Overview

overview

10

Static

static

10

2996308540...37.exe

windows10-2004-x64

10

2996308540...37.exe

windows11-21h2-x64

10

Analysis

  • max time kernel
    148s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    20/05/2026, 02:20

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2996308540b6848fbf2d8b1f1a6865ebf717cd61990aabb9975c28d570f12537.exe
  • Size 102KB
  • Sample260520-cskvvaf19y
  • SHA256 2996308540b6848fbf2d8b1f1a6865ebf717cd61990aabb9975c28d570f12537
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
discoverycryptomixpersistenceransomware

Malware Config

Extracted

Path

  • C:\PerfLogs\# RESTORING FILES #.TXT

Ransom Note
  • NOT YOUR LANGUAGE? USE http://translate.google.com What happens to you files? All of your files were encrypted by a strong encryption with RSA-2048 using CryptoShield 1.2. More information about the encryption keys using RSA-2048 can be found here: https://en.wikipedia.org/wiki/RSA_(cryptosystem) How did this happen ? Specially for your PC was generated personal RSA - 2048 KEY, both public and private. ALL your FILES were encrypted with the public key, which has been transferred to your computer via the Internet. Decrypting of your files is only possible with the help of the private key and decrypt program , which is on our secret server. What do I do ? So, there are two ways you can choose: wait for a miracle and get your price doubled, or start send email now for more specific instructions, and restore your data easy way. If You have really valuable data, you better not waste your time, because there is no other way to get your files, except make payment. To receive your private software: Contact us by email , send us an email your (personal identification) ID number and wait for further instructions. Our specialist will contact you within 24 hours. For you to be sure, that we can decrypt your files - you can send us a single encrypted file and we will send you back it in a decrypted form. This will be your guarantee. Please do not waste your time! You have 72 hours only! After that The Main Server will double your price! So right now You have a chance to buy your individual private SoftWare with a low price! CONTACTS E-MAILS: [email protected] - SUPPORT; [email protected] - SUPPORT RESERVE FIRST; [email protected] - SUPPORT RESERVE SECOND; ID (PERSONAL IDENTIFICATION): 1C9B74EAC25C9144
URLs

  • http://translate.google.com

Extracted

Path

  • C:\PerfLogs\# RESTORING FILES #.HTML

Ransom Note
  • <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> <title>CryptoShield 1.2</title> <style type="text/css"> <!-- .style2 {color: #FF0000} --> body{ background-color: #33CCFF; /* ???? ???? ???-???????? */ } </style> </head> <body> <br> <table width="59%" height="100%" border="1" align="center" bgcolor="#E4E2E0"> <tr> <td> <strong>NOT YOUR LANGUAGE? USE</strong> <a href="translate.google.com" <strong>http://translate.google.com</strong></a><br> <br> <span class="style2"><strong>What happens to you files</strong>?</span><br> All of your files encrypted by a strong encryption with RSA - 2048 using <strong>CryptoShield 1.2</strong>.<br> More information about the encryption keys using RSA-2048 can be found here: <a href=" http://en.wikipedia.org/wiki/RSA_(cryptosystem)" <strong> en.wikipedia.org/wiki/RSA_(cryptosystem)</strong></a><br><br><br> <span class="style2"><strong>How did this happen ?</strong></span> <br> Specially for your PC was generated personal RSA-2048 KEY, both public and private. <br> ALL your FILES were encrypted with the public key, which has been transferred to your computer via the Internet. <br> Decrypting of your files is only possible with the help of the private key and decrypt program , which is on our secret server.<br><br><br> <span class="style2"><strong>What do I do ?</strong></span><br> So, there are two ways you can choose: wait for a miracle and get your price doubled, or start send email now for more specific instructions, and restore your data easy way.<br> If You have really valuable data, you better not waste your time, because there is no other way to get your files, except make a payment.<br><br><br> <span class="style2"><strong>To receive your private software:</strong></span><br> Contact us by email , send us an email your <strong>(personal identification) ID number </strong> and wait for further instructions.<br> Our specialist will contact you within 24 hours.<br> For you to be sure, that we can decrypt your files - you can send us a single encrypted file and we will send you back it in a decrypted form. This will be your guarantee.<br><br><br> Please do not waste your time! You have 72 hours only! After that The Main Server will double your price!<br> So right now You have a chance to buy your individual private SoftWare with a low price! <br> <br> <br> <span class="style2"><strong>CONTACTS E-MAILS:</strong></span><br> [email protected] - SUPPORT;<br> [email protected] - SUPPORT RESERVE FIRST;<br> [email protected] - SUPPORT RESERVE SECOND;<br> <br> <strong>ID (PERSONAL IDENTIFICATION): 1C9B74EAC25C9144 </strong> <br> <br> </td> </tr> </table> </body> </html>
URLs

  • http-equiv="Content-Type"

Signatures

  • Family: CryptoMix

    Ransomware first seen in 2016 which has returned with new variants in 2019.

    ransomwarecryptomix
  • Detects CryptoMix CryptoShield variant 5 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 9 IoCs
  • Drops file in Windows directory 2 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 39 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 4 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2996308540b6848fbf2d8b1f1a6865ebf717cd61990aabb9975c28d570f12537.exe
    "C:\Users\Admin\AppData\Local\Temp\2996308540b6848fbf2d8b1f1a6865ebf717cd61990aabb9975c28d570f12537.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:4324
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C vssadmin.exe Delete Shadows /All /Quiet
      2⤵
      • System Location Discovery: System Language Discovery
      PID:3604
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C bcdedit /set {default} recoveryenabled No
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2064
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures
      2⤵
      • System Location Discovery: System Language Discovery
      PID:5060
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C net stop vss
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1548
      • C:\Windows\SysWOW64\net.exe
        net stop vss
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4880
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 stop vss
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2176
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=Z: /All /Quiet
      2⤵
      • System Location Discovery: System Language Discovery
      PID:4532
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=Y: /All /Quiet
      2⤵
      • System Location Discovery: System Language Discovery
      PID:4496
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=X: /All /Quiet
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1568
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=W: /All /Quiet
      2⤵
      • System Location Discovery: System Language Discovery
      PID:472
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=V: /All /Quiet
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2368
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=U: /All /Quiet
      2⤵
      • System Location Discovery: System Language Discovery
      PID:3824
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=T: /All /Quiet
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1920
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=S: /All /Quiet
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2340
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=R: /All /Quiet
      2⤵
      • System Location Discovery: System Language Discovery
      PID:5076
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=Q: /All /Quiet
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2220
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=P: /All /Quiet
      2⤵
      • System Location Discovery: System Language Discovery
      PID:716
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=O: /All /Quiet
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1412
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=N: /All /Quiet
      2⤵
      • System Location Discovery: System Language Discovery
      PID:460
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=M: /All /Quiet
      2⤵
      • System Location Discovery: System Language Discovery
      PID:780
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=L: /All /Quiet
      2⤵
      • System Location Discovery: System Language Discovery
      PID:3788
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=K: /All /Quiet
      2⤵
      • System Location Discovery: System Language Discovery
      PID:704
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=J: /All /Quiet
      2⤵
      • System Location Discovery: System Language Discovery
      PID:3952
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=I: /All /Quiet
      2⤵
      • System Location Discovery: System Language Discovery
      PID:4172
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=H: /All /Quiet
      2⤵
      • System Location Discovery: System Language Discovery
      PID:3216
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=G: /All /Quiet
      2⤵
      • System Location Discovery: System Language Discovery
      PID:4376
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=F: /All /Quiet
      2⤵
      • System Location Discovery: System Language Discovery
      PID:4672
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=E: /All /Quiet
      2⤵
      • System Location Discovery: System Language Discovery
      PID:4256
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=D: /All /Quiet
      2⤵
      • System Location Discovery: System Language Discovery
      PID:4108
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=C: /All /Quiet
      2⤵
      • System Location Discovery: System Language Discovery
      PID:3760
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=B: /All /Quiet
      2⤵
      • System Location Discovery: System Language Discovery
      PID:4612
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=A: /All /Quiet
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1960
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C net stop vss
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3152
      • C:\Windows\SysWOW64\net.exe
        net stop vss
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:5052
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 stop vss
          4⤵
          • System Location Discovery: System Language Discovery
          PID:636
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Music\# RESTORING FILES #.HTML
      2⤵
      • Drops file in Program Files directory
      • Checks processor information in registry
      • Enumerates system info in registry
      • Modifies data under HKEY_USERS
      • Modifies registry class
      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:3984
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x35c,0x7ffd88d7c188,0x7ffd88d7c194,0x7ffd88d7c1a0
        3⤵
          PID:4384
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1852,i,10720707410767301905,17078158015853119177,262144 --field-trial-handle=2416,i,16167741775716983018,6457277856230311673,262144 --variations-seed-version --mojo-platform-channel-handle=2412 /prefetch:2
          3⤵
            PID:2920
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1992,i,9684410926034988363,6947957123187894926,524288 --field-trial-handle=2416,i,16167741775716983018,6457277856230311673,262144 --variations-seed-version --mojo-platform-channel-handle=2464 /prefetch:3
            3⤵
            • System Time Discovery
            PID:1636
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2576,i,8077422082505282509,5578893864029271245,524288 --field-trial-handle=2416,i,16167741775716983018,6457277856230311673,262144 --variations-seed-version --mojo-platform-channel-handle=2568 /prefetch:8
            3⤵
              PID:3812
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3408,i,2057409170792900646,9101915247204628898,2097152 --field-trial-handle=2416,i,16167741775716983018,6457277856230311673,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
              3⤵
                PID:3700
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3412,i,2052209275736845790,14959891899479514011,2097152 --field-trial-handle=2416,i,16167741775716983018,6457277856230311673,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
                3⤵
                  PID:4424
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4228,i,1303775961377504023,1708468747695413321,2097152 --field-trial-handle=2416,i,16167741775716983018,6457277856230311673,262144 --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:2
                  3⤵
                    PID:4876
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4216,i,17507419192791006497,2302227856380967084,2097152 --field-trial-handle=2416,i,16167741775716983018,6457277856230311673,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:1
                    3⤵
                      PID:1220
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5132,i,305844711129254176,324395773549129274,524288 --field-trial-handle=2416,i,16167741775716983018,6457277856230311673,262144 --variations-seed-version --mojo-platform-channel-handle=5124 /prefetch:8
                      3⤵
                        PID:1780
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5040,i,4162656875174324282,6899048948112189942,524288 --field-trial-handle=2416,i,16167741775716983018,6457277856230311673,262144 --variations-seed-version --mojo-platform-channel-handle=5300 /prefetch:8
                        3⤵
                          PID:2968
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4536,i,17933785079167828619,8198651289426652084,524288 --field-trial-handle=2416,i,16167741775716983018,6457277856230311673,262144 --variations-seed-version --mojo-platform-channel-handle=5392 /prefetch:8
                          3⤵
                            PID:4112
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5124,i,9031334258253078268,10962845214474541870,524288 --field-trial-handle=2416,i,16167741775716983018,6457277856230311673,262144 --variations-seed-version --mojo-platform-channel-handle=5040 /prefetch:8
                            3⤵
                              PID:4636
                            • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5832,i,4572680489836256107,9302725626590288814,524288 --field-trial-handle=2416,i,16167741775716983018,6457277856230311673,262144 --variations-seed-version --mojo-platform-channel-handle=5868 /prefetch:8
                              3⤵
                                PID:2552
                              • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5832,i,4572680489836256107,9302725626590288814,524288 --field-trial-handle=2416,i,16167741775716983018,6457277856230311673,262144 --variations-seed-version --mojo-platform-channel-handle=5868 /prefetch:8
                                3⤵
                                  PID:3616
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6104,i,17573650662894090271,16834663637426636696,524288 --field-trial-handle=2416,i,16167741775716983018,6457277856230311673,262144 --variations-seed-version --mojo-platform-channel-handle=6108 /prefetch:8
                                  3⤵
                                    PID:4740
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6120,i,2088720025364058371,9639829234435152009,524288 --field-trial-handle=2416,i,16167741775716983018,6457277856230311673,262144 --variations-seed-version --mojo-platform-channel-handle=6252 /prefetch:8
                                    3⤵
                                      PID:2360
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6116,i,2610747841390516884,7926145840296324807,524288 --field-trial-handle=2416,i,16167741775716983018,6457277856230311673,262144 --variations-seed-version --mojo-platform-channel-handle=6488 /prefetch:8
                                      3⤵
                                        PID:3744
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6520,i,7958740968288404707,7862209852076018243,524288 --field-trial-handle=2416,i,16167741775716983018,6457277856230311673,262144 --variations-seed-version --mojo-platform-channel-handle=6532 /prefetch:8
                                        3⤵
                                          PID:2352
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6520,i,13338552944235395460,9548327553733667821,524288 --field-trial-handle=2416,i,16167741775716983018,6457277856230311673,262144 --variations-seed-version --mojo-platform-channel-handle=6532 /prefetch:8
                                          3⤵
                                            PID:4148
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5956,i,4285053691469644315,5611206005729830719,524288 --field-trial-handle=2416,i,16167741775716983018,6457277856230311673,262144 --variations-seed-version --mojo-platform-channel-handle=6576 /prefetch:8
                                            3⤵
                                              PID:416
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5976,i,13111980304560322257,12363887565189795480,524288 --field-trial-handle=2416,i,16167741775716983018,6457277856230311673,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:8
                                              3⤵
                                                PID:1852
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5872,i,14605393005484140487,17497137598558846435,524288 --field-trial-handle=2416,i,16167741775716983018,6457277856230311673,262144 --variations-seed-version --mojo-platform-channel-handle=5992 /prefetch:8
                                                3⤵
                                                  PID:5108
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5284,i,7512945152044282418,857667491967999675,524288 --field-trial-handle=2416,i,16167741775716983018,6457277856230311673,262144 --variations-seed-version --mojo-platform-channel-handle=5308 /prefetch:8
                                                  3⤵
                                                    PID:5112
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3496,i,8138039829489868641,17805394297892768230,524288 --field-trial-handle=2416,i,16167741775716983018,6457277856230311673,262144 --variations-seed-version --mojo-platform-channel-handle=6740 /prefetch:8
                                                    3⤵
                                                      PID:2304
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6756,i,7016693683516757930,15800805853330522330,524288 --field-trial-handle=2416,i,16167741775716983018,6457277856230311673,262144 --variations-seed-version --mojo-platform-channel-handle=6752 /prefetch:8
                                                      3⤵
                                                        PID:2744
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6468,i,17131694326176835612,2601644314402538655,524288 --field-trial-handle=2416,i,16167741775716983018,6457277856230311673,262144 --variations-seed-version --mojo-platform-channel-handle=6880 /prefetch:8
                                                        3⤵
                                                          PID:4080
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6460,i,2673267575801691287,1030341434934815177,262144 --field-trial-handle=2416,i,16167741775716983018,6457277856230311673,262144 --variations-seed-version --mojo-platform-channel-handle=6468 /prefetch:8
                                                          3⤵
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          PID:2512
                                                      • C:\Windows\SysWOW64\NOTEPAD.EXE
                                                        "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Music\# RESTORING FILES #.TXT
                                                        2⤵
                                                        • System Location Discovery: System Language Discovery
                                                        PID:4128
                                                    • C:\Users\Admin\AppData\Local\Temp\2996308540b6848fbf2d8b1f1a6865ebf717cd61990aabb9975c28d570f12537.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\2996308540b6848fbf2d8b1f1a6865ebf717cd61990aabb9975c28d570f12537.exe"
                                                      1⤵
                                                      • System Location Discovery: System Language Discovery
                                                      PID:4260
                                                    • C:\ProgramData\MicroSoftTMP\system32\winlogon.exe
                                                      "C:\ProgramData\MicroSoftTMP\system32\winlogon.exe"
                                                      1⤵
                                                      • Executes dropped EXE
                                                      • System Location Discovery: System Language Discovery
                                                      PID:1112
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                      1⤵
                                                        PID:1700
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
                                                        1⤵
                                                          PID:3564

                                                        Network

                                                              MITRE ATT&CK Enterprise v16

                                                              Replay Monitor

                                                              Loading Replay Monitor...

                                                              Downloads

                                                              # RESTORING FILES #.HTML
                                                              • Path C:\PerfLogs\# RESTORING FILES #.HTML
                                                              • Size 2KB
                                                              • SHA256 ee2f3c0200608b7257e73b52c870265180caa4091cd2ce4050883c6a399488ec
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              # RESTORING FILES #.TXT
                                                              • Path C:\PerfLogs\# RESTORING FILES #.TXT
                                                              • Size 1KB
                                                              • SHA256 c31df9fe9956fd708b7889538c36ac9b349410a2b8bc1353c21ad51b017a6cac
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              manifest.json
                                                              • Path C:\Program Files\chrome_Unpacker_BeginUnzipping3984_1655586805\manifest.json
                                                              • Size 43B
                                                              • SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
                                                              • MD5 SHA1 SHA512
                                                              Submit Download

                                                              manifest.json
                                                              • Path C:\Program Files\chrome_Unpacker_BeginUnzipping3984_2145588159\manifest.json
                                                              • Size 160B
                                                              • SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              manifest.json
                                                              • Path C:\Program Files\chrome_Unpacker_BeginUnzipping3984_654697972\manifest.json
                                                              • Size 135B
                                                              • SHA256 ba5c9096d20a482aaa1aa9e5f98ad6127d3e97c2f21de84f7c78d9b8073c8e26
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              winlogon.exe
                                                              • Path C:\ProgramData\MicroSoftTMP\system32\winlogon.exe
                                                              • Size 102KB
                                                              • SHA256 2996308540b6848fbf2d8b1f1a6865ebf717cd61990aabb9975c28d570f12537
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              protocols.json
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.10\protocols.json
                                                              • Size 3KB
                                                              • SHA256 4fd800e7b1a5fb24b13fac2e31946d205012b7c28d8c61580b0669b2fa3517cc
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              CrashpadMetrics-active.pma
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
                                                              • Size 16KB
                                                              • SHA256 814d47aad78c212b52568b9c7b58d242899d490d3afebce66181cae50c880df5
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              settings.dat
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                              • Size 280B
                                                              • SHA256 81240d13af4ca099e1358c75991e3fa5640dbb3aac72c2d98006f6159bf74aa0
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              BookmarkMergedSurfaceOrdering
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
                                                              • Size 6B
                                                              • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                                              • MD5 SHA1 SHA512
                                                              Submit Download

                                                              the-real-index
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                              • Size 3KB
                                                              • SHA256 950f36fac5cdcfde1b99f07cad8f29a94e5736f60f39cf3418302ee8fade52ce
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              SiteList-Enterprise.json
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
                                                              • Size 2B
                                                              • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                              • MD5 SHA1 SHA512
                                                              Submit Download

                                                              Edge Profile.ico
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
                                                              • Size 70KB
                                                              • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              Network Persistent State
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                              • Size 111B
                                                              • SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              Network Persistent State
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                              • Size 2KB
                                                              • SHA256 ed78f8e04662d5d66d85ac68d688f379dccbeb1554fdfdfbd9807fab99649cfb
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              SCT Auditing Pending Reports
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
                                                              • Size 2B
                                                              • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                              • MD5 SHA1 SHA512
                                                              Submit Download

                                                              Preferences
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                              • Size 13KB
                                                              • SHA256 ca6d0c6b030778ba413c5b260c0eb03fb5303ea1e586905aa1a28fa6fefdecea
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              Secure Preferences
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                                              • Size 35KB
                                                              • SHA256 9114e0b9b721c75e7a959e2ad8c739ea2dec6482830060b8b6cac05f0334daea
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              sync_diagnostic.log
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
                                                              • Size 4KB
                                                              • SHA256 b462aa2f8c5394d3d7b582d1cd7daf9586001558de37317e9b8b51c8a6612239
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              ac37b252-9cff-4f5b-8905-8263994c4c8d.tmp
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\ac37b252-9cff-4f5b-8905-8263994c4c8d.tmp
                                                              • Size 22KB
                                                              • SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              Local State
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                              • Size 8KB
                                                              • SHA256 25266aee4416f70675b779ff1bf213bb5ad1780f16a09422beb34fbe6bdcdd2a
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              Local State
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                              • Size 16KB
                                                              • SHA256 ce8fb94a6ce8c870021c8500a1abd86d5d04a39d61f72c9a6876bb5c512c4866
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              Local State
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                              • Size 19KB
                                                              • SHA256 5999d8f753009c7e4b79b8f1cb271f078f834562d17e4be634d740ae96a63ce4
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              Local State
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                              • Size 8KB
                                                              • SHA256 e63a0671ad962340e7dc0ec36b8623fbafc7bbe23733ab0a1e604a2e730bb355
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              Local State
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                              • Size 19KB
                                                              • SHA256 e5338164a9eaf983c7f78f5d4a428c79198b40568e2783e953096415e36464e5
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              Local State
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                              • Size 25KB
                                                              • SHA256 b7d7eba5c932957063060faccd81926c253d3b0794c283868f12a30356a52799
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              nav_config.json
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\WorkspacesNavigationComponent\1.0.0.5\nav_config.json
                                                              • Size 2KB
                                                              • SHA256 98252dc9f9e81167e893f2c32f08ee60e9a6c43fadb454400ed3bff3a68fbf0d
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              metadata.json
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                              • Size 252B
                                                              • SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              metadata.json
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                              • Size 372B
                                                              • SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              metadata.json
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                              • Size 132B
                                                              • SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              metadata.json
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
                                                              • Size 13B
                                                              • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
                                                              • MD5 SHA1 SHA512
                                                              Submit Download

                                                              5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
                                                              • Size 2KB
                                                              • SHA256 3d0655f7fe8f49ab9e9eeff8702e6d01c045153cc156a0f7ecb0ab9177c20f2f
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              9d30b31d-025c-44a1-a5a7-ef2aa48e64cd.tmp
                                                              • Path C:\Users\Admin\AppData\Local\Temp\9d30b31d-025c-44a1-a5a7-ef2aa48e64cd.tmp
                                                              • Size 1B
                                                              • SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
                                                              • MD5 SHA1 SHA512
                                                              Submit Download

                                                              dde9a99f-3477-4161-a8ce-155b63bb9e2d.tmp
                                                              • Path C:\Users\Admin\AppData\Local\Temp\dde9a99f-3477-4161-a8ce-155b63bb9e2d.tmp
                                                              • Size 10KB
                                                              • SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              afcfbb4a-a8f3-4af0-bef5-ea225a1d6088.tmp
                                                              • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3984_151627057\afcfbb4a-a8f3-4af0-bef5-ea225a1d6088.tmp
                                                              • Size 147KB
                                                              • SHA256 d766e75ceffe993aa1dadd5619b24043a0ebe9a9689a6796d19d88bf952683d4
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              content_new.js
                                                              • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3984_2076182260\CRX_INSTALL\content_new.js
                                                              • Size 10KB
                                                              • SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              ERDHRFGHAVAFGNYY.GKG.[[email protected]].ID[1C9B74EAC25C9144].CRYPTOSHIELD
                                                              • Path C:\Users\Admin\Desktop\ERDHRFGHAVAFGNYY.GKG.[[email protected]].ID[1C9B74EAC25C9144].CRYPTOSHIELD
                                                              • Size 1.0MB
                                                              • SHA256 dea06b20f8545baa43c625b4e89e9c9d556b4c9410e8674a90828651d2053e02
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              ERFBYIRFNIR.EGS.[[email protected]].ID[1C9B74EAC25C9144].CRYPTOSHIELD
                                                              • Path C:\Users\Admin\Desktop\ERFBYIRFNIR.EGS.[[email protected]].ID[1C9B74EAC25C9144].CRYPTOSHIELD
                                                              • Size 414KB
                                                              • SHA256 a13bc7402d98f70186eb169d3bd10fa92925dc01e7edd536a55b6eb97b26542d
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              ERFRGVAFGNYY.UGZ.[[email protected]].ID[1C9B74EAC25C9144].CRYPTOSHIELD
                                                              • Path C:\Users\Admin\Desktop\ERFRGVAFGNYY.UGZ.[[email protected]].ID[1C9B74EAC25C9144].CRYPTOSHIELD
                                                              • Size 1.6MB
                                                              • SHA256 01f2f1620ccc13e1e4fba2e7e4f5e77255b60471ca4c5131635a4f554988a155
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              FGNEGHAERTVFGRE.KZY.[[email protected]].ID[1C9B74EAC25C9144].CRYPTOSHIELD
                                                              • Path C:\Users\Admin\Desktop\FGNEGHAERTVFGRE.KZY.[[email protected]].ID[1C9B74EAC25C9144].CRYPTOSHIELD
                                                              • Size 453KB
                                                              • SHA256 341bbeaa9981bbd4f8ad2146cb7f3e4ba4856f2472df1dcd32cef113ef608d61
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              FGNEGTRG.QBPK.[[email protected]].ID[1C9B74EAC25C9144].CRYPTOSHIELD
                                                              • Path C:\Users\Admin\Desktop\FGNEGTRG.QBPK.[[email protected]].ID[1C9B74EAC25C9144].CRYPTOSHIELD
                                                              • Size 17KB
                                                              • SHA256 db7946e4be0c9b36e35fe2a0dc636019af1ccd0107ae45d06c7ae1599b73a15c
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              FGRCBCRA.CCGK.[[email protected]].ID[1C9B74EAC25C9144].CRYPTOSHIELD
                                                              • Path C:\Users\Admin\Desktop\FGRCBCRA.CCGK.[[email protected]].ID[1C9B74EAC25C9144].CRYPTOSHIELD
                                                              • Size 888KB
                                                              • SHA256 81423ffdc9a65a0e0920334edf46f2b1337673df09b824dcf49c97eba7f15331
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              FRYRPGFNIR.Z3H.[[email protected]].ID[1C9B74EAC25C9144].CRYPTOSHIELD
                                                              • Path C:\Users\Admin\Desktop\FRYRPGFNIR.Z3H.[[email protected]].ID[1C9B74EAC25C9144].CRYPTOSHIELD
                                                              • Size 730KB
                                                              • SHA256 0f43a105d50697de41097838794451c97cf52ed707bdf32fbb7428292bcf8981
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              HAERTVFGREFRAQ.JZS.[[email protected]].ID[1C9B74EAC25C9144].CRYPTOSHIELD
                                                              • Path C:\Users\Admin\Desktop\HAERTVFGREFRAQ.JZS.[[email protected]].ID[1C9B74EAC25C9144].CRYPTOSHIELD
                                                              • Size 967KB
                                                              • SHA256 0e7e8f0d6271ac9c483b47bed8b0a4b5d0871f76607c7fdc4726f23dc015348b
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              HCQNGRQRAL.IO.[[email protected]].ID[1C9B74EAC25C9144].CRYPTOSHIELD
                                                              • Path C:\Users\Admin\Desktop\HCQNGRQRAL.IO.[[email protected]].ID[1C9B74EAC25C9144].CRYPTOSHIELD
                                                              • Size 572KB
                                                              • SHA256 a785f2eec970a62fa0491850a108249db8bceb1a2a485c5452915976773f2675
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              JEVGRVAIBXR.Z4I.[[email protected]].ID[1C9B74EAC25C9144].CRYPTOSHIELD
                                                              • Path C:\Users\Admin\Desktop\JEVGRVAIBXR.Z4I.[[email protected]].ID[1C9B74EAC25C9144].CRYPTOSHIELD
                                                              • Size 927KB
                                                              • SHA256 5a358d33840dfa5d2f1994b61bfbe6d418f85e29a42a1696c782d75d14a07362
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              memory/1112-4-0x0000000001300000-0x000000000130F000-memory.dmp
                                                              Download

                                                              memory/4260-5-0x0000000000F20000-0x0000000000F2F000-memory.dmp
                                                              Download

                                                              memory/4324-532-0x0000000000D40000-0x0000000000D4F000-memory.dmp
                                                              Download

                                                              memory/4324-0-0x0000000000D40000-0x0000000000D4F000-memory.dmp
                                                              Download