6fe3e2b89204368a78e8920afa3420ce70a75052fd54784097f30faaeddf75a3

Resubmissions

07/05/2026, 03:57

260507-eje94sew8110

07/05/2026, 03:54

260507-ef76qaew4z7

07/05/2026, 03:52

260507-efjs5aax6q4

06/05/2026, 22:56

260506-2w1sxafx5q7

Analysis

user interaction
yes
max time kernel
118s
max time network
124s
platform
windows11-21h2_x64
resource
win11-20250502-en
resource tags

arch:x64arch:x86image:win11-20250502-enlocale:en-usos:windows11-21h2-x64system
submitted
07/05/2026, 03:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Lock.Julie.exe
Size 5.9MB
Sample260507-ef76qaew4z
SHA256 6fe3e2b89204368a78e8920afa3420ce70a75052fd54784097f30faaeddf75a3
MD5 e2ac9e24dce3e923bfe2526f7e4681b7
SHA1 d1d3aa5b10d95f31b3191e8cbd23913e185ae5cd
SHA512 4470eae0e48b7c76972b0052397bd6bb6af1a6428b982bd341d82351370f7b592ea2b8d56b46e245c231d86c60ea79e2cc9cb124ac1bbf57f7243672efd149bd
SSDEEP 49152:k7Ne2hvV5WFgXbVDQHf2lKzqioZYUBxbOaZvf/ud+GMnW3ycatyWtJ5NMofZ/9GZ:
TLSH
T19B5633106F9E7CB5CB58817830AF1E6E1E700F894448E4D727CD69DB678FB409A1F8A6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery persistence ransomware

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4356	SyncService.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-330179853-1108322181-418488014-1000\Software\Microsoft\Windows\CurrentVersion\Run\DeviceSyncService = "\"C:\\ProgramData\\Microsoft\\DeviceSync\\SyncService.exe\""	SyncService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\DeviceSyncService = "\"C:\\ProgramData\\Microsoft\\DeviceSync\\SyncService.exe\""	Lock.Julie.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330179853-1108322181-418488014-1000\Software\Microsoft\Windows\CurrentVersion\Run\DeviceSyncService = "\"C:\\ProgramData\\Microsoft\\DeviceSync\\SyncService.exe\""	Lock.Julie.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\DeviceSyncService = "\"C:\\ProgramData\\Microsoft\\DeviceSync\\SyncService.exe\""	SyncService.exe

Sets desktop wallpaper using registry 2 TTPs 2 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-330179853-1108322181-418488014-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\Microsoft\\DeviceSync\\bg.dat"	Lock.Julie.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330179853-1108322181-418488014-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\Microsoft\\DeviceSync\\bg.dat"	SyncService.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3288_616353993\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3288_616353993\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3288_616353993\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3288_616353993\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3288_616353993\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3288_616353993\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3288_616353993\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3288_616353993\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3288_616353993\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3288_616353993\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3288_1510481269\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3288_616353993\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3288_616353993\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3288_616353993\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3288_616353993\_locales\zh_TW\messages.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3288_616353993\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3288_616353993\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3288_616353993\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3288_4879393\sets.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3288_616353993\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3288_616353993\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3288_616353993\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3288_616353993\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3288_616353993\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3288_616353993\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3288_1510481269\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3288_616353993\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3288_616353993\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3288_616353993\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3288_616353993\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3288_616353993\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3288_616353993\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3288_616353993\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_3288_1817726508\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_104_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3288_616353993\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3288_616353993\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3288_616353993\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3288_616353993\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3288_616353993\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3288_616353993\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3288_616353993\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3288_616353993\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3288_616353993\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3288_616353993\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3288_616353993\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3288_616353993\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3288_616353993\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3288_616353993\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3288_616353993\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3288_616353993\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3288_616353993\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3288_616353993\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3288_616353993\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3288_616353993\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3288_616353993\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3288_4879393\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3288_616353993\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3288_616353993\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3288_616353993\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3288_616353993\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3288_616353993\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3288_616353993\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3288_616353993\dasherSettingSchema.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Control Panel 4 IoCs

defense_evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-330179853-1108322181-418488014-1000\Control Panel\Desktop\TileWallpaper = "0"	Lock.Julie.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330179853-1108322181-418488014-1000\Control Panel\Desktop\WallpaperStyle = "3"	SyncService.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330179853-1108322181-418488014-1000\Control Panel\Desktop\TileWallpaper = "0"	SyncService.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330179853-1108322181-418488014-1000\Control Panel\Desktop\WallpaperStyle = "3"	Lock.Julie.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134225996801266311"	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-330179853-1108322181-418488014-1000\{BAB52753-380C-4C62-BE03-2B963310E8AD}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4280	Lock.Julie.exe
4356	SyncService.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4280	Lock.Julie.exe
Token: SeIncreaseQuotaPrivilege	4280	Lock.Julie.exe
Token: SeSecurityPrivilege	4280	Lock.Julie.exe
Token: SeTakeOwnershipPrivilege	4280	Lock.Julie.exe
Token: SeLoadDriverPrivilege	4280	Lock.Julie.exe
Token: SeSystemProfilePrivilege	4280	Lock.Julie.exe
Token: SeSystemtimePrivilege	4280	Lock.Julie.exe
Token: SeProfSingleProcessPrivilege	4280	Lock.Julie.exe
Token: SeIncBasePriorityPrivilege	4280	Lock.Julie.exe
Token: SeCreatePagefilePrivilege	4280	Lock.Julie.exe
Token: SeBackupPrivilege	4280	Lock.Julie.exe
Token: SeRestorePrivilege	4280	Lock.Julie.exe
Token: SeShutdownPrivilege	4280	Lock.Julie.exe
Token: SeDebugPrivilege	4280	Lock.Julie.exe
Token: SeSystemEnvironmentPrivilege	4280	Lock.Julie.exe
Token: SeRemoteShutdownPrivilege	4280	Lock.Julie.exe
Token: SeUndockPrivilege	4280	Lock.Julie.exe
Token: SeManageVolumePrivilege	4280	Lock.Julie.exe
Token: 33	4280	Lock.Julie.exe
Token: 34	4280	Lock.Julie.exe
Token: 35	4280	Lock.Julie.exe
Token: 36	4280	Lock.Julie.exe
Token: SeIncreaseQuotaPrivilege	4280	Lock.Julie.exe
Token: SeSecurityPrivilege	4280	Lock.Julie.exe
Token: SeTakeOwnershipPrivilege	4280	Lock.Julie.exe
Token: SeLoadDriverPrivilege	4280	Lock.Julie.exe
Token: SeSystemProfilePrivilege	4280	Lock.Julie.exe
Token: SeSystemtimePrivilege	4280	Lock.Julie.exe
Token: SeProfSingleProcessPrivilege	4280	Lock.Julie.exe
Token: SeIncBasePriorityPrivilege	4280	Lock.Julie.exe
Token: SeCreatePagefilePrivilege	4280	Lock.Julie.exe
Token: SeBackupPrivilege	4280	Lock.Julie.exe
Token: SeRestorePrivilege	4280	Lock.Julie.exe
Token: SeShutdownPrivilege	4280	Lock.Julie.exe
Token: SeDebugPrivilege	4280	Lock.Julie.exe
Token: SeSystemEnvironmentPrivilege	4280	Lock.Julie.exe
Token: SeRemoteShutdownPrivilege	4280	Lock.Julie.exe
Token: SeUndockPrivilege	4280	Lock.Julie.exe
Token: SeManageVolumePrivilege	4280	Lock.Julie.exe
Token: 33	4280	Lock.Julie.exe
Token: 34	4280	Lock.Julie.exe
Token: 35	4280	Lock.Julie.exe
Token: 36	4280	Lock.Julie.exe
Token: SeIncreaseQuotaPrivilege	4280	Lock.Julie.exe
Token: SeSecurityPrivilege	4280	Lock.Julie.exe
Token: SeTakeOwnershipPrivilege	4280	Lock.Julie.exe
Token: SeLoadDriverPrivilege	4280	Lock.Julie.exe
Token: SeSystemProfilePrivilege	4280	Lock.Julie.exe
Token: SeSystemtimePrivilege	4280	Lock.Julie.exe
Token: SeProfSingleProcessPrivilege	4280	Lock.Julie.exe
Token: SeIncBasePriorityPrivilege	4280	Lock.Julie.exe
Token: SeCreatePagefilePrivilege	4280	Lock.Julie.exe
Token: SeBackupPrivilege	4280	Lock.Julie.exe
Token: SeRestorePrivilege	4280	Lock.Julie.exe
Token: SeShutdownPrivilege	4280	Lock.Julie.exe
Token: SeDebugPrivilege	4280	Lock.Julie.exe
Token: SeSystemEnvironmentPrivilege	4280	Lock.Julie.exe
Token: SeRemoteShutdownPrivilege	4280	Lock.Julie.exe
Token: SeUndockPrivilege	4280	Lock.Julie.exe
Token: SeManageVolumePrivilege	4280	Lock.Julie.exe
Token: 33	4280	Lock.Julie.exe
Token: 34	4280	Lock.Julie.exe
Token: 35	4280	Lock.Julie.exe
Token: 36	4280	Lock.Julie.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3288	msedge.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 4280 wrote to memory of 4536	4280	Lock.Julie.exe	78
PID 4536 wrote to memory of 4108	4536	csc.exe	80
PID 4356 wrote to memory of 564	4356	SyncService.exe	84
PID 564 wrote to memory of 2960	564	csc.exe	86
PID 4280 wrote to memory of 3288	4280	Lock.Julie.exe	87
PID 3288 wrote to memory of 8	3288	msedge.exe	88
PID 3288 wrote to memory of 1072	3288	msedge.exe	90
PID 3288 wrote to memory of 5240	3288	msedge.exe	91
PID 3288 wrote to memory of 5056	3288	msedge.exe	92
PID 3288 wrote to memory of 5240	3288	msedge.exe	91
PID 3288 wrote to memory of 5240	3288	msedge.exe	91
PID 3288 wrote to memory of 5056	3288	msedge.exe	92
PID 3288 wrote to memory of 5880	3288	msedge.exe	94
PID 3288 wrote to memory of 5880	3288	msedge.exe	94
PID 3288 wrote to memory of 3444	3288	msedge.exe	95
PID 3288 wrote to memory of 5880	3288	msedge.exe	94
PID 3288 wrote to memory of 3444	3288	msedge.exe	95
PID 3288 wrote to memory of 3444	3288	msedge.exe	95
PID 3288 wrote to memory of 4548	3288	msedge.exe	96
PID 3288 wrote to memory of 3696	3288	msedge.exe	97
PID 3288 wrote to memory of 4548	3288	msedge.exe	96
PID 3288 wrote to memory of 3696	3288	msedge.exe	97
PID 3288 wrote to memory of 3100	3288	msedge.exe	99
PID 3288 wrote to memory of 5256	3288	msedge.exe	100
PID 5256 wrote to memory of 1004	5256	msedge.exe	101
PID 3288 wrote to memory of 2920	3288	msedge.exe	102
PID 3288 wrote to memory of 2920	3288	msedge.exe	102
PID 3288 wrote to memory of 4796	3288	msedge.exe	105
PID 3288 wrote to memory of 4796	3288	msedge.exe	105
PID 3288 wrote to memory of 3956	3288	msedge.exe	106
PID 3288 wrote to memory of 3956	3288	msedge.exe	106
PID 3288 wrote to memory of 1004	3288	msedge.exe	107
PID 3288 wrote to memory of 5928	3288	msedge.exe	108
PID 3288 wrote to memory of 3808	3288	msedge.exe	109
PID 3288 wrote to memory of 5660	3288	msedge.exe	110
PID 3288 wrote to memory of 5660	3288	msedge.exe	110
PID 3288 wrote to memory of 4404	3288	msedge.exe	113
PID 3288 wrote to memory of 4404	3288	msedge.exe	113
PID 3288 wrote to memory of 5612	3288	msedge.exe	114
PID 3288 wrote to memory of 5612	3288	msedge.exe	114

System policy modification 1 TTPs 26 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer	SyncService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\SettingsPageVisibility = "hide:personalization-background"	SyncService.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop\NoChangingWallPaper = "1"	Lock.Julie.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\UIPI	Lock.Julie.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\WallpaperStyle = "3"	Lock.Julie.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop	SyncService.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop\NoChangingWallPaper = "1"	SyncService.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit	SyncService.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System	SyncService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Wallpaper = "C:\\ProgramData\\Microsoft\\DeviceSync\\bg.dat"	SyncService.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop	Lock.Julie.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer	Lock.Julie.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	SyncService.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	SyncService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\SettingsPageVisibility = "hide:personalization-background"	Lock.Julie.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit	Lock.Julie.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\UIPI\Clipboard	Lock.Julie.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	Lock.Julie.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\TileWallpaper = "0"	Lock.Julie.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	Lock.Julie.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\WallpaperStyle = "3"	SyncService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\TileWallpaper = "0"	SyncService.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop	Lock.Julie.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\UIPI\Clipboard\ExceptionFormats	Lock.Julie.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Wallpaper = "C:\\ProgramData\\Microsoft\\DeviceSync\\bg.dat"	Lock.Julie.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop	SyncService.exe

C:\Users\Admin\AppData\Local\Temp\Lock.Julie.exe
"C:\Users\Admin\AppData\Local\Temp\Lock.Julie.exe"
1⤵
- Adds Run key to start application
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4280
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\xxabmvej\xxabmvej.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4536
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5FF2.tmp" "c:\Users\Admin\AppData\Local\Temp\xxabmvej\CSC14CF015567D643EB88A7F65193A27.TMP"
    3⤵
    PID:4108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://julie.click/
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3288
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x2e4,0x2e8,0x2ec,0x2e0,0x36c,0x7ffe0aaff208,0x7ffe0aaff214,0x7ffe0aaff220
    3⤵
    PID:8
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1868,i,14838606939612005547,11449213893361576273,262144 --variations-seed-version --mojo-platform-channel-handle=2596 /prefetch:11
    3⤵
    PID:1072
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2560,i,14838606939612005547,11449213893361576273,262144 --variations-seed-version --mojo-platform-channel-handle=2456 /prefetch:2
    3⤵
    PID:5240
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2216,i,14838606939612005547,11449213893361576273,262144 --variations-seed-version --mojo-platform-channel-handle=2600 /prefetch:13
    3⤵
    PID:5056
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3432,i,14838606939612005547,11449213893361576273,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
    3⤵
    PID:5880
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3440,i,14838606939612005547,11449213893361576273,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
    3⤵
    PID:3444
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --string-annotations --always-read-main-dll --field-trial-handle=4784,i,14838606939612005547,11449213893361576273,262144 --variations-seed-version --mojo-platform-channel-handle=4840 /prefetch:14
    3⤵
    PID:4548
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --string-annotations --always-read-main-dll --field-trial-handle=4792,i,14838606939612005547,11449213893361576273,262144 --variations-seed-version --mojo-platform-channel-handle=4860 /prefetch:14
    3⤵
    PID:3696
- - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=5472,i,14838606939612005547,11449213893361576273,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:14
    3⤵
    PID:5480
- - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=5472,i,14838606939612005547,11449213893361576273,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:14
    3⤵
    PID:3100
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=5576,i,14838606939612005547,11449213893361576273,262144 --variations-seed-version --mojo-platform-channel-handle=5596 /prefetch:14
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5256
  - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\cookie_exporter.exe
      cookie_exporter.exe --cookie-json=1132
      4⤵
      PID:1004
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --string-annotations --always-read-main-dll --field-trial-handle=5704,i,14838606939612005547,11449213893361576273,262144 --variations-seed-version --mojo-platform-channel-handle=5708 /prefetch:14
    3⤵
    PID:2920
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=6012,i,14838606939612005547,11449213893361576273,262144 --variations-seed-version --mojo-platform-channel-handle=5980 /prefetch:14
    3⤵
    PID:4796
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --string-annotations --always-read-main-dll --field-trial-handle=6104,i,14838606939612005547,11449213893361576273,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:14
    3⤵
    PID:3956
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --string-annotations --always-read-main-dll --field-trial-handle=732,i,14838606939612005547,11449213893361576273,262144 --variations-seed-version --mojo-platform-channel-handle=6300 /prefetch:14
    3⤵
    PID:1004
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --string-annotations --always-read-main-dll --field-trial-handle=5508,i,14838606939612005547,11449213893361576273,262144 --variations-seed-version --mojo-platform-channel-handle=6348 /prefetch:14
    3⤵
    PID:5928
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --string-annotations --always-read-main-dll --field-trial-handle=5724,i,14838606939612005547,11449213893361576273,262144 --variations-seed-version --mojo-platform-channel-handle=6368 /prefetch:14
    3⤵
    PID:3808
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --string-annotations --always-read-main-dll --field-trial-handle=4980,i,14838606939612005547,11449213893361576273,262144 --variations-seed-version --mojo-platform-channel-handle=1964 /prefetch:14
    3⤵
    PID:5660
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=5616,i,14838606939612005547,11449213893361576273,262144 --variations-seed-version --mojo-platform-channel-handle=5736 /prefetch:14
    3⤵
    PID:4404
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=5512,i,14838606939612005547,11449213893361576273,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:14
    3⤵
    PID:5612

C:\ProgramData\Microsoft\DeviceSync\SyncService.exe
"C:\ProgramData\Microsoft\DeviceSync\SyncService.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4356
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\tuysusy4\tuysusy4.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:564
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7E58.tmp" "c:\Users\Admin\AppData\Local\Temp\tuysusy4\CSCE65D4C104A404E608D52132035BA57B.TMP"
    3⤵
    PID:2960

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:3740

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5768

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

.dscfg

Path C:\ProgramData\Microsoft\DeviceSync\.dscfg
Size 123B
SHA256 5dde9bcaf239c71a24b30aca08f8f6235a4d148b0aafa07c525d71eea560810e
MD5 2881b9156fcc2677417c9f65e5994cd6
SHA1 fb9639ec8f61c3b0c6eae2fc4eab52a3b9ffec88
SHA512 c03ff2a0d98af3288d89121fda9dc8aab84e462a4da339c0485bf9d8a3804f477f6d07e8441494e3c0335fd0e0c46d194743e8aa37504f325a4f9e4e77c1ca19
TLSH
T1BDB09B1185558920367515C1C30659505C81533759546551B7FD5F6817395311415E51
MD5 SHA1 SHA512 TLSH

Submit Download

SyncService.exe

Path C:\ProgramData\Microsoft\DeviceSync\SyncService.exe
Size 5.9MB
SHA256 6fe3e2b89204368a78e8920afa3420ce70a75052fd54784097f30faaeddf75a3
MD5 e2ac9e24dce3e923bfe2526f7e4681b7
SHA1 d1d3aa5b10d95f31b3191e8cbd23913e185ae5cd
SHA512 4470eae0e48b7c76972b0052397bd6bb6af1a6428b982bd341d82351370f7b592ea2b8d56b46e245c231d86c60ea79e2cc9cb124ac1bbf57f7243672efd149bd
SSDEEP 49152:k7Ne2hvV5WFgXbVDQHf2lKzqioZYUBxbOaZvf/ud+GMnW3ycatyWtJ5NMofZ/9GZ:
TLSH
T19B5633106F9E7CB5CB58817830AF1E6E1E700F894448E4D727CD69DB678FB409A1F8A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bg_extracted.jpg

Path C:\ProgramData\Microsoft\DeviceSync\bg_extracted.jpg
Size 4.4MB
SHA256 8d547744b4ab2c3189a566753ec1f19470d1367936e11a941d5addc9ca5e7b92
MD5 e5e7a24e300db549a35a5f3d734544a3
SHA1 2b0617e8126fab1c5f136248524283c98d6f6897
SHA512 defa97ade3dc9fc4a0f1d44c8bbaa3ef2c2b664f9554f5dd8a81a0375781fc7ef48b637fdc1939759d1b1da934c43f8d8efc1696ebf38ba09f70ab3b0b4cbc36
SSDEEP 98304:pZ54kuruikPJdefM4pxHzaGhQsXu7H0kV0zwMtHiU0BqIclCHeb:P54ku7QVAxTahsXgFV0wOL0BElq4
TLSH
T1BE2633C0FCEB1F75D993118CCF9372B6969D7160D73E28C6B764B2C24A3E44522A8792
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

protocols.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.10\protocols.json
Size 3KB
SHA256 4fd800e7b1a5fb24b13fac2e31946d205012b7c28d8c61580b0669b2fa3517cc
MD5 1de85fec2dfcc28011a7c2aaab95eb5f
SHA1 80e8c954bfbe8f7ee5a2335c8d969ae033935dc3
SHA512 9c7dd37eb0c094b6aa05201e7c71a8f33b9db81284223bcfa595a44a6ac95d5a6820ab6f07b7aa8d26bf207454e94277bf35332e9c009ee63f083752b6b51750
TLSH
T1D1611DB79A3048090E3412B86B19B35DF63E029F1AD598EB76BE568F1F710F7245C54C
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c1db9209bc374a2f86cd95b7346b358838349df213bbf2e5a06533baaa399d8b
MD5 abed9e3e2618edc08b0b4a9bf347482b
SHA1 4b8e21f266a1b3861e89185599ab6b265e0c308b
SHA512 11ac46f03cb60b91cc665ca07d95cef83b62e58ef3e2c0e57aad330a2f44ddffcc94b6bc031f690502171ae756869ec4b1c8cfd689529ed13915f42ea2cc1bc5
TLSH
T1B6D0A7D9FB951306D147203912A2DE66375950AC24DB3240645F11BC8A56D91605C5CE
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 12e9cd1d77c6efaa13c23e5fba437bfb447a002c849ff7bd0b2278f158dd41c2
MD5 d31861c7f12db4387e73cb965ff789f9
SHA1 092387751595ab7bc278d4a93d3ea59045220335
SHA512 e08837effc86fe52fce16a1fbbd0f18d8c5501e9205079c3f364d007e7868bc9dce5ff1170d8e1f87fa62eec06a3f63a1917d54b79eef38e9550433c79fb069d
SSDEEP 1536:IfEEvnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BkHSRhPjU1
TLSH
T1FAB35327D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F6C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 794d0d85e405d6562145f7edb416d73dbc22708cf4a96f78bf689b12f11b740e
MD5 06aac320dfa3cddff4ae1785421721a8
SHA1 66463d5d37e230695031677f1d3a16224650110a
SHA512 ee4700110b15ccb9c1f869463cb08c6af74d04bd3b66b79732020463861c5922150a938d4326c06e5c4657370b8928a5334bd4a6333e24922e8f036f633e5c36
TLSH
T1A451EEF383E8456ECA5196F47B24AE1FCE2D0510432C3E6A89D0AF5BD3E2471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 ef26eb220b3383bd36bc23a6a4cbdfce4ba8d1dd76bc60ecb8c98e4fa228c096
MD5 31f6b69c5f692879a9251cb56f449288
SHA1 0633a445e9144eadbabc47fb66062aff7f1eef09
SHA512 67ee9cd9d1863e4e94a60c796cba73d427f4f82a3115e159394016d9f33b0a1a7a8d67644960f7979f70357f8e7c8472a33b41440e94402d68d5edd870b66b22
SSDEEP 192:sVTRCyMh/Ky0Ml8M3posZC2xQSA3aEzoZ8p1Q/Y+WNcN1UwY0JfjyH8cIgyU1YJ:sVT+LPpos42TAKiK/Sxw57An18
TLSH
T10A72C7196A28997F8CDBD61CFA427B53DBFD157391405E449AFC8E0C01E7ADD220282F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 37KB
SHA256 fec0073dd52e34562e44be3b3f7df9d655fd8c103b3d030da7809abafd2fd548
MD5 1502adaa22c590f3ca56b46f2f34145c
SHA1 b6b98aa4877edf65f515985a62166cf82e98c009
SHA512 9387e9e53c81a429185d8937b0cc1d5e3157867f2703647dbc29aceb107e19ab64e9050f4d8299759cdb791a97f76a5bb6604fc222b99a69f191360ac5fc1bef
SSDEEP 768:+e8dM8jQ29y7pL/Ln1/WRWDpQ3V8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3JTpuLlJ:+e8dM8jQ29KDn1/WRWDpQ3Vu1jaKJTpy
TLSH
T125031C7B2C0CCB7F4FC44E9CED2A6F9A5DE8028B9698895447FE440C03C66EB451A5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync App Settings\ahokoikenoafgppiblgpenaaaolecifn\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync App Settings\ahokoikenoafgppiblgpenaaaolecifn\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 22KB
SHA256 417c21aa68a8a59780d4c1b86c49fbe50fdad846c11f4c304d8e216b4bcc56a4
MD5 aa10e58d70bf000953d15c980d861265
SHA1 fea226a9336e9d7a04dbbdcc0c9a312121fbbc67
SHA512 21714dacb2596e95a25283fe1d99a466c911680f3fcbaaa150e04dc6591e40c97f43fa5dd26ad385e8970fa6a9829970b321b13c0f4bd045173468a9485eb46b
SSDEEP 192:2CM1L7oH7NtNmFSbLz5BDKparjwv8TP5xBSxmPP/ddvutuFJd1Enb13XQ7mnjJra:V
TLSH
T15BA2507D753B1241383E355DA5A8916FC94260E22030BFBF79A500A68E6BE309DFD9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5840e582-efe7-4eca-98e6-8de653a964a6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\5840e582-efe7-4eca-98e6-8de653a964a6.tmp
Size 5KB
SHA256 d64c208fb6c455733e51342c8bdaac2a32642005e0ab4cae3aaa104f10dac6cd
MD5 d6de34a552a3a71e42a498a5eace82d0
SHA1 58d2aec9c38b1f28356d584031e08b9c5943da12
SHA512 2ddde4a7af42cc3a012e42ad7a817148455620df1388c7b5d2037b7164fd43855114650cf3c50929964c020aa0185ceebb5fac4f4fca588246e31f8a2ebb96a9
SSDEEP 96:K5JR+0+IC+H+DQ+B+XST+STk0I0ZeNcUyn8KxGh7OMvytO7O+5pxqaoP:K5XST+STktWejy88GhaMvytOa+5pxqaQ
TLSH
T141B11E4FCC0DBE775BB72670952996F1F69131EB904199977F9C408EEB160FE0282A90
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CloudConfigLog

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog
Size 465B
SHA256 9d9504d5b452f4910b20eae9d4cfd66b80291ebfe76de223ee24574e18557c4d
MD5 373f19e3a173c1a8498280861a4bfa41
SHA1 833608deace5a6ed703cded28ffd27545298dfa6
SHA512 8f935c18292db98896a02b7ad57e1b5ce233f3578877f0a2de7eba5b0b86587d30a14b5ff3573d06ebc893694e97a8e2d335f9e9aa61ae11333d103f819aed7a
TLSH
T187F02BE3861A3DAB09712364546616B1FE65131F8246A08F7ABD204D1F7A83A04DBA65
MD5 SHA1 SHA512 TLSH

Submit Download

CloudConfigLog

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog
Size 896B
SHA256 77f8294136467cfdd4b1977e29f552907288ae6116f3d27ec29bb5b7e123e667
MD5 3b4298dea2e84a71165b6d7eb8cd2ba3
SHA1 8dab6ac27cb7243dd186f7886a1c537480911bbc
SHA512 a6db2c732bb27e5a2d7ab717f70defa1ae77f775a99f4ef55efffa16bacf90248746de0e1057273468947514a62072e1e62d27fe7e1ad15fa8c9736319be1326
TLSH
T14411BDB3D92E7DBB05312264155927F0FE65035F8245A08F7ABC208D1F7BC3A08EB699
MD5 SHA1 SHA512 TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 4503345ee70aa9ca0f90012b665743d7c13ec7052e7a943222287973b752b9c7
MD5 3bca8411b45106afaa963d562c371631
SHA1 78857d33a65e7061ca18a3540c304f01e7e85325
SHA512 a6a7e9af6613a30730a0b87be76f87144a3483afb756445d462de7b22543027e5e8f5822e0337ba2d7b65e413e526da962783d05d226c0d13d113d57d28b56ff
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/uz:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbA0
TLSH
T1B2A2B81DC81C7E3257DA2F7D6A2F9DB276CA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 48KB
SHA256 97ed59a8c2c706e2dc4addd4c75cab1b2866d45844c312ba828427ad58c8a63e
MD5 cda0b2cabe77ad0e44cf49f7e6a4bace
SHA1 263b32f6b17149aa546f00e069e26690734a7422
SHA512 f5903a0507e8090d5fc05bb29e648dfd2e49b1e9a79ec327e6be61c86f1a09aee8c5912c952907905c3339bdbd34e0f5a6c241c7fa79618a005783a765568257
SSDEEP 768:1FTTRMUVai1SKqvu3/Cg7oPQCsVQ9jmRsA9ZOSj3x6eJPIY6JiDK9wPLJJ4tVQQH:PT3oSvqvu3/ocQsPhWY6Qm9ELz43QE
TLSH
T1C2235BF498C78976D8AD8747A33E6D46ADBCC153B5880A88B7C45D0ECD821BFE70B815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 48KB
SHA256 c68c505abc634b483b82aa1cee3db9f521635e7a07fd17f32afeb4e0b33e3bd5
MD5 495653781120059a3c72ac9e222f107d
SHA1 e65c4b16bc8dda7d8210561704004094fee2ade2
SHA512 2fd49890281dd3d8d8b0288bf5db844c4b326a50b48551e8b4b7e9ca5b57eeaa73f3223f99c0953c1e8e7bc6e7b285cbaf5d94b98ea321595d29aa522df7bbd9
SSDEEP 768:1FETRMUVai1SKqvu3X4Cg7oPQC5VQ7jmRsAQZOSj3x6eJPIY6JiDK9wPLJJ4tVQE:gT3oSvqvu3Xao7QmYhWY6Qm9ELz43QE
TLSH
T104236AF498C789B2D8AD8747A33E6D46ADBCC153B5884A84B7C45D0ECD821BFE70B815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 42KB
SHA256 e453313652566b9aca8991094a2f3242189479ad7457694f7cf501565de1af9f
MD5 13930b853b4011f77f3de31326795e09
SHA1 d0f16428f88e970a59540f8a8741a8b13d0e7c88
SHA512 409a322a9fd94365e7f499304101303d811d07f27071d272a0948b76687656966829a524a7d57f6db45413ae70c4a0ee8e244a2fcb323f1a67287c3cc417f407
SSDEEP 768:KQDTRMUVai1SKqvY3/wg8oPQCbVQ9jmRsA9ZOSj1x6eJPIY6JiDK9wPLJJ4tVQQH:JT3oSvqvY3uoxQsVhWY6Qm9ELz43QE
TLSH
T18213A035DC59CD972CEECA96E31A764BADF141A3968C4F88D9C85E0F02C21DD2B4F819
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 6ee0054d8e893e2783a7340ec71af28ae121a9618e6e6ce84d2afacfa9376653
MD5 a2b852976f7916f1703a4be0e474dc7e
SHA1 85d7e0185374403e7687245fbc4f7ab40aab94a2
SHA512 d053155be1d602c5640da84a9c321c5507b1718f4ef5d4aca3cba38598da896def9d85ff6b6ffc8ddf1180bc30e63f0f1b7b530f83da210f0a69c56923a42247
SSDEEP 768:XQiE6esE8lDldUGz3UwgkQCtIQQ9jmRsA9wiy5wv8ZDK9wPLJJ4tVQQ9IY6gp:jeB85d73dXQsTawUZm9ELz43QPY6gp
TLSH
T194037B3DDC84C9BF18DEDB44A30D361A6DA142B7D56C8B84DBC85E0E81E60ADF34B865
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 42KB
SHA256 e86a0d5424588345a616a4997a68a3c8b8ff4373e4605832123ecd3682705eac
MD5 9c9570f33440bdf82e3549fc44ef6103
SHA1 9e940276b8337c7e6ad80c549a66da7a25e2ed35
SHA512 de4f1ff60510ddbf47b32e1064532949442734803530cc9178c1525972d1942a122e2d7af6243858908209942173f60da34619c7f1573418166c3de2051f382a
SSDEEP 768:KQTTRMUVai1SKqvT3/wg8oPQC2VQ9jmRsA9ZOSj1x6eJPIY6JiDK9wPLJJ4tVQQH:NT3oSvqvT3uoCQsVhWY6Qm9ELz43QE
TLSH
T14913B035EC59CD972CEECA96E31A764BADF14193968C4F88D9C85D0F02C21DD2B4F819
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c4ee47f5-f17a-4b9c-b8dd-7e78c1586384.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\c4ee47f5-f17a-4b9c-b8dd-7e78c1586384.tmp
Size 39KB
SHA256 1fe85f8d8716ee54416b925cd1db4f831f313c5115cab7a6b98a312f5d2cae58
MD5 61c545f6fd04c7b2e93a187c1b823598
SHA1 08d74e465904ad59f05ae5a357cf38f2f2f72018
SHA512 5f6aa9a2145d64ddcc784dd3e3f0e6a4482e6a984198667014c17c3f55622cd6d239693fa4303ae39098cf74c18548c10633dd937ede434f94951e728a599055
SSDEEP 768:qQiE6esE8lDldUGz3UwgkQCq0Q9jmRsA9ZOSj1x7DK9wPLJJ4tVQQ9IY6gp:qeB85d739QsV7m9ELz43QPY6gp
TLSH
T1A9039E35D848CDA76CDACA55E30A775BBEE001A795484FC4D9C88C0E12C71AD774FC69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ghbmnnjooekpmoecnnnilnnbdlolhkhi_1.3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\ghbmnnjooekpmoecnnnilnnbdlolhkhi_1.3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
Size 147KB
SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
MD5 9c670f04d98ab7404f16423f6ee6cdfa
SHA1 8d01079b2d065731df8a7ef52f447cd4b7add353
SHA512 102cee76d9dfcfe91e044f529672fbec042b50c5db55a3cc137197b2013dd7f81e47f50dbb0db96cb621c5732610e1eb553c4146837c11075c7c4dbd67546a3b
SSDEEP 3072:F7R0M+jCozOtDTsjMcT0JnFjkbxnEbm/+OdGmlVVklFHEpCm+:F7WxxzyDTM0JnRkb5bJdGmJkvkpx+
TLSH
T12DE3E16D3DE6DE1FC41B58F53E64708BC80E8F0B820A644FB64988345A60B5D1BD6AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RES5FF2.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES5FF2.tmp
Size 1KB
SHA256 b5edf3cf5603be8f53c33e929cb99d99144a8c9c53bf951174698e1efe471d12
MD5 8b7a2f361b46b2a4d1086bd0a2229a07
SHA1 6f029bf2eb7c1755b51d196cf6526d4d93ef5773
SHA512 3be1699ba4bc8cbc84222d20b0ac0423c4df4add4d1b9da9363b79ee1fed510fed2cc7b4e2aa980df6bc656e54ad3b6b0a0a261fcc73eea082aaa104d8c50584
TLSH
T12C21AF0697ED470AF073573179F5172B9264FD94FFB1935F8440822C1C52144EEA1E72
MD5 SHA1 SHA512 TLSH

Submit Download

RES7E58.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES7E58.tmp
Size 1KB
SHA256 de72ab20b1324d91ac38f1344eece0df2d645727db47684c6ea8dfaddfc1f32a
MD5 e892fe058277e8b154e6cbc934758972
SHA1 2372bc7253b61d23b0521cffe8d8cc2503c5de4d
SHA512 a99fe9a2308bf832e4d321b4dbf543a03a1bffed7e8b7ffa5d98cf6ac712eca11c827b523e55e05faba1cfe693d024da27de00be595c4c91448810f48986dca1
TLSH
T1DC217F0553E8471BF0779B3169FA072BA375FD55EF61936B844052292C51604DEB0E72
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_0tfy1msb.arh.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0tfy1msb.arh.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

tuysusy4.dll

Path C:\Users\Admin\AppData\Local\Temp\tuysusy4\tuysusy4.dll
Size 3KB
SHA256 e14cf4a65d9b3f21cb42231ab3ae3bef8cb344350bfe1ee0b1f807baca870319
MD5 1da05af6ebcdfc1123909f9944861260
SHA1 dbf41f8fa2ae3b218be043de7959c4332b2841ab
SHA512 25aaf958edbedacd8ec7dfc01d466bdedf2b727a6c13df2dac1a91a1ee3f69baf1e05ceb4dd5fda2b30251b8115d7251d53495e36d5e23fc84c7d024967c1fa0
TLSH
T19271F016A7D84627E47B47307EFB43666770FC54AF23972A08D0121DACA17685E31FB1
MD5 SHA1 SHA512 TLSH

Submit Download

xxabmvej.dll

Path C:\Users\Admin\AppData\Local\Temp\xxabmvej\xxabmvej.dll
Size 3KB
SHA256 5f91ec279d3d865c8b63d8aa1d0b90f8add7f05fef15ae30d00f7a37ac4b0ca4
MD5 1893db57bea275e4b3c56c397bd6c5e0
SHA1 6de1f81d14e6b23dcaa353759cafccaf1c12d3ad
SHA512 10fad2a5ec5d23a6b48449c72601578e3186c096ff2222e17a9aee920cc2159ccc4baa06bca67a76d5aea72793ceef6bafbf85021ead289c056c745267572363
TLSH
T150710416E7D84627E4BB4730BEF7436227B0FC64AF23972E09900219ACA12645E31FB1
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.fingerprint

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3288_1510481269\manifest.fingerprint
Size 66B
SHA256 c236a2ac7741d48e1c56980652331cb3f1f12baf937baf0b280600fbafb143e3
MD5 c28ffa45708f10e3a35143ed2708782f
SHA1 84a03f2615333c9311dbf79d6f58f56b5c009163
SHA512 beac0eacff45a152eb2a50f4d72db2933b8f8ba97e6f0a9f6811abe866fef5c7c83068151915dbdffaccaee5d0cd335d182671f44dbab6da2222266ff8a28ff0
TLSH
T169A022F3F000F02030022F8A80203C00C8A23BA80C8020808000BEE0200322A3A0C820
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3288_1510481269\manifest.json
Size 135B
SHA256 ba5c9096d20a482aaa1aa9e5f98ad6127d3e97c2f21de84f7c78d9b8073c8e26
MD5 fbebd68ecaa98928909421f66909c054
SHA1 99d787d90f7ed2e5ad924f9c5668eb988b5a6c07
SHA512 749a3b2be47fe28399dc763888654a3e8d397e06e8d3c3af3965bb45846a1336e6ab4ca82c82c3df846b34a2afafa2156f2690e9bf347ab175408dc0171c61cc
TLSH
T158C04C668D51DEAB00A747A56B295315E23B4B4B5044800A7AF5429C1A288964171944
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3288_4879393\manifest.json
Size 85B
SHA256 2d905d7b28b1afd313753d14f6a916a2e56ec4c1316bfa43046b09214ceb6090
MD5 8ce95626b39ebc2401eee0b34c24fc7c
SHA1 f97a2fefe756f7a03e388e1333573b884730c2b0
SHA512 f04e4f695977918adf6e0603386b6f9c75a4a2202b0fe7215b642f3db491a1db398039cc28633b8e2541749403581622d28c1400f3f8fc66a3daab200e27266d
TLSH
T106A0121018015DE318880320213143D2D3A51C05247437001106108019B8636027A22E
MD5 SHA1 SHA512 TLSH

Submit Download

CSCE65D4C104A404E608D52132035BA57B.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\tuysusy4\CSCE65D4C104A404E608D52132035BA57B.TMP
Size 652B
SHA256 e0b6d60e2ecf060f8bc96f2bbb317367957b547470e9d62841700e94034b201b
MD5 e6e1d12ba96868a6c7f56f2343b26a48
SHA1 ac185617baa8346447f99996ac01357703f0f838
SHA512 72baea5e74550891866a9e63faa6b164f21c4dd1ac57bb593bc391d3cff18aebb51d0fb2cddf3d0c1ae7995391f67f997ded71dda90d00e20607e80d193e8858
TLSH
T1F0F03A0A63F8020AF1F74B30BAF6436391A9FC65DE3293ED1440031D2C64614C972FB2
MD5 SHA1 SHA512 TLSH

Submit Download

tuysusy4.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\tuysusy4\tuysusy4.cmdline
Size 369B
SHA256 e9397a165432c30dc9d66e19451239a439cac9698831aaeeb775ec4194fa0ef5
MD5 b2986555e9adfce3fbde6f3b66e525cd
SHA1 9c741b34930edf9eda2b6ad265645cfea20c67b6
SHA512 c517e8c681f485a79e5b5ec6ca89a8740e9c356d379ce8390a2f5c47660b7ed4215abf8a16675af605de5ce145b661f5462c11b38acfdbfcd2d8424287593186
TLSH
T1F8E0686A528AC2BD11DD20172669C4BC837207472B403F8458B0C42ED03790027D1771
MD5 SHA1 SHA512 TLSH

Submit Download

CSC14CF015567D643EB88A7F65193A27.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\xxabmvej\CSC14CF015567D643EB88A7F65193A27.TMP
Size 652B
SHA256 5ca6daf4de7ed085539198d5621551b86d69dfe9ed3fcdcaf5abaab7558ebac6
MD5 3f4cf289cd2d9921724e6660a9d79a63
SHA1 03e765490eefaf7aa0cbbbe5281967fa4524fddf
SHA512 7e107364ed1efc50a78c4262c73dbffa16b241de0632662f33aaa09c5edb759fe2b5d3731a95af8505a7159e1033da2fc29e364a6a0315e334424bd1456b574d
TLSH
T150F05E0AA7F8120EF0F34B30BEF643A395A8BC64EE3293ED145043192865510C962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

xxabmvej.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\xxabmvej\xxabmvej.0.cs
Size 418B
SHA256 cbc4940031baf6e739b3838b4df0fe531d59bea50d713d2bafc9c0e720b16cd4
MD5 378bae59e416d1ef128b553a82dec088
SHA1 aac56f28dafd3444c326fc34f4510f2390a72893
SHA512 1a5b0f05ea0fd2dcba9242d265927eef1ce70c3d1f0654e7f7734924f8e20bcb82a57d0d573a0e3a54caf1e9d07d5fc24c07f8ff89d4009267252f892a0f9d1c
TLSH
T1DDE02B207343D9B9546601162EC3A0A17933E20A39DBBE4875ED6220CF57189B73267F
MD5 SHA1 SHA512 TLSH

Submit Download

xxabmvej.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\xxabmvej\xxabmvej.cmdline
Size 369B
SHA256 c9e07319c9c06352344d5ffca3421669bccffe178192d758a30b3a55f98e203b
MD5 d7afb3277d1d331a3b41b81804f5719f
SHA1 b5b2747ce38886beb0d2ff84a2c0753d48a92649
SHA512 879795c3c18c8da0543dd77f1f9712e0c6dea60a427625e2523fff28e319caaabe57bbaa923c1583dc09f356fd61eb480ad2996add17964a2baae2dddd9763ad
TLSH
T10CE0223B534BC26D02E910073369E5ECD376074329882F8461808C8DE01B0103BE2745
MD5 SHA1 SHA512 TLSH

Submit Download

memory/564-70-0x00000197EA410000-0x00000197EA41C000-memory.dmp

Download

memory/2960-67-0x0000025EF9670000-0x0000025EF967C000-memory.dmp

Download

memory/4108-18-0x0000020D423D0000-0x0000020D423DC000-memory.dmp

Download

memory/4280-40-0x000000001E590000-0x000000001E59A000-memory.dmp

Download

memory/4280-43-0x000000001EFC0000-0x000000001F182000-memory.dmp

Download

memory/4280-7-0x000000001B9B0000-0x000000001B9C0000-memory.dmp

Download

memory/4280-78-0x0000000001350000-0x000000000135C000-memory.dmp

Download

memory/4280-76-0x00007FF43AA60000-0x00007FF43AA70000-memory.dmp

Download

memory/4280-74-0x0000000001350000-0x000000000135C000-memory.dmp

Download

memory/4280-75-0x0000000001520000-0x0000000001532000-memory.dmp

Download

memory/4280-73-0x000000001B9B0000-0x000000001B9C0000-memory.dmp

Download

memory/4280-8-0x00000000015A0000-0x00000000015C2000-memory.dmp

Download

memory/4280-60-0x000000001B9B0000-0x000000001B9C0000-memory.dmp

Download

memory/4280-23-0x0000000001620000-0x0000000001628000-memory.dmp

Download

memory/4280-44-0x000000001F6C0000-0x000000001FBE8000-memory.dmp

Download

memory/4280-24-0x000000001B9B0000-0x000000001B9C0000-memory.dmp

Download

memory/4280-31-0x00007FF43AA60000-0x00007FF43AA70000-memory.dmp

Download

memory/4280-42-0x000000001B9B0000-0x000000001B9C0000-memory.dmp

Download

memory/4280-41-0x000000001E5C0000-0x000000001E5DC000-memory.dmp

Download

memory/4280-0-0x0000000000560000-0x0000000000B44000-memory.dmp

Download

memory/4280-39-0x000000001E4D0000-0x000000001E583000-memory.dmp

Download

memory/4280-38-0x000000001E4B0000-0x000000001E4CC000-memory.dmp

Download

memory/4356-123-0x00000000036D0000-0x00000000036E2000-memory.dmp

Download

memory/4356-540-0x0000000001CC0000-0x0000000001CCC000-memory.dmp

Download

memory/4356-536-0x000000001DAE0000-0x000000001DB93000-memory.dmp

Download

memory/4356-72-0x000000001D850000-0x000000001D858000-memory.dmp

Download

memory/4356-122-0x0000000001CC0000-0x0000000001CCC000-memory.dmp

Download

memory/4536-21-0x00000289AC130000-0x00000289AC13C000-memory.dmp

Download