Overview

overview

10

Static

static

1

URLScan

urlscan

https://web.archive....

windows11-21h2-x64

10

Analysis

  • max time kernel
    382s
  • max time network
    383s
  • platform
    windows11-21h2_x64
  • resource
    win11-20250217-en
  • resource tags

    arch:x64arch:x86image:win11-20250217-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    23/02/2025, 21:44

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    https://web.archive.org/web/20110804063940/govnobakovkaxxx.ru

Score
10/10
badrabbitcryptolockerdharmafantommimikatzcredential_accessdefense_evasiondiscoveryexecutionimpactpersistenceransomwarestealerupx

Malware Config

Extracted

Path

C:\Program Files\7-Zip\Lang\DECRYPT_YOUR_FILES.HTML

Ransom Note
<html> <head> <style> body{ background-color: #3366CC; } h1 { background-color: RGB(249, 201, 16); } p { background-color: maroon; color: white; } </style> </head> <body> <center> <h1><b> Attention ! All your files </b> have been encrypted. </h1></br> <p> Due encrypting was used algoritm RSA-4096 and AES-256, used for protection military secrets.</br> That means > RESTORE YOU DATA POSIBLE ONLY BUYING decryption passwords from us.</br> Getting a decryption of your files is - SIMPLY task.</br></br> That all what you need:</br> 1. Sent Your ID_KEY on mailbox [email protected] or [email protected] </br> 2. For test, decrypt 2 small files, to be sure that we can decrypt you files.</br> 3. Pay our services. </br> 4. GET software with passwords for decrypt you files.</br> 5. Make measures to prevent this type situations again.</br></br> IMPORTANT(1)</br> Do not try restore files without our help, this is useless, and can destroy you data permanetly.</br></br> IMPORTANT(2) </br> We Cant hold you decryption passwords forever. </br>ALL DECRYPTION PASSWORDS, for what wasn`t we receive reward, will destroy after week of moment of encryption. </p> <p> Your ID_KEY: <br> </p> <table width="1024" border="0"> <tbody> <tr> <td><p>JJEqo3LrSvxj7DrJMULwhG6PQR8cqtP/+aHYyiTkJtix5VKihee74vuXYIwQF1Y1Ph6SJ06byS6VHFRbTKqskMPnfLoJJc3Zqe0cO1qeKQff0UC5hQKvv2HpOTo/L5RttH2lrhylUiF3cLQ3iNFLhYAGfW8lpeW+coRrjxU5zns/kAK4W0+icXiUftH7y4VCcDznYNsCMdu7CC6ABh5AuRipDzVN7PSlD0Xev37A0Y30V00n3cn+zd7HGYgikVj38Y1xIE5GFrlbOdhNxjfHRYxt4n+J78+iQmU7L6orJzNm7yE8XC3J6FAqAnhAiaBLWGA3XoT4rqG9BVQblAQPBw==ZW4tVVM=</p></td> </tr> </tbody> </table> </center></html></body>

Signatures

  • BadRabbit

    Ransomware family discovered in late 2017, mainly targeting Russia and Ukraine.

    ransomwarebadrabbit
  • Badrabbit family
    badrabbit
  • CryptoLocker

    Ransomware family with multiple variants.

    ransomwarecryptolocker
  • Cryptolocker family
    cryptolocker
  • Dharma

    Dharma is a ransomware that uses security software installation to hide malicious activities.

    ransomwaredharma
  • Dharma family
    dharma
  • Fantom

    Ransomware which hides encryption process behind fake Windows Update screen.

    ransomwarefantom
  • Fantom family
    fantom
  • Mimikatz

    mimikatz is an open source tool to dump credentials on Windows.

    mimikatz
  • Mimikatz family
    mimikatz
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Renames multiple (679) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • mimikatz is an open source tool to dump credentials on Windows 1 IoCs
  • Disables Task Manager via registry modification
    defense_evasion
  • Sets service image path in registry 2 TTPs 8 IoCs
    persistence
  • Credentials from Password Stores: Windows Credential Manager 1 TTPs

    Suspicious access to Credentials History.

    credential_accessstealer
  • Drops startup file 10 IoCs
  • Executes dropped EXE 8 IoCs
  • Impair Defenses: Safe Mode Boot 1 TTPs 12 IoCs
    defense_evasion
  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 8 IoCs
    persistence
  • Drops desktop.ini file(s) 64 IoCs
  • Enumerates connected drives 3 TTPs 1 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 42 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 5 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 29 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Interacts with shadow copies 3 TTPs 2 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Modifies registry class 1 IoCs
  • NTFS ADS 2 IoCs
  • Runs net.exe
  • Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 32 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 13 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://web.archive.org/web/20110804063940/govnobakovkaxxx.ru
    1⤵
    • Enumerates system info in registry
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3040
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffedcfc3cb8,0x7ffedcfc3cc8,0x7ffedcfc3cd8
      2⤵
        PID:3356
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1808,17861447386950703190,8460141916882927046,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1896 /prefetch:2
        2⤵
          PID:3756
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1808,17861447386950703190,8460141916882927046,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2244 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:3508
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1808,17861447386950703190,8460141916882927046,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2760 /prefetch:8
          2⤵
            PID:416
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1808,17861447386950703190,8460141916882927046,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
            2⤵
              PID:4248
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1808,17861447386950703190,8460141916882927046,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
              2⤵
                PID:1892
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1808,17861447386950703190,8460141916882927046,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5540 /prefetch:8
                2⤵
                • Suspicious behavior: EnumeratesProcesses
                PID:1476
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1808,17861447386950703190,8460141916882927046,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5268 /prefetch:1
                2⤵
                  PID:2092
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1808,17861447386950703190,8460141916882927046,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5548 /prefetch:1
                  2⤵
                    PID:2700
                  • C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1808,17861447386950703190,8460141916882927046,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6020 /prefetch:8
                    2⤵
                      PID:2360
                    • C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1808,17861447386950703190,8460141916882927046,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6020 /prefetch:8
                      2⤵
                      • Suspicious behavior: EnumeratesProcesses
                      PID:4604
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1808,17861447386950703190,8460141916882927046,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5464 /prefetch:1
                      2⤵
                        PID:1624
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1808,17861447386950703190,8460141916882927046,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5488 /prefetch:1
                        2⤵
                          PID:1548
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1808,17861447386950703190,8460141916882927046,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2608 /prefetch:1
                          2⤵
                            PID:4944
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1808,17861447386950703190,8460141916882927046,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2396 /prefetch:1
                            2⤵
                              PID:3104
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1808,17861447386950703190,8460141916882927046,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6124 /prefetch:1
                              2⤵
                                PID:2792
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1808,17861447386950703190,8460141916882927046,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3956 /prefetch:1
                                2⤵
                                  PID:2628
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1808,17861447386950703190,8460141916882927046,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3656 /prefetch:1
                                  2⤵
                                    PID:4224
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1808,17861447386950703190,8460141916882927046,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6372 /prefetch:1
                                    2⤵
                                      PID:3656
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1808,17861447386950703190,8460141916882927046,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=876 /prefetch:2
                                      2⤵
                                      • Suspicious behavior: EnumeratesProcesses
                                      PID:1908
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1808,17861447386950703190,8460141916882927046,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3932 /prefetch:8
                                      2⤵
                                      • NTFS ADS
                                      • Suspicious behavior: EnumeratesProcesses
                                      PID:3760
                                  • C:\Windows\System32\CompPkgSrv.exe
                                    C:\Windows\System32\CompPkgSrv.exe -Embedding
                                    1⤵
                                      PID:2084
                                    • C:\Windows\System32\CompPkgSrv.exe
                                      C:\Windows\System32\CompPkgSrv.exe -Embedding
                                      1⤵
                                        PID:1120
                                      • C:\Windows\System32\rundll32.exe
                                        C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                        1⤵
                                          PID:4312
                                        • C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Ransomware\$uckyLocker.exe
                                          "C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Ransomware\$uckyLocker.exe"
                                          1⤵
                                          • Sets desktop wallpaper using registry
                                          • System Location Discovery: System Language Discovery
                                          PID:4596
                                        • C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Ransomware\BadRabbit.exe
                                          "C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Ransomware\BadRabbit.exe"
                                          1⤵
                                          • Drops file in Windows directory
                                          • System Location Discovery: System Language Discovery
                                          PID:3720
                                          • C:\Windows\SysWOW64\rundll32.exe
                                            C:\Windows\system32\rundll32.exe C:\Windows\infpub.dat,#1 15
                                            2⤵
                                            • Loads dropped DLL
                                            • Drops file in Windows directory
                                            • System Location Discovery: System Language Discovery
                                            • Suspicious behavior: EnumeratesProcesses
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:1004
                                            • C:\Windows\SysWOW64\cmd.exe
                                              /c schtasks /Delete /F /TN rhaegal
                                              3⤵
                                              • System Location Discovery: System Language Discovery
                                              PID:1704
                                              • C:\Windows\SysWOW64\schtasks.exe
                                                schtasks /Delete /F /TN rhaegal
                                                4⤵
                                                • System Location Discovery: System Language Discovery
                                                PID:4812
                                            • C:\Windows\SysWOW64\cmd.exe
                                              /c schtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR "C:\Windows\system32\cmd.exe /C Start \"\" \"C:\Windows\dispci.exe\" -id 3853269842 && exit"
                                              3⤵
                                              • System Location Discovery: System Language Discovery
                                              PID:2392
                                              • C:\Windows\SysWOW64\schtasks.exe
                                                schtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR "C:\Windows\system32\cmd.exe /C Start \"\" \"C:\Windows\dispci.exe\" -id 3853269842 && exit"
                                                4⤵
                                                • System Location Discovery: System Language Discovery
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:860
                                            • C:\Windows\SysWOW64\cmd.exe
                                              /c schtasks /Create /SC once /TN drogon /RU SYSTEM /TR "C:\Windows\system32\shutdown.exe /r /t 0 /f" /ST 22:06:00
                                              3⤵
                                              • System Location Discovery: System Language Discovery
                                              PID:1532
                                              • C:\Windows\SysWOW64\schtasks.exe
                                                schtasks /Create /SC once /TN drogon /RU SYSTEM /TR "C:\Windows\system32\shutdown.exe /r /t 0 /f" /ST 22:06:00
                                                4⤵
                                                • System Location Discovery: System Language Discovery
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:1596
                                            • C:\Windows\FDDA.tmp
                                              "C:\Windows\FDDA.tmp" \\.\pipe\{77093C3A-AFBE-462C-A6B4-7E88DCC0E5FD}
                                              3⤵
                                              • Executes dropped EXE
                                              • Suspicious behavior: EnumeratesProcesses
                                              • Suspicious use of AdjustPrivilegeToken
                                              PID:3764
                                        • C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Ransomware\Birele.exe
                                          "C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Ransomware\Birele.exe"
                                          1⤵
                                          • System Location Discovery: System Language Discovery
                                          PID:2560
                                          • C:\Windows\SysWOW64\WerFault.exe
                                            C:\Windows\SysWOW64\WerFault.exe -u -p 2560 -s 280
                                            2⤵
                                            • Program crash
                                            PID:4760
                                        • C:\Windows\SysWOW64\WerFault.exe
                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2560 -ip 2560
                                          1⤵
                                            PID:1524
                                          • C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Ransomware\CoronaVirus.exe
                                            "C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Ransomware\CoronaVirus.exe"
                                            1⤵
                                            • Drops startup file
                                            • Adds Run key to start application
                                            • Drops desktop.ini file(s)
                                            • Drops file in System32 directory
                                            • Drops file in Program Files directory
                                            • System Location Discovery: System Language Discovery
                                            • Suspicious behavior: EnumeratesProcesses
                                            PID:1012
                                            • C:\Windows\system32\cmd.exe
                                              "C:\Windows\system32\cmd.exe"
                                              2⤵
                                                PID:1356
                                                • C:\Windows\system32\mode.com
                                                  mode con cp select=1251
                                                  3⤵
                                                    PID:10332
                                                  • C:\Windows\system32\vssadmin.exe
                                                    vssadmin delete shadows /all /quiet
                                                    3⤵
                                                    • Interacts with shadow copies
                                                    PID:31084
                                                • C:\Windows\system32\cmd.exe
                                                  "C:\Windows\system32\cmd.exe"
                                                  2⤵
                                                    PID:28928
                                                    • C:\Windows\system32\mode.com
                                                      mode con cp select=1251
                                                      3⤵
                                                        PID:31168
                                                      • C:\Windows\system32\vssadmin.exe
                                                        vssadmin delete shadows /all /quiet
                                                        3⤵
                                                        • Interacts with shadow copies
                                                        PID:31824
                                                    • C:\Windows\System32\mshta.exe
                                                      "C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"
                                                      2⤵
                                                        PID:29240
                                                      • C:\Windows\System32\mshta.exe
                                                        "C:\Windows\System32\mshta.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"
                                                        2⤵
                                                          PID:29320
                                                      • C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Ransomware\CryptoLocker.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Ransomware\CryptoLocker.exe"
                                                        1⤵
                                                        • System Location Discovery: System Language Discovery
                                                        • NTFS ADS
                                                        PID:4900
                                                        • C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe
                                                          "C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe" "/rC:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Ransomware\CryptoLocker.exe"
                                                          2⤵
                                                          • Executes dropped EXE
                                                          • Adds Run key to start application
                                                          • System Location Discovery: System Language Discovery
                                                          PID:3384
                                                          • C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe
                                                            "C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe" /w00000234
                                                            3⤵
                                                            • Executes dropped EXE
                                                            • System Location Discovery: System Language Discovery
                                                            PID:1256
                                                      • C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Ransomware\CryptoWall.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Ransomware\CryptoWall.exe"
                                                        1⤵
                                                        • System Location Discovery: System Language Discovery
                                                        • Suspicious behavior: MapViewOfSection
                                                        PID:5048
                                                        • C:\Windows\SysWOW64\explorer.exe
                                                          "C:\Windows\syswow64\explorer.exe"
                                                          2⤵
                                                          • Drops startup file
                                                          • Adds Run key to start application
                                                          • System Location Discovery: System Language Discovery
                                                          • Suspicious behavior: MapViewOfSection
                                                          PID:4512
                                                          • C:\Windows\SysWOW64\svchost.exe
                                                            -k netsvcs
                                                            3⤵
                                                            • System Location Discovery: System Language Discovery
                                                            PID:3152
                                                      • C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Ransomware\DeriaLock.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Ransomware\DeriaLock.exe"
                                                        1⤵
                                                        • Drops startup file
                                                        • System Location Discovery: System Language Discovery
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        PID:3024
                                                      • C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Ransomware\Dharma.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Ransomware\Dharma.exe"
                                                        1⤵
                                                        • Drops file in System32 directory
                                                        • System Location Discovery: System Language Discovery
                                                        PID:24408
                                                        • C:\Windows\SysWOW64\ac\nc123.exe
                                                          "C:\Windows\system32\ac\nc123.exe"
                                                          2⤵
                                                          • Executes dropped EXE
                                                          PID:29448
                                                        • C:\Windows\SysWOW64\ac\mssql.exe
                                                          "C:\Windows\system32\ac\mssql.exe"
                                                          2⤵
                                                          • Sets service image path in registry
                                                          • Executes dropped EXE
                                                          • Impair Defenses: Safe Mode Boot
                                                          • Drops file in System32 directory
                                                          • Suspicious behavior: LoadsDriver
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          • Suspicious use of SetWindowsHookEx
                                                          PID:29588
                                                        • C:\Windows\SysWOW64\ac\mssql2.exe
                                                          "C:\Windows\system32\ac\mssql2.exe"
                                                          2⤵
                                                          • Executes dropped EXE
                                                          • System Location Discovery: System Language Discovery
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          • Suspicious use of SetWindowsHookEx
                                                          PID:29852
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c ""C:\Windows\system32\ac\Shadow.bat" "
                                                          2⤵
                                                          • System Location Discovery: System Language Discovery
                                                          PID:30884
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c ""C:\Windows\system32\ac\systembackup.bat" "
                                                          2⤵
                                                          • System Location Discovery: System Language Discovery
                                                          PID:30980
                                                          • C:\Windows\SysWOW64\cmd.exe
                                                            C:\Windows\system32\cmd.exe /c WMIC Group Where "SID = 'S-1-5-32-544'" Get Name /Value | Find "="
                                                            3⤵
                                                            • System Location Discovery: System Language Discovery
                                                            PID:31448
                                                            • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                                              WMIC Group Where "SID = 'S-1-5-32-544'" Get Name /Value
                                                              4⤵
                                                              • System Location Discovery: System Language Discovery
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:31580
                                                            • C:\Windows\SysWOW64\find.exe
                                                              Find "="
                                                              4⤵
                                                              • System Location Discovery: System Language Discovery
                                                              PID:31556
                                                          • C:\Windows\SysWOW64\net.exe
                                                            net user systembackup Default3104 /add /active:"yes" /expires:"never" /passwordchg:"NO"
                                                            3⤵
                                                            • System Location Discovery: System Language Discovery
                                                            PID:32052
                                                            • C:\Windows\SysWOW64\net1.exe
                                                              C:\Windows\system32\net1 user systembackup Default3104 /add /active:"yes" /expires:"never" /passwordchg:"NO"
                                                              4⤵
                                                              • System Location Discovery: System Language Discovery
                                                              PID:32152
                                                        • C:\Windows\SysWOW64\ac\EVER\SearchHost.exe
                                                          "C:\Windows\system32\ac\EVER\SearchHost.exe"
                                                          2⤵
                                                          • Executes dropped EXE
                                                          • Enumerates connected drives
                                                          • System Location Discovery: System Language Discovery
                                                          • Suspicious use of SendNotifyMessage
                                                          • Suspicious use of SetWindowsHookEx
                                                          PID:31132
                                                      • C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Ransomware\Fantom.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Ransomware\Fantom.exe"
                                                        1⤵
                                                        • Drops file in Program Files directory
                                                        • System Location Discovery: System Language Discovery
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        PID:12092
                                                        • C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe"
                                                          2⤵
                                                          • Executes dropped EXE
                                                          PID:33232
                                                      • C:\Windows\system32\vssvc.exe
                                                        C:\Windows\system32\vssvc.exe
                                                        1⤵
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        PID:31356
                                                      • C:\Windows\explorer.exe
                                                        explorer.exe
                                                        1⤵
                                                          PID:32284

                                                        Network

                                                        MITRE ATT&CK Enterprise v15

                                                        Reconnaissance

                                                        Resource Development

                                                        Initial Access

                                                        Execution

                                                        Scheduled Task/Job

                                                        1
                                                        T1053

                                                        Scheduled Task

                                                        1
                                                        T1053.005

                                                        Windows Management Instrumentation

                                                        1
                                                        T1047

                                                        Persistence

                                                        Boot or Logon Autostart Execution

                                                        2
                                                        T1547

                                                        Registry Run Keys / Startup Folder

                                                        2
                                                        T1547.001

                                                        Scheduled Task/Job

                                                        1
                                                        T1053

                                                        Scheduled Task

                                                        1
                                                        T1053.005

                                                        Privilege Escalation

                                                        Boot or Logon Autostart Execution

                                                        2
                                                        T1547

                                                        Registry Run Keys / Startup Folder

                                                        2
                                                        T1547.001

                                                        Scheduled Task/Job

                                                        1
                                                        T1053

                                                        Scheduled Task

                                                        1
                                                        T1053.005

                                                        Defense Evasion

                                                        Direct Volume Access

                                                        1
                                                        T1006

                                                        Impair Defenses

                                                        1
                                                        T1562

                                                        Safe Mode Boot

                                                        1
                                                        T1562.009

                                                        Indicator Removal

                                                        2
                                                        T1070

                                                        File Deletion

                                                        2
                                                        T1070.004

                                                        Modify Registry

                                                        3
                                                        T1112

                                                        Credential Access

                                                        Credentials from Password Stores

                                                        1
                                                        T1555

                                                        Windows Credential Manager

                                                        1
                                                        T1555.004

                                                        Discovery

                                                        Browser Information Discovery

                                                        1
                                                        T1217

                                                        Peripheral Device Discovery

                                                        1
                                                        T1120

                                                        Query Registry

                                                        2
                                                        T1012

                                                        System Information Discovery

                                                        3
                                                        T1082

                                                        System Location Discovery

                                                        1
                                                        T1614

                                                        System Language Discovery

                                                        1
                                                        T1614.001

                                                        Lateral Movement

                                                        Collection

                                                        Command and Control

                                                        Exfiltration

                                                        Impact

                                                        Defacement

                                                        1
                                                        T1491

                                                        Inhibit System Recovery

                                                        2
                                                        T1490

                                                        Replay Monitor

                                                        Loading Replay Monitor...

                                                        Downloads

                                                        • C:\Program Files\7-Zip\Lang\DECRYPT_YOUR_FILES.HTML
                                                          Filesize

                                                          1KB

                                                          MD5

                                                          0ebb62268225183da704bc0c20e57851

                                                          SHA1

                                                          310a320d29ee50e1464846a394687036f9ef3963

                                                          SHA256

                                                          2ff609b126f0268e6d6496e9404adc22f624ccf5dec9f49428cb641aa90a72e8

                                                          SHA512

                                                          3c7c76c1b367f1c7e8ff7bfa4de7ecee786bdde82bf5a3d1ff0fce43b16213320b7d7f5dc01052afc29dfa823797b54e363f304f356953690bb17c57ffa525b7

                                                          Download Submit

                                                        • C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe.id-F49E4D4C.[[email protected]].ncov
                                                          Filesize

                                                          2.9MB

                                                          MD5

                                                          404df275a6f99e2e527ec8ac44d2e3af

                                                          SHA1

                                                          8583867a5c29cb39d43bfefc5a818baa29698c78

                                                          SHA256

                                                          42bb2dce04d6c74356d077c643307f75f30bc8cbb70a6ea0bc3e5afdc50eb9ee

                                                          SHA512

                                                          288291296306d85c90e2affbd19ed2768b050d1018274737e8e53fad8ff7af0dbdbe386912b6741f244123c9fb3199f5e5a0f5f75c0e45727c5408b70dce81f0

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                          Filesize

                                                          152B

                                                          MD5

                                                          0517a9ec1a0298a87dac0ad50c998d79

                                                          SHA1

                                                          c01cab2a1ffb6180134315d827709b46d07018ea

                                                          SHA256

                                                          084f62f24d15ce30e231b1690497a004070932b3618e06d6b26079a489f689a5

                                                          SHA512

                                                          d9be6c0e55a74137b1e6dc882b0e665cb6c18fe80ff585cccff0bd4fc32923b155b62000492613c861b3f0cbfa8996dac7ca12d66fcf06d1b1d0e57294dee84d

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                          Filesize

                                                          152B

                                                          MD5

                                                          236fd72d944b494ed36178d8c80baa40

                                                          SHA1

                                                          affaef8eea7ac675dfccc68528f9cc828906d209

                                                          SHA256

                                                          c84f8f8ff1471655a154db4ba294d245cdcee376bd482f7b433b42f28d4f0184

                                                          SHA512

                                                          6db4bcd8f81de26f8d5a350019f45be7fe00c3531efbc2cf8e96c696b4e75acc81514fbe10c02410895fa318ec1d2c0bfec429da97451d32d9b0a8c340b2894b

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\276e5dc8-a659-4a02-a0db-87cb2c8ec41f.tmp
                                                          Filesize

                                                          7KB

                                                          MD5

                                                          d096f198118d9ae5e4d6631db504bdca

                                                          SHA1

                                                          0c4b5f3ab17b7474ea39e64b78ac6686b7f44b10

                                                          SHA256

                                                          b9b84897346784c2ff5bc67522abcc413698fe8ca878f16cdb254e9c953d4d1b

                                                          SHA512

                                                          b0d4645e4d4816e7c36a0f44510afe4d8508bd59e6d569819438b774459719885b48cc6c937db4ea7af47ac8b7611becf1a19a75c2ad3a566a7d65a6cf6ea01f

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                          Filesize

                                                          192B

                                                          MD5

                                                          b7d5a0c8fdd58cffdffb9287b133030f

                                                          SHA1

                                                          2607aea1763e04bec1ecc5d77aa1fddc832c182d

                                                          SHA256

                                                          efe062e76c0ebfd3ad73f619e19b47c9f55a43aabb6a794bdd3a4010469ab537

                                                          SHA512

                                                          343bab025a491f9fa4c5a5b1735723ab767019f1b48b7b63b379d65f8bb8013d705a604e04a80d168c7232bb1330e343051430d23d5723df4a703f7e040cb019

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                          Filesize

                                                          3KB

                                                          MD5

                                                          5172a5db80ddeda4997107ecce1008bc

                                                          SHA1

                                                          aabb732d6c1271a8c4fa1cc6630ce1b04cdadd15

                                                          SHA256

                                                          c1695fec9873a57d12ba2bc45eb3323f73a98e70e5e76916ab43fb2c73b73dbf

                                                          SHA512

                                                          b17382a082c2ba2529d14222463d8fefc8489f86c12c948f60727a338d28d3417d8cd3ad53f702a86a42123c6924b16115d1fdb84f4064e082290b77830cb99d

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
                                                          Filesize

                                                          1KB

                                                          MD5

                                                          7d63a1fe126edcb812bf87dbae888899

                                                          SHA1

                                                          f43c1f402d2edabb6c80a665d3995560e21c88cb

                                                          SHA256

                                                          9b644d420d0589af518ab394f41f9d69befa408b1bc06b7996d02695c5d70d5e

                                                          SHA512

                                                          a21a2cce736fa4f6855aeae18e8d4b93f1b96c0792100f29b3edc4a91999f0320475fd716bc9113089df7483417597ce53db25d21c4d2f86d702cf31b4d093a3

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
                                                          Filesize

                                                          1KB

                                                          MD5

                                                          2587d2dc1d9046442815f4405b27c320

                                                          SHA1

                                                          642f1a4cbc23cb723b66d5aea8cc6f1dd0654612

                                                          SHA256

                                                          d00c820c3320373677010f80af055cabb2c5295a5af3c8beac9c446f148c9b03

                                                          SHA512

                                                          0bac23b61518aa2d13cc45e922f1ee8acc049c4aec401beeb639121cce04c3496287d7c34a8a830de1925fdb079d0d9147de0ea27a8eb65004b68b73cf10decf

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                          Filesize

                                                          6KB

                                                          MD5

                                                          17b8ed80f7684d54cad0306e476f7a40

                                                          SHA1

                                                          60c059d27d2df1ad14f29861e4e82be4e81f9432

                                                          SHA256

                                                          45fa78c6a60d01e0bb5171997e882774467678ffa47a4f6a82bb53dd97b5996d

                                                          SHA512

                                                          97a042e9e9fd36544d8928560ffc8d1d1d47267fef44eac7d48a3877f259e873a3425c1c55ce965e32e1c2cd6df83b43b23f59795df131f01286b04dc53ecd87

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                          Filesize

                                                          6KB

                                                          MD5

                                                          7605f3ee589c079ce9f45416ed5468c7

                                                          SHA1

                                                          e10b1d626adeb692a1cca41a0bdd6ed7adf454fa

                                                          SHA256

                                                          a7ea768c07f4aca446142ecfe3f9fe01590ae4443d77ff23d2da8408ccb426af

                                                          SHA512

                                                          e4ee803df584f948b4655d82362645308f5eef9eb24970985162458b34afdbb5ef033e7f0be0a14b60fe10f165cbac4bc9a6b3f1910879e8fadc1ba575c1ce31

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                          Filesize

                                                          7KB

                                                          MD5

                                                          549566bcb0da482a7d307b7e9950a59c

                                                          SHA1

                                                          7ad3ba0878632ef321661e7404f02150fd69df45

                                                          SHA256

                                                          0de7a275799a816979779becb577808b7f5b0d1d9f87b87005b4663d7f98ccb8

                                                          SHA512

                                                          7899cb1fcb2850ae58ad997c0b226d810b6571a4ca5fc396e7c399eab6e6105d51a7f126d028632997a36720daf2f14471d268a7945a6b89f2c87e85c1f3889d

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                          Filesize

                                                          5KB

                                                          MD5

                                                          f94f07e12ba23ef484987cd2032d1f3f

                                                          SHA1

                                                          b0f362d9e52a15acf444fb3134ed3583c6d4bfca

                                                          SHA256

                                                          acdd7330c9aac778f2a409753155aa93cb3e9cc1e20d96d00e2f3fb3663d3be7

                                                          SHA512

                                                          f58467bc720d51221e93df49d7277a4d85e5f91a63a4a1da1c6c89c26cbf1d64c967955e7ec439e6c8d229652a182357277fe67db4be760c0f714b9b4fc17b35

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                          Filesize

                                                          7KB

                                                          MD5

                                                          f02c53ec75fa8cb8912f889d72265524

                                                          SHA1

                                                          350432e16c9664eea0e1bfd106b4b13b21a6dde5

                                                          SHA256

                                                          760bf8841db5d94ef64d2db0087af1b6dcace0e331cbd039c6a761ac5aea7d21

                                                          SHA512

                                                          b154b818561afacb6a3893ad73a5333abc8bb82ad9b4f5c501bb331986fd10f08a154b24a8e2957cf78e3a1925abe4a62264ae062527f4f0b12b6a6ab043aba9

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                          Filesize

                                                          372B

                                                          MD5

                                                          a07d37247b33bcf0f5212bb87775a75f

                                                          SHA1

                                                          c3bbbcb5dcc8bc4a5136a8806c781aaf89eac3d2

                                                          SHA256

                                                          8b1b3f5bf5a3e6c2ccc10117d723442186ba408c965e5e460659c62a81ff719d

                                                          SHA512

                                                          9f13d910c488be96c9d4f852301d6ab3989f671014862a5ee3f29670d10ee7398c0c9938e7bc4dcb27048aa5caa71be1ff900306e653ca59903e072d3e264b43

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                          Filesize

                                                          874B

                                                          MD5

                                                          881c2b0baa332a3d20b65cb0721f111f

                                                          SHA1

                                                          8016450b7268507bcdf175bbfbb0b57ec4f8af04

                                                          SHA256

                                                          be056409f8d8e85a43b814f50450fad54d6ab2999d5c7e09277595aaf916f305

                                                          SHA512

                                                          7bd4121d461caba26cd5668da7c137d44f8af75bce5510dfceafeab00030e3a5a630ec31c858cce8090a69dc7a4180ab8ffe3e633ce0d9f5a3c51c05568b00a6

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                          Filesize

                                                          372B

                                                          MD5

                                                          8e5295fc4d30250a93b3e93a2b3782cd

                                                          SHA1

                                                          e12716322ed24920a8cdeb1d9370ffbb23448818

                                                          SHA256

                                                          dcdcd517a77d6abdfed71a9bb30d00e1d4dbdbc365665a41a29d55cea7eb71ff

                                                          SHA512

                                                          e9fb71ff93dfc4eba76a331614e719f5526be479a209c234e2620b6cbec10a78ac0900066d54bfe58c3ddb6ece1ff92b9504d88a213d745255c96e93f4194303

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                          Filesize

                                                          1KB

                                                          MD5

                                                          d5aaa55080b00272055c8b33b5828640

                                                          SHA1

                                                          6f40844506158643dd0ab605703eb6dbca2236db

                                                          SHA256

                                                          c7b0628825856ef84fae245175d0af39c791d2958883b9c310147f392b0de9c9

                                                          SHA512

                                                          761d8e714aff60701c33b7554e9cadc570243023ef2979bb628fe513a1441201779a4baed721d6dcd8ca3efb5cff9996c80c1000ca0fa07759d1da44386b228a

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
                                                          Filesize

                                                          16B

                                                          MD5

                                                          46295cac801e5d4857d09837238a6394

                                                          SHA1

                                                          44e0fa1b517dbf802b18faf0785eeea6ac51594b

                                                          SHA256

                                                          0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                                                          SHA512

                                                          8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
                                                          Filesize

                                                          16B

                                                          MD5

                                                          206702161f94c5cd39fadd03f4014d98

                                                          SHA1

                                                          bd8bfc144fb5326d21bd1531523d9fb50e1b600a

                                                          SHA256

                                                          1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

                                                          SHA512

                                                          0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\heavy_ad_intervention_opt_out.db
                                                          Filesize

                                                          16KB

                                                          MD5

                                                          9a8e0fb6cf4941534771c38bb54a76be

                                                          SHA1

                                                          92d45ac2cc921f6733e68b454dc171426ec43c1c

                                                          SHA256

                                                          9ee9211a57c3f6fa211fe0323fa8cd521e7cbffcd8ff0896645a45795dc472be

                                                          SHA512

                                                          12ed22537dcc79d53f6c7d39e92a38f8fea076d793198928f5b7a5dd1234d50a3c0b4815632f3fadf8bc4ef0499773d22bd83f961d2d0ffd8afacf471bd3a5ae

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\previews_opt_out.db
                                                          Filesize

                                                          16KB

                                                          MD5

                                                          d926f072b41774f50da6b28384e0fed1

                                                          SHA1

                                                          237dfa5fa72af61f8c38a1e46618a4de59bd6f10

                                                          SHA256

                                                          4f7b0e525d4bfc53d5df49589e25a0bccf2fcf6a1a0ca3f94d3285bb9cf0a249

                                                          SHA512

                                                          a140df6ec0d3099ef374e8f3ece09bf91bc896ac4a1d251799a521543fe9bdea796ba09fa47932bd54fa939118495078f9258557b32c31d3d4011b0666a4723f

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                          Filesize

                                                          12KB

                                                          MD5

                                                          16c15d20cd70d3e20e180067884572fa

                                                          SHA1

                                                          025464b965ed610536bb9cf653e78208e5a526fc

                                                          SHA256

                                                          c64770da119c58129c4025f0a28fab4657aa93dfba174af87331ec6b450e1a88

                                                          SHA512

                                                          5eb61307016f52a689940a0d80ec3f4327a0eb63901981bc31621c3e8e5d9857e0695d8bd5b056575b62769d0cfdce1efc8d540f7525a28afe643d439653306c

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                          Filesize

                                                          11KB

                                                          MD5

                                                          ac2e78ed3612644972724a8037d126fd

                                                          SHA1

                                                          8c5fdb0fce4bc522dc9dc060b55728f3127dfb63

                                                          SHA256

                                                          cb8b92151d77470114f9c5d83fb36daf8e1413c7e4e3f7cf4595c394ace8f60d

                                                          SHA512

                                                          71d7f27f95ac38b0279a3b60e6ca1493efdc441e15aeea03f5b8c80f6371f07b23133ab90a0615781296b4c621e75315a779be1847bb4d69d1602b568fd26977

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                          Filesize

                                                          11KB

                                                          MD5

                                                          69ed6ac5732e2a864d3d633310004990

                                                          SHA1

                                                          bc5465eab657f3b323a55f4ce5bf3ef800aa1863

                                                          SHA256

                                                          4b17e07b2a0ee7966fff3edf8fb182f7f2ebd0703f8c8f6973a004c5254dcaf2

                                                          SHA512

                                                          a6a7784b84d1c60df7ba14c72653acce8a0c77314254bbf922302b34dd3888967513972ab7b12e13dd4afa0c5b6eea09e231eada455c204259e1968a80c9ccc8

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                          Filesize

                                                          12KB

                                                          MD5

                                                          32f815fe2093eef98888cc705b4a4ac9

                                                          SHA1

                                                          30557d6543f1175e443cce8e3f94e8facb40ceb3

                                                          SHA256

                                                          4148b304da7415a5e5ae9f0523fd7958c306de72a0898b5bbe6f769e82002fe4

                                                          SHA512

                                                          343219d58d655e6419501d3fe7ba6163c198cdf504f85a21065124567a7f0699ed7dd284c1f5affda872f8bcb3031cc9b93b5e194fa7a1457c44ebfc3843d272

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe
                                                          Filesize

                                                          21KB

                                                          MD5

                                                          fec89e9d2784b4c015fed6f5ae558e08

                                                          SHA1

                                                          581fd9fb59bd42fbe7bd065cf0e6ff6d4d0daba2

                                                          SHA256

                                                          489f2546a4ad1e0e0147d1ca2fd8801785689f67fb850171ccbaa6306a152065

                                                          SHA512

                                                          e3bbf89cc0a955a2819455137e540952c55f417732a596ef314a46d5312b3bed644ac7595f75d3639ebc30e85f0f210dba0ef5b013d1b83bafd2c17a9d685a24

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe
                                                          Filesize

                                                          338KB

                                                          MD5

                                                          04fb36199787f2e3e2135611a38321eb

                                                          SHA1

                                                          65559245709fe98052eb284577f1fd61c01ad20d

                                                          SHA256

                                                          d765e722e295969c0a5c2d90f549db8b89ab617900bf4698db41c7cdad993bb9

                                                          SHA512

                                                          533d6603f6e2a77bd1b2c6591a135c4717753d53317c1be06e43774e896d9543bcd0ea6904a0688aa84b2d8424641d68994b1e7dc4aa46d66c36feecb6145444

                                                          Download Submit

                                                        • C:\Users\Admin\Downloads\The-MALWARE-Repo-master.zip:Zone.Identifier
                                                          Filesize

                                                          26B

                                                          MD5

                                                          fbccf14d504b7b2dbcb5a5bda75bd93b

                                                          SHA1

                                                          d59fc84cdd5217c6cf74785703655f78da6b582b

                                                          SHA256

                                                          eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

                                                          SHA512

                                                          aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

                                                          Download Submit

                                                        • C:\Windows\FDDA.tmp
                                                          Filesize

                                                          60KB

                                                          MD5

                                                          347ac3b6b791054de3e5720a7144a977

                                                          SHA1

                                                          413eba3973a15c1a6429d9f170f3e8287f98c21c

                                                          SHA256

                                                          301b905eb98d8d6bb559c04bbda26628a942b2c4107c07a02e8f753bdcfe347c

                                                          SHA512

                                                          9a399916bc681964af1e1061bc0a8e2926307642557539ad587ce6f9b5ef93bdf1820fe5d7b5ffe5f0bb38e5b4dc6add213ba04048c0c7c264646375fcd01787

                                                          Download Submit

                                                        • C:\Windows\SysWOW64\ac\EVER\SearchHost.exe
                                                          Filesize

                                                          1.6MB

                                                          MD5

                                                          8add121fa398ebf83e8b5db8f17b45e0

                                                          SHA1

                                                          c8107e5c5e20349a39d32f424668139a36e6cfd0

                                                          SHA256

                                                          35c4a6c1474eb870eec901cef823cc4931919a4e963c432ce9efbb30c2d8a413

                                                          SHA512

                                                          8f81c4552ff561eea9802e5319adcd6c7e5bdd1dc4c91e56fda6bdc9b7e8167b222500a0aee5cf27b0345d1c19ac9fa95ae4fd58d4c359a5232bcf86f03d2273

                                                          Download Submit

                                                        • C:\Windows\SysWOW64\ac\mssql.exe
                                                          Filesize

                                                          10.2MB

                                                          MD5

                                                          f6a3d38aa0ae08c3294d6ed26266693f

                                                          SHA1

                                                          9ced15d08ffddb01db3912d8af14fb6cc91773f2

                                                          SHA256

                                                          c522e0b5332cac67cde8fc84080db3b8f2e0fe85f178d788e38b35bbe4d464ad

                                                          SHA512

                                                          814b1130a078dcb6ec59dbfe657724e36aa3db64ed9b2f93d8559b6a50e512365c8596240174141d6977b5ddcf7f281add7886c456dc7463c97f432507e73515

                                                          Download Submit

                                                        • C:\Windows\SysWOW64\ac\mssql2.exe
                                                          Filesize

                                                          6.7MB

                                                          MD5

                                                          f7d94750703f0c1ddd1edd36f6d0371d

                                                          SHA1

                                                          cc9b95e5952e1c870f7be55d3c77020e56c34b57

                                                          SHA256

                                                          659e441cadd42399fc286b92bbc456ff2e9ecb24984c0586acf83d73c772b45d

                                                          SHA512

                                                          af0ced00dc6eeaf6fb3336d9b3abcc199fb42561b8ce24ff2e6199966ad539bc2387ba83a4838301594e50e36844796e96c30a9aa9ad5f03cf06860f3f44e0fa

                                                          Download Submit

                                                        • C:\Windows\SysWOW64\ac\nc123.exe
                                                          Filesize

                                                          125KB

                                                          MD5

                                                          597de376b1f80c06d501415dd973dcec

                                                          SHA1

                                                          629c9649ced38fd815124221b80c9d9c59a85e74

                                                          SHA256

                                                          f47e3555461472f23ab4766e4d5b6f6fd260e335a6abc31b860e569a720a5446

                                                          SHA512

                                                          072565912208e97cc691e1a102e32fd6c243b5a3f8047a159e97aabbe302bddc36f3c52cecde3b506151bc89e0f3b5acf6552a82d83dac6e0180c873d36d3f6b

                                                          Download Submit

                                                        • C:\Windows\SysWOW64\ac\smaybsncmqoppx.sys
                                                          Filesize

                                                          674KB

                                                          MD5

                                                          b2233d1efb0b7a897ea477a66cd08227

                                                          SHA1

                                                          835a198a11c9d106fc6aabe26b9b3e59f6ec68fd

                                                          SHA256

                                                          5fd17e3b8827b5bb515343bc4066be0814f6466fb4294501becac284a378c0da

                                                          SHA512

                                                          6ca61854db877d767ce587ac3d7526cda8254d937a159fd985e0475d062d07ae83e7ff4f9f42c7e1e1cad5e1f408f6849866aa4e9e48b29d80510e5c695cee37

                                                          Download Submit

                                                        • C:\Windows\infpub.dat
                                                          Filesize

                                                          401KB

                                                          MD5

                                                          1d724f95c61f1055f0d02c2154bbccd3

                                                          SHA1

                                                          79116fe99f2b421c52ef64097f0f39b815b20907

                                                          SHA256

                                                          579fd8a0385482fb4c789561a30b09f25671e86422f40ef5cca2036b28f99648

                                                          SHA512

                                                          f2d7b018d1516df1c97cfff5507957c75c6d9bf8e2ce52ae0052706f4ec62f13eba6d7be17e6ad2b693fdd58e1fd091c37f17bd2b948cdcd9b95b4ad428c0113

                                                          Download Submit

                                                        • C:\Windows\infpub.dat
                                                          Filesize

                                                          401KB

                                                          MD5

                                                          f6f7dfe324da976481c8730ffd5509c0

                                                          SHA1

                                                          240f9e6e3caecd8ba5b95a1e426f9d61655a56f1

                                                          SHA256

                                                          7d03ed6535d8c34bf9672eeccb16cd0eca0d50941b7e2e410b0a7be58545d686

                                                          SHA512

                                                          4b1b7a9daa0ee984c124f6059beefac7bb2d24599e435b00f1df6a10d752eef7d5575a69775924a3ed8fda20566f4e1cb07b02eda68b81662fdd128c807929ed

                                                          Download Submit

                                                        • memory/1004-503-0x0000000002870000-0x00000000028D8000-memory.dmp

                                                          Filesize

                                                          416KB

                                                          Download

                                                        • memory/1004-497-0x0000000002870000-0x00000000028D8000-memory.dmp

                                                          Filesize

                                                          416KB

                                                          Download

                                                        • memory/1004-489-0x0000000002870000-0x00000000028D8000-memory.dmp

                                                          Filesize

                                                          416KB

                                                          Download

                                                        • memory/1012-529-0x0000000000400000-0x000000000056F000-memory.dmp

                                                          Filesize

                                                          1.4MB

                                                          Download

                                                        • memory/1012-689-0x0000000000400000-0x000000000056F000-memory.dmp

                                                          Filesize

                                                          1.4MB

                                                          Download

                                                        • memory/1012-3262-0x0000000000400000-0x000000000056F000-memory.dmp

                                                          Filesize

                                                          1.4MB

                                                          Download

                                                        • memory/2560-511-0x0000000000400000-0x0000000000438000-memory.dmp

                                                          Filesize

                                                          224KB

                                                          Download

                                                        • memory/2560-501-0x0000000000400000-0x0000000000438000-memory.dmp

                                                          Filesize

                                                          224KB

                                                          Download

                                                        • memory/2560-500-0x0000000000400000-0x0000000000438000-memory.dmp

                                                          Filesize

                                                          224KB

                                                          Download

                                                        • memory/3024-544-0x00000000058A0000-0x00000000058F6000-memory.dmp

                                                          Filesize

                                                          344KB

                                                          Download

                                                        • memory/3024-543-0x0000000005670000-0x000000000570C000-memory.dmp

                                                          Filesize

                                                          624KB

                                                          Download

                                                        • memory/3024-542-0x0000000000BF0000-0x0000000000C72000-memory.dmp

                                                          Filesize

                                                          520KB

                                                          Download

                                                        • memory/3152-541-0x00000000008B0000-0x00000000008D5000-memory.dmp

                                                          Filesize

                                                          148KB

                                                          Download

                                                        • memory/4512-3263-0x0000000000FB0000-0x0000000000FD5000-memory.dmp

                                                          Filesize

                                                          148KB

                                                          Download

                                                        • memory/4512-537-0x0000000000FB0000-0x0000000000FD5000-memory.dmp

                                                          Filesize

                                                          148KB

                                                          Download

                                                        • memory/4596-467-0x0000000000C70000-0x0000000000CDE000-memory.dmp

                                                          Filesize

                                                          440KB

                                                          Download

                                                        • memory/4596-468-0x0000000005DA0000-0x0000000006346000-memory.dmp

                                                          Filesize

                                                          5.6MB

                                                          Download

                                                        • memory/4596-469-0x00000000057F0000-0x0000000005882000-memory.dmp

                                                          Filesize

                                                          584KB

                                                          Download

                                                        • memory/4596-470-0x0000000005780000-0x000000000578A000-memory.dmp

                                                          Filesize

                                                          40KB

                                                          Download

                                                        • memory/12092-24447-0x0000000004A30000-0x0000000004A5B000-memory.dmp

                                                          Filesize

                                                          172KB

                                                          Download

                                                        • memory/12092-24451-0x0000000004A30000-0x0000000004A5B000-memory.dmp

                                                          Filesize

                                                          172KB

                                                          Download

                                                        • memory/12092-24432-0x0000000004A30000-0x0000000004A5B000-memory.dmp

                                                          Filesize

                                                          172KB

                                                          Download

                                                        • memory/12092-24427-0x0000000004A30000-0x0000000004A5B000-memory.dmp

                                                          Filesize

                                                          172KB

                                                          Download

                                                        • memory/12092-24426-0x0000000004A30000-0x0000000004A5B000-memory.dmp

                                                          Filesize

                                                          172KB

                                                          Download

                                                        • memory/12092-23533-0x00000000024E0000-0x0000000002512000-memory.dmp

                                                          Filesize

                                                          200KB

                                                          Download

                                                        • memory/12092-24445-0x0000000004A30000-0x0000000004A5B000-memory.dmp

                                                          Filesize

                                                          172KB

                                                          Download

                                                        • memory/12092-24449-0x0000000004A30000-0x0000000004A5B000-memory.dmp

                                                          Filesize

                                                          172KB

                                                          Download

                                                        • memory/12092-24012-0x0000000004A30000-0x0000000004A62000-memory.dmp

                                                          Filesize

                                                          200KB

                                                          Download

                                                        • memory/12092-24436-0x0000000004A30000-0x0000000004A5B000-memory.dmp

                                                          Filesize

                                                          172KB

                                                          Download

                                                        • memory/12092-24443-0x0000000004A30000-0x0000000004A5B000-memory.dmp

                                                          Filesize

                                                          172KB

                                                          Download

                                                        • memory/12092-24433-0x0000000004A30000-0x0000000004A5B000-memory.dmp

                                                          Filesize

                                                          172KB

                                                          Download

                                                        • memory/12092-24441-0x0000000004A30000-0x0000000004A5B000-memory.dmp

                                                          Filesize

                                                          172KB

                                                          Download

                                                        • memory/12092-26851-0x0000000005520000-0x000000000552E000-memory.dmp

                                                          Filesize

                                                          56KB

                                                          Download

                                                        • memory/12092-24437-0x0000000004A30000-0x0000000004A5B000-memory.dmp

                                                          Filesize

                                                          172KB

                                                          Download

                                                        • memory/12092-24439-0x0000000004A30000-0x0000000004A5B000-memory.dmp

                                                          Filesize

                                                          172KB

                                                          Download

                                                        • memory/29852-26821-0x0000000000400000-0x0000000000B02000-memory.dmp

                                                          Filesize

                                                          7.0MB

                                                          Download

                                                        • memory/29852-26806-0x0000000000400000-0x0000000000B02000-memory.dmp

                                                          Filesize

                                                          7.0MB

                                                          Download

                                                        • memory/33232-26871-0x0000000000940000-0x000000000094C000-memory.dmp

                                                          Filesize

                                                          48KB

                                                          Download