e3e0d94fa969c8b62acbf7ed62c19648dbedd02e90830f4fa0a0811366c8be85

Resubmissions

04/04/2024, 14:55

240404-sae5msaf6t8

04/04/2024, 14:38

04/04/2024, 14:32

04/04/2024, 14:30

04/04/2024, 13:55

Analysis

max time kernel
324s
max time network
324s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
04/04/2024, 14:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
cmd-x.lua
Size 1KB
Sample240404-sae5msaf6t
SHA256 e3e0d94fa969c8b62acbf7ed62c19648dbedd02e90830f4fa0a0811366c8be85
MD5 71f3144982eeed188d8c776a92bd819d
SHA1 f3b1b1b7c8e923afc17bbcb10a86478d9c43b1a0
SHA512 736bd75cf7d010c1b9b85c102a90d69bd76343966fc646f51222dcbdb714d8c958cfbd86b31664401ecb61e0f5f9a69666b0e338935df25de68d907bd6bcb66f
MD5 SHA1 SHA512

Score

8^/10

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 3 IoCs

pid	Process
1800	winrar-x64-700.exe
4384	winrar-x64-700.exe
1524	Virus Maker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-983155329-280873152-1838004294-1000\{E034B0BA-C054-413C-92A3-F869C0740673}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings	7zFM.exe
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings	cmd.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 721997.crdownload:SmartScreen	msedge.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
3320	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
2596	msedge.exe
2596	msedge.exe
3844	msedge.exe
3844	msedge.exe
4492	identity_helper.exe
4492	identity_helper.exe
708	msedge.exe
708	msedge.exe
404	msedge.exe
404	msedge.exe
4732	msedge.exe
4732	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1432	7zFM.exe
1432	7zFM.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
4744	7zFM.exe
1432	7zFM.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 22 IoCs

pid	Process
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeRestorePrivilege	4744	7zFM.exe
Token: 35	4744	7zFM.exe
Token: SeRestorePrivilege	5056	7zFM.exe
Token: 35	5056	7zFM.exe
Token: SeRestorePrivilege	872	7zFM.exe
Token: 35	872	7zFM.exe
Token: SeRestorePrivilege	1432	7zFM.exe
Token: 35	1432	7zFM.exe
Token: SeSecurityPrivilege	1432	7zFM.exe
Token: SeSecurityPrivilege	1432	7zFM.exe
Token: SeSecurityPrivilege	1432	7zFM.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
752	OpenWith.exe
4384	winrar-x64-700.exe
4384	winrar-x64-700.exe
1800	winrar-x64-700.exe
1800	winrar-x64-700.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3844 wrote to memory of 2000	3844	msedge.exe	101
PID 3844 wrote to memory of 2000	3844	msedge.exe	101
PID 3844 wrote to memory of 5004	3844	msedge.exe	102
PID 3844 wrote to memory of 5004	3844	msedge.exe	102
PID 3844 wrote to memory of 5004	3844	msedge.exe	102
PID 3844 wrote to memory of 5004	3844	msedge.exe	102
PID 3844 wrote to memory of 5004	3844	msedge.exe	102
PID 3844 wrote to memory of 5004	3844	msedge.exe	102
PID 3844 wrote to memory of 5004	3844	msedge.exe	102
PID 3844 wrote to memory of 5004	3844	msedge.exe	102
PID 3844 wrote to memory of 5004	3844	msedge.exe	102
PID 3844 wrote to memory of 5004	3844	msedge.exe	102
PID 3844 wrote to memory of 5004	3844	msedge.exe	102
PID 3844 wrote to memory of 5004	3844	msedge.exe	102
PID 3844 wrote to memory of 5004	3844	msedge.exe	102
PID 3844 wrote to memory of 5004	3844	msedge.exe	102
PID 3844 wrote to memory of 5004	3844	msedge.exe	102
PID 3844 wrote to memory of 5004	3844	msedge.exe	102
PID 3844 wrote to memory of 5004	3844	msedge.exe	102
PID 3844 wrote to memory of 5004	3844	msedge.exe	102
PID 3844 wrote to memory of 5004	3844	msedge.exe	102
PID 3844 wrote to memory of 5004	3844	msedge.exe	102
PID 3844 wrote to memory of 5004	3844	msedge.exe	102
PID 3844 wrote to memory of 5004	3844	msedge.exe	102
PID 3844 wrote to memory of 5004	3844	msedge.exe	102
PID 3844 wrote to memory of 5004	3844	msedge.exe	102
PID 3844 wrote to memory of 5004	3844	msedge.exe	102
PID 3844 wrote to memory of 5004	3844	msedge.exe	102
PID 3844 wrote to memory of 5004	3844	msedge.exe	102
PID 3844 wrote to memory of 5004	3844	msedge.exe	102
PID 3844 wrote to memory of 5004	3844	msedge.exe	102
PID 3844 wrote to memory of 5004	3844	msedge.exe	102
PID 3844 wrote to memory of 5004	3844	msedge.exe	102
PID 3844 wrote to memory of 5004	3844	msedge.exe	102
PID 3844 wrote to memory of 5004	3844	msedge.exe	102
PID 3844 wrote to memory of 5004	3844	msedge.exe	102
PID 3844 wrote to memory of 5004	3844	msedge.exe	102
PID 3844 wrote to memory of 5004	3844	msedge.exe	102
PID 3844 wrote to memory of 5004	3844	msedge.exe	102
PID 3844 wrote to memory of 5004	3844	msedge.exe	102
PID 3844 wrote to memory of 5004	3844	msedge.exe	102
PID 3844 wrote to memory of 5004	3844	msedge.exe	102
PID 3844 wrote to memory of 2596	3844	msedge.exe	103
PID 3844 wrote to memory of 2596	3844	msedge.exe	103
PID 3844 wrote to memory of 3512	3844	msedge.exe	104
PID 3844 wrote to memory of 3512	3844	msedge.exe	104
PID 3844 wrote to memory of 3512	3844	msedge.exe	104
PID 3844 wrote to memory of 3512	3844	msedge.exe	104
PID 3844 wrote to memory of 3512	3844	msedge.exe	104
PID 3844 wrote to memory of 3512	3844	msedge.exe	104
PID 3844 wrote to memory of 3512	3844	msedge.exe	104
PID 3844 wrote to memory of 3512	3844	msedge.exe	104
PID 3844 wrote to memory of 3512	3844	msedge.exe	104
PID 3844 wrote to memory of 3512	3844	msedge.exe	104
PID 3844 wrote to memory of 3512	3844	msedge.exe	104
PID 3844 wrote to memory of 3512	3844	msedge.exe	104
PID 3844 wrote to memory of 3512	3844	msedge.exe	104
PID 3844 wrote to memory of 3512	3844	msedge.exe	104
PID 3844 wrote to memory of 3512	3844	msedge.exe	104
PID 3844 wrote to memory of 3512	3844	msedge.exe	104
PID 3844 wrote to memory of 3512	3844	msedge.exe	104
PID 3844 wrote to memory of 3512	3844	msedge.exe	104
PID 3844 wrote to memory of 3512	3844	msedge.exe	104
PID 3844 wrote to memory of 3512	3844	msedge.exe	104

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\cmd-x.lua
1⤵
- Modifies registry class
PID:3868

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:752

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffa9edd46f8,0x7ffa9edd4708,0x7ffa9edd4718
  2⤵
  PID:2000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2000,1856045269218159707,2856769747983632029,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2008 /prefetch:2
  2⤵
  PID:5004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2000,1856045269218159707,2856769747983632029,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2368 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2000,1856045269218159707,2856769747983632029,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2872 /prefetch:8
  2⤵
  PID:3512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,1856045269218159707,2856769747983632029,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:4348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,1856045269218159707,2856769747983632029,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:4624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,1856045269218159707,2856769747983632029,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5060 /prefetch:1
  2⤵
  PID:4172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,1856045269218159707,2856769747983632029,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4788 /prefetch:1
  2⤵
  PID:3584
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2000,1856045269218159707,2856769747983632029,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4816 /prefetch:8
  2⤵
  PID:4344
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2000,1856045269218159707,2856769747983632029,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4816 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,1856045269218159707,2856769747983632029,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3560 /prefetch:1
  2⤵
  PID:640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,1856045269218159707,2856769747983632029,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5356 /prefetch:1
  2⤵
  PID:2536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2000,1856045269218159707,2856769747983632029,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4912 /prefetch:8
  2⤵
  PID:3916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2000,1856045269218159707,2856769747983632029,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5772 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,1856045269218159707,2856769747983632029,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4836 /prefetch:1
  2⤵
  PID:1236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,1856045269218159707,2856769747983632029,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4204 /prefetch:1
  2⤵
  PID:4188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,1856045269218159707,2856769747983632029,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5644 /prefetch:1
  2⤵
  PID:640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,1856045269218159707,2856769747983632029,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5996 /prefetch:1
  2⤵
  PID:116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,1856045269218159707,2856769747983632029,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5536 /prefetch:1
  2⤵
  PID:4380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2000,1856045269218159707,2856769747983632029,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5056 /prefetch:8
  2⤵
  PID:4344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,1856045269218159707,2856769747983632029,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5904 /prefetch:1
  2⤵
  PID:2052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2000,1856045269218159707,2856769747983632029,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6564 /prefetch:8
  2⤵
  PID:4768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,1856045269218159707,2856769747983632029,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6584 /prefetch:1
  2⤵
  PID:5064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,1856045269218159707,2856769747983632029,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6712 /prefetch:1
  2⤵
  PID:4064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2000,1856045269218159707,2856769747983632029,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1756 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:404
- C:\Users\Admin\Downloads\winrar-x64-700.exe
  "C:\Users\Admin\Downloads\winrar-x64-700.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1800
- C:\Users\Admin\Downloads\winrar-x64-700.exe
  "C:\Users\Admin\Downloads\winrar-x64-700.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,1856045269218159707,2856769747983632029,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5664 /prefetch:1
  2⤵
  PID:4692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,1856045269218159707,2856769747983632029,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6236 /prefetch:1
  2⤵
  PID:532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,1856045269218159707,2856769747983632029,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6888 /prefetch:1
  2⤵
  PID:4868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,1856045269218159707,2856769747983632029,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6132 /prefetch:1
  2⤵
  PID:4752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,1856045269218159707,2856769747983632029,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6116 /prefetch:1
  2⤵
  PID:1412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,1856045269218159707,2856769747983632029,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6400 /prefetch:1
  2⤵
  PID:4348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,1856045269218159707,2856769747983632029,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6328 /prefetch:1
  2⤵
  PID:2892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,1856045269218159707,2856769747983632029,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7036 /prefetch:1
  2⤵
  PID:3488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2000,1856045269218159707,2856769747983632029,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7084 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4732
- C:\Program Files\7-Zip\7zFM.exe
  "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\Virus Maker.rar"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5056
- C:\Program Files\7-Zip\7zFM.exe
  "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\Virus Maker.rar"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:872
- C:\Program Files\7-Zip\7zFM.exe
  "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\Virus Maker.rar"
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  PID:1432
- - C:\Windows\system32\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\7zO8953752A\readme.txt
    3⤵
    - Opens file in notepad (likely ransom note)
    PID:3320
- - C:\Users\Admin\AppData\Local\Temp\7zO895B963A\Virus Maker.exe
    "C:\Users\Admin\AppData\Local\Temp\7zO895B963A\Virus Maker.exe"
    3⤵
    - Executes dropped EXE
    PID:1524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2000,1856045269218159707,2856769747983632029,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6564 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1232

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3348

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3884

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\8e4ee10244a4429c88b30b855075b9aa /t 1472 /p 1800
1⤵
PID:2412

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\4cb42fba9ca24529a482524a6e3cea14 /t 3464 /p 4384
1⤵
PID:4812

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:4744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 bdd4adaa418d40558ab033ac0005fd6c2312d5f1f7fdf8b0e186fe1d65d78221
MD5 7740a919423ddc469647f8fdd981324d
SHA1 c1bc3f834507e4940a0b7594e34c4b83bbea7cda
SHA512 7ad98d5d089808d9a707d577e76e809a223d3007778a672734d0a607c2c3ac5f93bc72adb6e6c7f878a577d3a1e69a16d0cd871eb6f58b8d88e2ea25f77d87b7
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 0ae5cf8b49bc34fafe9f86734c8121b631bad52a1424c1dd2caa05781032334a
MD5 9f44d6f922f830d04d7463189045a5a3
SHA1 2e9ae7188ab8f88078e83ba7f42a11a2c421cb1c
SHA512 7c1825eaefcc7b97bae31eeff031899300b175222de14000283e296e9b44680c8b3885a4ed5d78fd8dfee93333cd7289347b95a62bf11f751c4ca47772cf987d
MD5 SHA1 SHA512

Submit Download

f_000002

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002
Size 69KB
SHA256 3f208f049ffaf4a7ed808bf0ff759ce7986c177f476b380d0076fd1f5482fca6
MD5 a127a49f49671771565e01d883a5e4fa
SHA1 09ec098e238b34c09406628c6bee1b81472fc003
SHA512 61b54222e54e7ab8743a2d6ca3c36768a7b2cf22d5689a3309dee9974b1f804533720ea9de2d3beab44853d565a94f1bc0e60b9382997abcf03945219f98d734
SSDEEP 1536:O76VBiDmGlrMd/+kdwYZwLnUU+wI8jDfqyToN:O7bm+romkd1qUU+w5Df9E
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000003

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003
Size 64KB
SHA256 34013d7f3f0186a612bef84f2984e2767b32c9e1940df54b01d5bd6789f59e92
MD5 d6b36c7d4b06f140f860ddc91a4c659c
SHA1 ccf16571637b8d3e4c9423688c5bd06167bfb9e9
SHA512 2a9dd9352298ec7d1b439033b57ee9a390c373eeb8502f7f36d6826e6dd3e447b8ffd4be4f275d51481ef9a6ac2c2d97ef98f3f9d36a5a971275bf6cee48e487
SSDEEP 1536:Lm4AGqOak9IP5qOYV7SofryJiRB3xVcVXsIBGCrmQR:LITk4qOq2oDwuhpDCaQR
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000005

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005
Size 19KB
SHA256 c1334e604dbbffdf38e9e2f359938569afe25f7150d1c39c293469c1ee4f7b6f
MD5 2e86a72f4e82614cd4842950d2e0a716
SHA1 d7b4ee0c9af735d098bff474632fc2c0113e0b9c
SHA512 7a5fd3e3e89c5f8afca33b2d02e5440934e5186b9fa6367436e8d20ad42b211579225e73e3a685e5e763fa3f907fc4632b9425e8bd6d6f07c5c986b6556d47b1
SSDEEP 384:eV4Eqc1qgk/XDVGi8m7JEM9TUKPqivdjfommfP974oNF38:eV9qlxhVEM9UKPpMV74kFM
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000006

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006
Size 65KB
SHA256 f12de7e272171cda36389813df4ba68eb2b8b23c58e515391614284e7b03c4d4
MD5 56d57bc655526551f217536f19195495
SHA1 28b430886d1220855a805d78dc5d6414aeee6995
SHA512 7814c60dc377e400bbbcc2000e48b617e577a21045a0f5c79af163faa0087c6203d9f667e531bbb049c9bd8fb296678e6a5cdcad149498d7f22ffa11236b51cb
SSDEEP 1536:654NcGosP0w+UcGoanS2RR/QwNdIvEsgXn:6iRsw+UkC5QdEfXn
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000007

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007
Size 88KB
SHA256 b18b9eb934a5b3b81b16c66ec3ec8e8fecdb3d43550ce050eb2523aabc08b9cd
MD5 b38fbbd0b5c8e8b4452b33d6f85df7dc
SHA1 386ba241790252df01a6a028b3238de2f995a559
SHA512 546ca9fb302bf28e3a178e798dd6b80c91cba71d0467257b8ed42e4f845aa6ecb858f718aac1e0865b791d4ecf41f1239081847c75c6fb3e9afd242d3704ad16
SSDEEP 1536:WwVbiMNFmJrBrbhiWu0FKK9fLRXT+FjhwTn1sH5J3iotwUB4xzjIRB9h:zVOiFWwg3Rjm1wRW5JSywbo9h
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000008

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008
Size 1.2MB
SHA256 dd35fa6ced81d040a5aaa4726885204f44abc7ff1f7a83874b76f34bcc4d1598
MD5 8f4b4d5d848b49f72ec9d45000e45fb0
SHA1 6517ec20d81ce901746076948417cfafdbcc2d20
SHA512 9704356124a9f7df23cc91ff93b13fbcfbc0d09d92fa0a5d4c1dec65f7ab78ad2786ffd9ddc304bc24df4a0cfe43afa24cc0c6cc3c721088320feb5c6f7e7baa
SSDEEP 24576:IaKtKILtsqbCbE2xDSc1M6e97coQc/GFhB5bFqukVnwSeP7PVuAFxp11Zv0snbjz:IltKIZsvA2xWAneFwcuvTFquAwHdphF9
MD5 SHA1 SHA512 SSDEEP

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 1KB
SHA256 12e21383fb0b7986c76ec1b5c67fec4fa19321c4df00e72650c359d921eef455
MD5 a2d1a87c00622443ef08007594276017
SHA1 229b40ece63596689b475b300696a01da26ea642
SHA512 4538b5cc7f0ed411fc2ae106cd090161ba64299344015dc5955d449292631387579835574a66fad04072d60cb72a4fb293435c3b3bd86806fbe4ac3d5b6374fd
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 4e2db0a3700180975aef0d0d1b152ed338bebd858bfae8c022a5b7c0cf0c91f4
MD5 b001a50a62f2d26c4e8fcbeea60cb357
SHA1 afcb8e0e855f9e7586f691ea3a0f7cc6a08b14ad
SHA512 dc9cf3209ca1ca317e8a3b523209016f2a8f66c16ef96d6096e7f99851f295a4e78c1c9bafefe406c0b3a2735d329825dbd5b9f29286ceef8633ada5a57fcf1a
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 623B
SHA256 c5c634be6b9cd337740081e41c6ff09b8118cc13906320d1a0100e765b697805
MD5 c7a603d9f2a3483e1b5737cbe42a948f
SHA1 586fd6022d372912568d67f26babf3e64b05cf68
SHA512 37e3b4381c5ba0b617d1b76e2a196d28119a70793c95fb1022703c539a7c71509559af3e51faedbe0d13c6ee2076082fa7825318ffa1dccd15a546b0dde6fbae
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 990B
SHA256 38211d4f698569410e131d9120b045ee77016be0f1c9271f99a164d80399c2da
MD5 80b18f49cd418d7725df35c91b18e799
SHA1 2bcff671bd892b2bdbc07e4a22ad3c188010dad9
SHA512 5aeb3b86f04a8b5ba5ce3384f32ff8a2a099180ff55f1f24f6bf02cf814fd6aa7fa63ccf23cc86a207b1d900eb81718526af0025d3d7f1c7f40b586c67a642af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 d025d78a59b3a068f6df8eb72229dc8b7f3dd0b6856c9ade59e26455afa4faa1
MD5 246ee52539e61a11efea0317881d7177
SHA1 2645455260e446ed93e70735c219b59b3a1c6d34
SHA512 9f6fc506eff43120751f5ce9b0fdfaaaf78352b90257b13574bb004b96d19af63d9751df901c6dc0aab6d7d54c8eaf48fbd46116ba2521b20e47379f18d73179
SSDEEP 96:nbk8sQoy31fGlh8lwphAWMoiWR5mderYXMkoOcZtXRfhcG7hTjUWQyV+VD7AiEwb:nbkZsA4lOAWMWdYXhc/hpH7djrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 4a52c444efb34f440c23ec5df20b292db7fd4f15e00090cd9849004697952fd0
MD5 32f005798847b6bb65a1041035bf9c27
SHA1 995b8c57adad01feca4abc53244400f569a300d5
SHA512 0aa36cad835b1d99314735cceac358151dcbe56ee1735abc3ddd1a9a38f0511df0dbca4c2e9075f79b1c69be1bbadb849a86bf1c2910ebe91385e9524658547a
SSDEEP 96:nbk631f+Ih8lwpvWMoiVmdeH+G5kjUWQyV+VD7ziEwb:nbk0EPlGWMXNKjrt
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 76f5141973f6f13e1c304ef0cd67c14146698770ab9bdb0f70cac71ddd33b959
MD5 a24126fedd91110023595cab6abea7e3
SHA1 a7b64ba13495f1ec3e30ea818c5806fe1c393694
SHA512 2380f71174bcd148441161f9373f3ad5b7c65c68efe7311fe0ebb9e74e3a06b3d4afdd6d01f120a94f5818312fd529ef4c39c3cd7477b0547092703ac90f4405
SSDEEP 96:nbkx31fG4h8lwpfV9WMoiVmde5uJ1j+G1FkjUWQyV+VD7AiEwb:nbkZA/l4V9WMpuJhNUjrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 9e99d208e52420dbd4f586042f7e34546fc31886d3df18af5732e966edff6f8f
MD5 493a2d48f4c11a89ac64061aac6a2d2f
SHA1 85e8189e3d59228d2be7259054c091de70988e8b
SHA512 3615f782d3c47a8c576a554b80b196b10b296a262eed50f79b58b66f141a08c3aabc86cdc8fa378f83bf4479eaf14bfb812b6a04d860832aec2437ac85100bc7
SSDEEP 96:nbk8sQ431fGch8lwphAWMoiORaR5mderYXMkoOcZtXRfhcG7hajUWQyV+VD7AiEc:nbkLADlOAWMO8dYXhc/hpH74jrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 705B
SHA256 0ce233bdd3a89dbe41d9693d6b04b6fc2ad1afd84784c1f3e217cb8a55f5f00a
MD5 796342e1900e8fbb50dbc9c7ec494665
SHA1 68a44878802646de5b5f1af782cb8238d1e12d79
SHA512 48f6a7f4f4e5437bd91e759c420f6c0067096d4e647ec8dbf81bf7d5c3430a9f071047e9798ff98dc08076b92d5e872fd335d4f88f0296dd8eecd41340666d44
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 705B
SHA256 e967fa7453488b9cedcf8c175d0a3f566752f808b4c4f30c1930a07a71367f95
MD5 26eadfd8098d25e808c3b58632fcd8b5
SHA1 09690904c3ab377a7e91f58cb68c4e0387919ddf
SHA512 6309981bab7c3188bd58b85de6ecf1f20884384e441a6154765a49226ecd6d4be7fbffb01b1b81094de4cda33d084c959b6ba9aecaf3f03dff49682084f18a74
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe582c3b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe582c3b.TMP
Size 705B
SHA256 60bb1a22507f92a6e5cf44ed3f1139f41289a567ec6f3a26b452d09d73589628
MD5 83fa51fba8dc7a101edbbfac6f9d20ca
SHA1 0be719855c63e634e2bee30da932b3e2e61a5d8e
SHA512 2746e481670b3463e073378681fd43620d74317108c1c05bc613924e2dbc18c18b8060960a3a7d558555d93625c9cd15d1134fe6378b7525dd44b06c8445aecd
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

fdc217a2-ee16-461b-b5ed-a2ebfc6c3a33.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\fdc217a2-ee16-461b-b5ed-a2ebfc6c3a33.tmp
Size 6KB
SHA256 649a234376ad7b7a36be86cce96458a8f5f1ad8b57f5f83a6ff3df8f63897c02
MD5 c0c29ba43e1c64cda69d76847c200a49
SHA1 00d26bb8251d9afdb02089c05e9106d70664c61a
SHA512 ce0203fe25a007adbd9bee8d3aa4add97219879da67cb1a2848aa22b4841bcdd38f6fbe39732c900fdf5e0ee1f1fd92cce9632b83ee9a96d3eba3e4b714ee107
SSDEEP 96:nbk8sQoZ31fGHh8lwpuVWMoiVmde5uJ1uyHhP+GMkjUWQyV+VD7AiEwb:nbkZhAmlZVWMpuJIyHhNFjrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 5f816c866a3ee07354946732edba6fbbdc07c21f88cbfccf25b0e4a4dc7a6175
MD5 a0bfaf0500e21b5f2285453c6201fe5b
SHA1 2d6110069502cd6b719db77f3ff01e31d3770bb9
SHA512 2ebce639558a8ba2463d5cf16e013f0d8a2b57edf49a54da63009a954c9d2e05999e58fab04d2b2e60ff4d0836d7e5e0b88c1f85337a80fe3941842140fc75e8
SSDEEP 192:R7oCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupA/2RUMS+ebgAGjKFGOz0Q:Rr9iIxuERzA83h09RZxYJtfDAiMJzV+o
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 d0bc0e0484ceefa6d86d5c6b40dca2fe93d37134ca2c3671911b5a0c4ce5554c
MD5 e47828a5fe3f20fb851153d8b2f6ef37
SHA1 0257c2fc3303d2880753bf241b1739759462b7b0
SHA512 14d177ff483aeb686bb4b22f8f9e7e28b8a13297805b2cadb0cf87d9bd41a52d060bf95dd1374ce0ccc3b34c51d5c714f89164e6bd2f43da6d2800008d982a77
SSDEEP 384:O9iIxuERzA83h09RZxYJwMrWCNiMJzV+o:dIxuERzA83h09RZxhM6CNXTP
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 6d162bcf30449ae1740a35298cc9c80db730feeac4007ae029f9808a8e57bdd5
MD5 a68e6086ea6acf95cf146f5023c87eee
SHA1 82ce7ed1e6f4e3d791ba88f860b49b015115635a
SHA512 a7374b1ad5636b8a73175d084565b24b0be7d38dd8c2703fce16879df5a2a5fc7c84db728c7c86dd40500efbe2bfc0feebd27a33ff7e3ff3164c5d4f27d502a2
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexups/2RUKzebgGGjKFGOz0c+o:A9iIxuERzA83h09RZxYN1DGiMJzV+o
MD5 SHA1 SHA512 SSDEEP

Submit Download

readme.txt

Path C:\Users\Admin\AppData\Local\Temp\7zO8953752A\readme.txt
Size 19B
SHA256 ec059872ca0ab2a183c1e5539e76f926605ae2e7a60ced5247e5f0f72465d971
MD5 25cacb7c8b102e2ad4658121bdd2459e
SHA1 7b5ed8c98f3e04774aa20de108d2b5e3ffcada8a
SHA512 747c6cef1744f1aba9c74b5573e21807225ee8ed7ac9229ae551f37e6d577b9875e3ce8a2991cbeac1e2ef5f1fb768d50deabb5fa5eaa0180a406d2c246956f5
MD5 SHA1 SHA512

Submit Download

Virus Maker.exe

Path C:\Users\Admin\AppData\Local\Temp\7zO895B963A\Virus Maker.exe
Size 3.7MB
SHA256 16f14bd60c84a7838b99c34a791d5d334f08ee1e588c95162290ced38db8b092
MD5 c00845708ee4e6cbaa628a0886076c4d
SHA1 e011d28a40304957961654e62d00754a772fdee8
SHA512 2b6a09b934ad6076008ad1b8bc960b6c3bf39968275f9f46fe1afbed7228eb196b46172c175106da70af80ad78aafc327869e71860af6472c74867dba022fb59
SSDEEP 6144:GJvHYJvHYJvHYJvHYJvHYJvHoJvHYJvHRJvHulhfNPpXomiJvHkD:kvuvuvuvuvuvevuvjvkPN/Avi
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unconfirmed 721997.crdownload

Path C:\Users\Admin\Downloads\Unconfirmed 721997.crdownload
Size 3.8MB
SHA256 ff309d1430fc97fccaa9cb82ddf3d23ce9afdf62dcf8c69512de40820df15e24
MD5 48deabfacb5c8e88b81c7165ed4e3b0b
SHA1 de3dab0e9258f9ff3c93ab6738818c6ec399e6a4
SHA512 d1d30f6267349bb23334f72376fe3384ac14d202bc8e12c16773231f5f4a3f02b76563f05b11d89d5ef6c05d4acaacc79f72f1d617ee6d1b6eddab2b866426af
SSDEEP 98304:sWaWOBfKnlSXdgRgopW/r+N5op154iXEBdbwUoy60518ymXM2mGm:xamnqdgyoE+noL54u2wUoylrVmlw
MD5 SHA1 SHA512 SSDEEP

Submit Download

Virus Maker.rar

Path C:\Users\Admin\Downloads\Virus Maker.rar
Size 82KB
SHA256 d32f3a860b863d38f117c2e7efcaa6909583d418f8578b526a7ed0153529644b
MD5 d1f61793e7898df4b27e3345764ceca8
SHA1 f03b91146aeaf753b565620a022a238830ed56d4
SHA512 6491767f6db68886d000b173306377f3b0bf2d6db765ce4c14139c9ad09fa44e6cb75489f3858e45c4000333d2ad517721f81cc48e94de25c75c17cac36bb617
SSDEEP 1536:S0s/fG5w2aRBBNACjLkvSrfqAbv0Zarjg5AfDLCNE3Ztg/776X95:5s/+uRBmvMfzrhfbD2NStk76N5
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1524-714-0x0000000000710000-0x0000000000ABE000-memory.dmp

Download

memory/1524-715-0x0000000075250000-0x0000000075A00000-memory.dmp

Download

memory/1524-716-0x00000000054B0000-0x000000000554C000-memory.dmp

Download

memory/1524-717-0x0000000005B00000-0x00000000060A4000-memory.dmp

Download

memory/1524-718-0x00000000055F0000-0x0000000005682000-memory.dmp

Download

memory/1524-719-0x0000000005550000-0x000000000555A000-memory.dmp

Download

memory/1524-720-0x0000000005870000-0x0000000005880000-memory.dmp

Download

memory/1524-721-0x00000000057C0000-0x0000000005816000-memory.dmp

Download

memory/1524-722-0x0000000005870000-0x0000000005880000-memory.dmp

Download

memory/1524-723-0x0000000075250000-0x0000000075A00000-memory.dmp

Download

memory/1524-724-0x0000000005870000-0x0000000005880000-memory.dmp

Download