cerber | 40902f482be77455af14009ca7ec71c8b1b78cc12af7d51319cc47f92387026f

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
24-06-2024 09:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

40902f482be77455af14009ca7ec71c8b1b78cc12af7d51319cc47f92387026f.exe
Size

267KB
MD5

58d6f1f73af65c56b5686a8fd43462f7
SHA1

8db860773719ee42c4aff6ac811d539f0ea8c13b
SHA256

40902f482be77455af14009ca7ec71c8b1b78cc12af7d51319cc47f92387026f
SHA512

c103bcb985eb974246974d84565e5cc2962dd9221a12a0a4e0e97a742a3815a6d73314bf0771b6dd794a9306c37a400bf484b57b500aab9165add22c5b4936b9
SSDEEP

6144:P9KOQS4qFSHLougzUhU0oxIVoVr9VygKhnWOerfsR:PsqFsgz20wa5V5KU5DA

Score

10^/10

cerber discovery persistence ransomware spyware stealer

Malware Config

Extracted

Path

C:\Users\Admin\Pictures\# DECRYPT MY FILES #.txt

Family

cerber

Ransom Note

C E R B E R R A N S O M W A R E ######################################################################### Cannot you find the files you need? Is the content of the files that you looked for not readable? It is normal because the files' names, as well as the data in your files have been encrypted. Great!!! You have turned to be a part of a big community #Cerber_Ransomware. ######################################################################### !!! If you are reading this message it means the software !!! "Cerber Rans0mware" has been removed from your computer. ######################################################################### What is encryption? ------------------- Encryption is a reversible modification of information for security reasons but providing full access to it for authorized users. To become an authorized user and keep the modification absolutely reversible (in other words to have a possibility to decrypt your files) you should have an individual private key. But not only it. It is required also to have the special decryption software (in your case "Cerber Decryptor" software) for safe and complete decryption of all your files and data. ######################################################################### Everything is clear for me but what should I do? ------------------------------------------------ The first step is reading these instructions to the end. Your files have been encrypted with the "Cerber Ransomware" software; the instructions ("# DECRYPT MY FILES #.html" and "# DECRYPT MY FILES #.txt") in the folders with your encrypted files are not viruses, they will help you. After reading this text the most part of people start searching in the Internet the words the "Cerber Ransomware" where they find a lot of ideas, recommendations and instructions. It is necessary to realize that we are the ones who closed the lock on your files and we are the only ones who have this secret key to open them. !!! Any attempts to get back your files with the third-party tools can !!! be fatal for your encrypted files. The most part of the third-party software change data within the encrypted file to restore it but this causes damage to the files. Finally it will be impossible to decrypt your files. When you make a puzzle but some items are lost, broken or not put in its place - the puzzle items will never match, the same way the third-party software will ruin your files completely and irreversibly. You should realize that any intervention of the third-party software to restore files encrypted with the "Cerber Ransomware" software may be fatal for your files. ######################################################################### !!! There are several plain steps to restore your files but if you do !!! not follow them we will not be able to help you, and we will not try !!! since you have read this warning already. ######################################################################### For your information the software to decrypt your files (as well as the private key provided together) are paid products. After purchase of the software package you will be able to: 1. decrypt all your files; 2. work with your documents; 3. view your photos and other media; 4. continue your usual and comfortable work at the computer. If you understand all importance of the situation then we propose to you to go directly to your personal page where you will receive the complete instructions and guarantees to restore your files. ######################################################################### There is a list of temporary addresses to go on your personal page below: _______________________________________________________________________ | | 1. http://cerberhhyed5frqa.wewiso.top/64DC-5FFF-05C2-006D-F4B3 | | 2. http://cerberhhyed5frqa.we34re.top/64DC-5FFF-05C2-006D-F4B3 | | 3. http://cerberhhyed5frqa.ad34ft.win/64DC-5FFF-05C2-006D-F4B3 | | 4. http://cerberhhyed5frqa.xmfu59.win/64DC-5FFF-05C2-006D-F4B3 | | 5. http://cerberhhyed5frqa.zgf48j.win/64DC-5FFF-05C2-006D-F4B3 |_______________________________________________________________________ ######################################################################### What should you do with these addresses? ---------------------------------------- If you read the instructions in TXT format (if you have instruction in HTML (the file with an icon of your Internet browser) then the easiest way is to run it): 1. take a look at the first address (in this case it is http://cerberhhyed5frqa.wewiso.top/64DC-5FFF-05C2-006D-F4B3); 2. select it with the mouse cursor holding the left mouse button and moving the cursor to the right; 3. release the left mouse button and press the right one; 4. select "Copy" in the appeared menu; 5. run your Internet browser (if you do not know what it is run the Internet Explorer); 6. move the mouse cursor to the address bar of the browser (this is the place where the site address is written); 7. click the right mouse button in the field where the site address is written; 8. select the button "Insert" in the appeared menu; 9. then you will see the address http://cerberhhyed5frqa.wewiso.top/64DC-5FFF-05C2-006D-F4B3 appeared there; 10. press ENTER; 11. the site should be loaded; if it is not loaded repeat the same instructions with the second address and continue until the last address if falling. If for some reason the site cannot be opened check the connection to the Internet; if the site still cannot be opened take a look at the instructions on omitting the point about working with the addresses in the HTML instructions. If you browse the instructions in HTML format: 1. click the left mouse button on the first address (in this case it is http://cerberhhyed5frqa.wewiso.top/64DC-5FFF-05C2-006D-F4B3); 2. in a new tab or window of your web browser the site should be loaded; if it is not loaded repeat the same instructions with the second address and continue until the last address. If for some reason the site cannot be opened check the connection to the Internet. ######################################################################### Unfortunately these sites are short-term since the antivirus companies are interested in you do not have a chance to restore your files but continue to buy their products. Unlike them we are ready to help you always. If you need our help but the temporary sites are not available: 1. run your Internet browser (if you do not know what it is run the Internet Explorer); 2. enter or copy the address https://www.torproject.org/download/download-easy.html.en into the address bar of your browser and press ENTER; 3. wait for the site loading; 4. on the site you will be offered to download Tor Browser; download and run it, follow the installation instructions, wait until the installation is completed; 5. run Tor Browser; 6. connect with the button "Connect" (if you use the English version); 7. a normal Internet browser window will be opened after the initialization; 8. type or copy the address ________________________________________________________ | | | http://cerberhhyed5frqa.onion/64DC-5FFF-05C2-006D-F4B3 | |________________________________________________________| in this browser address bar; 9. press ENTER; 10. the site should be loaded; if for some reason the site is not loading wait for a moment and try again. If you have any problems during installation or operation of Tor Browser, please, visit https://www.youtube.com/ and type request in the search bar "install tor browser windows" and you will find a lot of training videos about Tor Browser installation and operation. If TOR address is not available for a long period (2-3 days) it means you are late; usually you have about 2-3 weeks after reading the instructions to restore your files. ######################################################################### Additional information: You will find the instructions for restoring your files in those folders where you have your encrypted files only. The instructions are made in two file formats - HTML and TXT for your convenience. Unfortunately antivirus companies cannot protect or restore your files but they can make the situation worse removing the instructions how to restore your encrypted files. The instructions are not viruses; they have informative nature only, so any claims on the absence of any instruction files you can send to your antivirus company. ######################################################################### Cerber Ransomware Project is not malicious and is not intended to harm a person and his/her information data. The project is created for the sole purpose of instruction regarding information security, as well as certification of antivirus software for their suitability for data protection. Together we make the Internet a better and safer place. ######################################################################### If you look through this text in the Internet and realize that something is wrong with your files but you do not have any instructions to restore your files, please, contact your antivirus support. ######################################################################### Remember that the worst situation already happened and now it depends on your determination and speed of your actions the further life of your files.

URLs

http://cerberhhyed5frqa.wewiso.top/64DC-5FFF-05C2-006D-F4B3

http://cerberhhyed5frqa.we34re.top/64DC-5FFF-05C2-006D-F4B3

http://cerberhhyed5frqa.ad34ft.win/64DC-5FFF-05C2-006D-F4B3

http://cerberhhyed5frqa.xmfu59.win/64DC-5FFF-05C2-006D-F4B3

http://cerberhhyed5frqa.zgf48j.win/64DC-5FFF-05C2-006D-F4B3

http://cerberhhyed5frqa.onion/64DC-5FFF-05C2-006D-F4B3

Extracted

Path

C:\Users\Admin\Pictures\# DECRYPT MY FILES #.html

Ransom Note

<!DOCTYPE html> <html lang="en"> <head> <meta charset="utf-8"> <title>Cerber Ransomware</title> <style> a { color: #47c; text-decoration: none; } a:hover { text-decoration: underline; } body { background-color: #e7e7e7; color: #333; font-family: "Helvetica Neue", Helvetica, "Segoe UI", Arial, freesans, sans-serif, "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI Symbol"; font-size: 16px; line-height: 1.6; margin: 0; padding: 0; } hr { background-color: #e7e7e7; border: 0 none; border-bottom: 1px solid #c7c7c7; height: 5px; margin: 30px 0; } li { padding: 0 0 7px 7px; } ol { padding-left: 3em; } .container { background-color: #fff; border: 1px solid #c7c7c7; margin: 40px; padding: 40px 40px 20px 40px; } .info, .tor { background-color: #efe; border: 1px solid #bda; display: block; padding: 0px 20px; } .logo { font-size: 12px; font-weight: bold; line-height: 1; margin: 0; } .tor { padding: 10px 0; text-align: center; } .warning { background-color: #f5e7e7; border: 1px solid #ebccd1; color: #a44; display: block; padding: 15px 10px; text-align: center; } </style> </head> <body> <div class="container"> <h3>C E R B E R   R A N S O M W A R E</h3> <hr> Cannot you find the files you need? Is the content of the files that you looked for not readable? It is normal because the files' names, as well as the data in your files have been encrypted. Great!!! You have turned to be a part of a big community #Cerber_Ransomware. <hr> If you are reading this message it means the software "Cerber Rans0mware" has been removed from your computer. <hr> <h3>What is encryption?</h3> Encryption is a reversible modification of information for security reasons but providing full access to it for authorized users. To become an authorized user and keep the modification absolutely reversible (in other words to have a possibility to decrypt your files) you should have an individual private key. But not only it. It is required also to have the special decryption software (in your case "Cerber Decryptor" software) for safe and complete decryption of all your files and data. <hr> <h3>Everything is clear for me but what should I do?</h3> The first step is reading these instructions to the end. Your files have been encrypted with the "Cerber Ransomware" software; the instructions ("# DECRYPT MY FILES #.html" and "# DECRYPT MY FILES #.txt") in the folders with your encrypted files are not viruses, they will help you. After reading this text the most part of people start searching in the Internet the words the "Cerber Ransomware" where they find a lot of ideas, recommendations and instructions. It is necessary to realize that we are the ones who closed the lock on your files and we are the only ones who have this secret key to open them. Any attempts to get back your files with the third-party tools can be fatal for your encrypted files. The most part of the third-party software change data within the encrypted file to restore it but this causes damage to the files. Finally it will be impossible to decrypt your files. When you make a puzzle but some items are lost, broken or not put in its place - the puzzle items will never match, the same way the third-party software will ruin your files completely and irreversibly. You should realize that any intervention of the third-party software to restore files encrypted with the "Cerber Ransomware" software may be fatal for your files. <hr> There are several plain steps to restore your files but if you do not follow them we will not be able to help you, and we will not try since you have read this warning already. <hr> For your information the software to decrypt your files (as well as the private key provided together) are paid products. After purchase of the software package you will be able to: <ol> <li>decrypt all your files;</li> <li>work with your documents;</li> <li>view your photos and other media;</li> <li>continue your usual and comfortable work at the computer.</li> </ol> If you understand all importance of the situation then we propose to you to go directly to your personal page where you will receive the complete instructions and guarantees to restore your files. <hr> <div class="info"> There is a list of temporary addresses to go on your personal page below: <ol> <li><a href="http://cerberhhyed5frqa.wewiso.top/64DC-5FFF-05C2-006D-F4B3" target="_blank">http://cerberhhyed5frqa.wewiso.top/64DC-5FFF-05C2-006D-F4B3</a></li> <li><a href="http://cerberhhyed5frqa.we34re.top/64DC-5FFF-05C2-006D-F4B3" target="_blank">http://cerberhhyed5frqa.we34re.top/64DC-5FFF-05C2-006D-F4B3</a></li> <li><a href="http://cerberhhyed5frqa.ad34ft.win/64DC-5FFF-05C2-006D-F4B3" target="_blank">http://cerberhhyed5frqa.ad34ft.win/64DC-5FFF-05C2-006D-F4B3</a></li> <li><a href="http://cerberhhyed5frqa.xmfu59.win/64DC-5FFF-05C2-006D-F4B3" target="_blank">http://cerberhhyed5frqa.xmfu59.win/64DC-5FFF-05C2-006D-F4B3</a></li> <li><a href="http://cerberhhyed5frqa.zgf48j.win/64DC-5FFF-05C2-006D-F4B3" target="_blank">http://cerberhhyed5frqa.zgf48j.win/64DC-5FFF-05C2-006D-F4B3</a></li> </ol> </div> <hr> <h3>What should you do with these addresses?</h3> If you read the instructions in TXT format (if you have instruction in HTML (the file with an icon of your Internet browser) then the easiest way is to run it): <ol> <li>take a look at the first address (in this case it is <a href="http://cerberhhyed5frqa.wewiso.top/64DC-5FFF-05C2-006D-F4B3" target="_blank">http://cerberhhyed5frqa.wewiso.top/64DC-5FFF-05C2-006D-F4B3</a>);</li> <li>select it with the mouse cursor holding the left mouse button and moving the cursor to the right;</li> <li>release the left mouse button and press the right one;</li> <li>select "Copy" in the appeared menu;</li> <li>run your Internet browser (if you do not know what it is run the Internet Explorer);</li> <li>move the mouse cursor to the address bar of the browser (this is the place where the site address is written);</li> <li>click the right mouse button in the field where the site address is written;</li> <li>select the button "Insert" in the appeared menu;</li> <li>then you will see the address <a href="http://cerberhhyed5frqa.wewiso.top/64DC-5FFF-05C2-006D-F4B3" target="_blank">http://cerberhhyed5frqa.wewiso.top/64DC-5FFF-05C2-006D-F4B3</a> appeared there;</li> <li>press ENTER;</li> <li>the site should be loaded; if it is not loaded repeat the same instructions with the second address and continue until the last address if falling.</li> </ol> If for some reason the site cannot be opened check the connection to the Internet; if the site still cannot be opened take a look at the instructions on omitting the point about working with the addresses in the HTML instructions. If you browse the instructions in HTML format: <ol> <li>click the left mouse button on the first address (in this case it is <a href="http://cerberhhyed5frqa.wewiso.top/64DC-5FFF-05C2-006D-F4B3" target="_blank">http://cerberhhyed5frqa.wewiso.top/64DC-5FFF-05C2-006D-F4B3</a>);</li> <li>in a new tab or window of your web browser the site should be loaded; if it is not loaded repeat the same instructions with the second address and continue until the last address.</li> </ol> If for some reason the site cannot be opened check the connection to the Internet. <hr> Unfortunately these sites are short-term since the antivirus companies are interested in you do not have a chance to restore your files but continue to buy their products. Unlike them we are ready to help you always. If you need our help but the temporary sites are not available: <ol> <li>run your Internet browser (if you do not know what it is run the Internet Explorer);</li> <li>enter or copy the address <a href="https://www.torproject.org/download/download-easy.html.en" target="_blank">https://www.torproject.org/download/download-easy.html.en</a> into the address bar of your browser and press ENTER;</li> <li>wait for the site loading;</li> <li>on the site you will be offered to download Tor Browser; download and run it, follow the installation instructions, wait until the installation is completed;</li> <li>run Tor Browser;</li> <li>connect with the button "Connect" (if you use the English version);</li> <li>a normal Internet browser window will be opened after the initialization;</li> <li>type or copy the address http://cerberhhyed5frqa.onion/64DC-5FFF-05C2-006D-F4B3 in this browser address bar;</li> <li>press ENTER;</li> <li>the site should be loaded; if for some reason the site is not loading wait for a moment and try again.</li> </ol> If you have any problems during installation or operation of Tor Browser, please, visit <a href="https://www.youtube.com/results?search_query=install+tor+browser+windows" target="_blank">https://www.youtube.com/</a> and type request in the search bar "install tor browser windows" and you will find a lot of training videos about Tor Browser installation and operation. If TOR address is not available for a long period (2-3 days) it means you are late; usually you have about 2-3 weeks after reading the instructions to restore your files. <hr> <h3>Additional information:</h3> You will find the instructions for restoring your files in those folders where you have your encrypted files only. The instructions are made in two file formats - HTML and TXT for your convenience. Unfortunately antivirus companies cannot protect or restore your files but they can make the situation worse removing the instructions how to restore your encrypted files. The instructions are not viruses; they have informative nature only, so any claims on the absence of any instruction files you can send to your antivirus company. <hr> Cerber Ransomware Project is not malicious and is not intended to harm a person and his/her information data. The project is created for the sole purpose of instruction regarding information security, as well as certification of antivirus software for their suitability for data protection. Together we make the Internet a better and safer place. <hr> If you look through this text in the Internet and realize that something is wrong with your files but you do not have any instructions to restore your files, please, contact your antivirus support. <hr> Remember that the worst situation already happened and now it depends on your determination and speed of your actions the further life of your files. </div> </body> </html>

Signatures

Cerber
Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.
ransomware cerber
Contacts a large (2050) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run = "\"C:\\Users\\Admin\\AppData\\Roaming\\{2A62359E-001A-DB50-37C5-75EE5DF583A7}\\perfmon.exe\""	40902f482be77455af14009ca7ec71c8b1b78cc12af7d51319cc47f92387026f.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run = "\"C:\\Users\\Admin\\AppData\\Roaming\\{2A62359E-001A-DB50-37C5-75EE5DF583A7}\\perfmon.exe\""	perfmon.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	perfmon.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartUp\perfmon.lnk	40902f482be77455af14009ca7ec71c8b1b78cc12af7d51319cc47f92387026f.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartUp\perfmon.lnk	perfmon.exe

Executes dropped EXE 6 IoCs

pid	Process
856	perfmon.exe
452	perfmon.exe
5016	perfmon.exe
2100	perfmon.exe
3572	perfmon.exe
3852	perfmon.exe

Loads dropped DLL 8 IoCs

pid	Process
4524	40902f482be77455af14009ca7ec71c8b1b78cc12af7d51319cc47f92387026f.exe
4524	40902f482be77455af14009ca7ec71c8b1b78cc12af7d51319cc47f92387026f.exe
856	perfmon.exe
856	perfmon.exe
5016	perfmon.exe
5016	perfmon.exe
3572	perfmon.exe
3572	perfmon.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\perfmon = "\"C:\\Users\\Admin\\AppData\\Roaming\\{2A62359E-001A-DB50-37C5-75EE5DF583A7}\\perfmon.exe\""	40902f482be77455af14009ca7ec71c8b1b78cc12af7d51319cc47f92387026f.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\perfmon = "\"C:\\Users\\Admin\\AppData\\Roaming\\{2A62359E-001A-DB50-37C5-75EE5DF583A7}\\perfmon.exe\""	40902f482be77455af14009ca7ec71c8b1b78cc12af7d51319cc47f92387026f.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\perfmon = "\"C:\\Users\\Admin\\AppData\\Roaming\\{2A62359E-001A-DB50-37C5-75EE5DF583A7}\\perfmon.exe\""	perfmon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\perfmon = "\"C:\\Users\\Admin\\AppData\\Roaming\\{2A62359E-001A-DB50-37C5-75EE5DF583A7}\\perfmon.exe\""	perfmon.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
7	ipinfo.io

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tmpE589.bmp"	perfmon.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 4524 set thread context of 5108	4524	40902f482be77455af14009ca7ec71c8b1b78cc12af7d51319cc47f92387026f.exe	82
PID 856 set thread context of 452	856	perfmon.exe	89
PID 5016 set thread context of 2100	5016	perfmon.exe	92
PID 3572 set thread context of 3852	3572	perfmon.exe	99

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\	perfmon.exe
File opened for modification	C:\Windows\	perfmon.exe
File opened for modification	C:\Windows\	40902f482be77455af14009ca7ec71c8b1b78cc12af7d51319cc47f92387026f.exe
File opened for modification	C:\Windows\	perfmon.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

NSIS installer 2 IoCs

installer

resource	yara_rule
behavioral2/files/0x000700000002342e-65.dat	nsis_installer_1
behavioral2/files/0x000700000002342e-65.dat	nsis_installer_2

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Kills process with taskkill 2 IoCs

evasion

pid	Process
2948	taskkill.exe
2320	taskkill.exe

Modifies Control Panel 4 IoCs

evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\Desktop\SCRNSAVE.EXE = "\"C:\\Users\\Admin\\AppData\\Roaming\\{2A62359E-001A-DB50-37C5-75EE5DF583A7}\\perfmon.exe\""	perfmon.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\Desktop	40902f482be77455af14009ca7ec71c8b1b78cc12af7d51319cc47f92387026f.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\Desktop\SCRNSAVE.EXE = "\"C:\\Users\\Admin\\AppData\\Roaming\\{2A62359E-001A-DB50-37C5-75EE5DF583A7}\\perfmon.exe\""	40902f482be77455af14009ca7ec71c8b1b78cc12af7d51319cc47f92387026f.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\Desktop	perfmon.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings	perfmon.exe

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
4964	PING.EXE
4856	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
452	perfmon.exe
452	perfmon.exe
452	perfmon.exe
452	perfmon.exe
452	perfmon.exe
452	perfmon.exe
452	perfmon.exe
452	perfmon.exe
452	perfmon.exe
452	perfmon.exe
452	perfmon.exe
452	perfmon.exe
452	perfmon.exe
452	perfmon.exe
452	perfmon.exe
452	perfmon.exe
452	perfmon.exe
452	perfmon.exe
452	perfmon.exe
452	perfmon.exe
452	perfmon.exe
452	perfmon.exe
452	perfmon.exe
452	perfmon.exe
452	perfmon.exe
452	perfmon.exe
452	perfmon.exe
452	perfmon.exe
452	perfmon.exe
452	perfmon.exe
452	perfmon.exe
452	perfmon.exe
452	perfmon.exe
452	perfmon.exe
452	perfmon.exe
452	perfmon.exe
452	perfmon.exe
452	perfmon.exe
452	perfmon.exe
452	perfmon.exe
452	perfmon.exe
452	perfmon.exe
452	perfmon.exe
452	perfmon.exe
452	perfmon.exe
452	perfmon.exe
452	perfmon.exe
452	perfmon.exe
452	perfmon.exe
452	perfmon.exe
452	perfmon.exe
452	perfmon.exe
452	perfmon.exe
452	perfmon.exe
452	perfmon.exe
452	perfmon.exe
452	perfmon.exe
452	perfmon.exe
452	perfmon.exe
452	perfmon.exe
452	perfmon.exe
452	perfmon.exe
452	perfmon.exe
452	perfmon.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	5108	40902f482be77455af14009ca7ec71c8b1b78cc12af7d51319cc47f92387026f.exe
Token: SeDebugPrivilege	2948	taskkill.exe
Token: SeDebugPrivilege	452	perfmon.exe
Token: SeDebugPrivilege	2100	perfmon.exe
Token: 33	3948	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3948	AUDIODG.EXE
Token: SeDebugPrivilege	3852	perfmon.exe
Token: SeDebugPrivilege	2320	taskkill.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4524 wrote to memory of 5108	4524	40902f482be77455af14009ca7ec71c8b1b78cc12af7d51319cc47f92387026f.exe	82
PID 4524 wrote to memory of 5108	4524	40902f482be77455af14009ca7ec71c8b1b78cc12af7d51319cc47f92387026f.exe	82
PID 4524 wrote to memory of 5108	4524	40902f482be77455af14009ca7ec71c8b1b78cc12af7d51319cc47f92387026f.exe	82
PID 4524 wrote to memory of 5108	4524	40902f482be77455af14009ca7ec71c8b1b78cc12af7d51319cc47f92387026f.exe	82
PID 4524 wrote to memory of 5108	4524	40902f482be77455af14009ca7ec71c8b1b78cc12af7d51319cc47f92387026f.exe	82
PID 4524 wrote to memory of 5108	4524	40902f482be77455af14009ca7ec71c8b1b78cc12af7d51319cc47f92387026f.exe	82
PID 4524 wrote to memory of 5108	4524	40902f482be77455af14009ca7ec71c8b1b78cc12af7d51319cc47f92387026f.exe	82
PID 4524 wrote to memory of 5108	4524	40902f482be77455af14009ca7ec71c8b1b78cc12af7d51319cc47f92387026f.exe	82
PID 4524 wrote to memory of 5108	4524	40902f482be77455af14009ca7ec71c8b1b78cc12af7d51319cc47f92387026f.exe	82
PID 5108 wrote to memory of 856	5108	40902f482be77455af14009ca7ec71c8b1b78cc12af7d51319cc47f92387026f.exe	83
PID 5108 wrote to memory of 856	5108	40902f482be77455af14009ca7ec71c8b1b78cc12af7d51319cc47f92387026f.exe	83
PID 5108 wrote to memory of 856	5108	40902f482be77455af14009ca7ec71c8b1b78cc12af7d51319cc47f92387026f.exe	83
PID 5108 wrote to memory of 3056	5108	40902f482be77455af14009ca7ec71c8b1b78cc12af7d51319cc47f92387026f.exe	84
PID 5108 wrote to memory of 3056	5108	40902f482be77455af14009ca7ec71c8b1b78cc12af7d51319cc47f92387026f.exe	84
PID 5108 wrote to memory of 3056	5108	40902f482be77455af14009ca7ec71c8b1b78cc12af7d51319cc47f92387026f.exe	84
PID 3056 wrote to memory of 2948	3056	cmd.exe	86
PID 3056 wrote to memory of 2948	3056	cmd.exe	86
PID 3056 wrote to memory of 2948	3056	cmd.exe	86
PID 3056 wrote to memory of 4964	3056	cmd.exe	88
PID 3056 wrote to memory of 4964	3056	cmd.exe	88
PID 3056 wrote to memory of 4964	3056	cmd.exe	88
PID 856 wrote to memory of 452	856	perfmon.exe	89
PID 856 wrote to memory of 452	856	perfmon.exe	89
PID 856 wrote to memory of 452	856	perfmon.exe	89
PID 856 wrote to memory of 452	856	perfmon.exe	89
PID 856 wrote to memory of 452	856	perfmon.exe	89
PID 856 wrote to memory of 452	856	perfmon.exe	89
PID 856 wrote to memory of 452	856	perfmon.exe	89
PID 856 wrote to memory of 452	856	perfmon.exe	89
PID 856 wrote to memory of 452	856	perfmon.exe	89
PID 5016 wrote to memory of 2100	5016	perfmon.exe	92
PID 5016 wrote to memory of 2100	5016	perfmon.exe	92
PID 5016 wrote to memory of 2100	5016	perfmon.exe	92
PID 5016 wrote to memory of 2100	5016	perfmon.exe	92
PID 5016 wrote to memory of 2100	5016	perfmon.exe	92
PID 5016 wrote to memory of 2100	5016	perfmon.exe	92
PID 5016 wrote to memory of 2100	5016	perfmon.exe	92
PID 5016 wrote to memory of 2100	5016	perfmon.exe	92
PID 5016 wrote to memory of 2100	5016	perfmon.exe	92
PID 3572 wrote to memory of 3852	3572	perfmon.exe	99
PID 3572 wrote to memory of 3852	3572	perfmon.exe	99
PID 3572 wrote to memory of 3852	3572	perfmon.exe	99
PID 3572 wrote to memory of 3852	3572	perfmon.exe	99
PID 3572 wrote to memory of 3852	3572	perfmon.exe	99
PID 3572 wrote to memory of 3852	3572	perfmon.exe	99
PID 3572 wrote to memory of 3852	3572	perfmon.exe	99
PID 3572 wrote to memory of 3852	3572	perfmon.exe	99
PID 3572 wrote to memory of 3852	3572	perfmon.exe	99
PID 452 wrote to memory of 4636	452	perfmon.exe	100
PID 452 wrote to memory of 4636	452	perfmon.exe	100
PID 4636 wrote to memory of 4456	4636	msedge.exe	101
PID 4636 wrote to memory of 4456	4636	msedge.exe	101
PID 452 wrote to memory of 4548	452	perfmon.exe	102
PID 452 wrote to memory of 4548	452	perfmon.exe	102
PID 452 wrote to memory of 1816	452	perfmon.exe	103
PID 452 wrote to memory of 1816	452	perfmon.exe	103
PID 1816 wrote to memory of 2000	1816	msedge.exe	104
PID 1816 wrote to memory of 2000	1816	msedge.exe	104
PID 4636 wrote to memory of 3944	4636	msedge.exe	105
PID 4636 wrote to memory of 3944	4636	msedge.exe	105
PID 4636 wrote to memory of 3944	4636	msedge.exe	105
PID 4636 wrote to memory of 3944	4636	msedge.exe	105
PID 4636 wrote to memory of 3944	4636	msedge.exe	105
PID 4636 wrote to memory of 3944	4636	msedge.exe	105

C:\Users\Admin\AppData\Local\Temp\40902f482be77455af14009ca7ec71c8b1b78cc12af7d51319cc47f92387026f.exe
"C:\Users\Admin\AppData\Local\Temp\40902f482be77455af14009ca7ec71c8b1b78cc12af7d51319cc47f92387026f.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4524
- C:\Users\Admin\AppData\Local\Temp\40902f482be77455af14009ca7ec71c8b1b78cc12af7d51319cc47f92387026f.exe
  "C:\Users\Admin\AppData\Local\Temp\40902f482be77455af14009ca7ec71c8b1b78cc12af7d51319cc47f92387026f.exe"
  2⤵
  - Adds policy Run key to start application
  - Drops startup file
  - Adds Run key to start application
  - Modifies Control Panel
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5108
- - C:\Users\Admin\AppData\Roaming\{2A62359E-001A-DB50-37C5-75EE5DF583A7}\perfmon.exe
    "C:\Users\Admin\AppData\Roaming\{2A62359E-001A-DB50-37C5-75EE5DF583A7}\perfmon.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - Drops file in Windows directory
    - Suspicious use of WriteProcessMemory
    PID:856
  - - C:\Users\Admin\AppData\Roaming\{2A62359E-001A-DB50-37C5-75EE5DF583A7}\perfmon.exe
      "C:\Users\Admin\AppData\Roaming\{2A62359E-001A-DB50-37C5-75EE5DF583A7}\perfmon.exe"
      4⤵
      Adds policy Run key to start application
      Checks computer location settings
      Drops startup file
      Executes dropped EXE
      Adds Run key to start application
      Sets desktop wallpaper using registry
      Modifies Control Panel
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:452
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\# DECRYPT MY FILES #.html
        5⤵
        Enumerates system info in registry
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:4636
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa4c4846f8,0x7ffa4c484708,0x7ffa4c484718
        6⤵
        
        PID:4456
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,7330382251918944499,12874300318716765899,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
        6⤵
        
        PID:3944
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,7330382251918944499,12874300318716765899,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 /prefetch:3
        6⤵
        
        PID:2860
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,7330382251918944499,12874300318716765899,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2772 /prefetch:8
        6⤵
        
        PID:2240
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7330382251918944499,12874300318716765899,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
        6⤵
        
        PID:3324
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7330382251918944499,12874300318716765899,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
        6⤵
        
        PID:3952
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7330382251918944499,12874300318716765899,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3908 /prefetch:1
        6⤵
        
        PID:4740
      - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,7330382251918944499,12874300318716765899,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4868 /prefetch:8
        6⤵
        
        PID:2508
      - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,7330382251918944499,12874300318716765899,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4868 /prefetch:8
        6⤵
        
        PID:5104
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7330382251918944499,12874300318716765899,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5032 /prefetch:1
        6⤵
        
        PID:4040
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7330382251918944499,12874300318716765899,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5056 /prefetch:1
        6⤵
        
        PID:3016
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7330382251918944499,12874300318716765899,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5076 /prefetch:1
        6⤵
        
        PID:3384
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7330382251918944499,12874300318716765899,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5000 /prefetch:1
        6⤵
        
        PID:2676
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7330382251918944499,12874300318716765899,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3996 /prefetch:1
        6⤵
        
        PID:556
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7330382251918944499,12874300318716765899,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3448 /prefetch:1
        6⤵
        
        PID:2984
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7330382251918944499,12874300318716765899,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4296 /prefetch:1
        6⤵
        
        PID:2096
    - - C:\Windows\system32\NOTEPAD.EXE
        
        "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\# DECRYPT MY FILES #.txt
        5⤵
        
        PID:4548
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://cerberhhyed5frqa.wewiso.top/64DC-5FFF-05C2-006D-F4B3?auto
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1816
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa4c4846f8,0x7ffa4c484708,0x7ffa4c484718
        6⤵
        
        PID:2000
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\# DECRYPT MY FILES #.vbs"
        5⤵
        
        PID:2900
    - - C:\Windows\system32\cmd.exe
        
        /d /c taskkill /t /f /im "perfmon.exe" > NUL & ping -n 1 127.0.0.1 > NUL & del "C:\Users\Admin\AppData\Roaming\{2A62359E-001A-DB50-37C5-75EE5DF583A7}\perfmon.exe" > NUL
        5⤵
        
        PID:3488
      - C:\Windows\system32\taskkill.exe
        
        taskkill /t /f /im "perfmon.exe"
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2320
      - C:\Windows\system32\PING.EXE
        
        ping -n 1 127.0.0.1
        6⤵
        Runs ping.exe
        
        PID:4856
- - C:\Windows\SysWOW64\cmd.exe
    /d /c taskkill /t /f /im "40902f482be77455af14009ca7ec71c8b1b78cc12af7d51319cc47f92387026f.exe" > NUL & ping -n 1 127.0.0.1 > NUL & del "C:\Users\Admin\AppData\Local\Temp\40902f482be77455af14009ca7ec71c8b1b78cc12af7d51319cc47f92387026f.exe" > NUL
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3056
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /t /f /im "40902f482be77455af14009ca7ec71c8b1b78cc12af7d51319cc47f92387026f.exe"
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2948
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      Runs ping.exe
      PID:4964

C:\Users\Admin\AppData\Roaming\{2A62359E-001A-DB50-37C5-75EE5DF583A7}\perfmon.exe
C:\Users\Admin\AppData\Roaming\{2A62359E-001A-DB50-37C5-75EE5DF583A7}\perfmon.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:5016
- C:\Users\Admin\AppData\Roaming\{2A62359E-001A-DB50-37C5-75EE5DF583A7}\perfmon.exe
  C:\Users\Admin\AppData\Roaming\{2A62359E-001A-DB50-37C5-75EE5DF583A7}\perfmon.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2100

C:\Users\Admin\AppData\Roaming\{2A62359E-001A-DB50-37C5-75EE5DF583A7}\perfmon.exe
C:\Users\Admin\AppData\Roaming\{2A62359E-001A-DB50-37C5-75EE5DF583A7}\perfmon.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3572
- C:\Users\Admin\AppData\Roaming\{2A62359E-001A-DB50-37C5-75EE5DF583A7}\perfmon.exe
  C:\Users\Admin\AppData\Roaming\{2A62359E-001A-DB50-37C5-75EE5DF583A7}\perfmon.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:3852

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4616

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4736

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4fc 0x2ec
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3948

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Network Service Discovery

T1046

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Recovery\WindowsRE\# DECRYPT MY FILES #.vbs

Filesize
231B

MD5
9d8c4bfbd009c4d6001e2125abaa8b02

SHA1
cd040558172b5fca5b200447a281843956243741

SHA256
a652297987f14317100f8c5f7eb26d1bc67eb8a64f0b39b72b5fd5046a9f29b0

SHA512
c4c84f43642b805a105acce9ebc9f01aa0e6ef553ea32be3f8b890fc7440f0b7d3ddf99b9336bce20ce7a3d9b9f6434a704651a8af425ffc8407ba39d5de735f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4158365912175436289496136e7912c2

SHA1
813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59

SHA256
354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1

SHA512
74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ce4c898f8fc7601e2fbc252fdadb5115

SHA1
01bf06badc5da353e539c7c07527d30dccc55a91

SHA256
bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa

SHA512
80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
881c36e964bf4a43c32c12b5d78489a7

SHA1
9cdb6da95e90c5bb7d8879b5ec597ae3fc4a8d3e

SHA256
b64ac2c2d540c8712da20c1737088ed37711d26a33cc928a49ddc800b6ad4cef

SHA512
de6192196aa3c218ab15a2d4fe6f2c017bee72b2e75d489aef21dba14bf5e140a4833d87f2a69e4ced54f6afc59e95b17899a302fd54fa333b64f35ab3d45e13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9ac6e7e8943975495405084e2e84a18a

SHA1
77f60dc518c7fc45a430dc44189b1c33921d82d3

SHA256
2d5abe2a37769ee1957445d8b9c2cedcc29e65ad910c1efd35bb6932b4f58cb2

SHA512
10e509a211aedb4c5e73b86418fd9a30b47b859399aa85678677c99e9d924e349da9ae9e939afe7dbfa4e726fa59d9feaf1abeb8a4a53a579e79169cfe6ed5bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
7bedf8ea95ef6a514c5dc5afe6ab8292

SHA1
8ff0fcd141decf7dc425fa9d60f64fa7677d85ff

SHA256
56dfb1574f9a41cc56361414f8a5429a7e279cc6c6df5bb7e6a6c8b89815da04

SHA512
448e2b7531a18d4e930964b76d8d3b98f691cee3b70d479b525df7cb337b11be6935809c6be747c5ae6c49636d5f100109ef2142d4facd36d4d1fc5e3dc0a466

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsw49EB.tmp\System.dll

Filesize
11KB

MD5
6f5257c0b8c0ef4d440f4f4fce85fb1b

SHA1
b6ac111dfb0d1fc75ad09c56bde7830232395785

SHA256
b7ccb923387cc346731471b20fc3df1ead13ec8c2e3147353c71bb0bd59bc8b1

SHA512
a3cc27f1efb52fb8ecda54a7c36ada39cefeabb7b16f2112303ea463b0e1a4d745198d413eebb3551e012c84a20dcdf4359e511e51bc3f1a60b13f1e3bad1aa8

Download Submit
C:\Users\Admin\AppData\Roaming\12.gif

Filesize
210B

MD5
a22f4f8b1ba890258a463d6ffe0d8d6f

SHA1
9a36636b558548a06f00f228327930a1608e005c

SHA256
1b5876c39a3f179c58af460f890c577a5949de12e8c01b3381093688e9f8a9f5

SHA512
bffb7bbbb9a27e6f7651c7c454e4671a617ab658366ca7e208f889628a61feeda76dbec79c261ca0b2bb2969b4aacbd5b12a3f0b816252a1f228c06792f05b48

Download Submit
C:\Users\Admin\AppData\Roaming\404-12.htm

Filesize
1KB

MD5
e207c1a73e2bc89fe048f7b26951f2be

SHA1
691e8e6185377ece49ceef5e0cbf552753c5a1d9

SHA256
8b7e3683d4c21ff8416216e0749e65a15d7a8e0085d3297411fb875781599ac6

SHA512
155b599343d25484a6372c412b14eb7605a36c262cc0876536a9aec15b9fc1c9be9206c99bcfb54f507107e699795875de9c28956b7f370dc50a11fcf7f33837

Download Submit
C:\Users\Admin\AppData\Roaming\8.gif

Filesize
918B

MD5
bf2ec0f8882f07fe7854b1f2be6d68dd

SHA1
9fd4b679e70016535eaafb240157f0ac5ab69926

SHA256
f0e9c1973b0ac41e622f099e5558bea491486180e77f36b8a3dd46da27a1b82b

SHA512
ecb948398abd7e1ddb35e5f6ac42025c62fbc82ee855dd060cb55525ada0854c7aad9b239b66d3344da164564a27c114c6f43c13cd8708db7d5f97a800777258

Download Submit
C:\Users\Admin\AppData\Roaming\Add-V

Filesize
3KB

MD5
9f4ef1bd410103a52dab480c00768ded

SHA1
6d0ad55ac9ad4a3bea21b768d7acc0942a66a30d

SHA256
fb7e6a07052c2d4dae1633cc4a1ca44b32ed4a41cc7698e7cae9d25f9ba0e84d

SHA512
b4dcf4ba77d7bebb84c0cfcc701b2c6a2819c44934c87a2fd217ec0121269c505197ff58b2158bd8398b5a6dcd7a45e50c49db4388870fecd58134ad095c35b0

Download Submit
C:\Users\Admin\AppData\Roaming\Adobe-CNS1-H-CID

Filesize
3KB

MD5
03016d6b79313a63773d97792ee13889

SHA1
53817df4ead0586b47b12ec3bb8af2e130f3c360

SHA256
38896b1f0903a9a577d129e2dfd3d4c2cdc174031c79c7fca943870a1538280e

SHA512
7bc24ec4b4d28a3eb260d636652e72884ca9c2022ad0d04cef08e7907828396c71ccafc8d7c3605c6b7a67784db6837209e48e498ea491aad1b149a2d6c73e15

Download Submit
C:\Users\Admin\AppData\Roaming\Adobe-Japan1-5

Filesize
4KB

MD5
858f74b052990a76d06809c378ec0f37

SHA1
62268942d465eaff9f7374797f824493810f8c55

SHA256
7b719d81583d72f2b2857214beb78c679fb823542e78f8676951315c3e22e579

SHA512
29c7fe9213195fa4ec99d98469957a27cbb14335439dbf4b5424cceb75b7ec3dafcc9c66edafbc06dc480ac2f0dadf32851104608859b0a621249aa315cb2ca9

Download Submit
C:\Users\Admin\AppData\Roaming\Attributions.txt

Filesize
3KB

MD5
19ad62300dd66d6f479b13c40bae58e4

SHA1
c2393e348c48f9f3e6644f08473dfe22f889f9b2

SHA256
6505cb7369eb363a6dca90fd9dccfcb98bfd9eb9a1aaf586652f6e2950ff719d

SHA512
2bca333525c9892bd0cf13ec58d1786b67b1c63f1e7cfe688383fdba366ae8dede26f4bcaebce2b5c393987a9a2fef6c9cabf150ac0d0bc3f7d332c09aa3029d

Download Submit
C:\Users\Admin\AppData\Roaming\B5pc-UCS2

Filesize
2KB

MD5
3c261dd687fd42d4b97b2ed2befe5201

SHA1
1199a4a49ccc3e729fa6052e3e3ec67c78394a22

SHA256
9d80bf7d6122a3940dd8f1c7318a18598559b074a4d9d305c989c3b0edda8dc0

SHA512
59ca5885ba84f4f06ec10fb159682acf7ba3a60f7a92a6779629e40a88900eab525f6b1e4b8a02027f3746d02bac34dd2f85966a742fc159cd59b78d1840f2a2

Download Submit
C:\Users\Admin\AppData\Roaming\Bl CG10 WmG4 CG3.ADO

Filesize
524B

MD5
02710317e2ed8cff32667d51f5b66075

SHA1
4864ad2b003b38295a26301488366d5ab02ce546

SHA256
d0807c59413e8607b26eda3f20989ce2baaa57ed387e8754e050ac64df39230b

SHA512
698f08773b1cd7702a96dd5a0fd3dc5185abe070dabdc2c2907ab9968bf39cd2ad67ffdec778997e60e3785b56d0ec288b66cfe6a37bfa0f69f2a3be962a1c83

Download Submit
C:\Users\Admin\AppData\Roaming\Brisbane

Filesize
189B

MD5
6a9e9573c09dad7780cd82a24071c34a

SHA1
95033332a849ac93d6fb01474452d3c477005ad7

SHA256
97cb53438a334f7b182229831077dc8f9018253233045d7dc1e38e9c9a0ed3fd

SHA512
510aa1f7d2e28c894d07c05b7faf1ed9ab5953a3326a8e883882150ce193e0b37fe9be7d42d7186f4e9ef12b7519e7523aaa3a4dfddd03b5723182c7fc156e6a

Download Submit
C:\Users\Admin\AppData\Roaming\Cambridge_Bay

Filesize
1KB

MD5
89de3d027493b9dbe3298a06fef9a89d

SHA1
3d8ac130c5dab1becabb0a17cae55c9aa42e50cd

SHA256
4d1380365eaceb6082c783f733af0ec9fd99e947c1c08c84fa6ff1d370b551ea

SHA512
d7699a070cc465d5d960bd3d712fe72f68b24bd6e6bca6e67b5a17fa9581bb0cb02d10bfca2c32949ef86c3156c08e8bacdb33f1bcf4b5b188f149fc52870829

Download Submit
C:\Users\Admin\AppData\Roaming\CommandTemplate.mws

Filesize
4KB

MD5
c3f6ff0818d66a2a3725998f5c44ffa4

SHA1
127417dc331619716ba8f3b3aa63d23d0c59c443

SHA256
fd5d297ec3edf6973d7c2cf834dd8fbd7ded61748ba82f3e259507f30eee09f3

SHA512
c69b0cf5e2f62a1b5be3137fda26d1d3c5cca810b845f2c51e8c5253297bffcabcedb845c322dd643cd467504f82569545f1c03626b0d60d59d604845722b6e9

Download Submit
C:\Users\Admin\AppData\Roaming\Errlog.txt

Filesize
2KB

MD5
1b5c9ac81d0db16bdef65bb8ed4401a1

SHA1
b45a09049cdabcdaa104e284bb457aabf9e02909

SHA256
79f8f465d0ad808a0c2bc0bd79cad80d1f2ec0e92df2a7b9d79d764bb0308535

SHA512
c2d6146fad4289a9f6b502872f102dbe7678bab74f744810845ed80d137620b3ea45b8141f2600cc557df27f3e79523df6ce8bc9fc2947798f2171034149076c

Download Submit
C:\Users\Admin\AppData\Roaming\GMT-9

Filesize
27B

MD5
3e5e7f59b78835b605d1559e9806d29d

SHA1
aee36c61c7e5ce1e95fc29fe97eda4254d00b323

SHA256
d1fc281b021228c2373cdc886f786432bc0b7d95110b2f0a6bdf8e57cf48be27

SHA512
1670b3e3dbd434a337803518b137aba604865ecd51d5e465b452e51a453288dd1b66b882f22a71f8420418c2a311906d2c6185d888cecf503c578194cacfb7ae

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartUp\perfmon.lnk

Filesize
1KB

MD5
606b5dbaa7bf4afe9d1218258b17c51d

SHA1
28987966e24b46189dd40c27fad4a4099574a411

SHA256
2b35433a31d5ed5b8e2ca69aa5c2e38a6470f332bb531dc3e972e377f4df91e7

SHA512
89eb7b3933460ce5770442ce6b001161c6ef1b08b28eb9f7c6a4b2eb9c33b7ede493d4caddb4fb57680ab94906ecf33f95b34ca8cb644fcf9dfcfb2d66499112

Download Submit
C:\Users\Admin\AppData\Roaming\Perl.dll

Filesize
50KB

MD5
f3747b354de68c83ec083fef4d7f5105

SHA1
49702bb5aa30cb661a49fe6174734bb2b1dfeded

SHA256
37e99df1f5ffb6bf2237fa61548f9f37936cad98a3b28d2b596069d2f580bb8c

SHA512
2ba4672b3a59c13987d5aa7ac43a33045472521c14d5cf23ad92fde3ffca876f31b7e7239baba3214f39e47cd22b9b6c6581925c3007d4b31c3be14cf510ac9c

Download Submit
C:\Users\Admin\AppData\Roaming\TsarAgeratum.n

Filesize
2KB

MD5
b949801b4a01da5e1b24c3e60a60c623

SHA1
e0ef68a0a4357b6e1953fe393e48b72239a3d645

SHA256
81f8e472a9900add1fba90f34cc8dc6585cb8f485cc99c093b6a866c61c7ac75

SHA512
40631e9e934a4e70373667d904ca70fe914c6a7513a6f837f002e3f6465127e0b0d594b240ad27a2ce1160ac4b6dc9ce312023660e6b0f2bd041e761857213c6

Download Submit
C:\Users\Admin\AppData\Roaming\Votary.U

Filesize
125KB

MD5
8a490abd45832b1583172a09e94b594e

SHA1
aed810790bbd252376c9c4cc490fe3efe0a544be

SHA256
081bbad6a6379eacdefe3cdb3e81e972a4f617c9ef85a4979250df740e9449f9

SHA512
8be82ad022fc36c305b8bdac0e377da84fccac7d7aa6403f20a6dd8a429e6b12dacf43c21340105d2201b40ed4fb2c2c35500a4897f1507d355195c55ab95314

Download Submit
C:\Users\Admin\AppData\Roaming\administration.config

Filesize
4KB

MD5
ea8786a9e8c53d4136b57da721d3a530

SHA1
ee83b68c4c9f40b3d3eb4a04f61d9952d7513a0e

SHA256
85835a7c2f33dd24fd15d48f288ef0a8e07745611a08bfe6dcb9b8f547321f2c

SHA512
b7e4095ed87a7dd922a6a5afbb02acd7e4761c03645819a6c8690b56296f8839db2e355a1bb83d243a42fad4e5400a6f873f8d6caf9a1eee9c6fd86951511016

Download Submit
C:\Users\Admin\AppData\Roaming\app_updater_learn_more_body.png

Filesize
122B

MD5
71e771fa06ec34edb44eba0cb02da889

SHA1
1e233e7b302fa65ac0f506274a21a9c1e448ed93

SHA256
95d366e926a4de1471e1d987ccb9e7082f0129f10bfe184399f4bb0932f75329

SHA512
4dc2623d8aa3c472f0c25d19aeba1222768b589065c8db97c4283c4c69e34f16a704d7eb291d10d78e91d01840e5ef59f1d4a9632958d4124fc1a854b4a91454

Download Submit
C:\Users\Admin\AppData\Roaming\archive_inactive_hovered.png

Filesize
2KB

MD5
463e6fbc5660df166f0345891e5acd12

SHA1
46ea68079e196535a545b3452661d6623ddde772

SHA256
efd501cd8d5a892ab9998418b6b5c191d606ecb153a470d63ddf6904b5f79e74

SHA512
04e7935ddec6f656c8f37dbc6cf886ff96a1a6ed71f957644218e4e529383a4b53a175477e7edb8530e88219642d3af2380eaf5a0f7df7f01d16e0c4a5be3589

Download Submit
C:\Users\Admin\AppData\Roaming\bg_black_body.gif

Filesize
1KB

MD5
f023181a5fedc1cbb386394ed020950a

SHA1
4376324a67b9a8ef30f8661141c9220a9c011b95

SHA256
f08f925e31080d63ee26e3475b31c6a083f05ceaa67545c682f42e47eab98fcd

SHA512
e94d30fd321b40ff01ab44a2525d0087e695edc122d88dc7fdd2efd2d757939b20668b2c6564b1a9fa5281675c7a3174551bea8eca11a1a12db55dd71387129d

Download Submit
C:\Users\Admin\AppData\Roaming\btn-next-static.png

Filesize
3KB

MD5
20418349e7f8244ea53bc174b2ff9576

SHA1
edb9087b6d85247ea0cad0060f540b0f890a80e1

SHA256
35d36d6619e249e8bf4838098fd1770c78617e3019162aaca092f8fa37c82dcb

SHA512
b12946ca17bb23403e106d561ae42d15695efde73eb4efb4099b57824c7ba0d2e331850022405f1d5da9502b568a217c06f259600cbbacc0d1c2b7210b31081f

Download Submit
C:\Users\Admin\AppData\Roaming\cell_phone.png

Filesize
3KB

MD5
fc58057fe3cb6bb2665cc42bfb09b521

SHA1
2f5e8a19f30dd689c03729bb860d1379c588f038

SHA256
0e629059c78c8881df5e2f23bf6ab9b10ffd3194a6a7301ea001eef362bc63e7

SHA512
bf6fbc3e505115c04e267bd7c268bab2aa0f7eff63869591109d7dc606d8d5b28c963aa4dbe8dd934cdf5ad6427dd9fb6058f90e4796bc9b7cbe70ee686a71f9

Download Submit
C:\Users\Admin\AppData\Roaming\chmod.js

Filesize
1KB

MD5
86b436eac80e09ab73167e1c19482f3f

SHA1
df618eaecc275ad751f3e45b71618655572e072f

SHA256
f317efe6072c7e4bab43485d3b2dcb2262323159d4a4fb4a41e3561f7d3c57c3

SHA512
7e5341acc76fdc0800c18b3879f9cf23e84c8291a15fbac53995cbcb353797dee26725633a45621c48c5303cb7174c92ca1ac9ec7f4067c22aa88a6d16f2a9d9

Download Submit
C:\Users\Admin\AppData\Roaming\column.count.titlepage.xml

Filesize
893B

MD5
22c26db210377294a086cab75d4bc00a

SHA1
5c68dfc95a1b449da52bc88a266f08bd80296db7

SHA256
c3b4d092156fc9faf15c74cdeee18df6b3a56e4a79a764a0bb9397a3e43ca5ae

SHA512
9a51d52a8d2f25dd8f57a2d723b22c4adc1c14fba9ba06f0809d3f8cbf2f8f85885c670f15cf1aea27eeb479888b4c7e576fbc9a572c96680956c382aa29c857

Download Submit
C:\Users\Admin\AppData\Roaming\component.label.includes.part.label.xml

Filesize
1KB

MD5
59159241399b141689dfb8bcd7a97687

SHA1
cec2775a0afc540b4593cb616b1c6ce43ea2c7c3

SHA256
94122f4fa60f0c0a794c1f48ba7739bfbbba944fb2465b1c37bcd00bad358907

SHA512
7b12619fb230871fde5649fcac0487fb082de6139234de2a57bd6c40999e93b8217b015ec081cbbc3c80cc2803f990dedefdf84d0fa40e817ff2e607adcd66ae

Download Submit
C:\Users\Admin\AppData\Roaming\computer_server_tower.png

Filesize
997B

MD5
a748c35ba3e192f03d651ab42fe84f1e

SHA1
204beec2489330c9d9268f2cc0177e8420ebe4ee

SHA256
ffad3e6a7540761f3c75ea528ca8d92131f2ac51d1c5a578d10c3b53b2e9986d

SHA512
75511d900c6481218326a759caf37d35859b016bbdae8fea70c394d1cf246fdbbab3ce3ad8c32a7b4e3d97cb80e56eb7c3ad3f1154fe16beabcb7fe01a5d43a0

Download Submit
C:\Users\Admin\AppData\Roaming\config.ini

Filesize
875B

MD5
17e0634e2e6a8f0b9f6696403e01e814

SHA1
0a9e1ef393263b73e8c97d71f0090a7393821406

SHA256
f830ad61e83dfe77cebc7a8c137b27f0fe2f8825cac69b6f6139a6ddcb99bbd2

SHA512
4a7c0080173ed0f56813747653ea4fd526f61f6115e0532232ef4aacb148129327eb8048db17590f67d761ad9cb039f6425b162810fd80c738eb5db10fd5263e

Download Submit
C:\Users\Admin\AppData\Roaming\default.image.width.xml

Filesize
1KB

MD5
fece9f6cec2b34095490bc555f487a1c

SHA1
999a2e4adf6ab823a5f29d9a5c51b57259d8c8e9

SHA256
2168dc9fc268a623fd695b25c5309e5fe1c57a826314d0c983b142d61e33620b

SHA512
f0d0399835ccc3d6ff9fe2e6e81817adfb2c0ffd7122c8d2712b95411fdd2668901c3bbc0d98cae577172f7cfb3712e71789a527b86f53c2293cad4a560cc130

Download Submit
C:\Users\Admin\AppData\Roaming\dfrg.png

Filesize
2KB

MD5
54f817239bdf35ed1f43e660ec8d2983

SHA1
928a946eb5ec5a18f5961d02c329e6e0b04aab4f

SHA256
c98cb5674c9daed32a630e6a5f981113a5cbe4670438f8d17e0015967816a729

SHA512
b0ab5f07775fd7f07a08d02eb71e0f296063303b9de697d3516837dcf79503e1762bb539c3a826cf01dcd7c05608fee8eab502abd4fbfeea048026ccd9259332

Download Submit
C:\Users\Admin\AppData\Roaming\download_10.ico

Filesize
2KB

MD5
bbc88107fcf2fcde4126f104e5f66b0c

SHA1
92132d73a3e0772c0d16b0232718286f98413455

SHA256
742e4862dcdc16eed03126a18af5443a82f7c6c8aa6ec256746a674393ce1e4f

SHA512
0ecaacbd0fa861a9508361e331016decb12d4b81027a4bead298c713580c745cbaf629bf5413f7782dc072f7a828c30592fc4e540a307f4ee90fcf4f865fe547

Download Submit
C:\Users\Admin\AppData\Roaming\f5.png

Filesize
1KB

MD5
277b4a2390469a4f4c28fd10c39c4864

SHA1
6956f1afc8002c28bd98b434005989ee1c4decc8

SHA256
4a92521b6f7d1f9151939fda51b664f51d9a667f036f5a686b1b18f53b755424

SHA512
cff98bbf64acac33565735bc7dac87cf4429175d73c4eff3d6d0cd874ad6fb07e69fc199cdd1fab018b9a76f24dc2ad2b7d90366c812c18b3f99f6b66624bc67

Download Submit
C:\Users\Admin\AppData\Roaming\function.parens.xml

Filesize
922B

MD5
054b78215f249c0bdb4a66dc5194ff6b

SHA1
b7375a86ea0bc22a5a2033ea92eb0435e5a6c0d4

SHA256
4acce89219d39f8e1f024bd6e90f93936afc4899821cf0674548f96a80815fb9

SHA512
e59c92ff9198afa690a61d789379e6cc448156c20a673e948066dbf97446bf2f11533516d92deba0b865b8b6460b785646cab9970234aada7fda02fdac15fca8

Download Submit
C:\Users\Admin\AppData\Roaming\generate.id.attributes.xml

Filesize
2KB

MD5
9c9a95e738765fc608d7c4e76b2f35cb

SHA1
9dc240f7154d9aaf682906a987f141b3dd4be7e0

SHA256
3c33893b88336ee1a3b8371c05ce32b51010b5ec73f67af002d53ca66174534c

SHA512
aab54fde37e68017852729846f7fd77db36bd38ba20ad2991ae95c534fa85c518e1d837c308db87c88412877eb5742555f512053b537b16d032d291cc3cc01d1

Download Submit
C:\Users\Admin\AppData\Roaming\goURL_lr_photoshop_jp.csv

Filesize
518B

MD5
124b2b68a4ebb67c538af29d59f66228

SHA1
92b4323a674644106fd5f24165e9dc277edf83be

SHA256
f2027f1449e8f6beb557a957c5856b57d981c8e229b7944ee4ffce6efe4707e4

SHA512
d2ec62e211a03f026940502c1d6a7cf73da23008746c4de5d7e13eace46f088db90b4fb71696972752e121063bc9ff8336b599a5a4c958c8e7da21dd8ee0d7bf

Download Submit
C:\Users\Admin\AppData\Roaming\green 349 bl 2.ADO

Filesize
524B

MD5
3aa186c985b906a6ec8cda0091ff2f54

SHA1
f2149771a0c1204ac7156fb8ce1f963fd11b51da

SHA256
bc610c9b6af205021efdff5ee4d1b9ad925755f109d10c94e18ca1dd816b55ff

SHA512
6c82b65b26cce8c30ec920be579d25cfe091d3e1cc37b6f3a4163afe43af051b1d94f76b63b1f5356539c80d017351c3d2027b8f78775de89da250f5cb0f3428

Download Submit
C:\Users\Admin\AppData\Roaming\{2A62359E-001A-DB50-37C5-75EE5DF583A7}\perfmon.exe

Filesize
267KB

MD5
58d6f1f73af65c56b5686a8fd43462f7

SHA1
8db860773719ee42c4aff6ac811d539f0ea8c13b

SHA256
40902f482be77455af14009ca7ec71c8b1b78cc12af7d51319cc47f92387026f

SHA512
c103bcb985eb974246974d84565e5cc2962dd9221a12a0a4e0e97a742a3815a6d73314bf0771b6dd794a9306c37a400bf484b57b500aab9165add22c5b4936b9

Download Submit
C:\Users\Admin\Pictures\# DECRYPT MY FILES #.html

Filesize
12KB

MD5
329616b1d4e66d3155f988ff21775b60

SHA1
e2d1f3d8904773e9f698ffad9cb519e03061b239

SHA256
0261092e6a4f2be3ff03abf6a13dc8e55431b5d18faf9a7bee24a65b0ab70726

SHA512
310bf666215b2016bd1b6e82b98b31ade486a375f3387af698b9e3aa963656bd5dd8f6acb94c7da0bf5fe208070fb6d1dcb852f5fb0aeab16c7e4fd70ec796f3

Download Submit
C:\Users\Admin\Pictures\# DECRYPT MY FILES #.txt

Filesize
10KB

MD5
6c126bb647ce282ca8a630e9aedd6b10

SHA1
7d5970bdf5ebcc7519df40122d46ee25ee781f63

SHA256
9ccc0676e18e11f7bbdd69e750bc34da5f7858e5094f2e93c97a7d4bc62ccbf8

SHA512
ecc2b8199f00e68e1a3b158e9a6e11e93fd46dfb342267dae25fedae22d3b79e423a354c88f6539a004f7b26953c5691de93df3193a9b5c98818b65297034bed

Download Submit
C:\Users\Admin\Pictures\# DECRYPT MY FILES #.url

Filesize
90B

MD5
630f172f987c626920d2ea44fbee4979

SHA1
bb6c955f2a6c496b78c6a1409e18d14d8ae0502c

SHA256
30c4fcfe2ab32e081b63b8c4cc73a3a1fbe0af1ad0b9af3d2cf06d87b1e46601

SHA512
3b80bd37c715651fbd2e6f096aa5f5319a462307a74329c0a8b10739b2b3367cb65f64ca39a6a69687f3077b931ecb8cdd255dbfbea15f10468e1584ee17a1f2

Download Submit
memory/452-661-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/452-658-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/452-638-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/452-635-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/452-645-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/452-648-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/452-249-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/452-252-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/452-306-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/452-307-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/452-308-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/452-179-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/452-175-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/452-176-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/452-655-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/452-664-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/452-641-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/452-644-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/452-667-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/452-241-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/452-673-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/452-671-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/452-670-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/856-174-0x0000000062100000-0x0000000062118000-memory.dmp

Filesize
96KB

Download
memory/856-172-0x0000000062100000-0x0000000062118000-memory.dmp

Filesize
96KB

Download
memory/2100-244-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2100-246-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/3572-510-0x0000000062100000-0x0000000062118000-memory.dmp

Filesize
96KB

Download
memory/4524-56-0x0000000062100000-0x0000000062118000-memory.dmp

Filesize
96KB

Download
memory/4524-54-0x0000000062100000-0x0000000062118000-memory.dmp

Filesize
96KB

Download
memory/5016-242-0x0000000062100000-0x0000000062118000-memory.dmp

Filesize
96KB

Download
memory/5016-245-0x0000000062100000-0x0000000062118000-memory.dmp

Filesize
96KB

Download
memory/5108-59-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/5108-57-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/5108-60-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/5108-53-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/5108-72-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download