troldesh | hxxps://github[.]com/Endermanch/MalwareDatabase/blob/master/ransomwares/NoMoreRansom[.]zip

Analysis

max time kernel
123s
max time network
117s
platform
windows10-2004_x64
resource
win10v2004-20230621-es
resource tags

arch:x64arch:x86image:win10v2004-20230621-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
30-06-2023 05:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/Endermanch/MalwareDatabase/blob/master/ransomwares/NoMoreRansom.zip

Score

10^/10

troldesh persistence ransomware trojan upx

Malware Config

Signatures

Troldesh, Shade, Encoder.858
Troldesh is a ransomware spread by malspam.
ransomware trojan troldesh

Executes dropped EXE 2 IoCs

pid	Process
4692	[email protected]
4128	[email protected]

UPX packed file 14 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/4692-471-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral1/memory/4692-473-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral1/memory/4692-474-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral1/memory/4692-475-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral1/memory/4692-477-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral1/memory/4692-507-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral1/memory/4692-508-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral1/memory/4128-511-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral1/memory/4128-512-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral1/memory/4692-513-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral1/memory/4128-514-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral1/memory/4692-517-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral1/memory/4692-518-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral1/memory/4692-519-0x0000000000400000-0x00000000005DE000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4025927695-1301755775-2607443251-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\	[email protected]
Set value (str)	\REGISTRY\USER\S-1-5-21-4025927695-1301755775-2607443251-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Client Server Runtime Subsystem = "\"C:\\ProgramData\\Windows\\csrss.exe\""	[email protected]

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\4acdea68-7026-4e62-8ce9-878c6c300911.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20230630050203.pma	setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4025927695-1301755775-2607443251-1000_Classes\Local Settings	powershell.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4025927695-1301755775-2607443251-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
3008	powershell.exe
3008	powershell.exe
4784	msedge.exe
4784	msedge.exe
2220	msedge.exe
2220	msedge.exe
1476	identity_helper.exe
1476	identity_helper.exe
2544	msedge.exe
2544	msedge.exe
4692	[email protected]
4692	[email protected]
4692	[email protected]
4692	[email protected]
4128	[email protected]
4128	[email protected]
4128	[email protected]
4128	[email protected]

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	3008	powershell.exe
Token: SeRestorePrivilege	2544	7zG.exe
Token: 35	2544	7zG.exe
Token: SeSecurityPrivilege	2544	7zG.exe
Token: SeSecurityPrivilege	2544	7zG.exe

Suspicious use of FindShellTrayWindow 20 IoCs

pid	Process
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2544	7zG.exe

Suspicious use of SendNotifyMessage 8 IoCs

pid	Process
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2220 wrote to memory of 4100	2220	msedge.exe	81
PID 2220 wrote to memory of 4100	2220	msedge.exe	81
PID 2220 wrote to memory of 2020	2220	msedge.exe	84
PID 2220 wrote to memory of 2020	2220	msedge.exe	84
PID 2220 wrote to memory of 2020	2220	msedge.exe	84
PID 2220 wrote to memory of 2020	2220	msedge.exe	84
PID 2220 wrote to memory of 2020	2220	msedge.exe	84
PID 2220 wrote to memory of 2020	2220	msedge.exe	84
PID 2220 wrote to memory of 2020	2220	msedge.exe	84
PID 2220 wrote to memory of 2020	2220	msedge.exe	84
PID 2220 wrote to memory of 2020	2220	msedge.exe	84
PID 2220 wrote to memory of 2020	2220	msedge.exe	84
PID 2220 wrote to memory of 2020	2220	msedge.exe	84
PID 2220 wrote to memory of 2020	2220	msedge.exe	84
PID 2220 wrote to memory of 2020	2220	msedge.exe	84
PID 2220 wrote to memory of 2020	2220	msedge.exe	84
PID 2220 wrote to memory of 2020	2220	msedge.exe	84
PID 2220 wrote to memory of 2020	2220	msedge.exe	84
PID 2220 wrote to memory of 2020	2220	msedge.exe	84
PID 2220 wrote to memory of 2020	2220	msedge.exe	84
PID 2220 wrote to memory of 2020	2220	msedge.exe	84
PID 2220 wrote to memory of 2020	2220	msedge.exe	84
PID 2220 wrote to memory of 2020	2220	msedge.exe	84
PID 2220 wrote to memory of 2020	2220	msedge.exe	84
PID 2220 wrote to memory of 2020	2220	msedge.exe	84
PID 2220 wrote to memory of 2020	2220	msedge.exe	84
PID 2220 wrote to memory of 2020	2220	msedge.exe	84
PID 2220 wrote to memory of 2020	2220	msedge.exe	84
PID 2220 wrote to memory of 2020	2220	msedge.exe	84
PID 2220 wrote to memory of 2020	2220	msedge.exe	84
PID 2220 wrote to memory of 2020	2220	msedge.exe	84
PID 2220 wrote to memory of 2020	2220	msedge.exe	84
PID 2220 wrote to memory of 2020	2220	msedge.exe	84
PID 2220 wrote to memory of 2020	2220	msedge.exe	84
PID 2220 wrote to memory of 2020	2220	msedge.exe	84
PID 2220 wrote to memory of 2020	2220	msedge.exe	84
PID 2220 wrote to memory of 2020	2220	msedge.exe	84
PID 2220 wrote to memory of 2020	2220	msedge.exe	84
PID 2220 wrote to memory of 2020	2220	msedge.exe	84
PID 2220 wrote to memory of 2020	2220	msedge.exe	84
PID 2220 wrote to memory of 2020	2220	msedge.exe	84
PID 2220 wrote to memory of 2020	2220	msedge.exe	84
PID 2220 wrote to memory of 4784	2220	msedge.exe	85
PID 2220 wrote to memory of 4784	2220	msedge.exe	85
PID 2220 wrote to memory of 4684	2220	msedge.exe	86
PID 2220 wrote to memory of 4684	2220	msedge.exe	86
PID 2220 wrote to memory of 4684	2220	msedge.exe	86
PID 2220 wrote to memory of 4684	2220	msedge.exe	86
PID 2220 wrote to memory of 4684	2220	msedge.exe	86
PID 2220 wrote to memory of 4684	2220	msedge.exe	86
PID 2220 wrote to memory of 4684	2220	msedge.exe	86
PID 2220 wrote to memory of 4684	2220	msedge.exe	86
PID 2220 wrote to memory of 4684	2220	msedge.exe	86
PID 2220 wrote to memory of 4684	2220	msedge.exe	86
PID 2220 wrote to memory of 4684	2220	msedge.exe	86
PID 2220 wrote to memory of 4684	2220	msedge.exe	86
PID 2220 wrote to memory of 4684	2220	msedge.exe	86
PID 2220 wrote to memory of 4684	2220	msedge.exe	86
PID 2220 wrote to memory of 4684	2220	msedge.exe	86
PID 2220 wrote to memory of 4684	2220	msedge.exe	86
PID 2220 wrote to memory of 4684	2220	msedge.exe	86
PID 2220 wrote to memory of 4684	2220	msedge.exe	86
PID 2220 wrote to memory of 4684	2220	msedge.exe	86
PID 2220 wrote to memory of 4684	2220	msedge.exe	86

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell start shell:Appsfolder\Microsoft.MicrosoftEdge_8wekyb3d8bbwe!MicrosoftEdge https://github.com/Endermanch/MalwareDatabase/blob/master/ransomwares/NoMoreRansom.zip
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3008

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-redirect=Windows.Launch https://github.com/Endermanch/MalwareDatabase/blob/master/ransomwares/NoMoreRansom.zip
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffb3fee46f8,0x7ffb3fee4708,0x7ffb3fee4718
  2⤵
  PID:4100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,2012668876178907529,16808267368064927073,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
  2⤵
  PID:2020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,2012668876178907529,16808267368064927073,131072 --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=2448 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,2012668876178907529,16808267368064927073,131072 --lang=es --service-sandbox-type=utility --mojo-platform-channel-handle=2912 /prefetch:8
  2⤵
  PID:4684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,2012668876178907529,16808267368064927073,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3620 /prefetch:1
  2⤵
  PID:4312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,2012668876178907529,16808267368064927073,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3628 /prefetch:1
  2⤵
  PID:3740
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,2012668876178907529,16808267368064927073,131072 --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=5344 /prefetch:8
  2⤵
  PID:3288
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
  2⤵
  - Drops file in Program Files directory
  PID:736
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ff6ad1e5460,0x7ff6ad1e5470,0x7ff6ad1e5480
    3⤵
    PID:2972
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,2012668876178907529,16808267368064927073,131072 --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=5344 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,2012668876178907529,16808267368064927073,131072 --disable-gpu-compositing --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5704 /prefetch:1
  2⤵
  PID:3628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,2012668876178907529,16808267368064927073,131072 --disable-gpu-compositing --lang=es --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5720 /prefetch:1
  2⤵
  PID:384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,2012668876178907529,16808267368064927073,131072 --disable-gpu-compositing --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6092 /prefetch:1
  2⤵
  PID:4400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,2012668876178907529,16808267368064927073,131072 --disable-gpu-compositing --lang=es --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6120 /prefetch:1
  2⤵
  PID:4444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2108,2012668876178907529,16808267368064927073,131072 --lang=es --service-sandbox-type=collections --mojo-platform-channel-handle=3684 /prefetch:8
  2⤵
  PID:1904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,2012668876178907529,16808267368064927073,131072 --disable-gpu-compositing --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5968 /prefetch:1
  2⤵
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2108,2012668876178907529,16808267368064927073,131072 --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=6300 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2544

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1960

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4872

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\NoMoreRansom\" -spe -an -ai#7zMap17510:86:7zEvent17081
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2544

C:\Users\Admin\Downloads\NoMoreRansom\[email protected]
"C:\Users\Admin\Downloads\NoMoreRansom\[email protected]"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
PID:4692

C:\Users\Admin\Downloads\NoMoreRansom\[email protected]
"C:\Users\Admin\Downloads\NoMoreRansom\[email protected]"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4128

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Web Service

T1102

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
cb62f344ad026c624f757eeb452e2ee2

SHA1
69d135731ecd414f7f7b1ed5a6d4a6e4414dce92

SHA256
61cf4c2a79753705e6ecd28867b548115e83cbdb76a5a124849cd094635d2d6a

SHA512
50318f97a2fae97f9483d1eb87b4cb8ec3f22f22f21749f375ee3210ad8ad1c3929f8afc60fcaf19d5fc2c4a8420fb0da5787744c589b25f70ff763c6abfcb6d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ab6c60116611221845298123c757197c

SHA1
f90ee239579b1c40697c32ea688390ff9d777362

SHA256
6f72e30896b7ac428f722bf30ef27bf005dff5c9df0a210c05d3077a86a67b2f

SHA512
481b8743f7835acdc7463638b584be281e4f99d6b457a50d4276b19ccf151373a7fd2287c51efea2c1335a4263694aed330b5c41313f76a9b149171364e28a3f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
48B

MD5
365450386d5950eb68e640f1a114522c

SHA1
8950d65d214ffd042948aa5789aa491dc54a6e6c

SHA256
fc3f6cdc4e94b03f4f46493e5e8dc524d0e516b18e2a832471cdbe6076f69778

SHA512
03d922862078cbf9b6ba88ce730997b1f3f9d9f960036aec0ebe8d17d6758ba66d5d28df6e9c5421adad3083aabe92a0d6d055d16da366530f9720082fed34e8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
542c72ba4dc3cd64ca61cbfb15443a6e

SHA1
e765ad9e88c6134d332d205eca75109e50cd30c8

SHA256
1c72b5489a7e38860c62dee55aea162f7d24e07f716c53a8cd51641625dd048a

SHA512
1bb19a00762af5a9f23d0ab34d18aecffb247aae4de783004e89af514312d9c50fd542d4342eea3ea1850da4fe0a656374b2b1ec769337bad447e2fddb579ad2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Microsoft Edge.lnk

Filesize
2KB

MD5
b199e35679db0008f406e79515e5e027

SHA1
ab7f8b068294f95ee67f6c73cf8745ff9dbc2753

SHA256
8c5b987373f3a2c168f7900116b83f7997ec4154e6edcdce12f4586254058526

SHA512
34d65cfc7a9a7ce25c3629175df7bb3f5aba5d17cab340fa5a48e82a3196ebcbe674330c9ae3ea6afc80e15efba7d1763a7a0122dd1ebd14f9d7a846b136e709

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
576B

MD5
dd0b0966031eb42c365039bee632486f

SHA1
75980d18328670ec3036a9448e5828a50135c7e3

SHA256
0677faf183648bfdb2af0e7c3be795023588fd875636f1c71cbe619b351bd121

SHA512
d3c54175b706018ecee8f72b288086889f022992b117a599d827f3c17711b84bafbc1a0c886026ab76c4f8c1b18716a34e75e14e5db62db68771a905ce88322f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
a9aaa263a8ffa8162e397a35ba471d7c

SHA1
4c70c95be2181c0f221252de133b8f78be602b2c

SHA256
6ff9da137b9b1574f8cfe2744ac7add0660323ab5bb5f995299849a8116d81d9

SHA512
a24e77f1e30c2dbcc4cc1b49046f6916882a98a2a1ec0ad765bbc867ff1ef2f3e93b5d188390f2d59b518d60c556fe30a73e7cafc529ed7bcd0b2e4e42d81777

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
4KB

MD5
8d6a2fd56fbf8792e1143e42c68f1a1a

SHA1
fa9d437deed908cb417cb54b6cf20e7176dcbeb0

SHA256
66af090f63341471768dcfd8e4f0919f456dad290114cb0f4180f65f0de7b49c

SHA512
a68f635ecdf89d33f2cc920f4c4abf2c7344d57a84ca2895f3c5c5f10db9c30c1016d6a0d9b5e2534b87a2687d6297ae1b149ebe5ec1e11067ed74f91fc3ac87

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
68c713f9f0c03e89d844d3b5c20b2434

SHA1
4609342ce6a7e2eb48a0799c809c977a727b9dd3

SHA256
f3c708ef4d3b724d803d9823022fb7dafefda2e1080aadf3b62b30e169d8ee3b

SHA512
6e1b3985744090e74675322bd250a989c81bf53c1408d99cf3b59658e9ccb35f3066b451422732c00c970d0b289ad77675e58acdebadc86d5ed53724348b1f08

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
2babd6c48369403ceb0e62762ef724be

SHA1
2e656183c7dee0ae8ae9b5eb361cd5884f694829

SHA256
6e45b5ab488834284f859c30331156076d2429fbbb1c7c6bb8a8f47cec0fd372

SHA512
f4bd88b94e4dc547811448df8edbd2851026b33916fc80c8b1558511aa381fe5663c371c8c41e03e2b3171cd5c96c3fa0324f8cf732dcb352cd697cc22864b87

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
4350790c5ce221003810409ebaf1ab5e

SHA1
5b6be3ea1e79b347d2d307ef6e74369cd224fcf2

SHA256
718d087bd1fdd3695ecbf02fbf119cd2f281a0e7ab03706b3fc5961d5250779b

SHA512
aa8011ac7260c485b7d170d5ee48251eb82e592fdeeff9fef4c90643a48c15a6a8caf7f2dd9c5b39e91bc730e1ab206538a94ec06a06dd87de6b96b6ce0a1ce7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
53f83748d303753eddd1ad56b13acc65

SHA1
212e993161a38e6d322b58646ca876223b0a7513

SHA256
21f81be07b7a45d99fd9e69a9245806fa833e5350e22f442f7dffa2b47c704bd

SHA512
e04ea02da85484eaffa75694d3178b5de20b1cedb69f6e418814c0fd371c477e154d2ad95c0137b399505796580181d77cd4a147ac28b508edefa2a60667f347

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe56f532.TMP

Filesize
873B

MD5
fa44993936ec5357fe507a2b4808958c

SHA1
f9018246b14bb17683933c38afd3f52daefd9289

SHA256
14aa7407555e87cad35011c9c198766864e767f8b2105d409866b47e73308aca

SHA512
cce18656876f1cbb1220ff42e332eca69b1624fc75a6e644ff7be14f9384e5d414030e88311b9b3bda887ac4e6b817da48b0dc3a49f17d7f7da3c123e6ffccf1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
13KB

MD5
1c8804ccde275f798839550b31741a3b

SHA1
87507986c92bbb7e93ff5b4be195d8120889c6a8

SHA256
b11b2cec46c68cdb23bc4269907ab944004016aeca677af3e97b2737e6069f00

SHA512
b0a6c246c992ebcd854d5acfa019dc288e8def8dc66a99c260db9917f6a64784cee880ce120804bd2c341abb8fea9379f7a03bebdb6b1caa7c4bc9e91f36e1e8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
13KB

MD5
e3a39206e27554344e3e6b346c6d7432

SHA1
6a0ffaaba33bb04682f02d2b817891fee751d73f

SHA256
17596f23298fe95300e873ca7ef27b08dac7aa79268baac7f2c5e973aa1dc36f

SHA512
e52a25de0cb7d0972f401cab8e9c38921c88a252b49290ca125f3f896767a7001ed10a7167cb5be6cb5415cce64054d5fea2f7e4570302c5c069d208e4fb4878

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
a456b70a78f52b5198c1aec665e8e37f

SHA1
5e9e0f92822ebce39899a6c1b1bccbdf08729d48

SHA256
522b44acc8b5afadaa46b92c9bb38e3f8a72fcb512c5eac629adeb4279434585

SHA512
52913e5c3e26755b51d6a61d3613b28042edfa4e84d6d6a54611e1465040e6cdab937a01080d89b7d11d439b162aea2ff1fcede28dcea8a8518fa038086563d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5ctrwkr4.iow.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
e09c4ae5bb3188fb92591db6d86b2623

SHA1
998392e091835b5e2534183777fc56fa2fbfcfd0

SHA256
27dce2b64a875ebfdf79b92511140f2647517495bbfef1f19c1925dec0b9f6cc

SHA512
1b6183164df0e109bfc70f4611bc879e7c11ac49790abd0e200f0ea74af3b46307f22965cd6f04917815b105bd7a2b846a64855fdc21c7c6d71e23476d13875c

Download Submit
C:\Users\Admin\Downloads\NoMoreRansom.zip

Filesize
916KB

MD5
f315e49d46914e3989a160bbcfc5de85

SHA1
99654bfeaad090d95deef3a2e9d5d021d2dc5f63

SHA256
5cbb6442c47708558da29588e0d8ef0b34c4716be4a47e7c715ea844fbcf60d7

SHA512
224747b15d0713afcb2641f8f3aa1687516d42e045d456b3ed096a42757a6c10c6626672366c9b632349cf6ffe41011724e6f4b684837de9b719d0f351dfd22e

Download Submit
C:\Users\Admin\Downloads\NoMoreRansom.zip

Filesize
916KB

MD5
f315e49d46914e3989a160bbcfc5de85

SHA1
99654bfeaad090d95deef3a2e9d5d021d2dc5f63

SHA256
5cbb6442c47708558da29588e0d8ef0b34c4716be4a47e7c715ea844fbcf60d7

SHA512
224747b15d0713afcb2641f8f3aa1687516d42e045d456b3ed096a42757a6c10c6626672366c9b632349cf6ffe41011724e6f4b684837de9b719d0f351dfd22e

Download Submit
C:\Users\Admin\Downloads\NoMoreRansom\[email protected]

Filesize
1.4MB

MD5
63210f8f1dde6c40a7f3643ccf0ff313

SHA1
57edd72391d710d71bead504d44389d0462ccec9

SHA256
2aab13d49b60001de3aa47fb8f7251a973faa7f3c53a3840cdf5fd0b26e9a09f

SHA512
87a89e8ab85be150a783a9f8d41797cfa12f86fdccb48f2180c0498bfd2b1040b730dee4665fe2c83b98d436453680226051b7f1532e1c0e0cda0cf702e80a11

Download Submit
C:\Users\Admin\Downloads\NoMoreRansom\[email protected]

Filesize
1.4MB

MD5
63210f8f1dde6c40a7f3643ccf0ff313

SHA1
57edd72391d710d71bead504d44389d0462ccec9

SHA256
2aab13d49b60001de3aa47fb8f7251a973faa7f3c53a3840cdf5fd0b26e9a09f

SHA512
87a89e8ab85be150a783a9f8d41797cfa12f86fdccb48f2180c0498bfd2b1040b730dee4665fe2c83b98d436453680226051b7f1532e1c0e0cda0cf702e80a11

Download Submit
C:\Users\Admin\Downloads\NoMoreRansom\[email protected]

Filesize
1.4MB

MD5
63210f8f1dde6c40a7f3643ccf0ff313

SHA1
57edd72391d710d71bead504d44389d0462ccec9

SHA256
2aab13d49b60001de3aa47fb8f7251a973faa7f3c53a3840cdf5fd0b26e9a09f

SHA512
87a89e8ab85be150a783a9f8d41797cfa12f86fdccb48f2180c0498bfd2b1040b730dee4665fe2c83b98d436453680226051b7f1532e1c0e0cda0cf702e80a11

Download Submit
memory/3008-147-0x0000011939360000-0x0000011939370000-memory.dmp

Filesize
64KB

Download
memory/3008-144-0x0000011939290000-0x00000119392B2000-memory.dmp

Filesize
136KB

Download
memory/3008-133-0x00000119392C0000-0x0000011939342000-memory.dmp

Filesize
520KB

Download
memory/3008-145-0x0000011920C30000-0x0000011920C40000-memory.dmp

Filesize
64KB

Download
memory/3008-134-0x0000011939360000-0x0000011939370000-memory.dmp

Filesize
64KB

Download
memory/3008-146-0x00000119396F0000-0x00000119397F2000-memory.dmp

Filesize
1.0MB

Download
memory/4128-514-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/4128-512-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/4128-511-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/4692-471-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/4692-477-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/4692-507-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/4692-508-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/4692-475-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/4692-474-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/4692-473-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/4692-513-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/4692-472-0x0000000002400000-0x00000000024CE000-memory.dmp

Filesize
824KB

Download
memory/4692-517-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/4692-518-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/4692-519-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download