Analysis
-
max time kernel
149s -
max time network
135s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
15-11-2020 23:03
Static task
static1
Behavioral task
behavioral1
Sample
28b28111884badedf0870be7bef1e417b3ddea12eb06b1c431e992be39d6bf8e.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
28b28111884badedf0870be7bef1e417b3ddea12eb06b1c431e992be39d6bf8e.exe
Resource
win10v20201028
General
-
Target
28b28111884badedf0870be7bef1e417b3ddea12eb06b1c431e992be39d6bf8e.exe
-
Size
270KB
-
MD5
1e97fda428488834e73a9d21f45905ca
-
SHA1
349780006801787b966a14ff7b9b7d5d0872feb6
-
SHA256
28b28111884badedf0870be7bef1e417b3ddea12eb06b1c431e992be39d6bf8e
-
SHA512
5e6848598bb9e51df29237e3154a1f271b4b6ccb474f34c0bfbc0682a53d2e41c84214a1405d63e85dcaee95e83049a465d58ede46a6d1a1324eaf3a13a19fb9
Malware Config
Extracted
C:\Users\Admin\Documents\# DECRYPT MY FILES #.txt
cerber
http://bqyjebfh25oellur.onion.to/B9D1-50B9-594D-0072-8EA2
http://bqyjebfh25oellur.onion.cab/B9D1-50B9-594D-0072-8EA2
http://bqyjebfh25oellur.onion.nu/B9D1-50B9-594D-0072-8EA2
http://bqyjebfh25oellur.onion.link/B9D1-50B9-594D-0072-8EA2
http://bqyjebfh25oellur.tor2web.org/B9D1-50B9-594D-0072-8EA2
http://bqyjebfh25oellur.onion/B9D1-50B9-594D-0072-8EA2
Extracted
C:\Users\Admin\Desktop\# DECRYPT MY FILES #.html
http://bqyjebfh25oellur.onion.to/B9D1-50B9-594D-0072-8EA2(Get
http://bqyjebfh25oellur.onion.cab/B9D1-50B9-594D-0072-8EA2
http://bqyjebfh25oellur.onion.nu/B9D1-50B9-594D-0072-8EA2
http://bqyjebfh25oellur.onion.link/B9D1-50B9-594D-0072-8EA2
http://bqyjebfh25oellur.tor2web.org/B9D1-50B9-594D-0072-8EA2
http://bqyjebfh25oellur.onion.to/B9D1-50B9-594D-0072-8EA2);
http://bqyjebfh25oellur.onion.to/B9D1-50B9-594D-0072-8EA2
http://bqyjebfh25oellur.onion/B9D1-50B9-594D-0072-8EA2
Signatures
-
Cerber
Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.
-
Adds policy Run key to start application 2 TTPs 2 IoCs
Processes:
28b28111884badedf0870be7bef1e417b3ddea12eb06b1c431e992be39d6bf8e.exeARP.EXEdescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run = "\"C:\\Users\\Admin\\AppData\\Roaming\\{979CC176-2CBB-9CDF-ED19-828F81E1B52B}\\ARP.EXE\"" 28b28111884badedf0870be7bef1e417b3ddea12eb06b1c431e992be39d6bf8e.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run = "\"C:\\Users\\Admin\\AppData\\Roaming\\{979CC176-2CBB-9CDF-ED19-828F81E1B52B}\\ARP.EXE\"" ARP.EXE -
Executes dropped EXE 2 IoCs
Processes:
ARP.EXEARP.EXEpid process 2652 ARP.EXE 2396 ARP.EXE -
Modifies extensions of user files 1 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
ARP.EXEdescription ioc process File opened for modification C:\Users\Admin\Pictures\DenyRevoke.tiff ARP.EXE -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
ARP.EXEdescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Control Panel\International\Geo\Nation ARP.EXE -
Drops startup file 2 IoCs
Processes:
28b28111884badedf0870be7bef1e417b3ddea12eb06b1c431e992be39d6bf8e.exeARP.EXEdescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartUp\ARP.lnk 28b28111884badedf0870be7bef1e417b3ddea12eb06b1c431e992be39d6bf8e.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartUp\ARP.lnk ARP.EXE -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 8 IoCs
Processes:
ARP.EXE28b28111884badedf0870be7bef1e417b3ddea12eb06b1c431e992be39d6bf8e.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\ARP = "\"C:\\Users\\Admin\\AppData\\Roaming\\{979CC176-2CBB-9CDF-ED19-828F81E1B52B}\\ARP.EXE\"" ARP.EXE Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run 28b28111884badedf0870be7bef1e417b3ddea12eb06b1c431e992be39d6bf8e.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\ARP = "\"C:\\Users\\Admin\\AppData\\Roaming\\{979CC176-2CBB-9CDF-ED19-828F81E1B52B}\\ARP.EXE\"" 28b28111884badedf0870be7bef1e417b3ddea12eb06b1c431e992be39d6bf8e.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce 28b28111884badedf0870be7bef1e417b3ddea12eb06b1c431e992be39d6bf8e.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\ARP = "\"C:\\Users\\Admin\\AppData\\Roaming\\{979CC176-2CBB-9CDF-ED19-828F81E1B52B}\\ARP.EXE\"" 28b28111884badedf0870be7bef1e417b3ddea12eb06b1c431e992be39d6bf8e.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run ARP.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\ARP = "\"C:\\Users\\Admin\\AppData\\Roaming\\{979CC176-2CBB-9CDF-ED19-828F81E1B52B}\\ARP.EXE\"" ARP.EXE Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce ARP.EXE -
JavaScript code in executable 1 IoCs
Processes:
resource yara_rule C:\Users\Admin\Desktop\# DECRYPT MY FILES #.html js -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 7 ip-api.com -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
ARP.EXEdescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tmp5341.bmp" ARP.EXE -
Drops file in Windows directory 1 IoCs
Processes:
MicrosoftEdge.exedescription ioc process File opened for modification C:\Windows\Debug\ESE.TXT MicrosoftEdge.exe -
Kills process with taskkill 2 IoCs
Processes:
taskkill.exetaskkill.exepid process 3824 taskkill.exe 4612 taskkill.exe -
Modifies Control Panel 5 IoCs
Processes:
28b28111884badedf0870be7bef1e417b3ddea12eb06b1c431e992be39d6bf8e.exeARP.EXEMicrosoftEdge.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Control Panel\Desktop 28b28111884badedf0870be7bef1e417b3ddea12eb06b1c431e992be39d6bf8e.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Control Panel\Desktop\SCRNSAVE.EXE = "\"C:\\Users\\Admin\\AppData\\Roaming\\{979CC176-2CBB-9CDF-ED19-828F81E1B52B}\\ARP.EXE\"" 28b28111884badedf0870be7bef1e417b3ddea12eb06b1c431e992be39d6bf8e.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Control Panel\Desktop ARP.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Control Panel\Desktop\SCRNSAVE.EXE = "\"C:\\Users\\Admin\\AppData\\Roaming\\{979CC176-2CBB-9CDF-ED19-828F81E1B52B}\\ARP.EXE\"" ARP.EXE Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Control Panel\Colors MicrosoftEdge.exe -
Processes:
MicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdge.exebrowser_broker.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main browser_broker.exe -
Modifies registry class 275 IoCs
Processes:
MicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\IntelliForms MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\LowRegistry\DontShowMeThisDialogAgain MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListDOSTime = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\OnlineHistory\NextBrowserDataLogTime = e0353c3fdfbbd601 MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BingPageData\Md5FileCheck = 9fa75725855604a758366c6a1d9f0311 MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\FileVersion = "2016061511" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate\NextUpdateDate = "312266978" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\ChromeMigration MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Root\Certificates MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BingPageData\RulesVersion = "6" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\SmartScreenCompletedVersio = "1" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DeviceId = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\SharedCookie_MRACMigrationDone = "1" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\IETld\LowMic MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Rating\Rating Prompt Shown = "0" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Rating\Next Rating Prompt = 903ff9e0e7d1d601 MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\MigrationTime = 6c3a3b6c55add601 MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url5 = "https://twitter.com/" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Revision = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CacheLimit = "1" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 028f08dfacbbd601 MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionLow = "395205405" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 1ce898edacbbd601 MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\TrustedPeople MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\trust\CTLs MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-SubSysId = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Cookies MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\OnlineHistory\UUID = "{7705DB14-27F4-42DE-8541-16B4D02CFEE5}" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\MigrationTime = 6c3a3b6c55add601 MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\EnableNegotiate = "1" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DXFeatureLevel = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TabbedBrowsing\NewTabPage MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Rating\NextPromptBuild = "15063" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$blogger MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$vBulletin 4 MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000 MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Content\CachePrefix MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\ACGPolicyState = "8" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TabbedBrowsing MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$Discuz! MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Root\CRLs MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Zoom MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CacheLimit = "256000" MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$Telligent MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\NextUpdateDate = "312298970" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate\Certificates MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BingPageData\Enabled = "1" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge MicrosoftEdge.exe -
Runs ping.exe 1 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 450 IoCs
Processes:
ARP.EXEpid process 2652 ARP.EXE 2652 ARP.EXE 2652 ARP.EXE 2652 ARP.EXE 2652 ARP.EXE 2652 ARP.EXE 2652 ARP.EXE 2652 ARP.EXE 2652 ARP.EXE 2652 ARP.EXE 2652 ARP.EXE 2652 ARP.EXE 2652 ARP.EXE 2652 ARP.EXE 2652 ARP.EXE 2652 ARP.EXE 2652 ARP.EXE 2652 ARP.EXE 2652 ARP.EXE 2652 ARP.EXE 2652 ARP.EXE 2652 ARP.EXE 2652 ARP.EXE 2652 ARP.EXE 2652 ARP.EXE 2652 ARP.EXE 2652 ARP.EXE 2652 ARP.EXE 2652 ARP.EXE 2652 ARP.EXE 2652 ARP.EXE 2652 ARP.EXE 2652 ARP.EXE 2652 ARP.EXE 2652 ARP.EXE 2652 ARP.EXE 2652 ARP.EXE 2652 ARP.EXE 2652 ARP.EXE 2652 ARP.EXE 2652 ARP.EXE 2652 ARP.EXE 2652 ARP.EXE 2652 ARP.EXE 2652 ARP.EXE 2652 ARP.EXE 2652 ARP.EXE 2652 ARP.EXE 2652 ARP.EXE 2652 ARP.EXE 2652 ARP.EXE 2652 ARP.EXE 2652 ARP.EXE 2652 ARP.EXE 2652 ARP.EXE 2652 ARP.EXE 2652 ARP.EXE 2652 ARP.EXE 2652 ARP.EXE 2652 ARP.EXE 2652 ARP.EXE 2652 ARP.EXE 2652 ARP.EXE 2652 ARP.EXE -
Suspicious behavior: MapViewOfSection 4 IoCs
Processes:
MicrosoftEdgeCP.exepid process 2604 MicrosoftEdgeCP.exe 2604 MicrosoftEdgeCP.exe 2604 MicrosoftEdgeCP.exe 2604 MicrosoftEdgeCP.exe -
Suspicious use of AdjustPrivilegeToken 19 IoCs
Processes:
28b28111884badedf0870be7bef1e417b3ddea12eb06b1c431e992be39d6bf8e.exetaskkill.exeARP.EXEARP.EXEMicrosoftEdge.exeAUDIODG.EXEMicrosoftEdgeCP.exeMicrosoftEdgeCP.exetaskkill.exedescription pid process Token: SeDebugPrivilege 912 28b28111884badedf0870be7bef1e417b3ddea12eb06b1c431e992be39d6bf8e.exe Token: SeDebugPrivilege 3824 taskkill.exe Token: SeDebugPrivilege 2652 ARP.EXE Token: SeDebugPrivilege 2396 ARP.EXE Token: SeDebugPrivilege 2144 MicrosoftEdge.exe Token: SeDebugPrivilege 2144 MicrosoftEdge.exe Token: SeDebugPrivilege 2144 MicrosoftEdge.exe Token: SeDebugPrivilege 2144 MicrosoftEdge.exe Token: 33 4380 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 4380 AUDIODG.EXE Token: SeDebugPrivilege 1700 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 1700 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 1700 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 1700 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 4284 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 4284 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 4284 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 4284 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 4612 taskkill.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
MicrosoftEdge.exeMicrosoftEdgeCP.exepid process 2144 MicrosoftEdge.exe 2604 MicrosoftEdgeCP.exe 2604 MicrosoftEdgeCP.exe -
Suspicious use of WriteProcessMemory 34 IoCs
Processes:
28b28111884badedf0870be7bef1e417b3ddea12eb06b1c431e992be39d6bf8e.execmd.exeARP.EXEMicrosoftEdgeCP.execmd.exedescription pid process target process PID 912 wrote to memory of 2652 912 28b28111884badedf0870be7bef1e417b3ddea12eb06b1c431e992be39d6bf8e.exe ARP.EXE PID 912 wrote to memory of 2652 912 28b28111884badedf0870be7bef1e417b3ddea12eb06b1c431e992be39d6bf8e.exe ARP.EXE PID 912 wrote to memory of 2652 912 28b28111884badedf0870be7bef1e417b3ddea12eb06b1c431e992be39d6bf8e.exe ARP.EXE PID 912 wrote to memory of 3612 912 28b28111884badedf0870be7bef1e417b3ddea12eb06b1c431e992be39d6bf8e.exe cmd.exe PID 912 wrote to memory of 3612 912 28b28111884badedf0870be7bef1e417b3ddea12eb06b1c431e992be39d6bf8e.exe cmd.exe PID 912 wrote to memory of 3612 912 28b28111884badedf0870be7bef1e417b3ddea12eb06b1c431e992be39d6bf8e.exe cmd.exe PID 3612 wrote to memory of 3824 3612 cmd.exe taskkill.exe PID 3612 wrote to memory of 3824 3612 cmd.exe taskkill.exe PID 3612 wrote to memory of 3824 3612 cmd.exe taskkill.exe PID 3612 wrote to memory of 820 3612 cmd.exe PING.EXE PID 3612 wrote to memory of 820 3612 cmd.exe PING.EXE PID 3612 wrote to memory of 820 3612 cmd.exe PING.EXE PID 2652 wrote to memory of 1216 2652 ARP.EXE NOTEPAD.EXE PID 2652 wrote to memory of 1216 2652 ARP.EXE NOTEPAD.EXE PID 2652 wrote to memory of 4100 2652 ARP.EXE WScript.exe PID 2652 wrote to memory of 4100 2652 ARP.EXE WScript.exe PID 2604 wrote to memory of 1700 2604 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 2604 wrote to memory of 1700 2604 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 2604 wrote to memory of 1700 2604 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 2604 wrote to memory of 1700 2604 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 2604 wrote to memory of 1700 2604 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 2604 wrote to memory of 1700 2604 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 2604 wrote to memory of 1700 2604 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 2604 wrote to memory of 1700 2604 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 2604 wrote to memory of 1700 2604 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 2604 wrote to memory of 1700 2604 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 2652 wrote to memory of 4568 2652 ARP.EXE cmd.exe PID 2652 wrote to memory of 4568 2652 ARP.EXE cmd.exe PID 4568 wrote to memory of 4612 4568 cmd.exe taskkill.exe PID 4568 wrote to memory of 4612 4568 cmd.exe taskkill.exe PID 4568 wrote to memory of 4680 4568 cmd.exe PING.EXE PID 4568 wrote to memory of 4680 4568 cmd.exe PING.EXE PID 2604 wrote to memory of 4284 2604 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 2604 wrote to memory of 4284 2604 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\28b28111884badedf0870be7bef1e417b3ddea12eb06b1c431e992be39d6bf8e.exe"C:\Users\Admin\AppData\Local\Temp\28b28111884badedf0870be7bef1e417b3ddea12eb06b1c431e992be39d6bf8e.exe"1⤵
- Adds policy Run key to start application
- Drops startup file
- Adds Run key to start application
- Modifies Control Panel
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\{979CC176-2CBB-9CDF-ED19-828F81E1B52B}\ARP.EXE"C:\Users\Admin\AppData\Roaming\{979CC176-2CBB-9CDF-ED19-828F81E1B52B}\ARP.EXE"2⤵
- Adds policy Run key to start application
- Executes dropped EXE
- Modifies extensions of user files
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\# DECRYPT MY FILES #.txt3⤵
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\# DECRYPT MY FILES #.vbs"3⤵
-
C:\Windows\system32\cmd.exe/d /c taskkill /t /f /im "ARP.EXE" > NUL & ping -n 1 127.0.0.1 > NUL & del "C:\Users\Admin\AppData\Roaming\{979CC176-2CBB-9CDF-ED19-828F81E1B52B}\ARP.EXE" > NUL3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\taskkill.exetaskkill /t /f /im "ARP.EXE"4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\PING.EXEping -n 1 127.0.0.14⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\cmd.exe/d /c taskkill /t /f /im "28b28111884badedf0870be7bef1e417b3ddea12eb06b1c431e992be39d6bf8e.exe" > NUL & ping -n 1 127.0.0.1 > NUL & del "C:\Users\Admin\AppData\Local\Temp\28b28111884badedf0870be7bef1e417b3ddea12eb06b1c431e992be39d6bf8e.exe" > NUL2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /t /f /im "28b28111884badedf0870be7bef1e417b3ddea12eb06b1c431e992be39d6bf8e.exe"3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\PING.EXEping -n 1 127.0.0.13⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Roaming\{979CC176-2CBB-9CDF-ED19-828F81E1B52B}\ARP.EXEC:\Users\Admin\AppData\Roaming\{979CC176-2CBB-9CDF-ED19-828F81E1B52B}\ARP.EXE1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Drops file in Windows directory
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
- Modifies Internet Explorer settings
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x4241⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartUp\ARP.lnkMD5
81630d7999cce78f58fb4aa4cdefb43c
SHA134d9dea1fbb6ae3e98fcadd97b9b1ee1c2cdfe8e
SHA256c569606bb1cdd818b10a0b1ed96dba063c3a61cda928a178bb92e0789613c717
SHA51274110689e5e70039be31990b448b57665933ee5aec62c391d4fe901f72630588af617853033fc301ec04c6e63e9795198c9bca8db80b6fbbfa22934aad3501ff
-
C:\Users\Admin\AppData\Roaming\{979CC176-2CBB-9CDF-ED19-828F81E1B52B}\ARP.EXEMD5
1e97fda428488834e73a9d21f45905ca
SHA1349780006801787b966a14ff7b9b7d5d0872feb6
SHA25628b28111884badedf0870be7bef1e417b3ddea12eb06b1c431e992be39d6bf8e
SHA5125e6848598bb9e51df29237e3154a1f271b4b6ccb474f34c0bfbc0682a53d2e41c84214a1405d63e85dcaee95e83049a465d58ede46a6d1a1324eaf3a13a19fb9
-
C:\Users\Admin\AppData\Roaming\{979CC176-2CBB-9CDF-ED19-828F81E1B52B}\ARP.EXEMD5
1e97fda428488834e73a9d21f45905ca
SHA1349780006801787b966a14ff7b9b7d5d0872feb6
SHA25628b28111884badedf0870be7bef1e417b3ddea12eb06b1c431e992be39d6bf8e
SHA5125e6848598bb9e51df29237e3154a1f271b4b6ccb474f34c0bfbc0682a53d2e41c84214a1405d63e85dcaee95e83049a465d58ede46a6d1a1324eaf3a13a19fb9
-
C:\Users\Admin\AppData\Roaming\{979CC176-2CBB-9CDF-ED19-828F81E1B52B}\ARP.EXEMD5
1e97fda428488834e73a9d21f45905ca
SHA1349780006801787b966a14ff7b9b7d5d0872feb6
SHA25628b28111884badedf0870be7bef1e417b3ddea12eb06b1c431e992be39d6bf8e
SHA5125e6848598bb9e51df29237e3154a1f271b4b6ccb474f34c0bfbc0682a53d2e41c84214a1405d63e85dcaee95e83049a465d58ede46a6d1a1324eaf3a13a19fb9
-
C:\Users\Admin\Desktop\# DECRYPT MY FILES #.htmlMD5
6811c914f10e468a6b32bca2922b9bef
SHA183744a23a8dd83cb2ede9bb9fd79fce10177b1ae
SHA256196e4cd087e4ea0a966177788067d90f59e491e7c0187aabfe35f7183bca1e20
SHA51223acb87d0e9e1e83e19228bf052b45052037b935a2a0b8c221cc731a92ae97b37d541f007f4075ed56f988d178c3dc00120da32456211df6612d3970f2dad64c
-
C:\Users\Admin\Desktop\# DECRYPT MY FILES #.txtMD5
d07f92739d3404279bca47051ed85c56
SHA108b8ee3527fb00645287091812078c7b8fc04931
SHA2565c18bb529ea13d3cc1b3af73724e6cd7e90188a91eccb32369ac4bc3cb7ead9a
SHA5126ff6c73639da3664934de0dd6f563c88006214695e812c2d4df0683169ef18ea36f89486a4633ece66ac469c30f24318a486693eba71300e883c3eb5b282f748
-
C:\Users\Admin\Desktop\# DECRYPT MY FILES #.vbsMD5
1c2a24505278e661eca32666d4311ce5
SHA1d1deb57023bbe38a33f0894b6a9a7bbffbfdeeee
SHA2563f0dc6126cf33e7aa725df926a1b7d434eaf62a69f42e1b8ae4c110fd3572628
SHA512ce866f2c4b96c6c7c090f4bf1708bfebdfcd58ce65a23bdc124a13402ef4941377c7e286e6156a28bd229e422685454052382f1f532545bc2edf07be4861b36c
-
memory/820-5-0x0000000000000000-mapping.dmp
-
memory/1216-9-0x0000000000000000-mapping.dmp
-
memory/2652-0-0x0000000000000000-mapping.dmp
-
memory/3612-3-0x0000000000000000-mapping.dmp
-
memory/3824-4-0x0000000000000000-mapping.dmp
-
memory/4100-25-0x0000000000000000-mapping.dmp
-
memory/4100-40-0x00000250B1100000-0x00000250B1101000-memory.dmpFilesize
4KB
-
memory/4568-43-0x0000000000000000-mapping.dmp
-
memory/4612-44-0x0000000000000000-mapping.dmp
-
memory/4680-49-0x0000000000000000-mapping.dmp