cryptolocker | ea8fac7c65fb589b0d53560f5251f74f9e9b243478dcb6b3ea79b5e36449c8d9

Resubmissions

05/08/2024, 10:50

240805-mxgn4axgmc4

05/08/2024, 09:26

240805-lemlysscmk10

Analysis

max time kernel
735s
max time network
742s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
05/08/2024, 09:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
.html
Size 1KB
Sample240805-lemlysscmk
SHA256 ea8fac7c65fb589b0d53560f5251f74f9e9b243478dcb6b3ea79b5e36449c8d9
MD5 84238dfc8092e5d9c0dac8ef93371a07
SHA1 4a3ce8ee11e091dd7923f4d8c6e5b5e41ec7c047
SHA512 d06b93c883f8126a04589937a884032df031b05518eed9d433efb6447834df2596aebd500d69b8283e5702d988ed49655ae654c1683c7a4ae58bfa6b92f2b73a
MD5 SHA1 SHA512

Score

10^/10

cryptolocker gandcrab backdoor credential_access defense_evasion discovery persistence ransomware spyware stealer

Malware Config

Extracted

Path

C:\$Recycle.Bin\S-1-5-21-945322488-2060912225-3527527000-1000\TXAXSPD-MANUAL.txt

gandcrab

Ransom Note

---= GANDCRAB V5.2 =--- ***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED*********************** *****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS***** Attention! All your files, documents, photos, databases and other important files are encrypted and have the extension: .TXAXSPD The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files. The server with your key is in a closed network TOR. You can get there by the following ways: ---------------------------------------------------------------------------------------- | 0. Download Tor browser - https://www.torproject.org/ | 1. Install Tor browser | 2. Open Tor Browser | 3. Open link in TOR browser: http://gandcrabmfe6mnef.onion/ad5fe8b4a418f1f | 4. Follow the instructions on this page ---------------------------------------------------------------------------------------- On our page you will see instructions on payment and get the opportunity to decrypt 1 file for free. ATTENTION! IN ORDER TO PREVENT DATA DAMAGE: * DO NOT MODIFY ENCRYPTED FILES * DO NOT CHANGE DATA BELOW ---BEGIN GANDCRAB KEY--- lAQAAOLRQwKUERylc25TE55zOg/VToIfITMdYI+ZPMsByInrypZOiSKOpfbc7ywHjpLeHPi12l2A7KfDLcz5h5UbYSVivvtZAGAK9A/FCrXcSkr58qRqh62FXlzTghgH/ZerQgpdolYfdieirVpD6JTWcFuzbnci625FK4auTBTeJ/+q32MTjtOxc+YtE9nIoGccqVnvNiPQML9ugp2QsXIUCnEs9xz3RI65Z2xwb7LDCCKibDeK8qMzeVlpv1M+lSegRQZc8HCIX++8NKkCJLnV6aEjXiH+s6KjHForIVFCuKg8A6VniLHouOxij0doiS5sreKb/rRlWqYqaLqsfS5/Pr+1gbY/D48w2MlqFmCJdS+/PItlD0XJKxPWu30o0CG0q/lbwDFZXBZovuEU7xuSVL7CQy/tbPItooFrzunPx/NLZbWwrNkeJbczpmjhByohcvudZwfEJnSpAk81mU66xbcrcniUssUI1LhQS9kiVhT9y5dBoBngH2Zn5HOgPRbXgd0GLtuao4/BfTYj9X3ZaM9q3ikWsvPIq1BbLwkECfQHejcRo125YnC0yVBSiYBoh9z68u3waD+UmpiVfp2BseY5BTbBDKX+PmlVb399mB9SXvF93KHC5FarqceFBBgs5C2SHaiUChyB68EJZJNnIMNSZauEiYkvKP4u1Y1Q21sHVyO/BiM3ldikStJnV+ycwSa3mhiXPUA9uhc8fvDDsWWOjT6qEhj8FTT3BHf7okY4h9uJPudva4fNdyE5wzHtJqUYSsNu7n90m6kg8iOpQdvZezo+7ZziKN+UiAwVKKuLmKQwdFM50UrfHnJIi2fzz2u3Rxr6DXd/h/yMk6Ojci8Wpv0lETZ/plw4yYzg3KCt4UiSk9KdeTzPbgvc1C+yZonbWg1LT0vCFtmVxl/zMUtQaRecGyZ9WNwCQiydkNcgEdz21CshNMG9lSkC1mJEPBJuQqnDcrSYZepr3bmQm9UgcJgw1lAKHagBACGyBuL3cAJy9Pq1DGtbX3jeghs6tbAhRWRVtpKBZs1Vs3AYgNgn2YfZDZjA7Itd5RTo5uIf36I2kQK7y9bWI7q7oKP6M1GZZfVgfMZQ7DiWZhizTQtp1fHwyolbudJmldjt/efV3CTgtMZxxgnVRiteGKRMFiFC4cQs81NwAIqUYdUoxpN64S7Tt/1d+kd/mujb4E3t5wI9JqkBkcaKSL5midWncxkAVg5DAczgSEdMts/uUfkXmshFW38MKJDpHXTzX6Qe3cI0jajOyZsjMXLfyCnlyQDOLXJRiHLyBNcgJn0arI/4sWvaE5Z+WC6sfgdLcKbxNz6a/JxTR+csBoOq8hsc13qbGLQfnuqT5KJQ4ncWtNKk1prcddo9MozwROhudlE5T/FNIA3T9RvPWYFffJM+H9YNCLBUS1exZ2z8W7ThQXL65uN6Y/uwDaFu7S98zJ+KTSz0XiZiyS9DDyRLm+mieALX+plrvnMbf3eQdcRYMyltfRgQ9B3KqgtQZzM5+KAcJ7uQYZcz8E6lB7GEytAuThbaOL34tn/XhtMxYzHpeB+LnzmVGj0f0AOFtCIiIdSuIC0wxW6ioAa0j4Ui0IA7v3yIhfwusWo1BXZJaUGa2xbkMZexWNW9shSw0gHN1JTTHggAKWUtjgfg99s+TZ1Wrww5zStCB59lYrK+Dvldf0oQLHYWNWF9ZADlC5XpgJj23qnf/SwQF4liwv50txRTLAkYLNultPOoGtUyvSn1hE1C2PIwqHO7AEunNzoxTTr4pm1UIgr1BRsPW6RpOE/ZzjIKR4WkN00FurwghPmQs0q4GyC9dU3qOHQ7Rdyfj6eQyOadgsEIa7bikSavunW86xalBC4nHQQq0mlOF4qZuvvwySEdIM/zCq7qK8Dyfc9A490ItoZA/6Pd9i9Rk9e2QfOe/BU5gMCjadnpLncf1XR2Rt47lXYjXlZYPf5hQ8grspsKdwmZDrserYzdbtDBo4Yl2wLrGj7jDBD2CNWf7YQKqQqS+PxV2yQLLFJ+DgJtcKK1G0kn5qMa5UIy5jMLfyD8eHIpuJVFR5AlCOD5eymQYcMfhwkiHnTKY7/N/ejzT6SJ0x93gYyErnu+Stp9z/am1N4CJWvefOhvSvHxXa3ypZYp/Je2sD3N/WupLsBN+iBykeVbLICc8ISdYxhAMAoZWdUtSUCpLlWHwoItwtptaHuKXu94Xq9BDtJNxeRePn5A+8unpeLYv+TkXyz4JQBDzMA= ---END GANDCRAB KEY--- ---BEGIN PC DATA--- 7ftDEgLb/ZS0lcmZbHM61KDJ6AOtD78KkA7absMgUXYxWLsC+5+UYF9xVmDr9MTJMZDIAvSVt+DSRWLIKnQXQzua3LPyzokSUuglaqKXwabsGM4pXku5In6gtMQMqg7sgEh1XW1iPMFgiUj/s1LdWpJHdiPjMpn7rCZNO/A31mak0K8RefoREu3BxtlAsseHWfVIIKN0U4NnA3w0Ga7XDLlF3iOIB6ImYbF6Z/7MBN2mgBr2rZ2gU1R7jNx2WKAyu4W+5zlHFnKwMISBi1CwemOo6FrxnP+Z5F9bSR7OvDBsmLj7oYD6GBgpBqj3RSAVfvfE0yZSXyCRtLeJLNBZBiFq+MZrR+i3Y7HImYWRiEeBP9HyqvNkLOLjT6O6r1xW4eZxTzPJ1fbDL0900Pf6S0az7KAooTbFrZ2EPDix5ShBudHoMloO6iOVzOm2qBpvYLwDrt0yqy8B1filVjmQ7qt4A+w+gSWwQUzSb+QfwNw4LR2j3Li9wF7i8TPbKPugg42XWKf+7AkXvCaiiYFEEv9EtCM4ANvhx9QWIEz1UEGNybGMOp0F1gg/+uQVe3kEm3TdCrDrBNcRPB6VJMopLqYb8gmQcDmVvbCVEY+sVLSKnN6aP0Iub5o0+FHLc3/SgKIMDArFyYH6qAJw1UaCxMHGs3USmw== ---END PC DATA---

URLs

http://gandcrabmfe6mnef.onion/ad5fe8b4a418f1f

Signatures

CryptoLocker
Ransomware family with multiple variants.
ransomware cryptolocker
Gandcrab
Gandcrab is a Trojan horse that encrypts files on a computer.
ransomware backdoor gandcrab
Renames multiple (320) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware
Downloads MZ/PE file

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation	GandCrab.exe

Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
credential_access stealer

Windows Credential Manager
T1555.004

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\TXAXSPD-MANUAL.txt	GandCrab.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\a4188f2a418f116d.lock	GandCrab.exe

Executes dropped EXE 6 IoCs

pid	Process
4032	CryptoLocker.exe
2160	{34184A33-0407-212E-3320-09040709E2C2}.exe
812	{34184A33-0407-212E-3320-09040709E2C2}.exe
1056	{34184A33-0407-212E-3320-09040709E2C2}.exe
5168	{34184A33-0407-212E-3320-09040709E2C2}.exe
4496	GandCrab.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\CryptoLocker = "C:\\Users\\Admin\\AppData\\Roaming\\{34184A33-0407-212E-3320-09040709E2C2}.exe"	{34184A33-0407-212E-3320-09040709E2C2}.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	GandCrab.exe
File opened (read-only)	\??\E:	GandCrab.exe
File opened (read-only)	\??\I:	GandCrab.exe
File opened (read-only)	\??\W:	GandCrab.exe
File opened (read-only)	\??\J:	GandCrab.exe
File opened (read-only)	\??\M:	GandCrab.exe
File opened (read-only)	\??\O:	GandCrab.exe
File opened (read-only)	\??\V:	GandCrab.exe
File opened (read-only)	\??\G:	GandCrab.exe
File opened (read-only)	\??\K:	GandCrab.exe
File opened (read-only)	\??\N:	GandCrab.exe
File opened (read-only)	\??\P:	GandCrab.exe
File opened (read-only)	\??\Q:	GandCrab.exe
File opened (read-only)	\??\S:	GandCrab.exe
File opened (read-only)	\??\T:	GandCrab.exe
File opened (read-only)	\??\U:	GandCrab.exe
File opened (read-only)	\??\X:	GandCrab.exe
File opened (read-only)	\??\Y:	GandCrab.exe
File opened (read-only)	\??\B:	GandCrab.exe
File opened (read-only)	\??\H:	GandCrab.exe
File opened (read-only)	\??\L:	GandCrab.exe
File opened (read-only)	\??\R:	GandCrab.exe
File opened (read-only)	\??\Z:	GandCrab.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 7 IoCs

Web Service

T1102

flow	ioc
391	raw.githubusercontent.com
221	raw.githubusercontent.com
222	raw.githubusercontent.com
287	raw.githubusercontent.com
288	raw.githubusercontent.com
289	raw.githubusercontent.com
390	raw.githubusercontent.com

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\DriverStore\FileRepository\prnms003.inf_amd64_0e2452f597790e95\Amd64\PrintConfig.dll	GandCrab.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\\\bxmeoengtf.bmp"	GandCrab.exe

Drops file in Program Files directory 42 IoCs

description	ioc	Process
File created	C:\Program Files\TXAXSPD-MANUAL.txt	GandCrab.exe
File created	C:\Program Files\a4188f2a418f116d.lock	GandCrab.exe
File opened for modification	C:\Program Files\AssertMove.edrwx	GandCrab.exe
File opened for modification	C:\Program Files\ReceiveLock.mpg	GandCrab.exe
File opened for modification	C:\Program Files\WaitCopy.pptm	GandCrab.exe
File opened for modification	C:\Program Files\FindExit.midi	GandCrab.exe
File opened for modification	C:\Program Files\FormatReceive.mpp	GandCrab.exe
File created	C:\Program Files (x86)\TXAXSPD-MANUAL.txt	GandCrab.exe
File opened for modification	C:\Program Files\AssertFormat.mp2v	GandCrab.exe
File opened for modification	C:\Program Files\DisconnectClose.php	GandCrab.exe
File opened for modification	C:\Program Files\DismountStep.zip	GandCrab.exe
File opened for modification	C:\Program Files\ResetApprove.mpv2	GandCrab.exe
File opened for modification	C:\Program Files\UnprotectWatch.m4a	GandCrab.exe
File opened for modification	C:\Program Files\WaitSubmit.xlsm	GandCrab.exe
File opened for modification	C:\Program Files\PingUnblock.mht	GandCrab.exe
File opened for modification	C:\Program Files\RenameRepair.mpv2	GandCrab.exe
File opened for modification	C:\Program Files\SetInstall.jpg	GandCrab.exe
File opened for modification	C:\Program Files\StepResolve.ex_	GandCrab.exe
File opened for modification	C:\Program Files\UnpublishRead.jpeg	GandCrab.exe
File opened for modification	C:\Program Files\CopyCompress.odt	GandCrab.exe
File opened for modification	C:\Program Files\EnableEnter.mp2v	GandCrab.exe
File opened for modification	C:\Program Files\ProtectNew.html	GandCrab.exe
File opened for modification	C:\Program Files\RequestConvertTo.3gp	GandCrab.exe
File opened for modification	C:\Program Files\RestartMove.mpeg2	GandCrab.exe
File opened for modification	C:\Program Files\DisconnectStop.xlsb	GandCrab.exe
File opened for modification	C:\Program Files\InvokeSync.ppsm	GandCrab.exe
File opened for modification	C:\Program Files\JoinUninstall.wax	GandCrab.exe
File opened for modification	C:\Program Files\ResolveConnect.potm	GandCrab.exe
File opened for modification	C:\Program Files\RestartSuspend.dot	GandCrab.exe
File opened for modification	C:\Program Files\RevokeGroup.vstx	GandCrab.exe
File opened for modification	C:\Program Files\SendWatch.M2V	GandCrab.exe
File opened for modification	C:\Program Files\StartTrace.odt	GandCrab.exe
File opened for modification	C:\Program Files\StopHide.m4a	GandCrab.exe
File opened for modification	C:\Program Files\UnregisterNew.mpeg3	GandCrab.exe
File created	C:\Program Files (x86)\a4188f2a418f116d.lock	GandCrab.exe
File opened for modification	C:\Program Files\DisconnectCheckpoint.iso	GandCrab.exe
File opened for modification	C:\Program Files\InitializeSync.eps	GandCrab.exe
File opened for modification	C:\Program Files\OptimizePush.ppsx	GandCrab.exe
File opened for modification	C:\Program Files\GrantRead.wm	GandCrab.exe
File opened for modification	C:\Program Files\JoinImport.css	GandCrab.exe
File opened for modification	C:\Program Files\SelectRestart.DVR	GandCrab.exe
File opened for modification	C:\Program Files\SkipAdd.css	GandCrab.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 3 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\Downloads\CryptoLocker.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\GandCrab.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\Locky.AZ.exe:Zone.Identifier	firefox.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5144	4496	WerFault.exe	167

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CryptoLocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{34184A33-0407-212E-3320-09040709E2C2}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{34184A33-0407-212E-3320-09040709E2C2}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{34184A33-0407-212E-3320-09040709E2C2}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{34184A33-0407-212E-3320-09040709E2C2}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GandCrab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 11 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	GandCrab.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	GandCrab.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	GandCrab.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-945322488-2060912225-3527527000-1000\{EFE970B5-2054-4ED9-BE42-8C74B5E1A463}	msedge.exe

NTFS ADS 5 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\CryptoLocker.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe\:Zone.Identifier:$DATA	CryptoLocker.exe
File created	C:\Users\Admin\Downloads\GandCrab.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\Locky.AZ.exe:Zone.Identifier	firefox.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 256801.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 25 IoCs

pid	Process
2916	msedge.exe
2916	msedge.exe
5012	msedge.exe
5012	msedge.exe
996	identity_helper.exe
996	identity_helper.exe
4844	msedge.exe
4844	msedge.exe
1488	msedge.exe
1488	msedge.exe
4652	identity_helper.exe
4652	identity_helper.exe
3764	msedge.exe
3764	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
1644	taskmgr.exe
1644	taskmgr.exe
1644	taskmgr.exe
4496	GandCrab.exe
4496	GandCrab.exe
4496	GandCrab.exe
4496	GandCrab.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 29 IoCs

pid	Process
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe

Suspicious use of AdjustPrivilegeToken 13 IoCs

description	pid	Process
Token: 33	4328	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4328	AUDIODG.EXE
Token: SeDebugPrivilege	852	firefox.exe
Token: SeDebugPrivilege	852	firefox.exe
Token: SeDebugPrivilege	1644	taskmgr.exe
Token: SeSystemProfilePrivilege	1644	taskmgr.exe
Token: SeCreateGlobalPrivilege	1644	taskmgr.exe
Token: 33	1644	taskmgr.exe
Token: SeIncBasePriorityPrivilege	1644	taskmgr.exe
Token: SeDebugPrivilege	852	firefox.exe
Token: SeDebugPrivilege	852	firefox.exe
Token: SeDebugPrivilege	852	firefox.exe
Token: SeDebugPrivilege	852	firefox.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
852	firefox.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
852	firefox.exe
852	firefox.exe
852	firefox.exe
852	firefox.exe
852	firefox.exe
852	firefox.exe
852	firefox.exe
852	firefox.exe
852	firefox.exe
852	firefox.exe
852	firefox.exe
852	firefox.exe

Suspicious use of SetWindowsHookEx 21 IoCs

pid	Process
852	firefox.exe
852	firefox.exe
852	firefox.exe
852	firefox.exe
852	firefox.exe
852	firefox.exe
852	firefox.exe
852	firefox.exe
852	firefox.exe
852	firefox.exe
852	firefox.exe
852	firefox.exe
852	firefox.exe
852	firefox.exe
852	firefox.exe
852	firefox.exe
852	firefox.exe
852	firefox.exe
852	firefox.exe
852	firefox.exe
852	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5012 wrote to memory of 1764	5012	msedge.exe	83
PID 5012 wrote to memory of 1764	5012	msedge.exe	83
PID 5012 wrote to memory of 2368	5012	msedge.exe	84
PID 5012 wrote to memory of 2368	5012	msedge.exe	84
PID 5012 wrote to memory of 2368	5012	msedge.exe	84
PID 5012 wrote to memory of 2368	5012	msedge.exe	84
PID 5012 wrote to memory of 2368	5012	msedge.exe	84
PID 5012 wrote to memory of 2368	5012	msedge.exe	84
PID 5012 wrote to memory of 2368	5012	msedge.exe	84
PID 5012 wrote to memory of 2368	5012	msedge.exe	84
PID 5012 wrote to memory of 2368	5012	msedge.exe	84
PID 5012 wrote to memory of 2368	5012	msedge.exe	84
PID 5012 wrote to memory of 2368	5012	msedge.exe	84
PID 5012 wrote to memory of 2368	5012	msedge.exe	84
PID 5012 wrote to memory of 2368	5012	msedge.exe	84
PID 5012 wrote to memory of 2368	5012	msedge.exe	84
PID 5012 wrote to memory of 2368	5012	msedge.exe	84
PID 5012 wrote to memory of 2368	5012	msedge.exe	84
PID 5012 wrote to memory of 2368	5012	msedge.exe	84
PID 5012 wrote to memory of 2368	5012	msedge.exe	84
PID 5012 wrote to memory of 2368	5012	msedge.exe	84
PID 5012 wrote to memory of 2368	5012	msedge.exe	84
PID 5012 wrote to memory of 2368	5012	msedge.exe	84
PID 5012 wrote to memory of 2368	5012	msedge.exe	84
PID 5012 wrote to memory of 2368	5012	msedge.exe	84
PID 5012 wrote to memory of 2368	5012	msedge.exe	84
PID 5012 wrote to memory of 2368	5012	msedge.exe	84
PID 5012 wrote to memory of 2368	5012	msedge.exe	84
PID 5012 wrote to memory of 2368	5012	msedge.exe	84
PID 5012 wrote to memory of 2368	5012	msedge.exe	84
PID 5012 wrote to memory of 2368	5012	msedge.exe	84
PID 5012 wrote to memory of 2368	5012	msedge.exe	84
PID 5012 wrote to memory of 2368	5012	msedge.exe	84
PID 5012 wrote to memory of 2368	5012	msedge.exe	84
PID 5012 wrote to memory of 2368	5012	msedge.exe	84
PID 5012 wrote to memory of 2368	5012	msedge.exe	84
PID 5012 wrote to memory of 2368	5012	msedge.exe	84
PID 5012 wrote to memory of 2368	5012	msedge.exe	84
PID 5012 wrote to memory of 2368	5012	msedge.exe	84
PID 5012 wrote to memory of 2368	5012	msedge.exe	84
PID 5012 wrote to memory of 2368	5012	msedge.exe	84
PID 5012 wrote to memory of 2368	5012	msedge.exe	84
PID 5012 wrote to memory of 2916	5012	msedge.exe	85
PID 5012 wrote to memory of 2916	5012	msedge.exe	85
PID 5012 wrote to memory of 2280	5012	msedge.exe	86
PID 5012 wrote to memory of 2280	5012	msedge.exe	86
PID 5012 wrote to memory of 2280	5012	msedge.exe	86
PID 5012 wrote to memory of 2280	5012	msedge.exe	86
PID 5012 wrote to memory of 2280	5012	msedge.exe	86
PID 5012 wrote to memory of 2280	5012	msedge.exe	86
PID 5012 wrote to memory of 2280	5012	msedge.exe	86
PID 5012 wrote to memory of 2280	5012	msedge.exe	86
PID 5012 wrote to memory of 2280	5012	msedge.exe	86
PID 5012 wrote to memory of 2280	5012	msedge.exe	86
PID 5012 wrote to memory of 2280	5012	msedge.exe	86
PID 5012 wrote to memory of 2280	5012	msedge.exe	86
PID 5012 wrote to memory of 2280	5012	msedge.exe	86
PID 5012 wrote to memory of 2280	5012	msedge.exe	86
PID 5012 wrote to memory of 2280	5012	msedge.exe	86
PID 5012 wrote to memory of 2280	5012	msedge.exe	86
PID 5012 wrote to memory of 2280	5012	msedge.exe	86
PID 5012 wrote to memory of 2280	5012	msedge.exe	86
PID 5012 wrote to memory of 2280	5012	msedge.exe	86
PID 5012 wrote to memory of 2280	5012	msedge.exe	86

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe9f0846f8,0x7ffe9f084708,0x7ffe9f084718
  2⤵
  PID:1764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,8254870651974491625,9008674306790782778,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2068 /prefetch:2
  2⤵
  PID:2368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,8254870651974491625,9008674306790782778,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,8254870651974491625,9008674306790782778,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2812 /prefetch:8
  2⤵
  PID:2280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,8254870651974491625,9008674306790782778,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:4216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,8254870651974491625,9008674306790782778,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:4068
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,8254870651974491625,9008674306790782778,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5084 /prefetch:8
  2⤵
  PID:1848
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,8254870651974491625,9008674306790782778,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5084 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,8254870651974491625,9008674306790782778,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5300 /prefetch:1
  2⤵
  PID:3232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,8254870651974491625,9008674306790782778,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5368 /prefetch:1
  2⤵
  PID:2072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,8254870651974491625,9008674306790782778,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:1
  2⤵
  PID:4796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,8254870651974491625,9008674306790782778,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4672 /prefetch:1
  2⤵
  PID:4200

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4740

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2844

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffe9f0846f8,0x7ffe9f084708,0x7ffe9f084718
  2⤵
  PID:180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,18189975967730472649,8992983106568259972,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2
  2⤵
  PID:3148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,18189975967730472649,8992983106568259972,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2296 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,18189975967730472649,8992983106568259972,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2712 /prefetch:8
  2⤵
  PID:1784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,18189975967730472649,8992983106568259972,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3592 /prefetch:1
  2⤵
  PID:2204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,18189975967730472649,8992983106568259972,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3596 /prefetch:1
  2⤵
  PID:4556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,18189975967730472649,8992983106568259972,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2120 /prefetch:1
  2⤵
  PID:1884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,18189975967730472649,8992983106568259972,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4420 /prefetch:1
  2⤵
  PID:3540
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,18189975967730472649,8992983106568259972,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3692 /prefetch:8
  2⤵
  PID:4636
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,18189975967730472649,8992983106568259972,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3692 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,18189975967730472649,8992983106568259972,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3740 /prefetch:1
  2⤵
  PID:708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,18189975967730472649,8992983106568259972,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5196 /prefetch:1
  2⤵
  PID:3728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,18189975967730472649,8992983106568259972,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5568 /prefetch:1
  2⤵
  PID:5048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,18189975967730472649,8992983106568259972,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5776 /prefetch:1
  2⤵
  PID:4356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,18189975967730472649,8992983106568259972,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1828 /prefetch:1
  2⤵
  PID:1924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2116,18189975967730472649,8992983106568259972,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=1936 /prefetch:8
  2⤵
  PID:2516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2116,18189975967730472649,8992983106568259972,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=1320 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:3764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,18189975967730472649,8992983106568259972,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5760 /prefetch:1
  2⤵
  PID:4920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,18189975967730472649,8992983106568259972,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6096 /prefetch:1
  2⤵
  PID:3204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,18189975967730472649,8992983106568259972,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1168 /prefetch:1
  2⤵
  PID:976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,18189975967730472649,8992983106568259972,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5704 /prefetch:1
  2⤵
  PID:620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,18189975967730472649,8992983106568259972,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5724 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2116,18189975967730472649,8992983106568259972,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6084 /prefetch:8
  2⤵
  PID:1760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,18189975967730472649,8992983106568259972,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3788 /prefetch:1
  2⤵
  PID:4152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,18189975967730472649,8992983106568259972,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4392 /prefetch:1
  2⤵
  PID:4564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,18189975967730472649,8992983106568259972,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6176 /prefetch:1
  2⤵
  PID:2612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,18189975967730472649,8992983106568259972,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2936 /prefetch:1
  2⤵
  PID:3692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,18189975967730472649,8992983106568259972,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5216 /prefetch:1
  2⤵
  PID:4396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,18189975967730472649,8992983106568259972,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6440 /prefetch:1
  2⤵
  PID:4372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,18189975967730472649,8992983106568259972,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6388 /prefetch:1
  2⤵
  PID:1464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,18189975967730472649,8992983106568259972,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6592 /prefetch:1
  2⤵
  PID:3452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,18189975967730472649,8992983106568259972,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6684 /prefetch:1
  2⤵
  PID:4964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2116,18189975967730472649,8992983106568259972,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6500 /prefetch:8
  2⤵
  PID:3496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,18189975967730472649,8992983106568259972,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5188 /prefetch:1
  2⤵
  PID:2640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2116,18189975967730472649,8992983106568259972,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7448 /prefetch:8
  2⤵
  PID:4528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2116,18189975967730472649,8992983106568259972,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6252 /prefetch:8
  2⤵
  PID:1712

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2028

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2192

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x500 0x360
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4328

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1800

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:496
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:852
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2016 -parentBuildID 20240401114208 -prefsHandle 1932 -prefMapHandle 1924 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {459c1a3b-6684-418c-a7a9-4540dd177757} 852 "\\.\pipe\gecko-crash-server-pipe.852" gpu
    3⤵
    PID:4988
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2428 -parentBuildID 20240401114208 -prefsHandle 2420 -prefMapHandle 2416 -prefsLen 23716 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f9c5ca08-535f-4287-a34c-dca2d4980542} 852 "\\.\pipe\gecko-crash-server-pipe.852" socket
    3⤵
    PID:1956
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1316 -childID 1 -isForBrowser -prefsHandle 1412 -prefMapHandle 3080 -prefsLen 23857 -prefMapSize 244658 -jsInitHandle 1160 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {163b6575-584f-4c50-a085-600371bf9f05} 852 "\\.\pipe\gecko-crash-server-pipe.852" tab
    3⤵
    PID:3908
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3808 -childID 2 -isForBrowser -prefsHandle 3796 -prefMapHandle 1408 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1160 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {45378a8b-5a68-4b73-97b1-e12d60900d02} 852 "\\.\pipe\gecko-crash-server-pipe.852" tab
    3⤵
    PID:1280
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4892 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4876 -prefMapHandle 4940 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f4a42cb3-5d04-4283-9b6e-76e9add2ec26} 852 "\\.\pipe\gecko-crash-server-pipe.852" utility
    3⤵
    - Checks processor information in registry
    PID:5368
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5408 -childID 3 -isForBrowser -prefsHandle 5400 -prefMapHandle 5396 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1160 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3b08dea9-b755-4824-a9bc-649940a616a3} 852 "\\.\pipe\gecko-crash-server-pipe.852" tab
    3⤵
    PID:5816
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5528 -childID 4 -isForBrowser -prefsHandle 5604 -prefMapHandle 5600 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1160 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2813f5ec-ae46-4e91-a1e1-6c625a22148f} 852 "\\.\pipe\gecko-crash-server-pipe.852" tab
    3⤵
    PID:5828
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5504 -childID 5 -isForBrowser -prefsHandle 5748 -prefMapHandle 5756 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1160 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {65835a14-4d77-4002-9bb8-d96d7c7b96f7} 852 "\\.\pipe\gecko-crash-server-pipe.852" tab
    3⤵
    PID:5840
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6268 -childID 6 -isForBrowser -prefsHandle 6260 -prefMapHandle 6256 -prefsLen 27211 -prefMapSize 244658 -jsInitHandle 1160 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0ece5d03-c6b1-4faa-922c-f3c11de150b7} 852 "\\.\pipe\gecko-crash-server-pipe.852" tab
    3⤵
    PID:5264
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5700 -childID 7 -isForBrowser -prefsHandle 5212 -prefMapHandle 5208 -prefsLen 27251 -prefMapSize 244658 -jsInitHandle 1160 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b7b70c25-4f57-4b15-bf38-8123d9aaae7e} 852 "\\.\pipe\gecko-crash-server-pipe.852" tab
    3⤵
    PID:5804
- - C:\Users\Admin\Downloads\CryptoLocker.exe
    "C:\Users\Admin\Downloads\CryptoLocker.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - NTFS ADS
    PID:4032
  - - C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe
      "C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe" "/rC:\Users\Admin\Downloads\CryptoLocker.exe"
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      PID:2160
    - - C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe
        
        "C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe" /w0000021C
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:812
      - C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe
        
        "C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe" /w0000021C
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1056
        
        C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe
        
        "C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe" /w0000021C
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5168
- - C:\Users\Admin\Downloads\GandCrab.exe
    "C:\Users\Admin\Downloads\GandCrab.exe"
    3⤵
    - Checks computer location settings
    - Drops startup file
    - Executes dropped EXE
    - Enumerates connected drives
    - Drops file in System32 directory
    - Sets desktop wallpaper using registry
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    PID:4496
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c vssadmin delete shadows /all /quiet
      4⤵
      System Location Discovery: System Language Discovery
      PID:3760
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4496 -s 1704
      4⤵
      Program crash
      PID:5144

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /0
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1644

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4496 -ip 4496
1⤵
PID:5568

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {24AC8F2B-4D4A-4C17-9607-6A4B14068F97} -Embedding
1⤵
PID:352

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Credentials from Password Stores

T1555

Windows Credential Manager

T1555.004

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

TXAXSPD-MANUAL.txt

Path C:\$Recycle.Bin\S-1-5-21-945322488-2060912225-3527527000-1000\TXAXSPD-MANUAL.txt
Size 8KB
SHA256 a7848a944a7985190296c7c68f858e5ebb1aff87d79eb43497b46f96a50eb706
MD5 33e892f9acbe1bf1ebe05d14730740f4
SHA1 5c2f59e9ed84834a24780e0f45a864295054e62d
SHA512 6ba18dc89d926cfab6b971e2c8bee83768363965c130eb2b0a99fea7b6cb554fc4191c05df208e85ec7eebd88804d701c80b047eca82d505edf6a4e0c251b9c6
SSDEEP 192:SbChfQIkmDxbSGGPOk2tou0Jz2tdh2oUyyaJTrNiK:+ChoIvDxbSyS9sB7y6nEK
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 8cce4ca60b3eedf83df670550f90d7249e2eab38ca24a4f7813aba0c3189c64a
MD5 c24571af4b33308aa26898e227f0ecfc
SHA1 1bf2d149f4a9b53a68826df2ff52a5ddb7d664b9
SHA512 15d321c6b736005d9e1c90b461fab45693decd5c94224f466b2e78855d69a264093d8aec616488dac0379b5f4e3fbbece44163a88cf2bec76d10323180f21a22
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 9ac598d4f8170f7e475d84103aead9e3c23d5f2d292741a7f56a17bde8b6f7da
MD5 9b008261dda31857d68792b46af6dd6d
SHA1 e82dc88e2d1da2df7cb19d79a0346b9bb90d52b3
SHA512 78853091403a06beeec4998e2e3a4342111895ffd485f7f7cd367741a4883f7a25864cba00a6c86f27dc0c9ce9d04f08011ecc40c8ae9383d33274739ac39f10
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 242f7ff49fadc6c1b85fdf9aef9377e4d9a47c7f75efccf4d4cc80a197a2a1c6
MD5 bb17cb3118a9ca382a817773855098c6
SHA1 35890bc2e939d86b9740fd724a7eaa75814b3d82
SHA512 90270cc0472652289bb8e51d1a71b18eaba63400a4d10b14ea61b8b4c66298119d8d9966bad85db6bb1bf669f6b1e3c08827f8ea43f14990b8c54a07871be6df
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 62c5dc18b25e758f3508582a7c58bb46b734a774d97fc0e8a20614235caa8222
MD5 0446fcdd21b016db1f468971fb82a488
SHA1 726b91562bb75f80981f381e3c69d7d832c87c9d
SHA512 1df7c085042266959f1fe0aedc5f6d40ceba485b54159f51f0c38f17bb250b79ea941b735e1b6faf219f23fe8ab65ac4557f545519d52d5416b89ad0f9047a31
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_0
Size 44KB
SHA256 17862ba5ed9bbb3865972595c244eeca4a1571b008cde31db70c62eb11764150
MD5 139176b6c0765ad73524fbaa373bbb36
SHA1 f32ff12cf6cc879092ea1ccc32148b8bdf89ad3e
SHA512 0d71f42d289d1ee06e3f1701e45ae4781c5ca4fb4b71b45bd389ecf3ce9f47dba89abbc74ed1bcaaf7c8562003fdd465eeed072b06fe8379993ebb48c6b3a968
SSDEEP 3:MsFlYhXllLlX8l06nln+clOBL/ll/:/Fiz10xEc0htl
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_1
Size 264KB
SHA256 7e366b0495d8cf02c15224b1997ce7a5b0e3ada14af63a0f106aa4a75aaff398
MD5 953418ed1f20ec51f38b03aec8fca886
SHA1 cfc8f2b334457f5e6ac1601daf32deb6642ca0fd
SHA512 e1793f1971e94515d2db714841893badbebc672c72ea16253be2bbddd4b2d1b578cada1be36928113eef96b14da442406187e36fe7f23ee287e7de5e484aac45
SSDEEP 6:/M/PXGuEX5rlYlZ+ViT9xiT9xWMEbGjgDeAPDgLAWiXwMhc:U/PX+heNx2xWMEiUDekOA/c
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000002

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002
Size 38KB
SHA256 bf2628805c1ab19bb57f28bab852a104fa2f5075219999115f36adcf1fd732ce
MD5 5dd5786ad383a1cd69ac190000ab5b7e
SHA1 81c977fc02dcc748591a65c107360742667a03f9
SHA512 2e7508fc60607970a2dd061ee6abf338893151e69299ca0489372b658502c453753195069bb28f5331069329a8a0cf59ba0c86b236239c45ce72d8ee57ae8eb8
SSDEEP 768:IJQ+FHLiL/tZUQtI5Q91DITZYmNO1Rezub24IZvSBER:IFFsLUQtv9xIKmNOrezG2ZVSM
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000003

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003
Size 64KB
SHA256 34013d7f3f0186a612bef84f2984e2767b32c9e1940df54b01d5bd6789f59e92
MD5 d6b36c7d4b06f140f860ddc91a4c659c
SHA1 ccf16571637b8d3e4c9423688c5bd06167bfb9e9
SHA512 2a9dd9352298ec7d1b439033b57ee9a390c373eeb8502f7f36d6826e6dd3e447b8ffd4be4f275d51481ef9a6ac2c2d97ef98f3f9d36a5a971275bf6cee48e487
SSDEEP 1536:Lm4AGqOak9IP5qOYV7SofryJiRB3xVcVXsIBGCrmQR:LITk4qOq2oDwuhpDCaQR
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000004

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004
Size 67KB
SHA256 a9dc0d556e1592de2aeef8eed47d099481cfb7f37ea3bf1736df764704f39ddf
MD5 1d9097f6fd8365c7ed19f621246587eb
SHA1 937676f80fd908adc63adb3deb7d0bf4b64ad30e
SHA512 251bf8a2baf71cde89873b26ee77fe89586daf2a2a913bd8383b1b4eca391fdd28aea6396de3fdff029c6d188bf9bb5f169954e5445da2933664e70acd79f4e3
SSDEEP 1536:gp8/vaVthovsrdXqTWdUxwhneM5SgsgVoonBENmlfCxe:gp8/vafphXUxwhneMVsgWABEN+fCxe
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000005

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005
Size 41KB
SHA256 55cbb893756192704a23a400bf8f874e29c0feee435f8831af9cbe975d0ef85d
MD5 ed3c7f5755bf251bd20441f4dc65f5bf
SHA1 3919a57831d103837e0cc158182ac10b903942c5
SHA512 c79460ded439678b6ebf2def675cbc5f15068b9ea4b19263439c3cca4fa1083dc278149cde85f551cd2ffc2c77fd1dc193200c683fc1c3cdac254e533df84f06
SSDEEP 768:bPwsQ2pr2cmflvHgxdLuBODUHaUMbO83Of2Yq7csRiLgo:7fpr2THODOaUH8T7s3
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000007

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007
Size 65KB
SHA256 f12de7e272171cda36389813df4ba68eb2b8b23c58e515391614284e7b03c4d4
MD5 56d57bc655526551f217536f19195495
SHA1 28b430886d1220855a805d78dc5d6414aeee6995
SHA512 7814c60dc377e400bbbcc2000e48b617e577a21045a0f5c79af163faa0087c6203d9f667e531bbb049c9bd8fb296678e6a5cdcad149498d7f22ffa11236b51cb
SSDEEP 1536:654NcGosP0w+UcGoanS2RR/QwNdIvEsgXn:6iRsw+UkC5QdEfXn
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000008

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008
Size 19KB
SHA256 c1334e604dbbffdf38e9e2f359938569afe25f7150d1c39c293469c1ee4f7b6f
MD5 2e86a72f4e82614cd4842950d2e0a716
SHA1 d7b4ee0c9af735d098bff474632fc2c0113e0b9c
SHA512 7a5fd3e3e89c5f8afca33b2d02e5440934e5186b9fa6367436e8d20ad42b211579225e73e3a685e5e763fa3f907fc4632b9425e8bd6d6f07c5c986b6556d47b1
SSDEEP 384:eV4Eqc1qgk/XDVGi8m7JEM9TUKPqivdjfommfP974oNF38:eV9qlxhVEM9UKPpMV74kFM
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000009

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009
Size 1.2MB
SHA256 6f0e8c5ae26abbae3efc6ca213cacaaebd19bf2c7ed88495289a8f40428803dd
MD5 027a77a637cb439865b2008d68867e99
SHA1 ba448ff5be0d69dbe0889237693371f4f0a2425e
SHA512 66f8fbdd68de925148228fe1368d78aa8efa5695a2b4f70ab21a0a4eb2e6e9f0f54ed57708bd9200c2bbe431b9d09e5ca08c3f29a4347aeb65b090790652b5c4
SSDEEP 24576:GibTkuS3JrJOHHi9mld2rJAOoQh2vzjfwO7j/GL49OLYS9aiD+JCN:GibTjHi9i8JAK2ft/GL1LYS9aiSJQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00000a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000a
Size 88KB
SHA256 b18b9eb934a5b3b81b16c66ec3ec8e8fecdb3d43550ce050eb2523aabc08b9cd
MD5 b38fbbd0b5c8e8b4452b33d6f85df7dc
SHA1 386ba241790252df01a6a028b3238de2f995a559
SHA512 546ca9fb302bf28e3a178e798dd6b80c91cba71d0467257b8ed42e4f845aa6ecb858f718aac1e0865b791d4ecf41f1239081847c75c6fb3e9afd242d3704ad16
SSDEEP 1536:WwVbiMNFmJrBrbhiWu0FKK9fLRXT+FjhwTn1sH5J3iotwUB4xzjIRB9h:zVOiFWwg3Rjm1wRW5JSywbo9h
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00000b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b
Size 43KB
SHA256 9b02f8fe6810cacb76fbbcefdb708f590e22b1014dcae2732b43896a7ac060f3
MD5 d9b427d32109a7367b92e57dae471874
SHA1 ce04c8aeb6d89d0961f65b28a6f4a03381fc9c39
SHA512 dcabc4223745b69039ea6a634b2c5922f0a603e5eeb339f42160adc41c33b74911bb5a3daa169cd01c197aeaca09c5e4a34e759b64f552d15f7a45816105fb07
SSDEEP 768:e4dSnD8Fcsd+iHRDmg8erBkLqh2LCBsMZAhwSrfv9lQnW1VgskG9SVsMy7MnFmYP:nE8hVxDmCOqh2CshwS2W/9SE4nFm8
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00000c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000c
Size 74KB
SHA256 d261915939a3b9c6e9b877d3a71a3783ed5504d3492ef3f64e0cb508fee59496
MD5 b07f576446fc2d6b9923828d656cadff
SHA1 35b2a39b66c3de60e7ec273bdf5e71a7c1f4b103
SHA512 7358cbb9ddd472a97240bd43e9cc4f659ff0f24bf7c2b39c608f8d4832da001a95e21764160c8c66efd107c55ff1666a48ecc1ad4a0d72f995c0301325e1b1df
SSDEEP 1536:m7QOAA9lzzC1CUzr0CvwpW9njABbuJueqby24:XAvfC1Nr70W92uJueP
MD5 SHA1 SHA512 SSDEEP

Submit Download

a51ef587dc6dd4bd_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\a51ef587dc6dd4bd_0
Size 6KB
SHA256 f08ca1f7349639672e568cbd6f2386def6bbbc09dbbf85ccf878921faceabc5a
MD5 67ac2fc36727a29f7704a35133a19d1e
SHA1 d95c90a255030e2730c6e41f2fd23c9defe53780
SHA512 aeae754d6f9e470301e098993e69a91664cbd6979a78a5af467d13405b6d8252598cb17b2a4b35cc2034d26cf6bc538ab4438dad7988a5579f66d20d35d9bb44
SSDEEP 96:vMR1xvprt6xSS6+grJ1d6lEpv5R2s6Tl0DaP695Q4TJe6I0i/CVA+LH09e7OjwcC:vSZ48rvpvi7l0C6T0/0i/CS+pvcD
MD5 SHA1 SHA512 SSDEEP

Submit Download

bfd9b5c29c5c8524_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\bfd9b5c29c5c8524_0
Size 1KB
SHA256 30430ae8bd404bc8c25bf43f1dda4f79307f0da653778e52c71b88d2d01113ce
MD5 cbade15c46f76e5a43ca5f43d20e03a6
SHA1 7d2d77a0359d400871400a82908929ea00086c0b
SHA512 76c202c67f0363d13de23e050764d68c9f065883cb43af9aef3b0c618ee94f8a7c4a30e050077e88129a0c1cbe1d51ab29dec23fd9bed4ea96bd8010ffa8c288
MD5 SHA1 SHA512

Submit Download

e55f0a6d1b533c66_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\e55f0a6d1b533c66_0
Size 2KB
SHA256 e74f21f0921a071cf5d1e9c914c1f0060dd2521521b85e7ec3046fe14effaddf
MD5 64f20591eadb93c328a93da315cf6c6b
SHA1 23c9eba7e2d24f60b61476d27c3f035f08332677
SHA512 4a53cee598917ae04426618abcecc4ab8b6d9e5491f5b5fd081f9b068c89ebcd1f29ebf8d11ee5a2dfd6f20c5fa7e0d4a4dea89cecbf129ba1b80b053f670546
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 2ba65bb352291e0e3d1cc57c08541fc6014b293381cd2beb0d203c900aeb311f
MD5 6c3fe82d320a72c7a381b56ed1e92eba
SHA1 1b8222223e87cb9dc6110f3cf15c0cea91997f9e
SHA512 70f883020a707775f37ed1ce0ccd709a1de0eb605aa9c1493eacf9c82a0d054216eb0e19fca19f1086f228d21a816c0152d6638bf56b6facfe988c67824c2a05
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 b7eb78ab1480772fd4e358b68f5b24ee248aa6cd2e18b5572f848a0402690b43
MD5 430670d1fbec185128eb24aad3c10971
SHA1 8d7fb2583d6583ae8971a97642323138168aa28b
SHA512 675b867701a8ae023e90d0d40f70d0a725c63ca0c2906b0f902178bf83d1eb2f3c3cdacfa20149cc3a9ef55505341c9e01e926006a190c27b884dc6fbc4cea8f
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 d64d091e74974c2181277565943384581ddc19c68f5cd9465a88ff2715b3a851
MD5 24770e4e769545d310afbe372960923f
SHA1 e92c6f221e8636ab0c5c866c7fe7c26e1b2cd0bd
SHA512 f17d530a10c2835ab3a30ef0dad2c2b83e54fd641f26303c0c0d547e6efddd13bbb5bfff28ca0105334f438ad598495ceae240af32bde0431a77e3960d5677b4
SSDEEP 96:JIfedILubyl3xCwUo3v31oWygbv1I9mulmxYeDyVoMNd7zmGIDm/9m9S9Zy0y/k9:2Wi6bcwsDCL/CTy/
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 4325585cb6aec8c8f65bb7140f8680344af08ce483598cae62ee38cd1b0c3fb0
MD5 49a69c8af6a4d047248f10b41d60efd9
SHA1 8fa7a84abd56efa18b890a23dee6b622c2fac26b
SHA512 6b1cdcf0201e9b63ebc826a10afe8fe3049a6f441a504ed5c03eb187bd165ae5f01f1e6ed5348deed10b50145ca8279ca36a10d77003408218e8e8124535b942
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 319B
SHA256 5427349ba846785434655570ff6354819386ea31949f5e031a3d4906f1be0dd9
MD5 6782f5fd6b2c00692cf4c378ee3e97bf
SHA1 2b96579759a791c943932ce865a615b09e2913ac
SHA512 b94881600a07b4c557169e716d50edc3d0ceb18594ca018b93172c573d37c0874dc7d3463d4a316b30e04a66ef2942ea7991e5665bae6de72b946fa6e1393228
MD5 SHA1 SHA512

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 124KB
SHA256 e245f3a5867b995743651b3a3db9e3b65f88d2314434976dc01308a808b07d61
MD5 8680f8c49b594064e6382d370a27392a
SHA1 f6c71ac0d3228c319a4e829a0383ffd5b1e76229
SHA512 9383f667648cd65d4d5f96b75f8ee09d7d585139f061fa291dc4b229f05cae68ec16828a990d5ba3610f382ba2757239a07f87cffe278c430e889d2caf3dfefc
SSDEEP 96:xBIXU+bDoYysX0uhnyTpvVjN9DLjGQLBE3uUG:xBIE+bDo3irhnyTpvVj3XBBE3uUG
MD5 SHA1 SHA512 SSDEEP

Submit Download

History Provider Cache

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History Provider Cache
Size 592B
SHA256 65e84475120066737720c088f3fe2da84364730ded290584532bf4ac3492c4e9
MD5 ef2ded653b23b4cbdfc65f1121e21ed1
SHA1 78ad436105f4a95685dbbc4897c0ab44882579a3
SHA512 9ef39ddfde53e2d179708429b616fc437aa1cb8fd60b10a81b663388e83b9061236da2d3bd04e8f80cd2c505ebe5f0f7f72ff48e471567872b62761249d96218
MD5 SHA1 SHA512

Submit Download

History-journal

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History-journal
Size 44KB
SHA256 45ffac571cd6bb8515be320de5b5249c4d8ed39b3efc98943473bcc5c96c8d82
MD5 36d8cdf9f3ec9483c8dd886beb70d277
SHA1 cc6f97f30b5bbd1bbb592242bd72d2e612d4a991
SHA512 6a6f11a5e173cc1b79e07c13b5569586876de62340a0b5df1c4f4ffbce126a8399832a8eada2f2efd8db24b6d70969ccc12aa436b0f4191abe735276f454b9cd
SSDEEP 12:iJUB625P7A34B625muvcHOmkpnOsMuhz0DK:iJUksPE34ksb5NMuhgDK
MD5 SHA1 SHA512 SSDEEP

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 334B
SHA256 fcc46e408c7317ad9ccdc8d589a176b6b9dbaa30148cde75dfc11f0bc82081cf
MD5 06209f40bd39ff6fc49a303a62d947f9
SHA1 846232bdee0effb0fe4d9234d71cfe2cf0eb3548
SHA512 6f8fffc5617f92b64e897d5becaf8dc3f469f822d69640e9728069a60dfdf89488250d962939489115646138e264f141b2bf332c06411d15ead70a2f3432831c
MD5 SHA1 SHA512

Submit Download

Network Action Predictor

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Action Predictor
Size 36KB
SHA256 f79fc9fca22eace1d33311f380f135b75b30baa639f2d819fa437580ef268b6d
MD5 cf4b0a74bdc68a111bd7ccbd8569daa5
SHA1 e567e83b8db5476018dfed63802d0f60690c8139
SHA512 4ffda967282821d319e22334cc4410eb8883b436654c2ffa65a7a75fdac296a349a672c734e8fed023b9b34d5f17d1af611f81d433108f898459b5ae412dac9f
SSDEEP 24:TLUPD3zzbLGfIzLihje90xq/WMFFfeFzfXVVlYWOT/CUFS:TM/qALihje9kqL42WOT/9F
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 3KB
SHA256 14df1f4721661465511e73757d0a8a4e34d1a489562513ace9181fdcb2b6509c
MD5 db8c6b60635e71190871d80577872990
SHA1 d7d60a245d1169c9d20a8fd985344dbba2572470
SHA512 f55f0872dc7e26c4264f9d488660019591082407fd7f58b01394f07b144fa83c2ff8982ebccc38d3d257281912b37270b09ead7f3537de21f70f25d53c3f160d
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 5KB
SHA256 785e7b31f4bea3960ad489fae020a2da734c113089eaff10d22eb3f5447c7a3d
MD5 aebb6d574d25483b11d77f51d6be4e69
SHA1 4a811fd8eac2281df365420603ad6177a608e0cd
SHA512 76625d93d9e5b8a74c1e08e2f794b7b0ce38b2fcbc88817fca780a2587aea32ff10b7dc2a8dc14aadc0f58a890a027f3911d64de0bd3634a1bee4e9871b1e83c
SSDEEP 96:JcjG6GirgGTMGfGC6GjG8fqpWRGwlGNvVHGs8G02VhtAeXGXvU:JcjVLkHuY81qpWRDyvVHOuBXj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 863B
SHA256 9ac54f18e4a972726ab175d038ca2993a83982c44e1caf033fc697b1789b82ea
MD5 c991415bc7569976ef05136400ae8816
SHA1 62654828b6fdc8572869b7ed75cc910e47d56594
SHA512 ba5d087ecb5e9f7b58131c2360bd793a7ffecff28be0eef75a29c44e63866907a21e8ef928840a90d6e5b79f703631eef1668b3ccc7dc7ae4bb4f96683bfdfa0
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 6KB
SHA256 2001c06ddb49d9f718d49c3333f3833a1eeff47dca1fbff18517cf7f3530d499
MD5 f5a70a96b589bd087790d36e388c5aac
SHA1 c71bb033a06c7a658b2afbe1d0a7946355ed9662
SHA512 84ecac9d72ba2bb99cef8a62f28d2888dc4c16023f3e0e022ed7a1831831803b50567fe67fc0a95908f2ab29ef09c88ea389052ed280e228effcec8cf9f2aef6
SSDEEP 96:Jczr8GfGC6GjG8FGwlGLGs8G02rG+GaG7G2GthtGyoGTG5GwGxGT2U:JczwuY8jDwOw7Xy5C8IwjKI
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 56ac410e0a5183de934e3f224168be010bec7be1c26177012dc4c98910cc560b
MD5 1e3b15b4e9dcd0b49ea7391714ad50f2
SHA1 24c20f50f9079af9ec3d0360d8bde98e6f252f09
SHA512 c6c61eed4ddae89d1a8480b5c8c10949375faf31ad35c6f14d033dfafaed2234265a8616eed2bd7f73ea48c3d3ca67579b4cccb37f15a62c23dd3a7a0c8729ec
SSDEEP 96:ndkNbU1NQdwpvWMoiVmdeH/d+KeyWQyV+VD7AiEwb:ndkeDmGWMX1velg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 442ed5a619b72e62752d2c280e5a8d4a1ae4b614864118b8bfd48f295bb6d871
MD5 2e7ae7cd20b574ed8859bcf0987ab456
SHA1 84920d4ab8703ebcd915cbc7bd5af639ba133a34
SHA512 dce058e8a47173e44fe0087030971bc0ef97f1f006042c8259a32fe71df63e2e57454b1ea87a59eef56259d6904c3fce49d44474ac3ad83dd2416c4460537fe7
SSDEEP 96:ndk/UU1N4dwpvWMoiVmdeH/dd6UWQyV+VDCziEwb:ndk/BDeGWMX10ro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 8KB
SHA256 37fba8b3e74a3e9714bbd155c79522627b18e9072038c25c645dbfae13537044
MD5 8450bfe23a49165261132f9f0effeb7d
SHA1 971260b96bcdd8713a1429eacb9d4aeea0258e24
SHA512 1347d1a2e260171cf5c3eb1c63aa2ad65d160a4f13df49aec1f5d012696f3c9a87162b5004e03bc0490d73cf77aa0a598fa5350ca0a2fa03202de55b4686864a
SSDEEP 96:ndk3sQrDfU1WZb8wpQ8WMoivKROmdecsUdNgpHQ7XGORqQeeFdmTDUWQyV+VD7AE:ndk9c0ZoX8WMSFsUTgpSXG8qQVT8Drg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 6d4f76077076dd9cb874466065d9ea943b2b49ee6ce3a8eed17babe1a495a2f8
MD5 394d67efd377f0a8a2afdc168730471d
SHA1 76fc3da8ef2f8603a73b6ee070af9fac06ba4182
SHA512 b4ac4a1c71302fa60adffd91be4771408e21e237d4baec311b88bedc608072b366483b065051ad7bcde739977ae51b33638a085260a432a2c2cbd93fae9a16ee
SSDEEP 96:ndkfMfU1WJQdwpvWMoiVmdeH/ddKDUWQyV+VD7AiEwb:ndk0c0JmGWMX1gDrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 d4eca9bade88fb1c774a5d0fabf5469642e82c7ed270af0e1b27f78bb5fdf2f8
MD5 7d2c5610144cbc243525580f9244699f
SHA1 26b62b36d3ab67c0884b0ba2613153f7c7ac219c
SHA512 5f8bbc7a09e946a19f828321e7f9a2d603f90c6da1d5bae48916c159d28039824c5a57f936686da038f674edbb197b25584752d71f3d88bcd9d6a3d44dc952fd
SSDEEP 96:ndkfJfU1WZR8wpwfWMoikR5mdeOw5jc7XGORqQ2dfKDUWQyV+VD7AiEwb:ndkRc0ZmLfWMkQw56XG8qQkCDrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 8KB
SHA256 9190278f32ebaa5c2bb22326b2f751c52bc9e9de2d9f5e491c2be6a0bf618842
MD5 d3438045a442672802db0768a258cd40
SHA1 06f975491690caf50da286366ac8dbd444857eaf
SHA512 1bb39d12ec6616f70e153bab2c68eb7205d5aade289171a83bee328be5c094238a64fecb6d9e7ae0e0f58279c338d58575d5641b5aade0b4595303551e3a588c
SSDEEP 96:ndk8sQrDfU1WZb8wpQ8WMoivKROmdeAyIhngpHQ7XGORqQeeFdWKDUWQyV+VD7AE:ndkAc0ZoX8WMSdyIVgpSXG8qQVTnDrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 8KB
SHA256 d9a10c6c605f0b26874bf1c73a9f1b81637c1b2355479964185236a56149bec2
MD5 fa27074edf1974dbe036cf5010a46016
SHA1 abccd81341f5d4a20f657e88f9902f95c08e16a2
SHA512 2c5db1855aa2c9081005bc1fac1965e71d79338ff2cce000621cc54b2fdf7dfd18167f236895a23657523a45b019491b77d3f7f17f9f3707c19c063b1103adbd
SSDEEP 96:ndkrsQrDfU1WZb8wpQ8WMoivKROmdecsUdNgpHQ7XGORqQeeFdmb2DUWQyV+VD7l:ndkBc0ZoX8WMSFsUTgpSXG8qQVTG2Drg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 a3746cef0394eea29e755891752a58931f05a16c68fa84035975d77eee1557c0
MD5 2b7a75af7b9dd802c2df069888b4f606
SHA1 a35d72d2ae491a7b13405597482e30ba964da878
SHA512 85e5bdf58cc469ce325db2c96c46de5a7b0ada2ac52bff25b4ddb4a5a141f22a42f2c07d9d86a65e79966f7c75c8c9a52e67405f44f8b31da96458d2b7e528d2
SSDEEP 96:ndkfbU1WJQdwpvWMoiVmdeH/ddKDUWQyV+VD7ziEwb:ndko0JmGWMX1gDrt
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 ee84f8033f776947c593d83c9b8628442a6edac3701e5302c430053ce62c873a
MD5 f162159a7592bbf6a0010a41b5049dac
SHA1 39fa619c12f4792688999604553f159d118e5082
SHA512 05204aee82d42c564e6586a2ff661a40e17f791f0d2941ac292a89e347502459cfcc9670e322e91455636ef8e47bbcba358ef196ab8180e81084abc043d24901
SSDEEP 96:ndkN3fU1WZRdwpwfWMoiVmdeXu/S1j/dRKDUWQyV+VD7AiEwb:ndkRc0ZDLfWMHuqh18Drg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 9073206deb6596ca33321a34ce7659cfddb59a7b4e349430be7b5218a84bf0ea
MD5 34d2a162dd96fc9224074916dc78940d
SHA1 b6e6ff60ee273788bf8c689824580974faa117d4
SHA512 8bb77173ffeeffcb0c866ad18478b8265eb9d48d21b1d82e3dc5fe8bdd29f3e576847980dd5d19c03b30fbab1c1e3751397b23ca0c408d045e9eb670b5eabe7c
SSDEEP 96:ndkNJfU1WZc8wpv9WMoikR5mdeCKDRC57XGORqQeeFdbnKDUWQyV+VD7AiEwb:ndkXc0Zno9WMkgKDRoXG8qQVTbKDrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 6d54939ff870fda6592566d78a58bc1daef85ca2e89a552567782aa224ff33a4
MD5 be9ed5745e505cc676fb189b21fd47b5
SHA1 4940516c2b88267f461689362cc3543600484aa2
SHA512 626661cabf7adcffd470dfda1879c235c4bf604c800e4c25e3b4a0e98de180264f0a3e12124129b3debc2bde2213d024a399d3930a91d991c178a3d358fb4141
SSDEEP 96:ndkNDfU1WZi8wpQ8WMoivKROmde3gpHQ7XGORqQeeFd7KDUWQyV+VD7AiEwb:ndkxc0ZFX8WMSagpSXG8qQVTWDrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 813a83bffb6ab1e4d11d7d25a9e5f21734083737144885fb02d6d8098eefcf7b
MD5 2288e0160a4c645ab88eb16010a6a437
SHA1 66e2e4e159e4dbab97366e9ffa1e7c93eaa3b655
SHA512 25fdd0101df9a4714f2bcf63e60ae642ae94a767a80e7414ca0399e5c0d699bea7e6d135e34cc874231ab2f0680cfe4016d6ab0ea39119217b6c2970fd79fd05
SSDEEP 96:ndkNJfU1WZRdwpwfWMoikR5mdeOw5jc/uu14q/dbKDUWQyV+VD7AiEwb:ndkXc0ZDLfWMkQw5+uu2q12Drg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 87dd40c220c1019ec47a6212518cf974f226b0bdc614ccb018923c4d1d91af66
MD5 548b8063ba4685127c1ddce696ce4471
SHA1 8c2303f7cdf4cfe72b4a50aa7025a9eee74caa05
SHA512 aabcd346811e5f8cf85df1f3cbff2c6938cf758ca3d398e034a71b3ded93d3a52b7d5f732530b843a1ba79c6707218a3d44a26f89ae9d1f041591ab7ff92bd2d
SSDEEP 96:ndkNJfU1WZW8wpE5WMoikR5mdestfEL7XGORqQeeFd0KDUWQyV+VD7AiEwb:ndkXc0ZRj5WMkqtfIXG8qQVTlDrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 8KB
SHA256 a0bfd76d60991594b2187b101f2ea7eca54b6944070ee75066a285451ada0a84
MD5 077fef0fab9b11a367d9ad8812532186
SHA1 2ee9eef9000a07cc34a94532ac46af285761acd9
SHA512 496834925d0be2268ab529600bb30f3cdc36c605e8c38cc1f7f1102fd7b840ab5dcff2b91c1d79c87b4fc652e6e7689aa94ef707048a90b6781d789831161e41
SSDEEP 96:ndk3sQnDfU1WZ58wpvWMoixSRzKRP9R5mdecsUdNgpHQ7XGORqQeeFdPTryWQyVg:ndkxc0Z+GWMowfCsUTgpSXG8qQVTLrlg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 aed109e6888ab497b5fd64712ad50bef45e4b1a157eb9074e0763440c73a5125
MD5 ddf54aff4cb476353aada7b7ee613f66
SHA1 a1376ec03018526f21ead13a34079e8c1081f58d
SHA512 a29a22ec42d220c306702c57c65533a2e8bb5bab1faf986f8fc9da8e1687696352a38e70d54739dc008a0ec1f7fea195a894d420757b5bd4960125ae26453fc2
SSDEEP 96:ndkNJfU1WZf8wpykWMoikR5mdeycljU7XGORqQeeFdqKDUWQyV+VD7AiEwb:ndkXc0ZElkWMkQclKXG8qQVTDDrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

PreferredApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferredApps
Size 33B
SHA256 42b55d126d1e640b1ed7a6bdcb9a46c81df461fa7e131f4f8c7108c2c61c14de
MD5 2b432fef211c69c745aca86de4f8e4ab
SHA1 4b92da8d4c0188cf2409500adcd2200444a82fcc
SHA512 948502de4dc89a7e9d2e1660451fcd0f44fd3816072924a44f145d821d0363233cc92a377dba3a0a9f849e3c17b1893070025c369c8120083a622d025fe1eacf
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\f6880280-f857-48c9-adb9-2f722de73eed\index-dir\temp-index
Size 2KB
SHA256 e0e09366680c7b1fcda387c3d172531b6a9fb560a02c0c5d70454890b8fe0111
MD5 9a0ad3ca4178920c606b3795730aec0c
SHA1 c0b67e823bb8b0d51564a0da788d0a2b14bb8555
SHA512 fe412d97d224def7b9057443b4bc17efb1023c139f5a45e5105fabdf797de42207f2614210e7fea6d9e30720f37d32fa7d3d3e5150c1b84534b7ab84179f0acc
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\f6880280-f857-48c9-adb9-2f722de73eed\index-dir\the-real-index
Size 2KB
SHA256 1d861a03ee9c0c2da03ffb72bef59084d60b5ea08c689844cae4fd7c9ea774b8
MD5 46a3ce57dfae6680e9774a02b8cbad20
SHA1 7d1199ca5077874cef4946c47bc7c1c9005f2895
SHA512 64c0dcc2b7de3b71e2a5cea6e69d157544d64ba6710e75d8e61223b5e241f74ad7496392f7badd8de527e3d7686a45bd46078b3edfdfbdc25f35059554131d22
MD5 SHA1 SHA512

Submit Download

the-real-index~RFe5a259a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\f6880280-f857-48c9-adb9-2f722de73eed\index-dir\the-real-index~RFe5a259a.TMP
Size 48B
SHA256 b5e6e1971ef460847689b8db2057a5cedc19c328c3e3a25c0dc6f1dc57ba92ce
MD5 d554ff12977d628c5850c6578cda9494
SHA1 f0a82dcdc82d05034a233811a593c2eea06f47cb
SHA512 ca5c4745880f8ad68b1a872e9f473689839e2b3dd0a5d7fb7a461c02b6082857eebe80602a76395cd498e3874c526a3215fcd586c78cbded5d22bfb4a68e3d0f
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 89B
SHA256 3ca591ca9b16f030bb992a60736f25239d2b16cd77e75a963f2a7e09355611ed
MD5 2b43bda4e05e0038fa043e7048bfc9e7
SHA1 86b810fc44ccc4561a7c7c6188d2f52be8bc10df
SHA512 025845fa17295e658a488abe974d9cce795e87fb1a0c84fcdfc665ba4467e143cf981371d3ef07722562550e5af4460f0d3185e984ee1e2387ff617f58a29449
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 146B
SHA256 af05924bc150e1d2bdb8e310d37934848f5287a83c4b01eed2b50e41d4ffd4f7
MD5 520ca2f492bdef8ab977f49098032abf
SHA1 bc292938e6dcef575c600b39ba3e2776cdefced1
SHA512 0759573ab14028361cb2e0fe95d4bf0c0ca99825d7b40cf0d172cfc9c6513f57580236b2c7d8cda7fa8ffe2cca58133c5d4ecd8f06194e592b570d0fd9fd4a77
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 84B
SHA256 3d078d41156ac7b46b3a791d46740db9c032b0b21bfaaffc166561653cb472f1
MD5 5ba81d37550844818b99be5ed9968260
SHA1 c788069cb0cc4bd68034f8624b1278208ad212ce
SHA512 c18599241a672777f514475e0a106d83bc5cdad03d7d90a915759112fe49d8733574b81dceaa3853d6582818e94c41769118108800c3af035e5888528f419bf9
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 82B
SHA256 a94cd4edb679c595ca8b6806e749db520eb9bd3204deb11861a611ac6ed63881
MD5 15b4c17ae09c82a544929411abb61b2b
SHA1 f9cfdc2415deaf9b53a2cd3fb03cdba15df12bef
SHA512 b535c4f4cf237ab42e295bc1e55a5744c86cf072eea100ebb47fc02f6ceae34ed6e7953a9d7676b497b3ac113ddf34d007075899f0e79920029a1c6c47b4fcc4
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 84B
SHA256 a9bdb64129d7f02b86b4dc3c4241b31a8f8f42a899f8bfee074b57981223a0bd
MD5 85fd31418c26f3a824c69efbc81e493d
SHA1 0d6a38dad7ad0b9bd48cf36f7d7a467717dc0a5e
SHA512 b547673c3e9c7171960e06976c49a979923ebdd12d2d328942e81e8996858e215875177f5eed0535eb5e42809a500b3f72c11255e6aa90658cdb5e6d6ea6a22f
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 e4740657e440b6068e78515bf39265d131ebef15e9d1c905ee19338ef9eb4f81
MD5 d8b6d716c4be255fcf486de74fd8c59e
SHA1 f60cd09261fa1a43f842462e23db9a92d410fa9e
SHA512 c43a41fe627dc60e8506af940647c51c070fe7cef6ba00d089d486b8d1d4efb150f8d326b6f3cd249885f9634c9d60a46b2bd787f488fbec96399dd32bd5de0d
MD5 SHA1 SHA512

Submit Download

the-real-index~RFe5a1f8f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5a1f8f.TMP
Size 48B
SHA256 319b215a73905ac7acccc7aa16233f413ea09a1af5df066fb5fa954c3d7168a3
MD5 4dc01648e655dbaa86e517e3d5bd0f57
SHA1 c1c5f644170434d37cce6836488ecfc44ca9b4df
SHA512 f206e289ca94b1931bcf8a297af2c1c52e4af1253abf56615e61bc1ee4560d40a8d2e6726c7b431a4cd93f3e6ce7b331e18b759e5c0c9f01d0e0d39339cb0ef5
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log
Size 156B
SHA256 00dd3c8077c2cca17ea9b94804490326ae6f43e6070d06b1516dfd5c4736d94d
MD5 fa1af62bdaf3c63591454d2631d5dd6d
SHA1 14fc1fc51a9b7ccab8f04c45d84442ed02eb9466
SHA512 2c3184f563b9a9bff088114f0547f204ee1e0b864115366c86506215f42d7dbf161bc2534ccaee783e62cc01105edffc5f5dabf229da5ebd839c96af1d45de77
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG
Size 322B
SHA256 a47b587ce29f1c4231b2bf46554e0ff757b3b5c4ba3c99841011f6f48d96930a
MD5 4e0e01d8eb32dbf0c61f22f7062759bb
SHA1 ea302bd03aeda9943169e2ceec257fb8c9e3f91f
SHA512 7364ddbc83ca093381d1fd30dfc8266844d6f6253b54a558a1be174f9a74f974bad7b492ef2c3cb1dcb026c1685c4ec3e7d34e3f6b2483d66e65bf413b5bba11
MD5 SHA1 SHA512

Submit Download

Session_13367323637458053

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Session_13367323637458053
Size 1KB
SHA256 ca7a297972ce9d1de0a9db5ea2ad44de9a84bcaa07c55c19978a3be00c567d8e
MD5 a00ed30e0270bbeeb84ab3e592b068e9
SHA1 df21926fd9fb5c527dd4a659f26ef05a70d59ebb
SHA512 72db799d76df898066a839f8014b9e1489c1242ed0a0e5eacebf4f38ebf8c102a7f80e203c4e2f1723cbb9ecc16fc59bf0e54c9fc4a12e364b7937567e452092
MD5 SHA1 SHA512

Submit Download

Tabs_13367323637676053

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Tabs_13367323637676053
Size 1KB
SHA256 8109cf7a23d1dacb35e49c45234306437a8bb6f7320253cee09eafb06c9cf949
MD5 96f43549dad2d17079590e8b69899042
SHA1 3591f683cf089a7174058c2f9d579d6765fe5bc4
SHA512 7b52114ebdf2533a0e52199899fe1ecb64a8623a7ed51cdba5e538a06b6781dab8c963756e9dd9361088524c1f0a9590777afc147daf610b749c009596490241
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 350B
SHA256 e96360708dbf75ec0d6fdeea7ad849e44af010d14a5af43ff0aafd91d5aa5958
MD5 989150d7a137e277cf50f44fbec5c337
SHA1 0ab7195a9fa3219cae874715d542adf544d5382a
SHA512 c2b807433318daba830589b59cee14609182d6782bfb5e6ff72affded57e9d9343aa6e982f23c83d0395a51f413c4cb55738936184d3bdfe6dbb4596e8348761
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 323B
SHA256 a3832b995b05028afedbeff23453071f6c48ca08b2a069c4a259e198de8f0db2
MD5 5327e532d3f6bc36de2cce9b9b906d85
SHA1 6a4b5018b7803bbfa71e24874bfec034c9ffb2ef
SHA512 a5d998013ba148332ce343ff5b751a6406421ccd2659782df07cb26bb5c400ede071db4ae5680b0883ff672c53a4522679d5a6391d3671371b11b7d1e0c5d96e
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 6089a8ef6f3eaa45aaf1d11f4b14a358850e20f5a15f9e9ead96a05393495af7
MD5 f11eff03c7baa453fbc2ae19b9e3a770
SHA1 d964a662a80c5669c8f2f38a6f4be3b841f0066d
SHA512 b2722d1efa3c87df637e5bec11c8cc741cf43eafa0f2af227cad6246fa8c301bbaca9bb22a57815b24792831b2903b338faf1e29d31754f75363b11d6f9143c7
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 57c36cb686067a40c39bd64d09773faa079f2c880b0fdd3430becbe44c652afa
MD5 d7ab9c8b9e72c43901e9cd25d2b57328
SHA1 4637c5856a057293347e65f80c5ba094c934b860
SHA512 f3aaf0aac8e732d97b7cd3a38a7a98d90c15500a4b5c22dd65889aff0002e065d9e5311f7bd5b87bf8394cb8f844a80e1019a77e6d54a2fd4b9347a1c77f70a9
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 fc96653506bc6d848653f2022c57463bf2ef887aecda7c1f298ccd3581395133
MD5 ea30077dfd1083c6c878c227d019ef0e
SHA1 f0a84d4599b2ff8df7ebdb5331ffecfdcf24f7bf
SHA512 b4c6daa7b9685d54337ec7298a836eff38f1f87e80ef8a1b26d475b02525742947d78097e34b978b2d6e5553f4fa05020a9e475d53c2633657c795dad6a36499
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 5799a25e386773267bbae229f40a2aeaa466417a984499a3b3258b65c731736b
MD5 3e2232a42fc262ab0f26f9549a7e34bd
SHA1 9093026eef4a73ee151cb287b91077f65a31c71e
SHA512 1bd62d77ea250e44c2ce215cd970ec0fe1bad995eb03695b50541de0f51b34be5e90dda0adb1d48b1351cdb620ae3626efc1a6a0ec071ccc0b2ef50db0fb381f
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 2KB
SHA256 cdc59ab8cf3718afac3768eb893ae82e340c6519c3383d2bf6f65677ba6109cb
MD5 072dc901adb58fb6fab35811fce2bde3
SHA1 1652441a969babe89589ee40f45d00caaf4ac88b
SHA512 3c3d7025ef70c14eafce4ae20719491a282b9fe8d0fb2e9445b9a0bc92ed834ddcd7dd906ffdef016c4c44f4191c29683cd8dec9aab6124a524e96508fc2f2dc
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 3af364d3170ed4e971ba29d8e3ddedc43ae458438fa1e7bd8caf074c2eb12882
MD5 e056e12784dc5f1abb48b485a01e0a7e
SHA1 78c31c6be599a2ab4b3e5bb7daa61adf9827d964
SHA512 f33cd79f3b2181e0891cbc9fc82eb37fc217194fea7ce870a59c74d217e83eccb7323239efef473549a9762064a5fc30e2617cf7ed071ff7bb5123a276336e14
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 ebfad71167472374d0abcd6b7a7c27ed14b8c0483833b576d95c256e70569e5d
MD5 ece3d64ce38c3c8c71f7173f3dae993d
SHA1 c578c5c523372a3e22fa9fb771f6251029995720
SHA512 824023f86554eeb9d89862adb1b748624ec1010fcc862b4d453d646426914c46d28b33d409b01f7e0332d1a4f49bbc12c62662778c5860760ab838b6671ef486
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 9c1f25ed4db76688bdc91ec61590e525d80bc6d4daa5181826447cc1ceefbe6f
MD5 adbfc39a1e91f9c5b6ca234f9b654355
SHA1 4b80d7143427a1077657ae207d3014945749a896
SHA512 f41e48b596333be8b3fd61f10e7fcce9bb4f814078cb3f2328a0d86b2881a156fbc4f2143d6d14aff6256824011fdc69289236fae9dfd5d65dad19721ab1d240
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 2KB
SHA256 9c142098757136c2a6bfa10b93cb7aac522844ec4e768c70fc10a8704bf331cf
MD5 01d50ee69570f57bfb07bf242ad93271
SHA1 54934b8477090ecd5e96ba009598e29348ffc29b
SHA512 f14c0a8418abfda91f2d0395605899c582fcc7404332d0858c6c9ab77c81d1a93c2cb57688304119920272fadc2660ce5ab7bd516a71cb83c285ef01fd0528e2
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe59f11d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe59f11d.TMP
Size 536B
SHA256 06c9072a268ef048ea661ba2e6b0c73cdc0684afdd210706800670b77b7f009f
MD5 c21dac070abc0c01501383ba1cae8658
SHA1 0ad766e0cf0f8e12522c8807e9e0d08761fcfa2f
SHA512 6ec627e027ef68e5481ecd2e01162009a081b082a53f1ee069225d678eda412d0a85981f9a604e0ca5b31b5d3f682cfa9d7125c2ee421bf43b15ae3a5b42c354
MD5 SHA1 SHA512

Submit Download

Visited Links

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Visited Links
Size 128KB
SHA256 330f5cfddb08f89f6386e41abb5a89e6f56ba8ddb6c31f314eca29563c810660
MD5 40cff637d8649252501d56dc4d7afbbd
SHA1 782d8f20464ff2d5abea2dbe2169fa82efbd841c
SHA512 5cfeca5f291cea831fdc36a14d86a3690303c4ad7e789ae1f817e1535137fc88164f0b484270f5d4f1f4ae2e4aa152bf06e922368bb418fb23df9959f623143f
SSDEEP 3:ImtVuj46h/lll+:IiVuDt
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 4166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611
MD5 aefd77f47fb84fae5ea194496b44c67a
SHA1 dcfbb6a5b8d05662c4858664f81693bb7f803b82
SHA512 b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\LOG
Size 136B
SHA256 29a4061f7f35b7fd463acc4025865beb2df0808d53827f596f9873f4c599e9b4
MD5 4ec0b0c89e8dba9f58bed4e657136352
SHA1 b41ca8edb643d918a7d69110480aed7fb4c17179
SHA512 3576243d3e65e2b6030c4f4deb82d6250c48062337956fe7fa6e5f08f3d5c4d60f7385ea4cc0a724f5551a3e436378bc62ecc76f39ad1ce3aceac043eee69668
MD5 SHA1 SHA512

Submit Download

MANIFEST-000004

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\MANIFEST-000004
Size 50B
SHA256 b51bc53f3c43a5b800a723623c4e56a836367d6e2787c57d71184df5d24151da
MD5 031d6d1e28fe41a9bdcbd8a21da92df1
SHA1 38cee81cb035a60a23d6e045e5d72116f2a58683
SHA512 e994cd3a8ee3e3cf6304c33df5b7d6cc8207e0c08d568925afa9d46d42f6f1a5bdd7261f0fd1fcdf4df1a173ef4e159ee1de8125e54efee488a1220ce85af904
MD5 SHA1 SHA512

Submit Download

load_statistics.db

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db
Size 44KB
SHA256 9ee72d6072a2d8151df98fcc5ae2fb44c47ad747f7fc50a1e363d38f1ca2731a
MD5 ec9e30b3c72df86623fc4d34fc04412e
SHA1 651de6acc8f753188e3c386e001b245004fb1e77
SHA512 c8317e0553fd26b596dfad67de3e8d3524906e890e80aa9a8dca1370a6aae1851f830abf892209d908b5fb6e3cd32f091f880b34cd4256c80e49536a76c6f9d6
SSDEEP 24:TS4UYP5/ZrK/AxH1Aj5sAFWZmasamfDsCBjy8jdCklhy4n1hyZEy8cI5fc:TtUYVAKAFXX+uA+hye1hy2y8cEc
MD5 SHA1 SHA512 SSDEEP

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 187B
SHA256 36a322ec9e4354b5bd59bffa8a5ac4005d2a1eb7fab2a7b3774b2a0cec4bb7ce
MD5 47a1cedd68ebf4f7807714513c07ec4c
SHA1 d2ff45eab5461088b66a138a2608bc294a454211
SHA512 8c4f65d3c492d523517250e4d6084558a43212c17b6869e9f8fdfba660733aa51f1a47de257a7587064f4c81c4f2a1e5f0d8c825fbd563a1a1b55eccf86309f7
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 322B
SHA256 b3edeac5b20393667684ec9e695171704ab9f674a60c93a993e39d538ead279c
MD5 f8b323cfabce1b2456af73330d3601af
SHA1 5afcfc7a312ce578f3db9653a5dad2bdaf723946
SHA512 cbd688a3a98646fa48744f6b404b7c7d5c785aab28654a2dbc89edd826779b61a1b9267086ee937babd2019c3bcf1f17baacf94a456d68dcbe2797e2dce8a83f
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 565B
SHA256 bb64cbfbd4a944158d25ce92bd1ee7c0575c5b6ecc7745c7dc59371a41ed11fb
MD5 b7b347075e1f3e3c934f79c9731d0779
SHA1 2806336abfc33f365777c9855406f7e1529dffbe
SHA512 78e136dc05074e3d5dd2657f429fc2cfd0387c2a321d8d3992f2f874fa7197255d9a7c9cb63121504cf372037765be0e75873866ba5d8298252bd7f2bfb1b6e6
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 340B
SHA256 6a8682f810e330d3e16a32b53feb099efeb6e413fb300c95ff90ab7f76ed33a9
MD5 b352a489453fed1b6d047c810cb3894b
SHA1 0732fdd4038e9605610457b910b65d61942424ed
SHA512 7363ebd3923ef8dffe8f334ac742e4db1ecdf86094a45308634f7688634aa47eb0470157fa47298e79a10846785718ce04e37ee7a127f5a65a76698a006ca16b
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_0
Size 44KB
SHA256 5f7e9ecb264b6f80ae4b30f55651383383616c99b210f08406f4db66313e3d26
MD5 4e4c2e37e62d45a03fb560f94cc9fc8c
SHA1 e9e43d3d05225b47bdc3ef07930344f85407fed4
SHA512 3bbabb4ebd614e356c35a9332aa988f1a5b4c22663cda8e8d3218eb5cc79e08ebe23c85aff3ba5f74b50cf40659bd901bb600018adeeba23327628b2a413e683
SSDEEP 24:deEyVWCDiXffXt/d6dPlFlnvlFlh0J/vB69:EIXXXt0P5P
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_1
Size 264KB
SHA256 5a29634d4a704bf770f85f81d4e65f71722a63c0d7358c3f66809fc92aa86db1
MD5 d91140a88b5f0fa1cd80e091925a254f
SHA1 6a24a85822730c7899264d795f23be09327a5309
SHA512 a5674cd758e45386aad858fb58c6e559dff61c3acf0d2bfaee0ae2072c621d521436934b872b17e6b3b05a3f441d36d2a52429f95461cb091943a27673631244
SSDEEP 96:evcjS913jSNzjSdjjSdnajSgjSGpNjSG4ojSdedjS2jSVpdjSNKjSG:evjo7CiOa
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_3
Size 4.0MB
SHA256 51eee275a59db29c0af21269d3c3febd7ca9f9bd946b208a378672fbf9e9e6f8
MD5 fa7c25fcf05ca1aeb8f311f3e776a65e
SHA1 a8c3682193dc9fad6fbafed5ddec123892ed11f4
SHA512 de34a44754e708edc5896a28734e9a0c9d16be906723e939ad7384e294675e55d1898d2dd8cce1766407139a29019ade1ece74b05db049a43bb6da8c978a1433
SSDEEP 1536:KI82vNFtYNDHheZ1Fl8Jqg6VOk0uuuSeoAp0Jl6z:KubtoeZ10LQ0uuuS1
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\f_000001
Size 16KB
SHA256 f077596d48d72f781d8dec4803c6b360e0a6d193758952e70a8a42f309595d91
MD5 2ac0e9550a06af37db2959aabfc084e2
SHA1 1949433519c9d587f66d317018a2fb2538973df9
SHA512 cc943996eb97d1f64408d9c66290e65d7ca499d318cde1492afe46e461964fba97b3c01bd884e23b63870e3808682f981345de7eced62025ca2be58d5d82a43a
SSDEEP 192:InDIVdLfOLLI/jy4B+BqWXF1eyEQ0AJqgMwmt6pKRWgy:n8I/W4oJvMwmt6pKf
MD5 SHA1 SHA512 SSDEEP

Submit Download

Last Browser

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Browser
Size 120B
SHA256 9c70f766d3b84fc2bb298efa37cc9191f28bec336329cc11468cfadbc3b137f4
MD5 a397e5983d4a1619e36143b4d804b870
SHA1 aa135a8cc2469cfd1ef2d7955f027d95be5dfbd4
SHA512 4159ea654152d2810c95648694dd71957c84ea825fcca87b36f7e3282a72b30ef741805c610c5fa847ca186e34bde9c289aaa7b6931c5b257f1d11255cd2a816
MD5 SHA1 SHA512

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 11B
SHA256 ac3dd2221d90b09b795f1f72e72e4860342a4508fe336c4b822476eb25a55eaa
MD5 838a7b32aefb618130392bc7d006aa2e
SHA1 5159e0f18c9e68f0e75e2239875aa994847b8290
SHA512 9e350f0565cc726f66146838f9cebaaa38dd01892ffab9a45fe4f72e5be5459c0442e99107293a7c6f2412c71f668242c5e5a502124bc57cbf3b6ad8940cb3e9
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 dd22581030796b2cb33e7c0291b8be38963070cfcc62271a564a399f3fe3ab98
MD5 7f64f024a7165126211ed7a37594eb75
SHA1 3c5b551e3e3dbd3bbc86601683429ef6d26e6dd7
SHA512 48f53f882fc4c5a107a9bdbbf05ccf008abbf15eeec8c26268f3a6d599e8a45b9c13140e95904171a099fdfa1de8b2fb495bc0c60e265f6b0a5b36d2713bf958
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupj9xEe2RUx23Ixs0KVhY3lD:A9iIxuERzA83h09RZxYjK5YFKo37Zn
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 59f74669359d538c8aed67a5333ca29b9898ca31593bc465bfdcdbf1e94ac7b5
MD5 2066e187963b388acc2a5abd004f817d
SHA1 ba621fb02f413ae8155cabfbd54db13e60943f4a
SHA512 62975ec532198b18d9b262ee1e9ba7fab7bc2cd88b241b9ca072ce0b5f6f897024b20b9a2dd083c80dac4232058aed820f285ac0ab50603870da99f199a6f992
SSDEEP 192:BoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupAI72RUX1EVyrJU5xQbs0K0:99iIxuERzA83h09RZxYOACy1wxQzKo39
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 f1936bb3fb8fe9d81a49d8f461040a834b13bdbccfa55685db7afa1ecc4d287f
MD5 93ab262c0a31cbfb44a2f856626ee1b9
SHA1 868261f0a6d706f49ddc1764e74a211325a4f4aa
SHA512 d68afa4536cfb7d465d269335569a4fb03624e22995129c10f022e018854a481850699acd0d5e37679fc688222dab1a1c003b0688c8e23e0e33b929f71dde41d
SSDEEP 192:soCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupj9xEe2RUo23ITs0KVhY3lD:c9iIxuERzA83h09RZxYjK2Y7Ko37Zn
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 6b6d63caa0ef28fcee46401fca2d606db7e342fafed408da38dcc2a78ef6400d
MD5 83fa378f271ff2f424d988d2cb5e5219
SHA1 984682d9733de3e8a94910be81fe45af9fec29e2
SHA512 9b1514ae67bc26c130f9e9c21131d9d595a98860c5e80e62064064ac703ed93f3a1fd5a2bc6411fa57f54cfad668c1d3946863c40034f1b2d35a7a7809d26dae
SSDEEP 192:GoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupAI72RUv1EVyrJU5Ybs0KV6:C9iIxuERzA83h09RZxYOyCy1wYzKo3rJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 1c1edc14e36c9c41d126227a743d28df9c852165831ff6b968afbf1facf1fa83
MD5 ec65c7569a5484b86bac779978c5d39a
SHA1 3dc5fed8ee0be8a68ae56a51e61128105d593a59
SHA512 02f873c21663698c276b21b98ca1b5425b39ab9d4cf0f5d65d206609589310d1294bd14b5fd7bd3043a24d4b2d8ff846c6aa87386d6116a050386de68967551f
SSDEEP 192:8oCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupAI72RUX1EVyrJU5xQbs0K0:s9iIxuERzA83h09RZxYOACy1wxQzKo39
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

edge_shutdown_ms.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\edge_shutdown_ms.txt
Size 4B
SHA256 ea5044aaf71d8d86b2b72926e9cc3ca1b7e99f5f37dd999433b09dc383fb7c28
MD5 d333a89578c2b47c2c23eda241963b3b
SHA1 2ac84e0c1d74c89023d666ec225fc1b7c130b39f
SHA512 9aa881310244b97a6880bcb43a4b56067341afd5aac21e8a62fc1cf8e9710686d5b841c24ec4b26eb80ed09b864c15d52b6b2e9cd6a7e6527c1efe1246f7227a
MD5 SHA1 SHA512

Submit Download

9cd93bc6dcf544bae69531052e64647ec02f2bb4.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\9cd93bc6dcf544bae69531052e64647ec02f2bb4.tbres
Size 4KB
SHA256 1b374bc5087d443149b43ec6960fcb883c69adcabfaf609d540dd9dcdf7ae114
MD5 c28ee38caa389168bc33aea72b9b4c78
SHA1 4e93cbcdbb4d59d01e42c8dd5ab3437270e901ad
SHA512 3f3203d4524181df9697431940c2e6e451367bb7a6ccda7adf9abae69e83c6876ffb2e71a5fd8d678a850d0d32f38c33a20f8e09ced1f175f12191487c2f744c
SSDEEP 96:IDYpJ6junGnE2E+myx2eoDxAQE81BCuofXh:IDA+unCE+dx2LDxnrT6
MD5 SHA1 SHA512 SSDEEP

Submit Download

activity-stream.discovery_stream.json.tmp

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\lirn7gz7.default-release\activity-stream.discovery_stream.json.tmp
Size 21KB
SHA256 d4e2f2952aacd7fecb9860f9e33d67a3ba1f93bfb993b261fca711e57ce7dd1c
MD5 bc0c32f230014cf7fdb01924bf1b2a33
SHA1 40f750514e7c1094f6fe1c3ac54f77420b89b137
SHA512 29fc19106173913e87ca5e6501bb05a9eef2bc0fab04a497661ab8dfdab8dbb0fd23b3937ac21d0622bce43e37c502fbf43ae4ba52a64947699eb4dcb821921d
SSDEEP 384:rU/UzaXh1FUJ2bqQh10v8gYSXkXO9BPcbCEf49GdlXKav82PyauXaglxCglx27:rUFSYVkvU/34OXHvRPydXaMAM07
MD5 SHA1 SHA512 SSDEEP

Submit Download

21816B0DB510050B0FACA059FFBCA789FAFF93A3

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\lirn7gz7.default-release\cache2\entries\21816B0DB510050B0FACA059FFBCA789FAFF93A3
Size 123KB
SHA256 2f366cfbf4db8316c7bf0c87f4b36079e789d8d302cb4a4b63b98ee0482c7b73
MD5 857baba84c31aa249af4ca0bffd420e1
SHA1 034df958992e84ddae13b894be90726ee696f347
SHA512 51912f606e7086576df78e7934428d6d784fad92797373a46cdd0285597ec8174b806b3a7bc96b52b45bad743ba0ec7336f9351cf46ed345d21a5db3256eab95
SSDEEP 3072:eIvanqqafRcH7py7TJtOwfRAS8vbOAAexUjqJRJYhR8A:9qVH7p6JtOjS8aAADjIyD
MD5 SHA1 SHA512 SSDEEP

Submit Download

234C1AA9D0CDCCC9AE77F7D35DE0E77EB9B7EF55

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\lirn7gz7.default-release\cache2\entries\234C1AA9D0CDCCC9AE77F7D35DE0E77EB9B7EF55
Size 47KB
SHA256 3b21b6c605f6937be806bb7fda99f113469bbc02f1b697082fbe4f2b03071fc2
MD5 8dcc673ea1f01c8b303472a9cf1264ed
SHA1 55c9afbd7afccaee5fe86681aa708436125b9c51
SHA512 0e847461bdc51ca38e29b9bbfb49331c7bdb37d8cb26593a2ffcc70ce5a49cc0aa411eb8f95fc7c66c00e4e5fa530cddc01d1bbf83f753a1e9e6ddc98ac258a2
SSDEEP 768:S0yMq5pyHW1fq0At3AxhkOQYJQYFYkOdWabTLUqANIDRYhVQXBcn+Pc9PrVlrZS3:yMqDy70Atwxh1JQmYkO0aH+VQRc++83
MD5 SHA1 SHA512 SSDEEP

Submit Download

2492994A253B970917AF5CDF605580B1C2DC16A0

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\lirn7gz7.default-release\cache2\entries\2492994A253B970917AF5CDF605580B1C2DC16A0
Size 63KB
SHA256 3810a9c18e87f45cbc8d4da62f268dabb256a6f7cef6eb24d03007f82c0d51f6
MD5 9b7994ac139636c14568b3f2da71edbe
SHA1 2d75a9bfd74492c18e5b09f834b0c2ba937ce303
SHA512 c5871886f9c1aeecc8b46802e0b9ca63617d72035144e85e6b0dd040b3cb5d6f5f1e6f1f656b540703b7b71710704f2dab936f20a810cd6585cfbbaaf11d64e8
SSDEEP 1536:jZDAF9Zy4IgbrQve5Hl/vec91zYAqjsVYz8m:jKF90FY0veptv/1BqjgU8m
MD5 SHA1 SHA512 SSDEEP

Submit Download

2587B8254FF29804EA8C313AE41DED8329BBA421

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\lirn7gz7.default-release\cache2\entries\2587B8254FF29804EA8C313AE41DED8329BBA421
Size 86KB
SHA256 72587655ad7881b42de0ba4a3ead8b670b48693c75e91e098183b52ffdbaba84
MD5 c1059b6177b14f2195818b954288d7f5
SHA1 62db66d6401464bf17b097b4004f7ba402544b9d
SHA512 62a40e9c7f35e0ad89e41115352d2e2f792263ea0201ec29f3dcb3996cd625fef8e3f55cd939b5ec7fa5cfeffd9b52791b74485ea19567bb877680af423ac4d6
SSDEEP 1536:6snmoWopYWNeQnKAtTDW+fY4t0CUnDrES6BxaorNvi3LW8w:ovWNrTy+g4IDrB6BxaorNaLW8w
MD5 SHA1 SHA512 SSDEEP

Submit Download

3B41650862B7E1E982A2AD67EC918ED5A47FA24E

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\lirn7gz7.default-release\cache2\entries\3B41650862B7E1E982A2AD67EC918ED5A47FA24E
Size 83KB
SHA256 120cd6f7baaa512beefdb87a9768fafbc66b562bc362a690b45eae7b366d5dd2
MD5 5f08e0e24641f9b502ecf3e73f956162
SHA1 394642f2eb53e476440b435f4cbb8ae69fc3f82c
SHA512 9bf9293e0aa0a774a3e691c37fcef9e4534e92620071044e8df2dfdc6191dce6a8b80b2691135c44d5e3cc8e0c5f9d50aff67816a20120109d91532814c3c580
SSDEEP 1536:OuUyVh78gpd3oN4foKoHp+EkAxyAQDh8t99H75dciyHI6QxXvV582:DUsR8m4NmoH5d5U3fQxXL82
MD5 SHA1 SHA512 SSDEEP

Submit Download

5BB66A8F6778DEB9D595D468945EFF9C7D66B934

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\lirn7gz7.default-release\cache2\entries\5BB66A8F6778DEB9D595D468945EFF9C7D66B934
Size 68KB
SHA256 0489f61c9290c310bfb2e156f42a3dd12fce5a89f579dbf4147728b2c95d20a6
MD5 34f4e78ec53992c27f8a0285a9ecf763
SHA1 a25e19b97c4491be4c66f2450ebd472c95edd967
SHA512 7550f3ecc331f569dd4e65f4e69f53982fb9713c4301dbeb0416ec174ad9eb1888c05bc4041fec48f2afcdd7be353d6cedae6c60a87161283d0e3a9f90f3106b
SSDEEP 768:QZ5gENUZDXCET2WMb8KYTTt3dGB5IC8QXLgY/v3WxtXhM1OX6EZy1IEUBg0G0F0z:QZe6oDyWo8KYv3QLgp/kOXXIIjBXb8f
MD5 SHA1 SHA512 SSDEEP

Submit Download

7804D38CB5EFBE4D6A56E24B2F21D7B36AE8BE94

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\lirn7gz7.default-release\cache2\entries\7804D38CB5EFBE4D6A56E24B2F21D7B36AE8BE94
Size 66KB
SHA256 966e027e25ea37d160100893d068c8a9e35f87dd5e90bca78ed50d135d7e3f82
MD5 6b2ca473dbbf5dd950727e3132d580e9
SHA1 13308c8cc70d150a9e4443e8eb8a35575f4a15b4
SHA512 0606965850ccf7a52aa1383b35f26a5ec889411eb9db8cd802b2d44f99c238fd1d720a9a1c17f8bc2732269459a6b9f4695c183386a2935eb679833b051e47e4
SSDEEP 1536:cr6TCHnm/Dur9M8nXLG46S6GVvIR40XLstctZ8m:cr6IlLRZVv30bsy8m
MD5 SHA1 SHA512 SSDEEP

Submit Download

8C61F63CC1452C042384E497491F1766796C2C1F

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\lirn7gz7.default-release\cache2\entries\8C61F63CC1452C042384E497491F1766796C2C1F
Size 30KB
SHA256 613e2515b00445f085b3486f6b8e5ebb5295bbcb02f33f168c7d48028adfb861
MD5 2ee181cda73bb00b7eef115d6d0e5dd3
SHA1 24c8863b480b34d09e4c18953effb8be2703ff81
SHA512 72b4d5b0332f1041810b7d929d8b307163a6b567b2f683470de98a8b9f895c5688e58efe00743d05fad09919485dd36d8a39fd40b9e447fde133ad74c3648ad5
SSDEEP 768:0Zkne9yYiRWR+eWu8/V21pRgaac9PrVlrZSp5jTMe:0Z25YiWR5Wu8/O58j
MD5 SHA1 SHA512 SSDEEP

Submit Download

8F2B50ADE38DBEB7F4A4E85B4AEA9EE28AE93B76

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\lirn7gz7.default-release\cache2\entries\8F2B50ADE38DBEB7F4A4E85B4AEA9EE28AE93B76
Size 147KB
SHA256 1a55e480c8cd4be15a03094a11f06f62a98d684dbb3437ddb9adffec7ee52bf0
MD5 df5ea4562a1c59b5b4801e487efa1454
SHA1 47eccedff19cab6be2c7943d20f387e558c36be9
SHA512 9c06594bcf499ea460be300ee012d40c5026009d0f12ae88ada81375905a7912e88a4a2f63664e386501c776f3376b238c5bf7542c9de15f254218db10615c68
SSDEEP 3072:AmloLnzhSX9pthlsSvSPGREi4OpP1i+107jjZJKLTY/bmo08s:bloLzhSNbJveGRB7PIyQJKUzo
MD5 SHA1 SHA512 SSDEEP

Submit Download

A2BD72A3227572715C6CBC7E489B8F9A87263541

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\lirn7gz7.default-release\cache2\entries\A2BD72A3227572715C6CBC7E489B8F9A87263541
Size 79KB
SHA256 ff4467267015426ad63ac73c38b0ca00fc0856575f282142adff3c1c084bc32b
MD5 e949d6a93c839444043f374ec9b5bdc4
SHA1 9656f90663f07a9c0cce6c77c938a96ddf1d29ad
SHA512 0a079359fa23f9c4d39088d4e438a6f142ba4eb93032fc259805550d24c0095c1ff21fa107373d0ea40a596e0f353479dfbfd58d97c5028141e958f9982f9c9a
SSDEEP 1536:hUozrpqCh9GSvRmOghyo2NNDEbLdoJ/GzBL8o:hUoBbGw0t+WiJ+1L8o
MD5 SHA1 SHA512 SSDEEP

Submit Download

AF6E7B7DB9908D7B867517AC33D094ABD56E38F7

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\lirn7gz7.default-release\cache2\entries\AF6E7B7DB9908D7B867517AC33D094ABD56E38F7
Size 81KB
SHA256 61f0ffe72bf14b8e71d1ce734427e671a871ca448a845859d3506e3af4871dc7
MD5 b1045e71403532e86820dfaf9c77b2bf
SHA1 d89a7a5daec45c5d0ffc6c6577586908b37a4715
SHA512 d46fac4a61997fcd08ce166349f6bdcf6ec35da24255c8cea94e9ba5fc9ba027052594b232cf81618a125e1c3c44977508bb815adf295108977967841fa4c8dc
SSDEEP 768:knF2XMmSppIr7rJ7mVzHK9hjgBMKLIwLdaaeBPlQaR6dnNGf3KmtySavMlSAjNPB:GFqpHPhsBMKL4S8dAyx56AuQ728J
MD5 SHA1 SHA512 SSDEEP

Submit Download

B47C2290387CA81094036091C984E8DF3E89AE1C

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\lirn7gz7.default-release\cache2\entries\B47C2290387CA81094036091C984E8DF3E89AE1C
Size 79KB
SHA256 4fc3ca0475b20236a40efc4ecae4bb2b3c06f3ae20cc4d260f2286daae623c6e
MD5 785966bd350c150d79636d8d3c55a82b
SHA1 6cd2e6744695f433ed74d5e2227c0a95bb76767a
SHA512 03ccd51020e7fc718ff1000f741c3106f9f0a5f6b7709816a215ef98cd522cf71baf3ee60e392922eb53e4025ec8ce7b456304d9d79e97203bccacc29b1d838c
SSDEEP 1536:H+a2NTa+o2NhRyYcN5gTCeFQTH0s0pE/Lx8z:eawTaCFR+H0s0pE/Lx8z
MD5 SHA1 SHA512 SSDEEP

Submit Download

B6666573B462283A3403C0599718DD1394C86D7C

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\lirn7gz7.default-release\cache2\entries\B6666573B462283A3403C0599718DD1394C86D7C
Size 168KB
SHA256 5b52ba5d9e3e936645221fa0d277474110f869a01cd5ea965999c9bb186d2f37
MD5 974de9a2b52b6f1d59baf205e5e4188c
SHA1 99c3d2b226bf989b91e527d2badf8489749353c6
SHA512 7b9ab028c6ce27a89925d0cff3969f1a6393f26ced09e5a786f90beb35946e03e394b3eeeb52a6c8c54bafe2015774ee819267e8b2e21a3fb387484486ad5ef5
SSDEEP 3072:HEV5CWoFMQfRKRBlcd/sPT9rb9FxCbgQIfRrvL2RtuuXcIKu2ReCqNeGAwOnZWJ+:DEhB+d/sr9rb9FxCMCtuuXdK3qZkz
MD5 SHA1 SHA512 SSDEEP

Submit Download

BF0923D6C9AC3F4148AB74C98E937ACD57DCEAD3

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\lirn7gz7.default-release\cache2\entries\BF0923D6C9AC3F4148AB74C98E937ACD57DCEAD3
Size 97KB
SHA256 70db7f01b3cdb573307fa0014446f87f5ddf00005087ea1339f4d72f910ad5f5
MD5 00afdd72629b367bf1e52a9eb85dcdea
SHA1 cb469394570ad613d61ef9b8d4ffc9806a064c09
SHA512 136731e295d5ad4478f37082bda6ec1ba776ad54bc2c1645a99a8190af891302c2ded8ed3e917147d14d7ced7a0fed94559e95e045af672a5f695fd5eaded510
SSDEEP 768:UBwks4/DRmyTkdFydKcyt95HtFcEHsxFLdBtMRe2tDPG+mZtoMF7BAjKbl5Ic9Pr:ss4LxTkdFydD250EHkFLGRWLoMF7DH8y
MD5 SHA1 SHA512 SSDEEP

Submit Download

C2283632E322561BA2F9CE9CCB092B53DDDBC82D

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\lirn7gz7.default-release\cache2\entries\C2283632E322561BA2F9CE9CCB092B53DDDBC82D
Size 34KB
SHA256 0b9690749e799574882707dcef9185186d8959975fb69cdf3e6013a56932874c
MD5 9ca8acbb811ee2bfbe1ada70690540a5
SHA1 4a6d6738eef00629ef89816479d216e336d71ea3
SHA512 fc234d449ad5b6174105d7805555dbf90c5968b1a77dc62eaaeed62135d0652f19354b3ae50e35465181cb7fae27c9981eb50085979306886e782e2f30a0f962
SSDEEP 768:hd1D+DJ/6pUp6BxR64FrabBBaJ++R8eoM7VN+gzMSc9PrVlrZSp5jTMV:R+DeVN66CnGfaRMB68k
MD5 SHA1 SHA512 SSDEEP

Submit Download

D207CA89781848E7ECA4C658F22D4AEF1B168DD3

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\lirn7gz7.default-release\cache2\entries\D207CA89781848E7ECA4C658F22D4AEF1B168DD3
Size 27KB
SHA256 522efa57f63e03a2e87d2c75fef10289f453d899085630d295f7aaa51cf9f8ca
MD5 dc8d70b4b98cb8e9d0bbb9fd02cb8f0a
SHA1 dd835375e03e996e96b43313de3c043f7e23a800
SHA512 e80fcd37ba760631b4b137f85cd79625adf5f997910d9f0084b3eaf556caf8f225ed8e2ec626eeaee30f6033216afb9859a14802150d6b89de955323d0c98f85
SSDEEP 768:z4r+ZNc0bQPfn9oeHzas/pbtpiMu9jIc9PrVlrZSp5jTMT:z4rQRbqoeTasdtpdcH8m
MD5 SHA1 SHA512 SSDEEP

Submit Download

FBDBFF904862DA0962D7732A80A2D006463328F1

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\lirn7gz7.default-release\cache2\entries\FBDBFF904862DA0962D7732A80A2D006463328F1
Size 47KB
SHA256 ce3f886da3eb0a97d5c1c0350e0f291c2d4e94814d4c81568181bba6d6546530
MD5 6338e29e43b3fbea7af125c97af1ab97
SHA1 c722e553988cc522893a6cb1771c61fa56130cae
SHA512 e14674449e24ce2e2066d9bea28029c38175ec1e1c41136fe93516fa421277ff2d2f52c5a3238c09a2b57e083be920a0b393fcd2f753017ad7e77cd27e02f461
SSDEEP 768:iyiUNFsZEco1VjVRZ0xoBb6k1ftzZTjePSIxeB+ky2jo9RSY787QkKac9PrVlrZM:iyvF+EN1VVROxIvHCGByPSYQ7QN8F
MD5 SHA1 SHA512 SSDEEP

Submit Download

FC7A5D4D58FA3844EEE1296C1CD77E65BD49B520

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\lirn7gz7.default-release\cache2\entries\FC7A5D4D58FA3844EEE1296C1CD77E65BD49B520
Size 31KB
SHA256 d49a68cbffea035acbc909217905ba225ea38cbc525e9ee4415b4d8c19d7ad27
MD5 86bdae2cceb38803e16c3a1c8e118e97
SHA1 f76b819e366c9047a5fbe75089ac8bc84ec682e7
SHA512 efba17cb4b066d9e9179da2575a416af8b69a77ef1b11871f44700637fbf0008c83c17c3ffcc6d98850a2962d244c9dcde8d73bbd6217d0f2dbb3f9424f2ba3e
SSDEEP 768:8d1PFc7gmKK2SYZS4N+bg/IUEZ9JvYuM6Xlj0cc9PrVlrZSp5jTM3:8d1PegO2dS4EM/S9nMO6T8m
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 479KB
SHA256 c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
MD5 09372174e83dbbf696ee732fd2e875bb
SHA1 ba360186ba650a769f9303f48b7200fb5eaccee1
SHA512 b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1
SSDEEP 12288:u8fhrUPE5+8TK1g9M6y5JJtuiA50eHgB2rAnavTQu:fZrUPE5I1g9M6yyZ0AgYra4Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon-1

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
Size 13.8MB
SHA256 32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03
MD5 0a8747a2ac9ac08ae9508f36c6d75692
SHA1 b287a96fd6cc12433adb42193dfe06111c38eaf0
SHA512 59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d
SSDEEP 393216:AlbmEldfMHfblCYl2mgJxBpLwSRl/uuUNEGRSr:AxmyfMHf8YYxBG+lWueRSr
MD5 SHA1 SHA512 SSDEEP

Submit Download

6824f4a902c78fbd.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms
Size 17KB
SHA256 e3e973d3c78615a3b03743d28414494444003a289e53b3875e94b5fe207363c5
MD5 15dcc97c3957be90fce68725e02ddc18
SHA1 1c117ee4eb6d31c7d40c447467d4834e3aaca491
SHA512 87b16a34678ec42ae796fcbca10bb91934ba857e1e3816e8e3fe23f0b01a72c51b0f2a5d4d988cf8df3c8af287a2b4d3d5b0b092eb24457c133ef45e1ccd7e0d
SSDEEP 96:HzfqTfq/qfq/KfqmA5cMEfqm75WOsDOUMHfqKs5UFrCRfqYx5vfq7x5tfqwx5UW:HziTiii/KiFmiqfbfi93iKNidriij
MD5 SHA1 SHA512 SSDEEP

Submit Download

6824f4a902c78fbd.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms
Size 11KB
SHA256 02a5547d25b696ab947c56db80e5de6f35041e7042d7469eee8d3c6abe16114d
MD5 bc89ea9905961b94f7fa51c1d8b38a5d
SHA1 5e0b61d16e70d4dec624b87ab68343a75132d637
SHA512 522f9e019eca8f781662fbd4b0ae9aae6fd77678308ebc69bf2694ba4f40534491e9382e851687dd3078566ef2e3040cd277d73a2fd809c075b6673daf2169f1
SSDEEP 96:H6fq0fq/Bfq/ofqm75BMhfqKs5jefqwx5UW:H6i0iZi/oiq6i9Qiij
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\AlternateServices.bin
Size 8KB
SHA256 9d776c5844cec2dac5b8b09ff0373ede36cece4dcfc1bc334e2c390f1b438422
MD5 cca5121649b590454c97f5131f7e59b2
SHA1 1a4799485537c211e4123ba49f9ceba867347474
SHA512 c1324894b75b626bdc27ca9422d99951a9646b027718a78b185e025cfc7ecd10019a219c7fe26d63bbb1cb3a0985596e8f463db6dd1631b65a126336bbc800f0
SSDEEP 24:q2uB1oF9S7lUgu1xgRbc9S4XFsh2F3LFB9S5KpR5cOb9SkzuhMZj9SmRMPQhcV:FGy5oK7f9cOR74PHV
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 2f8636bd4ad910aacf9087743ce41beca0baecb420a46a4314cde30cc40836cf
MD5 81baaa9ac16ab12fa6d21d8238f4309c
SHA1 13cb61d68a5b1720dea504cf47e2c946fcd048ae
SHA512 e665c715a19f26a37af9493613727cc1c53909da140c7dc9caae5e85e3e79ca1ca78f4cc74bb5b6d74821519fd08cac327d8a03c58f2943ea9b64a7be98b9348
SSDEEP 96:9sqQyrayby9yHFl66JozGzgClKtmSSxrSMF9ZbkW6ShmVEPP/PrWI:L3GEH/66JozGzgCl6mSSxrrvZboShA6N
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\datareporting\glean\db\data.safe.tmp
Size 18KB
SHA256 74fc08906df2d97eaa4b6345a94e8c5b92924c26a3ae8b6fe6ba0923d7376698
MD5 20a724d458614a3682979d197dca5594
SHA1 ca55140ae88f272359c3415d8d153d031e7dc7e1
SHA512 3fd86fb05a866fea00ad8c38174a94623836d563327719b9c0ea702069416599967577f325e1e344106fe98b4097ce5d89334ac477f7033eb3b1c36261a07e73
SSDEEP 384:FUCOdHkQB+SUZdGbPbEtbw+Uhbom1KMPC3GEH/66JozGzgC1bM:DOKA+SUZdGbPbwbw+UR/H63GECEm
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\datareporting\glean\db\data.safe.tmp
Size 42KB
SHA256 61af0a20228f4c725f973ef78de6779e6e233962848cb20d581f34ba45fc1bb7
MD5 d1bcd4930e88e3524b4f6b36255dcf04
SHA1 e91290b1990f030da50a1e1cd99acaa05c3a56d0
SHA512 7ef521e9052865a35487a4fb19ad76b5eb14224d4f23cbd0b7967c2fe7a3d82be9b705b2c826b5c3948f38aaf7ef07f3d9e3058e634497e5086922f7fb05e56d
SSDEEP 768:sR/HiGECEMvSzbU6B8M9ChpHgq3eNds76eqem6iG5AQbWbTbhbibLb2bIbxHJqBx:sFCGEkvUbU6B8MshpHgq3eNdsbHJUxZl
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 7c15268182e8f1bc7fed8441c62c50a3fcdb197d4feeade5aac4ea310191f77a
MD5 657de6553bbbfc1ca651a934aa0c0fab
SHA1 f2c4380fee036f52cfa449d1d6f787e61c8b9529
SHA512 d34790baff46c7bb764be0aaea66d7a4f2cf9d7f7f78077b112546c734ea45de0dddfa8704bd3dadaaabdd62b57d58a0bcf43dca2728f502183981246ba2ffc9
SSDEEP 192:Y3GEH/66JozGzgCl6mSSxrrvZboP+1hA6PDf3:Y3GEH/66JozGzgC1bxBbom1zPr
MD5 SHA1 SHA512 SSDEEP

Submit Download

0119f2d3-72cf-44cd-a1d3-6920447b7398

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\datareporting\glean\pending_pings\0119f2d3-72cf-44cd-a1d3-6920447b7398
Size 1KB
SHA256 c63c4aa3ce7e0c9a2e7c3de4b59a9316d3529eb8c07c8035ccfcad19d1618092
MD5 be7add46cf7eea3b9a817a35fb56dddb
SHA1 23b2d801998b529e88a6d6514f318c3b8c937c39
SHA512 b56af2a460ac0b5ec0ea287e014a3931e0e7b91c8881452de636c42515dbd0f975222934d8b1b6ecb57cf0cc6a6d7a1ebdf685a6cf331d3d4129376002f70772
MD5 SHA1 SHA512

Submit Download

06b69794-3383-446f-be16-71ceba194d0c

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\datareporting\glean\pending_pings\06b69794-3383-446f-be16-71ceba194d0c
Size 847B
SHA256 47a059b7adb420cfbceec0e021ce51c3eae9ee9507fc1a67e1ba16fc8d2ee8ab
MD5 8321c66aca299b523c80ddaae2384747
SHA1 bdaf7b1ee7bef1bf1b1ddd05ba2df2cd5bafc073
SHA512 ba8fb0d08348b33539598c33ce5b77a29bccd20bb50aa3d1a3182b9079cb13fae0f89b8dd0691b968b1e53af93022a6d9ef07a7d80e9074568c4ec370f93bd56
MD5 SHA1 SHA512

Submit Download

4fc2b404-736f-45e4-ab00-53bedab84401

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\datareporting\glean\pending_pings\4fc2b404-736f-45e4-ab00-53bedab84401
Size 671B
SHA256 7782ed0dba25f162785dd2af2484b7f770a027ed0a09794459c2577046682310
MD5 5b0be59b73cb3a75f4ca7d317e0deddd
SHA1 8181db485d26b2ba417a33fa79736b3c137023cc
SHA512 38c206a6b98df5e608ce387dd89c345a990d20ebb70938c58ded1bf4ef60aadc543cb4d45af965f4a2d4b7acfc766fad5e1f02026078754667e0442e26e8b8a7
MD5 SHA1 SHA512

Submit Download

7513e6ad-5c0d-4c53-af90-90160b70e8be

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\datareporting\glean\pending_pings\7513e6ad-5c0d-4c53-af90-90160b70e8be
Size 982B
SHA256 5062d96ad8525c5cd6d40c02ad2b9fcc9c5962e8ca13c00cacfa81d227342249
MD5 ab25aa92606d8ff0d983c42665425654
SHA1 c8afde41fe235a8cc1eb70773ffbc79867543da7
SHA512 e21009975bd3acd4a53cf8bc24c3ab76bb4de14835818422935bdd45fde6364a7304a4ec58bedbf7b93cf02c6511a6668e1fcc8441d497bbbe638c8464c64855
MD5 SHA1 SHA512

Submit Download

d2b5e274-4209-4dc3-943e-10b3589c206d

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\datareporting\glean\pending_pings\d2b5e274-4209-4dc3-943e-10b3589c206d
Size 26KB
SHA256 2b6ba722d445913de87b38048312fafbb37ebb00834762a3d8d3d0f6213d67ea
MD5 3c5c63bdd08c8fec655f970ec7141de8
SHA1 934a5e62f282047fffecd533d91ad71f9da264b5
SHA512 1969a5b8f3f5f92edcb299c4f91ecc22f71e67f8e201bfca4c36276e313a58c0f2afe63fdd5906964c9f3e0d6f941c7f3bdecd3230978989bb4f3690006d1cf7
SSDEEP 192:kOX2qqbCdAcJzNSm739dX+SKopoOnm5ElAcNRTK3C/dX1dSINN/ZxMFRpJL6UVvL:kOG2bE7gXiZHTl8rvFqpHrJ0wrIRCGMP
MD5 SHA1 SHA512 SSDEEP

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
Size 1.1MB
SHA256 d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
MD5 842039753bf41fa5e11b3a1383061a87
SHA1 3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
SHA512 d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157
SSDEEP 24576:bif6DS+hWYEwTkhPcB64VjVEj3cYemypfYIC:bTDSNwToPcfjBmypf6
MD5 SHA1 SHA512 SSDEEP

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
Size 116B
SHA256 4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
MD5 2a461e9eb87fd1955cea740a3444ee7a
SHA1 b10755914c713f5a4677494dbe8a686ed458c3c5
SHA512 34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
Size 372B
SHA256 bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda
MD5 bf957ad58b55f64219ab3f793e374316
SHA1 a11adc9d7f2c28e04d9b35e23b7616d0527118a1
SHA512 79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e
MD5 SHA1 SHA512

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
Size 17.8MB
SHA256 bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e
MD5 daf7ef3acccab478aaa7d6dc1c60f865
SHA1 f8246162b97ce4a945feced27b6ea114366ff2ad
SHA512 5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75
SSDEEP 393216:aPR9ZiVTK93/u7036bbXHumUMKU5otXJYOJBlC9qkTSgz1:L8J/G036bbemFot2kl1kVz1
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\prefs-1.js
Size 11KB
SHA256 1dd6304bf11abbc9550dcf1c3e94f4a4ddd65d91e27b5adbab5bab273b3201f9
MD5 1a920da79192142948ef2d689d3aa5e9
SHA1 13e17c1552a9dec118fa8d5bb6d250730cf208e6
SHA512 a414212b4118e361c43bbba37218c4c501f26c76406bd69132f21b25b42c148453fe8f57ab5b2546e749f6bf3a50c01b1f2284cdaba124933cc7d441e14aae91
SSDEEP 192:b5nPRsfDQ9JhzsI40tZQSAcddI4mtvDnjXA60faXCp+Bw8Hs:4Yskvl7yvDn/sywV
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\prefs-1.js
Size 12KB
SHA256 855cae2be70e84865b3bbb23afd2e68851158fc5872cd13ceba8353926177b6c
MD5 35ef6f6eb1ca0a6fa442bd74a3f49993
SHA1 cd3aee4b81dad0f87b2cdf55f59fadd8cdd5a0ee
SHA512 75e628286c50e8a81a856f04036d112b33ef9d957bafe299013259c597561a44d00527f55e8ccd605d611c729a1d19b1065459006f24f54adef09da011c6a889
SSDEEP 192:bunnCRFfwQ9JhzsI40tZQSAcddI4mtvDnjXA60faXCp5Bw8Hy:LRskvl7yvDn/shwz
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\prefs.js
Size 13KB
SHA256 a10a31099afd3743a7033531e5edb19200e68d03b386bd49d4f988fa22c52e17
MD5 c0880eb2c041738a8d8c56e5057418a8
SHA1 d0a71dc1c0f3a9ebd6626cb6d082c96a01a76d15
SHA512 c9e1d26b60f2cf306fbaad4a513e82b5899e698e20bd04418a6d170002d1269a40bad496f8491d2e0a9726c3248cd0ef27dddbecae3a5e5362b7ae6829872574
SSDEEP 192:YunnCRFfwQ9JhzsI40tZQSAcddI4mtvDnjXA60qaXCpViBw8Hr:qRskvl7yvDn/tgwC
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\prefs.js
Size 11KB
SHA256 625ebbac66fff444e5b652674194a368df6d7143fd32ee0a77edb3233d888958
MD5 9ff05bc4503efd121cecadddca6789df
SHA1 8d7e207cea6dcf32936a7bd0f109c25d0400c609
SHA512 b6c419cf835de3a4e27fa511977c8c844228f6957177c6a19e5a28471554c90cc63fa4200c32d1e52391babf780a43d168f9f54e038774aca968f6eaea849ecb
SSDEEP 192:b5nPRsfD8hJFf5fStvvZDoncdWfstIDnjXT60WaXIp+Bw8Vr:4+bf54vvicAWIDn6Tyws
MD5 SHA1 SHA512 SSDEEP

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\sessionstore-backups\recovery.baklz4
Size 3KB
SHA256 628e39b1bf9141951104bb0d6925b007da529299c72ffe86080b1986e7e88d55
MD5 7353b0fdf492c633821b83700ef39b5f
SHA1 6e7953b6a0296be18dfb8d3b58a126e816a6cdac
SHA512 51305574e536840234694ea87e5d9ff56e1ea015aa2b2e80edc440c1b5d3660efe6a6be399c846ee3fd2156b7191dd0431f1210de97ed7f9007d72016affcec6
MD5 SHA1 SHA512

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\sessionstore-backups\recovery.baklz4
Size 3KB
SHA256 7466663e77d4b4d5bb0cfd938af13c2853436d914a2087b06412329d7084219f
MD5 959be35f6b8764ccdba3a2451569369e
SHA1 9949499e7cfa2f3071cfaba8d89d0163c05deedf
SHA512 b13e1af720dfdcb7111820a8d00616098c37855231f056e779128b0d1b433f89b541aac4ab51f488fc0757d54d3022177f5637bc9e16f57c70dd0c4e675bbd86
MD5 SHA1 SHA512

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\sessionstore-backups\recovery.baklz4
Size 3KB
SHA256 c1a4c9fd91db982fe8a7be542b1f94f6f421b40db9bd978e12905f2426390983
MD5 301105fb246aff38909c063e7767bbf9
SHA1 d189ceb1fb6920f62974dd05751804cde79439bf
SHA512 3a48b8b53a1038f0d66700388cf3dbcd6e17b66cc2215509f7e148ee4ffbd7ffc6ce371aee6511d86b1c00402ac4399fc872e07a9dd80ce1dbc595719efaeca8
MD5 SHA1 SHA512

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\sessionstore-backups\recovery.baklz4
Size 3KB
SHA256 6833ca4814fcf6ed0e786eda12257f0b2d6a67bafebe46d64086b2db0026bb98
MD5 d097ea7f6d335a518afaf152550448a2
SHA1 b1c3d3f75f2200e7da863e51ace72d5443221d71
SHA512 cf010b7544f19b7c84b09cd9bb20e14291d8113f8a71e1192b1dc4f7ca9b814e905559bb202735f6068b2dcd1905919800cad169bc32c26948a223f0f81a0ce5
MD5 SHA1 SHA512

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\sessionstore-backups\recovery.baklz4
Size 7KB
SHA256 0bc18395fbe92677e79e338409f15d222c5269f7ebde3c2768af2a54af1dc90e
MD5 784ff854389ec2c4fcb537be38ceeb7d
SHA1 731f6b901bcdead309976142d432c85ce790ce55
SHA512 bcf719e1ede953dfe0c7a266eafdb03b650ab1e1b20bdf1996c6ff34dacd516c78697564fe0d6cdb7a052d4eb3f3bcb32c36ac2e871ced2dbe3c0bbbfec62bbc
SSDEEP 192:AH/KVMlcX6JkHA9Oev+HC2P/faS5GA2ZmDu66:AH/fSCkgqCA/faJXZmDu66
MD5 SHA1 SHA512 SSDEEP

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lirn7gz7.default-release\sessionstore-backups\recovery.baklz4
Size 7KB
SHA256 d208ac006f3566347418508873c7cb79626c6a92b9c06319eb307d592aeda8e8
MD5 4372350506be418ecdf9debd0caab750
SHA1 5c1bb61962e3d30bb3e06582c99fbd7a0cc7b330
SHA512 36c417876288424b0eac5cce07b71ad51c722addcef9a75f184ef5407f6279dbe0f2e94a9fb68a4345b641b1767b44a579720d4cae4d82951a13cee0a55459e3
SSDEEP 192:7H/KVMlcX6JkHA9Oev+HC2P/faS5G4ESnU8k:7H/fSCkgqCA/faJ4jnU8k
MD5 SHA1 SHA512 SSDEEP

Submit Download

GandCrab.TLjsvDcQ.exe.part

Path C:\Users\Admin\Downloads\GandCrab.TLjsvDcQ.exe.part
Size 291KB
SHA256 bfb9db791b8250ffa8ebc48295c5dbbca757a5ed3bbb01de12a871b5cd9afd5a
MD5 e6b43b1028b6000009253344632e69c4
SHA1 e536b70e3ffe309f7ae59918da471d7bf4cadd1c
SHA512 07da214314673407a7d3978ee6e1d20bf1e02f135bf557e86b50489ecc146014f2534515c1b613dba96e65489d8c82caaa8ed2e647684d61e5e86bd3e8251adf
SSDEEP 6144:nSRCSpUtLz+/enihebWBUOP3yIhLVMmi0CtG7go+I:SUOEnNnHbmP3yIE3tGX
MD5 SHA1 SHA512 SSDEEP

Submit Download

Locky.9tce8Kc3.AZ.exe.part

Path C:\Users\Admin\Downloads\Locky.9tce8Kc3.AZ.exe.part
Size 181KB
SHA256 2e4319ff62c03a539b2b2f71768a0cfc0adcaedbcca69dbf235081fe2816248b
MD5 0826df3aaa157edff9c0325f298850c2
SHA1 ed35b02fa029f1e724ed65c2de5de6e5c04f7042
SHA512 af6c5734fd02b9ad3f202e95f9ff4368cf0dfdaffe0d9a88b781b196a0a3c44eef3d8f7c329ec6e3cbcd3e6ab7c49df7d715489539e631506ca1ae476007a6a6
SSDEEP 3072:hVingY1rYkIsBu0qhEEaXIwfBhZ1nJ7lUbKVjcApXH3nX:PigJkrBuAXpZ71nVlUbKtc
MD5 SHA1 SHA512 SSDEEP

Submit Download

Locky.AZ.exe:Zone.Identifier

Path C:\Users\Admin\Downloads\Locky.AZ.exe:Zone.Identifier
Size 220B
SHA256 47419905ee70e6eeb760f50b9acf1596be57f0c6bcd42c2273a8c8ea9a5a0f5f
MD5 1d9c94796c34c43cf2fcc4f0b9f88eab
SHA1 fb80e4edb4ab613448e5cd5c44ab9dc7dd70ff83
SHA512 01aa432ee05220956ba296f7fd1b96382aae53a97dfe21fb6495a7ea29472f7a1b329aa0f71bbf6ccb8a0aef1ea9e2ac43abaff089d3117125581c588ae81fd8
MD5 SHA1 SHA512

Submit Download

Unconfirmed 256801.crdownload

Path C:\Users\Admin\Downloads\Unconfirmed 256801.crdownload
Size 338KB
SHA256 d765e722e295969c0a5c2d90f549db8b89ab617900bf4698db41c7cdad993bb9
MD5 04fb36199787f2e3e2135611a38321eb
SHA1 65559245709fe98052eb284577f1fd61c01ad20d
SHA512 533d6603f6e2a77bd1b2c6591a135c4717753d53317c1be06e43774e896d9543bcd0ea6904a0688aa84b2d8424641d68994b1e7dc4aa46d66c36feecb6145444
SSDEEP 6144:sWmw0EuCN0pLWgTO3x5N22vWvLRKKAX5l++SybIvC:sWkEuCaNT85I2vCMX5l+ZRv
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1644-2660-0x000002297C760000-0x000002297C761000-memory.dmp

Download

memory/1644-2651-0x000002297C760000-0x000002297C761000-memory.dmp

Download

memory/1644-2657-0x000002297C760000-0x000002297C761000-memory.dmp

Download

memory/1644-2662-0x000002297C760000-0x000002297C761000-memory.dmp

Download

memory/1644-2661-0x000002297C760000-0x000002297C761000-memory.dmp

Download

memory/1644-2650-0x000002297C760000-0x000002297C761000-memory.dmp

Download

memory/1644-2652-0x000002297C760000-0x000002297C761000-memory.dmp

Download

memory/1644-2659-0x000002297C760000-0x000002297C761000-memory.dmp

Download

memory/1644-2658-0x000002297C760000-0x000002297C761000-memory.dmp

Download

memory/1644-2656-0x000002297C760000-0x000002297C761000-memory.dmp

Download

memory/4496-3855-0x0000000000400000-0x00000000052B3000-memory.dmp

Download

memory/4496-3841-0x0000000000400000-0x00000000052B3000-memory.dmp

Download