troldesh | hxxps://github[.]com/Da2dalus/The-MALWARE-Repo/blob/master/Trojan/BlueScreen[.]exe

Analysis

user interaction
yes
max time kernel
235s
max time network
236s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/07/2026, 19:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Trojan/BlueScreen.exe
Sample260722-ye4xfstcle

Score

10^/10

discovery troldesh persistence ransomware suricata trojan upx

Malware Config

Signatures

Family: Troldesh, Shade, Encoder.858
Troldesh is a ransomware spread by malspam.
ransomware trojan troldesh

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Program Files (x86)\\Windows\\Error file remover\\fatalerror.exe"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Program Files (x86)\\Windows\\Error file remover\\fatalerror.exe"	msiexec.exe

Downloads MZ/PE file 3 IoCs

flow	pid	Process
94	4672	msedge.exe
94	4672	msedge.exe
94	4672	msedge.exe

Executes dropped EXE 7 IoCs

pid	Process
2408	BlueScreen.exe
2376	BlueScreen.exe
2720	BlueScreen.exe
5384	NoMoreRansom.exe
5664	csrss.exe
5440	WinlockerVB6Blacksod.exe
5876	fatalerror.exe

Loads dropped DLL 16 IoCs

pid	Process
5440	WinlockerVB6Blacksod.exe
5440	WinlockerVB6Blacksod.exe
5300	MsiExec.exe
5300	MsiExec.exe
5300	MsiExec.exe
5300	MsiExec.exe
5300	MsiExec.exe
5300	MsiExec.exe
5300	MsiExec.exe
5300	MsiExec.exe
5300	MsiExec.exe
5300	MsiExec.exe
3312	MsiExec.exe
5300	MsiExec.exe
5440	WinlockerVB6Blacksod.exe
5300	MsiExec.exe

Suricata alert: Tor Node X.509 Certificate Pattern Detected - Inbound 2 IoCs

Network activity triggered a Suricata alert

suricata

flow	pid	Process
121	5384	NoMoreRansom.exe
121	5384	NoMoreRansom.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\Client Server Runtime Subsystem = "\"C:\\ProgramData\\Windows\\csrss.exe\""	NoMoreRansom.exe

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
134	5300	MsiExec.exe

Contacts third-party web service commonly abused for C2 1 TTPs 5 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
93	raw.githubusercontent.com
94	raw.githubusercontent.com
131	raw.githubusercontent.com
132	raw.githubusercontent.com
92	raw.githubusercontent.com

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\D:	WinlockerVB6Blacksod.exe
File opened (read-only)	\??\W:	WinlockerVB6Blacksod.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\K:	WinlockerVB6Blacksod.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\P:	WinlockerVB6Blacksod.exe
File opened (read-only)	\??\Q:	WinlockerVB6Blacksod.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\B:	WinlockerVB6Blacksod.exe
File opened (read-only)	\??\T:	WinlockerVB6Blacksod.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\G:	WinlockerVB6Blacksod.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	WinlockerVB6Blacksod.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\I:	WinlockerVB6Blacksod.exe
File opened (read-only)	\??\J:	WinlockerVB6Blacksod.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	WinlockerVB6Blacksod.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\U:	WinlockerVB6Blacksod.exe
File opened (read-only)	\??\V:	WinlockerVB6Blacksod.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\N:	WinlockerVB6Blacksod.exe
File opened (read-only)	\??\S:	WinlockerVB6Blacksod.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\L:	WinlockerVB6Blacksod.exe
File opened (read-only)	\??\R:	WinlockerVB6Blacksod.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\H:	WinlockerVB6Blacksod.exe
File opened (read-only)	\??\X:	WinlockerVB6Blacksod.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	WinlockerVB6Blacksod.exe
File opened (read-only)	\??\M:	WinlockerVB6Blacksod.exe

UPX packed file 25 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0004000000016cc3-334.dat	upx
behavioral1/memory/2408-341-0x0000000000400000-0x0000000000409000-memory.dmp	upx
behavioral1/memory/2408-351-0x0000000000400000-0x0000000000409000-memory.dmp	upx
behavioral1/memory/2376-371-0x0000000000400000-0x0000000000409000-memory.dmp	upx
behavioral1/memory/5384-470-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral1/memory/5384-471-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral1/memory/5384-472-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral1/memory/5384-474-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral1/memory/5664-480-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral1/memory/5664-490-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral1/memory/5384-501-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral1/memory/5384-513-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral1/memory/5384-515-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral1/memory/5384-533-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral1/memory/5384-535-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral1/memory/5384-568-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral1/memory/5384-883-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral1/memory/5384-955-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral1/memory/5384-977-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral1/memory/5384-978-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral1/memory/5384-983-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral1/memory/5384-992-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral1/memory/5384-994-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral1/memory/5384-996-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral1/memory/5384-1049-0x0000000000400000-0x00000000005DE000-memory.dmp	upx

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Windows\Error file remover\fatalerror.exe	msiexec.exe
File created	C:\Program Files (x86)\Windows\Error file remover\Windows Logoff Sound.wav	msiexec.exe

Drops file in Windows directory 25 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE8D8.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE976.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF56278A2F8B76CEB5.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEBEE.tmp	msiexec.exe
File created	C:\Windows\Tasks\sys.job	MsiExec.exe
File opened for modification	C:\Windows\Installer\MSIEC9B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIED67.tmp	msiexec.exe
File created	C:\Windows\Installer\e5be6f1.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE946.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF2F08C734F15F7F78.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFD64A9E5C61616AA2.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE7DC.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE9F5.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEA74.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF93ED7C04C5E220EB.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\e5be6f1.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE83B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE9A6.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{C452D4E2-DE24-48B6-B5C3-ACB240A01606}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEA63.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEAE2.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEB22.tmp	msiexec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BlueScreen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BlueScreen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NoMoreRansom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WinlockerVB6Blacksod.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BlueScreen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fatalerror.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4672	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134292229949649100"	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1875162379-3804078649-638427191-1000\{69F8CB5E-8DE5-4412-97CD-EDADDA9E4E84}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
5384	NoMoreRansom.exe
5384	NoMoreRansom.exe
5384	NoMoreRansom.exe
5384	NoMoreRansom.exe
5664	csrss.exe
5664	csrss.exe
5664	csrss.exe
5664	csrss.exe
2396	msedge.exe
2396	msedge.exe
6064	msiexec.exe
6064	msiexec.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
5824	msedge.exe
5824	msedge.exe
5824	msedge.exe
5824	msedge.exe
5824	msedge.exe
5824	msedge.exe
5824	msedge.exe
5824	msedge.exe
5824	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeSecurityPrivilege	6064	msiexec.exe
Token: SeCreateTokenPrivilege	5440	WinlockerVB6Blacksod.exe
Token: SeAssignPrimaryTokenPrivilege	5440	WinlockerVB6Blacksod.exe
Token: SeLockMemoryPrivilege	5440	WinlockerVB6Blacksod.exe
Token: SeIncreaseQuotaPrivilege	5440	WinlockerVB6Blacksod.exe
Token: SeMachineAccountPrivilege	5440	WinlockerVB6Blacksod.exe
Token: SeTcbPrivilege	5440	WinlockerVB6Blacksod.exe
Token: SeSecurityPrivilege	5440	WinlockerVB6Blacksod.exe
Token: SeTakeOwnershipPrivilege	5440	WinlockerVB6Blacksod.exe
Token: SeLoadDriverPrivilege	5440	WinlockerVB6Blacksod.exe
Token: SeSystemProfilePrivilege	5440	WinlockerVB6Blacksod.exe
Token: SeSystemtimePrivilege	5440	WinlockerVB6Blacksod.exe
Token: SeProfSingleProcessPrivilege	5440	WinlockerVB6Blacksod.exe
Token: SeIncBasePriorityPrivilege	5440	WinlockerVB6Blacksod.exe
Token: SeCreatePagefilePrivilege	5440	WinlockerVB6Blacksod.exe
Token: SeCreatePermanentPrivilege	5440	WinlockerVB6Blacksod.exe
Token: SeBackupPrivilege	5440	WinlockerVB6Blacksod.exe
Token: SeRestorePrivilege	5440	WinlockerVB6Blacksod.exe
Token: SeShutdownPrivilege	5440	WinlockerVB6Blacksod.exe
Token: SeDebugPrivilege	5440	WinlockerVB6Blacksod.exe
Token: SeAuditPrivilege	5440	WinlockerVB6Blacksod.exe
Token: SeSystemEnvironmentPrivilege	5440	WinlockerVB6Blacksod.exe
Token: SeChangeNotifyPrivilege	5440	WinlockerVB6Blacksod.exe
Token: SeRemoteShutdownPrivilege	5440	WinlockerVB6Blacksod.exe
Token: SeUndockPrivilege	5440	WinlockerVB6Blacksod.exe
Token: SeSyncAgentPrivilege	5440	WinlockerVB6Blacksod.exe
Token: SeEnableDelegationPrivilege	5440	WinlockerVB6Blacksod.exe
Token: SeManageVolumePrivilege	5440	WinlockerVB6Blacksod.exe
Token: SeImpersonatePrivilege	5440	WinlockerVB6Blacksod.exe
Token: SeCreateGlobalPrivilege	5440	WinlockerVB6Blacksod.exe
Token: SeShutdownPrivilege	4600	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4600	msiexec.exe
Token: SeCreateTokenPrivilege	4600	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4600	msiexec.exe
Token: SeLockMemoryPrivilege	4600	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4600	msiexec.exe
Token: SeMachineAccountPrivilege	4600	msiexec.exe
Token: SeTcbPrivilege	4600	msiexec.exe
Token: SeSecurityPrivilege	4600	msiexec.exe
Token: SeTakeOwnershipPrivilege	4600	msiexec.exe
Token: SeLoadDriverPrivilege	4600	msiexec.exe
Token: SeSystemProfilePrivilege	4600	msiexec.exe
Token: SeSystemtimePrivilege	4600	msiexec.exe
Token: SeProfSingleProcessPrivilege	4600	msiexec.exe
Token: SeIncBasePriorityPrivilege	4600	msiexec.exe
Token: SeCreatePagefilePrivilege	4600	msiexec.exe
Token: SeCreatePermanentPrivilege	4600	msiexec.exe
Token: SeBackupPrivilege	4600	msiexec.exe
Token: SeRestorePrivilege	4600	msiexec.exe
Token: SeShutdownPrivilege	4600	msiexec.exe
Token: SeDebugPrivilege	4600	msiexec.exe
Token: SeAuditPrivilege	4600	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4600	msiexec.exe
Token: SeChangeNotifyPrivilege	4600	msiexec.exe
Token: SeRemoteShutdownPrivilege	4600	msiexec.exe
Token: SeUndockPrivilege	4600	msiexec.exe
Token: SeSyncAgentPrivilege	4600	msiexec.exe
Token: SeEnableDelegationPrivilege	4600	msiexec.exe
Token: SeManageVolumePrivilege	4600	msiexec.exe
Token: SeImpersonatePrivilege	4600	msiexec.exe
Token: SeCreateGlobalPrivilege	4600	msiexec.exe
Token: SeRestorePrivilege	6064	msiexec.exe
Token: SeTakeOwnershipPrivilege	6064	msiexec.exe
Token: SeRestorePrivilege	6064	msiexec.exe

Suspicious use of FindShellTrayWindow 59 IoCs

pid	Process
5824	msedge.exe
5824	msedge.exe
5824	msedge.exe
5824	msedge.exe
5824	msedge.exe
5824	msedge.exe
5824	msedge.exe
5824	msedge.exe
5824	msedge.exe
5824	msedge.exe
5824	msedge.exe
5824	msedge.exe
5824	msedge.exe
5824	msedge.exe
5824	msedge.exe
5824	msedge.exe
5824	msedge.exe
5824	msedge.exe
5824	msedge.exe
5824	msedge.exe
5824	msedge.exe
5824	msedge.exe
5824	msedge.exe
5824	msedge.exe
5824	msedge.exe
5824	msedge.exe
5824	msedge.exe
5824	msedge.exe
5824	msedge.exe
5824	msedge.exe
5824	msedge.exe
5824	msedge.exe
5824	msedge.exe
5824	msedge.exe
5824	msedge.exe
5824	msedge.exe
5824	msedge.exe
5824	msedge.exe
5824	msedge.exe
5824	msedge.exe
5824	msedge.exe
5824	msedge.exe
5824	msedge.exe
5824	msedge.exe
5824	msedge.exe
5824	msedge.exe
5824	msedge.exe
5824	msedge.exe
5824	msedge.exe
5824	msedge.exe
5824	msedge.exe
5824	msedge.exe
5824	msedge.exe
5824	msedge.exe
5824	msedge.exe
5824	msedge.exe
5824	msedge.exe
4600	msiexec.exe
4600	msiexec.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5824	msedge.exe
5824	msedge.exe
5824	msedge.exe
5824	msedge.exe
5824	msedge.exe
5824	msedge.exe
5824	msedge.exe
5824	msedge.exe
5824	msedge.exe
5824	msedge.exe
5824	msedge.exe
5824	msedge.exe
5824	msedge.exe
5824	msedge.exe
5824	msedge.exe
5824	msedge.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
6064	msiexec.exe
4600	msiexec.exe
5300	MsiExec.exe
3312	MsiExec.exe
5876	fatalerror.exe
5876	fatalerror.exe
5876	fatalerror.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5824 wrote to memory of 2028	5824	msedge.exe	88
PID 5824 wrote to memory of 4348	5824	msedge.exe	90
PID 5824 wrote to memory of 4672	5824	msedge.exe	91
PID 5824 wrote to memory of 4348	5824	msedge.exe	90
PID 5824 wrote to memory of 4348	5824	msedge.exe	90
PID 5824 wrote to memory of 4516	5824	msedge.exe	92
PID 5824 wrote to memory of 4516	5824	msedge.exe	92
PID 5824 wrote to memory of 3192	5824	msedge.exe	93
PID 5824 wrote to memory of 3192	5824	msedge.exe	93
PID 5824 wrote to memory of 3192	5824	msedge.exe	93
PID 5824 wrote to memory of 2548	5824	msedge.exe	94
PID 5824 wrote to memory of 2548	5824	msedge.exe	94
PID 5824 wrote to memory of 2548	5824	msedge.exe	94
PID 5824 wrote to memory of 4264	5824	msedge.exe	95
PID 5824 wrote to memory of 4264	5824	msedge.exe	95
PID 5824 wrote to memory of 4264	5824	msedge.exe	95
PID 5824 wrote to memory of 2752	5824	msedge.exe	96
PID 5824 wrote to memory of 2752	5824	msedge.exe	96
PID 5824 wrote to memory of 2752	5824	msedge.exe	96
PID 5824 wrote to memory of 4476	5824	msedge.exe	98
PID 5824 wrote to memory of 3196	5824	msedge.exe	99
PID 5824 wrote to memory of 4476	5824	msedge.exe	98
PID 5824 wrote to memory of 3196	5824	msedge.exe	99
PID 5824 wrote to memory of 3052	5824	msedge.exe	101
PID 5824 wrote to memory of 1320	5824	msedge.exe	104
PID 5824 wrote to memory of 2084	5824	msedge.exe	105
PID 5824 wrote to memory of 1320	5824	msedge.exe	104
PID 5824 wrote to memory of 2084	5824	msedge.exe	105
PID 5824 wrote to memory of 2084	5824	msedge.exe	105
PID 5824 wrote to memory of 3932	5824	msedge.exe	106
PID 5824 wrote to memory of 1140	5824	msedge.exe	107
PID 5824 wrote to memory of 1140	5824	msedge.exe	107
PID 5824 wrote to memory of 2408	5824	msedge.exe	108
PID 5824 wrote to memory of 2676	5824	msedge.exe	110
PID 5824 wrote to memory of 4456	5824	msedge.exe	111
PID 5824 wrote to memory of 4520	5824	msedge.exe	112
PID 5824 wrote to memory of 2376	5824	msedge.exe	113
PID 5824 wrote to memory of 2720	5824	msedge.exe	114
PID 5824 wrote to memory of 1584	5824	msedge.exe	115
PID 5824 wrote to memory of 1584	5824	msedge.exe	115
PID 5824 wrote to memory of 3288	5824	msedge.exe	117
PID 5824 wrote to memory of 3288	5824	msedge.exe	117
PID 5824 wrote to memory of 3288	5824	msedge.exe	117
PID 5824 wrote to memory of 572	5824	msedge.exe	118
PID 5824 wrote to memory of 1096	5824	msedge.exe	119
PID 5824 wrote to memory of 1096	5824	msedge.exe	119
PID 5824 wrote to memory of 5384	5824	msedge.exe	120
PID 5824 wrote to memory of 2396	5824	msedge.exe	124
PID 5824 wrote to memory of 3480	5824	msedge.exe	125
PID 5824 wrote to memory of 3480	5824	msedge.exe	125
PID 5824 wrote to memory of 3480	5824	msedge.exe	125
PID 5824 wrote to memory of 4624	5824	msedge.exe	126
PID 5824 wrote to memory of 3312	5824	msedge.exe	127
PID 5824 wrote to memory of 3312	5824	msedge.exe	127
PID 5824 wrote to memory of 6036	5824	msedge.exe	128
PID 5824 wrote to memory of 6036	5824	msedge.exe	128
PID 5824 wrote to memory of 6036	5824	msedge.exe	128
PID 5824 wrote to memory of 5440	5824	msedge.exe	129
PID 5440 wrote to memory of 4600	5440	WinlockerVB6Blacksod.exe	131
PID 6064 wrote to memory of 5300	6064	msiexec.exe	132
PID 6064 wrote to memory of 3312	6064	msiexec.exe	133
PID 5824 wrote to memory of 1748	5824	msedge.exe	137
PID 5824 wrote to memory of 1748	5824	msedge.exe	137
PID 5824 wrote to memory of 5732	5824	msedge.exe	138

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Trojan/BlueScreen.exe
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2c8,0x7ffc2642c188,0x7ffc2642c194,0x7ffc2642c1a0
  2⤵
  PID:2028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1604,i,5462581793145022019,4971841545197675070,262144 --field-trial-handle=2900,i,2879604503918908272,8505468775432765139,262144 --variations-seed-version --mojo-platform-channel-handle=2272 /prefetch:2
  2⤵
  PID:4348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1912,i,8009339997054027148,5140805137825442134,524288 --field-trial-handle=2900,i,2879604503918908272,8505468775432765139,262144 --variations-seed-version --mojo-platform-channel-handle=2948 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:4672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2460,i,11564193941275786031,4892622180574365081,524288 --field-trial-handle=2900,i,2879604503918908272,8505468775432765139,262144 --variations-seed-version --mojo-platform-channel-handle=3280 /prefetch:13
  2⤵
  PID:4516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3596,i,17486739854835301091,11661492164649534025,2097152 --field-trial-handle=2900,i,2879604503918908272,8505468775432765139,262144 --variations-seed-version --mojo-platform-channel-handle=3660 /prefetch:1
  2⤵
  PID:3192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3616,i,5247469116339568748,17242379325672193001,2097152 --field-trial-handle=2900,i,2879604503918908272,8505468775432765139,262144 --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:1
  2⤵
  PID:2548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4236,i,10875090131515116591,6163356362598702652,2097152 --field-trial-handle=2900,i,2879604503918908272,8505468775432765139,262144 --variations-seed-version --mojo-platform-channel-handle=4332 /prefetch:1
  2⤵
  PID:4264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4308,i,7571801974470461607,5504998032880767806,2097152 --field-trial-handle=2900,i,2879604503918908272,8505468775432765139,262144 --variations-seed-version --mojo-platform-channel-handle=4448 /prefetch:9
  2⤵
  PID:2752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3812,i,11936204921181843839,7090070287636184354,524288 --field-trial-handle=2900,i,2879604503918908272,8505468775432765139,262144 --variations-seed-version --mojo-platform-channel-handle=5416 /prefetch:14
  2⤵
  PID:4476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5376,i,1107677482357239342,10159175350751427278,524288 --field-trial-handle=2900,i,2879604503918908272,8505468775432765139,262144 --variations-seed-version --mojo-platform-channel-handle=5384 /prefetch:14
  2⤵
  PID:3196
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6080,i,6206414465392687058,4047695356029805860,524288 --field-trial-handle=2900,i,2879604503918908272,8505468775432765139,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:14
  2⤵
  PID:2440
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6080,i,6206414465392687058,4047695356029805860,524288 --field-trial-handle=2900,i,2879604503918908272,8505468775432765139,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:14
  2⤵
  PID:3052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6548,i,7117993215127907039,2781669818147091824,524288 --field-trial-handle=2900,i,2879604503918908272,8505468775432765139,262144 --variations-seed-version --mojo-platform-channel-handle=6572 /prefetch:14
  2⤵
  PID:1320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6488,i,8989889908519414451,3091730256119298871,2097152 --field-trial-handle=2900,i,2879604503918908272,8505468775432765139,262144 --variations-seed-version --mojo-platform-channel-handle=6580 /prefetch:1
  2⤵
  PID:2084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6924,i,14538108202670404235,1184679033357381616,524288 --field-trial-handle=2900,i,2879604503918908272,8505468775432765139,262144 --variations-seed-version --mojo-platform-channel-handle=6700 /prefetch:14
  2⤵
  PID:3932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7216,i,6851627357361832676,4144053392283526369,524288 --field-trial-handle=2900,i,2879604503918908272,8505468775432765139,262144 --variations-seed-version --mojo-platform-channel-handle=7208 /prefetch:14
  2⤵
  PID:1140
- C:\Users\Admin\Downloads\BlueScreen.exe
  "C:\Users\Admin\Downloads\BlueScreen.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7064,i,13872458852371328836,9254494173495578435,524288 --field-trial-handle=2900,i,2879604503918908272,8505468775432765139,262144 --variations-seed-version --mojo-platform-channel-handle=7224 /prefetch:14
  2⤵
  PID:2676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7288,i,6243200873751743796,2963650515060707731,524288 --field-trial-handle=2900,i,2879604503918908272,8505468775432765139,262144 --variations-seed-version --mojo-platform-channel-handle=7204 /prefetch:14
  2⤵
  PID:4456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7312,i,14215194048277338121,4880061467041644957,524288 --field-trial-handle=2900,i,2879604503918908272,8505468775432765139,262144 --variations-seed-version --mojo-platform-channel-handle=7244 /prefetch:14
  2⤵
  PID:4520
- C:\Users\Admin\Downloads\BlueScreen.exe
  "C:\Users\Admin\Downloads\BlueScreen.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2376
- C:\Users\Admin\Downloads\BlueScreen.exe
  "C:\Users\Admin\Downloads\BlueScreen.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6524,i,3621655556221066087,2987180141206682201,524288 --field-trial-handle=2900,i,2879604503918908272,8505468775432765139,262144 --variations-seed-version --mojo-platform-channel-handle=7352 /prefetch:14
  2⤵
  PID:1584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6016,i,8405859328290652105,3039878514706037006,2097152 --field-trial-handle=2900,i,2879604503918908272,8505468775432765139,262144 --variations-seed-version --mojo-platform-channel-handle=6040 /prefetch:1
  2⤵
  PID:3288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5028,i,13402613997536280231,2943523944194221920,524288 --field-trial-handle=2900,i,2879604503918908272,8505468775432765139,262144 --variations-seed-version --mojo-platform-channel-handle=7080 /prefetch:14
  2⤵
  PID:572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7300,i,7165639410482768611,6874211184554357142,524288 --field-trial-handle=2900,i,2879604503918908272,8505468775432765139,262144 --variations-seed-version --mojo-platform-channel-handle=7044 /prefetch:14
  2⤵
  PID:1096
- C:\Users\Admin\Downloads\NoMoreRansom.exe
  "C:\Users\Admin\Downloads\NoMoreRansom.exe"
  2⤵
  - Executes dropped EXE
  - Suricata alert: Tor Node X.509 Certificate Pattern Detected - Inbound
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:5384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5520,i,7391744782078061077,14231104097880353262,262144 --field-trial-handle=2900,i,2879604503918908272,8505468775432765139,262144 --variations-seed-version --mojo-platform-channel-handle=5524 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=6456,i,15072070711756320365,18326243708794457615,2097152 --field-trial-handle=2900,i,2879604503918908272,8505468775432765139,262144 --variations-seed-version --mojo-platform-channel-handle=6640 /prefetch:1
  2⤵
  PID:3480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6872,i,10955863083531678017,8700140757470579300,524288 --field-trial-handle=2900,i,2879604503918908272,8505468775432765139,262144 --variations-seed-version --mojo-platform-channel-handle=6860 /prefetch:14
  2⤵
  PID:4624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6844,i,3262865431267657345,18170547503300648050,524288 --field-trial-handle=2900,i,2879604503918908272,8505468775432765139,262144 --variations-seed-version --mojo-platform-channel-handle=6864 /prefetch:14
  2⤵
  PID:3312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=5772,i,5887626505493623646,17928681997965989739,2097152 --field-trial-handle=2900,i,2879604503918908272,8505468775432765139,262144 --variations-seed-version --mojo-platform-channel-handle=5764 /prefetch:1
  2⤵
  PID:6036
- C:\Users\Admin\Downloads\WinlockerVB6Blacksod.exe
  "C:\Users\Admin\Downloads\WinlockerVB6Blacksod.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5440
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\Windows\Error file remover 1.0.0.0\install\0A01606\Error file remover.msi" AI_SETUPEXEPATH=C:\Users\Admin\Downloads\WinlockerVB6Blacksod.exe SETUPEXEDIR=C:\Users\Admin\Downloads\ EXE_CMD_LINE="/exenoupdates /exelang 0 /noprereqs "
    3⤵
    - Enumerates connected drives
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    PID:4600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6296,i,17344786037205738870,9653573436966957894,524288 --field-trial-handle=2900,i,2879604503918908272,8505468775432765139,262144 --variations-seed-version --mojo-platform-channel-handle=6276 /prefetch:14
  2⤵
  PID:1748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4296,i,16842767729287392202,14394715369065110045,524288 --field-trial-handle=2900,i,2879604503918908272,8505468775432765139,262144 --variations-seed-version --mojo-platform-channel-handle=5544 /prefetch:14
  2⤵
  PID:5732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4308,i,16904455187025075916,4977686906765235862,524288 --field-trial-handle=2900,i,2879604503918908272,8505468775432765139,262144 --variations-seed-version --mojo-platform-channel-handle=6512 /prefetch:14
  2⤵
  PID:4232

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4368

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2960

C:\ProgramData\Windows\csrss.exe
"C:\ProgramData\Windows\csrss.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:5664

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Modifies WinLogon for persistence
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6064
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 4C602D3047C40F3A5247B2DC0994A078
  2⤵
  - Loads dropped DLL
  - Badlisted process makes network request
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:5300
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 3F0CD874B0FD94A5B7E67682BAAEA02D E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3312

C:\Program Files (x86)\Windows\Error file remover\fatalerror.exe
"C:\Program Files (x86)\Windows\Error file remover\fatalerror.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5876

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004F0 0x00000000000004F8
1⤵
PID:4944

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e5be6f4.rbs

Path C:\Config.Msi\e5be6f4.rbs
Size 99KB
SHA256 d0afe34925854f8aeebbd0badc3c2edec915e535ad191a701e6f3d75600d9915
MD5 9b7028822e79a4c57743b00205107a3b
SHA1 e2195e0a4fe01062280fb005f34b7c0022b518ac
SHA512 119c243efce0e4a72ccea0a554b8673d8947652f10d4e89e5597632e4c59b1622dd3768c50bd24877959cfaef5f4da648e83000be790f66d0a5019cd869dac05
SSDEEP 1536:xDCPYXUTK5kjNuQ+7bzwZH8uZYriQAvk7Dnzk28m2+b32Iq:oPYEI0T9kfV8m2+b3dq
TLSH
T10AA39E1239E0C132C19F5F78885EE7A09B7EB5209DF484473B6807BE6F716919A3A317
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ecdd5c8034c45eff453cbaf31d8886e2bd9609a73853367a6d096a69cc81f1be
MD5 a774534a956a5c8affebe08e87c80683
SHA1 b3e4e20a91e4087d3b9247b5ef6815f51858a041
SHA512 27769aee2cac148a0154fe42b51da2a9a1088e9e990873915b4c7ab9bd5442a3facf82b2bd1cbaef75328bd5937813698b96ac06aa76d934d07ab5ebb194a824
TLSH
T103D09B6673449A1CC9C439712461565161115820E41443581C96715CCDE56C707571DE
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 dfacefa73d018d54e3feba3eef28ec722a8422fee8768a2c3d8d6253f863b375
MD5 cb5000b6fab1115bfff50bedcc3eb9fd
SHA1 afbfe0ec03df59e7a1eba1da4227111508419c03
SHA512 aab9a1afd5de2f983466724b6ecf0dbc2e176c5a1eb2f059b9507511cc53643fcf9ed990bd565f22f8d53fb82db71cba238962a75c68db02d5f10b526661bd08
TLSH
T15AD09B667354991CC9C439712462565161015820941443581D96B16CCDE56C707561DA
MD5 SHA1 SHA512 TLSH

Submit Download

6cfdef0c-246b-42af-9e02-2c8f193bcc10.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6cfdef0c-246b-42af-9e02-2c8f193bcc10.tmp
Size 23KB
SHA256 4a6659212dca1efd0cd83684ffd5af7d3a22a5390796a15337dbe3a050336117
MD5 58ea8d78317cc826be28620144fedf6b
SHA1 0c6868df0a09acdca8f192b3d2281bcce0110070
SHA512 782389630fcac787e742b58c17cbfad64bdd43cfc74da8d1e567a5cd95d965e909590d701def1c82f43b552d4fb77161f78a6875550a2ed262a626058301e250
SSDEEP 384:a8YfWRmfCtg/NFfHfKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVOe91bRc0ropD/:azfWR0Wg/XfHf8F1+UoAYDCx9Tuqh0Vd
TLSH
T1BDB2EA2F600CCB7E5F800AADAD196FD76D9802C79B588D5047FE994C02C77EA921A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 5c5366f107fb5968579cc557b2bf1d96514cb155359bb902d6fb997a76d430ef
MD5 a0bbb753a4b8be174b75dcbfd94272a0
SHA1 7e53465b77fbb57bb4c19ce33f104ccdb220cd2d
SHA512 edb29ae5dea8f2683142b57ab1eaba579b7a6ca1c9c2e93222858e85aeda8fdd9efc0d71d141a33069eed74950304dfe266b6afa8d74485463ad8b656da7144f
SSDEEP 96:kSkXA45op5QZ4S/ae0xaGw1EXB6GiKDmjaNjnwXWEUna90ho6AVC7cbNQWRIe44U:QXA45orQZ4S/ae0xavEXB6GiymWdnwX0
TLSH
T1E591B6F56223A5C2CF245A70E0E3A4597E77F7748E07AEEC1B5113B8B8933665090BE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe5a2b38.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a2b38.TMP
Size 2KB
SHA256 42039a151f719d954172b1eed8a933c4a83be3422c16cbee79d79566419631d4
MD5 1e8232b345a7c1d7e82a51e59cf99cee
SHA1 fc9fe1bffb8f2034695920788327686e127f8a2c
SHA512 f05c406c7c0e6a5c0282da481db4b7bda3f5b33b85bcf54415602f54e878ef9ee88fbac065497be56ba229b5c20b85621622da98714d5aea2dcfea9847f22649
TLSH
T18341A756B77395C1DF244E72E0E1D0A97FB58469CE03EEBC5A91A178C882734A0E1B30
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 8893aa95585e9c4318514e91ea87f0aa3d619acd08db580b1caab74d80a6562a
MD5 4bdc7823b2644e42458165af9d980eb8
SHA1 fb4653c50cda83f827bb75ef860d3ed2821cee90
SHA512 6b83f4f93cb56e7ef4322698e323fbc0f96f3dc4f9874691e40f1c6268137f8f9e08db35501568c9d5e6c00a6eab18023e34725478d3848bab18a5367d0f3e98
TLSH
T11B61ACF787F5966D8A0155F0AA08EE1BCE2C0525831C3C6AC9E0BE57E3E3871E14165F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 890b8f790aedf194a7044d5d4dc1d234300677c74c149a7345690953fe4d0712
MD5 d4a0db0d583bcc3d6e805558f50aaf89
SHA1 cb6f0756113b026947e2e9163cb6ee70030c31fd
SHA512 e58fe6c78b5272f7da11a13d47a68993afe95240d15fa5dd9b8a2cbec951c2d0dcb30321be6e8d61f85884b0ceeac77a7a6305f8b2018759b75f0c44300dc994
SSDEEP 192:sxRuRVOn/fgs9b/RKCA94/WzoA8pyTi/g6+WNSuz4XYD9A6SVGf/IgD3pJ:sxRuGn/fgs9bZZ8Wx/5P4XySATT
TLSH
T14242C716A964593B9CCBE21DBB56BF53E2F91032A1D11E88A7FC970C00EB6DD630741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 5f755a6695d919c02c984b0acbaa20a18cd0da8651ed8388cc5189ee4ce32d71
MD5 7d513c5aae8641277d015e72d55dcc7a
SHA1 7e00d5492e372c33d64a84aeeec50b1e725adb1b
SHA512 21da93ce61e68616298e803502e05d0a66f3084bd726b1b9742ce863296224453e7243d48b8d51075d39f5dc4d83b4d27289c4a7b5f4e6e8c637307f48dd6dd9
SSDEEP 192:sxRVRVbn/fgsfb/RKCA94/WzoA8pyTi/g6+WNSeb/YD9S6SVGf/IghJ:sxRVDn/fgsfbZZ8Wx/5D/CSAr
TLSH
T11642D8165964993B9CCBE21DBB56BF53D2F91032A1D11E88E7FC970C00EA6ED630741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 4947531cafda0606317078854edfd9e52b13e73f2580aab299bac33e1249078d
MD5 7d879e398619cd046f8cb4a22b4bdd42
SHA1 0f4bd38fd5af9cb2a7363248577f4b1b7c95605a
SHA512 e3071aa10eddb9d2e96c2c1db01920af88dc0bc2ff258576d6cff8a7a2da5dc92f5293e514702918fd5a88585d43aacf15e953210ddf302b2e2e6f173b26efcf
SSDEEP 192:sxRuRVOn/fgs9b/RKCA94/WzoA8pyTi/g6+WNSuz4XYD9y6SVGf/IgD3zJ:sxRuGn/fgs9bZZ8Wx/5P4X+SATl
TLSH
T10142E716A964993B5CCBE21DBB56BF53D6F91032A1D01E88A7FC970C00EA7ED630741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

c0809dfc-9531-415d-9802-b04de46efe08.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\c0809dfc-9531-415d-9802-b04de46efe08.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 b124858d05f3bc26216ec5a571dc91363b32735e155f1e52ffd13aa33f011231
MD5 4f26c01681e5413c29efe47693270846
SHA1 e5a3789cc1caf9197e9da1cd1f0a9399d8133d70
SHA512 32904b3f24373dda9b100c8633a728aedd552fe833f00067e02ab2e237beeb907f9df3d769f99dbc4321a9190b2831f04aa13287a8e9ccf1d74b349333793139
SSDEEP 384:/tNn/s3n9SC38NMv4k5Hx3sWZlf8hyEGGzUCt3Oy2rEoajo4cdR8eHhVODjYPNDv:/j+9x3O63Fi0ct3WrEnjN3Gac1F3Mj+
TLSH
T1BEF2BE766DA58DB38CEAD2C6B5437B42BEE04663C5C80AD48ADD7A0D05C76BC130B937
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 42KB
SHA256 6441640611725901dc2b88818095ef5998c63121f8013d60147cbe217087b16b
MD5 e0c3277213733ba859839180a3a02da7
SHA1 9f0e0253bbfa78d16245c03a48e1dfc17205835c
SHA512 47f73225a95b44dd31c6489ecf99540f9e7e3c4bb180f97b5a9e3a59b38d79c75183501ff5a362ad5c250a0cfe300ca91c28c844e83ffdb94ef42e4dfa98a5ae
SSDEEP 768:KFKj+9o3LwgCm3Fi0ct3XrEnjN3Gac1F3Mj+:i9o3Mi7CQnjMaE5
TLSH
T145134BF659D78977C8AE8787673E2E029EBCC253B5840690B7C8690CCD871BFD306925
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 a0f19ccd1c4ddbec940ce40a20a5ade6ba83ae3271ad446a358d10789d143509
MD5 7334639702db5970724fc9650fc1497c
SHA1 209fdd786f3a26015a26f06888c9eb4d4c280755
SHA512 34d7de141a338c248244ace551e61c8ce9c73e5c0238785c9733dbf4adfd24a763880c19246c5efcda0e4b82b11acd9e2bd9bcd3a1c7d67f839d4fc11cc67456
SSDEEP 768:Arv+4UNbd23hP3Fi0ct3nrEnjN3Gac1F3/:Absb03h/7IQnjMaE/
TLSH
T1C003CF3569A89EB38CFAD2C6B1437A037EB0464386C907E4CADD3B0C45DB5AD130B963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 7007815ab9e6014dfacc9faab33266df7066512af29d1ebcfa3807c5292a89a5
MD5 b25b80c0b00387c733d0b1202ca076c3
SHA1 fe472f03e4b1a7f7f1e9c495d0adcf90c5d77472
SHA512 5e3b48326d499ad27987bc0d45c3b75a82002deb112791635d005f04e7b996339fece3e514f8a3c4736ad21f45de8b261f1eb94b42f60fd53a1294b5fcc88a1c
SSDEEP 384:ZtNn/s3n9Sb38NMC4k5Ix3sWZlf8hyEGGzUCt3ry2rEoajo4cdR8eHhVODjYPNDv:Zj+9Q3hV3Fi0ct3NrEnjN3Gac1F3Mj+
TLSH
T113F2BF766EA58DB38CEAD2C6B5037B42BEE0476385C40AD48ADD7A0D05D76BC130B937
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 69b35469a034bae045c6d06159751b285cce3de1ab431daa5dcd6e9d7a841b1b
MD5 384f6f29275986bef76d712a73dd0ae0
SHA1 3734183feaee928f24c496bf17b3ced6a989ae94
SHA512 0b74cfbf208a289872e1809d4cab137dbc5e5008c0cebbee34f5592756f67a84694a64e69cd18a54e3d600463e05031dca5d2405e84804cc6d9339c111a0756a
SSDEEP 384:/tNn/s3n9SgR38NMv4k5qx3sWZlf8hyEGGzUCt3Oy2rEoajo4cdR8eHhVODjYPN7:/j+9X3OP3Fi0ct3WrEnjN3Gac1F3Mj+
TLSH
T128F2BE766DA58DB38CEAD2C6B5437B42BEE04663C5C80AD48ADD7A0D05C76BC130B937
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 42KB
SHA256 b601c26de06fa13c221f420b3c76191741a3593d592067863ac2ef524b612494
MD5 1f7e6939285c5dfad7a38ce3bff8b08f
SHA1 29b4eeb8623c6542b9b525dcff7dd53c92b171eb
SHA512 0834d53b81418292aabbbcbfa658b061790e6fcd73095360f721066fd9f6e45d23931bb803559b6709e0f0b64d12160354f66265365b4c14c536f2b880d75f79
SSDEEP 768:KFCj+983MwgCw3Fi0ct3ArEnjN3Gac1F3Mj+:Q983nU7BQnjMaE5
TLSH
T1D9135BF659D78977C8AE8787673E2E029EBCC253B5840690B7C8690CCD871BFD306925
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 069772cee6db1c343823c2a4ac21bc4436073f89fad48a6bed4d9314fc389900
MD5 7063069a5c803539bb4031c93267085f
SHA1 96c1453585fa88d9e8a3e5f8325a2e37e1baed95
SHA512 d33a8e6861a8c276d086253f70c66f82024e52fe932301b70955144c9e6becfacc722d63e90a3659c2c1ba9ea95a2df965cec0dbd94da65b2a4628e7537e448c
SSDEEP 768:rrv+4UNbdS3fmi0lrEnjN3Gac1ZQeVH1SCz:rbsbg3MlQnjMajEH1V
TLSH
T19C03CF3269A88E738CEBE38571877A037EF4525386C40BE4C9DD6B0D469B5EC130B967
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 42KB
SHA256 5703ffe690b694181e27d7a56ecf29cd2174fdcdb50f4744a8ef116199cf22e6
MD5 f84a1616a67055e54797c415f78df07d
SHA1 c654b5ce6840c2318c648553c0276fcc0ca52530
SHA512 e7e15c58545ab7a7dd5d3cc836be3437de35b3f544b94cb8f67b91553addab8fa0ac33d98844cea05204d405207813db135c564dda349ec920140a72aeb846d1
SSDEEP 768:KFoj+9+3MwgCG3Fi0ct3OrEnjN3Gac1F3Mj+:a9+3nC77QnjMaE5
TLSH
T1F4134AF659D78976C8AE8787673E2E029EBCC253B5840590B7C8690CCD871BFD306925
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 e6ed4a90f9c1e3b355757581fd254f31effbd7cb0354a6068e985a720bc480df
MD5 f21663a4011c3cbab710bb347224148d
SHA1 5348fc4997cbd134da2ff297291c4294a0db82c1
SHA512 a92b726556883ddb550c58de32d5a9c1384c24d64cab3db1769b1bba002b6d43a28a82af209fa50f1e47fc20fbe03508ca99440caf983edc07f117e1f41ee20a
TLSH
T186E00903934404F9D478137140831B301BE3903015F546466E2581482C233066E24BC0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 647e8537dab2b0997f9cf94ea131a77db273872f5112e2179c3b21eb0e0d6ddb
MD5 3fd76fbfc4235ce26b09ac7cd42bd753
SHA1 9622a9f520a34520ca397eaeed861e667e769b8c
SHA512 4d45b52f204b4338a542e9f4df9249f525e96dee2e3fdc286b14ea98f5c8e96a1f8b3cc636cac0bc03e24a421e1c0c0b8edb7c7e2ce8ae4d8175bf767e85bc88
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 85becf01745f3489b98fca54fd04b27d91857b1357ab0f9a5d74c43ce4fe20a7
MD5 a9a6576cd8b500e28232701c3c3d42c8
SHA1 146d563d2f997a57dd2f4a2554d0cc0024637c7b
SHA512 356c8ca9e90a98d2018d7726a4309520006c3e7c602793b0362aaaeb3c9f47e8215ea7d5e314ee640399a355b78c940f9b33da561f03d25e75d924f28556fb7c
TLSH
T1BCE00203530400FDD078137140831B301BE3D03015F507476E2581481C233066F24FC0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 7cf6a8918cb67bdbc3b535f1621c6d4f541278e697befe86f068d3def6f1b816
MD5 2a073ec5a86ef809933ca8188b10d49c
SHA1 528f6c95a52a847b4a7a8938cd37a6b689ac4e53
SHA512 7c40287fde28442bda1774277fdb8fd52e15388f35760fd568d946f0a27ed051df5a40473fc88623d0c809f98d2036ff5d4896cdae0c189b6ac6b3043a0ceda5
TLSH
T1B5E00203130400FDD07813714043173017E3D03005B507066D1441540C132065F14BC0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe5a9c60.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5a9c60.TMP
Size 392B
SHA256 81528d7a5d1023b485e84e0627646c4ea3b860581c213cc4e4a071d912ec24a5
MD5 2ed356e75e3a8b72fae802551cfa3792
SHA1 754f829d6eab11fbb96a985c5f8b184241cefa7c
SHA512 06407457fc5343d2b591e728f0ebb576fba04b7c42518681408161ae877d2627b6016a605995cec6649eef2dabfee61f07385608b1b9f3569f8c18c3ca377991
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

warning[1]

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\CFYAF9LW\warning[1]
Size 1KB
SHA256 5f95eff2bcaaea82d0ae34a007de3595c0d830ac4810ea4854e6526e261108e9
MD5 124a9e7b6976f7570134b7034ee28d2b
SHA1 e889bfc2a2e57491016b05db966fc6297a174f55
SHA512 ea1b3cc56bd41fc534aac00f186180345cb2c06705b57c88c8a6953e6ce8b9a2e3809ddb01daac66fa9c424d517d2d14fa45fbef9d74fef8a809b71550c7c145
TLSH
T17F1198025F23C861C1961AB44294E9D602880802F766A65B72FDB297E2F5AD1F7FB341
MD5 SHA1 SHA512 TLSH

Submit Download

error[1]

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\UQC8YCF3\error[1]
Size 3KB
SHA256 7990e703ae060c241eba6257d963af2ecf9c6f3fbdb57264c1d48dda8171e754
MD5 16aa7c3bebf9c1b84c9ee07666e3207f
SHA1 bf0afa2f8066eb7ee98216d70a160a6b58ec4aa1
SHA512 245559f757bab9f3d63fb664ab8f2d51b9369e2b671cf785a6c9fb4723f014f5ec0d60f1f8555d870855cf9eb49f3951d98c62cbdf9e0dc1d28544966d4e70f1
TLSH
T1FB614203C3547C8A61238DB27903FBEAA58104801309A1B87EB194AB7BCD9BD1BE37D5
MD5 SHA1 SHA512 TLSH

Submit Download

error[1]

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\WV4CZIZ0\error[1]
Size 1KB
SHA256 b0abe318200dcde42e2125df1f0239ae1efa648c742dbf9a5b0d3397b903c21d
MD5 b9bec45642ff7a2588dc6cb4131ea833
SHA1 4d150a53276c9b72457ae35320187a3c45f2f021
SHA512 c119f5625f1fc2bcdb20ee87e51fc73b31f130094947ac728636451c46dced7b30954a059b24fef99e1db434581fd9e830abceb30d013404aac4a7bb1186ad3a
TLSH
T1DD31D06CB103BBB58EDB3C59B31A70C4ACA846301D244996B5BCC4D2F5ABC178BA275D
MD5 SHA1 SHA512 TLSH

Submit Download

tracking.ini

Path C:\Users\Admin\AppData\Local\Temp\AdvinstAnalytics\Error file remover\1.0.0.0\tracking.ini
Size 84B
SHA256 b83924517ce1e151acebf46774acd6e39ba1c5b700203bad60e75c8d4260877b
MD5 1024d1629eeaf91a6911e6eb2b3e6bb3
SHA1 4aa31012ee16a45e6b4fe5807ae454c0d0f0c9c2
SHA512 b9874dfa03fad430170a13fa496f0cb893328e669d04c26a35522b7bbb1999a6245cb45003d0989cdb9980456fa76d2979c0a5ef053c26fd34b286ab990781df
TLSH
T1CDA01219A8427034DC516609015786100C3010C0303B5060108C4241E518B508F0600C
MD5 SHA1 SHA512 TLSH

Submit Download

tracking.ini

Path C:\Users\Admin\AppData\Local\Temp\AdvinstAnalytics\Error file remover\1.0.0.0\tracking.ini
Size 84B
SHA256 e1ac952416a4716f39021352e6d024c9f41c058d4e4b6970d7a5ab5172569494
MD5 6ef9f9bdd569b051870bf25cc2e91114
SHA1 6acb0a349a9580a5c9d22d6b01b2e5632dff03b2
SHA512 b865dd0c0017fb8995fb1d527048447ac02a816e27f3b5ce2baf58553a2b3572fdabee7b27c70a356c31d947a82b41d180b2b7e923ae62c91fce0ca6d9e78e5d
TLSH
T13AA0122C2881303C6F201706184300208E3802943137201140444195D207B848B91008
MD5 SHA1 SHA512 TLSH

Submit Download

{EF0D1219-0C8C-499E-A012-439C440E4ED0}.session

Path C:\Users\Admin\AppData\Local\Temp\AdvinstAnalytics\Error file remover\1.0.0.0\{EF0D1219-0C8C-499E-A012-439C440E4ED0}.session
Size 3KB
SHA256 9284f59b78d9e4a433db6dce1ec7519bb3abb6a997ce9f308dfdcc6e2b391c64
MD5 909d6417c316b58bc04916f0b2f64844
SHA1 a25ee2c2d6ff1933e7264a0a48a82a3668b0a19c
SHA512 09c34972960cf1962ea3ed2cfdfb2e1bc3e18693811c146add861031700db7b80ba6d0407a38a3bd78d2e1bae8b7cae94bb8cde100f0cc78182b3b5f0925a310
TLSH
T17B518FE4648791F0CD92F3125225A3E23EE912C95E27A00D7761D11E770AA19AB0E717
MD5 SHA1 SHA512 TLSH

Submit Download

{EF0D1219-0C8C-499E-A012-439C440E4ED0}.session

Path C:\Users\Admin\AppData\Local\Temp\AdvinstAnalytics\Error file remover\1.0.0.0\{EF0D1219-0C8C-499E-A012-439C440E4ED0}.session
Size 3KB
SHA256 2fe93eccc97232921295d6fb597fd9b6427368b11c90be843548f78ebd27f505
MD5 28d10e442a2cf9967664b16403f14aba
SHA1 d7141e4f04990cb43f861a97e5079b003022bfb6
SHA512 4e2506601f01800a8ae4a03ecb24ae86c9cc039db692cffa46fd6a33b54f8565f959361117a109a263cf2120885a4cbaaac1cddf3693e275fd147777fbd16eec
TLSH
T1408180E4648791F0C992F2129225B3E23EFC26C95E27A00D7761D11E731AB19AF0E727
MD5 SHA1 SHA512 TLSH

Submit Download

{EF0D1219-0C8C-499E-A012-439C440E4ED0}.session

Path C:\Users\Admin\AppData\Local\Temp\AdvinstAnalytics\Error file remover\1.0.0.0\{EF0D1219-0C8C-499E-A012-439C440E4ED0}.session
Size 4KB
SHA256 dcfec12d1fea8156ed4583c4b138c643fe0fd2c58bd9d67c7f38b763b44cb7c2
MD5 5021f5ec204b69d7a18c13005123ec92
SHA1 c08297982bf3660166fb6edfaab38307ecb72e27
SHA512 3ac96e0841e6618fe64ce037c14558e3b41b1aad15d312b4ddd8de8d855a90233519966bbaccf82ccba653158f566de14f27bb45bcbc96cd863803024785ef25
SSDEEP 96:sOPzg4KWZAKGtKkH4K3BKbvKAGK6RK+YK1puKqxKEEkKu:Km
TLSH
T129A18EE4684791F0D992F3529221B3E23EEC17C99E27A00D7761D11E731AB19AF0E717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Error file remover.msi

Path C:\Users\Admin\AppData\Roaming\Windows\Error file remover 1.0.0.0\install\0A01606\Error file remover.msi
Size 1010KB
SHA256 05c18698c3dc3b2709afd3355ad5b91a60b2121a52e5fcc474e4e47fb8e95e2a
MD5 27bc9540828c59e1ca1997cf04f6c467
SHA1 bfa6d1ce9d4df8beba2bedf59f86a698de0215f3
SHA512 a3ae822116cddb52d859de7ffc958541bb47c355a835c5129aade9cc0e5fba3ff25387061deb5b55b5694a535f09fe8669485282eb6e7c818cc7092eb3392848
SSDEEP 24576:yAgEr3Zw5abtZ3L60uRaCXEYDmbnreAgC:PgxabtZ320uRa+EYDmbreAg
TLSH
T13D25BF1377E0C132D5EB16305A6AD7649BB9F8709A71C00BB3940A1E2FB1791EB36793
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

decoder.dll

Path C:\Users\Admin\AppData\Roaming\Windows\Error file remover 1.0.0.0\install\decoder.dll
Size 126KB
SHA256 76133e832c15aa5cbc49fb3ba09e0b8dd467c307688be2c9e85e79d3bf62c089
MD5 3531cf7755b16d38d5e9e3c43280e7d2
SHA1 19981b17ae35b6e9a0007551e69d3e50aa1afffe
SHA512 7b053ba2cf92ef2431b98b2a06bd56340dad94de36d11e326a80cd61b9acb378ac644ac407cf970f4ef8333b8d3fb4ff40b18bb41ec5aee49d79a6a2adcf28fd
SSDEEP 3072:pJzYRnR1UrYpMxbkpG2/wI/Bf6zWcvEm+6MG:zYPqrKM5kA2jy
TLSH
T1C1C3AE213380C032F11B113E8547E7B59BBF7AA1C9A0968B7FA40A655F35392DF3935A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BlueScreen.exe

Path C:\Users\Admin\Downloads\BlueScreen.exe
Size 9KB
SHA256 14e6ac84d824c0cf6ea8ebb5b3be10f8893449474096e59ff0fd878d49d0c160
MD5 b01ee228c4a61a5c06b01160790f9f7c
SHA1 e7cc238b6767401f6e3018d3f0acfe6d207450f8
SHA512 c849231c19590e61fbf15847af5062f817247f2bcd476700f1e1fa52dcafa5f0417cc01906b44c890be8cef9347e3c8f6b1594d750b1cebdd6a71256fed79140
SSDEEP 192:+fD9Nr7FhGYGkYPtkavYYGD6eXLeBZOic7b:+z7FUYGkoVRGD60EZOicf
TLSH
T14E123B86A3DAD469D89E02322DD34E61547ABC2583A8C3FF1D74028F6E71BC05D3127D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NoMoreRansom.exe

Path C:\Users\Admin\Downloads\NoMoreRansom.exe
Size 1.4MB
SHA256 2aab13d49b60001de3aa47fb8f7251a973faa7f3c53a3840cdf5fd0b26e9a09f
MD5 63210f8f1dde6c40a7f3643ccf0ff313
SHA1 57edd72391d710d71bead504d44389d0462ccec9
SHA512 87a89e8ab85be150a783a9f8d41797cfa12f86fdccb48f2180c0498bfd2b1040b730dee4665fe2c83b98d436453680226051b7f1532e1c0e0cda0cf702e80a11
SSDEEP 12288:WZgSKWk54jeg6lL5assQHtzV2KoLJ+PwXxwuLSJ8slf1zMr6iL/KNDx2PIXe2Q:KgoLetlLS8tz6V+PwD0XVMrXCNDxtK
TLSH
T10B65E05473F49606E1B7AA399A7689B8083EBC01FD70D96F31C0FD0F7831BA1986535A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WinlockerVB6Blacksod.exe

Path C:\Users\Admin\Downloads\WinlockerVB6Blacksod.exe
Size 2.4MB
SHA256 68b0e1932f3b4439865be848c2d592d5174dbdbaab8f66104a0e5b28c928ee0c
MD5 dbfbf254cfb84d991ac3860105d66fc6
SHA1 893110d8c8451565caa591ddfccf92869f96c242
SHA512 5e9ccdf52ebdb548c3fa22f22dd584e9a603ca1163a622db5707dbcc5d01e4835879dcfd28cb1589cbb25aed00f352f7a0a0962b1f38b68fc7d6693375e7666d
SSDEEP 49152:6kAG2QGTC5xvMdgpdb1KRHGepUu2cGbqPs9+q2HRPTnFVSLE:6kAjQGTCnvMmpYQqPNRPTnF4Y
TLSH
T1A9C5D022B7E3C077E57716B01929E36DD1F9BD609A32808FA3945B1E6B30991D538F23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIE7DC.tmp

Path C:\Windows\Installer\MSIE7DC.tmp
Size 88KB
SHA256 252b7423b01ff81aea6fe7b40de91abf49f515e9c0c7b95aa982756889f8ac1a
MD5 4083cb0f45a747d8e8ab0d3e060616f2
SHA1 dcec8efa7a15fa432af2ea0445c4b346fef2a4d6
SHA512 26f8949cad02334f9942fda8509579303b81b11bc052a962c5c31a7c6c54a1c96957f30ee241c2206d496d2c519d750d7f6a12b52afdb282fa706f9fee385133
SSDEEP 1536:adQe5dWJ5PQrYbcdv06DoY4J70eVsRckW1HhYpK5EubsF:pGdWJ5PGc6DoYu7hSWhYpwXsF
TLSH
T1E1933C4173E451B9F5E36AB03FFAD615CA76F8A5A5B2C51F4724080B58E0A42FB26333
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIE83B.tmp

Path C:\Windows\Installer\MSIE83B.tmp
Size 180KB
SHA256 a0367875b68b1699d2647a748278ebce64d5be633598580977aa126a81cf57c5
MD5 d552dd4108b5665d306b4a8bd6083dde
SHA1 dae55ccba7adb6690b27fa9623eeeed7a57f8da1
SHA512 e5545a97014b5952e15bb321135f65c0e24414f8dd606fe454fd2d048d3f769b9318df7cfb2a6bf932eb2bf6d79811b93cb2008115deb0f0fa9db07f32a70969
SSDEEP 3072:uVvQSjk1ZA65w4m2Qhy8beP7bNhDbKYpPlsB2KNndf:ovnqZzxmH7G7bnrhQ/
TLSH
T19A049D1236A0C03BD2BF263544798768A6BCE9615F71C40BB3688E6E1F70782EE75357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIEA74.tmp

Path C:\Windows\Installer\MSIEA74.tmp
Size 96KB
SHA256 604e79fe970c5ed044517a9a35e4690ea6f7d959d21173ebef45cdd3d3a22bdd
MD5 3cab78d0dc84883be2335788d387601e
SHA1 14745df9595f190008c7e5c190660361f998d824
SHA512 df6b49f2b5cddebd7e23e81b0f89e4883fc12d95735a9b3f84d2f402f4996c54b5fdea8adb9eaa98e8c973b089656d18d6b322bd71cb42d7807f7fa8a7348820
SSDEEP 1536:9CPYXUTK5kjNuQ+7bzwZH8uZYriQAvk7Dnzk28m2+b32I:wPYEI0T9kfV8m2+b3d
TLSH
T128A39E2239E0C132C55F5F79485EE7A09B7EB5219DF4840B3B6807BE5F70291AA3A317
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIEAE2.tmp

Path C:\Windows\Installer\MSIEAE2.tmp
Size 128KB
SHA256 59ff5bc12b155cc2e666bd8bc34195c3750eb742542374fc5e53fb22d11e862f
MD5 7e6b88f7bb59ec4573711255f60656b5
SHA1 5e7a159825a2d2cb263a161e247e9db93454d4f6
SHA512 294a379c99403f928d476e04668717cdabc7dc3e33bcf6bcad5c3d93d4268971811ff7303aa5b4b2ed2b59d59c8eba350a9a30888d4b5b3064708521ac21439c
SSDEEP 1536:BZTfyLkhcCrnxivk2tychAFPsrc2tlNY6hHLThRn0CWihVrePB4E+URMVQKa:BT2fhKUNf1hjZV6SE+UREQKa
TLSH
T1E7D38E1235E0C032C1AB1A3D8519EBA09FBFB621D97445077BA40BBE6F717909B3D34A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIEB22.tmp

Path C:\Windows\Installer\MSIEB22.tmp
Size 312KB
SHA256 9c155d4214cebda186647c035ada552963dcac8f88a6b38a23ea34f9ecd1d437
MD5 aa82345a8f360804ea1d8d935f0377aa
SHA1 c09cf3b1666d9192fa524c801bb2e3542c0840e2
SHA512 c051a381d87ba933ea7929c899fb01af2207cb2462dcb2b55c28cff65596b27bdb05a48207624eeea40fddb85003133ad7af09ca93cfb2426c155daea5a9a6db
SSDEEP 6144:2yULssarl2Qr7DsSb45R+V573Wj2quM3o4cBo4NeRiAmf:2/9arvr7Q0FP73Lqz0uRa
TLSH
T160648C22B6E4C032E5AF15746B65C76CC5FDF4B166A1C00BF3D0161E1FB2A82DA25B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2376-371-0x0000000000400000-0x0000000000409000-memory.dmp

Download

memory/2408-341-0x0000000000400000-0x0000000000409000-memory.dmp

Download

memory/2408-351-0x0000000000400000-0x0000000000409000-memory.dmp

Download

memory/5384-513-0x0000000000400000-0x00000000005DE000-memory.dmp

Download

memory/5384-983-0x0000000000400000-0x00000000005DE000-memory.dmp

Download

memory/5384-470-0x0000000000400000-0x00000000005DE000-memory.dmp

Download

memory/5384-501-0x0000000000400000-0x00000000005DE000-memory.dmp

Download

memory/5384-471-0x0000000000400000-0x00000000005DE000-memory.dmp

Download

memory/5384-472-0x0000000000400000-0x00000000005DE000-memory.dmp

Download

memory/5384-474-0x0000000000400000-0x00000000005DE000-memory.dmp

Download

memory/5384-533-0x0000000000400000-0x00000000005DE000-memory.dmp

Download

memory/5384-883-0x0000000000400000-0x00000000005DE000-memory.dmp

Download

memory/5384-535-0x0000000000400000-0x00000000005DE000-memory.dmp

Download

memory/5384-955-0x0000000000400000-0x00000000005DE000-memory.dmp

Download

memory/5384-1049-0x0000000000400000-0x00000000005DE000-memory.dmp

Download

memory/5384-996-0x0000000000400000-0x00000000005DE000-memory.dmp

Download

memory/5384-568-0x0000000000400000-0x00000000005DE000-memory.dmp

Download

memory/5384-977-0x0000000000400000-0x00000000005DE000-memory.dmp

Download

memory/5384-978-0x0000000000400000-0x00000000005DE000-memory.dmp

Download

memory/5384-515-0x0000000000400000-0x00000000005DE000-memory.dmp

Download

memory/5384-992-0x0000000000400000-0x00000000005DE000-memory.dmp

Download

memory/5384-994-0x0000000000400000-0x00000000005DE000-memory.dmp

Download

memory/5664-490-0x0000000000400000-0x00000000005DE000-memory.dmp

Download

memory/5664-480-0x0000000000400000-0x00000000005DE000-memory.dmp

Download