bae296cff126b19fa3c70ad3224afca16f891e7117730aad4ddbcd7250a01f80

Analysis

user interaction
yes
max time kernel
32s
max time network
57s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
04/05/2026, 13:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
trigger.ps1
Size 6KB
Sample260504-ql9saagy3k
SHA256 bae296cff126b19fa3c70ad3224afca16f891e7117730aad4ddbcd7250a01f80
MD5 24e066cf342832022ba96d8968df2206
SHA1 4de5a105b3fc623815d683e72bcab68ed7a2c584
SHA512 e9ae3b56e7fd759bb4953a475a842e78fa1911ab5611ded5874f22d36aca2d0c8027f1ef15fe06913cf72833dc7bfa797726549fd0f2725f26ec48a481a364db
SSDEEP 192:cqUcYsh6wN5Mn8YSERGLegZu/ayqKMrfgxu/:cq3LhDN5M8RERGLZQ/ayqKKfZ
TLSH
T12DD1B926B70F896AC3F28B1BC457F84DEE150033B14A9C4CB5CEA591DF3411A936C68D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution ransomware

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3824	PowerShell.exe
3688	powershell.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2704	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
2104	taskkill.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134223745543545181"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3847269522-1618051987-1942096715-1000\{A1624B3E-635F-4D15-AD51-80774E630CD7}	msedge.exe

Opens file in notepad (likely ransom note) 50 IoCs

ransomware

pid	Process
4012	notepad.exe
1968	notepad.exe
4856	notepad.exe
5520	notepad.exe
5784	notepad.exe
5872	notepad.exe
5964	notepad.exe
5596	notepad.exe
4844	notepad.exe
5476	notepad.exe
5564	notepad.exe
5828	notepad.exe
6096	notepad.exe
5064	notepad.exe
5608	notepad.exe
5200	notepad.exe
3100	notepad.exe
2072	notepad.exe
4752	notepad.exe
2240	notepad.exe
5144	notepad.exe
5344	notepad.exe
6140	notepad.exe
5372	notepad.exe
5724	notepad.exe
3476	notepad.exe
2556	notepad.exe
912	notepad.exe
5256	notepad.exe
5740	notepad.exe
6008	notepad.exe
4576	notepad.exe
5652	notepad.exe
2368	notepad.exe
4616	notepad.exe
2740	notepad.exe
5212	notepad.exe
5300	notepad.exe
6052	notepad.exe
3340	notepad.exe
4052	notepad.exe
5016	notepad.exe
2464	notepad.exe
5696	notepad.exe
5916	notepad.exe
5856	notepad.exe
5960	notepad.exe
5388	notepad.exe
5432	notepad.exe
6080	notepad.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
3824	PowerShell.exe
3824	PowerShell.exe
3688	powershell.exe
3688	powershell.exe
3688	powershell.exe
3688	powershell.exe
3688	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3688	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3824	PowerShell.exe
Token: SeDebugPrivilege	3688	powershell.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4416	msedge.exe
4416	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4032 wrote to memory of 3688	4032	cmd.exe	84
PID 3688 wrote to memory of 2368	3688	powershell.exe	85
PID 3688 wrote to memory of 4416	3688	powershell.exe	86
PID 4416 wrote to memory of 4832	4416	msedge.exe	87
PID 4416 wrote to memory of 2488	4416	msedge.exe	88
PID 4416 wrote to memory of 2488	4416	msedge.exe	88
PID 4416 wrote to memory of 2488	4416	msedge.exe	88
PID 4416 wrote to memory of 2704	4416	msedge.exe	89
PID 4416 wrote to memory of 3784	4416	msedge.exe	90
PID 4416 wrote to memory of 3784	4416	msedge.exe	90
PID 4416 wrote to memory of 2072	4416	msedge.exe	92
PID 4416 wrote to memory of 2072	4416	msedge.exe	92
PID 4416 wrote to memory of 2072	4416	msedge.exe	92
PID 4416 wrote to memory of 1480	4416	msedge.exe	93
PID 4416 wrote to memory of 1480	4416	msedge.exe	93
PID 4416 wrote to memory of 1480	4416	msedge.exe	93
PID 4416 wrote to memory of 5064	4416	msedge.exe	94
PID 4416 wrote to memory of 5064	4416	msedge.exe	94
PID 4416 wrote to memory of 5064	4416	msedge.exe	94
PID 4416 wrote to memory of 3064	4416	msedge.exe	95
PID 4416 wrote to memory of 3064	4416	msedge.exe	95
PID 4416 wrote to memory of 3064	4416	msedge.exe	95
PID 4416 wrote to memory of 2492	4416	msedge.exe	96
PID 4416 wrote to memory of 2492	4416	msedge.exe	96
PID 4416 wrote to memory of 2492	4416	msedge.exe	96
PID 4416 wrote to memory of 2116	4416	msedge.exe	97
PID 4416 wrote to memory of 2116	4416	msedge.exe	97
PID 4416 wrote to memory of 2116	4416	msedge.exe	97
PID 4416 wrote to memory of 4128	4416	msedge.exe	99
PID 4416 wrote to memory of 4128	4416	msedge.exe	99
PID 4416 wrote to memory of 2984	4416	msedge.exe	101
PID 4416 wrote to memory of 2984	4416	msedge.exe	101
PID 4416 wrote to memory of 488	4416	msedge.exe	102
PID 4416 wrote to memory of 488	4416	msedge.exe	102
PID 4416 wrote to memory of 488	4416	msedge.exe	102
PID 3688 wrote to memory of 2368	3688	powershell.exe	103
PID 4416 wrote to memory of 2428	4416	msedge.exe	104
PID 4416 wrote to memory of 792	4416	msedge.exe	105
PID 4416 wrote to memory of 2428	4416	msedge.exe	104
PID 4416 wrote to memory of 792	4416	msedge.exe	105
PID 4416 wrote to memory of 1472	4416	msedge.exe	107
PID 4416 wrote to memory of 756	4416	msedge.exe	108
PID 756 wrote to memory of 2240	756	msedge.exe	109
PID 4416 wrote to memory of 4740	4416	msedge.exe	110
PID 4416 wrote to memory of 4740	4416	msedge.exe	110
PID 4416 wrote to memory of 2840	4416	msedge.exe	111
PID 4416 wrote to memory of 2840	4416	msedge.exe	111
PID 4416 wrote to memory of 4616	4416	msedge.exe	112
PID 4416 wrote to memory of 4616	4416	msedge.exe	112
PID 4416 wrote to memory of 736	4416	msedge.exe	113
PID 4416 wrote to memory of 736	4416	msedge.exe	113
PID 4416 wrote to memory of 1740	4416	msedge.exe	114
PID 4416 wrote to memory of 1740	4416	msedge.exe	114
PID 3688 wrote to memory of 3476	3688	powershell.exe	115
PID 3688 wrote to memory of 4012	3688	powershell.exe	116
PID 4416 wrote to memory of 3996	4416	msedge.exe	117
PID 4416 wrote to memory of 3996	4416	msedge.exe	117
PID 3688 wrote to memory of 2072	3688	powershell.exe	118
PID 3688 wrote to memory of 1968	3688	powershell.exe	119
PID 3688 wrote to memory of 2556	3688	powershell.exe	120
PID 3688 wrote to memory of 4052	3688	powershell.exe	121
PID 3688 wrote to memory of 5016	3688	powershell.exe	122
PID 3688 wrote to memory of 4616	3688	powershell.exe	123
PID 3688 wrote to memory of 4856	3688	powershell.exe	124

C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\trigger.ps1
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3824

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\Start Flash.bat" "
1⤵
- Suspicious use of WriteProcessMemory
PID:4032
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -ExecutionPolicy Bypass -File "C:\Users\Admin\Desktop\Flash.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3688
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\yfjkqpze\yfjkqpze.cmdline"
    3⤵
    PID:2368
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.google.com/search?q=hi
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4416
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x368,0x7ff91b60c188,0x7ff91b60c194,0x7ff91b60c1a0
      4⤵
      PID:4832
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1612,i,765557460363884752,6168895931402576713,262144 --field-trial-handle=2008,i,1733505256389932974,1874265129900857686,262144 --variations-seed-version --mojo-platform-channel-handle=2000 /prefetch:2
      4⤵
      PID:2488
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2260,i,14003271837982567212,9560030340425651884,524288 --field-trial-handle=2008,i,1733505256389932974,1874265129900857686,262144 --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:11
      4⤵
      System Time Discovery
      PID:2704
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2480,i,15072963771569292654,10190849549196760429,524288 --field-trial-handle=2008,i,1733505256389932974,1874265129900857686,262144 --variations-seed-version --mojo-platform-channel-handle=3096 /prefetch:13
      4⤵
      PID:3784
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3536,i,2344389907860539,2448902574636323230,2097152 --field-trial-handle=2008,i,1733505256389932974,1874265129900857686,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:1
      4⤵
      PID:2072
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3516,i,11623400799691459639,6024000850053623214,2097152 --field-trial-handle=2008,i,1733505256389932974,1874265129900857686,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:1
      4⤵
      PID:1480
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4100,i,5394970469335538882,240147847702833868,2097152 --field-trial-handle=2008,i,1733505256389932974,1874265129900857686,262144 --variations-seed-version --mojo-platform-channel-handle=4164 /prefetch:1
      4⤵
      PID:5064
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4124,i,1408969604033614073,6307125428845877241,2097152 --field-trial-handle=2008,i,1733505256389932974,1874265129900857686,262144 --variations-seed-version --mojo-platform-channel-handle=4584 /prefetch:1
      4⤵
      PID:3064
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4112,i,17304100229156604217,12519318497358959696,2097152 --field-trial-handle=2008,i,1733505256389932974,1874265129900857686,262144 --variations-seed-version --mojo-platform-channel-handle=4644 /prefetch:9
      4⤵
      PID:2492
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4136,i,5675019131823110217,9632762561121439247,2097152 --field-trial-handle=2008,i,1733505256389932974,1874265129900857686,262144 --variations-seed-version --mojo-platform-channel-handle=4676 /prefetch:9
      4⤵
      PID:2116
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5204,i,15189603802088675833,6997934191029813824,524288 --field-trial-handle=2008,i,1733505256389932974,1874265129900857686,262144 --variations-seed-version --mojo-platform-channel-handle=3980 /prefetch:14
      4⤵
      PID:4128
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5316,i,13494158991111585518,18210589755907841046,524288 --field-trial-handle=2008,i,1733505256389932974,1874265129900857686,262144 --variations-seed-version --mojo-platform-channel-handle=5344 /prefetch:14
      4⤵
      PID:2984
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=5236,i,4545170265997569592,10984788015800660300,2097152 --field-trial-handle=2008,i,1733505256389932974,1874265129900857686,262144 --variations-seed-version --mojo-platform-channel-handle=5124 /prefetch:1
      4⤵
      PID:488
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3628,i,3076593788870191891,3409135084854167100,524288 --field-trial-handle=2008,i,1733505256389932974,1874265129900857686,262144 --variations-seed-version --mojo-platform-channel-handle=3720 /prefetch:14
      4⤵
      PID:2428
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4048,i,11532783807512065024,1008636330823230250,524288 --field-trial-handle=2008,i,1733505256389932974,1874265129900857686,262144 --variations-seed-version --mojo-platform-channel-handle=3680 /prefetch:14
      4⤵
      PID:792
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6128,i,2760376799499403415,11807545637619775475,524288 --field-trial-handle=2008,i,1733505256389932974,1874265129900857686,262144 --variations-seed-version --mojo-platform-channel-handle=6060 /prefetch:14
      4⤵
      PID:4844
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6128,i,2760376799499403415,11807545637619775475,524288 --field-trial-handle=2008,i,1733505256389932974,1874265129900857686,262144 --variations-seed-version --mojo-platform-channel-handle=6060 /prefetch:14
      4⤵
      PID:1472
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6216,i,10104275655493115539,6960364289710397027,524288 --field-trial-handle=2008,i,1733505256389932974,1874265129900857686,262144 --variations-seed-version --mojo-platform-channel-handle=6204 /prefetch:14
      4⤵
      Suspicious use of WriteProcessMemory
      PID:756
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=1132
        5⤵
        
        PID:2240
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6340,i,4158091636235014991,13042721759789777042,524288 --field-trial-handle=2008,i,1733505256389932974,1874265129900857686,262144 --variations-seed-version --mojo-platform-channel-handle=6368 /prefetch:14
      4⤵
      PID:4740
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6500,i,17852705312401190577,137229426950631483,524288 --field-trial-handle=2008,i,1733505256389932974,1874265129900857686,262144 --variations-seed-version --mojo-platform-channel-handle=6504 /prefetch:14
      4⤵
      PID:2840
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6608,i,16411810167081420999,4206997023786008973,524288 --field-trial-handle=2008,i,1733505256389932974,1874265129900857686,262144 --variations-seed-version --mojo-platform-channel-handle=6644 /prefetch:14
      4⤵
      PID:4616
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6424,i,17645746352257822339,17014861155110437899,524288 --field-trial-handle=2008,i,1733505256389932974,1874265129900857686,262144 --variations-seed-version --mojo-platform-channel-handle=6720 /prefetch:14
      4⤵
      PID:736
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6424,i,6876855921450449911,8570555572132573935,524288 --field-trial-handle=2008,i,1733505256389932974,1874265129900857686,262144 --variations-seed-version --mojo-platform-channel-handle=6808 /prefetch:14
      4⤵
      PID:1740
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6544,i,6315561333363276862,14074951396044115015,524288 --field-trial-handle=2008,i,1733505256389932974,1874265129900857686,262144 --variations-seed-version --mojo-platform-channel-handle=6396 /prefetch:12
      4⤵
      PID:3996
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=4200,i,10021205714200498262,11093885546846953057,2097152 --field-trial-handle=2008,i,1733505256389932974,1874265129900857686,262144 --variations-seed-version --mojo-platform-channel-handle=6608 /prefetch:1
      4⤵
      PID:3976
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=6140,i,938448103791246059,11531414555986231976,2097152 --field-trial-handle=2008,i,1733505256389932974,1874265129900857686,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:1
      4⤵
      PID:2492
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5212,i,4473275298548975635,11270571582047701903,524288 --field-trial-handle=2008,i,1733505256389932974,1874265129900857686,262144 --variations-seed-version --mojo-platform-channel-handle=3340 /prefetch:14
      4⤵
      PID:5920
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5368,i,1900338543940169089,2222426123453873659,524288 --field-trial-handle=2008,i,1733505256389932974,1874265129900857686,262144 --variations-seed-version --mojo-platform-channel-handle=6968 /prefetch:14
      4⤵
      PID:5980
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5128,i,5746007320938829362,595932480784328600,524288 --field-trial-handle=2008,i,1733505256389932974,1874265129900857686,262144 --variations-seed-version --mojo-platform-channel-handle=5248 /prefetch:14
      4⤵
      PID:5568
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5124,i,6086161495930532016,977200373566374706,524288 --field-trial-handle=2008,i,1733505256389932974,1874265129900857686,262144 --variations-seed-version --mojo-platform-channel-handle=7064 /prefetch:14
      4⤵
      PID:5652
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7052,i,942243434921375652,11801546062064389903,524288 --field-trial-handle=2008,i,1733505256389932974,1874265129900857686,262144 --variations-seed-version --mojo-platform-channel-handle=6872 /prefetch:14
      4⤵
      PID:5712
- - C:\Windows\system32\notepad.exe
    "C:\Windows\system32\notepad.exe" C:\Users\Admin\AppData\Local\Temp\game.txt
    3⤵
    - Opens file in notepad (likely ransom note)
    PID:2368
- - C:\Windows\system32\notepad.exe
    "C:\Windows\system32\notepad.exe" C:\Users\Admin\AppData\Local\Temp\friend20672.txt
    3⤵
    - Opens file in notepad (likely ransom note)
    PID:3476
- - C:\Windows\system32\notepad.exe
    "C:\Windows\system32\notepad.exe" C:\Users\Admin\AppData\Local\Temp\friend32965.txt
    3⤵
    - Opens file in notepad (likely ransom note)
    PID:4012
- - C:\Windows\system32\notepad.exe
    "C:\Windows\system32\notepad.exe" C:\Users\Admin\AppData\Local\Temp\friend98059.txt
    3⤵
    - Opens file in notepad (likely ransom note)
    PID:2072
- - C:\Windows\system32\notepad.exe
    "C:\Windows\system32\notepad.exe" C:\Users\Admin\AppData\Local\Temp\friend45694.txt
    3⤵
    - Opens file in notepad (likely ransom note)
    PID:1968
- - C:\Windows\system32\notepad.exe
    "C:\Windows\system32\notepad.exe" C:\Users\Admin\AppData\Local\Temp\friend44295.txt
    3⤵
    - Opens file in notepad (likely ransom note)
    PID:2556
- - C:\Windows\system32\notepad.exe
    "C:\Windows\system32\notepad.exe" C:\Users\Admin\AppData\Local\Temp\friend69412.txt
    3⤵
    - Opens file in notepad (likely ransom note)
    PID:4052
- - C:\Windows\system32\notepad.exe
    "C:\Windows\system32\notepad.exe" C:\Users\Admin\AppData\Local\Temp\friend70940.txt
    3⤵
    - Opens file in notepad (likely ransom note)
    PID:5016
- - C:\Windows\system32\notepad.exe
    "C:\Windows\system32\notepad.exe" C:\Users\Admin\AppData\Local\Temp\friend74235.txt
    3⤵
    - Opens file in notepad (likely ransom note)
    PID:4616
- - C:\Windows\system32\notepad.exe
    "C:\Windows\system32\notepad.exe" C:\Users\Admin\AppData\Local\Temp\friend78887.txt
    3⤵
    - Opens file in notepad (likely ransom note)
    PID:4856
- - C:\Windows\system32\notepad.exe
    "C:\Windows\system32\notepad.exe" C:\Users\Admin\AppData\Local\Temp\friend35081.txt
    3⤵
    - Opens file in notepad (likely ransom note)
    PID:4752
- - C:\Windows\system32\notepad.exe
    "C:\Windows\system32\notepad.exe" C:\Users\Admin\AppData\Local\Temp\friend26150.txt
    3⤵
    - Opens file in notepad (likely ransom note)
    PID:2740
- - C:\Windows\system32\notepad.exe
    "C:\Windows\system32\notepad.exe" C:\Users\Admin\AppData\Local\Temp\friend61350.txt
    3⤵
    - Opens file in notepad (likely ransom note)
    PID:2240
- - C:\Windows\system32\notepad.exe
    "C:\Windows\system32\notepad.exe" C:\Users\Admin\AppData\Local\Temp\friend15345.txt
    3⤵
    - Opens file in notepad (likely ransom note)
    PID:4844
- - C:\Windows\system32\notepad.exe
    "C:\Windows\system32\notepad.exe" C:\Users\Admin\AppData\Local\Temp\friend86910.txt
    3⤵
    - Opens file in notepad (likely ransom note)
    PID:912
- - C:\Windows\system32\notepad.exe
    "C:\Windows\system32\notepad.exe" C:\Users\Admin\AppData\Local\Temp\friend4094.txt
    3⤵
    - Opens file in notepad (likely ransom note)
    PID:2464
- - C:\Windows\system32\notepad.exe
    "C:\Windows\system32\notepad.exe" C:\Users\Admin\AppData\Local\Temp\friend84012.txt
    3⤵
    - Opens file in notepad (likely ransom note)
    PID:5144
- - C:\Windows\system32\notepad.exe
    "C:\Windows\system32\notepad.exe" C:\Users\Admin\AppData\Local\Temp\friend33270.txt
    3⤵
    - Opens file in notepad (likely ransom note)
    PID:5212
- - C:\Windows\system32\notepad.exe
    "C:\Windows\system32\notepad.exe" C:\Users\Admin\AppData\Local\Temp\friend3663.txt
    3⤵
    - Opens file in notepad (likely ransom note)
    PID:5256
- - C:\Windows\system32\notepad.exe
    "C:\Windows\system32\notepad.exe" C:\Users\Admin\AppData\Local\Temp\friend3362.txt
    3⤵
    - Opens file in notepad (likely ransom note)
    PID:5300
- - C:\Windows\system32\notepad.exe
    "C:\Windows\system32\notepad.exe" C:\Users\Admin\AppData\Local\Temp\friend4782.txt
    3⤵
    - Opens file in notepad (likely ransom note)
    PID:5344
- - C:\Windows\system32\notepad.exe
    "C:\Windows\system32\notepad.exe" C:\Users\Admin\AppData\Local\Temp\friend88208.txt
    3⤵
    - Opens file in notepad (likely ransom note)
    PID:5388
- - C:\Windows\system32\notepad.exe
    "C:\Windows\system32\notepad.exe" C:\Users\Admin\AppData\Local\Temp\friend84969.txt
    3⤵
    - Opens file in notepad (likely ransom note)
    PID:5432
- - C:\Windows\system32\notepad.exe
    "C:\Windows\system32\notepad.exe" C:\Users\Admin\AppData\Local\Temp\friend80835.txt
    3⤵
    - Opens file in notepad (likely ransom note)
    PID:5476
- - C:\Windows\system32\notepad.exe
    "C:\Windows\system32\notepad.exe" C:\Users\Admin\AppData\Local\Temp\friend25497.txt
    3⤵
    - Opens file in notepad (likely ransom note)
    PID:5520
- - C:\Windows\system32\notepad.exe
    "C:\Windows\system32\notepad.exe" C:\Users\Admin\AppData\Local\Temp\friend44309.txt
    3⤵
    - Opens file in notepad (likely ransom note)
    PID:5564
- - C:\Windows\system32\notepad.exe
    "C:\Windows\system32\notepad.exe" C:\Users\Admin\AppData\Local\Temp\friend62889.txt
    3⤵
    - Opens file in notepad (likely ransom note)
    PID:5608
- - C:\Windows\system32\notepad.exe
    "C:\Windows\system32\notepad.exe" C:\Users\Admin\AppData\Local\Temp\friend9821.txt
    3⤵
    - Opens file in notepad (likely ransom note)
    PID:5652
- - C:\Windows\system32\notepad.exe
    "C:\Windows\system32\notepad.exe" C:\Users\Admin\AppData\Local\Temp\friend5169.txt
    3⤵
    - Opens file in notepad (likely ransom note)
    PID:5696
- - C:\Windows\system32\notepad.exe
    "C:\Windows\system32\notepad.exe" C:\Users\Admin\AppData\Local\Temp\friend68683.txt
    3⤵
    - Opens file in notepad (likely ransom note)
    PID:5740
- - C:\Windows\system32\notepad.exe
    "C:\Windows\system32\notepad.exe" C:\Users\Admin\AppData\Local\Temp\friend82053.txt
    3⤵
    - Opens file in notepad (likely ransom note)
    PID:5784
- - C:\Windows\system32\notepad.exe
    "C:\Windows\system32\notepad.exe" C:\Users\Admin\AppData\Local\Temp\friend77880.txt
    3⤵
    - Opens file in notepad (likely ransom note)
    PID:5828
- - C:\Windows\system32\notepad.exe
    "C:\Windows\system32\notepad.exe" C:\Users\Admin\AppData\Local\Temp\friend4106.txt
    3⤵
    - Opens file in notepad (likely ransom note)
    PID:5872
- - C:\Windows\system32\notepad.exe
    "C:\Windows\system32\notepad.exe" C:\Users\Admin\AppData\Local\Temp\friend50762.txt
    3⤵
    - Opens file in notepad (likely ransom note)
    PID:5916
- - C:\Windows\system32\notepad.exe
    "C:\Windows\system32\notepad.exe" C:\Users\Admin\AppData\Local\Temp\friend6030.txt
    3⤵
    - Opens file in notepad (likely ransom note)
    PID:5964
- - C:\Windows\system32\notepad.exe
    "C:\Windows\system32\notepad.exe" C:\Users\Admin\AppData\Local\Temp\friend61869.txt
    3⤵
    - Opens file in notepad (likely ransom note)
    PID:6008
- - C:\Windows\system32\notepad.exe
    "C:\Windows\system32\notepad.exe" C:\Users\Admin\AppData\Local\Temp\friend89765.txt
    3⤵
    - Opens file in notepad (likely ransom note)
    PID:6052
- - C:\Windows\system32\notepad.exe
    "C:\Windows\system32\notepad.exe" C:\Users\Admin\AppData\Local\Temp\friend66258.txt
    3⤵
    - Opens file in notepad (likely ransom note)
    PID:6096
- - C:\Windows\system32\notepad.exe
    "C:\Windows\system32\notepad.exe" C:\Users\Admin\AppData\Local\Temp\friend93448.txt
    3⤵
    - Opens file in notepad (likely ransom note)
    PID:6140
- - C:\Windows\system32\notepad.exe
    "C:\Windows\system32\notepad.exe" C:\Users\Admin\AppData\Local\Temp\friend85730.txt
    3⤵
    - Opens file in notepad (likely ransom note)
    PID:5200
- - C:\Windows\system32\notepad.exe
    "C:\Windows\system32\notepad.exe" C:\Users\Admin\AppData\Local\Temp\friend95625.txt
    3⤵
    - Opens file in notepad (likely ransom note)
    PID:5372
- - C:\Windows\system32\notepad.exe
    "C:\Windows\system32\notepad.exe" C:\Users\Admin\AppData\Local\Temp\friend98169.txt
    3⤵
    - Opens file in notepad (likely ransom note)
    PID:4576
- - C:\Windows\system32\notepad.exe
    "C:\Windows\system32\notepad.exe" C:\Users\Admin\AppData\Local\Temp\friend43070.txt
    3⤵
    - Opens file in notepad (likely ransom note)
    PID:5596
- - C:\Windows\system32\notepad.exe
    "C:\Windows\system32\notepad.exe" C:\Users\Admin\AppData\Local\Temp\friend78274.txt
    3⤵
    - Opens file in notepad (likely ransom note)
    PID:5724
- - C:\Windows\system32\notepad.exe
    "C:\Windows\system32\notepad.exe" C:\Users\Admin\AppData\Local\Temp\friend63438.txt
    3⤵
    - Opens file in notepad (likely ransom note)
    PID:5856
- - C:\Windows\system32\notepad.exe
    "C:\Windows\system32\notepad.exe" C:\Users\Admin\AppData\Local\Temp\friend49880.txt
    3⤵
    - Opens file in notepad (likely ransom note)
    PID:5064
- - C:\Windows\system32\notepad.exe
    "C:\Windows\system32\notepad.exe" C:\Users\Admin\AppData\Local\Temp\friend18503.txt
    3⤵
    - Opens file in notepad (likely ransom note)
    PID:3340
- - C:\Windows\system32\notepad.exe
    "C:\Windows\system32\notepad.exe" C:\Users\Admin\AppData\Local\Temp\friend79265.txt
    3⤵
    - Opens file in notepad (likely ransom note)
    PID:5960
- - C:\Windows\system32\notepad.exe
    "C:\Windows\system32\notepad.exe" C:\Users\Admin\AppData\Local\Temp\friend54331.txt
    3⤵
    - Opens file in notepad (likely ransom note)
    PID:6080
- - C:\Windows\system32\notepad.exe
    "C:\Windows\system32\notepad.exe" C:\Users\Admin\AppData\Local\Temp\friend31317.txt
    3⤵
    - Opens file in notepad (likely ransom note)
    PID:3100
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/
    3⤵
    PID:2152
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "taskkill.exe /f /im svchost.exe"
    3⤵
    PID:1584
  - - C:\Windows\system32\taskkill.exe
      taskkill.exe /f /im svchost.exe
      4⤵
      Kills process with taskkill
      PID:2104

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1776

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:4420

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 d69b7d84970cb04cd069299fd8aa9cef8394999588bead979104dc3cb743b4f2
MD5 5f4c933102a824f41e258078e34165a7
SHA1 d2f9e997b2465d3ae7d91dad8d99b77a2332b6ee
SHA512 a7556b2be1a69dbc1f7ff4c1c25581a28cb885c7e1116632c535fee5facaa99067bcead8f02499980f1d999810157d0fc2f9e45c200dee7d379907ef98a6f034
TLSH
T15651CF323375B1D489163F07192C59C463BF8355FA94AF4CB698624ED92700B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 9dfa6aedebac0b2a7a6a4b7cf7a5385b714d5fbe36a5f334877adc4e59f7bed3
MD5 3c974a700ca35a09f8c2b49b1532d825
SHA1 c8bfc7bbffa5a8b16f303fb3855c7272f8cd2207
SHA512 d0f0c915c5c5723353ebb14545f03ebb586f6004eadf2c4989a392b096d18eb0d4d7b393ef79d0e5b3d4fcce239d92a12d86c978f01ea96a23a5eccc24d012f9
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7z:fwUQC5VwBIiElEd2K57P7z
TLSH
T1AAB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e365308021ade71cd7fd8bcb77743afa8328c70101415bb9b419c11ce7afa8b2
MD5 20d252cf697b00581a3fc1a7eb0aa400
SHA1 999f264f6caea10fd708d20094aec5024868af67
SHA512 7bdbd68d07d0b20ca7f49d51c821765822e32a81d51915eddc65d999ab43472632b096aaaf0a8fc634bc0a88ab61a5ff5c5b9e3a19f7fb7623f3e7b7a69eb13a
TLSH
T1ACD0805C17F76C31E554AD7004563F15BA55D5B39B49D73164732C791C4208215911C3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6a6727a0a4fa4cb1a57a4c321f756d9dd6f44ea45d205327c5e7e5f18c2f6950
MD5 8f53b23305ec44c09bb086cb47d00ebe
SHA1 a54d190b6b6e3b05a68b18a4e38bc67e0d914f6d
SHA512 24004588102e1fa8a9bf07c27541083145da06836345681ba0f438a086ca89db4bcfe563005d6b736f731acf1ba98f4abfdd021ee48bd0cd93d4afd01bba7f70
TLSH
T1DBD0805C57B76C31E554AD7004573F15BA55D5B39B49973164732C791C4104215911C3
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 70d72ca40bc8f75911eda112aff2aac555232af05421d35c06c5afb1364c1f8f
MD5 773b339cbe1aa4fafcfd79a54f2b9985
SHA1 78a1a3c9998355a5fd98bbc7452402e39e6d1791
SHA512 d27ec63cb0e6f6312d828433d4b6d94fac32b9d89b9db09ccd11d10c1adba82fa3eab3cb94514e8772dcb2b99baf99b70ab53e311c556d00a43c7edb32e7108c
TLSH
T15261834610D69809EFE040BCE6ED10DC763EDB08C3372E171ADC593D4ADEB6E1198813
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58d1c2.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58d1c2.TMP
Size 3KB
SHA256 70e4dfcfdd6726047a1621d47156a6ce8360198df22feecf61c950ec824c53d8
MD5 6cfbf6a7e81c4bb5c7a47a04d0e817d4
SHA1 19db61662b52d9e120f40eeed15dc8ea52c2928a
SHA512 b94c027cc07c50375a761ed08b9675a70021b7954029756954d91e15ecf091882df1a84585fb8a11b438d0ae76124a2bba43e88a2fd318e5d013ed48fc5ce8ef
TLSH
T13661824621D69809EFE040BCE6EE10DC763EDB08C3372E171ADC593D9ADEB6E1198813
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\000003.log
Size 118KB
SHA256 e4488573f09889251463e2673339bc3c4ddcc584c279365338d7c4b23db0ffd3
MD5 3432504c969870e6fef04a37c1546da8
SHA1 94f4ef50c339130eea50077e7d8f21c0f2264196
SHA512 6127e900cb9d10e5122b3a797879f81d24af15204ba59b531dd36517561e1a0fb79d7ceccab3be000c86d30c2d0751d1af542960aee4d4fea96d6fcf2ef63deb
SSDEEP 3072:7C+LmNOSEnOUxTMlMg/R5f5wtKUsSYMsMAzy:9nj
TLSH
T111C3C85F61E43AEBC519817118224F954BFA2D0D6488709FE0C67E3DE9B7E932730E1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000005.ldb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\000005.ldb
Size 42KB
SHA256 4ff7ef9cc89e28f375ad5edbf1680ca2f02e6f367f0284eabe8ff966c13b5aa9
MD5 d365e46d8696395f72362c74d7ee13ee
SHA1 84686958ca8bc0e134f01c0ebc8473946b32899a
SHA512 7e420c82cb8a98e482c16b5dbfd0e513a5c77b0c4fd290cf7045228cc7539c855bd6a8dbf1e49f89156de8cdd1fc5a1edca55f54492156a11712b607627795ec
SSDEEP 768:7JdAuLwdnCYGYlstqXVOGGehhHHqY2QBoejqxOKdJJprUYD9R:ldXLwXl+21GSHiQBoHO2Jpj5R
TLSH
T1C213BEF39BECC482D47A477BC8FE02DE5FE4F90E2650A0983981335D4C26B9964D6E19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 399c7b88ff3169e58b7783aeff7ab7ed22a7b9be2ad1a137174bb3620ab395a2
MD5 1964966d04e3eef73abb0f09aa640ea2
SHA1 b9a8469b52a3081d30101ea1ca9415d8a7865d71
SHA512 80c8735c8f3d07b2fd3c174077ad44810e2f7e4200ce1b3758d5db359b0665ab1e05fa05284bfea7c8b3617250977b0400879818d4cc8ddd7bf6d0863c712e5e
SSDEEP 192:sxZ1tRTyM//K1Ml8McM/fms608x3IdpRuH/W6+WNrW1/Y0GB3O0Ig4J:sxZ1tr0M/fms60pW/bM/5qc
TLSH
T17752EA12AA345977CCCBD219FA55BF53D6F51573A2900D48AAFCCA0C05E6AED2213C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 730e33281edaabef695b19ae2dc9e35c2afba556092988b56caeca254cae48dd
MD5 f27b51b743213a1fd5fbd9ab360f3a9b
SHA1 1951719d983f3136a239dfa2c5f5ff0c7ca6c705
SHA512 d69f1a558566d8985eb2130136f73d265fc632e2463d560691ce8fec2cd68df765f8f8d661b7ff2a22d12f8baeedb5f21cc43266943014ff604a76159614e848
SSDEEP 192:sxZ1CRTyM//K1Ml8McM/fmshe8x1Idpz7TBpi/W6+WNrW1UUj/Bv0GWfO0Ig5bJ:sxZ1Cl0M/fmshe5K/bMj/eLf
TLSH
T10662E952AA345977CCCBD219F655FB57D7F50522A2900E48AAFCCA0C01E6BEE6213C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 b550c5da5bd9af2bc845abc95a137044d8cb6a9b1f1f5d5a75b1a00609865e5b
MD5 b5232852bc9a897ad17a90daf8adbcb1
SHA1 f00bd45be3e158095891c7d9c9f08e5880234054
SHA512 4004936d340dcc36e1e0cd36b054c1054eefd1e8dd49e52139955621d44cccb6900c290177104f09c30137eb7c3d2f89ad7f5c5c98d6ecc64b7a09a89fa3bc93
SSDEEP 192:sxZ1CRTyM//K1Ml8MgM/fmshe8x1Idpz7TBpi/W6+WNrW1UlCXBxne0GTfO0Ig5m:sxZ1Cl4M/fmshe5K/bM/XbqA
TLSH
T1C972D852AA34597B8DD7D219F651FB57D6F50523A2D00E48AAFCCA0C00E6BEE621381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 8d5fecff84140b01695ace35a9f865bdee950f82f978b071298f5d90f4749fb6
MD5 c1e4d5b5fbe9420c7149dd3261a13c4f
SHA1 7003abd82d0e90bebc08afe2f0f15b8fc9fe5fd5
SHA512 8525ddc3504e8e0f412d37a86e0e9472e47d4c025ed012d4edd337dc8a9a40a4e1584eab306c61413fa3e67f4a5e2b877ad969f7db893c1666dd659175f8f8d2
SSDEEP 768:Ux91L8/j2sf7pLuLnqeWRmqSQBq8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3kDzJLlr:Ux91L8/j2sZEnqeWRmqSQBqu1jaKkDzX
TLSH
T1D6030B3B6C0CCB7E4F804E9CEC26BF9E6DE8018BA698C95447FA444C03C66EB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\24af46bf-eab3-42c9-90e8-b765e8e76d30\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\8f2c7a5c-b79e-429a-9e0a-39c25c7469f3\index-dir\the-real-index
Size 2KB
SHA256 35a5a12538491caed6237a07716c9e042dc6d18ef0b7eae5c262ca20ea6ee5f9
MD5 20fedbfc316b8b4d7855fa60c8bf0765
SHA1 4603630fc5364b4852cf2d3a0bcc3f416b27821e
SHA512 9e6c5cc3ed7f44921cc68119e20f448407ec4ddfe6dd4d6c26f9e65b5b734b6ec1065dd7832629324d36827463f8a02745563fcf96b073ce28d82818b0229022
TLSH
T1E941B88DCDC0A7EDEC7552BB2D6821B553B41C34FC58C3929464B1B27403A58174B6FC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58e356.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\8f2c7a5c-b79e-429a-9e0a-39c25c7469f3\index-dir\the-real-index~RFe58e356.TMP
Size 48B
SHA256 8685465fd4e9a1b68be833e6c65a3f95961559fd01e36005ea878e522094711c
MD5 d2e79890799e09e34184289a9a5c2736
SHA1 1341c4264c96caabe79b8422ed35a823d8dda833
SHA512 dc69eca8fce94315175cf294a8dae64a21e1e413b29a6ea50d7bba4788c2b3bf605e50e5b245cfe136ae19daecbc5947aa31bc97b7ffbd4d2bb1ba375a39e0c0
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 221B
SHA256 e2632635302f39493f3d63882a80f68efb2b2a2237a27f71f1f43fd768eb7b56
MD5 8501899a5b54752f36c9f3c103f2da7a
SHA1 49fe9e963a3614df1ab8a5c8a62b68216dda444d
SHA512 5b7ae9065abdedfc4f039c320e3fa38086f4f9b76041a8d92dad6d82bd8423bcb9e065c4d6b7ed1e4011cbe21aed591f2dceb93a7bfb7973911711ae04a50191
TLSH
T122D022EB61724D4627306EC5623C2A9DA42A8C1BDCC8CCE0968AB24B3078A03D408434
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 130B
SHA256 8400ad4ca0b849bcaec009c31834e48732346ba2618e9151953e262803a8d12a
MD5 647c8967834ac76cefbe24e975406afb
SHA1 c8984219119e660970cd46f3d96e2facc29f2463
SHA512 72466d3f2e2b06b79e5d2a16bc898981637e4a2f9a11405fee41f35d614d04019c3e2bc79e295ae32ab6b71ea15624f6f7eb88324668e42d5fb42a650ff7fdd7
TLSH
T105C09BF654108A4A17749FC4217C775DD51F8559DCD4CCF4A09851477435D134401575
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 56B
SHA256 c58cb79fa4a9ade48ed821dd9f98957b0adfda7c2d267e3d07951c2d371aa968
MD5 94275bde03760c160b707ba8806ef545
SHA1 aad8d87b0796de7baca00ab000b2b12a26427859
SHA512 2aabd49bc9f0ed3a5c690773f48a92dbbbd60264090a0db2fe0f166f8c20c767a74d1e1d7cc6a46c34cfbd1587ddb565e791d494cd0d2ca375ab8cc11cd8f930
TLSH
T1069002F74800819A0E20A9C82038A35DE40F818CD8C0CCF0900890423028A234002851
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 130B
SHA256 81dae2ee71959a7431c7cbc7c88f9361f52600591eb5aa270ec154879432930a
MD5 10a9577d0ad1c9d794533c63178b0b6b
SHA1 71b6854af3c9069571a59b1c8a2ffea789384435
SHA512 d4000850b86dfb80bc6a07cb14c1d622eb703f9a7b60726a3340f3d19bc73391869b6b278a5ad12b173cb08d3673fec8ae71f715acd66feb302f4bed1ff9f60e
TLSH
T153C09BD35564864F09B1ABCA10795B1DD50FC158D8C4CDE4644C50C53178527C512929
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 140B
SHA256 144f82db72c9a4ca5032d627d13056f6c5fa5fa9d5e54a4f60357a8d206e725d
MD5 75965fb06e4ec300ccc9f4a757384e43
SHA1 4160094dd3be35e2bdd21ee2e5df4d903e166df0
SHA512 a1b7ba0e398624e4fbd4f1276f5992087749240f52c4802a42c8fed267f6c13f025034cb0157ef72131df97bd012c588388e8f52bbc7f256e59e4104140aab36
TLSH
T12EC09BE7567551551760ADD59438714C9D3FDC5BD9C0CCF4C415F4C17078752C005D72
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 221B
SHA256 37d45b4e10a54a9f80258f27eff46500532f30ce1d86d29a0a4015f00ce9f73f
MD5 1d7847d14fec8ae4c22a3d6a15ff8671
SHA1 fab758317b3814f01ff90d593e3e6865aa5dce22
SHA512 03c16f0c27d4372d60e39c892b30b3f45e4d23f37e64f0addf17ce3b2df1a8064ee133cbbe83fcc3e8cd323efd273a14a2144ae691fa304693659cfdc11e7ad5
TLSH
T1DFD0A9D352B4091603B16A829038264C583ACC26D980CCE4D009B0C170B8723C609E3A
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe58d6c3.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt~RFe58d6c3.TMP
Size 137B
SHA256 3a6a8deee0a7fbeece24d0aa1ea8e1c90b40dd4affd335396c571af26b0ed07e
MD5 19214c7c963bea3b6c1bfee131556e90
SHA1 da3e1c1cc683f5755f1afdbd6f2d5e38eeee1385
SHA512 8179a6f9178cdf52d3a11afbf0fb4d3030768a0da84b8a93cee53dd8be582f0c4ee82863be8932e62f47ea31e6da1a9a732b50ef1e052d0e253cd59c6aea9c11
TLSH
T150C09BF754104A4617705EC4617C775DD52F8C59DCC4CCF4E19D71477035D138401565
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 130541f493f4f3f89c1b8c573b8b52ba032c1424d0835eea987d5d1ba26c28c9
MD5 5d9e25aeba6da3d46c1546078d88c0ec
SHA1 504f5359d96725657590f390a620bb90b8a22f6a
SHA512 ae75c3ac401c01eab0faf416b8c7980ae31438f55fce8e9ae88adae465b915d426f4af8d48d7cf70ba61d9360746c1a6b4c501e27f63b43ec8e81b7ec955bb10
SSDEEP 24:KsL+XYIPNsoIx1kB7sIqsxKnOhPax1pihSzThWxISyXbUbEs6I1K4hQ1uSdaFyJf:KAHIpK448fyVlI1KuQI6jINK48wXy5
TLSH
T1B9918491B17B22413ABE244DC1E0B96B56C230A33468E57B7BFC51614F27E648CFE5C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 7a763ce872a53bd10ee2c5ec9cf8907d6b480c87f3548c87aa3d7445dfa0c6e6
MD5 ad14e35abd109d92e0b263f0f42c4bef
SHA1 b9a475181c19c05c4be306f6abb98df6d824a4d3
SHA512 95db991c63b084f4c4c383ed0fc1e246a24ecd3916d27ee072468a50c2c2723ffed0ca44b3fbd7460892304262c8818dc9add2b2a0ae20ee597ee2aa6f5b0671
SSDEEP 384:nTcXqnE8NTT03Dt3R2WJX5Q/5+uOi1Vq6qdnx53bCysW6k:rEd2ww4uOi/q6qdnrLCtk
TLSH
T170827C71AC799C375DEB5249F00B32935FF420B7E6981F84E6D88B0C00DA79D270AD2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 48700f9d6a650b638782863da6da19b3d1b778d18abfb339cff70bf68f3bd046
MD5 ba17d97edd47c71894f5ccff10132df6
SHA1 baed414eb81df0c1f7009f2f92fdf6722d49b764
SHA512 257d5600979192db3fa2346aaf8d348d640fb5860ffe0a5c0ae6cf756210499d790693acc4cc15da669615e3bcb62f3fd4e484e1bc5b5512780ce515f38341d4
SSDEEP 384:nQcXqn08NTT03Dd3R2WJX5Q/5+uOi1Vq6odnx53bCysW6k:S0B2ww4uOi/q6odnrLCtk
TLSH
T1AA827C71AC799C335DEB5249F04B32935FF420B7E6881F84E6D88B0C00DA79D270AD2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 fa399d36f37d7a3ca7d15930199250550d8047a280e79638961e3e15f4e6f449
MD5 c74ab9782779fa6c26704e49d750225f
SHA1 922eaaaeebb5a315139501a5ce1cbcbfca258d87
SHA512 60acc3e5893e1cd2fb9cc24a6ae56c3f2d80c6def4b7ec308cebea3de58090c01dedb5f7118c15a6c014fd443c5accb26421d00b09cabb23fd97e61d53ea3651
SSDEEP 384:ngcXqn08NTs03Dv3A2X2JX5Q/5+uOi1Vq6odnx53bCysW6k:C0/2XQw4uOi/q6odnrLCtk
TLSH
T145827C71AC799C275DEB5249F04B32935FF420B7E6881F84E6E88B0C00D679D270AD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 08c11d869e1cea90511986c4aac7e6ad197ca91798782df5a05ff7f76a34f2c6
MD5 edd52d882c11083d1531c11fe6ae281a
SHA1 922eb0bea64badff0f26ba2d5405bc2d7e3b7cec
SHA512 67894e2bea801db0442c61e93e5a6f3887b442cb1ee95f365fc62c4d69128da634085e117884e27bee18ca5fb7bfa24232108e37ab7abcf59f4c57d116567a9c
SSDEEP 192:ZGN66hNQmiUymGhjNYX5Hw/5+uOia0VVWYdOCU6:ZGN66R1GZNYX5Q/5+uOi1V9d9U6
TLSH
T1B002D638BD686C779EF2AE49B58737179FE5112BE6956F84D6E81F1C008725C2306C23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 b0e5378767a3fb4f4d9fe14e41452acb945f87fa8dff2881cb8e3fccb06fca80
MD5 140b72d1ca600dbfbc0ef3e9e804245a
SHA1 ac85ab72a474965a6cb81768acf5c62c129e6b85
SHA512 483b31d4786aa6da4b84bab16ea0c8cbcc4f32de0c7b08bfc9369ba63530cea5ccf402e19e66e02614a88fcab3b342a8074769174912ab09c1051627cd55bff2
SSDEEP 192:2GNm6hGQmiUyCljCYX5Hw/5+uOia0VqiPoqLdBqjWU6:2GNm6AnlCYX5Q/5+uOi1Vq6VdnU6
TLSH
T18B120835B868DC371DE6A558F58732839FF5207BEA85AF84E1E80F0C008635D270AD23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 e9d94c614f33e6aed7d543c82026778d1b4b4b30b9adf8b94741151618f8ebe7
MD5 f79afb97d4d9a6e7b1140097e8ae568f
SHA1 ba168892cc4f115dcc87ba21612579a7b9bed37b
SHA512 5a6a2107b4da37bebcb5dfb2532dc281f8800cba4b4bd4fd9b3df6404f5487f00c8152636e0d9c6b54ed250bdb126c56823bd08d7da7de97e2c31d0acadf7715
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter~RFe590640.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe590640.TMP
Size 392B
SHA256 c31255ad3aabc9d79d5a2872cc54f05f99d3396ee2c876d1b0f1122b656da87a
MD5 3a57becb6f2f34fdef85ee011cf86df5
SHA1 251e7265a990eaf9b3c4cfcd9371f083a9537df9
SHA512 25f212be2572936a2a0aa68c049fa89f70cd7cb76f08ad41acbd8902126d0d3ed46b9397c159c1ac20b906a2c11c0ae7101b9180e711e8f2c2bcc75ac9cec7e3
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 1081c6b484e3ce0572ea539029bc598ee7870cf099c5585bd52fbeee220c56b7
MD5 8117d1162c008cf731fe668d81f95ac0
SHA1 1fdce919b160546d65f946726794b3331de06938
SHA512 711cc338d15b6b36cad3e8ca1a57b0595991f060d24f39faa2b24a2c4ca08c07c82497ed8b1bfbc998452778d75fb24558d72062ef5ee6848d99e35068c5f188
TLSH
T11B117A33B79CC135C8D9157A1089AD01B2B4C3C7049EDE8B7A84C509E57F58ADB645E4
MD5 SHA1 SHA512 TLSH

Submit Download

5c233137-a57f-46a9-bda7-0e6bf88f9566.tmp

Path C:\Users\Admin\AppData\Local\Temp\5c233137-a57f-46a9-bda7-0e6bf88f9566.tmp
Size 147KB
SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
MD5 9c670f04d98ab7404f16423f6ee6cdfa
SHA1 8d01079b2d065731df8a7ef52f447cd4b7add353
SHA512 102cee76d9dfcfe91e044f529672fbec042b50c5db55a3cc137197b2013dd7f81e47f50dbb0db96cb621c5732610e1eb553c4146837c11075c7c4dbd67546a3b
SSDEEP 3072:F7R0M+jCozOtDTsjMcT0JnFjkbxnEbm/+OdGmlVVklFHEpCm+:F7WxxzyDTM0JnRkb5bJdGmJkvkpx+
TLSH
T12DE3E16D3DE6DE1FC41B58F53E64708BC80E8F0B820A644FB64988345A60B5D1BD6AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_pr3pgmmn.khk.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_pr3pgmmn.khk.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

c257923a-db31-4e3e-af7b-1e31b47ad5f6.tmp

Path C:\Users\Admin\AppData\Local\Temp\c257923a-db31-4e3e-af7b-1e31b47ad5f6.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

e126edd9-e2eb-49cf-ab9a-60dd2e380021.tmp

Path C:\Users\Admin\AppData\Local\Temp\e126edd9-e2eb-49cf-ab9a-60dd2e380021.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

friend20672.txt

Path C:\Users\Admin\AppData\Local\Temp\friend20672.txt
Size 11B
SHA256 42ba0b66285ef6d43fc97b62fddd2593ec536be78f0d3a731ad77489c6857cd5
MD5 66faeefea7e590b7e4dbd724408684de
SHA1 f3623d039f8ab8100e14ab4033701158c7b8203d
SHA512 89f4cb9ec85cc570493e9a9fd6450e0806f18755b7aa21aea6d90a85114c52ebbe33bacfe901dda6edd23c3f0d009525eecc5922f05025c60590a075a4a8ce57
MD5 SHA1 SHA512

Submit Download

game.txt

Path C:\Users\Admin\AppData\Local\Temp\game.txt
Size 32B
SHA256 c02fe1f466b64e61ff2b95b63cb05fd3c37d7313aac896157719ef8bd323107d
MD5 7307653a4e1d7a781f5d1ccda4131e14
SHA1 c4d07d4272d80db55dc8a39e38a3ee75cd7a71e9
SHA512 975cb55093972cff6417a36efeae644a0d110a6b238e4add913405be5e179f0f3371a4f8763fb75272381a7ef5002fd66c80718e3cb15d58d241e698b8378acd
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4416_644876904\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Flash.ps1

Path C:\Users\Admin\Desktop\Flash.ps1
Size 5KB
SHA256 a64e5a4b00fe8576b1be468f1896b3f7ed5a01e1f2053338ea2a88a6fe8ecf67
MD5 0784c5ffd71e9a8c32095eaf70406c8a
SHA1 335bcd41142616756101a4d8e2a6e40df24f81e5
SHA512 1ced0cc96d5d1df4272a543f992f96b95f45e333feb0fd964605dabdc642d7281aee1fa82655425ae50bf303104d919ef8cf17d58a50d503d7195d282897d606
SSDEEP 96:4TQU7YY8n3hpKtwN55aQ+HKDNYreER5YK+2Fr0WPGl/ayqI4KRBkPDfg:zUcYsh6wN5Mn8YSERGLeg4u/ayqKMrfg
TLSH
T13EC16726B70E89A5C3F28A5BC867F48DEE150073705ADC4CB6CFA590DF34516936C68D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Start Flash.bat

Path C:\Users\Admin\Desktop\Start Flash.bat
Size 107B
SHA256 c6e8e4ef0c46ef1c147c9c4736e0ec4f5f3721cc95f007d54127e762fddb5911
MD5 1a6277c68692a9c758464a16f5bd5e04
SHA1 eba7abceb6c8b5cf352c2b7d3f9db791363fac4d
SHA512 b7155e3423cab16aaca1105372e4e5ca4ee95d1463fbc5c8c272d7fbc5a8b155376dbb9cad5e0cfc54d8ffc4bc4de42fe18656fbeff4fe43185e19e38d0d5961
TLSH
T166B09B4755145B485652882781E65554497D280157105601656285217441265C18E545
MD5 SHA1 SHA512 TLSH

Submit Download

yfjkqpze.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\yfjkqpze\yfjkqpze.0.cs
Size 217B
SHA256 a85d20b9b5eb6ea9bc7b25f4347a27758fef96c1bafbfaa5fa26bdb15aa7a179
MD5 1d635463886abf502bcd7ebc13d7831c
SHA1 3a7c988adc664b83728935e5d5930af3713463dc
SHA512 8a45b58e2b0726fcbf6773fdec5392493f0ef5d037ae741829c11eedb00ffd978d2670969488213477de042eb677915f713d3564a0ca7254639283a40333435e
TLSH
T162D0A71975B36AA540034C220C57F1FD76134126265A2609AAA50310DF8B00D8131E19
MD5 SHA1 SHA512 TLSH

Submit Download

yfjkqpze.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\yfjkqpze\yfjkqpze.cmdline
Size 369B
SHA256 4bfbc531d4b8cd4753e970e31aa50e83151daf318b2f0f32049b59023ca51f2e
MD5 b60d30aaddcc763a010aa502c62ec776
SHA1 020045979e396aa8ee17e49b5a66622667c7e6ca
SHA512 b71646458fd80ec30d6d183a6a01070ba4356e305e10d2d1c9a0d451015dbda4c0ad86a9c517cf6ffc2499671877426f954f13f8bf2a9fe458d5e86faf61a797
TLSH
T147E0C07A4246C27E01DD600721EDE4ACEB764B432D453F84B559440FF09B00027E1785
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2368-34-0x0000024EF9A80000-0x0000024EF9A8C000-memory.dmp

Download

memory/3688-27-0x000001B9E8AD0000-0x000001B9E8AE0000-memory.dmp

Download

memory/3688-19-0x000001B9E8AD0000-0x000001B9E8AE0000-memory.dmp

Download

memory/3688-39-0x000001B9EA340000-0x000001B9EA352000-memory.dmp

Download

memory/3688-37-0x000001B9E8AD0000-0x000001B9E8AE0000-memory.dmp

Download

memory/3688-38-0x000001B9E8AF0000-0x000001B9E8AFC000-memory.dmp

Download

memory/3688-40-0x000001B9E8AD0000-0x000001B9E8AE0000-memory.dmp

Download

memory/3688-18-0x000001B9E8AD0000-0x000001B9E8AE0000-memory.dmp

Download

memory/3688-36-0x000001B9E8AD0000-0x000001B9E8AE0000-memory.dmp

Download

memory/3824-0-0x000001D5EA7D0000-0x000001D5EA7E0000-memory.dmp

Download

memory/3824-15-0x000001D5EA7A0000-0x000001D5EA7B2000-memory.dmp

Download

memory/3824-14-0x000001D5E8900000-0x000001D5E890C000-memory.dmp

Download

memory/3824-9-0x000001D5EA7D0000-0x000001D5EA7E0000-memory.dmp

Download

memory/3824-8-0x000001D5EA820000-0x000001D5EA842000-memory.dmp

Download

memory/3824-1-0x000001D5EA7D0000-0x000001D5EA7E0000-memory.dmp

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads