troldesh | hxxps://github[.]com/Endermanch/MalwareDatabase

Resubmissions

17/04/2025, 00:02

250417-abss1sxvby 10

16/04/2025, 23:53

250416-3xnems1pt6 10

16/04/2025, 23:50

250416-3vm14a1n12 7

Analysis

max time kernel
300s
max time network
285s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20250410-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20250410-enlocale:en-usos:windows10-ltsc_2021-x64system
submitted
16/04/2025, 23:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/Endermanch/MalwareDatabase

Score

10^/10

troldesh discovery persistence ransomware trojan upx

Malware Config

Signatures

Troldesh family
troldesh
Troldesh, Shade, Encoder.858
Troldesh is a ransomware spread by malspam.
ransomware trojan troldesh

Executes dropped EXE 3 IoCs

pid	Process
5156	[email protected]
5388	csrss.exe
1424	[email protected]

Loads dropped DLL 1 IoCs

pid	Process
916	msedge.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4097046113-3950943903-3587629992-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Client Server Runtime Subsystem = "\"C:\\ProgramData\\Windows\\csrss.exe\""	[email protected]

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
79	raw.githubusercontent.com
80	raw.githubusercontent.com
81	raw.githubusercontent.com

UPX packed file 13 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/5156-498-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral1/memory/5156-499-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral1/memory/5156-500-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral1/memory/5156-502-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral1/memory/5388-508-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral1/memory/5388-509-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral1/memory/5388-510-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral1/memory/5156-517-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral1/memory/1424-520-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral1/memory/1424-521-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral1/memory/5156-538-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral1/memory/5156-606-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral1/memory/5156-617-0x0000000000400000-0x00000000005DE000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping916_1632653452\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping916_1632653452\Part-DE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping916_1422806156\auto_open_controller.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping916_421043773\hyph-bn.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping916_421043773\hyph-de-1996.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping916_421043773\hyph-la.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping916_1632653452\Part-ES	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping916_1632653452\Part-IT	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping916_1422806156\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping916_1422806156\shopping_iframe_driver.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping916_421043773\hyph-it.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping916_421043773\hyph-ka.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping916_421043773\hyph-ta.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping916_421043773\hyph-uk.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping916_1632653452\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping916_421043773\hyph-cu.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping916_421043773\hyph-or.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping916_1632653452\Filtering Rules-AA	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping916_1422806156\edge_tracking_page_validator.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping916_237108001\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping916_1305847568\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping916_421043773\hyph-cs.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping916_421043773\hyph-ru.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping916_421043773\hyph-te.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping916_1422806156\edge_driver.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping916_1422806156\shopping.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping916_237108001\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping916_1081286942\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping916_249991907\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping916_421043773\hyph-de-1901.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping916_421043773\hyph-es.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping916_421043773\hyph-fr.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping916_421043773\hyph-kn.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping916_421043773\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping916_756027230\deny_full_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping916_1081286942\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping916_421043773\hyph-hi.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping916_421043773\hyph-sv.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping916_421043773\hyph-und-ethi.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping916_1632653452\adblock_snippet.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping916_1632653452\Filtering Rules-CA	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping916_1422806156\edge_confirmation_page_validator.js	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping916_421043773\hyph-as.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping916_421043773\hyph-lv.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping916_421043773\hyph-pt.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping916_1632653452\Part-NL	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping916_1632653452\Part-RU	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping916_237108001\sets.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping916_249991907\ct_config.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping916_421043773\hyph-en-gb.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping916_1422806156\shoppingfre.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping916_756027230\deny_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping916_756027230\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping916_1305847568\well_known_domains.dll	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping916_421043773\hyph-cy.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping916_421043773\hyph-en-us.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping916_421043773\hyph-mul-ethi.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping916_421043773\hyph-sl.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping916_1632653452\Part-FR	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping916_237108001\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping916_249991907\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping916_901841574\Microsoft.CognitiveServices.Speech.core.dll	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping916_421043773\hyph-be.hyb	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	[email protected]

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	taskmgr.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133893212362040849"	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4097046113-3950943903-3587629992-1000\{CA6FAA87-2972-4F79-B6B6-61766D05379D}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4097046113-3950943903-3587629992-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5156	[email protected]
5156	[email protected]
5156	[email protected]
5156	[email protected]
5388	csrss.exe
5388	csrss.exe
5388	csrss.exe
5388	csrss.exe
1424	[email protected]
1424	[email protected]
1424	[email protected]
1424	[email protected]
4384	taskmgr.exe
4384	taskmgr.exe
4384	taskmgr.exe
4384	taskmgr.exe
4384	taskmgr.exe
4384	taskmgr.exe
4384	taskmgr.exe
4384	taskmgr.exe
4384	taskmgr.exe
4384	taskmgr.exe
4384	taskmgr.exe
4384	taskmgr.exe
4384	taskmgr.exe
4384	taskmgr.exe
4384	taskmgr.exe
4384	taskmgr.exe
4384	taskmgr.exe
4384	taskmgr.exe
4384	taskmgr.exe
4384	taskmgr.exe
4384	taskmgr.exe
4384	taskmgr.exe
4384	taskmgr.exe
4384	taskmgr.exe
4384	taskmgr.exe
4384	taskmgr.exe
4384	taskmgr.exe
4384	taskmgr.exe
4384	taskmgr.exe
4384	taskmgr.exe
4384	taskmgr.exe
4384	taskmgr.exe
4384	taskmgr.exe
4384	taskmgr.exe
4384	taskmgr.exe
4384	taskmgr.exe
4384	taskmgr.exe
4384	taskmgr.exe
4384	taskmgr.exe
4384	taskmgr.exe
4384	taskmgr.exe
4384	taskmgr.exe
4384	taskmgr.exe
4384	taskmgr.exe
4384	taskmgr.exe
4384	taskmgr.exe
4384	taskmgr.exe
4384	taskmgr.exe
4384	taskmgr.exe
4384	taskmgr.exe
4384	taskmgr.exe
4384	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4384	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeRestorePrivilege	3128	7zG.exe
Token: 35	3128	7zG.exe
Token: SeSecurityPrivilege	3128	7zG.exe
Token: SeSecurityPrivilege	3128	7zG.exe
Token: SeDebugPrivilege	4384	taskmgr.exe
Token: SeSystemProfilePrivilege	4384	taskmgr.exe
Token: SeCreateGlobalPrivilege	4384	taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
3128	7zG.exe
4384	taskmgr.exe
4384	taskmgr.exe
4384	taskmgr.exe
4384	taskmgr.exe
4384	taskmgr.exe
4384	taskmgr.exe
4384	taskmgr.exe
4384	taskmgr.exe
4384	taskmgr.exe
4384	taskmgr.exe
4384	taskmgr.exe
4384	taskmgr.exe
4384	taskmgr.exe
4384	taskmgr.exe
4384	taskmgr.exe
4384	taskmgr.exe
4384	taskmgr.exe
4384	taskmgr.exe
4384	taskmgr.exe
4384	taskmgr.exe
4384	taskmgr.exe
4384	taskmgr.exe
4384	taskmgr.exe
4384	taskmgr.exe
4384	taskmgr.exe
4384	taskmgr.exe
4384	taskmgr.exe
4384	taskmgr.exe
4384	taskmgr.exe
4384	taskmgr.exe
4384	taskmgr.exe
4384	taskmgr.exe
4384	taskmgr.exe
4384	taskmgr.exe
4384	taskmgr.exe
4384	taskmgr.exe
4384	taskmgr.exe
4384	taskmgr.exe
4384	taskmgr.exe
4384	taskmgr.exe
4384	taskmgr.exe
4384	taskmgr.exe
4384	taskmgr.exe
4384	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
916	msedge.exe
916	msedge.exe
4384	taskmgr.exe
4384	taskmgr.exe
4384	taskmgr.exe
4384	taskmgr.exe
4384	taskmgr.exe
4384	taskmgr.exe
4384	taskmgr.exe
4384	taskmgr.exe
4384	taskmgr.exe
4384	taskmgr.exe
4384	taskmgr.exe
4384	taskmgr.exe
4384	taskmgr.exe
4384	taskmgr.exe
4384	taskmgr.exe
4384	taskmgr.exe
4384	taskmgr.exe
4384	taskmgr.exe
4384	taskmgr.exe
4384	taskmgr.exe
4384	taskmgr.exe
4384	taskmgr.exe
4384	taskmgr.exe
4384	taskmgr.exe
4384	taskmgr.exe
4384	taskmgr.exe
4384	taskmgr.exe
4384	taskmgr.exe
4384	taskmgr.exe
4384	taskmgr.exe
4384	taskmgr.exe
4384	taskmgr.exe
4384	taskmgr.exe
4384	taskmgr.exe
4384	taskmgr.exe
4384	taskmgr.exe
4384	taskmgr.exe
4384	taskmgr.exe
4384	taskmgr.exe
4384	taskmgr.exe
4384	taskmgr.exe
4384	taskmgr.exe
4384	taskmgr.exe
4384	taskmgr.exe
4384	taskmgr.exe
4384	taskmgr.exe
4384	taskmgr.exe
4384	taskmgr.exe
4384	taskmgr.exe
4384	taskmgr.exe
4384	taskmgr.exe
4384	taskmgr.exe
4384	taskmgr.exe
4384	taskmgr.exe
4384	taskmgr.exe
4384	taskmgr.exe
4384	taskmgr.exe
4384	taskmgr.exe
4384	taskmgr.exe
4384	taskmgr.exe
4384	taskmgr.exe
4384	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 916 wrote to memory of 1872	916	msedge.exe	81
PID 916 wrote to memory of 1872	916	msedge.exe	81
PID 916 wrote to memory of 2352	916	msedge.exe	82
PID 916 wrote to memory of 2352	916	msedge.exe	82
PID 916 wrote to memory of 5792	916	msedge.exe	83
PID 916 wrote to memory of 5792	916	msedge.exe	83
PID 916 wrote to memory of 5792	916	msedge.exe	83
PID 916 wrote to memory of 5792	916	msedge.exe	83
PID 916 wrote to memory of 5792	916	msedge.exe	83
PID 916 wrote to memory of 5792	916	msedge.exe	83
PID 916 wrote to memory of 5792	916	msedge.exe	83
PID 916 wrote to memory of 5792	916	msedge.exe	83
PID 916 wrote to memory of 5792	916	msedge.exe	83
PID 916 wrote to memory of 5792	916	msedge.exe	83
PID 916 wrote to memory of 5792	916	msedge.exe	83
PID 916 wrote to memory of 5792	916	msedge.exe	83
PID 916 wrote to memory of 5792	916	msedge.exe	83
PID 916 wrote to memory of 5792	916	msedge.exe	83
PID 916 wrote to memory of 5792	916	msedge.exe	83
PID 916 wrote to memory of 5792	916	msedge.exe	83
PID 916 wrote to memory of 5792	916	msedge.exe	83
PID 916 wrote to memory of 5792	916	msedge.exe	83
PID 916 wrote to memory of 5792	916	msedge.exe	83
PID 916 wrote to memory of 5792	916	msedge.exe	83
PID 916 wrote to memory of 5792	916	msedge.exe	83
PID 916 wrote to memory of 5792	916	msedge.exe	83
PID 916 wrote to memory of 5792	916	msedge.exe	83
PID 916 wrote to memory of 5792	916	msedge.exe	83
PID 916 wrote to memory of 5792	916	msedge.exe	83
PID 916 wrote to memory of 5792	916	msedge.exe	83
PID 916 wrote to memory of 5792	916	msedge.exe	83
PID 916 wrote to memory of 5792	916	msedge.exe	83
PID 916 wrote to memory of 5792	916	msedge.exe	83
PID 916 wrote to memory of 5792	916	msedge.exe	83
PID 916 wrote to memory of 5792	916	msedge.exe	83
PID 916 wrote to memory of 5792	916	msedge.exe	83
PID 916 wrote to memory of 5792	916	msedge.exe	83
PID 916 wrote to memory of 5792	916	msedge.exe	83
PID 916 wrote to memory of 5792	916	msedge.exe	83
PID 916 wrote to memory of 5792	916	msedge.exe	83
PID 916 wrote to memory of 5792	916	msedge.exe	83
PID 916 wrote to memory of 5792	916	msedge.exe	83
PID 916 wrote to memory of 5792	916	msedge.exe	83
PID 916 wrote to memory of 5792	916	msedge.exe	83
PID 916 wrote to memory of 5792	916	msedge.exe	83
PID 916 wrote to memory of 5792	916	msedge.exe	83
PID 916 wrote to memory of 5792	916	msedge.exe	83
PID 916 wrote to memory of 5792	916	msedge.exe	83
PID 916 wrote to memory of 5792	916	msedge.exe	83
PID 916 wrote to memory of 5792	916	msedge.exe	83
PID 916 wrote to memory of 5792	916	msedge.exe	83
PID 916 wrote to memory of 5792	916	msedge.exe	83
PID 916 wrote to memory of 5792	916	msedge.exe	83
PID 916 wrote to memory of 5792	916	msedge.exe	83
PID 916 wrote to memory of 5792	916	msedge.exe	83
PID 916 wrote to memory of 1796	916	msedge.exe	84
PID 916 wrote to memory of 1796	916	msedge.exe	84
PID 916 wrote to memory of 1796	916	msedge.exe	84
PID 916 wrote to memory of 1796	916	msedge.exe	84
PID 916 wrote to memory of 1796	916	msedge.exe	84
PID 916 wrote to memory of 1796	916	msedge.exe	84
PID 916 wrote to memory of 1796	916	msedge.exe	84
PID 916 wrote to memory of 1796	916	msedge.exe	84
PID 916 wrote to memory of 1796	916	msedge.exe	84

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/Endermanch/MalwareDatabase
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x318,0x7ffe658cf208,0x7ffe658cf214,0x7ffe658cf220
  2⤵
  PID:1872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1844,i,9506151859983040335,3868043039464574541,262144 --variations-seed-version --mojo-platform-channel-handle=2364 /prefetch:3
  2⤵
  PID:2352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2332,i,9506151859983040335,3868043039464574541,262144 --variations-seed-version --mojo-platform-channel-handle=2288 /prefetch:2
  2⤵
  PID:5792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2540,i,9506151859983040335,3868043039464574541,262144 --variations-seed-version --mojo-platform-channel-handle=2536 /prefetch:8
  2⤵
  PID:1796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3480,i,9506151859983040335,3868043039464574541,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:1
  2⤵
  PID:2668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3496,i,9506151859983040335,3868043039464574541,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:1
  2⤵
  PID:1284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5124,i,9506151859983040335,3868043039464574541,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:8
  2⤵
  PID:2424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5164,i,9506151859983040335,3868043039464574541,262144 --variations-seed-version --mojo-platform-channel-handle=5104 /prefetch:8
  2⤵
  PID:892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5560,i,9506151859983040335,3868043039464574541,262144 --variations-seed-version --mojo-platform-channel-handle=5568 /prefetch:8
  2⤵
  PID:5148
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6088,i,9506151859983040335,3868043039464574541,262144 --variations-seed-version --mojo-platform-channel-handle=5576 /prefetch:8
  2⤵
  PID:2996
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6088,i,9506151859983040335,3868043039464574541,262144 --variations-seed-version --mojo-platform-channel-handle=5576 /prefetch:8
  2⤵
  PID:5908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5896,i,9506151859983040335,3868043039464574541,262144 --variations-seed-version --mojo-platform-channel-handle=5900 /prefetch:8
  2⤵
  PID:5520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --field-trial-handle=6184,i,9506151859983040335,3868043039464574541,262144 --variations-seed-version --mojo-platform-channel-handle=5824 /prefetch:1
  2⤵
  PID:4856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6700,i,9506151859983040335,3868043039464574541,262144 --variations-seed-version --mojo-platform-channel-handle=6724 /prefetch:8
  2⤵
  PID:2196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --field-trial-handle=6736,i,9506151859983040335,3868043039464574541,262144 --variations-seed-version --mojo-platform-channel-handle=6824 /prefetch:1
  2⤵
  PID:4092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3684,i,9506151859983040335,3868043039464574541,262144 --variations-seed-version --mojo-platform-channel-handle=5572 /prefetch:8
  2⤵
  PID:2172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --field-trial-handle=6684,i,9506151859983040335,3868043039464574541,262144 --variations-seed-version --mojo-platform-channel-handle=5872 /prefetch:1
  2⤵
  PID:4704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5884,i,9506151859983040335,3868043039464574541,262144 --variations-seed-version --mojo-platform-channel-handle=3692 /prefetch:8
  2⤵
  PID:2380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3584,i,9506151859983040335,3868043039464574541,262144 --variations-seed-version --mojo-platform-channel-handle=5656 /prefetch:8
  2⤵
  PID:3340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6788,i,9506151859983040335,3868043039464574541,262144 --variations-seed-version --mojo-platform-channel-handle=6404 /prefetch:8
  2⤵
  PID:4416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5096,i,9506151859983040335,3868043039464574541,262144 --variations-seed-version --mojo-platform-channel-handle=5736 /prefetch:8
  2⤵
  PID:5032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6936,i,9506151859983040335,3868043039464574541,262144 --variations-seed-version --mojo-platform-channel-handle=6860 /prefetch:8
  2⤵
  PID:2484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6924,i,9506151859983040335,3868043039464574541,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:8
  2⤵
  PID:2768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5220,i,9506151859983040335,3868043039464574541,262144 --variations-seed-version --mojo-platform-channel-handle=6908 /prefetch:8
  2⤵
  PID:2644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6948,i,9506151859983040335,3868043039464574541,262144 --variations-seed-version --mojo-platform-channel-handle=6332 /prefetch:8
  2⤵
  PID:3176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=6840,i,9506151859983040335,3868043039464574541,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:8
  2⤵
  PID:1360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5552,i,9506151859983040335,3868043039464574541,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:8
  2⤵
  PID:5048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=2992,i,9506151859983040335,3868043039464574541,262144 --variations-seed-version --mojo-platform-channel-handle=6320 /prefetch:8
  2⤵
  PID:2488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3460,i,9506151859983040335,3868043039464574541,262144 --variations-seed-version --mojo-platform-channel-handle=5684 /prefetch:8
  2⤵
  PID:2484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3452,i,9506151859983040335,3868043039464574541,262144 --variations-seed-version --mojo-platform-channel-handle=3240 /prefetch:8
  2⤵
  PID:1216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4832,i,9506151859983040335,3868043039464574541,262144 --variations-seed-version --mojo-platform-channel-handle=3320 /prefetch:8
  2⤵
  PID:5008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3488,i,9506151859983040335,3868043039464574541,262144 --variations-seed-version --mojo-platform-channel-handle=4000 /prefetch:8
  2⤵
  PID:2700

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:5332

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
  2⤵
  PID:3492

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5432

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\NoMoreRansom\" -spe -an -ai#7zMap3478:86:7zEvent7360
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3128

C:\Users\Admin\Downloads\NoMoreRansom\[email protected]
"C:\Users\Admin\Downloads\NoMoreRansom\[email protected]"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:5156

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\ProgramData\Windows\csrss.exe"
1⤵
PID:5456
- C:\ProgramData\Windows\csrss.exe
  C:\ProgramData\Windows\csrss.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:5388

C:\Users\Admin\Downloads\NoMoreRansom\[email protected]
"C:\Users\Admin\Downloads\NoMoreRansom\[email protected]"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1424

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4384

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
9a4c1ed93782e9b67c4f4e4f7154099b

SHA1
0b0ad64a8b4e9086e09efa428ead470f10190ac7

SHA256
df0c0e585b383666db28063cc3b34a4d974f9a73832c9047bf831f48e38aea75

SHA512
77673c0c295471fd434a576739093d0911f9848c6f5152eb77b21f13ab773b334fa69fc2d715c8e32cd487d033b229329a2dd19fb2d3b0d9c10163ec75c507ff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old

Filesize
334B

MD5
18fbf2c32d27b5bd65f4a2895f4b2ac2

SHA1
ce0f0d6af0f165e10c95c7a982669adf80e35579

SHA256
7f429e5c012bdf7d6635d72865a9072b741853ff431b802c70188a1a4b781dd2

SHA512
096a7f74c8708a7f7e271e97c291c16cccec4410e3d42301ddb2fd04254d40fbe3010250d1d6b89b96fa133730855114f0829773634109e246492a0776b6dba9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
5KB

MD5
53dfdebb653ddcc068cf316f0114f94c

SHA1
d8c51db7cde24061710a8931695b1f444c493247

SHA256
dfd3ee2b1f8044ebb41f452be2f9dff32f08ec326592c2b37983ae813da290e0

SHA512
1def67833ffe180a87dd7bf14d20dd33104c07c8b0c003651f0347c9708de2dfe00c2cdedeb8736b3bfb128b914b995babe9379b2fc380e8fc7bddad1e2165e0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe580858.TMP

Filesize
3KB

MD5
87134786d06b4827a300a2d2f47d7a16

SHA1
7cab90c8e3e4efb7ba46cb34fcb67179a96dee87

SHA256
e9e2f1472751233a26d011434122dab0fe6c721245177ba5d4bce461c97248f1

SHA512
493d26ec2a54a63471a1e97cea2af1960b82546eef4cd50ab4449f23f33ac9090e4fdb3d30ecbfe3ae9aef4c81e260e2ac95e2f8e3003fdac997b121e7164824

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps

Filesize
107KB

MD5
2b66d93c82a06797cdfd9df96a09e74a

SHA1
5f7eb526ee8a0c519b5d86c845fea8afd15b0c28

SHA256
d4c064db769b3c109da2ed80a53fbab00987c17421a47921e41e213781d67954

SHA512
95e45c0aea0e704be5f512dffaae377d4abef78da99b3bca769264d69be20f2570daf2f47905645217e1b2696e42b101f26149219f148b4d6dd97a6c2868b6f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
3af24c743e7b75d1ca214ccfa9c784fc

SHA1
0e9299052e99d52084032104b047f29c0982272b

SHA256
98611900977df7a17f8f3428ef2408f0c7ff79ee36b6e2482275fde03248fdec

SHA512
06ca7686172757ed481a3796a7cacaea2ba0d2a590937b9131598e5290593411d473e9d68f6a3fc02c31004274c68b674b16524357f93044fb39ca814f704acd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
aab44f6f06e64b2b4221b22a2f712d0d

SHA1
a39db4fb72595153ff37d58fb8bf8f4db71c3fd4

SHA256
8f45fb423c4d3bea636e0001913d74914f133c1c846fd15637f6c692385e7b0c

SHA512
a2178553b062ad14fe18429625b5d3942f980782e598b27383bc4916d94113fe605aef2cd3cd132702dd019b31db3cc0fc97bb6ce6cbd2a7f4c595ddfd7eee46

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
037a9192882d65ef036e5a38d94a2fff

SHA1
4beea1b5173c4621e4deaad2ef282333f78d2d1a

SHA256
91ddfa83f0af4c0ad13b3153c1740180ecacc9e4cb6117180b797a436ab3f119

SHA512
0047248bbf603978a6464df98be79b56d21395cabf9d8d336781d337713f5165f793896aff727df4800b2bebdce3a1da9b08638b7bc4e9f6ebad5d76230d60c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
47bd0ac71ce8f0da5b9628918597fd42

SHA1
1307bc2a17f2d82d746f191f13199939a873db30

SHA256
ec746dc25bae4ff6890756aa5a48513354b7217e4da9dfa909d04180b65ba3d3

SHA512
523ed2f480e89bb59dae627db3d386f51b5839c2568164baecb74d9bcb573cd6ccc48294eeb6841fb1483d44af112035d0e597f598bfe91f951e6da151392904

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
9a01edd3b434f289b63082e645e06321

SHA1
308b654ca976b03984cc8306be2beefa0c928fc4

SHA256
556975b788fe0c53f41ea6f9acf4e0b995873037693e75659ef57c45fc1b3dc5

SHA512
c50f4dbdafd6c9dec3f06b6931910d2ffc413cb58b826e0fbf565f2115a0d562301bf234e515a35790c338719b43e52c027420e2471caad3998f3b7911151203

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
ca486f9b7faa6b418ba9fe93839266d7

SHA1
db29ee29f800c0fe3ff2ea520b62320822a3b7e1

SHA256
fc96080c0c6a4249e29cf66409df0e1bdabc79a9149cc089146eebcbdcafe9c7

SHA512
51b3cbb96a7353f5c1c5182ba9cc38cf2a3481b8770f05778a051c8b559e584041a25f544448ea09f6bcec67b02bfeb8c052e7724edd449c332188c7d1809cb0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
40B

MD5
20d4b8fa017a12a108c87f540836e250

SHA1
1ac617fac131262b6d3ce1f52f5907e31d5f6f00

SHA256
6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

SHA512
507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
16KB

MD5
d1a40357d835636da2fab42cee72b5cb

SHA1
a7534e51166287615e3cbbbff68115d55e3081c2

SHA256
d06564056c14bc1fe5a12dbd26826247f95afa9bd2a630a9bb76c89205254a25

SHA512
4f641932e0a0ec1bf335bac582900e0094eb22800a0410d9cd09e582ae0cb3486f6ed176d75ff91831700955a9759a82643b31ee8451f68d6d1b5b60df914c1c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
16KB

MD5
62577b42a48792ef748e602a17fcc358

SHA1
9e13908fee782ec2d1e2eec06e83f6cce0feca56

SHA256
166034fca276de969bcc36687bce542cfaa5c95bf0f6cf881743d3c79dab3178

SHA512
cedb96dea92d7b34964f36cf4d97568a0f2e7589351c987b7742123def7e5bb40cc6769524cdaef7ebb5352bbb37d299e482e3a1593b50707e3b167956477ecc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
16KB

MD5
a049bc828254c63773ecb8b01cc6b7c0

SHA1
79e28bce830ebfbf4f7f445069cc76ba513b4882

SHA256
9e78e5d85268bf088f7f83a6f51a0a175b9b22e5eafcb0a0821ba0aa463a8eae

SHA512
ed205b5ffba0ad00603ed8de73a8b5167e87be4394520605dee477bc9c6219ebe29f8695da4bc82cf4ca8441bfca004ef4b6cf05299c2db2bb0b29dae96c96ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
36KB

MD5
2dda1be0c43205983c0fe236dd2262e0

SHA1
f206b67e3eb8041178b708c9602e4a79da207f35

SHA256
e38a1c4b97b6168a0e3db8044337eb2dc4c389cd81e0a467595f8e49817c9f3e

SHA512
8d6a9701c2f72cdcf3d4e014999032d050904c44d6894691b0623719d40b3590e813cd5aaa9b464a5598c80bf30abc508f1753a92046271b32e20eb228bbac7d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

Filesize
22KB

MD5
81ecdaf9ed7b32f364175b88f0487a2b

SHA1
e94f12e26f4d21a7510cdb5e7a76dd2f45bbae6d

SHA256
d25062fccd5383b970746c3cbccefa1fee422e042ddcc593372e5f67805edebb

SHA512
6f31336441550d0585f00f609cdbdea09dc1c21a13bb12310a31e517329eb24f08415b963aac3f0e5c0e76dee0e2270367f1a6cb2dc5c7556fca74119960c68f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
20KB

MD5
0b037cc57336187a1cb8c70e3026b48e

SHA1
21fda63d3d49a6e993f242eb3eaf4487a90c334f

SHA256
e31caf158b959bcec1c7867255c67f55c063e5896c6803faef1f45cfa882e430

SHA512
8e7891d406a85d82e54dba299e3f80bcbafd15482c912d64e033737307a4840f46332dcda8a41ed101790b0171674d9f474692b98a66ee4434cce02e5127ecb5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
904B

MD5
d7c9a0ad03745d0bf92837a4c105bb8f

SHA1
eed85deda2f51f5e1064fe005504c7cb3d194462

SHA256
be4fcbe518f7c0000fc3949a510a4f1395db2a8d5d5a42f1af23365e359db2db

SHA512
902dcdf9233f985baf8ee57f354c60953f1b095bd0898b3dead3debc8679ff437037fe2d66075fba928b5c1360e6a27ef2056937d2d821723791e01256c0fc17

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
469B

MD5
1fd784c36a3b102d4912ae1c5cac82d0

SHA1
f644540f192968aec02a16543f6335b4cfdcd21d

SHA256
eb4b039576b4928cc4bacbae214b66e2942f957c108569370e115509708b162b

SHA512
d33a99f0ce1913c21eb1916727f1e67e0be82ebd71df437200af1bd14c1e61a556c4387dad5c738ff206d648eb2870d5b257bd925fbce5709328741b728c4e9e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig

Filesize
22KB

MD5
3f8927c365639daa9b2c270898e3cf9d

SHA1
c8da31c97c56671c910d28010f754319f1d90fa6

SHA256
fc80d48a732def35ab6168d8fd957a6f13f3c912d7f9baf960c17249e4a9a1f2

SHA512
d75b93f30989428883cb5e76f6125b09f565414cf45d59053527db48c6cf2ac7f54ed9e8f6a713c855cd5d89531145592ef27048cf1c0f63d7434cfb669dbd72

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
49KB

MD5
41c770df49a603cf565d68964f31a6fc

SHA1
1e17bbdc048d17507ef0af1b0649d191139b11d3

SHA256
e7a659953d5443d92b6686268cc5c48d30d15664347746ba847fc6c1ab8145ed

SHA512
44fe7675497728e67f1d1358c5d7b1cbe21b006e0e386daa80a539d468d68ad3669e0a3cab843460eb2679d3f0b7f3e36e22068e41a061fe05c98aee29683a8c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
49KB

MD5
8c468503470cec86a84250b5ad751c6a

SHA1
20ae01640b35f77dde910bc82857db66a176d04e

SHA256
3ec8fdc8837e2465961e02cba49047db0a7aca8bd4b4679ccee9359eb77119af

SHA512
7205d2630b2e6743e9572a8d2abab11cf8007457180d5b0d45a7ef21ac94e7f9cf9325815dc90dee3668a9e3467c82886a3b0da53795878043fe7b4af1cbbd26

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
40KB

MD5
687d72e327479a811c1771a632364ee5

SHA1
88ea52be158353129a78cf0d170ebb0edb9f20c8

SHA256
bca15c220aac4dedb63599294dd11988f2a8a8abfdf554b8ae0745c0bdc1bf20

SHA512
1a273c1682114044ec1d3842390d487f6f2a0089922e565b23ff94906547a2e7d538a9b0a6857da1e7505119875a7c80bd11f33f4ae1ec8e7a927e2ee694b32d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
49KB

MD5
56db5fb65669fdb12578bc48af94ded8

SHA1
38290d866856c2ba9f0e8b18957ef6985a05cffe

SHA256
a15dfaedf1aa65108a5c3dd51d30f97c080fb12b3ef2f2143b2f2425090b06f5

SHA512
9e3b11de45b303b71c08979434e414439ecd5c8ce3f3c6daa9a7b519caefb3af41e910c8a762672a8464e8b3bded2344dcc1f6e26345c176d3a357b59716cebf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
54KB

MD5
2c05570352f3627991d9616cb7203b53

SHA1
2ccbc2e461bc840b213cf77035744835f8ddf05f

SHA256
9c4ffd73a16f70eee267d72bdb55b7fff722153863864f0d74ff851168b1a888

SHA512
37938fce56ee27e47700c654d8f0f8203798a8862ad29f8a7421e7c85f2fd6ebd71afa776da47a9d6e8441692c4dcfd575b71806118b05d49d544f17cb66cdb1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter

Filesize
392B

MD5
5dc46729ef97d131cece4520a7c46bfa

SHA1
8abf1b7e33b31c3613e0204953b2c519ea962509

SHA256
3a2c1e5e20073df6a3f86c8819b7a096545c663280b7a6147c4fa4cf952ae679

SHA512
ce55f531dbd88015133fe8fc0ee120f35d3810cb24222b73d5fd0c23a0c965d310e54f5a4f19601116d05c49f8642a802940a320dad5368545c44a3ebce05cfb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter

Filesize
392B

MD5
d6c2767431ef8002600307d1a19dc10d

SHA1
caa6388910766f41989c8bcce78f89481a75e40d

SHA256
4590c37ede3c9472e7f27d15a3c8efe7634c3e99f612238c1cd02ec9c7fef622

SHA512
7625976f8a1a6e0f938b3c57ee97a3d97cfe1693682d2122e95fa7b9debb6f4300fd4aede6048e44185651ebe86a0b73381b10abb67fb2e16cf34d992fba2159

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe57d14a.TMP

Filesize
392B

MD5
62544a3dcee7ba3ee8bfec302a356153

SHA1
10477f1b3f45ab32f4cb7e298639f32ec48bea89

SHA256
5ee36bf34886745d795586c5d2e6717741b5a9200cd3ca0372e3e775ee7c88d5

SHA512
e47d66f097214aab956ebe355e0e3cb770af011ad25e1e4c01212393c01892fae3fd55130c64f182423e83196e769c0b0e4e79abbb2d641a58ab944a45394902

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Well Known Domains\1.2.0.0\well_known_domains.dll

Filesize
572KB

MD5
f5f5b37fd514776f455864502c852773

SHA1
8d5ed434173fd77feb33cb6cb0fad5e2388d97c6

SHA256
2778063e5ded354d852004e80492edb3a0f731b838bb27ba3a233bc937592f6e

SHA512
b0931f1cae171190e6ec8880f4d560cc7b3d5bffe1db11525bd133eaf51e2e0b3c920ea194d6c7577f95e7b4b4380f7845c82eb2898ad1f5c35d4550f93a14b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Filesize
2KB

MD5
2fa7681f2afe41e2a4e03ff5527602bb

SHA1
0f2c34dc6bc077f5e2571699ed8ddf496db91d18

SHA256
d459544cdc32c9f0c54fe6c2cb6a173addd633538fdb16ed70c631b0993b0f17

SHA512
a32dccc518af086847da8b9109e11507ae045d23fc19d39e1d3c0b1453d1e6d057653af04443d7e7ff6ad24c0b67fcad5b1fc7e1e7b3ce18c8bfa407d9a23b65

Download Submit
C:\Users\Admin\Downloads\NoMoreRansom.zip

Filesize
916KB

MD5
f315e49d46914e3989a160bbcfc5de85

SHA1
99654bfeaad090d95deef3a2e9d5d021d2dc5f63

SHA256
5cbb6442c47708558da29588e0d8ef0b34c4716be4a47e7c715ea844fbcf60d7

SHA512
224747b15d0713afcb2641f8f3aa1687516d42e045d456b3ed096a42757a6c10c6626672366c9b632349cf6ffe41011724e6f4b684837de9b719d0f351dfd22e

Download Submit
C:\Users\Admin\Downloads\NoMoreRansom\[email protected]

Filesize
1.4MB

MD5
63210f8f1dde6c40a7f3643ccf0ff313

SHA1
57edd72391d710d71bead504d44389d0462ccec9

SHA256
2aab13d49b60001de3aa47fb8f7251a973faa7f3c53a3840cdf5fd0b26e9a09f

SHA512
87a89e8ab85be150a783a9f8d41797cfa12f86fdccb48f2180c0498bfd2b1040b730dee4665fe2c83b98d436453680226051b7f1532e1c0e0cda0cf702e80a11

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping916_1422806156\edge_checkout_page_validator.js

Filesize
1.1MB

MD5
1db0c159a8afc8073ed9f0a83f782ae8

SHA1
0874d03928cc347db7f5c7720fa6c23321671fb7

SHA256
f7ee28dee8d78ac7456a683cbc673e8b3b57bc9a1ba37c0d6d5d4332a7534d93

SHA512
4fda31e15918efa31ebbd69965e3fa1702daf6b1995af2c010a63e55030ee2f3affb4c45ea6275b7d4c35c0e61bdfbd3051872f392725394489b4c43e8cb3bf1

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping916_421043773\hyph-bn.hyb

Filesize
703B

MD5
8961fdd3db036dd43002659a4e4a7365

SHA1
7b2fa321d50d5417e6c8d48145e86d15b7ff8321

SHA256
c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe

SHA512
531ecec11d296a1ab3faeb2c7ac619da9d80c1054a2ccee8a5a0cd996346fea2a2fee159ac5a8d79b46a764a2aa8e542d6a79d86b3d7dda461e41b19c9bebe92

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping916_421043773\hyph-mr.hyb

Filesize
687B

MD5
0807cf29fc4c5d7d87c1689eb2e0baaa

SHA1
d0914fb069469d47a36d339ca70164253fccf022

SHA256
f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42

SHA512
5324fd47c94f5804bfa1aa6df952949915896a3fc77dccaed0eeffeafe995ce087faef035aecea6b4c864a16ad32de00055f55260af974f2c41afff14dce00f3

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping916_421043773\hyph-nn.hyb

Filesize
141KB

MD5
f2d8fe158d5361fc1d4b794a7255835a

SHA1
6c8744fa70651f629ed887cb76b6bc1bed304af9

SHA256
5bcbb58eaf65f13f6d039244d942f37c127344e3a0a2e6c32d08236945132809

SHA512
946f4e41be624458b5e842a6241d43cd40369b2e0abc2cacf67d892b5f3d8a863a0e37e8120e11375b0bacb4651eedb8d324271d9a0c37527d4d54dd4905afab

Download Submit
memory/1424-520-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/1424-521-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/4384-595-0x000001742E5B0000-0x000001742E5B1000-memory.dmp

Filesize
4KB

Download
memory/4384-603-0x000001742E5B0000-0x000001742E5B1000-memory.dmp

Filesize
4KB

Download
memory/4384-602-0x000001742E5B0000-0x000001742E5B1000-memory.dmp

Filesize
4KB

Download
memory/4384-601-0x000001742E5B0000-0x000001742E5B1000-memory.dmp

Filesize
4KB

Download
memory/4384-600-0x000001742E5B0000-0x000001742E5B1000-memory.dmp

Filesize
4KB

Download
memory/4384-599-0x000001742E5B0000-0x000001742E5B1000-memory.dmp

Filesize
4KB

Download
memory/4384-594-0x000001742E5B0000-0x000001742E5B1000-memory.dmp

Filesize
4KB

Download
memory/4384-593-0x000001742E5B0000-0x000001742E5B1000-memory.dmp

Filesize
4KB

Download
memory/4384-604-0x000001742E5B0000-0x000001742E5B1000-memory.dmp

Filesize
4KB

Download
memory/4384-605-0x000001742E5B0000-0x000001742E5B1000-memory.dmp

Filesize
4KB

Download
memory/5156-538-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/5156-617-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/5156-606-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/5156-517-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/5156-502-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/5156-500-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/5156-499-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/5156-498-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/5388-510-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/5388-509-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/5388-508-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download