hxxps://pastebin[.]com/gU4Zj4SD

Resubmissions

07/05/2024, 19:43

240507-yfk6qsfa24 7

07/05/2024, 19:40

07/05/2024, 19:35

07/05/2024, 19:31

07/05/2024, 19:26

07/05/2024, 19:21

07/05/2024, 19:16

07/05/2024, 19:14

Analysis

max time kernel
191s
max time network
279s
platform
windows11-21h2_x64
resource
win11-20240419-en
resource tags

arch:x64arch:x86image:win11-20240419-enlocale:en-usos:windows11-21h2-x64system
submitted
07/05/2024, 19:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://pastebin.com/gU4Zj4SD

Score

8^/10

bootkit evasion persistence

Malware Config

Signatures

Disables Task Manager via registry modification
evasion
Downloads MZ/PE file

Executes dropped EXE 3 IoCs

pid	Process
4416	Faux ransomware by back V3.exe
688	jeu.exe
2304	Heptoxide.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service

T1102

flow	ioc
4	pastebin.com
10	raw.githubusercontent.com
47	raw.githubusercontent.com
1	pastebin.com

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	Heptoxide.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Kills process with taskkill 2 IoCs

evasion

pid	Process
3160	taskkill.exe
2472	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2878097196-921257239-309638238-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2878097196-921257239-309638238-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2878097196-921257239-309638238-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2878097196-921257239-309638238-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe

Modifies registry class 47 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2878097196-921257239-309638238-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Downloads"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2878097196-921257239-309638238-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0100000000000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2878097196-921257239-309638238-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0 = 5c00310000000000a758c09b1000484550544f587e310000440009000400efbea758c09ba758c09b2e000000c5ac020000001b0000000000000000000000000000000b3bda0048006500700074006f007800690064006500000018000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2878097196-921257239-309638238-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2878097196-921257239-309638238-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2878097196-921257239-309638238-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2878097196-921257239-309638238-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2878097196-921257239-309638238-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\WorkFolders	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2878097196-921257239-309638238-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 19002f433a5c000000000000000000000000000000000000000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2878097196-921257239-309638238-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\MRUListEx = ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2878097196-921257239-309638238-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1 = 3a002e8005398e082303024b98265d99428e115f260001002600efbe11000000d614e1ab3c92da01d4ad6df2b4a0da01d4ad6df2b4a0da0114000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2878097196-921257239-309638238-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2878097196-921257239-309638238-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\NodeSlot = "2"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2878097196-921257239-309638238-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2878097196-921257239-309638238-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2878097196-921257239-309638238-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 500031000000000093585854100041646d696e003c0009000400efbe9358374ca758619b2e000000525702000000010000000000000000000000000000007bc1cd00410064006d0069006e00000014000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2878097196-921257239-309638238-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2878097196-921257239-309638238-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0 = 8400310000000000a758b89b1100444f574e4c4f7e3100006c0009000400efbe9358374ca758b89b2e0000005a57020000000100000000000000000042000000000082737f0044006f0077006e006c006f00610064007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100370039003800000018000000	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2878097196-921257239-309638238-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2878097196-921257239-309638238-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2878097196-921257239-309638238-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2878097196-921257239-309638238-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2878097196-921257239-309638238-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2878097196-921257239-309638238-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2878097196-921257239-309638238-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\NodeSlot = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2878097196-921257239-309638238-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2878097196-921257239-309638238-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\KnownFolderDerivedFolderType = "{885A186E-A440-4ADA-812B-DB871B942259}"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2878097196-921257239-309638238-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2878097196-921257239-309638238-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2878097196-921257239-309638238-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2878097196-921257239-309638238-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2878097196-921257239-309638238-1000\{044E21FD-1C44-4CE0-BAE4-55256FE4E7CB}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2878097196-921257239-309638238-1000_Classes\Local Settings	Faux ransomware by back V3.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2878097196-921257239-309638238-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 78003100000000009358374c1100557365727300640009000400efbec5522d60a758619b2e0000006c0500000000010000000000000000003a0000000000ea86300155007300650072007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100380031003300000014000000	explorer.exe
Key created	\Registry\User\S-1-5-21-2878097196-921257239-309638238-1000_Classes\NotificationData	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2878097196-921257239-309638238-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2878097196-921257239-309638238-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2878097196-921257239-309638238-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Generic"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2878097196-921257239-309638238-1000_Classes\Local Settings	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2878097196-921257239-309638238-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2878097196-921257239-309638238-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2878097196-921257239-309638238-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2878097196-921257239-309638238-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2878097196-921257239-309638238-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2878097196-921257239-309638238-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2878097196-921257239-309638238-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	explorer.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
5064	reg.exe

NTFS ADS 6 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 249240.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Faux ransomware by back V3.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Heptoxide.zip:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Heptoxide\readme.txt:Zone.Identifier	explorer.exe
File opened for modification	C:\Users\Admin\Downloads\Heptoxide\Heptoxide.exe:Zone.Identifier	explorer.exe
File opened for modification	C:\Users\Admin\Downloads\Heptoxide\Heptoxide-safety.exe:Zone.Identifier	explorer.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
2236	explorer.exe
2236	explorer.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
1516	msedge.exe
1516	msedge.exe
4508	msedge.exe
4508	msedge.exe
1504	msedge.exe
1504	msedge.exe
2200	identity_helper.exe
2200	identity_helper.exe
2116	msedge.exe
2116	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
2968	msedge.exe
2968	msedge.exe
2216	msedge.exe
2216	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

pid	Process
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2472	taskkill.exe
Token: SeDebugPrivilege	3160	taskkill.exe

Suspicious use of FindShellTrayWindow 45 IoCs

pid	Process
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
2268	rundll32.exe
2268	rundll32.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3056	hh.exe
3056	hh.exe
2236	explorer.exe
2236	explorer.exe
2236	explorer.exe
2304	Heptoxide.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4508 wrote to memory of 2140	4508	msedge.exe	80
PID 4508 wrote to memory of 2140	4508	msedge.exe	80
PID 4508 wrote to memory of 2540	4508	msedge.exe	81
PID 4508 wrote to memory of 2540	4508	msedge.exe	81
PID 4508 wrote to memory of 2540	4508	msedge.exe	81
PID 4508 wrote to memory of 2540	4508	msedge.exe	81
PID 4508 wrote to memory of 2540	4508	msedge.exe	81
PID 4508 wrote to memory of 2540	4508	msedge.exe	81
PID 4508 wrote to memory of 2540	4508	msedge.exe	81
PID 4508 wrote to memory of 2540	4508	msedge.exe	81
PID 4508 wrote to memory of 2540	4508	msedge.exe	81
PID 4508 wrote to memory of 2540	4508	msedge.exe	81
PID 4508 wrote to memory of 2540	4508	msedge.exe	81
PID 4508 wrote to memory of 2540	4508	msedge.exe	81
PID 4508 wrote to memory of 2540	4508	msedge.exe	81
PID 4508 wrote to memory of 2540	4508	msedge.exe	81
PID 4508 wrote to memory of 2540	4508	msedge.exe	81
PID 4508 wrote to memory of 2540	4508	msedge.exe	81
PID 4508 wrote to memory of 2540	4508	msedge.exe	81
PID 4508 wrote to memory of 2540	4508	msedge.exe	81
PID 4508 wrote to memory of 2540	4508	msedge.exe	81
PID 4508 wrote to memory of 2540	4508	msedge.exe	81
PID 4508 wrote to memory of 2540	4508	msedge.exe	81
PID 4508 wrote to memory of 2540	4508	msedge.exe	81
PID 4508 wrote to memory of 2540	4508	msedge.exe	81
PID 4508 wrote to memory of 2540	4508	msedge.exe	81
PID 4508 wrote to memory of 2540	4508	msedge.exe	81
PID 4508 wrote to memory of 2540	4508	msedge.exe	81
PID 4508 wrote to memory of 2540	4508	msedge.exe	81
PID 4508 wrote to memory of 2540	4508	msedge.exe	81
PID 4508 wrote to memory of 2540	4508	msedge.exe	81
PID 4508 wrote to memory of 2540	4508	msedge.exe	81
PID 4508 wrote to memory of 2540	4508	msedge.exe	81
PID 4508 wrote to memory of 2540	4508	msedge.exe	81
PID 4508 wrote to memory of 2540	4508	msedge.exe	81
PID 4508 wrote to memory of 2540	4508	msedge.exe	81
PID 4508 wrote to memory of 2540	4508	msedge.exe	81
PID 4508 wrote to memory of 2540	4508	msedge.exe	81
PID 4508 wrote to memory of 2540	4508	msedge.exe	81
PID 4508 wrote to memory of 2540	4508	msedge.exe	81
PID 4508 wrote to memory of 2540	4508	msedge.exe	81
PID 4508 wrote to memory of 2540	4508	msedge.exe	81
PID 4508 wrote to memory of 1516	4508	msedge.exe	82
PID 4508 wrote to memory of 1516	4508	msedge.exe	82
PID 4508 wrote to memory of 3540	4508	msedge.exe	83
PID 4508 wrote to memory of 3540	4508	msedge.exe	83
PID 4508 wrote to memory of 3540	4508	msedge.exe	83
PID 4508 wrote to memory of 3540	4508	msedge.exe	83
PID 4508 wrote to memory of 3540	4508	msedge.exe	83
PID 4508 wrote to memory of 3540	4508	msedge.exe	83
PID 4508 wrote to memory of 3540	4508	msedge.exe	83
PID 4508 wrote to memory of 3540	4508	msedge.exe	83
PID 4508 wrote to memory of 3540	4508	msedge.exe	83
PID 4508 wrote to memory of 3540	4508	msedge.exe	83
PID 4508 wrote to memory of 3540	4508	msedge.exe	83
PID 4508 wrote to memory of 3540	4508	msedge.exe	83
PID 4508 wrote to memory of 3540	4508	msedge.exe	83
PID 4508 wrote to memory of 3540	4508	msedge.exe	83
PID 4508 wrote to memory of 3540	4508	msedge.exe	83
PID 4508 wrote to memory of 3540	4508	msedge.exe	83
PID 4508 wrote to memory of 3540	4508	msedge.exe	83
PID 4508 wrote to memory of 3540	4508	msedge.exe	83
PID 4508 wrote to memory of 3540	4508	msedge.exe	83
PID 4508 wrote to memory of 3540	4508	msedge.exe	83

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://pastebin.com/gU4Zj4SD
1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fff231f3cb8,0x7fff231f3cc8,0x7fff231f3cd8
  2⤵
  PID:2140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1896,13606228808254052452,12740770494289442066,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1912 /prefetch:2
  2⤵
  PID:2540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1896,13606228808254052452,12740770494289442066,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2352 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1896,13606228808254052452,12740770494289442066,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2600 /prefetch:8
  2⤵
  PID:3540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,13606228808254052452,12740770494289442066,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:3444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,13606228808254052452,12740770494289442066,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
  2⤵
  PID:1664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1896,13606228808254052452,12740770494289442066,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4988 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,13606228808254052452,12740770494289442066,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5072 /prefetch:1
  2⤵
  PID:4212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,13606228808254052452,12740770494289442066,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4532 /prefetch:1
  2⤵
  PID:2796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,13606228808254052452,12740770494289442066,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5208 /prefetch:1
  2⤵
  PID:2168
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1896,13606228808254052452,12740770494289442066,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5088 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,13606228808254052452,12740770494289442066,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5276 /prefetch:1
  2⤵
  PID:2620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,13606228808254052452,12740770494289442066,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5112 /prefetch:1
  2⤵
  PID:4768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,13606228808254052452,12740770494289442066,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4600 /prefetch:1
  2⤵
  PID:5004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,13606228808254052452,12740770494289442066,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5512 /prefetch:1
  2⤵
  PID:2964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,13606228808254052452,12740770494289442066,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5328 /prefetch:1
  2⤵
  PID:484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1896,13606228808254052452,12740770494289442066,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5364 /prefetch:8
  2⤵
  PID:4212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1896,13606228808254052452,12740770494289442066,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5352 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:2116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,13606228808254052452,12740770494289442066,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5632 /prefetch:1
  2⤵
  PID:2500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,13606228808254052452,12740770494289442066,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5396 /prefetch:1
  2⤵
  PID:4776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,13606228808254052452,12740770494289442066,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5892 /prefetch:1
  2⤵
  PID:1424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=1896,13606228808254052452,12740770494289442066,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5420 /prefetch:8
  2⤵
  PID:4804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,13606228808254052452,12740770494289442066,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4608 /prefetch:1
  2⤵
  PID:3228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1896,13606228808254052452,12740770494289442066,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6972 /prefetch:8
  2⤵
  PID:4616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1896,13606228808254052452,12740770494289442066,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=6948 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1896,13606228808254052452,12740770494289442066,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6832 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:2968
- C:\Users\Admin\Downloads\Faux ransomware by back V3.exe
  "C:\Users\Admin\Downloads\Faux ransomware by back V3.exe"
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  PID:4416
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ransomware.vbs"
    3⤵
    PID:1752
  - - C:\Windows\SysWOW64\taskkill.exe
      "C:\Windows\System32\taskkill.exe" /f /IM explorer.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3160
  - - C:\Windows\SysWOW64\taskkill.exe
      "C:\Windows\System32\taskkill.exe" /f /IM javaw.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2472
  - - C:\Windows\SysWOW64\hh.exe
      "C:\Windows\System32\hh.exe" h
      4⤵
      Suspicious use of SetWindowsHookEx
      PID:3056
  - - C:\Users\Admin\AppData\Local\Temp\jeu.exe
      "C:\Users\Admin\AppData\Local\Temp\jeu.exe"
      4⤵
      Executes dropped EXE
      PID:688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,13606228808254052452,12740770494289442066,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5996 /prefetch:1
  2⤵
  PID:1148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1896,13606228808254052452,12740770494289442066,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6012 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:2216

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2360

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3636

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding
1⤵
PID:3628

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{682159d9-c321-47ca-b3f1-30e36b2ec8b9} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- NTFS ADS
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2236
- C:\Users\Admin\Downloads\Heptoxide\Heptoxide.exe
  "C:\Users\Admin\Downloads\Heptoxide\Heptoxide.exe"
  2⤵
  - Executes dropped EXE
  - Writes to the Master Boot Record (MBR)
  - Suspicious use of SetWindowsHookEx
  PID:2304
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c REG ADD hkcu\Software\Microsoft\Windows\CurrentVersion\policies\system /v DisableTaskMgr /t reg_dword /d 1 /f
    3⤵
    PID:2196
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD hkcu\Software\Microsoft\Windows\CurrentVersion\policies\system /v DisableTaskMgr /t reg_dword /d 1 /f
      4⤵
      Modifies registry key
      PID:5064

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {3eef301f-b596-4c0b-bd92-013beafce793} -Embedding
1⤵
PID:1624

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
- Modifies registry class
PID:3492

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {515980c3-57fe-4c1e-a561-730dd256ab98} -Embedding
1⤵
- Suspicious use of FindShellTrayWindow
PID:2268

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004D0 0x0000000000000490
1⤵
PID:4316

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7c16971be0e6f1e01725260be0e299cd

SHA1
e7dc1882a0fc68087a2d146b3a639ee7392ac5ed

SHA256
b1fa098c668cdf8092aa096c83328b93e4014df102614aaaf6ab8dc12844bdc0

SHA512
dc76816e756d27eedc2fe7035101f35d90d54ec7d7c724ad6a330b5dd2b1e6d108f3ae44cedb14a02110157be8ddac7d454efae1becebf0efc9931fdc06e953c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
bdf3e009c72d4fe1aa9a062e409d68f6

SHA1
7c7cc29a19adb5aa0a44782bb644575340914474

SHA256
8728752ef08d5b17d7eb77ed69cfdd1fc73b9d6e27200844b0953aeece7a7fdc

SHA512
75b85a025733914163d90846af462124db41a40f1ce97e1e0736a05e4f09fe9e78d72316753317dabea28d50906631f634431a39384a332d66fa87352ff497f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\5067b872-25ac-4ed1-8d8d-edbd3f39e048.tmp

Filesize
1KB

MD5
7a4329bd72f0f213988e435fde0390ed

SHA1
ffdf7f89023654012e83990539332ebec4eede41

SHA256
f2715da9987361b9f2cf56f919736a9b39f10d3d4a64cdd0c10e60bb55ec7787

SHA512
601c7c1170ffff56ca44a07f0860ae3c72501bed4f2c27d5667bba58b7ee1a22081bb0d2a0f6e64c35b0d011597da319d8e12e3a6cfbf7f49f223aea8d8a88f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\5257feac-bc0e-4a2a-b936-da804d2a97c8.tmp

Filesize
1KB

MD5
79645cc0ef6a515afca99b56ba177578

SHA1
d031e5400dd1c4edcf53d8a86e6fcca95a82b7db

SHA256
93b783ff9b6acdff4c319ee2c8be1129e72c295f22277a8db6b33f5054a4421a

SHA512
0fc9a20c5cb9b845672e56fb6d1e823b0deb0f4143e18c9ac287488104165f5c72a064f71c6ce54616c1224cbce15f142e261bfa4395fec12920bb61fdcbace8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
babd2b83497002b76c88d7a5bfc84369

SHA1
ab223673ba3e61626bcefa8ae01579efb456c81e

SHA256
5a0a9a49ff5fcd777a85aa0fb1ac4643f3d6667816847497f02813bac1d43d81

SHA512
0a531c9b0a1101fa6cf2812205684312f61f7c624477f68cb73cc6c55edaafc3b86962f3b5a9d274488077dab7cccd5831a6795107ccb4bfb7f14cb6d18642fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
14c89b20d2a7a2e90606924c58929201

SHA1
ba3072a82367e0be56446d3f286174f00d632995

SHA256
93fcd47697b141b67a56fdbd915b3c2be31f883dfae3274b62208aa8ecb49a3a

SHA512
1b8ac21b2ddbee823fcb29c54e83a14e47317215f9bff43d23fd34d22bba6b2b00f286105d4b1e2f5872a82a5c97b07f8aafb28b4a60b0d3886f54c27fa11fe6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
757f1a8d07a2dede1460ce5a929c5641

SHA1
8d017f7566f849e4de974d4d32f81d80f647e8e0

SHA256
2b311f108c257f285db1226fda9026a544f5f34b75d472c65f17e10a6c22a6c4

SHA512
38086a2be26dd6087f3a8e45ac2da8eb140b63fb9c27cdaddc5e33ef08f02b78a261d948eeb39f1bb10caffbd10d4b97851a2634ec5ca68a9533633b09add6cc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
0b239450c4a396352e34336b57b71f61

SHA1
0f4f10ef687b6c6bca7a6823703b42951c72fc31

SHA256
20bfc89e7160bce68345c143ff2f3573de4f907a0d255c6549c8fb1f1e1829a4

SHA512
b3100f3b442d91a2486b05be2b55b15ca673b3464ca8feeec53fe4b6359afe00224d264857e10ecda76d41adef1befcafda2b4a927c78e051a504cf76134b4e4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
e50d1f18b8a2ce9aca26207af5dc64f2

SHA1
274061421430929c420fcd5de16c23f49e835515

SHA256
11bb78f7a0431091b0f35780eaeb9f0094e41299d92cc76bf8b1f8f122d4b66b

SHA512
d32d4838fffb0fd44bf9d76a5de31ebdd06252f58117a5d704b8237f6e3852c7af37b819c72fbac816c52115403617b17ad713b8744c3a083f50e654c66e8bc7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9e01805bb6525580f9c62383f8358a64

SHA1
441e898a43d2b046871ae8aa9436d2878ee59c97

SHA256
3aca2bf2f4856bfb14edb3cefba5e36c23642c5ae28db835741f1e566c13ce75

SHA512
11f63bc52f38f1291abef89d784a58d51ac8dd22c9200a15ea1f8fcb2aa83573ffc9ef01b54081dbe0d76484fdb125b71738197eeba2798243760bef7e53ad3f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
4bd1702995fb147f08022b28e1af2fc8

SHA1
2345a85231c3599eb497cf5a5811a7c22c05f62f

SHA256
576d6b37011a22283ca15947cfd61dc1f59aaa0163ad5e3a38a1111cd7fe01c1

SHA512
0b82a237add21ef24ca08c10637d9456c194f3913a959ae5cd68e3e555cab98cf58b3915298d61adf2e5f3d3301ee330cc4a0eaea06d8e5dc4cc872dd3feabd2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
528266e1bce625dfca31ba8b63cd8b6e

SHA1
1680bcb33cb9874e2f9efede5e643ac33123c9f4

SHA256
14edc005ef29e3a1c468f4e11dc6d1809de0e1e04d1ab36c7e81b9e2df5fa67b

SHA512
bee59418ca672ae4fec0712d4365ef1b34c128403dba5909f028a1e8d1ce52d92f10235180f58b69f94cd782548d7272dda53ff3ef624320e9739f06be8d3e6f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
ef9f95d06cf2b23c0e12305edc4b78d5

SHA1
2fe32272d7c2798d7a9ec782f9af9a58b9ef057b

SHA256
159fd9e34dea6effe0528a570ca8957f43318a49f580fe6b3741bfc029019253

SHA512
5ccbd8ccca4238911dbc7951a4228b73a3d5e504bd946d85e3b065efd1a2c22a90aee976ce50cb3abf464e16ee0a0b34b053773ed55dfe6bc420e44122c43d5e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
737045e6b3f86aa374eb7a37a9537c60

SHA1
c0e2af95d431f733e99f68d3f74486471e18b56b

SHA256
95aa03ac7e35fde89c5a600d0a394e2dfd0c77fcb3da88513d4bf373d9fc593f

SHA512
86f3a8d872c0a5cc678a6242e4fcb546b83b7fbc87b8a815d2d71e09651d64c6b49e7ca54bd2f201236380f37c11a6ec2d56e8a900b5143467aed4edb7609c8d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57c8fd.TMP

Filesize
203B

MD5
7729b7a8fc4b4c180d3993583f85c108

SHA1
73cd702fda1bed379185ac144dbd2c9aeda6997a

SHA256
36a18766f506e84fc2610a72adfa4dfd09ecdd89a0dc0103f13f319890dafe33

SHA512
3caaca71d4df05402f68bc9b171e189cd2075662f22b8c9edd00b0132bbe17296d37388b8f68e082d992387800e9c7e2e5c3b268880415b10ba1563b951de1ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
3209a9aa8964ce7cad5a2e8b74528024

SHA1
b7cac7d478e2da10932a6df12d413ff32930a79a

SHA256
31a70c2579181d53fd5f16e10fd4c0a123d50e3b2142f1bbfb0e2511288da858

SHA512
fe3e9d3928104b67c58c8dcc9999de306aca305cbcd7870ab038308a8037dcfa8ac5431e2f650728af863a178dd7bf07fa1f7a5ac47737018529ef13a1760bc0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
6ed584c1e43ff579586fa808a6d2f8c6

SHA1
5b7e1180658e20f5e178a0dca16453a90b4523b8

SHA256
1a00526ec2f9ae9522bbe392070a77916b77396165dcfa53a85a817240ededc5

SHA512
cfb335ee35bad22ea4aeccc0ee95eb3f8f8d211ba5b5bafcdc93c7226fb56624bc9e2b93ccd62cb4e3a572caee6ce503aa4bacc5448225d305ffdb41e4f0fd6e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
88dbcc78d3f783f93dd02247049197da

SHA1
600fcb72e90542b2bc3f014bdb3aea529bf9ec0e

SHA256
16a1cd13b1704ef8b3b0c64cdcf3e098ef9faa94af6a5e2453672d9736391ae4

SHA512
380c17646e1af40e207b0d9137214eb76bb6fda075ae08e6f01a3ca58361b1ba567b461dce5026f0b1253711d27c7316bc1760a30380855108c93a87a72c74b5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db

Filesize
14KB

MD5
28d39d9115889e76f0df726b4c82b7e8

SHA1
2bff47125413d9798fe7b382e556852c8ef060b2

SHA256
1cabfe4fcd6a265a82e724a15ac41ab3cab63fa7675379dce555631202987029

SHA512
751c4b84fcbbb8e420f17b47d61ba42fc494c9abd8f86eb8bf82a6de11dbe9f7601c7a363f46e810522fb0c132bb837779b1d6ce10b20b6b0ec29309af28bba6

Download Submit
C:\Users\Admin\AppData\Local\Temp\jeu.exe

Filesize
29KB

MD5
b7b03416b93cec63cf7eff3b392dcb7f

SHA1
97ff574161b03173bee25d99f79c7c75e4ed0f2c

SHA256
f1c90c49d28e2c0d903cb10230114d5e3486f2aac5e964450a3063c07bfcce55

SHA512
956a0909d995baad109b1443e083dfe37211df66e81f1d67a0443043786f710fc3abfa6bb47688f7c47f74f1d15cfb35a777d287357d3efae7f54e1eeb594e6e

Download Submit
C:\Users\Admin\AppData\Local\Temp\ransomware.vbs

Filesize
224B

MD5
a9e466445b8ac42b2c02709e4fd1b35d

SHA1
eee53ddfc1e75c2b65675770d6bd7baef8556b05

SHA256
07b601de8945ee8f38dd84764b0b84544dc7631f8a3c5884bf90bf3b8ed23802

SHA512
968ed9111c8a6e4ac015edc32b7dcb3ba0b79bcef535c470fdec3dfe5e6bf0e4115d4bb88964101dc979d1984322ea863969b504840d012f4874c26202f9b85b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\f01b4d95cf55d32a.automaticDestinations-ms

Filesize
8KB

MD5
9c121b3466b8b61bf8221a926609a128

SHA1
3126dd94a350b75d047dca1b21dfc3b6b25e0d0d

SHA256
a39ddd06ee9ca0b5fa9edc2b90bb2a71f732f573a46c887a516c0a63b913708c

SHA512
2e1b062604b792c343b74228626ef21ec5807783912dd833fd87d9df5aad84e9449b2caff2ab36aeb470e1f8c36eab7d6150955913f9827999c712824f62dd3f

Download Submit
C:\Users\Admin\Downloads\Faux ransomware by back V3.exe:Zone.Identifier

Filesize
55B

MD5
0f98a5550abe0fb880568b1480c96a1c

SHA1
d2ce9f7057b201d31f79f3aee2225d89f36be07d

SHA256
2dfb5f4b33e4cf8237b732c02b1f2b1192ffe4b83114bcf821f489bbf48c6aa1

SHA512
dbc1150d831950684ab37407defac0177b7583da0fe13ee8f8eeb65e8b05d23b357722246888189b4681b97507a4262ece96a1c458c4427a9a41d8ea8d11a2f6

Download Submit
C:\Users\Admin\Downloads\Heptoxide.zip

Filesize
112KB

MD5
d6432ec77eca2ef0059ef14192bc2a72

SHA1
d7f23e4db31753043703c91d4018ae05b6b0bc8e

SHA256
814a7c942439026ba9db24e6281f8f2af844b927c55ea71c69a1ff8881c01d45

SHA512
8ae21dc71d0fa2df0d5f92043b0a704e9c5f0aba99279f9433c1d5f440a1be437bce5c5e325e4739500de997831fb7c581da308d8e54bac2208a10b4a8e1b1d2

Download Submit
C:\Users\Admin\Downloads\Heptoxide\Heptoxide-safety.exe

Filesize
127KB

MD5
56f7bc7dd9ac24ee6496dc5e4e8910e6

SHA1
12ee8024ee1fbca3ea4ee461de523595cbcff978

SHA256
e82bc130eb8eca2247989884a863af341374419127489a043faaf77829f97a72

SHA512
5f5a44775d6bd0e246a9eb58f73496cdf4095f1515372883a17410790034dd569d80653fade2cdf75a0f2cce4557c9f574f909d0772c1a8739fe5d3cd36283ee

Download Submit
C:\Users\Admin\Downloads\Heptoxide\Heptoxide-safety.exe:Zone.Identifier

Filesize
78B

MD5
5ee93c139c055b40d8511dcf1b1fdde5

SHA1
4dd1c1c2219f2a26e84b31bc8ffba4c7c3bb4618

SHA256
2c7282c78a53683504f618dfb74bc0e4a7dd0b95e5c85a2e18b3098e6454e507

SHA512
450cf8b2e45bdde7bb68a96a2bd0968487d8a8fb87bae3256287793f39ed9bb6fef720e21ccebda8af24c2017a05b7465d7799f1970df3cecb52a02fb44d1823

Download Submit
C:\Users\Admin\Downloads\Heptoxide\Heptoxide.exe

Filesize
165KB

MD5
f970a59a728c152ebdbd8e45f26ac9d8

SHA1
ee6390f8798ffefd4472b427a4078e0c68286add

SHA256
fa544f8e0146d5f12bd904f65c2e999e475a525ff676350f90289a0ca834c21f

SHA512
f0351e4caeec6edf17cb7813c4557767f0382102e72622fe7e52b98dd6989af1190791ff79f14a07271df77baab9157e273fe5aea848b5438b80d1d1cd631df3

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 249240.crdownload

Filesize
2.6MB

MD5
089bfa56fe6eb738efbfd64bc6bc5986

SHA1
3f3bb1b33b3c2b90f8be63bdaa1f9681b4be2c84

SHA256
d2b84d77cde74660601a30c46b4e1818917df41895ffdf5776028b6ac0cd6feb

SHA512
e6c62a7b96de27ace8ff81a41c9c0f843f7ba6e5bc4fad37ce6b013b903a1ee78d2b63ae4293e4291d86a9ac3db63b32b45fd81b2d396854e363fb0636ba8eb3

Download Submit
memory/688-586-0x0000000004C70000-0x0000000004C7A000-memory.dmp

Filesize
40KB

Download
memory/688-582-0x00000000001D0000-0x00000000001DE000-memory.dmp

Filesize
56KB

Download
memory/688-587-0x0000000004FA0000-0x0000000004FF6000-memory.dmp

Filesize
344KB

Download
memory/688-583-0x0000000004CE0000-0x0000000004D7C000-memory.dmp

Filesize
624KB

Download
memory/688-585-0x0000000004D80000-0x0000000004E12000-memory.dmp

Filesize
584KB

Download
memory/688-584-0x0000000005330000-0x00000000058D6000-memory.dmp

Filesize
5.6MB

Download