sodinokibi | hxxps://cdn7[.]filehaus[.]su/files/1723351476_87078/240811_pw_infected[.]zip

Analysis

max time kernel
123s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
11-08-2024 04:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://cdn7.filehaus.su/files/1723351476_87078/240811_pw_infected.zip

Score

10^/10

sodinokibi $2a$10$n1j5.fm58bdqxg1iiawkk.puueyhacglscgxm6cjq94af.gij58eg 6758 credential_access discovery ransomware spyware stealer

Malware Config

Extracted

Family

sodinokibi

Botnet

$2a$10$n1J5.fM58bdQxg1IiAWkk.PuUeYhAcGlSCgxM6CJQ94aF.GiJ58eG

Campaign

6758

Decoy

mezhdu-delom.ru

songunceliptv.com

basisschooldezonnewijzer.nl

justinvieira.com

iqbalscientific.com

memaag.com

cwsitservices.co.uk

paymybill.guru

mir-na-iznanku.com

anteniti.com

slupetzky.at

delchacay.com.ar

calxplus.eu

jolly-events.com

irishmachineryauctions.com

solerluethi-allart.ch

schmalhorst.de

maasreusel.nl

sanyue119.com

lescomtesdemean.be

Attributes

net
true
pid
$2a$10$n1J5.fM58bdQxg1IiAWkk.PuUeYhAcGlSCgxM6CJQ94aF.GiJ58eG
prc
tbirdconfig

firefox

outlook

encsvc

sql

xfssvccon

wordpad

visio

thunderbird

infopath

thebat

msaccess

dbsnmp

ocssd

ocautoupds

excel

isqlplussvc

agntsvc

ocomm

oracle

steam

powerpnt

onenote

synctime

sqbcoreservice

mspub

dbeng50

mydesktopservice

mydesktopqos

winword
ransom_oneliner
All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions
ransom_template
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] Data leak [+] First of all we have uploaded more then 300 GB archived data from \\UDATA. Example of data: - Accounting - Finance - Personal Data - Banking data - Strategic sourcing - Management - Projects, plans - Immigrants info - Confidential files And more other... Our blog: http://dnpscnbaix6nkwvystl3yxglz7nteicqrou3t75tpcc5532cztc46qyd.onion/ Read what happens to those who do not pay. We are ready: - To provide you the evidence of stolen data - To give you universal decrypting tool for all encrypted files. - To delete all the stolen data. [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
sub
6758
svc
mepocs

vss

sql

memtas

sophos

backup

svc$

veeam

Extracted

Path

C:\Users\Admin\ig520x30m-readme.txt

Family

sodinokibi

Ransom Note

---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension ig520x30m. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] Data leak [+] First of all we have uploaded more then 300 GB archived data from \\UDATA. Example of data: - Accounting - Finance - Personal Data - Banking data - Strategic sourcing - Management - Projects, plans - Immigrants info - Confidential files And more other... Our blog: http://dnpscnbaix6nkwvystl3yxglz7nteicqrou3t75tpcc5532cztc46qyd.onion/ Read what happens to those who do not pay. We are ready: - To provide you the evidence of stolen data - To give you universal decrypting tool for all encrypted files. - To delete all the stolen data. [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/30A2E6670570A2EE 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/30A2E6670570A2EE Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: zrT8r7w3IYQ69Q+20kuv2/VXRXKYaoEHO5uKKGxLJ+5U4sQGVNheqmPbqzvc15y2 3O0IBThySTp327INAk9KtQNhahFiexoLhhw70t/O+4udGaAi7iIVFH2qZw1Vl6cI 7D2P+G4HuHquOFLwSETznXvOtBuTHISOURPYql5zm3HwF/p23QTExRb5K6PTFTia zdSFDjeeyjbsZGz0jbuktbJ1XNshOOHUIh7i3U1H1S4T3XDgf7UIwHx/fj5kIzTE QITr6xvjP14CqhCI0mZ+YcCUTYTywQ9/pq2EOEmWWYcI1IM7RY1N8Lmz9FmVNx+I OwzyPTJWyc61eDqYJsAqo9+x9kg6DDsXGJmSKdLJVv64tH3q41fcPjFpJWrSAnqL K4PtdHwas43u53EEVW9btf5i19zjMw+S/1/+7cl5s9/rnXXx5GGWsGYbKuDjH/XB Q4Q9Vg69SaUpEfcHYOAa8Ktz6Jm3vavSBq7sBvNzf7M4E8DA02UROdGj4NBWe2RM f+j/iA64nTPkChcOkIApZPiYdu9OYA9DrDWpi2KmOogDdoK/uX2dNvIy4aVoyuDp lp5ETK2WDwbL7r3URQjNZp2Fxrn0iz0T+0gHBmdMCVEZ4f+t3mPFkYuY3lSqjxG/ qrL9rfdWy8ygODjSRNDXsqcLbfI1ZjLws3ABPxMJLAPTY6Jyd7zKkt54L1dhyAwL +Cchl7GDNQ7plTHnonlrCgqYYo7FNOglAhr636FG1CMXRChDjDa5S//lZyhyPGFW 2buVCH7KQ9ee2FY2ahwunzQjWeDmfw773C91LnIxZATMe08OUqDk6/KfjlapbrHu W0fMp3FRDviFjbPSEeh4dcGsAaOXHXVL4S4lXoe5QCYUfX0IJsbBiojVLt4UTc60 gUmdilbbR5OFcAehpJVELuVm7cb+4KjC3rqBLou8YTNQ+o/NShzredhxp7/Y/Vp7 2j3WkMeLZbYGtMuAqs5sA8bZm/90a3y3hvZ25PzIes90t9AskeoqaNxl2wxUzp67 65FQm/52ZT0qJET3hCX1fejQfGptb0UwQURgM6SOeyyrVY1GOEQT5YQWRPya1Uvp ytBpuwenmS6gPpoMlWH02g158FiAGnf5lFeLEVWyqZ7rzZRoiIblK7qKtIOAxJFI 0cex+3PJabXqrYC/9ZFEAdX8BJ5pSJbACbyjJQs3gGYeRlxtFlO7MeTvaC/5LDAn VgRXrMHnepV5zjfNGZT5fpa1qn9c8+NgaRJWSAJL9wuUDrVtZBt/72oZuUvBi5LP /jVNujmnam2blf/1s4LfANl32QYSlzic/NtM/Zn4nrKE37eZJMxPj395sMilcUsK Ompx00KibOxXJr0LzAW7q311bPni+t1TYRqXPHsHZybzsMdxLOhk5fxtfSo= ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/30A2E6670570A2EE

http://decoder.re/30A2E6670570A2EE

Signatures

Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
ransomware sodinokibi
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003
Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
credential_access stealer

Windows Credential Manager
T1555.004

Executes dropped EXE 1 IoCs

pid	Process
1052	2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Enumerates connected drives 3 TTPs 25 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\M:	2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e.exe
File opened (read-only)	\??\U:	2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e.exe
File opened (read-only)	\??\E:	2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e.exe
File opened (read-only)	\??\G:	2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e.exe
File opened (read-only)	\??\K:	2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e.exe
File opened (read-only)	\??\A:	2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e.exe
File opened (read-only)	\??\R:	2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e.exe
File opened (read-only)	\??\V:	2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e.exe
File opened (read-only)	\??\Y:	2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e.exe
File opened (read-only)	\??\I:	2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e.exe
File opened (read-only)	\??\J:	2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e.exe
File opened (read-only)	\??\S:	2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e.exe
File opened (read-only)	\??\L:	2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e.exe
File opened (read-only)	\??\D:	2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e.exe
File opened (read-only)	\??\W:	2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e.exe
File opened (read-only)	\??\Q:	2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e.exe
File opened (read-only)	\??\X:	2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e.exe
File opened (read-only)	\??\B:	2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e.exe
File opened (read-only)	\??\H:	2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e.exe
File opened (read-only)	\??\N:	2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e.exe
File opened (read-only)	\??\T:	2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e.exe
File opened (read-only)	\??\F:	2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e.exe
File opened (read-only)	\??\O:	2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e.exe
File opened (read-only)	\??\P:	2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e.exe
File opened (read-only)	\??\Z:	2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\21dm4jj5514tv.bmp"	2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e.exe

Drops file in Program Files directory 32 IoCs

description	ioc	Process
File opened for modification	\??\c:\program files\ConfirmDebug.mpeg	2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e.exe
File opened for modification	\??\c:\program files\ExitDeny.vdw	2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e.exe
File opened for modification	\??\c:\program files\SyncMerge.3gp	2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e.exe
File opened for modification	\??\c:\program files\AssertDebug.html	2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e.exe
File opened for modification	\??\c:\program files\LockSubmit.pps	2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e.exe
File opened for modification	\??\c:\program files\RemoveMove.ps1xml	2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e.exe
File opened for modification	\??\c:\program files\StartMount.mov	2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e.exe
File opened for modification	\??\c:\program files\AddDisconnect.dxf	2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e.exe
File opened for modification	\??\c:\program files\EditGroup.css	2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e.exe
File opened for modification	\??\c:\program files\OutWrite.fon	2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e.exe
File opened for modification	\??\c:\program files\UnregisterUnprotect.vb	2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e.exe
File opened for modification	\??\c:\program files\CheckpointShow.xml	2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e.exe
File opened for modification	\??\c:\program files\RegisterExpand.search-ms	2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e.exe
File opened for modification	\??\c:\program files\GroupSubmit.mpeg2	2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e.exe
File opened for modification	\??\c:\program files\OpenSearch.AAC	2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e.exe
File opened for modification	\??\c:\program files\RestartUpdate.vstm	2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e.exe
File opened for modification	\??\c:\program files\SyncUnlock.xltm	2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e.exe
File opened for modification	\??\c:\program files\UpdateEnter.eprtx	2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e.exe
File opened for modification	\??\c:\program files\AddUpdate.potm	2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e.exe
File opened for modification	\??\c:\program files\CopyFormat.ex_	2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e.exe
File opened for modification	\??\c:\program files\ImportRead.3gpp	2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e.exe
File opened for modification	\??\c:\program files\SearchStart.M2T	2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e.exe
File opened for modification	\??\c:\program files\ConvertFromUnregister.htm	2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e.exe
File opened for modification	\??\c:\program files\DenyEdit.MTS	2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e.exe
File opened for modification	\??\c:\program files\InstallUndo.vsx	2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e.exe
File opened for modification	\??\c:\program files\SplitImport.doc	2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e.exe
File opened for modification	\??\c:\program files\UnblockProtect.dotx	2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e.exe
File opened for modification	\??\c:\program files\ApproveSwitch.temp	2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e.exe
File opened for modification	\??\c:\program files\DisableUnblock.edrwx	2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e.exe
File opened for modification	\??\c:\program files\MountPublish.htm	2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e.exe
File opened for modification	\??\c:\program files\RequestRead.mpeg	2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e.exe
File opened for modification	\??\c:\program files\ShowTrace.7z	2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
2452	msedge.exe
2452	msedge.exe
3264	msedge.exe
3264	msedge.exe
1188	identity_helper.exe
1188	identity_helper.exe
4608	msedge.exe
4608	msedge.exe
2300	msedge.exe
2300	msedge.exe
1052	2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e.exe
1052	2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e.exe
1052	2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e.exe
1052	2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeRestorePrivilege	5124	7zG.exe
Token: 35	5124	7zG.exe
Token: SeSecurityPrivilege	5124	7zG.exe
Token: SeSecurityPrivilege	5124	7zG.exe
Token: SeDebugPrivilege	1052	2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e.exe
Token: SeTakeOwnershipPrivilege	1052	2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e.exe
Token: SeBackupPrivilege	5536	vssvc.exe
Token: SeRestorePrivilege	5536	vssvc.exe
Token: SeAuditPrivilege	5536	vssvc.exe

Suspicious use of FindShellTrayWindow 43 IoCs

pid	Process
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
5124	7zG.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3264 wrote to memory of 1152	3264	msedge.exe	84
PID 3264 wrote to memory of 1152	3264	msedge.exe	84
PID 3264 wrote to memory of 4084	3264	msedge.exe	86
PID 3264 wrote to memory of 4084	3264	msedge.exe	86
PID 3264 wrote to memory of 4084	3264	msedge.exe	86
PID 3264 wrote to memory of 4084	3264	msedge.exe	86
PID 3264 wrote to memory of 4084	3264	msedge.exe	86
PID 3264 wrote to memory of 4084	3264	msedge.exe	86
PID 3264 wrote to memory of 4084	3264	msedge.exe	86
PID 3264 wrote to memory of 4084	3264	msedge.exe	86
PID 3264 wrote to memory of 4084	3264	msedge.exe	86
PID 3264 wrote to memory of 4084	3264	msedge.exe	86
PID 3264 wrote to memory of 4084	3264	msedge.exe	86
PID 3264 wrote to memory of 4084	3264	msedge.exe	86
PID 3264 wrote to memory of 4084	3264	msedge.exe	86
PID 3264 wrote to memory of 4084	3264	msedge.exe	86
PID 3264 wrote to memory of 4084	3264	msedge.exe	86
PID 3264 wrote to memory of 4084	3264	msedge.exe	86
PID 3264 wrote to memory of 4084	3264	msedge.exe	86
PID 3264 wrote to memory of 4084	3264	msedge.exe	86
PID 3264 wrote to memory of 4084	3264	msedge.exe	86
PID 3264 wrote to memory of 4084	3264	msedge.exe	86
PID 3264 wrote to memory of 4084	3264	msedge.exe	86
PID 3264 wrote to memory of 4084	3264	msedge.exe	86
PID 3264 wrote to memory of 4084	3264	msedge.exe	86
PID 3264 wrote to memory of 4084	3264	msedge.exe	86
PID 3264 wrote to memory of 4084	3264	msedge.exe	86
PID 3264 wrote to memory of 4084	3264	msedge.exe	86
PID 3264 wrote to memory of 4084	3264	msedge.exe	86
PID 3264 wrote to memory of 4084	3264	msedge.exe	86
PID 3264 wrote to memory of 4084	3264	msedge.exe	86
PID 3264 wrote to memory of 4084	3264	msedge.exe	86
PID 3264 wrote to memory of 4084	3264	msedge.exe	86
PID 3264 wrote to memory of 4084	3264	msedge.exe	86
PID 3264 wrote to memory of 4084	3264	msedge.exe	86
PID 3264 wrote to memory of 4084	3264	msedge.exe	86
PID 3264 wrote to memory of 4084	3264	msedge.exe	86
PID 3264 wrote to memory of 4084	3264	msedge.exe	86
PID 3264 wrote to memory of 4084	3264	msedge.exe	86
PID 3264 wrote to memory of 4084	3264	msedge.exe	86
PID 3264 wrote to memory of 4084	3264	msedge.exe	86
PID 3264 wrote to memory of 4084	3264	msedge.exe	86
PID 3264 wrote to memory of 2452	3264	msedge.exe	87
PID 3264 wrote to memory of 2452	3264	msedge.exe	87
PID 3264 wrote to memory of 2900	3264	msedge.exe	88
PID 3264 wrote to memory of 2900	3264	msedge.exe	88
PID 3264 wrote to memory of 2900	3264	msedge.exe	88
PID 3264 wrote to memory of 2900	3264	msedge.exe	88
PID 3264 wrote to memory of 2900	3264	msedge.exe	88
PID 3264 wrote to memory of 2900	3264	msedge.exe	88
PID 3264 wrote to memory of 2900	3264	msedge.exe	88
PID 3264 wrote to memory of 2900	3264	msedge.exe	88
PID 3264 wrote to memory of 2900	3264	msedge.exe	88
PID 3264 wrote to memory of 2900	3264	msedge.exe	88
PID 3264 wrote to memory of 2900	3264	msedge.exe	88
PID 3264 wrote to memory of 2900	3264	msedge.exe	88
PID 3264 wrote to memory of 2900	3264	msedge.exe	88
PID 3264 wrote to memory of 2900	3264	msedge.exe	88
PID 3264 wrote to memory of 2900	3264	msedge.exe	88
PID 3264 wrote to memory of 2900	3264	msedge.exe	88
PID 3264 wrote to memory of 2900	3264	msedge.exe	88
PID 3264 wrote to memory of 2900	3264	msedge.exe	88
PID 3264 wrote to memory of 2900	3264	msedge.exe	88
PID 3264 wrote to memory of 2900	3264	msedge.exe	88

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://cdn7.filehaus.su/files/1723351476_87078/240811_pw_infected.zip
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff381446f8,0x7fff38144708,0x7fff38144718
  2⤵
  PID:1152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,16743811092330720432,11460724687530685177,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:2
  2⤵
  PID:4084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2064,16743811092330720432,11460724687530685177,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2064,16743811092330720432,11460724687530685177,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2672 /prefetch:8
  2⤵
  PID:2900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,16743811092330720432,11460724687530685177,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:2064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,16743811092330720432,11460724687530685177,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:3184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,16743811092330720432,11460724687530685177,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4956 /prefetch:1
  2⤵
  PID:2960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,16743811092330720432,11460724687530685177,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4940 /prefetch:1
  2⤵
  PID:2516
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,16743811092330720432,11460724687530685177,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5476 /prefetch:8
  2⤵
  PID:2300
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,16743811092330720432,11460724687530685177,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5476 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,16743811092330720432,11460724687530685177,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5472 /prefetch:1
  2⤵
  PID:4848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,16743811092330720432,11460724687530685177,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2660 /prefetch:1
  2⤵
  PID:4760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2064,16743811092330720432,11460724687530685177,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5708 /prefetch:8
  2⤵
  PID:3444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,16743811092330720432,11460724687530685177,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5736 /prefetch:1
  2⤵
  PID:1908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2064,16743811092330720432,11460724687530685177,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5740 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,16743811092330720432,11460724687530685177,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6116 /prefetch:1
  2⤵
  PID:4864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,16743811092330720432,11460724687530685177,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5008 /prefetch:1
  2⤵
  PID:5028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,16743811092330720432,11460724687530685177,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4648 /prefetch:1
  2⤵
  PID:3572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2064,16743811092330720432,11460724687530685177,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4992 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2300

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1632

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3880

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4576

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\240811_pw_infected (1)\" -ad -an -ai#7zMap25614:106:7zEvent4796
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5124

C:\Users\Admin\Downloads\240811_pw_infected (1)\2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e.exe
"C:\Users\Admin\Downloads\240811_pw_infected (1)\2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1052

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:2520

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5536

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Public\Desktop\ig520x30m-readme.txt
1⤵
PID:5088

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Windows Credential Manager

T1555.004

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
eeaa8087eba2f63f31e599f6a7b46ef4

SHA1
f639519deee0766a39cfe258d2ac48e3a9d5ac03

SHA256
50fe80c9435f601c30517d10f6a8a0ca6ff8ca2add7584df377371b5a5dbe2d9

SHA512
eaabfad92c84f422267615c55a863af12823c5e791bdcb30cabe17f72025e07df7383cf6cf0f08e28aa18a31c2aac5985cf5281a403e22fbcc1fb5e61c49fc3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b9569e123772ae290f9bac07e0d31748

SHA1
5806ed9b301d4178a959b26d7b7ccf2c0abc6741

SHA256
20ab88e23fb88186b82047cd0d6dc3cfa23422e4fd2b8f3c8437546a2a842c2b

SHA512
cfad8ce716ac815b37e8cc0e30141bfb3ca7f0d4ef101289bddcf6ed3c579bc34d369f2ec2f2dab98707843015633988eb97f1e911728031dd897750b8587795

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_0

Filesize
44KB

MD5
2530da8afb3fc7b372d4b85060f8a310

SHA1
dea83de447a5f4f595e60e6da2a2d3be484691ed

SHA256
ca957f18f1a0139e2df8d9cd449f17a6dcf7bff407119da9f92f7ad4ae5aae0a

SHA512
c07e4297aedf7acbddb04734305df2f6446691311f1d008f628e5462482816d5bd58de4cdeffa5bdc2ebde7e1f4936c4349fe1411d4e6bf39a46fdb795796c41

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_1

Filesize
264KB

MD5
9bde83d0b5e87012df92f50b0a773517

SHA1
3363e28c61c721adb7fd4df838270f5386e1cd71

SHA256
7afdb3024b0139f32e73814efb4ba681ea016c571b78424fb9fc80b1fb7422d3

SHA512
0592e182227fc184292d747fa6d3493dcebd09c758d79368b95abc610fdeb6a7401e494b0a13dee6b1a9286e93ac7a6db7a01acf339cbc51b991261b93333220

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_2

Filesize
1.0MB

MD5
e5b04d79896e444e8b4a484d1bb499f7

SHA1
c9d772e2ef5535f2bacbe2ae5f4d778e3042b1fa

SHA256
a9c17a78fe7045224fc4ebdf775090ad23e7832a5d3cc0e2015ddc975bb9b981

SHA512
436cdd1c6440aaae91af8eee74b1b25116c729ce15893b60d6d17122fb511864713462cdad42dafac2765c4409cbb4ca192511fe18b1849709f9913a3131ec11

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Collections\collectionsSQLite

Filesize
64KB

MD5
2b65c5d1ab0aa3f3f57c635932c12a5d

SHA1
b532c837537438e591d5d6adbf96a5dfe5c40eba

SHA256
c111777e9b9a42cf62b06900b847283238af63d15033c40577cb10aaa58c084a

SHA512
7d75089fb928c23c0166a74bb2baa3c1245bb23012d30ec2cf1fe71f8412700d354d4b9b8070309b23a5b003e37727ecd00f9ffaa018ffa5bb67ad1bed58e175

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

Filesize
319B

MD5
e322fd9187162d790ab43f753eb9c83f

SHA1
29431a61356c2f666daf07bbbf011cbf3324b09c

SHA256
5f1fdee8a254f62762ad55f891aeb93e0e14a61bb15cf55c0750a86d57b69de7

SHA512
8099b54f526d42002311df1b4ed7464ed3e1610bef5e9a7e6c9d6f7f3ccf35fe046dbb641f0b1634291e27b392b84944360adccbe1f45fa36cc2ee2c26dc421e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History

Filesize
124KB

MD5
96409b5a1add2c489a8bed0c39148830

SHA1
b80515fd980cc123254610370ee4588d0bfb4bb7

SHA256
d6ace3158d9d64551d523ca7a4ac5770a6e351c6ddf7a27f06c6ac5978834b1e

SHA512
7c3adc4022d804afb0486867963807344680c63c60fad6ebd890094906affdcd5e2083a348d5173b6b1c70583f7acba69df3a40141fa1b96e249974d88aed18b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History Provider Cache

Filesize
6B

MD5
a9851aa4c3c8af2d1bd8834201b2ba51

SHA1
fa95986f7ebfac4aab3b261d3ed0a21b142e91fc

SHA256
e708be5e34097c8b4b6ecb50ead7705843d0dc4b0779b95ef57073d80f36c191

SHA512
41a1b4d650ff55b164f3db02c8440f044c4ec31d8ddbbbf56195d4e27473c6b1379dfad3581e16429650e2364791f5c19aae723efc11986bb986ef262538b818

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Filesize
331B

MD5
877620c54ec09760094740870914e681

SHA1
3737c92671f2ba19bbd15c7218d5ad9c374ba90e

SHA256
8a77566cb729cbe44c07ed0ea0ee754dc546c68855e575afdc19a38de835686a

SHA512
0be33f504b6dc763f60d78af25f14f6f64aca90db2db5d8f5758a94e05832119cfbb50293200dfcdaadc92fa6d6029a1294cdb3a3170e958f0aea5059a43dea2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8a9567050d6009ea49adebf6f3c82411

SHA1
59722b8b4110ebe2a0ed163ed86a150d4d239d35

SHA256
c42197cd00ac40d0858890807d57b963ef610d7d5e0b69c2fea1367a2dc663e5

SHA512
a5320837c25ef53bf5d2c6c86365d8ae0495d736c054d2d0deba26c9e845552900a93c0b2ed1072c275811741426c900fed9da91f48f585ee3a340af8e321f78

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
fdc7d739db6226f2b8ec5fde44157b9e

SHA1
82ab6a8bbe4787a9f25f133f48a5e875ae2d46b4

SHA256
35316aff3ffd33af486e510e320c9010dade0d330c3e6a7cb7f9b3ab8abcd1ba

SHA512
201e2147a981a6fa995caf918136afd02bc4e8641102cef089782d0f7bbf6f9802baaa99d138989c6aad92acac934415be4a0e55202ea301d6876a871f60777a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
edc4b98ce5883af2043ff67be93bdf69

SHA1
6a4c5af76513db9e394a7acea35444403d077c49

SHA256
8d5a44e167997d714adb109b2ee462b98c9222a791e1b4548ef86258fff12571

SHA512
369cd01451066046083866f2161ca5feb30ce033a925a1aa8cedb8c4afe95f42a166c13bae080649f79be00b5fc8b4e4d578588656a92926c8549666eaa3c97d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferredApps

Filesize
33B

MD5
2b432fef211c69c745aca86de4f8e4ab

SHA1
4b92da8d4c0188cf2409500adcd2200444a82fcc

SHA256
42b55d126d1e640b1ed7a6bdcb9a46c81df461fa7e131f4f8c7108c2c61c14de

SHA512
948502de4dc89a7e9d2e1660451fcd0f44fd3816072924a44f145d821d0363233cc92a377dba3a0a9f849e3c17b1893070025c369c8120083a622d025fe1eacf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Filesize
175B

MD5
6153ae3a389cfba4b2fe34025943ec59

SHA1
c5762dbae34261a19ec867ffea81551757373785

SHA256
93c2b2b9ce1d2a2f28fac5aadc19c713b567df08eaeef4167b6543a1cd094a61

SHA512
f2367664799162966368c4a480df6eb4205522eaae32d861217ba8ed7cfabacbfbb0f7c66433ff6d31ec9638da66e727e04c2239d7c6a0d5fd3356230e09ab6c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

Filesize
319B

MD5
cae66d997f1abb643c0db11a924f12b4

SHA1
6eeee6fe74a3a50354b4ebae99dea346889d61c7

SHA256
fb5a54523f372556df994d1299901fb64137dc01a9ebc56bf3d00f6a66f13061

SHA512
186226d665b391bcbf7f46a73efdd555d0b66fecde70901388118e29ce255356a4966b5194d257d8f42efd0634d537f18833c56c5735b6272a2ef350d46dca98

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Session_13367825175084799

Filesize
1KB

MD5
0465cb65eda014bb0e741e5fb32fa951

SHA1
1552806fb54ef0c4977a76a5b0437db003eb1139

SHA256
bfe8b9d0bdbf561aba1d61e9911b81350cef67cc2d95bd0097c5894608233aa9

SHA512
8f289c0d2fe04b814073be7a7fb08f3918dd8f0eb487986af71fd54236d7ceee9970ad67165a55195e697d76f279e4eed73e7e41dde7ccda3b238a2f77b6e2cc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Tabs_13367825175262799

Filesize
1KB

MD5
36ca069d08ba92ba730d2c7ebea01355

SHA1
f54b72ab8fbdbb0a07c8cb304dfeedbf34b940ac

SHA256
f5e8c9b17a6ff75667b8ab6b29fe9ef8902bfa0e387a9d1c75fc5ccbd531066c

SHA512
77492edf908dc358e8bf7a46f2a263c4521dafecdebfca9f3aa7ea1e61192cc6c60ba4a146619b1193570ecb42f3768837f33033b2c50d89c2f79095285fb634

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log

Filesize
112B

MD5
7ad890fe76f7b9a88904e0985e27a77d

SHA1
f0ecdec9f05323172d95e33e6a461d6ad1a07542

SHA256
016c76f70c51fe317891bc5a0442c0cd8fc70329b61928b431219179b1fba996

SHA512
1a2908609f13f777fedc84980da032519c0ef0b2458e5e890912318f40e5622518633f2c82a1375f78ce3e11a8617745efdf8610bf558fa20e941b8f485b2240

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Filesize
350B

MD5
83d89de7016036760e9721b65f643d00

SHA1
86e44bdf7a59956872b4482fb76b3f3b55143580

SHA256
9ed4d7401a323a00bf5950740d366ae162d9fcead9a2373ade505650f74c275e

SHA512
a2e0bb26d5ac5eb2cbca94ae98bc81c46d92e01914266bb347b3a45587c6d35c4729764bd43851f7788e11cf738b24f0b4a780a47cdacc3f4cd6ce67b7dcb480

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Filesize
326B

MD5
004eded7834b2344c1e6658f1416b0f3

SHA1
c566985e29eeef8b9c3534df62e445d437990d50

SHA256
7ca8a3769e9e2273ce5ae4094f3f549b288e557cff9ed2ca01f5b9a8b38ef4f1

SHA512
f0b0b2a40e1c6e75fba746bb6cfba0cf55ea6f1f218ebd152422277a9ac04fc7c559488305b7a4ab170ac70549558823475221cffe61a8ad0f1a89eda3c8a628

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\LOG

Filesize
136B

MD5
2a6e2e03ad5107dfc578acab39580467

SHA1
ebd43a93a8d74c1a894ca6fc8688bb8b31a9fb0c

SHA256
c7738cd18ed79c6d7d26e7dac2fbaa6b16d834ed1555fdeb7278dbb5bde124f4

SHA512
ee6eebb62c02bbc36d3c129ec49954a37089364dffd83b02125deb79910aa933acafacfbef951cbe9b68e141fa8dcd9ae13226bc47ac2998a574f9db9eece6c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\MANIFEST-000004

Filesize
50B

MD5
031d6d1e28fe41a9bdcbd8a21da92df1

SHA1
38cee81cb035a60a23d6e045e5d72116f2a58683

SHA256
b51bc53f3c43a5b800a723623c4e56a836367d6e2787c57d71184df5d24151da

SHA512
e994cd3a8ee3e3cf6304c33df5b7d6cc8207e0c08d568925afa9d46d42f6f1a5bdd7261f0fd1fcdf4df1a173ef4e159ee1de8125e54efee488a1220ce85af904

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db

Filesize
44KB

MD5
4df767f73bf0843fd47798613781b113

SHA1
e49ce331a5d2967e41422a8a052d9880ee617247

SHA256
3f97cad0b7c9e273c3e13b1010bf59784988e986acbb7d0eb0239b7a52d6d260

SHA512
6c49a18981e1e5e18203f39c23769b71d672aed63fdc8331cfef79c80d05880c5dd99154e1a770b8a88db138d4875969228f82a186e64d7894e83b8ae308fb17

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Filesize
5KB

MD5
a1c8a3ad8dd54d74220a8daf78253491

SHA1
7060c0228655476bbf888899ede82d896a0a069b

SHA256
3c26a94a40aa4bb8ac1b391fa494edd2e39f3f4e900ec1e4e56ad8f70db3ee5d

SHA512
2d41178d037ca587799b4ffb93c8c39a2e5aafc5f9a30dbf0d105c1fc8e6911367b6fbefa2b4c780b26c9bf504fd74801598632f78b9ecb7cb2054f25c3309dc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Filesize
319B

MD5
90dba0be44e32d4192ba8b57d3bed870

SHA1
ff46a1afd399984bf421717a56a15d1da024de4a

SHA256
359c50f1f6d8baedf7cbd7aefed133a88b45b7cd141ca0b3e20db866fdbbf8f2

SHA512
fad227acef2eadebde26543c8b280869c63d6c39503a3189e4cdbac1efba2884d4d055914695907fd68dc31d21d72deec1979db9adfa37300148b4f2f18ed81d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Filesize
560B

MD5
8813786a319d4d4f24026ceefd2e1004

SHA1
087e6361ea5ed8a25ad423c4f35de13c71cb05d5

SHA256
e4913069d3bf4c036a8b01490e1e2328903525fe1bc53287f053e0566c153343

SHA512
a24a3c05c36dd0c3bce0b0261c8ce033038e7b90cf2909d2c759c6bd90ea016a76268f6372474fdaca73306dda113b3bebd307f8688a42e118fe35c192e9d11b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Filesize
337B

MD5
e4f359621db5a72cdeebdcae3216b75e

SHA1
b771f3fa72e011b8541c13ccaa53f796ddd57dfd

SHA256
54827a8a8dd81ee9ccb7b8a8053818a95fb14bc3e85984f695224f003efd147e

SHA512
a5bc2b87266db2b809e7213440549a9188833bf00f52e268dd9f8785da3dbb15b626db8963259522a1b061e43f5ad48d30395ba674b0efbb70142f881eb67b8f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_0

Filesize
44KB

MD5
28207754786deba802ac8dab7e63b620

SHA1
1124f103f129492b08882b78b4a2ed0a8ff28e8e

SHA256
ee783cd2d0e1c9d528ffade7dd082314472d82001930285903c2ef26bf349d32

SHA512
28beaffbd811b96bece8e5e89265059319672a65a7ba7a18f41018ead4b100ad07bbd5e9d7f0f2fd46bb05b0134685f1fd6caa032e2d5b91557dccba9f0bd896

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_1

Filesize
264KB

MD5
4d635a788ea699a3162f294e7c23c009

SHA1
4a9581736a8bd01a5c734941b6f97ee6eb4b9b79

SHA256
e2f38038faf02e84b63106d83a55542b5adc89b53904881784d7d82661b1c2c0

SHA512
f7db4d08023c846b083768754c579fa5db95a2c59aa2acf464a2592a89d8beb7a9d814009709d66267bfeae33a1e57d14afa1bdf0d22cdcc19c56ff3bdce2d72

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_3

Filesize
4.0MB

MD5
6f8811bf3ef310f96d132a01ee75afdd

SHA1
de682afc524b5288e53df07a1983da1227017613

SHA256
34ceb180cd8eeb21278ab8dd3c1ee7c4650ffa2dd2a2ddba9cd9753e0ffc656f

SHA512
c73be21d13acd5415f63f01faa7981608f7598906f885061e59e3a02b15d4e533bc572e9a446ae302f063175d27aa25bfa6d3ba6543afcb789a1c288fa558e09

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Browser

Filesize
120B

MD5
a397e5983d4a1619e36143b4d804b870

SHA1
aa135a8cc2469cfd1ef2d7955f027d95be5dfbd4

SHA256
9c70f766d3b84fc2bb298efa37cc9191f28bec336329cc11468cfadbc3b137f4

SHA512
4159ea654152d2810c95648694dd71957c84ea825fcca87b36f7e3282a72b30ef741805c610c5fa847ca186e34bde9c289aaa7b6931c5b257f1d11255cd2a816

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version

Filesize
11B

MD5
838a7b32aefb618130392bc7d006aa2e

SHA1
5159e0f18c9e68f0e75e2239875aa994847b8290

SHA256
ac3dd2221d90b09b795f1f72e72e4860342a4508fe336c4b822476eb25a55eaa

SHA512
9e350f0565cc726f66146838f9cebaaa38dd01892ffab9a45fe4f72e5be5459c0442e99107293a7c6f2412c71f668242c5e5a502124bc57cbf3b6ad8940cb3e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
80d27bbc52f54b50d893d1b887e5bcd8

SHA1
370eeb83fcffaafd6d4902396fb837ba9532ffb4

SHA256
b152e1d8641395322cae3c68c1cacdb865239121c0bb89318cb6a9049b6c6e20

SHA512
d1aea3bdba8a273c0785dd7978699e0df9657d1ac38306b1436b075abe9b8a981b70caca868bca7474b9c9846c63fa64879e4b280bf022400b7dd8e6efeb47e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
2f2c532360b9fd36c12b34d1e704ea84

SHA1
4dd5633ae7e9dd9aaa9f1af032b6b79e1380b156

SHA256
dd13e765f88355886c46d4cf0fc303dc301ebbe1bbad51f9ca33a7ec4d1d1441

SHA512
e3804e2a74d217b551cd70b026fdc5526ddfbf05ba3ce7c390d4889c5bd24a6b9f59507910ff75209b5549fce5e27305d415de50532f4cf34d67ee7898b37bc6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\edge_shutdown_ms.txt

Filesize
4B

MD5
a38ae3870e24bb9cf3e29c102bb2d996

SHA1
722fa8c442264e4712611bb0b3f1a5cdd4910e57

SHA256
054e3f4b2827c61834e4419dae973ccf65ae02442398ca0e27b2ec45bd6132b6

SHA512
018ff28c5ec5937984ef2104c116c81a51a6175afa0d4019204d0ed85657a52d975b1213db7045a823230afdbada11b4c105a73398b62d8bcb16977cc2e36320

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\9cd93bc6dcf544bae69531052e64647ec02f2bb4.tbres

Filesize
4KB

MD5
0c1311b9a463017f42a60fce022d4db9

SHA1
fe87b57ecd9d4ad9b1d6a2977219f5e866bfac7b

SHA256
f312481a7c61b373ea0eb6111f09f18e18565a4d83e825dd62e32f3e352175c7

SHA512
c37c8637be7a6fbdbb247cd0b54794cda41154b7d3a889a1bed1d37fa41e93d5a40d1c78aa4a3666a3c32d740c464b69f663042e2b22654a7db0710c161b00b0

Download Submit
C:\Users\Admin\Downloads\240811_pw_infected (1)\2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e.exe

Filesize
118KB

MD5
9c08dfc58885a9a7beca989ea5ee9108

SHA1
ce2f51348da7a19dbf0e79b64f9eb8e46f45efa3

SHA256
2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e

SHA512
34cf39e4976f264f31b3236cca87aeca04ebc447fe99b35bbb72dd126462eed78310954fcdebab48b1f3ad9eaf5efe22ad8405b12d80ddd357244138067a1ae2

Download Submit
C:\Users\Admin\Downloads\240811_pw_infected.zip

Filesize
77KB

MD5
52e47f2362da95b968b20c06271a8108

SHA1
ecd7a536b1b15c0b77b936836a9425b14d32b5c5

SHA256
8de773cb0fe04f690b3b1f9b9f1dfc7ed96e662b4590a25e0dacfa3d32489bcb

SHA512
72309ef37816650e7a93b78cc911ae86b63d904938d9ccdde3cd85544573f200abdbaca534942c5e81bfe0f2d27e357ffebbcbf539971f5f45b1514dda53af02

Download Submit
C:\Users\Admin\ig520x30m-readme.txt

Filesize
8KB

MD5
45752e5bfcbc586185a6b2ed2e69e7a6

SHA1
c34ae500e5b0b2af9be3eb03f965945d50d4c7dc

SHA256
c72e6be4bac5029afdb9b701d27cf94403d55d1e676c9400bf00715fa8231a94

SHA512
27a5b86a8268a1223e1525422fe6206acf4b582c16e2ebe4255b4b4db628944147ab8e04affe9d8d1b9b3564e91314c3a95a4de4f19087534ac1b612bc6a023f

Download Submit