hxxps://github[.]com/ytisf/theZoo

Resubmissions

06-08-2024 16:26

240806-txwlksxfmh 6

06-08-2024 16:23

06-08-2024 16:18

06-08-2024 16:16

06-08-2024 16:12

Analysis

max time kernel
187s
max time network
190s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
06-08-2024 16:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/ytisf/theZoo

Score

6^/10

discovery

Malware Config

Signatures

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\X:	unregmp2.exe
File opened (read-only)	\??\I:	wmplayer.exe
File opened (read-only)	\??\O:	wmplayer.exe
File opened (read-only)	\??\R:	wmplayer.exe
File opened (read-only)	\??\T:	wmplayer.exe
File opened (read-only)	\??\V:	wmplayer.exe
File opened (read-only)	\??\S:	unregmp2.exe
File opened (read-only)	\??\W:	unregmp2.exe
File opened (read-only)	\??\K:	unregmp2.exe
File opened (read-only)	\??\K:	wmplayer.exe
File opened (read-only)	\??\N:	wmplayer.exe
File opened (read-only)	\??\P:	wmplayer.exe
File opened (read-only)	\??\Z:	wmplayer.exe
File opened (read-only)	\??\B:	unregmp2.exe
File opened (read-only)	\??\G:	unregmp2.exe
File opened (read-only)	\??\Y:	wmplayer.exe
File opened (read-only)	\??\M:	unregmp2.exe
File opened (read-only)	\??\Z:	unregmp2.exe
File opened (read-only)	\??\V:	unregmp2.exe
File opened (read-only)	\??\Y:	unregmp2.exe
File opened (read-only)	\??\E:	wmplayer.exe
File opened (read-only)	\??\H:	wmplayer.exe
File opened (read-only)	\??\J:	wmplayer.exe
File opened (read-only)	\??\A:	unregmp2.exe
File opened (read-only)	\??\U:	unregmp2.exe
File opened (read-only)	\??\Q:	unregmp2.exe
File opened (read-only)	\??\T:	unregmp2.exe
File opened (read-only)	\??\A:	wmplayer.exe
File opened (read-only)	\??\M:	wmplayer.exe
File opened (read-only)	\??\Q:	wmplayer.exe
File opened (read-only)	\??\S:	wmplayer.exe
File opened (read-only)	\??\H:	unregmp2.exe
File opened (read-only)	\??\O:	unregmp2.exe
File opened (read-only)	\??\X:	wmplayer.exe
File opened (read-only)	\??\U:	wmplayer.exe
File opened (read-only)	\??\W:	wmplayer.exe
File opened (read-only)	\??\B:	wmplayer.exe
File opened (read-only)	\??\L:	wmplayer.exe
File opened (read-only)	\??\I:	unregmp2.exe
File opened (read-only)	\??\P:	unregmp2.exe
File opened (read-only)	\??\R:	unregmp2.exe
File opened (read-only)	\??\G:	wmplayer.exe
File opened (read-only)	\??\E:	unregmp2.exe
File opened (read-only)	\??\J:	unregmp2.exe
File opened (read-only)	\??\L:	unregmp2.exe
File opened (read-only)	\??\N:	unregmp2.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 7 IoCs

Web Service

T1102

flow	ioc
32	camo.githubusercontent.com
33	camo.githubusercontent.com
34	camo.githubusercontent.com
51	raw.githubusercontent.com
2	raw.githubusercontent.com
22	camo.githubusercontent.com
31	camo.githubusercontent.com

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\drivers.txt	Win32.WannaPeace.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll	svchost.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll	svchost.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1760	6128	WerFault.exe	116

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmplayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	unregmp2.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 39 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 8c003100000000000259897d110050524f4752417e310000740009000400efbec55259610259897d2e0000003f0000000000010000000000000000004a0000000000c84c2301500072006f006700720061006d002000460069006c0065007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100370038003100000018000000	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\NodeSlot = "1"	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = ffffffff	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000_Classes\Local Settings	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000_Classes\Local Settings	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 19002f433a5c000000000000000000000000000000000000000000	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	OpenWith.exe

NTFS ADS 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Ransomware.Satana.zip:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Ransomware.Thanos.zip:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Win32.WannaPeace.zip:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
5040	msedge.exe
5040	msedge.exe
1764	msedge.exe
1764	msedge.exe
3852	msedge.exe
3852	msedge.exe
2772	identity_helper.exe
2772	identity_helper.exe
5528	msedge.exe
5528	msedge.exe
2516	msedge.exe
2516	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
5484	msedge.exe
5484	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 3 IoCs

pid	Process
5596	OpenWith.exe
2952	OpenWith.exe
3148	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeShutdownPrivilege	6128	wmplayer.exe
Token: SeCreatePagefilePrivilege	6128	wmplayer.exe
Token: SeShutdownPrivilege	1012	unregmp2.exe
Token: SeCreatePagefilePrivilege	1012	unregmp2.exe

Suspicious use of FindShellTrayWindow 50 IoCs

pid	Process
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe
6128	wmplayer.exe
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe
1764	msedge.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
5596	OpenWith.exe
5596	OpenWith.exe
5596	OpenWith.exe
5596	OpenWith.exe
5596	OpenWith.exe
5596	OpenWith.exe
5596	OpenWith.exe
5596	OpenWith.exe
5596	OpenWith.exe
5596	OpenWith.exe
5596	OpenWith.exe
5596	OpenWith.exe
5596	OpenWith.exe
5596	OpenWith.exe
5596	OpenWith.exe
5596	OpenWith.exe
5596	OpenWith.exe
5596	OpenWith.exe
5596	OpenWith.exe
5596	OpenWith.exe
2952	OpenWith.exe
2952	OpenWith.exe
2952	OpenWith.exe
2952	OpenWith.exe
2952	OpenWith.exe
2952	OpenWith.exe
2952	OpenWith.exe
2952	OpenWith.exe
2952	OpenWith.exe
2952	OpenWith.exe
2952	OpenWith.exe
2952	OpenWith.exe
2952	OpenWith.exe
2952	OpenWith.exe
2952	OpenWith.exe
3888	AcroRd32.exe
3888	AcroRd32.exe
3888	AcroRd32.exe
3888	AcroRd32.exe
3148	OpenWith.exe
3148	OpenWith.exe
3148	OpenWith.exe
3148	OpenWith.exe
3148	OpenWith.exe
3148	OpenWith.exe
3148	OpenWith.exe
3148	OpenWith.exe
3148	OpenWith.exe
3148	OpenWith.exe
3148	OpenWith.exe
3148	OpenWith.exe
3148	OpenWith.exe
3148	OpenWith.exe
3148	OpenWith.exe
3148	OpenWith.exe
3148	OpenWith.exe
3148	OpenWith.exe
3148	OpenWith.exe
3148	OpenWith.exe
3148	OpenWith.exe
3148	OpenWith.exe
3148	OpenWith.exe
3148	OpenWith.exe
3148	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1764 wrote to memory of 5228	1764	msedge.exe	80
PID 1764 wrote to memory of 5228	1764	msedge.exe	80
PID 1764 wrote to memory of 1064	1764	msedge.exe	83
PID 1764 wrote to memory of 1064	1764	msedge.exe	83
PID 1764 wrote to memory of 1064	1764	msedge.exe	83
PID 1764 wrote to memory of 1064	1764	msedge.exe	83
PID 1764 wrote to memory of 1064	1764	msedge.exe	83
PID 1764 wrote to memory of 1064	1764	msedge.exe	83
PID 1764 wrote to memory of 1064	1764	msedge.exe	83
PID 1764 wrote to memory of 1064	1764	msedge.exe	83
PID 1764 wrote to memory of 1064	1764	msedge.exe	83
PID 1764 wrote to memory of 1064	1764	msedge.exe	83
PID 1764 wrote to memory of 1064	1764	msedge.exe	83
PID 1764 wrote to memory of 1064	1764	msedge.exe	83
PID 1764 wrote to memory of 1064	1764	msedge.exe	83
PID 1764 wrote to memory of 1064	1764	msedge.exe	83
PID 1764 wrote to memory of 1064	1764	msedge.exe	83
PID 1764 wrote to memory of 1064	1764	msedge.exe	83
PID 1764 wrote to memory of 1064	1764	msedge.exe	83
PID 1764 wrote to memory of 1064	1764	msedge.exe	83
PID 1764 wrote to memory of 1064	1764	msedge.exe	83
PID 1764 wrote to memory of 1064	1764	msedge.exe	83
PID 1764 wrote to memory of 1064	1764	msedge.exe	83
PID 1764 wrote to memory of 1064	1764	msedge.exe	83
PID 1764 wrote to memory of 1064	1764	msedge.exe	83
PID 1764 wrote to memory of 1064	1764	msedge.exe	83
PID 1764 wrote to memory of 1064	1764	msedge.exe	83
PID 1764 wrote to memory of 1064	1764	msedge.exe	83
PID 1764 wrote to memory of 1064	1764	msedge.exe	83
PID 1764 wrote to memory of 1064	1764	msedge.exe	83
PID 1764 wrote to memory of 1064	1764	msedge.exe	83
PID 1764 wrote to memory of 1064	1764	msedge.exe	83
PID 1764 wrote to memory of 1064	1764	msedge.exe	83
PID 1764 wrote to memory of 1064	1764	msedge.exe	83
PID 1764 wrote to memory of 1064	1764	msedge.exe	83
PID 1764 wrote to memory of 1064	1764	msedge.exe	83
PID 1764 wrote to memory of 1064	1764	msedge.exe	83
PID 1764 wrote to memory of 1064	1764	msedge.exe	83
PID 1764 wrote to memory of 1064	1764	msedge.exe	83
PID 1764 wrote to memory of 1064	1764	msedge.exe	83
PID 1764 wrote to memory of 1064	1764	msedge.exe	83
PID 1764 wrote to memory of 1064	1764	msedge.exe	83
PID 1764 wrote to memory of 5040	1764	msedge.exe	84
PID 1764 wrote to memory of 5040	1764	msedge.exe	84
PID 1764 wrote to memory of 3252	1764	msedge.exe	85
PID 1764 wrote to memory of 3252	1764	msedge.exe	85
PID 1764 wrote to memory of 3252	1764	msedge.exe	85
PID 1764 wrote to memory of 3252	1764	msedge.exe	85
PID 1764 wrote to memory of 3252	1764	msedge.exe	85
PID 1764 wrote to memory of 3252	1764	msedge.exe	85
PID 1764 wrote to memory of 3252	1764	msedge.exe	85
PID 1764 wrote to memory of 3252	1764	msedge.exe	85
PID 1764 wrote to memory of 3252	1764	msedge.exe	85
PID 1764 wrote to memory of 3252	1764	msedge.exe	85
PID 1764 wrote to memory of 3252	1764	msedge.exe	85
PID 1764 wrote to memory of 3252	1764	msedge.exe	85
PID 1764 wrote to memory of 3252	1764	msedge.exe	85
PID 1764 wrote to memory of 3252	1764	msedge.exe	85
PID 1764 wrote to memory of 3252	1764	msedge.exe	85
PID 1764 wrote to memory of 3252	1764	msedge.exe	85
PID 1764 wrote to memory of 3252	1764	msedge.exe	85
PID 1764 wrote to memory of 3252	1764	msedge.exe	85
PID 1764 wrote to memory of 3252	1764	msedge.exe	85
PID 1764 wrote to memory of 3252	1764	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/ytisf/theZoo
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fff3be13cb8,0x7fff3be13cc8,0x7fff3be13cd8
  2⤵
  PID:5228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1912,439882239804714017,509274185691597301,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1920 /prefetch:2
  2⤵
  PID:1064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1912,439882239804714017,509274185691597301,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2356 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1912,439882239804714017,509274185691597301,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2864 /prefetch:8
  2⤵
  PID:3252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,439882239804714017,509274185691597301,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:3076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,439882239804714017,509274185691597301,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:5968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,439882239804714017,509274185691597301,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4692 /prefetch:1
  2⤵
  PID:4988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,439882239804714017,509274185691597301,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4832 /prefetch:1
  2⤵
  PID:3764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,439882239804714017,509274185691597301,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5416 /prefetch:1
  2⤵
  PID:2104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,439882239804714017,509274185691597301,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:1
  2⤵
  PID:2116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1912,439882239804714017,509274185691597301,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4716 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3852
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1912,439882239804714017,509274185691597301,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5072 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,439882239804714017,509274185691597301,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5852 /prefetch:1
  2⤵
  PID:1992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1912,439882239804714017,509274185691597301,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5912 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:5528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,439882239804714017,509274185691597301,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6236 /prefetch:1
  2⤵
  PID:3008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1912,439882239804714017,509274185691597301,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3764 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:2516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1912,439882239804714017,509274185691597301,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5420 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,439882239804714017,509274185691597301,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6372 /prefetch:1
  2⤵
  PID:2616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1912,439882239804714017,509274185691597301,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6432 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:5484

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1252

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2976

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2876

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:5596

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2952
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.Satana.zip\unpacked.mem"
  2⤵
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious use of SetWindowsHookEx
  PID:3888

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3148
- C:\Program Files (x86)\Windows Media Player\wmplayer.exe
  "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Play "C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.Thanos.zip\5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d"
  2⤵
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:6128
- - C:\Windows\SysWOW64\unregmp2.exe
    "C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2500
  - - C:\Windows\system32\unregmp2.exe
      "C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT
      4⤵
      Enumerates connected drives
      Suspicious use of AdjustPrivilegeToken
      PID:1012
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 6128 -s 4556
    3⤵
    - Program crash
    PID:1760

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s upnphost
1⤵
- Drops file in Windows directory
PID:648

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 352 -p 6128 -ip 6128
1⤵
PID:4900

C:\Users\Admin\AppData\Local\Temp\Temp1_Win32.WannaPeace.zip\Win32.WannaPeace.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_Win32.WannaPeace.zip\Win32.WannaPeace.exe"
1⤵
- Drops file in Program Files directory
PID:3440
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\fvhutxcv\fvhutxcv.cmdline"
  2⤵
  PID:4612

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\ccc72fca84c4455bbff0893b7d1561ec /t 3120 /p 3440
1⤵
PID:4100

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
3e681bda746d695b173a54033103efa8

SHA1
ae07be487e65914bb068174b99660fb8deb11a1d

SHA256
fee5f7377e5ca213c1d8d7827b788723d0dd2538e7ce3f35581fc613fde834c2

SHA512
0f4381c769d4ae18ff3ac93fd97e8d879043b8ec825611db27f08bd44c08babc1710672c3f93435a61e40db1ccbf5b74c6363aaaf5f4a7fc95a6a7786d1aced8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9f081a02d8bbd5d800828ed8c769f5d9

SHA1
978d807096b7e7a4962a001b7bba6b2e77ce419a

SHA256
a7645e1b16115e9afec86efa139d35d5fecc6c5c7c59174c9901b4213b1fae0e

SHA512
7f3045f276f5bd8d3c65a23592419c3b98f1311c214c8e54a4dfe09122a08afb08ab7967b49bd413bc748ce6363658640bc87958d5e0a78974680a8f9beadf44

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
62c7418cae37ecfabeff007cba720da0

SHA1
3f384b24a2a23595a5bed382251f9fe08508e7de

SHA256
29b0d16e49acf7f934017449fe348e767b4af989b52536cdbf771848ba4e114a

SHA512
582bcab1d6b0a0d3cd035e9c6ea1825676fa757d3f0346448440bf0e0f3acfd7da39d38a43cc94353bfd29a230fc29608b4278c7aec351ce6aebdfb0e09399d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
663B

MD5
6e62eb4e8a27e3c1f4a0a6e8e6fce539

SHA1
e9a65b102eec684dba4c50ecac1610e147c03a91

SHA256
291cfc3dc3143a9f1d8ed8fea5faed24c37e56e3a07cdbc9b68638d87e8961fa

SHA512
87cd75ce42ff47dfef4a485653fd528ed638d5a97e0f7c60dd299c81102d47e27d151a6806a6071c04d1fbd010e5fc4dc941a2f62a9a1c72fe3a08e50f973450

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
663B

MD5
4eae5a209f1db8e0f4c82c4a93a453e6

SHA1
a45ee93c03b0db1f7308fdb57eb28111d55530ae

SHA256
e50f674c6f9d46251115d7c9fd90321b6a201dde46f6793aa7cf6f6b97e98ef0

SHA512
f83c394cd0eaddd23ffd594aecca32ce07cb506bb5f24239e932f817dee0b5e13a55ebaca4342e910e96d9f7a80b4815eb812d7a27c7080ae0888fd1b430a6f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
223fb577ec5bbaa9ba928eeeaea7229e

SHA1
7ad9543c59e521a2a8cd5ebc45a7d62c091b22e6

SHA256
0323a5a93a8f77f193acb3027a3ed74dbd809514f32490c6aec637d64babe309

SHA512
9d3144d1ac8d7b712bcc36ac787c4f15ecda49a77cf5046c6a5348ff17605ba06f35b9fa42d5420e4a5baa5062c7ecb8a253f1f357388a7d20351258cb53635c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5f6a58cc3b829ec587adfeb61bbb37ef

SHA1
22450d36688cf43fafb2286608f2291b48be29e5

SHA256
e1c5c70d2dfe4a9f5dd8677aab7adfb0e28cd21121c245e6121309b6aff462ef

SHA512
648af746df9a0f2c34f596fa404055fa9b8843252209e368c9353c28d9c79e10078717f5f0f5fdb2d8e4021e3221c78577f3e7d42cea46b27d36ac16f5dc68d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1d71be321082efd4143810f40225c806

SHA1
23ca2bc40fb7d27bd15482a2f11ed9174047a5e0

SHA256
6c1147f553c77c6e4c3e544faee5e373aae094a22ef0cc1fb32385a68d45c8d8

SHA512
516ac31f23dd1b1a3d8cb5857b353c4d79a041326ce8c9ba82992ce97241b1878ac7b8014345111fdf6d7cce2a031ba1e69a62889e9605c711237e3a5ad9ed78

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
8c198373398e0379533c7ca780384425

SHA1
ddc2f025f46f4637bc3c792b5e6983895c466211

SHA256
a17234da9cdc4fa2bfb68e5ab5608c787414b9a025f239b008d4c7d8d1181c06

SHA512
667c6e1590ca4e0dc4f8495763ded2b58ab03f1791bc33804ba019a5f2857aa3ddcabad7985278e7dc32fde72a8e87b80c6169ec71b4499f6e06093ec68ef173

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
efbfa6e9997e932de7ca3e731bccb5e1

SHA1
47430d1f177b7765d6f87f4053c1f3cd683d5994

SHA256
14c6bcc01bf4be63e38327547156a6e643ded841f5e5c29b9bf869581230fe93

SHA512
587c073ea5e6206818ea1c206f25522a8b482b877a6b9ca658b74f51df6c0445022c4f1b005760b532e167efa48696197568aea0feda77c8db8588b5c3aab806

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
b10859125bf51aee98b64d9e767637d7

SHA1
abfdcaeb42012408089871efe943141e6ea10947

SHA256
dafc622ef2c290860cda5bf7bedfa995c1b0137f939191da5dd7269557342c49

SHA512
bf22d4bfd71e2384197111df5fcc15ffb0e41b64b2322f47ddb62634614b40298d59371bbe63228a52003b4583db258b027f80a536140aa5c9fa2859c16370b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
50a509f0a2893d43d3b732be3af9a0a9

SHA1
22f6e57f742c417990371afa5b67c5ae7025b777

SHA256
d26ca7ce261359bd282cef148f9195ed4b97ec48d831ae7d7c05ad446351051f

SHA512
5090f869eb105b8d3234ccda766f5aa12795e0acc654a9e06be8dd3e5a2710b79006e0853d22f1b02ab96bd5f55b86db1e224500530c521291d25c88a6183b7e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
1031a1f98421f3d7d2c42c6412a7f6ca

SHA1
8b2cfc45ccc9b00f360632e96bbb69f9b489117c

SHA256
5c1ea63295e7a1e50f27bf3e1243ab47a1077d0a3a9de5a13c3678fb2de52af0

SHA512
2539da2d38f4ac99265e2cfd82bb297293b46a5749dcbdbb268b13d3871f28671b87e02f09c9b03b10f19fc4fb72cd16ca9dd80d277c13cb29012b7634f16592

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
afe00d58b6032ac817fd8fe1a0da54c5

SHA1
517044b8e01d06bc56479ed653131be354587b87

SHA256
c355a6a5407556147f4c2432ea8031585a14b8ad879de5b0a6521b85d03262fc

SHA512
e7b86dbd40a3e5450208ff67d3ba27bc183cb511e3e004455e08e7ee7dc0cd26561e247229939fe8e92e2715f3e4125c278c8f29c843e2786ada4c3fa4dead0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
8294db46d6dfaf08b1b37c4387b8ab92

SHA1
ff39dc3da4f673141129e3c3e7ecbd969ee90036

SHA256
d844d319c2c21489f254b647c548e5498a719bc2ebd5ab05ef635ef5614ed74a

SHA512
8f648f918692828c9c5251914339c8a3115721a0f33de7f1fb4aab2a5f6396fc3ab158034c6e79dca23bbfff36bcd1fa7b508dd2f24acf2d254b1d96b96cc196

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
05dbeaf6e82adcf7a5b65c33c253ca6d

SHA1
316c1b00df8643f8f8030cca3aa86b4cd0d8dced

SHA256
dfc8a27d49dc6341b1a249a69a0c6c4ec9f0287145cd5e7f595e459d1b16eaff

SHA512
7ec497c4f8a33861f9e7acf20202e74d57e16dc30375e521fa754703c0284784b9f07dd7ef6b1d7d464f17da94d02e29515c230ad8becd899489c7962d0e9634

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
0667f0de3a8d1231290481e01f6eca1e

SHA1
db944fda6ff0d897d2c8bb7981c654cb0965cd6c

SHA256
0b0cfdba486c1a944dd10c4e136f4743ecf6999cd5197942552c1875f1ce0883

SHA512
79673b2a92893960cd8616b2ab6db3114928bbb8ace7d6ff9b61d496b70ca7a76afc075bd9ccef3f56fc013961b7f862e965ba4ef2fe35337b125739a565b0ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
1a8120f13c2d615d2fd73a3b07776ca4

SHA1
19bba5831fbd8ab48d1a4dcf981b43c623710536

SHA256
6a34fc549ac8b9fd6829b9d124b7d5d3484456bbaad01f1f37353cf20f78155c

SHA512
0bf9f49f5a43cc9ebf8a6496f5c1e85be98bc1176c02bc59cd7dfd4fd541a110447679f7a0f62bd2b25667d72825ef7bda41440d8dd0066899bd3176f93562f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5806b2.TMP

Filesize
1KB

MD5
d22b6ccdb302b34bd5718daccb7a4f06

SHA1
5c9a415ff07502aa9d871f193d7a652d27fafa35

SHA256
bcec0e2d4d599a6060ac63e1489a9c4a80df481265275d630a92c4fbbc40a477

SHA512
b66b0b2269010926d9de3a7f78dac8b370950b8743a6882e6f4a448d9f8ed051dc1e61a8fa01c6ee4422b59057d4ac07ac2aee022dd0b729b456cbb705dc6da2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
d56589e2a28abe3826a4fcb0fa04f911

SHA1
60c29bcd91d20a620e72ea87e835df1ba0be6155

SHA256
4a6dbe56ee7425c6369f56a6bace0df9563e0b0daaf64113a6e939588634dce0

SHA512
cc83a19c1613fb963bdf09f7e84ff8b23f51a9a8d1eb4e90d0ae1f5fc911e2be470af4cc18ff2e11b7a74288a721eea290963b4760033132add9a6e1eeed0a6e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
38d8a4084da5ab6d371a05f0545f1a7d

SHA1
e49c8c59b7f81684512f2bd4c16c51ceda6cf483

SHA256
ef254b253f7c008a89cb41cfbc05b8260a0261b3da7e131c00feed549c67a555

SHA512
05a3240836a81f1ed4e0bde8f96304fc6fce2137c2df053e8b55c5d373f73ea24d9c54c5bab7598155a4f23979dbd2f05186d3f3da601d948046102f93c1e1cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
98315f458284771d9a2e05c90a8ffe60

SHA1
feabea8ee42d3e2c70cd959260f1ba5a722599b5

SHA256
4b9362dabde4db562e338419e7e30925a872e9a971c53605b5d37be3b9df8860

SHA512
36b4a96a5efe179965f63804407f2fd374ff84489ffbcacf6237982286a13a39b2589ea56e5c88fae05529b09ba311646fd2dd1a915c0719a22cade55360a4eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
2a81c13007e910c3057c3b97cf2f7b55

SHA1
e71bf0d5c5b18101b12c78fdc1b54a3ed6348cf9

SHA256
804c19efab6c7107e3e920eaee3c52f67e59a6104a86b23dd1f6d19a91449b98

SHA512
0ef4087deaed3e7d50ac0192da1b90543570c9f208b880d09b635d487808a68eddbb754df900d81d65869bcf12b8399e1277a56a50107c5c4073e5f9151affe8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
bf78e241ee5fcffc692c8f18ef0c1a59

SHA1
597ecf097e25f60e5d0f948b5e7c18e2952a7abc

SHA256
4f9c15053902cc1282c10b267c6f17f8c1d01a60c98f2d85b397f8a101b1a8ed

SHA512
1928b37122f510469753d48be6718ce6740a138b80ee81694747fa6c4266d525d16355b799b7708e797fae4a9f379587319cd1231f857af381d89c42df2f2f8e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
b810fca038d5d872e57fca4f5f05cdce

SHA1
f3f1b751bcfabc915f7aa5ac9f23cadaf95068f2

SHA256
270a16d976f95b4ed06c972eb23992f766a35acfd2551b9fd02a2b8123225f00

SHA512
38c5ffb7741f020391d22d9ffafe798480d8b81551851bc804b0647ecbc62ea6592c24bc238da5084676432fc25a4cb176d2343c234ecdfaa9232e83ecf21b13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb

Filesize
256KB

MD5
50612e8679faa34c3495656cbc607fff

SHA1
0497e2ff95dcdde3732d8817014c311a7169d809

SHA256
5c6cdbc2afd79d206900629066cddd4831692cf5cb8fa50d5cae5deb714cc114

SHA512
ce862db1c1b8b253f1b914b426c851c7807070f2c6d67b04de7e2105ad678f25027cb92e43e4bd1321c8d4259075f68ad84d08cdd8d50110ad3e7c428e4bad5d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb

Filesize
1024KB

MD5
cffd02034be1ba8d449c50ded408c5ea

SHA1
afde4ffe09a8f6f9a7966a56f1a0decbe40d9c33

SHA256
5b883edeb06b765ba35d3ac1c49eafe94caef0b09fdeaa117eb2e3701286b28e

SHA512
a6bc7df50f3cb7dfe49deae6c34a2ecd10b7abdea0646096dff1754aaa38f30ec56c519af2521c58b6d52fb381f91a8bd1ff78c527a2a90d976ae71ded13888c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML

Filesize
9KB

MD5
7050d5ae8acfbe560fa11073fef8185d

SHA1
5bc38e77ff06785fe0aec5a345c4ccd15752560e

SHA256
cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b

SHA512
a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b

Download Submit
C:\Users\Admin\AppData\Local\Temp\wmsetup.log

Filesize
1KB

MD5
827f2475cc41952858e8b235afd0a051

SHA1
ba2d7c0f4bbb521caa3ea9e1ebca4c076ba4bd54

SHA256
a9aead2cb2460fbb5f3cab1be297d449015a29395b67cb3d2340bd1a3d784720

SHA512
0c1a9a85cf8b1654e1feb0bd87533023ea512f2988249f4da86d4d0af6d580baa25375ec64e489e186f8cb61025b12cb58673ab321b0d5ea9f37588df34b96c6

Download Submit
C:\Users\Admin\Downloads\Ransomware.Satana.zip

Filesize
57KB

MD5
82f621944ee2639817400befabedffcf

SHA1
c183ae5ab43b9b3d3fabdb29859876c507a8d273

SHA256
4785c134b128df624760c02ad23c7e345a234a99828c3fecf58fbd6d5449897f

SHA512
7a2257af32b265596e9f864767f2b86fb439b846f7bffa4b9f477f2e54bc3ff2bb56a39db88b72a0112972959570afc697c3202839a836a6d10409a10985031b

Download Submit
C:\Users\Admin\Downloads\Ransomware.Satana.zip:Zone.Identifier

Filesize
55B

MD5
0f98a5550abe0fb880568b1480c96a1c

SHA1
d2ce9f7057b201d31f79f3aee2225d89f36be07d

SHA256
2dfb5f4b33e4cf8237b732c02b1f2b1192ffe4b83114bcf821f489bbf48c6aa1

SHA512
dbc1150d831950684ab37407defac0177b7583da0fe13ee8f8eeb65e8b05d23b357722246888189b4681b97507a4262ece96a1c458c4427a9a41d8ea8d11a2f6

Download Submit
C:\Users\Admin\Downloads\Ransomware.Thanos.zip

Filesize
145KB

MD5
00184463f3b071369d60353c692be6f0

SHA1
d3c1e90f39da2997ef4888b54d706b1a1fde642a

SHA256
cd0f55dd00111251cd580c7e7cc1d17448faf27e4ef39818d75ce330628c7787

SHA512
baa931a23ecbcb15dda6a1dc46d65fd74b46ccea8891c48f0822a8a10092b7d4f7ea1dc971946a161ac861f0aa8b99362d5bea960b47b10f8c91e33d1b018006

Download Submit
C:\Users\Admin\Downloads\Win32.WannaPeace.zip

Filesize
477KB

MD5
96593e22646caafcd606ae75f816c989

SHA1
ab3cc81a4304d0d5ad93f4e7b87e6ca42e7a5804

SHA256
cdb4ad5d0bdb1c44cad5937305f383331fdd75b2bf41c4f0fd66b8015002c5af

SHA512
ad8fb66af4483e694d806148b21633d2bf288db5b3dfb8b13957fb6f8fe2646503a57700e8382123f23b586fc743d0ac00fd09c145df335d275602793141fe66

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\fvhutxcv\fvhutxcv.0.cs

Filesize
42B

MD5
0fd6c5ef54a461a3968153320a86fe2b

SHA1
11aab7e8917c87fdf88f1fecbc0d5a833972e044

SHA256
7709fd57593ec1b52c4ab8883244eddfc14066a7d3734a314dfae8bc5216fca8

SHA512
1d16b2915433a0219b2b84f42d6692f125068e3f01a0048b2dc20717c51907137ebbd30e31a2092089a8ca307cbe3fcaf4efe42b3df63b47786020cbba52d682

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\fvhutxcv\fvhutxcv.cmdline

Filesize
117B

MD5
fd0fbadfce5391382c0df2eaa84a4b3a

SHA1
9e86a3339966da0bf593a566177b49efc4e4c0b0

SHA256
6164bbfe564e0eb7222baecb1d712c76f73f788b4d8dd1f9e818171f7ebaa617

SHA512
050e1539a837ba1cdcc5779c8605642d3b205aa227f6cace68d62a31084187453ddb41b14102ce29c60f76f881803dd1c4299c2a8680f94213ac4f06949858f5

Download Submit
memory/3440-577-0x00000000001A0000-0x000000000024A000-memory.dmp

Filesize
680KB

Download
memory/3440-614-0x000000001D150000-0x000000001D90A000-memory.dmp

Filesize
7.7MB

Download
memory/6128-486-0x0000000006D10000-0x0000000006D20000-memory.dmp

Filesize
64KB

Download
memory/6128-494-0x0000000009320000-0x0000000009330000-memory.dmp

Filesize
64KB

Download
memory/6128-493-0x0000000009320000-0x0000000009330000-memory.dmp

Filesize
64KB

Download
memory/6128-489-0x0000000009320000-0x0000000009330000-memory.dmp

Filesize
64KB

Download
memory/6128-490-0x0000000009320000-0x0000000009330000-memory.dmp

Filesize
64KB

Download
memory/6128-487-0x0000000009320000-0x0000000009330000-memory.dmp

Filesize
64KB

Download
memory/6128-491-0x0000000009320000-0x0000000009330000-memory.dmp

Filesize
64KB

Download
memory/6128-492-0x0000000009320000-0x0000000009330000-memory.dmp

Filesize
64KB

Download
memory/6128-488-0x0000000009320000-0x0000000009330000-memory.dmp

Filesize
64KB

Download