cryptjoker | e8527f309846d18fbf85289283dcde7b19063a50b11263ba0d36663df8fcfd30

Analysis

max time kernel
149s
max time network
98s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
08/05/2026, 12:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e8527f309846d18fbf85289283dcde7b19063a50b11263ba0d36663df8fcfd30.exe
Size 581KB
Sample260508-n6kmsagv21
SHA256 e8527f309846d18fbf85289283dcde7b19063a50b11263ba0d36663df8fcfd30
MD5 e997e15ae021046dc75a618b7bcc2a01
SHA1 06f9cf60d1ee55fd815b14b2c280f23e39685ef6
SHA512 405ff7e7f556224e6128233f1aedb8d4aed5c52850aaac1ff14c94857db0f9f896a0772cc2c7325beb702ba1e72133f783e8bb5e3e34053f9d98e316222c4fff
SSDEEP 12288:WnSKwjzsZpds2JbrpoRSKwjzuZpXs2JTypo:WnSKwWes6RSKw88s/
TLSH
T1A5C4E04237985673C87DCA73EC16C2710F30DDAECB42C76B39C1B66B3C9A6608A43A55
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

credential_access discovery cryptjoker ransomware spyware stealer

Malware Config

Signatures

Family: CryptJoker, PlutoCrypt
CryptoJoker is an open source ransomware written in C#.
ransomware cryptjoker

Detects CryptoJoker ransomware 1 IoCs

resource	yara_rule
behavioral2/memory/2596-0-0x000001F0400B0000-0x000001F040148000-memory.dmp	family_cryptjoker

Renames multiple (3253) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware
Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
credential_access stealer

Windows Credential Manager
T1555.004

Drops startup file 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	e8527f309846d18fbf85289283dcde7b19063a50b11263ba0d36663df8fcfd30.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops desktop.ini file(s) 37 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Music\desktop.ini	e8527f309846d18fbf85289283dcde7b19063a50b11263ba0d36663df8fcfd30.exe
File opened for modification	C:\Users\Admin\Searches\desktop.ini	e8527f309846d18fbf85289283dcde7b19063a50b11263ba0d36663df8fcfd30.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini	e8527f309846d18fbf85289283dcde7b19063a50b11263ba0d36663df8fcfd30.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini	e8527f309846d18fbf85289283dcde7b19063a50b11263ba0d36663df8fcfd30.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	e8527f309846d18fbf85289283dcde7b19063a50b11263ba0d36663df8fcfd30.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	e8527f309846d18fbf85289283dcde7b19063a50b11263ba0d36663df8fcfd30.exe
File opened for modification	C:\Users\Admin\Links\desktop.ini	e8527f309846d18fbf85289283dcde7b19063a50b11263ba0d36663df8fcfd30.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini	e8527f309846d18fbf85289283dcde7b19063a50b11263ba0d36663df8fcfd30.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	e8527f309846d18fbf85289283dcde7b19063a50b11263ba0d36663df8fcfd30.exe
File opened for modification	C:\Users\Admin\Saved Games\desktop.ini	e8527f309846d18fbf85289283dcde7b19063a50b11263ba0d36663df8fcfd30.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	e8527f309846d18fbf85289283dcde7b19063a50b11263ba0d36663df8fcfd30.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn1\desktop.ini	e8527f309846d18fbf85289283dcde7b19063a50b11263ba0d36663df8fcfd30.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini	e8527f309846d18fbf85289283dcde7b19063a50b11263ba0d36663df8fcfd30.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	e8527f309846d18fbf85289283dcde7b19063a50b11263ba0d36663df8fcfd30.exe
File opened for modification	C:\Users\Admin\Pictures\Camera Roll\desktop.ini	e8527f309846d18fbf85289283dcde7b19063a50b11263ba0d36663df8fcfd30.exe
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	e8527f309846d18fbf85289283dcde7b19063a50b11263ba0d36663df8fcfd30.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini	e8527f309846d18fbf85289283dcde7b19063a50b11263ba0d36663df8fcfd30.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini	e8527f309846d18fbf85289283dcde7b19063a50b11263ba0d36663df8fcfd30.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini	e8527f309846d18fbf85289283dcde7b19063a50b11263ba0d36663df8fcfd30.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	e8527f309846d18fbf85289283dcde7b19063a50b11263ba0d36663df8fcfd30.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini	e8527f309846d18fbf85289283dcde7b19063a50b11263ba0d36663df8fcfd30.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini	e8527f309846d18fbf85289283dcde7b19063a50b11263ba0d36663df8fcfd30.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Application Shortcuts\desktop.ini	e8527f309846d18fbf85289283dcde7b19063a50b11263ba0d36663df8fcfd30.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini	e8527f309846d18fbf85289283dcde7b19063a50b11263ba0d36663df8fcfd30.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini	e8527f309846d18fbf85289283dcde7b19063a50b11263ba0d36663df8fcfd30.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	e8527f309846d18fbf85289283dcde7b19063a50b11263ba0d36663df8fcfd30.exe
File opened for modification	C:\Users\Admin\Favorites\Links\desktop.ini	e8527f309846d18fbf85289283dcde7b19063a50b11263ba0d36663df8fcfd30.exe
File opened for modification	C:\Users\Admin\OneDrive\desktop.ini	e8527f309846d18fbf85289283dcde7b19063a50b11263ba0d36663df8fcfd30.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	e8527f309846d18fbf85289283dcde7b19063a50b11263ba0d36663df8fcfd30.exe
File opened for modification	C:\Users\Admin\Pictures\Saved Pictures\desktop.ini	e8527f309846d18fbf85289283dcde7b19063a50b11263ba0d36663df8fcfd30.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn2\desktop.ini	e8527f309846d18fbf85289283dcde7b19063a50b11263ba0d36663df8fcfd30.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini	e8527f309846d18fbf85289283dcde7b19063a50b11263ba0d36663df8fcfd30.exe
File opened for modification	C:\Users\Admin\Contacts\desktop.ini	e8527f309846d18fbf85289283dcde7b19063a50b11263ba0d36663df8fcfd30.exe
File opened for modification	F:\$RECYCLE.BIN\S-1-5-21-1456842261-3464001825-2855069093-1000\desktop.ini	e8527f309846d18fbf85289283dcde7b19063a50b11263ba0d36663df8fcfd30.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini	e8527f309846d18fbf85289283dcde7b19063a50b11263ba0d36663df8fcfd30.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini	e8527f309846d18fbf85289283dcde7b19063a50b11263ba0d36663df8fcfd30.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	e8527f309846d18fbf85289283dcde7b19063a50b11263ba0d36663df8fcfd30.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2596	e8527f309846d18fbf85289283dcde7b19063a50b11263ba0d36663df8fcfd30.exe

C:\Users\Admin\AppData\Local\Temp\e8527f309846d18fbf85289283dcde7b19063a50b11263ba0d36663df8fcfd30.exe
"C:\Users\Admin\AppData\Local\Temp\e8527f309846d18fbf85289283dcde7b19063a50b11263ba0d36663df8fcfd30.exe"
1⤵
- Drops startup file
- Drops desktop.ini file(s)
- Suspicious use of AdjustPrivilegeToken
PID:2596

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Windows Credential Manager

T1555.004

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

USStmp.jtx

Path C:\Users\Admin\AppData\Local\Comms\UnistoreDB\USStmp.jtx
Size 3.0MB
SHA256 679f331dfae27db8b1b3d7644b455c8096fb67838633bd882de66ac042d8ded0
MD5 56d0ef48c3f867b1c5e94cfb0fb5a008
SHA1 e43611d3e8f2e7ceba5adf23556c3bc8ed298baa
SHA512 01f53af52619b00c6e42dc9273191ebd280c7432e45f0fcfbce9aa3ee9f8fd656ae810433e38331ae0f19f97bdf0decd21d91efbccbb6a2e94c3a2de12b59a39
SSDEEP 3:rx/:rZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension State\CURRENT
Size 16B
SHA256 1bacff3cdbbd9cc2406e6a73327b622307bfd79e865fa8ab7214b2184ad85ccd
MD5 b51bd523e020654414aab2bf320dbd21
SHA1 09f042261bb4ae17e434cbbad22a39e3b6647175
SHA512 87f8cd6f351fd80f1aebdf9e73c3eba777a79665bfb4c7ee09d8f190814d8f11b744370e73d3f1aeeba429552e8b111c5db7d5d64d2b9a6beaaa3a887fe5ab75
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension State\MANIFEST-000001
Size 41B
SHA256 3de105c0b34ebed46d6cf323a9b8bc1ab10292d20a2ecd3db7fc737d468f1e7c
MD5 2c99de9b61d9a9ef6f2747b7c5631ddd
SHA1 992bac6deb57b363bd4d164bccc010fcfb5a32d4
SHA512 f617b908c938970f081bde8202efff18d761337fbb1a07e613ede7fee7727916f7a5c129ec3e3b21f68bb2ad4616578f4b98cd5950c5ce5b240ed92075bf5946
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_0
Size 8KB
SHA256 8c5bd90ca54284955375fa919b04ba5d91ce033b246c7bbb464c3cdbc284ab25
MD5 17db2734aba475a2298c19a9551b7b28
SHA1 07b3a5ea5e82423d934e32ab61de9836d08ca943
SHA512 21e7be74f956f2d1365bed2ad072c1c187f9cee2bf7bd27a6ad4f728ebe611e77a43eb1821e497702b4f548a8cf4ef9c2f2d39d0b2f5c7d3b236e3abcf88631d
SSDEEP 3:aEGFS/:Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1
Size 264KB
SHA256 f0e08624db9e1b3cf62c43d4266e7b201322599c9924ff55a7816b5e329dec2d
MD5 3ff53f3cd49f891dc98b9f592404a341
SHA1 e0e33b091638f643d1e8b6301c395ccc21159fb7
SHA512 35f004e4af35502b02f7dc3fc019b8da044e9337a29aeecca58b57c1278c2c4931d9a1ca1d951821361330a898f1391a9c40bb7c8f0206f5a3c6443070ebe856
SSDEEP 3:aQwwKwwGKOwPI/CE:6cEQC
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_2
Size 8KB
SHA256 dc7b5439a27819ddffd0d0532062aa8e5eac283798653c8b00df206b76cd83f2
MD5 5b98652eac833b57a208580de1fb5519
SHA1 7ae99be80ebcef0c63ef40b0f6fbda76da3b1be7
SHA512 c93c6fe02a8704aeaa390e8c6b6404ded0cbb0421c3423bd8178ee2b4853961081249b6a5fc8cc0c2bfd03fa7ff0373d9378ffa15286f7c83846ef6cfca83092
SSDEEP 3:aKw8wKwwB/:b
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_3
Size 8KB
SHA256 0adc4c6710c0e0dce4e6bf90d82ca8000ab8d56c6f02c42620285eac58959319
MD5 fbf9cebf08fa0af0b9bad142500dcca8
SHA1 c292408b42921d3ff054799bc341edd3fe80272a
SHA512 7e138bd40327545aedb705c50ae7db004bd472c9149bb4ffa0193536e0eec251032134ecb1716527cc3c650f0039be50e3c4238abf88094e4f6c7949b4c7d13c
SSDEEP 3:azwAKKB/:c1f
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\index
Size 256KB
SHA256 0823ddc709f70c54be3907541db473284ce2aeaffcb0249ca439949ebd31ed90
MD5 b6a85d3c8bbbac69d80889d7178a1609
SHA1 6166124a32eb3cbaaebafdb2e016b17d09ce4e19
SHA512 63394b13efb126730f9029130b4e05808fe5087d236113f5957e08546e70425e0ebe4e423a26b2c3e7662eb781b41f17cbbed2e7c1df199eea5e46a3a4258c06
SSDEEP 3:Q95Wz8wzFKXPwy/:Z8wXC
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index
Size 24B
SHA256 1115050e7e14ffec6c5815bf9d28752b3d28b5c7ad335e58aa770e8d0e1d8eb7
MD5 d5bb77e637b91a46f59b6004da483314
SHA1 e56eb8a7ea97c841822b21dc9a6b33620757b7b5
SHA512 fa0afbc636e6f0ffb174238d186eef8176d1f871d6501e0ce04d66ec2d2c1eab06268c59a7794e33ce8564ce2af50eecfa11f2dd22284bcab8383840ad630502
MD5 SHA1 SHA512

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.100.1_0\_locales\en\messages.json
Size 851B
SHA256 c61981e8bf2ff10199530304aee0b74a9b6cc88c6a475b578cf6e9d658107e5a
MD5 ed37eacb03c35a654a93ada7d56012ef
SHA1 089c118fc26b2400185e92e3e096ccbe1511af1b
SHA512 0c676832a49c544a9bc7d570fb834f53cf08bba74e06e15d0845a144da206078b161bdd18f46aea3cdeb846001f2d60ebfd611371cb01bafbf3e7cd13f88ab52
TLSH
T1A5018C1F63D4DF1CFC5D737CD47563758242546620595B884183DA21EEED0F9E364124
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log
Size 114B
SHA256 026d1f65529e1b2aafcabcd512ab871c3f2a44748ed34a19c673f8a71253d68e
MD5 7da430e435dba6f5ae080f23cd6cd910
SHA1 c38f21944fce7157e0e152ba031251aa46e40f21
SHA512 886d1e86009704f993671750a01b95512c77bc910118fbb09d778a32db1369a4af4c9cdd42935485565a5e54eceacc97d1aefb724a3fce432799235bdbcb1adc
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 094863dd45b51c16a33a3cc843490e46f06ae45cabf06cd2a3566f3d53ac2326
MD5 fe18eea8768fdf1a36b48e549d8d29d3
SHA1 5bc5a4674a5a80a3b57cb15aff2a29873057655d
SHA512 b05d18281e29dec568433a8fe84cc358063019970783d10374ac4c81d30f6824b003d08ac9c4d8ace52d0ec0a5861f06daec4cd7eb063a9ab867cce86a7dc81a
MD5 SHA1 SHA512

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\db
Size 44KB
SHA256 08190363c82ffcea170b2169dfd088d7796b0234c7e431bb8b1b9a611ff23082
MD5 3ba15f232520d7bb41e5cdd5a0392bfd
SHA1 5765209e3ede4b50e5e4d9fd470b0e2cb03bc68c
SHA512 2935b72d9d9e0f04816a1a3bb21fd99776b51d1a7178a8479762b2cbd9ba1af0196bd6844cca2b7eb81bb63337bc744039f7aa36f588852e9fb61f2d2146cb21
SSDEEP 24:wYbEQJhPwMuz6G0ZestjteX4yNQeYlv+1b3IeNS6+6Uwg8TPq81fBG:wYbHOIy4m1b3fbUdeqSB
TLSH
T13C13A80F2E187550D1BD0535E9E68E6B2ABE204C9B8328D165F01AF24DE212C9D3F27F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SharedStorage

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\SharedStorage
Size 4KB
SHA256 9d70eb99ba013602bd680c674fd7d2d46ba2ae289cf19cadcd6aeaf44050e8ba
MD5 acd8fb96a864aae3d2c378cbb02d988a
SHA1 0b36a37e5315c6039812010b564e31e485c7f361
SHA512 b7babd288d0e2892a04916fca917556ac27ae848d81154cee1551263f4974249a755928e3e6a95d4dd34549d9ecfd6ac418159547a2ce8de3c466be75409011c
TLSH
T136810231705B5110C56A2CB805040074E350340196640DDC11C5A454E64175C43945C2
MD5 SHA1 SHA512 TLSH

Submit Download

edge_driver.js

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\2.1.94.0\edge_driver.js
Size 1.0MB
SHA256 dc3a746048c7c055ee0bbc74b21bf936b993b2006458425f2e8ea115f824e32e
MD5 7d4a84723d26db55399b4075a0ec3444
SHA1 5d706b9de5bf89bc715b67d1a7bd3be87384c9a6
SHA512 ff518f73f316984a6a628935136e70d6beed44c045175e46425c0f494d4287217203db47da7558308d62c28509c5a7dd61d7140ac911f207ad690108870db217
SSDEEP 24576:as4LmRApsg8Xo9rISByEAZvni+bvGMk82xnUTKQnF0LRrwhWVmCQOkftUJJi6WwY:as4LmRAqg8Xo9rISByEAZvni+bvGMk85
TLSH
T18B253B80E1E2253466D74CB960B7D2C4B5DC14583399F1E8FA6C588ADB0FD4723F6A3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

winword.exe_Rules.xml

Path C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\winword.exe_Rules.xml
Size 325KB
SHA256 71289d02f94389e0f092a12abffd88ec64c8d5f9d2d12d951dc9561df8d04d31
MD5 67eabb815318728f85839c20a6f908d7
SHA1 1ce24675fd9f5213419f48dd9938a1d37f88760d
SHA512 fce800754bd0b47697329cba85be7d7253c1083e05c72358054f8204ce3405515e943c0274e50a48046e12193a049e781d51cbcc975002a4eb36039cfe71aeb2
SSDEEP 3072:dDO4D0tEtLU8KPe1u6uSivsUQK75IthgXV:dDO4D0tEtAg1u6uSivsUQK75IthiV
TLSH
T1D964DD87F012A5536B8E263D53B085FB0DF4815BA6C79C42705027FDE863CEA0D96BB6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

winword.exe.db

Path C:\Users\Admin\AppData\Local\Microsoft\Office\OTele\winword.exe.db
Size 24KB
SHA256 b0c1df31d130317a70a11974979e6d3523bebc6f54dfe6aa67fe0eb17df560a7
MD5 177d727bc30d0f6894db2d29d59f316c
SHA1 6cd2c195cbad4a5b8a7e000d395c17d841fc9775
SHA512 c3b3e3b8b20bb10a35c78df0447e5fdc614507c2bd778852fbd5f184f6d67784ca766e7601906b4ea2dfadc06fbacc0439f47a185327598f6f7d74faf1194559
SSDEEP 12:i2CAgeY4syJttJxUSo0x9DdN1tDEX4vcImm5RyZkFv4sbMS+e:ZHVtbDBtDi4kZERDEe
TLSH
T1ABB2AC8125787420E05E64BBCCB102775379956A043353E228F248A19CC248A9A368FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

desktop.ini

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn2\desktop.ini
Size 174B
SHA256 9dcf2ec9747e5645869975db34fdddcd5e030dd5d70c9ec6ccdcdc6d825837fe
MD5 8e130c3ccc4904bb946af5ee544a5961
SHA1 f5f4bd50f32e2e9e7c51b426acad14095b4e693b
SHA512 6dcb5a4c43b42a2ed3e093d93e8a29f12360601bf191f63db414c4d798d8f845ca3c32ecb1ea82ec154d112cc4a0be2df8a5320c26b7de8efa723e747acc4d02
TLSH
T13EC08CB32048320A3843CAE328F66968532345B12AD4098E0982EB0B990850180522B4
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Packages\E2A4F912-2574-4A75-9BB0-0D023378592B_cw5n1h2txyewy\Settings\settings.dat
Size 8KB
SHA256 40dcd1122af3e7b55819dd02a8e11e00c85c470586da7e2329252c48acda925d
MD5 820df0afe07ffec61dece7a80d82e8b2
SHA1 0ea546c7e654d3c5f670ae54d206ca57e49e2c84
SHA512 7221af648fb472ac1925a0b3c5318a26e69ab1c7688a8fcb0a3381ac89778239668840bf0258c8fa267301c41676edc058dd4eeac4227d7d31235b5f1dfb1508
SSDEEP 24:FMC5FzXG7HnQlDuUbwB7d82/+wB7svTnl/wZPo:WCHMM87d37J
TLSH
T17AF149627304D297C9331A31DC66D2C47373FE6B5E150AC378D973AD68F66254A51184
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\AC\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock
Size 4B
SHA256 7ce4329b40a4c2b219edb53223affda78de66eefff9190c36b70e8e044215b12
MD5 52166e07c07f257cb9c357c74f617d65
SHA1 03a123b82386d34cd53e12f25dd05e04f534600d
SHA512 c15eb8b3b8c29cbfd6d6690e57b497c628e5606ea52f222e09c8a401d2d1c998718487914ae933e053ebf23881e0d2eac05a25d624f4a5ad88fcbe8c6d8a21e6
MD5 SHA1 SHA512

Submit Download

22TL6JMO3P_1

Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AppData\CacheStorage\Files4\S3QGLYIP_1\54SJHJS9_2\22TL6JMO3P_1
Size 19KB
SHA256 67a590c197b7790ac59209ca2d416ff87c4789da8b129900ac179e2bf4c80632
MD5 d949b592de0a0c30cb18a5704de722d2
SHA1 13ed438e9ac17356ffbcaf5c13b122746216abad
SHA512 d5bf804c2858fa8fe7f090e43167685ebf1021122e50005d822d4ee77cb5769b98fb07fe4c1f44f44a9c97d7489eedd8f5e6157b1fa31a73539340487c9b0a19
SSDEEP 384:bYoWSWrF5BDOcrDICWE8RtoW0W6jnRNUo0YZA9k7:20CWE8RgnUcA9s
TLSH
T19F9210081F65515DFD8BCF1BF992B895E2004103C0EF5DA5ACE73BF58A80ABD25922ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0.1.filtertrie.intermediate.txt

Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{cbd2a161-a192-44ff-9a4a-7ca6a77b4c20}\0.1.filtertrie.intermediate.txt
Size 5B
SHA256 683e00c76e27ec60ee567d42a6aeeb9743b836a67bf6aa7fdb111a0e1a1fa9a8
MD5 5c459b5bf7e221cbb47e7f168f62856c
SHA1 d47758b371991045bdde0410351ebf2a1a4ac51a
SHA512 fb73e530d3a544120c0a3e91715efe31bd65d33e93b38c4c86139a0468e2009c0d5c37eedce1652ff87fa4e021b1e8ecd7401e9a5a13cb01215f7dfe5f0e3a78
MD5 SHA1 SHA512

Submit Download

0.2.filtertrie.intermediate.txt

Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{cbd2a161-a192-44ff-9a4a-7ca6a77b4c20}\0.2.filtertrie.intermediate.txt
Size 5B
SHA256 7d90d3575baf5779d9df791b50defaa4df59489f449a7ba0e783cef0ec9629d7
MD5 f6e726eb15eeda9e918b56d636145add
SHA1 46b018bb5c90290e156e08e3479b8fdcc2a45f00
SHA512 21db54e2084464f84fec836645e83ecee64e3430884ab0c1d3bd2b31a7eed5600f118a8d9df9e6899ad99edc299b5259ec40ce8b9adf9c4c9e81589e2e98bf76
MD5 SHA1 SHA512

Submit Download

wct7FA1.tmp

Path C:\Users\Admin\AppData\Local\Temp\wct7FA1.tmp
Size 63KB
SHA256 1a78fbe998fdea696bee2bfca93bf7e3a36e080a12bdf2a4509e7d8854af9dfe
MD5 e4909fcb3c65939246ad733e26f79c8d
SHA1 af61d01f571e411f0dd549f11dccbe95ea167027
SHA512 ba0cf7fcddb7fb79f8c9267d4798337054b000d92df1da3b1206fc1e01cdb79d5c8e08d7d9906f6262984a5ded154781aa4b1bfba03c1d7b252af497efc1cfb3
SSDEEP 384:KwoaSLGTSy3S0XuMU9mCzHS7vpvpJGV6Hu/i49Pji7iJI5TZCP56vS1xDR+dBUFr:K9ryF7U9mCzHS7vu/xV2iP56vcDR+P0T
TLSH
T1A253EE8E2108B6AFE315AD5A7E6BA9861C31746E3842CF8DF5CDC26C5F40DC4334A5A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

favicons.sqlite-shm

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9zyrz34.default-release\favicons.sqlite-shm
Size 32KB
SHA256 1c95bf2ce26441cc1f0ff141cc06ec56db9d66747ddeed607fabec117548546e
MD5 6ebcaefa339f12bb650ece7d3cc2133d
SHA1 f286c54d0dc80d3f8226351b7d2f30a589fd65a5
SHA512 5ad1549be82360d771ab9d678a3dd7943ce4045f83ec72049a0891f85f699ee163f3bd460d4f7b57c8054371533369ba45a31dd50750a9779f084df8f1eba62b
SSDEEP 3:vrwKKR5rwKKRcwl3FZ/:sKakKMlFB
MD5 SHA1 SHA512 SSDEEP

Submit Download

2823318777ntouromlalnodry--naod.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9zyrz34.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite
Size 48KB
SHA256 14078d868ac8dcc0f84193672a879b43eccde1ea92df11e42e4c2c7405beea1b
MD5 cf97940c9b8e56a8cec24141fd446d71
SHA1 c6efa35ade9604f33b58ed83b7105f39dc6a4880
SHA512 8939e4f3e5289a21ceaf64f6a588ebca06e53ed36e1d6786047fabb235e532883e7eff4d7e832076c4118dc6fd5b447fe73c4c772f43ed9d91211604108e0762
SSDEEP 48:TWByFDXV6CM5znpgBlizb5pxVgnO9zxV+LU7mY2wzY5QcEVdyEQj:igFDF6CKnqlizbxV+2xVeU7X2B0
TLSH
T176239FDE3F07B911C576F0B1ADA48C51BC5E321A072226E539D0DAD4C9F215AEE1E872
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2596-0-0x000001F0400B0000-0x000001F040148000-memory.dmp

Download

memory/2596-6006-0x000001F041FCE000-0x000001F041FCF000-memory.dmp

Download

memory/2596-6008-0x000001F05A820000-0x000001F05A830000-memory.dmp

Download

memory/2596-6009-0x000001F05A540000-0x000001F05A62A000-memory.dmp

Download

memory/2596-6010-0x000001F05A820000-0x000001F05A830000-memory.dmp

Download

memory/2596-6013-0x000001F05A540000-0x000001F05A62A000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads