troldesh | hxxps://github[.]com/Da2dalus/The-MALWARE-Repo/raw/refs/heads/master/Ransomware/NoMoreRansom[.]exe

Analysis

max time kernel
38s
max time network
43s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
17-01-2025 15:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/Da2dalus/The-MALWARE-Repo/raw/refs/heads/master/Ransomware/NoMoreRansom.exe

Score

10^/10

troldesh defense_evasion discovery persistence ransomware trojan upx

Malware Config

Signatures

Troldesh family
troldesh
Troldesh, Shade, Encoder.858
Troldesh is a ransomware spread by malspam.
ransomware trojan troldesh
Downloads MZ/PE file

Executes dropped EXE 1 IoCs

pid	Process
432	NoMoreRansom.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2499603254-3415597248-1508446358-1000\Software\Microsoft\Windows\CurrentVersion\Run\Client Server Runtime Subsystem = "\"C:\\ProgramData\\Windows\\csrss.exe\""	NoMoreRansom.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
12	raw.githubusercontent.com
14	raw.githubusercontent.com

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/432-72-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral1/memory/432-73-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral1/memory/432-74-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral1/memory/432-76-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral1/memory/432-94-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral1/memory/432-185-0x0000000000400000-0x00000000005DE000-memory.dmp	upx

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\NoMoreRansom.exe:Zone.Identifier	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NoMoreRansom.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\NoMoreRansom.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 162143.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4420	msedge.exe
4420	msedge.exe
3744	msedge.exe
3744	msedge.exe
2164	msedge.exe
2164	msedge.exe
3284	identity_helper.exe
3284	identity_helper.exe
4348	msedge.exe
4348	msedge.exe
432	NoMoreRansom.exe
432	NoMoreRansom.exe
432	NoMoreRansom.exe
432	NoMoreRansom.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe

Suspicious use of FindShellTrayWindow 36 IoCs

pid	Process
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3744 wrote to memory of 4884	3744	msedge.exe	79
PID 3744 wrote to memory of 4884	3744	msedge.exe	79
PID 3744 wrote to memory of 2928	3744	msedge.exe	80
PID 3744 wrote to memory of 2928	3744	msedge.exe	80
PID 3744 wrote to memory of 2928	3744	msedge.exe	80
PID 3744 wrote to memory of 2928	3744	msedge.exe	80
PID 3744 wrote to memory of 2928	3744	msedge.exe	80
PID 3744 wrote to memory of 2928	3744	msedge.exe	80
PID 3744 wrote to memory of 2928	3744	msedge.exe	80
PID 3744 wrote to memory of 2928	3744	msedge.exe	80
PID 3744 wrote to memory of 2928	3744	msedge.exe	80
PID 3744 wrote to memory of 2928	3744	msedge.exe	80
PID 3744 wrote to memory of 2928	3744	msedge.exe	80
PID 3744 wrote to memory of 2928	3744	msedge.exe	80
PID 3744 wrote to memory of 2928	3744	msedge.exe	80
PID 3744 wrote to memory of 2928	3744	msedge.exe	80
PID 3744 wrote to memory of 2928	3744	msedge.exe	80
PID 3744 wrote to memory of 2928	3744	msedge.exe	80
PID 3744 wrote to memory of 2928	3744	msedge.exe	80
PID 3744 wrote to memory of 2928	3744	msedge.exe	80
PID 3744 wrote to memory of 2928	3744	msedge.exe	80
PID 3744 wrote to memory of 2928	3744	msedge.exe	80
PID 3744 wrote to memory of 2928	3744	msedge.exe	80
PID 3744 wrote to memory of 2928	3744	msedge.exe	80
PID 3744 wrote to memory of 2928	3744	msedge.exe	80
PID 3744 wrote to memory of 2928	3744	msedge.exe	80
PID 3744 wrote to memory of 2928	3744	msedge.exe	80
PID 3744 wrote to memory of 2928	3744	msedge.exe	80
PID 3744 wrote to memory of 2928	3744	msedge.exe	80
PID 3744 wrote to memory of 2928	3744	msedge.exe	80
PID 3744 wrote to memory of 2928	3744	msedge.exe	80
PID 3744 wrote to memory of 2928	3744	msedge.exe	80
PID 3744 wrote to memory of 2928	3744	msedge.exe	80
PID 3744 wrote to memory of 2928	3744	msedge.exe	80
PID 3744 wrote to memory of 2928	3744	msedge.exe	80
PID 3744 wrote to memory of 2928	3744	msedge.exe	80
PID 3744 wrote to memory of 2928	3744	msedge.exe	80
PID 3744 wrote to memory of 2928	3744	msedge.exe	80
PID 3744 wrote to memory of 2928	3744	msedge.exe	80
PID 3744 wrote to memory of 2928	3744	msedge.exe	80
PID 3744 wrote to memory of 2928	3744	msedge.exe	80
PID 3744 wrote to memory of 2928	3744	msedge.exe	80
PID 3744 wrote to memory of 4420	3744	msedge.exe	81
PID 3744 wrote to memory of 4420	3744	msedge.exe	81
PID 3744 wrote to memory of 4736	3744	msedge.exe	82
PID 3744 wrote to memory of 4736	3744	msedge.exe	82
PID 3744 wrote to memory of 4736	3744	msedge.exe	82
PID 3744 wrote to memory of 4736	3744	msedge.exe	82
PID 3744 wrote to memory of 4736	3744	msedge.exe	82
PID 3744 wrote to memory of 4736	3744	msedge.exe	82
PID 3744 wrote to memory of 4736	3744	msedge.exe	82
PID 3744 wrote to memory of 4736	3744	msedge.exe	82
PID 3744 wrote to memory of 4736	3744	msedge.exe	82
PID 3744 wrote to memory of 4736	3744	msedge.exe	82
PID 3744 wrote to memory of 4736	3744	msedge.exe	82
PID 3744 wrote to memory of 4736	3744	msedge.exe	82
PID 3744 wrote to memory of 4736	3744	msedge.exe	82
PID 3744 wrote to memory of 4736	3744	msedge.exe	82
PID 3744 wrote to memory of 4736	3744	msedge.exe	82
PID 3744 wrote to memory of 4736	3744	msedge.exe	82
PID 3744 wrote to memory of 4736	3744	msedge.exe	82
PID 3744 wrote to memory of 4736	3744	msedge.exe	82
PID 3744 wrote to memory of 4736	3744	msedge.exe	82
PID 3744 wrote to memory of 4736	3744	msedge.exe	82

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://github.com/Da2dalus/The-MALWARE-Repo/raw/refs/heads/master/Ransomware/NoMoreRansom.exe
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffc976d3cb8,0x7ffc976d3cc8,0x7ffc976d3cd8
  2⤵
  PID:4884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1920,14424952315544823127,6188591156539785952,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1940 /prefetch:2
  2⤵
  PID:2928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1920,14424952315544823127,6188591156539785952,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2264 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1920,14424952315544823127,6188591156539785952,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2268 /prefetch:8
  2⤵
  PID:4736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,14424952315544823127,6188591156539785952,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:3824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,14424952315544823127,6188591156539785952,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,14424952315544823127,6188591156539785952,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5408 /prefetch:1
  2⤵
  PID:1948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1920,14424952315544823127,6188591156539785952,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5828 /prefetch:8
  2⤵
  PID:2812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1920,14424952315544823127,6188591156539785952,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5864 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2164
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1920,14424952315544823127,6188591156539785952,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6080 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1920,14424952315544823127,6188591156539785952,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5548 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:4348
- C:\Users\Admin\Downloads\NoMoreRansom.exe
  "C:\Users\Admin\Downloads\NoMoreRansom.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,14424952315544823127,6188591156539785952,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4668 /prefetch:1
  2⤵
  PID:3640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,14424952315544823127,6188591156539785952,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5284 /prefetch:1
  2⤵
  PID:4840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,14424952315544823127,6188591156539785952,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4052 /prefetch:1
  2⤵
  PID:2936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,14424952315544823127,6188591156539785952,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4672 /prefetch:1
  2⤵
  PID:3996

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4412

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1400

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
aad1d98ca9748cc4c31aa3b5abfe0fed

SHA1
32e8d4d9447b13bc00ec3eb15a88c55c29489495

SHA256
2a07cac05ffcf140a9ad32e58ef51b32ecccf1e3ab5ef4e656770df813a8944e

SHA512
150ebf7e37d20f88b21ab7ea0793afe1d40b00611ed36f0cf1ac1371b656d26f11b08a84dbb958891c79776fae04c9c616e45e2e211d292988a5709857a3bf72

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
cb557349d7af9d6754aed39b4ace5bee

SHA1
04de2ac30defbb36508a41872ddb475effe2d793

SHA256
cfc24ed7d1c2e2c6585f53db7b39aa2447bf9212487b0a3c8c2a7d8e7e5572ee

SHA512
f0cf51f42d975d720d613d09f201435bf98c6283ae5bc033207f4ada93b15e49743a235a1cfb1b761bde268e2f7f8561aa57619b99bff67a36820bc1a4d0ec4a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
261B

MD5
2c2e6472d05e3832905f0ad4a04d21c3

SHA1
007edbf35759af62a5b847ab09055e7d9b86ffcc

SHA256
283d954fa21caa1f3b4aba941b154fab3e626ff27e7b8029f5357872c48cbe03

SHA512
8c4ce1ea02da6ffb7e7041c50528da447d087d9ee3c9f4a8c525d2d856cf48e46f5dd9a1fedd23dd047634e719c8886457f7e7240aa3cc36f1a6216e4c00ee37

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
1380fce78c48475925862994fc4daf7f

SHA1
73aa0fcdb0fdf89b23322467cb836e804d64ce12

SHA256
6e8a8b014bc444e22d7d356843a25746c4d9354bf1d42ee9437faf0df9ba2917

SHA512
886c0a1f8d4966726dd502de33fed488d6e584622d0e2d62b5088fa4e82ae0b319e340042323e3c7fd5263f70dbe5463d684d5e42e59f8a537d8808f0048f55c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
e016b6f5d169fbe9204686471f6d9dba

SHA1
cb7b9a98c35aa56936790dda7ab0b3f29abd4f01

SHA256
b2dc169c8e9bd59a2f9cb506ce0139116982325623f5b4a5d796b3486b011ffb

SHA512
d5c1b4572056ea801cb322f9c8225b00a7a598ed42d4eba1560eafd80797e9abd9d71e4cf72b6a323493905ea0965b7df75ecccde26f0f93b73f0ce4464f7ba2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
be69a884134692de72aa06640498f00d

SHA1
f5ff1fcc001fdfb4e01284c1ec3a50fe160fda02

SHA256
61c6ec9714c9649a5611320fe18c7b273b5ed6d2211ae36386f8c85167445d43

SHA512
8a4dee591be3202a24d580cc3f31b53a81c08eef7d35a2afe31d11abff3a0cb425f7d84615d7a9e999e664de6c1f7ab4928b5498fbaea08dce6cbcee0267b64e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
2bc20cd5ff66cdc0d1dc99761bfca4bb

SHA1
71eae244317d44403375196b026383d9cdc5955f

SHA256
c0255901331dcc3735987a0dd912381aaad2c3e8c9f96bb3abd88aef2d8a78b9

SHA512
ab518468cf8a5397ed876bd4b6f67870ee0e3c8f31c190bc7564b7697efa0623fa876e3d9db14a805e377d18abd80ae0221b1faa00ca6dbe8646b4e001a31382

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
0ca61ace4f938e17a9007bfd2cc802ac

SHA1
bb54f8da00d1400b3976d08a0e93ffb416f9b056

SHA256
4114095b0cac2c61dc5af129306044deb874af5a8bdd716049700bfe58a8a63c

SHA512
8ca342cf26b44ec1cf7d932b4514b331dc32770f57bf7c50a4c6f87cc7170c23b029ee4d715ec7f6d2760af4e0dc6d72439c42cf041bd9d278ab294e3f576af2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
fc280d437f8fa627abaa047b6bbe8213

SHA1
ddcd63fcd753b4ec68d20550cc689ecde63cd13a

SHA256
75531cec62d7f83732f7c55495344cbcc340a9965623fdb21d851b7277be58c7

SHA512
96cf859a6b1bd5b4e1803fb656ebb7189ae6bea972b127685293c15936f2740c092018aeca9d01a8d61cc86718ccef3f22037ec56bac5fb61f5f6c6796be14b2

Download Submit
C:\Users\Admin\Downloads\NoMoreRansom.exe:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 162143.crdownload

Filesize
1.4MB

MD5
63210f8f1dde6c40a7f3643ccf0ff313

SHA1
57edd72391d710d71bead504d44389d0462ccec9

SHA256
2aab13d49b60001de3aa47fb8f7251a973faa7f3c53a3840cdf5fd0b26e9a09f

SHA512
87a89e8ab85be150a783a9f8d41797cfa12f86fdccb48f2180c0498bfd2b1040b730dee4665fe2c83b98d436453680226051b7f1532e1c0e0cda0cf702e80a11

Download Submit
memory/432-76-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/432-74-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/432-94-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/432-73-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/432-72-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/432-185-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download