Malware Analysis Report

2024-09-11 01:36

Sample ID 230228-egpe1ahd72
Target 4d118d83c3192a771479d6e392d62a109aea4ca8dce81a0c6c0fe50329b15147
SHA256 4d118d83c3192a771479d6e392d62a109aea4ca8dce81a0c6c0fe50329b15147
Tags
quantum ransomware
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

4d118d83c3192a771479d6e392d62a109aea4ca8dce81a0c6c0fe50329b15147

Threat Level: Known bad

The file 4d118d83c3192a771479d6e392d62a109aea4ca8dce81a0c6c0fe50329b15147 was found to be: Known bad.

Malicious Activity Summary

quantum ransomware

Quantum Ransomware

Modifies extensions of user files

Deletes itself

Drops desktop.ini file(s)

Drops file in Program Files directory

Suspicious behavior: EnumeratesProcesses

Suspicious use of SetWindowsHookEx

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious use of FindShellTrayWindow

Modifies registry class

Suspicious use of WriteProcessMemory

Views/modifies file attributes

Modifies Internet Explorer settings

Suspicious use of AdjustPrivilegeToken

Suspicious use of SendNotifyMessage

Enumerates system info in registry

MITRE ATT&CK Matrix V6

Initial Access
TA0001
Execution
TA0002
Persistence
TA0003
Hidden Files and Directories
T1158
Privilege Escalation
TA0004
Defense Evasion
TA0005
Modify Registry
T1112
Hidden Files and Directories
T1158
Credential Access
TA0006
Discovery
TA0007
Query Registry
T1012
System Information Discovery
T1082
Lateral Movement
TA0008
Collection
TA0009
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040

Analysis: static1

Detonation Overview

Reported

2023-02-28 03:54

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-02-28 03:54

Reported

2023-02-28 03:57

Platform

win7-20230220-en

Max time kernel

145s

Max time network

142s

Command Line

"C:\Users\Admin\AppData\Local\Temp\4d118d83c3192a771479d6e392d62a109aea4ca8dce81a0c6c0fe50329b15147.exe"

Signatures

Quantum Ransomware

ransomware quantum

Modifies extensions of user files

ransomware
Description Indicator Process Target
File renamed C:\Users\Admin\Pictures\ImportDismount.crw => \??\c:\Users\Admin\Pictures\ImportDismount.crw.quantum C:\Users\Admin\AppData\Local\Temp\4d118d83c3192a771479d6e392d62a109aea4ca8dce81a0c6c0fe50329b15147.exe N/A
File opened for modification \??\c:\Users\Admin\Pictures\SearchResume.tiff C:\Users\Admin\AppData\Local\Temp\4d118d83c3192a771479d6e392d62a109aea4ca8dce81a0c6c0fe50329b15147.exe N/A
File renamed C:\Users\Admin\Pictures\StopSync.png => \??\c:\Users\Admin\Pictures\StopSync.png.quantum C:\Users\Admin\AppData\Local\Temp\4d118d83c3192a771479d6e392d62a109aea4ca8dce81a0c6c0fe50329b15147.exe N/A
File renamed C:\Users\Admin\Pictures\SuspendAdd.png => \??\c:\Users\Admin\Pictures\SuspendAdd.png.quantum C:\Users\Admin\AppData\Local\Temp\4d118d83c3192a771479d6e392d62a109aea4ca8dce81a0c6c0fe50329b15147.exe N/A
File renamed C:\Users\Admin\Pictures\SuspendTrace.tiff => \??\c:\Users\Admin\Pictures\SuspendTrace.tiff.quantum C:\Users\Admin\AppData\Local\Temp\4d118d83c3192a771479d6e392d62a109aea4ca8dce81a0c6c0fe50329b15147.exe N/A
File renamed C:\Users\Admin\Pictures\UnregisterWait.raw => \??\c:\Users\Admin\Pictures\UnregisterWait.raw.quantum C:\Users\Admin\AppData\Local\Temp\4d118d83c3192a771479d6e392d62a109aea4ca8dce81a0c6c0fe50329b15147.exe N/A
File renamed C:\Users\Admin\Pictures\CompareApprove.crw => \??\c:\Users\Admin\Pictures\CompareApprove.crw.quantum C:\Users\Admin\AppData\Local\Temp\4d118d83c3192a771479d6e392d62a109aea4ca8dce81a0c6c0fe50329b15147.exe N/A
File opened for modification \??\c:\Users\Admin\Pictures\SuspendTrace.tiff C:\Users\Admin\AppData\Local\Temp\4d118d83c3192a771479d6e392d62a109aea4ca8dce81a0c6c0fe50329b15147.exe N/A
File renamed C:\Users\Admin\Pictures\UseExport.tif => \??\c:\Users\Admin\Pictures\UseExport.tif.quantum C:\Users\Admin\AppData\Local\Temp\4d118d83c3192a771479d6e392d62a109aea4ca8dce81a0c6c0fe50329b15147.exe N/A
File renamed C:\Users\Admin\Pictures\SearchResume.tiff => \??\c:\Users\Admin\Pictures\SearchResume.tiff.quantum C:\Users\Admin\AppData\Local\Temp\4d118d83c3192a771479d6e392d62a109aea4ca8dce81a0c6c0fe50329b15147.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\system32\cmd.exe N/A

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification \??\c:\Users\Public\Desktop\desktop.ini C:\Users\Admin\AppData\Local\Temp\4d118d83c3192a771479d6e392d62a109aea4ca8dce81a0c6c0fe50329b15147.exe N/A
File opened for modification \??\c:\Users\Public\Downloads\desktop.ini C:\Users\Admin\AppData\Local\Temp\4d118d83c3192a771479d6e392d62a109aea4ca8dce81a0c6c0fe50329b15147.exe N/A
File opened for modification \??\c:\Users\Public\Libraries\desktop.ini C:\Users\Admin\AppData\Local\Temp\4d118d83c3192a771479d6e392d62a109aea4ca8dce81a0c6c0fe50329b15147.exe N/A
File opened for modification \??\c:\Users\Public\Pictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\4d118d83c3192a771479d6e392d62a109aea4ca8dce81a0c6c0fe50329b15147.exe N/A
File opened for modification \??\c:\Users\Public\Videos\Sample Videos\desktop.ini C:\Users\Admin\AppData\Local\Temp\4d118d83c3192a771479d6e392d62a109aea4ca8dce81a0c6c0fe50329b15147.exe N/A
File opened for modification \??\c:\Users\Admin\Contacts\desktop.ini C:\Users\Admin\AppData\Local\Temp\4d118d83c3192a771479d6e392d62a109aea4ca8dce81a0c6c0fe50329b15147.exe N/A
File opened for modification \??\c:\Users\Admin\Pictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\4d118d83c3192a771479d6e392d62a109aea4ca8dce81a0c6c0fe50329b15147.exe N/A
File opened for modification \??\c:\Users\Admin\Favorites\Links\desktop.ini C:\Users\Admin\AppData\Local\Temp\4d118d83c3192a771479d6e392d62a109aea4ca8dce81a0c6c0fe50329b15147.exe N/A
File opened for modification \??\c:\Users\Admin\Videos\desktop.ini C:\Users\Admin\AppData\Local\Temp\4d118d83c3192a771479d6e392d62a109aea4ca8dce81a0c6c0fe50329b15147.exe N/A
File opened for modification \??\c:\Users\Public\desktop.ini C:\Users\Admin\AppData\Local\Temp\4d118d83c3192a771479d6e392d62a109aea4ca8dce81a0c6c0fe50329b15147.exe N/A
File opened for modification \??\c:\Users\Public\Documents\desktop.ini C:\Users\Admin\AppData\Local\Temp\4d118d83c3192a771479d6e392d62a109aea4ca8dce81a0c6c0fe50329b15147.exe N/A
File opened for modification \??\c:\Users\Public\Music\desktop.ini C:\Users\Admin\AppData\Local\Temp\4d118d83c3192a771479d6e392d62a109aea4ca8dce81a0c6c0fe50329b15147.exe N/A
File opened for modification \??\c:\Users\Public\Music\Sample Music\desktop.ini C:\Users\Admin\AppData\Local\Temp\4d118d83c3192a771479d6e392d62a109aea4ca8dce81a0c6c0fe50329b15147.exe N/A
File opened for modification \??\c:\Users\Public\Videos\desktop.ini C:\Users\Admin\AppData\Local\Temp\4d118d83c3192a771479d6e392d62a109aea4ca8dce81a0c6c0fe50329b15147.exe N/A
File opened for modification \??\c:\Users\Admin\Favorites\Links for United States\desktop.ini C:\Users\Admin\AppData\Local\Temp\4d118d83c3192a771479d6e392d62a109aea4ca8dce81a0c6c0fe50329b15147.exe N/A
File opened for modification \??\c:\Users\Admin\Music\desktop.ini C:\Users\Admin\AppData\Local\Temp\4d118d83c3192a771479d6e392d62a109aea4ca8dce81a0c6c0fe50329b15147.exe N/A
File opened for modification \??\c:\Users\Admin\Downloads\desktop.ini C:\Users\Admin\AppData\Local\Temp\4d118d83c3192a771479d6e392d62a109aea4ca8dce81a0c6c0fe50329b15147.exe N/A
File opened for modification \??\c:\Users\Admin\Favorites\desktop.ini C:\Users\Admin\AppData\Local\Temp\4d118d83c3192a771479d6e392d62a109aea4ca8dce81a0c6c0fe50329b15147.exe N/A
File opened for modification \??\c:\Users\Admin\Links\desktop.ini C:\Users\Admin\AppData\Local\Temp\4d118d83c3192a771479d6e392d62a109aea4ca8dce81a0c6c0fe50329b15147.exe N/A
File opened for modification \??\c:\Users\Admin\Saved Games\desktop.ini C:\Users\Admin\AppData\Local\Temp\4d118d83c3192a771479d6e392d62a109aea4ca8dce81a0c6c0fe50329b15147.exe N/A
File opened for modification \??\c:\Users\Admin\Searches\desktop.ini C:\Users\Admin\AppData\Local\Temp\4d118d83c3192a771479d6e392d62a109aea4ca8dce81a0c6c0fe50329b15147.exe N/A
File opened for modification \??\c:\Users\Public\Pictures\Sample Pictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\4d118d83c3192a771479d6e392d62a109aea4ca8dce81a0c6c0fe50329b15147.exe N/A
File opened for modification \??\c:\Users\Admin\Desktop\desktop.ini C:\Users\Admin\AppData\Local\Temp\4d118d83c3192a771479d6e392d62a109aea4ca8dce81a0c6c0fe50329b15147.exe N/A
File opened for modification \??\c:\Users\Admin\Documents\desktop.ini C:\Users\Admin\AppData\Local\Temp\4d118d83c3192a771479d6e392d62a109aea4ca8dce81a0c6c0fe50329b15147.exe N/A
File opened for modification \??\c:\Users\Public\Recorded TV\desktop.ini C:\Users\Admin\AppData\Local\Temp\4d118d83c3192a771479d6e392d62a109aea4ca8dce81a0c6c0fe50329b15147.exe N/A
File opened for modification \??\c:\Users\Public\Recorded TV\Sample Media\desktop.ini C:\Users\Admin\AppData\Local\Temp\4d118d83c3192a771479d6e392d62a109aea4ca8dce81a0c6c0fe50329b15147.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\SearchScopes C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F3451BD1-B71B-11ED-8FBB-724BB54F6CA2} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_CLASSES\.quantum\shell\Open\command C:\Users\Admin\AppData\Local\Temp\4d118d83c3192a771479d6e392d62a109aea4ca8dce81a0c6c0fe50329b15147.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_CLASSES\.quantum C:\Users\Admin\AppData\Local\Temp\4d118d83c3192a771479d6e392d62a109aea4ca8dce81a0c6c0fe50329b15147.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_CLASSES\.quantum\shell C:\Users\Admin\AppData\Local\Temp\4d118d83c3192a771479d6e392d62a109aea4ca8dce81a0c6c0fe50329b15147.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_CLASSES\.quantum\shell\Open C:\Users\Admin\AppData\Local\Temp\4d118d83c3192a771479d6e392d62a109aea4ca8dce81a0c6c0fe50329b15147.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_CLASSES\.quantum\shell\Open\command\ = "explorer.exe README_TO_DECRYPT.html" C:\Users\Admin\AppData\Local\Temp\4d118d83c3192a771479d6e392d62a109aea4ca8dce81a0c6c0fe50329b15147.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\4d118d83c3192a771479d6e392d62a109aea4ca8dce81a0c6c0fe50329b15147.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4d118d83c3192a771479d6e392d62a109aea4ca8dce81a0c6c0fe50329b15147.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\4d118d83c3192a771479d6e392d62a109aea4ca8dce81a0c6c0fe50329b15147.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4d118d83c3192a771479d6e392d62a109aea4ca8dce81a0c6c0fe50329b15147.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1144 wrote to memory of 1716 N/A C:\Users\Admin\AppData\Local\Temp\4d118d83c3192a771479d6e392d62a109aea4ca8dce81a0c6c0fe50329b15147.exe C:\Windows\system32\cmd.exe
PID 1144 wrote to memory of 1716 N/A C:\Users\Admin\AppData\Local\Temp\4d118d83c3192a771479d6e392d62a109aea4ca8dce81a0c6c0fe50329b15147.exe C:\Windows\system32\cmd.exe
PID 1144 wrote to memory of 1716 N/A C:\Users\Admin\AppData\Local\Temp\4d118d83c3192a771479d6e392d62a109aea4ca8dce81a0c6c0fe50329b15147.exe C:\Windows\system32\cmd.exe
PID 1716 wrote to memory of 1728 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\attrib.exe
PID 1716 wrote to memory of 1728 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\attrib.exe
PID 1716 wrote to memory of 1728 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\attrib.exe
PID 1616 wrote to memory of 1820 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 1616 wrote to memory of 1820 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 1616 wrote to memory of 1820 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 1616 wrote to memory of 1820 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

Views/modifies file attributes

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\attrib.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\4d118d83c3192a771479d6e392d62a109aea4ca8dce81a0c6c0fe50329b15147.exe

"C:\Users\Admin\AppData\Local\Temp\4d118d83c3192a771479d6e392d62a109aea4ca8dce81a0c6c0fe50329b15147.exe"

C:\Windows\system32\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\\006C7B68.bat" "C:\Users\Admin\AppData\Local\Temp\4d118d83c3192a771479d6e392d62a109aea4ca8dce81a0c6c0fe50329b15147.exe""

C:\Windows\system32\attrib.exe

attrib -s -r -h "C:\Users\Admin\AppData\Local\Temp\4d118d83c3192a771479d6e392d62a109aea4ca8dce81a0c6c0fe50329b15147.exe"

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\README_TO_DECRYPT.html

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1616 CREDAT:275457 /prefetch:2

Network

Files

C:\Users\Admin\Desktop\README_TO_DECRYPT.html

MD5 1fe4427237b44360f7706f350d08e22e
SHA1 88423a07f8fff1eff8938577dd9c52ede1e22bfb
SHA256 c61b3e303c643ab5d4438bc9ba6f3f931778e777cf9abb7474411ba204fbcf0c
SHA512 df5cbbcf0492bf96ff0dac324a9eb551cb3fa8a4b80c01b5538daa0ff62e3a7345b8750dfad3b1b1b978a9fbdae12b70149b52e6c3bbf32b0cde654f613fe58c

C:\Users\Admin\AppData\Local\Temp\006C7B68.bat

MD5 348cae913e496198548854f5ff2f6d1e
SHA1 a07655b9020205bd47084afd62a8bb22b48c0cdc
SHA256 c80128f51871eec3ae2057989a025ce244277c1c180498a5aaef45d5214b8506
SHA512 799796736d41d3fcb5a7c859571bb025ca2d062c4b86e078302be68c1a932ed4f78e003640df5405274364b5a9a9c0ba5e37177997683ee7ab54e5267590b611

C:\Users\Admin\AppData\Local\Temp\006C7B68.bat

MD5 348cae913e496198548854f5ff2f6d1e
SHA1 a07655b9020205bd47084afd62a8bb22b48c0cdc
SHA256 c80128f51871eec3ae2057989a025ce244277c1c180498a5aaef45d5214b8506
SHA512 799796736d41d3fcb5a7c859571bb025ca2d062c4b86e078302be68c1a932ed4f78e003640df5405274364b5a9a9c0ba5e37177997683ee7ab54e5267590b611

memory/1616-337-0x00000000022C0000-0x00000000022D0000-memory.dmp

memory/1820-338-0x0000000002D90000-0x0000000002D92000-memory.dmp

C:\Users\Admin\Desktop\README_TO_DECRYPT.html

MD5 1fe4427237b44360f7706f350d08e22e
SHA1 88423a07f8fff1eff8938577dd9c52ede1e22bfb
SHA256 c61b3e303c643ab5d4438bc9ba6f3f931778e777cf9abb7474411ba204fbcf0c
SHA512 df5cbbcf0492bf96ff0dac324a9eb551cb3fa8a4b80c01b5538daa0ff62e3a7345b8750dfad3b1b1b978a9fbdae12b70149b52e6c3bbf32b0cde654f613fe58c

C:\Users\Admin\AppData\Local\Temp\Cab6404.tmp

MD5 fc4666cbca561e864e7fdf883a9e6661
SHA1 2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5
SHA256 10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b
SHA512 c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

C:\Users\Admin\AppData\Local\Temp\Tar6465.tmp

MD5 73b4b714b42fc9a6aaefd0ae59adb009
SHA1 efdaffd5b0ad21913d22001d91bf6c19ecb4ac41
SHA256 c0cf8cc04c34b5b80a2d86ad0eafb2dd71436f070c86b0321fba0201879625fd
SHA512 73af3c51b15f89237552b1718bef21fd80788fa416bab2cb2e7fb3a60d56249a716eda0d2dd68ab643752272640e7eaaaf57ce64bcb38373ddc3d035fb8d57cd

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 c5bd7521043ba95b296fa92132adef82
SHA1 b7e02a44f1303c9f4c20ee86a1811f9a79962743
SHA256 f4949b16f1b2bb134958e5a0611919d720f6faeee42865c4bd975e8e418a251b
SHA512 e755974a3916ad924e8f9fda700b28ab9aaa3c27b1aee69f8b168481bb14fdb04c4e83660a16cbcbc777074c00f21f8885293ba457fb0245cc42ff3f79d860eb

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 d9a2d6895fdca352cc95b2308c8a1f99
SHA1 902970cf18ccbe939fbf611c0e366edefb3c2f29
SHA256 e5ecc0256c2e42837d89b588d538c00f6a27200211e06ad178e48a9759c971b8
SHA512 9e6807144784b3599205e1a2bfbc126f88156c3a6e7defa1cc4d978e936e9cc8a2165ec88c3083e3650e47cb4f6e49270062b0d7f4f0562a21269a62fed8ae4e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 9446dfac35bbc992d7dfd199a8ab947a
SHA1 d7bc86f7e77fe67506bc3372df5d3d1b3fe7a226
SHA256 4da84bb265bd42ac8c85f64d9dba093d8829a2d6af45ff8e37483e5a948ea2de
SHA512 63fc681c51fedde36d8e535fdb8985fb420274868d2ddaa7cf60300aefc806da8a993a41de5204e202c88ef3fc1acc62c2661d889c927b05683721c82899d428

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 38d3b84010c5e432edf32eba2062f0b9
SHA1 cdf6c963f0906304340c64deddc6ad660e0133a8
SHA256 a5e70f7def9b0efe2272d405165fc90e5d5b28dbba8dc17cfff9db3a5d59beee
SHA512 43a519000722cdc8b316e7af954cc7a715af145cdec257c1ff5c13a174915cfc3bd0a8b3022ca4de7a10091bebce3b2a158e3bce980d412bba19c6f5efd26108

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 c8fdbdece886f7a4cc343d41d7b25e22
SHA1 d02973c1280a548970f49c16bfda35736b94d4c7
SHA256 7c5c6f195fe552469bd6e289ede91f042772815f610dafa7e907fb7fb3239af8
SHA512 e382b4eeb3c817f472ddc1cca0be40fc9b7545b07742c47d8c7b703e1dfa7bbaf34e5fd685920f9738d3c29a94f5847cf37e2b97b373fec0e54fe25f3dbe3251

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 8e832e7f60a67094de8d9bfcba6895a8
SHA1 677ae82b57a92f9337fd85c09ff2482b08e4b5a5
SHA256 c794356f0728798ba79d007e10ed79800ec4a43ac5cc6040ac288ee7a2864f91
SHA512 1bdca36a8e3c99fe27858936a69790752c71418019b34287b02a687962b91b468f1c394bb41641a9aab6d11cddd81a9a2acd99810b1e48e6f12f6b2f7822f67a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 d315b4283d99c54caf0ad53e3b3644fd
SHA1 6fa2d517f43f6712554e89dda934027c794f8260
SHA256 bad130ccd52aee0fa426248b26bd9439181fd322eaa1d3a6ed60626d4a9d7f53
SHA512 81855a78ef37b1369b74c932dd6c6ce115153d439041f178167385b81d6681e98b28c140ccb9a91d81ba6149ad4d5c3c9fe9b0d95f9cc39a117e25927eca4bfa

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 99b74285f411279981bb416d6c5b6d2f
SHA1 be51254257b799b3a46aaa66a8ec91f4c4890688
SHA256 39798a57aa5947749dc7557f07e9519f912a2b111d2ccc696c68bfc6e20da10b
SHA512 eb4f413cca01d3c4c2f9243fa340ac86795d46edbb6f6f59a88f5d8fb94eb2c88826b2be74f7ae19c53fb1a20cad57714ebcfdbccbe1e0deb74be2ad9b5844b9

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 99b74285f411279981bb416d6c5b6d2f
SHA1 be51254257b799b3a46aaa66a8ec91f4c4890688
SHA256 39798a57aa5947749dc7557f07e9519f912a2b111d2ccc696c68bfc6e20da10b
SHA512 eb4f413cca01d3c4c2f9243fa340ac86795d46edbb6f6f59a88f5d8fb94eb2c88826b2be74f7ae19c53fb1a20cad57714ebcfdbccbe1e0deb74be2ad9b5844b9

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 33dc730689ab861e05e5d0e4ef90a9c1
SHA1 d5db664ced2be156317ffae708adba19375ebc07
SHA256 f08926b2f88647dc17e9443e868f4ecabe4bd81faf24147099f5837b72e2fcdb
SHA512 a34416dba610280d13447639049adc1eb462adcc69bbdad142bc61faff41d36cc613ab4097a47a5fa11097ac632e8cec8691de7cdea56a5b77ed486adc5efb51

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 f235fad94d9104d971e427294e923f36
SHA1 556261394f85197987d786fc6edd0219913925ed
SHA256 4c332860a9c57f2f6330a4fdace63988f3a078ebf9fe978848c4f5adef69ad34
SHA512 06a4d33e2905d966aa4d4214a06799ce64083cdd0acdb505580f43f6689cabcf3b7734939c2f229f7c1ae8ef07a07ea0c132832b0ae5bbc90f9f29dde926fe5a

Analysis: behavioral2

Detonation Overview

Submitted

2023-02-28 03:54

Reported

2023-02-28 03:57

Platform

win10v2004-20230220-en

Max time kernel

148s

Max time network

143s

Command Line

"C:\Users\Admin\AppData\Local\Temp\4d118d83c3192a771479d6e392d62a109aea4ca8dce81a0c6c0fe50329b15147.exe"

Signatures

Quantum Ransomware

ransomware quantum

Modifies extensions of user files

ransomware
Description Indicator Process Target
File renamed C:\Users\Admin\Pictures\RestartRename.tif => \??\c:\Users\Admin\Pictures\RestartRename.tif.quantum C:\Users\Admin\AppData\Local\Temp\4d118d83c3192a771479d6e392d62a109aea4ca8dce81a0c6c0fe50329b15147.exe N/A
File renamed C:\Users\Admin\Pictures\StopPop.tif => \??\c:\Users\Admin\Pictures\StopPop.tif.quantum C:\Users\Admin\AppData\Local\Temp\4d118d83c3192a771479d6e392d62a109aea4ca8dce81a0c6c0fe50329b15147.exe N/A
File renamed C:\Users\Admin\Pictures\BlockMove.png => \??\c:\Users\Admin\Pictures\BlockMove.png.quantum C:\Users\Admin\AppData\Local\Temp\4d118d83c3192a771479d6e392d62a109aea4ca8dce81a0c6c0fe50329b15147.exe N/A
File renamed C:\Users\Admin\Pictures\FindAssert.png => \??\c:\Users\Admin\Pictures\FindAssert.png.quantum C:\Users\Admin\AppData\Local\Temp\4d118d83c3192a771479d6e392d62a109aea4ca8dce81a0c6c0fe50329b15147.exe N/A
File renamed C:\Users\Admin\Pictures\GroupRestart.crw => \??\c:\Users\Admin\Pictures\GroupRestart.crw.quantum C:\Users\Admin\AppData\Local\Temp\4d118d83c3192a771479d6e392d62a109aea4ca8dce81a0c6c0fe50329b15147.exe N/A

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification \??\c:\Users\Admin\Pictures\Saved Pictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\4d118d83c3192a771479d6e392d62a109aea4ca8dce81a0c6c0fe50329b15147.exe N/A
File opened for modification \??\c:\Users\Admin\Saved Games\desktop.ini C:\Users\Admin\AppData\Local\Temp\4d118d83c3192a771479d6e392d62a109aea4ca8dce81a0c6c0fe50329b15147.exe N/A
File opened for modification \??\c:\Users\Admin\Searches\desktop.ini C:\Users\Admin\AppData\Local\Temp\4d118d83c3192a771479d6e392d62a109aea4ca8dce81a0c6c0fe50329b15147.exe N/A
File opened for modification \??\c:\Users\Public\desktop.ini C:\Users\Admin\AppData\Local\Temp\4d118d83c3192a771479d6e392d62a109aea4ca8dce81a0c6c0fe50329b15147.exe N/A
File opened for modification \??\c:\Users\Admin\Contacts\desktop.ini C:\Users\Admin\AppData\Local\Temp\4d118d83c3192a771479d6e392d62a109aea4ca8dce81a0c6c0fe50329b15147.exe N/A
File opened for modification \??\c:\Users\Admin\Downloads\desktop.ini C:\Users\Admin\AppData\Local\Temp\4d118d83c3192a771479d6e392d62a109aea4ca8dce81a0c6c0fe50329b15147.exe N/A
File opened for modification \??\c:\Users\Admin\Favorites\Links\desktop.ini C:\Users\Admin\AppData\Local\Temp\4d118d83c3192a771479d6e392d62a109aea4ca8dce81a0c6c0fe50329b15147.exe N/A
File opened for modification \??\c:\Users\Admin\Links\desktop.ini C:\Users\Admin\AppData\Local\Temp\4d118d83c3192a771479d6e392d62a109aea4ca8dce81a0c6c0fe50329b15147.exe N/A
File opened for modification \??\c:\Users\Public\Libraries\desktop.ini C:\Users\Admin\AppData\Local\Temp\4d118d83c3192a771479d6e392d62a109aea4ca8dce81a0c6c0fe50329b15147.exe N/A
File opened for modification \??\c:\Users\Public\Pictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\4d118d83c3192a771479d6e392d62a109aea4ca8dce81a0c6c0fe50329b15147.exe N/A
File opened for modification \??\c:\Users\Admin\3D Objects\desktop.ini C:\Users\Admin\AppData\Local\Temp\4d118d83c3192a771479d6e392d62a109aea4ca8dce81a0c6c0fe50329b15147.exe N/A
File opened for modification \??\c:\Users\Admin\Desktop\desktop.ini C:\Users\Admin\AppData\Local\Temp\4d118d83c3192a771479d6e392d62a109aea4ca8dce81a0c6c0fe50329b15147.exe N/A
File opened for modification \??\c:\Users\Admin\Music\desktop.ini C:\Users\Admin\AppData\Local\Temp\4d118d83c3192a771479d6e392d62a109aea4ca8dce81a0c6c0fe50329b15147.exe N/A
File opened for modification \??\c:\Users\Admin\Pictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\4d118d83c3192a771479d6e392d62a109aea4ca8dce81a0c6c0fe50329b15147.exe N/A
File opened for modification \??\c:\Users\Public\Music\desktop.ini C:\Users\Admin\AppData\Local\Temp\4d118d83c3192a771479d6e392d62a109aea4ca8dce81a0c6c0fe50329b15147.exe N/A
File opened for modification \??\c:\Users\Public\Videos\desktop.ini C:\Users\Admin\AppData\Local\Temp\4d118d83c3192a771479d6e392d62a109aea4ca8dce81a0c6c0fe50329b15147.exe N/A
File opened for modification \??\c:\Users\Admin\Pictures\Camera Roll\desktop.ini C:\Users\Admin\AppData\Local\Temp\4d118d83c3192a771479d6e392d62a109aea4ca8dce81a0c6c0fe50329b15147.exe N/A
File opened for modification \??\c:\Users\Public\Desktop\desktop.ini C:\Users\Admin\AppData\Local\Temp\4d118d83c3192a771479d6e392d62a109aea4ca8dce81a0c6c0fe50329b15147.exe N/A
File opened for modification \??\c:\Users\Public\Documents\desktop.ini C:\Users\Admin\AppData\Local\Temp\4d118d83c3192a771479d6e392d62a109aea4ca8dce81a0c6c0fe50329b15147.exe N/A
File opened for modification \??\c:\Users\Public\Downloads\desktop.ini C:\Users\Admin\AppData\Local\Temp\4d118d83c3192a771479d6e392d62a109aea4ca8dce81a0c6c0fe50329b15147.exe N/A
File opened for modification \??\c:\Users\Public\AccountPictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\4d118d83c3192a771479d6e392d62a109aea4ca8dce81a0c6c0fe50329b15147.exe N/A
File opened for modification \??\c:\Users\Admin\Documents\desktop.ini C:\Users\Admin\AppData\Local\Temp\4d118d83c3192a771479d6e392d62a109aea4ca8dce81a0c6c0fe50329b15147.exe N/A
File opened for modification \??\c:\Users\Admin\Favorites\desktop.ini C:\Users\Admin\AppData\Local\Temp\4d118d83c3192a771479d6e392d62a109aea4ca8dce81a0c6c0fe50329b15147.exe N/A
File opened for modification \??\c:\Users\Admin\OneDrive\desktop.ini C:\Users\Admin\AppData\Local\Temp\4d118d83c3192a771479d6e392d62a109aea4ca8dce81a0c6c0fe50329b15147.exe N/A
File opened for modification \??\c:\Users\Admin\Videos\desktop.ini C:\Users\Admin\AppData\Local\Temp\4d118d83c3192a771479d6e392d62a109aea4ca8dce81a0c6c0fe50329b15147.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20230228045713.pma C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe N/A
File created C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\ba426732-6653-4196-81fa-dbc60426f4e2.tmp C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\.quantum\shell\Open\command C:\Users\Admin\AppData\Local\Temp\4d118d83c3192a771479d6e392d62a109aea4ca8dce81a0c6c0fe50329b15147.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\.quantum C:\Users\Admin\AppData\Local\Temp\4d118d83c3192a771479d6e392d62a109aea4ca8dce81a0c6c0fe50329b15147.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\.quantum\shell C:\Users\Admin\AppData\Local\Temp\4d118d83c3192a771479d6e392d62a109aea4ca8dce81a0c6c0fe50329b15147.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\.quantum\shell\Open C:\Users\Admin\AppData\Local\Temp\4d118d83c3192a771479d6e392d62a109aea4ca8dce81a0c6c0fe50329b15147.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\.quantum\shell\Open\command\ = "explorer.exe README_TO_DECRYPT.html" C:\Users\Admin\AppData\Local\Temp\4d118d83c3192a771479d6e392d62a109aea4ca8dce81a0c6c0fe50329b15147.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\4d118d83c3192a771479d6e392d62a109aea4ca8dce81a0c6c0fe50329b15147.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4d118d83c3192a771479d6e392d62a109aea4ca8dce81a0c6c0fe50329b15147.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe N/A

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\4d118d83c3192a771479d6e392d62a109aea4ca8dce81a0c6c0fe50329b15147.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4d118d83c3192a771479d6e392d62a109aea4ca8dce81a0c6c0fe50329b15147.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1272 wrote to memory of 1352 N/A C:\Users\Admin\AppData\Local\Temp\4d118d83c3192a771479d6e392d62a109aea4ca8dce81a0c6c0fe50329b15147.exe C:\Windows\system32\cmd.exe
PID 1272 wrote to memory of 1352 N/A C:\Users\Admin\AppData\Local\Temp\4d118d83c3192a771479d6e392d62a109aea4ca8dce81a0c6c0fe50329b15147.exe C:\Windows\system32\cmd.exe
PID 1352 wrote to memory of 4628 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\attrib.exe
PID 1352 wrote to memory of 4628 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\attrib.exe
PID 996 wrote to memory of 624 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 996 wrote to memory of 624 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 996 wrote to memory of 1588 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 996 wrote to memory of 1588 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 996 wrote to memory of 1588 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 996 wrote to memory of 1588 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 996 wrote to memory of 1588 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 996 wrote to memory of 1588 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 996 wrote to memory of 1588 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 996 wrote to memory of 1588 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 996 wrote to memory of 1588 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 996 wrote to memory of 1588 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 996 wrote to memory of 1588 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 996 wrote to memory of 1588 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 996 wrote to memory of 1588 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 996 wrote to memory of 1588 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 996 wrote to memory of 1588 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 996 wrote to memory of 1588 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 996 wrote to memory of 1588 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 996 wrote to memory of 1588 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 996 wrote to memory of 1588 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 996 wrote to memory of 1588 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 996 wrote to memory of 1588 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 996 wrote to memory of 1588 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 996 wrote to memory of 1588 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 996 wrote to memory of 1588 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 996 wrote to memory of 1588 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 996 wrote to memory of 1588 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 996 wrote to memory of 1588 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 996 wrote to memory of 1588 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 996 wrote to memory of 1588 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 996 wrote to memory of 1588 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 996 wrote to memory of 1588 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 996 wrote to memory of 1588 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 996 wrote to memory of 1588 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 996 wrote to memory of 1588 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 996 wrote to memory of 1588 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 996 wrote to memory of 1588 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 996 wrote to memory of 1588 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 996 wrote to memory of 1588 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 996 wrote to memory of 1588 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 996 wrote to memory of 1588 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 996 wrote to memory of 4372 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 996 wrote to memory of 4372 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 996 wrote to memory of 4524 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 996 wrote to memory of 4524 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 996 wrote to memory of 4524 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 996 wrote to memory of 4524 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 996 wrote to memory of 4524 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 996 wrote to memory of 4524 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 996 wrote to memory of 4524 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 996 wrote to memory of 4524 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 996 wrote to memory of 4524 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 996 wrote to memory of 4524 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 996 wrote to memory of 4524 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 996 wrote to memory of 4524 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 996 wrote to memory of 4524 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 996 wrote to memory of 4524 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 996 wrote to memory of 4524 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 996 wrote to memory of 4524 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Views/modifies file attributes

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\attrib.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\4d118d83c3192a771479d6e392d62a109aea4ca8dce81a0c6c0fe50329b15147.exe

"C:\Users\Admin\AppData\Local\Temp\4d118d83c3192a771479d6e392d62a109aea4ca8dce81a0c6c0fe50329b15147.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\\0E5698F9.bat" "C:\Users\Admin\AppData\Local\Temp\4d118d83c3192a771479d6e392d62a109aea4ca8dce81a0c6c0fe50329b15147.exe""

C:\Windows\system32\attrib.exe

attrib -s -r -h "C:\Users\Admin\AppData\Local\Temp\4d118d83c3192a771479d6e392d62a109aea4ca8dce81a0c6c0fe50329b15147.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\README_TO_DECRYPT.html

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0x118,0x128,0x7ffd4a0246f8,0x7ffd4a024708,0x7ffd4a024718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,10575617524032124311,2054572146910190080,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2200 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,10575617524032124311,2054572146910190080,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2364 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,10575617524032124311,2054572146910190080,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2736 /prefetch:8

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,10575617524032124311,2054572146910190080,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3628 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,10575617524032124311,2054572146910190080,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3636 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,10575617524032124311,2054572146910190080,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5204 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x26c,0x270,0x274,0x248,0x278,0x7ff6005b5460,0x7ff6005b5470,0x7ff6005b5480

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,10575617524032124311,2054572146910190080,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5204 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,10575617524032124311,2054572146910190080,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5556 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,10575617524032124311,2054572146910190080,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5468 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,10575617524032124311,2054572146910190080,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5796 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,10575617524032124311,2054572146910190080,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4244 /prefetch:1

Network

Country Destination Domain Proto
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 117.18.232.240:80 tcp
US 93.184.220.29:80 tcp
US 93.184.220.29:80 tcp
US 8.8.8.8:53 2.136.104.51.in-addr.arpa udp
US 8.8.8.8:53 123.108.74.40.in-addr.arpa udp
US 8.8.8.8:53 226.101.242.52.in-addr.arpa udp
US 8.8.8.8:53 199.176.139.52.in-addr.arpa udp
US 8.8.8.8:53 202.74.101.95.in-addr.arpa udp
US 8.8.8.8:53 29.237.18.117.in-addr.arpa udp
FR 40.79.141.153:443 tcp
US 117.18.232.240:80 tcp
US 117.18.232.240:80 tcp
NL 173.223.113.164:443 tcp
US 8.8.8.8:53 63.13.109.52.in-addr.arpa udp
US 93.184.221.240:80 tcp
NL 173.223.113.131:80 tcp
US 131.253.33.203:80 tcp
US 8.8.8.8:53 68.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 250.255.255.239.in-addr.arpa udp
N/A 224.0.0.251:5353 udp

Files

C:\Users\Admin\3D Objects\README_TO_DECRYPT.html

MD5 8b660e8ddf1eb1ea712e14a2b92c1a2b
SHA1 4175a0d10b8dae93d77dc295e67c74e96cbda140
SHA256 22295af10b4143e82d04b8a62e02b6ac606afc82134dcb8cdab55f4323e1d739
SHA512 42e7e6c8eb0816d948cc74c6af7b29b1899927e056f6b0ec8024aac44577b8c1ba736063178b79ae140a87f8dc6a83594ec110358a66ca4b05617eb8ebfcecb8

C:\Users\Admin\AppData\Local\Temp\0E5698F9.bat

MD5 348cae913e496198548854f5ff2f6d1e
SHA1 a07655b9020205bd47084afd62a8bb22b48c0cdc
SHA256 c80128f51871eec3ae2057989a025ce244277c1c180498a5aaef45d5214b8506
SHA512 799796736d41d3fcb5a7c859571bb025ca2d062c4b86e078302be68c1a932ed4f78e003640df5405274364b5a9a9c0ba5e37177997683ee7ab54e5267590b611

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 78c7656527762ed2977adf983a6f4766
SHA1 21a66d2eefcb059371f4972694057e4b1f827ce6
SHA256 e1000099751602ae1adcec6f1c74e1d65f472936817b45239dfed4b043984296
SHA512 0a8e58ae95163b3cdf8e81b5085887761e73cb7c836a1a6a972e837fb3df69b2ac70cfd6311d06d40656344ec35eb48e512f007561480f0345486ac2b329be0b

memory/1588-377-0x00007FFD65AB0000-0x00007FFD65AB1000-memory.dmp

\??\pipe\LOCAL\crashpad_996_BALPCFAQAHWZYJYK

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

MD5 e5e3377341056643b0494b6842c0b544
SHA1 d53fd8e256ec9d5cef8ef5387872e544a2df9108
SHA256 e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25
SHA512 83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 099b4ba2787e99b696fc61528100f83f
SHA1 06e1f8b7391e1d548e49a1022f6ce6e7aa61f292
SHA256 cdb1db488e260ed750edfe1c145850b57ee8ab819d75237a167e673116a33ee8
SHA512 4309375e10785564ceb03e0127ced414e366a5b833f16a60d796471d871b479e4c044db5268902d9dfd14715ca577cb26042bab8f7b0f31fe8abf33947feb9d1

C:\Users\Admin\Desktop\README_TO_DECRYPT.html

MD5 8b660e8ddf1eb1ea712e14a2b92c1a2b
SHA1 4175a0d10b8dae93d77dc295e67c74e96cbda140
SHA256 22295af10b4143e82d04b8a62e02b6ac606afc82134dcb8cdab55f4323e1d739
SHA512 42e7e6c8eb0816d948cc74c6af7b29b1899927e056f6b0ec8024aac44577b8c1ba736063178b79ae140a87f8dc6a83594ec110358a66ca4b05617eb8ebfcecb8

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 65584d02c8f9e126b05bb3ef7369bf26
SHA1 d885b8809f6105c544d614e27babaa628c6c7d53
SHA256 2419640992d394b07c1e656fe8ebc08911873d9ce701d3e631b0da9dd26641af
SHA512 7063edaa3e1c9306143175b88219984e84e7861da27807c9ef787ff322e59afa0a8e54ced891100c19b780057b56c89e7e502b62ff9f5031ad3ee56b952d47ab

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

MD5 02ee7addc9e8a2d07af55556ebf0ff5c
SHA1 020161bb64ecb7c6e6886ccc055908984dc651d8
SHA256 552d3ed359b7a52278ce621674d16428d8a7969f6cd5663df18e240cce66aadc
SHA512 567989543c3848a0c3276d96b96ca761f750e4b71fb74f36d809f590ffe16a72fd5ece251737a8b1ffe65f0051e211bd7ad19d2b8b0b7ca1b7ffc86dd2a52883

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Microsoft Edge.lnk

MD5 a4dede5dd4cd4c100a4a3e4c9e6c4c20
SHA1 f66ac6d398941b21a6ff98274c149a0e39f33b72
SHA256 b9d275be2fd7385b2317f2ff1b497f303cfbaaba53f88529710aa2320f947f3b
SHA512 5066cd538a84b00148930c4a0f77334f43f9b29c46059282e971dbbee982cecc26dd58a6bcff4476b4d2aa8b679520b03bf04585c7f2db912b4d1ae0b3f7ed0a

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\MANIFEST-000001

MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000001.dbtmp

MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

MD5 c66b94d249f60075c9c4df62696202db
SHA1 fe711af485a7cad5adb1afc6458e340ef96c6817
SHA256 0925ab69580d9fb80feda389c0af05d9c01677c1400a7af1a7f8bb95369114ad
SHA512 c4723238ec1d1fa1540f3b985f5f2df7c1995afecfc9202a9a1f0f7908ea4c3abb7c858936f18c08a4d879fbed209afb6bf6783728f1db626d1acbaaf49d44fb

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 da0380af0d3cfda822bec054a99a6bbd
SHA1 17fa3c201ef034efe221c4692d49b837f50ddadc
SHA256 61d169ed95caf595deb12d6833339c892eb8836c30848c38cc8210c80a17c65b
SHA512 49e708f2ebe08b446eca68cb1f4af1b76f0ea4e85cb7ed50e8113fec89bc300c2eb9af947df70d21b68a1c8877ae4c9a2bbf097d23e88724c21e7d4ff30f759f

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 4617f94832c685b31f703f8dfe8fdca1
SHA1 1933266775ae809cdd479f1c76ad1580a5cd4171
SHA256 1e0f01ec217feea7b68cb7f2d63b2567e36b7e16dc7405b9a77e95672b95f7f2
SHA512 fab8a62359505fdcc4f639d42abfc0caabe7e4f8d19629988abb7ffb4b25e2175bc3131541910a4a868dc9a0f6a1e03996f211cd7101bec22e5213bb13da7aff

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 3ae615065daa0ee99735442361e9bc4b
SHA1 cbb19c04354709f048186433abb9c34f7e9d913e
SHA256 37e6d27fe2ad97c621023b8a370c7755a9decd8f300f2088daa874204bf7657c
SHA512 8b9f4613385f4b8f5fd6b42c8f867d5a7acdae1ed5831979d5ff5c7aab37c77159d290a2c2044f5318901d4cf51f7dba9b7203d611b066c0777d3ee9ba4cad86