a7c9743655a640be30dc557d22eab580a2e4dc3dea7d767e20dc1079a8a1b132

Analysis

user interaction
yes
max time kernel
165s
max time network
161s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
30/04/2026, 22:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Dupe Mod.jar
Size 1.3MB
Sample260430-2md8jsat91
SHA256 a7c9743655a640be30dc557d22eab580a2e4dc3dea7d767e20dc1079a8a1b132
MD5 22c003f4b9d3a96a9682c50972d359dd
SHA1 4a825b90d0bf0f4dcd9518e664d71ddc0272df15
SHA512 f1b5acf3a8eaa90c6b963d6f05c4c1905932771c71d049feda1ebf4f62434e016074876e0ba751ed6615e6f45f48b828b5e0f36916d1f841447ea741baa11724
SSDEEP 24576:bYlE7Y1aWwexYeMExsSB/5Ghd1A+RZLu1ljY6vrNUorrpukX8pNkYz16X:57K7xhMExpp5U1AWZyY6msdCpNcX
TLSH
T19C5533560FB54D04F2A118387E483F59A018FDAD4AD588BE2E136C95C0C88767CDEFEA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery ransomware

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
201	5976	msedge.exe

Executes dropped EXE 7 IoCs

pid	Process
1048	jdk-21_windows-x64_bin.exe
1156	jdk-21_windows-x64_bin.exe
1556	javaw.exe
4236	javaw.exe
2248	javaw.exe
1876	javaw.exe
5456	javaw.exe

Loads dropped DLL 42 IoCs

pid	Process
1192	MsiExec.exe
1192	MsiExec.exe
1192	MsiExec.exe
1192	MsiExec.exe
1192	MsiExec.exe
1192	MsiExec.exe
5688	MsiExec.exe
5688	MsiExec.exe
5688	MsiExec.exe
5688	MsiExec.exe
5688	MsiExec.exe
5688	MsiExec.exe
5688	MsiExec.exe
5688	MsiExec.exe
5688	MsiExec.exe
5688	MsiExec.exe
5688	MsiExec.exe
5688	MsiExec.exe
812	MsiExec.exe
812	MsiExec.exe
812	MsiExec.exe
812	MsiExec.exe
812	MsiExec.exe
812	MsiExec.exe
812	MsiExec.exe
812	MsiExec.exe
812	MsiExec.exe
812	MsiExec.exe
812	MsiExec.exe
812	MsiExec.exe
812	MsiExec.exe
812	MsiExec.exe
1556	javaw.exe
1556	javaw.exe
4236	javaw.exe
4236	javaw.exe
2248	javaw.exe
2248	javaw.exe
1876	javaw.exe
1876	javaw.exe
5456	javaw.exe
5456	javaw.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\system32\WindowsAccessBridge-64.dll	MsiExec.exe
File opened for modification	C:\Windows\system32\WindowsAccessBridge-64.dll	MsiExec.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk-21.0.11\jmods\java.compiler.jmod	MsiExec.exe
File created	C:\Program Files\Java\jdk-21.0.11\jmods\java.logging.jmod	MsiExec.exe
File created	C:\Program Files\Java\jdk-21.0.11\jmods\jdk.internal.ed.jmod	MsiExec.exe
File created	C:\Program Files\Java\jdk-21.0.11\legal\java.instrument\LICENSE	MsiExec.exe
File created	C:\Program Files\Java\jdk-21.0.11\bin\api-ms-win-core-datetime-l1-1-0.dll	MsiExec.exe
File created	C:\Program Files\Java\jdk-21.0.11\include\win32\bridge\AccessBridgeCalls.h	MsiExec.exe
File created	C:\Program Files\Java\jdk-21.0.11\legal\java.smartcardio\COPYRIGHT	MsiExec.exe
File created	C:\Program Files\Java\jdk-21.0.11\legal\jdk.javadoc\LICENSE	MsiExec.exe
File created	C:\Program Files\Java\jdk-21.0.11\legal\jdk.security.jgss\COPYRIGHT	MsiExec.exe
File created	C:\Program Files\Java\jdk-21.0.11\legal\jdk.unsupported.desktop\COPYRIGHT	MsiExec.exe
File created	C:\Program Files\Java\jdk-21.0.11\bin\api-ms-win-crt-math-l1-1-0.dll	MsiExec.exe
File created	C:\Program Files\Java\jdk-21.0.11\bin\mlib_image.dll	MsiExec.exe
File created	C:\Program Files\Java\jdk-21.0.11\bin\msvcp140.dll	MsiExec.exe
File created	C:\Program Files\Java\jdk-21.0.11\bin\saproc.dll	MsiExec.exe
File created	C:\Program Files\Java\jdk-21.0.11\jmods\java.sql.jmod	MsiExec.exe
File created	C:\Program Files\Java\jdk-21.0.11\jmods\jdk.internal.le.jmod	MsiExec.exe
File created	C:\Program Files\Java\jdk-21.0.11\legal\jdk.accessibility\LICENSE	MsiExec.exe
File created	C:\Program Files\Java\jdk-21.0.11\bin\le.dll	MsiExec.exe
File created	C:\Program Files\Java\jdk-21.0.11\bin\api-ms-win-core-handle-l1-1-0.dll	MsiExec.exe
File created	C:\Program Files\Java\jdk-21.0.11\bin\api-ms-win-crt-heap-l1-1-0.dll	MsiExec.exe
File created	C:\Program Files\Java\jdk-21.0.11\bin\dt_socket.dll	MsiExec.exe
File created	C:\Program Files\Java\jdk-21.0.11\bin\javadoc.exe	MsiExec.exe
File created	C:\Program Files\Java\jdk-21.0.11\bin\jimage.dll	MsiExec.exe
File created	C:\Program Files\Java\jdk-21.0.11\jmods\jdk.jcmd.jmod	MsiExec.exe
File created	C:\Program Files\Java\jdk-21.0.11\jmods\jdk.jpackage.jmod	MsiExec.exe
File created	C:\Program Files\Java\jdk-21.0.11\include\classfile_constants.h	MsiExec.exe
File created	C:\Program Files\Java\jdk-21.0.11\jmods\java.instrument.jmod	MsiExec.exe
File created	C:\Program Files\Java\jdk-21.0.11\legal\java.desktop\colorimaging.md	MsiExec.exe
File created	C:\Program Files\Java\jdk-21.0.11\legal\java.desktop\giflib.md	MsiExec.exe
File created	C:\Program Files\Java\jdk-21.0.11\legal\jdk.attach\COPYRIGHT	MsiExec.exe
File created	C:\Program Files\Java\jdk-21.0.11\legal\jdk.crypto.cryptoki\pkcs11cryptotoken.md	MsiExec.exe
File created	C:\Program Files\Java\jdk-21.0.11\legal\jdk.hotspot.agent\LICENSE	MsiExec.exe
File created	C:\Program Files\Java\jdk-21.0.11\legal\jdk.jcmd\LICENSE	MsiExec.exe
File created	C:\Program Files\Java\jdk-21.0.11\bin\api-ms-win-core-processenvironment-l1-1-0.dll	MsiExec.exe
File created	C:\Program Files\Java\jdk-21.0.11\conf\logging.properties	MsiExec.exe
File created	C:\Program Files\Java\jdk-21.0.11\legal\java.base\wepoll.md	MsiExec.exe
File created	C:\Program Files\Java\jdk-21.0.11\legal\jdk.management\LICENSE	MsiExec.exe
File created	C:\Program Files\Java\jdk-21.0.11\legal\jdk.unsupported\COPYRIGHT	MsiExec.exe
File created	C:\Program Files\Java\jdk-21.0.11\lib\modules	MsiExec.exe
File created	C:\Program Files\Java\jdk-21.0.11\bin\api-ms-win-core-console-l1-1-0.dll	MsiExec.exe
File created	C:\Program Files\Java\jdk-21.0.11\bin\api-ms-win-core-console-l1-2-0.dll	MsiExec.exe
File created	C:\Program Files\Java\jdk-21.0.11\bin\jarsigner.exe	MsiExec.exe
File created	C:\Program Files\Java\jdk-21.0.11\jmods\jdk.security.jgss.jmod	MsiExec.exe
File created	C:\Program Files\Java\jdk-21.0.11\legal\java.rmi\LICENSE	MsiExec.exe
File created	C:\Program Files\Java\jdk-21.0.11\legal\jdk.javadoc\COPYRIGHT	MsiExec.exe
File created	C:\Program Files\Java\jdk-21.0.11\legal\jdk.jpackage\LICENSE	MsiExec.exe
File created	C:\Program Files\Java\jdk-21.0.11\bin\api-ms-win-core-file-l1-1-0.dll	MsiExec.exe
File created	C:\Program Files\Java\jdk-21.0.11\bin\jpackage.dll	MsiExec.exe
File created	C:\Program Files\Java\jdk-21.0.11\jmods\java.se.jmod	MsiExec.exe
File created	C:\Program Files\Java\jdk-21.0.11\legal\jdk.incubator.vector\LICENSE	MsiExec.exe
File created	C:\Program Files\Java\jdk-21.0.11\legal\jdk.zipfs\LICENSE	MsiExec.exe
File created	C:\Program Files\Java\jdk-21.0.11\bin\api-ms-win-core-synch-l1-1-0.dll	MsiExec.exe
File created	C:\Program Files\Java\jdk-21.0.11\bin\server\jvm.dll	MsiExec.exe
File created	C:\Program Files\Java\jdk-21.0.11\conf\management\jmxremote.access	MsiExec.exe
File created	C:\Program Files\Java\jdk-21.0.11\jmods\java.smartcardio.jmod	MsiExec.exe
File created	C:\Program Files\Java\jdk-21.0.11\jmods\jdk.internal.vm.compiler.jmod	MsiExec.exe
File created	C:\Program Files\Java\jdk-21.0.11\legal\java.scripting\COPYRIGHT	MsiExec.exe
File created	C:\Program Files\Java\jdk-21.0.11\legal\jdk.compiler\LICENSE	MsiExec.exe
File created	C:\Program Files\Java\jdk-21.0.11\legal\jdk.nio.mapmode\LICENSE	MsiExec.exe
File created	C:\Program Files\Java\jdk-21.0.11\bin\api-ms-win-core-synch-l1-2-0.dll	MsiExec.exe
File created	C:\Program Files\Java\jdk-21.0.11\bin\jstack.exe	MsiExec.exe
File created	C:\Program Files\Java\jdk-21.0.11\conf\security\java.policy	MsiExec.exe
File created	C:\Program Files\Java\jdk-21.0.11\legal\java.desktop\mesa3d.md	MsiExec.exe
File created	C:\Program Files\Java\jdk-21.0.11\legal\jdk.xml.dom\LICENSE	MsiExec.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping692_1381241955\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping692_1381241955\_locales\it\messages.json	msedge.exe
File opened for modification	C:\Windows\Installer\MSIECE7.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping692_1381241955\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping692_1381241955\_locales\af\messages.json	msedge.exe
File opened for modification	C:\Windows\Installer\MSIEC44.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEC55.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping692_1381241955\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping692_1381241955\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping692_1381241955\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping692_1381241955\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping692_1381241955\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping692_1381241955\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping692_1381241955\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping692_1381241955\_locales\kk\messages.json	msedge.exe
File opened for modification	C:\Windows\Installer\MSIFD2B.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF39AE7E81733309FF.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3396_1477229606\keys.json	msedge.exe
File opened for modification	C:\Windows\Installer\MSIFD8F.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping692_1381241955\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping692_1381241955\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping692_1381241955\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping692_1381241955\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping692_1381241955\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping692_1381241955\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping692_1381241955\page_embed_script.js	msedge.exe
File created	C:\Windows\Installer\e58e191.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF787.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping692_1381241955\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping692_1381241955\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping692_1381241955\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping692_1381241955\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping692_1381241955\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\~DFCAA9E73CFB957777.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEBE4.tmp	msiexec.exe
File created	C:\Windows\Installer\e58e193.msi	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping692_1381241955\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping692_1381241955\_locales\el\messages.json	msedge.exe
File opened for modification	C:\Windows\Installer\MSIED07.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFD1A.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping692_1381241955\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping692_1381241955\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping692_1381241955\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping692_1381241955\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping692_1381241955\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping692_1381241955\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping692_1381241955\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping692_1381241955\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3396_1477229606\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping692_1381241955\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping692_1381241955\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping692_1381241955\_locales\mk\messages.json	msedge.exe
File opened for modification	C:\Windows\Installer\MSIFCC8.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFD5C.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFD6C.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping692_1381241955\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping692_1381241955\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping692_1381241955\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping692_1381241955\_locales\sv\messages.json	msedge.exe
File opened for modification	C:\Windows\Installer\MSIEC24.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3396_1926701840\deny_etld1_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping692_1381241955\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping692_1381241955\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping692_1381241955\_locales\sr\messages.json	msedge.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\jdk-21_windows-x64_bin.exe:Zone.Identifier	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5976	msedge.exe
4568	msedge.exe

Checks SCSI registry key(s) 3 TTPs 8 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000e689d3d397d010a60000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000e689d3d30000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900e689d3d3000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1ae689d3d3000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1de689d3d3000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Winword.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Winword.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msiexec.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	msiexec.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	Winword.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	Winword.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	Winword.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	Winword.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 17 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Console	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Keyboard Layout	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Control Panel	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Environment	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Printers	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	MsiExec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134220625287781688"	msedge.exe
Key created	\REGISTRY\USER\.DEFAULT\EUDC	MsiExec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\System	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 44 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\18AAE151D2FDDC25DB2B70C6ABE50AB1	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\18AAE151D2FDDC25DB2B70C6ABE50AB1\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1456842261-3464001825-2855069093-1000\{A89C6D40-E841-454A-9AD1-3C0970648A48}	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\18AAE151D2FDDC25DB2B70C6ABE50AB1\SourceList\Media\DiskPrompt = "[1]"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Applications\java.exe	MsiExec.exe
Key created	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.WindowsTerminal_8wekyb3d8bbwe\StartTerminalOnLoginTask	taskmgr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\18AAE151D2FDDC25DB2B70C6ABE50AB1	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\18AAE151D2FDDC25DB2B70C6ABE50AB1\ProductName = "Java(TM) SE Development Kit 21.0.11 (64-bit)"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\18AAE151D2FDDC25DB2B70C6ABE50AB1\PackageCode = "08842C9F785F30646B9422E6BE6AC0F6"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\18AAE151D2FDDC25DB2B70C6ABE50AB1\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\LocalLow\\Oracle\\Java\\jdk21.0.11_x64\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\java.exe\IsHostApp	MsiExec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.jar	MsiExec.exe
Key created	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\18AAE151D2FDDC25DB2B70C6ABE50AB1\ToolsFeature	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\jarfile\shell\open\command	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\18AAE151D2FDDC25DB2B70C6ABE50AB1\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\18AAE151D2FDDC25DB2B70C6ABE50AB1\ProductIcon = "C:\\Program Files\\Java\\jdk-21.0.11\\\\bin\\java.exe"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\18AAE151D2FDDC25DB2B70C6ABE50AB1\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\18AAE151D2FDDC25DB2B70C6ABE50AB1\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\18AAE151D2FDDC25DB2B70C6ABE50AB1\SourceList\Media\1 = "DISK1;1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\18AAE151D2FDDC25DB2B70C6ABE50AB1\SourceList\Media\2 = "DISK1;1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\jarfile\shell\open\command\ = "\"C:\\Program Files\\Java\\jdk-21.0.11\\bin\\javaw.exe\" -jar \"%1\" %*"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\4F4A3A46297B6D117AA8000B0D022001	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\4F4A3A46297B6D117AA8000B0D022001\18AAE151D2FDDC25DB2B70C6ABE50AB1	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\18AAE151D2FDDC25DB2B70C6ABE50AB1\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\LocalLow\\Oracle\\Java\\jdk21.0.11_x64\\"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\18AAE151D2FDDC25DB2B70C6ABE50AB1\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Applications\javaw.exe	MsiExec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1456842261-3464001825-2855069093-1000\{E32FB054-455F-4E61-8CCA-1A3CAC072410}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1456842261-3464001825-2855069093-1000\{77CEAD14-E504-48CE-990A-0EA65B2D6F97}	msedge.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\18AAE151D2FDDC25DB2B70C6ABE50AB1\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\18AAE151D2FDDC25DB2B70C6ABE50AB1\Version = "352321547"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\18AAE151D2FDDC25DB2B70C6ABE50AB1\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\18AAE151D2FDDC25DB2B70C6ABE50AB1\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\javaw.exe\IsHostApp	MsiExec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\jarfile	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\18AAE151D2FDDC25DB2B70C6ABE50AB1\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\18AAE151D2FDDC25DB2B70C6ABE50AB1\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\18AAE151D2FDDC25DB2B70C6ABE50AB1\SourceList\PackageName = "jdk21.0.1164.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\jarfile\ = "Executable Jar File"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.jar\ = "jarfile"	MsiExec.exe
Key created	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000_Classes\Local Settings	OpenWith.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\jdk-21_windows-x64_bin.exe:Zone.Identifier	msedge.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
2648	Winword.exe
2648	Winword.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
2148	taskmgr.exe
2148	taskmgr.exe
2148	taskmgr.exe
2148	taskmgr.exe
2148	taskmgr.exe
2148	taskmgr.exe
2148	taskmgr.exe
6040	msiexec.exe
6040	msiexec.exe
3396	msedge.exe
3396	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4748	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
3396	msedge.exe
3396	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2148	taskmgr.exe
Token: SeSystemProfilePrivilege	2148	taskmgr.exe
Token: SeCreateGlobalPrivilege	2148	taskmgr.exe
Token: 33	2148	taskmgr.exe
Token: SeIncBasePriorityPrivilege	2148	taskmgr.exe
Token: SeShutdownPrivilege	2636	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2636	msiexec.exe
Token: SeSecurityPrivilege	6040	msiexec.exe
Token: SeCreateTokenPrivilege	2636	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2636	msiexec.exe
Token: SeLockMemoryPrivilege	2636	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2636	msiexec.exe
Token: SeMachineAccountPrivilege	2636	msiexec.exe
Token: SeTcbPrivilege	2636	msiexec.exe
Token: SeSecurityPrivilege	2636	msiexec.exe
Token: SeTakeOwnershipPrivilege	2636	msiexec.exe
Token: SeLoadDriverPrivilege	2636	msiexec.exe
Token: SeSystemProfilePrivilege	2636	msiexec.exe
Token: SeSystemtimePrivilege	2636	msiexec.exe
Token: SeProfSingleProcessPrivilege	2636	msiexec.exe
Token: SeIncBasePriorityPrivilege	2636	msiexec.exe
Token: SeCreatePagefilePrivilege	2636	msiexec.exe
Token: SeCreatePermanentPrivilege	2636	msiexec.exe
Token: SeBackupPrivilege	2636	msiexec.exe
Token: SeRestorePrivilege	2636	msiexec.exe
Token: SeShutdownPrivilege	2636	msiexec.exe
Token: SeDebugPrivilege	2636	msiexec.exe
Token: SeAuditPrivilege	2636	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2636	msiexec.exe
Token: SeChangeNotifyPrivilege	2636	msiexec.exe
Token: SeRemoteShutdownPrivilege	2636	msiexec.exe
Token: SeUndockPrivilege	2636	msiexec.exe
Token: SeSyncAgentPrivilege	2636	msiexec.exe
Token: SeEnableDelegationPrivilege	2636	msiexec.exe
Token: SeManageVolumePrivilege	2636	msiexec.exe
Token: SeImpersonatePrivilege	2636	msiexec.exe
Token: SeCreateGlobalPrivilege	2636	msiexec.exe
Token: SeCreateTokenPrivilege	2636	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2636	msiexec.exe
Token: SeLockMemoryPrivilege	2636	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2636	msiexec.exe
Token: SeMachineAccountPrivilege	2636	msiexec.exe
Token: SeTcbPrivilege	2636	msiexec.exe
Token: SeSecurityPrivilege	2636	msiexec.exe
Token: SeTakeOwnershipPrivilege	2636	msiexec.exe
Token: SeLoadDriverPrivilege	2636	msiexec.exe
Token: SeSystemProfilePrivilege	2636	msiexec.exe
Token: SeSystemtimePrivilege	2636	msiexec.exe
Token: SeProfSingleProcessPrivilege	2636	msiexec.exe
Token: SeIncBasePriorityPrivilege	2636	msiexec.exe
Token: SeCreatePagefilePrivilege	2636	msiexec.exe
Token: SeCreatePermanentPrivilege	2636	msiexec.exe
Token: SeBackupPrivilege	2636	msiexec.exe
Token: SeRestorePrivilege	2636	msiexec.exe
Token: SeShutdownPrivilege	2636	msiexec.exe
Token: SeDebugPrivilege	2636	msiexec.exe
Token: SeAuditPrivilege	2636	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2636	msiexec.exe
Token: SeChangeNotifyPrivilege	2636	msiexec.exe
Token: SeRemoteShutdownPrivilege	2636	msiexec.exe
Token: SeUndockPrivilege	2636	msiexec.exe
Token: SeSyncAgentPrivilege	2636	msiexec.exe
Token: SeEnableDelegationPrivilege	2636	msiexec.exe
Token: SeManageVolumePrivilege	2636	msiexec.exe

Suspicious use of FindShellTrayWindow 47 IoCs

pid	Process
692	msedge.exe
2148	taskmgr.exe
2148	taskmgr.exe
2148	taskmgr.exe
2148	taskmgr.exe
2148	taskmgr.exe
2148	taskmgr.exe
2148	taskmgr.exe
2148	taskmgr.exe
2148	taskmgr.exe
2148	taskmgr.exe
2148	taskmgr.exe
2148	taskmgr.exe
2148	taskmgr.exe
2148	taskmgr.exe
2148	taskmgr.exe
2148	taskmgr.exe
2148	taskmgr.exe
2148	taskmgr.exe
2148	taskmgr.exe
2148	taskmgr.exe
2148	taskmgr.exe
2148	taskmgr.exe
2148	taskmgr.exe
2148	taskmgr.exe
2148	taskmgr.exe
2148	taskmgr.exe
2148	taskmgr.exe
2148	taskmgr.exe
2148	taskmgr.exe
2148	taskmgr.exe
2148	taskmgr.exe
2148	taskmgr.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
2636	msiexec.exe
692	msedge.exe
2636	msiexec.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2148	taskmgr.exe
2148	taskmgr.exe
2148	taskmgr.exe
2148	taskmgr.exe
2148	taskmgr.exe
2148	taskmgr.exe
2148	taskmgr.exe
2148	taskmgr.exe
2148	taskmgr.exe
2148	taskmgr.exe
2148	taskmgr.exe
2148	taskmgr.exe
2148	taskmgr.exe
2148	taskmgr.exe
2148	taskmgr.exe
2148	taskmgr.exe
2148	taskmgr.exe
2148	taskmgr.exe
2148	taskmgr.exe
2148	taskmgr.exe
2148	taskmgr.exe
2148	taskmgr.exe
2148	taskmgr.exe
2148	taskmgr.exe
2148	taskmgr.exe
2148	taskmgr.exe
2148	taskmgr.exe
2148	taskmgr.exe
2148	taskmgr.exe
2148	taskmgr.exe
2148	taskmgr.exe
2148	taskmgr.exe

Suspicious use of SetWindowsHookEx 21 IoCs

pid	Process
4748	OpenWith.exe
4748	OpenWith.exe
4748	OpenWith.exe
4748	OpenWith.exe
4748	OpenWith.exe
4748	OpenWith.exe
4748	OpenWith.exe
4748	OpenWith.exe
4748	OpenWith.exe
4748	OpenWith.exe
4748	OpenWith.exe
4748	OpenWith.exe
4748	OpenWith.exe
2648	Winword.exe
2648	Winword.exe
2648	Winword.exe
2648	Winword.exe
2648	Winword.exe
2648	Winword.exe
2648	Winword.exe
2648	Winword.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 692 wrote to memory of 5044	692	msedge.exe	81
PID 692 wrote to memory of 5976	692	msedge.exe	82
PID 692 wrote to memory of 1784	692	msedge.exe	83
PID 692 wrote to memory of 1784	692	msedge.exe	83
PID 692 wrote to memory of 1784	692	msedge.exe	83
PID 692 wrote to memory of 5416	692	msedge.exe	84
PID 692 wrote to memory of 5416	692	msedge.exe	84
PID 692 wrote to memory of 2352	692	msedge.exe	86
PID 692 wrote to memory of 2352	692	msedge.exe	86
PID 692 wrote to memory of 2352	692	msedge.exe	86
PID 692 wrote to memory of 5556	692	msedge.exe	87
PID 692 wrote to memory of 5556	692	msedge.exe	87
PID 692 wrote to memory of 5556	692	msedge.exe	87
PID 692 wrote to memory of 660	692	msedge.exe	90
PID 692 wrote to memory of 660	692	msedge.exe	90
PID 692 wrote to memory of 5400	692	msedge.exe	91
PID 692 wrote to memory of 5400	692	msedge.exe	91
PID 692 wrote to memory of 5188	692	msedge.exe	93
PID 692 wrote to memory of 5448	692	msedge.exe	94
PID 5448 wrote to memory of 3656	5448	msedge.exe	95
PID 692 wrote to memory of 5512	692	msedge.exe	98
PID 692 wrote to memory of 5512	692	msedge.exe	98
PID 692 wrote to memory of 5512	692	msedge.exe	98
PID 692 wrote to memory of 3128	692	msedge.exe	100
PID 692 wrote to memory of 3128	692	msedge.exe	100
PID 692 wrote to memory of 3128	692	msedge.exe	100
PID 692 wrote to memory of 5568	692	msedge.exe	101
PID 692 wrote to memory of 5568	692	msedge.exe	101
PID 692 wrote to memory of 5568	692	msedge.exe	101
PID 692 wrote to memory of 748	692	msedge.exe	102
PID 692 wrote to memory of 748	692	msedge.exe	102
PID 692 wrote to memory of 748	692	msedge.exe	102
PID 692 wrote to memory of 996	692	msedge.exe	103
PID 692 wrote to memory of 996	692	msedge.exe	103
PID 692 wrote to memory of 996	692	msedge.exe	103
PID 692 wrote to memory of 2320	692	msedge.exe	104
PID 692 wrote to memory of 5876	692	msedge.exe	105
PID 692 wrote to memory of 2320	692	msedge.exe	104
PID 692 wrote to memory of 1284	692	msedge.exe	106
PID 692 wrote to memory of 1296	692	msedge.exe	107
PID 692 wrote to memory of 1284	692	msedge.exe	106
PID 692 wrote to memory of 1296	692	msedge.exe	107
PID 692 wrote to memory of 1296	692	msedge.exe	107
PID 692 wrote to memory of 2724	692	msedge.exe	108
PID 692 wrote to memory of 1216	692	msedge.exe	109
PID 692 wrote to memory of 600	692	msedge.exe	110
PID 692 wrote to memory of 228	692	msedge.exe	111
PID 692 wrote to memory of 228	692	msedge.exe	111
PID 692 wrote to memory of 2544	692	msedge.exe	112
PID 692 wrote to memory of 2544	692	msedge.exe	112
PID 692 wrote to memory of 4584	692	msedge.exe	113
PID 692 wrote to memory of 1048	692	msedge.exe	114
PID 1048 wrote to memory of 1156	1048	jdk-21_windows-x64_bin.exe	115
PID 1156 wrote to memory of 2636	1156	jdk-21_windows-x64_bin.exe	116
PID 6040 wrote to memory of 1192	6040	msiexec.exe	118
PID 692 wrote to memory of 3396	692	msedge.exe	119
PID 3396 wrote to memory of 4304	3396	msedge.exe	120
PID 3396 wrote to memory of 4568	3396	msedge.exe	122
PID 3396 wrote to memory of 1452	3396	msedge.exe	124
PID 3396 wrote to memory of 1452	3396	msedge.exe	124
PID 3396 wrote to memory of 708	3396	msedge.exe	123
PID 3396 wrote to memory of 708	3396	msedge.exe	123
PID 3396 wrote to memory of 708	3396	msedge.exe	123
PID 3396 wrote to memory of 3820	3396	msedge.exe	126

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar "C:\Users\Admin\AppData\Local\Temp\Dupe Mod.jar"
1⤵
PID:4372

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x2f4,0x7ffd6be4c188,0x7ffd6be4c194,0x7ffd6be4c1a0
  2⤵
  PID:5044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1748,i,4002284163528767693,13316095705867786594,524288 --field-trial-handle=2152,i,17860995490523495060,7520973848920183979,262144 --variations-seed-version --mojo-platform-channel-handle=2188 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:5976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1576,i,16735891882047352916,12909700406978035950,262144 --field-trial-handle=2152,i,17860995490523495060,7520973848920183979,262144 --variations-seed-version --mojo-platform-channel-handle=2148 /prefetch:2
  2⤵
  PID:1784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2568,i,9612735192260715954,6837156150314771409,524288 --field-trial-handle=2152,i,17860995490523495060,7520973848920183979,262144 --variations-seed-version --mojo-platform-channel-handle=2552 /prefetch:13
  2⤵
  PID:5416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3452,i,13983264307662623876,4761938588723997280,2097152 --field-trial-handle=2152,i,17860995490523495060,7520973848920183979,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:2352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3468,i,7644082810609656345,16122544497426574670,2097152 --field-trial-handle=2152,i,17860995490523495060,7520973848920183979,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:1
  2⤵
  PID:5556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5112,i,448874595157934939,9101184758259739439,524288 --field-trial-handle=2152,i,17860995490523495060,7520973848920183979,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:14
  2⤵
  PID:660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5116,i,17284348577505991466,12838052479052328160,524288 --field-trial-handle=2152,i,17860995490523495060,7520973848920183979,262144 --variations-seed-version --mojo-platform-channel-handle=5212 /prefetch:14
  2⤵
  PID:5400
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5900,i,15313364886118767359,2301321345455161434,524288 --field-trial-handle=2152,i,17860995490523495060,7520973848920183979,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:14
  2⤵
  PID:5296
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5900,i,15313364886118767359,2301321345455161434,524288 --field-trial-handle=2152,i,17860995490523495060,7520973848920183979,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:14
  2⤵
  PID:5188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6036,i,10444559011851365472,6013467482667830658,524288 --field-trial-handle=2152,i,17860995490523495060,7520973848920183979,262144 --variations-seed-version --mojo-platform-channel-handle=6008 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5448
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1132
    3⤵
    PID:3656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=4884,i,10873407362241843528,4247714748869230453,2097152 --field-trial-handle=2152,i,17860995490523495060,7520973848920183979,262144 --variations-seed-version --mojo-platform-channel-handle=6596 /prefetch:1
  2⤵
  PID:5512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6412,i,452141893227260103,16387489950734807087,2097152 --field-trial-handle=2152,i,17860995490523495060,7520973848920183979,262144 --variations-seed-version --mojo-platform-channel-handle=6548 /prefetch:1
  2⤵
  PID:3128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6684,i,7206080787833695231,4526712766384602580,2097152 --field-trial-handle=2152,i,17860995490523495060,7520973848920183979,262144 --variations-seed-version --mojo-platform-channel-handle=4784 /prefetch:1
  2⤵
  PID:5568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6708,i,15181298518100006051,5066362045367736945,2097152 --field-trial-handle=2152,i,17860995490523495060,7520973848920183979,262144 --variations-seed-version --mojo-platform-channel-handle=6840 /prefetch:1
  2⤵
  PID:748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=7080,i,1255356277149458578,14485616825147035720,2097152 --field-trial-handle=2152,i,17860995490523495060,7520973848920183979,262144 --variations-seed-version --mojo-platform-channel-handle=7064 /prefetch:1
  2⤵
  PID:996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7048,i,10814680264560502297,11701259267952549294,524288 --field-trial-handle=2152,i,17860995490523495060,7520973848920183979,262144 --variations-seed-version --mojo-platform-channel-handle=7188 /prefetch:12
  2⤵
  PID:2320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7180,i,4818471686486203608,10506659313871284487,524288 --field-trial-handle=2152,i,17860995490523495060,7520973848920183979,262144 --variations-seed-version --mojo-platform-channel-handle=7208 /prefetch:14
  2⤵
  - Modifies registry class
  PID:5876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7572,i,14215712811821428663,157139858405142683,524288 --field-trial-handle=2152,i,17860995490523495060,7520973848920183979,262144 --variations-seed-version --mojo-platform-channel-handle=7548 /prefetch:14
  2⤵
  PID:1284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=7532,i,17218633050445030621,12260070922660025257,2097152 --field-trial-handle=2152,i,17860995490523495060,7520973848920183979,262144 --variations-seed-version --mojo-platform-channel-handle=7524 /prefetch:1
  2⤵
  PID:1296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8052,i,9861504933596972400,13959735690689426556,524288 --field-trial-handle=2152,i,17860995490523495060,7520973848920183979,262144 --variations-seed-version --mojo-platform-channel-handle=8064 /prefetch:14
  2⤵
  PID:2724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8056,i,15513842149827496811,6413175957191976423,524288 --field-trial-handle=2152,i,17860995490523495060,7520973848920183979,262144 --variations-seed-version --mojo-platform-channel-handle=8116 /prefetch:14
  2⤵
  PID:1216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8060,i,16955735092072868698,15497402100729335301,524288 --field-trial-handle=2152,i,17860995490523495060,7520973848920183979,262144 --variations-seed-version --mojo-platform-channel-handle=8160 /prefetch:14
  2⤵
  PID:600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8060,i,5542363333178907948,2910257761669969438,524288 --field-trial-handle=2152,i,17860995490523495060,7520973848920183979,262144 --variations-seed-version --mojo-platform-channel-handle=8208 /prefetch:14
  2⤵
  PID:228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8200,i,6902588135573437036,12750536765497442086,524288 --field-trial-handle=2152,i,17860995490523495060,7520973848920183979,262144 --variations-seed-version --mojo-platform-channel-handle=8180 /prefetch:14
  2⤵
  PID:2544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6488,i,10230634541623826711,13035807828240249389,524288 --field-trial-handle=2152,i,17860995490523495060,7520973848920183979,262144 --variations-seed-version --mojo-platform-channel-handle=3000 /prefetch:14
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:4584
- C:\Users\Admin\Downloads\jdk-21_windows-x64_bin.exe
  "C:\Users\Admin\Downloads\jdk-21_windows-x64_bin.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1048
- - C:\Users\Admin\AppData\Local\Temp\jds240684703.tmp\jdk-21_windows-x64_bin.exe
    "C:\Users\Admin\AppData\Local\Temp\jds240684703.tmp\jdk-21_windows-x64_bin.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1156
  - - C:\Windows\System32\msiexec.exe
      "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\LocalLow\Oracle\Java\jdk21.0.11_x64\jdk21.0.1164.msi" WRAPPER=1
      4⤵
      Enumerates connected drives
      Checks processor information in registry
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      PID:2636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:3396
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x264,0x7ffd6be4c188,0x7ffd6be4c194,0x7ffd6be4c1a0
    3⤵
    PID:4304
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1772,i,2142935777313038795,2809896781460565878,524288 --field-trial-handle=2184,i,10277091891141384456,227030742084408357,262144 --variations-seed-version --mojo-platform-channel-handle=2420 /prefetch:11
    3⤵
    - System Time Discovery
    PID:4568
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1572,i,15376242876325323068,2429142722750883223,262144 --field-trial-handle=2184,i,10277091891141384456,227030742084408357,262144 --variations-seed-version --mojo-platform-channel-handle=2180 /prefetch:2
    3⤵
    PID:708
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2376,i,15512653364451290542,12327566446458961933,524288 --field-trial-handle=2184,i,10277091891141384456,227030742084408357,262144 --variations-seed-version --mojo-platform-channel-handle=3400 /prefetch:13
    3⤵
    PID:1452
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4460,i,7622003014081672373,9294851735509059513,524288 --field-trial-handle=2184,i,10277091891141384456,227030742084408357,262144 --variations-seed-version --mojo-platform-channel-handle=4476 /prefetch:14
    3⤵
    PID:1552
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4460,i,7622003014081672373,9294851735509059513,524288 --field-trial-handle=2184,i,10277091891141384456,227030742084408357,262144 --variations-seed-version --mojo-platform-channel-handle=4476 /prefetch:14
    3⤵
    PID:3820
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4508,i,14355724204186148957,15363346837008557303,524288 --field-trial-handle=2184,i,10277091891141384456,227030742084408357,262144 --variations-seed-version --mojo-platform-channel-handle=4596 /prefetch:14
    3⤵
    PID:5028
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4544,i,5066671186784859649,16394929891157801088,524288 --field-trial-handle=2184,i,10277091891141384456,227030742084408357,262144 --variations-seed-version --mojo-platform-channel-handle=4876 /prefetch:14
    3⤵
    PID:1624
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4540,i,8197506330768358682,8411876065883312533,524288 --field-trial-handle=2184,i,10277091891141384456,227030742084408357,262144 --variations-seed-version --mojo-platform-channel-handle=4548 /prefetch:14
    3⤵
    PID:1472
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5112,i,240356965598757789,2661915047972746186,2097152 --field-trial-handle=2184,i,10277091891141384456,227030742084408357,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:1
    3⤵
    PID:4076
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5460,i,5964946660893788839,15975481729478500096,524288 --field-trial-handle=2184,i,10277091891141384456,227030742084408357,262144 --variations-seed-version --mojo-platform-channel-handle=5492 /prefetch:14
    3⤵
    PID:4808
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5468,i,16668142205004851914,1826708420317084605,524288 --field-trial-handle=2184,i,10277091891141384456,227030742084408357,262144 --variations-seed-version --mojo-platform-channel-handle=5532 /prefetch:14
    3⤵
    PID:712
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5856,i,3846820096990192082,12990423258589895226,2097152 --field-trial-handle=2184,i,10277091891141384456,227030742084408357,262144 --variations-seed-version --mojo-platform-channel-handle=5540 /prefetch:1
    3⤵
    PID:4456
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6292,i,15598443384878498549,15621933896891077554,524288 --field-trial-handle=2184,i,10277091891141384456,227030742084408357,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:14
    3⤵
    PID:1868
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6164,i,18004402522612184244,3360843358432827386,524288 --field-trial-handle=2184,i,10277091891141384456,227030742084408357,262144 --variations-seed-version --mojo-platform-channel-handle=5564 /prefetch:14
    3⤵
    PID:5236

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4484

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /0
1⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2148

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3592

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6040
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding EC7E46B35002C4B97BAF2A73B2756B22 C
  2⤵
  - Loads dropped DLL
  PID:1192
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:5336
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 807B84D7D7C2433FA25F394B94555357
  2⤵
  - Loads dropped DLL
  PID:5688
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 168A3CE23F5054CC100BDBEEEC6A7FE7 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Modifies data under HKEY_USERS
  - Modifies registry class
  PID:812

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4976

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:1992

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:564

C:\Program Files\Java\jdk-21.0.11\bin\javaw.exe
"C:\Program Files\Java\jdk-21.0.11\bin\javaw.exe" -jar "C:\Users\Admin\Downloads\Dupe Mod.jar"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1556

C:\Program Files\Java\jdk-21.0.11\bin\javaw.exe
"C:\Program Files\Java\jdk-21.0.11\bin\javaw.exe" -jar "C:\Users\Admin\Downloads\Dupe Mod.jar"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4236

C:\Program Files\Java\jdk-21.0.11\bin\javaw.exe
"C:\Program Files\Java\jdk-21.0.11\bin\javaw.exe" -jar "C:\Users\Admin\Downloads\Dupe Mod.jar"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2248

C:\Program Files\Java\jdk-21.0.11\bin\javaw.exe
"C:\Program Files\Java\jdk-21.0.11\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Local\Temp\Temp1_Dupe Mod.zip\Dupe Mod.jar"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1876

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4748
- C:\Program Files\Microsoft Office\root\Office16\Winword.exe
  "C:\Program Files\Microsoft Office\root\Office16\Winword.exe" /n "C:\Users\Admin\AppData\Local\Temp\Temp1_Dupe Mod (2).zip\Main"
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of SetWindowsHookEx
  PID:2648

C:\Program Files\Java\jdk-21.0.11\bin\javaw.exe
"C:\Program Files\Java\jdk-21.0.11\bin\javaw.exe" -jar "C:\Users\Admin\Downloads\Dupe Mod\Dupe Mod.jar"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5456

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e58e192.rbs

Path C:\Config.Msi\e58e192.rbs
Size 10KB
SHA256 f6b33ec322833cc6543c6b535ffbe388a80abeffaebdb9d7633d5da1a71cc8e0
MD5 4c5930c3a2c61ae6b0868e914472920d
SHA1 2c8edd2ed9fb05f83b129c47b56a2ba1e859932e
SHA512 8dfbcabba6447c2d4f87305426707abf5bb9fe717aa413aa1801661dcbafd69fbce6b5ff631ef46b8165f0c75123001cc5d9b04043f64fe74896ce976f816abd
SSDEEP 192:c08CzI1m3fiGoAe50qIx0qojka6CnpU7zUF:c08CzI14Kn0P0Ga6U
TLSH
T136225412A601C1D3FC431A358B072B2677B7E6D5D78452CF468EF1249F0778C1E9529E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Program Files\Java\jdk-21.0.11\legal\java.logging\COPYRIGHT
Size 35B
SHA256 7afb3a2dc57cb16223dddc970e0b464311e5311484c793abf9327a19ef629018
MD5 4586c3797f538d41b7b2e30e8afebbc9
SHA1 3419ebac878fa53a9f0ff1617045ddaafb43dce0
SHA512 f2c722ae80d2c0dcdb30a6993864eb90b85be5311261012d4585c6595579582d1b37323613f5417d189adcd096fa948e0378c1e6c59761bf94d65c0a5c2f2fd3
MD5 SHA1 SHA512

Submit Download

LICENSE

Path C:\Program Files\Java\jdk-21.0.11\legal\java.logging\LICENSE
Size 33B
SHA256 86e0516b888276a492b19f9a84f5a866ed36925fae1510b3a94a0b6213e69192
MD5 16989bab922811e28b64ac30449a5d05
SHA1 51ab20e8c19ee570bf6c496ec7346b7cf17bd04a
SHA512 86571f127a6755a7339a9ed06e458c8dc5898e528de89e369a13c183711831af0646474986bae6573bc5155058d5f38348d6bfdeb3fd9318e98e0bf7916e6608
MD5 SHA1 SHA512

Submit Download

Reference Documentation.url

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java Development Kit\Reference Documentation.url
Size 202B
SHA256 318a5f85bec4fb4b1480735fa8fe871a4e9b451b2f8b101b41fd54b011479e20
MD5 34957693da804050884ae2eb7450d02b
SHA1 e89cc9629c858339a2d037023972cd1d74ecd4a3
SHA512 0f55bdbe2a61759170fd835e4462b453588cea2a7856d80c2900de85318dc902b449996f03f35a5e7fca8d35025117519466e101b7f12acb270bb3993ed1f261
TLSH
T19CD0223CCD04C194E043BC0223B0BC28A90E79E018CFC84C93C0DA8F0D884A1880E936
MD5 SHA1 SHA512 TLSH

Submit Download

Get Help.url

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java\Get Help.url
Size 175B
SHA256 7f75a65299b7abfad831523c53a38ca4454d63972b7b33390f0e73a070ae73b9
MD5 0b7f7b921d15c8f4651075739aa1c64c
SHA1 a2faad6346abc164c037e168f247ade8b3a50c82
SHA512 01c96b880b77581c9e149e29e8826a3f04a15c0ab5f5bc004988acaa267eef12e584ff7ac3c9294382093d029cc0cfa185596d8467906d80e9d1d4dda290c9ff
TLSH
T1DEC0806CCD08C1E4E15355861B71BC74E50D74E019DFC84DD3C2CE8F1D445418C09E72
MD5 SHA1 SHA512 TLSH

Submit Download

698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
Size 471B
SHA256 5e0d4313487cee88a4dffaae4ab90ceb7767b8e3f09be823dbcb7544d645bd5e
MD5 708edfc74e9c65a9825ca02eef354d22
SHA1 560b6d6dc1c033ea203e6c852e55e4ff1d080a38
SHA512 14e7e368c7abc11f8e541eb76d9d0d31241f8f3e79c1b49f9e4407b19549fe3da27c5ecbac4a89af3c17828839908234442f50c2d519403e8c49ada4fbb4a546
TLSH
T191F0543B246E1CA0240F20EDB3B8DD3A3EA2584529C20033503810C102470D8D28A506
MD5 SHA1 SHA512 TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_0D89C5EAD59EC1C2BC9790314666F3D2

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_0D89C5EAD59EC1C2BC9790314666F3D2
Size 727B
SHA256 b188db1e050ebf14c4fc3700be9bcaafef6004e433257950ea09767ddba18009
MD5 9644c3e9e823ecf3aafd79b866820756
SHA1 0cccfca596e8e9bf7ba09d2ad0c0dce7445e2c30
SHA512 7434a3fa094c6e8792ddb5dd19e02e4b61a0dc84a8d650deb3e20e8e5c0558b52df30a17f0bdddc1af1829c2ee3aa0d0a938ec97c6f4468e084b51361bbc6936
TLSH
T1D301491575562661C53DC8059E74CFB4715159313FCDC78B789D42CC619DE5C0708534
MD5 SHA1 SHA512 TLSH

Submit Download

C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Size 727B
SHA256 5fcb1848db2d07879b413fa72008529c2d485efc8e24259639b64ec478a02bde
MD5 1bb1ea44c5dba087418fb5f7e708d077
SHA1 e662557f6f884ba4ff46dd59135a49e5864a89b8
SHA512 6fedacc0535821615117b600d63aaa8b37b0f0e4388760f983f5ff2cd4cf9d851a8cd6de7c16f847258b9dcb5861f46383b289d0890389d6b6a7a639957635e9
TLSH
T11D01600370A88380B15B0E40F6BCD372B93581D82A802AF3B1E45E5EB09DE218B86977
MD5 SHA1 SHA512 TLSH

Submit Download

698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
Size 400B
SHA256 e3358ee62496906287c58b86f9c09fdc15d63065001ad531c2e2229fe4d9d99d
MD5 d99dd91baff694dbc0b204c00dbd3edc
SHA1 6a170ae91d06974ad3c749aa13ee0c92b15b7af2
SHA512 8c6261cde94612bbb22ba0b69789729bc7d21358a2647374f2ccfce6213442443b20bf69f53b2999df188e9401407313ddf814cfb498cde59113705aa03fe64d
TLSH
T1ABE0262027FF502EF2A49B7803D6D096AF27F1037CA897BE09C11C1DAA16A005CB3C31
MD5 SHA1 SHA512 TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_0D89C5EAD59EC1C2BC9790314666F3D2

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_0D89C5EAD59EC1C2BC9790314666F3D2
Size 408B
SHA256 babc53af76a68e036222900243e1485e59bfdfa6b00e13a6882fc87c9a3b5981
MD5 9bb9708fc63dc8a266a94b68578dc580
SHA1 747e36d804da47f3a15953f359da696b0474cf12
SHA512 3d3d1841bd70f5fdd844ca2c65d87905d266062abb94dea9411b0d78f4a6bab086cc782249ff263dcc8d54095d71058e4006a229853d3fe1d9f34fef7add9068
TLSH
T15EE0C03421F6500DF2F0D57586F1AA31CE59F2261948827900C022147A217007CA3720
MD5 SHA1 SHA512 TLSH

Submit Download

C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Size 412B
SHA256 7c5d8da1e79038e46f9165213e02245615385690cebde0e453fda0e4beff8f8d
MD5 89867d361199a7cca23fbf67c52eb698
SHA1 c7788489cd07d4dfbecf7d5c9891f45040e269d9
SHA512 4b8d4cce06870730fcb17550bffc8d6f61c7ae7956cfab7a8d0143fb0a9bd7b5c865af6d873fb18dcaa0c4c7e68e3ab20e22f14e91d8175588c3711896ccd234
TLSH
T176E0DF3C2AEFA61EF0A0D93546E9B5BA1E59F3126458DABD11D08308BB0BF046C11AF0
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 727b9c64de42b97b0c07edefd85353a32601f1f961d1e5f8df8766c0155d8d51
MD5 9b4e125867b60d02602f440395c98fac
SHA1 4eb2176db96d718ebc158d7c48224a615b75c178
SHA512 7726a6bbf9c459145bb3c953e571aaa388cd984d8db9a1bd56af3534abb19967036198f399d4110fec3a50b87549eafff6460f4a9a05564787a7ea48e14e0cb1
TLSH
T17BD0A7367756F822D17844B580115651256A948A288B9186E225404E44B99A8A3D62A6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9cf5acc3a4797f1d8e969ab1970c2330530e33f7dac25d2b42a810961a67ea68
MD5 6bbadb85852ef58796e988ee6bd3abc6
SHA1 f87a8c99cc4052067a5b532f97bd1ccc92f6a0b9
SHA512 a3813b64d663d976b681f2ced98d428dc47f49c99219d4a147277e7c8375b07692a5a14501eee0df77c86f9da6e3205c49e89510005d4f3b21e3afff243fb088
TLSH
T13CD080155FF27C70D014E8F694187B41392DACA68D43A6115471EA7E4C224D48BD0FE7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b79a86ef217b7608072f27b9569e30a226441e92f1d42ada10a4b59d6591b98a
MD5 2829e1247ab70c5983ad3d0a2d791e2b
SHA1 a34c8a07b312fd3ae217f059e961d3c97b7cbf13
SHA512 389d78841baf3926a09895c76f731a778d3c0e71d1a9d63015dcbfcd68df3b1de2892bc3a46d6e6ae3144a5967bf2041053aef76bedd419a77ea89b0df0df3e3
TLSH
T17CD0A775374BF811D2A8E4B6D84486402566948F248A92876122540FE462958A3DE3A6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 cf4fb90cf8a62f73acf8c0d406acdc28da821eafbe1e89cbd2332938ffdc1edc
MD5 34d0087f99270d55b7adbc297b469f29
SHA1 84e5486738f3a5cfde894f5e975b339e660d7a9d
SHA512 dd3cabcfc4b533176c48e7e6aafce362cffa1d8f5d6671cbc3ca279e24087aa2d27c95f12ced356b543b45ee749735fc77ecd6459911d7e45f34ae1644c91b34
TLSH
T17ED023713747FC11D2A8E4B6D84487403566908F34CB92876133540FF472968A3DE3A7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ea750b8ccfa8d7c7a393cdf6c9c8a3be0f2f086fb814bb44905a02c83d9af71f
MD5 697a394c9a3ff43b8925489b648b073c
SHA1 5828315de0bd17378051f664204bff07d8659dea
SHA512 37519d78554ef3947030bf7fc74d2660bf2dc752f04de85daef8079fdce335d2e6ad77071de5a938f7422ad0bdd2acad3963260b61149fc0d91381c007a2514f
TLSH
T173D080115FF27C70D014E8F694187B413A3DA8A68D43A61154B1EA7E4C624D48FD0FE7
MD5 SHA1 SHA512 TLSH

Submit Download

96827b18-0247-4382-ab6b-dfc1964a914f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\96827b18-0247-4382-ab6b-dfc1964a914f.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 b506dca68037c975780cdfb3f207f2642d81974a04056ca21ccaaf332764b9d0
MD5 ffd754a364bf1cd48f09b539d41034cf
SHA1 cdee5399e907c655830f664e5c40d852f0a5a6c9
SHA512 8c48a6819a562f9afa981ef5b23cbc245f341f344a6d761b8722adce809e48fc9ad9ef0555573bb39eca959e46a7d2da1985897a23d03d86863419171322fb39
TLSH
T165E02BAADC20EC3748FD87185058074AE754135B27C0884B3A3C920DCFB17379547C6C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 7KB
SHA256 fb50492c19bbf1f6dc8d8c0026ca86b803786b68de029a91f4fdd481ee5ba71f
MD5 16ddf1586cd67090f4638efc06498e96
SHA1 874009d2e053b0f6cd4388711d2beb00513524b8
SHA512 4453c63ecf3c903d8e1d8c03c6ba7de87e2b5aec57e425ddc8a11bb3f187e6151b0272cc68a7c3e726356a394624e87783aad40a8f66e934836439202a6bc2ed
SSDEEP 96:V9Vw4UDXL5j+5s/kl6Sv8SrhEAYgaONJVm9DLKbyQbHlRxN9+niCNt:VrzYXVy+8PNhEbY/nyeHLL+t
TLSH
T1CDF1E8A390B0706BEBF92CB95EDC8A7C36B1D644923B0F9749D40ABC5C7E7DA04844B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 7KB
SHA256 20e9d5ebb13b82041815bb416b71642d38349ff2e99898f9b812599e4007c9fa
MD5 79912aac0945ff401576ac8baf8ed8eb
SHA1 429cbcd1585b3578fc1e3f72b1684eff66349415
SHA512 83fb62cac938eb2dcf64140d5d53e8cf9b93b02a8ac3997e7fcd0026333202b54a5d5b583bf806cfe381ca297a3b392b002df079217f28619d3ec49afd7db985
SSDEEP 96:cLmFWLb+bufuGMhClPvSuuWzuyH2WJppT30eTfD8XdenHhq/ilRv6:1y+qm3VazuQVL0cD8XeHI/0y
TLSH
T180F171BB90A0701BDBFC2DB95DDC8A7C3AB1C658803B0F9745D40ABC2DAE7D505864B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58896f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58896f.TMP
Size 3KB
SHA256 60eec291d006d33e5c4d42ce65800ed43b02f2eff43e5f6f5d405e789602e92e
MD5 cd6b57d137da5c9b774eb1a7f1049799
SHA1 d193265352b91b7d1701c9b6c0e9380d67d83dd2
SHA512 c30175fadf89692464441208d17efd918db414567a2a11d8beb833e87f4076992ca47d6feadf8b767c9936e278a885de1d0b3f4e7951000af81fce706b9cfc59
TLSH
T16D611A64A091B42BE7F89CBD2AEDC0B8BBF1CB5890771ED786E1033C5E9E7D21080418
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 caacb05d15679eac0571507a9398c0beb77a6fa34a15fdfdc317de7e0839acae
MD5 fe2105d132882b80c3e2972191a2ffa5
SHA1 4bd16f85958aa985f0d4424c1b223a6d4d141161
SHA512 7206550515210c36b452a6d3bb71fb385c9f55198cd4bc96a8c7229c346e485f479ad153211d47df4ba64c9fe01e479b679f12f2ff8ce99432f92e0e0721053c
SSDEEP 3:MsEllllkEthXllkl2zEkl+4kX:/M/xT02zn+LX
MD5 SHA1 SHA512 SSDEEP

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 319B
SHA256 5937141e58373ac2756e8b77dbd02eb98160f7561f74ab00a5b5b8348a90b977
MD5 b9296151ff40af061f9bc1354917d462
SHA1 da751807132a4579cfdecd5b3494c4469d8ae6fd
SHA512 7549c1d7a2e3d7012417f69be81527f3b21ea0bd3a82c646187b6501fa4f10a98c74463b633d2a0b088ce62cace75de14fa015c8d1a92fa1f8ef5dac63916b91
TLSH
T1BBE0260445EAC3BDE05478EB827C5708C2D0B402AFECB942270C8C427D41A4AE6866E9
MD5 SHA1 SHA512 TLSH

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.104.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons
Size 28KB
SHA256 4003a11199981352f09b4ee0b01df04dbd43b7b017eeb868a6a06196c3747f30
MD5 88e1db6ce782f8be30e8505ab94b004e
SHA1 3628d4bd0fb9b9372ca5ac0395c977df8ae302f8
SHA512 cbe7da1ca4ea61b4cdbe01544b78140d96230f29b4fd9942702d12c04ab5a3707882dc466375883275679b520b6b7f0f4e3be63a54607b7cb65ff2584327d803
SSDEEP 96:BBCQl0nNl0ep4mWwtHE7oZnAhxzoJVea/ik8vwiZGFdSF0GFJ:3xU34mztXZQaVea/yZGFdS6GFJ
TLSH
T18ED23A635AF6B804CB525EBA026B0A7ADE37815CCFE6E9943830141E5878877493C5FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 204KB
SHA256 2c640c048febebaac725c3fa983be2d099c0e39ed94fdf20ed854e2a0934f35f
MD5 7229b088ebd8468179b4ec0fecaa25ef
SHA1 0dfc983795f068090bec7ca0ac07f1b18876ddbb
SHA512 98b83c21368cf3285529e83014b5b3d1f6c75f93ddb12fee06a97ca8c2494bd8dcbcf5a4e4cc9594fa98bf6bd3ca7c11ebb5df4019516b75de5372c4691508c3
SSDEEP 192:bybL1nCv0+G83uxXBBK31GkSJcz5bIkZTEJH7DNspUO:mnCva83uFBBQ1GkSB7DNspUO
TLSH
T13814972F1B627614CE7C817629EB1A965D1E903BCB93E5C668B004A9DEF2D13540C8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 0f0dc5a810bcd7af3fd278a1bfbf4c7427f7a3b2a83ba9b87f531ba239d30130
MD5 e08cba66c977b3738340b4756631f019
SHA1 fa8be0a0277b106457b3a1d47af03c8a0ba582c1
SHA512 60a1a55dc51d1cb36979acad43174520b8851d6aea8ae60068d675686a317dad42748ee2eea4852429b9928ad83295f7ea4f95b6f6d7c9e2c2d90d056355b6fa
SSDEEP 192:DcHQau5fgM1H75Yt4tcj6AitjCzmzBQ9sv8xRQQ7zVWZ:DcHQau5fgM1H75Yt4tcGAitjCzmzBQ9m
TLSH
T194E19BF783F5862DCA1196F4AA18AF1FCE1C0911436C3C5A85D4AF1BA3F2471E152B9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 209B
SHA256 ae29f7041840086e913fb303f307a1099f18f7461332a208999029effba047d6
MD5 d284d01be89b4e39a92573bb0768779b
SHA1 217e02b23dce1738ef12ddca36d3039437fc797a
SHA512 dc8581d0e7942fb113438b30b6a0c6791bae76d1d7aa30842ccd0de8f80f132372562c85839d84a1968c63a996b9cb83080a13e6b5323ff6ab40da549957e46f
TLSH
T178D022231302F0B6B5EC2FC5446EEC8FC32F01290883EADB10E0989E093146F1907284
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 20KB
SHA256 f725f0eb11d631d2d370721b38fa68f06ccf24446432a0183ba7b47bcc4ee77f
MD5 2aff267e8b86ef6bf8a9b817de106cdf
SHA1 71fb90f13789a4f63a8978276de40c9b23fe89fb
SHA512 fcf99ba9152be2e163302fd64392fe8b48110b94094bd5224b0350e0130c730f7564ba8f4af59c892fbf9f6968fe446502784dc22dbe791301ec643683700a73
SSDEEP 384:sxZFnAeEm1W/fRsa7or63PPdpjT/b6U/DkAqc:s9Abm1W/f37okb/bfDoc
TLSH
T1DAA2E9526534897BCCD7C615F9257F57D6F815639A904E8899FCCE0C04EAAEE3203C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 22KB
SHA256 a0af68f94e64d644ecc5d5e0894ea3dcaa7b062f589158b31e82dbe5cf9752be
MD5 5f17d804dba84a6a3c23843682c454f0
SHA1 bb8b0506bb402088e88b617c6dc4a34a98b2edea
SHA512 fef0ee9ec7300a03dd3ce0a4cd5d741ba33d2e6a15db4894e8c428d7e087a5bc2a575f4ccc4046dd74be7bcfa07ea674f289798eaa3745165de0fd36bd6a479e
SSDEEP 384:sxZFnAenm4W/fRsxWvl0or63/PdpjT/b6U/DFjmc:s9Aem4W/fIYl0okL/bfDwc
TLSH
T19EA2E9176530897BCCE7C619F9257F57D6F815639A914E4899FCCE0C04EABEE320282B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 5d06c0955dad58be52592993d8c06467c29e4dda6a2442596a13362840a61276
MD5 4d862b306d598114213c2afaca84e78e
SHA1 33da4f76e75fdec22d80381dc57caaf85f093831
SHA512 30354b0f565b2a14e59f875e49dde244164fed15a6a1d8dddb5bbfe374ccfe21f53fcf8ddfbb9ba3fd2a9e4e78c22f1fd67e80773738cf71579073fdbc7243cc
SSDEEP 384:sxZFn3e/W/fRsT7or63mPdp/h/bK/5bj9:s93OW/fi7okQ/bw5N
TLSH
T1DA82E8066A74597BDCD7D219FA16BB53D6FC116296804E48A5FCCF0C04E6BDE321382B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 9a8b0cdf2325e38c94f9892da9d64106c282316de1bb46fb7c75d8c1433c49ff
MD5 91337225ce41a8d2b163ea19e4672ed5
SHA1 7ab1fd30f2c27018f9ebff4cae6f10931ad7a388
SHA512 28e9b856dd614ae8353495eb12e2ad06463ed92f693bad1f64d793c48baad0f44f12e8dda52463296cebcb9e6e7df5fc26766b0cb81e0d07d29d5abab54c15f9
SSDEEP 768:EZN9b8PT24f7pLuL/CuWRmCCQx68F1+UoAYDCx9Tuqh0VfUC9xbog/OV3m7yZLlA:EZN9b8PT24ZE/CuWRmCCQx6u1jaKm7yk
TLSH
T153031C3B2C0CCB7E4F804E9CDD26AE8E6DE801CB9698899447FA844C03D66EF55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 37KB
SHA256 fe9c66f99b1a87fb0bf86f32fa605229825edbe1f7c3cf846d2dba69b452b5de
MD5 67d2b3f6d7533b8d59b206cc10d77a4e
SHA1 8dab085a417a5233c31ae8d41b32abde177c0af8
SHA512 26ba8d3e21591c9673334bb17cd933d1f9cc92ad77be40b1d4288068efade3025f490dd62b315986954551287a17085cec270f3fb1581707cd14a15ceba52dda
SSDEEP 768:EZN9b8PT2QA7pLuLnRuWRmCCQD68F1+UoAYDCx9Tuqh0VfUC9xbog/OV3L7yZLlg:EZN9b8PT2QMEnRuWRmCCQD6u1jaKL7y8
TLSH
T150030C3B280CCB7F4F804E9CDD26BE8E6DE8018B96988D9447FA844C03D66EF55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\16400d67-dcb3-4f58-9b0f-1aee95e63444\index-dir\the-real-index
Size 72B
SHA256 de75be6561e2302af7b630dd22044b33683743e1214807a62492a2cbfbd4fb17
MD5 f38493f6fed96ed5284fea103371854b
SHA1 4605042aac113aa242c0affdd0d2712b1ec7169e
SHA512 80332dc6863f7936f58169dc0eda49743f670b66a1240e4d9e88ca4139a17a67751871563d242bec29e7d2967ed1408e2da3efad4cdf7cfd3d8dac4555c19615
TLSH
T1F4A0026045788051D0451FF9618781D03314DD99020547074091547D8D961FA4D33048
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\16400d67-dcb3-4f58-9b0f-1aee95e63444\index-dir\the-real-index
Size 72B
SHA256 40d5fee7cdc43e6e82ab5a77504b5518ad15c37d345997ff957f464beed11036
MD5 3458f6e23af0c17ea2f9d819fb4c5ea1
SHA1 aee82335de68fca8069f144abf3fba10fef99627
SHA512 d80c436507fb9df166d42e4ecfe9ec7b194c9ed23ca574bb4c10252c5932e28c7a835b8ee3995d7169583dd3fe4061e8ddcc4b9c00c8000d94f7642a196a6c70
TLSH
T1B2A002314B5C0181E0451EB2618A87912314DC191E5143174C90459D8E652DD8D42094
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\6aac2439-179d-4043-8571-41ec4c32b4c4\index-dir\the-real-index
Size 72B
SHA256 c41a9032bf101122460a9be3114a9ce60cb0baee9eea1e8f1252cdac9c2b1de5
MD5 ef07421c84318bdafc4c8ae766c6a224
SHA1 583f2bf6c9b512af7a61f02572d5463b4fb42bf8
SHA512 6ed47bc8008214e61b7e1556d60238ab119f1d059de9042ad6d935a5a7fe3bfa7caea30eed844ce66ca71c3a644979f25092ce9cbab12dcffce7e00992ba4dd2
TLSH
T153A0027C5B444699C5C4777016E209412360C9E4314B431150BD44ADAC681C09253D2C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\6aac2439-179d-4043-8571-41ec4c32b4c4\index-dir\the-real-index
Size 72B
SHA256 9652995f318d9b7e5f963ede5bf2384e6d15c4648c16c7456e98478a75470e08
MD5 30e356ec257633d9e575877cf23bedf1
SHA1 68ecce4797f241688babcfc8d315d2fab972f86d
SHA512 793bcb2378fe1e12c28802d05b606d45667bd0212ad692be561f1653d7498cae858e78dc5bb402a8511d2793746cb7e2820d56fc6783f8d25cb99de1a1317ac5
TLSH
T1BFA0025003A0442DC796237110E905626260C8D813010B6160F844E4CCE95C56352431
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5833fc.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\6aac2439-179d-4043-8571-41ec4c32b4c4\index-dir\the-real-index~RFe5833fc.TMP
Size 48B
SHA256 52a5ec713b21f0ce946a0ffd57c02401614bcb2a7c2ae0506a221d09c8fd7b74
MD5 756384f10e4a66cdaea5571ab7b0dc40
SHA1 6c503f73d50b4e961b3f6968f5fbc33e48939555
SHA512 1a81d3076c0dc35c6a8a60ded76119bbab1bc68c9ac9fd88c74fa550c05d0cae0b455283382cc6370bea4caad6d232f44f45ef28afdec4dcab26671ffc4af2fa
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\8c25048e-ff1f-45e2-9fb3-c8319a8de388\index-dir\the-real-index
Size 72B
SHA256 57e7336bb0f9a211b63748a7992faf4972144c4abbc8288b41649e1319f7e753
MD5 be16fd5f3e61b978d1b6da48baeccbc5
SHA1 d81aefef7c4d106290a987a52d61616117ddc1df
SHA512 e7a2e1ac8b9fdf7ecd2745a0179248e62b17571446d9ccf164bacc937c63decf48e88affed988279b311d8d6d3fd62313bb4107482fba859ece02f6e4cad2e1d
TLSH
T1A8A002A11BD10441C0471EF425D34751E754C8105215170742E11184CCA45CD4E4305D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5836ea.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\8c25048e-ff1f-45e2-9fb3-c8319a8de388\index-dir\the-real-index~RFe5836ea.TMP
Size 72B
SHA256 e4799fe21ff35c41d24ffaa0f376378a3fd95b85760eeff7aecd950cd0455172
MD5 b3a4990d766d7bff8d64fa7ba2058b6a
SHA1 a4430a0c5d4690c8951c71f3f90ef65cebd78eaf
SHA512 07359c49a41cba81591e6b8dd8c102da26d4ce541cee0f412fda109c55559030ca25684fcfc01e9683459c3caf37762acc6ab2b97b6be07c7ba3b8ad34e92b7d
TLSH
T19CA0025053810006D412D9B71956F24362018C105202220650950049CE504998B460BC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\975adb1f-7a3d-454e-87a7-b5b4a2c9e7ea\index-dir\the-real-index
Size 3KB
SHA256 25f94ada9a16db398dbc99ae9dc46673c690a054609ca8b0e5b1a5c06834447e
MD5 acc2cf60c5ecf3c7c0e254faa8de012f
SHA1 5f5656d62e3b8e2a5f58dc660306df6126691646
SHA512 514982706d5e4375238faa712c8b945575dab26e7904bc9f0b84006315ece5cc1866ad917c58d485cb61a6bd2199878d570b38f359bd1b0795a7742067ebbaed
TLSH
T1AE51C54D0C0B4BB6C85C42B315F35485373C1CCD5BD49A2758ACB13AA88B37D0E4E799
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe586c51.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\975adb1f-7a3d-454e-87a7-b5b4a2c9e7ea\index-dir\the-real-index~RFe586c51.TMP
Size 2KB
SHA256 08869d021a57c86b2ab65bbadfb0aac77a0b3cd12e765fc6a3274beb6f78c272
MD5 b6d98456dfd0720d0f44d6709fdfa3f3
SHA1 694780adb5a1bd83f1e64ee24ea3068a1c14e8b4
SHA512 f82607b2bc27272ddf80ffa455225608120dca63f2e28a5f908c24caad494c32d576f9dd706ab502a078ef8d8880fa28d1b1571d6a756b14a15b4ef2ec3f9777
TLSH
T13551C95E9C830A31CDA491B399CA5469333D68954945AF0B35FCCA33BCC37AD3D66394
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 476B
SHA256 dbccd7abbb77416647d172f9c985f49b5e02a3596306416c1516a1dc47112f20
MD5 6d988d932ce3d85a6206b9136f44fed1
SHA1 81eeec9902ac0e38f1175337da018ed16740446a
SHA512 b8d28917007096fede807992f391a6f6e02d1869e5f7b7e567096b0a9c2dcbd00322f7d8c76437436e5e7d66976b4b6c0e0574cff8fff6e976a7e9793804ac70
TLSH
T144F027B33EF61D14F9DFD3EA687104600169B858D96A9D4F1416A2D740B831A2599C72
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 481B
SHA256 afb344769f4e042728ba263ba9952d1f7083cfa75a2b35a6d5b59012c3b2fbaa
MD5 adc122a3aba3e4ceb512c3e2bc1530f0
SHA1 d4edec2cc8954da77d7733d0cf280df13f3ce129
SHA512 dda6961309bc6ce0c2f5264158c7500c018a745749d20d41da28460be5162e0e674cd3cdd55d50c59f189e5b1461dfc055cafb4faaf7753b2ab5f89ae0f8fcdd
TLSH
T19EF0E2B33EE71C14F9DFC2E6A871146004657C58D926AD0F1426B2D7907431A269DC72
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 476B
SHA256 b845eb9ff09ebc5fed70158a1019c8a6c371f174982eaf2725a6b7991bf3e5a9
MD5 2695e3642936ce683d3e07a99187616b
SHA1 6f7aa7049ce6295f73ca742be4c4639e09352f62
SHA512 0a4ee728229e79fb1e7f77bc76c86aedabfa2ba8bbd51f06ece497a37218aca5866fffa95757526cbdb27bcc0008b71c73e6f48c9d86d4f8bc00e1dd2e43109d
TLSH
T190F097B33EF22D00F9DFC3EA68B100600039B858D86A9C4F0416A2D740B831A2599C72
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000003.log
Size 8KB
SHA256 ad830f163aed93aa2d637675de9b9e0895cc1a10d257625bbacb1b006180bdf8
MD5 a1576bfd82dac21b05c3946b55836a27
SHA1 ba450a438211134c4316c1999e0d3d83a408ac4d
SHA512 378c8ac555664982ab4c03173f2c9b92dccd35b11729cfcd1c23b1c08714a5cde6af0e542f74c7c72ff74fde7c3db08bc2ecf23007b9b5a0cfc17f9702f8ae20
SSDEEP 96:F1m5HEJp6vApkrp6spYpR/zOap3WXp1S8Mmp3ppwQ:F1YHcX0/Wj71FWXNFp2Q
TLSH
T158128BE3DA109053C9C966FB2039F5D9592DCA066FFF87A611BD8F6E52402D63328B4C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 335B
SHA256 825fe12d1df9807517bf478cfdba4d4bc276751a99a87b1753532aa33d39f1f6
MD5 b8f4dbcfb6ebe0618d25a3b63d05b048
SHA1 aa6d6833568f7fc9ccd3f2a80b8d1a57961c3d64
SHA512 a63c41305e6a05cedafdda24e1384b4998bbd80b4ce584bfc9bcf4c7379f0982d7da17fd590ff4071fdd72a461e5a2344ec8dd847a42ed3869332ff937027aea
TLSH
T13DE0866847DAC2FDF215314B027CC30892F8B417DFDC3D423F54CE52A686548B6921EA
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 b454989c6d55bcd269d4b476e0038451a6540f7c269372d9b863c6bcac63a6f6
MD5 47e038baab64cf048ffeb20bd1c57d95
SHA1 b34ee8d628993fb8ad1e07e1848b98431febf8f7
SHA512 502d33c70811bda400e053b59cb75bd6e4a89dfe59a6583368f3743e3ef353034dc479f13cada4677fa5ecbbef254279805b6d6c4f15e37efa7da20a60a4a8b9
TLSH
T1F1A002938F788045C3004278F5B111882260D9985B152E6344BD0054985024085A6918
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe586c32.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe586c32.TMP
Size 72B
SHA256 e0655170bb673ac4efd5ce59a48c20c4d57f80f64a64dbcd7a688c4722a67c44
MD5 7c61e91fb71ae9d8155aa43b400534f7
SHA1 76dcf1f09254b9e355c8534680002e07a046ebcd
SHA512 9ef4684ff05a2b393d6e0840acc34b4323541cd97abd74d4e51d016bdf5281e2f7bfb47b5dfcf926ea2d0f4e6391cd4a2154c754b4d821022c9d9743e34d4d99
TLSH
T12AA00224934A1800C8080DBA1046234073B4CD5A0004570358D0D0DCECDE1C15DD1113
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log
Size 244B
SHA256 d45db80f6a6614ad7d540ff5d01239fba12a1e32afc3c0af25271f946bd230d7
MD5 e0192ae6096d3e3c3fca3a63311a12c9
SHA1 ecd6b6488f39b1eca85c6151929370023c070441
SHA512 eace915fe0098d46f591ecf6f64faefa9649c2b49e426dfbe75a60d997b0789e9e9921137a32cee6591eb371e1508011becf66fb698069d99399c1713b316be8
TLSH
T128D0239073151753CD5B66311674E7474754DEC24154440FCD1C7F112D075D03E6F4D0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 347B
SHA256 9e2554e1a85ea0bfbe843cc7e7c0895793a77d1a677bf2407a4dd3567e240a75
MD5 dcd174cd276a80d747c517f276a763a8
SHA1 a45127fb70eaa73b285d1234992acf64a5c71ab8
SHA512 9e2f3b0aa98cbf622e5e4a0267753cd7e5829b04a3d873dda383230c27f3e8178477e05c82844e3d45a0b010e4d0808f8813acd687331cb7f0082940d1d67f3b
TLSH
T189E0D87057CAC3BBF14530874238E308C2F2F402DFD839513F28DC41624A1447A871E5
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 323B
SHA256 d050393da1cd370988d83e5286feef3d85560f9efe53dd0fde2b92f310635d8b
MD5 b064f420b016a86716ce6ca44582d1c1
SHA1 66ed02ac8f6293f1eaec05183dcdf5c9c019d70d
SHA512 6860ba4c0e1b8aff6a4587ad92f1c234769f8f415c68def1caf60a75c66d592cbda6ca89c09edc577f1fa7af20eabf753025851fc1e96da342bd95c7df97a88a
TLSH
T1BFE086B087DBC3B9E1057087427C9B0C82F0B8079FD83A86AB0C4852B581248F7F65E9
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 d12486d43b9ca219807c1731aa0f7474ef05f72763de8df2f9d5610968232380
MD5 476dd47523686b46e6640f02f5fcdae9
SHA1 ebb4148aa81f1cc1c2a6eaf61010535737189d96
SHA512 e417070da6940178bcc07fbffe5ac999cc491eaad4ecec8db1efb01b746994f53a372d17a543404c93fc5925f05ce8cc71b16df55982e2008c773382cf790cc8
SSDEEP 384:cdOlNbMrgcmS2paFgkI1keB0k1+ojSSjroduZnJz:cdOlNXJjSSjroduZnJz
TLSH
T13DB26D15723B13903ABD258A8594B4AF52C231633018E43B7BB954AE0F67E18DDFECC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 340B
SHA256 3ae70f134a0d8715e36c05343517c9e29b9192d9a207554226c21aa7d358a418
MD5 bb70cc346b6cd3156ed0b501823cc890
SHA1 2b6ab2b6bfd71a7a6711571a2b8027e5d29ad3ec
SHA512 e41386b7db368ff3704d05e4a14cc909f40cf8960de41cd14e40f0ca0f04ddc24d6b4cbd679a88567eac163271dd91b6b5565c5eb074b9fc9e22cd13a30ffa74
TLSH
T18EE0D860A5C5C2DFB064308301789B4CC3D13806EFD42E41AF048C45A5455497A861A6
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 405cacb8b795989b91900d21334619c5746ac1ace1e090c59cc777a5504e0410
MD5 07a0bf8f30d4fb59a0cb63546cafe6e6
SHA1 1b1d223f3b0255186ecac23de68c71021b7830ab
SHA512 7d94c5aee35e3ea80b00784cdcadabc34dc0919042e246dc4ee1f344b58f50188ee4250c94aab3761370c4e7d572544f057b81221318a09dd62eb1e39e634dac
SSDEEP 384:nzRiFavqMg38Ni8TUNTUlIxB4dTmQqh1vfXKeee3Ops7Cq9M5tlDlRYV/Vw1mRoH:cFayv3VwgG2KPeV7Cq2hDlRYk1m6/0HQ
TLSH
T1CFC25B72E855DDABEDEA8FC9E70A7653EEE001A3858C4AD4D6D84E0D00D71DE270BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 8c2fec38d08053dad088080132bb9f36ba26f930ade4eeeafd9cd51872c894c2
MD5 dc364a3d6196f3ac1500bbb7db4994bd
SHA1 4669542e172e47ac2aad7def6412144671e6fb99
SHA512 854447762c94c5a2b66372afca3bb621c8ef8c258bb219539b54b0b81e7ba4fe658cb05eb0fde80ba2dff9be091c19c7cc7d65d51d85a0a1aebc63bb2bf14939
SSDEEP 768:sFjkFwgQyKKPeV7Cq2pRRtwbK/Vz9H5qSy:SkjeV7Cq2XRGbKNz9W
TLSH
T1A8F2187DDC95997F98EE7B88A30E3622A9E40273C1B84998D7D81F4DC0B749DF30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 29KB
SHA256 7603e734828f085513aa70eb194154dbbac089a7e0db65334f9ca8d417b9d746
MD5 f0665bd5a0617193731af10fa678b7f4
SHA1 86f63d0bbf6a4177d56c207e78f0d73fa0a6c10f
SHA512 edcfc3acdbdb64ea2a30143f0b01832d2344fe2adbb8538dec4b98ae071843d310e659950d0119177531f17c468b50fa0aa8d15b6f60a7957ab39292d5624d43
SSDEEP 384:njTiF7cXqnk8NS8TUNTUlIR8TpdIRPqF23aiLfYYkeee3Ops7ChdSuZx95jo5jep:aFjkJwg7y3isYkPeV7ChYux95jo5qp
TLSH
T15BD24A36DC85CD7FD8EE6B89A20E76129DE002B3C5A84ED4EBD85F0C406359D670B919
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 06ed0fd0a9491124f4dce5de919f24dacbcf3da14c2528e3cee9084574726f76
MD5 f6cf6bedb662a618dde5a5e26f4c12f8
SHA1 d0d99174ae82ab46799b37cef0b740004007a3e5
SHA512 c6528c54930c9e4c6bec5b00a718895bd0061af6f0fd51244f122e4f4a2ec0fc6fe7ac685ed919303125e26e46c7b05f8ae8b7ed510652769aac79508477fefb
SSDEEP 384:n2iFavqMg38Ns8TUNTUlIxB4d454OK1vfXKeee3Ops7C1DNRYV/Vw1mRoCe0zrNK:dFayv3jwgLKOGKPeV7C1DNRYk1m6/0HQ
TLSH
T1F5C25B36E858DEABEDEA8FC9E7097A13EEE00167C59C49D4DAD81D0D10970DE130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 fdc43b9f80ce73ee45fd052f8007bb4fd7dde5ebf7de8804b748c047245a2aac
MD5 d136dbf9835e01f50be53b799eff3a71
SHA1 d681e1ab7fe33578c140cfc834e72341d6c001f6
SHA512 3231825b6013b2b51e4a94dbfb3737acdc0b372bd1b5bfecf51de3d02e179a4dcd0a092375e39838b3492e033c14b955e8d435c7e5fd79dac11174f46fce8dd7
SSDEEP 384:nZRiFscXqnZ38Nm8TUNTUlIR8TpdIsJqF21vfXKeee3Ops7Cq9M5ttDlH5jejzS8:eFuZ3FwgUyKKPeV7Cq2pDlH5qSy
TLSH
T1BBC24B72E8A5DD6BECEA4BC9B31A7753EEE001A3858C4ED4E5D85E0C00976DD270BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 14f1b27dcdfea1bdf0c6f2695132b992cab695103684735ac0b7983014760e5c
MD5 4dd94d117029043fff92ad04fc987a27
SHA1 b90989677246fa66216108c41ff85f6fa1f45a4d
SHA512 991fcf97ff83f618e83d19eada6ea34750e3fa8746e0300652eeb64c4bee4d93adf87c2d521650d344c77720349e0570c75ebae33ff38a2d2455e4eb2e621ddc
SSDEEP 384:nZRiFPcXqnZ38Nm8TUNTUlIRYTpdIooqU1vfXKeee3Ops7Cq9M5ttDlH5jejzSDA:eF3Z3FwgdjKPeV7Cq2hDlH5qSy
TLSH
T113C24B72E8A5DD6BECEA4BC9B31A7753EEE001A3858C4ED4E5D85E0C00976DD270BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 23adf9c3fbc630a0bfacaa890ac01fc13da786302be46dec98fd9de6f7458645
MD5 31f12e69f555250302fdb41c1178a7d9
SHA1 160af20c23d840143f2d7cfb33a291e45a495dce
SHA512 4da584383d3e63a71a465f38683164c0914a211c954a638b480f2834e06baa0415748b07d0501305fb5f7eacfca7846141a03d5828814a2f4464f944ebe0d298
SSDEEP 768:sFjkFwgRyKKPeV7Cq2pRRtwbK/Vz9H5qSy:SkoeV7Cq2XRGbKNz9W
TLSH
T1C3F2187DDC95997F98EE7B88A30E3622A9E40273C1B84998D7D80F4DC0B749DF30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 aec72180b24d493029d89ae0763ef398bae3ad7ea3d919906060a768a0404e8b
MD5 42855348dede8c1d787c995548028ff8
SHA1 e8410a0bb5a0a0f908459fd24558405ae308d109
SHA512 1c17f738af26cc8cf756d66b457dc94752c5896d188a1b847ba01fa556633d595123b01032a5b59b0ba189cff50ba949374bdaf9a0ddc3c01efdb5ae9e591ab8
SSDEEP 384:njRiFscXqnZ38Nm8TUNTUlIR8TpdIsJqF21vfXKeee3Ops7Cq9M5ttDlH5jejzS8:sFuZ3FwgUyKKPeV7Cq2pDlH5qSy
TLSH
T15DC24B72E8A5DD6BECEA4BC9B31A7753EEE001A3858C4ED4E5D85E0C00976DD270BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

campaign_history

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history
Size 20KB
SHA256 30e2871a4e907d2fa7d735c9694fe474bbdc5579a41620901e5ddf9fdbdc9d3f
MD5 25db334ccaf67740f79af309d02c1886
SHA1 a9a59c317c494876f2ab5ec08c5c1acebbfcd66e
SHA512 5aa73b1f0eab23451566935929faea4a41456fe0766b7217910c85ab3c49a6570b3da11b4bab5009d964f1317209539c18c66b15b7afe0f9ac9c3251b5859bbc
SSDEEP 24:TLc5UOl0afDdWec9sJNyHXNSvjPVTGDB5fc:TA5UUDbg3PHXNojPV6jc
TLSH
T13A92D272B9302067E99F1B76F8974C500DFC12EF8DA77544DAE04D911462AC27B950FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 5e882eccf8707058815ae2a16a834dc6a726ba8b028a1fa18bf12d1776c04202
MD5 f673024dab2aa283241c52563fea0834
SHA1 91b5e0a3aef673528d42901a766d40be1f2ff522
SHA512 77f1eecb13e21cac660f08a8670a2cdcc0dead0b949bfab1a21358805c40f6d756740651706d0bef13cf107c5b7beb04f554ed0c344401fed524d2a6cb37cb08
SSDEEP 3:MsEllllkEthXllkl2zEelG4kX:/M/xT02zNGLX
TLSH
T18344040C7FD41405C51410304073C35003F0DC100D31574334714413DCC77415C00040
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 c2c57c9dab86d065350bebbb5770de9aad2f721b5640e6fbd1796929b2c1fb0e
MD5 89f75d8ea837351fe5304599af1162a4
SHA1 c26c988aee190c4a20bf42c52397e42ca2155f52
SHA512 3695fcf0a73d3faae9100057bd175c5c8a2d59dcfe66ea4602064e7044e1226fb8faf2d2f857f2bc8e04c7427c5f43d9a701fa7869f0d692853af1e625b8ec15
TLSH
T1A73162D18C3E26D1D4FD0E2E649B38FC95D8D32AF4B8347D1468E9D4023951DA44043F
MD5 SHA1 SHA512 TLSH

Submit Download

3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
Size 147KB
SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
MD5 9c670f04d98ab7404f16423f6ee6cdfa
SHA1 8d01079b2d065731df8a7ef52f447cd4b7add353
SHA512 102cee76d9dfcfe91e044f529672fbec042b50c5db55a3cc137197b2013dd7f81e47f50dbb0db96cb621c5732610e1eb553c4146837c11075c7c4dbd67546a3b
SSDEEP 3072:F7R0M+jCozOtDTsjMcT0JnFjkbxnEbm/+OdGmlVVklFHEpCm+:F7WxxzyDTM0JnRkb5bJdGmJkvkpx+
TLSH
T12DE3E16D3DE6DE1FC41B58F53E64708BC80E8F0B820A644FB64988345A60B5D1BD6AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 54f761e00d363bd15db7bae3cc55144c80148a5fa1db7c3c2049e0e406a9142c
MD5 b1ac780361002049b0a10a7fd30fd809
SHA1 0ee0a7dc27fd175ab7abd6e5649890be3e2795b5
SHA512 1bd8b1d2dc30bc62728d3d08085a446e8c037b02499687affa9a0bb18c6bdfee19104eabdcd8a52c2d0b542046abf26b7fdf81815037d4923e31231b0dfb7d60
TLSH
T156C02B5538F9488C2FA5257ED238092E12E4C912310022B0002ED804103465C13A0C2F
MD5 SHA1 SHA512 TLSH

Submit Download

MSI9B60.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI9B60.tmp
Size 935KB
SHA256 3efada1f1be0eaf2039affc0f8781fdab40528063d178618e08cb228ad5564c3
MD5 117ff19ce920b93a4a670faef0eb8879
SHA1 6e0212d2e06f012380faa87dba1a1b10e34e54d5
SHA512 88b60bedf990135e51f6faee1a17e40fe727afa3c64ecf0b9bcb543ca17885c3e9a81abc7d7d93dd592331e947e79a0bdcdb3ac83e49d30a88bbe634aa5f7f93
SSDEEP 12288:vTK+sBcws3vqS8jQD2PpGRO5/33TJzZl8eJOWj0sYfD89:LKZBcoS8jQDipN5v3TJzZlfYxfDS
TLSH
T185157D1AE7A8027DE0F7D278CD974916EBB2B84A42B19A4F03D146963F13760DE3D712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jusched.log

Path C:\Users\Admin\AppData\Local\Temp\jusched.log
Size 164KB
SHA256 cc2f991a1f36ab28805f10f9b04c964546a38193a5da8f429674056b14becfc4
MD5 1f381ce200a6e7e9acc9bf292be6ceb5
SHA1 0cc61749ab2d67e0e6b9720c9aaf5716d3b05dd8
SHA512 2d0ac08a74ad2dc40a62f45ad2345f4e7e599dc1752eae08b83a488d4aef03d9e4789fbe39c65197c75ac9c49153a8ebe5b03c0f808ac514aedbcbc112b9b3b4
SSDEEP 3072:0s+9lwT4uqO38RIZOMdzGjuABX5WW4Rv5rT6H9ppicz:PSB5
TLSH
T141F33196D52F41BE38534AD3C7B97EA84666060A53FE191832CF82DE6441D07CB2F4EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jusched.log

Path C:\Users\Admin\AppData\Local\Temp\jusched.log
Size 171KB
SHA256 2ddb241caf23e6fa474f6c71e9763583804d50c8b4e631b7daaa192b2f71508c
MD5 72999d9900481be731e400993492ee83
SHA1 c3bc3b108b2a5432c555dfb028c564850b859287
SHA512 09bca6ef5a41f5e1a4bf899dc97bd35e3f54b7b12ea940f3af603c45a23e24d62216f8aa2a18462d0805d6bead9a7cf016fa8ff579373c2e0b7e2654881ba562
SSDEEP 3072:0s+9lwT4uqO38RIZOMdzGjuABX5WW4Rv5rT6H9ppico:PSBW
TLSH
T154043156D92F41BF28534AD3C7B9BE984666060A53FE191832CF82DE6445C07CB2F4EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jusched.log

Path C:\Users\Admin\AppData\Local\Temp\jusched.log
Size 188KB
SHA256 0819dac45bac54194e08c4a240b8ed8915a143f2b4b2f5eeb1a405e19c49e460
MD5 9ba2241d0e6c5eec62be6e52121a87cd
SHA1 e4702d2dd6fb89a851cf0c867d44dbbc03dc06fd
SHA512 6527d146d54e51a961b3ab8d3a85f8023288d01a93a904075bef8c7f3b07d1651136cef7e15659183e928f5a54bd12e5c0bf44d2818b3ec24a3bf2b6d1d419cb
SSDEEP 3072:0s+9lwT4uqO38RIZOMdzGjuABX5WW4Rv5rT6H9ppicE:PSBy
TLSH
T151142096D52F41BE28534AD3C7B97EA84666060A57FE191C32CF42DEA441C07CB2F4EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdk-21_windows-x64_bin.exe:Zone.Identifier

Path C:\Users\Admin\Downloads\jdk-21_windows-x64_bin.exe:Zone.Identifier
Size 170B
SHA256 66b8d270eab1df751e9f9f460f3b6f2e759df8fde8deeb69f6b89d2bc03c592a
MD5 093ca9c90318de1491eb03f54c5bf0cb
SHA1 85b7419f57104fa2801c2e9987134c5bdcf1b780
SHA512 15f6eb1dc88eae07360b567825475330c0990fa114d61b003b73d86682653448b5a2a39fb221b64c1fc0d6c821d31b6736c4deb8a4970d4e5ab5e5567925815f
TLSH
T190C0807FC951F5140611B581539D530D7A4B56148862C288D850544FF4F4C75D468673
MD5 SHA1 SHA512 TLSH

Submit Download

WindowsAccessBridge-64.dll

Path C:\Windows\System32\WindowsAccessBridge-64.dll
Size 71KB
SHA256 97f0e78b229e4945c399d4fa657e46c68a21ebd12c4c3d38c13922963b82206c
MD5 0d8049139bb4beede30b01b10c41961a
SHA1 4a16a9af9b39e432a04d39daba648470df0e0648
SHA512 45e34a58f227b2b2c99e42435f3a429cc5eb67b576cf7e6784c85c1929c4eb5d343392690956f4036f4dcbda3d647c8d8b8ceabf62c9452229de8a60f76cd37a
SSDEEP 1536:l9KObfJrVSRTesefg/Z+to8lRFUDDB71V6EU:fKOFrZL4eRFetZV0
TLSH
T135632B53E29420F2C12E817D88F14115AEF97BBC0633474BDB7FA15B8BA2152563E736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keys.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3396_1477229606\keys.json
Size 8KB
SHA256 ae6e69a145f84c0a261b4e82888779fbf137f193881d687588e1af71609ae947
MD5 d3ebc1cb4b692c6e2d29a4625420fe73
SHA1 4ce74c1e9af6fd34d6379ec0fec6afb24082a7c1
SHA512 e34b855615e6a3bf770f27d85aa29ca57a324c08bd8f8d9c0130e2a142c0e4a5f17bffd0861b725acc8a2316f73b7fe50406b0af26264a5c2d8f37599b260860
SSDEEP 192:uNtGbR+mFGfvPNyR9Pm4lOvMwkoR9PuGMXcy:ORmqwKjA
TLSH
T18402A57F14A41181CE7FC1698F0B78B78FA038065BCA3A83539BFA49494296D173B5B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3396_1477229606\manifest.json
Size 79B
SHA256 7ea98f2308a9c51d17a1ac71b64afbe2a41ff0a083a166a0e4cc428bf44f0715
MD5 817fea104100763cd1bf4f15a51bfe94
SHA1 589717cf98cf7e2d55fc0d6025a4b8e215ed13d6
SHA512 da7b959d93113c5a6be360f90d9c721989c5e7acad7fa592081b582c4c3a0c4a9066a71473fd8492ce7fe7b0fbfd6870d939428a67fbd508fcf6b2c6dc1a41ea
TLSH
T15EA0122058019233108407600360478243551C022015244809461041258813A12A3128
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3396_1926701840\manifest.json
Size 177B
SHA256 096e772e0f2e8c15e6dec9087ee0a1fb8b0c56b25061626aedc9e7e705adfc2e
MD5 2714a51ed8c2a891ad73b7488ab655b9
SHA1 9a8cc479aec8de1b4eb678e5d68b23b16a39dc99
SHA512 4811522c06ad6946626a9f4d12eb62a1d623825d18a1cd0ad7b628f4c059f37d299b5857abffd959e4ea53239412490539f5705b4aa6c6951d13c68e6d5b72ad
TLSH
T1E6C012EFDC509DB215EB4323156D43C4E733CF4B1546490935FB66082A25981C193500
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2148-331-0x0000019E16840000-0x0000019E16841000-memory.dmp

Download

memory/2148-322-0x0000019E16840000-0x0000019E16841000-memory.dmp

Download

memory/2148-328-0x0000019E16840000-0x0000019E16841000-memory.dmp

Download

memory/2148-324-0x0000019E16840000-0x0000019E16841000-memory.dmp

Download

memory/2148-330-0x0000019E16840000-0x0000019E16841000-memory.dmp

Download

memory/2148-323-0x0000019E16840000-0x0000019E16841000-memory.dmp

Download

memory/2148-334-0x0000019E16840000-0x0000019E16841000-memory.dmp

Download

memory/2148-329-0x0000019E16840000-0x0000019E16841000-memory.dmp

Download

memory/2148-332-0x0000019E16840000-0x0000019E16841000-memory.dmp

Download

memory/2148-333-0x0000019E16840000-0x0000019E16841000-memory.dmp

Download

memory/2636-1821-0x0000018DB62A0000-0x0000018DB62AC000-memory.dmp

Download

memory/2636-2628-0x0000018DB62A0000-0x0000018DB62AC000-memory.dmp

Download

memory/2648-2880-0x00007FFD3B070000-0x00007FFD3B080000-memory.dmp

Download

memory/2648-2695-0x00007FFD3B070000-0x00007FFD3B080000-memory.dmp

Download

memory/2648-2846-0x000001D9CDAB0000-0x000001D9CDAB8000-memory.dmp

Download

memory/2648-2882-0x00007FFD3B070000-0x00007FFD3B080000-memory.dmp

Download

memory/2648-2881-0x00007FFD3B070000-0x00007FFD3B080000-memory.dmp

Download

memory/2648-2698-0x00007FFD384D0000-0x00007FFD384E0000-memory.dmp

Download

memory/2648-2879-0x00007FFD3B070000-0x00007FFD3B080000-memory.dmp

Download

memory/2648-2696-0x00007FFD3B070000-0x00007FFD3B080000-memory.dmp

Download

memory/2648-2692-0x00007FFD3B070000-0x00007FFD3B080000-memory.dmp

Download

memory/2648-2693-0x00007FFD3B070000-0x00007FFD3B080000-memory.dmp

Download

memory/2648-2694-0x00007FFD3B070000-0x00007FFD3B080000-memory.dmp

Download

memory/2648-2697-0x00007FFD384D0000-0x00007FFD384E0000-memory.dmp

Download

memory/6040-1870-0x0000022077A30000-0x0000022077A3C000-memory.dmp

Download