medusalocker | 26af2222204fca27c0fdabf9eefbfdb638a8a9322b297119f85cce3c708090f0

Resubmissions

11-04-2024 18:57

240411-xl1ypsdc9v 10

28-03-2023 10:46

230328-mve3gscb91 10

Analysis

max time kernel
84s
max time network
86s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
28-03-2023 10:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

medusa.exe
Size

669KB
MD5

646698572afbbf24f50ec5681feb2db7
SHA1

70530bc23bad38e6aee66cbb2c2f58a96a18fb79
SHA256

26af2222204fca27c0fdabf9eefbfdb638a8a9322b297119f85cce3c708090f0
SHA512

89bad552a3c0d8b28550957872561d03bf239d2708d616f21cbf22e58ae749542b07eee00fedac6fdb83c5969f50ea0f56fc103264a164671a94e156f73f160a
SSDEEP

12288:dQA0FfTcwpBuV2UxqDmuiLZeUaoFi2XZWfGe615HhAZV8D4KD/KeX:Tuf4wTuV2Ux3uIZeUBi2Te6HWdKrKe

Score

10^/10

medusalocker evasion ransomware spyware stealer trojan

Malware Config

Extracted

Path

\Device\HarddiskVolume1\Boot\how_to_back_files.html

Ransom Note

<html> <style type="text/css"> body { background-color: #f5f5f5; } h1, h3{ text-align: center; text-transform: uppercase; font-weight: normal; } /*---*/ .tabs1{ display: block; margin: auto; } .tabs1 .head{ text-align: center; float: top; padding: 0px; text-transform: uppercase; font-weight: normal; display: block; background: #81bef7; color: #DF0101; font-size: 30px; } .tabs1 .identi { font-size: 10px; text-align: center; float: top; padding: 15px; display: block; background: #81bef7; color: #DFDFDF; word-break: break-all; } .tabs .content { background: #f5f5f5; /*text-align: center;*/ color: #000000; padding: 25px 15px; font-size: 15px; font-weight: 400; line-height: 20px; } .tabs .content a { color: #df0130; font-size: 23px; font-style: italic; text-decoration: none; line-height: 35px; } .tabs .content .text{ padding: 25px; line-height: 1.2; } </style> <body> <div class="tabs1"> <div class="head" ><b>Your personal ID:</b></div> <div class="identi"> <span style="width:1000px; color: #ffffff; font-size: 10px;">B42D2CAA662AC0F205F8511F54784B4F3F3948D613C2F0B769C273B8E58325A82AFE7887DCC94DF3D98B4D7CFFAFEB775CAFA8DA2FA4FFC44139CE54043D6A7F<br>099EB88563583ADEC64599734824FF42D4FA8A757DD5F14E2A6EA78FF14FC5F50D9F38FAB1FFBF4E7C96C7C57507C06E31568670DCD43EB5626DD2535B96<br>375F1AF08DD392FE6D3E673CFA8AAF89EC9E44F8B2B9E997A4321AA0CF4261B7D1AE7C97E030587AA1EE9A73B88E23B2304B058951DB72B6629009DC60C9<br>74F210CD039A7C5DB762DB380044533470A495BAACAAB7EACC0B20A150574705E42077C8636313B17F9CF17D6F6303C913669E4154753BFAF34C4ABB8D62<br>D910FE7A1C30CB781BFFF6F580D17E239F50FDB934B97994E70C55F13FBF3BDB8D1ACC378CC918E294866DA4EA43C15E946F2DC3EE1D11DC44B69E2DF4A7<br>FE4CEB1694FCD33BD6D67D638C990AFD4583C3902DD91024C39E92C01BE64D3A33EBC5599740DE3346E7F42C19A9451A6A671629614F84D6C19C68F3F981<br>25F585B070735062F41A578A5B21E688F1D1AA22D7BB1E0D47F7944A65217A6EC19A7826DC21B83FDF2E9649FD8054D5570C3ECC08B3C35B37AF0170E841<br>8021677C4F2979D2523F04609C522B4E5B5DEA7287DA615F038757F3E018A880697B6A7D20514BF50FD1BF313BAD70CB2C5D93A54A68E055EF1F92B32149<br>C184F7C14707D136F1A01111B10A</span> <br>  </div> </div>  <div class="tabs">  <div class="tab"> <div id="tab-content1" class="content"> <div class="text">  <b>/!\ YOUR COMPANY NETWORK HAS BEEN PENETRATED /!\</b><br> <b>All your important files have been encrypted!</b><br><br> <hr> Your files are safe! Only modified. (RSA+AES)<br><br> ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE<br> WILL PERMANENTLY CORRUPT IT.<br> DO NOT MODIFY ENCRYPTED FILES.<br> DO NOT RENAME ENCRYPTED FILES.<br><br> No software available on internet can help you. We are the only ones able to<br> solve your problem.<br><br> We gathered highly confidential/personal data. These data are currently stored on<br> a private server. This server will be immediately destroyed after your payment.<br> If you decide to not pay, we will release your data to public or re-seller.<br> So you can expect your data to be publicly available in the near future..<br><br> We only seek money and our goal is not to damage your reputation or prevent<br> your business from running.<br><br> You will can send us 2-3 non-important files and we will decrypt it for free<br> to prove we are able to give your files back.<br><br>  <hr> <b>Contact us for price and get decryption software.</b><br><br> <a>qd7pcafncosqfqu3ha6fcx4h6sr7tzwagzpcdcnytiw3b6varaeqv5yd.onion</a><br> * Note that this server is available via Tor browser only<br><br> Follow the instructions to open the link:<br> 1. Type the addres "https://www.torproject.org" in your Internet browser. It opens the Tor site.<br> 2. Press "Download Tor", then press "Download Tor Browser Bundle", install and run it.<br> 3. Now you have Tor browser. In the Tor Browser open <a>qd7pcafncosqfqu3ha6fcx4h6sr7tzwagzpcdcnytiw3b6varaeqv5yd.onion<br> </a> 4. Start a chat and follow the further instructions. <br> <hr> <b>If you can not use the above link, use the email:</b><br> <a href="ithelp02@decorous.cyou ">ithelp02@decorous.cyou </a> <br> <a href="ithelp02@wholeness.business ">ithelp02@wholeness.business </a> <br> <p>* To contact us, create a new free email account on the site: <a href="https://protonmail.com">protonmail.com <br> <b> IF YOU DON'T CONTACT US WITHIN 72 HOURS, PRICE WILL BE HIGHER.</b><br> </div> </div> </div>   </div> </div>  </div> </div> </body> </html>

Emails

href="ithelp02@decorous.cyou

">ithelp02@decorous.cyou

href="ithelp02@wholeness.business

">ithelp02@wholeness.business

Extracted

Path

C:\Users\Public\Desktop\how_to_back_files.html

Family

medusalocker

Ransom Note

Your personal ID: B42D2CAA662AC0F205F8511F54784B4F3F3948D613C2F0B769C273B8E58325A82AFE7887DCC94DF3D98B4D7CFFAFEB775CAFA8DA2FA4FFC44139CE54043D6A7F 099EB88563583ADEC64599734824FF42D4FA8A757DD5F14E2A6EA78FF14FC5F50D9F38FAB1FFBF4E7C96C7C57507C06E31568670DCD43EB5626DD2535B96 375F1AF08DD392FE6D3E673CFA8AAF89EC9E44F8B2B9E997A4321AA0CF4261B7D1AE7C97E030587AA1EE9A73B88E23B2304B058951DB72B6629009DC60C9 74F210CD039A7C5DB762DB380044533470A495BAACAAB7EACC0B20A150574705E42077C8636313B17F9CF17D6F6303C913669E4154753BFAF34C4ABB8D62 D910FE7A1C30CB781BFFF6F580D17E239F50FDB934B97994E70C55F13FBF3BDB8D1ACC378CC918E294866DA4EA43C15E946F2DC3EE1D11DC44B69E2DF4A7 FE4CEB1694FCD33BD6D67D638C990AFD4583C3902DD91024C39E92C01BE64D3A33EBC5599740DE3346E7F42C19A9451A6A671629614F84D6C19C68F3F981 25F585B070735062F41A578A5B21E688F1D1AA22D7BB1E0D47F7944A65217A6EC19A7826DC21B83FDF2E9649FD8054D5570C3ECC08B3C35B37AF0170E841 8021677C4F2979D2523F04609C522B4E5B5DEA7287DA615F038757F3E018A880697B6A7D20514BF50FD1BF313BAD70CB2C5D93A54A68E055EF1F92B32149 C184F7C14707D136F1A01111B10A /!\ YOUR COMPANY NETWORK HAS BEEN PENETRATED /!\ All your important files have been encrypted! Your files are safe! Only modified. (RSA+AES) ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE WILL PERMANENTLY CORRUPT IT. DO NOT MODIFY ENCRYPTED FILES. DO NOT RENAME ENCRYPTED FILES. No software available on internet can help you. We are the only ones able to solve your problem. We gathered highly confidential/personal data. These data are currently stored on a private server. This server will be immediately destroyed after your payment. If you decide to not pay, we will release your data to public or re-seller. So you can expect your data to be publicly available in the near future.. We only seek money and our goal is not to damage your reputation or prevent your business from running. You will can send us 2-3 non-important files and we will decrypt it for free to prove we are able to give your files back. Contact us for price and get decryption software. qd7pcafncosqfqu3ha6fcx4h6sr7tzwagzpcdcnytiw3b6varaeqv5yd.onion * Note that this server is available via Tor browser only Follow the instructions to open the link: 1. Type the addres "https://www.torproject.org" in your Internet browser. It opens the Tor site. 2. Press "Download Tor", then press "Download Tor Browser Bundle", install and run it. 3. Now you have Tor browser. In the Tor Browser open qd7pcafncosqfqu3ha6fcx4h6sr7tzwagzpcdcnytiw3b6varaeqv5yd.onion 4. Start a chat and follow the further instructions. If you can not use the above link, use the email: ithelp02@decorous.cyou ithelp02@wholeness.business * To contact us, create a new free email account on the site: protonmail.com IF YOU DON'T CONTACT US WITHIN 72 HOURS, PRICE WILL BE HIGHER.

Emails

ithelp02@decorous.cyou

ithelp02@wholeness.business

Signatures

MedusaLocker
Ransomware with several variants first seen in September 2019.
ransomware medusalocker

MedusaLocker payload 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Roaming\svhost.exe	family_medusalocker
C:\Users\Admin\AppData\Roaming\svhost.exe	family_medusalocker

UAC bypass 3 TTPs 2 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

medusa.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	medusa.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	medusa.exe

Modifies extensions of user files 7 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

medusa.exe

description	ioc	process
File renamed	C:\Users\Admin\Pictures\SetInitialize.tif => C:\Users\Admin\Pictures\SetInitialize.tif.onelock	medusa.exe
File opened for modification	C:\Users\Admin\Pictures\DisableUpdate.tiff	medusa.exe
File renamed	C:\Users\Admin\Pictures\DisableUpdate.tiff => C:\Users\Admin\Pictures\DisableUpdate.tiff.onelock	medusa.exe
File renamed	C:\Users\Admin\Pictures\DismountConvert.tif => C:\Users\Admin\Pictures\DismountConvert.tif.onelock	medusa.exe
File opened for modification	C:\Users\Admin\Pictures\GrantRestart.tiff	medusa.exe
File renamed	C:\Users\Admin\Pictures\GrantRestart.tiff => C:\Users\Admin\Pictures\GrantRestart.tiff.onelock	medusa.exe
File renamed	C:\Users\Admin\Pictures\RegisterAssert.tif => C:\Users\Admin\Pictures\RegisterAssert.tif.onelock	medusa.exe

Executes dropped EXE 1 IoCs

Processes:

svhost.exe

pid process

5516 svhost.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

medusa.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" medusa.exe
Drops desktop.ini file(s) 1 IoCs

Processes:

medusa.exe

description ioc process

File opened for modification \??\Z:\$RECYCLE.BIN\S-1-5-21-2275444769-3691835758-4097679484-1000\desktop.ini medusa.exe

pid	process
5516	svhost.exe

description	ioc	process
File opened for modification	\??\Z:\$RECYCLE.BIN\S-1-5-21-2275444769-3691835758-4097679484-1000\desktop.ini	medusa.exe

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

medusa.exe

description	ioc	process
File opened (read-only)	\??\Z:	medusa.exe
File opened (read-only)	\??\A:	medusa.exe
File opened (read-only)	\??\J:	medusa.exe
File opened (read-only)	\??\M:	medusa.exe
File opened (read-only)	\??\Q:	medusa.exe
File opened (read-only)	\??\S:	medusa.exe
File opened (read-only)	\??\X:	medusa.exe
File opened (read-only)	\??\V:	medusa.exe
File opened (read-only)	\??\B:	medusa.exe
File opened (read-only)	\??\G:	medusa.exe
File opened (read-only)	\??\H:	medusa.exe
File opened (read-only)	\??\L:	medusa.exe
File opened (read-only)	\??\R:	medusa.exe
File opened (read-only)	\??\T:	medusa.exe
File opened (read-only)	\??\Y:	medusa.exe
File opened (read-only)	\??\E:	medusa.exe
File opened (read-only)	\??\N:	medusa.exe
File opened (read-only)	\??\O:	medusa.exe
File opened (read-only)	\??\P:	medusa.exe
File opened (read-only)	\??\U:	medusa.exe
File opened (read-only)	\??\W:	medusa.exe
File opened (read-only)	\??\F:	medusa.exe
File opened (read-only)	\??\I:	medusa.exe
File opened (read-only)	\??\K:	medusa.exe

Drops file in Program Files directory 2 IoCs

Processes:

setup.exe

description	ioc	process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\12db20af-c2cf-4a46-a311-fcb55b1e349f.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20230328124742.pma	setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

Processes:

msedge.exe

description ioc process

Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msedge.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

medusa.exe

pid	process
2296	medusa.exe
2296	medusa.exe
2296	medusa.exe
2296	medusa.exe
2296	medusa.exe
2296	medusa.exe
2296	medusa.exe
2296	medusa.exe
2296	medusa.exe
2296	medusa.exe
2296	medusa.exe
2296	medusa.exe
2296	medusa.exe
2296	medusa.exe
2296	medusa.exe
2296	medusa.exe
2296	medusa.exe
2296	medusa.exe
2296	medusa.exe
2296	medusa.exe
2296	medusa.exe
2296	medusa.exe
2296	medusa.exe
2296	medusa.exe
2296	medusa.exe
2296	medusa.exe
2296	medusa.exe
2296	medusa.exe
2296	medusa.exe
2296	medusa.exe
2296	medusa.exe
2296	medusa.exe
2296	medusa.exe
2296	medusa.exe
2296	medusa.exe
2296	medusa.exe
2296	medusa.exe
2296	medusa.exe
2296	medusa.exe
2296	medusa.exe
2296	medusa.exe
2296	medusa.exe
2296	medusa.exe
2296	medusa.exe
2296	medusa.exe
2296	medusa.exe
2296	medusa.exe
2296	medusa.exe
2296	medusa.exe
2296	medusa.exe
2296	medusa.exe
2296	medusa.exe
2296	medusa.exe
2296	medusa.exe
2296	medusa.exe
2296	medusa.exe
2296	medusa.exe
2296	medusa.exe
2296	medusa.exe
2296	medusa.exe
2296	medusa.exe
2296	medusa.exe
2296	medusa.exe
2296	medusa.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

Processes:

msedge.exe

pid process

1036 msedge.exe
1036 msedge.exe
1036 msedge.exe
1036 msedge.exe
1036 msedge.exe
1036 msedge.exe

pid	process
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe

Suspicious use of AdjustPrivilegeToken 63 IoCs

Processes:

wmic.exewmic.exewmic.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	1672	wmic.exe
Token: SeSecurityPrivilege	1672	wmic.exe
Token: SeTakeOwnershipPrivilege	1672	wmic.exe
Token: SeLoadDriverPrivilege	1672	wmic.exe
Token: SeSystemProfilePrivilege	1672	wmic.exe
Token: SeSystemtimePrivilege	1672	wmic.exe
Token: SeProfSingleProcessPrivilege	1672	wmic.exe
Token: SeIncBasePriorityPrivilege	1672	wmic.exe
Token: SeCreatePagefilePrivilege	1672	wmic.exe
Token: SeBackupPrivilege	1672	wmic.exe
Token: SeRestorePrivilege	1672	wmic.exe
Token: SeShutdownPrivilege	1672	wmic.exe
Token: SeDebugPrivilege	1672	wmic.exe
Token: SeSystemEnvironmentPrivilege	1672	wmic.exe
Token: SeRemoteShutdownPrivilege	1672	wmic.exe
Token: SeUndockPrivilege	1672	wmic.exe
Token: SeManageVolumePrivilege	1672	wmic.exe
Token: 33	1672	wmic.exe
Token: 34	1672	wmic.exe
Token: 35	1672	wmic.exe
Token: 36	1672	wmic.exe
Token: SeIncreaseQuotaPrivilege	2348	wmic.exe
Token: SeSecurityPrivilege	2348	wmic.exe
Token: SeTakeOwnershipPrivilege	2348	wmic.exe
Token: SeLoadDriverPrivilege	2348	wmic.exe
Token: SeSystemProfilePrivilege	2348	wmic.exe
Token: SeSystemtimePrivilege	2348	wmic.exe
Token: SeProfSingleProcessPrivilege	2348	wmic.exe
Token: SeIncBasePriorityPrivilege	2348	wmic.exe
Token: SeCreatePagefilePrivilege	2348	wmic.exe
Token: SeBackupPrivilege	2348	wmic.exe
Token: SeRestorePrivilege	2348	wmic.exe
Token: SeShutdownPrivilege	2348	wmic.exe
Token: SeDebugPrivilege	2348	wmic.exe
Token: SeSystemEnvironmentPrivilege	2348	wmic.exe
Token: SeRemoteShutdownPrivilege	2348	wmic.exe
Token: SeUndockPrivilege	2348	wmic.exe
Token: SeManageVolumePrivilege	2348	wmic.exe
Token: 33	2348	wmic.exe
Token: 34	2348	wmic.exe
Token: 35	2348	wmic.exe
Token: 36	2348	wmic.exe
Token: SeIncreaseQuotaPrivilege	5004	wmic.exe
Token: SeSecurityPrivilege	5004	wmic.exe
Token: SeTakeOwnershipPrivilege	5004	wmic.exe
Token: SeLoadDriverPrivilege	5004	wmic.exe
Token: SeSystemProfilePrivilege	5004	wmic.exe
Token: SeSystemtimePrivilege	5004	wmic.exe
Token: SeProfSingleProcessPrivilege	5004	wmic.exe
Token: SeIncBasePriorityPrivilege	5004	wmic.exe
Token: SeCreatePagefilePrivilege	5004	wmic.exe
Token: SeBackupPrivilege	5004	wmic.exe
Token: SeRestorePrivilege	5004	wmic.exe
Token: SeShutdownPrivilege	5004	wmic.exe
Token: SeDebugPrivilege	5004	wmic.exe
Token: SeSystemEnvironmentPrivilege	5004	wmic.exe
Token: SeRemoteShutdownPrivilege	5004	wmic.exe
Token: SeUndockPrivilege	5004	wmic.exe
Token: SeManageVolumePrivilege	5004	wmic.exe
Token: 33	5004	wmic.exe
Token: 34	5004	wmic.exe
Token: 35	5004	wmic.exe
Token: 36	5004	wmic.exe

Suspicious use of FindShellTrayWindow 4 IoCs

Processes:

msedge.exe

pid process

1036 msedge.exe
1036 msedge.exe
1036 msedge.exe
1036 msedge.exe

pid	process
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

medusa.exemsedge.exe

description	pid	process	target process
PID 2296 wrote to memory of 1672	2296	medusa.exe	wmic.exe
PID 2296 wrote to memory of 1672	2296	medusa.exe	wmic.exe
PID 2296 wrote to memory of 1672	2296	medusa.exe	wmic.exe
PID 2296 wrote to memory of 2348	2296	medusa.exe	wmic.exe
PID 2296 wrote to memory of 2348	2296	medusa.exe	wmic.exe
PID 2296 wrote to memory of 2348	2296	medusa.exe	wmic.exe
PID 2296 wrote to memory of 5004	2296	medusa.exe	wmic.exe
PID 2296 wrote to memory of 5004	2296	medusa.exe	wmic.exe
PID 2296 wrote to memory of 5004	2296	medusa.exe	wmic.exe
PID 1036 wrote to memory of 3696	1036	msedge.exe	msedge.exe
PID 1036 wrote to memory of 3696	1036	msedge.exe	msedge.exe
PID 1036 wrote to memory of 3436	1036	msedge.exe	msedge.exe
PID 1036 wrote to memory of 3436	1036	msedge.exe	msedge.exe
PID 1036 wrote to memory of 3436	1036	msedge.exe	msedge.exe
PID 1036 wrote to memory of 3436	1036	msedge.exe	msedge.exe
PID 1036 wrote to memory of 3436	1036	msedge.exe	msedge.exe
PID 1036 wrote to memory of 3436	1036	msedge.exe	msedge.exe
PID 1036 wrote to memory of 3436	1036	msedge.exe	msedge.exe
PID 1036 wrote to memory of 3436	1036	msedge.exe	msedge.exe
PID 1036 wrote to memory of 3436	1036	msedge.exe	msedge.exe
PID 1036 wrote to memory of 3436	1036	msedge.exe	msedge.exe
PID 1036 wrote to memory of 3436	1036	msedge.exe	msedge.exe
PID 1036 wrote to memory of 3436	1036	msedge.exe	msedge.exe
PID 1036 wrote to memory of 3436	1036	msedge.exe	msedge.exe
PID 1036 wrote to memory of 3436	1036	msedge.exe	msedge.exe
PID 1036 wrote to memory of 3436	1036	msedge.exe	msedge.exe
PID 1036 wrote to memory of 3436	1036	msedge.exe	msedge.exe
PID 1036 wrote to memory of 3436	1036	msedge.exe	msedge.exe
PID 1036 wrote to memory of 3436	1036	msedge.exe	msedge.exe
PID 1036 wrote to memory of 3436	1036	msedge.exe	msedge.exe
PID 1036 wrote to memory of 3436	1036	msedge.exe	msedge.exe
PID 1036 wrote to memory of 3436	1036	msedge.exe	msedge.exe
PID 1036 wrote to memory of 3436	1036	msedge.exe	msedge.exe
PID 1036 wrote to memory of 3436	1036	msedge.exe	msedge.exe
PID 1036 wrote to memory of 3436	1036	msedge.exe	msedge.exe
PID 1036 wrote to memory of 3436	1036	msedge.exe	msedge.exe
PID 1036 wrote to memory of 3436	1036	msedge.exe	msedge.exe
PID 1036 wrote to memory of 3436	1036	msedge.exe	msedge.exe
PID 1036 wrote to memory of 3436	1036	msedge.exe	msedge.exe
PID 1036 wrote to memory of 3436	1036	msedge.exe	msedge.exe
PID 1036 wrote to memory of 3436	1036	msedge.exe	msedge.exe
PID 1036 wrote to memory of 3436	1036	msedge.exe	msedge.exe
PID 1036 wrote to memory of 3436	1036	msedge.exe	msedge.exe
PID 1036 wrote to memory of 3436	1036	msedge.exe	msedge.exe
PID 1036 wrote to memory of 3436	1036	msedge.exe	msedge.exe
PID 1036 wrote to memory of 3436	1036	msedge.exe	msedge.exe
PID 1036 wrote to memory of 3436	1036	msedge.exe	msedge.exe
PID 1036 wrote to memory of 3436	1036	msedge.exe	msedge.exe
PID 1036 wrote to memory of 3436	1036	msedge.exe	msedge.exe
PID 1036 wrote to memory of 3436	1036	msedge.exe	msedge.exe
PID 1036 wrote to memory of 3436	1036	msedge.exe	msedge.exe
PID 1036 wrote to memory of 2784	1036	msedge.exe	msedge.exe
PID 1036 wrote to memory of 2784	1036	msedge.exe	msedge.exe
PID 1036 wrote to memory of 1492	1036	msedge.exe	msedge.exe
PID 1036 wrote to memory of 1492	1036	msedge.exe	msedge.exe
PID 1036 wrote to memory of 1492	1036	msedge.exe	msedge.exe
PID 1036 wrote to memory of 1492	1036	msedge.exe	msedge.exe
PID 1036 wrote to memory of 1492	1036	msedge.exe	msedge.exe
PID 1036 wrote to memory of 1492	1036	msedge.exe	msedge.exe
PID 1036 wrote to memory of 1492	1036	msedge.exe	msedge.exe
PID 1036 wrote to memory of 1492	1036	msedge.exe	msedge.exe
PID 1036 wrote to memory of 1492	1036	msedge.exe	msedge.exe
PID 1036 wrote to memory of 1492	1036	msedge.exe	msedge.exe
PID 1036 wrote to memory of 1492	1036	msedge.exe	msedge.exe

System policy modification 1 TTPs 3 IoCs

evasion

Modify Registry

T1112

Processes:

medusa.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	medusa.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	medusa.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1"	medusa.exe

C:\Users\Admin\AppData\Local\Temp\medusa.exe
"C:\Users\Admin\AppData\Local\Temp\medusa.exe"
1⤵
- UAC bypass
- Modifies extensions of user files
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2296

C:\Windows\SysWOW64\Wbem\wmic.exe
wmic.exe SHADOWCOPY /nointeractive
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1672

C:\Windows\SysWOW64\Wbem\wmic.exe
wmic.exe SHADOWCOPY /nointeractive
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2348

C:\Windows\SysWOW64\Wbem\wmic.exe
wmic.exe SHADOWCOPY /nointeractive
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:5004

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Public\Desktop\how_to_back_files.html
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1036

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8f04746f8,0x7ff8f0474708,0x7ff8f0474718
2⤵
PID:3696

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,6314241710995674479,14019599904865060033,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:2
2⤵
PID:3436

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,6314241710995674479,14019599904865060033,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2244 /prefetch:3
2⤵
PID:2784

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,6314241710995674479,14019599904865060033,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2740 /prefetch:8
2⤵
PID:1492

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,6314241710995674479,14019599904865060033,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3628 /prefetch:1
2⤵
PID:4132

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,6314241710995674479,14019599904865060033,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3612 /prefetch:1
2⤵
PID:1972

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,6314241710995674479,14019599904865060033,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5312 /prefetch:1
2⤵
PID:3372

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,6314241710995674479,14019599904865060033,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5296 /prefetch:1
2⤵
PID:2684

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,6314241710995674479,14019599904865060033,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5648 /prefetch:1
2⤵
PID:4976

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,6314241710995674479,14019599904865060033,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5556 /prefetch:1
2⤵
PID:2332

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
2⤵
- Drops file in Program Files directory
PID:1616

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x128,0x12c,0x124,0x254,0x120,0x7ff63c4b5460,0x7ff63c4b5470,0x7ff63c4b5480
3⤵
PID:4760

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,6314241710995674479,14019599904865060033,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5440 /prefetch:8
2⤵
PID:1252

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,6314241710995674479,14019599904865060033,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5440 /prefetch:8
2⤵
PID:5012

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4876

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5460

C:\Users\Admin\AppData\Roaming\svhost.exe
C:\Users\Admin\AppData\Roaming\svhost.exe
1⤵
- Executes dropped EXE
PID:5516

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Bypass User Account Control

T1088

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Query Registry

T1012

Peripheral Device Discovery

T1120

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
78c7656527762ed2977adf983a6f4766

SHA1
21a66d2eefcb059371f4972694057e4b1f827ce6

SHA256
e1000099751602ae1adcec6f1c74e1d65f472936817b45239dfed4b043984296

SHA512
0a8e58ae95163b3cdf8e81b5085887761e73cb7c836a1a6a972e837fb3df69b2ac70cfd6311d06d40656344ec35eb48e512f007561480f0345486ac2b329be0b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
099b4ba2787e99b696fc61528100f83f

SHA1
06e1f8b7391e1d548e49a1022f6ce6e7aa61f292

SHA256
cdb1db488e260ed750edfe1c145850b57ee8ab819d75237a167e673116a33ee8

SHA512
4309375e10785564ceb03e0127ced414e366a5b833f16a60d796471d871b479e4c044db5268902d9dfd14715ca577cb26042bab8f7b0f31fe8abf33947feb9d1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_1
Filesize
264KB

MD5
f4e028cd95083851798792408bf77c7b

SHA1
30388a712b6c36094b4477ddb810502c69d72130

SHA256
63c1a7e5a7815c3bcdfe5b26e78f31ac691ffb780ff51eea4faaef52d4b2e738

SHA512
4110faa82b3c3fa61c145a5b3a59b04b4e12901d5211782649ece1f5a30fe7b5497f39118882fc593814edd0baacb8922118db2e365ccf7a5d9229f0b2d5f338

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_2
Filesize
8KB

MD5
0962291d6d367570bee5454721c17e11

SHA1
59d10a893ef321a706a9255176761366115bedcb

SHA256
ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

SHA512
f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_3
Filesize
8KB

MD5
41876349cb12d6db992f1309f22df3f0

SHA1
5cf26b3420fc0302cd0a71e8d029739b8765be27

SHA256
e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c

SHA512
e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Microsoft Edge.lnk
Filesize
2KB

MD5
44f97d709e8a0b37a366f2074e83eb29

SHA1
06bd468d2e8696d3416bd139d26c0bf051467f51

SHA256
314454b72eacb2844d299e1325f32aca20ce9f7eb2a73e9a3cd875c967d33127

SHA512
2f18d1e61915108c4ebd8a61599ec1e53592849c1e51f4eeff6915502d266955a4b1008d6f619724fea81ec4deaed1a5fa0bbae3b40d8879b3754cf6162d0bab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
4KB

MD5
797ea77412e164257b6dcd353f17bd16

SHA1
002afa6f508fe5b7378c7f799d029a81a305e9fc

SHA256
411489c2d0ee7d409456eab6e6e9a5f4e98653be8568f2fe4fb073498d09f2f3

SHA512
672a87333245c07ef78212999732245b9a62827eb48f959632b5f294eb25e0051f4ba0e43ee735fc06e91d5ed6d7f6fb02a253e095eccc7bfad5b6039da3ec79

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
2f52c9d0705b771ea2336fa2b8d66869

SHA1
4deeee6886934c5d6c82f6d1eb8bdb6267e1bf5e

SHA256
bcc0060d526a941046beaa89ecf5c17348282f41fd4a706142602c9c694f9098

SHA512
d0a29b55270b7941e115a4946944888a441a21bcafee30dda9c51830d4bae9034d487f3d486375d1d6428dc05b049f0a6566936397ec0f4af29c566182f85da7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
21ffd6c41f50b4500341f913a00bb9b0

SHA1
d015c73a34ff9843e14e2c59801ad668301b8165

SHA256
8fbd055d0d011cd38c4bc5ba91005a4dc04f5d1a6f095dcb482b212c8d5ebcc3

SHA512
3e40e39dba7c001310fd0f9e7c69a5f23718e1b8aa9dfe3ee4a71b314fa54b6060447c7dec4f510e3a8b5a1c209308e6393d43782be95ecc365311422cab4cff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Filesize
24KB

MD5
02ee7addc9e8a2d07af55556ebf0ff5c

SHA1
020161bb64ecb7c6e6886ccc055908984dc651d8

SHA256
552d3ed359b7a52278ce621674d16428d8a7969f6cd5663df18e240cce66aadc

SHA512
567989543c3848a0c3276d96b96ca761f750e4b71fb74f36d809f590ffe16a72fd5ece251737a8b1ffe65f0051e211bd7ad19d2b8b0b7ca1b7ffc86dd2a52883

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\CURRENT
Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\MANIFEST-000001
Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
9KB

MD5
15dbe6a801346078dc11c54ece7d9f27

SHA1
a3a14f51dba16b30d9bf88fee90c2c293ea3891f

SHA256
5b957b2d6895e4192719ab3940170d1d21e8e284f7319383df50ff5d2d7ea965

SHA512
86f0d2ef7c12ce928227d39e614709957fb6a1217f7e97cf26b09692d9a1226ea306a5b8986ed615cc5fe0db16559ebd0ee7fdd54b698928c8ff48d8f8214ad3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
12KB

MD5
6f08e61afbf9d4985457b350c86b4e99

SHA1
59b40674fda70a04785df582f630bac8afeb3c70

SHA256
1846ae737b79dbccf515aeacb387e487a8ffd930a2bd233819989845fcd7665f

SHA512
c0851ad258c80b73b384dc73f5e4813933e631c10fa944ba1d6e04b1aeb8b1bce817cd943dfdd9804b9728ff73f6814e07e067adc6719a6416ce009177793d11

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
Filesize
3KB

MD5
dfc046c925f048402ddb58267c6a88b9

SHA1
20f7bdf4a9607be287423d48bc7a4a0acfc7dce2

SHA256
4153e0f47efc5ce5c2d346bc4ab29226748bba278429aa9bffa7aa05baea26f2

SHA512
3e7dd9f8ac17843fe17e67a37553c257270faec6c471f6f624978f86a64aff4099f8d8f06d0d7ba2d9b3601e227197ce4628f4688f7b3327c5dc3977e3240eed

Download Submit
C:\Users\Admin\AppData\Roaming\svhost.exe
Filesize
669KB

MD5
646698572afbbf24f50ec5681feb2db7

SHA1
70530bc23bad38e6aee66cbb2c2f58a96a18fb79

SHA256
26af2222204fca27c0fdabf9eefbfdb638a8a9322b297119f85cce3c708090f0

SHA512
89bad552a3c0d8b28550957872561d03bf239d2708d616f21cbf22e58ae749542b07eee00fedac6fdb83c5969f50ea0f56fc103264a164671a94e156f73f160a

Download Submit
C:\Users\Admin\AppData\Roaming\svhost.exe
Filesize
669KB

MD5
646698572afbbf24f50ec5681feb2db7

SHA1
70530bc23bad38e6aee66cbb2c2f58a96a18fb79

SHA256
26af2222204fca27c0fdabf9eefbfdb638a8a9322b297119f85cce3c708090f0

SHA512
89bad552a3c0d8b28550957872561d03bf239d2708d616f21cbf22e58ae749542b07eee00fedac6fdb83c5969f50ea0f56fc103264a164671a94e156f73f160a

Download Submit
C:\Users\Default\ntuser.dat.LOG2
Filesize
536B

MD5
5c3288dbf1d35fa3de903cc4d54165ff

SHA1
d4d1fa42b6481f6ec6712dd94dd67038b718af57

SHA256
2175c89d49488e5899a2553cccc5f5d7d004b516f7f8d7469635fe0b66c7f156

SHA512
5933d1fd1b0586275c1a8f8de390688ead4ba9585890a7be04e705b8feab9c325ce81f20e2ce0b6ca5f77ecbb3af83444c970ab6eb510af10cf5b31681a788a0

Download Submit
C:\Users\Public\Desktop\how_to_back_files.html
Filesize
4KB

MD5
83b0477889b911e23c8dc472e2ee0b79

SHA1
c72777a3771f0426d74da097aa3b9180d256ea99

SHA256
7934a17627a9a18da1a5f8dc0bf5ad92b7bb97f7c7994f75ddaf9fafe4117e9b

SHA512
7bd1e52bd30e858328939fe9bda0a06821e38f9614f9d30b7bfa810241f435597adfc7b684007a8074eb89acbcd4e79bb0ecb7630e375eb863a263e7d41ed8d3

Download Submit
\??\pipe\LOCAL\crashpad_1036_YWFTQSQLAXNBWENQ
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\Device\HarddiskVolume1\Boot\how_to_back_files.html
Filesize
4KB

MD5
83b0477889b911e23c8dc472e2ee0b79

SHA1
c72777a3771f0426d74da097aa3b9180d256ea99

SHA256
7934a17627a9a18da1a5f8dc0bf5ad92b7bb97f7c7994f75ddaf9fafe4117e9b

SHA512
7bd1e52bd30e858328939fe9bda0a06821e38f9614f9d30b7bfa810241f435597adfc7b684007a8074eb89acbcd4e79bb0ecb7630e375eb863a263e7d41ed8d3

Download Submit