Technical Analysis of MedusaLocker Ransomware

**MedusaLocker technical analysis:** This report provides an in-depth technical examination of the MedusaLocker ransomware (active since 2019), covering pre-encryption operations (mutex, UAC bypass via CMSTPLUA, registry modifications), persistence (copying to %APPDATA% and scheduled task creation), volume and device enumeration (including targeting SystemReserved), service and process termination, backup/recovery neutralization, network scanning (ICMP reconnaissance and NetShareEnum), encryption workflow (AES for data, RSA to protect keys, .marlock11 extension), and a list of executable hashes as IoCs.