hxxp://we[.]tl/t-dIsTXRtNmc

Resubmissions

17/10/2022, 08:54

221017-ktx6kabbg8 8

17/10/2022, 08:29

17/10/2022, 08:08

17/10/2022, 05:56

16/10/2022, 16:18

Analysis

max time kernel
297s
max time network
323s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
17/10/2022, 08:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://we.tl/t-dIsTXRtNmc

Score

8^/10

persistence ransomware

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 7 IoCs

pid	Process
3556	slam ransomware builder installer 3.exe
3524	slam ransomware builder installer 3.exe
724	start.exe
4876	slam.exe
3224	MSBuild.exe
2036	MSBuild.exe
1812	test.exe

Modifies extensions of user files 10 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

description	ioc	Process
File created	C:\Users\Admin\Pictures\MergeFind.crw.SLAM	test.exe
File created	C:\Users\Admin\Pictures\OpenLimit.raw.SLAM	test.exe
File created	C:\Users\Admin\Pictures\PushAdd.raw.SLAM	test.exe
File created	C:\Users\Admin\Pictures\PushEnter.crw.SLAM	test.exe
File created	C:\Users\Admin\Pictures\ConfirmSkip.tif.SLAM	test.exe
File created	C:\Users\Admin\Pictures\JoinFind.tif.SLAM	test.exe
File created	C:\Users\Admin\Pictures\JoinRevoke.crw.SLAM	test.exe
File created	C:\Users\Admin\Pictures\JoinSync.crw.SLAM	test.exe
File created	C:\Users\Admin\Pictures\RenameReset.crw.SLAM	test.exe
File created	C:\Users\Admin\Pictures\ResizeUndo.raw.SLAM	test.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	slam ransomware builder installer 3.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	start.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	test.exe

Loads dropped DLL 8 IoCs

pid	Process
4876	slam.exe
4876	slam.exe
4876	slam.exe
4876	slam.exe
3224	MSBuild.exe
3224	MSBuild.exe
2036	MSBuild.exe
2036	MSBuild.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run	msedge.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\6ee01dff-7f37-428b-bdac-e362f878362f.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20221017085455.pma	setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2020	1312	WerFault.exe	14

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Kills process with taskkill 43 IoCs

evasion

pid	Process
64	taskkill.exe
3380	taskkill.exe
4724	taskkill.exe
1848	taskkill.exe
5144	taskkill.exe
4076	taskkill.exe
1504	taskkill.exe
1664	taskkill.exe
1772	taskkill.exe
2124	taskkill.exe
1724	taskkill.exe
5548	taskkill.exe
4460	taskkill.exe
5136	taskkill.exe
3612	taskkill.exe
1972	taskkill.exe
2356	taskkill.exe
876	taskkill.exe
4912	taskkill.exe
3784	taskkill.exe
2228	taskkill.exe
4628	taskkill.exe
5040	taskkill.exe
764	taskkill.exe
872	taskkill.exe
3056	taskkill.exe
4980	taskkill.exe
4004	taskkill.exe
3208	taskkill.exe
460	taskkill.exe
3504	taskkill.exe
4184	taskkill.exe
5692	taskkill.exe
1928	taskkill.exe
1336	taskkill.exe
5080	taskkill.exe
4440	taskkill.exe
3680	taskkill.exe
4204	taskkill.exe
2596	taskkill.exe
5700	taskkill.exe
5556	taskkill.exe
4192	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 13 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{4C32BAAC-4DF9-11ED-A0EE-E289BC6C3020} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe

Modifies registry class 35 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0 = 7800310000000000515541471000534c414d5f527e310000600009000400efbe51552047515541472e0000009f310200000004000000000000000000000000000000b5e4820073006c0061006d005f00720061006e0073006f006d0077006100720065005f006200750069006c00640065007200000018000000	slam.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	slam.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	slam.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	slam.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	slam.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 0100000000000000ffffffff	slam.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0	slam.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	slam.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1	slam.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3	slam.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	slam.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	slam.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	slam.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	slam.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	slam.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg	slam.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1 = 19002f433a5c000000000000000000000000000000000000000000	slam.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\MRUListEx = 00000000ffffffff	slam.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	slam.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	slam.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	slam.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	slam.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	slam.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	slam.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	slam.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\NodeSlot = "3"	slam.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	slam.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	slam.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	slam.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\MRUListEx = ffffffff	slam.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	slam.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell	slam.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\SniffedFolderType = "Generic"	slam.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	slam.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 345758.crdownload:SmartScreen	msedge.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
2104	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2220	msedge.exe
2220	msedge.exe
640	msedge.exe
640	msedge.exe
5132	identity_helper.exe
5132	identity_helper.exe
5308	msedge.exe
5308	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3556	slam ransomware builder installer 3.exe
3556	slam ransomware builder installer 3.exe
3556	slam ransomware builder installer 3.exe
3556	slam ransomware builder installer 3.exe
3556	slam ransomware builder installer 3.exe
3556	slam ransomware builder installer 3.exe
3556	slam ransomware builder installer 3.exe
3556	slam ransomware builder installer 3.exe
3556	slam ransomware builder installer 3.exe
3556	slam ransomware builder installer 3.exe
3556	slam ransomware builder installer 3.exe
3556	slam ransomware builder installer 3.exe
3556	slam ransomware builder installer 3.exe
3556	slam ransomware builder installer 3.exe
3556	slam ransomware builder installer 3.exe
3556	slam ransomware builder installer 3.exe
3556	slam ransomware builder installer 3.exe
3556	slam ransomware builder installer 3.exe
3556	slam ransomware builder installer 3.exe
3556	slam ransomware builder installer 3.exe
3556	slam ransomware builder installer 3.exe
3556	slam ransomware builder installer 3.exe
3556	slam ransomware builder installer 3.exe
3556	slam ransomware builder installer 3.exe
3556	slam ransomware builder installer 3.exe
3556	slam ransomware builder installer 3.exe
3556	slam ransomware builder installer 3.exe
3556	slam ransomware builder installer 3.exe
3556	slam ransomware builder installer 3.exe
3556	slam ransomware builder installer 3.exe
3556	slam ransomware builder installer 3.exe
3556	slam ransomware builder installer 3.exe
3556	slam ransomware builder installer 3.exe
3556	slam ransomware builder installer 3.exe
3556	slam ransomware builder installer 3.exe
3556	slam ransomware builder installer 3.exe
3556	slam ransomware builder installer 3.exe
3556	slam ransomware builder installer 3.exe
3556	slam ransomware builder installer 3.exe
3556	slam ransomware builder installer 3.exe
3556	slam ransomware builder installer 3.exe
3556	slam ransomware builder installer 3.exe
3556	slam ransomware builder installer 3.exe
3556	slam ransomware builder installer 3.exe
3556	slam ransomware builder installer 3.exe
3556	slam ransomware builder installer 3.exe
3556	slam ransomware builder installer 3.exe
3556	slam ransomware builder installer 3.exe
3556	slam ransomware builder installer 3.exe
3556	slam ransomware builder installer 3.exe
3556	slam ransomware builder installer 3.exe
3556	slam ransomware builder installer 3.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe

Suspicious use of AdjustPrivilegeToken 45 IoCs

description	pid	Process
Token: SeDebugPrivilege	3556	slam ransomware builder installer 3.exe
Token: SeDebugPrivilege	3524	slam ransomware builder installer 3.exe
Token: SeDebugPrivilege	1972	taskkill.exe
Token: SeDebugPrivilege	1812	test.exe
Token: SeDebugPrivilege	3208	taskkill.exe
Token: SeDebugPrivilege	64	taskkill.exe
Token: SeDebugPrivilege	1504	taskkill.exe
Token: SeDebugPrivilege	3380	taskkill.exe
Token: SeDebugPrivilege	2356	taskkill.exe
Token: SeDebugPrivilege	4628	taskkill.exe
Token: SeDebugPrivilege	4440	taskkill.exe
Token: SeDebugPrivilege	3680	taskkill.exe
Token: SeDebugPrivilege	4204	taskkill.exe
Token: SeDebugPrivilege	460	taskkill.exe
Token: SeDebugPrivilege	5040	taskkill.exe
Token: SeDebugPrivilege	3504	taskkill.exe
Token: SeDebugPrivilege	1664	taskkill.exe
Token: SeDebugPrivilege	4724	taskkill.exe
Token: SeDebugPrivilege	2596	taskkill.exe
Token: SeDebugPrivilege	1848	taskkill.exe
Token: SeDebugPrivilege	4184	taskkill.exe
Token: SeDebugPrivilege	5144	taskkill.exe
Token: SeDebugPrivilege	1772	taskkill.exe
Token: SeDebugPrivilege	876	taskkill.exe
Token: SeDebugPrivilege	5548	taskkill.exe
Token: SeDebugPrivilege	2124	taskkill.exe
Token: SeDebugPrivilege	4912	taskkill.exe
Token: SeDebugPrivilege	4460	taskkill.exe
Token: SeDebugPrivilege	764	taskkill.exe
Token: SeDebugPrivilege	5136	taskkill.exe
Token: SeDebugPrivilege	5700	taskkill.exe
Token: SeDebugPrivilege	5556	taskkill.exe
Token: SeDebugPrivilege	1336	taskkill.exe
Token: SeDebugPrivilege	5692	taskkill.exe
Token: SeDebugPrivilege	872	taskkill.exe
Token: SeDebugPrivilege	3784	taskkill.exe
Token: SeDebugPrivilege	1724	taskkill.exe
Token: SeDebugPrivilege	3612	taskkill.exe
Token: SeDebugPrivilege	3056	taskkill.exe
Token: SeDebugPrivilege	1928	taskkill.exe
Token: SeDebugPrivilege	4076	taskkill.exe
Token: SeDebugPrivilege	2228	taskkill.exe
Token: SeDebugPrivilege	4004	taskkill.exe
Token: SeDebugPrivilege	4980	taskkill.exe
Token: SeDebugPrivilege	4192	taskkill.exe

Suspicious use of FindShellTrayWindow 52 IoCs

pid	Process
4192	iexplore.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
4192	iexplore.exe
4192	iexplore.exe
1848	IEXPLORE.EXE
1848	IEXPLORE.EXE
4876	slam.exe
4876	slam.exe
4876	slam.exe
4876	slam.exe
4876	slam.exe
4876	slam.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4192 wrote to memory of 1848	4192	iexplore.exe	83
PID 4192 wrote to memory of 1848	4192	iexplore.exe	83
PID 4192 wrote to memory of 1848	4192	iexplore.exe	83
PID 640 wrote to memory of 2504	640	msedge.exe	86
PID 640 wrote to memory of 2504	640	msedge.exe	86
PID 640 wrote to memory of 3016	640	msedge.exe	88
PID 640 wrote to memory of 3016	640	msedge.exe	88
PID 640 wrote to memory of 3016	640	msedge.exe	88
PID 640 wrote to memory of 3016	640	msedge.exe	88
PID 640 wrote to memory of 3016	640	msedge.exe	88
PID 640 wrote to memory of 3016	640	msedge.exe	88
PID 640 wrote to memory of 3016	640	msedge.exe	88
PID 640 wrote to memory of 3016	640	msedge.exe	88
PID 640 wrote to memory of 3016	640	msedge.exe	88
PID 640 wrote to memory of 3016	640	msedge.exe	88
PID 640 wrote to memory of 3016	640	msedge.exe	88
PID 640 wrote to memory of 3016	640	msedge.exe	88
PID 640 wrote to memory of 3016	640	msedge.exe	88
PID 640 wrote to memory of 3016	640	msedge.exe	88
PID 640 wrote to memory of 3016	640	msedge.exe	88
PID 640 wrote to memory of 3016	640	msedge.exe	88
PID 640 wrote to memory of 3016	640	msedge.exe	88
PID 640 wrote to memory of 3016	640	msedge.exe	88
PID 640 wrote to memory of 3016	640	msedge.exe	88
PID 640 wrote to memory of 3016	640	msedge.exe	88
PID 640 wrote to memory of 3016	640	msedge.exe	88
PID 640 wrote to memory of 3016	640	msedge.exe	88
PID 640 wrote to memory of 3016	640	msedge.exe	88
PID 640 wrote to memory of 3016	640	msedge.exe	88
PID 640 wrote to memory of 3016	640	msedge.exe	88
PID 640 wrote to memory of 3016	640	msedge.exe	88
PID 640 wrote to memory of 3016	640	msedge.exe	88
PID 640 wrote to memory of 3016	640	msedge.exe	88
PID 640 wrote to memory of 3016	640	msedge.exe	88
PID 640 wrote to memory of 3016	640	msedge.exe	88
PID 640 wrote to memory of 3016	640	msedge.exe	88
PID 640 wrote to memory of 3016	640	msedge.exe	88
PID 640 wrote to memory of 3016	640	msedge.exe	88
PID 640 wrote to memory of 3016	640	msedge.exe	88
PID 640 wrote to memory of 3016	640	msedge.exe	88
PID 640 wrote to memory of 3016	640	msedge.exe	88
PID 640 wrote to memory of 3016	640	msedge.exe	88
PID 640 wrote to memory of 3016	640	msedge.exe	88
PID 640 wrote to memory of 3016	640	msedge.exe	88
PID 640 wrote to memory of 3016	640	msedge.exe	88
PID 640 wrote to memory of 2220	640	msedge.exe	89
PID 640 wrote to memory of 2220	640	msedge.exe	89
PID 640 wrote to memory of 1052	640	msedge.exe	91
PID 640 wrote to memory of 1052	640	msedge.exe	91
PID 640 wrote to memory of 1052	640	msedge.exe	91
PID 640 wrote to memory of 1052	640	msedge.exe	91
PID 640 wrote to memory of 1052	640	msedge.exe	91
PID 640 wrote to memory of 1052	640	msedge.exe	91
PID 640 wrote to memory of 1052	640	msedge.exe	91
PID 640 wrote to memory of 1052	640	msedge.exe	91
PID 640 wrote to memory of 1052	640	msedge.exe	91
PID 640 wrote to memory of 1052	640	msedge.exe	91
PID 640 wrote to memory of 1052	640	msedge.exe	91
PID 640 wrote to memory of 1052	640	msedge.exe	91
PID 640 wrote to memory of 1052	640	msedge.exe	91
PID 640 wrote to memory of 1052	640	msedge.exe	91
PID 640 wrote to memory of 1052	640	msedge.exe	91
PID 640 wrote to memory of 1052	640	msedge.exe	91
PID 640 wrote to memory of 1052	640	msedge.exe	91

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://we.tl/t-dIsTXRtNmc
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4192
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4192 CREDAT:17410 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1848

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
1⤵
- Adds Run key to start application
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd8,0x104,0x7ffc2de446f8,0x7ffc2de44708,0x7ffc2de44718
  2⤵
  PID:2504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,8033391331387032397,1233202459334472780,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
  2⤵
  PID:3016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,8033391331387032397,1233202459334472780,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,8033391331387032397,1233202459334472780,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2740 /prefetch:8
  2⤵
  PID:1052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,8033391331387032397,1233202459334472780,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3636 /prefetch:1
  2⤵
  PID:5028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,8033391331387032397,1233202459334472780,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4196 /prefetch:1
  2⤵
  PID:2296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,8033391331387032397,1233202459334472780,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4208 /prefetch:1
  2⤵
  PID:4880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2108,8033391331387032397,1233202459334472780,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5408 /prefetch:8
  2⤵
  PID:1468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2108,8033391331387032397,1233202459334472780,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4184 /prefetch:8
  2⤵
  PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,8033391331387032397,1233202459334472780,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3536 /prefetch:1
  2⤵
  PID:3420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,8033391331387032397,1233202459334472780,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6512 /prefetch:1
  2⤵
  PID:1356
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,8033391331387032397,1233202459334472780,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3860 /prefetch:8
  2⤵
  PID:4324
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
  2⤵
  - Drops file in Program Files directory
  PID:4440
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ff63b2f5460,0x7ff63b2f5470,0x7ff63b2f5480
    3⤵
    PID:3232
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,8033391331387032397,1233202459334472780,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3860 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2108,8033391331387032397,1233202459334472780,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=2616 /prefetch:8
  2⤵
  PID:5460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,8033391331387032397,1233202459334472780,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2840 /prefetch:1
  2⤵
  PID:5536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,8033391331387032397,1233202459334472780,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6716 /prefetch:1
  2⤵
  PID:5620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,8033391331387032397,1233202459334472780,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6532 /prefetch:1
  2⤵
  PID:5704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,8033391331387032397,1233202459334472780,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6632 /prefetch:1
  2⤵
  PID:5720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,8033391331387032397,1233202459334472780,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6600 /prefetch:1
  2⤵
  PID:5788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,8033391331387032397,1233202459334472780,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6004 /prefetch:1
  2⤵
  PID:5860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,8033391331387032397,1233202459334472780,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6772 /prefetch:1
  2⤵
  PID:5928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,8033391331387032397,1233202459334472780,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7112 /prefetch:1
  2⤵
  PID:6080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2108,8033391331387032397,1233202459334472780,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4124 /prefetch:8
  2⤵
  PID:5140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2108,8033391331387032397,1233202459334472780,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=8152 /prefetch:8
  2⤵
  PID:4368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,8033391331387032397,1233202459334472780,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5264 /prefetch:1
  2⤵
  PID:2296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2108,8033391331387032397,1233202459334472780,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=8068 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2108,8033391331387032397,1233202459334472780,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=8180 /prefetch:8
  2⤵
  PID:2236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,8033391331387032397,1233202459334472780,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1820 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2108,8033391331387032397,1233202459334472780,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4076 /prefetch:8
  2⤵
  PID:4228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2108,8033391331387032397,1233202459334472780,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5720 /prefetch:8
  2⤵
  PID:5932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2108,8033391331387032397,1233202459334472780,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2208 /prefetch:8
  2⤵
  PID:6064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2108,8033391331387032397,1233202459334472780,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1072 /prefetch:8
  2⤵
  PID:5636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2108,8033391331387032397,1233202459334472780,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5240 /prefetch:8
  2⤵
  PID:1944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2108,8033391331387032397,1233202459334472780,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4408 /prefetch:8
  2⤵
  PID:876

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4320

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 456 -p 1312 -ip 1312
1⤵
PID:1964

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1312 -s 2460
1⤵
- Program crash
PID:2020

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:904

C:\Users\Admin\Downloads\slam ransomware builder installer 3.exe
"C:\Users\Admin\Downloads\slam ransomware builder installer 3.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3556

C:\Users\Admin\Downloads\slam ransomware builder installer 3.exe
"C:\Users\Admin\Downloads\slam ransomware builder installer 3.exe"
1⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
PID:3524
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c cd C:\Users\Admin\Desktop & del /Q /F slam_ransomware_builder.url & taskkill /F /IM slam.exe & exit
  2⤵
  PID:5544
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM slam.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1972
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c cd C:\Users\Admin\Desktop & del /Q /F slam_ransomware_builder.url & exit
  2⤵
  PID:1924
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c start C:\slam_ransomware_builder\start.exe & exit
  2⤵
  PID:4632
- - C:\slam_ransomware_builder\start.exe
    C:\slam_ransomware_builder\start.exe
    3⤵
    - Executes dropped EXE
    - Checks computer location settings
    PID:724
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\35AC.tmp\start.bat" C:\slam_ransomware_builder\start.exe"
      4⤵
      PID:4080
    - - C:\slam_ransomware_builder\slam.exe
        
        slam.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        Suspicious use of SetWindowsHookEx
        
        PID:4876
      - C:\Windows\SysWOW64\cmd.exe
        
        "cmd" /c MSBuild.exe ConsoleApp2\ConsoleApp2.sln
        6⤵
        
        PID:936
        
        C:\slam_ransomware_builder\MSBuild.exe
        
        MSBuild.exe ConsoleApp2\ConsoleApp2.sln
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:3224
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\Csc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Csc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\tmp521ccbc794f94fc6a857306d16b1d74e.rsp"
        8⤵
        
        PID:5128
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5ED.tmp" "c:\slam_ransomware_builder\ConsoleApp2\ConsoleApp2\obj\Debug\CSC7C25D649A0714B71B510C92A887BB5D7.TMP"
        9⤵
        
        PID:2000
      - C:\Windows\SysWOW64\cmd.exe
        
        "cmd" /c C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /out:Decrypter.exe src.cs /win32manifest:App.config
        6⤵
        
        PID:1804
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /out:Decrypter.exe src.cs /win32manifest:App.config
        7⤵
        
        PID:5700
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA33.tmp" "c:\slam_ransomware_builder\CSCE58CE8C2F5CA4BC0BD84F4129FC5EE26.TMP"
        8⤵
        
        PID:4868
      - C:\Windows\SysWOW64\cmd.exe
        
        "cmd" /c MSBuild.exe ConsoleApp2\ConsoleApp2.sln
        6⤵
        
        PID:5096
        
        C:\slam_ransomware_builder\MSBuild.exe
        
        MSBuild.exe ConsoleApp2\ConsoleApp2.sln
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2036
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\Csc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Csc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\tmp42becbe421c24b19929ec224959718b5.rsp"
        8⤵
        
        PID:1732
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES590E.tmp" "c:\slam_ransomware_builder\ConsoleApp2\ConsoleApp2\obj\Debug\CSC700A5373B47849E8B0BC3ED7ED7A53B4.TMP"
        9⤵
        
        PID:3988
      - C:\Windows\SysWOW64\cmd.exe
        
        "cmd" /c C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /out:Decrypter.exe src.cs /win32manifest:App.config
        6⤵
        
        PID:4548
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /out:Decrypter.exe src.cs /win32manifest:App.config
        7⤵
        
        PID:5172
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5BAE.tmp" "c:\slam_ransomware_builder\CSC195EB92C6A8B42C0BC17A435681759B1.TMP"
        8⤵
        
        PID:5164

C:\slam_ransomware_builder\test.exe
"C:\slam_ransomware_builder\test.exe"
1⤵
- Executes dropped EXE
- Modifies extensions of user files
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
PID:1812
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c taskkill /F /IM BackupExecAgentBrowser* & taskkill /F /IM BackupExecDiveciMediaService* & taskkill /F /IM BackupExecJobEngine* & taskkill /F /IM BackupExecManagementService* & taskkill /F /IM vss* & taskkill /F /IM sql* & taskkill /F /IM svc$* & taskkill /F /IM memtas* & taskkill /F /IM sophos* & taskkill /F /IM veeam* & taskkill /F /IM backup* & taskkill /F /IM GxVss* & taskkill /F /IM GxBlr* & taskkill /F /IM GxFWD* & taskkill /F /IM GxCVD* & taskkill /F /IM GxCIMgr* & taskkill /F /IM DefWatch* & taskkill /F /IM ccEvtMgr* & taskkill /F /IM SavRoam* & taskkill /F /IM RTVscan* & taskkill /F /IM QBFCService* & taskkill /F /IM Intuit.QuickBooks.FCS* & taskkill /F /IM YooBackup* & taskkill /F /IM YooIT* & taskkill /F /IM zhudongfangyu* & taskkill /F /IM sophos* & taskkill /F /IM stc_raw_agent* & taskkill /F /IM VSNAPVSS* & taskkill /F /IM QBCFMonitorService* & taskkill /F /IM VeeamTransportSvc* & taskkill /F /IM VeeamDeploymentService* & taskkill /F /IM VeeamNFSSvc* & taskkill /F /IM veeam* & taskkill /F /IM PDVFSService* & taskkill /F /IM BackupExecVSSProvider* & taskkill /F /IM BackupExecAgentAccelerator* & taskkill /F /IM BackupExecRPCService* & taskkill /F /IM AcrSch2Svc* & taskkill /F /IM AcronisAgent* & taskkill /F /IM CASAD2DWebSvc* & taskkill /F /IM CAARCUpdateSvc* & taskkill /F /IM TeamViewer*
  2⤵
  PID:1924
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM BackupExecAgentBrowser*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3208
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM BackupExecDiveciMediaService*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:64
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM BackupExecJobEngine*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1504
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM BackupExecManagementService*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3380
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM vss*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2356
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM sql*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4628
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM svc$*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4440
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM memtas*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3680
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM sophos*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4204
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM veeam*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:460
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM backup*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5040
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM GxVss*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3504
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM GxBlr*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1664
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM GxFWD*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4724
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM GxCVD*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2596
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM GxCIMgr*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1848
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM DefWatch*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4184
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM ccEvtMgr*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5144
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM SavRoam*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1772
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM RTVscan*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:876
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM QBFCService*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5548
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM Intuit.QuickBooks.FCS*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2124
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM YooBackup*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4912
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM YooIT*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4460
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM zhudongfangyu*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:764
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM sophos*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5136
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM stc_raw_agent*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5700
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM VSNAPVSS*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5556
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM QBCFMonitorService*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1336
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM VeeamTransportSvc*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5692
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM VeeamDeploymentService*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:872
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM VeeamNFSSvc*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3784
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM veeam*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1724
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM PDVFSService*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3612
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM BackupExecVSSProvider*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3056
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM BackupExecAgentAccelerator*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1928
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM BackupExecRPCService*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4076
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM AcrSch2Svc*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2228
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM AcronisAgent*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4004
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM CASAD2DWebSvc*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4980
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM CAARCUpdateSvc*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4192
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM TeamViewer*
    3⤵
    - Kills process with taskkill
    PID:5080
- C:\Windows\SysWOW64\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\README.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:2104

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\75CA58072B9926F763A91F0CC2798706_93E4B2BA79A897B3100CCB27F2D3BF4F

Filesize
1KB

MD5
d35cb93ad78a7e29785d4eb5fc25ab0e

SHA1
d1c0a3b38708b84a4198989ec13f086bfb79bb56

SHA256
7a16d6bd9ec044e74c7327462bd175518d199fe8fd2fe7d69ded48b6c707366c

SHA512
2148ec93a665e1a899ae1ee79b01968195e4c62378afd7feb519fe53944e9f18e466e89841cb9ee33231ad3f47ff933584732222fbe97bb928e497e7a7139cd8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7D6243C18F0F8F9AEC6638DD210F1984_FD4F3AB5065583C0DC5D6551E486247B

Filesize
471B

MD5
9d0d86b3c55d84e4eeb79db7eb51dbe9

SHA1
becc572560f027b77a2e8d7c68c5a2f26b3df24c

SHA256
2257c1309e27d56b6a389438958c2c220f4611eca403946273af43adda90d25e

SHA512
2183c044adfa85a0124b587eb59968881cf0c4b01a462077e3bbe36d8cd13d3ee4d708be617d770783def8d3a4dad04128e0426a6c3fb3fd9bb16cd2cfd10783

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62

Filesize
1KB

MD5
d59a05ba9c5285f503985b3b3cb8c7b9

SHA1
b0e1468c2510508f4c4f258b7af5b2d389d02b1c

SHA256
0166287ab72cc9f6e35c7c0d5488a8bb5fcf150052ac087f1720d00f56bbc085

SHA512
ca1c1b6acb5ffd191109a57c8537f61baef343bd87298dab440e91a7cd6e7a3ba3322dcf5b79247ae9c47780c8331889a68734d8a1e31282ed887d661dd4ae4c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894

Filesize
1KB

MD5
cffb3bb22aad98d90d0869f156630add

SHA1
7be59bbb4a70a606da964bd3af2d96e1f5b68c3d

SHA256
3d7dafcc27fe8333df20bd4398ea56b592eceea8e126298fba1ad86caacb9ea6

SHA512
401c6dab268fdecfea5fa5f5a4d9c562cc1944f32098ef152d211376846f24176606454ba3e79516aa8b02bbb1b8bbd7757510d32f530942c455a5ee6e31f23b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\75CA58072B9926F763A91F0CC2798706_93E4B2BA79A897B3100CCB27F2D3BF4F

Filesize
442B

MD5
5f2a8ff7bbb6039581431aa9f52a9db1

SHA1
97899f19fdfff45d6abec9918bd54dfdff185d09

SHA256
ba16e4108627c9dc294f1cced91c6a3e6de5ed046e0e3de22e3183fc91645c08

SHA512
df03c7d14bfc6e7c3c6254ebbb59476ca972f49dde5626813bb81c523bdaab276685534a145abf82a8f244e78f12ce42c4f0e49221ed88312ecfebddaf87b181

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7D6243C18F0F8F9AEC6638DD210F1984_FD4F3AB5065583C0DC5D6551E486247B

Filesize
444B

MD5
c2871af896e41cdb2ae8973fa545331d

SHA1
cf57d2fc69e81a9ed47fab1666945939e30717ce

SHA256
aed2712d6a09471dc9bd75c0e5d41477fee704085f9aad4c18044b8a3671a7d0

SHA512
75158cc36763e13a43804e067cb849f51382c5221655dd8226e3a7ae8432e1ae8fab4f7ffd358ca767ddf88f0c121ae71a4008ba2c3a4422a674900bf97048a0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62

Filesize
458B

MD5
e335ae23c32ad7a55414ec0d61f4c426

SHA1
3501785bf532394ef05bfaf969c9927889256d18

SHA256
fd3aee063cba2b39886697edb50becbc1c133b6f0fc46a78a7e4ecbfaa387a74

SHA512
26bbedf752710c3e7afffc412cc0fd7609193e168a4b9b9b969433907847ac2cd6461ed51d48e2d4959e4be53af20e365f84fceaa71fb1bfb42eeb2bce5c545e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894

Filesize
432B

MD5
6c1303964deb06dd22113777379a0286

SHA1
35f4a95b9040d6d657b6ec0e8773099fbaf39e8c

SHA256
ebe32c897aaed7967baeb7218d90dd5695f934957f5f2915d2a7063ce741e17e

SHA512
130f9827fe7d1ec662060a1630861a5a425d963ce1aa30b34ff83b552350d5800c45940d08fecc8c6df7692daa37ea4f80c43100b4ef45f7756b341024cafbcb

Download Submit
C:\Users\Admin\AppData\Local\Temp\35AC.tmp\start.bat

Filesize
96B

MD5
2615bf9ed6d2e854c0602ef8fdd787df

SHA1
4e0682a961ee43b9ddce5b3c03c83945d7d0cc40

SHA256
a33ee4de5292cb00e1833b85a5dc530240bb5f23ee64a56ae7fa23ae4aabc493

SHA512
24ec09d91c3d8d93c7dd595dad8eefd00de24759e039bc4dfc6967291ee54ef2a65b693b02143352a8a7c0e83b372d77389059811927b18f52472ead1332fb8c

Download Submit
C:\Users\Admin\Downloads\slam ransomware builder installer 3.exe

Filesize
39.2MB

MD5
ae8b3404772d75962e2d614f32655835

SHA1
2806778ab74ac435d0c811a65787bbec62c219f1

SHA256
372117893c8ce82e0d74275d59902007d4f637781e4d6a68c6c4bcab0dd25641

SHA512
6ffd9ce3a35c369c089edb9ff2d4c82d4a2dc322b2634d941126ab974b975c741844a5f6b602e9a260beeba6efe53b51d4aa8278633b3a19461011b912e528c6

Download Submit
C:\Users\Admin\Downloads\slam ransomware builder installer 3.exe

Filesize
39.2MB

MD5
ae8b3404772d75962e2d614f32655835

SHA1
2806778ab74ac435d0c811a65787bbec62c219f1

SHA256
372117893c8ce82e0d74275d59902007d4f637781e4d6a68c6c4bcab0dd25641

SHA512
6ffd9ce3a35c369c089edb9ff2d4c82d4a2dc322b2634d941126ab974b975c741844a5f6b602e9a260beeba6efe53b51d4aa8278633b3a19461011b912e528c6

Download Submit
C:\Users\Admin\Downloads\slam ransomware builder installer 3.exe

Filesize
39.2MB

MD5
ae8b3404772d75962e2d614f32655835

SHA1
2806778ab74ac435d0c811a65787bbec62c219f1

SHA256
372117893c8ce82e0d74275d59902007d4f637781e4d6a68c6c4bcab0dd25641

SHA512
6ffd9ce3a35c369c089edb9ff2d4c82d4a2dc322b2634d941126ab974b975c741844a5f6b602e9a260beeba6efe53b51d4aa8278633b3a19461011b912e528c6

Download Submit
C:\slam_ransomware_builder\ConsoleApp2\ConsoleApp2\1.ico

Filesize
66KB

MD5
889e8ff9455bb4837f91ff644dcf2b82

SHA1
6bc850368a6444885e59d368ab5774cedb6792e2

SHA256
56ee941f7f4fcf1e050be3544ad73cfe7a061f288a3af4960632b0fcced94d51

SHA512
771af6b48883b408d45c952380ede6ab466efb776360af6bda5c0530332876d62b127803e4e4cef7e68dc64f829603cb939dbdc2d8cafe3d08dc954b796f2fa4

Download Submit
C:\slam_ransomware_builder\ConsoleApp2\ConsoleApp2\Properties\AssemblyInfo.cs

Filesize
569B

MD5
6ae5c2395170e2d6d29d4f1e95e676e6

SHA1
533905ab44c6c68b58212f62202549646e23f2f6

SHA256
c12e04bcf0c4bd14dcbb50cc96416c77080ffc4bac7fb784d462ee6d6d163d6f

SHA512
492b0f4e8d4783194438f6be9d432bc008b7d72a31dbaf9aca5714e276ee13f8310408f379f165ec4ac63eb59404899c772f471a48a785ad8fd79c1cd9bfc80e

Download Submit
C:\slam_ransomware_builder\ConsoleApp2\ConsoleApp2\Resources\wallpaper.jpg.SLAM

Filesize
122KB

MD5
d877f5dd07829e98e34655aea09979c3

SHA1
d0a0a784450ca4611edd213d12e0681b9fee301d

SHA256
668745d41f7e5107c7b934193158e910974a9f158b745d1f5a37509dd288a664

SHA512
5c6404273ece76dc0819abe17caf57a62b24f33eb8ce90bbf3aebac7cb3ac250982abff7c3e268d37c4cdb199758be4df62ae88a3a79d9c80c59b3d14abc68c4

Download Submit
C:\slam_ransomware_builder\ConsoleApp2\ConsoleApp2\obj\Debug\.NETFramework,Version=v4.7.2.AssemblyAttributes.cs

Filesize
214B

MD5
896ab120ac6b6af2895fdb71c452b9d3

SHA1
eb545ccd7a1bafcdf31ad0f32c09ac505744aa39

SHA256
621199557e90fb1661e401cc9a973163c850b4b7e65bbc8d100f67f6699eef70

SHA512
834f53444444cee5c348da44674a2b8e6ce51f21a7565a23629001a5c535533c78a4dff8663176d982bab24f0dd272868cfc5c2fadeccc9b97a14f6946766dee

Download Submit
C:\slam_ransomware_builder\ConsoleApp2\ConsoleApp2\obj\Debug\ConsoleApp2.csproj.AssemblyReference.cache

Filesize
9KB

MD5
f95571aba36661a497553a04bd470ce0

SHA1
10a7917eb303c620b9bbfd549eb20dfc1516932c

SHA256
202f72d03579fbf9f65535a0299078f1e56355ac1bd82f7a49eb83429599c0ba

SHA512
758e3eddbacec89f4c6bebdeb0754cc18f414885740992187d49d47ca07f30318eaccc0a6e3d4625afe580b2877d37c9e2768af92065bcc288c0d72cc46f37b4

Download Submit
C:\slam_ransomware_builder\ConsoleApp2\ConsoleApp2\obj\Debug\DesignTimeResolveAssemblyReferencesInput.cache

Filesize
8KB

MD5
73b6fc93329bc76c8769664f37a38713

SHA1
826735c744989d0f03d733ccbb6f1c0944be1eea

SHA256
7da3e39b3f6a792f6dc37dfb2f678b7c603ba0ba520bee73e7011b14117c1806

SHA512
a2e3884c992acace66264958e8aefc55b1d1f504fe30627881db6573a9254bce971164b83144c0ff92e11bfe1ff41ce62ad0a695f9ccaa9eb6952f27b96a2644

Download Submit
C:\slam_ransomware_builder\FastColoredTextBox.dll

Filesize
325KB

MD5
adac0cee5cc4de7d4046ae1243e41bf0

SHA1
c8d6d92f0dbee64d0f4c0930f0d2699a8253e891

SHA256
68d0e444c0b27552d2cb86501dcb7db3fd64b82d966e9708db0408ec1ba38c79

SHA512
1d7af604540532a4121850760b1e401bb6356e59503c26f3d1fa358a105b7d88362c92f78aa4394095b165f06c484b8c2d2ed640380e85ef9b3eb087d3e7c869

Download Submit
C:\slam_ransomware_builder\FastColoredTextBox.dll

Filesize
325KB

MD5
adac0cee5cc4de7d4046ae1243e41bf0

SHA1
c8d6d92f0dbee64d0f4c0930f0d2699a8253e891

SHA256
68d0e444c0b27552d2cb86501dcb7db3fd64b82d966e9708db0408ec1ba38c79

SHA512
1d7af604540532a4121850760b1e401bb6356e59503c26f3d1fa358a105b7d88362c92f78aa4394095b165f06c484b8c2d2ed640380e85ef9b3eb087d3e7c869

Download Submit
C:\slam_ransomware_builder\FastColoredTextBox.dll

Filesize
325KB

MD5
adac0cee5cc4de7d4046ae1243e41bf0

SHA1
c8d6d92f0dbee64d0f4c0930f0d2699a8253e891

SHA256
68d0e444c0b27552d2cb86501dcb7db3fd64b82d966e9708db0408ec1ba38c79

SHA512
1d7af604540532a4121850760b1e401bb6356e59503c26f3d1fa358a105b7d88362c92f78aa4394095b165f06c484b8c2d2ed640380e85ef9b3eb087d3e7c869

Download Submit
C:\slam_ransomware_builder\Figgle.dll

Filesize
473KB

MD5
7c89d3e9baf0648fb767a70e0eacc35c

SHA1
6558308ec9d4be79b001c03030401c0e3c9701bc

SHA256
ba6a8965961f80013100f0aa804565edfec035b141cc4484a60b658a1b858dd9

SHA512
00b62dea3d4b4dd60ef307121acf1357e418b3de69b85b8ccb0f74dbb28c357a8dd410020ef325dba5c8bab8c2eac41234686a8e4fdee24063734f3f860ee7d2

Download Submit
C:\slam_ransomware_builder\Figgle.dll

Filesize
473KB

MD5
7c89d3e9baf0648fb767a70e0eacc35c

SHA1
6558308ec9d4be79b001c03030401c0e3c9701bc

SHA256
ba6a8965961f80013100f0aa804565edfec035b141cc4484a60b658a1b858dd9

SHA512
00b62dea3d4b4dd60ef307121acf1357e418b3de69b85b8ccb0f74dbb28c357a8dd410020ef325dba5c8bab8c2eac41234686a8e4fdee24063734f3f860ee7d2

Download Submit
C:\slam_ransomware_builder\Figgle.dll

Filesize
473KB

MD5
7c89d3e9baf0648fb767a70e0eacc35c

SHA1
6558308ec9d4be79b001c03030401c0e3c9701bc

SHA256
ba6a8965961f80013100f0aa804565edfec035b141cc4484a60b658a1b858dd9

SHA512
00b62dea3d4b4dd60ef307121acf1357e418b3de69b85b8ccb0f74dbb28c357a8dd410020ef325dba5c8bab8c2eac41234686a8e4fdee24063734f3f860ee7d2

Download Submit
C:\slam_ransomware_builder\MSBuild.exe

Filesize
256KB

MD5
8fdf47e0ff70c40ed3a17014aeea4232

SHA1
e6256a0159688f0560b015da4d967f41cbf8c9bd

SHA256
ed9884bac608c06b7057037cc91d90e4ae5f74dd2dbce2af476699c6d4492d82

SHA512
bd69d092ed4f9c5e1f24eaf5ec79fb316469d53849dc798fae0fcba5e90869b77ee924c23cc6f692198ff25827ab60ad47bb46cadd6e0aadde7731cbafb013be

Download Submit
C:\slam_ransomware_builder\MSBuild.exe

Filesize
256KB

MD5
8fdf47e0ff70c40ed3a17014aeea4232

SHA1
e6256a0159688f0560b015da4d967f41cbf8c9bd

SHA256
ed9884bac608c06b7057037cc91d90e4ae5f74dd2dbce2af476699c6d4492d82

SHA512
bd69d092ed4f9c5e1f24eaf5ec79fb316469d53849dc798fae0fcba5e90869b77ee924c23cc6f692198ff25827ab60ad47bb46cadd6e0aadde7731cbafb013be

Download Submit
C:\slam_ransomware_builder\fonts\big.flf

Filesize
28KB

MD5
53d797b00ba6bb56ba3c804afedabc2f

SHA1
9cccecd73d7767aef0f83ebbe8efb097cde612e2

SHA256
931beae4b5b7a6a0fff63a6a0b80a974f94bd7e723a3a506bebb45095dc384a1

SHA512
aa7d91210e653d807898fe385e018353e4602666171c77b5f2c12e7b5aaf98f62809401c0165372dd7b41a80c6f1f13df6072c245b6b2340a30215425c0c5d32

Download Submit
C:\slam_ransomware_builder\slam ransomware builder.exe

Filesize
1.6MB

MD5
cfbebe8d5a9d23a64371946878bbb2bf

SHA1
ac78104cc89850233e01d956c414b351123879e3

SHA256
68d2aec44cfd1e6092be775da6dd2625de56e30c8781ee072cf8076ca37b1f4c

SHA512
9d7ce8fc508557c3df848e10c56d7ab005280a733f0b882f15d53fc3055958f7f01c0f42758868acaaa3a64f1791934b60cf64bd6aea3dd2b581e283ea72e679

Download Submit
C:\slam_ransomware_builder\slam.exe

Filesize
1.6MB

MD5
cfbebe8d5a9d23a64371946878bbb2bf

SHA1
ac78104cc89850233e01d956c414b351123879e3

SHA256
68d2aec44cfd1e6092be775da6dd2625de56e30c8781ee072cf8076ca37b1f4c

SHA512
9d7ce8fc508557c3df848e10c56d7ab005280a733f0b882f15d53fc3055958f7f01c0f42758868acaaa3a64f1791934b60cf64bd6aea3dd2b581e283ea72e679

Download Submit
C:\slam_ransomware_builder\start.exe

Filesize
46KB

MD5
f7b1a64333ab633f980b702723fb7cba

SHA1
e7e04a69a84c5a9e7d0901eb00face35457a0df1

SHA256
e7bde6768de9a7a1b1028d7fa52548f8c074b7355820b7a1cb2d4c2c082512d2

SHA512
666d09200f0bc1762903fcfb748335d1fec27cf2cd9723a91d2ad870468b94236ad7c15ed453446accc415f0be5d40f006d57695204fd7fa30c676a8e6d2ecad

Download Submit
C:\slam_ransomware_builder\start.exe

Filesize
46KB

MD5
f7b1a64333ab633f980b702723fb7cba

SHA1
e7e04a69a84c5a9e7d0901eb00face35457a0df1

SHA256
e7bde6768de9a7a1b1028d7fa52548f8c074b7355820b7a1cb2d4c2c082512d2

SHA512
666d09200f0bc1762903fcfb748335d1fec27cf2cd9723a91d2ad870468b94236ad7c15ed453446accc415f0be5d40f006d57695204fd7fa30c676a8e6d2ecad

Download Submit
C:\slam_ransomware_builder\uac\ConsoleApp2\1.ico

Filesize
66KB

MD5
889e8ff9455bb4837f91ff644dcf2b82

SHA1
6bc850368a6444885e59d368ab5774cedb6792e2

SHA256
56ee941f7f4fcf1e050be3544ad73cfe7a061f288a3af4960632b0fcced94d51

SHA512
771af6b48883b408d45c952380ede6ab466efb776360af6bda5c0530332876d62b127803e4e4cef7e68dc64f829603cb939dbdc2d8cafe3d08dc954b796f2fa4

Download Submit
C:\slam_ransomware_builder\uac\ConsoleApp2\Properties\AssemblyInfo.cs

Filesize
556B

MD5
a08e9477bcf35558054417f16a5f5617

SHA1
5853ada9553643a039b1b56324f0c95226179c44

SHA256
7ef40c0cf01ec60f42ace3924716f5ccef0f5eea84bd8f9006016ddbfcdf36d2

SHA512
2f7950f9462fb26dfbd133311f2c0403929eef6c75abe416d55ca8e88dceaef15021e294c3ea683d221ae22ba7acac33c63d80d441adf28fa8ffd67a577b11b2

Download Submit
C:\slam_ransomware_builder\wallpaper.jpg.SLAM

Filesize
122KB

MD5
f83cd0592ef46ff26c4b81f3ebbeec1c

SHA1
9a99d054675e7fa659188e1057a271b4b59c6e78

SHA256
2c070169ac950517fd5e828e309fb0e27ad24cfc94dfbc2c3de5f6a9adbc8d7b

SHA512
6c3576a275fb7da04c982682999ebaed346af757e88f2b5d12cc1ecaf3bb9639a458a2e207f69d5fa04dd03272e831d1c07e0a7c46beb28c2a51ef93425b2df9

Download Submit
memory/1812-284-0x0000000000B80000-0x0000000000C6A000-memory.dmp

Filesize
936KB

Download
memory/3224-255-0x00000000066E0000-0x0000000006790000-memory.dmp

Filesize
704KB

Download
memory/3224-254-0x0000000006B90000-0x00000000070FC000-memory.dmp

Filesize
5.4MB

Download
memory/3224-246-0x0000000000F30000-0x0000000000F70000-memory.dmp

Filesize
256KB

Download
memory/3224-247-0x0000000001950000-0x000000000196A000-memory.dmp

Filesize
104KB

Download
memory/3224-248-0x0000000005A10000-0x0000000005B6A000-memory.dmp

Filesize
1.4MB

Download
memory/3224-266-0x00000000068F0000-0x0000000006A6C000-memory.dmp

Filesize
1.5MB

Download
memory/3224-265-0x0000000006A00000-0x0000000006C86000-memory.dmp

Filesize
2.5MB

Download
memory/3224-264-0x0000000005F70000-0x0000000005FA0000-memory.dmp

Filesize
192KB

Download
memory/3224-249-0x00000000057F0000-0x0000000005820000-memory.dmp

Filesize
192KB

Download
memory/3224-262-0x0000000006F9C000-0x000000000719E000-memory.dmp

Filesize
2.0MB

Download
memory/3224-260-0x0000000006770000-0x00000000067E6000-memory.dmp

Filesize
472KB

Download
memory/3224-252-0x0000000006490000-0x00000000065B2000-memory.dmp

Filesize
1.1MB

Download
memory/3224-259-0x0000000005F60000-0x0000000005F72000-memory.dmp

Filesize
72KB

Download
memory/3224-258-0x0000000005F70000-0x0000000005F98000-memory.dmp

Filesize
160KB

Download
memory/3224-257-0x0000000006AE0000-0x0000000006E46000-memory.dmp

Filesize
3.4MB

Download
memory/3224-256-0x0000000006C30000-0x000000000722E000-memory.dmp

Filesize
6.0MB

Download
memory/3224-253-0x00000000063D0000-0x0000000006414000-memory.dmp

Filesize
272KB

Download
memory/3524-201-0x000000000B950000-0x000000000B95A000-memory.dmp

Filesize
40KB

Download
memory/3524-204-0x000000000C520000-0x000000000C532000-memory.dmp

Filesize
72KB

Download
memory/3556-195-0x0000000008660000-0x0000000008C04000-memory.dmp

Filesize
5.6MB

Download
memory/3556-196-0x0000000008150000-0x00000000081E2000-memory.dmp

Filesize
584KB

Download
memory/3556-194-0x0000000000F90000-0x00000000036D4000-memory.dmp

Filesize
39.3MB

Download
memory/3556-197-0x0000000005C40000-0x0000000005C4A000-memory.dmp

Filesize
40KB

Download
memory/4876-231-0x0000000009D80000-0x0000000009DD8000-memory.dmp

Filesize
352KB

Download
memory/4876-219-0x0000000009700000-0x0000000009766000-memory.dmp

Filesize
408KB

Download
memory/4876-217-0x0000000000B60000-0x0000000000D00000-memory.dmp

Filesize
1.6MB

Download
memory/4876-237-0x000000000A690000-0x000000000A70C000-memory.dmp

Filesize
496KB

Download
memory/4876-218-0x0000000008DB0000-0x0000000008E4C000-memory.dmp

Filesize
624KB

Download