teslacrypt | b5a35f6dc7bc0708cfa5b5fb39472509eb81c22ccd93bdb563305164381a1d3e

Resubmissions

20-10-2024 16:47

241020-vaj5ps1blj 10

19-10-2024 22:18

241019-172znsvajm 10

Analysis

max time kernel
137s
max time network
136s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
20-10-2024 16:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5ef1fdd422951c153db8c39b87e84e5d_JaffaCakes118.exe
Size

356KB
MD5

5ef1fdd422951c153db8c39b87e84e5d
SHA1

a89966004343653b2d20c06b373b1390ed0450d3
SHA256

b5a35f6dc7bc0708cfa5b5fb39472509eb81c22ccd93bdb563305164381a1d3e
SHA512

94a775ab67babe692fd6cc6c597453f3607e39627579ec82575025a1c1aa3015a108418852a64d84e4fb8c2a5ef4b5619284b25d52a5790b5e3ef11153c11871
SSDEEP

6144:nOWcl+ocAAe1EAnT43osv0pnzKK+PDncAuLELquaWVzsHA93Wo8nswPm22fwh:nFeq0F+PzcOLyWRsHA93/oswe

Score

10^/10

teslacrypt defense_evasion discovery execution impact persistence ransomware spyware stealer

Malware Config

Extracted

Path

C:\Program Files\7-Zip\Lang\_ReCoVeRy_+pyaxf.txt

Family

teslacrypt

Ransom Note

NOT YOUR LANGUAGE? USE https://translate.google.com What happened to your files ? All of your files were protected by a strong encryption with RSA4096 More information about the encryption keys using RSA4096 can be found here: http://en.wikipedia.org/wiki/RSA_(cryptosystem) How did this happen ? !!! Specially for your PC was generated personal RSA4096 Key , both public and private. !!! ALL YOUR FILES were encrypted with the public key, which has been transferred to your computer via the Internet. !!! Decrypting of your files is only possible with the help of the private key and decrypt program , which is on our Secret Server What do I do ? So, there are two ways you can choose: wait for a miracle and get your price doubled, or start obtaining BITCOIN NOW! , and restore your data easy way. If You have really valuable data, you better not waste your time, because there is no other way to get your files, except make a payment. For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: 1 - http://sondr5344ygfweyjbfkw4fhsefv.heliofetch.at/B4FCA37DE78ABF9B 2 - http://pts764gt354fder34fsqw45gdfsavadfgsfg.kraskula.com/B4FCA37DE78ABF9B 3 - http://yyre45dbvn2nhbefbmh.begumvelic.at/B4FCA37DE78ABF9B If for some reasons the addresses are not available, follow these steps: 1 - Download and install tor-browser: http://www.torproject.org/projects/torbrowser.html.en 2 - After a successful installation, run the browser 3 - Type in the address bar: xlowfznrg4wf7dli.onion/B4FCA37DE78ABF9B 4 - Follow the instructions on the site IMPORTANT INFORMATION Your personal pages http://sondr5344ygfweyjbfkw4fhsefv.heliofetch.at/B4FCA37DE78ABF9B http://pts764gt354fder34fsqw45gdfsavadfgsfg.kraskula.com/B4FCA37DE78ABF9B http://yyre45dbvn2nhbefbmh.begumvelic.at/B4FCA37DE78ABF9B Your personal page Tor-Browser xlowfznrg4wf7dli.ONION/B4FCA37DE78ABF9B

URLs

http://sondr5344ygfweyjbfkw4fhsefv.heliofetch.at/B4FCA37DE78ABF9B

http://pts764gt354fder34fsqw45gdfsavadfgsfg.kraskula.com/B4FCA37DE78ABF9B

http://yyre45dbvn2nhbefbmh.begumvelic.at/B4FCA37DE78ABF9B

http://xlowfznrg4wf7dli.ONION/B4FCA37DE78ABF9B

Signatures

TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
ransomware teslacrypt
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Renames multiple (865) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops startup file 6 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_ReCoVeRy_+pyaxf.txt	ocpeumlfjhhx.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_ReCoVeRy_+pyaxf.html	ocpeumlfjhhx.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\_ReCoVeRy_+pyaxf.png	ocpeumlfjhhx.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\_ReCoVeRy_+pyaxf.txt	ocpeumlfjhhx.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\_ReCoVeRy_+pyaxf.html	ocpeumlfjhhx.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_ReCoVeRy_+pyaxf.png	ocpeumlfjhhx.exe

Executes dropped EXE 2 IoCs

pid	Process
3440	ocpeumlfjhhx.exe
1232	ocpeumlfjhhx.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000\Software\Microsoft\Windows\CurrentVersion\Run\vccmjhb = "C:\\Windows\\system32\\CMD.EXE /c start C:\\Windows\\ocpeumlfjhhx.exe"	ocpeumlfjhhx.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4672 set thread context of 3180	4672	5ef1fdd422951c153db8c39b87e84e5d_JaffaCakes118.exe	95
PID 3440 set thread context of 1232	3440	ocpeumlfjhhx.exe	110

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ks_IN\_ReCoVeRy_+pyaxf.txt	ocpeumlfjhhx.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Paint_10.2104.17.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\PaintStoreLogo.scale-125.png	ocpeumlfjhhx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_1.0.22.0_x64__8wekyb3d8bbwe\Assets\AppTiles\MapsSplashScreen.scale-200.png	ocpeumlfjhhx.exe
File opened for modification	C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\theme\node_modules\@uifabric\utilities\lib-commonjs\Rectangle.js	ocpeumlfjhhx.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\uk-UA\_ReCoVeRy_+pyaxf.html	ocpeumlfjhhx.exe
File opened for modification	C:\Program Files\7-Zip\Lang\co.txt	ocpeumlfjhhx.exe
File opened for modification	C:\Program Files\dotnet\shared\_ReCoVeRy_+pyaxf.png	ocpeumlfjhhx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxIdentityProvider_12.50.6001.0_x64__8wekyb3d8bbwe\_ReCoVeRy_+pyaxf.txt	ocpeumlfjhhx.exe
File opened for modification	C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\react\lib-amd\components\DocumentCard\DocumentCardActions.base.js	ocpeumlfjhhx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppPackageAppList.targetsize-16_altform-unplated_contrast-black.png	ocpeumlfjhhx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Paint_10.2104.17.0_x64__8wekyb3d8bbwe\Assets\contrast-black\PaintAppList.targetsize-80_altform-lightunplated.png	ocpeumlfjhhx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.6.3102.0_x64__8wekyb3d8bbwe\Win10\MicrosoftSolitaireAppList.targetsize-48_altform-unplated.png	ocpeumlfjhhx.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\OutlookMailLargeTile.scale-150.png	ocpeumlfjhhx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.21012.10511.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-black\iheart-radio.scale-125_contrast-black.png	ocpeumlfjhhx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.40831.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-256_altform-unplated.png	ocpeumlfjhhx.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\Theme_Illustration_Seasons_Spring_Right_Dark.png	ocpeumlfjhhx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsStore_12104.1001.1.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\StoreAppList.targetsize-60_altform-unplated.png	ocpeumlfjhhx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.6.3102.0_x64__8wekyb3d8bbwe\Win10\contrast-black\_ReCoVeRy_+pyaxf.html	ocpeumlfjhhx.exe
File opened for modification	C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\theme\lib-commonjs\types\_ReCoVeRy_+pyaxf.txt	ocpeumlfjhhx.exe
File opened for modification	C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\theme\node_modules\@uifabric\utilities\lib-commonjs\IStyleFunction.js	ocpeumlfjhhx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_4.0.2.0_x64__8wekyb3d8bbwe\Assets\Icons\StickyNotesWideTile.scale-200_contrast-white.png	ocpeumlfjhhx.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\OutOfOffice.scale-200_contrast-white.png	ocpeumlfjhhx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsNotepad_10.2102.13.0_x64__8wekyb3d8bbwe\Assets\contrast-black\NotepadAppList.targetsize-20_altform-unplated.png	ocpeumlfjhhx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Xbox.TCUI_1.23.28002.0_x64__8wekyb3d8bbwe\Assets\_ReCoVeRy_+pyaxf.html	ocpeumlfjhhx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Paint_10.2104.17.0_x64__8wekyb3d8bbwe\AppxMetadata\_ReCoVeRy_+pyaxf.html	ocpeumlfjhhx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.32731.0_x64__8wekyb3d8bbwe\Assets\contrast-white\SmallTile.scale-100_contrast-white.png	ocpeumlfjhhx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\Images\StoreLogo.scale-400.png	ocpeumlfjhhx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.21012.10511.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-30_altform-unplated_contrast-black.png	ocpeumlfjhhx.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\de-DE\_ReCoVeRy_+pyaxf.png	ocpeumlfjhhx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsNotepad_10.2102.13.0_x64__8wekyb3d8bbwe\Assets\contrast-black\NotepadAppList.targetsize-30.png	ocpeumlfjhhx.exe
File opened for modification	C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\react\lib-commonjs\Fabric.js	ocpeumlfjhhx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Paint_10.2104.17.0_x64__8wekyb3d8bbwe\Assets\contrast-black\PaintAppList.targetsize-30_altform-lightunplated.png	ocpeumlfjhhx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.40831.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\StoreLogo.scale-125_contrast-white.png	ocpeumlfjhhx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_2021.427.1821.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\_ReCoVeRy_+pyaxf.png	ocpeumlfjhhx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.21012.10511.0_x64__8wekyb3d8bbwe\AppxMetadata\_ReCoVeRy_+pyaxf.txt	ocpeumlfjhhx.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\en\_ReCoVeRy_+pyaxf.html	ocpeumlfjhhx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.41182.0_x64__8wekyb3d8bbwe\Assets\AppList.scale-400.png	ocpeumlfjhhx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_21.21030.25003.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.targetsize-60_altform-lightunplated.png	ocpeumlfjhhx.exe
File opened for modification	C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\react\lib\Announced.js	ocpeumlfjhhx.exe
File opened for modification	C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\react\lib-amd\components\DocumentCard\DocumentCardDetails.base.js	ocpeumlfjhhx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.People_10.1909.12456.0_x64__8wekyb3d8bbwe\Assets\contrast-black\PeopleMedTile.scale-200.png	ocpeumlfjhhx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.29231.0_x64__8wekyb3d8bbwe\_ReCoVeRy_+pyaxf.html	ocpeumlfjhhx.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\contrast-white\GenericMailMediumTile.scale-150.png	ocpeumlfjhhx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingNews_1.0.6.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\NewsMedTile.scale-200_contrast-black.png	ocpeumlfjhhx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_1.0.6.0_x64__8wekyb3d8bbwe\Assets\AppTiles\_ReCoVeRy_+pyaxf.txt	ocpeumlfjhhx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_1.0.6.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\WeatherAppList.targetsize-60_altform-unplated_contrast-black.png	ocpeumlfjhhx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Paint_10.2104.17.0_x64__8wekyb3d8bbwe\Assets\contrast-black\PaintAppList.targetsize-20_altform-lightunplated.png	ocpeumlfjhhx.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\contrast-black\HxCalendarAppList.targetsize-60_altform-unplated.png	ocpeumlfjhhx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.21012.10511.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-32_altform-unplated_contrast-white.png	ocpeumlfjhhx.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-white_scale-100.png	ocpeumlfjhhx.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft\_ReCoVeRy_+pyaxf.html	ocpeumlfjhhx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_2.2106.2807.0_x64__8wekyb3d8bbwe\Assets\Store\AppIcon.altform-unplated_targetsize-32.png	ocpeumlfjhhx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingNews_1.0.6.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\NewsAppList.targetsize-256_altform-unplated_contrast-white.png	ocpeumlfjhhx.exe
File opened for modification	C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\react\lib-commonjs\SelectedItemsList.js	ocpeumlfjhhx.exe
File opened for modification	C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\theme\lib\types\ITheme.js	ocpeumlfjhhx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.21012.10511.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-96_altform-lightunplated_contrast-black.png	ocpeumlfjhhx.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Sort\_ReCoVeRy_+pyaxf.png	ocpeumlfjhhx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.GetHelp_10.2008.32311.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\_ReCoVeRy_+pyaxf.txt	ocpeumlfjhhx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_21.21030.25003.0_neutral_split.scale-100_8wekyb3d8bbwe\_ReCoVeRy_+pyaxf.png	ocpeumlfjhhx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsStore_12104.1001.1.0_x64__8wekyb3d8bbwe\Assets\AppTiles\StoreAppList.targetsize-32.png	ocpeumlfjhhx.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\Theme_Photo_AutumnLeaves_Thumbnail_Dark.jpg	ocpeumlfjhhx.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\Theme_Photo_DeepSea_Background.jpg	ocpeumlfjhhx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.21012.10511.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-16.png	ocpeumlfjhhx.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\contrast-white\OutlookMailLargeTile.scale-125.png	ocpeumlfjhhx.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp	setup.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\metadata	setup.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\settings.dat	setup.exe
File created	C:\Windows\ocpeumlfjhhx.exe	5ef1fdd422951c153db8c39b87e84e5d_JaffaCakes118.exe
File opened for modification	C:\Windows\ocpeumlfjhhx.exe	5ef1fdd422951c153db8c39b87e84e5d_JaffaCakes118.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NOTEPAD.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5ef1fdd422951c153db8c39b87e84e5d_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5ef1fdd422951c153db8c39b87e84e5d_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ocpeumlfjhhx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ocpeumlfjhhx.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133739164591666406"	chrome.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings	ocpeumlfjhhx.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
3968	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3184	chrome.exe
3184	chrome.exe
1232	ocpeumlfjhhx.exe
1232	ocpeumlfjhhx.exe
1232	ocpeumlfjhhx.exe
1232	ocpeumlfjhhx.exe
1232	ocpeumlfjhhx.exe
1232	ocpeumlfjhhx.exe
1232	ocpeumlfjhhx.exe
1232	ocpeumlfjhhx.exe
1232	ocpeumlfjhhx.exe
1232	ocpeumlfjhhx.exe
1232	ocpeumlfjhhx.exe
1232	ocpeumlfjhhx.exe
1232	ocpeumlfjhhx.exe
1232	ocpeumlfjhhx.exe
1232	ocpeumlfjhhx.exe
1232	ocpeumlfjhhx.exe
1232	ocpeumlfjhhx.exe
1232	ocpeumlfjhhx.exe
1232	ocpeumlfjhhx.exe
1232	ocpeumlfjhhx.exe
1232	ocpeumlfjhhx.exe
1232	ocpeumlfjhhx.exe
1232	ocpeumlfjhhx.exe
1232	ocpeumlfjhhx.exe
1232	ocpeumlfjhhx.exe
1232	ocpeumlfjhhx.exe
1232	ocpeumlfjhhx.exe
1232	ocpeumlfjhhx.exe
1232	ocpeumlfjhhx.exe
1232	ocpeumlfjhhx.exe
1232	ocpeumlfjhhx.exe
1232	ocpeumlfjhhx.exe
1232	ocpeumlfjhhx.exe
1232	ocpeumlfjhhx.exe
1232	ocpeumlfjhhx.exe
1232	ocpeumlfjhhx.exe
1232	ocpeumlfjhhx.exe
1232	ocpeumlfjhhx.exe
1232	ocpeumlfjhhx.exe
1232	ocpeumlfjhhx.exe
1232	ocpeumlfjhhx.exe
1232	ocpeumlfjhhx.exe
1232	ocpeumlfjhhx.exe
1232	ocpeumlfjhhx.exe
1232	ocpeumlfjhhx.exe
1232	ocpeumlfjhhx.exe
1232	ocpeumlfjhhx.exe
1232	ocpeumlfjhhx.exe
1232	ocpeumlfjhhx.exe
1232	ocpeumlfjhhx.exe
1232	ocpeumlfjhhx.exe
1232	ocpeumlfjhhx.exe
1232	ocpeumlfjhhx.exe
1232	ocpeumlfjhhx.exe
1232	ocpeumlfjhhx.exe
1232	ocpeumlfjhhx.exe
1232	ocpeumlfjhhx.exe
1232	ocpeumlfjhhx.exe
1232	ocpeumlfjhhx.exe
1232	ocpeumlfjhhx.exe
1232	ocpeumlfjhhx.exe
1232	ocpeumlfjhhx.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3480	msedge.exe
3480	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3184	chrome.exe
Token: SeCreatePagefilePrivilege	3184	chrome.exe
Token: SeShutdownPrivilege	3184	chrome.exe
Token: SeCreatePagefilePrivilege	3184	chrome.exe
Token: SeShutdownPrivilege	3184	chrome.exe
Token: SeCreatePagefilePrivilege	3184	chrome.exe
Token: SeShutdownPrivilege	3184	chrome.exe
Token: SeCreatePagefilePrivilege	3184	chrome.exe
Token: SeShutdownPrivilege	3184	chrome.exe
Token: SeCreatePagefilePrivilege	3184	chrome.exe
Token: SeShutdownPrivilege	3184	chrome.exe
Token: SeCreatePagefilePrivilege	3184	chrome.exe
Token: SeShutdownPrivilege	3184	chrome.exe
Token: SeCreatePagefilePrivilege	3184	chrome.exe
Token: SeShutdownPrivilege	3184	chrome.exe
Token: SeCreatePagefilePrivilege	3184	chrome.exe
Token: SeShutdownPrivilege	3184	chrome.exe
Token: SeCreatePagefilePrivilege	3184	chrome.exe
Token: SeShutdownPrivilege	3184	chrome.exe
Token: SeCreatePagefilePrivilege	3184	chrome.exe
Token: SeShutdownPrivilege	3184	chrome.exe
Token: SeCreatePagefilePrivilege	3184	chrome.exe
Token: SeShutdownPrivilege	3184	chrome.exe
Token: SeCreatePagefilePrivilege	3184	chrome.exe
Token: SeShutdownPrivilege	3184	chrome.exe
Token: SeCreatePagefilePrivilege	3184	chrome.exe
Token: SeShutdownPrivilege	3184	chrome.exe
Token: SeCreatePagefilePrivilege	3184	chrome.exe
Token: SeShutdownPrivilege	3184	chrome.exe
Token: SeCreatePagefilePrivilege	3184	chrome.exe
Token: SeShutdownPrivilege	3184	chrome.exe
Token: SeCreatePagefilePrivilege	3184	chrome.exe
Token: SeShutdownPrivilege	3184	chrome.exe
Token: SeCreatePagefilePrivilege	3184	chrome.exe
Token: SeShutdownPrivilege	3184	chrome.exe
Token: SeCreatePagefilePrivilege	3184	chrome.exe
Token: SeDebugPrivilege	3180	5ef1fdd422951c153db8c39b87e84e5d_JaffaCakes118.exe
Token: SeShutdownPrivilege	3184	chrome.exe
Token: SeCreatePagefilePrivilege	3184	chrome.exe
Token: SeShutdownPrivilege	3184	chrome.exe
Token: SeCreatePagefilePrivilege	3184	chrome.exe
Token: SeShutdownPrivilege	3184	chrome.exe
Token: SeCreatePagefilePrivilege	3184	chrome.exe
Token: SeShutdownPrivilege	3184	chrome.exe
Token: SeCreatePagefilePrivilege	3184	chrome.exe
Token: SeShutdownPrivilege	3184	chrome.exe
Token: SeCreatePagefilePrivilege	3184	chrome.exe
Token: SeShutdownPrivilege	3184	chrome.exe
Token: SeCreatePagefilePrivilege	3184	chrome.exe
Token: SeShutdownPrivilege	3184	chrome.exe
Token: SeCreatePagefilePrivilege	3184	chrome.exe
Token: SeShutdownPrivilege	3184	chrome.exe
Token: SeCreatePagefilePrivilege	3184	chrome.exe
Token: SeShutdownPrivilege	3184	chrome.exe
Token: SeCreatePagefilePrivilege	3184	chrome.exe
Token: SeShutdownPrivilege	3184	chrome.exe
Token: SeCreatePagefilePrivilege	3184	chrome.exe
Token: SeDebugPrivilege	1232	ocpeumlfjhhx.exe
Token: SeIncreaseQuotaPrivilege	2764	WMIC.exe
Token: SeSecurityPrivilege	2764	WMIC.exe
Token: SeTakeOwnershipPrivilege	2764	WMIC.exe
Token: SeLoadDriverPrivilege	2764	WMIC.exe
Token: SeSystemProfilePrivilege	2764	WMIC.exe
Token: SeSystemtimePrivilege	2764	WMIC.exe

Suspicious use of FindShellTrayWindow 53 IoCs

pid	Process
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4876	OpenWith.exe
4876	OpenWith.exe
4876	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3184 wrote to memory of 4088	3184	chrome.exe	81
PID 3184 wrote to memory of 4088	3184	chrome.exe	81
PID 3184 wrote to memory of 3132	3184	chrome.exe	82
PID 3184 wrote to memory of 3132	3184	chrome.exe	82
PID 3184 wrote to memory of 3132	3184	chrome.exe	82
PID 3184 wrote to memory of 3132	3184	chrome.exe	82
PID 3184 wrote to memory of 3132	3184	chrome.exe	82
PID 3184 wrote to memory of 3132	3184	chrome.exe	82
PID 3184 wrote to memory of 3132	3184	chrome.exe	82
PID 3184 wrote to memory of 3132	3184	chrome.exe	82
PID 3184 wrote to memory of 3132	3184	chrome.exe	82
PID 3184 wrote to memory of 3132	3184	chrome.exe	82
PID 3184 wrote to memory of 3132	3184	chrome.exe	82
PID 3184 wrote to memory of 3132	3184	chrome.exe	82
PID 3184 wrote to memory of 3132	3184	chrome.exe	82
PID 3184 wrote to memory of 3132	3184	chrome.exe	82
PID 3184 wrote to memory of 3132	3184	chrome.exe	82
PID 3184 wrote to memory of 3132	3184	chrome.exe	82
PID 3184 wrote to memory of 3132	3184	chrome.exe	82
PID 3184 wrote to memory of 3132	3184	chrome.exe	82
PID 3184 wrote to memory of 3132	3184	chrome.exe	82
PID 3184 wrote to memory of 3132	3184	chrome.exe	82
PID 3184 wrote to memory of 3132	3184	chrome.exe	82
PID 3184 wrote to memory of 3132	3184	chrome.exe	82
PID 3184 wrote to memory of 3132	3184	chrome.exe	82
PID 3184 wrote to memory of 3132	3184	chrome.exe	82
PID 3184 wrote to memory of 3132	3184	chrome.exe	82
PID 3184 wrote to memory of 3132	3184	chrome.exe	82
PID 3184 wrote to memory of 3132	3184	chrome.exe	82
PID 3184 wrote to memory of 3132	3184	chrome.exe	82
PID 3184 wrote to memory of 3132	3184	chrome.exe	82
PID 3184 wrote to memory of 3132	3184	chrome.exe	82
PID 3184 wrote to memory of 2452	3184	chrome.exe	83
PID 3184 wrote to memory of 2452	3184	chrome.exe	83
PID 3184 wrote to memory of 4772	3184	chrome.exe	84
PID 3184 wrote to memory of 4772	3184	chrome.exe	84
PID 3184 wrote to memory of 4772	3184	chrome.exe	84
PID 3184 wrote to memory of 4772	3184	chrome.exe	84
PID 3184 wrote to memory of 4772	3184	chrome.exe	84
PID 3184 wrote to memory of 4772	3184	chrome.exe	84
PID 3184 wrote to memory of 4772	3184	chrome.exe	84
PID 3184 wrote to memory of 4772	3184	chrome.exe	84
PID 3184 wrote to memory of 4772	3184	chrome.exe	84
PID 3184 wrote to memory of 4772	3184	chrome.exe	84
PID 3184 wrote to memory of 4772	3184	chrome.exe	84
PID 3184 wrote to memory of 4772	3184	chrome.exe	84
PID 3184 wrote to memory of 4772	3184	chrome.exe	84
PID 3184 wrote to memory of 4772	3184	chrome.exe	84
PID 3184 wrote to memory of 4772	3184	chrome.exe	84
PID 3184 wrote to memory of 4772	3184	chrome.exe	84
PID 3184 wrote to memory of 4772	3184	chrome.exe	84
PID 3184 wrote to memory of 4772	3184	chrome.exe	84
PID 3184 wrote to memory of 4772	3184	chrome.exe	84
PID 3184 wrote to memory of 4772	3184	chrome.exe	84
PID 3184 wrote to memory of 4772	3184	chrome.exe	84
PID 3184 wrote to memory of 4772	3184	chrome.exe	84
PID 3184 wrote to memory of 4772	3184	chrome.exe	84
PID 3184 wrote to memory of 4772	3184	chrome.exe	84
PID 3184 wrote to memory of 4772	3184	chrome.exe	84
PID 3184 wrote to memory of 4772	3184	chrome.exe	84
PID 3184 wrote to memory of 4772	3184	chrome.exe	84
PID 3184 wrote to memory of 4772	3184	chrome.exe	84
PID 3184 wrote to memory of 4772	3184	chrome.exe	84
PID 3184 wrote to memory of 4772	3184	chrome.exe	84

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	ocpeumlfjhhx.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1"	ocpeumlfjhhx.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\5ef1fdd422951c153db8c39b87e84e5d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\5ef1fdd422951c153db8c39b87e84e5d_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:4672
- C:\Users\Admin\AppData\Local\Temp\5ef1fdd422951c153db8c39b87e84e5d_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\5ef1fdd422951c153db8c39b87e84e5d_JaffaCakes118.exe"
  2⤵
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:3180
- - C:\Windows\ocpeumlfjhhx.exe
    C:\Windows\ocpeumlfjhhx.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    PID:3440
  - - C:\Windows\ocpeumlfjhhx.exe
      C:\Windows\ocpeumlfjhhx.exe
      4⤵
      Drops startup file
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      System policy modification
      PID:1232
    - - C:\Windows\System32\wbem\WMIC.exe
        
        "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /nointeractive
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2764
    - - C:\Windows\SysWOW64\NOTEPAD.EXE
        
        "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\_ReCoVeRy_.TXT
        5⤵
        System Location Discovery: System Language Discovery
        Opens file in notepad (likely ransom note)
        
        PID:3968
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\_ReCoVeRy_.HTM
        5⤵
        Enumerates system info in registry
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:3480
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fffca8d3cb8,0x7fffca8d3cc8,0x7fffca8d3cd8
        6⤵
        
        PID:4596
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,17206380950700449362,1595561866315801422,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2064 /prefetch:2
        6⤵
        
        PID:4824
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2052,17206380950700449362,1595561866315801422,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 /prefetch:3
        6⤵
        
        PID:3716
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2052,17206380950700449362,1595561866315801422,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2744 /prefetch:8
        6⤵
        
        PID:336
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,17206380950700449362,1595561866315801422,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3140 /prefetch:1
        6⤵
        
        PID:300
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,17206380950700449362,1595561866315801422,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3112 /prefetch:1
        6⤵
        
        PID:492
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=2052,17206380950700449362,1595561866315801422,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4376 /prefetch:8
        6⤵
        
        PID:4412
      - C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,17206380950700449362,1595561866315801422,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4852 /prefetch:8
        6⤵
        
        PID:992
    - - C:\Windows\System32\wbem\WMIC.exe
        
        "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /nointeractive
        5⤵
        
        PID:2624
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c DEL C:\Windows\OCPEUM~1.EXE
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4952
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\AppData\Local\Temp\5EF1FD~1.EXE
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3164

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3184
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffdc36cc40,0x7fffdc36cc4c,0x7fffdc36cc58
  2⤵
  PID:4088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1804,i,9899061435320458199,2019742578885451788,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1800 /prefetch:2
  2⤵
  PID:3132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2080,i,9899061435320458199,2019742578885451788,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2140 /prefetch:3
  2⤵
  PID:2452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2200,i,9899061435320458199,2019742578885451788,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2244 /prefetch:8
  2⤵
  PID:4772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3112,i,9899061435320458199,2019742578885451788,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:2380
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3180,i,9899061435320458199,2019742578885451788,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4456,i,9899061435320458199,2019742578885451788,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4444 /prefetch:1
  2⤵
  PID:580
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4760,i,9899061435320458199,2019742578885451788,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4768 /prefetch:8
  2⤵
  PID:768
- C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe
  "C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe" --reenable-autoupdates --system-level
  2⤵
  - Drops file in Windows directory
  PID:1700
- - C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe
    "C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x244,0x248,0x24c,0x220,0x250,0x7ff6ec914698,0x7ff6ec9146a4,0x7ff6ec9146b0
    3⤵
    - Drops file in Windows directory
    PID:3700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=4312,i,9899061435320458199,2019742578885451788,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4792 /prefetch:1
  2⤵
  PID:4648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=4472,i,9899061435320458199,2019742578885451788,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4304 /prefetch:1
  2⤵
  PID:4000
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=3432,i,9899061435320458199,2019742578885451788,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:2944

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:956

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2184

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\ResizeSuspend.cmd" "
1⤵
PID:5076

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004D4 0x00000000000004CC
1⤵
PID:4536

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:1296

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:4940

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4876

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Documents\_ReCoVeRy_+pyaxf.txt
1⤵
PID:4876

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2500

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2760

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
PID:312
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffdc36cc40,0x7fffdc36cc4c,0x7fffdc36cc58
  2⤵
  PID:3744

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
PID:1016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xfc,0x100,0x104,0xdc,0x108,0x7fffdc36cc40,0x7fffdc36cc4c,0x7fffdc36cc58
  2⤵
  PID:824

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\Lang\_ReCoVeRy_+pyaxf.html

Filesize
12KB

MD5
fd2ce57984c1faf7e64929b30f1b8921

SHA1
597c185421dbfaaa6fa2c7f981b04296e92ce490

SHA256
daaec48167aee0db73c942af54be9c525b56d2043556f575e94a19700b4ec498

SHA512
8a7cc198231146aefd105ec313a21520fea4a4d06d144c9f76ea81927d218673490c86fb5e20da79ae6b10c21a52f23b4da72401c63032e702068cdb5242d020

Download Submit
C:\Program Files\7-Zip\Lang\_ReCoVeRy_+pyaxf.png

Filesize
65KB

MD5
ae349cbbb630fe5dd1636a1255aa438d

SHA1
aaeb8e3ae93203816005db2c9c9cd9127ecbebb1

SHA256
05d38e6a39e4a8e50c926ef9d685010377162beb273deed24572cb8e750d3521

SHA512
f131f76e52ddd30db61bfae91254a40dcf0385b61b71a682d74fd34c9b8d804076de301505983f1caed2a8c8faf03e70f79957f4851e46f458e9b79476d2e871

Download Submit
C:\Program Files\7-Zip\Lang\_ReCoVeRy_+pyaxf.txt

Filesize
1KB

MD5
b78394437ede6ad016a03a1e4cf98b6c

SHA1
246dc449b73b7b99bdac2406da99768bf268b68c

SHA256
97631491e943a124d8780cb8c3ac60ab69aa97797a70da20f6520ec0a830cb82

SHA512
fba72c2815c282d7e95cccc3a23781b2adcc11846545dbf5ac03f349ca0c58dd73718227d1e2c1ccf522e9fd2cf3eee671e01645638d2ccafad6adaba2ad9115

Download Submit
C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt

Filesize
560B

MD5
4b52a3948944cc39bf21fe586d6f1075

SHA1
48a97e336ce740a556b884d4f6b96c11d8b9cd92

SHA256
20eb6a38d38f8509889ed08d7575c6b0d2d2d61bfe19e69d7d89b7dac3b6eb91

SHA512
bfd2e17c3b3bcb0cf578767a7d33117528a9bf06a113b1c3f2e501611c4eaf919e6b09f4c83b946464e743d29a4eb4c7de687604cea8c10efc8b17959968ac53

Download Submit
C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt

Filesize
560B

MD5
701ad414c92ea24db75aed17c375578e

SHA1
f98fa7d3083c6d2dbb091919c0042bfcd8d0a02f

SHA256
11f103e6193854542a7e2bacddf6899c8233684bb04def5ba39b258adc5f0fed

SHA512
4a8d13c8413cb66dc7d1d5d2bec481895707ae9f03eb853cce0751ef8fcdbe84a079b30faa0d863e4f257f1b5da79bf6ae260dcf047f85eb1fecdaf9ef678b1a

Download Submit
C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub2019_eula.txt

Filesize
416B

MD5
ac10c3744f5598303cf1c3ab148188dc

SHA1
9b6cc36e12a70af85b324c53748ac7d906078227

SHA256
c0a1e8a5a37c9aa3ba91f1d51182d7525c79b5bade49dde30f03d88dab55ba33

SHA512
3c0cb79abc4e9e637cf910f1bd47eb86f9fe3a505349baaf39c25b49f525294073a0d29383cef892ee8ab8cafef93dc92ebf6039f79fab901589fa48b2b6b3d4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\metadata

Filesize
114B

MD5
eebca33b9e4d62c49382c2c4d53cd7f8

SHA1
22a7dff519d9c4854e3a33e1245af62b2353b5a6

SHA256
b901cfb2b04efc7485205a2686e7a486cdc1c0237af8396e96c5a7236decbe0c

SHA512
62ed3c09f1aa7519d5208dabf0984d6df712ef1a1037945ea9095d4451b1afd82500bc8e217caf5bf35d13e027e87de436c862ecd27ae778bc2c7be4bf485fb9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\reports\6185e3bb-fc8e-44d7-ba06-c9a8286cbe2f.dmp

Filesize
159KB

MD5
29e293bc65f4e149e6f51807ba6d4c7b

SHA1
48f771e46d83e196701d093306882c23ff146bfb

SHA256
2c0b30f610bf9495856dcff2996a51a1687ed8f29d07d43d45529190f5c54329

SHA512
a356c41a3f24019db2439077253d0e5e660aeb423a864d622b9ba889d41ae24e1df54e82b2bdbe1f3d27a660239bc4a730a449de8860dfdd5b448931f462f937

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

Filesize
40B

MD5
46b257e2db3a3cab4fe4e8b36a53c612

SHA1
2327a773bca75530bc9bd7c74ef0ec3acbf99adf

SHA256
e7c310337da9c0b11f73414f116c230092a508f82fe7a57d2fb80a16d1d0973f

SHA512
6c9cdbac647aa323073edce54767cff14c7d54ae4b41034980833ccf8567d05985fb9a148772241f9a070622951af71e0cd943dddc1bbf445dc1c217393855e2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
7b772966705930ff11e2cb2ab543b13e

SHA1
e0b036bbc542b45af50a2b4b513280cb8750e64d

SHA256
7f481086f70b2c261bda0e7f5edb79500e209c6ce4d2f0773d0931680130ee42

SHA512
ce9b3f1549b84d47d5e663c55d783c929e93bed0d05fe5bbea2b8e76bf973b23c403acf442d50982b821d00563cccf70d54fff47dbbf569dacda0b2138c37fe7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
572ac96ff94401886960e92f142d929d

SHA1
73cd382c16abdfe125c184b608f75ed0dc214a5a

SHA256
f555e4ecfb05f3fec2678c321f8f91b2147877f9937b17d2cbfaab30216235d9

SHA512
5ac2b3e2742b68262b66c6fb402576027c17459f04f085b6bf8a454cd6cbda172515a9698a464b9ddfdf71a33946df6b0f591ae9d4df9e2f31156b59c252fc5a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
74c2fd91640858261649900a021e48f6

SHA1
d9be08ed7141162266c2d784f0523991ff996cab

SHA256
e5b8bff1da4cc6abe0ca7e93f87dd11b1652049f96cee55518e4a375edfaeba6

SHA512
f7422795ffc693162904c24fc57095a28ad22ea62b3117c0e0bcbee63bd6c8d5b439949404772e4ce85523c6f7cf00467784185b7b0db8416467c5b5f590dccf

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
66ca5dfb395343eb32b2e2631de20b03

SHA1
a24030e69001abaea9cc1c46ef48359ed8d706f5

SHA256
0d0ea3a8162dd6504a699b7a47b0c2c15716915a7aea28c4e99bdf6529326d78

SHA512
c2ce73e5eb77719851e32e5b1e73d11effa4c5b8e04158fc8533a5aa9e89f4817910c20bb16badaebbd8a9b2f3d1ed52e99562948925fe897dad83e40a034c76

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
228KB

MD5
95fe40c1ca1b43194fd5954786948592

SHA1
322a3d0d9a913022a58c36ffd80f034a33d09d8c

SHA256
a5f7230149707310da5cebac6449d194dc53566639016fef7fa3dd5ae542be1f

SHA512
6e2f35a6aa3d1cac40d05d6d7f8b8b1370d95f41cecc4407a87aa69344d467c67667ee542b44fac6cf1a7407f26f87db9497b8ec928524c9c80e678f267db1fd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
228KB

MD5
ffb62a3097281acd418217b2bc5f33e9

SHA1
e08f9561f6f54a883f681d4667546a2a234cf9fd

SHA256
e45c1127ca92e67a93b23a50e53e230ef9132a8475bf4f7eb084438d2f638af7

SHA512
37ade05f127c2fba9d9de57fd7bd5c5c89f62f322ba8800e0c9d62dbd8cec78016c82d9095c63b44a6ca4f042e1f41a7b8515fdd2d3aa92e357ea250ab27c5ee

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Variations

Filesize
86B

MD5
961e3604f228b0d10541ebf921500c86

SHA1
6e00570d9f78d9cfebe67d4da5efe546543949a7

SHA256
f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed

SHA512
535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Variations

Filesize
86B

MD5
f732dbed9289177d15e236d0f8f2ddd3

SHA1
53f822af51b014bc3d4b575865d9c3ef0e4debde

SHA256
2741df9ee9e9d9883397078f94480e9bc1d9c76996eec5cfe4e77929337cbe93

SHA512
b64e5021f32e26c752fcba15a139815894309b25644e74ceca46a9aa97070bca3b77ded569a9bfd694193d035ba75b61a8d6262c8e6d5c4d76b452b38f5150a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c03d23a8155753f5a936bd7195e475bc

SHA1
cdf47f410a3ec000e84be83a3216b54331679d63

SHA256
6f5f7996d9b0e131dc2fec84859b7a8597c11a67dd41bdb5a5ef21a46e1ae0ca

SHA512
6ea9a631b454d7e795ec6161e08dbe388699012dbbc9c8cfdf73175a0ecd51204d45cf28a6f1706c8d5f1780666d95e46e4bc27752da9a9d289304f1d97c2f41

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
3d68c7edc2a288ee58e6629398bb9f7c

SHA1
6c1909dea9321c55cae38b8f16bd9d67822e2e51

SHA256
dfd733ed3cf4fb59f2041f82fdf676973783ffa75b9acca095609c7d4f73587b

SHA512
0eda66a07ec4cdb46b0f27d6c8cc157415d803af610b7430adac19547e121f380b9c6a2840f90fe49eaea9b48fa16079d93833c2bcf4b85e3c401d90d464ad2f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
bf2fa223dec23a6d51e38ab934f7c2ea

SHA1
fab5d4833c2ee22dd2fc6496a3d4e2612705bbc5

SHA256
f29b8293cb24598d2553bfb4d1e521c2184c64d66aee873c9f69aed08236075f

SHA512
7a2eee15d2bb2457917d5d02f0d5632090000d619be5a4b19cd4cf1d6f517fef369f96fa9c8ab9ceed546630d3e0971194564fe8e90496665e2da419bfa396dc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
c21511446bbbf5fc0730081c13e468e3

SHA1
e825f1ffc91475bb373e3e2ecfd9e24aaa89bce1

SHA256
c1747231c83eefc10f13df38beb0869d1dcefb2b103b082a744c950f5ea1fdb3

SHA512
cf851885e723541c83243c3987e130cbd3accd39ed62e92fb6b915d3690045d04f29051029a8e701f1c0c1bf07bcd7c847ac6058ce7c02e7d7a28fbb1f2b7279

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
b75b184d167bb1ecc174517bc5094095

SHA1
375966822056027137ef7eb3377aa725c38ae636

SHA256
755f4c328e75428ebce6d19a8c9ed5d863ef87e9a2d4883a3e49315f66039b4f

SHA512
b4c6658f009058704de3039630088340f3f425a3412f105e3049612dc13f4b0d2f5780bc15e9ca0a4a85a76b827c5c3dae8e87e32ee134f4ee647ed720264d73

Download Submit
C:\Windows\ocpeumlfjhhx.exe

Filesize
356KB

MD5
5ef1fdd422951c153db8c39b87e84e5d

SHA1
a89966004343653b2d20c06b373b1390ed0450d3

SHA256
b5a35f6dc7bc0708cfa5b5fb39472509eb81c22ccd93bdb563305164381a1d3e

SHA512
94a775ab67babe692fd6cc6c597453f3607e39627579ec82575025a1c1aa3015a108418852a64d84e4fb8c2a5ef4b5619284b25d52a5790b5e3ef11153c11871

Download Submit
memory/1232-10790-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/1232-8422-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/1232-10778-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/1232-10781-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/1232-10789-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/1232-10953-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/1232-5275-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/1232-3473-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/1232-2699-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/1232-169-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/1232-166-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/1232-165-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/1232-163-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/3180-56-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/3180-50-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/3180-48-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/4672-0-0x0000000002320000-0x0000000002324000-memory.dmp

Filesize
16KB

Download
memory/4672-49-0x0000000002320000-0x0000000002324000-memory.dmp

Filesize
16KB

Download
memory/4672-1-0x0000000002320000-0x0000000002324000-memory.dmp

Filesize
16KB

Download