cryptolocker | hxxps://github[.]com/ytisf/thezoo

Resubmissions

26/03/2026, 18:52

260326-xjjawagv4t6

26/03/2026, 18:49

26/03/2026, 18:44

26/03/2026, 18:36

26/03/2026, 18:30

26/03/2026, 18:27

Analysis

user interaction
yes
max time kernel
119s
max time network
120s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
26/03/2026, 18:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://github.com/ytisf/thezoo
Sample260326-w3vbtabt5l

Score

10^/10

discovery cryptolocker persistence ransomware

Malware Config

Signatures

CryptoLocker
Ransomware family with multiple variants.
ransomware cryptolocker
Cryptolocker family
cryptolocker

Executes dropped EXE 4 IoCs

pid	Process
468	{71257279-042b-371d-a1d3-fbf8d2fadffa}.exe
3936	{34184A33-0407-212E-3320-09040709E2C2}.exe
4324	{34184A33-0407-212E-3320-09040709E2C2}.exe
412	{34184A33-0407-212E-3320-09040709E2C2}.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2023547815-1162023398-1465618254-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\CryptoLocker = "C:\\Users\\Admin\\AppData\\Roaming\\{34184A33-0407-212E-3320-09040709E2C2}.exe"	{34184A33-0407-212E-3320-09040709E2C2}.exe

Contacts third-party web service commonly abused for C2 1 TTPs 7 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
76	raw.githubusercontent.com
125	raw.githubusercontent.com
53	camo.githubusercontent.com
54	camo.githubusercontent.com
55	camo.githubusercontent.com
56	camo.githubusercontent.com
75	raw.githubusercontent.com

ConfuserEx .NET packer 1 IoCs

Detects ConfuserEx .NET packer.

resource	yara_rule
behavioral1/files/0x0004000000000745-1174.dat	ConfuserEx

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4052_1667276536\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4052_1531666769\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4052_1531666769\protocols.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{71257279-042b-371d-a1d3-fbf8d2fadffa}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{34184A33-0407-212E-3320-09040709E2C2}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{34184A33-0407-212E-3320-09040709E2C2}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{34184A33-0407-212E-3320-09040709E2C2}.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3480	msedge.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Winword.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	Winword.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Winword.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	Winword.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	Winword.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	Winword.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134190232499118681"	msedge.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2023547815-1162023398-1465618254-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2023547815-1162023398-1465618254-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2023547815-1162023398-1465618254-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2023547815-1162023398-1465618254-1000\{ADD76944-CB46-4070-8E97-50447D9D9D22}	msedge.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
4036	Winword.exe
4036	Winword.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4856	taskmgr.exe
4856	taskmgr.exe
4856	taskmgr.exe
4856	taskmgr.exe
4856	taskmgr.exe
4856	taskmgr.exe
4856	taskmgr.exe
4856	taskmgr.exe
4856	taskmgr.exe
4856	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1956	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeRestorePrivilege	852	7zG.exe
Token: 35	852	7zG.exe
Token: SeSecurityPrivilege	852	7zG.exe
Token: SeSecurityPrivilege	852	7zG.exe
Token: SeRestorePrivilege	1100	7zG.exe
Token: 35	1100	7zG.exe
Token: SeSecurityPrivilege	1100	7zG.exe
Token: SeSecurityPrivilege	1100	7zG.exe
Token: SeDebugPrivilege	4856	taskmgr.exe
Token: SeSystemProfilePrivilege	4856	taskmgr.exe
Token: SeCreateGlobalPrivilege	4856	taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
852	7zG.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
1100	7zG.exe
4856	taskmgr.exe
4856	taskmgr.exe
4856	taskmgr.exe
4856	taskmgr.exe
4856	taskmgr.exe
4856	taskmgr.exe
4856	taskmgr.exe
4856	taskmgr.exe
4856	taskmgr.exe
4856	taskmgr.exe
4856	taskmgr.exe
4856	taskmgr.exe

Suspicious use of SendNotifyMessage 54 IoCs

pid	Process
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4856	taskmgr.exe
4856	taskmgr.exe
4856	taskmgr.exe
4856	taskmgr.exe
4856	taskmgr.exe
4856	taskmgr.exe
4856	taskmgr.exe
4856	taskmgr.exe
4856	taskmgr.exe
4856	taskmgr.exe
4856	taskmgr.exe
4856	taskmgr.exe
4856	taskmgr.exe
4856	taskmgr.exe
4856	taskmgr.exe
4856	taskmgr.exe
4856	taskmgr.exe
4856	taskmgr.exe
4856	taskmgr.exe
4856	taskmgr.exe
4856	taskmgr.exe
4856	taskmgr.exe

Suspicious use of SetWindowsHookEx 47 IoCs

pid	Process
1956	OpenWith.exe
1956	OpenWith.exe
1956	OpenWith.exe
1956	OpenWith.exe
1956	OpenWith.exe
1956	OpenWith.exe
1956	OpenWith.exe
1956	OpenWith.exe
1956	OpenWith.exe
1956	OpenWith.exe
1956	OpenWith.exe
1956	OpenWith.exe
1956	OpenWith.exe
1956	OpenWith.exe
1956	OpenWith.exe
1956	OpenWith.exe
1956	OpenWith.exe
1956	OpenWith.exe
1956	OpenWith.exe
1956	OpenWith.exe
1956	OpenWith.exe
1956	OpenWith.exe
1956	OpenWith.exe
1956	OpenWith.exe
1956	OpenWith.exe
1956	OpenWith.exe
1956	OpenWith.exe
1956	OpenWith.exe
1956	OpenWith.exe
1956	OpenWith.exe
1956	OpenWith.exe
1956	OpenWith.exe
1956	OpenWith.exe
1956	OpenWith.exe
1956	OpenWith.exe
4036	Winword.exe
4036	Winword.exe
4036	Winword.exe
4036	Winword.exe
4036	Winword.exe
4036	Winword.exe
4036	Winword.exe
4036	Winword.exe
4036	Winword.exe
4036	Winword.exe
4036	Winword.exe
4036	Winword.exe

Suspicious use of WriteProcessMemory 60 IoCs

description	pid	Process	procid_target
PID 4052 wrote to memory of 4112	4052	msedge.exe	87
PID 4052 wrote to memory of 3480	4052	msedge.exe	88
PID 4052 wrote to memory of 4668	4052	msedge.exe	89
PID 4052 wrote to memory of 4668	4052	msedge.exe	89
PID 4052 wrote to memory of 4668	4052	msedge.exe	89
PID 4052 wrote to memory of 4556	4052	msedge.exe	90
PID 4052 wrote to memory of 4556	4052	msedge.exe	90
PID 4052 wrote to memory of 3316	4052	msedge.exe	92
PID 4052 wrote to memory of 3316	4052	msedge.exe	92
PID 4052 wrote to memory of 3316	4052	msedge.exe	92
PID 4052 wrote to memory of 3644	4052	msedge.exe	91
PID 4052 wrote to memory of 3644	4052	msedge.exe	91
PID 4052 wrote to memory of 3644	4052	msedge.exe	91
PID 4052 wrote to memory of 4132	4052	msedge.exe	94
PID 4052 wrote to memory of 4132	4052	msedge.exe	94
PID 4052 wrote to memory of 4132	4052	msedge.exe	94
PID 4052 wrote to memory of 2996	4052	msedge.exe	95
PID 4052 wrote to memory of 2996	4052	msedge.exe	95
PID 4052 wrote to memory of 2996	4052	msedge.exe	95
PID 4052 wrote to memory of 2868	4052	msedge.exe	98
PID 4052 wrote to memory of 2868	4052	msedge.exe	98
PID 4052 wrote to memory of 3432	4052	msedge.exe	100
PID 4052 wrote to memory of 3432	4052	msedge.exe	100
PID 4052 wrote to memory of 1208	4052	msedge.exe	102
PID 4052 wrote to memory of 1208	4052	msedge.exe	102
PID 4052 wrote to memory of 3208	4052	msedge.exe	101
PID 4052 wrote to memory of 3208	4052	msedge.exe	101
PID 4052 wrote to memory of 4224	4052	msedge.exe	104
PID 4052 wrote to memory of 2284	4052	msedge.exe	105
PID 4052 wrote to memory of 2284	4052	msedge.exe	105
PID 4052 wrote to memory of 3804	4052	msedge.exe	106
PID 4052 wrote to memory of 3804	4052	msedge.exe	106
PID 4052 wrote to memory of 1264	4052	msedge.exe	107
PID 4052 wrote to memory of 1264	4052	msedge.exe	107
PID 4052 wrote to memory of 3484	4052	msedge.exe	108
PID 4052 wrote to memory of 3484	4052	msedge.exe	108
PID 4052 wrote to memory of 4156	4052	msedge.exe	109
PID 4052 wrote to memory of 4156	4052	msedge.exe	109
PID 4052 wrote to memory of 2996	4052	msedge.exe	125
PID 4052 wrote to memory of 1480	4052	msedge.exe	126
PID 4052 wrote to memory of 5060	4052	msedge.exe	127
PID 4052 wrote to memory of 3160	4052	msedge.exe	128
PID 4052 wrote to memory of 3160	4052	msedge.exe	128
PID 4052 wrote to memory of 3160	4052	msedge.exe	128
PID 4052 wrote to memory of 4200	4052	msedge.exe	129
PID 4052 wrote to memory of 4200	4052	msedge.exe	129
PID 4052 wrote to memory of 4764	4052	msedge.exe	130
PID 468 wrote to memory of 3936	468	{71257279-042b-371d-a1d3-fbf8d2fadffa}.exe	137
PID 3936 wrote to memory of 4324	3936	{34184A33-0407-212E-3320-09040709E2C2}.exe	138
PID 4052 wrote to memory of 732	4052	msedge.exe	141
PID 4052 wrote to memory of 732	4052	msedge.exe	141
PID 4052 wrote to memory of 712	4052	msedge.exe	147
PID 4052 wrote to memory of 712	4052	msedge.exe	147
PID 4052 wrote to memory of 5060	4052	msedge.exe	148
PID 4052 wrote to memory of 5060	4052	msedge.exe	148
PID 4052 wrote to memory of 5060	4052	msedge.exe	148
PID 4052 wrote to memory of 2352	4052	msedge.exe	149
PID 1956 wrote to memory of 4036	1956	OpenWith.exe	152
PID 4052 wrote to memory of 3544	4052	msedge.exe	158
PID 4052 wrote to memory of 3544	4052	msedge.exe	158

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/ytisf/thezoo
1⤵
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x260,0x7ffe8a5dc188,0x7ffe8a5dc194,0x7ffe8a5dc1a0
  2⤵
  PID:4112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1980,i,15871113642758327781,16060005365580994281,524288 --field-trial-handle=2856,i,11725186742873842121,527872479977022948,262144 --variations-seed-version --mojo-platform-channel-handle=2976 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1736,i,1992110784983754502,17696042129308234400,262144 --field-trial-handle=2856,i,11725186742873842121,527872479977022948,262144 --variations-seed-version --mojo-platform-channel-handle=2836 /prefetch:2
  2⤵
  PID:4668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2304,i,5017249500044379309,11392829643809264568,524288 --field-trial-handle=2856,i,11725186742873842121,527872479977022948,262144 --variations-seed-version --mojo-platform-channel-handle=2984 /prefetch:8
  2⤵
  PID:4556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=2796,i,6335531819033671956,545455253213111205,2097152 --field-trial-handle=2856,i,11725186742873842121,527872479977022948,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:3644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3460,i,1457861849970199573,14674601665930216789,2097152 --field-trial-handle=2856,i,11725186742873842121,527872479977022948,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:3316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4176,i,15168812243812117882,7541633878853039879,2097152 --field-trial-handle=2856,i,11725186742873842121,527872479977022948,262144 --variations-seed-version --mojo-platform-channel-handle=4184 /prefetch:1
  2⤵
  PID:4132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4200,i,17343167031849007831,4794925560555501932,2097152 --field-trial-handle=2856,i,11725186742873842121,527872479977022948,262144 --variations-seed-version --mojo-platform-channel-handle=4204 /prefetch:2
  2⤵
  PID:2996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3876,i,14811695649867705687,8356420116326492342,524288 --field-trial-handle=2856,i,11725186742873842121,527872479977022948,262144 --variations-seed-version --mojo-platform-channel-handle=4152 /prefetch:8
  2⤵
  PID:2868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5264,i,12681207692872566969,9954798064755351099,524288 --field-trial-handle=2856,i,11725186742873842121,527872479977022948,262144 --variations-seed-version --mojo-platform-channel-handle=5276 /prefetch:8
  2⤵
  PID:3432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5184,i,293876852058501225,15955845248998994342,524288 --field-trial-handle=2856,i,11725186742873842121,527872479977022948,262144 --variations-seed-version --mojo-platform-channel-handle=5424 /prefetch:8
  2⤵
  PID:3208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3900,i,7033875116572204597,3215744576907358027,524288 --field-trial-handle=2856,i,11725186742873842121,527872479977022948,262144 --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:8
  2⤵
  PID:1208
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5896,i,11165644051448935097,10077653091529468660,524288 --field-trial-handle=2856,i,11725186742873842121,527872479977022948,262144 --variations-seed-version --mojo-platform-channel-handle=5912 /prefetch:8
  2⤵
  PID:3572
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5896,i,11165644051448935097,10077653091529468660,524288 --field-trial-handle=2856,i,11725186742873842121,527872479977022948,262144 --variations-seed-version --mojo-platform-channel-handle=5912 /prefetch:8
  2⤵
  PID:4224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6088,i,3275252475283907373,8993170929030604708,524288 --field-trial-handle=2856,i,11725186742873842121,527872479977022948,262144 --variations-seed-version --mojo-platform-channel-handle=6084 /prefetch:8
  2⤵
  PID:2284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6356,i,12386424340539271889,6938463115152043975,524288 --field-trial-handle=2856,i,11725186742873842121,527872479977022948,262144 --variations-seed-version --mojo-platform-channel-handle=6096 /prefetch:8
  2⤵
  PID:3804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6088,i,2994121510329620596,15872566857067681826,524288 --field-trial-handle=2856,i,11725186742873842121,527872479977022948,262144 --variations-seed-version --mojo-platform-channel-handle=6492 /prefetch:8
  2⤵
  PID:1264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6088,i,14356149586454730664,16671014932796337575,524288 --field-trial-handle=2856,i,11725186742873842121,527872479977022948,262144 --variations-seed-version --mojo-platform-channel-handle=6528 /prefetch:8
  2⤵
  PID:3484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6468,i,16255142696363653387,10233328592756790173,524288 --field-trial-handle=2856,i,11725186742873842121,527872479977022948,262144 --variations-seed-version --mojo-platform-channel-handle=6444 /prefetch:8
  2⤵
  PID:4156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5924,i,10664506584834589301,8001913753724379548,524288 --field-trial-handle=2856,i,11725186742873842121,527872479977022948,262144 --variations-seed-version --mojo-platform-channel-handle=4848 /prefetch:8
  2⤵
  PID:2996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4232,i,9441518301146137794,12616544555337576978,524288 --field-trial-handle=2856,i,11725186742873842121,527872479977022948,262144 --variations-seed-version --mojo-platform-channel-handle=5996 /prefetch:8
  2⤵
  PID:1480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5952,i,321414093993195738,16040390686873097724,524288 --field-trial-handle=2856,i,11725186742873842121,527872479977022948,262144 --variations-seed-version --mojo-platform-channel-handle=4976 /prefetch:8
  2⤵
  PID:5060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=6080,i,15915229283118511944,18005434199616025168,2097152 --field-trial-handle=2856,i,11725186742873842121,527872479977022948,262144 --variations-seed-version --mojo-platform-channel-handle=4996 /prefetch:1
  2⤵
  PID:3160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3532,i,5891906500136138437,13305158913575968195,524288 --field-trial-handle=2856,i,11725186742873842121,527872479977022948,262144 --variations-seed-version --mojo-platform-channel-handle=6632 /prefetch:8
  2⤵
  PID:4200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6464,i,14565299379432466792,296703861590726664,524288 --field-trial-handle=2856,i,11725186742873842121,527872479977022948,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:8
  2⤵
  PID:4764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4912,i,12835117969531892971,10666942566695800479,524288 --field-trial-handle=2856,i,11725186742873842121,527872479977022948,262144 --variations-seed-version --mojo-platform-channel-handle=4900 /prefetch:8
  2⤵
  PID:732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4160,i,7947668429537375331,7936970077334682807,524288 --field-trial-handle=2856,i,11725186742873842121,527872479977022948,262144 --variations-seed-version --mojo-platform-channel-handle=2632 /prefetch:8
  2⤵
  PID:712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=2632,i,13250361196370460841,13579561522813458475,2097152 --field-trial-handle=2856,i,11725186742873842121,527872479977022948,262144 --variations-seed-version --mojo-platform-channel-handle=6024 /prefetch:1
  2⤵
  PID:5060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2176,i,4351968217425753081,12952170412283281790,524288 --field-trial-handle=2856,i,11725186742873842121,527872479977022948,262144 --variations-seed-version --mojo-platform-channel-handle=5748 /prefetch:8
  2⤵
  PID:2352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2172,i,7013575487084565516,1265058710335232905,524288 --field-trial-handle=2856,i,11725186742873842121,527872479977022948,262144 --variations-seed-version --mojo-platform-channel-handle=6848 /prefetch:8
  2⤵
  PID:3544

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4496

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:556

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\CryptoLocker_10Sep2013\" -spe -an -ai#7zMap7826:106:7zEvent22688
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:852

C:\Users\Admin\Downloads\CryptoLocker_10Sep2013\{71257279-042b-371d-a1d3-fbf8d2fadffa}.exe
"C:\Users\Admin\Downloads\CryptoLocker_10Sep2013\{71257279-042b-371d-a1d3-fbf8d2fadffa}.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:468
- C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe
  "C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe" "/rC:\Users\Admin\Downloads\CryptoLocker_10Sep2013\{71257279-042b-371d-a1d3-fbf8d2fadffa}.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3936
- - C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe
    "C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe" /w0000021C
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4324

C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe
C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:412

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Ransomware.Jigsaw\" -spe -an -ai#7zMap14306:96:7zEvent21628
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1100

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1956
- C:\Program Files\Microsoft Office\root\Office16\Winword.exe
  "C:\Program Files\Microsoft Office\root\Office16\Winword.exe" /n "C:\Users\Admin\Downloads\Ransomware.Jigsaw\jigsaw"
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of SetWindowsHookEx
  PID:4036

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4856

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4052_1531666769\manifest.json
Size 135B
SHA256 ba5c9096d20a482aaa1aa9e5f98ad6127d3e97c2f21de84f7c78d9b8073c8e26
MD5 fbebd68ecaa98928909421f66909c054
SHA1 99d787d90f7ed2e5ad924f9c5668eb988b5a6c07
SHA512 749a3b2be47fe28399dc763888654a3e8d397e06e8d3c3af3965bb45846a1336e6ab4ca82c82c3df846b34a2afafa2156f2690e9bf347ab175408dc0171c61cc
TLSH
T158C04C668D51DEAB00A747A56B295315E23B4B4B5044800A7AF5429C1A288964171944
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4052_1667276536\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 6f351f89098ca8fac90536f0b67e046f2c8529e7a0c9b00961e9e8c4049abd60
MD5 5eefff91fdb70636523dd375644e9001
SHA1 0279f72391b71667d1128ff21dbcf2802b07cae7
SHA512 84633eac45ee4ca84488bd6889c589be18aaacb93ede1c479051d4177122b08bc6d0815a9b79daa85ef71794891c8ec0407823a3107458e21f92641f37c0dad3
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7X:fwUQC5VwBIiElEd2K57P7X
TLSH
T1E4B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

protocols.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.10\protocols.json
Size 3KB
SHA256 4fd800e7b1a5fb24b13fac2e31946d205012b7c28d8c61580b0669b2fa3517cc
MD5 1de85fec2dfcc28011a7c2aaab95eb5f
SHA1 80e8c954bfbe8f7ee5a2335c8d969ae033935dc3
SHA512 9c7dd37eb0c094b6aa05201e7c71a8f33b9db81284223bcfa595a44a6ac95d5a6820ab6f07b7aa8d26bf207454e94277bf35332e9c009ee63f083752b6b51750
TLSH
T1D1611DB79A3048090E3412B86B19B35DF63E029F1AD598EB76BE568F1F710F7245C54C
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 cb613b38f1a2ef1d7f968013bee137482fd7f1b9ac432a185349ca7af1ddcc5c
MD5 5dfb75fa7d9c19610e7a0e36c8fa9ace
SHA1 2f2d9fafddeb0f80dc320ff1d41637d357584567
SHA512 2904ecccd4a8f7dfd1766d00e6bddd938f2984761d9b3102096a47d7382d9e1cc7e5e47e090e15e9a0a873b8b21bbb08944fb8fabdf711977ca38d16408fc276
TLSH
T132D0228820080C32E0AEA033888ABBCA2008CA0288038AB200B3288C0C830A0220A08A
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 d704323915043d1e8ba1ac67c2c0cea4747fce2ec5dd1d452c54d67cdaa364da
MD5 9ecee64956ff7a6628d57b9d63536204
SHA1 124118908026144deced68554ae4d8aee4ccaad4
SHA512 5b6dcfdfbbcda770e04e542bfabf560ed4c2de634818798ce6a80545b8d4d2d3490a5dbaa210ed0a734269aee2b39bac9064b4c4a1b15d7894df5aea29ed2ac0
TLSH
T15CD02B8810440C31D4AD603344897BC61004C9014403C7720073144C0C430A0220A046
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 7KB
SHA256 4bea929933e9862fcbf3a92e3791aa742a02bcf12f93b5fd7134a6d4d66273f4
MD5 d0abd8e0e28990e68cded634b7f7faa3
SHA1 6d0bbb832b5288fd1060d312780a76c4945644b9
SHA512 d6c4e683843421f644bd370308c416a857b0cfec49fe2d69cb0674fa3314963f1ffa7bc16583e2d3a6be5d6680474a1262ea63aa54507cd8c3b647683dd98de3
SSDEEP 96:SsxXQP1IMj4GR/0aZ3De6YdJAlSBsJ5gt9e4+pVAHtYgBiLypS2+d7gEZz/yA5Ua:XXQZMkLZ3W0SB+L4+pVUTBiLyKDIPQuw
TLSH
T180F1E9E4CA41CC14E7E5513225D55B8AB27CAB24208B7FE631B804BEAD9AF1C743C4BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe587838.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe587838.TMP
Size 3KB
SHA256 21a1fdc3f0f3d1f694f7cd1cd2318bdc05440b474ffee7d80fc88d339828bb73
MD5 471441261eea636fb19b15d15d3d0b7a
SHA1 e70c80530d109bbe68a40bacda37fbfe87039083
SHA512 e9091eda9a89720e1250bf4a1df1b5a91658254cf9505671b48b8024be2a45d9e762dcbcef3dfea197692720b877678ce5c71700ad2aa768b2b79bfbe67cda86
TLSH
T1B961F9B4C396A415EBE851B176DA24DF72704B68048B0FEA31F951FFEA0AF6271800F0
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 47ee188f5bfabd125a719d00da1392392677b9831323ec6a1ee22f1a7c9c9b15
MD5 1b5f66644a495b411c2b7d7c5e3b4d2f
SHA1 fed468c2c6a49663afb2d93b1e7a6713ab17734b
SHA512 53c181fa6700f2e0ed564246b2764a4bcc7e0325884a24540e885fbf4e375142d08a2a62307a80b53426add89965f23db6c6d2d31be5158476e4fd7442c816a8
TLSH
T13E618CF783E5856D8A1295F0AA18EE1BCE2D0524831C3C6A89E4BE5BD3E3871E14175F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
MD5 807419ca9a4734feaf8d8563a003b048
SHA1 a723c7d60a65886ffa068711f1e900ccc85922a6
SHA512 f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
TLSH
T18DB01269E5507CFF074A83A41428B463C3FF0047421C8ABEEA3873AD42A21FE0828C57
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 7d9f0e59377b87fd2d97bf352266cb05bcf3615f13d7ca5d9089077d2d0a8dfe
MD5 33780cfb4e07a06862317ac2cc12aedc
SHA1 e23a6e5d646715bf1e11ea1a69eb9720bab77dcd
SHA512 6049f9f8ba4f3e84c8f61eadf5d71f0b57e7a88bbe2837b01c4fcf4ce6078e19ad38548e0135861e7e94459adc55f9cc38895ce23f48b01f90956a0b95925439
SSDEEP 192:sxZnRDyM//K1Ml8Mk3/f5sz0nO7r0l6oIdp9JLHW6+WNYkK/YBkl33fXZIg4J:sxZnnM3/f5sYnOUl6ZXHba/B9c
TLSH
T12252FA156A386977CCDBD209FA45BB53E6F50522E1940D48AEFCCE0C04E6BED620781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 bf0cfcc6e44af56b009cd23b6ed5539601395eae526813d365ac2a69950cb48b
MD5 e45ed4b9719136e78a7dad668ef8cf23
SHA1 2eb51015354ce7b4ff31db5ed049a0d91a6daa26
SHA512 46eabec6f5098bfa9df4f27c6f604e1d9f86c5e6065189c90f3bf9289f9dd63e205b9d93cc3d4806b836f33ebcb36d23c1275266b93a63613d23c1ad2603dd29
SSDEEP 192:sxZnRDyM//K1Ml8Mk3/f5sA0nO7r0l6oIdp9JLHW6+WNYZeXYBkc3fXZIg5jGJ:sxZnxM3/f5sznOUl6ZXHbDXW1S
TLSH
T1E352E915AA386977CCDBD209BA45BB53E6F50526D5940D48ADFCCE0C04E6BED720382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 2071140a4588b62bef178163b64449d438ee762c8b8651b21f75dc0cf7ed4562
MD5 21c26bb2d693d1e5f26960419fe31aac
SHA1 28f634e6e9d16a7a192dd47e66c918930f458c83
SHA512 cf5a6e63b29e24e96be0737469f5d252967118ea6f57f120d5c2e98b106d7bb1cb67899b2f4f899168390af2f42bfc68cad3e0e4b8a262a485f8ff94d419747b
SSDEEP 192:sxZnRDyM//K1Ml8M93/f5sA0nT7r0l6oIdp9JLHW6+WNYjIEZYfjPk1y3afXZIgB:sxZnx13/f5sznTUl6ZXHbirZIyv1P
TLSH
T14C62EA55AA386977CCDBD209BA45BB53E6F51427D5940E489EFCCE0C00E6BED620381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 98538e0951a6033a5398f2fa4e85d863ab9f921991282ae85c92ebfbd4a5718d
MD5 deacac994d2b36bf95da280488812779
SHA1 794e25aaebced64c944ff5ec44e819647f44ba60
SHA512 83f4f6bcc40a14283e70b5baae89a37a093a33d4c52d46afb8efdcfee3f27de827e8715c60e07be07833203dfcf1b4b50265ebf282c438d3b7d00971d043f22c
SSDEEP 768:z3U2JeCv7pLuLv7nWvB3u/8F1+UoAYDCx9Tuqh0VfUC9xbog/OVgj0sLl4CpR8ri:z3U2JeCpEv7nWvB3u/u1ja1j0sLiaRnl
TLSH
T106F21C3B2C4CCB7E4F804E9CEC2A7E9E6DE8018B96D8895447F9844C03C66EF55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 2425d183c1baaf0fd9b3cd112b39253900706356e201018017c85704cce6d3e0
MD5 8af13bc953c18a5e5ba7c9957d28072e
SHA1 bb313806f42220cd7bbcfe6d3aeb7885d8affde7
SHA512 fc38baa89864bcf275c322ed748f1753ff8e75ba0d87eddb262d34137812a329781c3975286ff1bc1290ad67baa25e6952e76ba5abb8c66082e1c12abab795d4
SSDEEP 96:K88gKFGNKMAKtCGu76K44mXuKgA2u3OKIIO:KMHrF0NF3
TLSH
T18CE1F511717B12803A7E299EA855F42E56C530A33058F4AB3FF904A60F67E60DDFE8D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe58f661.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe58f661.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 23KB
SHA256 a6b0046f1f7a48bcd027d04ec23267d7bb963c4910ed76cfc86692931a1b13e8
MD5 31f8359cac5fed6a67b9fa17e31de652
SHA1 b55331529c712cb104dec4789fe273fac8ed24a0
SHA512 1df6e52b68baddf361aa5d44afbbae4626de86b96cb21fc15888f9b186599ecfa58882eb1a9a35073d1796e83451526ea39f54880fcf5c7dcbff3e5d64303243
SSDEEP 384:nEiFwTumV7IhV2o8ysNc8TUNTUlIlqOEMr/BDfwt/j2srusH/uO2eN8h9x5xwl2k:fF56IDNBxwgvdut/l1H/XN8hRGAk
TLSH
T1A1B23979D8A4EA2BEEE74BC5F31AB257AEE0106789991DD8DED85E0C00C72DD1307C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 29KB
SHA256 92e4b7d3df9ba77256a9b65f8327637a047a1908287791d1db40cc79e0d0bd85
MD5 24b60f734cdc26cf2ae15b234b268ba8
SHA1 04cc1741d4e9a0724590ad9b481f926a15466c0f
SHA512 d8ead7c69e2b2bfacc894f32142b58e8edb81f2b4759bf40b1bbfa29700f78444f7d82bcdc382259265e9a7a60d343251c85113d07a667ed395e0445071b8bb5
SSDEEP 384:nEiFyTumV7IhV2o86sNv8TUNTUlIlqOEEq/Bifxt/j2srusH/uO2lN8h9x5xwl2k:fFb6IDNF0wgvoyt/l1H/yN8hRGAk
TLSH
T1F7D2A2F598D79936E9AE4B87A33E7E029EBCC05774881984BBD85D0CCC861BFD306811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 29KB
SHA256 c76aca57ea5d1912bae213cab8785a3d6117791942d3ba031aaef2e427010a65
MD5 9046756ff0f0e3cf496dd53de7be0537
SHA1 9b6cade3b0cc858c3ce76316d91643367b03a907
SHA512 f15c75e45f8de154ce7b60f7471ca5a6d9f4552eb9b68da254ba74b3c43a0b46af28f1ac2ea3a77d279f5cbdb1f48e969553da324164f7ceb7c37d2a15aae74a
SSDEEP 384:nEiFwTumV7IhV2o8ysNv8TUNTUlIlqOExq/BDfxt/j2srusH/uO2ON8h9x5xwl2k:fF56IDN90wgvf/t/l1H/pN8hRGAk
TLSH
T123D2A2F598D79936E9AE4B87A33E7E029EBCD05774881984BBD85D0CCC861BFD306811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 aa68de7e7ed168c0fae54d872f52a7f7c3a457096843f52749faf4f1350221f8
MD5 402ff7a7bc9c97e874d1e7d001699564
SHA1 2f6542793535331b42c0849fd763beca1ccb47f9
SHA512 91efbcdf6f0103ca9fca16c481aefc8c9fedc9c897700101cf546872e943389bf26ecebeac148e14e24ccb14a3c8f2ba922fe694533999c5bcb51e5e6b1bdac0
SSDEEP 192:tONg6xIQmiUyBlM8R/j2wzASus60ldWHnFU6:tONg6a0MW/j2srusHmFU6
TLSH
T17B02D739682D7C7BDEF36E45F68677239FD4203BA9512F48DAE85E1D00D759C2302826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 fa1933277bbafd9dc01312c4e2c138ece0ff7d862135402b7c1137ddfdcb61a7
MD5 7d13fef2962f92b7b1b3e4e4b2f83b33
SHA1 75e061fc12c7bd4239863fbe4125f2726e708ebe
SHA512 1bcda23063cf3ed6a54575891ccfeb06f9d5c9cab11156a7ec35b2748c6470137f7c7b7fcec471b4642d936e62a0e5b8c628318bdf3b6609be07262c01db7b8b
SSDEEP 192:MONF6xZQmiUyQld8R/j2wzASus60lUSuO2R6sBq4U6:MONF6JrdW/j2srusH/uO2NNU6
TLSH
T1AB120A34682CBCA7AEF26E95F24772239FE4202BA9552F44D9E85E1C00DB55C2316C36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 9b7d5538b8138a1322055bd774f9390484379fc71ff5108cb1089ef39b5a7387
MD5 b593defe476755cd7b15e69d4cef3f79
SHA1 7095447f3bc7d4152e456d5b6421db3fda069480
SHA512 7b86b37d28d2c696b57d3d8c0d6e7a46d75c9592734dd214ae5518882b2157ddc91de96a2422f9a074f31ba413d3b19c4e198ae12f88e943a82ee7c642a67360
SSDEEP 384:nKTumV7IhV2ofsNUvOEyr/h/j2srusH/uO2QN8h9x5xwl2k:T6IDNfOfJ/l1H/TN8hRGAk
TLSH
T196827E7528687C679BA76B95F31B72136FF4103B89952E58DEEC9F0D00CB29C2317826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 7527ddfe047fc5016ee5b8cbb865aa95bdec9bb723b797fb291bb69853672245
MD5 7998aa2b6b93ec2383ea92bbf63bf955
SHA1 932a0b2c70036a2ff49e117766067b8d7c41cfb5
SHA512 82f30de0f5cea4c354920b1667c9cceebc07c0b373ece923b078193e1cacf8c58ec9e6e87550553af90c587917bdeb5f5d7e28f2c5b174bad109cf80863a5b7a
SSDEEP 384:n1TumV7IhV2oxsNUqOEFr/h/j2srusH/uO2QN8h9x5xwl2k:I6IDNxluJ/l1H/TN8hRGAk
TLSH
T1EE827F7968687C67DBA76B55F31B72136FF4102B89951E58DEEC9F0D00CB29C2307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 50fef4711d484b87f65b30fcdfa37b815491cde6a217cdb4ee82d08013aa4577
MD5 33e42a6d3f035a0614ffa9bf941d96b6
SHA1 f946cc0641379cf7f49fc047dcda92700ade5777
SHA512 121e0da6b2e0af24fc072fdb5affb651cc43ee4a9c44b11b050a95d165299c5ab2f85703db4f3b7221ecc4d5c1f1608aee3eecfebd2dbbedd36a02dee16469aa
TLSH
T196E00242D30000B6C02C033410C31F103FB2C02023D3034A9B30017D7C357083D39D40
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 462afd66848a5e601696f86d3930f4394c2030bf57e5d7abf94257cf419c78df
MD5 fe35673e636293f5d6c1772d6fc0b1d9
SHA1 bb2371c5dec55b2256c9bab16713e7735df202eb
SHA512 d3f3280af6407d2f4b8371d816538f5893629b050ad602b1b83b4c8ebd76956391c442ce5d4a72bff1994497bd18314a6cb8a795882a0ceb11d1c087aaf5e5bb
TLSH
T15CE00142930040BAC02C133450C31F203FA2C02023E2034A9B30016D6C367083D3AE81
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 d4c1df5d752a160f93b7e93daefb7ec402137e5ffe5baaa97bb8ace75d94c5c0
MD5 42414cfa5620140de8b415aa15636fb2
SHA1 784ab5723e5c668b101a3d7a29f4fbdf3bbbe9bd
SHA512 4b3865a2c0bc4deaa50127fe893436369f3d301cd28f409f9b1eb43d42b47ab0bdf28c12e6a9c102a7907b2fadda3a9c7239357030711fb5df1a421ae1b5ce02
TLSH
T1FBE00441D1000074C03C033410C31F103DD1401031D1034CD730015D7C3550C3D3DD40
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe586f7e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe586f7e.TMP
Size 392B
SHA256 11e8719c58b0cb5869c42d39d2ba9fde9673a1bf9bb849b11468e267519c0158
MD5 67cff92f0b99f6970f926f3df1dbfc0c
SHA1 4f1194d4d81bd2ee29a0c21977ca796bd9d81753
SHA512 ce49c7608e1a0e5e4878a877546ac7c43322edd62d973705a046d05a25903fcc5f01c1c4075eb0df2cc8e9bfddd3c70b002d0a63918bc3012879df47c3070c1c
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

07e1ee38-474b-46fb-9313-baa8cdd68aea.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\07e1ee38-474b-46fb-9313-baa8cdd68aea.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 91b6539f482b020e70e69be04fe80710ebc6b368bc64b7129de9abc9ba1bd1ce
MD5 f4987d6606db4d9232688e43c1f970f1
SHA1 01f5b795fdc335eb59eabd01630d6f39711e3a7e
SHA512 fb58dba02d28011369a7b74d0428548cd18c44d88f173965b04e432004ccdc417fc881d67b033eba68efc78b11f97ecdfbb4dee337db7864ffb83705730f19f8
TLSH
T143412A48B6E9114CB3B76F4BAFF6686E487FB9732E16D45E11110E8F0A22A40C971737
MD5 SHA1 SHA512 TLSH

Submit Download

8b0d4544beb97a69dbb9583fca5575a9aba6e37d.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\8b0d4544beb97a69dbb9583fca5575a9aba6e37d.tbres
Size 2KB
SHA256 c07aca3383eaf0a4ce5333ac8a65d5425871b3d68e3d090116e4e0d0346ef93b
MD5 178eb4629faff2b37b4ad9b83b50e15f
SHA1 b2c1a58f470e006a46a5d40533d4c251d41ee554
SHA512 17ad0f0f178d92961c6bb944c3048d256661a0067c05f0da9a81c8ba4f951dc57f6e5b84f2825de7577bc513b2328ca272b401afd416725ce07ca24071ab4a2b
TLSH
T1EE517E5C76E95059B3B36F5A9BF6B86E48BBBD733A46C49D00110E4F0922A40CD61737
MD5 SHA1 SHA512 TLSH

Submit Download

a20fa551-86db-47eb-a54b-068d9eff44bd.tmp

Path C:\Users\Admin\AppData\Local\Temp\a20fa551-86db-47eb-a54b-068d9eff44bd.tmp
Size 146KB
SHA256 ec68b308c1b5444ed4d179df510a843fe2d464fefb631f11fd4b9310fda986bd
MD5 fa032a5db34ff20ecbcb6654b02cd7c7
SHA1 3a0c7141dc03421536419c33cb5f9ebd5a4e0289
SHA512 3a3d99e5b9794db882760f754b9b58bebf77e88ce8d0bef61f3ae82c4d3c9631e524a98389f74f7f9215674d60a6d06c10b9e5d0760c908dc19412955ea8522e
SSDEEP 3072:Hl6RntNhz5AkVuPmNptLSZPunVlkDS6it9TyZpd21+PIpGE8aK5KyTmBpw:HM3z5A41L+gXkDS624Xwp1XKgyKzw
TLSH
T170E3E16C6EEAC81AD10F60BA795DB08FC8068F16C107645FB2558418CA64B8D57E2FFF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eff710b2-881b-4642-9986-1ee092844725.tmp

Path C:\Users\Admin\AppData\Local\Temp\eff710b2-881b-4642-9986-1ee092844725.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

7b4532b1-44ac-455a-9ea9-d301805a98f8.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4052_849085825\7b4532b1-44ac-455a-9ea9-d301805a98f8.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4052_849085825\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CryptoLocker_10Sep2013.zip

Path C:\Users\Admin\Downloads\CryptoLocker_10Sep2013.zip
Size 282KB
SHA256 ddb9b850fa0eee2f62463728b07bffc11eaa9b241d215029eaddf1de4ec54936
MD5 22078ff56e3fcd674ec4b9322a7dee5b
SHA1 3a5d07577b40e85047dcfb0bd03a6fc23e7cc671
SHA512 6e1f260057ba8f8eb4568fac513f0b49094ae387d9a555c2600a75df00d1c091506e77dab58f36908b1c0cbfebb1d82984f915741c1a8b790f5f6c82f64add5e
SSDEEP 6144:WUCoUrZ5JGadcmBrwTbp7zgJxhlgL4U569Lmg7KCrrJRj+AP8:WUgrfJGadfByZzgJxhl1U569Lf7KCGA0
TLSH
T1965423D1331121E26C9322495B2BC867B43F3356D448F32A26B942A574BA5D98EF3F47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{71257279-042b-371d-a1d3-fbf8d2fadffa}.exe

Path C:\Users\Admin\Downloads\CryptoLocker_10Sep2013\{71257279-042b-371d-a1d3-fbf8d2fadffa}.exe
Size 338KB
SHA256 d765e722e295969c0a5c2d90f549db8b89ab617900bf4698db41c7cdad993bb9
MD5 04fb36199787f2e3e2135611a38321eb
SHA1 65559245709fe98052eb284577f1fd61c01ad20d
SHA512 533d6603f6e2a77bd1b2c6591a135c4717753d53317c1be06e43774e896d9543bcd0ea6904a0688aa84b2d8424641d68994b1e7dc4aa46d66c36feecb6145444
SSDEEP 6144:sWmw0EuCN0pLWgTO3x5N22vWvLRKKAX5l++SybIvC:sWkEuCaNT85I2vCMX5l+ZRv
TLSH
T14F74E073B4919525E9E04DB4F6B9BD324639B8396F3D4BC792842D4E04701CBEAB9383
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ransomware.Jigsaw.zip

Path C:\Users\Admin\Downloads\Ransomware.Jigsaw.zip
Size 239KB
SHA256 86a391fe7a237f4f17846c53d71e45820411d1a9a6e0c16f22a11ebc491ff9ff
MD5 3ad6374a3558149d09d74e6af72344e3
SHA1 e7be9f22578027fc0b6ddb94c09b245ee8ce1620
SHA512 21c21b36be200a195bfa648e228c64e52262b06d19d294446b8a544ff1d81f81eb2af74ddbdebc59915168db5dba76d0f0585e83471801d9ee37e59af0620720
SSDEEP 3072:p7ykj3uuY4NsJD7kPdSRQLqas/pkPm9jvkEL60Uf7k2BgS6/aFybrNN5ZAdNstk7:p7ym3VNA7w8R5/rxv7O0yng0UtVw5NJ
TLSH
T1263423121BD13B4CDD6F7C19DCCFA43DD3B62D4DE08A069979AA990E0E0E0A1E9F1D06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jigsaw

Path C:\Users\Admin\Downloads\Ransomware.Jigsaw\jigsaw
Size 283KB
SHA256 3ae96f73d805e1d3995253db4d910300d8442ea603737a1428b613061e7f61e7
MD5 2773e3dc59472296cb0024ba7715a64e
SHA1 27d99fbca067f478bb91cdbcb92f13a828b00859
SHA512 6ef530b209f8ec459cca66dbf2c31ec96c5f7d609f17fa3b877d276968032fbc6132ea4a45ed1450fb6c5d730a7c9349bf4481e28befaea6b119ec0ded842262
SSDEEP 6144:7fukPLPvucHiQQQ4uuy9ApZbZWxcZt+kTfMLJTOAZiYSXjjeqXus:7fu5cCT7yYlWi8kTfMLJTOAZiYSXjyqX
TLSH
T110549D9C366076EFC867D476DEA81CA4FA6078BB832B8207901715EDA90D997CF141F3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/412-1056-0x0000000002F10000-0x0000000002FA6000-memory.dmp

Download

memory/468-1053-0x00000000030F0000-0x0000000003186000-memory.dmp

Download

memory/852-1045-0x0000020406A70000-0x0000020406B1D000-memory.dmp

Download

memory/1100-1155-0x000001B5A1190000-0x000001B5A123D000-memory.dmp

Download

memory/1956-1181-0x0000027318DA0000-0x0000027318E4D000-memory.dmp

Download

memory/3936-1057-0x0000000002CD0000-0x0000000002D66000-memory.dmp

Download

memory/4036-1175-0x00007FFE663F0000-0x00007FFE66400000-memory.dmp

Download

memory/4036-1176-0x00007FFE663F0000-0x00007FFE66400000-memory.dmp

Download

memory/4036-1177-0x00007FFE663F0000-0x00007FFE66400000-memory.dmp

Download

memory/4036-1182-0x00007FFE63B90000-0x00007FFE63BA0000-memory.dmp

Download

memory/4036-1178-0x00007FFE663F0000-0x00007FFE66400000-memory.dmp

Download

memory/4036-1179-0x00007FFE663F0000-0x00007FFE66400000-memory.dmp

Download

memory/4036-1229-0x00007FFE663F0000-0x00007FFE66400000-memory.dmp

Download

memory/4036-1230-0x00007FFE663F0000-0x00007FFE66400000-memory.dmp

Download

memory/4036-1180-0x00007FFE63B90000-0x00007FFE63BA0000-memory.dmp

Download

memory/4036-1227-0x00007FFE663F0000-0x00007FFE66400000-memory.dmp

Download

memory/4036-1228-0x00007FFE663F0000-0x00007FFE66400000-memory.dmp

Download

memory/4036-1231-0x0000021C39080000-0x0000021C3912D000-memory.dmp

Download

memory/4224-986-0x0000022A22800000-0x0000022A228AD000-memory.dmp

Download

memory/4324-1058-0x0000000002C10000-0x0000000002CA6000-memory.dmp

Download

memory/4856-1232-0x0000022F95D70000-0x0000022F95D71000-memory.dmp

Download

memory/4856-1238-0x0000022F95D70000-0x0000022F95D71000-memory.dmp

Download

memory/4856-1244-0x0000022F95D70000-0x0000022F95D71000-memory.dmp

Download

memory/4856-1243-0x0000022F95D70000-0x0000022F95D71000-memory.dmp

Download

memory/4856-1242-0x0000022F95D70000-0x0000022F95D71000-memory.dmp

Download

memory/4856-1241-0x0000022F95D70000-0x0000022F95D71000-memory.dmp

Download

memory/4856-1239-0x0000022F95D70000-0x0000022F95D71000-memory.dmp

Download

memory/4856-1240-0x0000022F95D70000-0x0000022F95D71000-memory.dmp

Download

memory/4856-1233-0x0000022F95D70000-0x0000022F95D71000-memory.dmp

Download

memory/4856-1234-0x0000022F95D70000-0x0000022F95D71000-memory.dmp

Download