chaos | hxxps://github[.]com/pankoza2-pl/malwaredatabase-old

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
07-03-2024 14:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/pankoza2-pl/malwaredatabase-old

Score

10^/10

chaos bootkit evasion persistence ransomware trojan upx

Malware Config

Signatures

Chaos
Ransomware family first seen in June 2021.
ransomware chaos

Chaos Ransomware 2 IoCs

resource	yara_rule
behavioral1/files/0x0007000000023577-442.dat	family_chaos
behavioral1/memory/5704-451-0x00000000002A0000-0x00000000002C0000-memory.dmp	family_chaos

UAC bypass 3 TTPs 2 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe

Disables Task Manager via registry modification
evasion
Downloads MZ/PE file

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation	Antivirus 2021.exe
Key value queried	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation	Cov29Cry.exe
Key value queried	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation	Antivirus 2021.exe

Executes dropped EXE 5 IoCs

pid	Process
4588	Antivirus 2021.exe
4384	Antivirus 2021.exe
6116	mbr.exe
5704	Cov29Cry.exe
868	svchost.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x00070000000233c1-354.dat	upx
behavioral1/memory/2200-409-0x0000000000400000-0x00000000005D5000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
164	raw.githubusercontent.com
165	raw.githubusercontent.com

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	mbr.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\Local Settings	Antivirus 2021.exe
Key created	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\Local Settings	Antivirus 2021.exe
Key created	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\Local Settings	cmd.exe

Modifies registry key 1 TTPs 7 IoCs

Modify Registry

T1112

pid	Process
5824	reg.exe
5812	reg.exe
4872	reg.exe
5944	reg.exe
4312	reg.exe
5800	reg.exe
2600	reg.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 606814.crdownload:SmartScreen	msedge.exe

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
4468	PING.EXE
4728	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2680	msedge.exe
2680	msedge.exe
1916	msedge.exe
1916	msedge.exe
4976	identity_helper.exe
4976	identity_helper.exe
5896	msedge.exe
5896	msedge.exe
3256	taskmgr.exe
3256	taskmgr.exe
3256	taskmgr.exe
3256	taskmgr.exe
3256	taskmgr.exe
3256	taskmgr.exe
3256	taskmgr.exe
3256	taskmgr.exe
3256	taskmgr.exe
3256	taskmgr.exe
3256	taskmgr.exe
3256	taskmgr.exe
3256	taskmgr.exe
3256	taskmgr.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
6096	msedge.exe
6096	msedge.exe
5704	Cov29Cry.exe
5704	Cov29Cry.exe
5704	Cov29Cry.exe
5704	Cov29Cry.exe
5704	Cov29Cry.exe
5704	Cov29Cry.exe
5704	Cov29Cry.exe
5704	Cov29Cry.exe
5704	Cov29Cry.exe
5704	Cov29Cry.exe
5704	Cov29Cry.exe
5704	Cov29Cry.exe
5704	Cov29Cry.exe
5704	Cov29Cry.exe
5704	Cov29Cry.exe
5704	Cov29Cry.exe
5704	Cov29Cry.exe
5704	Cov29Cry.exe
5704	Cov29Cry.exe
5704	Cov29Cry.exe
5704	Cov29Cry.exe
5704	Cov29Cry.exe
5704	Cov29Cry.exe
5704	Cov29Cry.exe
868	svchost.exe
868	svchost.exe
868	svchost.exe
868	svchost.exe
868	svchost.exe
868	svchost.exe
868	svchost.exe
868	svchost.exe
868	svchost.exe
868	svchost.exe
868	svchost.exe
868	svchost.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
1916	msedge.exe
1916	msedge.exe
1916	msedge.exe
1916	msedge.exe
1916	msedge.exe
1916	msedge.exe
1916	msedge.exe
1916	msedge.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeDebugPrivilege	3256	taskmgr.exe
Token: SeSystemProfilePrivilege	3256	taskmgr.exe
Token: SeCreateGlobalPrivilege	3256	taskmgr.exe
Token: 33	3256	taskmgr.exe
Token: SeIncBasePriorityPrivilege	3256	taskmgr.exe
Token: SeShutdownPrivilege	5512	shutdown.exe
Token: SeRemoteShutdownPrivilege	5512	shutdown.exe
Token: SeDebugPrivilege	5704	Cov29Cry.exe
Token: SeDebugPrivilege	868	svchost.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1916	msedge.exe
1916	msedge.exe
1916	msedge.exe
1916	msedge.exe
1916	msedge.exe
1916	msedge.exe
1916	msedge.exe
1916	msedge.exe
1916	msedge.exe
1916	msedge.exe
1916	msedge.exe
1916	msedge.exe
1916	msedge.exe
1916	msedge.exe
1916	msedge.exe
1916	msedge.exe
1916	msedge.exe
1916	msedge.exe
1916	msedge.exe
1916	msedge.exe
1916	msedge.exe
1916	msedge.exe
1916	msedge.exe
1916	msedge.exe
1916	msedge.exe
1916	msedge.exe
1916	msedge.exe
1916	msedge.exe
1916	msedge.exe
1916	msedge.exe
1916	msedge.exe
1916	msedge.exe
1916	msedge.exe
1916	msedge.exe
1916	msedge.exe
3256	taskmgr.exe
3256	taskmgr.exe
3256	taskmgr.exe
3256	taskmgr.exe
3256	taskmgr.exe
3256	taskmgr.exe
3256	taskmgr.exe
3256	taskmgr.exe
3256	taskmgr.exe
3256	taskmgr.exe
3256	taskmgr.exe
3256	taskmgr.exe
3256	taskmgr.exe
3256	taskmgr.exe
3256	taskmgr.exe
3256	taskmgr.exe
3256	taskmgr.exe
3256	taskmgr.exe
3256	taskmgr.exe
3256	taskmgr.exe
3256	taskmgr.exe
3256	taskmgr.exe
3256	taskmgr.exe
3256	taskmgr.exe
3256	taskmgr.exe
3256	taskmgr.exe
3256	taskmgr.exe
3256	taskmgr.exe
3256	taskmgr.exe

Suspicious use of SendNotifyMessage 62 IoCs

pid	Process
1916	msedge.exe
1916	msedge.exe
1916	msedge.exe
1916	msedge.exe
1916	msedge.exe
1916	msedge.exe
1916	msedge.exe
1916	msedge.exe
1916	msedge.exe
1916	msedge.exe
1916	msedge.exe
1916	msedge.exe
1916	msedge.exe
1916	msedge.exe
1916	msedge.exe
1916	msedge.exe
1916	msedge.exe
1916	msedge.exe
1916	msedge.exe
1916	msedge.exe
1916	msedge.exe
1916	msedge.exe
1916	msedge.exe
1916	msedge.exe
3256	taskmgr.exe
3256	taskmgr.exe
3256	taskmgr.exe
3256	taskmgr.exe
3256	taskmgr.exe
3256	taskmgr.exe
3256	taskmgr.exe
3256	taskmgr.exe
3256	taskmgr.exe
3256	taskmgr.exe
3256	taskmgr.exe
3256	taskmgr.exe
3256	taskmgr.exe
3256	taskmgr.exe
3256	taskmgr.exe
3256	taskmgr.exe
3256	taskmgr.exe
3256	taskmgr.exe
3256	taskmgr.exe
3256	taskmgr.exe
3256	taskmgr.exe
3256	taskmgr.exe
3256	taskmgr.exe
3256	taskmgr.exe
3256	taskmgr.exe
3256	taskmgr.exe
3256	taskmgr.exe
3256	taskmgr.exe
3256	taskmgr.exe
3256	taskmgr.exe
3256	taskmgr.exe
3256	taskmgr.exe
3256	taskmgr.exe
3256	taskmgr.exe
3256	taskmgr.exe
3256	taskmgr.exe
3256	taskmgr.exe
3256	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1916 wrote to memory of 3580	1916	msedge.exe	89
PID 1916 wrote to memory of 3580	1916	msedge.exe	89
PID 1916 wrote to memory of 1996	1916	msedge.exe	90
PID 1916 wrote to memory of 1996	1916	msedge.exe	90
PID 1916 wrote to memory of 1996	1916	msedge.exe	90
PID 1916 wrote to memory of 1996	1916	msedge.exe	90
PID 1916 wrote to memory of 1996	1916	msedge.exe	90
PID 1916 wrote to memory of 1996	1916	msedge.exe	90
PID 1916 wrote to memory of 1996	1916	msedge.exe	90
PID 1916 wrote to memory of 1996	1916	msedge.exe	90
PID 1916 wrote to memory of 1996	1916	msedge.exe	90
PID 1916 wrote to memory of 1996	1916	msedge.exe	90
PID 1916 wrote to memory of 1996	1916	msedge.exe	90
PID 1916 wrote to memory of 1996	1916	msedge.exe	90
PID 1916 wrote to memory of 1996	1916	msedge.exe	90
PID 1916 wrote to memory of 1996	1916	msedge.exe	90
PID 1916 wrote to memory of 1996	1916	msedge.exe	90
PID 1916 wrote to memory of 1996	1916	msedge.exe	90
PID 1916 wrote to memory of 1996	1916	msedge.exe	90
PID 1916 wrote to memory of 1996	1916	msedge.exe	90
PID 1916 wrote to memory of 1996	1916	msedge.exe	90
PID 1916 wrote to memory of 1996	1916	msedge.exe	90
PID 1916 wrote to memory of 1996	1916	msedge.exe	90
PID 1916 wrote to memory of 1996	1916	msedge.exe	90
PID 1916 wrote to memory of 1996	1916	msedge.exe	90
PID 1916 wrote to memory of 1996	1916	msedge.exe	90
PID 1916 wrote to memory of 1996	1916	msedge.exe	90
PID 1916 wrote to memory of 1996	1916	msedge.exe	90
PID 1916 wrote to memory of 1996	1916	msedge.exe	90
PID 1916 wrote to memory of 1996	1916	msedge.exe	90
PID 1916 wrote to memory of 1996	1916	msedge.exe	90
PID 1916 wrote to memory of 1996	1916	msedge.exe	90
PID 1916 wrote to memory of 1996	1916	msedge.exe	90
PID 1916 wrote to memory of 1996	1916	msedge.exe	90
PID 1916 wrote to memory of 1996	1916	msedge.exe	90
PID 1916 wrote to memory of 1996	1916	msedge.exe	90
PID 1916 wrote to memory of 1996	1916	msedge.exe	90
PID 1916 wrote to memory of 1996	1916	msedge.exe	90
PID 1916 wrote to memory of 1996	1916	msedge.exe	90
PID 1916 wrote to memory of 1996	1916	msedge.exe	90
PID 1916 wrote to memory of 1996	1916	msedge.exe	90
PID 1916 wrote to memory of 1996	1916	msedge.exe	90
PID 1916 wrote to memory of 2680	1916	msedge.exe	91
PID 1916 wrote to memory of 2680	1916	msedge.exe	91
PID 1916 wrote to memory of 1992	1916	msedge.exe	92
PID 1916 wrote to memory of 1992	1916	msedge.exe	92
PID 1916 wrote to memory of 1992	1916	msedge.exe	92
PID 1916 wrote to memory of 1992	1916	msedge.exe	92
PID 1916 wrote to memory of 1992	1916	msedge.exe	92
PID 1916 wrote to memory of 1992	1916	msedge.exe	92
PID 1916 wrote to memory of 1992	1916	msedge.exe	92
PID 1916 wrote to memory of 1992	1916	msedge.exe	92
PID 1916 wrote to memory of 1992	1916	msedge.exe	92
PID 1916 wrote to memory of 1992	1916	msedge.exe	92
PID 1916 wrote to memory of 1992	1916	msedge.exe	92
PID 1916 wrote to memory of 1992	1916	msedge.exe	92
PID 1916 wrote to memory of 1992	1916	msedge.exe	92
PID 1916 wrote to memory of 1992	1916	msedge.exe	92
PID 1916 wrote to memory of 1992	1916	msedge.exe	92
PID 1916 wrote to memory of 1992	1916	msedge.exe	92
PID 1916 wrote to memory of 1992	1916	msedge.exe	92
PID 1916 wrote to memory of 1992	1916	msedge.exe	92
PID 1916 wrote to memory of 1992	1916	msedge.exe	92
PID 1916 wrote to memory of 1992	1916	msedge.exe	92

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/pankoza2-pl/malwaredatabase-old
1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb519a46f8,0x7ffb519a4708,0x7ffb519a4718
  2⤵
  PID:3580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,6898953250244333638,15611704076195875317,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2176 /prefetch:2
  2⤵
  PID:1996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2168,6898953250244333638,15611704076195875317,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2168,6898953250244333638,15611704076195875317,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2692 /prefetch:8
  2⤵
  PID:1992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,6898953250244333638,15611704076195875317,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:1436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,6898953250244333638,15611704076195875317,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:3952
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2168,6898953250244333638,15611704076195875317,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5488 /prefetch:8
  2⤵
  PID:1876
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2168,6898953250244333638,15611704076195875317,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5488 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,6898953250244333638,15611704076195875317,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5352 /prefetch:1
  2⤵
  PID:1032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,6898953250244333638,15611704076195875317,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5236 /prefetch:1
  2⤵
  PID:1876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,6898953250244333638,15611704076195875317,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:5264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,6898953250244333638,15611704076195875317,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
  2⤵
  PID:5272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2168,6898953250244333638,15611704076195875317,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=2080 /prefetch:8
  2⤵
  PID:5752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,6898953250244333638,15611704076195875317,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5024 /prefetch:1
  2⤵
  PID:5532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2168,6898953250244333638,15611704076195875317,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6176 /prefetch:8
  2⤵
  PID:5988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2168,6898953250244333638,15611704076195875317,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6360 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5896
- C:\Users\Admin\Downloads\Antivirus 2021.exe
  "C:\Users\Admin\Downloads\Antivirus 2021.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Modifies registry class
  PID:4588
- - C:\Windows\SysWOW64\mshta.exe
    "C:\Windows\SysWOW64\mshta.exe" "C:\Antivirus.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
    3⤵
    PID:5356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,6898953250244333638,15611704076195875317,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4764 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,6898953250244333638,15611704076195875317,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1884 /prefetch:1
  2⤵
  PID:1468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2168,6898953250244333638,15611704076195875317,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5812 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6096

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2920

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4668

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /7
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3256

C:\Windows\SysWOW64\werfault.exe
werfault.exe /h /shared Global\bd0c08e059a1474ab2fd4e71ebd2e3b9 /t 1452 /p 5356
1⤵
PID:4600

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4440

C:\Users\Admin\Downloads\Antivirus 2021.exe
"C:\Users\Admin\Downloads\Antivirus 2021.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
PID:4384
- C:\Windows\SysWOW64\mshta.exe
  "C:\Windows\SysWOW64\mshta.exe" "C:\Antivirus.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
  2⤵
  PID:988

C:\Users\Admin\AppData\Local\Temp\Temp1_Covid29 Ransomware.zip\TrojanRansomCovid29.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_Covid29 Ransomware.zip\TrojanRansomCovid29.exe"
1⤵
PID:2200
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\6E02.tmp\TrojanRansomCovid29.bat" "
  2⤵
  - Checks computer location settings
  - Modifies registry class
  PID:2192
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6E02.tmp\fakeerror.vbs"
    3⤵
    PID:4956
- - C:\Windows\SysWOW64\PING.EXE
    ping localhost -n 2
    3⤵
    - Runs ping.exe
    PID:4468
- - C:\Windows\SysWOW64\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
    3⤵
    - Modifies registry key
    PID:5944
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System /v HideFastUserSwitching /t REG_DWORD /d 1 /f
    3⤵
    - Modifies registry key
    PID:4312
- - C:\Windows\SysWOW64\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableChangePassword /t REG_DWORD /d 1 /f
    3⤵
    - Modifies registry key
    PID:5800
- - C:\Windows\SysWOW64\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableLockWorkstation /t REG_DWORD /d 1 /f
    3⤵
    - Modifies registry key
    PID:2600
- - C:\Windows\SysWOW64\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoLogoff /t REG_DWORD /d 1 /f
    3⤵
    - Modifies registry key
    PID:5824
- - C:\Windows\SysWOW64\reg.exe
    reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v ConsentPromptBehaviorAdmin /t REG_DWORD /d 0 /f
    3⤵
    - UAC bypass
    - Modifies registry key
    PID:5812
- - C:\Windows\SysWOW64\reg.exe
    reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
    3⤵
    - UAC bypass
    - Modifies registry key
    PID:4872
- - C:\Users\Admin\AppData\Local\Temp\6E02.tmp\mbr.exe
    mbr.exe
    3⤵
    - Executes dropped EXE
    - Writes to the Master Boot Record (MBR)
    PID:6116
- - C:\Users\Admin\AppData\Local\Temp\6E02.tmp\Cov29Cry.exe
    Cov29Cry.exe
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5704
  - - C:\Users\Admin\AppData\Roaming\svchost.exe
      "C:\Users\Admin\AppData\Roaming\svchost.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:868
- - C:\Windows\SysWOW64\shutdown.exe
    shutdown /r /t 300 /c "5 minutes to pay until you lose your data and system forever"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5512
- - C:\Windows\SysWOW64\PING.EXE
    ping localhost -n 9
    3⤵
    - Runs ping.exe
    PID:4728

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Antivirus.hta

Filesize
662B

MD5
8630fa16691e438e5272f37096806782

SHA1
4d49582d446120da6d7856eba3f486c61692a98f

SHA256
0189de779a96cd4a5b0ce942264ef9d4fc05b7b62e1dde01bac9731d3ada6f96

SHA512
4748c5188e0f59beec03825eede6c143502388dfa60d8d0fca677287e209daf4da5f2d49709f8fb6609576854e47f36483bee54ff2019d6beed568179d602092

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\53738599-23d4-467d-890d-826fd9a51c2f.tmp

Filesize
12KB

MD5
e8af80a6bcaf90d6110ad05366448356

SHA1
8de7da277fedf1518ab859081ce562e053c65ff2

SHA256
b879d74da5634d897ea188adf38e94bef6f6df68090a843195b45466b2dadba4

SHA512
53ae40df8976edf4cf0daafbda2a258c695375f9b124e0bdac87ec1fe670fdb96c959228ae2dd00a6dd1eaf0d4d03b932cb6eb5ac5a788575b59e6ea055a7655

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f35bb0615bb9816f562b83304e456294

SHA1
1049e2bd3e1bbb4cea572467d7c4a96648659cb4

SHA256
05e80abd624454e5b860a08f40ddf33d672c3fed319aac180b7de5754bc07b71

SHA512
db9100f3e324e74a9c58c7d9f50c25eaa4c6c4553c93bab9b80c6f7bef777db04111ebcd679f94015203b240fe9f4f371cae0d4290ec891a4173c746ff4b11c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1eb86108cb8f5a956fdf48efbd5d06fe

SHA1
7b2b299f753798e4891df2d9cbf30f94b39ef924

SHA256
1b53367e0041d54af89e7dd59733231f5da1393c551ed2b943c89166c0baca40

SHA512
e2a661437688a4a01a6eb3b2bd7979ecf96b806f5a487d39354a7f0d44cb693a3b1c2cf6b1247b04e4106cc816105e982569572042bdddb3cd5bec23b4fce29d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
ad280ed80c2e81602eaa0602469814b2

SHA1
9aad424f01d35374cb2fd28befd81648c2155c2a

SHA256
bdf48035f7993de0cbc62c22a89172bf19991a5c6afa7388f55e42eb17b8284f

SHA512
dc70ef1936d829c0cf3508ad1f284aa49d3628d244f6fe4371934ba420d852f653bc338304945cc6c5e7c2743168da0a1f26436a00c59b48ab8b04c3a7081f30

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
088627769aa7802a50cc791d2020820c

SHA1
659d21de1a0c2977fffab1e5579fce8cdcd3573f

SHA256
d1cde4421114f26e256e98701e470b5a488b05c775d7bb0b4be6d96a479985a6

SHA512
f2f46c771745a5b4f58b4e4b67120eb0b1ffe69e9645c3757c55d2140b517299335343ff7981a50c8a315d62de1b28af8bc8a08a7fc913b49b43280500fd8ead

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
579B

MD5
a7d1701142cca705f833d70023ef4e1e

SHA1
1b76853132abfcddb4fefac42bf9df5d013c9815

SHA256
6c92f51e7f056e73c407228fc280cb7ca4d00ab02674d1dda4eafd7dc9f070f7

SHA512
806b7ccb375cc6116e64a9fa15229d783615d13b54cf40251561d9b664f0925915c5375ad88f5ca8d061e01367de239c29da79adf693559af53eeb7d9b1ba1a0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
945835f06a6ebcf5adedc6d11b76fbac

SHA1
d6eb5aa71c3640bc8a3066bc22c3ec448b428b79

SHA256
a97920f84832f21bada05794c7568825abfd0203ccc7e7fbd8127848575077ed

SHA512
b6aacbcc0273396b6aac9095aa81395d8fed36bee1036f3bbb3c562ef3f46e19167d1479fe297b0add2f5dd778eec940d01e7daf5fd72815425049478a13d043

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
52686d45cc4706aac029fcd9fba9a83e

SHA1
1c5bb889a81a36c1753f475adf5367e49ab18ea6

SHA256
23d52ea30b7c8a4d0aaf9b312f072bfdd9d1ad9dbeef98dd4aed8490c36b36d8

SHA512
77a39737ff3b994a67244b8165159673c317c66478e0708a3acb22682116a3ce6d38fea8b7273cc403980660d760fc0e1c4fa59736320b8305c1189dde008e4f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
a7416d01950b92bfac04511027f309ba

SHA1
d0cfbb9b994f86fd8f24b8dfbdd3a9960a4a5de6

SHA256
98b5dd47e8f8ace9b8bba0743666792e5ceacc58ded7db58c54f0196cf67c776

SHA512
6662715e902a3b765ff63b4c62fa72093b62df5a662aa55259851f6b64c7a1da9ab8f53c2add0da8a933d13fc14e37da354d0aeb0f108b5b0bd3c7becf774277

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
bd5e1b2f9982b9c65afc7b1e062e8c1c

SHA1
3434820d3bba6eaddf8ffb81c98ddac19161e904

SHA256
c1096aa646e54ac9fed1672ad06f628b58ec551f348bd213cecdb4c5b63231ee

SHA512
4e6564d42200295cfba44837f6af8fc9669b86a0d156a21dae7cd108e39f0777640fe866de89977bc412adcdfb323243fdb486c189a2840d125650566b15affa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
92d1b9f877456fcc3566c6bf55f362a2

SHA1
14311b03ca6f3023da267126fb705f4cda251e6e

SHA256
a33cc00b5a397ed36d3ec71736b4c537a692b63e74aa5b3bb0ea23be4c2046a9

SHA512
6eae712a4d49c118375b30c06993a4ebaa6b2ad8e362a92a2c8eb82ac610dcf8ecf38b9ac52f53c7232511f783dc8737a4148f1cde6083f4b91baf6d2f5c4875

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe581f7a.TMP

Filesize
874B

MD5
180b0ecd5d9a6bce91eaac0f29f04170

SHA1
7a1668a2b1bc99468880bb5396d6bc6d6f8ab70a

SHA256
a9339f1ae8fb61ac8f6bc91045d35039e7fd9012da260ee041ab084806f59c17

SHA512
6a3b3e765656a579caff9cfa4d7b0deb1a77dd99e054264d14c883c1f53212f0efd422298f125c35b97a7d5374038a5387d5c2886031c0e62ea06f1b0702411d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b3986747-e087-49a7-9d4c-332fc75434b8.tmp

Filesize
6KB

MD5
c0e67282a14267c4f7c25632a3cab143

SHA1
25543539a4f9a096d7655103b02e76e339f8b21e

SHA256
45c64bb2f20199d2fc08afc4c031f8f547bba42ef32e4ef6787e43ef322062df

SHA512
9eb9af6c0f9381039b291eb40797176b34c5c0345de02d5c5c2902b710db7a20e6e540d4685a0b9a88b3c1a15df6720ac8ac5f14d13c087e30eb6daecf852226

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
4e2433f48948cbc67c6d4b04933ea599

SHA1
ee4b33823b1a35f5440df62f1bd0f8965abf40bb

SHA256
b86bd3fe10197f695d016dbcf4a96bc7d73e0cac3ca71d89235b0a91a455ba75

SHA512
fb47c89b7a2c921794dd4adcedf03422de6d4296761dc7f27e8b903e59f1df3ff62bfdb7073754f2dd32932c28b5f8ced0584313a8aaa3fc34dab996b945a812

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
d1e5628a79aca3894c105a46abc6d742

SHA1
ae01b240d4f269775ba5315bfd08c80e488108ab

SHA256
6657c20bee84e261c4a0584c01f03516bca01cfcc48342320b536f268c9bfddd

SHA512
bbac1b08d751a5e64f68f608f8015f09bc13f064e200cc606fbbf9d796338a9356fcb8dff6c021d5add376ef6b38bdd86fea2ff63fe73d5633db4ce9a82e6804

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
c34cb9a19f3566c809b29e6a3a9e4415

SHA1
1e9bbad42b20b950b733de4d8183d8f4382f693f

SHA256
74981c32ce3f925608c79debd048c1e3fc01636f923ac87a5dc7de5d2ef38036

SHA512
65a641ba6e6942a2c51b067d94bab26859a646faf44edc860d6361f50e75878b92d43d3bb0a7ac0e979e4b1cae622f29922a4deb26a7149be4a10677c95167cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
e4ea6314455e55c56230db7fc8d06485

SHA1
c8cda3e45871525d63efd57fa17b86c0a91329e6

SHA256
dd2837ee0c150f29fd9fc9414328f853554207a8c796935bab96d8a170daa4b2

SHA512
960b40b7b2ea35b392c19dfc3d821c69cd4f5775d8e6432def82d5ce37a025d579f400148136ffdff1eb3e487c7ee10306599f385bffa18b3de4f55adce4846d

Download Submit
C:\Users\Admin\AppData\Local\Temp\6E02.tmp\Cov29Cry.exe.death

Filesize
103KB

MD5
8bcd083e16af6c15e14520d5a0bd7e6a

SHA1
c4d2f35d1fdb295db887f31bbc9237ac9263d782

SHA256
b4f78ff66dc3f5f8ddd694166e6b596d533830792f9b5f1634d3f5f17d6a884a

SHA512
35999577be0626b50eeab65b493d48af2ab42b699f7241d2780647bf7d72069216d99f5f708337a109e79b9c9229613b8341f44c6d96245fd1f3ac9f05814d6a

Download Submit
C:\Users\Admin\AppData\Local\Temp\6E02.tmp\TrojanRansomCovid29.bat

Filesize
1KB

MD5
57f0432c8e31d4ff4da7962db27ef4e8

SHA1
d5023b3123c0b7fae683588ac0480cd2731a0c5e

SHA256
b82e64e533789c639d8e193b78e06fc028ea227f55d7568865120be080179afc

SHA512
bc082486503a95f8e2ce7689d31423386a03054c5e8e20e61250ca7b7a701e98489f5932eba4837e05ec935057f18633798a10f6f84573a95fcf086ee7cabcbf

Download Submit
C:\Users\Admin\AppData\Local\Temp\6E02.tmp\fakeerror.vbs

Filesize
144B

MD5
c0437fe3a53e181c5e904f2d13431718

SHA1
44f9547e7259a7fb4fe718e42e499371aa188ab6

SHA256
f2571f03eb9d5ee4dca29a8fec1317ded02973c5dd233d582f56cebe98544f22

SHA512
a6b488fc74dc69fc4227f92a06deb297d19cd54b0e07659f9c9a76ce15d1ef1d8fa4d607acdd03d30d3e2be2a0f59503e27fc95f03f3006e137fa2f92825e7e3

Download Submit
C:\Users\Admin\AppData\Local\Temp\6E02.tmp\mbr.exe.danger

Filesize
1.3MB

MD5
35af6068d91ba1cc6ce21b461f242f94

SHA1
cb054789ff03aa1617a6f5741ad53e4598184ffa

SHA256
9ac99df89c676a55b48de00384506f4c232c75956b1e465f7fe437266002655e

SHA512
136e3066c6e44af30691bcd76d9af304af0edf69f350211cf74d6713c4c952817a551757194b71c3b49ac3f87a6f0aa88fb80eb1e770d0f0dd82b29bfce80169

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 606814.crdownload

Filesize
603KB

MD5
a9781403e2e0f3539b81dbbc4ba52f07

SHA1
cba433e3c7690c1628bc620a43912f06db331065

SHA256
16837f396802d446e72fb4d02c68a2e07b5657e3e1d3d738b79a2c8992ad1ad0

SHA512
6c985a47a7bed1e150cbed5da08cb2528fdf8e5d80a482610ad7fb14d079cb19756872453b23ace8dade982b4979ff885de7b41e798b3d4ccdc957f2564836c5

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 656129.crdownload

Filesize
1.7MB

MD5
272d3e458250acd2ea839eb24b427ce5

SHA1
fae7194da5c969f2d8220ed9250aa1de7bf56609

SHA256
bbb5c6b4f85c81a323d11d34629776e99ca40e983c5ce0d0a3d540addb1c2fe3

SHA512
d05bb280775515b6eedf717f88d63ed11edbaae01321ec593ecc0725b348e9a0caacf7ebcd2c25a6e0dc79b2cdae127df5aa380b48480332a6f5cd2b32d4e55c

Download Submit
C:\\1.exe

Filesize
342KB

MD5
1698c972976295cd6072fb70a73c0cdc

SHA1
1c7e38ca6f7eeced6904d4b823f62b1569cf7f7c

SHA256
0ac6268c3d4ecddd9efdc853f4a2096dfa197f1e729960f55507b1f6276807dc

SHA512
4d4f2268e49ee1a5a014084227367062832c56c5e538159d3977cd46a2fff031dc72bb6c9dadb420095af90fd25a421aef1a35ae5d200bc434c87e34d9cce11f

Download Submit
memory/868-466-0x00007FFB39A20000-0x00007FFB3A4E1000-memory.dmp

Filesize
10.8MB

Download
memory/2200-409-0x0000000000400000-0x00000000005D5000-memory.dmp

Filesize
1.8MB

Download
memory/3256-340-0x00000285A6D60000-0x00000285A6D61000-memory.dmp

Filesize
4KB

Download
memory/3256-344-0x00000285A6D60000-0x00000285A6D61000-memory.dmp

Filesize
4KB

Download
memory/3256-349-0x00000285A6D60000-0x00000285A6D61000-memory.dmp

Filesize
4KB

Download
memory/3256-348-0x00000285A6D60000-0x00000285A6D61000-memory.dmp

Filesize
4KB

Download
memory/3256-347-0x00000285A6D60000-0x00000285A6D61000-memory.dmp

Filesize
4KB

Download
memory/3256-346-0x00000285A6D60000-0x00000285A6D61000-memory.dmp

Filesize
4KB

Download
memory/3256-345-0x00000285A6D60000-0x00000285A6D61000-memory.dmp

Filesize
4KB

Download
memory/3256-350-0x00000285A6D60000-0x00000285A6D61000-memory.dmp

Filesize
4KB

Download
memory/3256-339-0x00000285A6D60000-0x00000285A6D61000-memory.dmp

Filesize
4KB

Download
memory/3256-338-0x00000285A6D60000-0x00000285A6D61000-memory.dmp

Filesize
4KB

Download
memory/5704-451-0x00000000002A0000-0x00000000002C0000-memory.dmp

Filesize
128KB

Download
memory/5704-452-0x00007FFB39A20000-0x00007FFB3A4E1000-memory.dmp

Filesize
10.8MB

Download
memory/5704-465-0x00007FFB39A20000-0x00007FFB3A4E1000-memory.dmp

Filesize
10.8MB

Download
memory/6116-450-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download