4eaeeda72c1352264f13d2ceea4d43306d5f175f0d3c37979f9fb0fd60c553ee

Analysis

max time kernel
900s
max time network
1176s
platform
windows11-21h2_x64
resource
win11-20240508-en
resource tags

arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
submitted
12/05/2024, 07:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MalwareRepository-main/TrollInfiniteBlue.exe
Size 288KB
Sample240512-jtkd2aag78
SHA256 e5a872454cd6792202e10966edc9568db1032e41a2fd268d60a42a1ed547fd0b
MD5 b20880c0ec4d881a124673b5c30ba9fd
SHA1 626b52a9769843228c5a452d3b6fdaa6801b2d7c
SHA512 7a9e801dd01fd2450e0e2b74d2eea287c3097ffb0709636e9c3474e2df1e0d0e76ff4ca37c2558af5a95ff64ceaec43aa88b50c82e652d2649138b78b27c1d34
SSDEEP 6144:vjT5Zh17eWxoG/+ov/2OIQ4wW3OBsZeEWuYFvb1k:vRZ+IoG/n9IQxW3OBszqvb1k
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2100	msedge.exe
2100	msedge.exe
1692	msedge.exe
1692	msedge.exe
1416	msedge.exe
1416	msedge.exe
2400	identity_helper.exe
2400	identity_helper.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	4756	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4756	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1632 wrote to memory of 3080	1632	TrollInfiniteBlue.exe	80
PID 1632 wrote to memory of 3080	1632	TrollInfiniteBlue.exe	80
PID 1632 wrote to memory of 3080	1632	TrollInfiniteBlue.exe	80
PID 3080 wrote to memory of 1692	3080	cmd.exe	84
PID 3080 wrote to memory of 1692	3080	cmd.exe	84
PID 1692 wrote to memory of 4988	1692	msedge.exe	85
PID 1692 wrote to memory of 4988	1692	msedge.exe	85
PID 1692 wrote to memory of 2740	1692	msedge.exe	86
PID 1692 wrote to memory of 2740	1692	msedge.exe	86
PID 1692 wrote to memory of 2740	1692	msedge.exe	86
PID 1692 wrote to memory of 2740	1692	msedge.exe	86
PID 1692 wrote to memory of 2740	1692	msedge.exe	86
PID 1692 wrote to memory of 2740	1692	msedge.exe	86
PID 1692 wrote to memory of 2740	1692	msedge.exe	86
PID 1692 wrote to memory of 2740	1692	msedge.exe	86
PID 1692 wrote to memory of 2740	1692	msedge.exe	86
PID 1692 wrote to memory of 2740	1692	msedge.exe	86
PID 1692 wrote to memory of 2740	1692	msedge.exe	86
PID 1692 wrote to memory of 2740	1692	msedge.exe	86
PID 1692 wrote to memory of 2740	1692	msedge.exe	86
PID 1692 wrote to memory of 2740	1692	msedge.exe	86
PID 1692 wrote to memory of 2740	1692	msedge.exe	86
PID 1692 wrote to memory of 2740	1692	msedge.exe	86
PID 1692 wrote to memory of 2740	1692	msedge.exe	86
PID 1692 wrote to memory of 2740	1692	msedge.exe	86
PID 1692 wrote to memory of 2740	1692	msedge.exe	86
PID 1692 wrote to memory of 2740	1692	msedge.exe	86
PID 1692 wrote to memory of 2740	1692	msedge.exe	86
PID 1692 wrote to memory of 2740	1692	msedge.exe	86
PID 1692 wrote to memory of 2740	1692	msedge.exe	86
PID 1692 wrote to memory of 2740	1692	msedge.exe	86
PID 1692 wrote to memory of 2740	1692	msedge.exe	86
PID 1692 wrote to memory of 2740	1692	msedge.exe	86
PID 1692 wrote to memory of 2740	1692	msedge.exe	86
PID 1692 wrote to memory of 2740	1692	msedge.exe	86
PID 1692 wrote to memory of 2740	1692	msedge.exe	86
PID 1692 wrote to memory of 2740	1692	msedge.exe	86
PID 1692 wrote to memory of 2740	1692	msedge.exe	86
PID 1692 wrote to memory of 2740	1692	msedge.exe	86
PID 1692 wrote to memory of 2740	1692	msedge.exe	86
PID 1692 wrote to memory of 2740	1692	msedge.exe	86
PID 1692 wrote to memory of 2740	1692	msedge.exe	86
PID 1692 wrote to memory of 2740	1692	msedge.exe	86
PID 1692 wrote to memory of 2740	1692	msedge.exe	86
PID 1692 wrote to memory of 2740	1692	msedge.exe	86
PID 1692 wrote to memory of 2740	1692	msedge.exe	86
PID 1692 wrote to memory of 2740	1692	msedge.exe	86
PID 1692 wrote to memory of 2100	1692	msedge.exe	87
PID 1692 wrote to memory of 2100	1692	msedge.exe	87
PID 1692 wrote to memory of 2140	1692	msedge.exe	88
PID 1692 wrote to memory of 2140	1692	msedge.exe	88
PID 1692 wrote to memory of 2140	1692	msedge.exe	88
PID 1692 wrote to memory of 2140	1692	msedge.exe	88
PID 1692 wrote to memory of 2140	1692	msedge.exe	88
PID 1692 wrote to memory of 2140	1692	msedge.exe	88
PID 1692 wrote to memory of 2140	1692	msedge.exe	88
PID 1692 wrote to memory of 2140	1692	msedge.exe	88
PID 1692 wrote to memory of 2140	1692	msedge.exe	88
PID 1692 wrote to memory of 2140	1692	msedge.exe	88
PID 1692 wrote to memory of 2140	1692	msedge.exe	88
PID 1692 wrote to memory of 2140	1692	msedge.exe	88
PID 1692 wrote to memory of 2140	1692	msedge.exe	88
PID 1692 wrote to memory of 2140	1692	msedge.exe	88
PID 1692 wrote to memory of 2140	1692	msedge.exe	88

C:\Users\Admin\AppData\Local\Temp\MalwareRepository-main\TrollInfiniteBlue.exe
"C:\Users\Admin\AppData\Local\Temp\MalwareRepository-main\TrollInfiniteBlue.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1632
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\MalwareRepository-main\project.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3080
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/watch?v=dQw4w9WgXcQ
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:1692
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffaeba53cb8,0x7ffaeba53cc8,0x7ffaeba53cd8
      4⤵
      PID:4988
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1868,15967083793501938625,13431784207066768250,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1880 /prefetch:2
      4⤵
      PID:2740
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1868,15967083793501938625,13431784207066768250,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2336 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2100
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1868,15967083793501938625,13431784207066768250,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2828 /prefetch:8
      4⤵
      PID:2140
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,15967083793501938625,13431784207066768250,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
      4⤵
      PID:3044
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,15967083793501938625,13431784207066768250,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
      4⤵
      PID:3952
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,15967083793501938625,13431784207066768250,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4624 /prefetch:1
      4⤵
      PID:2312
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,15967083793501938625,13431784207066768250,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3468 /prefetch:1
      4⤵
      PID:2072
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1868,15967083793501938625,13431784207066768250,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3456 /prefetch:8
      4⤵
      PID:2668
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1868,15967083793501938625,13431784207066768250,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4872 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1416
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,15967083793501938625,13431784207066768250,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5416 /prefetch:1
      4⤵
      PID:3088
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,15967083793501938625,13431784207066768250,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5392 /prefetch:1
      4⤵
      PID:2628
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,15967083793501938625,13431784207066768250,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5164 /prefetch:1
      4⤵
      PID:3612
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,15967083793501938625,13431784207066768250,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3468 /prefetch:1
      4⤵
      PID:5008
  - - C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1868,15967083793501938625,13431784207066768250,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6228 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2400
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1868,15967083793501938625,13431784207066768250,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2568 /prefetch:2
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4972
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,15967083793501938625,13431784207066768250,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5112 /prefetch:1
      4⤵
      PID:2356

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1856

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3204

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2912

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004C4 0x00000000000004B4
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4756

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:1324

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 d222c8e3b19cda2657629a486faf32962e016fc66561ce0d17010afdb283c9de
MD5 8f2eb94e31cadfb6eb07e6bbe61ef7ae
SHA1 3f42b0d5a90408689e7f7941f8db72a67d5a2eab
SHA512 9f7f84149885b851e0bf7173c540e466a2b2eb9907d8b608f60360933328cc75d9d1b63640ea4ecc1e64ecc5dd7ee74d82903f96a8b4418ca56296641a8c0703
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 0bc24451c65457abc1e4e340be2f8faceae6b6ec7768a21d44bcd14636543bae
MD5 d56e8f308a28ac4183257a7950ab5c89
SHA1 044969c58cef041a073c2d132fa66ccc1ee553fe
SHA512 fd5798559f4025ec3408f5550b8671d394b1ec83b85fdac8c005b0cc3e183272bdd07db15a156a572c9c5e5798badf235dc10aae62a052efa8dd9dfdbdca8189
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 528B
SHA256 0682d076b3a56a78ea5296e9ccea408d2b93ab1fa8f1eabbd38b53312eb8b71a
MD5 571cf807c42b36c93b37cafd922ae8d8
SHA1 6f76f51db43c24c9a0aeeb26a5e7210adcd9abeb
SHA512 b6f173e6770a3eeafe14f78804aa8ecc37840f2e2916c9556a7edfb8f2a220e5587ef438541061503c21e9664b782adbb0bb78da9ae760af9112d8e83172fd15
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 3KB
SHA256 adaff68d13761a06f8fd0ef2cd21950516b58a818b8b0ee7c24f86755ba090c4
MD5 d64b53f43230deb30298f13071d2b23c
SHA1 dafc85c7de18ceb944f7a029cf2d4d2aadb65530
SHA512 1cdde789dd7a5ff4d937e24c3060c1503c63a9d4695757f326d6c224601956dba05f58ac3b2936a4101afa1b94d54dab9ede7e58c0f946583f9aaf6a0e97e6e2
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 2KB
SHA256 b22eab656e0e7ced131beaecc87ba9fad098dc02481374796ce3cdcd3af22c0c
MD5 8132886808a68aec5c4345ff697f806a
SHA1 f1680d4f72e6f0fbd0bcd2d8dd2e7180d2bb96cb
SHA512 049f0e143e093c7aaa2cbf3ec0ce0f3c4fe8d5037e463c0e67ba19b9c2997ac156cbb6b9652015c73f09c1f43fd96cea68be20f26a86f28a536a8afc5aed47c5
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 52b79edfe0d144a13c5cb629f2be24ab48e91e69bc1e8d5c11beba17f13abfca
MD5 b345e7063a8cd5f75efbfccb286f2d29
SHA1 791064df5ca23a2792d33490eb34c993efaf6757
SHA512 ae36c59c3912f1cb007f084450012504a793e08353f75279f4805a6291aee02bba9f3de9fc7c670a45ac54a527512c8925e6df295613fbb9b7b0634a0827c996
SSDEEP 96:nsNk3dxm/pQYmtXkkyExcGwSv0MoiVmdHIeJn0WQyV+VuziX3wI3:nEk3+Ctkk/tv0MAIcnLM93
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 c308681024fd659707373e4cadb73aac40c9834c71c7e23938fb0b405e74f5f0
MD5 6546a7a2e91e9aa9d1cc3cd642c6d35e
SHA1 fbde3ed34428171643765f68268a8c5664912742
SHA512 80efdf89056ccf4e99e2af33f123b39a8cdd3f0a0d470da7d8bfc146ceb042177502cdaf0bbc5299229212117cbe610e00cc7a4b3f77842cd7c64a1d1841eedf
SSDEEP 96:nsNk3Pxm/pUmtXkk8ExcGwSv0MoiCujR5md6twNjNIAJwQ0WQyV+VpAiX3wI3:nEk3khtkkNtv0MDvwNpI2/Le93
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 456a5e13bab7a0eb3b4424ddf14550beb1033ba3118eaf92742f8378f6d9f5d3
MD5 44b53f1f08255008a81072bf3fe29936
SHA1 adfade9a847acf9032a98185a25e5a86fcb71f19
SHA512 e032e627ba210ac08a76b20b4ebde72fc52b8fdce77872c20b13b6454d67c347401792dc65833b08c9251ee863d736e9ba564ff866fa2d58b16d20eedc94b062
SSDEEP 96:nsNk3dxm/pUmtXkkyExcGwSv0MoiVmd6quxSS1jINJn0WQyV+VpAiX3wI3:nEk3+htkk/tv0MmuzhIXnLe93
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\51b66971-f7c2-4cf3-aeb7-da0352a2ddd3\index-dir\the-real-index
Size 2KB
SHA256 4958926623ae88b13ea088ca86d1442dfdccd4037b97f22f81357ffe94fee646
MD5 72c0989a06c011b057ad01e8af87044f
SHA1 2e15204b3aa11332df8e0731f87414a24e0c4308
SHA512 ef70996f008c9cff21a102aa6e5dd9d7d8525909b53a7ef657c87e12cf083783565c9d651b150741163299a61fd4b80b2d48249edd5834acc24c5662ed197537
MD5 SHA1 SHA512

Submit Download

the-real-index~RFe57d1e6.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\51b66971-f7c2-4cf3-aeb7-da0352a2ddd3\index-dir\the-real-index~RFe57d1e6.TMP
Size 48B
SHA256 b2febd695baf926a97b505d0c0defa8876214be8e4cd19d7705a2be6032939b1
MD5 f57018e9fb432b67fdf634c43181c3ce
SHA1 d088317baf372eeb6c367784d43f4078b691d17a
SHA512 e2ca145b44a4e3032a0163d3883a1ba2dfcc622105161359ba96d26d37e1c3c4469195c3da76b979ec279c56c6e9e7b9cebec0fc52fff6f64f14fe51754eae81
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 89B
SHA256 40ea267aa6b3fefbdb2097536bef49fabfc1063a93852a059f47241599e68df1
MD5 aad46170eb0cf428b1f96bf75c8f0364
SHA1 f363879611098ec1cde05c246ce181a58097e3f2
SHA512 6553c2ccecb7c3cadd6558409052f90e0a4efe6032f128b5ade428c46e040f07493bbba9e75b92ae242829fbe16be9370c1dbbeea8d45f64b1b1227e2e494f9c
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 146B
SHA256 1ebe4feedfec4dba6c3307030adc8f556637e2921c6bac5132ca71a61b5c3123
MD5 a21d66dfb33fe460c0642c1b0d7a81f0
SHA1 03ad119accd03b8b581fca53a7586301af3a446c
SHA512 11b4f424d1b84c229ea2972f154412e4240b1d71622a2fff54f0aefe37de517e81f0341ef01e417780d04d956333496b50166272ce8c23bed56a2d8379ba64b7
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 82B
SHA256 ac3bd606e3ed61c0b99dfa6648d0454aeffa84c5f291c71ec42c170361f4cf98
MD5 360765541608c3c193fc8378d83f741d
SHA1 77b1736c4605ebb857d189da08dc1c0b0b4f1163
SHA512 5ebb590a8e7a2b24a3be251598a51b21d5663558accb11a33ea621dade0faaf492af75ffb581fa4c001ad4319b02f37f4e4bd8a5c5c9485b683ae5f85fe4a0f5
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 84B
SHA256 1fe72f371ac5b0e626e1fa713ebf549d8b0adea6b4fab6f5b962a732c3ec0b20
MD5 a943e2b8dfe3c1111da094fac2ef6913
SHA1 ebfe2011544551d5dfbfb814ffc41b06deb5edad
SHA512 197210863fefc8eba3b76465d0b054a352e7e3b74d0684ba1d94f67a79bd2f1cd34335704eca4990e590167e4c131df5599dd25f7e67587dba7db2ec9ad25ad8
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 919cfb282b3e63a369a06ad6aa95c5343f071424b65a4bf52b345b1f44b834f2
MD5 94c50aef8589d274b73895a1b2f6add4
SHA1 91784343a72fe522f9c3fd3a58dfd8fa6e833f53
SHA512 25972f6058df70b0d93d75fb15e5539082a752bf54424677613490e491f2ff9ca16fc090f61d6c7f05a45d67ec29b88c44dbe2640c5baecb1b1b273645dbc45d
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 48B
SHA256 93ea03e2bba4e683c60c568e489ff0476a21a431eebeb5e88fa275262a08a6c1
MD5 cc525047564149adbdabb0b22f2c71d1
SHA1 d79ab4f188b62352119d22d26f3eca2f6f3d1de1
SHA512 f758235296ed615aafcd6b846fdfbdca2e3a04b6224f1b17dcd64e292fab21a544144d92559284e58c6540fe809342e55bb3017c879498bb021cd3757b679161
MD5 SHA1 SHA512

Submit Download

the-real-index~RFe57c6bb.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57c6bb.TMP
Size 48B
SHA256 56e778f8778c745df71ef08e9835c368a3b0bae4e9dae04e3a16110a5616823b
MD5 b84a5e379264cc2a0a27c3c667b462cd
SHA1 e30326544355b83c6bacb90c51463e94a004584b
SHA512 07ff7d79e43e625b2ce8575c9b4ffd66af6d59ebba5cff101876026db1a0715d4f0001ea6afae6276e658caeb4054b10fd8300a1f30d3d52b2ef617ad4c9d898
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 706B
SHA256 88b15810e384cdeed1de5fa3b5ae6d3b05d4dc06b56f34aeecf934f0e0b44bf7
MD5 0af5ffcd52dae8c9218936ce13304da1
SHA1 d7f8fe830bb9fda946fe463213d7c7c8df9cd002
SHA512 853cfb5a1925569cbab94955866062a3fb14fb547947994e53d45d39ba024380d3e089611a23e2f16dc7d1350c2b72a1e9805b07e13a86f742754afc726dd8db
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe5944df.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5944df.TMP
Size 706B
SHA256 7cb38dbd0ccad5c48bff86d05087a94ffee95e48c35e3b3a76d66816689d9e9a
MD5 7be08798bb81b354c614c0a269cd00f2
SHA1 9bc9b5486197546f8fdad6b5e30afc49f72a08f9
SHA512 02430e1e6a1d1565335c613972236f86bfb781840326f5c89cc65766df630dbcee98767c034f45ae5ed25532fc72ad007849d98a82496cc45c8a6cb8b971cb83
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 67ab4e21e077a8af90eafc794567e5b5aeeb6a1ef3474b11b41342cfedcc43dc
MD5 939afb4ab86c8da3c1e64a1212d9f6c3
SHA1 52885316ec1985e237fe3948d9cadee7f9d98976
SHA512 9bea3a2668724f90b6c4e0fa0f8b47eb7b12eec65aa20c2ffb3b90f17a3ee8dc5f3bb6957a9cdee6691a773ee153f35386f00e8910a2d2fab7cfe786ebd9d06a
SSDEEP 192:coCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxASG3OMlAxie2RUB3RRm52TacHlC:M9iIxuERzA83h09RZxASG3r1Ujm50VGr
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 dc7b3a3655cab0392b294c593aa87eb2e1eebd8db53fbff372ab9ad4c893b951
MD5 694d7d6b53aef76a2ab4486dfc4dfc07
SHA1 17abf3cdfbeebbc207bef0b3aa3abc21acf4af5e
SHA512 1b315156ee6a71822e6b24d99caa060bb7dbcad07de5b4c5accd47c4277e6180216e99e20f5dd2fcc9fb231c33f45657086f82e2ebb0da3ddfd6b970e44a7a68
SSDEEP 384:O9iIxuERzA83h09RZxASG3rSlhOG0VGzPRhWap:dIxuERzA83h09RZxbG3r8IG0UbWap
MD5 SHA1 SHA512 SSDEEP

Submit Download

project.bat

Path C:\Users\Admin\AppData\Local\Temp\MalwareRepository-main\project.bat
Size 83B
SHA256 b1061cea7d9f4bbe417b1237755f702e9aa2eb3a0209678ba559d2f29a1878ee
MD5 49e2c81809619e9e797675db00b8e9eb
SHA1 c2a01852235051cbd44ae1c14ae375c8955eda07
SHA512 c63fc19ba0c32dea7a31e2945d8ee5435ccf8a4b8423df2e0fc6a04407c154591274facbc4788278c38c9f7573075cc73ba3550d3dba52d4144f8ac1911a8094
MD5 SHA1 SHA512

Submit Download