Malware Analysis Report

2024-09-11 01:36

Sample ID 230228-ezwa9shc6x
Target 76c75318d96c33c268f5e3454b1d220761c3a62a94775fee7e6df6423dd7e8d0
SHA256 76c75318d96c33c268f5e3454b1d220761c3a62a94775fee7e6df6423dd7e8d0
Tags
quantum ransomware
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

76c75318d96c33c268f5e3454b1d220761c3a62a94775fee7e6df6423dd7e8d0

Threat Level: Known bad

The file 76c75318d96c33c268f5e3454b1d220761c3a62a94775fee7e6df6423dd7e8d0 was found to be: Known bad.

Malicious Activity Summary

quantum ransomware

Quantum Ransomware

Modifies extensions of user files

Deletes itself

Drops desktop.ini file(s)

Drops file in Program Files directory

Suspicious use of SetWindowsHookEx

Suspicious use of FindShellTrayWindow

Suspicious use of AdjustPrivilegeToken

Modifies Internet Explorer settings

Views/modifies file attributes

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious use of SendNotifyMessage

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Enumerates system info in registry

MITRE ATT&CK Matrix V6

Initial Access
TA0001
Execution
TA0002
Persistence
TA0003
Hidden Files and Directories
T1158
Privilege Escalation
TA0004
Defense Evasion
TA0005
Modify Registry
T1112
Hidden Files and Directories
T1158
Credential Access
TA0006
Discovery
TA0007
Query Registry
T1012
System Information Discovery
T1082
Lateral Movement
TA0008
Collection
TA0009
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040

Analysis: static1

Detonation Overview

Reported

2023-02-28 04:23

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-02-28 04:23

Reported

2023-02-28 04:23

Platform

win7-20230220-en

Max time kernel

28s

Max time network

31s

Command Line

"C:\Users\Admin\AppData\Local\Temp\76c75318d96c33c268f5e3454b1d220761c3a62a94775fee7e6df6423dd7e8d0.exe"

Signatures

Quantum Ransomware

ransomware quantum

Modifies extensions of user files

ransomware
Description Indicator Process Target
File renamed C:\Users\Admin\Pictures\CheckpointDebug.raw => \??\c:\Users\Admin\Pictures\CheckpointDebug.raw.quantum C:\Users\Admin\AppData\Local\Temp\76c75318d96c33c268f5e3454b1d220761c3a62a94775fee7e6df6423dd7e8d0.exe N/A
File renamed C:\Users\Admin\Pictures\CloseTrace.raw => \??\c:\Users\Admin\Pictures\CloseTrace.raw.quantum C:\Users\Admin\AppData\Local\Temp\76c75318d96c33c268f5e3454b1d220761c3a62a94775fee7e6df6423dd7e8d0.exe N/A
File renamed C:\Users\Admin\Pictures\ImportLock.crw => \??\c:\Users\Admin\Pictures\ImportLock.crw.quantum C:\Users\Admin\AppData\Local\Temp\76c75318d96c33c268f5e3454b1d220761c3a62a94775fee7e6df6423dd7e8d0.exe N/A
File renamed C:\Users\Admin\Pictures\InitializeSwitch.crw => \??\c:\Users\Admin\Pictures\InitializeSwitch.crw.quantum C:\Users\Admin\AppData\Local\Temp\76c75318d96c33c268f5e3454b1d220761c3a62a94775fee7e6df6423dd7e8d0.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification \??\c:\Users\Public\Documents\desktop.ini C:\Users\Admin\AppData\Local\Temp\76c75318d96c33c268f5e3454b1d220761c3a62a94775fee7e6df6423dd7e8d0.exe N/A
File opened for modification \??\c:\Users\Public\Videos\Sample Videos\desktop.ini C:\Users\Admin\AppData\Local\Temp\76c75318d96c33c268f5e3454b1d220761c3a62a94775fee7e6df6423dd7e8d0.exe N/A
File opened for modification \??\c:\Users\Admin\Favorites\Links\desktop.ini C:\Users\Admin\AppData\Local\Temp\76c75318d96c33c268f5e3454b1d220761c3a62a94775fee7e6df6423dd7e8d0.exe N/A
File opened for modification \??\c:\Users\Admin\Favorites\Links for United States\desktop.ini C:\Users\Admin\AppData\Local\Temp\76c75318d96c33c268f5e3454b1d220761c3a62a94775fee7e6df6423dd7e8d0.exe N/A
File opened for modification \??\c:\Users\Admin\Music\desktop.ini C:\Users\Admin\AppData\Local\Temp\76c75318d96c33c268f5e3454b1d220761c3a62a94775fee7e6df6423dd7e8d0.exe N/A
File opened for modification \??\c:\Users\Admin\Videos\desktop.ini C:\Users\Admin\AppData\Local\Temp\76c75318d96c33c268f5e3454b1d220761c3a62a94775fee7e6df6423dd7e8d0.exe N/A
File opened for modification \??\c:\Users\Public\Recorded TV\Sample Media\desktop.ini C:\Users\Admin\AppData\Local\Temp\76c75318d96c33c268f5e3454b1d220761c3a62a94775fee7e6df6423dd7e8d0.exe N/A
File opened for modification \??\c:\Users\Public\Videos\desktop.ini C:\Users\Admin\AppData\Local\Temp\76c75318d96c33c268f5e3454b1d220761c3a62a94775fee7e6df6423dd7e8d0.exe N/A
File opened for modification \??\c:\Users\Admin\Favorites\desktop.ini C:\Users\Admin\AppData\Local\Temp\76c75318d96c33c268f5e3454b1d220761c3a62a94775fee7e6df6423dd7e8d0.exe N/A
File opened for modification \??\c:\Users\Admin\Links\desktop.ini C:\Users\Admin\AppData\Local\Temp\76c75318d96c33c268f5e3454b1d220761c3a62a94775fee7e6df6423dd7e8d0.exe N/A
File opened for modification \??\c:\Users\Admin\Saved Games\desktop.ini C:\Users\Admin\AppData\Local\Temp\76c75318d96c33c268f5e3454b1d220761c3a62a94775fee7e6df6423dd7e8d0.exe N/A
File opened for modification \??\c:\Users\Public\Downloads\desktop.ini C:\Users\Admin\AppData\Local\Temp\76c75318d96c33c268f5e3454b1d220761c3a62a94775fee7e6df6423dd7e8d0.exe N/A
File opened for modification \??\c:\Users\Admin\Searches\desktop.ini C:\Users\Admin\AppData\Local\Temp\76c75318d96c33c268f5e3454b1d220761c3a62a94775fee7e6df6423dd7e8d0.exe N/A
File opened for modification \??\c:\Users\Public\Music\Sample Music\desktop.ini C:\Users\Admin\AppData\Local\Temp\76c75318d96c33c268f5e3454b1d220761c3a62a94775fee7e6df6423dd7e8d0.exe N/A
File opened for modification \??\c:\Users\Public\Pictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\76c75318d96c33c268f5e3454b1d220761c3a62a94775fee7e6df6423dd7e8d0.exe N/A
File opened for modification \??\c:\Users\Public\Pictures\Sample Pictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\76c75318d96c33c268f5e3454b1d220761c3a62a94775fee7e6df6423dd7e8d0.exe N/A
File opened for modification \??\c:\Users\Admin\Desktop\desktop.ini C:\Users\Admin\AppData\Local\Temp\76c75318d96c33c268f5e3454b1d220761c3a62a94775fee7e6df6423dd7e8d0.exe N/A
File opened for modification \??\c:\Users\Admin\Documents\desktop.ini C:\Users\Admin\AppData\Local\Temp\76c75318d96c33c268f5e3454b1d220761c3a62a94775fee7e6df6423dd7e8d0.exe N/A
File opened for modification \??\c:\Users\Admin\Downloads\desktop.ini C:\Users\Admin\AppData\Local\Temp\76c75318d96c33c268f5e3454b1d220761c3a62a94775fee7e6df6423dd7e8d0.exe N/A
File opened for modification \??\c:\Users\Admin\Pictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\76c75318d96c33c268f5e3454b1d220761c3a62a94775fee7e6df6423dd7e8d0.exe N/A
File opened for modification \??\c:\Users\Public\Music\desktop.ini C:\Users\Admin\AppData\Local\Temp\76c75318d96c33c268f5e3454b1d220761c3a62a94775fee7e6df6423dd7e8d0.exe N/A
File opened for modification \??\c:\Users\Public\Recorded TV\desktop.ini C:\Users\Admin\AppData\Local\Temp\76c75318d96c33c268f5e3454b1d220761c3a62a94775fee7e6df6423dd7e8d0.exe N/A
File opened for modification \??\c:\Users\Admin\Contacts\desktop.ini C:\Users\Admin\AppData\Local\Temp\76c75318d96c33c268f5e3454b1d220761c3a62a94775fee7e6df6423dd7e8d0.exe N/A
File opened for modification \??\c:\Users\Public\Desktop\desktop.ini C:\Users\Admin\AppData\Local\Temp\76c75318d96c33c268f5e3454b1d220761c3a62a94775fee7e6df6423dd7e8d0.exe N/A
File opened for modification \??\c:\Users\Public\desktop.ini C:\Users\Admin\AppData\Local\Temp\76c75318d96c33c268f5e3454b1d220761c3a62a94775fee7e6df6423dd7e8d0.exe N/A
File opened for modification \??\c:\Users\Public\Libraries\desktop.ini C:\Users\Admin\AppData\Local\Temp\76c75318d96c33c268f5e3454b1d220761c3a62a94775fee7e6df6423dd7e8d0.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AC922EE1-B71F-11ED-BA98-CED2106B5FC8} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\iexplore.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_CLASSES\.quantum\shell\Open\command C:\Users\Admin\AppData\Local\Temp\76c75318d96c33c268f5e3454b1d220761c3a62a94775fee7e6df6423dd7e8d0.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_CLASSES\.quantum C:\Users\Admin\AppData\Local\Temp\76c75318d96c33c268f5e3454b1d220761c3a62a94775fee7e6df6423dd7e8d0.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_CLASSES\.quantum\shell C:\Users\Admin\AppData\Local\Temp\76c75318d96c33c268f5e3454b1d220761c3a62a94775fee7e6df6423dd7e8d0.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_CLASSES\.quantum\shell\Open C:\Users\Admin\AppData\Local\Temp\76c75318d96c33c268f5e3454b1d220761c3a62a94775fee7e6df6423dd7e8d0.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_CLASSES\.quantum\shell\Open\command\ = "explorer.exe README_TO_DECRYPT.html" C:\Users\Admin\AppData\Local\Temp\76c75318d96c33c268f5e3454b1d220761c3a62a94775fee7e6df6423dd7e8d0.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\76c75318d96c33c268f5e3454b1d220761c3a62a94775fee7e6df6423dd7e8d0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\76c75318d96c33c268f5e3454b1d220761c3a62a94775fee7e6df6423dd7e8d0.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\76c75318d96c33c268f5e3454b1d220761c3a62a94775fee7e6df6423dd7e8d0.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\76c75318d96c33c268f5e3454b1d220761c3a62a94775fee7e6df6423dd7e8d0.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1456 wrote to memory of 1692 N/A C:\Users\Admin\AppData\Local\Temp\76c75318d96c33c268f5e3454b1d220761c3a62a94775fee7e6df6423dd7e8d0.exe C:\Windows\SysWOW64\cmd.exe
PID 1456 wrote to memory of 1692 N/A C:\Users\Admin\AppData\Local\Temp\76c75318d96c33c268f5e3454b1d220761c3a62a94775fee7e6df6423dd7e8d0.exe C:\Windows\SysWOW64\cmd.exe
PID 1456 wrote to memory of 1692 N/A C:\Users\Admin\AppData\Local\Temp\76c75318d96c33c268f5e3454b1d220761c3a62a94775fee7e6df6423dd7e8d0.exe C:\Windows\SysWOW64\cmd.exe
PID 1456 wrote to memory of 1692 N/A C:\Users\Admin\AppData\Local\Temp\76c75318d96c33c268f5e3454b1d220761c3a62a94775fee7e6df6423dd7e8d0.exe C:\Windows\SysWOW64\cmd.exe
PID 1692 wrote to memory of 768 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 1692 wrote to memory of 768 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 1692 wrote to memory of 768 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 1692 wrote to memory of 768 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 1776 wrote to memory of 1488 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 1776 wrote to memory of 1488 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 1776 wrote to memory of 1488 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 1776 wrote to memory of 1488 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

Views/modifies file attributes

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\76c75318d96c33c268f5e3454b1d220761c3a62a94775fee7e6df6423dd7e8d0.exe

"C:\Users\Admin\AppData\Local\Temp\76c75318d96c33c268f5e3454b1d220761c3a62a94775fee7e6df6423dd7e8d0.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\\006C56D8.bat" "C:\Users\Admin\AppData\Local\Temp\76c75318d96c33c268f5e3454b1d220761c3a62a94775fee7e6df6423dd7e8d0.exe""

C:\Windows\SysWOW64\attrib.exe

attrib -s -r -h "C:\Users\Admin\AppData\Local\Temp\76c75318d96c33c268f5e3454b1d220761c3a62a94775fee7e6df6423dd7e8d0.exe"

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\README_TO_DECRYPT.html

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1776 CREDAT:275457 /prefetch:2

Network

Files

C:\Users\Admin\Desktop\README_TO_DECRYPT.html

MD5 e2023a501c3a5bbd5a37482841b34a53
SHA1 0172584ab0a393b1e608e4a470398d010405a674
SHA256 942904508fcdb8db57e17f570554089233df8b2e1eb9f21bdd077dd2bfb6d2d2
SHA512 8c5dc8ed89fccb411d0053f560228194dfd66711c3f95b7c7f712085b134650cf24ff05bef5eebd3b8b9c544ef88ae09f4d4a3b7d7ab3e89f5231959df093ae7

C:\Users\Admin\AppData\Local\Temp\006C56D8.bat

MD5 348cae913e496198548854f5ff2f6d1e
SHA1 a07655b9020205bd47084afd62a8bb22b48c0cdc
SHA256 c80128f51871eec3ae2057989a025ce244277c1c180498a5aaef45d5214b8506
SHA512 799796736d41d3fcb5a7c859571bb025ca2d062c4b86e078302be68c1a932ed4f78e003640df5405274364b5a9a9c0ba5e37177997683ee7ab54e5267590b611

C:\Users\Admin\AppData\Local\Temp\006C56D8.bat

MD5 348cae913e496198548854f5ff2f6d1e
SHA1 a07655b9020205bd47084afd62a8bb22b48c0cdc
SHA256 c80128f51871eec3ae2057989a025ce244277c1c180498a5aaef45d5214b8506
SHA512 799796736d41d3fcb5a7c859571bb025ca2d062c4b86e078302be68c1a932ed4f78e003640df5405274364b5a9a9c0ba5e37177997683ee7ab54e5267590b611

memory/1776-332-0x0000000002F40000-0x0000000002F50000-memory.dmp

memory/1488-333-0x00000000011C0000-0x00000000011C2000-memory.dmp

C:\Users\Admin\Desktop\README_TO_DECRYPT.html

MD5 e2023a501c3a5bbd5a37482841b34a53
SHA1 0172584ab0a393b1e608e4a470398d010405a674
SHA256 942904508fcdb8db57e17f570554089233df8b2e1eb9f21bdd077dd2bfb6d2d2
SHA512 8c5dc8ed89fccb411d0053f560228194dfd66711c3f95b7c7f712085b134650cf24ff05bef5eebd3b8b9c544ef88ae09f4d4a3b7d7ab3e89f5231959df093ae7

Analysis: behavioral2

Detonation Overview

Submitted

2023-02-28 04:23

Reported

2023-02-28 04:23

Platform

win10v2004-20230220-en

Max time kernel

32s

Max time network

37s

Command Line

"C:\Users\Admin\AppData\Local\Temp\76c75318d96c33c268f5e3454b1d220761c3a62a94775fee7e6df6423dd7e8d0.exe"

Signatures

Quantum Ransomware

ransomware quantum

Modifies extensions of user files

ransomware
Description Indicator Process Target
File renamed C:\Users\Admin\Pictures\OpenUnlock.tiff => \??\c:\Users\Admin\Pictures\OpenUnlock.tiff.quantum C:\Users\Admin\AppData\Local\Temp\76c75318d96c33c268f5e3454b1d220761c3a62a94775fee7e6df6423dd7e8d0.exe N/A
File renamed C:\Users\Admin\Pictures\UnpublishRegister.tif => \??\c:\Users\Admin\Pictures\UnpublishRegister.tif.quantum C:\Users\Admin\AppData\Local\Temp\76c75318d96c33c268f5e3454b1d220761c3a62a94775fee7e6df6423dd7e8d0.exe N/A
File renamed C:\Users\Admin\Pictures\UseDebug.crw => \??\c:\Users\Admin\Pictures\UseDebug.crw.quantum C:\Users\Admin\AppData\Local\Temp\76c75318d96c33c268f5e3454b1d220761c3a62a94775fee7e6df6423dd7e8d0.exe N/A
File opened for modification \??\c:\Users\Admin\Pictures\ExitGroup.tiff C:\Users\Admin\AppData\Local\Temp\76c75318d96c33c268f5e3454b1d220761c3a62a94775fee7e6df6423dd7e8d0.exe N/A
File renamed C:\Users\Admin\Pictures\PushAssert.crw => \??\c:\Users\Admin\Pictures\PushAssert.crw.quantum C:\Users\Admin\AppData\Local\Temp\76c75318d96c33c268f5e3454b1d220761c3a62a94775fee7e6df6423dd7e8d0.exe N/A
File renamed C:\Users\Admin\Pictures\GrantImport.tif => \??\c:\Users\Admin\Pictures\GrantImport.tif.quantum C:\Users\Admin\AppData\Local\Temp\76c75318d96c33c268f5e3454b1d220761c3a62a94775fee7e6df6423dd7e8d0.exe N/A
File opened for modification \??\c:\Users\Admin\Pictures\OpenUnlock.tiff C:\Users\Admin\AppData\Local\Temp\76c75318d96c33c268f5e3454b1d220761c3a62a94775fee7e6df6423dd7e8d0.exe N/A
File renamed C:\Users\Admin\Pictures\ResolveFind.tiff => \??\c:\Users\Admin\Pictures\ResolveFind.tiff.quantum C:\Users\Admin\AppData\Local\Temp\76c75318d96c33c268f5e3454b1d220761c3a62a94775fee7e6df6423dd7e8d0.exe N/A
File renamed C:\Users\Admin\Pictures\RestartMerge.png => \??\c:\Users\Admin\Pictures\RestartMerge.png.quantum C:\Users\Admin\AppData\Local\Temp\76c75318d96c33c268f5e3454b1d220761c3a62a94775fee7e6df6423dd7e8d0.exe N/A
File renamed C:\Users\Admin\Pictures\SplitUpdate.crw => \??\c:\Users\Admin\Pictures\SplitUpdate.crw.quantum C:\Users\Admin\AppData\Local\Temp\76c75318d96c33c268f5e3454b1d220761c3a62a94775fee7e6df6423dd7e8d0.exe N/A
File renamed C:\Users\Admin\Pictures\WaitMeasure.crw => \??\c:\Users\Admin\Pictures\WaitMeasure.crw.quantum C:\Users\Admin\AppData\Local\Temp\76c75318d96c33c268f5e3454b1d220761c3a62a94775fee7e6df6423dd7e8d0.exe N/A
File renamed C:\Users\Admin\Pictures\CompleteExport.png => \??\c:\Users\Admin\Pictures\CompleteExport.png.quantum C:\Users\Admin\AppData\Local\Temp\76c75318d96c33c268f5e3454b1d220761c3a62a94775fee7e6df6423dd7e8d0.exe N/A
File renamed C:\Users\Admin\Pictures\ExitGroup.tiff => \??\c:\Users\Admin\Pictures\ExitGroup.tiff.quantum C:\Users\Admin\AppData\Local\Temp\76c75318d96c33c268f5e3454b1d220761c3a62a94775fee7e6df6423dd7e8d0.exe N/A
File renamed C:\Users\Admin\Pictures\ExpandUnlock.raw => \??\c:\Users\Admin\Pictures\ExpandUnlock.raw.quantum C:\Users\Admin\AppData\Local\Temp\76c75318d96c33c268f5e3454b1d220761c3a62a94775fee7e6df6423dd7e8d0.exe N/A
File renamed C:\Users\Admin\Pictures\ExportLock.tif => \??\c:\Users\Admin\Pictures\ExportLock.tif.quantum C:\Users\Admin\AppData\Local\Temp\76c75318d96c33c268f5e3454b1d220761c3a62a94775fee7e6df6423dd7e8d0.exe N/A
File opened for modification \??\c:\Users\Admin\Pictures\ResolveFind.tiff C:\Users\Admin\AppData\Local\Temp\76c75318d96c33c268f5e3454b1d220761c3a62a94775fee7e6df6423dd7e8d0.exe N/A
File renamed C:\Users\Admin\Pictures\SendStart.crw => \??\c:\Users\Admin\Pictures\SendStart.crw.quantum C:\Users\Admin\AppData\Local\Temp\76c75318d96c33c268f5e3454b1d220761c3a62a94775fee7e6df6423dd7e8d0.exe N/A

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification \??\c:\Users\Admin\Pictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\76c75318d96c33c268f5e3454b1d220761c3a62a94775fee7e6df6423dd7e8d0.exe N/A
File opened for modification \??\c:\Users\Admin\Saved Games\desktop.ini C:\Users\Admin\AppData\Local\Temp\76c75318d96c33c268f5e3454b1d220761c3a62a94775fee7e6df6423dd7e8d0.exe N/A
File opened for modification \??\c:\Users\Admin\Searches\desktop.ini C:\Users\Admin\AppData\Local\Temp\76c75318d96c33c268f5e3454b1d220761c3a62a94775fee7e6df6423dd7e8d0.exe N/A
File opened for modification \??\c:\Users\Public\AccountPictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\76c75318d96c33c268f5e3454b1d220761c3a62a94775fee7e6df6423dd7e8d0.exe N/A
File opened for modification \??\c:\Users\Admin\3D Objects\desktop.ini C:\Users\Admin\AppData\Local\Temp\76c75318d96c33c268f5e3454b1d220761c3a62a94775fee7e6df6423dd7e8d0.exe N/A
File opened for modification \??\c:\Users\Admin\Documents\desktop.ini C:\Users\Admin\AppData\Local\Temp\76c75318d96c33c268f5e3454b1d220761c3a62a94775fee7e6df6423dd7e8d0.exe N/A
File opened for modification \??\c:\Users\Admin\Favorites\desktop.ini C:\Users\Admin\AppData\Local\Temp\76c75318d96c33c268f5e3454b1d220761c3a62a94775fee7e6df6423dd7e8d0.exe N/A
File opened for modification \??\c:\Users\Admin\Pictures\Camera Roll\desktop.ini C:\Users\Admin\AppData\Local\Temp\76c75318d96c33c268f5e3454b1d220761c3a62a94775fee7e6df6423dd7e8d0.exe N/A
File opened for modification \??\c:\Users\Public\Documents\desktop.ini C:\Users\Admin\AppData\Local\Temp\76c75318d96c33c268f5e3454b1d220761c3a62a94775fee7e6df6423dd7e8d0.exe N/A
File opened for modification \??\c:\Users\Public\Music\desktop.ini C:\Users\Admin\AppData\Local\Temp\76c75318d96c33c268f5e3454b1d220761c3a62a94775fee7e6df6423dd7e8d0.exe N/A
File opened for modification \??\c:\Users\Public\Videos\desktop.ini C:\Users\Admin\AppData\Local\Temp\76c75318d96c33c268f5e3454b1d220761c3a62a94775fee7e6df6423dd7e8d0.exe N/A
File opened for modification \??\c:\Users\Admin\Favorites\Links\desktop.ini C:\Users\Admin\AppData\Local\Temp\76c75318d96c33c268f5e3454b1d220761c3a62a94775fee7e6df6423dd7e8d0.exe N/A
File opened for modification \??\c:\Users\Admin\Pictures\Saved Pictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\76c75318d96c33c268f5e3454b1d220761c3a62a94775fee7e6df6423dd7e8d0.exe N/A
File opened for modification \??\c:\Users\Public\Libraries\desktop.ini C:\Users\Admin\AppData\Local\Temp\76c75318d96c33c268f5e3454b1d220761c3a62a94775fee7e6df6423dd7e8d0.exe N/A
File opened for modification \??\c:\Users\Admin\Contacts\desktop.ini C:\Users\Admin\AppData\Local\Temp\76c75318d96c33c268f5e3454b1d220761c3a62a94775fee7e6df6423dd7e8d0.exe N/A
File opened for modification \??\c:\Users\Admin\Videos\desktop.ini C:\Users\Admin\AppData\Local\Temp\76c75318d96c33c268f5e3454b1d220761c3a62a94775fee7e6df6423dd7e8d0.exe N/A
File opened for modification \??\c:\Users\Public\Downloads\desktop.ini C:\Users\Admin\AppData\Local\Temp\76c75318d96c33c268f5e3454b1d220761c3a62a94775fee7e6df6423dd7e8d0.exe N/A
File opened for modification \??\c:\Users\Public\Pictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\76c75318d96c33c268f5e3454b1d220761c3a62a94775fee7e6df6423dd7e8d0.exe N/A
File opened for modification \??\c:\Users\Admin\OneDrive\desktop.ini C:\Users\Admin\AppData\Local\Temp\76c75318d96c33c268f5e3454b1d220761c3a62a94775fee7e6df6423dd7e8d0.exe N/A
File opened for modification \??\c:\Users\Public\Desktop\desktop.ini C:\Users\Admin\AppData\Local\Temp\76c75318d96c33c268f5e3454b1d220761c3a62a94775fee7e6df6423dd7e8d0.exe N/A
File opened for modification \??\c:\Users\Public\desktop.ini C:\Users\Admin\AppData\Local\Temp\76c75318d96c33c268f5e3454b1d220761c3a62a94775fee7e6df6423dd7e8d0.exe N/A
File opened for modification \??\c:\Users\Admin\Desktop\desktop.ini C:\Users\Admin\AppData\Local\Temp\76c75318d96c33c268f5e3454b1d220761c3a62a94775fee7e6df6423dd7e8d0.exe N/A
File opened for modification \??\c:\Users\Admin\Downloads\desktop.ini C:\Users\Admin\AppData\Local\Temp\76c75318d96c33c268f5e3454b1d220761c3a62a94775fee7e6df6423dd7e8d0.exe N/A
File opened for modification \??\c:\Users\Admin\Links\desktop.ini C:\Users\Admin\AppData\Local\Temp\76c75318d96c33c268f5e3454b1d220761c3a62a94775fee7e6df6423dd7e8d0.exe N/A
File opened for modification \??\c:\Users\Admin\Music\desktop.ini C:\Users\Admin\AppData\Local\Temp\76c75318d96c33c268f5e3454b1d220761c3a62a94775fee7e6df6423dd7e8d0.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\d1009118-a213-4195-9577-92d700b03cfe.tmp C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20230228052335.pma C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\.quantum\shell\Open\command\ = "explorer.exe README_TO_DECRYPT.html" C:\Users\Admin\AppData\Local\Temp\76c75318d96c33c268f5e3454b1d220761c3a62a94775fee7e6df6423dd7e8d0.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\.quantum\shell\Open\command C:\Users\Admin\AppData\Local\Temp\76c75318d96c33c268f5e3454b1d220761c3a62a94775fee7e6df6423dd7e8d0.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\.quantum C:\Users\Admin\AppData\Local\Temp\76c75318d96c33c268f5e3454b1d220761c3a62a94775fee7e6df6423dd7e8d0.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\.quantum\shell C:\Users\Admin\AppData\Local\Temp\76c75318d96c33c268f5e3454b1d220761c3a62a94775fee7e6df6423dd7e8d0.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\.quantum\shell\Open C:\Users\Admin\AppData\Local\Temp\76c75318d96c33c268f5e3454b1d220761c3a62a94775fee7e6df6423dd7e8d0.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\76c75318d96c33c268f5e3454b1d220761c3a62a94775fee7e6df6423dd7e8d0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\76c75318d96c33c268f5e3454b1d220761c3a62a94775fee7e6df6423dd7e8d0.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe N/A

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\76c75318d96c33c268f5e3454b1d220761c3a62a94775fee7e6df6423dd7e8d0.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\76c75318d96c33c268f5e3454b1d220761c3a62a94775fee7e6df6423dd7e8d0.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2432 wrote to memory of 4008 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2432 wrote to memory of 4008 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2432 wrote to memory of 1536 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2432 wrote to memory of 1536 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2432 wrote to memory of 1536 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2432 wrote to memory of 1536 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2432 wrote to memory of 1536 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2432 wrote to memory of 1536 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2432 wrote to memory of 1536 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2432 wrote to memory of 1536 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2432 wrote to memory of 1536 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2432 wrote to memory of 1536 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2432 wrote to memory of 1536 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2432 wrote to memory of 1536 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2432 wrote to memory of 1536 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2432 wrote to memory of 1536 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2432 wrote to memory of 1536 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2432 wrote to memory of 1536 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2432 wrote to memory of 1536 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2432 wrote to memory of 1536 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2432 wrote to memory of 1536 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2432 wrote to memory of 1536 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2432 wrote to memory of 1536 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2432 wrote to memory of 1536 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2432 wrote to memory of 1536 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2432 wrote to memory of 1536 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2432 wrote to memory of 1536 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2432 wrote to memory of 1536 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2432 wrote to memory of 1536 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2432 wrote to memory of 1536 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2432 wrote to memory of 1536 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2432 wrote to memory of 1536 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2432 wrote to memory of 1536 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2432 wrote to memory of 1536 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2432 wrote to memory of 1536 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2432 wrote to memory of 1536 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2432 wrote to memory of 1536 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2432 wrote to memory of 1536 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2432 wrote to memory of 1536 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2432 wrote to memory of 1536 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2432 wrote to memory of 1536 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2432 wrote to memory of 1536 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2432 wrote to memory of 1180 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2432 wrote to memory of 1180 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2432 wrote to memory of 3964 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2432 wrote to memory of 3964 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2432 wrote to memory of 3964 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2432 wrote to memory of 3964 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2432 wrote to memory of 3964 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2432 wrote to memory of 3964 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2432 wrote to memory of 3964 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2432 wrote to memory of 3964 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2432 wrote to memory of 3964 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2432 wrote to memory of 3964 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2432 wrote to memory of 3964 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2432 wrote to memory of 3964 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2432 wrote to memory of 3964 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2432 wrote to memory of 3964 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2432 wrote to memory of 3964 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2432 wrote to memory of 3964 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2432 wrote to memory of 3964 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2432 wrote to memory of 3964 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2432 wrote to memory of 3964 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2432 wrote to memory of 3964 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Views/modifies file attributes

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\76c75318d96c33c268f5e3454b1d220761c3a62a94775fee7e6df6423dd7e8d0.exe

"C:\Users\Admin\AppData\Local\Temp\76c75318d96c33c268f5e3454b1d220761c3a62a94775fee7e6df6423dd7e8d0.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\README_TO_DECRYPT.html

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffa7a3046f8,0x7ffa7a304708,0x7ffa7a304718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,2498696881479843462,10409687636470896852,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,2498696881479843462,10409687636470896852,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2272 /prefetch:3

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,2498696881479843462,10409687636470896852,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2996 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,2498696881479843462,10409687636470896852,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3580 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,2498696881479843462,10409687636470896852,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3592 /prefetch:1

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\\0E56B1EF.bat" "C:\Users\Admin\AppData\Local\Temp\76c75318d96c33c268f5e3454b1d220761c3a62a94775fee7e6df6423dd7e8d0.exe""

C:\Windows\SysWOW64\attrib.exe

attrib -s -r -h "C:\Users\Admin\AppData\Local\Temp\76c75318d96c33c268f5e3454b1d220761c3a62a94775fee7e6df6423dd7e8d0.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,2498696881479843462,10409687636470896852,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5104 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x240,0x244,0x248,0x21c,0x24c,0x7ff73de35460,0x7ff73de35470,0x7ff73de35480

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,2498696881479843462,10409687636470896852,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5104 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,2498696881479843462,10409687636470896852,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5528 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,2498696881479843462,10409687636470896852,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5544 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,2498696881479843462,10409687636470896852,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5408 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,2498696881479843462,10409687636470896852,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5412 /prefetch:1

Network

Country Destination Domain Proto
US 52.109.13.63:443 tcp
US 93.184.220.29:80 tcp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 93.184.220.29:80 tcp
US 8.8.8.8:53 29.220.184.93.in-addr.arpa udp
US 8.8.8.8:53 202.74.101.95.in-addr.arpa udp
US 8.8.8.8:53 250.255.255.239.in-addr.arpa udp
N/A 224.0.0.251:5353 udp
US 117.18.237.29:80 tcp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 192.124.249.24:80 tcp
US 192.124.249.24:80 tcp

Files

C:\Users\Admin\3D Objects\README_TO_DECRYPT.html

MD5 548ae2481a4f87619a2ce6494ee199fe
SHA1 062dd0f89cf6a29fd5bfa98cc8acbe9222ca37a8
SHA256 c3685c6906143c640c7ba6767ba0415c32d55dba9f0a2840d21324621835389b
SHA512 62e8fa7a34d6c97997c893ea849a7df74aed8117aebe454bbcb47cb93ad1382919f03ab0d5ed7bb1f464c6d7841014e99e82afd3780407dd2f77601b752a5aa4

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 78c7656527762ed2977adf983a6f4766
SHA1 21a66d2eefcb059371f4972694057e4b1f827ce6
SHA256 e1000099751602ae1adcec6f1c74e1d65f472936817b45239dfed4b043984296
SHA512 0a8e58ae95163b3cdf8e81b5085887761e73cb7c836a1a6a972e837fb3df69b2ac70cfd6311d06d40656344ec35eb48e512f007561480f0345486ac2b329be0b

memory/1536-391-0x00007FFA97140000-0x00007FFA97141000-memory.dmp

\??\pipe\LOCAL\crashpad_2432_OMOCOTKBNOXRXFMC

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

MD5 e5e3377341056643b0494b6842c0b544
SHA1 d53fd8e256ec9d5cef8ef5387872e544a2df9108
SHA256 e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25
SHA512 83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 099b4ba2787e99b696fc61528100f83f
SHA1 06e1f8b7391e1d548e49a1022f6ce6e7aa61f292
SHA256 cdb1db488e260ed750edfe1c145850b57ee8ab819d75237a167e673116a33ee8
SHA512 4309375e10785564ceb03e0127ced414e366a5b833f16a60d796471d871b479e4c044db5268902d9dfd14715ca577cb26042bab8f7b0f31fe8abf33947feb9d1

C:\Users\Admin\Desktop\README_TO_DECRYPT.html

MD5 548ae2481a4f87619a2ce6494ee199fe
SHA1 062dd0f89cf6a29fd5bfa98cc8acbe9222ca37a8
SHA256 c3685c6906143c640c7ba6767ba0415c32d55dba9f0a2840d21324621835389b
SHA512 62e8fa7a34d6c97997c893ea849a7df74aed8117aebe454bbcb47cb93ad1382919f03ab0d5ed7bb1f464c6d7841014e99e82afd3780407dd2f77601b752a5aa4

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\MANIFEST-000001

MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\CURRENT

MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 f1da646167d29e35745661e92ef09be3
SHA1 4bfdd1f9380a4a050e2c4c87d461de24a7b3ad0a
SHA256 3778c9079691688b1a5ad295c2f9c00854be0f4b4c083a0c58e25b91b09f5925
SHA512 ca9c96e3d92c9d2a89ed0dd086aa8c7819f69561a2c48c73d7955406ae6d6163ce585e56bc8598095a6d664068789cf9c6e0d2c50e6e78723122a2b48d21d762

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

MD5 02ee7addc9e8a2d07af55556ebf0ff5c
SHA1 020161bb64ecb7c6e6886ccc055908984dc651d8
SHA256 552d3ed359b7a52278ce621674d16428d8a7969f6cd5663df18e240cce66aadc
SHA512 567989543c3848a0c3276d96b96ca761f750e4b71fb74f36d809f590ffe16a72fd5ece251737a8b1ffe65f0051e211bd7ad19d2b8b0b7ca1b7ffc86dd2a52883

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Microsoft Edge.lnk

MD5 f4c031131e068697e8da9d6d8ac6bf73
SHA1 f30d47ef6dbc7289e1a688caf85dbb6d987ab17c
SHA256 9fad70b1600b16d4c032c83d8a6db7d996117e97fd59c30033f62cefe3d1e40b
SHA512 056d0d5385b6a0238ec82076d469b1f4247f43b6ac11e4901874e06d2c8c86b912c48cb9d7918ed0ec8451fa6c77d4fddf16f788832e6fdc46107352df33084b

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

MD5 12a512342a9c9c57c00baa255cf04b02
SHA1 797bce3168b7a86ef37ebd4b7227d8ea301483ea
SHA256 98aab88ea4e3a5eed8d52abdce51f4c6db06ead3bdf2f69bb051ad7aa2ac00ad
SHA512 0f635552798316ce7098a7a6fd965dba2e48c65f180dabd3c91aa9fec47f48f0e374222f5c952a44a0006663b76aabc1cc080dfb658f5f14e3482be2b6cc7a3f

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

C:\Users\Admin\AppData\Local\Temp\0E56B1EF.bat

MD5 348cae913e496198548854f5ff2f6d1e
SHA1 a07655b9020205bd47084afd62a8bb22b48c0cdc
SHA256 c80128f51871eec3ae2057989a025ce244277c1c180498a5aaef45d5214b8506
SHA512 799796736d41d3fcb5a7c859571bb025ca2d062c4b86e078302be68c1a932ed4f78e003640df5405274364b5a9a9c0ba5e37177997683ee7ab54e5267590b611

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 00a2b81c7d4529e811f4a3ec07e8d92c
SHA1 6af0f0a20ae75f33341d9b011126bb2cf73c0b1e
SHA256 5a0858c32c42c18475e87d2d68907d4f4be8b24bd9d0a0cffb132e7f90c5bde8
SHA512 76db7b137bf4159762e0cfde325f8e549250848512bdef964127a5a801992024b4ce7ff33607537ed7e307a203da40043d2b421d4116eb3ff57fbada877f9afc

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 e8216d34bb5406da510118349c86e3fd
SHA1 48047b7eb9c0bc780ff892d5dbe58158370ce499
SHA256 0462e19159e3f2a7242061eb4a33410278f773ad397691c4fe3ebf5071ccc01c
SHA512 de3002565ca44ca3540a3bf9c3e05eb0fd1fec9ef1a97c407bec58b904fb0cc7d552f73e4b54359cb36b22b2dbdd9f4afc4af60a116d189c46da33963c7eaff6

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 7724d5e6499ba1e428f587231810c858
SHA1 c9031fa86d565f8b454994a6e3513c95c7fb537c
SHA256 50698a2dd5e94a63a6cd4b0bed0e852a436f076b04d25aca55210c6bf554f62c
SHA512 3c7bd3969a2f1466f029bbab64f201de85b5e6fb02b045f882cdb1f82439f35779372f8d8e6511b56053650673cac9e841ba2ac82fbfc8cc882ec6dcf17ffb90