Resubmissions

12/05/2024, 21:55

240512-1s3bwsbd45 10

12/05/2024, 21:52

240512-1rffqsgc4s 9

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/05/2024, 21:52

General

  • Target

    https://github.com/Da2dalus/The-MALWARE-Repo/tree/master/Ransomware

Malware Config

Signatures

  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

  • Downloads MZ/PE file
  • Executes dropped EXE 4 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 13 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Interacts with shadow copies 2 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

  • NTFS ADS 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 44 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
      PID:516
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
      1⤵
        PID:776
      • C:\Windows\system32\taskhostw.exe
        taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
        1⤵
          PID:3116
        • C:\Windows\Explorer.EXE
          C:\Windows\Explorer.EXE
          1⤵
          • Adds Run key to start application
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          PID:3440
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/Da2dalus/The-MALWARE-Repo/tree/master/Ransomware
            2⤵
            • Enumerates system info in registry
            • NTFS ADS
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            • Suspicious use of WriteProcessMemory
            PID:2544
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe1ce946f8,0x7ffe1ce94708,0x7ffe1ce94718
              3⤵
                PID:3432
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,14176789601566361086,12621748119933879212,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
                3⤵
                  PID:1072
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,14176789601566361086,12621748119933879212,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2320 /prefetch:3
                  3⤵
                  • Suspicious behavior: EnumeratesProcesses
                  PID:4820
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,14176789601566361086,12621748119933879212,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2664 /prefetch:8
                  3⤵
                    PID:2396
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,14176789601566361086,12621748119933879212,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
                    3⤵
                      PID:3996
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,14176789601566361086,12621748119933879212,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
                      3⤵
                        PID:4424
                      • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,14176789601566361086,12621748119933879212,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5504 /prefetch:8
                        3⤵
                          PID:4380
                        • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,14176789601566361086,12621748119933879212,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5504 /prefetch:8
                          3⤵
                          • Suspicious behavior: EnumeratesProcesses
                          PID:708
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,14176789601566361086,12621748119933879212,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5072 /prefetch:1
                          3⤵
                            PID:4768
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,14176789601566361086,12621748119933879212,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5208 /prefetch:1
                            3⤵
                              PID:400
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,14176789601566361086,12621748119933879212,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:1
                              3⤵
                                PID:5208
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,14176789601566361086,12621748119933879212,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3516 /prefetch:1
                                3⤵
                                  PID:5216
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2112,14176789601566361086,12621748119933879212,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5816 /prefetch:8
                                  3⤵
                                    PID:5612
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,14176789601566361086,12621748119933879212,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5548 /prefetch:1
                                    3⤵
                                      PID:5620
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2112,14176789601566361086,12621748119933879212,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6264 /prefetch:8
                                      3⤵
                                        PID:5708
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,14176789601566361086,12621748119933879212,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6116 /prefetch:1
                                        3⤵
                                          PID:5108
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2112,14176789601566361086,12621748119933879212,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4856 /prefetch:8
                                          3⤵
                                          • Suspicious behavior: EnumeratesProcesses
                                          PID:1132
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,14176789601566361086,12621748119933879212,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1336 /prefetch:2
                                          3⤵
                                            PID:2716
                                        • C:\Users\Admin\Downloads\satan.exe
                                          "C:\Users\Admin\Downloads\satan.exe"
                                          2⤵
                                          • Executes dropped EXE
                                          • Suspicious use of SetThreadContext
                                          • Suspicious behavior: EnumeratesProcesses
                                          PID:4196
                                          • C:\Users\Admin\Downloads\satan.exe
                                            "C:\Users\Admin\Downloads\satan.exe"
                                            3⤵
                                            • Executes dropped EXE
                                            PID:1544
                                            • C:\Users\Admin\AppData\Roaming\Urho\ofexw.exe
                                              "C:\Users\Admin\AppData\Roaming\Urho\ofexw.exe"
                                              4⤵
                                              • Executes dropped EXE
                                              • Suspicious use of SetThreadContext
                                              • Suspicious behavior: EnumeratesProcesses
                                              PID:4604
                                              • C:\Users\Admin\AppData\Roaming\Urho\ofexw.exe
                                                "C:\Users\Admin\AppData\Roaming\Urho\ofexw.exe"
                                                5⤵
                                                • Executes dropped EXE
                                                • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                PID:2496
                                            • C:\Windows\SysWOW64\cmd.exe
                                              "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp_6b898cc2.bat"
                                              4⤵
                                                PID:3892
                                                • C:\Windows\System32\Conhost.exe
                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                  5⤵
                                                    PID:4048
                                            • C:\Windows\System32\vssadmin.exe
                                              "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
                                              2⤵
                                              • Interacts with shadow copies
                                              PID:2752
                                            • C:\Windows\system32\taskmgr.exe
                                              "C:\Windows\system32\taskmgr.exe" /4
                                              2⤵
                                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                                              • Checks SCSI registry key(s)
                                              • Suspicious use of AdjustPrivilegeToken
                                              • Suspicious use of FindShellTrayWindow
                                              • Suspicious use of SendNotifyMessage
                                              PID:5984
                                          • C:\Windows\system32\svchost.exe
                                            C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
                                            1⤵
                                              PID:3548
                                            • C:\Windows\system32\DllHost.exe
                                              C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                                              1⤵
                                                PID:3748
                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                1⤵
                                                • Suspicious use of UnmapMainImage
                                                PID:3844
                                              • C:\Windows\System32\RuntimeBroker.exe
                                                C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                1⤵
                                                • Suspicious use of UnmapMainImage
                                                PID:3912
                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                1⤵
                                                  PID:4056
                                                • C:\Windows\System32\RuntimeBroker.exe
                                                  C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                  1⤵
                                                    PID:4108
                                                  • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
                                                    "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca
                                                    1⤵
                                                      PID:396
                                                    • C:\Windows\System32\RuntimeBroker.exe
                                                      C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                      1⤵
                                                        PID:4660
                                                      • C:\Windows\System32\CompPkgSrv.exe
                                                        C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                        1⤵
                                                          PID:1884
                                                        • C:\Windows\System32\CompPkgSrv.exe
                                                          C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                          1⤵
                                                            PID:4456
                                                          • C:\Windows\System32\RuntimeBroker.exe
                                                            C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                            1⤵
                                                              PID:3896
                                                            • C:\Windows\System32\RuntimeBroker.exe
                                                              C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                              1⤵
                                                                PID:5140
                                                              • C:\Windows\System32\rundll32.exe
                                                                C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                                                1⤵
                                                                  PID:4596
                                                                • C:\Windows\system32\vssvc.exe
                                                                  C:\Windows\system32\vssvc.exe
                                                                  1⤵
                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                  PID:2260

                                                                Network

                                                                MITRE ATT&CK Enterprise v15

                                                                Replay Monitor

                                                                Loading Replay Monitor...

                                                                Downloads

                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                  Filesize

                                                                  152B

                                                                  MD5

                                                                  c9c4c494f8fba32d95ba2125f00586a3

                                                                  SHA1

                                                                  8a600205528aef7953144f1cf6f7a5115e3611de

                                                                  SHA256

                                                                  a0ca609205813c307df9122c0c5b0967c5472755700f615b0033129cf7d6b35b

                                                                  SHA512

                                                                  9d30cea6cfc259e97b0305f8b5cd19774044fb78feedfcef2014b2947f2e6a101273bc4ad30db9cc1724e62eb441266d7df376e28ac58693f128b9cce2c7d20d

                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                  Filesize

                                                                  152B

                                                                  MD5

                                                                  4dc6fc5e708279a3310fe55d9c44743d

                                                                  SHA1

                                                                  a42e8bdf9d1c25ef3e223d59f6b1d16b095f46d2

                                                                  SHA256

                                                                  a1c5f48659d4b3af960971b3a0f433a95fee5bfafe5680a34110c68b342377d8

                                                                  SHA512

                                                                  5874b2310187f242b852fa6dcded244cc860abb2be4f6f5a6a1db8322e12e1fef8f825edc0aae75adbb7284a2cd64730650d0643b1e2bb7ead9350e50e1d8c13

                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                                  Filesize

                                                                  2KB

                                                                  MD5

                                                                  af9eb8831185cf7ed7dcb6ed1f2b2391

                                                                  SHA1

                                                                  6c51733ef0a1610d648c14f2615bbc30fe4cbc15

                                                                  SHA256

                                                                  fa54550f3b3b76a040ff8098ad5763371790345b5914db762f2b3700d7064afe

                                                                  SHA512

                                                                  787b6739358bbeb6d711e16db768d024ff195b72a0a0ba2fa18dc765526161d32b59c26cf023c095d4adbfbfd05ec0772f1a899e6300eaf938b326b9e5706111

                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                                  Filesize

                                                                  579B

                                                                  MD5

                                                                  000fbec379b54832c8f3ca39dad9344f

                                                                  SHA1

                                                                  b3e63db91eb9b4cea7fa69ec5789450850da2aba

                                                                  SHA256

                                                                  2236ec3b053951ccc64977ad11e4d512a39d47799735f5b5de15ada77ed49933

                                                                  SHA512

                                                                  47da5d2362c6b4f33a6a7b5bdf3d6715612e11d5544924fa2aa5682c2f7462840bdb4ae86ced006670a9109eb5bd5e709191973d87a241091fb5740b1cddcd14

                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                  Filesize

                                                                  5KB

                                                                  MD5

                                                                  600e94939ebc1ac4cdfb3e99c0289fdf

                                                                  SHA1

                                                                  020518c7f8ef38c86813b1c806a23100a530d7ce

                                                                  SHA256

                                                                  4c8ac626a274017fe00f4f1e3911982b8e46771de188274c85ea7c4bb12fb43d

                                                                  SHA512

                                                                  5f08d2a4e5d64a29bbf41f49d1c0809bbd91b8a7695f2880a702cb4302823029cf6a08c871e1055e06e10e027a777bdcf59491244c1719504e39d1f9de00bb64

                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                  Filesize

                                                                  6KB

                                                                  MD5

                                                                  a601b001eb2be1697fcb77d8780f0f01

                                                                  SHA1

                                                                  62e27e2740598fa456a623c1c10cf001ace6225d

                                                                  SHA256

                                                                  5182bf9d9eebc7a06f3a92cd4b47cc45fae84defa7aaaa2a133a2cc21b0d9346

                                                                  SHA512

                                                                  42ace7f49c38aa3e0c27b13e6e3bfdffc009bc2a26d828813b119c52d3bc029e388957cba4bf6fa2c90d127a706907ab6c04e918914002a20283233b8e983657

                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                  Filesize

                                                                  6KB

                                                                  MD5

                                                                  b94f8fe825966bd7774b530ceb834cda

                                                                  SHA1

                                                                  aa828eff5a55961e3487cb945333ef2f96820623

                                                                  SHA256

                                                                  d2242f7e84d938e933fde93c1777fb36fe61d4ec952f614f0044bf03561d719b

                                                                  SHA512

                                                                  85b69061a2760702641feb7792c4fc4c62a9ab231291b27caadd2cb2e877859500d09bfb09459657b71bfadefdfb9ac2629259425f7ed91e53df18acc1be3d40

                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                  Filesize

                                                                  1KB

                                                                  MD5

                                                                  68dc17461dbd58dac902bd07823e4cf1

                                                                  SHA1

                                                                  f41e002c0935c5ba8933af12b29831c96d78cf8e

                                                                  SHA256

                                                                  47cecceda6b9266bdc64580e15370b96d9bd95ab56ad2eca34c1c80415b06993

                                                                  SHA512

                                                                  36db6463b779608579a62bfa5ec0a15dc6a367f6a9cf34ccd4ebec987ed15c69b57476ac779017af57337385a6bb4d07b03abad08b98addd61e8fcb4bb3c62f1

                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                  Filesize

                                                                  1KB

                                                                  MD5

                                                                  db2a96b03d78d22b6b54e6aaa7614c1e

                                                                  SHA1

                                                                  8eeb895a4c1172f2591cdd04d9f4210f7d153d15

                                                                  SHA256

                                                                  22c709fcddb17dfee7d7041ca273a1583bb58e9047c0f846698572b32ff20087

                                                                  SHA512

                                                                  8ce819eccc7c6421d7c260f9274fb5374d4752d746a53f455d17794a17307b86e1421626595ec3a3f9e0446852986df14da37ef21c61d438cc2668c322187d1e

                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                  Filesize

                                                                  1KB

                                                                  MD5

                                                                  30d078a5fa44c0e131cb99facb81d262

                                                                  SHA1

                                                                  f2ab724912c855ccdfacbd92d3c0e6fe322a9551

                                                                  SHA256

                                                                  f88bd7131db9e8bf990f0e6ecf8f3f03d065246a34d515a95c646cb628a658b9

                                                                  SHA512

                                                                  d21ace6ca854c0862620f0cf350f1b86d948164f69d4226acdd484d4e8367e772f874eab5a31077b53299f2cf008b984ada2d54cb76afa028c06355edd2e3868

                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                  Filesize

                                                                  1KB

                                                                  MD5

                                                                  fd0cd2061896d2ebddbff28bdc07a91c

                                                                  SHA1

                                                                  799302fc0d41543502011807eb130f811b487e87

                                                                  SHA256

                                                                  53d9af9e68c91614fef07859bdfb0e5782b798430ecefbd48fc8db095b88033b

                                                                  SHA512

                                                                  c639796de60541aabdad437795f845f147620c9d670e79114da820d6d5015a7b6293f0ff7792c8e271ebb812cd0893a3c6fe2cfb956b4ae11a465a56ffb7ffba

                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                  Filesize

                                                                  1KB

                                                                  MD5

                                                                  80cf9e04e37bc70f986b84bc96c20bc7

                                                                  SHA1

                                                                  d117c8d16f6e18d3987869ebf571ef883ddda3dd

                                                                  SHA256

                                                                  c5dd4355c8221b4511105c685a5cba379e916200964c07e94f44a220561bb527

                                                                  SHA512

                                                                  85fe1f33cb59821b26963c4fdcf4f2917abd5a159c892025d9082e409f81e4e23ebe1fb135c625404e38e1f211856da047f97e65fb22a4ef9009b94456a52a6b

                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                  Filesize

                                                                  1KB

                                                                  MD5

                                                                  623b1b485c259894f15dfe98a012e71c

                                                                  SHA1

                                                                  101e55268dae29525f83d12471107bc9c3029b47

                                                                  SHA256

                                                                  16597c81cdbf337814aec2c53fa16f070f1b83e929e6828411e3000bbae0d21c

                                                                  SHA512

                                                                  ac572215357bcf164ea6f501ee89fcc4a1cf12d2b573f0c13fca2b65f9db8e3b6f04018b523be80358c892e98e88c19908dc29d18a65a7fc0bfe5e47e01dd698

                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                  Filesize

                                                                  1KB

                                                                  MD5

                                                                  e8abe09a11f3d0264021b80d6e162e92

                                                                  SHA1

                                                                  a4e61dca5898110ded08882d961b06915bcefcbb

                                                                  SHA256

                                                                  2b3eedb1edde1a83f9993305dd4165e3e166ef5bcd95edad6e3483b40c17051b

                                                                  SHA512

                                                                  4f7d48a4bbb661173618ad0cbf2a474bb287401ca3e8d13c52d0790632f4d0cf98a33a1afbbbdf81f9880798bfaf45ffe715b2f568973167c21d3862369ff43c

                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57b630.TMP

                                                                  Filesize

                                                                  874B

                                                                  MD5

                                                                  c27eb77b52ccb1955671a1bf3c10c2b2

                                                                  SHA1

                                                                  e9eb22971c60daef884a16d2920f9e80a6df7654

                                                                  SHA256

                                                                  711ac39b03377c5846a436b6d8e96c4cebbf435e0b463ceefcb331d205797448

                                                                  SHA512

                                                                  cb714a8316e53f11f1d2348334b0e84feef596ecafe3b5192d0ba57524ebab4d844a449a1760d7a73bfa23006ee09f28079ef7945535bc5a6739be28fcf86d33

                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                                                  Filesize

                                                                  16B

                                                                  MD5

                                                                  206702161f94c5cd39fadd03f4014d98

                                                                  SHA1

                                                                  bd8bfc144fb5326d21bd1531523d9fb50e1b600a

                                                                  SHA256

                                                                  1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

                                                                  SHA512

                                                                  0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                                                  Filesize

                                                                  16B

                                                                  MD5

                                                                  46295cac801e5d4857d09837238a6394

                                                                  SHA1

                                                                  44e0fa1b517dbf802b18faf0785eeea6ac51594b

                                                                  SHA256

                                                                  0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                                                                  SHA512

                                                                  8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                  Filesize

                                                                  11KB

                                                                  MD5

                                                                  dff6ea0494f4e02287c0a9bba5bb56c1

                                                                  SHA1

                                                                  485f11701850ed7d23a822fc3d97c6fb1b17f769

                                                                  SHA256

                                                                  0db7bdceab6a0d00b317396796871319d2232607f67005130c49c8c9d468438f

                                                                  SHA512

                                                                  800502426bc9538c2dacb99a598fa2b739b515a7616fa8e624183bf8e80563f434f4b4c3a18b45acd9f3febb1041b9ecd6ab273a40c269f4cabf1af83dbc10fc

                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                  Filesize

                                                                  12KB

                                                                  MD5

                                                                  f93a99b46ce5589fd7eac8a1451df9c6

                                                                  SHA1

                                                                  3b0b4c40f08f0a21969519f2cb6d1572b73933a7

                                                                  SHA256

                                                                  42d15024b541616faa4afd149e2f6cb0a0305498b8e14d62c575c279c5630775

                                                                  SHA512

                                                                  f9924325dbfc2d655f3a524a12cc2db696c8bcd8fe254c0f402b3d3b8f349863527ee32f3ba611ab1cebe8b55e91681f326a8845c556006415cdaa3a1cb37a9b

                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                  Filesize

                                                                  12KB

                                                                  MD5

                                                                  500d52fc5c7d1ec949921e7d66410c0a

                                                                  SHA1

                                                                  7389197a77052463d2c8081b5636a7f372d469af

                                                                  SHA256

                                                                  aef1150c2ad12dade3dfc5a3991104770758a005cb43a0e60a2b7cd573e2d287

                                                                  SHA512

                                                                  31743b47e9828e66e8de2358a07ae220fef8cc0c7d22d869ebb39bbe80f2d7f4225f22d34895c8e3befe98b0b857fc75a239ecf51d577e2b3c8ff0ff10ad1812

                                                                • C:\Users\Admin\AppData\Local\Temp\tmp_6b898cc2.bat

                                                                  Filesize

                                                                  172B

                                                                  MD5

                                                                  c482e08cecb112fecd2aabada37632b1

                                                                  SHA1

                                                                  c0b8789c419f537de9111a445f9004eb5c16ea15

                                                                  SHA256

                                                                  a69b07abec0beb8ec71f8f69385d20a8bae288fda47d4dc1e8fe4ddc1503193d

                                                                  SHA512

                                                                  a11ac5544834fe154f7cca67584ff57110d740fabd8cac25d870dfb249b52c3df0b93aaf94457bf8c787cd3f3e3d7ae50ed09a9aa01742c52b7a6636a3b68015

                                                                • C:\Users\Admin\AppData\Roaming\Urho\ofexw.exe

                                                                  Filesize

                                                                  67KB

                                                                  MD5

                                                                  b4b3a8aee43eb2480f654ae5cbe1fbea

                                                                  SHA1

                                                                  448bd6d09ca43fd921e608cade2ec206af430a75

                                                                  SHA256

                                                                  31c2b5ee8fc1ddaf12bd47b04bc08f1035c24d12835d6ecf7263d20d9340284c

                                                                  SHA512

                                                                  f25f87b91aeecb34b815f7b7c3f8f49a11b165aa996f88ec9cf20ee632661a81d5e04b238020f4df51062ff5baa124bc6fbcc2c7094722a4f658c599450b6623

                                                                • C:\Users\Admin\Downloads\Unconfirmed 267325.crdownload

                                                                  Filesize

                                                                  184KB

                                                                  MD5

                                                                  c9c341eaf04c89933ed28cbc2739d325

                                                                  SHA1

                                                                  c5b7d47aef3bd33a24293138fcba3a5ff286c2a8

                                                                  SHA256

                                                                  1a0a2fd546e3c05e15b2db3b531cb8e8755641f5f1c17910ce2fb7bbce2a05b7

                                                                  SHA512

                                                                  7cfa6ec0be0f5ae80404c6c709a6fd00ca10a18b6def5ca746611d0d32a9552f7961ab0ebf8a336b27f7058d700205be7fcc859a30d7d185aa9457267090f99b

                                                                • memory/396-433-0x000001D1C3FA0000-0x000001D1C3FB7000-memory.dmp

                                                                  Filesize

                                                                  92KB

                                                                • memory/396-418-0x000001D1C3FA0000-0x000001D1C3FB7000-memory.dmp

                                                                  Filesize

                                                                  92KB

                                                                • memory/516-429-0x000001ED25AA0000-0x000001ED25AB7000-memory.dmp

                                                                  Filesize

                                                                  92KB

                                                                • memory/516-394-0x000001ED25AA0000-0x000001ED25AB7000-memory.dmp

                                                                  Filesize

                                                                  92KB

                                                                • memory/708-435-0x000002AC8FBE0000-0x000002AC8FBF7000-memory.dmp

                                                                  Filesize

                                                                  92KB

                                                                • memory/708-421-0x000002AC8FBE0000-0x000002AC8FBF7000-memory.dmp

                                                                  Filesize

                                                                  92KB

                                                                • memory/776-430-0x000001B0EAF30000-0x000001B0EAF47000-memory.dmp

                                                                  Filesize

                                                                  92KB

                                                                • memory/776-396-0x000001B0EAF30000-0x000001B0EAF47000-memory.dmp

                                                                  Filesize

                                                                  92KB

                                                                • memory/1544-370-0x0000000000400000-0x0000000000412000-memory.dmp

                                                                  Filesize

                                                                  72KB

                                                                • memory/1544-372-0x0000000000400000-0x0000000000412000-memory.dmp

                                                                  Filesize

                                                                  72KB

                                                                • memory/1544-378-0x0000000000400000-0x0000000000412000-memory.dmp

                                                                  Filesize

                                                                  72KB

                                                                • memory/2496-380-0x0000000000400000-0x0000000000417000-memory.dmp

                                                                  Filesize

                                                                  92KB

                                                                • memory/2496-459-0x0000000004C10000-0x0000000004C27000-memory.dmp

                                                                  Filesize

                                                                  92KB

                                                                • memory/2496-384-0x0000000000400000-0x0000000000417000-memory.dmp

                                                                  Filesize

                                                                  92KB

                                                                • memory/3116-397-0x0000028F244F0000-0x0000028F24507000-memory.dmp

                                                                  Filesize

                                                                  92KB

                                                                • memory/3116-424-0x0000028F244F0000-0x0000028F24507000-memory.dmp

                                                                  Filesize

                                                                  92KB

                                                                • memory/3440-404-0x0000000008290000-0x00000000082A7000-memory.dmp

                                                                  Filesize

                                                                  92KB

                                                                • memory/3440-402-0x0000000008290000-0x00000000082A7000-memory.dmp

                                                                  Filesize

                                                                  92KB

                                                                • memory/3440-399-0x0000000008290000-0x00000000082A7000-memory.dmp

                                                                  Filesize

                                                                  92KB

                                                                • memory/3440-405-0x0000000008290000-0x00000000082A7000-memory.dmp

                                                                  Filesize

                                                                  92KB

                                                                • memory/3440-406-0x0000000008290000-0x00000000082A7000-memory.dmp

                                                                  Filesize

                                                                  92KB

                                                                • memory/3440-403-0x0000000008290000-0x00000000082A7000-memory.dmp

                                                                  Filesize

                                                                  92KB

                                                                • memory/3548-431-0x000001F0A99D0000-0x000001F0A99E7000-memory.dmp

                                                                  Filesize

                                                                  92KB

                                                                • memory/3548-400-0x000001F0A99D0000-0x000001F0A99E7000-memory.dmp

                                                                  Filesize

                                                                  92KB

                                                                • memory/3748-457-0x0000027A30D70000-0x0000027A30D71000-memory.dmp

                                                                  Filesize

                                                                  4KB

                                                                • memory/3748-425-0x0000027A30DB0000-0x0000027A30DC7000-memory.dmp

                                                                  Filesize

                                                                  92KB

                                                                • memory/3748-401-0x0000027A30DB0000-0x0000027A30DC7000-memory.dmp

                                                                  Filesize

                                                                  92KB

                                                                • memory/3748-456-0x0000027A30EB0000-0x0000027A30EB8000-memory.dmp

                                                                  Filesize

                                                                  32KB

                                                                • memory/3844-432-0x000001E8610B0000-0x000001E8610C7000-memory.dmp

                                                                  Filesize

                                                                  92KB

                                                                • memory/3844-407-0x000001E8610B0000-0x000001E8610C7000-memory.dmp

                                                                  Filesize

                                                                  92KB

                                                                • memory/3896-420-0x0000022D617E0000-0x0000022D617F7000-memory.dmp

                                                                  Filesize

                                                                  92KB

                                                                • memory/3896-428-0x0000022D617E0000-0x0000022D617F7000-memory.dmp

                                                                  Filesize

                                                                  92KB

                                                                • memory/3912-427-0x000001E2F2E00000-0x000001E2F2E17000-memory.dmp

                                                                  Filesize

                                                                  92KB

                                                                • memory/3912-415-0x000001E2F2E00000-0x000001E2F2E17000-memory.dmp

                                                                  Filesize

                                                                  92KB

                                                                • memory/4048-437-0x0000015109AF0000-0x0000015109B07000-memory.dmp

                                                                  Filesize

                                                                  92KB

                                                                • memory/4048-423-0x0000015109AF0000-0x0000015109B07000-memory.dmp

                                                                  Filesize

                                                                  92KB

                                                                • memory/4056-416-0x0000011D164B0000-0x0000011D164C7000-memory.dmp

                                                                  Filesize

                                                                  92KB

                                                                • memory/4108-426-0x00000233FD050000-0x00000233FD067000-memory.dmp

                                                                  Filesize

                                                                  92KB

                                                                • memory/4108-417-0x00000233FD050000-0x00000233FD067000-memory.dmp

                                                                  Filesize

                                                                  92KB

                                                                • memory/4604-390-0x0000000000D70000-0x0000000000E0E000-memory.dmp

                                                                  Filesize

                                                                  632KB

                                                                • memory/4604-385-0x0000000000170000-0x0000000000200000-memory.dmp

                                                                  Filesize

                                                                  576KB

                                                                • memory/4604-398-0x0000000001290000-0x0000000001390000-memory.dmp

                                                                  Filesize

                                                                  1024KB

                                                                • memory/4604-408-0x0000000001590000-0x00000000015C0000-memory.dmp

                                                                  Filesize

                                                                  192KB

                                                                • memory/4604-409-0x0000000002C10000-0x0000000002C41000-memory.dmp

                                                                  Filesize

                                                                  196KB

                                                                • memory/4604-410-0x0000000002B90000-0x0000000002BA8000-memory.dmp

                                                                  Filesize

                                                                  96KB

                                                                • memory/4604-382-0x0000000000410000-0x00000000004CE000-memory.dmp

                                                                  Filesize

                                                                  760KB

                                                                • memory/4604-411-0x0000000002D00000-0x0000000002D34000-memory.dmp

                                                                  Filesize

                                                                  208KB

                                                                • memory/4604-393-0x0000000000FE0000-0x00000000010EB000-memory.dmp

                                                                  Filesize

                                                                  1.0MB

                                                                • memory/4604-412-0x0000000002D40000-0x0000000002D67000-memory.dmp

                                                                  Filesize

                                                                  156KB

                                                                • memory/4604-392-0x0000000000EB0000-0x0000000000FDA000-memory.dmp

                                                                  Filesize

                                                                  1.2MB

                                                                • memory/4604-413-0x00000000030B0000-0x00000000030BC000-memory.dmp

                                                                  Filesize

                                                                  48KB

                                                                • memory/4604-389-0x0000000000D40000-0x0000000000D6B000-memory.dmp

                                                                  Filesize

                                                                  172KB

                                                                • memory/4604-388-0x0000000000D10000-0x0000000000D32000-memory.dmp

                                                                  Filesize

                                                                  136KB

                                                                • memory/4604-387-0x0000000000B60000-0x0000000000C0C000-memory.dmp

                                                                  Filesize

                                                                  688KB

                                                                • memory/4604-383-0x00000000006E0000-0x00000000009A9000-memory.dmp

                                                                  Filesize

                                                                  2.8MB

                                                                • memory/4604-414-0x00000000030C0000-0x0000000003143000-memory.dmp

                                                                  Filesize

                                                                  524KB

                                                                • memory/4604-395-0x00000000010F0000-0x000000000118D000-memory.dmp

                                                                  Filesize

                                                                  628KB

                                                                • memory/4604-391-0x0000000000E10000-0x0000000000EAB000-memory.dmp

                                                                  Filesize

                                                                  620KB

                                                                • memory/4604-386-0x00000000009B0000-0x0000000000B51000-memory.dmp

                                                                  Filesize

                                                                  1.6MB

                                                                • memory/4660-434-0x00000230E5FA0000-0x00000230E5FB7000-memory.dmp

                                                                  Filesize

                                                                  92KB

                                                                • memory/4660-419-0x00000230E5FA0000-0x00000230E5FB7000-memory.dmp

                                                                  Filesize

                                                                  92KB

                                                                • memory/5140-422-0x0000012053CC0000-0x0000012053CD7000-memory.dmp

                                                                  Filesize

                                                                  92KB

                                                                • memory/5140-436-0x0000012053CC0000-0x0000012053CD7000-memory.dmp

                                                                  Filesize

                                                                  92KB