xworm | d9c2646994d741962b8baadd890a2acb2fd1becb217cc0a6bc9f2155662c6915

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/04/2026, 02:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
XClient.exe
Size 30KB
Sample260414-dfwbgset7y
SHA256 d9c2646994d741962b8baadd890a2acb2fd1becb217cc0a6bc9f2155662c6915
MD5 42870fb5b41b8d76b23085381b54fc35
SHA1 c7ed229a98ca48d0a93b7823f8c3880b1bbea012
SHA512 8cfd0147052904dd9831950c59c8c1402f6a1276d435e8aa187242cd72a0265e63ec67f29b9ca735df2257df7f0ad9f6efa53a64bd67bfa28309b676b5aad006
SSDEEP 384:qf1iAdT+QIfm0nUlenyc3LZlodJ7XlYECwaiU4sbRugtFuBLTIOZw/WVwvn9IkVd:f0T0U0yoQZ1YETD9sbBFR9RE8OqhEbu
TLSH
T16DD24B0877E58327D6FF2FF229B291020235D507D923DF9E5CD896AB6B67A8147003E6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery xworm ransomware rat trojan

Malware Config

Extracted

Family

xworm

Version

subscript-breadth.with.playit.plus:1073

Mutex

CGjzT0CboUGQq8a3

aes.plain

Signatures

Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral1/memory/412-0-0x00000000007B0000-0x00000000007BE000-memory.dmp	family_xworm

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\XBackground.bmp"	XClient.exe

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping768_1009300253\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping768_1696693404\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping768_1696693404\protocols.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5204	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 17 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "165"	LogonUI.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134206090973016135"	msedge.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-312252282-3884318443-358092420-1000\{7C3A5518-DCEA-493B-8AD1-83EE104A69C1}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	412	XClient.exe
Token: SeShutdownPrivilege	2764	shutdown.exe
Token: SeRemoteShutdownPrivilege	2764	shutdown.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
768	msedge.exe
768	msedge.exe
412	XClient.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3908	LogonUI.exe

Suspicious use of WriteProcessMemory 49 IoCs

description	pid	Process	procid_target
PID 412 wrote to memory of 768	412	XClient.exe	92
PID 768 wrote to memory of 5360	768	msedge.exe	93
PID 768 wrote to memory of 5204	768	msedge.exe	94
PID 768 wrote to memory of 2736	768	msedge.exe	95
PID 768 wrote to memory of 3348	768	msedge.exe	96
PID 768 wrote to memory of 2736	768	msedge.exe	95
PID 768 wrote to memory of 2736	768	msedge.exe	95
PID 768 wrote to memory of 3348	768	msedge.exe	96
PID 768 wrote to memory of 4476	768	msedge.exe	97
PID 768 wrote to memory of 5416	768	msedge.exe	98
PID 768 wrote to memory of 4476	768	msedge.exe	97
PID 768 wrote to memory of 4476	768	msedge.exe	97
PID 768 wrote to memory of 5416	768	msedge.exe	98
PID 768 wrote to memory of 5416	768	msedge.exe	98
PID 768 wrote to memory of 5832	768	msedge.exe	101
PID 768 wrote to memory of 2364	768	msedge.exe	102
PID 768 wrote to memory of 5832	768	msedge.exe	101
PID 768 wrote to memory of 5832	768	msedge.exe	101
PID 768 wrote to memory of 2364	768	msedge.exe	102
PID 768 wrote to memory of 2364	768	msedge.exe	102
PID 768 wrote to memory of 728	768	msedge.exe	104
PID 768 wrote to memory of 728	768	msedge.exe	104
PID 768 wrote to memory of 1764	768	msedge.exe	106
PID 768 wrote to memory of 1764	768	msedge.exe	106
PID 768 wrote to memory of 5516	768	msedge.exe	108
PID 768 wrote to memory of 692	768	msedge.exe	109
PID 768 wrote to memory of 5516	768	msedge.exe	108
PID 768 wrote to memory of 692	768	msedge.exe	109
PID 768 wrote to memory of 1456	768	msedge.exe	111
PID 768 wrote to memory of 2900	768	msedge.exe	112
PID 768 wrote to memory of 2900	768	msedge.exe	112
PID 768 wrote to memory of 4464	768	msedge.exe	113
PID 768 wrote to memory of 4464	768	msedge.exe	113
PID 768 wrote to memory of 1340	768	msedge.exe	114
PID 768 wrote to memory of 1808	768	msedge.exe	115
PID 768 wrote to memory of 1340	768	msedge.exe	114
PID 768 wrote to memory of 1808	768	msedge.exe	115
PID 768 wrote to memory of 5036	768	msedge.exe	116
PID 768 wrote to memory of 5036	768	msedge.exe	116
PID 768 wrote to memory of 3320	768	msedge.exe	118
PID 768 wrote to memory of 1392	768	msedge.exe	119
PID 768 wrote to memory of 4612	768	msedge.exe	120
PID 768 wrote to memory of 5916	768	msedge.exe	121
PID 768 wrote to memory of 5916	768	msedge.exe	121
PID 768 wrote to memory of 4412	768	msedge.exe	124
PID 768 wrote to memory of 4412	768	msedge.exe	124
PID 768 wrote to memory of 5968	768	msedge.exe	125
PID 768 wrote to memory of 5968	768	msedge.exe	125
PID 412 wrote to memory of 2764	412	XClient.exe	126

C:\Users\Admin\AppData\Local\Temp\XClient.exe
"C:\Users\Admin\AppData\Local\Temp\XClient.exe"
1⤵
- Sets desktop wallpaper using registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\How To Decrypt My Files.html
  2⤵
  - Drops file in Program Files directory
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:768
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x33c,0x7ffb5547c188,0x7ffb5547c194,0x7ffb5547c1a0
    3⤵
    PID:5360
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1880,i,10768049640899182072,16687841566588859761,524288 --field-trial-handle=3020,i,15787133171659345040,9476062783190296500,262144 --variations-seed-version --mojo-platform-channel-handle=3048 /prefetch:3
    3⤵
    - System Time Discovery
    PID:5204
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1724,i,679692445678013666,17185563027082695926,262144 --field-trial-handle=3020,i,15787133171659345040,9476062783190296500,262144 --variations-seed-version --mojo-platform-channel-handle=3016 /prefetch:2
    3⤵
    PID:2736
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2360,i,10942278472228267749,14437875906097658149,524288 --field-trial-handle=3020,i,15787133171659345040,9476062783190296500,262144 --variations-seed-version --mojo-platform-channel-handle=3056 /prefetch:8
    3⤵
    PID:3348
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3488,i,17044811708359670430,8462533924052849432,2097152 --field-trial-handle=3020,i,15787133171659345040,9476062783190296500,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
    3⤵
    PID:4476
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3492,i,5260492853026114366,9030485655056988780,2097152 --field-trial-handle=3020,i,15787133171659345040,9476062783190296500,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:1
    3⤵
    PID:5416
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4112,i,17956191427919683780,4736457579588154636,2097152 --field-trial-handle=3020,i,15787133171659345040,9476062783190296500,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:1
    3⤵
    PID:5832
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4124,i,867331020652492588,7457417707394843929,2097152 --field-trial-handle=3020,i,15787133171659345040,9476062783190296500,262144 --variations-seed-version --mojo-platform-channel-handle=4600 /prefetch:2
    3⤵
    PID:2364
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4628,i,2971801591227226525,4179256497803930931,524288 --field-trial-handle=3020,i,15787133171659345040,9476062783190296500,262144 --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:8
    3⤵
    PID:728
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5232,i,4745392340456636620,16501040221256542317,524288 --field-trial-handle=3020,i,15787133171659345040,9476062783190296500,262144 --variations-seed-version --mojo-platform-channel-handle=5228 /prefetch:8
    3⤵
    PID:1764
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5240,i,11717150600206043073,8712867315260452333,524288 --field-trial-handle=3020,i,15787133171659345040,9476062783190296500,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:8
    3⤵
    PID:5516
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5236,i,12612961770507206387,16495335799092081007,524288 --field-trial-handle=3020,i,15787133171659345040,9476062783190296500,262144 --variations-seed-version --mojo-platform-channel-handle=5460 /prefetch:8
    3⤵
    PID:692
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5136,i,11474294843965289960,10861367595705455285,524288 --field-trial-handle=3020,i,15787133171659345040,9476062783190296500,262144 --variations-seed-version --mojo-platform-channel-handle=5384 /prefetch:8
    3⤵
    PID:1520
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5136,i,11474294843965289960,10861367595705455285,524288 --field-trial-handle=3020,i,15787133171659345040,9476062783190296500,262144 --variations-seed-version --mojo-platform-channel-handle=5384 /prefetch:8
    3⤵
    PID:1456
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5956,i,12700272576192788422,6380462566102940352,524288 --field-trial-handle=3020,i,15787133171659345040,9476062783190296500,262144 --variations-seed-version --mojo-platform-channel-handle=5968 /prefetch:8
    3⤵
    PID:2900
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5956,i,8175916641951732765,758423447091135160,524288 --field-trial-handle=3020,i,15787133171659345040,9476062783190296500,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:8
    3⤵
    PID:4464
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6296,i,2156336257564507585,9598461683661091916,524288 --field-trial-handle=3020,i,15787133171659345040,9476062783190296500,262144 --variations-seed-version --mojo-platform-channel-handle=6080 /prefetch:8
    3⤵
    PID:1340
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6052,i,5309649896665622903,4213083379715778501,524288 --field-trial-handle=3020,i,15787133171659345040,9476062783190296500,262144 --variations-seed-version --mojo-platform-channel-handle=6004 /prefetch:8
    3⤵
    PID:1808
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6072,i,15448685613961315336,2140130189201769307,524288 --field-trial-handle=3020,i,15787133171659345040,9476062783190296500,262144 --variations-seed-version --mojo-platform-channel-handle=6044 /prefetch:8
    3⤵
    PID:5036
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3676,i,9215100886469768905,5328618689109695291,524288 --field-trial-handle=3020,i,15787133171659345040,9476062783190296500,262144 --variations-seed-version --mojo-platform-channel-handle=4876 /prefetch:8
    3⤵
    PID:3320
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4712,i,6187387288259119500,4939090248785096498,524288 --field-trial-handle=3020,i,15787133171659345040,9476062783190296500,262144 --variations-seed-version --mojo-platform-channel-handle=4860 /prefetch:8
    3⤵
    PID:1392
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5072,i,15812317582606127309,16105018878153338590,524288 --field-trial-handle=3020,i,15787133171659345040,9476062783190296500,262144 --variations-seed-version --mojo-platform-channel-handle=6064 /prefetch:8
    3⤵
    PID:4612
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5576,i,9897170931625730380,2479588214469337569,524288 --field-trial-handle=3020,i,15787133171659345040,9476062783190296500,262144 --variations-seed-version --mojo-platform-channel-handle=5252 /prefetch:8
    3⤵
    PID:5916
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6096,i,13107534273110543703,9316302714930370880,524288 --field-trial-handle=3020,i,15787133171659345040,9476062783190296500,262144 --variations-seed-version --mojo-platform-channel-handle=5616 /prefetch:8
    3⤵
    PID:4412
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=888,i,7397681547153730740,3946251005615171470,524288 --field-trial-handle=3020,i,15787133171659345040,9476062783190296500,262144 --variations-seed-version --mojo-platform-channel-handle=6524 /prefetch:8
    3⤵
    PID:5968
- C:\Windows\SYSTEM32\shutdown.exe
  shutdown.exe /f /s /t 0
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2764

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4668

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3959055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:3908

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping768_1009300253\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping768_1696693404\manifest.json
Size 135B
SHA256 ba5c9096d20a482aaa1aa9e5f98ad6127d3e97c2f21de84f7c78d9b8073c8e26
MD5 fbebd68ecaa98928909421f66909c054
SHA1 99d787d90f7ed2e5ad924f9c5668eb988b5a6c07
SHA512 749a3b2be47fe28399dc763888654a3e8d397e06e8d3c3af3965bb45846a1336e6ab4ca82c82c3df846b34a2afafa2156f2690e9bf347ab175408dc0171c61cc
TLSH
T158C04C668D51DEAB00A747A56B295315E23B4B4B5044800A7AF5429C1A288964171944
MD5 SHA1 SHA512 TLSH

Submit Download

686b0548-c2bc-4e63-9372-642c7396db7c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\686b0548-c2bc-4e63-9372-642c7396db7c.tmp
Size 14KB
SHA256 477b055341c2fefe75d08e0aeb1bdc55690b84cb832ebf5c05e59ce0e2972e9a
MD5 039df261f2db422e439cd171f20c5ebc
SHA1 4332c95d3decda5f7de18c77cb0978c8ac9e1845
SHA512 8011fec3d5cc685cd979cd6b49e14936cb1907d08cf4e1edfb945f6ba405b18c617f8072e9b0f49c4c68412216cbf5a9fa59a25651231bc3eefc2adec95839ce
SSDEEP 192:uubLsNtoQWtMmUMT0PKjQmiU11MxL4gDbFt1mSAMHF5ekrqrbVMi81+aqj0E5n:nHsNtorIakUgDXAMltskVS
TLSH
T10E627D757879AC3789E7E445F44737539FB061BB8E846F58EAE99B0C00C62C8370B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 f00ccd228daef1e7764629352f6409e7c411bd43dff6a14e6176681c9e065b7d
MD5 24f2c2bfd492fe4e654457e784f4f6b8
SHA1 04fbc59c7b048d74c093cf2cdd864902a365343b
SHA512 4293a0df8e2ce03ba3585c17302c6752db46ca64a5021251bd26cf4e43302dbc01bead80831601d6a6832304146c7e33438cd767e01c1e04bffd675aa12c87bd
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7f:fwUQC5VwBIiElEd2K57P7f
TLSH
T19CB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

protocols.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.10\protocols.json
Size 3KB
SHA256 4fd800e7b1a5fb24b13fac2e31946d205012b7c28d8c61580b0669b2fa3517cc
MD5 1de85fec2dfcc28011a7c2aaab95eb5f
SHA1 80e8c954bfbe8f7ee5a2335c8d969ae033935dc3
SHA512 9c7dd37eb0c094b6aa05201e7c71a8f33b9db81284223bcfa595a44a6ac95d5a6820ab6f07b7aa8d26bf207454e94277bf35332e9c009ee63f083752b6b51750
TLSH
T1D1611DB79A3048090E3412B86B19B35DF63E029F1AD598EB76BE568F1F710F7245C54C
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6b65e3f6d57bee85b90392c47f2236ea7ffcfe9cba07ca29930764c7dacc0ea2
MD5 726476576ad538c648305e214c389ece
SHA1 03960d925aa07a6736b28a431ddf422fa8bba04d
SHA512 7b99250e71a507574a7ea1c326ff4f687cffd7e1a0eb1ba5aa847f5b5e0c5d997dbef37ede7c2815a11e03b25f291a4f19173dd0aa9d22472d224e9b1d6349a5
TLSH
T11ED0808995F15C35D5D78CF1154B37067915C577DF42932374633C3C8C435D19546283
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 d084fddc35d62ab10457432373865714cd0577ad9bebe9188135998b9f802bd3
MD5 ff587c8337b9997eb40f19fb41bffd1a
SHA1 75e9be1412e32cbe6e960e041e872bbb48ab464e
SHA512 d50cc729f4f047045aba003643fd356cb1ac85c1d90f9ed992f787f682a862005a91103e9e388ad5cbd4f884c2668a35a0e5a0d011d0684ef2d6bc59a10b1701
TLSH
T15ED08089D5B15C35D1D78CF1154B37067915C577DF42532274633C3C8C435919546283
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 7e8dfaa32ad6114eee5e709eb6fe59d91f7292a3c567e79ca54d09c2c37d8773
MD5 d16dcdc98c9094902a1692e13937d59b
SHA1 0ece1b38028ec934d2bcdcf5872d9cb88df54f61
SHA512 d49b3e906cf0fa5594ef6396943c765b2a4c9533adceb4fdcdcacb11788b2c3bb7ce7d93428c2c7c94a7fc7e5f1532fec6c4bd8ba4d6708df9850d81cc642ff6
TLSH
T1A771734FA7918479EFE0CAB4D6F66458323186B841432EDE02D053FF8617F139094797
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58d7bd.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58d7bd.TMP
Size 3KB
SHA256 d3427b46178b83bdd13a34948cb2c5dd7138572dcf4801c86eadbcf58f27c10b
MD5 e615e8b89708e6fb9bda2947597dac99
SHA1 485035017c50eebd711b4b15b48037327053c4b1
SHA512 c9924d82cbcfe06ba7c29fd576bf80cb0f5c16c71a6d4e6bb9fdd712bdc23a5967ff59be6e8e169c32278c8de3a3648ed8ae7073dc3fb976269a51be02cb2986
TLSH
T13371608FA7918879EFE4CAB4D6F65468327186B841432EDE02D443FF8A17F13A094797
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 daadc49def6cf0b8d5a516d7f756d2dad9cabd1f1b766a383fd82412e3439ae1
MD5 322eac1775730a2cd4be75b99a7fb182
SHA1 f8d5806815b7c7c9b4e892ac524ca4add58beedb
SHA512 f3da555e89a943d2b4b75349a824d7b50a7aedd24bde3468029fd16c1d2264bc42e3a14af70c73f9e0a3ede70e939ffaf0c462d2ee868584d3ff559a1b293c3c
TLSH
T16841CDF7C3E8856D8A1156F0BB287E1BCE2D0A14432C3D5A89E4EF1BA3E2471E14155F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 07e37153a7ebc5ab667876f58a157852d086d0f8df245f9ac93da744417831d7
MD5 9693d30f9342c8c72b57179f8dfca1ff
SHA1 66efc8ab74f61de43cae55559e8036e3a2ecba0b
SHA512 efa39d3028cf3977cefd6942c54bbad401ddcd14c58ccaabbbed3b1cd9cbe1dea089a073402cd32bb647588ede3250b558f049135e0016019d7716ae558687c6
SSDEEP 192:sxZrR6yM//K1Ml8Mi1/fVsoeSYiTLwGZIdpd4HW6+WNGYJS6ruIg4J:sxZrAq1/fVsoeSNPyyHbGzc
TLSH
T16552F9156E24A977CCDBD309BA147F53D6F91573A2840D44AAFCDA0C00E6EED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 8cbf1286f9afca80f5af9c3b17872f636c8c96fbb0c95bd72b5b225305360a4c
MD5 a0d2a07fb5a584e444b5e1c36bb8b5e9
SHA1 34315b0eeb156cc57434800a9b047f84de9444d9
SHA512 cc68780f104a0880e533acf082e295fd773da7028a2a3d56d938f9fa5d0fb75f0798bcedafae848a1253d17acbb95ca1f9d31b8276c709ffa5987de23be0f524
SSDEEP 192:sxZrR6yM//K1Ml8Mj1/fVsQehYiTLwGZIdpH4HW6+WNGYNpZVuIgboJ:sxZrA71/fVsQehNPyYHbGFo
TLSH
T18262F9166A345977CCDBD209BA557F53D6F91573A2900E44AAFCDA0C01E6EED220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 bae1c6c5c5617b23f230363ddec482d4ace17d4748ea8b0a9a6171544c675ce6
MD5 8d0a3e3078e4ad26a7a5990f1ff166e6
SHA1 999ee1ec5501ceb0ca5d00529ec918380fa71425
SHA512 d7011da501098177760ed9afa275ab37571d6ebf1ee899032e7426aae599f8e810613874b9e9e5ae554eb3334fdae793f6b273ee82c548b8875b4c1d50dd7347
SSDEEP 768:rMQv20E7pLuLveqWve+l+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVE1nFLllnWhLroX:rMQv20IEveqWve+l+u1jah1nFLfWh4xJ
TLSH
T1ECF20C3B6C0CCB7E4F804E9CEC2ABE8E6DE8018B96D8895447FA455C03C66EB45175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 7KB
SHA256 dfcd734feb4fc38b57cebcffa6f39d624fd6c64fba9b66ef48ce863cf29e504a
MD5 34525816ed892d867cdf96f0a1eaa634
SHA1 0383330a6595c08ab4c6ff5f9257fe58562fffd4
SHA512 03391daa0055637638d97e693207ef55f6adb04b3c9f36b402d101f52db0460c29f9b1df02288a3d186e5d46d91c984830a50ca7df499bac43c20050d2d2b2aa
SSDEEP 96:KkE4Kh6CGNKK286mlSKEIHmgKzaGqeoKrqoSUKnKGg:SnBVjvrPozg
TLSH
T125F1BB55307712803A7D358DA960B46E4AD2B1A73024FC2B7BB950B69F27E20CDFD8D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59765f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59765f.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 1d02ab1db98233209b0ff75f3eb984f442fc0ea5a4017e0cee304a7efa061d1d
MD5 289e2ca503bcab2a72ff65e29177f83b
SHA1 89b43958917f88c6fb6b5087073071fc21712e6f
SHA512 1b36868217f52ebbb4f2ca4c56e8456074e0f2c4638fc61ddc2c03f26443d708ad4e0b4aff0a5c36851ee259360adae8d9fbe09b06a1c513dd533ad26688d1b1
SSDEEP 384:nwiFTzsN38TUNTUlIlRrIakUgTDfwpXAMlAskVS:LF3Swgu5wFqsB
TLSH
T1B1920876E8A4DD2BEDE797C1F64636939EF011A78A889ED8DAD95E0C00C31DC170BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 33b351f496f863e653716a878b09274091084f7b4827edb233558d05ecb4119d
MD5 5160a37cf1093eb240fb226070adbc3d
SHA1 5e7fd5a2aa1371d221657146c0536839a6c1c799
SHA512 b8bbad04e69a464ea913c62f26a84d5ef81adcd9305ab843903e80d4d6c73aefbc12d4364eb653de538c0dfd6056c4697c1d4c4c439e4eac56dd577af1ae60d4
SSDEEP 384:nwiFTzsNQ8TUNTUlIlRrIakUgTifxpXAMl1skVS:LF3vwgu5sFTsB
TLSH
T1EB920876E8A4DD2BADE79BC1F6463653DEF011A78A889ED8DAD95E0C00C31DC170BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 f80a5de63f7924fb4ae6454c397b65c3b98d1438763f7b664c78a94cf33ee304
MD5 640a8697476481da4632778cc0aa65ed
SHA1 74f7e71cd0a46e5d41c7c20b0c7eb7b7ff6c31f7
SHA512 5950aa5b8a3297f9eff2c0124ab9382974387f00abd4825474687c847e24cced012041c5900dc460c1dee93efd2640574df51cb82b46b37dfad0aed5c70596c0
SSDEEP 384:nwiFT0sNQ8TUNTUlIlRrIakUgTifxpXAMl13kVS:LFIvwgu5sFT3B
TLSH
T1CC920876E8A4DD2BADE79BC1F64636939EF011A78A889ED4DAD95E0C00C31DC170BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 7f71f3455cda01635c8ad73f1c60e01387a8e0b2ef9d7e98075f9517ff6019cc
MD5 78ac5604dde95ed7a9c2cd445d2d8553
SHA1 142f41fafdd2bc72c1ba123a3daa6bb2d385592a
SHA512 9a326cb985bd52464090d83e8384acc2bbf5c2e8edbfdcde41d8fa6f0daca34237190beb156bb8d8e524fa7aff3c68ead7004910f31fe82bb277f68a09c7197f
SSDEEP 96:iqONkxQsjpfKTzDXcJRC5ih/cIPURHl8h4otop5tyD9BEPgpYvJKxCbTqNGLYx4L:ZON56IT0JZQmiUyijOgibFt1muFu6TU6
TLSH
T14702E875B86C6C6B8EB3AE45F0473B275FB5216BDA952F88DAE41B1C01D758C2703822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 cc9e7d2872f88274e1ecfdc66ac4a4dc36275475455f9e4c2525f77ba414ab40
MD5 24bf6c70bb4019080e1b86a7b5739c38
SHA1 e21c0d282d4e5b53576d74e00b9c0cd522f1352e
SHA512 96a4724fb45628caee4926e368ac522ad3622450248eaa389a29084687f5c1d963967e231195e9b05386956e1a740ceaafd6ff562f7d26264ba00e08ed1d8171
SSDEEP 192:eONo6IT0vQmiUyDj0gibFt1mSAMHFsh1rqrbU6:eONo6J+0giXAMlasU6
TLSH
T15F121A70B86DEC2B4EE3A855F0873B635E7521BBDE856F44D6D45B1C04D768C2B0B822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 14KB
SHA256 ab86d696ab083091db3b0e6e2670debe575e122f0b45083aef624e88a28f9351
MD5 ff102915933d7145303acebff51a06b8
SHA1 213dd06b09d58456e469fca13b938b94636e87dd
SHA512 aa95911fffd2b9567f6d81e16bad550341c58b919a825bb5abc522f91aa132057d03c5045d190fe12c57674b5a85ce4109428ba3b0a081ea80afc0554c205993
SSDEEP 192:uuFLsNtRQWtMmUMT0PKjQmiU11MxL4gDbFt1mSAMHF5ekrqrbVMi81+aqj0E5n:n5sNtRrIakUgDXAMltskVS
TLSH
T111626D757879AC3789E7E445F44737539FB061BB8E846F58EAE99B0C00C62C8370B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

f71e3e47-b128-4187-b8f3-84ea484bd5d4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\f71e3e47-b128-4187-b8f3-84ea484bd5d4.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 a71638835733dc4c87dd62f9505c59d9c66572e929266b00074743c59e065210
MD5 41e49d0d8eb6e8b1bf5f02db194e2fcb
SHA1 005aa824abceb990e5a5a71a41ce11348445e4c9
SHA512 6002f2b8c7a4c95891d0428b614900a53bdf99f7801936f05b84583b9d4df4c449625448f3c3b3e24ff09933698ad7d244081c7fc921736f9b95929d397c9ebd
TLSH
T1DE412B58BAEA1148B3B77E56AFF6A46D497FB8772F06D45E00000E4F0667B40C9A1B37
MD5 SHA1 SHA512 TLSH

Submit Download

9aabc609-ccb3-48f4-94be-94e0ad062339.tmp

Path C:\Users\Admin\AppData\Local\Temp\9aabc609-ccb3-48f4-94be-94e0ad062339.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

6cae796d-6e0b-468d-969f-dfeb1b819dfe.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir768_2144550280\6cae796d-6e0b-468d-969f-dfeb1b819dfe.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir768_2144550280\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b40ef54d-7ab5-4849-b897-5585161bb71a.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir768_247270874\b40ef54d-7ab5-4849-b897-5585161bb71a.tmp
Size 146KB
SHA256 ec68b308c1b5444ed4d179df510a843fe2d464fefb631f11fd4b9310fda986bd
MD5 fa032a5db34ff20ecbcb6654b02cd7c7
SHA1 3a0c7141dc03421536419c33cb5f9ebd5a4e0289
SHA512 3a3d99e5b9794db882760f754b9b58bebf77e88ce8d0bef61f3ae82c4d3c9631e524a98389f74f7f9215674d60a6d06c10b9e5d0760c908dc19412955ea8522e
SSDEEP 3072:Hl6RntNhz5AkVuPmNptLSZPunVlkDS6it9TyZpd21+PIpGE8aK5KyTmBpw:HM3z5A41L+gXkDS624Xwp1XKgyKzw
TLSH
T170E3E16C6EEAC81AD10F60BA795DB08FC8068F16C107645FB2558418CA64B8D57E2FFF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AddMount.ico.ENC

Path C:\Users\Admin\Desktop\AddMount.ico.ENC
Size 412KB
SHA256 fde31e82eef3929de03d2473806941cd1cb9f7f5938f29ed76842115f5a60139
MD5 eb84438b330bebdd6d5e12820c3e3745
SHA1 b2e3c77841f57eade82e7f2f6b066bcb772a3ae9
SHA512 0572a025c95bf913aa1b474104bacd8ef5bcb222e67a757426955b064e99e42a8e005461b76725868d0057042efd12ba3b98ec0132f9facd2028b91345aa7456
SSDEEP 12288:n/O8i9LDpm7+ioXS163wtwl/nep5AQE4WB:/O8ifmCioC1Ztwlw5AdB
TLSH
T1929423A21BB1B73D5E01B5CC37E323BCBBA0C68907F50B19465065637B5FAA46C1B923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ApproveShow.odt.ENC

Path C:\Users\Admin\Desktop\ApproveShow.odt.ENC
Size 386KB
SHA256 92955123d1ac551906239bc3fbfdf58634eb0cc33b4e1aad1bbf667609ead79e
MD5 337d7c62ff4eac8a56ea764a44a7db5c
SHA1 d6df48636577e77b8c86ebaf54bd585a0a70c007
SHA512 1b5361aa90a630e0c93af51744a3ec3af17ac744f417863e8526e2b519ad6c5511ce7d7f8ebf6ea78551694739ab7b6bc193050ee38fb4427d7aa7bdb1d09ad5
SSDEEP 12288:+GPeMMqvnIhnTnjqxpoi8SZGS8kHJ79AFcZwFSZ2rnX5ovcE:tzuPip0SZGS/YFcKkZ2rnX5AX
TLSH
T12B8423486D73C1A0FC2825A391F8E83A20C92415C2CC57228FB6E955EAFEDCD549D3DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AssertWait.docx.ENC

Path C:\Users\Admin\Desktop\AssertWait.docx.ENC
Size 19KB
SHA256 d246db307ea424702e06c54aee3750d65f8ba45eaa8a6bd973b074b774dc86f2
MD5 27465223014291ce4ead85944fce405f
SHA1 6269da65bcdf21ea458569a563e89c6bf23217f0
SHA512 b4980952bf9422fee5ca3b2619a85a142b162f39ad8e56e7485900a3f2efad7d4980fad68833bcc5e2f0d28eee1d008f5f88d5b9f625a9de5c85bd950a2dccc7
SSDEEP 384:hhlWYxIN6YZjTGrNW84FQXJUFYCp8P3T/aPRFvZX3mkAS5140fWa3S:3GjZjTe0844UFYCi3uX3mUF+
TLSH
T1DC92F1B055CD38B412031792477E30D17C15B61E6BDBAE2BA8114BB38E599CBB3B714D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CheckpointConnect.jpg.ENC

Path C:\Users\Admin\Desktop\CheckpointConnect.jpg.ENC
Size 452KB
SHA256 939eec9abc73ca4a3d2cec39dd9e3fa2fd064a04eeffe54f71094e775f7e2177
MD5 9e953ac926b5ba2dcacf2fb2958c02c0
SHA1 8578b2a5aec548b20601a88a67b74a8ead5cadda
SHA512 da36e8cd94bb7bae0100cad4ac36368f5f5aee3b88b79309f8b966bd4b27fb1ddc04df82db8d1d98562f70a82333fe1573567c3bab2aa10b946ba3c4437646e8
SSDEEP 12288:I9m10mnj7l2++tsPxbxloCxP7ZyTsr3NPO+:am15jetsP13wTsRv
TLSH
T1F7A42324A36735B62F3AE663FD5B0DE6038CB670DA8B560C4BBE355C0DB103A4665E43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CompareSubmit.tmp.ENC

Path C:\Users\Admin\Desktop\CompareSubmit.tmp.ENC
Size 308KB
SHA256 54359d2f2650d25a768b64819e12f2eeb11a411f8ba9ae9e44570db1d4c12ece
MD5 8f452f5f941384319524677777e506df
SHA1 c210c883ef2476c72c139bdb634a54caed68f99f
SHA512 a3975148f5a9c9992a25c48c2ec8c0d8ded335670c1dde84f4fe49e90cc5f03c4ff6a4bbc4819a2cd19c003cfec1dfea78a96deed9e121500255c159f2255c22
SSDEEP 6144:CPqcZM2sxn/ss0n1FkaeIpiwCiZg7R+Zmj3z8u3nYrypG8hW95INw:BtZgk1IpR9ZmYuXY2MEW95J
TLSH
T1126423CE421EB0F87A766241B9584599D73EBAD452CE48C29450EB53841F23E3FE7A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CompleteCompress.mp4.ENC

Path C:\Users\Admin\Desktop\CompleteCompress.mp4.ENC
Size 216KB
SHA256 68d70a79bbbb6720e9be59b8f53e1e9abbebaebad87651ecfc5afb4779538ac4
MD5 e21676f9c6978e3f6c18cc866b4a9fd6
SHA1 4a8144225bc177a1a2f3e7aeef2b0b1076082c78
SHA512 5328a2eab8fda889d9647cf5b61eb2364e401adfe951a669b8c8e8b4eda37fd225561a33efd913fbc445c868303a61343627672ea84a216c152295e014f0f8d8
SSDEEP 3072:TU5rqx2GVYoBI96CkZSn2WnaZMoOg7tzyGjqKwFTsPhZyYaga6j5EP0s+5/vX+:wVgLYoB7S2WaZMTgBzNp6wUgtlkl2vO
TLSH
T1472422B8CA8E6475302C9F634034AF620505F39ECAE61DA5024297B5F35AEA6D377327
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CompleteImport.asf.ENC

Path C:\Users\Admin\Desktop\CompleteImport.asf.ENC
Size 426KB
SHA256 5268dd8074f3c8a93ac367281bc0c2368ef19c1bed8ba294a2cc6ff3122f4e8b
MD5 e2f74de299ca296c5f9751aae8e4eae3
SHA1 e86fd7742fb29e2326b83637c79c7a39b96b9e75
SHA512 66fb687e4139d78b5849e2e4bbc881c7c484dd11a9bfbbacd64969efb82bf996e5650f509260a755b48b07584d529b299cd1b66c8c1847931ee1abe786270cab
SSDEEP 12288:gMO4+gd4as7lPVQuNgVXfpgl3ytF0kzw2gZNu:gMf3wNOuNoXhglIFVkm
TLSH
T1D99423B9E08A3D21BFD7117DDB93D7B695206E466D0904883E60EB8D088E3E80767FD5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ConvertRevoke.doc.ENC

Path C:\Users\Admin\Desktop\ConvertRevoke.doc.ENC
Size 360KB
SHA256 1bf4a5ee7de8873d73cca403a0e4481e73078a5de421447c3e967be764a71e6b
MD5 71aa20ebe2ef1c98943993478a76bb99
SHA1 48c18e6d9cdcdfc17176299031a79c3323952170
SHA512 16ee80cad53281b199dcdbbc01fbe6a7c797d6ec96b08f761499aca56a841d74a171f0086aa0d9a2a47bc482b3fa7756be6dc31d66493fc7784fde6c0d9603d1
SSDEEP 6144:JcPAnjZJHxTN2eM8cWUx9TUvC12+a/n80FUUcYs5jUj9aqE0SiO:JOAnjZJRTNyNWm9TUYBk8uNijq9aq0
TLSH
T139742396C0F17C77C08A419E1E253DBF6DC92134BFAAC6791A5516B8A22077C418BC3F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DebugEnter.xlsx.ENC

Path C:\Users\Admin\Desktop\DebugEnter.xlsx.ENC
Size 9KB
SHA256 62d088a68fd48f1bd7910ca56e41ef89a9ab6d4a0e2ad33cb4900b35cc73f506
MD5 71f136740b394b030630392723988467
SHA1 64abc8a03fda277fa1542947fef12a029d47f450
SHA512 8ef5249d8bedfc67b52b90c2cf428162350ec4ddcf1bfe7f7803fe7dd6956b501997fbd0f95269473be3c2437c03ba46780011a5e9460442f0eff9a3da15b8f9
SSDEEP 192:RuvoXr+o79N9iKKOl0o1pCM+pW1w4Ur9tuRBLn8NRQEdwYw2Dq:Ivwxf3KpoznJ+3C83QaDq
TLSH
T1BF22B014B68448D380372426ADF2BA2D9BE7E5E72036111653127053EAB5E7B81A32F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DenySwitch.vstx.ENC

Path C:\Users\Admin\Desktop\DenySwitch.vstx.ENC
Size 255KB
SHA256 d7e589055dc31dcfb1f724b57cda892b1eae431218a3257199221b00278db620
MD5 69f88c3863409b9bf807a11bed455667
SHA1 dc2ef1e758cdb8ffe75e06915728726349724ff7
SHA512 b25379e8d07db4bca8e2a3d01c3c8888b97c9d062f941a0a93a12c430bc9eafd293402ae885b5b2a9b79f51a4088fb14fd9cefe04a7872b21afcabd07bb6caf4
SSDEEP 6144://cU5+W8LDoGXRvKXkctF/IG5zyydxui5g:/eWG790km7yWW
TLSH
T1744423A6E910188E947900F5FDD9EF8FEAFC689B2785551E0DC0F5A2D7E8B40302760D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DismountDisable.7z.ENC

Path C:\Users\Admin\Desktop\DismountDisable.7z.ENC
Size 242KB
SHA256 bf0d041517c6f3a3dddbd285db191a25c209c43079eb9fc0534c0d94a27c3d30
MD5 39b747b7156808a383ce530c7e1f58c9
SHA1 66563662b87cd66b62566001e8100916f0529e5b
SHA512 cea545d82947dc8be3467a002e29c3af1e3db83ce4cdf71888b901c77e3fc8b4b5edae99076ccfe867ade4a5618d07bf3de0692f270d3b962c96339e666abc47
SSDEEP 6144:Of+1Yq07Rg/CyNFyUAYvkOpnSgdF9n1MQgmIaEw7mvWMqZcuac:Of+1z07uv3yh0pnSO9n6h3G7mv2i5c
TLSH
T15E3423D883F9D80DC33F844DAF857375D1E4668AC998DB03A6CAAB21CDCF4DA225465C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ExpandSearch.mpg.ENC

Path C:\Users\Admin\Desktop\ExpandSearch.mpg.ENC
Size 439KB
SHA256 d76acbd97ec42c79a0a9355c79bb0bd362f349f1f27d73c0266bca391cdc54f0
MD5 790762080279e295308339774975e86e
SHA1 811ca3f0447c2b3e144acd5cf386a7c462375042
SHA512 27a6d996cbe2f471e2ea5332d8f75cfffd36cd9caade33ed438bb5d50299663c7f1d59fed3dd411c77cef8912dd66f51b3a6deb5cdd8c577511e482277aadc0b
SSDEEP 12288:x1CDf2gEwbf5qk+yt/gzSG0yUwz3YRC9j8F:PCDBEq5qsgGGF73YRCtC
TLSH
T15EA423A6761D199CB7DF63CB10CF63A682516F9E472AA9070A47C92C01D9F63473B8F0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ExportUnblock.xlsx.ENC

Path C:\Users\Admin\Desktop\ExportUnblock.xlsx.ENC
Size 10KB
SHA256 130c71016c63b69ff2dce94ef2a4e727ef2b5b1b7f5a6d2f4c6b9ff53881fbff
MD5 69080969af9cc716e12eaad493c0ffa8
SHA1 8e47a76abde3cce6e8856b63ec9a1f8bc5aadd25
SHA512 ba7e8a3aa83fc02050e751a39a22ab70a27337751a5577703d4de5dbd31a5367358b031cbc4422ba8cf0598b9c66b3fb93cabd92f251847cec4239cb0f7ddf0d
SSDEEP 192:RuvoXr+71yRFUXDftHFglY5/d7W9hM5Atw/6zVBdlKFcER:Ivw1FgBFglY5/w9hBAQVTWcC
TLSH
T13F22B069334464B30536EAD6FCA1BFA2816E449260D70476D14CF2A8497D9B3E0FCDBB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FormatCopy.easmx.ENC

Path C:\Users\Admin\Desktop\FormatCopy.easmx.ENC
Size 203KB
SHA256 ad69896edf5753404d733d627cc17f27eb4c301086d14ea3118962ccc8a1579e
MD5 f22993ec31fbddedd9d093e48e6aca2f
SHA1 7b5e6796606cce2759b29c0200a996b8a54a66cb
SHA512 2354cffd9c4c9e7a25df961a166cb93f295f76e9364963eced0a5ae8894ff9ef17995f5cc848b189c979adbf741a9372a476cdcf7d8d2d405a9091552d33d572
SSDEEP 6144:uMq+V07C830q692gKx3VfZr4b5RfmsvbrZM:yC830SZ4b5dM
TLSH
T19114136DFA76E3D4593CFA922FFB37C8C8CAA601F8C27694026851FC71F2A95104095E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FormatSelect.vssm.ENC

Path C:\Users\Admin\Desktop\FormatSelect.vssm.ENC
Size 334KB
SHA256 80aa02b88ddbba34001b366bac45e0c78adda85288f19b06d0dd839b05e034e5
MD5 987bd36343414ca32daa56208e916e2b
SHA1 2c454f648dfdc56c01097eedb14656905bffafd2
SHA512 fd5edf3e6882f11d4f6c39089e8383e8edcac3e49708cdf429008bb3c200cc35f0d034444cd515aa51045e5a964fbb0cf1fee6fea3ee3ce3b3cc2ebf459fc4f1
SSDEEP 6144:isPydPE19MJOUDI1ZCOEJ8lyh7T/UxVivLRi1vpTqYsMc+/QBd:RPg49SsCOo7T8ViU1vpT5/QBd
TLSH
T1E2742318AAFE9EC57772181E249E09FD05DD3C3928E6DC21D090AFAB0B98815D4DF6DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

How To Decrypt My Files.html

Path C:\Users\Admin\Desktop\How To Decrypt My Files.html
Size 723B
SHA256 bfbb59fa451071b37088b6286c3e5941f2536c4d9a1b77c1c6e987da9545b6ae
MD5 553cf6c7e10d1c701098d7e1d0a01839
SHA1 3cbdf41c6d02de51754a2696a382485be5175771
SHA512 591ace58027c743e663598f29857e3fa52e47e5a015dfb5e46570fcc563b623306b6e9de5df0aed2f5242c7ae88178aced6c909ec3b8c075b5d7239922d3183c
TLSH
T13901F4E0DB614DA47633096AB509B725DF70679370943E6D328ED3139FF0416894B2CC
MD5 SHA1 SHA512 TLSH

Submit Download

ImportOptimize.csv.ENC

Path C:\Users\Admin\Desktop\ImportOptimize.csv.ENC
Size 163KB
SHA256 7f5ce4f6dce9ebef74478929afa06c780557995ce44faa87b47e9581ee8d1f64
MD5 26f6ffe2fe41240c9578fa1e92d4b61f
SHA1 4099ace7355adf1b3a96eba28d404651d30022d4
SHA512 d7a1d0fb1714d520480c6b7a17b31beb675609569e6ef59e9cfec80b939b6c70fa43e49fb19b4a78f8a9f0a9f38d9343bb7047a1157112ab306d2833466cdf9f
SSDEEP 3072:3DAuvuFBey4gVrEln0Z7/ppqA/ce3XINqg1y8ABqQ/SVLs7j5gZAm2zfEcpSpjr2:Grey4gVrzBkr2D8Uqjs7tgZAmOccp5
TLSH
T1C5F31271E4984A0E07F8C692A9FEE069A38FC2D6D65C31C96C964D393D8B3ED15E3814
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft Edge.lnk.ENC

Path C:\Users\Admin\Desktop\Microsoft Edge.lnk.ENC
Size 2KB
SHA256 2be7f7ae0c73e78b171a46cf3e12606966a085d95b41422aacb511eb534ff88d
MD5 a65e6e323131453e4afac93d2d0584d7
SHA1 2cc2d1f9dca9af59557f311776cc61bea98e65f2
SHA512 b8696ec89a4d6f5320ccd598bf544503aee671e50180806ac03e451e70aa12b7ecb9415d6633f6eb1d7798dd8edbfd06462d4f7f284aad198acf20d695aa4064
TLSH
T191415D325F2BCEDBA009F246EC1D099108AB822F54995088893D4DB7C809DD9F61B1DB
MD5 SHA1 SHA512 TLSH

Submit Download

MountReceive.docx.ENC

Path C:\Users\Admin\Desktop\MountReceive.docx.ENC
Size 14KB
SHA256 9d050c215383732019586445e587719db5a0ee8bbdbf6f4d928d25f174fa1729
MD5 6e5f58d895c527bb3bb632c4f61bcc2c
SHA1 de2a9e96cc8f3f8d8fc4ffab028d74fa8efe9ed0
SHA512 0988f9d2ab0731528b79e1482c497a71d375daedc2e7699de9ad67bc986a530616194296d4430cd2d076a7db29f3d8fc0f2d9075100e5a0d8db4cabbeb1f71f7
SSDEEP 384:hhlWYxI7PhpEtpdhzRYnIoxYWSqqIvsXxc2nV:3mPhpijJoKJIvYxFV
TLSH
T13162C04FA5C046D57BB2DA361CAD65E95CCA1F0CC25A3E117A5810301C88AEFBF9BAD1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OutTrace.jpe.ENC

Path C:\Users\Admin\Desktop\OutTrace.jpe.ENC
Size 399KB
SHA256 c971014f132f7fbf000e3520e78328d67b213a69ddf18c746cff84818b58b1ee
MD5 fe97afd067b6fa175b99f3077a36c2c2
SHA1 806676be66749cdb64ee5a3417c813aa96c3d29c
SHA512 1ee73f9aafde29b02f09640dc4ee7810debfcccc6d4ccbae97c00ea01be1bf6c8427ae5e4703a3d48d48b71367054311388dd72f78ba02a7a097529b65e033ca
SSDEEP 12288:cFsKxy1nJpxzn4ZB8/Gsn0uI90IyOPhoDWI:cFsKxWpxn/Gs0uc9y28
TLSH
T1C99423F7207B6185E386793FA36CA1C544E1739165B5993FD60CE686B883CE01CDCA3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PingRequest.vsw.ENC

Path C:\Users\Admin\Desktop\PingRequest.vsw.ENC
Size 190KB
SHA256 7357f53d4841308d487212e2cd0717ed8d5e9d93b799e7880b97dd33599d7711
MD5 f5651ed732a59a9a7e1b6f3de6c106b2
SHA1 77dd6463b206d91ef0bbf4e80b001a2294f70d5b
SHA512 e60c319a09dcdbfced60033e50154aa8afacc52302212cda53a7413f179e8a0b6aa46671039be8fc92b7942a8361c4bf1f4e02042ce154dfdf3cab8d93b00a4c
SSDEEP 3072:2G4yhQHcZ5513JSVr6Ro//7twhAoxsIES0FYj9fGi7efz+fGpFCgS6ZAt8afQP9V:27yhcvl0o//aArofGpFPCp6isP1Bv
TLSH
T1781422CE1493289C8ADBE59DF47D611FF2071B0BC6A8AAA04CA67F3A37461D34541B7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PushSend.dotx.ENC

Path C:\Users\Admin\Desktop\PushSend.dotx.ENC
Size 268KB
SHA256 142b63916479d04276e8252262bb1d5293c2754038fa99979b852fd1f1ac4d4a
MD5 36bb7d1f636fd4ec6e066405c5e5c880
SHA1 0bef744e27f261cc3229e69094a9a95c4e321c3d
SHA512 23bc7c139fed3cfd7216a658605bc90d59588121dadb41874f141ae8b45d775fc1df2077545cadb99d5678a2d08402073ee33a05e53ceac67033ae78a49a845f
SSDEEP 6144:xWRypFTcUqiDwXkbiIicJFaB9bDGNWxr60hnJ32D55y4:3pdcziDdTlaBL12DT
TLSH
T1AC4423C9C172D9BA1D1268DF5E1CD6C48D6CBFEAC642140307111BAA2FAE5459F0F1AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RepairBackup.iso.ENC

Path C:\Users\Admin\Desktop\RepairBackup.iso.ENC
Size 294KB
SHA256 bf2ed7e0ac37fb22972e18c346b03f2ee2ca57d6f26ab5ea6337115dfee68a5f
MD5 8af7cf971d8da3612ca7b617f9bf7b9f
SHA1 9a5bf981eede88c7f50aacd65d7421c24ecb4f95
SHA512 a90eb2c1ea2dc7f8980b68204f7dad001bea81ecd94c6ac4b97a21ea87f66cfcd1b018c05fd77b34f5a1235c1f26bbe45a00fd39a983ea538167c8d6bd9aee62
SSDEEP 6144:2oAyVQKfYEm2uOpZV/pR5+iebZfU2OcqryWLe2vNvI+669ma/:DA+HCERGbZs2FoDFvISJ
TLSH
T1965423164DAD7AF78D3E8A9C9AC3C24610327EEE0E07C8F88D96762B5450856374EF17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RestoreExit.docx.ENC

Path C:\Users\Admin\Desktop\RestoreExit.docx.ENC
Size 321KB
SHA256 589cf8a2aafc03ef59aa25bdd67ffad558394414677fb88540eb751fcf11cee7
MD5 ffc375e1418662fe76c2949772043860
SHA1 eba2a1882ef2d4a02ef930f0a625b29a02adc81f
SHA512 e2c489026df8dafbda3f44ba4d62f10b9bcf2371231d3668cf1c62683d39bbb6dd25e1fcb2ceb24bb6a46861795c47ed6de7505b00da74b80b00b75e88f1e952
SSDEEP 6144:ohp9fJyN/BdsHyybpdH4Xp3ddOwUMyKOxGvqCL3EpdtTMX:oRJyN/BdsSybpZ4/TTz5L3M3MX
TLSH
T14F6423B99F307B201B5BF20859BB8D018571469A4D8C3AD87B7C76B1AC1DE24F279C72
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RestoreGet.vdx.ENC

Path C:\Users\Admin\Desktop\RestoreGet.vdx.ENC
Size 642KB
SHA256 b923e6e7c7f2dab9fcda313bb6a47cc08bf0073823302a45d0a1a92a380dcca6
MD5 c46c22dfa23765738a12ed9ab8a2dfeb
SHA1 135c3c8d2698548a31bf6f58cbcd7c5207c387bd
SHA512 908afa7410c27dbea52873f4617ec54590686c6a4bde8a1ff1059d71aef5d9003d2b3551e1a837200ebe3240538ec31d0721f0a63a5a51aa5b5f2ec9888e2ddc
SSDEEP 12288:3zJ+xVsyIMGkJRHPFaUXfav95pkxd2DrpQjbaS9HNcRYKTy48ubsGcvLOODT9S/8:3dByvvJxtneXKxqSjbhITy1ub8doA0pg
TLSH
T150E423C79F98ECDC52D1AB4AD530F0114A288C37F5009EA94EB3B8C6793C9F755A15AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ResumeMerge.ico.ENC

Path C:\Users\Admin\Desktop\ResumeMerge.ico.ENC
Size 347KB
SHA256 f10426636e4e782bc353947e68d80cf5e953e0ca612b305def3fbc35b367830d
MD5 ed5a48328eea9a251603e4542c2efd92
SHA1 17fa9bc39644c0fec33c097e99ec5ff3557bdea1
SHA512 1e4cb47fe3166843b941af45312dac981a3c3e4443d5c6e47ddf5bbf26ecebd983ce564852c5a18666e698cf92ddc700124d5a1f8ec29e1a17271f8fc3a855f8
SSDEEP 6144:bbUMGyDWtUazRmhu1vJBuGo5ecFs0koIvNQfEgf37RzTmn3OLbc8ENRIo+QNSrwS:vLG88vzRmYBuGIeyivNQfh5mn17NqxwS
TLSH
T1627423EC7BC308CB2C9C85E22DEADAAB4C64159D3BE0FA113E790F659C64994D5C9C80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SkipCopy.mp3.ENC

Path C:\Users\Admin\Desktop\SkipCopy.mp3.ENC
Size 373KB
SHA256 0658df248832e0ea45934e2584b824c1d2c8ba54a94d1a8638a7cb7550071b72
MD5 e9a098da282ece83f8ba67af647c0045
SHA1 586d20b330ef5df1afa4310920ba83ce10b4bc22
SHA512 63f86f891b8d2dd0792911ac24b7e3dc9c7ae1e6ad3590e2c1d890476901eef65d67799e5a4430ce4b12cd7d4f8b307b06504f198b77ec4906abdd5184de501b
SSDEEP 6144:q2g+kiDyzmhL387zQ26tNJyt5tGXtoB4/PSWIk67kx4UqsBeM3pByyuszV:xg+TWzmB3K6nJy2toynx67k2UqGeQSyx
TLSH
T1E884232148CBCD62431BAAADEB1DC58522D3698F1F1BD15CD6AC77D13BA400BF89818F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SplitConnect.hta.ENC

Path C:\Users\Admin\Desktop\SplitConnect.hta.ENC
Size 281KB
SHA256 e60b17e5c9e00f7f51cb59857eabba459dea43fee4d97bf79773ed49d8da901b
MD5 b13dc88dd4d516ffa690509b4e71160e
SHA1 a6c926cbdd9e31aa10616dd5e8010ed6bc0a8d64
SHA512 b19ace776ae276df8ed2e75d4cb1d5e532749c0e8885e352cf9b6a656c0ce551e7de6be0041e75c62e926f5f584621425296d3545f4d84d14b7c4ae22a02325b
SSDEEP 6144:pePk1QMwxiD/DZ9Ja3xSAh8WJGx6Z5jZSPlQqQY8de/SGs:peM1wxiDbjAhTc6Z5dMCLe/SGs
TLSH
T1CB5423A058AEC0B07BDDD6CC656F2688E4088123DD2D5B82FD0795C3D1AEE581D7D5F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SyncSplit.hta.ENC

Path C:\Users\Admin\Desktop\SyncSplit.hta.ENC
Size 176KB
SHA256 ef9ac5da7f065ba5f1ded2505be49b495ae5ae3fd5c4fa437bc28b1cf98de6c2
MD5 a3cb2120171bd422c4c1911ea3f79a61
SHA1 719991ec6d2c14341c4dbcaee61489c45ec2670f
SHA512 9a80645c297f258b89649dff4e3fd2d2014df974de80d2c3a5e776ca611c2db8d57d36b5aeab32b4008e674ee50a80d320b4a4b9a4d54665dc5f00a0d11b5701
SSDEEP 3072:6fHfAZG+ODWeiKD89Ms5iGGK+P4kK9oUBRmKABD4d0ChQXgebt34:+/s9UZiKD8Ks5HGK+PVwyS0WQXS
TLSH
T12404132AD6937F2FC8C7D5C9F84C3E6A98B18B1D0A17367C47D454C69CA9EE0193B201
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UnregisterConvert.vsw.ENC

Path C:\Users\Admin\Desktop\UnregisterConvert.vsw.ENC
Size 229KB
SHA256 3f876ed7cd5d698d59f82a2f5e24834830df229cc593310b8bb1b9f9b0a9dc6a
MD5 6a2ca08ac6b36e910978b9119c82cc0c
SHA1 6b2dcb04480ab6d39f005c526318df3b44b7a703
SHA512 99f10eb78807b1ef39ff8414a84c4b31e3e3bd8d566d8cb0534ab5cada798736b623ab98876da651133547f6de9c3a8f9dcffceec9e6dc93e280510bff597a09
SSDEEP 6144:RKQCN292bUyqOpE8u5CBQAkBbJasWanVv5iGrw27X3hPr6PC9:eNFVzWCuAiwsWan957rw27Xtr6I
TLSH
T1553412FF62E8A8076C61A4717372115097C487BDDEA8C2B8DFDABB45A23941848347F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UnregisterShow.wmf.ENC

Path C:\Users\Admin\Desktop\UnregisterShow.wmf.ENC
Size 465KB
SHA256 9c019c599fbbdbd50959d0ec382f90291fab76eac0dde6df0d9dc90bf2e0f3d4
MD5 3ad6486c068e650c085c9a5fa01f01a1
SHA1 723e283ccb3f63ff0c051f522d1828598202f750
SHA512 1c523e9685815d9a49ff419c88792fa055d4f3c71f0a7dd5b1d0dc6acf4948ad17bfaaee7acf4d309c920b6e369b7cb6510b6df8e985328173499708d907ceb2
SSDEEP 12288:Z4qSxMDknzmpFH5v6mJkKPZnTsw+6TfjDk:mvViJBFPZn9Xk
TLSH
T15EA423582C0AB542F5D906849866E92D0DEAE1CC2DFBBCC3374CC8A7E8F65EF5B14914
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

desktop.ini.ENC

Path C:\Users\Admin\Desktop\desktop.ini.ENC
Size 288B
SHA256 4ff7be4fe6f3572816ff1e3b5169426d4e2f198ddbbce83901adffcf1466f5b1
MD5 b294abda44143fcc8fd9276acccf0f28
SHA1 aac1135db0e6bb84f11830de7995cc90093c2da3
SHA512 db39c4d71962059f96d2615242dac84ca17f6b407bf4b6d398cf4f69e29352c96d47b92a42a985af4d0d933a8defc120f8243e8471586d2a1ff6d33b815d2e54
TLSH
T109D0E73DDC61C944608B46085437EF8A14B1F02CF05244D107485D9D58C4D17C48C8D9
MD5 SHA1 SHA512 TLSH

Submit Download

NTUSER.DAT{53b39e88-18c4-11ea-a811-000d3aa4692b}.TMContainer00000000000000000001.regtrans-ms.ENC

Path C:\Users\Admin\NTUSER.DAT{53b39e88-18c4-11ea-a811-000d3aa4692b}.TMContainer00000000000000000001.regtrans-ms.ENC
Size 16B
SHA256 95606685ccf0db12ad1839eb4d61857a78d7316fa0c0f6a4c0f1e66d09e1e057
MD5 a78bf39b9ebbbb255b68e31cf280434c
SHA1 e9febbcd5410ac57d0cf3667cf70073a98e27bf2
SHA512 a081e642babfd81c681b7ad8b00ee7c59ad09b4854164026da60963a4dc8044976a35c84dc00cc778c80b2e1b356b6d95f4e9c2fb12c2aa011552893b5e4f204
MD5 SHA1 SHA512

Submit Download

memory/412-273-0x00000000027C0000-0x000000000286D000-memory.dmp

Download

memory/412-728-0x00000000027C0000-0x000000000286D000-memory.dmp

Download

memory/412-825-0x0000000000E30000-0x0000000000E3A000-memory.dmp

Download

memory/412-0-0x00000000007B0000-0x00000000007BE000-memory.dmp

Download

memory/412-8-0x0000000000F90000-0x0000000000F9C000-memory.dmp

Download

memory/412-5-0x00000000027C0000-0x000000000286D000-memory.dmp

Download

memory/412-3-0x0000000000FE0000-0x0000000000FEA000-memory.dmp

Download

memory/412-2-0x0000000000F50000-0x0000000000F5C000-memory.dmp

Download

memory/412-1-0x0000000002890000-0x00000000028A0000-memory.dmp

Download

memory/1456-707-0x0000018B5DB20000-0x0000018B5DBCD000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads