cerber | aebce4939ad8d8df9d1807debb140669e47a24c71b7978249362d3b0900c33f3

Analysis

max time kernel
1787s
max time network
1798s
platform
windows10-2004_x64
resource
win10v2004-20220331-en
submitted
07-04-2022 19:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

VirusShare_41dd108ada487cb93a6e099e074f605b.exe
Size

382KB
MD5

41dd108ada487cb93a6e099e074f605b
SHA1

354f9fcee3214078d2bc5e3ea55c6b678c2fe2bf
SHA256

aebce4939ad8d8df9d1807debb140669e47a24c71b7978249362d3b0900c33f3
SHA512

33adb352e06e779871224ce094954756f15e49785fc14f8c8a02476b420b00907961d3489944c2da42fa84e8185f0f6bc7eefde58ebc4ae213fed9bfa1b5932b

Score

10^/10

cerber discovery persistence ransomware spyware stealer

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\# DECRYPT MY FILES #.html

Ransom Note

<!DOCTYPE html> <html lang="en"> <head> <meta charset="utf-8"> <title>Cerber Ransomware</title> <style> a { color: #47c; text-decoration: none; } a:hover { text-decoration: underline; } body { background-color: #e7e7e7; color: #333; font-family: "Helvetica Neue", Helvetica, "Segoe UI", Arial, freesans, sans-serif, "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI Symbol"; font-size: 16px; line-height: 1.6; margin: 0; padding: 0; } hr { background-color: #e7e7e7; border: 0 none; border-bottom: 1px solid #c7c7c7; height: 5px; margin: 30px 0; } li { padding: 0 0 7px 7px; } ol { padding-left: 3em; } .container { background-color: #fff; border: 1px solid #c7c7c7; margin: 40px; padding: 40px 40px 20px 40px; } .info, .tor { background-color: #efe; border: 1px solid #bda; display: block; padding: 0px 20px; } .logo { font-size: 12px; font-weight: bold; line-height: 1; margin: 0; } .tor { padding: 10px 0; text-align: center; } .warning { background-color: #f5e7e7; border: 1px solid #ebccd1; color: #a44; display: block; padding: 15px 10px; text-align: center; } </style> </head> <body> <div class="container"> <h3>C E R B E R   R A N S O M W A R E</h3> <hr> Cannot you find the files you need? Is the content of the files that you looked for not readable? It is normal because the files' names, as well as the data in your files have been encrypted. Great!!! You have turned to be a part of a big community #Cerber_Ransomware. <hr> If you are reading this message it means the software "Cerber Rans0mware" has been removed from your computer. <hr> <h3>What is encryption?</h3> Encryption is a reversible modification of information for security reasons but providing full access to it for authorized users. To become an authorized user and keep the modification absolutely reversible (in other words to have a possibility to decrypt your files) you should have an individual private key. But not only it. It is required also to have the special decryption software (in your case "Cerber Decryptor" software) for safe and complete decryption of all your files and data. <hr> <h3>Everything is clear for me but what should I do?</h3> The first step is reading these instructions to the end. Your files have been encrypted with the "Cerber Ransomware" software; the instructions ("# DECRYPT MY FILES #.html" and "# DECRYPT MY FILES #.txt") in the folders with your encrypted files are not viruses, they will help you. After reading this text the most part of people start searching in the Internet the words the "Cerber Ransomware" where they find a lot of ideas, recommendations and instructions. It is necessary to realize that we are the ones who closed the lock on your files and we are the only ones who have this secret key to open them. Any attempts to get back your files with the third-party tools can be fatal for your encrypted files. The most part of the third-party software change data within the encrypted file to restore it but this causes damage to the files. Finally it will be impossible to decrypt your files. When you make a puzzle but some items are lost, broken or not put in its place - the puzzle items will never match, the same way the third-party software will ruin your files completely and irreversibly. You should realize that any intervention of the third-party software to restore files encrypted with the "Cerber Ransomware" software may be fatal for your files. <hr> There are several plain steps to restore your files but if you do not follow them we will not be able to help you, and we will not try since you have read this warning already. <hr> For your information the software to decrypt your files (as well as the private key provided together) are paid products. After purchase of the software package you will be able to: <ol> <li>decrypt all your files;</li> <li>work with your documents;</li> <li>view your photos and other media;</li> <li>continue your usual and comfortable work at the computer.</li> </ol> If you understand all importance of the situation then we propose to you to go directly to your personal page where you will receive the complete instructions and guarantees to restore your files. <hr> <div class="info"> There is a list of temporary addresses to go on your personal page below: <ol> <li><a href="http://4kqd3hmqgptupi3p.wins4n.win/361E-2C46-C64F-0078-1CFC" target="_blank">http://4kqd3hmqgptupi3p.wins4n.win/361E-2C46-C64F-0078-1CFC</a></li> <li><a href="http://4kqd3hmqgptupi3p.we34re.top/361E-2C46-C64F-0078-1CFC" target="_blank">http://4kqd3hmqgptupi3p.we34re.top/361E-2C46-C64F-0078-1CFC</a></li> <li><a href="http://4kqd3hmqgptupi3p.5kti58.top/361E-2C46-C64F-0078-1CFC" target="_blank">http://4kqd3hmqgptupi3p.5kti58.top/361E-2C46-C64F-0078-1CFC</a></li> <li><a href="http://4kqd3hmqgptupi3p.vmckfi.top/361E-2C46-C64F-0078-1CFC" target="_blank">http://4kqd3hmqgptupi3p.vmckfi.top/361E-2C46-C64F-0078-1CFC</a></li> <li><a href="http://4kqd3hmqgptupi3p.onion.to/361E-2C46-C64F-0078-1CFC" target="_blank">http://4kqd3hmqgptupi3p.onion.to/361E-2C46-C64F-0078-1CFC</a></li> </ol> </div> <hr> <h3>What should you do with these addresses?</h3> If you read the instructions in TXT format (if you have instruction in HTML (the file with an icon of your Internet browser) then the easiest way is to run it): <ol> <li>take a look at the first address (in this case it is <a href="http://4kqd3hmqgptupi3p.wins4n.win/361E-2C46-C64F-0078-1CFC" target="_blank">http://4kqd3hmqgptupi3p.wins4n.win/361E-2C46-C64F-0078-1CFC</a>);</li> <li>select it with the mouse cursor holding the left mouse button and moving the cursor to the right;</li> <li>release the left mouse button and press the right one;</li> <li>select "Copy" in the appeared menu;</li> <li>run your Internet browser (if you do not know what it is run the Internet Explorer);</li> <li>move the mouse cursor to the address bar of the browser (this is the place where the site address is written);</li> <li>click the right mouse button in the field where the site address is written;</li> <li>select the button "Insert" in the appeared menu;</li> <li>then you will see the address <a href="http://4kqd3hmqgptupi3p.wins4n.win/361E-2C46-C64F-0078-1CFC" target="_blank">http://4kqd3hmqgptupi3p.wins4n.win/361E-2C46-C64F-0078-1CFC</a> appeared there;</li> <li>press ENTER;</li> <li>the site should be loaded; if it is not loaded repeat the same instructions with the second address and continue until the last address if falling.</li> </ol> If for some reason the site cannot be opened check the connection to the Internet; if the site still cannot be opened take a look at the instructions on omitting the point about working with the addresses in the HTML instructions. If you browse the instructions in HTML format: <ol> <li>click the left mouse button on the first address (in this case it is <a href="http://4kqd3hmqgptupi3p.wins4n.win/361E-2C46-C64F-0078-1CFC" target="_blank">http://4kqd3hmqgptupi3p.wins4n.win/361E-2C46-C64F-0078-1CFC</a>);</li> <li>in a new tab or window of your web browser the site should be loaded; if it is not loaded repeat the same instructions with the second address and continue until the last address.</li> </ol> If for some reason the site cannot be opened check the connection to the Internet. <hr> Unfortunately these sites are short-term since the antivirus companies are interested in you do not have a chance to restore your files but continue to buy their products. Unlike them we are ready to help you always. If you need our help but the temporary sites are not available: <ol> <li>run your Internet browser (if you do not know what it is run the Internet Explorer);</li> <li>enter or copy the address <a href="https://www.torproject.org/download/download-easy.html.en" target="_blank">https://www.torproject.org/download/download-easy.html.en</a> into the address bar of your browser and press ENTER;</li> <li>wait for the site loading;</li> <li>on the site you will be offered to download Tor Browser; download and run it, follow the installation instructions, wait until the installation is completed;</li> <li>run Tor Browser;</li> <li>connect with the button "Connect" (if you use the English version);</li> <li>a normal Internet browser window will be opened after the initialization;</li> <li>type or copy the address http://4kqd3hmqgptupi3p.onion/361E-2C46-C64F-0078-1CFC in this browser address bar;</li> <li>press ENTER;</li> <li>the site should be loaded; if for some reason the site is not loading wait for a moment and try again.</li> </ol> If you have any problems during installation or operation of Tor Browser, please, visit <a href="https://www.youtube.com/results?search_query=install+tor+browser+windows" target="_blank">https://www.youtube.com/</a> and type request in the search bar "install tor browser windows" and you will find a lot of training videos about Tor Browser installation and operation. If TOR address is not available for a long period (2-3 days) it means you are late; usually you have about 2-3 weeks after reading the instructions to restore your files. <hr> <h3>Additional information:</h3> You will find the instructions for restoring your files in those folders where you have your encrypted files only. The instructions are made in two file formats - HTML and TXT for your convenience. Unfortunately antivirus companies cannot protect or restore your files but they can make the situation worse removing the instructions how to restore your encrypted files. The instructions are not viruses; they have informative nature only, so any claims on the absence of any instruction files you can send to your antivirus company. <hr> Cerber Ransomware Project is not malicious and is not intended to harm a person and his/her information data. The project is created for the sole purpose of instruction regarding information security, as well as certification of antivirus software for their suitability for data protection. Together we make the Internet a better and safer place. <hr> If you look through this text in the Internet and realize that something is wrong with your files but you do not have any instructions to restore your files, please, contact your antivirus support. <hr> Remember that the worst situation already happened and now it depends on your determination and speed of your actions the further life of your files. </div> </body> </html>

Extracted

Path

C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\# DECRYPT MY FILES #.txt

Family

cerber

Ransom Note

C E R B E R R A N S O M W A R E ######################################################################### Cannot you find the files you need? Is the content of the files that you looked for not readable? It is normal because the files' names, as well as the data in your files have been encrypted. Great!!! You have turned to be a part of a big community #Cerber_Ransomware. ######################################################################### !!! If you are reading this message it means the software !!! "Cerber Rans0mware" has been removed from your computer. ######################################################################### What is encryption? ------------------- Encryption is a reversible modification of information for security reasons but providing full access to it for authorized users. To become an authorized user and keep the modification absolutely reversible (in other words to have a possibility to decrypt your files) you should have an individual private key. But not only it. It is required also to have the special decryption software (in your case "Cerber Decryptor" software) for safe and complete decryption of all your files and data. ######################################################################### Everything is clear for me but what should I do? ------------------------------------------------ The first step is reading these instructions to the end. Your files have been encrypted with the "Cerber Ransomware" software; the instructions ("# DECRYPT MY FILES #.html" and "# DECRYPT MY FILES #.txt") in the folders with your encrypted files are not viruses, they will help you. After reading this text the most part of people start searching in the Internet the words the "Cerber Ransomware" where they find a lot of ideas, recommendations and instructions. It is necessary to realize that we are the ones who closed the lock on your files and we are the only ones who have this secret key to open them. !!! Any attempts to get back your files with the third-party tools can !!! be fatal for your encrypted files. The most part of the third-party software change data within the encrypted file to restore it but this causes damage to the files. Finally it will be impossible to decrypt your files. When you make a puzzle but some items are lost, broken or not put in its place - the puzzle items will never match, the same way the third-party software will ruin your files completely and irreversibly. You should realize that any intervention of the third-party software to restore files encrypted with the "Cerber Ransomware" software may be fatal for your files. ######################################################################### !!! There are several plain steps to restore your files but if you do !!! not follow them we will not be able to help you, and we will not try !!! since you have read this warning already. ######################################################################### For your information the software to decrypt your files (as well as the private key provided together) are paid products. After purchase of the software package you will be able to: 1. decrypt all your files; 2. work with your documents; 3. view your photos and other media; 4. continue your usual and comfortable work at the computer. If you understand all importance of the situation then we propose to you to go directly to your personal page where you will receive the complete instructions and guarantees to restore your files. ######################################################################### There is a list of temporary addresses to go on your personal page below: _______________________________________________________________________ | | 1. http://4kqd3hmqgptupi3p.wins4n.win/361E-2C46-C64F-0078-1CFC | | 2. http://4kqd3hmqgptupi3p.we34re.top/361E-2C46-C64F-0078-1CFC | | 3. http://4kqd3hmqgptupi3p.5kti58.top/361E-2C46-C64F-0078-1CFC | | 4. http://4kqd3hmqgptupi3p.vmckfi.top/361E-2C46-C64F-0078-1CFC | | 5. http://4kqd3hmqgptupi3p.onion.to/361E-2C46-C64F-0078-1CFC |_______________________________________________________________________ ######################################################################### What should you do with these addresses? ---------------------------------------- If you read the instructions in TXT format (if you have instruction in HTML (the file with an icon of your Internet browser) then the easiest way is to run it): 1. take a look at the first address (in this case it is http://4kqd3hmqgptupi3p.wins4n.win/361E-2C46-C64F-0078-1CFC); 2. select it with the mouse cursor holding the left mouse button and moving the cursor to the right; 3. release the left mouse button and press the right one; 4. select "Copy" in the appeared menu; 5. run your Internet browser (if you do not know what it is run the Internet Explorer); 6. move the mouse cursor to the address bar of the browser (this is the place where the site address is written); 7. click the right mouse button in the field where the site address is written; 8. select the button "Insert" in the appeared menu; 9. then you will see the address http://4kqd3hmqgptupi3p.wins4n.win/361E-2C46-C64F-0078-1CFC appeared there; 10. press ENTER; 11. the site should be loaded; if it is not loaded repeat the same instructions with the second address and continue until the last address if falling. If for some reason the site cannot be opened check the connection to the Internet; if the site still cannot be opened take a look at the instructions on omitting the point about working with the addresses in the HTML instructions. If you browse the instructions in HTML format: 1. click the left mouse button on the first address (in this case it is http://4kqd3hmqgptupi3p.wins4n.win/361E-2C46-C64F-0078-1CFC); 2. in a new tab or window of your web browser the site should be loaded; if it is not loaded repeat the same instructions with the second address and continue until the last address. If for some reason the site cannot be opened check the connection to the Internet. ######################################################################### Unfortunately these sites are short-term since the antivirus companies are interested in you do not have a chance to restore your files but continue to buy their products. Unlike them we are ready to help you always. If you need our help but the temporary sites are not available: 1. run your Internet browser (if you do not know what it is run the Internet Explorer); 2. enter or copy the address https://www.torproject.org/download/download-easy.html.en into the address bar of your browser and press ENTER; 3. wait for the site loading; 4. on the site you will be offered to download Tor Browser; download and run it, follow the installation instructions, wait until the installation is completed; 5. run Tor Browser; 6. connect with the button "Connect" (if you use the English version); 7. a normal Internet browser window will be opened after the initialization; 8. type or copy the address ________________________________________________________ | | | http://4kqd3hmqgptupi3p.onion/361E-2C46-C64F-0078-1CFC | |________________________________________________________| in this browser address bar; 9. press ENTER; 10. the site should be loaded; if for some reason the site is not loading wait for a moment and try again. If you have any problems during installation or operation of Tor Browser, please, visit https://www.youtube.com/ and type request in the search bar "install tor browser windows" and you will find a lot of training videos about Tor Browser installation and operation. If TOR address is not available for a long period (2-3 days) it means you are late; usually you have about 2-3 weeks after reading the instructions to restore your files. ######################################################################### Additional information: You will find the instructions for restoring your files in those folders where you have your encrypted files only. The instructions are made in two file formats - HTML and TXT for your convenience. Unfortunately antivirus companies cannot protect or restore your files but they can make the situation worse removing the instructions how to restore your encrypted files. The instructions are not viruses; they have informative nature only, so any claims on the absence of any instruction files you can send to your antivirus company. ######################################################################### Cerber Ransomware Project is not malicious and is not intended to harm a person and his/her information data. The project is created for the sole purpose of instruction regarding information security, as well as certification of antivirus software for their suitability for data protection. Together we make the Internet a better and safer place. ######################################################################### If you look through this text in the Internet and realize that something is wrong with your files but you do not have any instructions to restore your files, please, contact your antivirus support. ######################################################################### Remember that the worst situation already happened and now it depends on your determination and speed of your actions the further life of your files.

URLs

http://4kqd3hmqgptupi3p.wins4n.win/361E-2C46-C64F-0078-1CFC

http://4kqd3hmqgptupi3p.we34re.top/361E-2C46-C64F-0078-1CFC

http://4kqd3hmqgptupi3p.5kti58.top/361E-2C46-C64F-0078-1CFC

http://4kqd3hmqgptupi3p.vmckfi.top/361E-2C46-C64F-0078-1CFC

http://4kqd3hmqgptupi3p.onion.to/361E-2C46-C64F-0078-1CFC

http://4kqd3hmqgptupi3p.onion/361E-2C46-C64F-0078-1CFC

Extracted

Path

C:\Users\Admin\Desktop\# DECRYPT MY FILES #.html

Ransom Note

C E R B E R R A N S O M W A R E Cannot you find the files you need? Is the content of the files that you looked for not readable? It is normal because the files' names, as well as the data in your files have been encrypted. Great!!! You have turned to be a part of a big community #Cerber_Ransomware. If you are reading this message it means the software "Cerber Rans0mware" has been removed from your computer. What is encryption? Encryption is a reversible modification of information for security reasons but providing full access to it for authorized users. To become an authorized user and keep the modification absolutely reversible (in other words to have a possibility to decrypt your files) you should have an individual private key. But not only it. It is required also to have the special decryption software (in your case "Cerber Decryptor" software) for safe and complete decryption of all your files and data. Everything is clear for me but what should I do? The first step is reading these instructions to the end. Your files have been encrypted with the "Cerber Ransomware" software; the instructions ("# DECRYPT MY FILES #.html" and "# DECRYPT MY FILES #.txt") in the folders with your encrypted files are not viruses, they will help you. After reading this text the most part of people start searching in the Internet the words the "Cerber Ransomware" where they find a lot of ideas, recommendations and instructions. It is necessary to realize that we are the ones who closed the lock on your files and we are the only ones who have this secret key to open them. Any attempts to get back your files with the third-party tools can be fatal for your encrypted files. The most part of the third-party software change data within the encrypted file to restore it but this causes damage to the files. Finally it will be impossible to decrypt your files. When you make a puzzle but some items are lost, broken or not put in its place - the puzzle items will never match, the same way the third-party software will ruin your files completely and irreversibly. You should realize that any intervention of the third-party software to restore files encrypted with the "Cerber Ransomware" software may be fatal for your files. There are several plain steps to restore your files but if you do not follow them we will not be able to help you, and we will not try since you have read this warning already. For your information the software to decrypt your files (as well as the private key provided together) are paid products. After purchase of the software package you will be able to: decrypt all your files; work with your documents; view your photos and other media; continue your usual and comfortable work at the computer. If you understand all importance of the situation then we propose to you to go directly to your personal page where you will receive the complete instructions and guarantees to restore your files. There is a list of temporary addresses to go on your personal page below: http://4kqd3hmqgptupi3p.wins4n.win/361E-2C46-C64F-0078-1CFC http://4kqd3hmqgptupi3p.we34re.top/361E-2C46-C64F-0078-1CFC http://4kqd3hmqgptupi3p.5kti58.top/361E-2C46-C64F-0078-1CFC http://4kqd3hmqgptupi3p.vmckfi.top/361E-2C46-C64F-0078-1CFC http://4kqd3hmqgptupi3p.onion.to/361E-2C46-C64F-0078-1CFC What should you do with these addresses? If you read the instructions in TXT format (if you have instruction in HTML (the file with an icon of your Internet browser) then the easiest way is to run it): take a look at the first address (in this case it is http://4kqd3hmqgptupi3p.wins4n.win/361E-2C46-C64F-0078-1CFC); select it with the mouse cursor holding the left mouse button and moving the cursor to the right; release the left mouse button and press the right one; select "Copy" in the appeared menu; run your Internet browser (if you do not know what it is run the Internet Explorer); move the mouse cursor to the address bar of the browser (this is the place where the site address is written); click the right mouse button in the field where the site address is written; select the button "Insert" in the appeared menu; then you will see the address http://4kqd3hmqgptupi3p.wins4n.win/361E-2C46-C64F-0078-1CFC appeared there; press ENTER; the site should be loaded; if it is not loaded repeat the same instructions with the second address and continue until the last address if falling. If for some reason the site cannot be opened check the connection to the Internet; if the site still cannot be opened take a look at the instructions on omitting the point about working with the addresses in the HTML instructions. If you browse the instructions in HTML format: click the left mouse button on the first address (in this case it is http://4kqd3hmqgptupi3p.wins4n.win/361E-2C46-C64F-0078-1CFC); in a new tab or window of your web browser the site should be loaded; if it is not loaded repeat the same instructions with the second address and continue until the last address. If for some reason the site cannot be opened check the connection to the Internet. Unfortunately these sites are short-term since the antivirus companies are interested in you do not have a chance to restore your files but continue to buy their products. Unlike them we are ready to help you always. If you need our help but the temporary sites are not available: run your Internet browser (if you do not know what it is run the Internet Explorer); enter or copy the address https://www.torproject.org/download/download-easy.html.en into the address bar of your browser and press ENTER; wait for the site loading; on the site you will be offered to download Tor Browser; download and run it, follow the installation instructions, wait until the installation is completed; run Tor Browser; connect with the button "Connect" (if you use the English version); a normal Internet browser window will be opened after the initialization; type or copy the address http://4kqd3hmqgptupi3p.onion/361E-2C46-C64F-0078-1CFC in this browser address bar; press ENTER; the site should be loaded; if for some reason the site is not loading wait for a moment and try again. If you have any problems during installation or operation of Tor Browser, please, visit https://www.youtube.com/ and type request in the search bar "install tor browser windows" and you will find a lot of training videos about Tor Browser installation and operation. If TOR address is not available for a long period (2-3 days) it means you are late; usually you have about 2-3 weeks after reading the instructions to restore your files. Additional information: You will find the instructions for restoring your files in those folders where you have your encrypted files only. The instructions are made in two file formats - HTML and TXT for your convenience. Unfortunately antivirus companies cannot protect or restore your files but they can make the situation worse removing the instructions how to restore your encrypted files. The instructions are not viruses; they have informative nature only, so any claims on the absence of any instruction files you can send to your antivirus company. Cerber Ransomware Project is not malicious and is not intended to harm a person and his/her information data. The project is created for the sole purpose of instruction regarding information security, as well as certification of antivirus software for their suitability for data protection. Together we make the Internet a better and safer place. If you look through this text in the Internet and realize that something is wrong with your files but you do not have any instructions to restore your files, please, contact your antivirus support. Remember that the worst situation already happened and now it depends on your determination and speed of your actions the further life of your files.

URLs

http://4kqd3hmqgptupi3p.wins4n.win/361E-2C46-C64F-0078-1CFC

http://4kqd3hmqgptupi3p.we34re.top/361E-2C46-C64F-0078-1CFC

http://4kqd3hmqgptupi3p.5kti58.top/361E-2C46-C64F-0078-1CFC

http://4kqd3hmqgptupi3p.vmckfi.top/361E-2C46-C64F-0078-1CFC

http://4kqd3hmqgptupi3p.onion.to/361E-2C46-C64F-0078-1CFC

http://4kqd3hmqgptupi3p.onion/361E-2C46-C64F-0078-1CFC

Signatures

Cerber
Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.
ransomware cerber
Contacts a large (16422) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run = "\"C:\\Users\\Admin\\AppData\\Roaming\\{8F96F56F-5268-382E-17C0-CEDE4D5A91E2}\\bitsadmin.exe\""	VirusShare_41dd108ada487cb93a6e099e074f605b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run = "\"C:\\Users\\Admin\\AppData\\Roaming\\{8F96F56F-5268-382E-17C0-CEDE4D5A91E2}\\bitsadmin.exe\""	bitsadmin.exe

Executes dropped EXE 10 IoCs

pid	Process
1280	bitsadmin.exe
4724	bitsadmin.exe
3596	bitsadmin.exe
2488	bitsadmin.exe
1520	bitsadmin.exe
5096	bitsadmin.exe
4792	bitsadmin.exe
244	bitsadmin.exe
4896	bitsadmin.exe
4936	bitsadmin.exe

Modifies extensions of user files 3 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

description	ioc	Process
File opened for modification	C:\Users\Admin\Pictures\SwitchUnregister.tiff	bitsadmin.exe
File opened for modification	C:\Users\Admin\Pictures\NewProtect.tiff	bitsadmin.exe
File opened for modification	C:\Users\Admin\Pictures\WaitWatch.tiff	bitsadmin.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\Control Panel\International\Geo\Nation	bitsadmin.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartUp\bitsadmin.lnk	VirusShare_41dd108ada487cb93a6e099e074f605b.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartUp\bitsadmin.lnk	bitsadmin.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 9 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\Software\Microsoft\Windows\CurrentVersion\Run	bitsadmin.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bitsadmin = "\"C:\\Users\\Admin\\AppData\\Roaming\\{8F96F56F-5268-382E-17C0-CEDE4D5A91E2}\\bitsadmin.exe\""	bitsadmin.exe
Key created	\REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\Software\Microsoft\Windows\CurrentVersion\Run	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\Software\Microsoft\Windows\CurrentVersion\Run	VirusShare_41dd108ada487cb93a6e099e074f605b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bitsadmin = "\"C:\\Users\\Admin\\AppData\\Roaming\\{8F96F56F-5268-382E-17C0-CEDE4D5A91E2}\\bitsadmin.exe\""	VirusShare_41dd108ada487cb93a6e099e074f605b.exe
Key created	\REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce	VirusShare_41dd108ada487cb93a6e099e074f605b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\bitsadmin = "\"C:\\Users\\Admin\\AppData\\Roaming\\{8F96F56F-5268-382E-17C0-CEDE4D5A91E2}\\bitsadmin.exe\""	VirusShare_41dd108ada487cb93a6e099e074f605b.exe
Key created	\REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce	bitsadmin.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\bitsadmin = "\"C:\\Users\\Admin\\AppData\\Roaming\\{8F96F56F-5268-382E-17C0-CEDE4D5A91E2}\\bitsadmin.exe\""	bitsadmin.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
12	ipinfo.io

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tmp78FB.bmp"	bitsadmin.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\99edd859-8d05-4f85-9d18-bb05447622db.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20220407213751.pma	setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Kills process with taskkill 3 IoCs

evasion

pid	Process
496	taskkill.exe
1548	taskkill.exe
3084	taskkill.exe

Modifies Control Panel 4 IoCs

evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\Control Panel\Desktop\SCRNSAVE.EXE = "\"C:\\Users\\Admin\\AppData\\Roaming\\{8F96F56F-5268-382E-17C0-CEDE4D5A91E2}\\bitsadmin.exe\""	VirusShare_41dd108ada487cb93a6e099e074f605b.exe
Key created	\REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\Control Panel\Desktop	bitsadmin.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\Control Panel\Desktop\SCRNSAVE.EXE = "\"C:\\Users\\Admin\\AppData\\Roaming\\{8F96F56F-5268-382E-17C0-CEDE4D5A91E2}\\bitsadmin.exe\""	bitsadmin.exe
Key created	\REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\Control Panel\Desktop	VirusShare_41dd108ada487cb93a6e099e074f605b.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000_Classes\Local Settings	bitsadmin.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Runs ping.exe 1 TTPs 3 IoCs

Remote System Discovery

T1018

pid	Process
4796	PING.EXE
3632	PING.EXE
4548	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1280	bitsadmin.exe
1280	bitsadmin.exe
1280	bitsadmin.exe
1280	bitsadmin.exe
1280	bitsadmin.exe
1280	bitsadmin.exe
1280	bitsadmin.exe
1280	bitsadmin.exe
1280	bitsadmin.exe
1280	bitsadmin.exe
1280	bitsadmin.exe
1280	bitsadmin.exe
1280	bitsadmin.exe
1280	bitsadmin.exe
1280	bitsadmin.exe
1280	bitsadmin.exe
1280	bitsadmin.exe
1280	bitsadmin.exe
1280	bitsadmin.exe
1280	bitsadmin.exe
1280	bitsadmin.exe
1280	bitsadmin.exe
1280	bitsadmin.exe
1280	bitsadmin.exe
1280	bitsadmin.exe
1280	bitsadmin.exe
1280	bitsadmin.exe
1280	bitsadmin.exe
1280	bitsadmin.exe
1280	bitsadmin.exe
1280	bitsadmin.exe
1280	bitsadmin.exe
1280	bitsadmin.exe
1280	bitsadmin.exe
1280	bitsadmin.exe
1280	bitsadmin.exe
1280	bitsadmin.exe
1280	bitsadmin.exe
1280	bitsadmin.exe
1280	bitsadmin.exe
1280	bitsadmin.exe
1280	bitsadmin.exe
1280	bitsadmin.exe
1280	bitsadmin.exe
1280	bitsadmin.exe
1280	bitsadmin.exe
1280	bitsadmin.exe
1280	bitsadmin.exe
1280	bitsadmin.exe
1280	bitsadmin.exe
1280	bitsadmin.exe
1280	bitsadmin.exe
1280	bitsadmin.exe
1280	bitsadmin.exe
1280	bitsadmin.exe
1280	bitsadmin.exe
1280	bitsadmin.exe
1280	bitsadmin.exe
1280	bitsadmin.exe
1280	bitsadmin.exe
1280	bitsadmin.exe
1280	bitsadmin.exe
1280	bitsadmin.exe
1280	bitsadmin.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe

Suspicious use of AdjustPrivilegeToken 15 IoCs

description	pid	Process
Token: SeDebugPrivilege	400	VirusShare_41dd108ada487cb93a6e099e074f605b.exe
Token: SeDebugPrivilege	496	taskkill.exe
Token: SeDebugPrivilege	1280	bitsadmin.exe
Token: SeDebugPrivilege	4724	bitsadmin.exe
Token: SeDebugPrivilege	3596	bitsadmin.exe
Token: SeDebugPrivilege	2488	bitsadmin.exe
Token: SeDebugPrivilege	1520	bitsadmin.exe
Token: SeDebugPrivilege	5096	bitsadmin.exe
Token: SeDebugPrivilege	4792	bitsadmin.exe
Token: SeDebugPrivilege	244	bitsadmin.exe
Token: SeDebugPrivilege	4896	bitsadmin.exe
Token: 33	4472	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4472	AUDIODG.EXE
Token: SeDebugPrivilege	1548	taskkill.exe
Token: SeDebugPrivilege	3084	taskkill.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 400 wrote to memory of 1280	400	VirusShare_41dd108ada487cb93a6e099e074f605b.exe	82
PID 400 wrote to memory of 1280	400	VirusShare_41dd108ada487cb93a6e099e074f605b.exe	82
PID 400 wrote to memory of 1280	400	VirusShare_41dd108ada487cb93a6e099e074f605b.exe	82
PID 400 wrote to memory of 1700	400	VirusShare_41dd108ada487cb93a6e099e074f605b.exe	83
PID 400 wrote to memory of 1700	400	VirusShare_41dd108ada487cb93a6e099e074f605b.exe	83
PID 400 wrote to memory of 1700	400	VirusShare_41dd108ada487cb93a6e099e074f605b.exe	83
PID 1700 wrote to memory of 496	1700	cmd.exe	85
PID 1700 wrote to memory of 496	1700	cmd.exe	85
PID 1700 wrote to memory of 496	1700	cmd.exe	85
PID 1700 wrote to memory of 4796	1700	cmd.exe	86
PID 1700 wrote to memory of 4796	1700	cmd.exe	86
PID 1700 wrote to memory of 4796	1700	cmd.exe	86
PID 1280 wrote to memory of 2384	1280	bitsadmin.exe	112
PID 1280 wrote to memory of 2384	1280	bitsadmin.exe	112
PID 2384 wrote to memory of 1456	2384	msedge.exe	114
PID 2384 wrote to memory of 1456	2384	msedge.exe	114
PID 1280 wrote to memory of 2392	1280	bitsadmin.exe	113
PID 1280 wrote to memory of 2392	1280	bitsadmin.exe	113
PID 1280 wrote to memory of 2432	1280	bitsadmin.exe	116
PID 1280 wrote to memory of 2432	1280	bitsadmin.exe	116
PID 2432 wrote to memory of 464	2432	msedge.exe	117
PID 2432 wrote to memory of 464	2432	msedge.exe	117
PID 1280 wrote to memory of 4556	1280	bitsadmin.exe	118
PID 1280 wrote to memory of 4556	1280	bitsadmin.exe	118
PID 2432 wrote to memory of 1532	2432	msedge.exe	123
PID 2432 wrote to memory of 1532	2432	msedge.exe	123
PID 2432 wrote to memory of 1532	2432	msedge.exe	123
PID 2432 wrote to memory of 1532	2432	msedge.exe	123
PID 2432 wrote to memory of 1532	2432	msedge.exe	123
PID 2432 wrote to memory of 1532	2432	msedge.exe	123
PID 2432 wrote to memory of 1532	2432	msedge.exe	123
PID 2432 wrote to memory of 1532	2432	msedge.exe	123
PID 2432 wrote to memory of 1532	2432	msedge.exe	123
PID 2432 wrote to memory of 1532	2432	msedge.exe	123
PID 2432 wrote to memory of 1532	2432	msedge.exe	123
PID 2432 wrote to memory of 1532	2432	msedge.exe	123
PID 2432 wrote to memory of 1532	2432	msedge.exe	123
PID 2432 wrote to memory of 1532	2432	msedge.exe	123
PID 2432 wrote to memory of 1532	2432	msedge.exe	123
PID 2432 wrote to memory of 1532	2432	msedge.exe	123
PID 2432 wrote to memory of 1532	2432	msedge.exe	123
PID 2432 wrote to memory of 1532	2432	msedge.exe	123
PID 2432 wrote to memory of 1532	2432	msedge.exe	123
PID 2432 wrote to memory of 1532	2432	msedge.exe	123
PID 2432 wrote to memory of 1532	2432	msedge.exe	123
PID 2432 wrote to memory of 1532	2432	msedge.exe	123
PID 2432 wrote to memory of 1532	2432	msedge.exe	123
PID 2432 wrote to memory of 1532	2432	msedge.exe	123
PID 2432 wrote to memory of 1532	2432	msedge.exe	123
PID 2432 wrote to memory of 1532	2432	msedge.exe	123
PID 2432 wrote to memory of 1532	2432	msedge.exe	123
PID 2432 wrote to memory of 1532	2432	msedge.exe	123
PID 2432 wrote to memory of 1532	2432	msedge.exe	123
PID 2432 wrote to memory of 1532	2432	msedge.exe	123
PID 2432 wrote to memory of 1532	2432	msedge.exe	123
PID 2432 wrote to memory of 1532	2432	msedge.exe	123
PID 2384 wrote to memory of 4868	2384	msedge.exe	122
PID 2384 wrote to memory of 4868	2384	msedge.exe	122
PID 2384 wrote to memory of 4868	2384	msedge.exe	122
PID 2384 wrote to memory of 4868	2384	msedge.exe	122
PID 2384 wrote to memory of 4868	2384	msedge.exe	122
PID 2384 wrote to memory of 4868	2384	msedge.exe	122
PID 2384 wrote to memory of 4868	2384	msedge.exe	122
PID 2384 wrote to memory of 4868	2384	msedge.exe	122

C:\Users\Admin\AppData\Local\Temp\VirusShare_41dd108ada487cb93a6e099e074f605b.exe
"C:\Users\Admin\AppData\Local\Temp\VirusShare_41dd108ada487cb93a6e099e074f605b.exe"
1⤵
- Adds policy Run key to start application
- Drops startup file
- Adds Run key to start application
- Modifies Control Panel
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:400
- C:\Users\Admin\AppData\Roaming\{8F96F56F-5268-382E-17C0-CEDE4D5A91E2}\bitsadmin.exe
  "C:\Users\Admin\AppData\Roaming\{8F96F56F-5268-382E-17C0-CEDE4D5A91E2}\bitsadmin.exe"
  2⤵
  - Adds policy Run key to start application
  - Executes dropped EXE
  - Modifies extensions of user files
  - Checks computer location settings
  - Drops startup file
  - Adds Run key to start application
  - Sets desktop wallpaper using registry
  - Modifies Control Panel
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1280
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\# DECRYPT MY FILES #.html
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2384
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xf8,0x108,0x7ffa5a5d46f8,0x7ffa5a5d4708,0x7ffa5a5d4718
      4⤵
      PID:1456
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,2592166406724061044,1600841099645066096,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
      4⤵
      PID:4868
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,2592166406724061044,1600841099645066096,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2344 /prefetch:3
      4⤵
      PID:3668
- - C:\Windows\system32\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\# DECRYPT MY FILES #.txt
    3⤵
    PID:2392
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://4kqd3hmqgptupi3p.wins4n.win/361E-2C46-C64F-0078-1CFC
    3⤵
    - Adds Run key to start application
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2432
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x104,0x108,0x10c,0xd4,0x110,0x7ffa5a5d46f8,0x7ffa5a5d4708,0x7ffa5a5d4718
      4⤵
      PID:464
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,13249192152578827037,5569570586284849837,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
      4⤵
      PID:1532
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2076,13249192152578827037,5569570586284849837,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2272 /prefetch:3
      4⤵
      PID:2336
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2076,13249192152578827037,5569570586284849837,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2656 /prefetch:8
      4⤵
      PID:2332
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,13249192152578827037,5569570586284849837,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3156 /prefetch:1
      4⤵
      PID:1296
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,13249192152578827037,5569570586284849837,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3092 /prefetch:1
      4⤵
      PID:776
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,13249192152578827037,5569570586284849837,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4172 /prefetch:1
      4⤵
      PID:4372
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,13249192152578827037,5569570586284849837,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5812 /prefetch:1
      4⤵
      PID:4032
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,13249192152578827037,5569570586284849837,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5836 /prefetch:1
      4⤵
      PID:3380
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,13249192152578827037,5569570586284849837,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5952 /prefetch:1
      4⤵
      PID:4732
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2076,13249192152578827037,5569570586284849837,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3912 /prefetch:8
      4⤵
      PID:3940
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,13249192152578827037,5569570586284849837,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6272 /prefetch:2
      4⤵
      PID:3008
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,13249192152578827037,5569570586284849837,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6616 /prefetch:8
      4⤵
      PID:4772
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,13249192152578827037,5569570586284849837,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6616 /prefetch:8
      4⤵
      PID:4932
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
      4⤵
      Drops file in Program Files directory
      PID:3440
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xe4,0x114,0xf0,0x10c,0xdc,0x7ff74ad55460,0x7ff74ad55470,0x7ff74ad55480
        5⤵
        
        PID:448
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2076,13249192152578827037,5569570586284849837,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6664 /prefetch:8
      4⤵
      PID:644
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2076,13249192152578827037,5569570586284849837,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4952 /prefetch:8
      4⤵
      PID:3480
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2076,13249192152578827037,5569570586284849837,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5720 /prefetch:8
      4⤵
      PID:3004
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2076,13249192152578827037,5569570586284849837,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2016 /prefetch:8
      4⤵
      PID:4880
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2076,13249192152578827037,5569570586284849837,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1308 /prefetch:8
      4⤵
      PID:904
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2076,13249192152578827037,5569570586284849837,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4196 /prefetch:8
      4⤵
      PID:4840
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2076,13249192152578827037,5569570586284849837,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3516 /prefetch:8
      4⤵
      PID:908
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2076,13249192152578827037,5569570586284849837,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3132 /prefetch:8
      4⤵
      PID:5068
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\# DECRYPT MY FILES #.vbs"
    3⤵
    PID:4556
- - C:\Windows\system32\cmd.exe
    /d /c taskkill /t /f /im "bitsadmin.exe" > NUL & ping -n 1 127.0.0.1 > NUL & del "C:\Users\Admin\AppData\Roaming\{8F96F56F-5268-382E-17C0-CEDE4D5A91E2}\bitsadmin.exe" > NUL
    3⤵
    PID:4712
  - - C:\Windows\system32\taskkill.exe
      taskkill /t /f /im "bitsadmin.exe"
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3084
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      Runs ping.exe
      PID:4548
- C:\Windows\SysWOW64\cmd.exe
  /d /c taskkill /t /f /im "VirusShare_41dd108ada487cb93a6e099e074f605b.exe" > NUL & ping -n 1 127.0.0.1 > NUL & del "C:\Users\Admin\AppData\Local\Temp\VirusShare_41dd108ada487cb93a6e099e074f605b.exe" > NUL
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1700
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /t /f /im "VirusShare_41dd108ada487cb93a6e099e074f605b.exe"
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:496
- - C:\Windows\SysWOW64\PING.EXE
    ping -n 1 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:4796

C:\Users\Admin\AppData\Roaming\{8F96F56F-5268-382E-17C0-CEDE4D5A91E2}\bitsadmin.exe
C:\Users\Admin\AppData\Roaming\{8F96F56F-5268-382E-17C0-CEDE4D5A91E2}\bitsadmin.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4724

C:\Users\Admin\AppData\Roaming\{8F96F56F-5268-382E-17C0-CEDE4D5A91E2}\bitsadmin.exe
C:\Users\Admin\AppData\Roaming\{8F96F56F-5268-382E-17C0-CEDE4D5A91E2}\bitsadmin.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3596

C:\Users\Admin\AppData\Roaming\{8F96F56F-5268-382E-17C0-CEDE4D5A91E2}\bitsadmin.exe
C:\Users\Admin\AppData\Roaming\{8F96F56F-5268-382E-17C0-CEDE4D5A91E2}\bitsadmin.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2488

C:\Users\Admin\AppData\Roaming\{8F96F56F-5268-382E-17C0-CEDE4D5A91E2}\bitsadmin.exe
C:\Users\Admin\AppData\Roaming\{8F96F56F-5268-382E-17C0-CEDE4D5A91E2}\bitsadmin.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1520

C:\Users\Admin\AppData\Roaming\{8F96F56F-5268-382E-17C0-CEDE4D5A91E2}\bitsadmin.exe
C:\Users\Admin\AppData\Roaming\{8F96F56F-5268-382E-17C0-CEDE4D5A91E2}\bitsadmin.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5096

C:\Users\Admin\AppData\Roaming\{8F96F56F-5268-382E-17C0-CEDE4D5A91E2}\bitsadmin.exe
C:\Users\Admin\AppData\Roaming\{8F96F56F-5268-382E-17C0-CEDE4D5A91E2}\bitsadmin.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4792

C:\Users\Admin\AppData\Roaming\{8F96F56F-5268-382E-17C0-CEDE4D5A91E2}\bitsadmin.exe
C:\Users\Admin\AppData\Roaming\{8F96F56F-5268-382E-17C0-CEDE4D5A91E2}\bitsadmin.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:244

C:\Users\Admin\AppData\Roaming\{8F96F56F-5268-382E-17C0-CEDE4D5A91E2}\bitsadmin.exe
C:\Users\Admin\AppData\Roaming\{8F96F56F-5268-382E-17C0-CEDE4D5A91E2}\bitsadmin.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4896

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x508 0x4e8
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4472

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3696

C:\Users\Admin\AppData\Roaming\{8F96F56F-5268-382E-17C0-CEDE4D5A91E2}\bitsadmin.exe
C:\Users\Admin\AppData\Roaming\{8F96F56F-5268-382E-17C0-CEDE4D5A91E2}\bitsadmin.exe
1⤵
- Executes dropped EXE
PID:4936
- C:\Windows\SysWOW64\cmd.exe
  /d /c taskkill /t /f /im "" > NUL & ping -n 1 127.0.0.1 > NUL & del "" > NUL
  2⤵
  PID:4104
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /t /f /im ""
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1548
- - C:\Windows\SysWOW64\PING.EXE
    ping -n 1 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:3632

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s camsvc
1⤵
PID:3084

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Network Service Scanning

T1046

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_E503B048B745DFA14B81FCFC68D6DECE

Filesize
471B

MD5
d2a99ffb2c73d006e4e8ffa26557ad1a

SHA1
676a39fb0687a05570e66ed2a5fdbbd846168367

SHA256
69ece1dfccce0a7eae10152fdfbecbc3cf8264bf981a55d141f5efa25d3d4aa9

SHA512
9bdebd6569f028e239da76ed67a593c53da04fb2f73c325f88c1bd83416c93080d778604d9894d2a02276736ef30b4654040460cfb040d185147eee0d02c50ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_E503B048B745DFA14B81FCFC68D6DECE

Filesize
446B

MD5
3c3af99524ce18a3fe0ceac73afb24f5

SHA1
2ec2881fc809068501f1a365c531647a80e6414b

SHA256
0471481adbd04eac6649187d446e5871177815efe98dc3fbba01cf3ea765707d

SHA512
8497a1e8a05e1529504c04ce742ebba723115fa49f8e8a8ddcff401aa98358100a2857f54b7c450ed38a2b02d94be3c2ad221bff79baed82a337cb94fcdbf2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7610889f134b713f224e9dc8dc2f1c47

SHA1
ca99dadb458a7abb868bd65389ceac72dfb95f9b

SHA256
127452182a479b418f3785541ab12c84105d6842d1800aea5a0473fe941f8d89

SHA512
2a67d3ea68812f9fd8c58b6a2718133d7e69085e589f89e43ea12ec5ca3e006938144246560026415b4be8f30eabd88d3685f7780af1c143a43c822b7b5af312

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7610889f134b713f224e9dc8dc2f1c47

SHA1
ca99dadb458a7abb868bd65389ceac72dfb95f9b

SHA256
127452182a479b418f3785541ab12c84105d6842d1800aea5a0473fe941f8d89

SHA512
2a67d3ea68812f9fd8c58b6a2718133d7e69085e589f89e43ea12ec5ca3e006938144246560026415b4be8f30eabd88d3685f7780af1c143a43c822b7b5af312

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7610889f134b713f224e9dc8dc2f1c47

SHA1
ca99dadb458a7abb868bd65389ceac72dfb95f9b

SHA256
127452182a479b418f3785541ab12c84105d6842d1800aea5a0473fe941f8d89

SHA512
2a67d3ea68812f9fd8c58b6a2718133d7e69085e589f89e43ea12ec5ca3e006938144246560026415b4be8f30eabd88d3685f7780af1c143a43c822b7b5af312

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7610889f134b713f224e9dc8dc2f1c47

SHA1
ca99dadb458a7abb868bd65389ceac72dfb95f9b

SHA256
127452182a479b418f3785541ab12c84105d6842d1800aea5a0473fe941f8d89

SHA512
2a67d3ea68812f9fd8c58b6a2718133d7e69085e589f89e43ea12ec5ca3e006938144246560026415b4be8f30eabd88d3685f7780af1c143a43c822b7b5af312

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7c709b14135a1c77814a526a2b460a97

SHA1
547bd68514a32a612c7c98e5324a35ea5b39d7a2

SHA256
ef9d2108ad41aa1480db4b633bcf66c964b5d8d8aab6f3372143242affd948d4

SHA512
baeb04f10ec0383f15ed5cfdf3242b69cbe3f166872012e5b85e83ca95e276623f62a923accc615394fd4058abe61809645f2cdaa0fafee099962a04541021c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7c709b14135a1c77814a526a2b460a97

SHA1
547bd68514a32a612c7c98e5324a35ea5b39d7a2

SHA256
ef9d2108ad41aa1480db4b633bcf66c964b5d8d8aab6f3372143242affd948d4

SHA512
baeb04f10ec0383f15ed5cfdf3242b69cbe3f166872012e5b85e83ca95e276623f62a923accc615394fd4058abe61809645f2cdaa0fafee099962a04541021c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7c709b14135a1c77814a526a2b460a97

SHA1
547bd68514a32a612c7c98e5324a35ea5b39d7a2

SHA256
ef9d2108ad41aa1480db4b633bcf66c964b5d8d8aab6f3372143242affd948d4

SHA512
baeb04f10ec0383f15ed5cfdf3242b69cbe3f166872012e5b85e83ca95e276623f62a923accc615394fd4058abe61809645f2cdaa0fafee099962a04541021c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
2KB

MD5
ef1492c083146aa85ec95b607e781551

SHA1
de1931540eabd9c57ad963da066d04a1f9c82da0

SHA256
99c7ca9fdc2617e8437c42776516e013198dcb9941f67fca266ced43c7a5b305

SHA512
cf8cf71b7d3fe22340dcda360e4659db4511b52b20001bb7a331b60282622d377af34e6a87621b277a935aa72e642db2665cc2d61efda2fe4caf57153a8235db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.21\Mu\Advertising

Filesize
24KB

MD5
4e9962558e74db5038d8073a5b3431aa

SHA1
3cd097d9dd4b16a69efbb0fd1efe862867822146

SHA256
6f81212bd841eca89aa6f291818b4ad2582d7cdb4e488adea98261494bdcd279

SHA512
fcd76bca998afc517c87de0db6ee54e45aa2263fa7b91653ac3adb34c41f3681fbe19d673ae9b24fdf3d53f5af4e4968e603a1eb557207f8860ac51372026b2e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.21\Mu\Analytics

Filesize
4KB

MD5
fad197d6ffd32d1268b9e7e8d13ab32a

SHA1
b0129887a75965bb2ef56a2c39d3231e5b87265d

SHA256
4e446af739e1a06b48a73607e9441bc4aa34ceafd808ff845864408179a4d2c3

SHA512
01d9f588bfa315e316ff0ff4a15a0a49144fd77ee89960882cd528d7f7a277b086667cea2357c3ca2bd16a2b3f4aeb7fcaf473501b499101be68acbe1e0126cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.21\Mu\Content

Filesize
6KB

MD5
94c183b842784d0ae69f8aa57c8ac015

SHA1
c5b1ebc2b5c140ccbb21cd377ca18f3c5d0b80cd

SHA256
aa5c4d50684aa478d5982e509cbf1f8347fbc9cc75cb847d54915c16c3a33d25

SHA512
5808ddb81657acf4712fa845c95aacbab32a414ffda3b9d1218637e2d53bd3e0d6b95c872779ead6eaa13b4d2d563494ad5587337958bd17f1e791fad5d822fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.21\Mu\Cryptomining

Filesize
1KB

MD5
8c31feb9c3faaa9794aa22ce9f48bfbd

SHA1
f5411608a15e803afc97961b310bb21a6a8bd5b6

SHA256
6016fd3685046b33c7a2b1e785ac757df20e7c760abe0c27e1b8b0294222421d

SHA512
ba4b5886c04ba8f7a7dbb87e96d639783a5969a245de181cf620b8f536e3ac95bbd910cd2f1f6aae6c3cd70fc1ef6209dc10d2b083ec51861b51d83f95811baa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.21\Mu\Entities

Filesize
68KB

MD5
0d37c9d98f35f2c6524bd9b874ec93ed

SHA1
87d2d1149db8a1c2d91bc8d2d6e2827d2d8850f5

SHA256
19ce05d2716fae5d0d6e2067a7a624c0fa7f8b02486d9469861fd30cf1c499ac

SHA512
68e73804a144cbe7287c2136ab1986c4e2a97c497d5bfd36ef5db0f1fb1b4a28839d63d83019082ce61af9b42853934888ce05d6b28350742776b97fa310a575

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.21\Mu\Fingerprinting

Filesize
1KB

MD5
b51076d21461e00fcbf3dbd2c9e96b2b

SHA1
31311536cf570f2f9c88d21f03a935ac6e233231

SHA256
21a8d3e85d76761a1aab9dca765efef5dfa08d49db037befd91833e4639dd993

SHA512
3e193220ddddc47ecea32a2f777e55faa12c7a8052323455c8d7a89c01048155c77ae009fd0f5bebea89f1fae4a88b6b3ceca4e808064f474ea5b3a9497598cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.21\Mu\Other

Filesize
34B

MD5
cd0395742b85e2b669eaec1d5f15b65b

SHA1
43c81d1c62fc7ff94f9364639c9a46a0747d122e

SHA256
2b4a47b82cbe70e34407c7df126a24007aff8b45d5716db384d27cc1f3b30707

SHA512
4df2ce734e2f7bc5f02bb7845ea801b57dcf649565dd94b1b71f578b453ba0a17c61ccee73e7cff8f23cdd6aa37e55be5cb15f4767ff88a9a06de3623604fbf0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.21\Mu\Social

Filesize
999B

MD5
152b745da17397ed5a2f3059bb157600

SHA1
47bf4e575ba1acf47dcc99f1800f753b4cc65ef6

SHA256
ef994058a637f7b1b47c31c8670977084d1f86cc21a196920aa87f8ed31e98e8

SHA512
4984a8a46eb452b3c62f2c2ca8c9d999de37c39895ad9a9ed91d12a7731b1cd227f335829f7a6927f19cd8bf4dd7d6749fc853461a46fc97853d5b9e23171d31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.21\Sigma\Advertising

Filesize
459B

MD5
d024831cae8599f0edee70275d99e843

SHA1
69e08b543802b130da5305cbb0140bda5601079c

SHA256
0b75817b9ce2164f52e537c66bbff0fe53024bf9a00fb193efd63fe48f34a978

SHA512
ee1096446f6a17bc3fde9aadb418ca4b2db5132cdde1e429300487aaf4d8b9865a3bbc95d3a3198cde137a6395f69c035b74a72f74edc22a490bccc3320b0b03

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.21\Sigma\Analytics

Filesize
50B

MD5
4cefbb980962973a354915a49d1b0f4d

SHA1
1d20148cab5cdadb85fad6041262584a12c2745d

SHA256
66de8db363de02974a1471153112e51f014bb05936ce870c433fd9a85b34455a

SHA512
6a088bbc6c40454165ddee3183667d2997dca5fcc8312f69e3c2397e61255e49b5146b24c2c64cd3c8867289e3abfdf1155e47722fdd8276f96d51e8f311d4b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.21\Sigma\Content

Filesize
36B

MD5
7f077f40c2d1ce8e95faa8fdb23ed8b4

SHA1
2c329e3e20ea559974ddcaabc2c7c22de81e7ad2

SHA256
bda08f8b53c121bbc03da1f5c870c016b06fa620a2c02375988555dd12889cdf

SHA512
c1fb5d40491ae22a155a9bd115c32cbe9dbcba615545af2f1a252475f9d59844763cd7c177f08277d8ef59e873b7d885fda17f2a504d9ec2c181d0f793cb542b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.21\Sigma\Cryptomining

Filesize
32B

MD5
4ec1eda0e8a06238ff5bf88569964d59

SHA1
a2e78944fcac34d89385487ccbbfa4d8f078d612

SHA256
696e930706b5d391eb8778f73b0627ffc2be7f6c9a3e7659170d9d37fc4a97b5

SHA512
c9b1ed7b61f26d94d7f5eded2d42d40f3e4300eee2319fe28e04b25cdb6dd92daf67828bff453bf5fc8d7b6ceb58cab319fc0daac9b0050e27a89efe74d2734e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.21\Sigma\Fingerprinting

Filesize
110B

MD5
a004023825237dadc8f934758ff9eaf2

SHA1
c981a900b5ce63884635cedfe5ba722416021cb2

SHA256
3c4e82aae615a7bed985b4544afecb774b728df1cc9f7561ea25b97482119ef7

SHA512
e49667fca51a6497ccae9b881d679b857c025f2945ab93c9a6769b1c0a632329993daefab6eda9ed70a32a75630d7b3d93dda5acda8ff87ffe5f090ca7b35e4f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.21\Sigma\Other

Filesize
75B

MD5
c6c7f3ee1e17acbff6ac22aa89b02e4e

SHA1
bdbd0220e54b80b3d2ffbbddadc89bfbb8e64a8b

SHA256
a2f9f27d6938a74979d34484bced535412969c2533dc694bfa667fe81d66d7d4

SHA512
86ed28ffdd00b4a397a20968792fcd30dd4a891a187a7789c00c88b64689b334a11fa087eb54ccee813c181cf891b43184dde7af9a6f33caed2a71e2c445a7b4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.21\Sigma\Social

Filesize
35B

MD5
976b1cf7e3442f88cd8ba26d3f0965bb

SHA1
b75438dc71de4ac761d94a215ddbffadcd1225b0

SHA256
decde67630f29fc003cb1f2ccbd7371a05079985a9cce93ec93c4fadd8dc5541

SHA512
d0472fed72e1eb0a7747a693a0e654fbe92dd028db3cc42377810d90474dd4099ac981cca333eb52c18e75ed04a1f1f79f3bf5957fe8b16086f1252b3454b8d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.21\Sigma\Staging

Filesize
519B

MD5
9ca5eb41a53645be63d247ad8a9a7869

SHA1
2e98b04b5a2efb04d20bc7fe51b05c4e4841205b

SHA256
f67c58a61ddef715b01debc66ddc0e3c365295ac9870328f6b8bdbcb02a6b8c9

SHA512
7dd7d295ccce957490f025eef124b22c809f140a96003126b801bbbdd94eb2115ee59e7d16dd1f020b1d6eaaff66853b9de2cbf7092c1692f40dbe21ab346fd8

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartUp\bitsadmin.lnk

Filesize
1KB

MD5
d404c20aa696a2523b971878f564bafd

SHA1
2a5092d1268d5a1a3ec598860f8dbcd9babccfa9

SHA256
7400bf65daaa42a40b4affff9146855916cb4601158dd240630c136336b9c413

SHA512
448ad8ff67a8d2fd9ed11d5f3f189e288e1c42a5b97e42618c3bbe4edc5acc98cba75140446c268d7043cdfa2b3b3d5ca6d1bce6e272ce059d6c0bb2875627dc

Download Submit
C:\Users\Admin\AppData\Roaming\{8F96F56F-5268-382E-17C0-CEDE4D5A91E2}\bitsadmin.exe

Filesize
382KB

MD5
41dd108ada487cb93a6e099e074f605b

SHA1
354f9fcee3214078d2bc5e3ea55c6b678c2fe2bf

SHA256
aebce4939ad8d8df9d1807debb140669e47a24c71b7978249362d3b0900c33f3

SHA512
33adb352e06e779871224ce094954756f15e49785fc14f8c8a02476b420b00907961d3489944c2da42fa84e8185f0f6bc7eefde58ebc4ae213fed9bfa1b5932b

Download Submit
C:\Users\Admin\AppData\Roaming\{8F96F56F-5268-382E-17C0-CEDE4D5A91E2}\bitsadmin.exe

Filesize
382KB

MD5
41dd108ada487cb93a6e099e074f605b

SHA1
354f9fcee3214078d2bc5e3ea55c6b678c2fe2bf

SHA256
aebce4939ad8d8df9d1807debb140669e47a24c71b7978249362d3b0900c33f3

SHA512
33adb352e06e779871224ce094954756f15e49785fc14f8c8a02476b420b00907961d3489944c2da42fa84e8185f0f6bc7eefde58ebc4ae213fed9bfa1b5932b

Download Submit
C:\Users\Admin\AppData\Roaming\{8F96F56F-5268-382E-17C0-CEDE4D5A91E2}\bitsadmin.exe

Filesize
382KB

MD5
41dd108ada487cb93a6e099e074f605b

SHA1
354f9fcee3214078d2bc5e3ea55c6b678c2fe2bf

SHA256
aebce4939ad8d8df9d1807debb140669e47a24c71b7978249362d3b0900c33f3

SHA512
33adb352e06e779871224ce094954756f15e49785fc14f8c8a02476b420b00907961d3489944c2da42fa84e8185f0f6bc7eefde58ebc4ae213fed9bfa1b5932b

Download Submit
C:\Users\Admin\AppData\Roaming\{8F96F56F-5268-382E-17C0-CEDE4D5A91E2}\bitsadmin.exe

Filesize
382KB

MD5
41dd108ada487cb93a6e099e074f605b

SHA1
354f9fcee3214078d2bc5e3ea55c6b678c2fe2bf

SHA256
aebce4939ad8d8df9d1807debb140669e47a24c71b7978249362d3b0900c33f3

SHA512
33adb352e06e779871224ce094954756f15e49785fc14f8c8a02476b420b00907961d3489944c2da42fa84e8185f0f6bc7eefde58ebc4ae213fed9bfa1b5932b

Download Submit
C:\Users\Admin\AppData\Roaming\{8F96F56F-5268-382E-17C0-CEDE4D5A91E2}\bitsadmin.exe

Filesize
382KB

MD5
41dd108ada487cb93a6e099e074f605b

SHA1
354f9fcee3214078d2bc5e3ea55c6b678c2fe2bf

SHA256
aebce4939ad8d8df9d1807debb140669e47a24c71b7978249362d3b0900c33f3

SHA512
33adb352e06e779871224ce094954756f15e49785fc14f8c8a02476b420b00907961d3489944c2da42fa84e8185f0f6bc7eefde58ebc4ae213fed9bfa1b5932b

Download Submit
C:\Users\Admin\AppData\Roaming\{8F96F56F-5268-382E-17C0-CEDE4D5A91E2}\bitsadmin.exe

Filesize
382KB

MD5
41dd108ada487cb93a6e099e074f605b

SHA1
354f9fcee3214078d2bc5e3ea55c6b678c2fe2bf

SHA256
aebce4939ad8d8df9d1807debb140669e47a24c71b7978249362d3b0900c33f3

SHA512
33adb352e06e779871224ce094954756f15e49785fc14f8c8a02476b420b00907961d3489944c2da42fa84e8185f0f6bc7eefde58ebc4ae213fed9bfa1b5932b

Download Submit
C:\Users\Admin\AppData\Roaming\{8F96F56F-5268-382E-17C0-CEDE4D5A91E2}\bitsadmin.exe

Filesize
382KB

MD5
41dd108ada487cb93a6e099e074f605b

SHA1
354f9fcee3214078d2bc5e3ea55c6b678c2fe2bf

SHA256
aebce4939ad8d8df9d1807debb140669e47a24c71b7978249362d3b0900c33f3

SHA512
33adb352e06e779871224ce094954756f15e49785fc14f8c8a02476b420b00907961d3489944c2da42fa84e8185f0f6bc7eefde58ebc4ae213fed9bfa1b5932b

Download Submit
C:\Users\Admin\AppData\Roaming\{8F96F56F-5268-382E-17C0-CEDE4D5A91E2}\bitsadmin.exe

Filesize
382KB

MD5
41dd108ada487cb93a6e099e074f605b

SHA1
354f9fcee3214078d2bc5e3ea55c6b678c2fe2bf

SHA256
aebce4939ad8d8df9d1807debb140669e47a24c71b7978249362d3b0900c33f3

SHA512
33adb352e06e779871224ce094954756f15e49785fc14f8c8a02476b420b00907961d3489944c2da42fa84e8185f0f6bc7eefde58ebc4ae213fed9bfa1b5932b

Download Submit
C:\Users\Admin\AppData\Roaming\{8F96F56F-5268-382E-17C0-CEDE4D5A91E2}\bitsadmin.exe

Filesize
382KB

MD5
41dd108ada487cb93a6e099e074f605b

SHA1
354f9fcee3214078d2bc5e3ea55c6b678c2fe2bf

SHA256
aebce4939ad8d8df9d1807debb140669e47a24c71b7978249362d3b0900c33f3

SHA512
33adb352e06e779871224ce094954756f15e49785fc14f8c8a02476b420b00907961d3489944c2da42fa84e8185f0f6bc7eefde58ebc4ae213fed9bfa1b5932b

Download Submit
C:\Users\Admin\AppData\Roaming\{8F96F56F-5268-382E-17C0-CEDE4D5A91E2}\bitsadmin.exe

Filesize
382KB

MD5
41dd108ada487cb93a6e099e074f605b

SHA1
354f9fcee3214078d2bc5e3ea55c6b678c2fe2bf

SHA256
aebce4939ad8d8df9d1807debb140669e47a24c71b7978249362d3b0900c33f3

SHA512
33adb352e06e779871224ce094954756f15e49785fc14f8c8a02476b420b00907961d3489944c2da42fa84e8185f0f6bc7eefde58ebc4ae213fed9bfa1b5932b

Download Submit
C:\Users\Admin\AppData\Roaming\{8F96F56F-5268-382E-17C0-CEDE4D5A91E2}\bitsadmin.exe

Filesize
382KB

MD5
41dd108ada487cb93a6e099e074f605b

SHA1
354f9fcee3214078d2bc5e3ea55c6b678c2fe2bf

SHA256
aebce4939ad8d8df9d1807debb140669e47a24c71b7978249362d3b0900c33f3

SHA512
33adb352e06e779871224ce094954756f15e49785fc14f8c8a02476b420b00907961d3489944c2da42fa84e8185f0f6bc7eefde58ebc4ae213fed9bfa1b5932b

Download Submit
C:\Users\Admin\Desktop\# DECRYPT MY FILES #.html

Filesize
12KB

MD5
90c9098e2eb5062c38d773ed36e0a45d

SHA1
75452e3e075afed8ce58cf1437cba9c82e3e0500

SHA256
26de924c9e2a7e4625b2d9d354bf9792b7c2929b4ab0def88f60ba6e8b7bb498

SHA512
e540eaa97e9eaf393eeaa31ef4990d55256c048ea96a3245298a42eb01d10d1fb791e7f17b31d3d6fe35c553c59dcd08e8d5c0efc3179c6b4abff138a15d836d

Download Submit
C:\Users\Admin\Desktop\# DECRYPT MY FILES #.txt

Filesize
10KB

MD5
1688527450637fc2493851e18b60063d

SHA1
61c8b4417984a6d72376b9f3dd0660a15745a0f6

SHA256
454ab36679a39e0caab39204e73d646f5234c21abcba0b4598d3e6e8a7bf3694

SHA512
6d9d4dac4028d960127ec4288f02a3e2dbd8ac124f6f913f241a2305b6a09f5dc8303d6047db63135400ea40e1697249d7124809a67548a30ad64b195aa1dd9e

Download Submit
C:\Users\Admin\Desktop\# DECRYPT MY FILES #.vbs

Filesize
231B

MD5
9d8c4bfbd009c4d6001e2125abaa8b02

SHA1
cd040558172b5fca5b200447a281843956243741

SHA256
a652297987f14317100f8c5f7eb26d1bc67eb8a64f0b39b72b5fd5046a9f29b0

SHA512
c4c84f43642b805a105acce9ebc9f01aa0e6ef553ea32be3f8b890fc7440f0b7d3ddf99b9336bce20ce7a3d9b9f6434a704651a8af425ffc8407ba39d5de735f

Download Submit
memory/244-148-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/400-125-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/400-124-0x0000000003DE0000-0x0000000003E01000-memory.dmp

Filesize
132KB

Download
memory/1280-132-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/1520-142-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2488-140-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/3596-138-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4724-136-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4792-146-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4868-169-0x00007FFA66ED0000-0x00007FFA66ED1000-memory.dmp

Filesize
4KB

Download
memory/4896-150-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4936-182-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/5096-144-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download