cryptolocker | hxxp://malware repo

Analysis

user interaction
yes
max time kernel
144s
max time network
157s
platform
windows11-21h2_x64
resource
win11-20260911-en
resource tags

arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
29/10/2026, 16:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://malware repo
Sample261029-vaej8a1x8j

Score

10^/10

defense_evasion discovery execution cryptolocker troldesh persistence ransomware suricata trojan upx

Malware Config

Signatures

Family: CryptoLocker
Ransomware family with multiple variants.
ransomware cryptolocker
Family: Troldesh, Shade, Encoder.858
Troldesh is a ransomware spread by malspam.
ransomware trojan troldesh
Disables Task Manager via registry modification
defense_evasion

Downloads MZ/PE file 1 IoCs

flow	pid	Process
103	2468	msedge.exe

Executes dropped EXE 7 IoCs

pid	Process
640	CryptoLocker.exe
3056	{34184A33-0407-212E-3320-09040709E2C2}.exe
2272	{34184A33-0407-212E-3320-09040709E2C2}.exe
4904	{34184A33-0407-212E-3320-09040709E2C2}.exe
5468	NoMoreRansom.exe
3616	csrss.exe
5912	000 (1).exe

Suricata alert: Tor Node X.509 Certificate Pattern Detected - Inbound 2 IoCs

Network activity triggered a Suricata alert

suricata

flow	pid	Process
122	5468	NoMoreRansom.exe
122	5468	NoMoreRansom.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1805035633-626948184-3225555471-1000\Software\Microsoft\Windows\CurrentVersion\Run\Client Server Runtime Subsystem = "\"C:\\ProgramData\\Windows\\csrss.exe\""	NoMoreRansom.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1805035633-626948184-3225555471-1000\Software\Microsoft\Windows\CurrentVersion\Run\CryptoLocker = "C:\\Users\\Admin\\AppData\\Roaming\\{34184A33-0407-212E-3320-09040709E2C2}.exe"	{34184A33-0407-212E-3320-09040709E2C2}.exe

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
103	raw.githubusercontent.com
101	raw.githubusercontent.com
102	raw.githubusercontent.com

Modifies WinLogon 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\AutoRestartShell = "0"	000 (1).exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1805035633-626948184-3225555471-1000\Control Panel\Desktop\Wallpaper	000 (1).exe

UPX packed file 15 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/5468-682-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral1/memory/5468-683-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral1/memory/5468-686-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral1/memory/5468-684-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral1/memory/3616-693-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral1/memory/3616-694-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral1/memory/5468-721-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral1/memory/5468-730-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral1/memory/5468-741-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral1/memory/5468-742-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral1/memory/5468-747-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral1/memory/5468-777-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral1/memory/5468-791-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral1/memory/5468-829-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral1/memory/5468-1697-0x0000000000400000-0x00000000005DE000-memory.dmp	upx

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 4 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\CryptoLocker.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\NoMoreRansom.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\000.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\000 (1).exe:Zone.Identifier	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5628	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	{34184A33-0407-212E-3320-09040709E2C2}.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	{34184A33-0407-212E-3320-09040709E2C2}.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	NoMoreRansom.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	NoMoreRansom.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{34184A33-0407-212E-3320-09040709E2C2}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NoMoreRansom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CryptoLocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{34184A33-0407-212E-3320-09040709E2C2}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{34184A33-0407-212E-3320-09040709E2C2}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	000 (1).exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2468	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Kills process with taskkill 2 IoCs

defense_evasion

pid	Process
4860	taskkill.exe
888	taskkill.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1805035633-626948184-3225555471-1000\{9703819C-8895-4A80-9297-02FD7AE12DEE}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\DefaultIcon	000 (1).exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile	000 (1).exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\icon.ico"	000 (1).exe

NTFS ADS 5 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\000.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\000 (1).exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\CryptoLocker.exe:Zone.Identifier	msedge.exe
File created	C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe\:Zone.Identifier:$DATA	CryptoLocker.exe
File opened for modification	C:\Users\Admin\Downloads\NoMoreRansom.exe:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5468	NoMoreRansom.exe
5468	NoMoreRansom.exe
5468	NoMoreRansom.exe
5468	NoMoreRansom.exe
3616	csrss.exe
3616	csrss.exe
3616	csrss.exe
3616	csrss.exe
2712	msedge.exe
2712	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs

pid	Process
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4860	taskkill.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe

Suspicious use of SendNotifyMessage 20 IoCs

pid	Process
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5912	000 (1).exe
5912	000 (1).exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3628 wrote to memory of 4120	3628	msedge.exe	81
PID 3628 wrote to memory of 2468	3628	msedge.exe	82
PID 3628 wrote to memory of 1040	3628	msedge.exe	83
PID 3628 wrote to memory of 1040	3628	msedge.exe	83
PID 3628 wrote to memory of 1040	3628	msedge.exe	83
PID 3628 wrote to memory of 2256	3628	msedge.exe	84
PID 3628 wrote to memory of 2256	3628	msedge.exe	84
PID 3628 wrote to memory of 4844	3628	msedge.exe	86
PID 3628 wrote to memory of 3584	3628	msedge.exe	87
PID 3628 wrote to memory of 4844	3628	msedge.exe	86
PID 3628 wrote to memory of 4844	3628	msedge.exe	86
PID 3628 wrote to memory of 3584	3628	msedge.exe	87
PID 3628 wrote to memory of 3584	3628	msedge.exe	87
PID 3628 wrote to memory of 4412	3628	msedge.exe	88
PID 3628 wrote to memory of 4412	3628	msedge.exe	88
PID 3628 wrote to memory of 4412	3628	msedge.exe	88
PID 3628 wrote to memory of 1712	3628	msedge.exe	89
PID 3628 wrote to memory of 3620	3628	msedge.exe	90
PID 3628 wrote to memory of 3632	3628	msedge.exe	91
PID 3628 wrote to memory of 1712	3628	msedge.exe	89
PID 3628 wrote to memory of 1712	3628	msedge.exe	89
PID 3628 wrote to memory of 3620	3628	msedge.exe	90
PID 3628 wrote to memory of 3620	3628	msedge.exe	90
PID 3628 wrote to memory of 3632	3628	msedge.exe	91
PID 3628 wrote to memory of 3632	3628	msedge.exe	91
PID 3628 wrote to memory of 3500	3628	msedge.exe	93
PID 3628 wrote to memory of 3500	3628	msedge.exe	93
PID 3628 wrote to memory of 3500	3628	msedge.exe	93
PID 3628 wrote to memory of 2640	3628	msedge.exe	96
PID 3628 wrote to memory of 2640	3628	msedge.exe	96
PID 3628 wrote to memory of 2640	3628	msedge.exe	96
PID 3628 wrote to memory of 4524	3628	msedge.exe	98
PID 3628 wrote to memory of 2548	3628	msedge.exe	99
PID 3628 wrote to memory of 1600	3628	msedge.exe	100
PID 3628 wrote to memory of 2548	3628	msedge.exe	99
PID 3628 wrote to memory of 4356	3628	msedge.exe	101
PID 3628 wrote to memory of 4356	3628	msedge.exe	101
PID 1600 wrote to memory of 4376	1600	msedge.exe	102
PID 3628 wrote to memory of 4872	3628	msedge.exe	103
PID 3628 wrote to memory of 4872	3628	msedge.exe	103
PID 3628 wrote to memory of 2268	3628	msedge.exe	104
PID 3628 wrote to memory of 2268	3628	msedge.exe	104
PID 3628 wrote to memory of 2268	3628	msedge.exe	104
PID 3628 wrote to memory of 3796	3628	msedge.exe	105
PID 3628 wrote to memory of 3796	3628	msedge.exe	105
PID 3628 wrote to memory of 3796	3628	msedge.exe	105
PID 3628 wrote to memory of 3704	3628	msedge.exe	107
PID 3628 wrote to memory of 3704	3628	msedge.exe	107
PID 3628 wrote to memory of 3704	3628	msedge.exe	107
PID 3628 wrote to memory of 4740	3628	msedge.exe	108
PID 3628 wrote to memory of 4740	3628	msedge.exe	108
PID 3628 wrote to memory of 4740	3628	msedge.exe	108
PID 3628 wrote to memory of 4472	3628	msedge.exe	109
PID 3628 wrote to memory of 4472	3628	msedge.exe	109
PID 3628 wrote to memory of 4472	3628	msedge.exe	109
PID 3628 wrote to memory of 5688	3628	msedge.exe	110
PID 3628 wrote to memory of 5696	3628	msedge.exe	111
PID 3628 wrote to memory of 5704	3628	msedge.exe	112
PID 3628 wrote to memory of 5872	3628	msedge.exe	114
PID 3628 wrote to memory of 5864	3628	msedge.exe	113
PID 3628 wrote to memory of 5864	3628	msedge.exe	113
PID 3628 wrote to memory of 5872	3628	msedge.exe	114
PID 3628 wrote to memory of 5872	3628	msedge.exe	114
PID 3628 wrote to memory of 5936	3628	msedge.exe	115

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://malware repo
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x24c,0x7ff926e7c188,0x7ff926e7c194,0x7ff926e7c1a0
  2⤵
  PID:4120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1828,i,16918268899257533367,13773617508864446565,524288 --field-trial-handle=2320,i,10365097264390933955,14670049778742546156,262144 --variations-seed-version --mojo-platform-channel-handle=2360 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:2468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1760,i,18121690440889494605,16604529820820481003,262144 --field-trial-handle=2320,i,10365097264390933955,14670049778742546156,262144 --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:2
  2⤵
  PID:1040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2128,i,12833977310210751761,18036976304452514066,524288 --field-trial-handle=2320,i,10365097264390933955,14670049778742546156,262144 --variations-seed-version --mojo-platform-channel-handle=2576 /prefetch:13
  2⤵
  PID:2256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3416,i,5084500556595419422,1708636711112300899,2097152 --field-trial-handle=2320,i,10365097264390933955,14670049778742546156,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:4844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3420,i,7342924481305572392,3400281073403339646,2097152 --field-trial-handle=2320,i,10365097264390933955,14670049778742546156,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:3584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4144,i,4130663133805635973,328961801847824982,2097152 --field-trial-handle=2320,i,10365097264390933955,14670049778742546156,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:1
  2⤵
  PID:4412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4156,i,16348643088370092158,16070936588293653315,2097152 --field-trial-handle=2320,i,10365097264390933955,14670049778742546156,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:9
  2⤵
  PID:1712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4204,i,14803728753462793175,5422423887600920591,2097152 --field-trial-handle=2320,i,10365097264390933955,14670049778742546156,262144 --variations-seed-version --mojo-platform-channel-handle=4360 /prefetch:9
  2⤵
  PID:3620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4172,i,5694002487029096529,10089500565918627202,2097152 --field-trial-handle=2320,i,10365097264390933955,14670049778742546156,262144 --variations-seed-version --mojo-platform-channel-handle=4368 /prefetch:1
  2⤵
  PID:3632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5328,i,537845995339329012,15242093553024951893,2097152 --field-trial-handle=2320,i,10365097264390933955,14670049778742546156,262144 --variations-seed-version --mojo-platform-channel-handle=5264 /prefetch:1
  2⤵
  PID:3500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=4280,i,15093482369238767794,7505995438801785535,2097152 --field-trial-handle=2320,i,10365097264390933955,14670049778742546156,262144 --variations-seed-version --mojo-platform-channel-handle=3704 /prefetch:1
  2⤵
  PID:2640
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5780,i,15342052092709859965,8324522273970367806,524288 --field-trial-handle=2320,i,10365097264390933955,14670049778742546156,262144 --variations-seed-version --mojo-platform-channel-handle=5796 /prefetch:14
  2⤵
  PID:3704
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5780,i,15342052092709859965,8324522273970367806,524288 --field-trial-handle=2320,i,10365097264390933955,14670049778742546156,262144 --variations-seed-version --mojo-platform-channel-handle=5796 /prefetch:14
  2⤵
  PID:4524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4520,i,17725323506125715713,4619718730828630075,524288 --field-trial-handle=2320,i,10365097264390933955,14670049778742546156,262144 --variations-seed-version --mojo-platform-channel-handle=5280 /prefetch:14
  2⤵
  PID:2548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5888,i,18324372035559761052,6771330564640464302,524288 --field-trial-handle=2320,i,10365097264390933955,14670049778742546156,262144 --variations-seed-version --mojo-platform-channel-handle=3708 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1600
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1128
    3⤵
    PID:4376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3568,i,13492893631063972301,8928402834698371561,524288 --field-trial-handle=2320,i,10365097264390933955,14670049778742546156,262144 --variations-seed-version --mojo-platform-channel-handle=6176 /prefetch:14
  2⤵
  PID:4356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1752,i,13270229468250653331,6441906313557680375,524288 --field-trial-handle=2320,i,10365097264390933955,14670049778742546156,262144 --variations-seed-version --mojo-platform-channel-handle=4492 /prefetch:14
  2⤵
  PID:4872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6720,i,14739814898737329223,3361587702318018238,2097152 --field-trial-handle=2320,i,10365097264390933955,14670049778742546156,262144 --variations-seed-version --mojo-platform-channel-handle=6728 /prefetch:1
  2⤵
  PID:2268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6716,i,15637243357940550095,2237114988471595711,2097152 --field-trial-handle=2320,i,10365097264390933955,14670049778742546156,262144 --variations-seed-version --mojo-platform-channel-handle=3720 /prefetch:1
  2⤵
  PID:3796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=4372,i,6751294307964043296,4797287187624528186,2097152 --field-trial-handle=2320,i,10365097264390933955,14670049778742546156,262144 --variations-seed-version --mojo-platform-channel-handle=6884 /prefetch:1
  2⤵
  PID:3704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=3556,i,18372915796303987086,14677089934026909671,2097152 --field-trial-handle=2320,i,10365097264390933955,14670049778742546156,262144 --variations-seed-version --mojo-platform-channel-handle=6724 /prefetch:1
  2⤵
  PID:4740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=5336,i,3476702848313477482,14156650178882345960,2097152 --field-trial-handle=2320,i,10365097264390933955,14670049778742546156,262144 --variations-seed-version --mojo-platform-channel-handle=3380 /prefetch:1
  2⤵
  PID:4472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4688,i,7710872964300592338,3035374441374679206,524288 --field-trial-handle=2320,i,10365097264390933955,14670049778742546156,262144 --variations-seed-version --mojo-platform-channel-handle=4660 /prefetch:14
  2⤵
  PID:5688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4684,i,1195472116145700684,12009512462459023997,524288 --field-trial-handle=2320,i,10365097264390933955,14670049778742546156,262144 --variations-seed-version --mojo-platform-channel-handle=4636 /prefetch:14
  2⤵
  PID:5696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4352,i,10978718745962104410,6703203757544821671,524288 --field-trial-handle=2320,i,10365097264390933955,14670049778742546156,262144 --variations-seed-version --mojo-platform-channel-handle=5288 /prefetch:14
  2⤵
  PID:5704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7264,i,6126456869189261542,126250359082782884,524288 --field-trial-handle=2320,i,10365097264390933955,14670049778742546156,262144 --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:14
  2⤵
  PID:5864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=4184,i,7355704034524387499,2278387708500630422,2097152 --field-trial-handle=2320,i,10365097264390933955,14670049778742546156,262144 --variations-seed-version --mojo-platform-channel-handle=7304 /prefetch:1
  2⤵
  PID:5872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7384,i,2703599033903015590,15519405772365538428,524288 --field-trial-handle=2320,i,10365097264390933955,14670049778742546156,262144 --variations-seed-version --mojo-platform-channel-handle=7284 /prefetch:14
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:5936
- C:\Users\Admin\Downloads\CryptoLocker.exe
  "C:\Users\Admin\Downloads\CryptoLocker.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - NTFS ADS
  PID:640
- - C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe
    "C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe" "/rC:\Users\Admin\Downloads\CryptoLocker.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    PID:3056
  - - C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe
      "C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe" /w00000234
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=7068,i,10116108691585298225,17382437252048868113,2097152 --field-trial-handle=2320,i,10365097264390933955,14670049778742546156,262144 --variations-seed-version --mojo-platform-channel-handle=7656 /prefetch:1
  2⤵
  PID:5252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7124,i,3334209698659687530,10567204935808154053,524288 --field-trial-handle=2320,i,10365097264390933955,14670049778742546156,262144 --variations-seed-version --mojo-platform-channel-handle=5856 /prefetch:14
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:2360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7660,i,195928847778976980,16804755100652265895,524288 --field-trial-handle=2320,i,10365097264390933955,14670049778742546156,262144 --variations-seed-version --mojo-platform-channel-handle=7724 /prefetch:14
  2⤵
  PID:832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7828,i,54185634509806160,14781469671399506841,524288 --field-trial-handle=2320,i,10365097264390933955,14670049778742546156,262144 --variations-seed-version --mojo-platform-channel-handle=3380 /prefetch:14
  2⤵
  PID:5368
- C:\Users\Admin\Downloads\NoMoreRansom.exe
  "C:\Users\Admin\Downloads\NoMoreRansom.exe"
  2⤵
  - Executes dropped EXE
  - Suricata alert: Tor Node X.509 Certificate Pattern Detected - Inbound
  - Adds Run key to start application
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:5468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4684,i,11660097902547038012,691516222094585274,262144 --field-trial-handle=2320,i,10365097264390933955,14670049778742546156,262144 --variations-seed-version --mojo-platform-channel-handle=7256 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=4740,i,14109215142602142514,8643437376491568636,2097152 --field-trial-handle=2320,i,10365097264390933955,14670049778742546156,262144 --variations-seed-version --mojo-platform-channel-handle=5544 /prefetch:1
  2⤵
  PID:5172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3604,i,6924768554177407151,12861121305475722584,524288 --field-trial-handle=2320,i,10365097264390933955,14670049778742546156,262144 --variations-seed-version --mojo-platform-channel-handle=6252 /prefetch:14
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:5136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6280,i,13347262436157461430,17707669001777749894,524288 --field-trial-handle=2320,i,10365097264390933955,14670049778742546156,262144 --variations-seed-version --mojo-platform-channel-handle=6292 /prefetch:14
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=7572,i,13575514812800644662,500902129070693879,2097152 --field-trial-handle=2320,i,10365097264390933955,14670049778742546156,262144 --variations-seed-version --mojo-platform-channel-handle=3408 /prefetch:1
  2⤵
  PID:4940
- C:\Users\Admin\Downloads\000 (1).exe
  "C:\Users\Admin\Downloads\000 (1).exe"
  2⤵
  - Executes dropped EXE
  - Modifies WinLogon
  - Sets desktop wallpaper using registry
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:5912
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\windl.bat""
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:5628
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4860
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im taskmgr.exe
      4⤵
      Kills process with taskkill
      PID:888
  - - C:\Windows\SysWOW64\Wbem\WMIC.exe
      wmic useraccount where name='Admin' set FullName='UR NEXT'
      4⤵
      PID:2196
  - - C:\Windows\SysWOW64\Wbem\WMIC.exe
      wmic useraccount where name='Admin' rename 'UR NEXT'
      4⤵
      PID:3236

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4356

C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe
C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4904

C:\ProgramData\Windows\csrss.exe
"C:\ProgramData\Windows\csrss.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3616

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

14791440-05cc-4e47-bff6-04e4be5d5e48.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\14791440-05cc-4e47-bff6-04e4be5d5e48.tmp
Size 392B
SHA256 f091529e8ed210555f5eea275336c20e3ba257490f1ffbd2004a064b1665c12d
MD5 0c6d48d893e0787392a53aaa08407ac9
SHA1 ac70289dbe0b20d07c177b5a3d1270962e3525a6
SHA512 a59e0eb591463de930fd3317daa3e09420831e90e5c743d92baa4ecb543df02669908f3dff0f402fedade43a4b8c3f472da681bf2fa504b6d9afbed76a54bdca
TLSH
T1E6E009A6670812BAC0385B3005C31F207FF2C2A167F2035A8A6105A82D637046E20F80
MD5 SHA1 SHA512 TLSH

Submit Download

1ec70722-340f-4bc8-9e4c-9909af4a4744.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\1ec70722-340f-4bc8-9e4c-9909af4a4744.tmp
Size 18KB
SHA256 fdb5fa23fc4ee704542040950dbb048d0ed7a95542b655fb513e64e91fd411f3
MD5 bc35cddd232fa47225bfb06fb64804b5
SHA1 9805636c0996469730455132270f55aa52c8378c
SHA512 1a5247c0ca3b1096e738e806e476cd4c30c8e501a477582384c2b77f9b37a2f6e1265ef0e910f6ac526a3cd352d9d06fad2404a0c3e2d84913c145e6d9ab8d3e
SSDEEP 384:mQkUSvm8NM3FaDvr2XW2CUde+cvaTZcj94IIls:GmPWRocvaTZcqLO
TLSH
T189826B72A8B96C2B4AB7B141E08E3603DEF09167DAC81F84E6DD5F2C01DA65C335A916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

246f2137-e671-41a8-be52-892dd59db6a7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\246f2137-e671-41a8-be52-892dd59db6a7.tmp
Size 392B
SHA256 fe6a5afc64a52ed2e9347a74b65aed281553f8a465c5e083629264ad9517c0c2
MD5 8024baf611f2d522e69c023459c476f0
SHA1 4f51627c47da8ce7fa501e9a8aef9b43e868ff6b
SHA512 223be4acd62cdb025f520e702c009010a5d3c630344f6e897eed6016580c6ffb335a5751774fe259750f0b21d26ecf88ed2d4bd48406361c4116910bb2e7bd2c
TLSH
T18AE001A6670812F6C03C5B3005C31F207FF282B157F2025A8A7005AC2D63B046E30F80
MD5 SHA1 SHA512 TLSH

Submit Download

24704d36-4234-4ef9-a49a-9bd925539d5f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\24704d36-4234-4ef9-a49a-9bd925539d5f.tmp
Size 18KB
SHA256 0f0f74abed8e24346ec89a7df0bbfb64a1d1e3d96a2506ab0544806ee6bcca5f
MD5 e0a2450cee123362488170949046d4ef
SHA1 c3cfaf9e7f899b01f6dd6c85fccf4ad7733b85f5
SHA512 f412aff903f4a9ad6254b4e3001a7d35e51af0bb16e032b953c0ec7ac123a1d17f0951064eac97ba2e42835f140e4b7c35b83976f2b03184fd8fe649a46a717d
SSDEEP 384:NQkUSva8NMDFaOvr2XW2CUdewcvaTZcj94IIls:3a8WRicvaTZcqLO
TLSH
T1D2826B72A8B96C2B49B7F141F08E3503DEF09167DAC81F84E6DD5F2C01DA65C335A916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

40642daa-a95e-486e-9b67-8720c70cb6b9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\40642daa-a95e-486e-9b67-8720c70cb6b9.tmp
Size 392B
SHA256 4fd68d1e134b62c4736920a2fb36ca2f19078af0baddce2d1acbcfaefb71b399
MD5 0ca46fd05a7b2032ccacf55750c1467f
SHA1 b863797ee593831091b5b0728734e7a2d0d425b1
SHA512 1d16ec99b69c800b11ffeaa107dec28da5f2ca72c794c675e2ee19b91525c4932d5b464fb7777b40c37e2a1987756e7efa9e522931086949b46cdd603667e718
TLSH
T19BE002C6630812B7C03C573005C31F106E7282B156E2021D4B30056C2D20B046D30E40
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f987e4a82615806ff556803b7b21b0d2d4b74c28595c743cb982cf070fdc5fe6
MD5 64208f3b75523f872abcacc513084508
SHA1 c88889be0582ef626138fd73abf40aa430663f9d
SHA512 cf875d56eca83af1bfe3be7b2a5882d79577728cd1b9f0a43747035e0ed6221affe2cdd306439a70e59ece38b8c684c37630340b92512e5d17ddbb4e1bd731bc
TLSH
T1E1D09BD4EB84B694D132183D16294219B64CD6745503B105E19C06960D452575192465
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3f310c3b8273b00d295147e393b4a23058ea03f5ee010d90678599d73c195a37
MD5 b9c8890d925e87eb0bbf19b910761f32
SHA1 ebc1bd95bce6c26382860b014f8b4af50c8eca50
SHA512 41b42b5d926befc815567f5591c6cfb0c14db9f9b34ece3e139916147381d3cbf08e79f43ca446cfce367a8a1de483fd5aa8dba2da8dc361432398890c328f38
TLSH
T127D09BD4EBC4BA94D532183D16294219B64CD6745503F105E19C06960D452975192465
MD5 SHA1 SHA512 TLSH

Submit Download

0052b6a2-068c-4c89-9ec5-393e035aacb0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\0052b6a2-068c-4c89-9ec5-393e035aacb0.tmp
Size 13KB
SHA256 ae5d0a597cb13c11bf22d511f00e1d62f1038d9cff9d4a52695470586e883f52
MD5 f79d7cbdcf5fda040cb3e0b0ca842640
SHA1 766ddcf1c7e7789d69104369bea5fa3bcf17b78b
SHA512 6b84696c91c209bc816d697b9052dcfe544c18cb1f042ef05a7ae7ba5600b3fb80000d8c861fa0ad522b134023a40770cf566299414c62391d0ce8fb92cc5268
SSDEEP 192:sxZRRYHcBWb/fssL59dpsoABWlt5n/W6+WNYOmiZH3oX/Y0nN+t8ohIg5ZhVarzj:sxZR0mWb/fssL5xFAK/bbX8/53eLXaP
TLSH
T1B252EA526924A9778CD7F509BF75BF13D6F9102299950E4CAAFCC91C04EB6EE230780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

063771fb-fe32-4a53-917a-4f0f65729e5e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\063771fb-fe32-4a53-917a-4f0f65729e5e.tmp
Size 12KB
SHA256 78096a1b21c5041e97d7ba837a856361b5198cfdae732d2bcb6a0ee310308e57
MD5 10ee221fd280cf7760e67235e2bbdf60
SHA1 e838a4152350f231312dbd3a9002b7b1615b9ab0
SHA512 1511104e66499816e9c6b7954fc9acf857f1bb9d83dfd8651e8c8d1e4dc37c63d70b851fc0c19b07bf05de9add7671f3e9c4a28126e1de1d33f7d6d0ed4cfb0e
SSDEEP 192:sxZcRYHcBzb/fssdGIdp8wltp/W6+WNi3oX/Y0nmVD8ohIgrVarzX/7:sxZc0mzb/fssdGo5/bI8/5mCepaP
TLSH
T1AE42FA526A24E5778CC7E609BE35BF13D6F9507299950E4CAAFCC51C04EB6EE220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

23aa02fe-332a-47a4-917b-0ff8b6032d67.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\23aa02fe-332a-47a4-917b-0ff8b6032d67.tmp
Size 12KB
SHA256 2da124a2da73ff7939d2661d4204ac84d2a5d3755da7f1813f258bf6344a55ad
MD5 82bd10916a54f6007a0125cec8432120
SHA1 3bf26257d18c0c510bacf55381b8c94ebc564a66
SHA512 aa346d46037e8cdc34122b9a2c03d886639292a4c56558e4fe02569adda56ca8920ef6f3be83fceece8913fef212210000af95f261321a6d062c93080bc3d23e
SSDEEP 192:sxZRRYHcBzb/fssLG9dpsoABWlt5n/W6+WNi3oX/Y0nmVD8ohIg5EVarzX/7:sxZR0mzb/fssLGxFAK/bI8/5mCeGaP
TLSH
T1F142EB526A24A5778CC7E519BE75FF13D6F9107299950E4CAAFCC91C04DB2EE220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

944e2113-1751-4f50-b9a2-7ab44109c1e0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\944e2113-1751-4f50-b9a2-7ab44109c1e0.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_00005c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00005c
Size 19KB
SHA256 af18b3681e8e2a1e8dc34c2aa60530dc8d8a9258c4d562cbe20c898d5de98725
MD5 1bd4ae71ef8e69ad4b5ffd8dc7d2dcb5
SHA1 6dd8803e59949c985d6a9df2f26c833041a5178c
SHA512 b3ff083b669aca75549396250e05344ba2f1c021468589f2bd6f1b977b7f11df00f958bbbd22f07708b5d30d0260f39d8de57e75382b3ab8e78a2c41ef428863
SSDEEP 384:/Und3PKicut4yiFkC9RWzlJpa2/CKYOyDJmCZyXJTW4PO821GyLjSoBwNeS:0UizQDYlJpaQCKYOyDJpI5Kx821DS3Nz
TLSH
T13692E1670BCE314E422EE25FA316A51733E41BE1EFE49640D6AA70D81C38DA243179D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00005d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00005d
Size 60KB
SHA256 a221cbf72963df1c02c8bc202b159379f26e3d0d06225a5933209e745040e35b
MD5 b90c0e06b88c09158b13db21c7fc9ef7
SHA1 a4b968f5abcd2addd2d8f2d3e6fc01f4127c95a3
SHA512 430aadb5315738f414c2d4ca0d9e2be42f5242a3b28765993602aed4b34e334d854a88a051e6519877b7ffd8a5bf4ee7276885d6daec541826dba878f8c07f2e
SSDEEP 1536:iw916VqIkIFHzR32SF2Sjm+KW3IS7uchJEsZP8:nngaGzR32ceS7uchJ1ZP8
TLSH
T18C530227CA3085D2572D05004B9EF35A1A6079FDEA09CD7E920157F772ACAACFE20E21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00005e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00005e
Size 45KB
SHA256 e8673783a155bb04180378c200fffc8910f6f062c8bf07d56f02f8bbbd697319
MD5 a7106e6beb39ce4e98233a5b3c1772c8
SHA1 689082c31b53555feafeff4145cc438b0d70e7a7
SHA512 8ad167a66e583628cad724c054e8a3a1a507a48352fa55225cfab6aef32185dcbfb7672340442ce7e9ddb92b12e398693a7e7e73dfcb96abfa2e0607bc7be95d
SSDEEP 768:SLK4xOdpIA1Szu+48kvAG2kLhCQpGCETEiDq2XDzjpl+qEKLj:SLK4dVu+DqARyCQsCq9q2zR3
TLSH
T1E223F1408E48EA9FD8D264CE83D7D8D9A4CDD4801612E73A634638C2B4B21BDFD568B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00005f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00005f
Size 63KB
SHA256 caecff4179910ce0ff470f9fa9eb4349e8fb717fa1432cf19987450a4e1ef4a5
MD5 226541550a51911c375216f718493f65
SHA1 f6e608468401f9384cabdef45ca19e2afacc84bd
SHA512 2947b309f15e0e321beb9506861883fde8391c6f6140178c7e6ee7750d6418266360c335477cae0b067a6a6d86935ec5f7acdfdacc9edffa8b04ec71be210516
SSDEEP 1536:tLQFdWY1+jAIuhc5s3JBP2ffX195jJqu1H5g60:qFdv+jA/cizOfTdRJ260
TLSH
T10E5302D829DC2DF4466490C19420E379C6FACED8E4485B6F5B2A2E0DF78DD7527C7242
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000060

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000060
Size 68KB
SHA256 9a184f33ae7f406bc55bb497748336469980585b53ccc41f863c96306dbf238a
MD5 0e776a9829f2513dc6b150e6e74178aa
SHA1 60fcee40a3ce00c80e125cad5c0a55fa02d15f2e
SHA512 39f0ccd6a44b69d59611679d725ad12187393d9628d977f9848796d5855fb145f3bfe2a3998bd2bbf8b5240c33cd6ecd9d49ed09f4d0270d5ae40558cf7acb54
SSDEEP 1536:H51miTVgrQ7JaUf76Z+AGYguWv0KxwhGPkMxOIdzz/SIWT27zQMPvp+elQDQ:ZYMR78X9GjuW8KxwhGPkKB5JWTMzz5+e
TLSH
T1026302329668F371BDE5B98DFECAD32F58485C204207CA11167E3DF3852549954D8C7B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000088

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000088
Size 6.7MB
SHA256 4ea1f2ecf7eb12896f2cbf8683dae8546d2b8dc43cf7710d68ce99e127c0a966
MD5 f2b7074e1543720a9a98fda660e02688
SHA1 1029492c1a12789d8af78d54adcb921e24b9e5ca
SHA512 73f9548633bc38bab64b1dd5a01401ef7f5b139163bdf291cc475dbd2613510c4c5e4d7702ecdfa74b49f3c9eaed37ed23b9d8f0064c66123eb0769c8671c6ff
SSDEEP 3072:eaLA1++iCeFj0im6X/AXpT8vVMCcHVcdhghUuz1o9Y:fLJlC6j0CX4XmvWHVcd62uO9
TLSH
T11E66F39B5ECC82E2FD3E05314062F676A6607EE907D24FCB62F80D47FA502E56C7119A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 7KB
SHA256 3339a9a0014d657b188458446143873dca9e1056a47cf75668e45cb5c8c41602
MD5 2a25757544fac0163f488e861f92ac2a
SHA1 6ddaa3534df1b1b1023c748f6e0d0f54d4c2e53c
SHA512 f2d2b14270862baf0c1d7a47860fb50e0e27f29e6b76442701d11a6493941ece5606180db948118a9004ddfc5a7df5ea554ec6a8bff5c30af0fe890790008ffe
SSDEEP 96:Dav+XzN6Kfqy3KNEM3T9u2pNNSs3/2uhJlE0ucp3SXfmpKw+f:DFbqaqEMVvj3/2IJl7p0f8Kw+f
TLSH
T164F14A4EDF558D88DB8A1DB852E057A7BE358183F64F9EBDC938C4B5F8C63C468A0480
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 32c617507701197e7b217bcf0fb47642f43e3d71ef47bd133bd0aff3287c2534
MD5 e92f70776c68f37799b66bb4d9dc0e97
SHA1 2c409f4363a678f0cabdbcffe48ab132530c6e42
SHA512 d66503ee39a510b2838efced06d334b1481864a789fed9083d3e81c8a7b73e4932111e31eff8972e959bf11117781cd58754c122f6a093ac99556c2d417602c5
TLSH
T11E51C65FD6518294EBD65EF1C7F142AB3D3099D0398BEDDDD9B8C5B958CA35840800C4
MD5 SHA1 SHA512 TLSH

Submit Download

80cc2bd7-5d1b-4598-bbfe-3122794d7e87.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\80cc2bd7-5d1b-4598-bbfe-3122794d7e87.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_github.com_0.indexeddb.leveldb\000003.log
Size 63KB
SHA256 39b1a492539af009dbf6b7e69e448863d6a9135fd0841bc7904b025a8b57b947
MD5 5844d9daf8a2a7d6f1abc84e83f74bda
SHA1 cdf55a8bda3075d75d84cd2efb8c5ad0c33733b9
SHA512 bfed118f3e63a6d0fa7df70f03b7abced0dd2d4786a1198cd8e0d39c3284d476c7a6f3617d199c986487a23c04c8b391a039523bc806939e8035d94369819bf6
SSDEEP 768:IVjqc5F/lMVjqc52UVjqM5cdC5KSl4OEX:AjDtkjQcjj/EX
TLSH
T10B53521C3AF9C8278BAE461378F2751D8873F2265488DCBED0561CDD47EABC1A1563A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_github.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_github.com_0.indexeddb.leveldb\LOG
Size 341B
SHA256 dac1c84202300a656f527912ad3c0e9a547335663196ea66fc8c07edd95ebb29
MD5 e811889cbc48fa13dfe91d3594e7261b
SHA1 34d592c04b1a089cd5bd0833f822f3eceb879a69
SHA512 c552ccb573bca91f094f3695caf0d6b13be661bf89699de00e68106f82e535b0452b729342321bbcb4f2cb4de304cc0cee0972c61ae8195a17dc75ed1ba121a0
TLSH
T1B9E0D87C85C9C11B521454E60538BB4ED7B7660FD7C46E8E4F02D820B0CA444D1AE251
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_github.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

7098dce8-718f-4cdf-a512-2cfe33e633ac.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\7098dce8-718f-4cdf-a512-2cfe33e633ac.tmp
Size 210B
SHA256 65afe388dbfd6b1bf6b9b9102efa55aac53ce0a18a4a4b0d98cc490b23dd9f9e
MD5 583e35168ed721694450bfdb060065b8
SHA1 b8687d858fca4c02aec800a9c8f2aad4479c1a5c
SHA512 415217c743df035291475c468cce1b0bb79cdbf15d1a6f490f85b0d94747ebaa5a58bb1053cd99ebfc6a22013994f51691851cc87412acc65e3762b53ec68b7b
TLSH
T1DAD023A3314272B15E1C25651125AC4FD77110141417D7D95490964815BBD6D044F0C9
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

cb2737c1-4411-45a4-af57-d0e915fdbafd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\cb2737c1-4411-45a4-af57-d0e915fdbafd.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

d35ddffd-64dc-40d5-af91-78727e04ccb4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\d35ddffd-64dc-40d5-af91-78727e04ccb4.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

ebc5cc9e-cd74-4ad7-9dde-03a7f88342ab.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\ebc5cc9e-cd74-4ad7-9dde-03a7f88342ab.tmp
Size 3KB
SHA256 99380113a815e665c90e3175a3586b9220ded8ea5b2dddd30b756420016def16
MD5 b242e92aedacdabb2acea5bea2531d3e
SHA1 2cf38ae65cfc09ec2d6a3a0e0c51257c7302cae7
SHA512 01a503576ce58c36c6b4c00c4ee7a871f641147691ed7b359a8e8b1474c74ee6d6092a93bc57d3b4d2d589077617c1ba0c55844bb88f5cd533122fe079fcb44f
TLSH
T12F819BF387E5866DCE1656F0AA18AE1BCF1D0515831C3C2AC8E4EE5BD3E2471E181B5E
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 bece153f8cd35e5429744c1b02070b8943245e45a025d7b608fa674d5909b390
MD5 92bb928df3189dd67b2e05478905a28e
SHA1 88d7b42d8d230f02ab41eb8cb6a415cc48e7aa14
SHA512 bf8c8d1dff5949892df2aed3f6c57e7ae2fbbd4448f27ed74a44e16b0bf178f38b9a653bbc494fddd39bd49b86c5189c0a754d632d9dbe8816d7ba85f938a2eb
SSDEEP 48:KYXIBKwAE/yBYI3KdOsLyhGIHKjqsPylXIxKEYMNQT8w1:KYXWKwA+iYAKdO6iGoKjqe2XCKEY9
TLSH
T154C1F54170BB024139BE2A1889B8971F16813173755DE9AB3FBC00A6DE77E094DFDAC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\blob_storage\b2d52a3d-95eb-4db3-af60-9f45617323e1\1
Size 1.7MB
SHA256 82df41538e6d381bc55ff884d5eadbc2dbbfeff57f50782e24842c4341829554
MD5 f7afb25d27a61917a2f26df8df3a1c1e
SHA1 bbfc1acb17d86f6a9562e1bd0f0f740413be2e78
SHA512 ae7cb5d064728256959351d10f8f9f05482b2b796dcb08a378548656a91c1df3754c9225ac69e9462908ae332713202699767033e53aa1c74e0f542fb21b654b
SSDEEP 3072:TLA1++iCeFj0im6X/AXpT8vVMCcHVcdhghUuz1o9Y:TLJlC6j0CX4XmvWHVcd62uO9
TLSH
T1CE85E29B5ECC82E2FD3E05314062F676A5647EE807E14FCB62F81E47FA501E4AC7119A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c597f07f-7c40-42c1-979a-7c76988f2e8b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c597f07f-7c40-42c1-979a-7c76988f2e8b.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3fc9c77-4518-484d-9abc-a29fbd2c7483.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d3fc9c77-4518-484d-9abc-a29fbd2c7483.tmp
Size 28KB
SHA256 29692f508ff4e66c90ce4a946c5a9a181bd1f70d06543aaddcbd1b0a7f9ad554
MD5 a1e1c9d04917ed8be217eb0d2b11ec5e
SHA1 62b8b174a2a0c2de9a25272e68cb6c5b0d853374
SHA512 a07d2948817e553e213b2186a9779b41cbdd97e3ce962d6afd0e600ba6f6f1a05c57029d7684562c1385079fb3ef5e494b98d02499f1d7b8797f1e1a1367fc55
SSDEEP 768:4enwK8sN2IsWRmkUQ3z8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3fYLl/Yi0E5broEy:4enwK8sN2IsWRmkUQ3zu1jaKfYLpY7EQ
TLSH
T151D2FA3F240CCB7E8FC05A99DC566F9B6AE802C796688D4047FA894C02C77EE511A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3264dfa9-fe4e-4eb5-a3f7-f0c2a0dbf57a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\3264dfa9-fe4e-4eb5-a3f7-f0c2a0dbf57a.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 d9ad9ee4d06403279dad4140c0187b0f52ae1799ddfaf07bfd99b746371ff145
MD5 cb341a562137b8f8521bb45e31fc4d3a
SHA1 cc16ec6c939b012f59e765408c5694c4627e15a0
SHA512 32f6f33ff8b6f97e881879688101f4cbe41fae8153ce9fa61e196344ce4aa81c72c19d7ba4a5ac1777d6f39dac758f0f6e47dc18f744e7c6987214f32fb57c8d
SSDEEP 192:ZGNT6f15sQmiUydJEIdTuLzFEz7pdBG8JNU6:ZGNT6tGiJfTu/UdVzU6
TLSH
T1A202E875AC786C6B9EF2EE45F4872613AFE4112BA9942F84D6EC1E2C00D765C2302827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 61be792e187554e72f49133125b10e8671add4ce18d6b93ffb53f8ddc1d20c4f
MD5 4a383c334a07e04cdd17e2bce5e98b21
SHA1 953f35fd5a1baabe63555d5405134d4ac7f78996
SHA512 8f9ad9cfaa2733a8bff32db43a8117241a3ffa36d5a3e79c9122d4f1f5b03257d5ff039e8f0898f97f66aff2e3c22af105d7e4021ceff58fbf24b1564ed1c563
TLSH
T197E004C071041113C034553005431D005D70414155D1011C4510455C35107007010700
MD5 SHA1 SHA512 TLSH

Submit Download

d34ac4ec-c4ba-4b7c-8eaf-ace284d7840b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\d34ac4ec-c4ba-4b7c-8eaf-ace284d7840b.tmp
Size 26KB
SHA256 213b8c0f1dd265107ee288356d9ab96be5cbde45fafeb91ed5dd3ade891fc97a
MD5 5c310a785db65a0c316f716c33fdd10c
SHA1 5483f2259293dacd917c6fe9bd1db023b79b5486
SHA512 bc777d782fc0d4941c3e49e22eb20a62d5295305df3158d8e2176b87ac27615704ee91436988ddc208bcdcdf605b4e0f1d517bbac501cfa6de6d3232cfa1031c
SSDEEP 384:0iFgQkUSvw8NE8TUNTUlIlDFaUvr1XW2CUdeycvaTZcj94IIls:PFIwtwgHWRkcvaTZcqLO
TLSH
T13DC229F248D7493AD9AEA743A37D2D039EBCC167B9845A40B78D4D1CCC961BFE306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d4d0cf8e-7198-4aba-af54-dc1d5cc818ed.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\d4d0cf8e-7198-4aba-af54-dc1d5cc818ed.tmp
Size 8KB
SHA256 3b7e655706c3d13274490561817ec7f54d088b92953550db7545773d62cbe785
MD5 975aab647bb26885f2f17a13af1a2bde
SHA1 d6e55c15cd432cc8ab9ba44994faaae96e6ba545
SHA512 e84e0dcedbd3e3ecd2db3a695cddb0f8d7622be5e425140becdccc626a72ebde4f9218748e6278f21d238a94f433fddd21ac2cc201df3bc6cc40885adaa420e8
SSDEEP 192:eGNl6f15WQmiUydKdTvLzFEz7pd6vNSKXRqBU6:eGNl6t8iiTv/UdencU6
TLSH
T1EF120B72A8B86C2B5EA3F541F4CB3503AEE55127EAC97F45E6DC1E2C01EB55C2306417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d6fefe80-89f2-4ddb-b023-79f36408ec88.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\d6fefe80-89f2-4ddb-b023-79f36408ec88.tmp
Size 392B
SHA256 9194dac96fc5733e73a2565884af0bdaafa4ba958b729231691216d9c5301e3a
MD5 52dbc62da8028050064ca35749c8cda5
SHA1 4edeea7077376a313d415b88babbd1c9a5248a30
SHA512 069ff515eb195d10809572d72f747fb8c821a9a6b0532974b5f995dac67687d355a399171a91c70cb07a072e246f83e3a8157347a699860977655930619c0cb8
TLSH
T11EE00186630812BAC03C5B3005831F206EA282A156E2025A4A3005AC2D21B046A30E80
MD5 SHA1 SHA512 TLSH

Submit Download

d86c63d1-ef78-4d51-b1f3-53d361c1e04a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\d86c63d1-ef78-4d51-b1f3-53d361c1e04a.tmp
Size 392B
SHA256 34ebeeed984373ff87ff176a763e2a410e64917b5eb35d201a11f3997b2eb8f6
MD5 9ce91afa6ae8186d474efb3af5d19e7f
SHA1 651505206aaefcba884975960278c22c77d4e73f
SHA512 66c703b4e094c970d8003e4732375a63c3b342dd623dff81c1f9fc02aa1266489ecf1c9f49c2c328cb8f8ebda5a73b6ca1c379d7d3d4d703760a94872a39b8d4
TLSH
T152E002C2620811B6C03C563005431E105DA2427155E1011C4A20055C29217006930F40
MD5 SHA1 SHA512 TLSH

Submit Download

dc5199a7-b5cf-4769-982b-3f35cca9727f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\dc5199a7-b5cf-4769-982b-3f35cca9727f.tmp
Size 26KB
SHA256 730e2a4e2bbc987cd3a824e803db9e9d7d18c27e355a4b12aa0c75da726e9a53
MD5 e3eb4867297d14bad224e9e05035e0fe
SHA1 9820a820db5e649a252ec02eb56f8d6f80e74e6d
SHA512 3b8d56367b4d758bd4fa9679134fb2d6fb04934823559147e7f09077424671a0985762d6e2ddc1f8dd14ac2b1c741a3a98849ec4e44d9080bebfc4576769318b
SSDEEP 384:0iF9QkUSvG8N/8TUNTUlIlDFalhvr1XW2CUdedcvaTZcj94IIls:PFnGswgcHWR7cvaTZcqLO
TLSH
T1EBC229F248E7483AD9AEA743A77D2D039EBCC167B5845A40B78D4D1CCC961BFE346806
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c8d54e7c-2d98-470e-9f27-0ed526382803.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\c8d54e7c-2d98-470e-9f27-0ed526382803.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

f067d24d-89eb-4daf-b4b8-8479c0bf9472.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\f067d24d-89eb-4daf-b4b8-8479c0bf9472.tmp
Size 18KB
SHA256 d779ac468a5ac02b1d815e3c2095d5886da6db9f6afe477cab8a782556385d03
MD5 aaeffc1b1fa1c42350839efe7ba4e1ff
SHA1 eb87599054b85866a91473036f08dc18a369d920
SHA512 b4e7e1f99cfd31640deb0e0f31f403861ff5900d7f7fd37ab67d299d947fea3949c09acd0fc1053b18f9d280f047d0d25bc657db20c7bd18a160d6bb8473d067
SSDEEP 384:CQkUSv08NMwFauvrgXtCUde+cvaTZcj94IIls:60BQocvaTZcqLO
TLSH
T1D0827C72A8B86C2B4EB3B141E08E3503DFF09167DAC41B84D6DD5F2C01DA65C335B916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CurrentDatabase_400.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
Size 896KB
SHA256 078710f879b2d154a2ca8d9983b4ba9a90fc0be52a52c98658ad9c2c5fa5592c
MD5 8a410ca32cfa68b6af87dd2a15895e22
SHA1 78218033b8278df0e23513baaffdfc346efaf5cb
SHA512 de46b955a9e9ca25d045efae4f34367a5b5832d36e49291d0c5e237381af12045a479b0d53777ab135db15b7af09f24152d48210ba24e4ffe0bc815b9936972e
SSDEEP 768:t0aleDxcg7KGVp3zT13VuI61HOdrrA9abhr8fEwPRzitFrzAqUmNKX08oJImdbaE:bZP2tFPuNnY4UmqEMioTaBacg
TLSH
T134154137D190B085CF2C71B1E5ED5F08BA23B10712E152465FB8A67BBA633C98D1B1E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CurrentDatabase_400.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
Size 896KB
SHA256 a2d4af8c553ce8a5870a5c434a90bfa0a92970be504d21c8a6a07ab9009e88f1
MD5 397be224386b968463d71eda1033d40c
SHA1 1da1fd3ad694f2f286900901623e669883edaf8f
SHA512 fb77046e507b21a715fec1fafa24b4d4aa1101d712d0fdfe2021df8d8a083b652fbd9a39982d632f361a45aef5e97a63c7948ba0c6ef6320dea38da14af0953b
SSDEEP 768:R0aleDxcg7KGVp3zT13VuI61HOdrrA9abhrXfEwPRzitFrzAqUmNKX08oJImdbaC:2ZPItFPuNnY4UmqEMioTaBacg
TLSH
T18D154137D190B085CF2C71B1E5ED5F08BA23B10712E052465FB8A67BBA633C99D1B1E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WMSDKNS.XML.bak

Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML.bak
Size 9KB
SHA256 cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
MD5 7050d5ae8acfbe560fa11073fef8185d
SHA1 5bc38e77ff06785fe0aec5a345c4ccd15752560e
SHA512 a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b
SSDEEP 96:/YkZRAF6zyHUhm77yB1pZYCEnfHrHH7B6xTGH+YCLV3zwULJEYCJWyHBt3zwFRh+:/2FV0bBPCfUdY
TLSH
T10022A2A194818DD206290E275DB95C0DDA8CE9D3832C24997C9EEB7FDFB1C00355FB6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

one.rtf

Path C:\Users\Admin\AppData\Local\Temp\one.rtf
Size 403B
SHA256 e152b106733d9263d3cf175f0b6197880d70acb753f8bde8035a3e4865b31690
MD5 6fbd6ce25307749d6e0a66ebbc0264e7
SHA1 faee71e2eac4c03b96aabecde91336a6510fff60
SHA512 35a0d6d91178ec10619cf4d2fd44d3e57aa0266e1779e15b1eef6e9c359c77c384e0ffe4edb2cde980a6847e53f47733e6eacb72d46762066b3541dee3d29064
TLSH
T162E0ABB65C82D2C5018D15AA9E5040190F1D8E7AACB6A5CEB40AAC10B2A549C70809D2
MD5 SHA1 SHA512 TLSH

Submit Download

rniw.exe

Path C:\Users\Admin\AppData\Local\Temp\rniw.exe
Size 76KB
SHA256 70faa0e1498461731f873d3594f20cbf2beaa6f123a06b66f9df59a9cdf862be
MD5 9232120b6ff11d48a90069b25aa30abc
SHA1 97bb45f4076083fca037eee15d001fd284e53e47
SHA512 b06688a9fc0b853d2895f11e812c48d5871f2793183fda5e9638ded22fc5dc1e813f174baedc980a1f0b6a7b0a65cd61f29bb16acc6dd45da62988eb012d6877
SSDEEP 1536:3vosBknP2Uo+GjDZwue3jzFfcdhghUuV+ETNOh:3vVMCcHVcdhghUuzE
TLSH
T134735A83B6C10772C68146B145B23AB6C735973A87269FD7D34C5A07AFA44F1CCB22DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

text.txt

Path C:\Users\Admin\AppData\Local\Temp\text.txt
Size 396B
SHA256 38c889b5d7bdcb79bbcb55554c520a9ce74b5bfc29c19d1e4cb1419176c99f48
MD5 9037ebf0a18a1c17537832bc73739109
SHA1 1d951dedfa4c172a1aa1aae096cfb576c1fb1d60
SHA512 4fb5c06089524c6dcd48b6d165cedb488e9efe2d27613289ef8834dbb6c010632d2bd5e3ac75f83b1d8024477ebdf05b9e0809602bbe1780528947c36e4de32f
MD5 SHA1 SHA512

Submit Download

v.mp4

Path C:\Users\Admin\AppData\Local\Temp\v.mp4
Size 81KB
SHA256 95374cf300097872a546d89306374e7cf2676f7a8b4c70274245d2dccfc79443
MD5 d2774b188ab5dde3e2df5033a676a0b4
SHA1 6e8f668cba211f1c3303e4947676f2fc9e4a1bcc
SHA512 3047a831ed9c8690b00763061807e98e15e9534ebc9499e3e5abb938199f9716c0e24a83a13291a8fd5b91a6598aeeef377d6793f6461fc0247ec4bbd901a131
SSDEEP 1536:ncypHn1U1VPY2RiCe6ujcvimXqX/IVcKMYXN9WTcTjT/:nLA1++iCeFj0im6X/AXpT/
TLSH
T12E83BFC94BDE1A9AFFB8633585494F280709A376566023CF31AC8C7B3BF22E56D5508D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

windl.bat

Path C:\Users\Admin\AppData\Local\Temp\windl.bat
Size 771B
SHA256 b551fba71dfd526d4916ae277d8686d83fff36d22fcf6f18457924a070b30ef7
MD5 a9401e260d9856d1134692759d636e92
SHA1 4141d3c60173741e14f36dfe41588bb2716d2867
SHA512 5cbe38cdab0283b87d9a9875f7ba6fa4e8a7673d933ca05deddddbcf6cf793bd1bf34ac0add798b4ed59ab483e49f433ce4012f571a658bc0add28dd987a57b6
TLSH
T1FF0128835579212398372F7C93CBEE479014DC1928C44B5739EF686AA7A2454B029BDE
MD5 SHA1 SHA512 TLSH

Submit Download

6aa286af-18d6-4695-882b-d83d7149f114.tmp

Path C:\Users\Admin\Downloads\6aa286af-18d6-4695-882b-d83d7149f114.tmp
Size 338KB
SHA256 d765e722e295969c0a5c2d90f549db8b89ab617900bf4698db41c7cdad993bb9
MD5 04fb36199787f2e3e2135611a38321eb
SHA1 65559245709fe98052eb284577f1fd61c01ad20d
SHA512 533d6603f6e2a77bd1b2c6591a135c4717753d53317c1be06e43774e896d9543bcd0ea6904a0688aa84b2d8424641d68994b1e7dc4aa46d66c36feecb6145444
SSDEEP 6144:sWmw0EuCN0pLWgTO3x5N22vWvLRKKAX5l++SybIvC:sWkEuCaNT85I2vCMX5l+ZRv
TLSH
T14F74E073B4919525E9E04DB4F6B9BD324639B8396F3D4BC792842D4E04701CBEAB9383
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

72bb9a67-882b-4689-820c-2f0dde44c074.tmp

Path C:\Users\Admin\Downloads\72bb9a67-882b-4689-820c-2f0dde44c074.tmp
Size 1.4MB
SHA256 2aab13d49b60001de3aa47fb8f7251a973faa7f3c53a3840cdf5fd0b26e9a09f
MD5 63210f8f1dde6c40a7f3643ccf0ff313
SHA1 57edd72391d710d71bead504d44389d0462ccec9
SHA512 87a89e8ab85be150a783a9f8d41797cfa12f86fdccb48f2180c0498bfd2b1040b730dee4665fe2c83b98d436453680226051b7f1532e1c0e0cda0cf702e80a11
SSDEEP 12288:WZgSKWk54jeg6lL5assQHtzV2KoLJ+PwXxwuLSJ8slf1zMr6iL/KNDx2PIXe2Q:KgoLetlLS8tz6V+PwD0XVMrXCNDxtK
TLSH
T10B65E05473F49606E1B7AA399A7689B8083EBC01FD70D96F31C0FD0F7831BA1986535A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CryptoLocker.exe:Zone.Identifier

Path C:\Users\Admin\Downloads\CryptoLocker.exe:Zone.Identifier
Size 55B
SHA256 2dfb5f4b33e4cf8237b732c02b1f2b1192ffe4b83114bcf821f489bbf48c6aa1
MD5 0f98a5550abe0fb880568b1480c96a1c
SHA1 d2ce9f7057b201d31f79f3aee2225d89f36be07d
SHA512 dbc1150d831950684ab37407defac0177b7583da0fe13ee8f8eeb65e8b05d23b357722246888189b4681b97507a4262ece96a1c458c4427a9a41d8ea8d11a2f6
TLSH
T1CA900297040444480F5535C459DC9418B11E7554CD454688EC5140D6D98409D42E9416
MD5 SHA1 SHA512 TLSH

Submit Download

CryptoLocker.exe:Zone.Identifier

Path C:\Users\Admin\Downloads\CryptoLocker.exe:Zone.Identifier
Size 55B
SHA256 2dfb5f4b33e4cf8237b732c02b1f2b1192ffe4b83114bcf821f489bbf48c6aa1
MD5 0f98a5550abe0fb880568b1480c96a1c
SHA1 d2ce9f7057b201d31f79f3aee2225d89f36be07d
SHA512 dbc1150d831950684ab37407defac0177b7583da0fe13ee8f8eeb65e8b05d23b357722246888189b4681b97507a4262ece96a1c458c4427a9a41d8ea8d11a2f6
TLSH
T1CA900297040444480F5535C459DC9418B11E7554CD454688EC5140D6D98409D42E9416
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3616-694-0x0000000000400000-0x00000000005DE000-memory.dmp

Download

memory/3616-693-0x0000000000400000-0x00000000005DE000-memory.dmp

Download

memory/5468-829-0x0000000000400000-0x00000000005DE000-memory.dmp

Download

memory/5468-721-0x0000000000400000-0x00000000005DE000-memory.dmp

Download

memory/5468-1697-0x0000000000400000-0x00000000005DE000-memory.dmp

Download

memory/5468-682-0x0000000000400000-0x00000000005DE000-memory.dmp

Download

memory/5468-791-0x0000000000400000-0x00000000005DE000-memory.dmp

Download

memory/5468-684-0x0000000000400000-0x00000000005DE000-memory.dmp

Download

memory/5468-686-0x0000000000400000-0x00000000005DE000-memory.dmp

Download

memory/5468-730-0x0000000000400000-0x00000000005DE000-memory.dmp

Download

memory/5468-683-0x0000000000400000-0x00000000005DE000-memory.dmp

Download

memory/5468-742-0x0000000000400000-0x00000000005DE000-memory.dmp

Download

memory/5468-777-0x0000000000400000-0x00000000005DE000-memory.dmp

Download

memory/5468-741-0x0000000000400000-0x00000000005DE000-memory.dmp

Download

memory/5468-747-0x0000000000400000-0x00000000005DE000-memory.dmp

Download

memory/5912-851-0x0000000008EF0000-0x0000000008EFE000-memory.dmp

Download

memory/5912-858-0x00000000096C0000-0x00000000096D0000-memory.dmp

Download

memory/5912-860-0x00000000093A0000-0x00000000093B0000-memory.dmp

Download

memory/5912-862-0x00000000096C0000-0x00000000096D0000-memory.dmp

Download

memory/5912-861-0x00000000093A0000-0x00000000093B0000-memory.dmp

Download

memory/5912-859-0x00000000096C0000-0x00000000096D0000-memory.dmp

Download

memory/5912-855-0x00000000093A0000-0x00000000093B0000-memory.dmp

Download

memory/5912-856-0x00000000093A0000-0x00000000093B0000-memory.dmp

Download

memory/5912-857-0x00000000093A0000-0x00000000093B0000-memory.dmp

Download

memory/5912-854-0x00000000093A0000-0x00000000093B0000-memory.dmp

Download

memory/5912-850-0x00000000093C0000-0x00000000093F8000-memory.dmp

Download

memory/5912-830-0x0000000005E10000-0x00000000063B6000-memory.dmp

Download

memory/5912-828-0x0000000000640000-0x0000000000CEE000-memory.dmp

Download