xworm | d9c2646994d741962b8baadd890a2acb2fd1becb217cc0a6bc9f2155662c6915

Analysis

max time kernel
148s
max time network
147s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
14/04/2026, 02:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
XClient.exe
Size 30KB
Sample260414-dfwbgset7y
SHA256 d9c2646994d741962b8baadd890a2acb2fd1becb217cc0a6bc9f2155662c6915
MD5 42870fb5b41b8d76b23085381b54fc35
SHA1 c7ed229a98ca48d0a93b7823f8c3880b1bbea012
SHA512 8cfd0147052904dd9831950c59c8c1402f6a1276d435e8aa187242cd72a0265e63ec67f29b9ca735df2257df7f0ad9f6efa53a64bd67bfa28309b676b5aad006
SSDEEP 384:qf1iAdT+QIfm0nUlenyc3LZlodJ7XlYECwaiU4sbRugtFuBLTIOZw/WVwvn9IkVd:f0T0U0yoQZ1YETD9sbBFR9RE8OqhEbu
TLSH
T16DD24B0877E58327D6FF2FF229B291020235D507D923DF9E5CD896AB6B67A8147003E6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery xworm ransomware rat trojan

Malware Config

Extracted

Family

xworm

Version

subscript-breadth.with.playit.plus:1073

Mutex

CGjzT0CboUGQq8a3

aes.plain

Signatures

Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral2/memory/4304-0-0x0000000000F60000-0x0000000000F6E000-memory.dmp	family_xworm

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\XBackground.bmp"	XClient.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1760_651821000\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1760_741783767\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1760_651821000\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1760_651821000\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1760_651821000\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1760_651821000\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1760_651821000\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1760_741783767\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1760_651821000\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1760_651821000\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1760_651821000\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1760_651821000\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1760_651821000\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1760_651821000\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1760_651821000\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1760_651821000\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1760_651821000\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1760_651821000\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1760_651821000\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1760_651821000\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1760_651821000\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1760_651821000\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1760_651821000\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1760_651821000\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1760_651821000\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1760_651821000\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1760_651821000\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1760_651821000\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1760_651821000\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1760_651821000\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1760_651821000\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1760_651821000\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1760_651821000\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1760_651821000\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1760_651821000\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1760_651821000\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1760_651821000\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1760_651821000\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1760_651821000\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1760_651821000\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1760_651821000\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1760_651821000\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1760_651821000\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1760_651821000\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1760_651821000\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1760_651821000\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1760_651821000\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1760_651821000\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1760_651821000\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1760_651821000\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1760_651821000\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1760_651821000\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_1760_1051439065\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_102_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1760_651821000\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1760_651821000\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1760_651821000\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1760_651821000\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1760_651821000\_locales\si\messages.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1760_651821000\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1760_651821000\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1760_651821000\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1760_651821000\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1760_651821000\_locales\no\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2132	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 17 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4290799360"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365268"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365268"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292114432"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292114432"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "125"	LogonUI.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134206091312012861"	msedge.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1456842261-3464001825-2855069093-1000\{BFD0A5C8-B2A6-4BAA-8675-5F299CD3CF40}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4304	XClient.exe
Token: SeShutdownPrivilege	5980	shutdown.exe
Token: SeRemoteShutdownPrivilege	5980	shutdown.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1760	msedge.exe
4304	XClient.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3976	LogonUI.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 4304 wrote to memory of 1760	4304	XClient.exe	80
PID 1760 wrote to memory of 932	1760	msedge.exe	81
PID 1760 wrote to memory of 2132	1760	msedge.exe	82
PID 1760 wrote to memory of 2556	1760	msedge.exe	83
PID 1760 wrote to memory of 2556	1760	msedge.exe	83
PID 1760 wrote to memory of 2556	1760	msedge.exe	83
PID 1760 wrote to memory of 3400	1760	msedge.exe	85
PID 1760 wrote to memory of 3400	1760	msedge.exe	85
PID 1760 wrote to memory of 2376	1760	msedge.exe	87
PID 1760 wrote to memory of 2376	1760	msedge.exe	87
PID 1760 wrote to memory of 2376	1760	msedge.exe	87
PID 1760 wrote to memory of 5680	1760	msedge.exe	88
PID 1760 wrote to memory of 5680	1760	msedge.exe	88
PID 1760 wrote to memory of 5680	1760	msedge.exe	88
PID 1760 wrote to memory of 5272	1760	msedge.exe	89
PID 1760 wrote to memory of 3392	1760	msedge.exe	90
PID 1760 wrote to memory of 5272	1760	msedge.exe	89
PID 1760 wrote to memory of 3392	1760	msedge.exe	90
PID 1760 wrote to memory of 1396	1760	msedge.exe	91
PID 1760 wrote to memory of 3908	1760	msedge.exe	93
PID 1396 wrote to memory of 1676	1396	msedge.exe	94
PID 1760 wrote to memory of 4272	1760	msedge.exe	97
PID 1760 wrote to memory of 3148	1760	msedge.exe	98
PID 1760 wrote to memory of 6140	1760	msedge.exe	99
PID 1760 wrote to memory of 5196	1760	msedge.exe	100
PID 1760 wrote to memory of 5196	1760	msedge.exe	100
PID 1760 wrote to memory of 4620	1760	msedge.exe	101
PID 1760 wrote to memory of 4620	1760	msedge.exe	101
PID 1760 wrote to memory of 792	1760	msedge.exe	102
PID 1760 wrote to memory of 792	1760	msedge.exe	102
PID 1760 wrote to memory of 4220	1760	msedge.exe	105
PID 1760 wrote to memory of 4220	1760	msedge.exe	105
PID 4304 wrote to memory of 5980	4304	XClient.exe	106

C:\Users\Admin\AppData\Local\Temp\XClient.exe
"C:\Users\Admin\AppData\Local\Temp\XClient.exe"
1⤵
- Sets desktop wallpaper using registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\How To Decrypt My Files.html
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1760
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x2f0,0x7ffcb4f7c188,0x7ffcb4f7c194,0x7ffcb4f7c1a0
    3⤵
    PID:932
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1800,i,3008143817117476379,2063153785885930143,524288 --field-trial-handle=2076,i,17681253291124609702,1044528817600071782,262144 --variations-seed-version --mojo-platform-channel-handle=2256 /prefetch:11
    3⤵
    - System Time Discovery
    PID:2132
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1676,i,14278601887851488678,14042583771933441634,262144 --field-trial-handle=2076,i,17681253291124609702,1044528817600071782,262144 --variations-seed-version --mojo-platform-channel-handle=2072 /prefetch:2
    3⤵
    PID:2556
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2536,i,8420347801083866242,1106625856118193005,524288 --field-trial-handle=2076,i,17681253291124609702,1044528817600071782,262144 --variations-seed-version --mojo-platform-channel-handle=2744 /prefetch:13
    3⤵
    PID:3400
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3428,i,16008872394331063467,12021987764795654122,2097152 --field-trial-handle=2076,i,17681253291124609702,1044528817600071782,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
    3⤵
    PID:2376
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3424,i,8115058732860689426,13479233904869251325,2097152 --field-trial-handle=2076,i,17681253291124609702,1044528817600071782,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
    3⤵
    PID:5680
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4744,i,3192141326650186777,101515824570709022,524288 --field-trial-handle=2076,i,17681253291124609702,1044528817600071782,262144 --variations-seed-version --mojo-platform-channel-handle=4920 /prefetch:14
    3⤵
    PID:5272
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4724,i,8311941306372883987,16537117015211396455,524288 --field-trial-handle=2076,i,17681253291124609702,1044528817600071782,262144 --variations-seed-version --mojo-platform-channel-handle=4912 /prefetch:14
    3⤵
    PID:3392
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5780,i,6208624692206027127,14496625569839631213,524288 --field-trial-handle=2076,i,17681253291124609702,1044528817600071782,262144 --variations-seed-version --mojo-platform-channel-handle=5784 /prefetch:14
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1396
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
      cookie_exporter.exe --cookie-json=1100
      4⤵
      PID:1676
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5836,i,824416122874200368,13061838915855772464,524288 --field-trial-handle=2076,i,17681253291124609702,1044528817600071782,262144 --variations-seed-version --mojo-platform-channel-handle=5852 /prefetch:14
    3⤵
    PID:6056
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5836,i,824416122874200368,13061838915855772464,524288 --field-trial-handle=2076,i,17681253291124609702,1044528817600071782,262144 --variations-seed-version --mojo-platform-channel-handle=5852 /prefetch:14
    3⤵
    PID:3908
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5880,i,16698693102500729434,10879315735507403161,524288 --field-trial-handle=2076,i,17681253291124609702,1044528817600071782,262144 --variations-seed-version --mojo-platform-channel-handle=6296 /prefetch:14
    3⤵
    PID:4272
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5884,i,4042804918172328177,17359659962497888106,524288 --field-trial-handle=2076,i,17681253291124609702,1044528817600071782,262144 --variations-seed-version --mojo-platform-channel-handle=6200 /prefetch:14
    3⤵
    PID:3148
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5736,i,12072716047326121010,4424646825569904713,524288 --field-trial-handle=2076,i,17681253291124609702,1044528817600071782,262144 --variations-seed-version --mojo-platform-channel-handle=6280 /prefetch:14
    3⤵
    PID:6140
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6276,i,1322906894877536983,14747959521578906783,524288 --field-trial-handle=2076,i,17681253291124609702,1044528817600071782,262144 --variations-seed-version --mojo-platform-channel-handle=6244 /prefetch:14
    3⤵
    PID:5196
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6256,i,10345239757937551896,17717972215266379960,524288 --field-trial-handle=2076,i,17681253291124609702,1044528817600071782,262144 --variations-seed-version --mojo-platform-channel-handle=5736 /prefetch:14
    3⤵
    PID:4620
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5020,i,14256546249559217758,10410357731041081913,524288 --field-trial-handle=2076,i,17681253291124609702,1044528817600071782,262144 --variations-seed-version --mojo-platform-channel-handle=5008 /prefetch:14
    3⤵
    PID:792
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5300,i,11875030031628378778,9050495833032872917,524288 --field-trial-handle=2076,i,17681253291124609702,1044528817600071782,262144 --variations-seed-version --mojo-platform-channel-handle=6264 /prefetch:14
    3⤵
    PID:4220
- C:\Windows\SYSTEM32\shutdown.exe
  shutdown.exe /f /s /t 0
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5980

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3132

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4496

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa39c2855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:3976

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ea750b8ccfa8d7c7a393cdf6c9c8a3be0f2f086fb814bb44905a02c83d9af71f
MD5 697a394c9a3ff43b8925489b648b073c
SHA1 5828315de0bd17378051f664204bff07d8659dea
SHA512 37519d78554ef3947030bf7fc74d2660bf2dc752f04de85daef8079fdce335d2e6ad77071de5a938f7422ad0bdd2acad3963260b61149fc0d91381c007a2514f
TLSH
T173D080115FF27C70D014E8F694187B413A3DA8A68D43A61154B1EA7E4C624D48FD0FE7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9cf5acc3a4797f1d8e969ab1970c2330530e33f7dac25d2b42a810961a67ea68
MD5 6bbadb85852ef58796e988ee6bd3abc6
SHA1 f87a8c99cc4052067a5b532f97bd1ccc92f6a0b9
SHA512 a3813b64d663d976b681f2ced98d428dc47f49c99219d4a147277e7c8375b07692a5a14501eee0df77c86f9da6e3205c49e89510005d4f3b21e3afff243fb088
TLSH
T13CD080155FF27C70D014E8F694187B41392DACA68D43A6115471EA7E4C224D48BD0FE7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 c2bd5fc04e0fab0ec7e5cd300f85fe1c604cd9069a215dfcc3a794eecba4f2bc
MD5 95eb832c7ff5f2e8e3b6fc4b98c2bc23
SHA1 14434e472be1d73e47557a4e1a98a8a65e6d13c2
SHA512 a1ee638ea89af44c1afcdc38c73c42c074fe636aed495c2e6982d5dd4a90f07779c9dcd873b12ace8a7a37437439c1fd3ffede6b3fb429a1861b5ac6cfc7af8f
TLSH
T1B0E02BAECC20AC3788FD8B6810880345EB6013572780485F3A3C92198FB26374546C6C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 9ee55f3ce4b42ee8a521e70fa5be53452caeb5960cd205c113180a9c1ddb0157
MD5 1314bf80cee53a9d2c76e58d45b7ee2b
SHA1 287521e87f6bed6195b68077343e17141a938c9b
SHA512 04c74752567a3ac979f34887fc71ddc44d9b6e66a52473965786382a736cf51f2ee714f645f6b7eab93ee861ff228539bc79ceb39c804a4f3aa7a526aff3d3d9
TLSH
T1BE41DDF7C3E4856DCE0156F0BA187E2BCE2D0A55432C3C5A85E4AF1BA3E2471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 9f6f90737e7d4e76419a74e637c942545c1f4ab460795ac7c83581454cc9de06
MD5 488d6d64657a1ea28b3a988dccf2fe77
SHA1 74873b590c147d38b76366e3bf73339bb83330d1
SHA512 fa7eeb87de6e7094441e9a3af97c08d2be0891cc08b2b8fb3abb5f0be68e4df0921a04b0d62d58ff6aa62224471877095020df7bf0c8eb989d820f992309d31e
SSDEEP 192:sxZIR6yMqZ/K1Ml8MNN/fZs/j4i0dILc5zodpEI/W6+WNGY0lAaQK2IgjGJ:sxZID1N/fZs/jOd3y9/bG5ejS
TLSH
T12562E9166A389A77CCD7D219BA45BF53D7F9257391404E489AFC8A0C04E6BED220783F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 15cc616ef0eaf7c8c55ed87ef1e8abb824f3a756c577af2d323302158896e9ab
MD5 bbaee4c094f86ecdebd427e9428f6a36
SHA1 869220e4a528a4dd2c87c149763a417ceb6b12df
SHA512 bd2d0cb40eaa7abe013dd8b63dc759a89569dc34783b525cf4fb9af5c15cb0a7e3201ec3f533da20284546345b8775b9e77ad0752ca2fb3a97eaf2bd25d2eb05
SSDEEP 768:EZN9b8PT24f7pLuL/CuWRmCCQx68F1+UoAYDCx9Tuqh0VfUC9xbog/OV3O7yZLlT:EZN9b8PT24ZE/CuWRmCCQx6u1jaKO7y/
TLSH
T12B031B3B280CCB7F4F804E9CDD26AE8E7DE801CB9698899447FA844C03D66EF55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 cdf487bf8126175178b888fef0f758feb01b233464d13bb1d6cd8dff377bb807
MD5 b6719deddb0005ece397a5a691102e06
SHA1 de4914fa9e30c1e10c4d0a263063b2318cdcf007
SHA512 bbe20e5b7c5636fb6551fa7ec5c21ffebab0cd81e1526bda77120f5a5a77b1990b826996179ceada33dedba372821f615eda76a915f4c9aa80f60d4dbbe8bf07
SSDEEP 384:cdOlNbMrgcmS2paFgkI1keB0k1+ojSSjroduZ7Dl:cdOlNXJjSSjroduZ7Dl
TLSH
T183B26E15713B13903ABD298A8594B4AF52C231633018F47B7BB954AE0F67E58DCFE8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 4f41c60fee2b5d95a266ae9d799dbdffa4f6b5322de012ff241e01008126396f
MD5 0b9e83ebc0bb45380d65c57dea6d8eb0
SHA1 46b757806d33a17f921ec74c00a2c789156c4820
SHA512 b62515110365dd109d6562ae09d03a8be3c6802d2ee9aa2591e694a93e4901b164e9579441f1b26a47afa4f21703c9feb62bda538e1f5b7f4f925a1aae2d7f2b
SSDEEP 384:nMiFJjccCs+Bt0S3U38NI8TUNTUlIR84dyD814fDKy3GzlfFqv8rbXKUyGFye6uz:3FJccQ03HwgeZKy+FawbaUyGFyduu43
TLSH
T1E5C24B31D8E5CE7BECE68B85F35A3647EEF01163998C4AE4EAC95E1C00971DD170B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 2e48ecb5f729b5ca2ad4c4bea881d4cac6adb9efc4a63e7bafcd69b546cd6046
MD5 178b0e3b23a9ed8f22dfa47c8d1c63fa
SHA1 b608b8db0cfc254ace9b3a8abd42d846a2ae7d52
SHA512 f0e871d8514b6a36fed7fa063a86b83792e74ba03d442c3984a05967e10f3c0992ee2850828d6b8fcf5488d5e7f56c3382381962aa503d1dea33a25cc291fee8
SSDEEP 384:nLiFavqMg38Nk8TUNTUlIxB4d9R514fDKy3GzlfFqv8rbXhURYV/Vw1mRO7iCrN0:mFayv3Xwg2mKy+FawbxURYk1mg7j6
TLSH
T187C25B32E8A9CD67DDEA8F89E7097A47EEF011A3D98C4AD4E6D40E1D00D71DE170B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 cd0c1d0aef4ab9f982defe2dc2d3d91a4f4c2d8387b4cce22cb331145f33f2b4
MD5 f8b97d87ab0b8f6088a0ddd1cf1d7b9e
SHA1 ecec135cd05c81d33c3130972a1b7fddc9b70cff
SHA512 762092c1ed419766c3bf574a3edd98d5b293fe70ef758774b0be60274c27db57bb7a7efc15e4a84782a9b9d6f8b630c25cd55a39648921bf5643d4f23619450d
SSDEEP 384:nHiFJjccCs+Bt0S3X38NI8TUNTUlIR84dyD814fDKy3GzlfFqv8rbXRUyGFye6uz:CFJccQ33HwgeZKy+FawbhUyGFyduu43
TLSH
T1BDC24B31D8E5CE7BECE68B85F35A3647EEF01163998C4AE4EAC95D1C00971DD170B82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 4d524229e97e31060affca24cadd7f3f7942f44b0e55710c7cca40dcee7804eb
MD5 d41fafd48d1ee6ed43dd6989b1304cbc
SHA1 ac6e26ed6c655106182cc73abafa7a116cb55b81
SHA512 d3e244ab098c3f53f03e9125a7bf95e42efeb762b21e0361aab470363060944084f098de07bee3c270f9149b97a0bc4cd8923f7f4a13f1f69f5e2d8dc2f28db5
SSDEEP 384:nliFavqMg38NI8TUNTUlIxB4d45dTK14fDKy3GzlfFqv8rgjRYV/Vw1mRO7iCrN0:sFayv37wgLTTzKy+FawgjRYk1mg7j6
TLSH
T151C24A35E8A8CAABDDEA8FC5E7097A03EFE01167D59C4AD4D6D81D1D00D71DE130B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 a65bce06a2be3dfcd68618e2bea8dc982fd16ec5e161cea443bacaff82263280
MD5 0278fe0c1b6864f07095fe2448c6a3af
SHA1 7b19bb269ae17d89e14682b32d168bc785894f59
SHA512 b48504af9849f611e9917ffcb4de397c64f4a0831f48491676db0ed42755542e85dd8be59e3b7fe55ace69416483a68ceeef1d1abd5b19172b6835816235791c
SSDEEP 384:nqiFJjccCs+Bt0S3U38NI8TUNTUlIR84dyD814fDKy3GzlfFqv8rbXKUyGFye6uz:hFJccQ03HwgeZKy+FawbaUyGFyduu43
TLSH
T158C24B31D8E5CE7BECE68B85F35A3647EEF01163998C4AE4EAC95E1C00971DD170B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ec68b308c1b5444ed4d179df510a843fe2d464fefb631f11fd4b9310fda986bd

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\ec68b308c1b5444ed4d179df510a843fe2d464fefb631f11fd4b9310fda986bd
Size 146KB
SHA256 ec68b308c1b5444ed4d179df510a843fe2d464fefb631f11fd4b9310fda986bd
MD5 fa032a5db34ff20ecbcb6654b02cd7c7
SHA1 3a0c7141dc03421536419c33cb5f9ebd5a4e0289
SHA512 3a3d99e5b9794db882760f754b9b58bebf77e88ce8d0bef61f3ae82c4d3c9631e524a98389f74f7f9215674d60a6d06c10b9e5d0760c908dc19412955ea8522e
SSDEEP 3072:Hl6RntNhz5AkVuPmNptLSZPunVlkDS6it9TyZpd21+PIpGE8aK5KyTmBpw:HM3z5A41L+gXkDS624Xwp1XKgyKzw
TLSH
T170E3E16C6EEAC81AD10F60BA795DB08FC8068F16C107645FB2558418CA64B8D57E2FFF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 49dee4519296cfe64f14418c408fb1e26710c833bfdd59a67e61c6f0c8461eca
MD5 4253fdd629204a9f147b4a12aaf2b5fd
SHA1 1048580ca1f0a5a753787848b82bc8c165fd4d8f
SHA512 67a37d1b7f80d171c80e8e8ada648bc184f7dc4e44c8ace55a38fd45c368efc17ee3f0838d824e1cb0507033f5a43c5808dd629c852a03551216d1b122603c37
TLSH
T18BC09B47695E1EC54E58067D45054D368AD6574563655175380B7904047431D435145F
MD5 SHA1 SHA512 TLSH

Submit Download

BlockMount.DVR.ENC

Path C:\Users\Admin\Desktop\BlockMount.DVR.ENC
Size 983KB
SHA256 7e5baf453589621e9b14e28c39e882e7b5ba60aadd3a1a3a8be35e743a2324ff
MD5 83f93d26d1021248e90b7ffce9b7933a
SHA1 3b5a1e785ea93e2186b044a641acd41e34363234
SHA512 48d4dcd15d508a7ff971fbcc7cd9c2498532adaee8a45144f32f282b50ad47a4e1d7068f4626680dfb2c9f6668b9a7f2c50ff92e78789d5adef5fa871fe44c57
SSDEEP 24576:PaBK0PzwpE7IHoPSUzHPicSKqMqsTmO8wt7L3n:PaxEpMIKSUPzWu8aLn
TLSH
T1F72533DA7EC889BD8732824A5108F96C17E3BC1969938BDB6175C306B73F09DB144B4D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CompleteStart.AAC.ENC

Path C:\Users\Admin\Desktop\CompleteStart.AAC.ENC
Size 1.1MB
SHA256 4b7767e57b14f9d1da7c87a4df35c0c8f32c6d34cfec60e772ba114765f841fd
MD5 bdc799c139be2471dcac719178638a06
SHA1 01c4b3f582fb9ba07f8344c580ab88fcef0c5034
SHA512 14e008bd04c89e4aeb87ef91d846e36493ab5fb7c5b32927b1ab40d4235d232d28d85e1aab0a606fb68d039b2b43b7721c6e4532bf88db8a3fda73a0a88dd5c6
SSDEEP 24576:Czbnb3tv/5HwXzypazF4cgdY1XXvuTvRGamLygjBiOzfvVZSeI+ohsGFDCo0pH3V:eb3B/5Hwuwou5f44+NOzfG9+ohsGFDrQ
TLSH
T17F4533AA534B75C99A1AA431D752F9C53CE39A78E35F182C1158A1F032ED0C7E11BCAF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CompleteUnregister.lnk.ENC

Path C:\Users\Admin\Desktop\CompleteUnregister.lnk.ENC
Size 1.0MB
SHA256 2ee0eb167ab656a3c71a5a9c870ca872e656150353fadf78bca4f05943eabeb9
MD5 c50bd323e0f94102fca66cd32f4bcb92
SHA1 6eea00cf361783da0229cf89f9b9e03fa0af1bff
SHA512 7d506a206a9e2243a04a0d728744c7971e2359e7af8aa1e0fbdae8d280b3e54e0d684ffbfac2a93383159489168fa734d06d8df83177c8d9edc561868925814b
SSDEEP 24576:zGayLYWFj7xMKXQM/HlxuZ0+YXOUKp8brFK14wl:Ka3a7KKfFsChsKUSwl
TLSH
T16A353392172869D880360B0E2161BE1E3EE7B278374C8EE7835853C74FBB5E4B54D65A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ConnectReceive.docx.ENC

Path C:\Users\Admin\Desktop\ConnectReceive.docx.ENC
Size 450KB
SHA256 504b71a1ece47c08e3b1a43a1aef22635e4e8de1593a424afb56bd3216b6c8e8
MD5 7c5bf86301ce28b233878f213e85918e
SHA1 1c1c8cc48abf045829932a456735da61a68b2f0b
SHA512 aa2a8a13bf7e5fc23ca168992bb6ce648a7658cd74ab279d465c530e544bff4a033dcef053173d29ed68bca26c8525080d236e3a348acacd5396e0ad9c273340
SSDEEP 12288:8aoJFiHclgQxMuWzRvIdGd+qbZZ3gWluOk+VFl:8aQYHclTmBRWd8Z3gWluO9l
TLSH
T1D2A42332EA99D90027DD55F6BB21C365323DC8975DDDB2B3232EF4234B649A616CD280
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ConvertToUninstall.xlsx.ENC

Path C:\Users\Admin\Desktop\ConvertToUninstall.xlsx.ENC
Size 10KB
SHA256 dfc2edcb76a698acbd3b0f3aa15d8529020eed374e4e25627cd066a50a87180e
MD5 6b17168c3afecca8f2e0355bd032c3d6
SHA1 0d2c4aecfa8375b3e675f42b7f933fd998e9a77d
SHA512 0e8c4aa955c909ef8b361a8039cff34f592f6c0fc9ff40998b46972e4b6ba3fdc4ccc0edbc380bcb3eb7aa932fd29ae7ebc0cc9977aeec3769d501364b81daa2
SSDEEP 192:wV2l82eAECVpIcy+In2DGghAz3CZpQTuTiGdRS/RQWYy7NPhJibm:9l5YCVpIcyUKguzUviuI/RQWYy7N54bm
TLSH
T15122AF50CCA6EAB291C980340DF40BC79D855FFEAE84E9B8504C77A54691F7C40BB1E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DebugReset.tif.ENC

Path C:\Users\Admin\Desktop\DebugReset.tif.ENC
Size 532KB
SHA256 a9cdffd762b53cce251f197494a22e4e773458f9f198a52fedad4e5e5fe77691
MD5 03ceef21fa5a3b05d84caee9f231098a
SHA1 e19fffc04c5c41d6261d7dd2e546133e8249ed4e
SHA512 ba9b9c290294f1b1632d20602f7921bf650067f575514f5f8c5a407e66d8ac0d090ee21f253f65311685553ecfe2348dcb1374ea797961df0eb1702aba202260
SSDEEP 12288:YfU0QZ3VMRHplGD2s02m9enXxfQpjxzycwy2ApS8+7WYuUJKRS0v:Y5u3VIHplGD2s0r4fgxGcwgSCUJA
TLSH
T1C8C4235A54188E4CF0E78F7EC506889BE9451A67E1AED66D0DF8BF03F12024D53B9AC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EditFormat.mp3.ENC

Path C:\Users\Admin\Desktop\EditFormat.mp3.ENC
Size 942KB
SHA256 01c008062475153d9b48a6a304ec18a3a512fa286e3d68f1a30ac3621c722035
MD5 4a1bb8a24bd90ee6f307978b73e625c9
SHA1 76b85d97a10ec76423c2afd447d10589a178de4f
SHA512 8a25924d221f01de2d41648a115be19ed875837cefd090dae30656f2f2c7a631ccb875f638ecfabcb7b7e33af005d71a84782b7a5e6b8b27dfdf78fe41a775aa
SSDEEP 24576:klok7RneB6JwjSCIV7Yqvu8d5mkHn3XdWfnPawNLU4AF:kRBeBYC0Y/kHn4PVNLmF
TLSH
T14F2533F37B8485D620A2BB776983FB5175593E5CA0926620A0117FF1AFD508603DD3F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ExitPing.pptm.ENC

Path C:\Users\Admin\Desktop\ExitPing.pptm.ENC
Size 696KB
SHA256 3858ef7b88b5c95948dd340b30796639ce4cd714a2adf138ef5cf4397aa41a44
MD5 f54a38b7329db866999d702acb0f6186
SHA1 514d8f43c77350dc632c26d9de8cb969eb0b7b6d
SHA512 808b33cc66c13c4fae4ace56bb4761db8942799e43c32fc7f0e1cc57af54a8ac09d90cf60efa344114173736c19cb2f23f6af26bdac9e5c525cb3ef24693e501
SSDEEP 12288:dt6SbJ9k1VFM+AUUek6HJ0jVI3V50/Y4pa2E7LgNxuuEwA5zWMtcCOmXA1AJWQ5e:dJcDCUUek6HGKV52Y4p3E7LgidB5z1cj
TLSH
T1CDE4337EDC0ABF9C1C7A9A59AC35DCFE2BE8A3D2680247427599533053429A71CF530E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HideStep.eps.ENC

Path C:\Users\Admin\Desktop\HideStep.eps.ENC
Size 819KB
SHA256 0c7afe0d2f00464e649384d781e583c55c83b8360cce835abc356fe2ccccfbaa
MD5 bd828c202cc458dbf810f34d42f09da7
SHA1 7440309679ae0e743f359304bb76fd4efe345966
SHA512 611b070d88133ea5350ba34def2aa504ff27314a9964c931d5d1891631b0c024743b99121352d2f3c3a2a90c400387db08ee14d6f15865ea0340e3161835d6e8
SSDEEP 12288:q7aYlPVi5UuWDJET1uYcHhK9H6jvpV8nyoKFCf0gplcjz1cVhqr9F2vSiqgU3Ier:qRVNDDYcHhuQCnjplUChiWvqg2x1L
TLSH
T1F40533B37169EEABD32980FE8413471A4446A20257F5BBD2A3C32FD966B1125CFCD44B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

How To Decrypt My Files.html

Path C:\Users\Admin\Desktop\How To Decrypt My Files.html
Size 723B
SHA256 bfbb59fa451071b37088b6286c3e5941f2536c4d9a1b77c1c6e987da9545b6ae
MD5 553cf6c7e10d1c701098d7e1d0a01839
SHA1 3cbdf41c6d02de51754a2696a382485be5175771
SHA512 591ace58027c743e663598f29857e3fa52e47e5a015dfb5e46570fcc563b623306b6e9de5df0aed2f5242c7ae88178aced6c909ec3b8c075b5d7239922d3183c
TLSH
T13901F4E0DB614DA47633096AB509B725DF70679370943E6D328ED3139FF0416894B2CC
MD5 SHA1 SHA512 TLSH

Submit Download

JoinRemove.bat.ENC

Path C:\Users\Admin\Desktop\JoinRemove.bat.ENC
Size 1.6MB
SHA256 c2f64b5d5f2ad11ebd519cbd128af151fc0acd4bf9267ee5c3cea092107e04d9
MD5 1400e2e624692b651cda17fa34074c1e
SHA1 b1aa202bbde018f02dec3a95e555458dd781c84e
SHA512 8ba9e94c3ef919534f36bd63d73e4f836d291c40f97f596c0c096c2f37b8b8239b9af4101e88ad80ad39549b8d064d9e0ca36528d7195458d16beee929d85407
SSDEEP 49152:Y3xWMlVYvy6Fvk8G8GZVNMtynSFxGnfUt:UWGmvZJk8G8GZVkFxFt
TLSH
T1DD75334D1B4B5E11D2E3955ABEC197EA2101B50F6B641C2C866C6C223C7EC74BB67CCB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LockRestore.WTV.ENC

Path C:\Users\Admin\Desktop\LockRestore.WTV.ENC
Size 573KB
SHA256 48dc85a7623045d571815a05e2faf19c0c72d4760c7da93898c707d587839094
MD5 9314e3c1d82ae273f2997574067bec84
SHA1 68ac917554d2b4ed914c87b67350f631ed9e22b9
SHA512 4b92310900591efab41622f82a67af154acbe3f05de7539b1de40e3e18c5df8fb76a989f88b8a690a0caaea7ad1aa0ce349908d4d6ab536ffc821a26886f5731
SSDEEP 12288:/BClumU3i586oEJ3fTWy9TBCQn11YxMzv7fq:Zo+i5oEdWq/1egrq
TLSH
T1DEC4238B78657F9C8749D68452952F6AF43D482E0CB11B61F72EBF33264F5B2041E2D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MergeExpand.tmp.ENC

Path C:\Users\Admin\Desktop\MergeExpand.tmp.ENC
Size 409KB
SHA256 b120985a8e44575ba5f8fb4c24674d755d72b15e298e2e1969b664449ad5859f
MD5 5982768a0267dc7b59c9744c53a3cb3f
SHA1 5dc729a1d53d850626cae023da56d6762a0379c6
SHA512 3691dffc0a7da7f8f763e8724605a3173509d8306d57472e5b5cd7d0497f01a3401f9cb739a23f7cafba7146c14544f9b7bec29fbba18e1f764b5840c0b1a01d
SSDEEP 12288:ZkfRr11e2Fg1sle1QRcLIVJLEzK3txXt5B1:iv1e2DeW+L8JLEivH
TLSH
T1189423B64443382CD457F502E6239EDE938DB887E6BBE8C62751217C444A27DB27B31B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft Edge.lnk.ENC

Path C:\Users\Admin\Desktop\Microsoft Edge.lnk.ENC
Size 2KB
SHA256 9360fa1ed63d5a312ca5bb6b1c4268beda5c6df93128892c15d327f69e24ba47
MD5 0f3c93ed6ba668761bbe34061a44f736
SHA1 1e426c207eef2f4b6cb456d7e1f43161290a3c4e
SHA512 693a76fb5d4e5cd666c96f370957f9e0adf9a118627a6396b68b21c8db7f113545a95be4f7884a93f823825a8b594515d6feeeac222fe791d2263c49941c6bd7
TLSH
T1A541389E8129D23C5430AA2F84A2C780DA4E261424E426EE36AD588C2B15A29CE357F2
MD5 SHA1 SHA512 TLSH

Submit Download

ProtectUnregister.ps1.ENC

Path C:\Users\Admin\Desktop\ProtectUnregister.ps1.ENC
Size 901KB
SHA256 964c0d4c489919e7c74c2ca4d0120a78c50ff0887d28592f5bd1d03477917f1e
MD5 dfb27d42fac073eaeba545143f522678
SHA1 e512202f4204469871191a16cda0fad6927332c5
SHA512 c06d75d681a4133e3d3dae51555698334717a9cd8140886db9198c711a54c14ff26ce3b19d5918b59036bf3cf380d0511924c832890aad9bd8878acd3e24dd73
SSDEEP 24576:t0sfNcCj9So2OnhIJadS5hFcXQSo4To60d:yyN5RhmQS5heXXTJk
TLSH
T1071533D255A0A8728F3A7ABC07E396D5B4EDB0D7856E2935D5CA778CE8013CA773600C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ResolvePush.m4a.ENC

Path C:\Users\Admin\Desktop\ResolvePush.m4a.ENC
Size 1024KB
SHA256 53a6b288904ee3a613f63931783a59bb90d2db1492727cc4e955720a954289f1
MD5 7ccbe3c45f22c608d4bd11288d83d632
SHA1 8b81df03607b12ab766b0040375fad8275abacfd
SHA512 74d48d4b5fea05f2f1ecaf965da5045ee3676783fd6b45c05ca3b91be80e3d3314b15775b9570f5cb5f20b5db3bef6f49531b2167506332ffcee28b8cd781f56
SSDEEP 12288:wNpF5zvL1jJBf9yMzb04vLPIRSLbwNXv9z08P44WV0u8aKhWRL8JT0AsiLP2VyDX:w1JrB04zfLbe9u440u8BT0ViLaySn+ZL
TLSH
T1152533B915454B81E94C4F01D67A93629C371EC4BEB0CF467CAD80C12FAE97A8EE6C4D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SaveApprove.ps1.ENC

Path C:\Users\Admin\Desktop\SaveApprove.ps1.ENC
Size 778KB
SHA256 f2f009e0f3cbb7d2642f30f35abbb2936bd5e20a3fe8496bad1df8b2ef31eee5
MD5 cb789c07e393fa7c736261e466f833c2
SHA1 1a34eb68a5e5d3ec3d207625270e93071e7cf33c
SHA512 7843cc034b8e550b0e1743664317459fb820b646c6cc497ff7a65e21b98d01a0d620af5b9449a38af3fc8fdf6e3c47f7b686c21c649a6368b336c885b4bce1ff
SSDEEP 24576:RIxBz/ccIRLLwRXTPnC1/d4ezVcrhUUByj:SxBz5w3w9LnK/qecrmsM
TLSH
T12C0533BA8705ED4C181F836C8DD9F029954643DB32B40EB6C63F2EF26A5E1E91471F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ShowSave.xlsm.ENC

Path C:\Users\Admin\Desktop\ShowSave.xlsm.ENC
Size 860KB
SHA256 02d84e640ace854b4f822374f9449c606b03eb67a20014bbb64ca6355983dc35
MD5 88bcc4c52ec98b4afc769f9c17402ff0
SHA1 d35a387df5dfba8498e0595fbc5c148d72442fe6
SHA512 f45ead0c1b218146567303a459f513e6107d47810bd7926c07683b9e9bab8c9c14e162226853b255d37efd92e44dddd7ff0f0a3c167083ca75e873c5f79a8df3
SSDEEP 24576:FNBiTx9XlKp/lwhyN08F6ZEHz1GYECujfxqBpS5:F3GxvWwM6wGF7f4I
TLSH
T1C4153329D21D6ACB4882E9778B744384D3F21D54B877F3E5DABC223B5C662500F099CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SubmitCompress.docx.ENC

Path C:\Users\Admin\Desktop\SubmitCompress.docx.ENC
Size 13KB
SHA256 c417616330dfabba9b484e964b47549fa01be49ea2afdca64cebb89c86ca0a57
MD5 b5bdcb52a84a0522484ca6a930ffd5f9
SHA1 18ce96d18085737b75f9b4850b848577be79883e
SHA512 adbba878211956805a26e2cff6cf6bb131a610654a84e384c179e465791367c4f50d71870e86fbccc6bdfe9ad860fb12fa2f39b1f1d57ccc14045611979838c1
SSDEEP 384:WjGGpiC7ALdl5X7axeCx9Fk0gMejQyYYyCFMlnMAc:WKGpiC7AtLa1CrXhyCFME
TLSH
T17B52CF794C9A2179A444624389C5EFC0B4CE69156883C70BBD9B126FB4E1FBE18ED61C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SubmitReceive.rle.ENC

Path C:\Users\Admin\Desktop\SubmitReceive.rle.ENC
Size 614KB
SHA256 57fa9ad3a4973ed6e6f524195e7933eac0fe8ca073d1cae77097f8f68c379cf3
MD5 5568e336b1086e5b400568989fca0779
SHA1 5fcb5628d24da1c3d334cd6cfc55231baf8b62ee
SHA512 5b029cbf3634f136d39010c254b6608eb965f76021b9f7c46efa545499c0758c683a75056c4114c28e2ef9945b86dfce2ffcac6883c2a9b0e690ec77a0472ba4
SSDEEP 12288:Bhxfwz/8QT7dRDPfCFbzdf4socZcT6gjY9oU20bakx9WI6ZgO:tfq1DfCFt4son6gjqWCYgO
TLSH
T19CD423A60438C9D0BBCD875FBE89DC013CAD5923C1BE6153706D00E589F2A4DAA97E5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UnlockSave.rle.ENC

Path C:\Users\Admin\Desktop\UnlockSave.rle.ENC
Size 491KB
SHA256 dd1bb3e5bc94d47154b27b37bccbe8f673d20020331c5bacb15fb7de6748ba53
MD5 015d84664e1d6183977fce24338f7da9
SHA1 527bf9bfdea8f6217b56bd8d97fd17474002a7d3
SHA512 da40ddb38a848809cc0d76909d9f9d388336e5881725dd05f78033704d71176837092ed7095649c44a3cb06ee9e953f20f2997df819c264e57c8e700937906ef
SSDEEP 12288:+qXK8P5RyncOw9zV7ajBa6gghUPddbJf6LUBOPMax:HP5RP9zV7ao6gghUFdbcLUjax
TLSH
T10DB4231720D7F8386AEE3A387A10FD119ED5EA24D47637AC7CF89AFD4C64662B0021D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UnregisterDeny.png.ENC

Path C:\Users\Admin\Desktop\UnregisterDeny.png.ENC
Size 1.1MB
SHA256 7a50af7923c10b64fbe2238a2fef7bcba01698883581dd2f0c2ce3232c81be08
MD5 9e14a86ddddf811037be1b9b88838002
SHA1 89a87be70833967aed95d4098d219f796db256e5
SHA512 58a77254f01ceac269032f74912c8eb78daf39228781ebcd086acf4b4e145383dff11b12c4127330470be0d514f067b0169acb5709734c6eb6c80af8461ec0e4
SSDEEP 24576:2Z+kTp0i8BNR6tKSfWPdsFyYbXK+7CBIy/supL:24Wpb8Br6sSfWPERbD6TN
TLSH
T1573533B3B6C7E59869DAD3F47204B487A8196089F05E72B72E3BE04B70F95D32577280
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WaitRemove.jpe.ENC

Path C:\Users\Admin\Desktop\WaitRemove.jpe.ENC
Size 737KB
SHA256 9bd2f332dd741a58e625e78d81b3baf265c73aac7bd26584cef79a21c8b31b7b
MD5 93bd6b97d7400ae239280ee456119027
SHA1 a6fe80beea37fde0cee59d866fdaccd25c3a129e
SHA512 bc779883f067a099d64554fc9841c604510aed4880aef2fd7d0e5fb496610dc671a45babb535da73d4f53e427f14f610ad24b6cc88c8c734ffbb403aeda623ea
SSDEEP 12288:BjPJJuP6hpOWF+qMuQNyQWZHhxXDuvFgTF0CdJuF1AAwz//LWsFeOWxyZbftjSy1:BLJiuMgbMQDMYdJuoA0asFwYRJBD
TLSH
T1C1F4334D2363CFA5B2AC5D98CF2670947D560C8B4E8B5FDE2AEADD271E542386C481C3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WaitRepair.xlsm.ENC

Path C:\Users\Admin\Desktop\WaitRepair.xlsm.ENC
Size 655KB
SHA256 0c2ec1bd323de9ad5fc1d1af8c5177a9cf8de376889a541c7222db2eed448c7d
MD5 18a25732ec997f3a04393191320de782
SHA1 47def919d24f2ca5b7f1d90c344fda4852ac880d
SHA512 d591d721ee0fd6699b272298f12b34ab3da97528b6a0d8455c0705b25b388b489680f3b93d8fee7ce7cbac7386411a3b0a06a450a699180445d2e93f6e590b68
SSDEEP 12288:ze2ykX4f5tteEXwECOhLFckGuqIIR0k/bZTmv55WjTJMOuHFY5WGC:ze6X4fBeqE3JRHKvzOuHFWWGC
TLSH
T168E423EC7FECE420DCA928C1D425A79EBDF269D75E2184D35C64822F826550D3E733A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

desktop.ini.ENC

Path C:\Users\Admin\Desktop\desktop.ini.ENC
Size 288B
SHA256 d9b51db5c529b7cca854761efbbad7fbecec193d85b6e17d792de1c7534ee150
MD5 82a4786217f2b4b05266700dd5ddbf4a
SHA1 a9b052b1c4292fa5c8b51935b9cdb031ee325c87
SHA512 50e9672e638062da54c207041971a09057101a43c1170e483fcd9d27ece2f70643c971980eb7b6dd3a0da69c4aed0735a29282dd6a5267cb5a3d07b2fb1114ff
TLSH
T138D0E75D3308807042523DB447B8F0C7D12D075D2181B7C44605E96C87550CD6C81407
MD5 SHA1 SHA512 TLSH

Submit Download

NTUSER.DAT{2fa72cf3-34ca-11ed-acae-cbf1edc82a99}.TMContainer00000000000000000001.regtrans-ms.ENC

Path C:\Users\Admin\NTUSER.DAT{2fa72cf3-34ca-11ed-acae-cbf1edc82a99}.TMContainer00000000000000000001.regtrans-ms.ENC
Size 16B
SHA256 68e53f1196f7dfcc29415b68e7fc4501a220f56a9b19e89dd09bcaec7ece6b13
MD5 fdd327a353355c8a59949d706630f24a
SHA1 83aa67c08ef1427f8084023a331912e195755bfa
SHA512 885495d70d6703f25127243e8a29048e2a556b40009b457ae722b2b0f0b15f965727845a35b96a81a9341ac4af2bb4ecc479267e9da153a56621bffa8d828e91
MD5 SHA1 SHA512

Submit Download

keys.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1760_741783767\keys.json
Size 8KB
SHA256 ae6e69a145f84c0a261b4e82888779fbf137f193881d687588e1af71609ae947
MD5 d3ebc1cb4b692c6e2d29a4625420fe73
SHA1 4ce74c1e9af6fd34d6379ec0fec6afb24082a7c1
SHA512 e34b855615e6a3bf770f27d85aa29ca57a324c08bd8f8d9c0130e2a142c0e4a5f17bffd0861b725acc8a2316f73b7fe50406b0af26264a5c2d8f37599b260860
SSDEEP 192:uNtGbR+mFGfvPNyR9Pm4lOvMwkoR9PuGMXcy:ORmqwKjA
TLSH
T18402A57F14A41181CE7FC1698F0B78B78FA038065BCA3A83539BFA49494296D173B5B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1760_741783767\manifest.json
Size 79B
SHA256 7ea98f2308a9c51d17a1ac71b64afbe2a41ff0a083a166a0e4cc428bf44f0715
MD5 817fea104100763cd1bf4f15a51bfe94
SHA1 589717cf98cf7e2d55fc0d6025a4b8e215ed13d6
SHA512 da7b959d93113c5a6be360f90d9c721989c5e7acad7fa592081b582c4c3a0c4a9066a71473fd8492ce7fe7b0fbfd6870d939428a67fbd508fcf6b2c6dc1a41ea
TLSH
T15EA0122058019233108407600360478243551C022015244809461041258813A12A3128
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1676-245-0x00000229E32D0000-0x00000229E368B000-memory.dmp

Download

memory/3908-382-0x0000021669520000-0x0000021669898000-memory.dmp

Download

memory/3908-381-0x0000021669520000-0x0000021669898000-memory.dmp

Download

memory/4304-359-0x000000001C0B0000-0x000000001C0BA000-memory.dmp

Download

memory/4304-7-0x000000001BB60000-0x000000001BED8000-memory.dmp

Download

memory/4304-365-0x000000001BB60000-0x000000001BED8000-memory.dmp

Download

memory/4304-0-0x0000000000F60000-0x0000000000F6E000-memory.dmp

Download

memory/4304-72-0x000000001BB60000-0x000000001BED8000-memory.dmp

Download

memory/4304-660-0x000000001BB60000-0x000000001BED8000-memory.dmp

Download

memory/4304-9-0x0000000001640000-0x000000000164C000-memory.dmp

Download

memory/4304-8-0x000000001BB60000-0x000000001BED8000-memory.dmp

Download

memory/4304-659-0x000000001BB60000-0x000000001BED8000-memory.dmp

Download

memory/4304-628-0x000000001BB60000-0x000000001BED8000-memory.dmp

Download

memory/4304-6-0x000000001BB60000-0x000000001BED8000-memory.dmp

Download

memory/4304-5-0x000000001BB60000-0x000000001BED8000-memory.dmp

Download

memory/4304-4-0x000000001BB60000-0x000000001BED8000-memory.dmp

Download

memory/4304-3-0x000000001C0C0000-0x000000001C0D0000-memory.dmp

Download

memory/4304-2-0x000000001BB60000-0x000000001BED8000-memory.dmp

Download

memory/4304-1-0x000000001C0C0000-0x000000001C0D0000-memory.dmp

Download

memory/4304-658-0x00000000021E0000-0x00000000021EA000-memory.dmp

Download

memory/4304-392-0x000000001BB60000-0x000000001BED8000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads