teslacrypt | 5343947829609f69e84fe7e8172c38ee018ede3c9898d4895275f596ac54320d

Resubmissions

05-09-2023 09:36

230905-llcqbseg77 10

12-04-2023 15:55

230412-tc7s4sdc52 10

Analysis

max time kernel
148s
max time network
151s
platform
windows10-1703_x64
resource
win10-20230831-en
resource tags

arch:x64arch:x86image:win10-20230831-enlocale:en-usos:windows10-1703-x64system
submitted
05-09-2023 09:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

suspect_file_2.exe
Size

360KB
MD5

9ce01dfbf25dfea778e57d8274675d6f
SHA1

1bd767beb5bc36b396ca6405748042640ad57526
SHA256

5343947829609f69e84fe7e8172c38ee018ede3c9898d4895275f596ac54320d
SHA512

d6ba89c1f221a94e3061bc4da896760d99935a7c766b8e4e30146266cf3356acd883835e75dbb86574bc869c83d381c8f63f23392101f6062bba4343af49978b
SSDEEP

6144:4qZbqZToxIizLBZ6R56VkGM4ceLJ5vs5JGJceO/QCErIiuNAvwu:4qZb8oR3D6R5QHXZJy/Q50imAvB

Score

10^/10

teslacrypt persistence ransomware spyware stealer

Malware Config

Extracted

Path

C:\PerfLogs\_RECOVERY_+sqemx.txt

Family

teslacrypt

Ransom Note

NOT YOUR LANGUAGE? USE https://translate.google.com What happened to your files ? All of your files were protected by a strong encryption with AES More information about the encryption keys using AES can be found here: http://en.wikipedia.org/wiki/AES How did this happen ? !!! Specially for your PC was generated personal AES KEY, both public and private. !!! ALL YOUR FILES were encrypted with the public key, which has been transferred to your computer via the Internet. !!! Decrypting of your files is only possible with the help of the private key and decrypt program , which is on our Secret Server What do I do ? So, there are two ways you can choose: wait for a miracle and get your price doubled, or start obtaining BITCOIN NOW! , and restore your data easy way. If You have really valuable data, you better not waste your time, because there is no other way to get your files, except make a payment. For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: 1. http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/EFA6EE942A4F3F4B 2. http://tes543berda73i48fsdfsd.keratadze.at/EFA6EE942A4F3F4B 3. http://tt54rfdjhb34rfbnknaerg.milerteddy.com/EFA6EE942A4F3F4B If for some reasons the addresses are not available, follow these steps: 1. Download and install tor-browser: http://www.torproject.org/projects/torbrowser.html.en 2. After a successful installation, run the browser 3. Type in the address bar: xlowfznrg4wf7dli.onion/EFA6EE942A4F3F4B 4. Follow the instructions on the site. ---------------- IMPORTANT INFORMATION------------------------ *-*-* Your personal pages: http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/EFA6EE942A4F3F4B http://tes543berda73i48fsdfsd.keratadze.at/EFA6EE942A4F3F4B http://tt54rfdjhb34rfbnknaerg.milerteddy.com/EFA6EE942A4F3F4B *-*-* Your personal page Tor-Browser: xlowfznrg4wf7dli.ONION/EFA6EE942A4F3F4B

URLs

http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/EFA6EE942A4F3F4B

http://tes543berda73i48fsdfsd.keratadze.at/EFA6EE942A4F3F4B

http://tt54rfdjhb34rfbnknaerg.milerteddy.com/EFA6EE942A4F3F4B

http://xlowfznrg4wf7dli.ONION/EFA6EE942A4F3F4B

Signatures

TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
ransomware teslacrypt
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490
Renames multiple (883) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

nbbkdkvlcafl.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2398454716-3289288241-2843025796-1000\Control Panel\International\Geo\Nation	nbbkdkvlcafl.exe

Drops startup file 6 IoCs

Processes:

nbbkdkvlcafl.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\_RECOVERY_+sqemx.txt	nbbkdkvlcafl.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\_RECOVERY_+sqemx.html	nbbkdkvlcafl.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_RECOVERY_+sqemx.png	nbbkdkvlcafl.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_RECOVERY_+sqemx.txt	nbbkdkvlcafl.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_RECOVERY_+sqemx.html	nbbkdkvlcafl.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\_RECOVERY_+sqemx.png	nbbkdkvlcafl.exe

Executes dropped EXE 1 IoCs

Processes:

nbbkdkvlcafl.exe

pid process

4932 nbbkdkvlcafl.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

nbbkdkvlcafl.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2398454716-3289288241-2843025796-1000\Software\Microsoft\Windows\CurrentVersion\Run\peankoovfnke = "C:\\Windows\\system32\\cmd.exe /c start \"\" \"C:\\Windows\\nbbkdkvlcafl.exe\""	nbbkdkvlcafl.exe

Drops file in Program Files directory 64 IoCs

Processes:

nbbkdkvlcafl.exe

description	ioc	process
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\ThemeCreation\Apply.png	nbbkdkvlcafl.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_16.511.8780.0_x64__8wekyb3d8bbwe\Assets\PhotosLogoExtensions.targetsize-48.png	nbbkdkvlcafl.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1612.10312.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\InsiderHubLargeTile.scale-125_contrast-black.png	nbbkdkvlcafl.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1612.10312.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\InsiderHubSplashWideTile.scale-125_contrast-white.png	nbbkdkvlcafl.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Work\RTL\_RECOVERY_+sqemx.txt	nbbkdkvlcafl.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\_RECOVERY_+sqemx.png	nbbkdkvlcafl.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SUMIPNTG\_RECOVERY_+sqemx.txt	nbbkdkvlcafl.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\Livetiles\MicrosoftSolitaireLargeTile.scale-125.jpg	nbbkdkvlcafl.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Car\LTR\SmallTile.scale-125.png	nbbkdkvlcafl.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\hrtfs\_RECOVERY_+sqemx.txt	nbbkdkvlcafl.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.3DBuilder_13.0.10349.0_neutral_split.scale-180_8wekyb3d8bbwe\Assets\Office\BooleanMerge.scale-180.png	nbbkdkvlcafl.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\1937_40x40x32.png	nbbkdkvlcafl.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\HxA-Generic-Light.scale-200.png	nbbkdkvlcafl.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSIPC\gl\_RECOVERY_+sqemx.png	nbbkdkvlcafl.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Portal\_RECOVERY_+sqemx.html	nbbkdkvlcafl.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PSReadline\1.2\en\_RECOVERY_+sqemx.html	nbbkdkvlcafl.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\da-DK\_RECOVERY_+sqemx.txt	nbbkdkvlcafl.exe
File opened for modification	C:\Program Files\Internet Explorer\images\_RECOVERY_+sqemx.html	nbbkdkvlcafl.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\include\win32\_RECOVERY_+sqemx.html	nbbkdkvlcafl.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-white\GenericMailSmallTile.scale-200.png	nbbkdkvlcafl.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.16112.11601.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-48.png	nbbkdkvlcafl.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\_RECOVERY_+sqemx.txt	nbbkdkvlcafl.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNotePageLargeTile.scale-100.png	nbbkdkvlcafl.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Wallet_1.0.16328.0_x64__8wekyb3d8bbwe\AppxMetadata\_RECOVERY_+sqemx.txt	nbbkdkvlcafl.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\HowToPlay\Klondike\Tips_5.jpg	nbbkdkvlcafl.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\microsoft.system.package.metadata\_RECOVERY_+sqemx.html	nbbkdkvlcafl.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-white\HxCalendarAppList.targetsize-24.png	nbbkdkvlcafl.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Work\LTR\contrast-black\_RECOVERY_+sqemx.txt	nbbkdkvlcafl.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\lib\ext\_RECOVERY_+sqemx.html	nbbkdkvlcafl.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\_RECOVERY_+sqemx.txt	nbbkdkvlcafl.exe
File opened for modification	C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\_RECOVERY_+sqemx.png	nbbkdkvlcafl.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.zh_CN_5.5.0.165303\_RECOVERY_+sqemx.txt	nbbkdkvlcafl.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\lib\deployed\jdk16\_RECOVERY_+sqemx.png	nbbkdkvlcafl.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\PROFILE\THMBNAIL.PNG	nbbkdkvlcafl.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2017.125.40.0_neutral_~_8wekyb3d8bbwe\_RECOVERY_+sqemx.txt	nbbkdkvlcafl.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\_RECOVERY_+sqemx.png	nbbkdkvlcafl.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsStore_11701.1001.87.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppTiles\contrast-white\_RECOVERY_+sqemx.html	nbbkdkvlcafl.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-32_altform-unplated.png	nbbkdkvlcafl.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\Assets\starttile.dualsim2.sad.scale-150.png	nbbkdkvlcafl.exe
File opened for modification	C:\Program Files\Windows Security\BrowserCore\_RECOVERY_+sqemx.txt	nbbkdkvlcafl.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\Assets\AppTiles\Spacer\9px.png	nbbkdkvlcafl.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\Microsoft.Msn.Controls\EndOfLife\Assets\_RECOVERY_+sqemx.html	nbbkdkvlcafl.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\_Resources\_RECOVERY_+sqemx.png	nbbkdkvlcafl.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.NET.Native.Runtime.1.3_1.3.23901.0_x86__8wekyb3d8bbwe\microsoft.system.package.metadata\Autogen\_RECOVERY_+sqemx.png	nbbkdkvlcafl.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.OneConnect_2.1701.277.0_x64__8wekyb3d8bbwe\Assets\OneConnectMedTile.scale-200.png	nbbkdkvlcafl.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1612.10312.0_x64__8wekyb3d8bbwe\Assets\InsiderHubWideTile.scale-200_contrast-black.png	nbbkdkvlcafl.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Work\LTR\_RECOVERY_+sqemx.txt	nbbkdkvlcafl.exe
File opened for modification	C:\Program Files\Common Files\System\ja-JP\_RECOVERY_+sqemx.png	nbbkdkvlcafl.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\de\_RECOVERY_+sqemx.png	nbbkdkvlcafl.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\_RECOVERY_+sqemx.html	nbbkdkvlcafl.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\_RECOVERY_+sqemx.html	nbbkdkvlcafl.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Home\LTR\contrast-white\_RECOVERY_+sqemx.txt	nbbkdkvlcafl.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\Assets\TextureBitmaps\rcypaper.jpg	nbbkdkvlcafl.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-black\ExchangeWideTile.scale-100.png	nbbkdkvlcafl.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.16112.11621.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-64_altform-unplated.png	nbbkdkvlcafl.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteWideTile.scale-150.png	nbbkdkvlcafl.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-black\HxA-Advanced-Light.scale-300.png	nbbkdkvlcafl.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\com.jrockit.mc.feature.flightrecorder_5.5.0.165303\_RECOVERY_+sqemx.txt	nbbkdkvlcafl.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\Content\desktop\_RECOVERY_+sqemx.txt	nbbkdkvlcafl.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteSectionWideTile.scale-150.png	nbbkdkvlcafl.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\_RECOVERY_+sqemx.html	nbbkdkvlcafl.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-white\HxCalendarAppList.targetsize-20.png	nbbkdkvlcafl.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\_RECOVERY_+sqemx.html	nbbkdkvlcafl.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\animations\OneNoteFRE_CreateNotes_RTL_Tablet.mp4	nbbkdkvlcafl.exe

Drops file in Windows directory 6 IoCs

Processes:

MicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exesuspect_file_2.exe

description	ioc	process
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdge.exe
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\nbbkdkvlcafl.exe	suspect_file_2.exe
File opened for modification	C:\Windows\nbbkdkvlcafl.exe	suspect_file_2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

Processes:

browser_broker.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2398454716-3289288241-2843025796-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-2398454716-3289288241-2843025796-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2398454716-3289288241-2843025796-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe

Modifies registry class 64 IoCs

Processes:

MicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2398454716-3289288241-2843025796-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VersionHigh = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2398454716-3289288241-2843025796-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2398454716-3289288241-2843025796-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\OnlineHistory	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2398454716-3289288241-2843025796-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2398454716-3289288241-2843025796-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DeviceId = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2398454716-3289288241-2843025796-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2398454716-3289288241-2843025796-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2398454716-3289288241-2843025796-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DeviceId = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2398454716-3289288241-2843025796-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\JumpListInPrivateBrowsingAllowed = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2398454716-3289288241-2843025796-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2398454716-3289288241-2843025796-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\CIStatus	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2398454716-3289288241-2843025796-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 33959abcdcdfd901	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2398454716-3289288241-2843025796-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\AdapterInfo = "vendorId=\"0x1414\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.15063.0\"hypervisor=\"No Hypervisor (No SLAT)\""	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2398454716-3289288241-2843025796-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\TreeView = "1"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2398454716-3289288241-2843025796-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3\{AEBA21FA-782A-4A90-978D-B7216 = 1a3761592352350c7a5f20172f1e1a190e2b017313371312141a152a	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2398454716-3289288241-2843025796-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-SubSysId = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2398454716-3289288241-2843025796-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionLow = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2398454716-3289288241-2843025796-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus\DynamicCodePolicy = 00000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2398454716-3289288241-2843025796-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Extensible Cache	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2398454716-3289288241-2843025796-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Cookies	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2398454716-3289288241-2843025796-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Rating\NextPromptBuild = "15063"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2398454716-3289288241-2843025796-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\Active = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2398454716-3289288241-2843025796-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionHigh = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2398454716-3289288241-2843025796-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2398454716-3289288241-2843025796-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2398454716-3289288241-2843025796-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 099af90748dcd901	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2398454716-3289288241-2843025796-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2398454716-3289288241-2843025796-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Content	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2398454716-3289288241-2843025796-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Content\CacheLimit = "256000"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2398454716-3289288241-2843025796-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2398454716-3289288241-2843025796-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2398454716-3289288241-2843025796-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2398454716-3289288241-2843025796-1000_Classes\Local Settings\MrtCache	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2398454716-3289288241-2843025796-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2398454716-3289288241-2843025796-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Cookies\CacheLimit = "1"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2398454716-3289288241-2843025796-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2398454716-3289288241-2843025796-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Explorer	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2398454716-3289288241-2843025796-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2398454716-3289288241-2843025796-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\History	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2398454716-3289288241-2843025796-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionHigh = "268435456"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2398454716-3289288241-2843025796-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TabbedBrowsing\NewTabPage	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2398454716-3289288241-2843025796-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionLow = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2398454716-3289288241-2843025796-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DXFeatureLevel = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2398454716-3289288241-2843025796-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2398454716-3289288241-2843025796-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Cookies	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2398454716-3289288241-2843025796-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\History\CacheLimit = "1"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2398454716-3289288241-2843025796-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2398454716-3289288241-2843025796-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2398454716-3289288241-2843025796-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI\IsSignedIn = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2398454716-3289288241-2843025796-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Explorer\Main	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2398454716-3289288241-2843025796-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 0b2258c1dcdfd901	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2398454716-3289288241-2843025796-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2398454716-3289288241-2843025796-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2398454716-3289288241-2843025796-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Rating	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2398454716-3289288241-2843025796-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 51ab6fbcdcdfd901	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2398454716-3289288241-2843025796-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2398454716-3289288241-2843025796-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2398454716-3289288241-2843025796-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Extensible Cache	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2398454716-3289288241-2843025796-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2398454716-3289288241-2843025796-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2398454716-3289288241-2843025796-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2398454716-3289288241-2843025796-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\ReadingStorePending = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2398454716-3289288241-2843025796-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\DisallowDefaultBrowserPrompt = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2398454716-3289288241-2843025796-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe

Opens file in notepad (likely ransom note) 1 IoCs
ransomware

Processes:

NOTEPAD.EXE

pid process

4592 NOTEPAD.EXE

pid	process
4592	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

nbbkdkvlcafl.exe

pid	process
4932	nbbkdkvlcafl.exe
4932	nbbkdkvlcafl.exe
4932	nbbkdkvlcafl.exe
4932	nbbkdkvlcafl.exe
4932	nbbkdkvlcafl.exe
4932	nbbkdkvlcafl.exe
4932	nbbkdkvlcafl.exe
4932	nbbkdkvlcafl.exe
4932	nbbkdkvlcafl.exe
4932	nbbkdkvlcafl.exe
4932	nbbkdkvlcafl.exe
4932	nbbkdkvlcafl.exe
4932	nbbkdkvlcafl.exe
4932	nbbkdkvlcafl.exe
4932	nbbkdkvlcafl.exe
4932	nbbkdkvlcafl.exe
4932	nbbkdkvlcafl.exe
4932	nbbkdkvlcafl.exe
4932	nbbkdkvlcafl.exe
4932	nbbkdkvlcafl.exe
4932	nbbkdkvlcafl.exe
4932	nbbkdkvlcafl.exe
4932	nbbkdkvlcafl.exe
4932	nbbkdkvlcafl.exe
4932	nbbkdkvlcafl.exe
4932	nbbkdkvlcafl.exe
4932	nbbkdkvlcafl.exe
4932	nbbkdkvlcafl.exe
4932	nbbkdkvlcafl.exe
4932	nbbkdkvlcafl.exe
4932	nbbkdkvlcafl.exe
4932	nbbkdkvlcafl.exe
4932	nbbkdkvlcafl.exe
4932	nbbkdkvlcafl.exe
4932	nbbkdkvlcafl.exe
4932	nbbkdkvlcafl.exe
4932	nbbkdkvlcafl.exe
4932	nbbkdkvlcafl.exe
4932	nbbkdkvlcafl.exe
4932	nbbkdkvlcafl.exe
4932	nbbkdkvlcafl.exe
4932	nbbkdkvlcafl.exe
4932	nbbkdkvlcafl.exe
4932	nbbkdkvlcafl.exe
4932	nbbkdkvlcafl.exe
4932	nbbkdkvlcafl.exe
4932	nbbkdkvlcafl.exe
4932	nbbkdkvlcafl.exe
4932	nbbkdkvlcafl.exe
4932	nbbkdkvlcafl.exe
4932	nbbkdkvlcafl.exe
4932	nbbkdkvlcafl.exe
4932	nbbkdkvlcafl.exe
4932	nbbkdkvlcafl.exe
4932	nbbkdkvlcafl.exe
4932	nbbkdkvlcafl.exe
4932	nbbkdkvlcafl.exe
4932	nbbkdkvlcafl.exe
4932	nbbkdkvlcafl.exe
4932	nbbkdkvlcafl.exe
4932	nbbkdkvlcafl.exe
4932	nbbkdkvlcafl.exe
4932	nbbkdkvlcafl.exe
4932	nbbkdkvlcafl.exe

Suspicious behavior: MapViewOfSection 3 IoCs

Processes:

MicrosoftEdgeCP.exe

pid process

4028 MicrosoftEdgeCP.exe
4028 MicrosoftEdgeCP.exe
4028 MicrosoftEdgeCP.exe

pid	process
4028	MicrosoftEdgeCP.exe
4028	MicrosoftEdgeCP.exe
4028	MicrosoftEdgeCP.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

suspect_file_2.exenbbkdkvlcafl.exeWMIC.exevssvc.exeWMIC.exe

description	pid	process
Token: SeDebugPrivilege	4740	suspect_file_2.exe
Token: SeDebugPrivilege	4932	nbbkdkvlcafl.exe
Token: SeIncreaseQuotaPrivilege	3420	WMIC.exe
Token: SeSecurityPrivilege	3420	WMIC.exe
Token: SeTakeOwnershipPrivilege	3420	WMIC.exe
Token: SeLoadDriverPrivilege	3420	WMIC.exe
Token: SeSystemProfilePrivilege	3420	WMIC.exe
Token: SeSystemtimePrivilege	3420	WMIC.exe
Token: SeProfSingleProcessPrivilege	3420	WMIC.exe
Token: SeIncBasePriorityPrivilege	3420	WMIC.exe
Token: SeCreatePagefilePrivilege	3420	WMIC.exe
Token: SeBackupPrivilege	3420	WMIC.exe
Token: SeRestorePrivilege	3420	WMIC.exe
Token: SeShutdownPrivilege	3420	WMIC.exe
Token: SeDebugPrivilege	3420	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3420	WMIC.exe
Token: SeRemoteShutdownPrivilege	3420	WMIC.exe
Token: SeUndockPrivilege	3420	WMIC.exe
Token: SeManageVolumePrivilege	3420	WMIC.exe
Token: 33	3420	WMIC.exe
Token: 34	3420	WMIC.exe
Token: 35	3420	WMIC.exe
Token: 36	3420	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3420	WMIC.exe
Token: SeSecurityPrivilege	3420	WMIC.exe
Token: SeTakeOwnershipPrivilege	3420	WMIC.exe
Token: SeLoadDriverPrivilege	3420	WMIC.exe
Token: SeSystemProfilePrivilege	3420	WMIC.exe
Token: SeSystemtimePrivilege	3420	WMIC.exe
Token: SeProfSingleProcessPrivilege	3420	WMIC.exe
Token: SeIncBasePriorityPrivilege	3420	WMIC.exe
Token: SeCreatePagefilePrivilege	3420	WMIC.exe
Token: SeBackupPrivilege	3420	WMIC.exe
Token: SeRestorePrivilege	3420	WMIC.exe
Token: SeShutdownPrivilege	3420	WMIC.exe
Token: SeDebugPrivilege	3420	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3420	WMIC.exe
Token: SeRemoteShutdownPrivilege	3420	WMIC.exe
Token: SeUndockPrivilege	3420	WMIC.exe
Token: SeManageVolumePrivilege	3420	WMIC.exe
Token: 33	3420	WMIC.exe
Token: 34	3420	WMIC.exe
Token: 35	3420	WMIC.exe
Token: 36	3420	WMIC.exe
Token: SeBackupPrivilege	2340	vssvc.exe
Token: SeRestorePrivilege	2340	vssvc.exe
Token: SeAuditPrivilege	2340	vssvc.exe
Token: SeIncreaseQuotaPrivilege	4060	WMIC.exe
Token: SeSecurityPrivilege	4060	WMIC.exe
Token: SeTakeOwnershipPrivilege	4060	WMIC.exe
Token: SeLoadDriverPrivilege	4060	WMIC.exe
Token: SeSystemProfilePrivilege	4060	WMIC.exe
Token: SeSystemtimePrivilege	4060	WMIC.exe
Token: SeProfSingleProcessPrivilege	4060	WMIC.exe
Token: SeIncBasePriorityPrivilege	4060	WMIC.exe
Token: SeCreatePagefilePrivilege	4060	WMIC.exe
Token: SeBackupPrivilege	4060	WMIC.exe
Token: SeRestorePrivilege	4060	WMIC.exe
Token: SeShutdownPrivilege	4060	WMIC.exe
Token: SeDebugPrivilege	4060	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4060	WMIC.exe
Token: SeRemoteShutdownPrivilege	4060	WMIC.exe
Token: SeUndockPrivilege	4060	WMIC.exe
Token: SeManageVolumePrivilege	4060	WMIC.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

MicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exe

pid process

3984 MicrosoftEdge.exe
4028 MicrosoftEdgeCP.exe
4412 MicrosoftEdgeCP.exe
4028 MicrosoftEdgeCP.exe

pid	process
3984	MicrosoftEdge.exe
4028	MicrosoftEdgeCP.exe
4412	MicrosoftEdgeCP.exe
4028	MicrosoftEdgeCP.exe

Suspicious use of WriteProcessMemory 19 IoCs

Processes:

suspect_file_2.exenbbkdkvlcafl.exeMicrosoftEdgeCP.exe

description	pid	process	target process
PID 4740 wrote to memory of 4932	4740	suspect_file_2.exe	nbbkdkvlcafl.exe
PID 4740 wrote to memory of 4932	4740	suspect_file_2.exe	nbbkdkvlcafl.exe
PID 4740 wrote to memory of 4932	4740	suspect_file_2.exe	nbbkdkvlcafl.exe
PID 4740 wrote to memory of 3612	4740	suspect_file_2.exe	cmd.exe
PID 4740 wrote to memory of 3612	4740	suspect_file_2.exe	cmd.exe
PID 4740 wrote to memory of 3612	4740	suspect_file_2.exe	cmd.exe
PID 4932 wrote to memory of 3420	4932	nbbkdkvlcafl.exe	WMIC.exe
PID 4932 wrote to memory of 3420	4932	nbbkdkvlcafl.exe	WMIC.exe
PID 4932 wrote to memory of 4592	4932	nbbkdkvlcafl.exe	NOTEPAD.EXE
PID 4932 wrote to memory of 4592	4932	nbbkdkvlcafl.exe	NOTEPAD.EXE
PID 4932 wrote to memory of 4592	4932	nbbkdkvlcafl.exe	NOTEPAD.EXE
PID 4932 wrote to memory of 4060	4932	nbbkdkvlcafl.exe	WMIC.exe
PID 4932 wrote to memory of 4060	4932	nbbkdkvlcafl.exe	WMIC.exe
PID 4028 wrote to memory of 4996	4028	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 4028 wrote to memory of 4996	4028	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 4028 wrote to memory of 4996	4028	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 4028 wrote to memory of 4996	4028	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 4028 wrote to memory of 4996	4028	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 4028 wrote to memory of 4996	4028	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

Processes:

nbbkdkvlcafl.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1"	nbbkdkvlcafl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	nbbkdkvlcafl.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\suspect_file_2.exe
"C:\Users\Admin\AppData\Local\Temp\suspect_file_2.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4740
- C:\Windows\nbbkdkvlcafl.exe
  C:\Windows\nbbkdkvlcafl.exe
  2⤵
  - Checks computer location settings
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:4932
- - C:\Windows\System32\wbem\WMIC.exe
    "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /nointeractive
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3420
- - C:\Windows\SysWOW64\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\RECOVERY.TXT
    3⤵
    - Opens file in notepad (likely ransom note)
    PID:4592
- - C:\Windows\System32\wbem\WMIC.exe
    "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /nointeractive
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4060
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\AppData\Local\Temp\SUSPEC~1.EXE
  2⤵
  PID:3612

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2340

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3984

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:4500

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4028

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4412

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
PID:4996

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:1188

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:3840

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PerfLogs\_RECOVERY_+sqemx.html

Filesize
11KB

MD5
092693e2494176eb033815de999d7eac

SHA1
aecc51236f08b10ec55005fba4e0989a503c1042

SHA256
3d7b6bf66480a0f34a7d0635a5b555206ec64a838ff2e767e214a2252c75b944

SHA512
c28c5a2beb5490f9a707e70e08ba09ccc68245c1b2add301c86ac31160953dfa93730054b3d6f7725818363abc627bbf6f0a2675836de92d845909fbbad1e399

Download Submit
C:\PerfLogs\_RECOVERY_+sqemx.png

Filesize
62KB

MD5
d67e2bffb2b3799e019d35d8e2a2337b

SHA1
efcc9ea317383f138e04fe31d767c50f210e063a

SHA256
514aa12a44524e177681f3bd53ac75f48e943af79a0d643b477132a31ab5a37f

SHA512
a25b1943c107d3796232414123f9896865ec3d387e4fb734c6db98fc232d8627070679d5e8f8fe5900e2d01a2881ad7f215d8de59d97934d83a905e1a9dd4e57

Download Submit
C:\PerfLogs\_RECOVERY_+sqemx.txt

Filesize
1KB

MD5
f0e6d1fad778b28cac4cdf003da5392b

SHA1
edf73fcb57e770dafb06ef881ebd438f8c639480

SHA256
c02beef44d3831bb70eb4aaf75499a344c47623488a1f57dc74d1b681184ad66

SHA512
b1062f15d3cfb5ed5619f67d53b21212218671a52fa4874416fcbbf71226732dfe479c179a5b392e68a0b8f39b74e71e89036c4692032ec2bbf0a7f50e7abe15

Download Submit
C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\asl-v20.txt

Filesize
11KB

MD5
78d1f94c5a7f1b000cdbe3ba8bf9d590

SHA1
3ac4c0b77d6305493a99ff36fca1bbe12d227ea8

SHA256
2ca10c21dc96bccf2bfabaa6a3d80e704066b5e52ce38f641a31f74d3a13c690

SHA512
38b96878c50bbdd82293deb7c2505192dd216f324fd1635eb8488ae3673cb6eb10e2518b3ce67811eacfc8764835bc7d1c81a023f8cc59b4d01ba356a7a5826d

Download Submit
C:\Program Files\Java\jre1.8.0_66\THIRDPARTYLICENSEREADME-JAVAFX.txt

Filesize
107KB

MD5
a6a43116c09c4ac59d580f5ca2b9aee8

SHA1
aacc2e6c31aaf190e7686d482e1e73519dc6d091

SHA256
3a3e407c920cc4646f050b22a12324ea3dadca2331a9125ec17eadc47294dc98

SHA512
e34f8f2dc32c537180e94c4f95bae896463cae10f11258142121016781b578939514885fe40ba4fbe79e553374623f924583f1987ecc4cb80a017012f4b032ee

Download Submit
C:\Program Files\Java\jre1.8.0_66\THIRDPARTYLICENSEREADME.txt

Filesize
173KB

MD5
01b87d595762f19af990395536148bb9

SHA1
3c931dff3fadda83fbcd12e331c00215ca692b5a

SHA256
75f881c6797501865a3303b46a6b0d06505894f1713ba4babbf446ea16de819d

SHA512
6f6d0254dc3864fadc8c17e629210e04eac7f08424692bec5b68b20ed2502be8dfca1013ac79e7f8e534c3149925a5f31180a360b957242ed251c68ab37a1d7f

Download Submit
C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub2019_eula.txt

Filesize
416B

MD5
aca7774691269d7f02dc7f4cb7454fe8

SHA1
c476b39a70dbf80a1ae4723de06e5225c272dfb8

SHA256
c09a0e587bebac218ec3b647d2ff2bc2a40a8c0da17db261dd61d5e2f270a8cc

SHA512
8e65600d6fb6f096786720ae83f1b2c95e89b2dcac57bb80e64f71bf090044859621f8aa176ae51f1598faad9ba4b2f60665f4af14427968e329b80c63748a33

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Filesize
4KB

MD5
24be8a92460b5b7a555b1da559296958

SHA1
94147054e8a04e82fea1c185af30c7c90b194064

SHA256
77a3cfe6b7eb676af438d5de88c7efcb6abcc494e0b65da90201969e6d79b2a3

SHA512
ed8ef0453e050392c430fdcf556249f679570c130decd18057e077471a45ab0bc0fba513cb2d4d1c61f3d1935318113b3733dec2bc7828a169b18a1081e609a0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Filesize
342B

MD5
e1f00148e4fe1ea7163406848a49dcbe

SHA1
a7b499816560c2e8f8f1a898d74f1e045b6437f8

SHA256
cda0f1e6d723a541e01b073ed0ee18a68051f645d49c1d167745030b11e3b429

SHA512
6db928a67380d0a48e8c004e632e72821a873d26f9a7f86bc5ffda3321c3fe3f0299714e6d3f417ece337dfd6032d0627c6ad107d410c9d8afa3395d85d8a221

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\GMAQ31I9\edgecompatviewlist[1].xml

Filesize
74KB

MD5
d4fc49dc14f63895d997fa4940f24378

SHA1
3efb1437a7c5e46034147cbbc8db017c69d02c31

SHA256
853d2f4eb81c9fdcea2ee079f6faf98214b111b77cdf68709b38989d123890f1

SHA512
cc60d79b4afe5007634ac21dc4bc92081880be4c0d798a1735b63b27e936c02f399964f744dc73711987f01e8a1064b02a4867dd6cac27538e5fbe275cc61e0a

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{e4e6a5fa-1a96-4117-9cd4-0eccc1b24c1b}\0.0.filtertrie.intermediate.txt

Filesize
15KB

MD5
f68b7443797ad3eb20677d5c3a5ce254

SHA1
d35f1307f72e301cec6b97dc57201fa0aff49fbb

SHA256
4f4e5a57fa1bb13c738dbdf0b3a47a8c3c25010eec2bc83ea548f900a04f7832

SHA512
37e042b2c36d5766241c6f97b8d1e73440fa9e5d69f86361169b7d279542d66dc6473190ae033173789fbafa8f6e472a8cf19326c538c2b6896ee8b138e0d1b5

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133379810919710374.txt

Filesize
58KB

MD5
33c767981b548cd67f5a1aa6c041f453

SHA1
12aca00bbc3c3bec1c0ea7224a5a860e4ffc87d7

SHA256
46c2670f8b282ba836295ab671ecd927cb8e8c6024b68e83888e9e9c92c28cc2

SHA512
6809f153580e104d5fc5054d14258247a774d521c29582cd049204fa2d124e80b2c1411f7e422ffc8aae258ac84638516748bf3d1bee881e86243275a21d023b

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133379822127582862.txt

Filesize
91KB

MD5
751230d580291e05c7ccaf8aab88bb4f

SHA1
307db7a14a1cdf80b6e8cd3f8a1e584b97c9bcb8

SHA256
763bd4b6711969d9bff4cf0ed67e64170e5c0f281a51cd5a2914228d43090633

SHA512
deedcbbc14154da755e2d743a58e21771e37df8b45c1cf074f622e2fad41666c203bcc8cea69bf540d05718e97a36d59ba60206b72b8d5a10ff37f470b9a88e1

Download Submit
C:\Users\Admin\Desktop\RECOVERY.HTM

Filesize
11KB

MD5
092693e2494176eb033815de999d7eac

SHA1
aecc51236f08b10ec55005fba4e0989a503c1042

SHA256
3d7b6bf66480a0f34a7d0635a5b555206ec64a838ff2e767e214a2252c75b944

SHA512
c28c5a2beb5490f9a707e70e08ba09ccc68245c1b2add301c86ac31160953dfa93730054b3d6f7725818363abc627bbf6f0a2675836de92d845909fbbad1e399

Download Submit
C:\Users\Admin\Desktop\RECOVERY.TXT

Filesize
1KB

MD5
f0e6d1fad778b28cac4cdf003da5392b

SHA1
edf73fcb57e770dafb06ef881ebd438f8c639480

SHA256
c02beef44d3831bb70eb4aaf75499a344c47623488a1f57dc74d1b681184ad66

SHA512
b1062f15d3cfb5ed5619f67d53b21212218671a52fa4874416fcbbf71226732dfe479c179a5b392e68a0b8f39b74e71e89036c4692032ec2bbf0a7f50e7abe15

Download Submit
C:\Windows\nbbkdkvlcafl.exe

Filesize
360KB

MD5
9ce01dfbf25dfea778e57d8274675d6f

SHA1
1bd767beb5bc36b396ca6405748042640ad57526

SHA256
5343947829609f69e84fe7e8172c38ee018ede3c9898d4895275f596ac54320d

SHA512
d6ba89c1f221a94e3061bc4da896760d99935a7c766b8e4e30146266cf3356acd883835e75dbb86574bc869c83d381c8f63f23392101f6062bba4343af49978b

Download Submit
C:\Windows\nbbkdkvlcafl.exe

Filesize
360KB

MD5
9ce01dfbf25dfea778e57d8274675d6f

SHA1
1bd767beb5bc36b396ca6405748042640ad57526

SHA256
5343947829609f69e84fe7e8172c38ee018ede3c9898d4895275f596ac54320d

SHA512
d6ba89c1f221a94e3061bc4da896760d99935a7c766b8e4e30146266cf3356acd883835e75dbb86574bc869c83d381c8f63f23392101f6062bba4343af49978b

Download Submit
memory/3984-10454-0x0000018A6C620000-0x0000018A6C630000-memory.dmp

Filesize
64KB

Download
memory/3984-10489-0x0000018A6CA40000-0x0000018A6CA42000-memory.dmp

Filesize
8KB

Download
memory/3984-10470-0x0000018A6CF00000-0x0000018A6CF10000-memory.dmp

Filesize
64KB

Download
memory/4740-9-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/4740-1-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/4740-0-0x0000000000AB0000-0x0000000000B35000-memory.dmp

Filesize
532KB

Download
memory/4740-10-0x0000000000AB0000-0x0000000000B35000-memory.dmp

Filesize
532KB

Download
memory/4932-559-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/4932-10522-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/4932-8276-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/4932-6481-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/4932-5025-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/4932-3841-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/4932-2664-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/4932-12-0x0000000002140000-0x00000000021C5000-memory.dmp

Filesize
532KB

Download
memory/4932-560-0x0000000002140000-0x00000000021C5000-memory.dmp

Filesize
532KB

Download
memory/4932-1453-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/4932-9944-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/4996-10518-0x00000212EA3E0000-0x00000212EA3E2000-memory.dmp

Filesize
8KB

Download
memory/4996-10520-0x00000212EA400000-0x00000212EA402000-memory.dmp

Filesize
8KB

Download
memory/4996-10516-0x00000212EA320000-0x00000212EA322000-memory.dmp

Filesize
8KB

Download
memory/4996-10514-0x00000212EA300000-0x00000212EA302000-memory.dmp

Filesize
8KB

Download
memory/4996-10512-0x00000212EA1E0000-0x00000212EA1E2000-memory.dmp

Filesize
8KB

Download
memory/4996-10509-0x00000212EA1B0000-0x00000212EA1B2000-memory.dmp

Filesize
8KB

Download