562.001

Modify Registry
T1112

Processes:

wscript.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" wscript.exe
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Renames multiple (631) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware
Blocklisted process makes network request 6 IoCs

Processes:

wscript.exe

flow pid process

220 5160 wscript.exe
221 5160 wscript.exe
223 5160 wscript.exe
225 5160 wscript.exe
227 5160 wscript.exe
234 5160 wscript.exe
Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
persistence

Active Setup
T1547.014

Modify Registry
T1112

Processes:

explorer.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe
Disables cmd.exe use via registry modification 1 IoCs
evasion

Processes:

wscript.exe

description ioc process

Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1" wscript.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wscript.exe

flow	pid	process
220	5160	wscript.exe
221	5160	wscript.exe
223	5160	wscript.exe
225	5160	wscript.exe
227	5160	wscript.exe
234	5160	wscript.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	wscript.exe

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 64 IoCs

persistence

Image File Execution Options Injection

T1546.012

Processes:

wscript.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\uTorrent.exe\Debugger = "wscript.exe C:\\Users\\Public\\ghostroot\\Message.vbs"	wscript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\install.exe	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wmic.exe\Debugger = "wscript.exe C:\\Users\\Public\\ghostroot\\Message.vbs"	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskhost.exe\Debugger = "wscript.exe C:\\Users\\Public\\ghostroot\\Message.vbs"	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vbsedit.exe\Debugger = "wscript.exe C:\\Users\\Public\\ghostroot\\Message.vbs"	wscript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\firefox.exe	wscript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\uninstall.exe	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad++.exe\Debugger = "wscript.exe C:\\Users\\Public\\ghostroot\\Message.vbs"	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe\Debugger = "wscript.exe C:\\Users\\Public\\ghostroot\\Message.vbs"	wscript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\takeown.exe	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "wscript.exe C:\\Users\\Public\\ghostroot\\Message.vbs"	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit33.exe\Debugger = "wscript.exe C:\\Users\\Public\\ghostroot\\Message.vbs"	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "wscript.exe C:\\Users\\Public\\ghostroot\\Message.vbs"	wscript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\control.exe	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VirtualBox.exe\Debugger = "wscript.exe C:\\Users\\Public\\ghostroot\\Message.vbs"	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procxp.exe\Debugger = "wscript.exe C:\\Users\\Public\\ghostroot\\Message.vbs"	wscript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit32.exe	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\install.exe\Debugger = "wscript.exe C:\\Users\\Public\\ghostroot\\Message.vbs"	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe\Debugger = "wscript.exe C:\\Users\\Public\\ghostroot\\Message.vbs"	wscript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\installer.exe	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\icacls.exe\Debugger = "wscript.exe C:\\Users\\Public\\ghostroot\\Message.vbs"	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSASCui.exe\Debugger = "wscript.exe C:\\Users\\Public\\ghostroot\\Message.vbs"	wscript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\icacls.exe	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger = "wscript.exe C:\\Users\\Public\\ghostroot\\Message.vbs"	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\autoruns.exe\Debugger = "wscript.exe C:\\Users\\Public\\ghostroot\\Message.vbs"	wscript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msert.exe	wscript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\firefox.exe\Debugger = "wscript.exe C:\\Users\\Public\\ghostroot\\Message.vbs"	wscript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\update.exe	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\plugin-hang-ui.exe\Debugger = "wscript.exe C:\\Users\\Public\\ghostroot\\Message.vbs"	wscript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\autoruns.exe	wscript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\adwcleaner_5.005.exe	wscript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vbsedit.exe	wscript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mbam.exe	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\setup.exe\Debugger = "wscript.exe C:\\Users\\Public\\ghostroot\\Message.vbs"	wscript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\update.exe\Debugger = "wscript.exe C:\\Users\\Public\\ghostroot\\Message.vbs"	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mssecse.exe\Debugger = "wscript.exe C:\\Users\\Public\\ghostroot\\Message.vbs"	wscript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CCleaner64.exe	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CCleaner64.exe\Debugger = "wscript.exe C:\\Users\\Public\\ghostroot\\Message.vbs"	wscript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\student.exe	wscript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe	wscript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\attrib.exe	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\attrib.exe\Debugger = "wscript.exe C:\\Users\\Public\\ghostroot\\Message.vbs"	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msert.exe\Debugger = "wscript.exe C:\\Users\\Public\\ghostroot\\Message.vbs"	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\adwcleaner_5.005.exe\Debugger = "wscript.exe C:\\Users\\Public\\ghostroot\\Message.vbs"	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\crashreporter.exe\Debugger = "wscript.exe C:\\Users\\Public\\ghostroot\\Message.vbs"	wscript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\htaedit.exe	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit32.exe\Debugger = "wscript.exe C:\\Users\\Public\\ghostroot\\Message.vbs"	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger = "wscript.exe C:\\Users\\Public\\ghostroot\\Message.vbs"	wscript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iexplore.exe	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\control.exe\Debugger = "wscript.exe C:\\Users\\Public\\ghostroot\\Message.vbs"	wscript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mdsched.exe	wscript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VirtualBox.exe	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\student.exe\Debugger = "wscript.exe C:\\Users\\Public\\ghostroot\\Message.vbs"	wscript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\chrome.exe	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\chrome.exe\Debugger = "wscript.exe C:\\Users\\Public\\ghostroot\\Message.vbs"	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\updater.exe\Debugger = "wscript.exe C:\\Users\\Public\\ghostroot\\Message.vbs"	wscript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wmic.exe	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\uninstall.exe\Debugger = "wscript.exe C:\\Users\\Public\\ghostroot\\Message.vbs"	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mbam.exe\Debugger = "wscript.exe C:\\Users\\Public\\ghostroot\\Message.vbs"	wscript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSASCui.exe	wscript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\uTorrent.exe	wscript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe	wscript.exe

Possible privilege escalation attempt 2 IoCs
exploit

Processes:

takeown.exeicacls.exe

pid process

21872 takeown.exe
16520 icacls.exe

pid	process
21872	takeown.exe
16520	icacls.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WScript.exewscript.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	wscript.exe

Drops startup file 5 IoCs

Processes:

CoronaVirus.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CoronaVirus.exe	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	CoronaVirus.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-DF8C3D32.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-DF8C3D32.[[email protected]].ncov	CoronaVirus.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta	CoronaVirus.exe

Impair Defenses: Safe Mode Boot 1 TTPs 6 IoCs

defense_evasion

Safe Mode Boot

T1562.009

Processes:

reg.exe

description	ioc	process
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\CBDHSvc	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\iai2c.sys	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\Power	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\ProfSvc	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\SerCx2.sys	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\UserManager	reg.exe

Modifies file permissions 1 TTPs 2 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

takeown.exeicacls.exe

pid process

21872 takeown.exe
16520 icacls.exe

pid	process
21872	takeown.exe
16520	icacls.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

wscript.exeCoronaVirus.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Bolbi = "C:\\Users\\Public\\Ghostroot\\Bolbi.vbs"	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Bolbi = "C:\\Users\\Public\\Ghostroot\\Bolbi.vbs"	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\CoronaVirus.exe = "C:\\Windows\\System32\\CoronaVirus.exe"	CoronaVirus.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Windows\System32\Info.hta = "mshta.exe \"C:\\Windows\\System32\\Info.hta\""	CoronaVirus.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Users\Admin\AppData\Roaming\Info.hta = "mshta.exe \"C:\\Users\\Admin\\AppData\\Roaming\\Info.hta\""	CoronaVirus.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

wscript.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" wscript.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wscript.exe

Drops desktop.ini file(s) 64 IoCs

Processes:

CoronaVirus.exeexplorer.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Pictures\Saved Pictures\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini	CoronaVirus.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn1\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\Searches\desktop.ini	CoronaVirus.exe
File opened for modification	F:\$RECYCLE.BIN\S-1-5-21-1181767204-2009306918-3718769404-1000\desktop.ini	explorer.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Application Shortcuts\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	CoronaVirus.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini	CoronaVirus.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Public\AccountPictures\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini	explorer.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\Contacts\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\Favorites\Links\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn2\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\OneDrive\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	CoronaVirus.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini	CoronaVirus.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini	explorer.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\Pictures\Camera Roll\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini	CoronaVirus.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Public\Libraries\desktop.ini	CoronaVirus.exe
File opened for modification	F:\$RECYCLE.BIN\S-1-5-21-1181767204-2009306918-3718769404-1000\desktop.ini	CoronaVirus.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\3D Objects\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\Saved Games\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Program Files\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Program Files (x86)\desktop.ini	CoronaVirus.exe

Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.

Query Registry
T1012

Peripheral Device Discovery
T1120

System Information Discovery
T1082

Processes:

explorer.exe

description ioc process

File opened (read-only) \??\D: explorer.exe
File opened (read-only) \??\F: explorer.exe
Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service
T1102

Processes:

flow ioc

184 raw.githubusercontent.com
185 raw.githubusercontent.com
186 raw.githubusercontent.com
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1542.003

Processes:

MEMZ.exe

description ioc process

File opened for modification \??\PhysicalDrive0 MEMZ.exe
Drops file in System32 directory 2 IoCs

Processes:

CoronaVirus.exe

description ioc process

File created C:\Windows\System32\CoronaVirus.exe CoronaVirus.exe
File created C:\Windows\System32\Info.hta CoronaVirus.exe
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
ransomware

Defacement
T1491

Modify Registry
T1112

Processes:

wscript.exe

description ioc process

Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Public\\ghostroot\\8ydfdsE.jpg" wscript.exe

description	ioc	process
File opened (read-only)	\??\D:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe

flow	ioc
184	raw.githubusercontent.com
185	raw.githubusercontent.com
186	raw.githubusercontent.com

description	ioc	process
File opened for modification	\??\PhysicalDrive0	MEMZ.exe

description	ioc	process
File created	C:\Windows\System32\CoronaVirus.exe	CoronaVirus.exe
File created	C:\Windows\System32\Info.hta	CoronaVirus.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Public\\ghostroot\\8ydfdsE.jpg"	wscript.exe

Drops file in Program Files directory 64 IoCs

Processes:

CoronaVirus.exewscript.exe

description	ioc	process
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\codec\libtwolame_plugin.dll	CoronaVirus.exe
File created	C:\Program Files\Internet Explorer\it-IT\Open182.vbs	wscript.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Car\LTR\contrast-black\LargeTile.scale-125.png	CoronaVirus.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\sk-sk\ui-strings.js.id-DF8C3D32.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019VL_MAK_AE-ul-phn.xrm-ms	CoronaVirus.exe
File created	C:\Program Files\Internet Explorer\es-ES\Open22.vbs	wscript.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\ReachFramework.resources.dll.id-DF8C3D32.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\es-es\ui-strings.js	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Retail-ul-phn.xrm-ms.id-DF8C3D32.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\CONCRETE\CONCRETE.INF	CoronaVirus.exe
File opened for modification	C:\Program Files\Internet Explorer\Clap223.vbs	wscript.exe
File opened for modification	C:\Program Files\Internet Explorer\ja-JP\Open111.vbs	wscript.exe
File created	C:\Program Files\Java\jdk-1.8\Open60.vbs	wscript.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\css\main.css.id-DF8C3D32.[[email protected]].ncov	CoronaVirus.exe
File created	C:\Program Files\Common Files\System\Open117.vbs	wscript.exe
File opened for modification	C:\Program Files\Common Files\System\ado\fr-FR\msader15.dll.mui	CoronaVirus.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\Open241.vbs	wscript.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	CoronaVirus.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_filter-hover_32.svg.id-DF8C3D32.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\hu-hu\ui-strings.js.id-DF8C3D32.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft SQL Server\130\Shared\msasxpress.dll	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected].[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxApp_48.49.31001.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\GamesXboxHubStoreLogo.scale-125.png	CoronaVirus.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-20_altform-unplated.png	CoronaVirus.exe
File opened for modification	C:\Program Files\Internet Explorer\Clap34.vbs	wscript.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\Open50.vbs	wscript.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml.id-DF8C3D32.[[email protected]].ncov	CoronaVirus.exe
File created	C:\Program Files\MsEdgeCrashpad\throttle_store.dat.id-DF8C3D32.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\goopdateres_ca.dll.id-DF8C3D32.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\Java\jre-1.8\Open167.vbs	wscript.exe
File created	C:\Program Files\Java\jre8\Open43.vbs	wscript.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\dt_shmem.dll	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest1-ul-oob.xrm-ms	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\Clap75.vbs	wscript.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-white\WideTile.scale-100_contrast-white.png	CoronaVirus.exe
File created	C:\Program Files\Microsoft Office\root\Open13.vbs	wscript.exe
File created	C:\Program Files\Mozilla Firefox\browser\Open20.vbs	wscript.exe
File created	C:\Program Files\7-Zip\7z.sfx.id-DF8C3D32.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\System.Windows.Input.Manipulations.resources.dll	CoronaVirus.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-96_contrast-white.png	CoronaVirus.exe
File opened for modification	C:\Program Files\dotnet\host\Open215.vbs	wscript.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\ru-ru\ui-strings.js	CoronaVirus.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.office32ww.msi.16.x-none.xml.id-DF8C3D32.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Security.Cryptography.Xml.dll.id-DF8C3D32.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-white\LargeTile.scale-200_contrast-white.png	CoronaVirus.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\themes\dark\illustrations.png.id-DF8C3D32.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\fi-fi\ui-strings.js.id-DF8C3D32.[[email protected]].ncov	CoronaVirus.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp-ppd.xrm-ms.id-DF8C3D32.[[email protected]].ncov	CoronaVirus.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libmpg123_plugin.dll.id-DF8C3D32.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\CourierStd-BoldOblique.otf	CoronaVirus.exe
File created	C:\Program Files\Common Files\DESIGNER\Open9.vbs	wscript.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.Tasks.Dataflow.dll.id-DF8C3D32.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_OEM_Perp-ppd.xrm-ms	CoronaVirus.exe
File created	C:\Program Files\Mozilla Firefox\Clap204.vbs	wscript.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hr.txt	CoronaVirus.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-utility-l1-1-0.dll	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BREEZE\THMBNAIL.PNG.id-DF8C3D32.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxApp_48.49.31001.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\GamesXboxHubStoreLogo.scale-200_contrast-white.png	CoronaVirus.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNotePageLargeTile.scale-100.png	CoronaVirus.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxCalendarAppList.targetsize-20.png	CoronaVirus.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\sv-se\ui-strings.js	CoronaVirus.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.Excel.Common.FrontEnd.XmlSerializers.dll.id-DF8C3D32.[[email protected]].ncov	CoronaVirus.exe
File created	C:\Program Files\Common Files\microsoft shared\Open118.vbs	wscript.exe
File created	C:\Program Files\Google\Clap97.vbs	wscript.exe

Drops file in Windows directory 1 IoCs

Processes:

wscript.exe

description ioc process

File opened for modification C:\Windows\System32 wscript.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

description	ioc	process
File opened for modification	C:\Windows\System32	wscript.exe

Checks SCSI registry key(s) 3 TTPs 58 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

explorer.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Capabilities	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	explorer.exe

Enumerates system info in registry 2 TTPs 5 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

SearchApp.exemsedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	SearchApp.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	SearchApp.exe

Interacts with shadow copies 3 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490

Direct Volume Access
T1006

Processes:

vssadmin.exe

pid process

29652 vssadmin.exe
Kills process with taskkill 1 IoCs
evasion

Processes:

taskkill.exe

pid process

1728 taskkill.exe

pid	process
29652	vssadmin.exe

pid	process
1728	taskkill.exe

Modifies Control Panel 4 IoCs

evasion

Processes:

wscript.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\s1159 = "Bolbi"	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\s2359 = "Bolbi"	wscript.exe
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\Desktop	wscript.exe

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

Processes:

explorer.exeSearchApp.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Software\Microsoft\Internet Explorer\IESettingSync	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Software\Microsoft\Internet Explorer\GPU	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Internet Explorer\GPU	SearchApp.exe

Modifies data under HKEY_USERS 2 IoCs

Processes:

msedge.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133639817419591729"	msedge.exe

Modifies registry class 46 IoCs

Processes:

cmd.exeexplorer.exeSearchApp.exeOpenWith.exeStartMenuExperienceHost.exeOpenWith.exemsedge.exemsedge.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.lnk\ = "exefile"	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "129"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search\Total = "23"	SearchApp.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei = "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Speech_OneCore\\Recognizers\\Tokens\\MS-1033-110-WINMO-DNN"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchApp.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1181767204-2009306918-3718769404-1000\{29A8E06E-B948-4FAE-A749-BA5781913FF2}	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\ApplicationFrame\Microsoft.Windows.PeopleExperienceHo = 6801000088020000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings\MuiCache	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoft.windows.search	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search\ = "56"	SearchApp.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1181767204-2009306918-3718769404-1000\{85199EE4-E0F6-4EA2-88EF-846D7F65F160}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.scr	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.pif	cmd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchApp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.scr\ = "dllfile"	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search\ = "0"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search\ = "23"	SearchApp.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1181767204-2009306918-3718769404-1000\{CED815A1-2008-4972-83D4-553E9A705813}	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\windows.search	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search\Total = "0"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "185"	SearchApp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.lnk	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.pif\ = "dllfile"	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "152"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search\Total = "56"	SearchApp.exe

Opens file in notepad (likely ransom note) 1 IoCs
ransomware

Processes:

NOTEPAD.EXE

pid process

21724 NOTEPAD.EXE

pid	process
21724	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

MEMZ.exeMEMZ.exeMEMZ.exeMEMZ.exeMEMZ.exe

pid	process
4708	MEMZ.exe
4708	MEMZ.exe
1220	MEMZ.exe
1220	MEMZ.exe
4708	MEMZ.exe
4708	MEMZ.exe
4708	MEMZ.exe
1220	MEMZ.exe
4708	MEMZ.exe
1220	MEMZ.exe
4708	MEMZ.exe
2960	MEMZ.exe
4708	MEMZ.exe
2960	MEMZ.exe
2960	MEMZ.exe
2960	MEMZ.exe
4708	MEMZ.exe
4708	MEMZ.exe
4656	MEMZ.exe
4656	MEMZ.exe
3164	MEMZ.exe
3164	MEMZ.exe
1220	MEMZ.exe
1220	MEMZ.exe
3164	MEMZ.exe
3164	MEMZ.exe
4656	MEMZ.exe
4656	MEMZ.exe
4708	MEMZ.exe
4708	MEMZ.exe
2960	MEMZ.exe
2960	MEMZ.exe
2960	MEMZ.exe
4656	MEMZ.exe
2960	MEMZ.exe
4656	MEMZ.exe
4708	MEMZ.exe
4708	MEMZ.exe
3164	MEMZ.exe
3164	MEMZ.exe
1220	MEMZ.exe
1220	MEMZ.exe
1220	MEMZ.exe
1220	MEMZ.exe
3164	MEMZ.exe
3164	MEMZ.exe
4708	MEMZ.exe
4708	MEMZ.exe
4656	MEMZ.exe
4656	MEMZ.exe
2960	MEMZ.exe
2960	MEMZ.exe
2960	MEMZ.exe
2960	MEMZ.exe
4656	MEMZ.exe
4656	MEMZ.exe
4708	MEMZ.exe
4708	MEMZ.exe
3164	MEMZ.exe
3164	MEMZ.exe
1220	MEMZ.exe
1220	MEMZ.exe
1220	MEMZ.exe
1220	MEMZ.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

explorer.exe

pid process

21844 explorer.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

taskkill.exeexplorer.exetakeown.exevssvc.exe

description	pid	process
Token: SeDebugPrivilege	1728	taskkill.exe
Token: SeShutdownPrivilege	21844	explorer.exe
Token: SeCreatePagefilePrivilege	21844	explorer.exe
Token: SeShutdownPrivilege	21844	explorer.exe
Token: SeCreatePagefilePrivilege	21844	explorer.exe
Token: SeTakeOwnershipPrivilege	21872	takeown.exe
Token: SeShutdownPrivilege	21844	explorer.exe
Token: SeCreatePagefilePrivilege	21844	explorer.exe
Token: SeShutdownPrivilege	21844	explorer.exe
Token: SeCreatePagefilePrivilege	21844	explorer.exe
Token: SeBackupPrivilege	23376	vssvc.exe
Token: SeRestorePrivilege	23376	vssvc.exe
Token: SeAuditPrivilege	23376	vssvc.exe
Token: SeShutdownPrivilege	21844	explorer.exe
Token: SeCreatePagefilePrivilege	21844	explorer.exe
Token: SeShutdownPrivilege	21844	explorer.exe
Token: SeCreatePagefilePrivilege	21844	explorer.exe
Token: SeShutdownPrivilege	21844	explorer.exe
Token: SeCreatePagefilePrivilege	21844	explorer.exe
Token: SeShutdownPrivilege	21844	explorer.exe
Token: SeCreatePagefilePrivilege	21844	explorer.exe
Token: SeShutdownPrivilege	21844	explorer.exe
Token: SeCreatePagefilePrivilege	21844	explorer.exe
Token: SeShutdownPrivilege	21844	explorer.exe
Token: SeCreatePagefilePrivilege	21844	explorer.exe
Token: SeShutdownPrivilege	21844	explorer.exe
Token: SeCreatePagefilePrivilege	21844	explorer.exe
Token: SeShutdownPrivilege	21844	explorer.exe
Token: SeCreatePagefilePrivilege	21844	explorer.exe
Token: SeShutdownPrivilege	21844	explorer.exe
Token: SeCreatePagefilePrivilege	21844	explorer.exe
Token: SeShutdownPrivilege	21844	explorer.exe
Token: SeCreatePagefilePrivilege	21844	explorer.exe
Token: SeShutdownPrivilege	21844	explorer.exe
Token: SeCreatePagefilePrivilege	21844	explorer.exe
Token: SeShutdownPrivilege	21844	explorer.exe
Token: SeCreatePagefilePrivilege	21844	explorer.exe
Token: SeShutdownPrivilege	21844	explorer.exe
Token: SeCreatePagefilePrivilege	21844	explorer.exe
Token: SeShutdownPrivilege	21844	explorer.exe
Token: SeCreatePagefilePrivilege	21844	explorer.exe
Token: SeShutdownPrivilege	21844	explorer.exe
Token: SeCreatePagefilePrivilege	21844	explorer.exe
Token: SeShutdownPrivilege	21844	explorer.exe
Token: SeCreatePagefilePrivilege	21844	explorer.exe
Token: SeShutdownPrivilege	21844	explorer.exe
Token: SeCreatePagefilePrivilege	21844	explorer.exe
Token: SeShutdownPrivilege	21844	explorer.exe
Token: SeCreatePagefilePrivilege	21844	explorer.exe
Token: SeShutdownPrivilege	21844	explorer.exe
Token: SeCreatePagefilePrivilege	21844	explorer.exe
Token: SeShutdownPrivilege	21844	explorer.exe
Token: SeCreatePagefilePrivilege	21844	explorer.exe
Token: SeShutdownPrivilege	21844	explorer.exe
Token: SeCreatePagefilePrivilege	21844	explorer.exe
Token: SeShutdownPrivilege	21844	explorer.exe
Token: SeCreatePagefilePrivilege	21844	explorer.exe
Token: SeShutdownPrivilege	21844	explorer.exe
Token: SeCreatePagefilePrivilege	21844	explorer.exe
Token: SeShutdownPrivilege	21844	explorer.exe
Token: SeCreatePagefilePrivilege	21844	explorer.exe
Token: SeShutdownPrivilege	21844	explorer.exe
Token: SeCreatePagefilePrivilege	21844	explorer.exe
Token: SeShutdownPrivilege	21844	explorer.exe

Suspicious use of FindShellTrayWindow 54 IoCs

Processes:

explorer.exeNOTEPAD.EXESearchApp.exe

pid	process
21844	explorer.exe
21844	explorer.exe
21844	explorer.exe
21844	explorer.exe
21844	explorer.exe
21844	explorer.exe
21844	explorer.exe
21724	NOTEPAD.EXE
21844	explorer.exe
21844	explorer.exe
21844	explorer.exe
21844	explorer.exe
21844	explorer.exe
21844	explorer.exe
21844	explorer.exe
21844	explorer.exe
21844	explorer.exe
21844	explorer.exe
21844	explorer.exe
21844	explorer.exe
21844	explorer.exe
21844	explorer.exe
21844	explorer.exe
21844	explorer.exe
21844	explorer.exe
21844	explorer.exe
21844	explorer.exe
21844	explorer.exe
21844	explorer.exe
21844	explorer.exe
21844	explorer.exe
21844	explorer.exe
21844	explorer.exe
21844	explorer.exe
21844	explorer.exe
21844	explorer.exe
21844	explorer.exe
21844	explorer.exe
21844	explorer.exe
21844	explorer.exe
21844	explorer.exe
21844	explorer.exe
21844	explorer.exe
21844	explorer.exe
21844	explorer.exe
21844	explorer.exe
21844	explorer.exe
21844	explorer.exe
21844	explorer.exe
21844	explorer.exe
21844	explorer.exe
21844	explorer.exe
21844	explorer.exe
15108	SearchApp.exe

Suspicious use of SendNotifyMessage 27 IoCs

Processes:

explorer.exe

pid	process
21844	explorer.exe
21844	explorer.exe
21844	explorer.exe
21844	explorer.exe
21844	explorer.exe
21844	explorer.exe
21844	explorer.exe
21844	explorer.exe
21844	explorer.exe
21844	explorer.exe
21844	explorer.exe
21844	explorer.exe
21844	explorer.exe
21844	explorer.exe
21844	explorer.exe
21844	explorer.exe
21844	explorer.exe
21844	explorer.exe
21844	explorer.exe
21844	explorer.exe
21844	explorer.exe
21844	explorer.exe
21844	explorer.exe
21844	explorer.exe
21844	explorer.exe
21844	explorer.exe
21844	explorer.exe

Suspicious use of SetWindowsHookEx 11 IoCs

Processes:

MEMZ.exeMEMZ.exeMEMZ.exeMEMZ.exeMEMZ.exeMEMZ.exeMEMZ.exeOpenWith.exeOpenWith.exeStartMenuExperienceHost.exeSearchApp.exe

pid process

5868 MEMZ.exe
4708 MEMZ.exe
1220 MEMZ.exe
3164 MEMZ.exe
2960 MEMZ.exe
4656 MEMZ.exe
2996 MEMZ.exe
27400 OpenWith.exe
23416 OpenWith.exe
10236 StartMenuExperienceHost.exe
15108 SearchApp.exe

pid	process
5868	MEMZ.exe
4708	MEMZ.exe
1220	MEMZ.exe
3164	MEMZ.exe
2960	MEMZ.exe
4656	MEMZ.exe
2996	MEMZ.exe
27400	OpenWith.exe
23416	OpenWith.exe
10236	StartMenuExperienceHost.exe
15108	SearchApp.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 4248 wrote to memory of 1684	4248	msedge.exe	msedge.exe
PID 4248 wrote to memory of 1684	4248	msedge.exe	msedge.exe
PID 4248 wrote to memory of 2684	4248	msedge.exe	msedge.exe
PID 4248 wrote to memory of 2684	4248	msedge.exe	msedge.exe
PID 4248 wrote to memory of 2684	4248	msedge.exe	msedge.exe
PID 4248 wrote to memory of 2684	4248	msedge.exe	msedge.exe
PID 4248 wrote to memory of 2684	4248	msedge.exe	msedge.exe
PID 4248 wrote to memory of 2684	4248	msedge.exe	msedge.exe
PID 4248 wrote to memory of 2684	4248	msedge.exe	msedge.exe
PID 4248 wrote to memory of 2684	4248	msedge.exe	msedge.exe
PID 4248 wrote to memory of 2684	4248	msedge.exe	msedge.exe
PID 4248 wrote to memory of 2684	4248	msedge.exe	msedge.exe
PID 4248 wrote to memory of 2684	4248	msedge.exe	msedge.exe
PID 4248 wrote to memory of 2684	4248	msedge.exe	msedge.exe
PID 4248 wrote to memory of 2684	4248	msedge.exe	msedge.exe
PID 4248 wrote to memory of 2684	4248	msedge.exe	msedge.exe
PID 4248 wrote to memory of 2684	4248	msedge.exe	msedge.exe
PID 4248 wrote to memory of 2684	4248	msedge.exe	msedge.exe
PID 4248 wrote to memory of 2684	4248	msedge.exe	msedge.exe
PID 4248 wrote to memory of 2684	4248	msedge.exe	msedge.exe
PID 4248 wrote to memory of 2684	4248	msedge.exe	msedge.exe
PID 4248 wrote to memory of 2684	4248	msedge.exe	msedge.exe
PID 4248 wrote to memory of 2684	4248	msedge.exe	msedge.exe
PID 4248 wrote to memory of 2684	4248	msedge.exe	msedge.exe
PID 4248 wrote to memory of 2684	4248	msedge.exe	msedge.exe
PID 4248 wrote to memory of 2684	4248	msedge.exe	msedge.exe
PID 4248 wrote to memory of 2684	4248	msedge.exe	msedge.exe
PID 4248 wrote to memory of 2684	4248	msedge.exe	msedge.exe
PID 4248 wrote to memory of 2684	4248	msedge.exe	msedge.exe
PID 4248 wrote to memory of 2684	4248	msedge.exe	msedge.exe
PID 4248 wrote to memory of 2684	4248	msedge.exe	msedge.exe
PID 4248 wrote to memory of 2684	4248	msedge.exe	msedge.exe
PID 4248 wrote to memory of 2684	4248	msedge.exe	msedge.exe
PID 4248 wrote to memory of 2684	4248	msedge.exe	msedge.exe
PID 4248 wrote to memory of 2684	4248	msedge.exe	msedge.exe
PID 4248 wrote to memory of 2684	4248	msedge.exe	msedge.exe
PID 4248 wrote to memory of 2684	4248	msedge.exe	msedge.exe
PID 4248 wrote to memory of 2684	4248	msedge.exe	msedge.exe
PID 4248 wrote to memory of 2684	4248	msedge.exe	msedge.exe
PID 4248 wrote to memory of 2684	4248	msedge.exe	msedge.exe
PID 4248 wrote to memory of 2684	4248	msedge.exe	msedge.exe
PID 4248 wrote to memory of 2684	4248	msedge.exe	msedge.exe
PID 4248 wrote to memory of 2684	4248	msedge.exe	msedge.exe
PID 4248 wrote to memory of 2684	4248	msedge.exe	msedge.exe
PID 4248 wrote to memory of 2684	4248	msedge.exe	msedge.exe
PID 4248 wrote to memory of 2684	4248	msedge.exe	msedge.exe
PID 4248 wrote to memory of 2684	4248	msedge.exe	msedge.exe
PID 4248 wrote to memory of 2684	4248	msedge.exe	msedge.exe
PID 4248 wrote to memory of 2684	4248	msedge.exe	msedge.exe
PID 4248 wrote to memory of 2684	4248	msedge.exe	msedge.exe
PID 4248 wrote to memory of 2684	4248	msedge.exe	msedge.exe
PID 4248 wrote to memory of 2684	4248	msedge.exe	msedge.exe
PID 4248 wrote to memory of 2684	4248	msedge.exe	msedge.exe
PID 4248 wrote to memory of 5204	4248	msedge.exe	msedge.exe
PID 4248 wrote to memory of 5204	4248	msedge.exe	msedge.exe
PID 4248 wrote to memory of 5312	4248	msedge.exe	msedge.exe
PID 4248 wrote to memory of 5312	4248	msedge.exe	msedge.exe
PID 4248 wrote to memory of 5312	4248	msedge.exe	msedge.exe
PID 4248 wrote to memory of 5312	4248	msedge.exe	msedge.exe
PID 4248 wrote to memory of 5312	4248	msedge.exe	msedge.exe
PID 4248 wrote to memory of 5312	4248	msedge.exe	msedge.exe
PID 4248 wrote to memory of 5312	4248	msedge.exe	msedge.exe
PID 4248 wrote to memory of 5312	4248	msedge.exe	msedge.exe
PID 4248 wrote to memory of 5312	4248	msedge.exe	msedge.exe

System policy modification 1 TTPs 31 IoCs

evasion

Modify Registry

T1112

Processes:

wscript.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\RestrictRun\	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\RestrictRun\ = "rpdbfk.exe"	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\RestrictRun\ = "wmplayer.exe"	wscript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoPinningToTaskbar = "1"	wscript.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer	wscript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFind = "1"	wscript.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\RestrictRun	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\RestrictRun\ = "explorer.exe"	wscript.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System	wscript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoStartMenuPinnedList = "1"	wscript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoStartMenuMorePrograms, = "1"	wscript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	wscript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoControlPanel = "1"	wscript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoStartMenuMFUprogramsList = "1"	wscript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFileAssociate = "1"	wscript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoRun = "1"	wscript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSaveSettings = "1"	wscript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoTrayContextMenu = "1"	wscript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableLockWorkstation = "1"	wscript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDrives = "67108863"	wscript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\RestrictRun = "1"	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\RestrictRun\ = "cscript.exe"	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\RestrictRun\ = "wscript.exe"	wscript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSetTaskbar = "1"	wscript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr = "1"	wscript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\TaskbarNoPinnedList = "1"	wscript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSecurityTab = "1"	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\legalnoticecaption = "ATTENTION!"	wscript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoTrayItemsDisplay = "1"	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\legalnoticetext = "Your PC has been wrecked by Bolbi!"	wscript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wscript.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://web.archive.org
1⤵
PID:3464

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --field-trial-handle=3848,i,6166776566165096562,4582328833313060853,262144 --variations-seed-version --mojo-platform-channel-handle=4544 /prefetch:1
1⤵
PID:1716

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --field-trial-handle=3884,i,6166776566165096562,4582328833313060853,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:1
1⤵
PID:2204

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=5236,i,6166776566165096562,4582328833313060853,262144 --variations-seed-version --mojo-platform-channel-handle=5264 /prefetch:8
1⤵
PID:1168

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --no-appcompat-clear --field-trial-handle=5268,i,6166776566165096562,4582328833313060853,262144 --variations-seed-version --mojo-platform-channel-handle=5432 /prefetch:8
1⤵
PID:464

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=14 --field-trial-handle=3808,i,6166776566165096562,4582328833313060853,262144 --variations-seed-version --mojo-platform-channel-handle=5240 /prefetch:1
1⤵
PID:936

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5876,i,6166776566165096562,4582328833313060853,262144 --variations-seed-version --mojo-platform-channel-handle=5608 /prefetch:8
1⤵
PID:2088

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=16 --field-trial-handle=5956,i,6166776566165096562,4582328833313060853,262144 --variations-seed-version --mojo-platform-channel-handle=5860 /prefetch:1
1⤵
PID:864

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --field-trial-handle=3344,i,6166776566165096562,4582328833313060853,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:1
1⤵
PID:3932

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --field-trial-handle=760,i,6166776566165096562,4582328833313060853,262144 --variations-seed-version --mojo-platform-channel-handle=4932 /prefetch:1
1⤵
PID:4928

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=6240,i,6166776566165096562,4582328833313060853,262144 --variations-seed-version --mojo-platform-channel-handle=6232 /prefetch:8
1⤵
PID:2544

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=20 --field-trial-handle=6188,i,6166776566165096562,4582328833313060853,262144 --variations-seed-version --mojo-platform-channel-handle=6308 /prefetch:1
1⤵
PID:4064

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=21 --field-trial-handle=6456,i,6166776566165096562,4582328833313060853,262144 --variations-seed-version --mojo-platform-channel-handle=6400 /prefetch:1
1⤵
PID:1904

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --no-appcompat-clear --field-trial-handle=6452,i,6166776566165096562,4582328833313060853,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:8
1⤵
PID:4068

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=6504,i,6166776566165096562,4582328833313060853,262144 --variations-seed-version --mojo-platform-channel-handle=6516 /prefetch:8
1⤵
- Modifies registry class
PID:4396

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=24 --field-trial-handle=6008,i,6166776566165096562,4582328833313060853,262144 --variations-seed-version --mojo-platform-channel-handle=6560 /prefetch:1
1⤵
PID:2908

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=25 --field-trial-handle=6724,i,6166776566165096562,4582328833313060853,262144 --variations-seed-version --mojo-platform-channel-handle=6712 /prefetch:1
1⤵
PID:2148

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=26 --field-trial-handle=6880,i,6166776566165096562,4582328833313060853,262144 --variations-seed-version --mojo-platform-channel-handle=5728 /prefetch:1
1⤵
PID:1800

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService
1⤵
PID:5128

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --no-appcompat-clear --field-trial-handle=6412,i,6166776566165096562,4582328833313060853,262144 --variations-seed-version --mojo-platform-channel-handle=7064 /prefetch:8
1⤵
PID:5812

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --no-appcompat-clear --field-trial-handle=7124,i,6166776566165096562,4582328833313060853,262144 --variations-seed-version --mojo-platform-channel-handle=7224 /prefetch:8
1⤵
PID:5892

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=29 --field-trial-handle=5992,i,6166776566165096562,4582328833313060853,262144 --variations-seed-version --mojo-platform-channel-handle=7232 /prefetch:1
1⤵
PID:5900

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=30 --field-trial-handle=7532,i,6166776566165096562,4582328833313060853,262144 --variations-seed-version --mojo-platform-channel-handle=7000 /prefetch:1
1⤵
PID:6064

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=6984,i,6166776566165096562,4582328833313060853,262144 --variations-seed-version --mojo-platform-channel-handle=7384 /prefetch:8
1⤵
PID:5144

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=32 --field-trial-handle=4992,i,6166776566165096562,4582328833313060853,262144 --variations-seed-version --mojo-platform-channel-handle=7364 /prefetch:1
1⤵
PID:3464

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=33 --field-trial-handle=5832,i,6166776566165096562,4582328833313060853,262144 --variations-seed-version --mojo-platform-channel-handle=7544 /prefetch:1
1⤵
PID:1504

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=7880,i,6166776566165096562,4582328833313060853,262144 --variations-seed-version --mojo-platform-channel-handle=7868 /prefetch:8
1⤵
PID:4672

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5812,i,6166776566165096562,4582328833313060853,262144 --variations-seed-version --mojo-platform-channel-handle=7836 /prefetch:8
1⤵
PID:5652

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=7228,i,6166776566165096562,4582328833313060853,262144 --variations-seed-version --mojo-platform-channel-handle=7224 /prefetch:8
1⤵
PID:5236

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=4944,i,6166776566165096562,4582328833313060853,262144 --variations-seed-version --mojo-platform-channel-handle=7272 /prefetch:8
1⤵
PID:1724

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4248

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=124.0.6367.118 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=124.0.2478.80 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7fff8865ceb8,0x7fff8865cec4,0x7fff8865ced0
2⤵
PID:1684

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2312,i,17645482639799250220,5720374516375562079,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:2
2⤵
PID:2684

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1944,i,17645482639799250220,5720374516375562079,262144 --variations-seed-version --mojo-platform-channel-handle=3324 /prefetch:3
2⤵
PID:5204

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2432,i,17645482639799250220,5720374516375562079,262144 --variations-seed-version --mojo-platform-channel-handle=3436 /prefetch:8
2⤵
PID:5312

C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4460,i,17645482639799250220,5720374516375562079,262144 --variations-seed-version --mojo-platform-channel-handle=4468 /prefetch:8
2⤵
PID:3956

C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4460,i,17645482639799250220,5720374516375562079,262144 --variations-seed-version --mojo-platform-channel-handle=4468 /prefetch:8
2⤵
PID:5116

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4468,i,17645482639799250220,5720374516375562079,262144 --variations-seed-version --mojo-platform-channel-handle=4200 /prefetch:8
2⤵
PID:12172

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4196,i,17645482639799250220,5720374516375562079,262144 --variations-seed-version --mojo-platform-channel-handle=4696 /prefetch:8
2⤵
PID:12188

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2656,i,17645482639799250220,5720374516375562079,262144 --variations-seed-version --mojo-platform-channel-handle=2544 /prefetch:8
2⤵
PID:14596

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1.5 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=4972,i,17645482639799250220,5720374516375562079,262144 --variations-seed-version --mojo-platform-channel-handle=4980 /prefetch:1
2⤵
PID:23344

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1.5 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=4988,i,17645482639799250220,5720374516375562079,262144 --variations-seed-version --mojo-platform-channel-handle=5252 /prefetch:1
2⤵
PID:23436

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=5536,i,17645482639799250220,5720374516375562079,262144 --variations-seed-version --mojo-platform-channel-handle=5544 /prefetch:8
2⤵
PID:23620

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --no-appcompat-clear --field-trial-handle=5480,i,17645482639799250220,5720374516375562079,262144 --variations-seed-version --mojo-platform-channel-handle=4952 /prefetch:8
2⤵
PID:23636

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1.5 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=6040,i,17645482639799250220,5720374516375562079,262144 --variations-seed-version --mojo-platform-channel-handle=6036 /prefetch:1
2⤵
PID:24400

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1.5 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=6052,i,17645482639799250220,5720374516375562079,262144 --variations-seed-version --mojo-platform-channel-handle=5956 /prefetch:1
2⤵
PID:24776

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1.5 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=6208,i,17645482639799250220,5720374516375562079,262144 --variations-seed-version --mojo-platform-channel-handle=6484 /prefetch:1
2⤵
PID:25108

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1.5 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --field-trial-handle=6192,i,17645482639799250220,5720374516375562079,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:1
2⤵
PID:25152

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=5884,i,17645482639799250220,5720374516375562079,262144 --variations-seed-version --mojo-platform-channel-handle=6328 /prefetch:8
2⤵
PID:25864

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5328,i,17645482639799250220,5720374516375562079,262144 --variations-seed-version --mojo-platform-channel-handle=5320 /prefetch:8
2⤵
PID:26208

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1.5 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --field-trial-handle=6020,i,17645482639799250220,5720374516375562079,262144 --variations-seed-version --mojo-platform-channel-handle=4956 /prefetch:1
2⤵
PID:26296

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --no-appcompat-clear --field-trial-handle=4240,i,17645482639799250220,5720374516375562079,262144 --variations-seed-version --mojo-platform-channel-handle=2992 /prefetch:8
2⤵
PID:26448

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1.5 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --field-trial-handle=5928,i,17645482639799250220,5720374516375562079,262144 --variations-seed-version --mojo-platform-channel-handle=5772 /prefetch:1
2⤵
PID:26596

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1.5 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --field-trial-handle=6352,i,17645482639799250220,5720374516375562079,262144 --variations-seed-version --mojo-platform-channel-handle=5276 /prefetch:1
2⤵
PID:27240

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1.5 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --field-trial-handle=6280,i,17645482639799250220,5720374516375562079,262144 --variations-seed-version --mojo-platform-channel-handle=6272 /prefetch:1
2⤵
PID:27532

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=6732,i,17645482639799250220,5720374516375562079,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:8
2⤵
PID:28008

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1.5 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --field-trial-handle=5764,i,17645482639799250220,5720374516375562079,262144 --variations-seed-version --mojo-platform-channel-handle=6700 /prefetch:1
2⤵
PID:28708

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5732,i,17645482639799250220,5720374516375562079,262144 --variations-seed-version --mojo-platform-channel-handle=3884 /prefetch:8
2⤵
PID:28824

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --no-appcompat-clear --field-trial-handle=5404,i,17645482639799250220,5720374516375562079,262144 --variations-seed-version --mojo-platform-channel-handle=6824 /prefetch:8
2⤵
PID:29580

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4132,i,17645482639799250220,5720374516375562079,262144 --variations-seed-version --mojo-platform-channel-handle=6852 /prefetch:8
2⤵
PID:29592

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3880,i,17645482639799250220,5720374516375562079,262144 --variations-seed-version --mojo-platform-channel-handle=6688 /prefetch:8
2⤵
PID:30488

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1.5 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --field-trial-handle=3912,i,17645482639799250220,5720374516375562079,262144 --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:1
2⤵
PID:31552

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1.5 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --field-trial-handle=5744,i,17645482639799250220,5720374516375562079,262144 --variations-seed-version --mojo-platform-channel-handle=4960 /prefetch:1
2⤵
PID:31876

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1.5 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --field-trial-handle=6780,i,17645482639799250220,5720374516375562079,262144 --variations-seed-version --mojo-platform-channel-handle=5636 /prefetch:1
2⤵
PID:32972

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1.5 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --field-trial-handle=5668,i,17645482639799250220,5720374516375562079,262144 --variations-seed-version --mojo-platform-channel-handle=5612 /prefetch:1
2⤵
PID:32996

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1.5 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --field-trial-handle=7300,i,17645482639799250220,5720374516375562079,262144 --variations-seed-version --mojo-platform-channel-handle=7412 /prefetch:1
2⤵
PID:36612

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1.5 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --field-trial-handle=7304,i,17645482639799250220,5720374516375562079,262144 --variations-seed-version --mojo-platform-channel-handle=7532 /prefetch:1
2⤵
PID:37036

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --no-appcompat-clear --field-trial-handle=7296,i,17645482639799250220,5720374516375562079,262144 --variations-seed-version --mojo-platform-channel-handle=7664 /prefetch:8
2⤵
PID:37160

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1.5 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --field-trial-handle=7460,i,17645482639799250220,5720374516375562079,262144 --variations-seed-version --mojo-platform-channel-handle=7316 /prefetch:1
2⤵
PID:37188

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=8104,i,17645482639799250220,5720374516375562079,262144 --variations-seed-version --mojo-platform-channel-handle=5696 /prefetch:8
2⤵
PID:37952

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=8116,i,17645482639799250220,5720374516375562079,262144 --variations-seed-version --mojo-platform-channel-handle=8208 /prefetch:8
2⤵
PID:37984

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1.5 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --field-trial-handle=7968,i,17645482639799250220,5720374516375562079,262144 --variations-seed-version --mojo-platform-channel-handle=6700 /prefetch:1
2⤵
PID:31772

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=7516,i,17645482639799250220,5720374516375562079,262144 --variations-seed-version --mojo-platform-channel-handle=8152 /prefetch:8
2⤵
PID:33980

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=8628,i,17645482639799250220,5720374516375562079,262144 --variations-seed-version --mojo-platform-channel-handle=8184 /prefetch:8
2⤵
PID:37024

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1.5 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --field-trial-handle=8228,i,17645482639799250220,5720374516375562079,262144 --variations-seed-version --mojo-platform-channel-handle=7224 /prefetch:1
2⤵
PID:36536

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1.5 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --field-trial-handle=8884,i,17645482639799250220,5720374516375562079,262144 --variations-seed-version --mojo-platform-channel-handle=7476 /prefetch:1
2⤵
PID:27820

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1.5 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --field-trial-handle=7596,i,17645482639799250220,5720374516375562079,262144 --variations-seed-version --mojo-platform-channel-handle=8660 /prefetch:1
2⤵
PID:30068

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1.5 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --field-trial-handle=6956,i,17645482639799250220,5720374516375562079,262144 --variations-seed-version --mojo-platform-channel-handle=3816 /prefetch:1
2⤵
PID:32488

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1.5 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --field-trial-handle=6340,i,17645482639799250220,5720374516375562079,262144 --variations-seed-version --mojo-platform-channel-handle=5772 /prefetch:1
2⤵
PID:30776

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1.5 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --field-trial-handle=6492,i,17645482639799250220,5720374516375562079,262144 --variations-seed-version --mojo-platform-channel-handle=7752 /prefetch:1
2⤵
PID:31556

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1.5 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --field-trial-handle=6688,i,17645482639799250220,5720374516375562079,262144 --variations-seed-version --mojo-platform-channel-handle=7576 /prefetch:1
2⤵
PID:28736

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1.5 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --field-trial-handle=9020,i,17645482639799250220,5720374516375562079,262144 --variations-seed-version --mojo-platform-channel-handle=9172 /prefetch:1
2⤵
PID:27312

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1.5 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --field-trial-handle=9368,i,17645482639799250220,5720374516375562079,262144 --variations-seed-version --mojo-platform-channel-handle=1020 /prefetch:1
2⤵
PID:24496

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1.5 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --field-trial-handle=8148,i,17645482639799250220,5720374516375562079,262144 --variations-seed-version --mojo-platform-channel-handle=9004 /prefetch:1
2⤵
PID:24680

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1.5 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --field-trial-handle=6640,i,17645482639799250220,5720374516375562079,262144 --variations-seed-version --mojo-platform-channel-handle=9184 /prefetch:1
2⤵
PID:4412

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1.5 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --field-trial-handle=9036,i,17645482639799250220,5720374516375562079,262144 --variations-seed-version --mojo-platform-channel-handle=6476 /prefetch:1
2⤵
PID:13916

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1.5 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --field-trial-handle=6636,i,17645482639799250220,5720374516375562079,262144 --variations-seed-version --mojo-platform-channel-handle=8880 /prefetch:1
2⤵
PID:11436

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1.5 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --field-trial-handle=7772,i,17645482639799250220,5720374516375562079,262144 --variations-seed-version --mojo-platform-channel-handle=9452 /prefetch:1
2⤵
PID:22980

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1.5 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --field-trial-handle=7312,i,17645482639799250220,5720374516375562079,262144 --variations-seed-version --mojo-platform-channel-handle=9564 /prefetch:1
2⤵
PID:22820

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1.5 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --field-trial-handle=7280,i,17645482639799250220,5720374516375562079,262144 --variations-seed-version --mojo-platform-channel-handle=9072 /prefetch:1
2⤵
PID:11924

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1.5 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --field-trial-handle=7096,i,17645482639799250220,5720374516375562079,262144 --variations-seed-version --mojo-platform-channel-handle=9372 /prefetch:1
2⤵
PID:11912

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1.5 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --field-trial-handle=9532,i,17645482639799250220,5720374516375562079,262144 --variations-seed-version --mojo-platform-channel-handle=9624 /prefetch:1
2⤵
PID:11032

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1.5 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --field-trial-handle=9488,i,17645482639799250220,5720374516375562079,262144 --variations-seed-version --mojo-platform-channel-handle=9524 /prefetch:1
2⤵
PID:10228

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1.5 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --field-trial-handle=9396,i,17645482639799250220,5720374516375562079,262144 --variations-seed-version --mojo-platform-channel-handle=9708 /prefetch:1
2⤵
PID:7972

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1.5 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --field-trial-handle=9560,i,17645482639799250220,5720374516375562079,262144 --variations-seed-version --mojo-platform-channel-handle=9972 /prefetch:1
2⤵
PID:8144

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1.5 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --field-trial-handle=10120,i,17645482639799250220,5720374516375562079,262144 --variations-seed-version --mojo-platform-channel-handle=9572 /prefetch:1
2⤵
PID:6348

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1.5 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --field-trial-handle=9932,i,17645482639799250220,5720374516375562079,262144 --variations-seed-version --mojo-platform-channel-handle=10128 /prefetch:1
2⤵
PID:936

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1.5 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=70 --field-trial-handle=9940,i,17645482639799250220,5720374516375562079,262144 --variations-seed-version --mojo-platform-channel-handle=9848 /prefetch:1
2⤵
PID:2084

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1.5 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --field-trial-handle=9648,i,17645482639799250220,5720374516375562079,262144 --variations-seed-version --mojo-platform-channel-handle=9636 /prefetch:1
2⤵
PID:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=8644,i,17645482639799250220,5720374516375562079,262144 --variations-seed-version --mojo-platform-channel-handle=10316 /prefetch:8
2⤵
PID:22004

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=6816,i,17645482639799250220,5720374516375562079,262144 --variations-seed-version --mojo-platform-channel-handle=5340 /prefetch:8
2⤵
PID:7868

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1.5 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=76 --field-trial-handle=9304,i,17645482639799250220,5720374516375562079,262144 --variations-seed-version --mojo-platform-channel-handle=9756 /prefetch:1
2⤵
PID:9564

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1.5 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=77 --field-trial-handle=9768,i,17645482639799250220,5720374516375562079,262144 --variations-seed-version --mojo-platform-channel-handle=10324 /prefetch:1
2⤵
PID:13784

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1.5 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=78 --field-trial-handle=10128,i,17645482639799250220,5720374516375562079,262144 --variations-seed-version --mojo-platform-channel-handle=10284 /prefetch:1
2⤵
PID:11424

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1.5 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=79 --field-trial-handle=9804,i,17645482639799250220,5720374516375562079,262144 --variations-seed-version --mojo-platform-channel-handle=8664 /prefetch:1
2⤵
PID:8776

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1.5 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=80 --field-trial-handle=8672,i,17645482639799250220,5720374516375562079,262144 --variations-seed-version --mojo-platform-channel-handle=5540 /prefetch:1
2⤵
PID:38892

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1.5 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=81 --field-trial-handle=4956,i,17645482639799250220,5720374516375562079,262144 --variations-seed-version --mojo-platform-channel-handle=8780 /prefetch:1
2⤵
PID:17256

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1.5 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=82 --field-trial-handle=8784,i,17645482639799250220,5720374516375562079,262144 --variations-seed-version --mojo-platform-channel-handle=10088 /prefetch:1
2⤵
PID:18192

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1.5 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=83 --field-trial-handle=10280,i,17645482639799250220,5720374516375562079,262144 --variations-seed-version --mojo-platform-channel-handle=8220 /prefetch:1
2⤵
PID:18308

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1.5 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=84 --field-trial-handle=8800,i,17645482639799250220,5720374516375562079,262144 --variations-seed-version --mojo-platform-channel-handle=7728 /prefetch:1
2⤵
PID:18404

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1.5 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=85 --field-trial-handle=2116,i,17645482639799250220,5720374516375562079,262144 --variations-seed-version --mojo-platform-channel-handle=6744 /prefetch:1
2⤵
PID:18444

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1.5 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=86 --field-trial-handle=9500,i,17645482639799250220,5720374516375562079,262144 --variations-seed-version --mojo-platform-channel-handle=9352 /prefetch:1
2⤵
PID:18524

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1.5 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=87 --field-trial-handle=9736,i,17645482639799250220,5720374516375562079,262144 --variations-seed-version --mojo-platform-channel-handle=10376 /prefetch:1
2⤵
PID:18900

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1.5 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=88 --field-trial-handle=8220,i,17645482639799250220,5720374516375562079,262144 --variations-seed-version --mojo-platform-channel-handle=10568 /prefetch:1
2⤵
PID:18996

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1.5 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=89 --field-trial-handle=5728,i,17645482639799250220,5720374516375562079,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:1
2⤵
PID:19448

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1.5 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=90 --field-trial-handle=7468,i,17645482639799250220,5720374516375562079,262144 --variations-seed-version --mojo-platform-channel-handle=5788 /prefetch:1
2⤵
PID:19532

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1.5 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=92 --field-trial-handle=9000,i,17645482639799250220,5720374516375562079,262144 --variations-seed-version --mojo-platform-channel-handle=7828 /prefetch:1
2⤵
PID:20000

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1.5 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=93 --field-trial-handle=6752,i,17645482639799250220,5720374516375562079,262144 --variations-seed-version --mojo-platform-channel-handle=10532 /prefetch:1
2⤵
PID:20292

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1.5 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=94 --field-trial-handle=7908,i,17645482639799250220,5720374516375562079,262144 --variations-seed-version --mojo-platform-channel-handle=10668 /prefetch:1
2⤵
PID:20168

C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\elevation_service.exe"
1⤵
PID:5640

C:\Users\Admin\Desktop\MEMZ.exe
"C:\Users\Admin\Desktop\MEMZ.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:5868

C:\Users\Admin\Desktop\MEMZ.exe
"C:\Users\Admin\Desktop\MEMZ.exe" /watchdog
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4708

C:\Users\Admin\Desktop\MEMZ.exe
"C:\Users\Admin\Desktop\MEMZ.exe" /watchdog
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1220

C:\Users\Admin\Desktop\MEMZ.exe
"C:\Users\Admin\Desktop\MEMZ.exe" /watchdog
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3164

C:\Users\Admin\Desktop\MEMZ.exe
"C:\Users\Admin\Desktop\MEMZ.exe" /watchdog
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2960

C:\Users\Admin\Desktop\MEMZ.exe
"C:\Users\Admin\Desktop\MEMZ.exe" /watchdog
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4656

C:\Users\Admin\Desktop\MEMZ.exe
"C:\Users\Admin\Desktop\MEMZ.exe" /main
2⤵
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetWindowsHookEx
PID:2996

C:\Windows\SysWOW64\notepad.exe
"C:\Windows\System32\notepad.exe" \note.txt
3⤵
PID:2044

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe"
3⤵
PID:25400

C:\Windows\SysWOW64\wscript.exe
wscript.exe C:\Users\Public\ghostroot\Message.vbs "C:\Windows\System32\Taskmgr.exe"
3⤵
PID:29736

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=batch+virus+download
3⤵
PID:23044

C:\Windows\SysWOW64\wscript.exe
wscript.exe C:\Users\Public\ghostroot\Message.vbs "C:\Windows\System32\mmc.exe"
3⤵
PID:25748

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://softonic.com/
3⤵
PID:27212

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=vinesauce+meme+collection
3⤵
PID:31524

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=virus+builder+legit+free+download
3⤵
PID:36576

C:\Windows\SysWOW64\wscript.exe
wscript.exe C:\Users\Public\ghostroot\Message.vbs "C:\Windows\System32\mmc.exe"
3⤵
PID:37892

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=dank+memz
3⤵
PID:36368

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=skrillex+scay+onster+an+nice+sprites+midi
3⤵
PID:32736

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=how+to+code+a+virus+in+visual+basic
3⤵
PID:28760

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=how+to+create+your+own+ransomware
3⤵
PID:24372

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=internet+explorer+is+the+best+browser
3⤵
PID:12440

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=virus+builder+legit+free+download
3⤵
PID:11100

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=g3t+r3kt
3⤵
PID:9428

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=how+to+send+a+virus+to+my+friend
3⤵
PID:1500

C:\Windows\SysWOW64\wscript.exe
wscript.exe C:\Users\Public\ghostroot\Message.vbs "C:\Windows\System32\Taskmgr.exe"
3⤵
PID:32164

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=mcafee+vs+norton
3⤵
PID:17316

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://answers.microsoft.com/en-us/protect/forum/protect_other-protect_scanning/memz-malwarevirus-trojan-completely-destroying/268bc1c2-39f4-42f8-90c2-597a673b6b45
3⤵
PID:18300

C:\Windows\SysWOW64\wscript.exe
wscript.exe C:\Users\Public\ghostroot\Message.vbs "C:\Windows\System32\mmc.exe"
3⤵
PID:19892

C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe
"C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe"
3⤵
PID:20652

C:\Windows\splwow64.exe
C:\Windows\splwow64.exe 12288
4⤵
PID:20800

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\Bolbi.vbs"
1⤵
- Checks computer location settings
PID:3172

C:\Windows\System32\wscript.exe
"C:\Windows\System32\wscript.exe" "C:\Users\Admin\Desktop\Bolbi.vbs" /elevated
2⤵
- UAC bypass
- Blocklisted process makes network request
- Disables cmd.exe use via registry modification
- Event Triggered Execution: Image File Execution Options Injection
- Checks computer location settings
- Adds Run key to start application
- Checks whether UAC is enabled
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies Control Panel
- System policy modification
PID:5160

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c C:\Users\Public\Ghostroot\KillDora.bat
3⤵
- Modifies registry class
PID:1584

C:\Windows\System32\rundll32.exe
C:\Windows\System32\RUNDLL32.EXE user32.dll, UpdatePerUserSystemParameters
4⤵
PID:364

C:\Windows\system32\reg.exe
reg delete "HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal" /f
4⤵
- Impair Defenses: Safe Mode Boot
PID:1876

C:\Windows\system32\reg.exe
reg delete "HKLM\System\CurrentControlSet\Control\SafeBoot\Network" /f
4⤵
PID:2932

C:\Windows\system32\taskkill.exe
taskkill /f /im explorer.exe
4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1728

C:\Windows\explorer.exe
explorer.exe
4⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops desktop.ini file(s)
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:21844

C:\Windows\system32\takeown.exe
takeown /f C:\Windows\System32\
4⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:21872

C:\Windows\system32\icacls.exe
icacls C:\Windows\System32 /Grant Users:F
4⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:16520

C:\Users\Admin\Desktop\CoronaVirus.exe
"C:\Users\Admin\Desktop\CoronaVirus.exe"
1⤵
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
PID:672

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
2⤵
PID:2420

C:\Windows\system32\mode.com
mode con cp select=1251
3⤵
PID:12560

C:\Windows\system32\vssadmin.exe
vssadmin delete shadows /all /quiet
3⤵
- Interacts with shadow copies
PID:29652

C:\Windows\SYSTEM32\wscript.exe
wscript.exe C:\Users\Public\ghostroot\Message.vbs "C:\Windows\system32\cmd.exe"
2⤵
PID:5432

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Bolbi.txt
1⤵
- Opens file in notepad (likely ransom note)
- Suspicious use of FindShellTrayWindow
PID:21724

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:15108

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:27400

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:23416

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:23376

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:10236

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Public\ghostroot\Message.vbs explorer.exe
1⤵
PID:22752

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x33c 0x320
1⤵
PID:26684

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:32404

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding
1⤵
PID:38684

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Public\ghostroot\Message.vbs C:\Windows\explorer.exe /factory,{682159d9-c321-47ca-b3f1-30e36b2ec8b9} -Embedding
1⤵
PID:38744

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:20960

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Active Setup

T1547.014

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Active Setup

T1547.014

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

Safe Mode Boot

Modify Registry

Indicator Removal

File Deletion

File and Directory Permissions Modification

Pre-OS Boot

Bootkit

Direct Volume Access

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Peripheral Device Discovery

T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

T1102

Impact

Inhibit System Recovery

T1490

Defacement

T1491

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems32.dll.id-DF8C3D32.[[email protected]].ncov
Filesize
2.7MB

MD5
344b62f6cc2397c769b5ef97eb13bbee

SHA1
6b7f06f3161d3a8e6279812fe5b8a75ba581d0b0

SHA256
52fa6b0ae439f2cc135bdaf2ea1d789d1926a670467b771ec0bd57a66bdd65bc

SHA512
bbb44460105b80d4c2bb613538fa6f440e4f3677c6b98d06ffc8274e8848e923d2761ee96dc7cbb62d9e043cf6c3eef1bfef16715ead13d0df32cbaf282021f9

Download Submit
C:\Program Files\scoped_dir4248_2093113460\128.png
Filesize
3KB

MD5
41acc59693d8a4420e1a2725e2b09747

SHA1
13e23d65dcb31fa3c38ab1b5b15f3f0d0eeb4071

SHA256
ba7e3e2768b64ab56de6e133acae0d5178d48c9b0d0c7b2331b24a4619bf1b77

SHA512
111785077fa97152bcc77f574cf7d9af624531530451d7779537af90365c37b447e2b590ac308750adcc19920a60109a46b14443cae0a320ff41b306961b7fad

Download Submit
C:\Program Files\scoped_dir4248_2093113460\150.png
Filesize
1KB

MD5
79ebcec94a01d3f10d6399602d1fbf94

SHA1
deca553b726adc9eddb4fb1aca579a43a65b5fb3

SHA256
3dba3a8980fde0f8feb46de0eaafe6ee7c00f3e35d90cc657a64e02eca88ef75

SHA512
2f54c151619f22335012e3c1089e0663466270dc3d4327873920b784466c72ec1ab7932741a81c684f70da9c90014b3a8f6b9b65f40f1d52ecc0cfd64a814d12

Download Submit
C:\Program Files\scoped_dir4248_2093113460\16.png
Filesize
377B

MD5
0314de72bb823363ead832e3043f7618

SHA1
98cd92f52ef9045d75e2e5e82fd0b0fe5b200618

SHA256
97faf167448554b1ac290acfe53cc70cfa3d50ae8e818fe417d306cbb489f361

SHA512
923de7eebee0bfbf5ecee885cd089d57e0d7fa8186044b04fb314f01e610d6961cb2f60f3dc0a3b7ce4a9dba572dc3b374f2fdf0a58d9e5292ce3b0781e213dc

Download Submit
C:\Program Files\scoped_dir4248_2093113460\24.png
Filesize
612B

MD5
598102382bb05bb61e71756bfa29167b

SHA1
8aae71276524dd2868bf1c1a40eb7e92642b3d07

SHA256
9ef34aa0fbae9a1e8a37937cf49f3302b84f3d4f3d443c8bb8c7040660c8a944

SHA512
02236bcce19fffe1c4f86054128c4b07161cc4a5c348fe449c13a7d7f25e15612d2bee215e51a8a59732baca34b9a4c3d114b3493ddc4502ffa30a30911e56a4

Download Submit
C:\Program Files\scoped_dir4248_2093113460\32.png
Filesize
668B

MD5
efc043b47a7ae2cbac431b85f992b443

SHA1
678181b466d60609273676cd5f2c53bc3625bb7a

SHA256
b7f5d700bcc828684b0ba15e394f88af1d3d565dc9bb707c8a3326d154f3ddf2

SHA512
a243f6b1f9936e35c9cbb34d970e3adb72bb4c9b63693950e472605fc3b2a7e4f7bc5247377f697eacaf75e30eac05639d0ed8baece1f53e0eac4defe7ef94d5

Download Submit
C:\Program Files\scoped_dir4248_2093113460\48.png
Filesize
1KB

MD5
e80bd6ad93cae0c82fece3fb4fbdb890

SHA1
5d99cdad8ba0fece89995722b1d7c0a5f9e7bb80

SHA256
5d2daebd220a8eb17684686b47b985a1344195a0a8e04e735e2854a11d49ad7c

SHA512
d553f411cf6e25a11f062ef3531ca9a2febdf8df42542e2d09271b8bdde3e74fd4fb02cd9d278fa9b2b82d8bed8f0b1ccea55aa228d3ad2d48fbd35b6802ecf2

Download Submit
C:\Program Files\scoped_dir4248_2093113460\64.png
Filesize
1KB

MD5
ddfa255fce0be8e83a6b31f98c9e092c

SHA1
afe7db7015f63af45d87e1a7ee57dcb009cb2aa8

SHA256
dfd9a6407c54fb4c412a792e6a8a50d86b81ad37a13b965c815070c2e3dec81b

SHA512
d29230325d17c0a1c84a5c375bbd6a660dac381a5ef4acb196b9b01a2efc9a2201a901856bb2ffa942dfd05ac04deb4c45363b996cd7fed06439b5621c943590

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Filesize
16KB

MD5
cfab81b800edabacbf6cb61aa78d5258

SHA1
2730d4da1be7238d701dc84eb708a064b8d1cf27

SHA256
452a5479b9a2e03612576c30d30e6f51f51274cd30ef576ea1e71d20c657376f

SHA512
ec188b0ee4d3daabc26799b34ee471bee988bdd7ceb011ed7df3d4cf26f98932bbbb4b70dc2b7fd4df9a3981b3ce22f4b5be4a0db97514d526e521575efb2ec6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
280B

MD5
203ec930ecaf2443cfbe203f405b4855

SHA1
f58cc6f664b0d51acf0b21bf54c6064c68b57ff6

SHA256
79110848c0e2dcb95bc00f6b9d17cb3940b0223e361849c054bce31d61234a77

SHA512
1c4ac46a1c84e4d5f942f6a62974178dd30ab522404e45cb6e435e45f1423ef4d24d49638b8395a25bace8633c74bd985a21347571357712ce2584f875c2a2c8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00003f
Filesize
211KB

MD5
151fb811968eaf8efb840908b89dc9d4

SHA1
7ec811009fd9b0e6d92d12d78b002275f2f1bee1

SHA256
043fd8558e4a5a60aaccd2f0377f77a544e3e375242e9d7200dc6e51f94103ed

SHA512
83aface0ab01da52fd077f747c9d5916e3c06b0ea5c551d7d316707ec3e8f3f986ce1c82e6f2136e48c6511a83cb0ac67ff6dc8f0e440ac72fc6854086a87674

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000040
Filesize
24KB

MD5
c594a826934b9505d591d0f7a7df80b7

SHA1
c04b8637e686f71f3fc46a29a86346ba9b04ae18

SHA256
e664eef3d68ac6336a28be033165d4780e8a5ab28f0d90df1b148ef86babb610

SHA512
04a1dfdb8ee2f5fefa101d5e3ff36e87659fd774e96aa8c5941d3353ccc268a125822cf01533c74839e5f1c54725da9cc437d3d69b88e5bf3f99caccd4d75961

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006d
Filesize
25KB

MD5
351abd831ef165b0d53a677732d916a7

SHA1
0a3b58e32b4c96222f95965b983c1883866d5923

SHA256
74cad18795868a3a77256e6a1bce43e5761782e7c72efd85d578d6d91888d5fe

SHA512
1b11ef517b4a4fe5f8404e2318c5d7e583dfcac5a2a0d9ec9efdc75786b15262058a25bed41b9a291767aeb7147fbf01440bf618a1cf4778ba90d34cc825ce18

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000083
Filesize
24KB

MD5
87c2b09a983584b04a63f3ff44064d64

SHA1
8796d5ef1ad1196309ef582cecef3ab95db27043

SHA256
d4a4a801c412a8324a19f21511a7880815b373628e66016bc1785a5a85e0afb0

SHA512
df1f0d6f5f53306887b0b16364651bda9cdc28b8ea74b2d46b2530c6772a724422b33bbdcd7c33d724d2fd4a973e1e9dbc4b654c9c53981386c341620c337067

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000085
Filesize
69KB

MD5
2280e0e4c8efa0f5fc1c10980425f5cf

SHA1
1d78ccb26fef7f1bf5bf29de100811e1ac8bda23

SHA256
b9225cb1f0df94ebe87b9eb2ad8c63cf664d2dfdb47aeaff785de6c7ce01aa74

SHA512
b759fcbf578947c0290ab703652df9f37abb1f9f5cf6140acaa8c4d4ee655ee0ee1f9bee9d4fd210d9e12585a51358b52e0e9c0878abf2713e6fd69a496ac624

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000086
Filesize
328KB

MD5
43af5c3167fdfcd680743f73ca4797c6

SHA1
d0112d91ef86ccd7ce7d6ac337902507035f67ee

SHA256
1cb2900776812ff6fedd4fce9dd614a047c42f971331caaba6fdcf473b7d4d4f

SHA512
b1e5171e540a4ad9e7551e6d698eea79e1a5764efc12b08280d34267504007bf15e6e78a172ece13f6565647400119e26c41bf3305da87957a6f8794b002302c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000087
Filesize
105KB

MD5
f94a23999ded29172d782cec94ec200a

SHA1
b53b54c31b2d8267e57e900e05d7256cbee8fdcd

SHA256
862a9834102c10710d1d031344cdf5f42a1fac732893d18eaf42434d3df5a0ef

SHA512
99147f93bfb2abd8b79db780adfc3132e0844f8c4f063a513e7f6810416bdfd59cfe09299cea70bca2162f12b514edb2776162feba372915969c058611408200

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008a
Filesize
18KB

MD5
e04d07cde610ddce3944744116f61009

SHA1
c5966cebf2d7756314d64641fb3316c88a4ac097

SHA256
9222cb7a8db8c17d6d7c4f7407c9a4b029d73b6d734a314304b78919fbfe60b1

SHA512
b1cc1fe2585256b18fa58d314d9539408352f5ad1b93a3adc2a4a5c16b7be866711fca38c62554a447fdaf2161d05ebaa31406f8d164ad39610cf7dd4feb542e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008d
Filesize
226KB

MD5
cf280d610989d102113861484e23ea9b

SHA1
48378e438330df7f49e1d2bdb731762735509e85

SHA256
4b7e02e94224d644551fac51e4b8587ef960a76f6741ea98444a7a9d1394ef7a

SHA512
369fda973ac68ccfa3182df162538bc1fdb2d6451670bce18b9683432cf559ad0cfb4092766d444e7653718569b2d25bfb988c702d202405fe7060314f9b5c19

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000090
Filesize
32KB

MD5
a37cb5b2be3ac24f85e18e0f6af90e18

SHA1
7888cab4667f8997bee7cfe1357b6d090e5f987b

SHA256
38322e4056896c3d332335130caef7ebf6f02a9e902e87adeb3141aaaefc5eb1

SHA512
f2772d825de479756299954d0d6b67c3c940e41a2e2329a733e755b8b3d107c53fbf845d64330ae9b75f75f56f872b9f6fbcefacb55606a0ae7fda58eab6b384

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000091
Filesize
23KB

MD5
7ef4c868940474e95ff7cd16af7d6094

SHA1
097edf552efc7f1ca4385da8f1312ee9047d9a3a

SHA256
949fa6feeb661f52de6cd85cd5ab44e315a8a8d22c48e1bf7f630e37dd9a9223

SHA512
730754efbb62a0a6886ede62f2daedaabd6230a4611e26e72b4c84dfbecefc8099b30e11c03debf76eef15df6de2f57e518ac77f1763fff734b123c0e22b33e8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000093
Filesize
32KB

MD5
fe0cb11576905a924b316b72b715c2e3

SHA1
31a833346d235602a4fc51b49ef9bf57d9d1409f

SHA256
ee9fdfd767036158d8d3bc22f6c3095c5bfa6c17d4611eaacd45a5a829a864b9

SHA512
0227816287e01021bc07b84db89642ed0cc5e1c3a653a8be2c38bc53dcb17cd62b1a45051cf143ba9c2a5880df961d281192547fbb0788d95659ec5169e98ac4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000094
Filesize
19KB

MD5
b68743724f30bab18e5f2556c8770bc0

SHA1
808e1e7387097820d6059c836b3d65b6a4ab61c2

SHA256
5830e4d376959aa39163b70792e4fc2652da57f7e67aaf99d6e0de3397cca7b7

SHA512
8367ec9b732a608ac975fcb6ad2816e92796a015d3fa9290f32ea9a8ac0df491d37d8068cc419806549c8777023d65cfa953a4cb280f983f5830da741dde3fcb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009e
Filesize
253KB

MD5
1a3d103ffdb2df8b2ba533aeb0dde273

SHA1
1f37293c95fa6be649073a3d20d2d498e609d194

SHA256
753175d72b46759a13162fe598f489cfde0eb7803cac2aa1ed1f7b8c7196fa22

SHA512
53d48e30f2ac2bcb8a021127506933f8257305fc7155db363320635eccb79450eaaac7de1d1a6b210f4232fb9abe52313b6c06a4cbd9fe8124f6ffd231cc1211

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009f
Filesize
163KB

MD5
e46bbcea45e37e595a5f88801e351691

SHA1
b1b64547963c8154fa8ee765b1869c0cbf746299

SHA256
25d5f35a2dc5516193ad87207872a1dbedc00e7adfb25aa10dfcd7f5b8f9d68c

SHA512
fa02818ff2b3ddea287a2c32777a1611319d7566a0a0e07ae5961d1cc0bfb96c6a9d6eb82ec20fb90c67a4dbf1b657dc21e0ea3a16efafbb87ed209af864842d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a0
Filesize
42KB

MD5
acbb80da268a4c5187c695616dd8c935

SHA1
f4c985d094af4e5bb7390b33ab146a0b2846c34c

SHA256
5a8ed99ce44b23080ba2d650901ab08cc129e671507c7b9a092a72fb35c5ec24

SHA512
80b4749778bba3955ce92124974df30054ba0f383856a89bd4dd305ca4d673021c0ba1413e629f13748d9d1b09854b9aeba92260561fab10a303bc41509333fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a1
Filesize
206KB

MD5
10497a6582db9930c510c3829f2b031c

SHA1
9f6261697a902ef0f13d1f0167630c8ac3d3e125

SHA256
46abc964e77324cea558dc8546e6074a14167052c891ff4479d16e068fe0015b

SHA512
e7c2c5e06df389cfdf9cad6d4b8b2288b2ac638075c4cee3ed6e311e638b168925658b662e486d15de29c242915e05fd153b7295dbc741a5535622c609fa39a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000b1
Filesize
53KB

MD5
d0d07bebf9509ed85ef927fd7b7d64aa

SHA1
4f6161bc4e2f12a919ccda7b13dcdcf3beb643ab

SHA256
a936ddb82521e6efeeece1cbba8f900dc36ebd60d9b4f180dc858d1862d30faf

SHA512
0b2450fe3eff146c92d7c3321dcb1eb96570f566d2cc6dfea8d6fedcc3786de025475c363010b8e409a7d3f3989ea3d82d4d4d54a7a2f9044240a1c24450ae15

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\23f05c81a59c0421_0
Filesize
282B

MD5
45872bee2ae00138a2f3745bb8a37b78

SHA1
0af60510a96cd4f77df0e98799cc5698733cfb69

SHA256
2a39a6652da514ec0a5868f0c7ad830bf94304d2ffef78abf048c8881f469c18

SHA512
61c93ea9d51e08f9a3e085defb4dee67beb0c62c61cb3fcf98d504d34e88281a9f728be0544aa7c06d34680e50162989b267732529f1e49cbbf02418ff136b37

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\47da525ce32e27f9_0
Filesize
3KB

MD5
95c0bb0f33f391ecfad375de328a7560

SHA1
7b21f21dff08e4ec8292621ac1aa694f23a2c108

SHA256
008b92d8fa84b459996a002487fac3f69976f54b53765e573dce1b85611f2178

SHA512
0e5f0823b94c82c0a1d5e76df6fb3a89c412100eecb70f52d6a40eac02afb750477f2c7f90afa4fc9b7d424a0f99a6e349b36a129196279238ba435508a34187

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\569c4b337b00a247_0
Filesize
19KB

MD5
b105c9b5f7cb8b64f81717c479f48183

SHA1
8d60b4f34ef5f61f25d4992e77cc2dfdd1d3f641

SHA256
4dc3f3f58b66231926a598ba55fff2fdaf9a56cd3b451e3c70cc37833b3060ad

SHA512
035bc1d0b0405bdc7fdc0a23c123a4d5adae5c39a6ab53aacb2b8966393e6922c193448cbd63d9aeff17062a8290fc137e2dca86a820d8e19d38a89235a724e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\7e4cd3714e2b0194_0
Filesize
365KB

MD5
03c87c147593387aeb5c94acc9c520ab

SHA1
8a6a043dc7d008959054922d5cee669f815b64e4

SHA256
1313bc29b5b3eb26832fd5f006142e493e61eb9399caafcecb286e9b3b85b323

SHA512
eede686923923ad069cd4f893d4e3f083a9290b73a99a171b5a64e9a4da162381780e66771e1ba89329de2436edfcb6403f06ab1ca305fc46a15fe7fbcffcf68

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\968cc64e6d2e7bcd_0
Filesize
257KB

MD5
42c2820dfeedb82fc5729580158cc5c5

SHA1
71bd89fdf3e53ae99e5d18f2a99d82ba8bda32bb

SHA256
78f3bb96f382af97a6829048e4f310839c71988140a28a4eff1e026a22826e0f

SHA512
59bbcfe4ca417080dcbc7183bc2e46643084d664294e489e1182ae0e88f09466e8c7a55df0cde92c54c6478193eb14ec8a9ecf605a2e72fcc274544a0d86f79f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\b9d3523f242e482f_0
Filesize
2KB

MD5
ed11cdf1d82d5b25568804049f3f2f03

SHA1
ac40337c41d7aae2bfefbdaaa8825157793df8b2

SHA256
4554ecf7797e8f0505e7a8a3b43868514b455db081eb99c40e967daf82dfd3dd

SHA512
0ac007c80466678f9c309306250c72aa9058a07a8741e860a9f3c592f6a2c42ea2a0b80cd21ade764ac0da36514dbd1ec963381ef717c57212e8630bd42876b4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\cbe1bb575e19636e_0
Filesize
349B

MD5
c00ced062b3e2afff368d13e2db62491

SHA1
9de53b75fc0fea72cd7f2438ac30709d023f6a5d

SHA256
71a9b80892eef137a28a3037bf926c52215d3346de3b65bf387466fdbc85d577

SHA512
4c4e02c2715d3968a6a4b9da7e6df5bff9151fae97f1d5e39eae07bfc5f878f745f574132d0edbfd3e6413042f704b28f46050c064f50cb3334249455a8582bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\db9ac2a6ac093915_0
Filesize
1.4MB

MD5
756650421982d15db1be2769a274f3a4

SHA1
83c7f090c4c2a172d221e1e0aca7b0469b2b7508

SHA256
40f685ac198df2874eafab0db42912e630e9a2c60fe32d81fc96b57a0d667590

SHA512
3e7da07efd895a3f97c1e48c113b78670c070ad6bd78ce354fd965621dc7c24197d93c6f74b901058e1c7892097841fb07e07484b88a88cd128ba8e696fc32c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\ec5ea768045d5c65_0
Filesize
289B

MD5
d912ad33aa57e90bea9f88e98eee2daf

SHA1
f8b3e3a3154d48d63ccd0f90452dded6747a2d2c

SHA256
e6a7d156c0b889f9e62cf900177b5bec4e5e5195a129e8dd5c044cddf9f9728d

SHA512
5cf3a3d3481b82012c617123113bcde14bcff4993b3892430e386e1ee5b8779d8b8ad91e1dbad4db7632ef8d3f356234827f6f61c0779067fdd0d7f7651db707

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
5KB

MD5
2efca94b2673d94a108513dc622cbbbd

SHA1
86cd65893443f95dab3293390446d6eda0068fa1

SHA256
6e37430c29572b365d6bd614015af3830f6a3cf2c40cf06a5af549a3fd363f50

SHA512
4d9e4cc00ac09a283a6fd438a33545b98601ac84bd50c2bcaa470ea7e9784164d13c4bc602b970583935490798f3fc8b965cfaea029c9bef3cc133ccc5f1ff57

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
9KB

MD5
a5b13beaf827c27964ddf980ddc0985f

SHA1
6ff40d6388964946e0f3359651179922663a556d

SHA256
86ad152df9d7f28c43b33ca7ef94effd7ec2563d341021ec11d71c5f7a863575

SHA512
5d54f90e23ca6e1d89d439ffbf4dea6a44503a9d0b4efa45fb2efd52fc1c59730e592058746820cfca3f2dc0cd7d6a2b131de72a2af4f620fb769127ff9676e4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
10KB

MD5
cae2b59279d984c183b30a64ad82366e

SHA1
82bc6e892cf666d89f9b8052fc17354fce011b30

SHA256
8b04919abe01bb821b0f4cfa1a6d2da11b920babe0622804bd41e62d54644bd7

SHA512
fe3306537daa12de770e372f254fe2588cb3c2786c674e9749740c75414a9390a3b5dcaf14abf6ba02b95ccaff36378d9b030fe8f2150bba8c0d225f03a1846e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5c65a7.TMP
Filesize
4KB

MD5
215d9b0c39cbfb842f5424c2b5e69f9e

SHA1
fe55432d88ee955b426b33cbf02aa251b8d8bedb

SHA256
5b6de6810c301f1e9ac410e9887196124c2eef38631a25e693876ff6e513e2af

SHA512
6218aff88db46e1ee483b99f4b0f6ab0c854d052c7fa6f2e18e00014d76279987ec9698f879d95701c453958b8dabb42ce2c835bb0c29635d9bd9ac646ad932b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeEDrop\EdgeEDropSQLite.db
Filesize
32KB

MD5
b7fd26ee1d72b58af07d9f16fc0996c5

SHA1
cd4da17ecd21c12ac33173bd805befc40307173d

SHA256
ebbdefbb919e56a4104ed7ec10c22051a4399c80363c0ad259115bec7abe4526

SHA512
d113b88128ff91f8ccbb9d4c4324da7403243e7d0d648c400254b9b3dcd1ed632f4a7acb12358917336e50ca3bd22512a1fe777a38ef7f7ce2ba675f056ab90c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\CURRENT
Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\MANIFEST-000001
Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\000017.ldb
Filesize
12KB

MD5
f86c6f45275bce9c897f0dfcc96584e5

SHA1
147d147b21f9d6ac129243d3fecc664c52b613b3

SHA256
d29f110ebd293e9e1d47be801256b55d7c8b81ffb01285e1f7c1ef2a1c1963bf

SHA512
8efb6d56451a556ee27eeb4c52bd4c4f72fb1bedce6424964b85ebf582073213a640a5c27f1298aa2b196c8ea52b6e9781aae49f5e7a08acae928530d384b943

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\000018.log
Filesize
111KB

MD5
359dcac8a5b440d036e6dd7088a0aa60

SHA1
947815bc6e7d95321b99ff99138354fea9612d8f

SHA256
770ec833365d8f3b82572181ceaafbf165f337cb87624f3fcfb4bcba65c27f5a

SHA512
cf698462f523a20b55f95ba62c37544d49f068eba1434b79c04097e38da1e3b86a9801146bf033749a775e74fe948aea74c1f05d9ebe5bb7ea51bf46fd077174

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\000020.ldb
Filesize
9KB

MD5
d4fd196e664aaf0a9a3eb93b3549ea14

SHA1
7d38d6048b1b8dbb77b5236f008f37db7f2c3378

SHA256
29ad83c4de95ba965dd9512d15fe7029868484c6e59be514e858e766c19a17d5

SHA512
3871b0ff788a45e4d8ce55bc13f1687c9e129e304074592261f4c21fa41daf059e5d4711e3e78a91d4bf6b743f2d23029d9071d0c6c6770fff8fb6204981644e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\LOG
Filesize
6KB

MD5
1cbff2ad66ef373148074ab8faf35f0b

SHA1
b2541e965cfabe8169c4d2e6cd88d394dd7217bb

SHA256
f09c447a800e696daa0f80bbc085c707defd33dce3f84cfc76f6b0ead4628559

SHA512
2b6351ee6b599d5d44035ce2d8e7192df38b362b99be19a0875fb44ce537584103e64bdbfe53b0876a21808355f8a57c5ca2a2affa8bc6d5c0d3e754d2122905

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\MANIFEST-000001
Filesize
1KB

MD5
b9397c9ee53440f163e9ab9c6b7d59fe

SHA1
5cb69b021ca24df5004989fde8bfcb39dcf3787b

SHA256
5ced77718affff75c8ecd43d3e27472966ff09fbc2be7a2cdcdd48c4c9f7779c

SHA512
3bb793c5bb682eddfb737623091ad00a6ae10d89669fe832740c363fcf236d34e36a6a5b25a53b913008042f1bc66291a22d4725983b782fbb55b48901aea335

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\JumpListIconsRecentClosed\3d8d677e-fe32-4be7-a89b-f770c80ae609.tmp
Filesize
25KB

MD5
e0485c0d743883df435265f51f5934ef

SHA1
2be1dca331fcbce9e08f7c58abc23a49988590bf

SHA256
cc284f9755742791d39cfcaf4435a39c727fd8469bbaa647809f3b710cda3cd3

SHA512
b518d0774e6ce8cab200d741be0cda0cb3905fece843bd769e0b64c437a903e204b5dc0fc6544b425d86861969a58f7f2aa589eea8584ab60b056183c1b551ce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Filesize
7KB

MD5
6f2eb8fa955f472530894ecc1fc4f0aa

SHA1
cff00af932a198b11d5f25e809228df2fc5f2950

SHA256
6f6c30b984b485e85c3d298f9a39ffbfada4bea1e6bf55b970b58f868b9f9800

SHA512
69bed986be7db40b14d2e78cb21e3fb180d8b160f619ab9b1a09a715750f1a35664b81f884e2961514a2f7ab688ca7acde48fac18d003312304ae56fc050f588

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Filesize
10KB

MD5
28558abebc611fa2ddbfe4cf10098496

SHA1
61f0b1b3ff597e44275f9ad136b9dad3785936d7

SHA256
6cb0b6dea6e7d3eebb4d26ce3849d44759198eba5d79353a005b6e731804aacd

SHA512
db59ba8764956178bc7b5bbc4110b43e5c720c4c53d0193c09bd09223f042a5a57d2b79607a3976d5305e557e81fe7bf9284f16860c42d6ec1faef7ac20ad7fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State~RFe5bb65c.TMP
Filesize
3KB

MD5
5e24c2252d5b4dd5ae52e452ce1c68a3

SHA1
b56b29fa373cf023241b9afbe28eb494fcae77dc

SHA256
73dc6e527c3edd24a24b038d9da4f83f71964ce673ea040b127cca038a0b3eae

SHA512
97f3fb07c3f19015bba9c920b10f9b4063b15bd6ab4e77af391b54a21aa2219fdcd938f72135c712c3ca35c6b9466037598540eb8811a3d0417adfcffac26ece

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Filesize
40B

MD5
20d4b8fa017a12a108c87f540836e250

SHA1
1ac617fac131262b6d3ce1f52f5907e31d5f6f00

SHA256
6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

SHA512
507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Filesize
3KB

MD5
b53400c27806acf3731c02d20f0846a6

SHA1
e9648670850472fcddf89f469b6fec1130d088ef

SHA256
bb7b7950830f1fa1bb39611e8b82231be14fb48d249fb2644cc5635ccc1b42c6

SHA512
5c630e6a613e645216857bac4a469afe0422c93a4ebc8341131421138fd6d12e6464a58a46937c8dc02afd12ded71bc9e942f0cf042f42dac0072d3e5b9c84cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Filesize
4KB

MD5
55047279254bfc3189590907b6926876

SHA1
0e5daf722824f999d439913c03fff964cbd90000

SHA256
ac214e4411ce2b9afdc4ce12754a828ee877d0df31aa216aec10cb6ea9747c2d

SHA512
b14ed1a783a2a0a9bac93d4df05d0e7da312e64b182490fcd233fe2b2a38247d663d93da6ca9747e7f3b17f0ab710534f8faa9559e14c7ad07a9dfef8787c893

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Filesize
4KB

MD5
8f285253b0b5047bf5ff829f79ee3f87

SHA1
b1a1d5e1e3cd81dbc9e657376967adb1840e6782

SHA256
fb8d86cc8704b07d0546e580bcc92fd7f30c0ef43afed9d30d9a09bf12185317

SHA512
61896cc707fadabef3a05730b6922da0ac6d33db137968dfe2fb198e464738fe1286d2d2ad7bd22c5c828fe849e85ed02fdc48a438286c203532dc60b679b930

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Filesize
5KB

MD5
d8e40ee52355a15f999d974ff52b543c

SHA1
18398b0b4bf1a9b4e1f4714826766ff0fab1ab69

SHA256
6ca99b1275001c733f8f1ee53d00ce3640fb27c7a1d8193859e426cd9d9a3367

SHA512
9b52d345e4233622ee7b46aaba76a8aa62c35d2d2bdafa94eeb9a199975ac7553e8d7c6fed7d66833bac2fe8ea8eb76a7b7408ae92622a4fc9a2cc96da5f0b81

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Filesize
5KB

MD5
18894ce7849d9551450b9720152ec227

SHA1
17033e43a35cf868d21c674163bc55a78cfd5d7a

SHA256
d24400adf2089e6e745d45c3397b69c2a2d35dfcd8fd3a1ba3e3b1e338f4f2b6

SHA512
94dced160cc6aad7c60085d25a9394a76f927b5afbb4eb6d37a2668ef78e80bf921041f570456611e03314190a2d212eb94e534abaa2f9e98246e025c269ad52

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Filesize
4KB

MD5
a15bc7433a086df6d66bc623da98cb09

SHA1
875cfe0ac10a147d286b85ef914274c3e808b6d5

SHA256
e5634cb809d36860a29a184af190dfb32db41f5e4cd915440b570c2fa4c03b0a

SHA512
8bfe52cb4fceece1b9504ece7b70aa69d18dde014cb2176dc6a7cac5f7ba379a1e1ffb396882521f51e0d8797c776423a5264b59425157eee51e9fe835f80f6a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Filesize
5KB

MD5
2dc571488314140a9ddb8efb233ad0d2

SHA1
2c1837c5cd3c088d81ebc1233c9d87cf7618dd9a

SHA256
9a08ee5c3d38a9f69b95b47d92fac7cd8aebdfd9cc8e2384aeddd97fcde5f91a

SHA512
41fde35ebe46a1992f02f2c683a531ffbae447e71752f00a63e46b136f1e3f3042ec0de981b5cb02e455b4856a71ace8ddaf40b67237e0eb25607de109942a39

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Filesize
6KB

MD5
a10d9e84582b275b624bf1e8372b3f10

SHA1
93ae5b3714483ef115859a818c5af7705eba81a7

SHA256
4fadbfe7b67c0ce84a6bcbff4d1fc1e52d680f778166d8463518fe268a24ee18

SHA512
bf7907e32e91176d8bb360156f88aa303e4a190f375c3d7f9ad92c494d93bc23844422bf449615b92970f310c0b5d6a943f1486aa7d6868ddbf7197604083491

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity~RFe5b8818.TMP
Filesize
1KB

MD5
1de2a1ecb87da942161c41bff4104540

SHA1
109fa2268dae48f75103b4c6e3daead15496994c

SHA256
94d4db1cc09792582ff24c2447e0519e90da28be11b97e3113aa68b3a5e8a7dc

SHA512
d25df4c466accec1bd4d2547d7bd7d1082dcac69b5f6a774ca6bf100fcbc0c28afc18f6cbb4af6a2949a942aee88e4ada3f39359b3cf66c88c139a37cae0f812

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
15KB

MD5
3b58ceac65b4e0e47f1d36e5c2a3cc1d

SHA1
5198d42aef767e19256ef6eb21dbe4e5038a8a16

SHA256
d60bec1643dfac096cc19429ecef3bc423fed84bd0d80e6b464902a8c66e67d1

SHA512
a0fb4b7cb6b4e15cf84379b77233f99329df21a5b3d34cec6ae35c97b2d25034529ecaa7bd4f4acee03571feea3af8601f6b26700e5f059248f7d091bfeec8de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
15KB

MD5
bf46bdab23303ac7e6414f3f20829c7e

SHA1
d695244938bbe3358cd926838b5e2b7940e36279

SHA256
80fde6738131e5307197c66fb38c26fd15b1361a8502db4396da1f166b513b9d

SHA512
fcfee83e6256a16f2bfa66119eb36198b51a02caba44393de9640e2ec8efea34e0b374872228dfce18ad6a69584667e255aeb18ea2c9a7a8d20be1d4e41577a5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
15KB

MD5
5c425147cc62e0d67db9abce41c9b6ac

SHA1
29b0cc3ec7365caf889af1f687a3908e68b5b8cc

SHA256
e5063d7fa6a9631c6af6b3fd4b60c6a41da2bfd5ad66b4454d6eedc4d73e535d

SHA512
cd4334e3162c5ecdb275802fcdd3658f10b8027aa37e04e18c55944d61edc60b13e6fc520039085462a8f95e04c315215c8a33334f721329fa615d73a8d83003

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
15KB

MD5
c9a240a23ea1be4c414c44a27647c14d

SHA1
e2650968b35d52e365064a16768ddfb50efa073d

SHA256
9eca0283fb9b3f3df03b77996579c0200c0393b4ef60d88e08a2f6a91d836be0

SHA512
b3a61ae884a363a5c19d95e937736bf8996a64e256bd024ac7c474dc0ec6df3b144d385938b1beb38826ee5f9efc1af2932684c2f64648ea5cdd23a1362ce41a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
15KB

MD5
47084359c42eef83071b198215860a08

SHA1
a5db6accd948e945d1aa8def8deba993b6918cba

SHA256
14e934aa7d8f76f0c53b83c121fd3d51ceca2d0350e29e22ee9f170b7c7f61a0

SHA512
99308899989765327d33f681ea25e29b34a5e5022d5bbef19e029f276695b36e9080afdba9f379d52fdde9038dd9b774d508b2b0611fa780810b81d7884b64b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
16KB

MD5
fbda6362482879c6c8d1ab90b015dbcc

SHA1
a52546af0857f261d35eeb949244e4483637d409

SHA256
73e678527e7f9bac1ef49dd96a3fa3b34c38fb74c67de6da683a0e1241de93fd

SHA512
46b7329f795b33bf65677d199d03f419767d4727f91e12ddd890471727241b89340ad55f32b762212d2169b917691d0056545d14cbef21a5d8724a5411a09f53

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
16KB

MD5
235b09b53ad79c88ae7b4283084920ef

SHA1
91e24920fd376d090f6ffbdcab8047de3c41addf

SHA256
e6734b8c29188606b0d727f1711f043dac6779838795970443772c20a1c91fe8

SHA512
fb5e236e40d83bfa9f0a5d00ae46cfd7a40fb7994022504849ba4262cd7a82c98a83dd2cb21f06fb0fa62183d5fab5762ccd0859e37d117f565bef43086d50a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
17KB

MD5
0dda260a9cf75b23b34e1e6f8820eafe

SHA1
980f241789d40395941c4979fac6dd5ee651daa7

SHA256
c02574fde7c83b8eb88ac9d70a826609ffd5846009ca1cb8440fa7f2ca74be39

SHA512
2919b3e3f7dc9ca2d0f126a34ad4adc677cb521704a97dcb5411848c00153a6e563628502116148ab2993b53506e4b4734432a6816f132783e436cdc18f65d41

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
18KB

MD5
6ac2fbc3b79414a9fd770be6d3b7ffce

SHA1
e80b64f7ae14316313fe46685aa2722e4a1e8fa7

SHA256
e32ab5332bc9d4211034efcf7a84304760e0501d26dca00cf9a97ac013a71d9d

SHA512
353906af5b5a9b9a01ffa255117fbf73c9f09b72b2127250af9ecc2bada4ae6d6aeca940913411c27928fd1db0484e771df863165eb885355b6471258b32fdd6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
18KB

MD5
f10a8d49da7a1cdddf929b823e51f10d

SHA1
8441de5c994e2a0e5a50d6d5846ce29d5bb47d24

SHA256
2de7deee832893b54923757165b33c17e37a5cf947fc083a10fc8e16dd7a725c

SHA512
2c711852556da7506961e215e1eb36dc5f7562e61663788c1f7d8b46a12ff0934c7bcf4084635b4c136f0224bedcf29bd6cd2ef7093a5c559ed08733b78b2c15

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
18KB

MD5
a3b54902f3cef1bee0b40c4492096d26

SHA1
cdd01a8821887340105643e563d8b08358d4cd2b

SHA256
8d67034890c79eaa19724566e2ac202bbfb8967ba314b643e06162d1f15ba796

SHA512
57433b6a4ae3451fc248dfe0f29768daea9ac73c47a34e4a4d35aed48cd259539d0ea19095252d5c20538a31b0ec34cd69d5931731b39d9a042222df79fcfb94

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
19KB

MD5
1cf10d3337453f9afda0a734d0793524

SHA1
c8057ed21a403765a5abf44478f8f2c0967b9963

SHA256
8f61776f10defcfa8f7a6df769e7076ebe71e01ef55e353e6219468a7b1fbbca

SHA512
894736977568cafeab18e6f60068c080513c3c950a17eaddc03aa60e40191b0fef0e68f0c856cca7ba2016470bed1b2b48eb737ebfd177a5c97356de07793aa6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
14KB

MD5
23f4468e6d763a309d01dccff0d43adb

SHA1
6f22efc2f0e76d0550979eb958ad4e82baa9eb37

SHA256
75b66c926dbb104c7cb9223e75e7e5900a69b1f71c94377b2c852ccc035a3361

SHA512
996844c530fab9f24876bcc12e3b3112c24bd4361ab2f5af856cbc294e07824446f41c84ceb070bcedf3a890d43739b29455f85da0503a59bead2ff632622eec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
13KB

MD5
d76194436c1d8d98401b4a4dfa7838fe

SHA1
db307560aace5ee5a2730b3af117cf947b9c7b0b

SHA256
84b8cc5329c7ad401a84fe6f7f59765042182d70b5d60a89019465e5f0f1ad49

SHA512
f55aac28fed17bde4dd1ce3c567a87eb228876c7685048c43e7575e26a6d09d1f70a7a32ff0ced6eb96df3fa1e365b3d62b6f0a46f81ae5c8b968a30479ec22d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
13KB

MD5
bf1746efc2bd60ae20ae7774a9cf4f3a

SHA1
9d0505cec2e8516a13fb0a6383a59701768562a9

SHA256
4f067b4f065a0e3f213e40733ee0ea1d1c2a41c8a512007276f277295da1c652

SHA512
a07fe3f7244a8a708e3a0593848eade27df3a14381ea78a1d8dd7b419826da3b2bde3d4e00f7d7b88055863f2420fe77ab89c0f3e90fe527b7f76025278407ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Filesize
30KB

MD5
4d74bce9298c707b3caafe821d0029d4

SHA1
ac168328a328c02d7f34911034e393261c5b78e0

SHA256
6ab8685e8f8d47d481c3819201527bf398ec5b12f7dd445f9b69d2b8f835a07e

SHA512
0090882f6d5131b9d33291e73690259c0f57a26372130bdb7157ceda5430526f171b3e2c13df57d1add8cc0ed3fdf27d41272a41f330e6a381ceb66bf9aece1b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\1d5bc3ff-67d5-44d7-bbb0-0a3fed180fc6\f666d0adc0ee4002_0
Filesize
2KB

MD5
8f7a42ef58277b509abdfa0b112702ac

SHA1
ecb9d53a1fa2b83bd21852f0570d7b8f0c0197ac

SHA256
f033259d6659429891cbabdb2e7be20097ae854403deb1f68849be77db820fbf

SHA512
20e3fb59d0c6b4cc9dbeffab3d0ba4de6f390797422fd1d9f3d47290bc3401676d3005a052e280a5c0e7b4a56b3b66ab74a3962ba380bdf284233e0145de785e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\1d5bc3ff-67d5-44d7-bbb0-0a3fed180fc6\index-dir\the-real-index
Filesize
576B

MD5
8aa63c70d8010268956c30271ad46b0b

SHA1
a1c660f779b03683a73f65b24bad31eb28995a8a

SHA256
87d5615cf29b7ce47ce3c64126d8ebc78b49171a4058ff6a99553afd79a633f4

SHA512
b4f8d8fc0b427875180e6a25426f2a9b943c693e9c19dc00d01b5be3831ee69c21fcfd068af9ba37a8c7bece2d38d1d8d2131692b9b05f62bd9c4fa7a97d3217

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\1d5bc3ff-67d5-44d7-bbb0-0a3fed180fc6\index-dir\the-real-index~RFe5d7765.TMP
Filesize
48B

MD5
22b67311ad05cab479a9fbb035c5c2b2

SHA1
e36b0a9f98bacaff69f94391c1c4fafba2488385

SHA256
c4d36b9ae60d4589504243c7c0c63d88d191ad3f213c1b3454fdbc00d47f0f4e

SHA512
94033b0d12e3afc457ea08beec1fbb93da1120ab938cbe5adb3808f37284d8311a5003fa23873b7d978dd64bd70cf983a53170132cb6e780d214dd721006761a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\7258a561-1cfe-4b07-9a61-ec4e24f5e347\index-dir\the-real-index
Filesize
2KB

MD5
6c8a276758e3de45c671322bdd18715d

SHA1
75fbb0e2ecb08e27bd3cc5b84aeaf0f04abb80eb

SHA256
57f60c38bab49914c359bd1710e06ec792a4631413c5aadde1112e79cc7e3c71

SHA512
3489ddaeefbc465adf10b15ba0ef7d3177b64b2edec0a174b7a19736c860b83314014c87748dfa46879472c0ffb0cc106f01fc694b2eb1bb29f08009fd2c6d33

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\7258a561-1cfe-4b07-9a61-ec4e24f5e347\index-dir\the-real-index
Filesize
2KB

MD5
23800f0141f62a39fa3f90f7f0efaf0c

SHA1
a56b89bc45fd4c10f3b883009029d8c04929dc71

SHA256
81f2a2bddde914b64a15f7d434aefa6541018c21c0d1a67ce71fe3f79fadf65e

SHA512
421a59ce976e3033ea7ea74d014bc55c7ca23ba29c0e14980d6f0348461addf49a6a9c89620da1c7bfa90d5c8119805c7e18df99758d80f610851cb04e6dd7a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\7258a561-1cfe-4b07-9a61-ec4e24f5e347\index-dir\the-real-index~RFe5d1669.TMP
Filesize
48B

MD5
34c0a6cc2dff79977cf8f2f157fc864e

SHA1
a59fb7613c94ae5344ee4b59fbcad593e7d54203

SHA256
5246dfb46dc4c0c17f7e3ce8208de1486b21ee574dcafbf1390f5dd0c2f562f7

SHA512
ce18996419a7fa54f842124d3ca14f3d83f0954b3cfaf16a241076146dab3c838296cff552ef5f05f783f64c787e16711cbb8e6bf59845fe1cd9d1b29ed386d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\8e8cfa7d-b6fb-4170-b8dd-169d838b1da5\index
Filesize
24B

MD5
54cb446f628b2ea4a5bce5769910512e

SHA1
c27ca848427fe87f5cf4d0e0e3cd57151b0d820d

SHA256
fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d

SHA512
8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Filesize
176B

MD5
45be5825f7bb280b4aed76a6be6c342c

SHA1
8535dfdf04875f24808d38dbbf74f1d8c26b6b88

SHA256
82a4b20c6f990cd440a1d074c4f6147496bdce05dd40515ad04b3a8c360c52ce

SHA512
e7f61870c8dd515a3412e6a6244a310e797fceb1778a442c675fcbc7f4bfcca52b5b9508a289542bba1147bbf815471b98259b78284aff07cee3eeedd4e63d2e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Filesize
178B

MD5
3a7f73af0a2c32e181317f23dd112d98

SHA1
32ee016efc47c68beee21f960aa400f6ed8476b2

SHA256
aa12f89c8efdf876c42d517a58582d8fe32613c6b4df8254cc37dfaddf5efdbc

SHA512
fe9d63bf32720b2cc9a319eaec20bd1d88d404933d97c5c5d74fee0235ae26acd6f72a6cc75508f9450b7363cb2f7d9dc8b2410cf95abcb4bd33fccbb8ba849d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Filesize
112B

MD5
bdde4d1bd0d7bb88bc548adee704a95e

SHA1
127d2a11c7db750a9a2a2aed18a1cc6afa82c4db

SHA256
6f932c9b2f0f016595362887e9db0193b4ed207dfc7d2357beeab067e17621d3

SHA512
7e23f76a6dbe2da8a2544fe41b3297679b37e5ee25020e42712ab65a7a25ce35a295f8a6b173db6f730f31c1f2207d4574d8acb3f6f3947dfbba26ee948d7060

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Filesize
114B

MD5
ac3d9526c5d196aaca5fdec912bc8eca

SHA1
c697634af02c6c40d78efb29893fd88cdefb91c6

SHA256
fbaa672beb4e39c675c9846c7c7fc4ff0326f2ab509170c508beeb36d84e981c

SHA512
d57dfcbaf6dc3ad3b28e169613350f51dc5718fdde307beae87b583703226b0065df6c6cb8626061a4b52cd3f8c54200e5c1d408e43d6765f98b2fda91328065

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Filesize
187B

MD5
3fde31c87bb3df439e493e83f532c691

SHA1
dd9bc444b929cf1c805b96347a98c60064b5a2e4

SHA256
efcb5abaddeb2ee589fa206599893604ae9a5b6eec7a1e4662738cd5fbb747f2

SHA512
14456bbb2dc43362db7e3ac57e672f6d8a53fc8d4b5f2ec6cf756bbc3e5b9c4233ab6f443ef539fbf8d77feaa552e75fbe3fa5c723b3825ef8795eaa575180de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Filesize
183B

MD5
d1e5d7c1391f419567223e3581ce8f8d

SHA1
3adfc5db911586f61881cc10537f4686dbeabdf9

SHA256
5e41fd9cf57434f49baaec7ccfdeda5033218173ac2ac304ca62c7ddb2538d06

SHA512
e36b87f3d60349d0ba825a2c0bf6bd5c2fd69f07964548809ec5f880f5d4431c56dbee55be2f859eabd50c79ec5c64e391a4779246383735cbb7758f2765b1cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt~RFe5d0477.TMP
Filesize
119B

MD5
d73a06c9a4e20cc305b09347d6717802

SHA1
2c293567f34d36f3e3fdf710b4cef324ac94030c

SHA256
fd7436c59f3e59c617016a16810381f5019bf36b9698ff38b527fad270190977

SHA512
7701ebe0970baa03d95424babda134f22d1e3f19e3f53a5aa0381e8e53ab13a262c2d8498f5a4e38dcea3aab96926b0f701e40c6442f27d6a8a03ea6e10cbd9d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Filesize
96B

MD5
32f311cccc8835536e3f08437bef50bb

SHA1
0b0243cd54859238d0ea8854ddd4b6f729b733be

SHA256
8519a1537bad54bc104262da7cd4b11288fbcc324fc31221972efd1767b0f7a8

SHA512
093c923b7d6ef3c513413493651c57e50efc8fb3e6ec962ef895403d545d00adde41c034cac83e79a097d8409cf3b61eafb271149b342091961b39ab00b1b7a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5d6d72.TMP
Filesize
48B

MD5
e53e5a8650e8e13fe35c95adb5a712c5

SHA1
e916e73f966097bc2a741f282df73be616c7a465

SHA256
93d093ae3423f35aa2d2182dae3e8f6640ce710d8513bfd4ae6cd27f689b8a0e

SHA512
4abff64613b34845e72ac6c83bd2bc35fb156582de1b21922176b2a24fbc2dbdb7db9425a3367ea0994951259adc16b274a8ecfdbbc7bfcc160819f67b61cf04

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\144.png
Filesize
1KB

MD5
8cecde103553c3a38d49a07b5ea40aae

SHA1
80d6399d87411e9e5bbd0791764dea87b60f8ef8

SHA256
d058ef0acc4124f5aa8eab0586555d78b46bcf4acd6e6f6ea0988423ec9d2ccb

SHA512
268353443025b9d8ec412e6e98ba13aaaf90aafc07b426522ddbee5ad728bebc55f5b00dce45e07f92f6a529ad48f5a39ef75f734282fc9f49f3428689c7c9a5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\192.png
Filesize
1KB

MD5
7e56c5b5084d3847a750f6b9f6fbf0fd

SHA1
22a7baf28bfdccbb31db155597517e515ab50d0a

SHA256
970652b350bafd68c91faf38828f178e46995c7962480db25556147121d03a5e

SHA512
bff3bb65572715ca43f56c892192e22c75fca1fbb953d7fcb835ea6a987ca47663fcdfd712bacd7ac25eaa0a84564861e8949ef1d43c99956022de2e066476d1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\256.png
Filesize
7KB

MD5
61add0d14d24d8fdc441cfbe5dd22490

SHA1
c693730b210cd4ca7ee253e16c9b23254ee7d4a5

SHA256
6bfa3a8e12096e5b8e65d2f60e2f047cc60c19f91541eccd36e100dc06faa0aa

SHA512
018887521687a866a755a3b42d7702b93d0732e783da62c49cc2143dc2acd6730edec9d70e8cf338b36aea636460d22f58eeb55b25e21d0fb11276292a1b7bdf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\96.png
Filesize
2KB

MD5
a84df7390166e3aba88e5286138c4eb1

SHA1
ac1ded2e013d3f1cc2d53722030547cd30edee04

SHA256
fef5904cdda41285c3b6c31350c2fe4e7cf33cdaca3938c30266501f7591dbc3

SHA512
e991ad9b617c24345f3fbf4b8fd44b79bff1e19f4bf781508e89bdf61ed51ff50a471a432faa06a2d7027db1ab588e9dbc8e56a97ee2fef685468ea6279f5cb7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Shortcuts Menu Icons\Monochrome\1\512.png
Filesize
10KB

MD5
529a0ad2f85dff6370e98e206ecb6ef9

SHA1
7a4ff97f02962afeca94f1815168f41ba54b0691

SHA256
31db550eb9c0d9afd316dc85cdfd832510e2c48e7d37d4a610c175667a4599c6

SHA512
d00e2d741a0a6321c92a4aab632f8f3bafd33c0e2875f37868e195ed5e7200a647b4c83358edcef5fc7acbc5c57f70410903f39eac76e23e88a342ac5c9c21cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Applications\Temp\scoped_dir4248_41061783\Shortcuts Menu Icons\Monochrome\0\512.png
Filesize
2KB

MD5
206fd9669027c437a36fbf7d73657db7

SHA1
8dee68de4deac72e86bbb28b8e5a915df3b5f3a5

SHA256
0d17a989f42bc129aca8e755871a7025acb6292ce06ca2437e95bedbc328fa18

SHA512
2c89878ec8466edf1f214d918aefc6a9b3de46d06ffacff4fdb85566560e94068601b1e4377d9d2eabefdc1c7f09eb46b00cf4545e377cc84a69edf8e57e48b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
39KB

MD5
32c00a4ad36a9759ff2b1c4336b187aa

SHA1
b18d2d865f6749fefc7410c33dbfc5cdf60d5279

SHA256
3c46780e700bc3242f92b6efac2d161d6caedce91077278e44a58cc176af138b

SHA512
a5812ba154813cc20ee518ebfe71622a0156d205f2d8af5da774d86006bd282eae9cb65050f38c3ac3543d4d9a8c0945db4b0f987250db8ba99382ce38e2ffdf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
44KB

MD5
d6826b2082e469264a5427bdc24740bc

SHA1
65710f40921e11440661c84dc0001006faf73d47

SHA256
e400ddbb77fd4b7f78299fdcd28f31ed519880a3eb8ab8c71b686555a1adff41

SHA512
2c4c4e7a9c808698bee4bf06c0fc0d161d0af2b9a69c09ec17ba2d90c2223b16069f52804cd86b0f71130b51cf3613e93f42f9b4a3fd6bc498fc220fc8790678

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
44KB

MD5
7e293b2c7d7612b9a5b40d4ab58e3fb9

SHA1
65392e68794d0b52a488caa0f06c02c60e177d8c

SHA256
923edcaaeb4d3f145a781e7cb0ac4a013644db06f9d265b0c9df07e979a64a54

SHA512
ab469f66d08d389a82c107f7150bce5c6b7b120c2a940a504ad1ba1413cc26a0a2527102b20ab9b0d87d6cff91ccab10586ec2c0e133c24c164bbaf39450cb32

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
76KB

MD5
c5a89c9cfe51fff241c2670d66a3a62c

SHA1
ca9bdb865cc4d3dacad03c11bceb82d01ed83590

SHA256
cd984a519a647178d3142d97753956c9aad7142553da46cfec2d09229016390c

SHA512
ec9ee06c9d7db2ba99e7196a80f71b406626e14bb143fb169b42ab2d184af7acdab924916640c993fecd884aa3dc4d6b9ab4982f0fc1d8142611d8241c6ea9d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
76KB

MD5
e95003e74b14c96b246b2d8f4b2e3a9c

SHA1
2cc878ea5d4484e92d06f3e412ba1fbcb264c600

SHA256
f8dabd0da7e9c6340801532749ba2b65dcecda572b5ab7c16d5defacb4020942

SHA512
f56b863ea07c0fffa959aec1e4562bb36302a57f7846dcf74c8a869e5680d9f41e9a8a43c773a20f4691f86254b850e7dec56918f7ee2c326763a204b7f7e79d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
44KB

MD5
256617edce37c54bde6848eda220b6dc

SHA1
3064b47a2910607cba03cbfb6ac549518cbad5bd

SHA256
8df826075a122d1eb84acef4f9a5f8de0afff5e8d266af805b7055be03b768ba

SHA512
00596646532a7e3d1c71d621a803d14617adacd8f539aa6f543f1e21a8c50af31d46e658840468c8cfabee5cd8d8711af8065dbbe3aef876488b7c0420a04a55

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\downloadCache
Filesize
14B

MD5
df741b3f19d9dc2621eaf973c8c9fa9d

SHA1
f45f1d9791c05366a8a23322d497c89957e75e61

SHA256
6e5ddba6d7aa3b287ea364034e1f843e4146ff92c07d8426f4a7c4b0e6435006

SHA512
650de3f99038bffbfef41a9acc0a06e15803550c6456d0bdeac9ebe18aea94ab3a0bb7d85b7a0230ce6f510f5e26fa739fe58924f355d7e3714ec37daa4c70d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\downloadCache_
Filesize
29B

MD5
47d41a980668e9bfae197488d6d56feb

SHA1
8acd8919b112d637a18e4c2f79f61fd62d2a1e6d

SHA256
87c1ba0f3a75480bef554b38abd51d7858bbe2cff07d4fd29162b4468d2b6c43

SHA512
165cf9913129bab36c22399c3636960cff235313256262439bea6a1ed78cf80d65690254cc63148e7e13bb515b513037ab6be7d20efdfb12b07985339ada36fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache
Filesize
9B

MD5
b6f7a6b03164d4bf8e3531a5cf721d30

SHA1
a2134120d4712c7c629cdceef9de6d6e48ca13fa

SHA256
3d6f3f8f1456d7ce78dd9dfa8187318b38e731a658e513f561ee178766e74d39

SHA512
4b473f45a5d45d420483ea1d9e93047794884f26781bbfe5370a554d260e80ad462e7eeb74d16025774935c3a80cbb2fd1293941ee3d7b64045b791b365f2b63

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\first_party_sets.db
Filesize
48KB

MD5
0e6aee8b03da6a1e3316a6bec2bfa09c

SHA1
e726b8d8c5a3fd98582c92a33265b9ff9058a594

SHA256
2d432d8beb9907b51fac24e1f4aadc73ceb631e2e0ccca63c434b00f61bd5065

SHA512
9882da1188682465a36006f3e2c73a57698a1a2cf948e5b6e234c7b23b83a304f717ce56c27032e53a0b68fe9c15ee63c992f91caa8ae5178865379605380524

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408.tbres
Filesize
2KB

MD5
05bbbe40247184c851b97edc25411f7d

SHA1
6f4f22a14a2566ce88bb708de6edb60154bd5806

SHA256
ee578bdd0767846c9607baa4903f076c9e055a59ddbfd81fa02ad0340e3f2488

SHA512
baef4e57fdcc61afb42b34b2cabd889408e3b63ab930b34e799cadaea03c7724a44d1af2b7b3ec9137761ef9379c4d09a379a4bd4a918156ff068509e70b9313

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML.bak
Filesize
9KB

MD5
7050d5ae8acfbe560fa11073fef8185d

SHA1
5bc38e77ff06785fe0aec5a345c4ccd15752560e

SHA256
cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b

SHA512
a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini
Filesize
174B

MD5
e0fd7e6b4853592ac9ac73df9d83783f

SHA1
2834e77dfa1269ddad948b87d88887e84179594a

SHA256
feea416e5e5c8aa81416b81fb25132d1c18b010b02663a253338dbdfb066e122

SHA512
289de77ffbe328388ad080129b7460712985d42076e78a3a545124881c30f564c5ef8fb4024d98903d88a6a187c60431a600f6ecbbe2888ee69e40a67ce77b55

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\{03BA58C4-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db.id-DF8C3D32.[[email protected]].ncov
Filesize
414KB

MD5
e628e70764c9ba9d3caecbc78b52ec6b

SHA1
47c4681d57d4809a9df974404aed49e04aa52a51

SHA256
1dc54c10ef6248ed61583468616c7b55c6ae61850fa27a5bd637e4e425fd4afc

SHA512
9aff4450b51c9b06f005229576cf65574aa532b6a460faaaf19ad783d80e33343bed842f75d64a2edf2e9c8d80607c50946c588a0f432d35bf35b99634ef5d12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000022.db.id-DF8C3D32.[[email protected]].ncov
Filesize
92KB

MD5
3144ee8243c00dd35f0d5181b83afa28

SHA1
39c76ade62acb6685441b8476562f1ed05a0fd9f

SHA256
1154724888a0a8f1bbb70df9e12da9a63d214c191189a019cff55d6af8069877

SHA512
10d2761d48ca295a2a49960872837e7e84fcf0d5923a84a1c40c0c454318546722f04e21ee39adf88562dd7b8769d86556f8743e8e3f1be1021108d211336042

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000023.db.id-DF8C3D32.[[email protected]].ncov
Filesize
88KB

MD5
db82ed586ce4c76aedb0f5b2d6e21f45

SHA1
8924e8ba924970f5601c30526d9246af2e260f98

SHA256
8a5c8b7b31fd288d89121777e9c12cc6f22751950dbeda95694f6dca96abbc9c

SHA512
45ee0a01b2baf93f68dab1866c56b285c555934169763bf9660e67c26ef9ad68894fb4221d558a687a7383544030341fcef32660e8d1accfbd16fbd2185b1347

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_48.db
Filesize
1024KB

MD5
f1cf836b35b3cd72c28a1df411fc6795

SHA1
547790e34c0cf63e14e884d7a7b73e022cf6c141

SHA256
755e9d811607a1ef2ef94bb7c5dc457c2d28a2b4b95a87e599f675125b51b8b6

SHA512
6d29fcbd46a1526266a649160c99378127e3500413e72dd080117c4470204e0d26febbbcb9a64fb52e5c723bd0f5f21145c952ab482abf63100c0184c55bbe78

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
Filesize
7KB

MD5
eb1fa4e408674512ed0678562997fcbb

SHA1
25ec80c38af44feba874fb8ed8a0dbd9039b88fd

SHA256
de6fab799f0fdd6aa8cca45a7394b0afd0db53e744af302b52c11fcc9d5e2e8a

SHA512
77efd4f0dba8555e8990cda082b6d24ef965c36e58f913a1660c4a848a463c1e4553c3ba3499b7d58b920f4046d766f6c0999b924044b26ddafb87d811f685bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_96.db
Filesize
24B

MD5
2a8875d2af46255db8324aad9687d0b7

SHA1
7a066fa7b69fb5450c26a1718b79ad27a9021ca9

SHA256
54097cccae0cfce5608466ba5a5ca2a3dfeac536964eec532540f3b837f5a7c7

SHA512
2c39f05a4dffd30800bb7fbb3ff2018cf4cc96398460b7492f05ce6afd59079fd6e3eb7c4f8384a35a954a22b4934c162a38534ad76cfb2fd772bcf10e211f7c

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\OE9DJ3LK\microsoft.windows[1].xml
Filesize
97B

MD5
bc9989808f505942f14f58d25b3306b1

SHA1
d51e8c26bfd5ebadc0abc327dffdeca8118266b3

SHA256
b875caa95fb9a87f9c3ac521aa6577584845d2dd6eec1be59d82a28849ca2136

SHA512
ec7ca226e68ed0e087ec784431626c26740c28986675e9062e6eb87a013a284de1430c4e69b3ea6d320cb85763a875b610d0aa044342f72300888be7a5ee60ff

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{4dab432b-3365-4ba8-96f0-54a0b94a0df2}\0.0.filtertrie.intermediate.txt
Filesize
1KB

MD5
9913dee3ab28ad6ebd60b930d6ee8da3

SHA1
6e6327df9f85d9037d83a4f537f32541f46a1dbc

SHA256
3bfac338a56813338b62dba88261ff9b1aa7e505af5f7a50ab9960a35f6ed5e4

SHA512
e7dead4ccbd7468e7d3d1cc930be40bc5fa0a881b406318bd56346b27651c3a58611c086b369de641f058af5748fa02eb5e02b9f482ff2443d2fbf442c04188d

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{4dab432b-3365-4ba8-96f0-54a0b94a0df2}\0.1.filtertrie.intermediate.txt
Filesize
5B

MD5
34bd1dfb9f72cf4f86e6df6da0a9e49a

SHA1
5f96d66f33c81c0b10df2128d3860e3cb7e89563

SHA256
8e1e6a3d56796a245d0c7b0849548932fee803bbdb03f6e289495830e017f14c

SHA512
e3787de7c4bc70ca62234d9a4cdc6bd665bffa66debe3851ee3e8e49e7498b9f1cbc01294bf5e9f75de13fb78d05879e82fa4b89ee45623fe5bf7ac7e48eda96

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{4dab432b-3365-4ba8-96f0-54a0b94a0df2}\0.2.filtertrie.intermediate.txt
Filesize
5B

MD5
c204e9faaf8565ad333828beff2d786e

SHA1
7d23864f5e2a12c1a5f93b555d2d3e7c8f78eec1

SHA256
d65b6a3bf11a27a1ced1f7e98082246e40cf01289fd47fe4a5ed46c221f2f73f

SHA512
e72f4f79a4ae2e5e40a41b322bc0408a6dec282f90e01e0a8aaedf9fb9d6f04a60f45a844595727539c1643328e9c1b989b90785271cc30a6550bbda6b1909f8

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{4dab432b-3365-4ba8-96f0-54a0b94a0df2}\Apps.ft
Filesize
2KB

MD5
ae92d8e34c6863d31010632e1472cd7e

SHA1
b6a286b8bc20d4b8fa1b29d234d71a89d696de9a

SHA256
ed6fdb649852ae050e65b42f4b2f0151f06aeb57f58aee36818fd6925ce1e217

SHA512
589e9ee259b2efe4cd4d94307075850274d324ba4232d2870ba4bf8fc570ad0b2d9b9ba1ea31f9aa81615b144c61418c6d09d6b24200a5d16b01eb36450e5eab

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{4dab432b-3365-4ba8-96f0-54a0b94a0df2}\Apps.index
Filesize
881KB

MD5
832fb9cd22b122f6c9d68f9f4fcc3424

SHA1
d398a299d12f6aeb005c724d1abd62edebabbac3

SHA256
e439f475eb0b32c6dfc9fc485c979b3e15126b54995e2ff9719bc4aa1910339a

SHA512
ba9e934a0880d09c4675d012215001feb282beca68d6c9885caaaabb31d6d3ef32bfb0d48cc9132bb977eee64ade2245fba29c6d5878e9dc9d3c740268d47922

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{e08d9ed8-1f4c-4262-b20d-41601f1cc4a9}\apps.csg
Filesize
444B

MD5
5475132f1c603298967f332dc9ffb864

SHA1
4749174f29f34c7d75979c25f31d79774a49ea46

SHA256
0b0af873ef116a51fc2a2329dc9102817ce923f32a989c7a6846b4329abd62cd

SHA512
54433a284a6b7185c5f2131928b636d6850babebc09acc5ee6a747832f9e37945a60a7192f857a2f6b4dd20433ca38f24b8e438ba1424cc5c73f0aa2d8c946ff

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{e08d9ed8-1f4c-4262-b20d-41601f1cc4a9}\apps.schema
Filesize
150B

MD5
1659677c45c49a78f33551da43494005

SHA1
ae588ef3c9ea7839be032ab4323e04bc260d9387

SHA256
5af0fc2a0b5ccecdc04e54b3c60f28e3ff5c7d4e1809c6d7c8469f0567c090bb

SHA512
740a1b6fd80508f29f0f080a8daddec802aabed467d8c5394468b0cf79d7628c1cb5b93cf69ed785999e8d4e2b0f86776b428d4fa0d1afcdf3cbf305615e5030

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{e08d9ed8-1f4c-4262-b20d-41601f1cc4a9}\appsconversions.txt
Filesize
1.4MB

MD5
2bef0e21ceb249ffb5f123c1e5bd0292

SHA1
86877a464a0739114e45242b9d427e368ebcc02c

SHA256
8b9fae5ea9dd21c2313022e151788b276d995c8b9115ee46832b804a914e6307

SHA512
f5b49f08b44a23f81198b6716195b868e76b2a23a388449356b73f8261107733f05baa027f8cdb8e469086a9869f4a64983c76da0dc978beb4ec1cb257532c6b

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{e08d9ed8-1f4c-4262-b20d-41601f1cc4a9}\appsglobals.txt
Filesize
343KB

MD5
931b27b3ec2c5e9f29439fba87ec0dc9

SHA1
dd5e78f004c55bbebcd1d66786efc5ca4575c9b4

SHA256
541dfa71a3728424420f082023346365cca013af03629fd243b11d8762e3403e

SHA512
4ba517f09d9ad15efd3db5a79747e42db53885d3af7ccc425d52c711a72e15d24648f8a38bc7e001b3b4cc2180996c6cac3949771aa1c278ca3eb7542eae23fd

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{e08d9ed8-1f4c-4262-b20d-41601f1cc4a9}\appssynonyms.txt
Filesize
237KB

MD5
06a69ad411292eca66697dc17898e653

SHA1
fbdcfa0e1761ddcc43a0fb280bbcd2743ba8820d

SHA256
2aa90f795a65f0e636154def7d84094af2e9a5f71b1b73f168a6ea23e74476d1

SHA512
ceb4b102309dffb65804e3a0d54b8627fd88920f555b334c3eac56b13eeb5075222d794c3cdbc3cda8bf1658325fdecf6495334e2c89b5133c9a967ec0d15693

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133639817864310655.txt
Filesize
2KB

MD5
ecaea544af9da1114077b951d8cb520d

SHA1
5820b2d71e7b2543cf1804eb91716c4e9f732fde

SHA256
9117b26ab2c8fdbb8223fe1f2d1770c50a6cf0d9849a5849d6aebcbe90435be6

SHA512
dc7bedbc581818011aa2d313429f234b12e5e9cf320b02b8d7ceeaf9cdc1c921ffc51af7f4080b02740f2d2146fbb006ccbf37cdcba3e3a10009142daffdb919

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\SettingsCache.txt
Filesize
670KB

MD5
9eb5f69e443e7d835e78519e5f3b3ef4

SHA1
5ba40cd4a127359dbd006eb3b0f800809c138659

SHA256
4aa1fa29fd0a2d15b9204426cfee2e348dcf65f5b444b53fc5425a0418a3fdcd

SHA512
b14fd14a1ac0aa59e0b648b64af0fa4848a4601124fe8b37d0c3f7e4066908237eb1c9d01a43aa45444db104c68380a60e1e1625d1f4eda5d501a3c33206cf4f

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ShellFeeds\IDX_CONTENT_TASKBARHEADLINES.json
Filesize
249KB

MD5
87371f3015acc09a291a61ff29b8e226

SHA1
6fd6ba24ebb93cf9976606cd8b1e87df2901035f

SHA256
941cbd0b172386618dfb9b6e54e3f520b2a588a8fe3ca0190552ea996e859be6

SHA512
9923f5b782c651311e5799996a6a0e6e21270c25365dc23fa33b5210e7e11038820226b54e1784e3bd6ebb33589a022550482e0eb83acde7aa900dff933c8088

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\TempState\CortanaUnifiedTileModelCache.dat
Filesize
1KB

MD5
2381f412c4c8ba10e5b1304887c8281d

SHA1
658582bcc282b1779a0ab0d06cb68674916b67c0

SHA256
b13dd56c97880ba4fb17b453fe4d29db4d0e04821deab7291c3d01c8bc43f070

SHA512
2f877b9fe916bbe7114c19f5784ef26702f6ed5659498a19244ccff08979b9baa2262337d02c4f30e603564a931af7162ec2e6c408cbe9a3122009fcc161934a

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\TempState\CortanaUnifiedTileModelCache.dat
Filesize
1KB

MD5
0aa42a6b441fe2cc5a336a5c4cedf8b6

SHA1
43941649d87a956114da3034fe3f08035f107fcf

SHA256
f8a16708a5b363e0e28ba7c9c5a379024c33fb55ac1b789659b5e0ec986066f5

SHA512
bbbd96259b6833d1154250c67a6e4e2a72cdad86d1c14966b79dcc33f016e6bd84bee2a6e8a643703e8f39a7c7a866a8b37c9ba8bed7ebc623fe7fb87cff058f

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\StartUnifiedTileModelCache.dat
Filesize
5KB

MD5
554ac8318ad238a386a07d54b0db81b9

SHA1
bcbcb65d4abb35b945dbda146b50072d3b173cd6

SHA256
2feefa95e6ebc1bc08ef4125fc1bb3a60883e3690441db8b493a5ee80e8c8131

SHA512
45ef1e645620e57be4fd051e8bb079db95a8d4e1f74d58032bc2c66ea85f283c1f5344ffb089a3b897b9b34c21454443cc024478efc85bbe6aa61f8bae1c4345

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\StartUnifiedTileModelCache.dat
Filesize
5KB

MD5
528440635722ff4f00e717a318d791e1

SHA1
e5a5e42f3c308b4656206180fce267b65841e9f0

SHA256
c1d674cac19807874c5437f7bb3edb52eb845a5820ac2fceb0c5ddcf3324fe39

SHA512
4a090ae56a06bd2771ed94efcc888e25cedd9bd05bbe951f3b351ce3a8b699d74a39e38556b5a8e3d3dcea932224dbb2d36d49b328d7b0baac0a9a2351ad96ab

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
Filesize
8KB

MD5
f67801cb835bfb0c29e7d97515b6b66a

SHA1
b4ad7d2bdbdce842ad95798013c57c19f3efbcba

SHA256
da9d40a3a6f92cb8fc4e45ee743eb4d26d330b1a4e6dd53da5f086a79b68513d

SHA512
988f0618a0a083a43a3a2c747c45eea825ab823f5fd91152d7348cee36d8a17566d0f800137a4e54519911401248bd27cd4050131101b8075c2e2282ef28311b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
Filesize
11KB

MD5
97fe411c2b56a62cf258e2c04d66936d

SHA1
cb2748d6770d10f907496c716faba35dd03169a7

SHA256
78ae93033a5b4d327662fa946fb064573cf53e6b240cabcc07f6f0bbe66f07a2

SHA512
a1cdf72a3d3394bdd1a0bf5954cc9658361ee84bfeceb638cf0b1dd81831dc4698c43ff2101acac6924a093020f57afdb432a872b6d759c7031882e5b2f8aca1

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
Filesize
11KB

MD5
e62e8c349edc3c5c7302761ca77015cf

SHA1
95b38a3020649f3a3b25db5c3b01026bbb995da0

SHA256
6b0052afd378f983c63b8fe23ffb02ae0873da21e81d23d168e52d040fa6217d

SHA512
16d5577454ad0e11faede89dc620c5d7e9e244d8b319aa7a12cd1cf36b6ea6dba3ee8deef3545389dc6a5ec08ad97c84030bd82f0e65e007aa89fff07e553a27

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
Filesize
10KB

MD5
f04e36a98cd4db0d6ddfdb2813439b77

SHA1
e322cab7f4951dc7d122d22fe3542028bbcc6a76

SHA256
94a579532b0844315e3e7cee67b2f6e74b3aae762bc0f7ddbd9cc9181641fa5d

SHA512
292c94afec51a567c2856940f68bd8b43690be5263129a2ec768182edf29f5831565ac38439d5a4349c240453f2c8a7efa4cb202249fff8248e51c6e9b8f365e

Download Submit
C:\Users\Admin\Desktop\ApproveDismount.wpl
Filesize
948KB

MD5
0f969440abf24392e3ddca798133307b

SHA1
cb5b3828f0f06dab90243fd6a91c3c8de5899ef3

SHA256
aeaddf573d2e9b611d6dc85745ee2d7d6c2895ff0fbe483ea66ed3737d0f97a3

SHA512
90096178fa0b464789de05b6dfb2ce81a601b8eea29b6e6f1a040d71eb6082f010f595a490b08f9dcaa97f9bd2ff8b448b1ea8d9ca624be20842719180689f54

Download Submit
C:\Users\Admin\Desktop\BackupUndo.bin
Filesize
543KB

MD5
41ea0340b802f291a8fce5d3d2f5c39c

SHA1
4832c12c5c704549c456f91d97643394919581f3

SHA256
a93d24ff5cb7a562fcd79eb4d1bdc9eab9e08bdc75ea0a358528a500f56be96e

SHA512
db24130ca9b4bde8200d858aaa343c8b7e3c602ca1ad521bafd1931eaab16e99fc8d17c2073a0765264329790d1e0ff9daf12020c5b3877a92ceccc9eb482afe

Download Submit
C:\Users\Admin\Desktop\BackupUnlock.DVR-MS
Filesize
493KB

MD5
aeb504c1a9be5743cf819d9de57c9109

SHA1
6e3039c6cd4f3b501f3bc50fff70950e98ba21d3

SHA256
9c3d0b8d3626aac519ffc8b7e0abcc94e3b7027f8b8a1dd622952852b41fb901

SHA512
e899adb9e0393bddf9185e43602398ce1e781c6ca7513e517be28b65e45ba2d760fba2312c11deb4fbf4c2fd20578e7fb3b1c58318e66af3042fb453e91afeb9

Download Submit
C:\Users\Admin\Desktop\Bolbi.txt
Filesize
29B

MD5
b37ed35ef479e43f406429bc36e68ec4

SHA1
5e3ec88d9d13d136af28dea0d3c2529f5b6e3b82

SHA256
cc2b26f9e750e05cd680ef5721d9269fe4c8d23cabf500a2ff9065b6b4f7e08c

SHA512
d1c1ea6292d8113ce8f02a9ad3921e2d8632f036bdfa243bd6600a173ac0b1fc659f91b43c8d9ec0beaabb87d9654f5f231e98fde27e4d9bdfd5862ca5cb13b7

Download Submit
C:\Users\Admin\Desktop\Bolbi.txt.id-DF8C3D32.[[email protected]].ncov
Filesize
262B

MD5
1c596050e4a8d0f3f88af0ecf25d3de5

SHA1
58ced006b6c46583ab4ff84ff757f249833e8df4

SHA256
e2f03949cdfaf225215fd2230537ceccf1fc7fef19e8fef8fb64ac3335c19564

SHA512
60d3e7e1c846e1051cb15e60bb1b4356d291dfb286c8824351cd4e9185939d114ac16f1f7055ca7e4975043096fdbb7ac4be7b9868bb5ddb67610629ff1bc83f

Download Submit
C:\Users\Admin\Desktop\Bolbi.vbs.id-DF8C3D32.[[email protected]].ncov
Filesize
47KB

MD5
6e49679eb8d29577e6fb93833d6f2dc7

SHA1
a7bd92d85a498b129f293d2d1be1d12aa180a165

SHA256
0d5e393dbefc7a352178836dddf73d52f39e5b33ca92e5de0c3933e6ef7d52dc

SHA512
11b7448f095154b797bbda28e0294625f8b802b4c95e6799676bcd1e4f4b4a6fc59965f23962306a8e2658aa59a67b962026b3c335e43280194811213858f7df

Download Submit
C:\Users\Admin\Desktop\CheckpointOpen.xml
Filesize
847KB

MD5
f4530d1e975520092af43c88c69f7f2d

SHA1
a88bac1104a1a9e6cca4b502980ff6ddd8d6ae67

SHA256
17203705ea491e640814497d1621b46976639e7f93033f591862f4023cc560fb

SHA512
b65681d84959f8f2ce20a53ef62f3484af4631a7edbd73d50264762a05a5b153a1aa52defa57f3dc57d3b9489726be38aa0a59e2e19c1bd64d9318190817fc51

Download Submit
C:\Users\Admin\Desktop\FindUnregister.pptm
Filesize
1.3MB

MD5
e2d5bd24f095d4cd60e946d195c786ed

SHA1
d138e0ec866d2b284ca4a390037dd52c7d9c74e6

SHA256
7ce193ccae2a6636b1b5faa45991ff645c5ba5c924711bcc51658a7429116514

SHA512
91cbf5a6c842c4f245478fc61ad0df3455c5dbd9588ed7f8e25a4ccadc7f14c44cdc0ca13e69dc5fdec43ea8f0511999ff7f3f8998c343c4f725f3ce6146ff20

Download Submit
C:\Users\Admin\Desktop\ImportStart.sql
Filesize
568KB

MD5
d8b243546e2267e56272cc296a89e625

SHA1
d936dc8ea31e3fa22ff3c0faca0ce6021de3dd3b

SHA256
b02a83ecb4df471e23cbef6f3baf78e654287c049019b2c44b574d63e61d357e

SHA512
bb90deabb25ad00f00d60105eabd6521d4890528752003a99316f62c7521df968e3190a8977d19280d8dd28b00946a0d0b52308b9f47ec99c5efbd80b3bb47ec

Download Submit
C:\Users\Admin\Desktop\InvokeMount.vsdx
Filesize
922KB

MD5
5f821d48ab1cd1e2593a064eca13ae77

SHA1
2e4c2e26439843b555c26e208712636cf7427914

SHA256
e0b9df023707eec75cd1f064f398a3ee037d08028719c80989888ccdbc1ee27f

SHA512
4a7890c53216e29364620483502779128ce08d96baf40ab36e7a32fe3ef7a9ee90213b96b9550d1b2b812ce043090f262782c7b46efee5dc26abda715789904a

Download Submit
C:\Users\Admin\Desktop\LimitSync.mpv2
Filesize
391KB

MD5
48d63509a95e73b7d8542549f7a92d66

SHA1
bc9ee1d37f86741f7a9ba4e751235b2ec709a11f

SHA256
edffd79da4dd5b2bfed6527d6e39faf6861b049466756e99ead07f1eeb175d61

SHA512
2879047240a10068e20d3a00d25a3f9ffb38c217cc7da8086fcdc4a3922f42bb0499bd3a7b5ef0903f0f11651fb72204fb03ee6075430325551e7e793ceb3475

Download Submit
C:\Users\Admin\Desktop\LockOptimize.ppsm
Filesize
442KB

MD5
b9f2bbd5914511689c29a138a55ab75b

SHA1
ab804cc9f4fbb6496d55a9f6f0c5afbe05be6df6

SHA256
9a1f61728aa1022f15d70beee42f16174a68f6edb8920d6af9aaaf9a2ff3061a

SHA512
45dad9c090dcaf7f4e50c692293e57815ed4af1012bfad49b775e81896bffaedd2b820e96fff778fd23313c96fa21e7ae0885a868ece4917969568a759ab206c

Download Submit
C:\Users\Admin\Desktop\OptimizeMeasure.pot
Filesize
417KB

MD5
43b80c32d377f388f2860e020880ba27

SHA1
8cc907b0a3b98683c0ca69f29d18bbd4e8bf4f20

SHA256
ab534f37413a0565c8557be62973b2e77f57f5c26e52e6e9bed967956568c9eb

SHA512
a5f63b006b5578c4de5be4d624b87dc9db4f46d4f9b5c78ab5f71e05d0aa5ea15d503ef12c5c5cfb0173ef890bb8bae40d3f7a9e1ecbb00be14e04f35550ecba

Download Submit
C:\Users\Admin\Desktop\ReadExpand.hta
Filesize
973KB

MD5
db464a24fa898cb64b19f5078a63b895

SHA1
19b47c37012a18ab3f8cfe2507a46f383c34b833

SHA256
4a041265120dab77ab37a5d3be4865b563113e484f8d14dec62360e3fcc6459c

SHA512
fd331fc4c4d548418a4674fc9a6c959662b6984e6b5ed99805ae87e58f8f40f476bdbc39e6217036878db1a2ae114dac060236de21f4d023fff4a584e31a9004

Download Submit
C:\Users\Admin\Desktop\ReceiveImport.tif
Filesize
518KB

MD5
8ea6e05e27bb2f2b8646ed693c461fca

SHA1
772bed28484c13da3901d3cc6ee5cb58760702a0

SHA256
3bc7ae1afa0f8cd7ce0860c0f4612fa6a52b16c65378ebe34a636f17e9a35509

SHA512
eb85f3b08af5036885b1bdbf997b9153f3b6335b0eeb76dcdc189fc6f30939cf5ae1041426e10170763f928b6dfc5c5e29c0d4d1ad1f7a6cc56b93afe9a34f05

Download Submit
C:\Users\Admin\Desktop\ReceiveRemove.tif
Filesize
720KB

MD5
79ac16bc73298ce8f2cd6f0ad4466483

SHA1
7b3ad5428682b956c0f3eeb2824748c55346fe68

SHA256
ada6c9ea67a40eb19ec38ab348475596d2f37f188329696ed9df85a597c27797

SHA512
1a8f42bc0e03929ec9cd20e8c542c9f449bc38f567e8c89bd8d5168d79d9a0f08ec926451c8262e41db39bc720c5b81ffe661148154dc872c56d11c721305909

Download Submit
C:\Users\Admin\Desktop\RegisterRedo.asx
Filesize
594KB

MD5
6aa069bca5dd977f65648bd8f2f62e32

SHA1
3fd920314981f9b219552afdb9205020b3b41f7a

SHA256
96b3833300eb6fb289800b60bdcf94866ab279f9228527834665c0c8e36db774

SHA512
57132b4c1a739ab8a1dabd7fe36bf023c73452478bb380efbb503976cd8903c9161c892f73f677df751d21f947347c74bb99c96c0615711bb69bda142df3e327

Download Submit
C:\Users\Admin\Desktop\RenameGroup.m4a
Filesize
897KB

MD5
d2c0ee65d1ba8732f6f4374806e59baa

SHA1
e4939bc0760a7e2375a869029c8c916abe6ec777

SHA256
e808942545cf5f70336406986dff50a090ff2611aa2c38b244d87f29d2cf6e9e

SHA512
23bb295fdd4798ab893d9ca68f8b77cf3705a7186a156ddde6c4275bcc740ea54ef28889af651a3a7fbbb8091d7a658bf07218fc9c818638247f96c1e098f58d

Download Submit
C:\Users\Admin\Desktop\RenameSearch.xla
Filesize
670KB

MD5
a22fdd4588b8fc77a36da5a98cf47488

SHA1
9ec52e2fb34ba78c89a813874b9b916d36aa71ae

SHA256
a04d447b8a456bde674c94cb556d00d7c539a23f0940b50b60c97ac19973fdb2

SHA512
93ce754274d3aad52e1a1d952d464ae941cd4ff7394505db4bc8407c9cc6182b688f5eddaaad8cb2918fb335a480b04ac84e7b6b27c7b041d56270dc7175ddc0

Download Submit
C:\Users\Admin\Desktop\ResetGet.bmp
Filesize
619KB

MD5
2114b030ac117597c2c12556698c5e0c

SHA1
31897688ba44e91c1d40abbbc9b8e34e3580899b

SHA256
7744649b2fb10cf951be90b04f5ee884c8dfb58fd5c7c3b4fd771cb95611ba24

SHA512
669cee9085775c0e5df4cf9292e208a721cbbdd8bef81bd3302d236401ff8478b4cae0c383894a6fcdfe0e884b27343d9615d317e72ec31f3afaa516e13e019a

Download Submit
C:\Users\Admin\Desktop\ResetPop.svgz
Filesize
695KB

MD5
e775c91a3820cb420aabd56ff42a073b

SHA1
fac36e01822da5bbe0e6067e40d6e80ccf5f47c1

SHA256
3ec85e38e263798ce4c24047c2572c0c2fb250be020c7adde77cc3fe83bd8394

SHA512
4e07e0730e3260ec52f589320fdb0f35bbccaa17bc3bd2c9c1c8f2411f93fc89532c95e163bb34785c4106511e9e6f834782d34b29dbedb4a1491c17861333d2

Download Submit
C:\Users\Admin\Desktop\ResetUnlock.xml
Filesize
341KB

MD5
1552a8173b9b5991dd6a14404aeb3d4d

SHA1
b165a7a5772c7e710529c1d898ca19579c5a01c3

SHA256
8baaaa5b88fe5580b55c82559912b03a7b2671b13c93d94b61c1fd89bd3293d5

SHA512
9f140f0f306a4125cfea7d23b145e6e74eada55f67044a33787aa48806c0a84f40df3f74299395828c83b80856746af4996a110db6d0bc083e12e85118d2d07c

Download Submit
C:\Users\Admin\Desktop\ResolveCheckpoint.bin
Filesize
467KB

MD5
3e8915f2eb6a1e9ba32e588ed49eca56

SHA1
00876fa893dceb547268424adadb7636a7fbc62f

SHA256
12e922c61875ec5bf43f289a6c00dd4bda5129da5f36dd8fed8f260950ca518a

SHA512
36a21fb860d67130ac17709f8b8f961ad62f5507b98bc9c98b65b609c5fe60777453a2a6cbcef632a875095f7b3a2a84da4013810ef9eb895ba19f70149a0d0d

Download Submit
C:\Users\Admin\Desktop\SplitPublish.tif
Filesize
745KB

MD5
224563e7775e307a8f00215aa20787f5

SHA1
b09304d9a0bed6986d8adf0f9355d76fa9a6d6d6

SHA256
11cbe34c1ae3a10e5ec9bd51ec12a182e157e5d9c40bf0fab519ac5e484d7ed9

SHA512
b07577f0883f6e97b7aa7b92708e46bab6213040608f78b1c7d961b5ade5a74953e11a008f7ad3de9dbb644bea03ea5d50b737d82ce1eba198a3b9876a30ea50

Download Submit
C:\Users\Admin\Desktop\TestRead.MOD
Filesize
644KB

MD5
f99f49b591d603e1525c9dde56837d03

SHA1
d37639cd3b4746b8423ae7fab5c8b61cf3256e97

SHA256
de1d4917a775a0182c7fa04281b42919a3709cc9295966b3f30ee6ca1ab6e80a

SHA512
d76b92e67b97cf2a852cbce8f51bb1925c49768ea37f047905099d72ec132e46c345394053093ef90e53e6e5f995761d9421c9e78e6179eff1468c4a24f7412b

Download Submit
C:\Users\Admin\Desktop\UpdateSubmit.M2TS
Filesize
796KB

MD5
e76366589b0d2339ee64bd78acaee069

SHA1
c933aa696942dc37c640c3d5e3dc0238c3c526df

SHA256
9be2eb70c61487c8b698c8e965c3ffbd0c5daa28debafbcc7edbb3408869f485

SHA512
3e4ada7ef8db98ca9ecf149e2b3d6711923bd15d074da5eba62ee39fd5827fce47e6db9abe3fb08b94ba065d0ae8b883fcdbdb9ef9e43c3d708e9d44eac83db3

Download Submit
C:\Users\Admin\Desktop\WaitWrite.xls
Filesize
366KB

MD5
0a06b1ad7adc6461eaacb2a7f663995b

SHA1
de11d1133d7f3186189a3e7f18391d04db9bca32

SHA256
30cbe6752ca3a24337604238e53c49ac8d7da9d038ad1c4b13829ce264208684

SHA512
4dcde8b7a54887770f0d43df8cae686f2ff9dc86535a11556a36fbcac943786f52b0fe98078fc083bb1e8d437498b4f2feffebdbfe46c15772227c4f4333eaf5

Download Submit
C:\Users\Admin\Desktop\WatchMount.rar
Filesize
872KB

MD5
30e333d1c093036d48842d7a3651419e

SHA1
4093ae26ccb501eebc407f082fe39675213a0c86

SHA256
52ac477b737fbe5a3ca4b79425004b8c064b02aadc4a3f7be8077e4995cbb0b4

SHA512
2cd512f6a7e98d59118b1aab1167e07ba139ef2f558ede2e34a69b72998577d29573e87ac1e16fa9e73f404897443ca1bba53f40937dcb4d164b1c4e92707ca1

Download Submit
C:\Users\Admin\Desktop\WatchOut.ex_
Filesize
771KB

MD5
ec7ff3c69f777ef441f8bbb56eab3f87

SHA1
1cbb97cb283bf5f6360a372cd49e03c60b231e5a

SHA256
1842238279d731723fe242ee89df6a97edc8fb1b18292a1f6a6713b62396757b

SHA512
495c548e0e9113e091de9c521c88719d3bc9074725a3f87b0c1d97da04a0be43a100cbb2e15d2507884488a8766b93492ebe126f8be46bb7ed07e93c0310ac3f

Download Submit
C:\Users\Admin\Desktop\WriteCompare.cr2
Filesize
821KB

MD5
143afa38f6fee46eeb5fdf4e3d7ae959

SHA1
8978b7ed9d10559f40366e0b73690000748bfeea

SHA256
7377c910c3522c4ee36b70254e8b9a322728e2c69f64c2bc10d726b3a1af14f2

SHA512
5643999715fbe87d82c6a0083df72aa1bcd1fa919010ca96c3eb34415e9e7ab28277d4a62b3d012a0972312587e294cd1158a0aec62fa7da8af7f7680bec6ce0

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 371318.crdownload
Filesize
2.5MB

MD5
4e19e70399076ab58d1160d0fa2664ec

SHA1
e7ca7e0f1895c6bf60a14d6fbb0ccd4fb10a3134

SHA256
b9ee60f31be0b7dc3f814c8abbc7caacb6a3e1dc7eb1504b8e831dd42277f8d8

SHA512
f6338b52cb5a80d960e6b1ec72a28538614782a75d0270cb89e911160c0a0e8e3a4d0f93fb902c70c37cc5f4da0529043776e2c0b59287096f976addb7e584d8

Download Submit
C:\Users\Admin\Downloads\Virus Maker.rar
Filesize
82KB

MD5
d1f61793e7898df4b27e3345764ceca8

SHA1
f03b91146aeaf753b565620a022a238830ed56d4

SHA256
d32f3a860b863d38f117c2e7efcaa6909583d418f8578b526a7ed0153529644b

SHA512
6491767f6db68886d000b173306377f3b0bf2d6db765ce4c14139c9ad09fa44e6cb75489f3858e45c4000333d2ad517721f81cc48e94de25c75c17cac36bb617

Download Submit
C:\Users\Public\Desktop\Acrobat Reader DC.lnk
Filesize
2KB

MD5
957fd54d6e346183794cce1b8ade97eb

SHA1
844b56fd0be676b8c5af4fb27cfbee94a458fbec

SHA256
3acc68d81fbbd7ea39262e9c3fd2bb31041da2fa2296a1e6629d93a5cea77b19

SHA512
11fee87ad1f3ca11ae176b43ea445101261edaaf33ebeca56c1ea54a9f26ccaf68cae41905ca0552d18625c2c2529d4c629992a9551c9564abdb6011d27bc73d

Download Submit
C:\Users\Public\Desktop\Firefox.lnk
Filesize
1000B

MD5
eac7ae582167fd2a084e066f64739484

SHA1
849bdc01c35240be937dad7ba0e52cf24802f92a

SHA256
4c770b8a07d4c8df960286380c38a6b0b4b9b6495bb3b67020e53c9f80414fd5

SHA512
7cd90531d1729a0e3a5bccd9ddbbbef5f58ddfb909b5fd2f2147e23aedae14940ef6daac699896c55db9efac7348f54ea94af5359469d0c2c3a4830250b406ef

Download Submit
C:\Users\Public\Desktop\Google Chrome.lnk
Filesize
2KB

MD5
c91eeab219802f45edecb0394e035985

SHA1
0f6928ca5eb0185f59d96d9e7a093c2a677449d5

SHA256
e7584f4626a5c20eedd84791ad2945bbf99ab4e640daaae5476f90b9f4e559f3

SHA512
66e4be329ebbccfbfaf5a4153fda9e50aaa6ff23bba4d75b4a95ff9ce989590126b730597adf78f79b8f925665660956a653ad19325beb1f38ed3e68c947b970

Download Submit
C:\Users\Public\Desktop\Microsoft Edge.lnk
Filesize
2KB

MD5
ccedd5883de8d471133b4fafe72156e1

SHA1
2b7a45fff2e0bb62a5c15dcfccac5210ecc6c343

SHA256
6a02c7d54a777f75119541de0d9619420363095edabe164455f061b0976335f0

SHA512
f645cdf743d71bcb6525763dc11047c3219c0dc3b9831b655c4b1dfd58f0c07c1a926449d937fc74a5e6d470f84506a9941761b80f6fd1d92af1b669da34748c

Download Submit
C:\Users\Public\Desktop\VLC media player.lnk
Filesize
923B

MD5
084098ff5104aba0968cf44585d7bdf0

SHA1
55f7b54e0121136f1a5639f61c8399b258af7742

SHA256
9ad75bad44901da21e2fc310ed90724b90913e10488c286b4d4f3fc10b998ab8

SHA512
22ae72391dadb1a07501f034235877201059e2fcc663475a4eef7fbf462b8512b938920b67ed608a99c551982d25d00e9a56b99c441d41e005137d45c1a61ecf

Download Submit
C:\Users\Public\Ghostroot\KillDora.bat
Filesize
482B

MD5
4f08159f1d70d41bf975e23230033a0f

SHA1
ea88d6fbdcf218e0e04a650d947250d8a3dfad40

SHA256
d6e7530e3879225bc21fc17859e5b5c71414375baac27bb361fd9162f4b49e0e

SHA512
958ac467e54d35c4ca5459853d661e49ea81efaa1ce3044114d577fcb757343a40ddb30b9f540cf9c100f05958a843bf312fa879c43bda7513643c824b318d6a

Download Submit
C:\Users\Public\ghostroot\rpdbfk.exe
Filesize
16KB

MD5
c00be65597bf40636145c34fbf4788c0

SHA1
6809a72fc75f323137e43c91cc0465328cbb525d

SHA256
8861afb9340e88a7f139fe1022748db3658b31ff505de897569032a1b34ed5ea

SHA512
1d948c49c94daf764ed8cd2b94aa78abc7a23b1fb7a1aa8dffc529cbeeaedb52ee693113a424c75abc80f5dc1a0c69cceb291e3ab47b96811cfd72e2b4494f23

Download Submit
C:\note.txt
Filesize
218B

MD5
afa6955439b8d516721231029fb9ca1b

SHA1
087a043cc123c0c0df2ffadcf8e71e3ac86bbae9

SHA256
8e9f20f6864c66576536c0b866c6ffdcf11397db67fe120e972e244c3c022270

SHA512
5da21a31fbc4e8250dffed30f66b896bdf007ac91948140334fe36a3f010e1bac3e70a07e9f3eb9da8633189091fd5cadcabbaacd3e01da0fe7ae28a11b3dddf

Download Submit
F:\$RECYCLE.BIN\S-1-5-21-1181767204-2009306918-3718769404-1000\desktop.ini
Filesize
129B

MD5
a526b9e7c716b3489d8cc062fbce4005

SHA1
2df502a944ff721241be20a9e449d2acd07e0312

SHA256
e1b9ce9b57957b1a0607a72a057d6b7a9b34ea60f3f8aa8f38a3af979bd23066

SHA512
d83d4c656c96c3d1809ad06ce78fa09a77781461c99109e4b81d1a186fc533a7e72d65a4cb7edf689eeccda8f687a13d3276f1111a1e72f7c3cd92a49bce0f88

Download Submit
\??\pipe\crashpad_4248_BYRSGODLVARZXMQG
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/672-96-0x0000000000400000-0x000000000056F000-memory.dmp

Filesize
1.4MB

Download
memory/672-125-0x0000000000400000-0x000000000056F000-memory.dmp

Filesize
1.4MB

Download
memory/672-7153-0x0000000000400000-0x000000000056F000-memory.dmp

Filesize
1.4MB

Download
memory/15108-25845-0x0000020D4B800000-0x0000020D4B820000-memory.dmp

Filesize
128KB

Download
memory/15108-25810-0x0000020D4B440000-0x0000020D4B460000-memory.dmp

Filesize
128KB

Download
memory/15108-25807-0x0000020D4A100000-0x0000020D4A200000-memory.dmp

Filesize
1024KB

Download
memory/15108-25805-0x0000020D4A100000-0x0000020D4A200000-memory.dmp

Filesize
1024KB

Download
memory/15108-25844-0x0000020D4B400000-0x0000020D4B420000-memory.dmp

Filesize
128KB

Download
memory/21844-25798-0x0000000002900000-0x0000000002901000-memory.dmp

Filesize
4KB

Download