d311a4f486e2f81d1ffb11b37782d8bc1325b1df96ff21ab3b3de818ae3d5d84

Analysis

geolocation tags

asiadelhiinindia
user interaction
yes
max time kernel
247s
max time network
247s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/06/2026, 02:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1Xi9Tw.html
Size 11KB
Sample260622-css68agw4m
SHA256 d311a4f486e2f81d1ffb11b37782d8bc1325b1df96ff21ab3b3de818ae3d5d84
MD5 c229b9d23420402bdea979bae2d31dde
SHA1 cf5cb6cd0c16a3cd252c792a13907df48fa2f0d4
SHA512 bdabdc88c2c5f8c1b6e4730801ad263d8f0172f9cbc19d80de98acaec7d06218f830366b5c10a63cf589de17ed23dd3b84542ab2183f93fe383f9fa3bd6f6fb8
SSDEEP 192:zMilLhIJhKYX5kerCNRupjQ4vYJkTcOHsU:zNOJhda4s4vYJk4OF
TLSH
T1BF32764A1EF280E701E785A97DF2FD0DAD85864BD219FC4832BC80A90FD7D468DC7995
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery persistence ransomware

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
77	3124	msedge.exe

Executes dropped EXE 2 IoCs

pid	Process
1652	XimGG.exe
2720	XimGG.exe

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
63	api.gofile.io
64	api.gofile.io
66	api.gofile.io

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3124	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134265684668278926"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3246620872-1649211507-2285877732-1000\{A3DB4946-7ACE-4440-8B33-38587EB1FF1D}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4272	msedge.exe
4272	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
1652	XimGG.exe
2720	XimGG.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
5576	msedge.exe
5576	msedge.exe
5576	msedge.exe
5576	msedge.exe
5576	msedge.exe
5576	msedge.exe
5576	msedge.exe

Suspicious use of FindShellTrayWindow 44 IoCs

pid	Process
5576	msedge.exe
5576	msedge.exe
5576	msedge.exe
5576	msedge.exe
5576	msedge.exe
5576	msedge.exe
5576	msedge.exe
5576	msedge.exe
5576	msedge.exe
5576	msedge.exe
5576	msedge.exe
5576	msedge.exe
5576	msedge.exe
5576	msedge.exe
5576	msedge.exe
5576	msedge.exe
5576	msedge.exe
5576	msedge.exe
5576	msedge.exe
5576	msedge.exe
5576	msedge.exe
5576	msedge.exe
5576	msedge.exe
5576	msedge.exe
5576	msedge.exe
5576	msedge.exe
5576	msedge.exe
5576	msedge.exe
5576	msedge.exe
5576	msedge.exe
5576	msedge.exe
5576	msedge.exe
5576	msedge.exe
5576	msedge.exe
5576	msedge.exe
5576	msedge.exe
5576	msedge.exe
5576	msedge.exe
5576	msedge.exe
5576	msedge.exe
5576	msedge.exe
5576	msedge.exe
5576	msedge.exe
5576	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5576	msedge.exe
5576	msedge.exe
5576	msedge.exe
5576	msedge.exe
5576	msedge.exe
5576	msedge.exe
5576	msedge.exe
5576	msedge.exe
5576	msedge.exe
5576	msedge.exe
5576	msedge.exe
5576	msedge.exe
5576	msedge.exe
5576	msedge.exe
5576	msedge.exe
5576	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1652	XimGG.exe
2720	XimGG.exe

Suspicious use of WriteProcessMemory 45 IoCs

description	pid	Process	procid_target
PID 5576 wrote to memory of 6060	5576	msedge.exe	89
PID 5576 wrote to memory of 4876	5576	msedge.exe	90
PID 5576 wrote to memory of 3124	5576	msedge.exe	91
PID 5576 wrote to memory of 4876	5576	msedge.exe	90
PID 5576 wrote to memory of 4876	5576	msedge.exe	90
PID 5576 wrote to memory of 3880	5576	msedge.exe	93
PID 5576 wrote to memory of 3880	5576	msedge.exe	93
PID 5576 wrote to memory of 5928	5576	msedge.exe	94
PID 5576 wrote to memory of 5928	5576	msedge.exe	94
PID 5576 wrote to memory of 5928	5576	msedge.exe	94
PID 5576 wrote to memory of 6620	5576	msedge.exe	95
PID 5576 wrote to memory of 6620	5576	msedge.exe	95
PID 5576 wrote to memory of 6620	5576	msedge.exe	95
PID 5576 wrote to memory of 4604	5576	msedge.exe	96
PID 5576 wrote to memory of 940	5576	msedge.exe	97
PID 5576 wrote to memory of 4604	5576	msedge.exe	96
PID 5576 wrote to memory of 940	5576	msedge.exe	97
PID 5576 wrote to memory of 6312	5576	msedge.exe	99
PID 5576 wrote to memory of 6196	5576	msedge.exe	103
PID 5576 wrote to memory of 5456	5576	msedge.exe	104
PID 5576 wrote to memory of 3832	5576	msedge.exe	105
PID 5576 wrote to memory of 6432	5576	msedge.exe	106
PID 5576 wrote to memory of 6432	5576	msedge.exe	106
PID 5576 wrote to memory of 3252	5576	msedge.exe	107
PID 5576 wrote to memory of 3252	5576	msedge.exe	107
PID 5576 wrote to memory of 2812	5576	msedge.exe	109
PID 5576 wrote to memory of 2812	5576	msedge.exe	109
PID 5576 wrote to memory of 2812	5576	msedge.exe	109
PID 5576 wrote to memory of 2448	5576	msedge.exe	110
PID 5576 wrote to memory of 2448	5576	msedge.exe	110
PID 5576 wrote to memory of 2448	5576	msedge.exe	110
PID 5576 wrote to memory of 5368	5576	msedge.exe	111
PID 5576 wrote to memory of 5368	5576	msedge.exe	111
PID 5576 wrote to memory of 5368	5576	msedge.exe	111
PID 5576 wrote to memory of 2836	5576	msedge.exe	112
PID 5576 wrote to memory of 2836	5576	msedge.exe	112
PID 5576 wrote to memory of 4972	5576	msedge.exe	113
PID 5576 wrote to memory of 4972	5576	msedge.exe	113
PID 5576 wrote to memory of 4972	5576	msedge.exe	113
PID 5576 wrote to memory of 3440	5576	msedge.exe	114
PID 5576 wrote to memory of 1652	5576	msedge.exe	115
PID 5576 wrote to memory of 4272	5576	msedge.exe	116
PID 5576 wrote to memory of 1472	5576	msedge.exe	117
PID 5576 wrote to memory of 1472	5576	msedge.exe	117
PID 5576 wrote to memory of 2720	5576	msedge.exe	118

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\1Xi9Tw.html
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2c8,0x7ffa449dc188,0x7ffa449dc194,0x7ffa449dc1a0
  2⤵
  PID:6060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1816,i,11934543125129821793,10231573773350342950,262144 --field-trial-handle=2068,i,14126987665872710020,5245689387860843890,262144 --variations-seed-version --mojo-platform-channel-handle=2076 /prefetch:2
  2⤵
  PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1912,i,3313647899726084314,10910080505270666860,524288 --field-trial-handle=2068,i,14126987665872710020,5245689387860843890,262144 --variations-seed-version --mojo-platform-channel-handle=2384 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:3124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2656,i,16656344963891869252,17815891960562369698,524288 --field-trial-handle=2068,i,14126987665872710020,5245689387860843890,262144 --variations-seed-version --mojo-platform-channel-handle=2768 /prefetch:13
  2⤵
  PID:3880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3532,i,10498131876870115602,13095586131495058972,2097152 --field-trial-handle=2068,i,14126987665872710020,5245689387860843890,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:1
  2⤵
  PID:5928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3536,i,8472415616386234434,8557733732376031037,2097152 --field-trial-handle=2068,i,14126987665872710020,5245689387860843890,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:1
  2⤵
  PID:6620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5164,i,15243033816975665447,8044643447129043427,524288 --field-trial-handle=2068,i,14126987665872710020,5245689387860843890,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:14
  2⤵
  PID:4604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5152,i,17684672197125169497,13669595241987192689,524288 --field-trial-handle=2068,i,14126987665872710020,5245689387860843890,262144 --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:14
  2⤵
  PID:940
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5692,i,12582810209442580564,8218767935446783933,524288 --field-trial-handle=2068,i,14126987665872710020,5245689387860843890,262144 --variations-seed-version --mojo-platform-channel-handle=5756 /prefetch:14
  2⤵
  PID:6776
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5692,i,12582810209442580564,8218767935446783933,524288 --field-trial-handle=2068,i,14126987665872710020,5245689387860843890,262144 --variations-seed-version --mojo-platform-channel-handle=5756 /prefetch:14
  2⤵
  PID:6312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5876,i,10716379715725467043,11360485679530675589,524288 --field-trial-handle=2068,i,14126987665872710020,5245689387860843890,262144 --variations-seed-version --mojo-platform-channel-handle=5084 /prefetch:14
  2⤵
  PID:6196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6320,i,13077306720252936777,10723964353377992448,524288 --field-trial-handle=2068,i,14126987665872710020,5245689387860843890,262144 --variations-seed-version --mojo-platform-channel-handle=5864 /prefetch:14
  2⤵
  PID:5456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6336,i,689062035265021984,17968013401398410197,524288 --field-trial-handle=2068,i,14126987665872710020,5245689387860843890,262144 --variations-seed-version --mojo-platform-channel-handle=600 /prefetch:14
  2⤵
  PID:3832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5412,i,502873559390404860,7413761612303794720,524288 --field-trial-handle=2068,i,14126987665872710020,5245689387860843890,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:14
  2⤵
  PID:6432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6516,i,5347384843454209180,6405587975476242291,524288 --field-trial-handle=2068,i,14126987665872710020,5245689387860843890,262144 --variations-seed-version --mojo-platform-channel-handle=6552 /prefetch:14
  2⤵
  PID:3252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=2636,i,3054946332363659947,5511566016815928226,2097152 --field-trial-handle=2068,i,14126987665872710020,5245689387860843890,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:1
  2⤵
  PID:2812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=5100,i,10466766969508571882,16921909071576634083,2097152 --field-trial-handle=2068,i,14126987665872710020,5245689387860843890,262144 --variations-seed-version --mojo-platform-channel-handle=6364 /prefetch:1
  2⤵
  PID:2448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=3616,i,1339270112285246571,1953071198661976195,2097152 --field-trial-handle=2068,i,14126987665872710020,5245689387860843890,262144 --variations-seed-version --mojo-platform-channel-handle=3736 /prefetch:1
  2⤵
  PID:5368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6416,i,6504191123409660993,4678690810547918267,524288 --field-trial-handle=2068,i,14126987665872710020,5245689387860843890,262144 --variations-seed-version --mojo-platform-channel-handle=6424 /prefetch:14
  2⤵
  PID:2836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=3560,i,13825193646139964097,14065563816619277121,2097152 --field-trial-handle=2068,i,14126987665872710020,5245689387860843890,262144 --variations-seed-version --mojo-platform-channel-handle=6428 /prefetch:1
  2⤵
  PID:4972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7060,i,7355720955417943095,14817795462204662838,524288 --field-trial-handle=2068,i,14126987665872710020,5245689387860843890,262144 --variations-seed-version --mojo-platform-channel-handle=7020 /prefetch:14
  2⤵
  PID:3440
- C:\Users\Admin\Downloads\XimGG.exe
  "C:\Users\Admin\Downloads\XimGG.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:1652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4940,i,10336786524359346687,17608832483718648406,262144 --field-trial-handle=2068,i,14126987665872710020,5245689387860843890,262144 --variations-seed-version --mojo-platform-channel-handle=3708 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4440,i,7268462399683606356,4123520994769358241,524288 --field-trial-handle=2068,i,14126987665872710020,5245689387860843890,262144 --variations-seed-version --mojo-platform-channel-handle=5600 /prefetch:14
  2⤵
  PID:1472
- C:\Users\Admin\Downloads\XimGG.exe
  "C:\Users\Admin\Downloads\XimGG.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:2720

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1432

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4272

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 808B
SHA256 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
MD5 878e958d6bff424e59d1feb51584a01f
SHA1 b11261559bbea40f1874448196e2934277a537e9
SHA512 6481a56d17126cf94901bed6f418af28f63089da57af4258fb13e468063c4d7849f78ca00a0e4a72c249a639afc8304669f99e48a360008f8e64172ab3133213
TLSH
T18D0152CD6E2925408AB18A334AB9C4970DB9724A3AD5910C4453A4A024D07588F0F54E
MD5 SHA1 SHA512 TLSH

Submit Download

C48B7CA5B70F9C68A6386028B8208079

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C48B7CA5B70F9C68A6386028B8208079
Size 45KB
SHA256 dd4046d701a3465cda67c6dc8dd92a824e2cd7f70c49e77d73ce239a4614e38f
MD5 d977aedd86da006312aff2170e854d77
SHA1 73d4ffcf0da8430a53816942445f4c9100c0e359
SHA512 fccd4cd975afcdc73167f01c099bf666fd871a707eb7a510321f624706ed25a037815281ed80be3e46465e9fc4c4389d1afbb5f9453d4290887f342209a7b136
SSDEEP 768:ynkHRqwr69C7fUds7JfnekWLwwLCYrwMCwQHMsCHw0TjuSdMryPfq:ynoqy/ekWwRHtCHwQ40fq
TLSH
T1E1232D6C6C37F1639DAA9EE28DDAEA9656E751C72A42431F0E303F505C03A97CB5BC40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 16bf46348d2b4d89f07dcf21ab2335c1f07dbb596644aabf3a6377b4f9e847f8
MD5 5b5a9bde6fd8c6cac9ca2e2e6a7e704d
SHA1 93e465c6b2b050f962373ef229ed5ad8f8a0f9db
SHA512 fc5d55a058a918763a55fa1a85d53072a1fd38174f75d4611a286166c2316f416664b44538b8ba4252c9479a540324a56385afa513573ff5edf4842dc0b8f524
TLSH
T19DC08C1C1AA20A06F2A8437C02D13943ABA18102F282CF151AF12A08D996B266838C6E
MD5 SHA1 SHA512 TLSH

Submit Download

C48B7CA5B70F9C68A6386028B8208079

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C48B7CA5B70F9C68A6386028B8208079
Size 246B
SHA256 b60a489438336ebc2663748a58178080a61197ad5efef6029c731843f8536b61
MD5 c6622b7ba5314f9910b99d922c0938ed
SHA1 78279dd3d82d61593cc774d3ed4912c3ab2dacaa
SHA512 c8b37b5f04617f4e09bd8691f7f43af28438a1c6d0510fd4a8c64588dc0a84a8994ade9e85450e9351c10fd13710c998151241beb5c5facd7caeaa9f0a5cbca6
TLSH
T1FAD0223C1371022DF53D8635EAF00B010B226232B2038B6E1F716A8CAC2A7021FE080C
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 01fc33638563dc8ab1a7b28573704bed2449b99eedc9bd38a25b21316506e8a0
MD5 11027c4e8a2219c9ce2e898ab0ee23b7
SHA1 035426b9d83735103c3507c9017885546a4bc3f1
SHA512 a538fa52093c0e8ae9c8760749e2905603b5390edd667d6d7eed03fc52795e15b07573b9fb01fe984851203afcec62a80bbc50d6e99f5fbb2fc0771ec7bb014b
TLSH
T1B2D022213628F001E22A10B34D20831012198A0629A39A0A3C90D04AE8A6080B2D2447
MD5 SHA1 SHA512 TLSH

Submit Download

897da7d2-8401-4e83-bfba-ebc3ba237b58.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\897da7d2-8401-4e83-bfba-ebc3ba237b58.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 352B
SHA256 66061d634bd25c6365b223135254ee33c2b5a733a52ee7c86bdb66e0a175877a
MD5 c7ab7f20ddaa55175c056a55f39c8eaf
SHA1 7d96649ed310377179dc49b7ad5afc583cdbb198
SHA512 f5074050f8033c008b10da8d9568616f6422ba1b7601dc70c67c02874651fc7176fc7f6de9911b751fb24a3c6193188c55716a843ef0bcdaa8714f0018ba0f44
TLSH
T12EE020F6C3F4D7A94108954BD564FB25D150F51F97CD64BD332DA28C3401F00B15D290
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 268B
SHA256 26bff9a3e1402d3f550ab8d3ced2c6552b2407bdd4f3ece6340cbaffe5aafe10
MD5 0976ebd68512e143dd930c0eea108ca6
SHA1 d3a11b502eac53fc52dcdfd333978c5ae1aa39aa
SHA512 2a9b406623c8b8eff082a32878425c877f27d79084dcc7003a5fe1881388bd6ea1d7160c837d4e04ac1fb730077b1e9644adb7712ed7b73fd029ed877609b644
TLSH
T15BD02BACB9DC7D4FD2F41DFED7A6F0000F5452914412DE131160FDC036A56E01B66060
MD5 SHA1 SHA512 TLSH

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 032dda1487d7a4e04000744afa72472e25cabd40425855a8757c7169f41dfc34
MD5 7da6c730f27c553640924da7dd3cead0
SHA1 de08b3bfdfa5262d963e9a879e0bb5a89a398d70
SHA512 e072cbea66c5183f6ac74d90b8dee2c7a81cfe31b400a31d1a5e0c5b201d6ed31dd4e56962dffed087afa10f08578eb3b55a4fd79bd3e2e420fcfcc43a2b6908
TLSH
T194E02BABC8249C7B04FD1F59645046C6EB1013576B40455B3A3DC20D8FB47FF5681C5C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 77a710194fe479fe2f5ae92172422df7d92e9d3fdeba12ce7032e24d40b4af2a
MD5 f49e6cb503b3d18ba36149bef0a15ae0
SHA1 12fc7a186d8b7fbc9cf4130b7d7b39c0a5868d4c
SHA512 16f0713bfce07ecdb3e7509793ff3b682c116a5c92ab32d7582ced625614982fecef6a9143458fef0e57a1a1efaf27d83e064247a9bdafc83721d3f55635cad0
TLSH
T1A88197AFC061A9A2CF26EF34DDE22CBD73704435021B2F2510C559B4EB86748F6C6957
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6e6b9a74-a314-4194-8299-eba57c2c2dbe.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\6e6b9a74-a314-4194-8299-eba57c2c2dbe.tmp
Size 2KB
SHA256 8a102e88ebf1c8c2838bc952f8e1ddc71106d0b511f7ed841f88de950377e221
MD5 9af43556b6f5ce41a0ff725011cea084
SHA1 d2384c30d042477b9ab09339d039efd1e034e88e
SHA512 3d660e7375e5088fd45390a2b38b7a185d5b9dce8a9393fe3296bed98d2ba5658be9c2dfe744e7b9b9aa081879430f341360da68009cc96fe2165ed01d5e9cb1
TLSH
T1C151ADF3C6E4826EC91156F0BA187E2BCE2D0954832C3D5AC5E4EF5B93E2471E181A5E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 7917d642cdc6f715824dd8b800cfdaeada59a58662712d548b5a02ffc9c42267
MD5 687d5f291aca1a847ce6c00bfc1a2278
SHA1 187785d1ed48e0a9e7e0092035871fcbdbbaa10a
SHA512 0a368e4adf78882ad1dd7439941c86a9095bcc9f51e883d38e3e6655d6f20b92dc8e025c9b75acb56f110e2b7ab166c43f6e638d06328be1e29fa1f385e89048
TLSH
T1A1519DF383E9866EC91156F0AA187E1FCE1D0515832C3D5AC9E4AF1BA3E2471E181B5E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 b1fce1c3eaeed4d19afa0ab968c01496c2b723ab43eb17d8375fc040ea627273
MD5 8777931fbfabf9bca18e65771695a024
SHA1 8ca0583f55e6f194636aaa66ea4c6274c898ae4d
SHA512 929abe75f7f95af80f4efe692ae3222d0529a483828485bfb30847177f5a78456eff07d5a73cdd9912692a88d95cbe3517d581dc3fdd1d3de2a8219866baf074
SSDEEP 192:sxReRFyMqZjK1Ml8wFj/f+sbmSI1ZuEsbzoA8peJ/g6+WNIY1FZDmGMIgj0tJ:sxReKbj/f+sbmz7Q6C/5ISDKj03
TLSH
T12262D8156A38997B8CDBD219F6957F53D2F81573F2905E44AAFC8A0C04E7ADC221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 60ad18a9ae564ae398687523d60728286d50fe814eb5bcaedea943d6780e9442
MD5 204be16d82286f2edfcbff94ebbc246d
SHA1 148caf5d1329f42c70abaed7264fad7086237ce3
SHA512 c97cd3187e4a04174738c3853f2737e1ea02e30cfd394441b8531ddef59bb3d99371d69b2c7230edd9ff2eeb987533878cc2173bf464135bc706dc80bce04ea1
SSDEEP 192:sxReRFyMqZjK1Ml8UQ6oj/f+spSt1ZuEsDzoA8peTl6/g6+WNMHNXY12ZDmGMIgk:sxReKq5j/f+spi7QyF/52X/DKV03
TLSH
T11872B715AA34897B8CDBD219F6957F63D2F91563F2905E44A6FC8B0C00E7EDC211782B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 b2b6579a64c70455cb6d9657e5ba62cccd8e9ad90ca814dee2f3cccfab7ef1ec
MD5 e61b10f566e744e4ded39f5cafea1480
SHA1 73fca2d3cf096c084874ad88fb0d08b5ff9d2e61
SHA512 ff84888255462c8c64fde100912e3cb6ed5d445b9e2c01765cdf4b8976ef22645caad4816b1e4e0247cb9c9f74c6a7bd4370761395a0fdb8b56e2071f009e349
SSDEEP 768:z2SIQTWgBdfLk8F1+UoAYDCx9Tuqh0VfUC9xbog/OVhbgZvro1u2:z2SIQTWgBdfLku1jaskZ8s2
TLSH
T1EFC20D2B640CC77E4F84496CEC2AAED66DD801CB9B944D9447FA894C03C67EB521B4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 b999e5a5cdbb4205a0aea88d3bd38092462e73fcf1689420ad8e72aff1b81a72
MD5 1c332fa4e88c2e1f1a3e335cf38042ce
SHA1 0f6273415e318683ec0da9d492dfad6715e29ea6
SHA512 936b400377a8b2352d47b1990d7a4b00f9f922c97649316eeebae0e847b3b0a8e51c06904dec65d4ca2a59503285ea6738c979cdad91c01ddf952b4c28f23190
SSDEEP 96:KcucKzSmmD+KsoPjWKQsKGpSKSsx8gKVGeGbqKEEfxGK6giOrOKs4MduK2E662wv:ijdt9ZpfpRBNwVnqxpJFBTPLu/X0
TLSH
T135B23711797E224138BE250CE195966F274230B3701AA63B3BBD20F64EA7E015FFD9D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 f3956094fb3b58ab9ceb5e0459788b1142f1845a5b9f706b346650284c4b985e
MD5 1f833186cf5fac7a69688c29765536e6
SHA1 85469cae6bdc1a189b9221986ca80bbcbcb170c4
SHA512 abb3455d3f7761776bd5ec92fe3abd5531f1a2de8832cededd6831487591646f39c331f31bf43b55e10a477e03da8ea80d69d12c3150bd529a8a206996ec1af2
SSDEEP 384:nEiF1tNn/s3n9S68N48TUNTUlIRfLqYB74HcpMcAfLp1HFZbpTm9WNjcQXlm3m9s:fF1j+9zNwgptUqC1HvdTmgtcklaWupvH
TLSH
T1A3C24A32A864CE7BEDE68BD5B7493647AEF001A3CAC86AD4D9D86D4D00C76DD070BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 2819c3160fca6500682a6f9ef5a6013d0fabb8ba91dbf83e4dd91ffa354e6a9b
MD5 ae6b6b2c016c31c70873d7f6737f90bd
SHA1 2d65b0691bf2ddb77e9fcfe3151aea42dc8bf3b4
SHA512 642e7747b0ca14987ccba04dfd544f01e5048116d40f9af7a342945bd3582c55088d120cbc12a2b4518a5d3715f251cf05d2893aeca9e24b6540f9ad332c2d82
SSDEEP 384:nUiF1tNn/s3n9SL8N48TUNTUlIRfLqYB74HcpMcAfLp1HFZbpTm9WNj4QXlm3m9s:vF1j+9KNwgptUqC1HvdTmgt4klaWupvH
TLSH
T1B5C24A32A864CE7BEDE68BD5B7493647AEF001A3CAC86AD4D9D86D4D00C76DD070BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 1da438034a103f5a6076132083c283ff72952dee79682239b4281f1abc891bc8
MD5 45bc9fb9bbac3a48d47adf1f78969a0d
SHA1 7a5c800ab157e85a50e76617a72457214c933106
SHA512 e72256bde96840c89f32f64ddd27cb00a69d10676c4ae862e9d059906ad22387cc27b63d40c5c0e18d3cac64095c3a752388882b1e8fd0364337813c5d322949
SSDEEP 384:nWiF1tNn/s3n9SL8N48TUNTUlIR9LqYB7vHsMcAfLp1HFZbpTm9WNj4QXlnj8j8h:9F1j+9KNwgHtfsC1HvdTmgt4klj82vp
TLSH
T1AAB21832A8A5DE7BECE68BC5B70A76479EE401A3C5C8AAD4D9C86D4D00C76DD070BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 4585f500edfacdba9ec31344a95d9ce9dce9aea9fad06715f7579beaf37b7550
MD5 a3f1f857d2281648ab30c77f7a9d0886
SHA1 09ff7201b27c5ffaa72dcad6725fe4f6d8cdd4d4
SHA512 beb314fad5aa3bc3592f8dc2e1d066ac3cf6c270ce9115e85e70dcc7fa531abbdb7f44733bc5972fb889ee5b98c520db57ad2182a224031382e0a26f26708094
SSDEEP 384:nziF1tNn/s3n9S58Np8TUNTUlIRABLqYBaqXmcAfLp1HFZbpTm9WNzTIITGT0IY7:eF1j+9sUwg+xNXg1HvdTmg5TIi+0QEvX
TLSH
T186C23932D864DA7BEDFA9FD5A709764BAEF001A3C1D86AD8D9D85D4D00872DD030BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 4a76c1f6e114264daf38830e33dbc165530f45100cc1c7fdeaaeee18438fa739
MD5 828760c68bcf74e9ffbfc8c49af37120
SHA1 8c683e1130e31e0e5a5c201a3622734eeb56f7e8
SHA512 a10867b5d7e47d706c4b1ef88f3c137191e53958c548009d3103b673e6a8ce12e838b6fc012fbfc6a04bee91e272f3d23174e6fd84cd98c36f7c80b85f7220af
SSDEEP 384:nEiFWtNn/s3n9Sg8NV8TUNTUlIRDLqYB7XHRMcAfLp1HFZbpTm9WNjeQXlm3m9hq:fFWj+9pQwgpt3RC1HvdTmgteklaWupvH
TLSH
T1A4C23932A864CE7BEDE68BD5B6493647AEF001A3CAC86ED4D9D86D4D00C76DD070BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 a15f822b7b260da43b40c07d149116e43dd56a65d6ebbf2a3671c7f131b2edb4
MD5 2ae53c2fa4b0adec25f9b564f324c3b5
SHA1 3498d294b15331b0e4a16c4b857c865b6d92be9a
SHA512 98d922dc82424ec468d8c0f4c0f01639ba9fdd39e4037e85858a665533fe675d6bb3b6df61bcb790b792bd94a1a50c80c2dee9b0cf4c44226236a866acec8e98
SSDEEP 384:nEiFutNn/s3n9SQ8NV8TUNTUlIRDLqYB7IHRMcAfLp1HFZbpTm9WNjcQXlm3m9hq:fFuj+9lQwgptkRC1HvdTmgtcklaWupvH
TLSH
T160C23932A864CE7BEDE68BD5B6493647AEF001A3CAC86AD4D9D86D4D00C76DD070BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XimGG.exe.crdownload

Path C:\Users\Admin\Downloads\XimGG.exe.crdownload
Size 1.7MB
SHA256 1d41043fb92ccbfa849fd068b56e1f5454d11552e065b84f1a071d3a4bb61e4f
MD5 67d0436a1623de58ecdfd90676f1bb74
SHA1 a2b8621cc36666d7f44c277226b9459d9fff8263
SHA512 e029eecc99738b4660216749e4e4ce58f59e8ad5d00d6c4a8881a1c94ee03d88e7fdf1d9a320ff86c04b701bf581cd7d9e9d73b51d393822bef9206b16cec880
SSDEEP 24576:W05DLQtQjpOQ4i5fwr27USeyFC81rhFaeLjboilnvq/3GxEF/3eTAJgTyhz8ju:W05DLKC2cfFHrhhLdlnUUTogTylS
TLSH
T14C85D044F2BA41ECEF7781348495AA1BE5713CC4036099EB13DC4A6A1F677F41ABEB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download