cc65535243dfd3cd54a9c5ecfcb93c7f918a87c725e9c52925017ab92effe278

Resubmissions

08/07/2025, 02:15

250708-cptctazjz610

14/02/2025, 20:11

14/02/2025, 20:11

05/02/2025, 09:01

15/10/2024, 03:47

05/08/2024, 04:49

05/08/2024, 03:50

Analysis

max time kernel
148s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
05/08/2024, 03:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1c8bc3890f3f202e459fb87acec4602955697eef3b08c93c15ebb0facb019845.exe
Size 179KB
Sample240805-eee4jszepd
SHA256 1c8bc3890f3f202e459fb87acec4602955697eef3b08c93c15ebb0facb019845
MD5 c2fea37aa19c947614c20fe2ad3aeef2
SHA1 16834915e3db38b5b954c2099d77bcb700428588
SHA512 e5d86b7d03c3428c59b0d0bc7e57089abc8dc8baf3dd9dde47852c43ede1e48804851cfb3ed018121b78248f8e75ed7049ea8b2d6ed6303df36514a016e98e59
SSDEEP 3072:ZTO/rWaQcrcfX25Qs9jRzj/rvV9Yecqj3:tO/rWayXIFVj/rvV9B
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery persistence ransomware

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation	1c8bc3890f3f202e459fb87acec4602955697eef3b08c93c15ebb0facb019845.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\discord = "C:\\Users\\Admin\\AppData\\Local\\discord.exe"	1c8bc3890f3f202e459fb87acec4602955697eef3b08c93c15ebb0facb019845.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Pictures\\imageRLcHhWKQFVPfwjfGIXJjePbWQmdLze.jpg"	1c8bc3890f3f202e459fb87acec4602955697eef3b08c93c15ebb0facb019845.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1c8bc3890f3f202e459fb87acec4602955697eef3b08c93c15ebb0facb019845.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NOTEPAD.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings	1c8bc3890f3f202e459fb87acec4602955697eef3b08c93c15ebb0facb019845.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4456	msedge.exe
4456	msedge.exe
3172	msedge.exe
3172	msedge.exe
3928	identity_helper.exe
3928	identity_helper.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4884	1c8bc3890f3f202e459fb87acec4602955697eef3b08c93c15ebb0facb019845.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
4884	1c8bc3890f3f202e459fb87acec4602955697eef3b08c93c15ebb0facb019845.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe

Suspicious use of SendNotifyMessage 25 IoCs

pid	Process
4884	1c8bc3890f3f202e459fb87acec4602955697eef3b08c93c15ebb0facb019845.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4884 wrote to memory of 5096	4884	1c8bc3890f3f202e459fb87acec4602955697eef3b08c93c15ebb0facb019845.exe	85
PID 4884 wrote to memory of 5096	4884	1c8bc3890f3f202e459fb87acec4602955697eef3b08c93c15ebb0facb019845.exe	85
PID 4884 wrote to memory of 5096	4884	1c8bc3890f3f202e459fb87acec4602955697eef3b08c93c15ebb0facb019845.exe	85
PID 4884 wrote to memory of 4580	4884	1c8bc3890f3f202e459fb87acec4602955697eef3b08c93c15ebb0facb019845.exe	86
PID 4884 wrote to memory of 4580	4884	1c8bc3890f3f202e459fb87acec4602955697eef3b08c93c15ebb0facb019845.exe	86
PID 4884 wrote to memory of 4580	4884	1c8bc3890f3f202e459fb87acec4602955697eef3b08c93c15ebb0facb019845.exe	86
PID 4580 wrote to memory of 3172	4580	cmd.exe	88
PID 4580 wrote to memory of 3172	4580	cmd.exe	88
PID 3172 wrote to memory of 2972	3172	msedge.exe	90
PID 3172 wrote to memory of 2972	3172	msedge.exe	90
PID 3172 wrote to memory of 2352	3172	msedge.exe	91
PID 3172 wrote to memory of 2352	3172	msedge.exe	91
PID 3172 wrote to memory of 2352	3172	msedge.exe	91
PID 3172 wrote to memory of 2352	3172	msedge.exe	91
PID 3172 wrote to memory of 2352	3172	msedge.exe	91
PID 3172 wrote to memory of 2352	3172	msedge.exe	91
PID 3172 wrote to memory of 2352	3172	msedge.exe	91
PID 3172 wrote to memory of 2352	3172	msedge.exe	91
PID 3172 wrote to memory of 2352	3172	msedge.exe	91
PID 3172 wrote to memory of 2352	3172	msedge.exe	91
PID 3172 wrote to memory of 2352	3172	msedge.exe	91
PID 3172 wrote to memory of 2352	3172	msedge.exe	91
PID 3172 wrote to memory of 2352	3172	msedge.exe	91
PID 3172 wrote to memory of 2352	3172	msedge.exe	91
PID 3172 wrote to memory of 2352	3172	msedge.exe	91
PID 3172 wrote to memory of 2352	3172	msedge.exe	91
PID 3172 wrote to memory of 2352	3172	msedge.exe	91
PID 3172 wrote to memory of 2352	3172	msedge.exe	91
PID 3172 wrote to memory of 2352	3172	msedge.exe	91
PID 3172 wrote to memory of 2352	3172	msedge.exe	91
PID 3172 wrote to memory of 2352	3172	msedge.exe	91
PID 3172 wrote to memory of 2352	3172	msedge.exe	91
PID 3172 wrote to memory of 2352	3172	msedge.exe	91
PID 3172 wrote to memory of 2352	3172	msedge.exe	91
PID 3172 wrote to memory of 2352	3172	msedge.exe	91
PID 3172 wrote to memory of 2352	3172	msedge.exe	91
PID 3172 wrote to memory of 2352	3172	msedge.exe	91
PID 3172 wrote to memory of 2352	3172	msedge.exe	91
PID 3172 wrote to memory of 2352	3172	msedge.exe	91
PID 3172 wrote to memory of 2352	3172	msedge.exe	91
PID 3172 wrote to memory of 2352	3172	msedge.exe	91
PID 3172 wrote to memory of 2352	3172	msedge.exe	91
PID 3172 wrote to memory of 2352	3172	msedge.exe	91
PID 3172 wrote to memory of 2352	3172	msedge.exe	91
PID 3172 wrote to memory of 2352	3172	msedge.exe	91
PID 3172 wrote to memory of 2352	3172	msedge.exe	91
PID 3172 wrote to memory of 2352	3172	msedge.exe	91
PID 3172 wrote to memory of 2352	3172	msedge.exe	91
PID 3172 wrote to memory of 2352	3172	msedge.exe	91
PID 3172 wrote to memory of 2352	3172	msedge.exe	91
PID 3172 wrote to memory of 4456	3172	msedge.exe	92
PID 3172 wrote to memory of 4456	3172	msedge.exe	92
PID 3172 wrote to memory of 3684	3172	msedge.exe	93
PID 3172 wrote to memory of 3684	3172	msedge.exe	93
PID 3172 wrote to memory of 3684	3172	msedge.exe	93
PID 3172 wrote to memory of 3684	3172	msedge.exe	93
PID 3172 wrote to memory of 3684	3172	msedge.exe	93
PID 3172 wrote to memory of 3684	3172	msedge.exe	93
PID 3172 wrote to memory of 3684	3172	msedge.exe	93
PID 3172 wrote to memory of 3684	3172	msedge.exe	93
PID 3172 wrote to memory of 3684	3172	msedge.exe	93
PID 3172 wrote to memory of 3684	3172	msedge.exe	93
PID 3172 wrote to memory of 3684	3172	msedge.exe	93
PID 3172 wrote to memory of 3684	3172	msedge.exe	93

C:\Users\Admin\AppData\Local\Temp\1c8bc3890f3f202e459fb87acec4602955697eef3b08c93c15ebb0facb019845.exe
"C:\Users\Admin\AppData\Local\Temp\1c8bc3890f3f202e459fb87acec4602955697eef3b08c93c15ebb0facb019845.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Sets desktop wallpaper using registry
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4884
- C:\Windows\SysWOW64\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\Read Me First!.txt
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5096
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c @echo off & echo github: https://github.com/temon_69 & start https://github.com/temon_69
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4580
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/temon_69
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:3172
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff8106846f8,0x7ff810684708,0x7ff810684718
      4⤵
      PID:2972
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2004,11368007030431741029,5624716475901918963,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2008 /prefetch:2
      4⤵
      PID:2352
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2004,11368007030431741029,5624716475901918963,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2336 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4456
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2004,11368007030431741029,5624716475901918963,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2920 /prefetch:8
      4⤵
      PID:3684
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,11368007030431741029,5624716475901918963,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
      4⤵
      PID:3936
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,11368007030431741029,5624716475901918963,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
      4⤵
      PID:3268
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2004,11368007030431741029,5624716475901918963,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5164 /prefetch:8
      4⤵
      PID:4124
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2004,11368007030431741029,5624716475901918963,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5164 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3928
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,11368007030431741029,5624716475901918963,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5232 /prefetch:1
      4⤵
      PID:4460
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,11368007030431741029,5624716475901918963,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5248 /prefetch:1
      4⤵
      PID:808
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,11368007030431741029,5624716475901918963,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5320 /prefetch:1
      4⤵
      PID:4312
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,11368007030431741029,5624716475901918963,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5116 /prefetch:1
      4⤵
      PID:3500
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2004,11368007030431741029,5624716475901918963,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4588 /prefetch:2
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4360

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:432

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4592

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 183b8e82a0deaa83d04736553671cedb738adc909f483b3c5f822a0e6be7477d
MD5 4dd2754d1bea40445984d65abee82b21
SHA1 4b6a5658bae9a784a370a115fbb4a12e92bd3390
SHA512 92d44ee372ad33f892b921efa6cabc78e91025e89f05a22830763217826fa98d51d55711f85c8970ac58abf9adc6c85cc40878032cd6d2589ab226cd099f99e1
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 882a513b71b26210ff251769b82b2c5d59a932f96d9ce606ca2fab6530a13687
MD5 ecf7ca53c80b5245e35839009d12f866
SHA1 a7af77cf31d410708ebd35a232a80bddfb0615bb
SHA512 706722bd22ce27d854036b1b16e6a3cdb36284b66edc76238a79c2e11cee7d1307b121c898ad832eb1af73e4f08d991d64dc0bff529896ffb4ebe9b3dc381696
MD5 SHA1 SHA512

Submit Download

10fbdf5f-2439-4a11-b283-0db3ef9fc3fd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\10fbdf5f-2439-4a11-b283-0db3ef9fc3fd.tmp
Size 6KB
SHA256 1cbe3ee5d1b7679cc072b04acb152c014a7f30011181c907932e0ec59e326b55
MD5 7252cb3915101495583dfd3202faaf02
SHA1 2e8c8fed40a027f60b43f83f3b823add3d349b98
SHA512 09a630ed60dca5a1c17b59013ad3e420fa496df53e55053d97bc9be6b52d4968cd234712d230f76ed842eeed2e6ab0c3b21528da1b351919558405443c2ac5e6
SSDEEP 96:nPkRUV1lHTNwpvWMoiVmdeH44YAhUWQyV+VDCziEwb:nPkRcT5GWMX4oro
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 3b4d64e03f36bf5e2ab4d4385f10ab823c959157f6fa408bf0f314b52dad63df
MD5 f6b3840cc50fd95398877c2c36838843
SHA1 ca4a75efcc8277e3c9ae372a4529490b567fefb7
SHA512 66607ab356c814b2d010eecf2ac8a9652ef676a30dd402dfe3b9d8df6e01ebfd2c381206ab4b03b9a03823c8ae90e5c837af8de547f40c056af8faccfafdf6c1
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 409B
SHA256 19b94f1cee30d5c9c2c0c15572c39aeace2842405c906faaf5b2c7ba7b34e910
MD5 5fc4e74c4d38bba219819f874c0113be
SHA1 a3fb5b9020c46ed9101423f7dd81d335aec02bb9
SHA512 b5625e4761ee52e339b9638d0d80db992fbce3552dd6574573d9c16e161c124177c8f5b1bdc70a78d82a252630dd73054179f73645a1d6954425daf9f01d6575
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 11cba9149fcb7e050e7787e2f8a0218ad0996115f4501fe18035dda24e19be33
MD5 e793478001759a4f004d16042e8b2783
SHA1 35aeb27e0b9f80d058662aa34d995508bd828e6f
SHA512 ed5b858769df4c8b0f96070b3dfefcc2de5241d9d99b0dc0262eafc60ab41f2bc8cb9f6159411f87b2c7d4b942bbec3fef5c877c3cb7d6f475a9592ff8d6363c
SSDEEP 96:nPkRLV1lfTNwpvWMoiVmdeGuq1j44YxhUWQyV+VD7AiEwb:nPkRRTRGWMWuqh43rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 6dadb17ab2d0fdf09c501abfbc2447fb56747c267bcb0f70b18096fa04138822
MD5 732114c5b092e85b1501bc13ff1d3124
SHA1 061ffadb01416de8dcdb55278edfe52841408aa7
SHA512 ee3b2fc0c4d8fbb24fed81dafd1f021ed5ec65b1c0bd1d2a055f4f9a42567dc36221021efd78fd8b57eeacf976ffc43e950ac8b6d8f1541168baf3f857254510
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupOwe2RUqOkuWs0KVhY321z:A9iIxuERzA83h09RZxYfDukKo321z
MD5 SHA1 SHA512 SSDEEP

Submit Download

Read Me First!.txt

Path C:\Users\Admin\AppData\Roaming\Read Me First!.txt
Size 268B
SHA256 b2b02392520557f11412437591845f013382f25a7df3c5528045ac2ba400d711
MD5 bc7ee9dffb2cf55f5fca0b0602a5f933
SHA1 7d7def061aa3ae9c0467cf5f126fa76b7b167482
SHA512 2d7bb4718a22669cbe96db6ec712c958c2154ef18c3d339262a89ca81868921df14698669f1c8fdbfbeb908b37784887c0383cb7663d3cbd6a6d4594597b3ed5
MD5 SHA1 SHA512

Submit Download

memory/4884-17-0x0000000074D80000-0x0000000075530000-memory.dmp

Download

memory/4884-5-0x0000000005040000-0x000000000504A000-memory.dmp

Download

memory/4884-4-0x0000000074D80000-0x0000000075530000-memory.dmp

Download

memory/4884-0-0x0000000074D8E000-0x0000000074D8F000-memory.dmp

Download

memory/4884-3-0x0000000004EF0000-0x0000000004F82000-memory.dmp

Download

memory/4884-2-0x00000000053A0000-0x0000000005944000-memory.dmp

Download

memory/4884-1-0x00000000004E0000-0x0000000000512000-memory.dmp

Download