hxxps://disk[.]yandex[.]com[.]tr/d/QI19y4a98I6DpQ

Analysis

user interaction
yes
max time kernel
94s
max time network
97s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/07/2026, 15:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://disk.yandex.com.tr/d/QI19y4a98I6DpQ
Sample260713-seqryaa17n

Score

8^/10

discovery persistence ransomware

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
115	5740	msedge.exe

Executes dropped EXE 1 IoCs

pid	Process
2584	2- Samsung 300K Tool.exe

Probable phishing domain 1 TTPs 1 IoCs

Phishing

T1566

description	flow	ioc	stream
HTTP URL	147	https://forum.gsmhosting.com/cdn-cgi/challenge-platform/h/b/orchestrate/chl_page/v1?ray=a1a92d38acbc652b	7

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2- Samsung 300K Tool.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5740	msedge.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134284285795939714"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-552508041-2681165170-3229858294-1000\{7CDADBC1-646B-430C-B3D8-963766587168}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2584	2- Samsung 300K Tool.exe
2584	2- Samsung 300K Tool.exe
2584	2- Samsung 300K Tool.exe
2584	2- Samsung 300K Tool.exe
2584	2- Samsung 300K Tool.exe
2584	2- Samsung 300K Tool.exe
2584	2- Samsung 300K Tool.exe
2584	2- Samsung 300K Tool.exe
2584	2- Samsung 300K Tool.exe
2584	2- Samsung 300K Tool.exe
2584	2- Samsung 300K Tool.exe
2584	2- Samsung 300K Tool.exe
2584	2- Samsung 300K Tool.exe
2584	2- Samsung 300K Tool.exe
2584	2- Samsung 300K Tool.exe
2584	2- Samsung 300K Tool.exe
2584	2- Samsung 300K Tool.exe
2584	2- Samsung 300K Tool.exe
2584	2- Samsung 300K Tool.exe
2584	2- Samsung 300K Tool.exe
2584	2- Samsung 300K Tool.exe
2584	2- Samsung 300K Tool.exe
2584	2- Samsung 300K Tool.exe
2584	2- Samsung 300K Tool.exe
2584	2- Samsung 300K Tool.exe
2584	2- Samsung 300K Tool.exe
2584	2- Samsung 300K Tool.exe
2584	2- Samsung 300K Tool.exe
2584	2- Samsung 300K Tool.exe
2584	2- Samsung 300K Tool.exe
2584	2- Samsung 300K Tool.exe
2584	2- Samsung 300K Tool.exe
2584	2- Samsung 300K Tool.exe
2584	2- Samsung 300K Tool.exe
2584	2- Samsung 300K Tool.exe
2584	2- Samsung 300K Tool.exe
2584	2- Samsung 300K Tool.exe
2584	2- Samsung 300K Tool.exe
2584	2- Samsung 300K Tool.exe
2584	2- Samsung 300K Tool.exe
2584	2- Samsung 300K Tool.exe
2584	2- Samsung 300K Tool.exe
2584	2- Samsung 300K Tool.exe
2584	2- Samsung 300K Tool.exe
2584	2- Samsung 300K Tool.exe
2584	2- Samsung 300K Tool.exe
2584	2- Samsung 300K Tool.exe
2584	2- Samsung 300K Tool.exe
2584	2- Samsung 300K Tool.exe
2584	2- Samsung 300K Tool.exe
2584	2- Samsung 300K Tool.exe
2584	2- Samsung 300K Tool.exe
2584	2- Samsung 300K Tool.exe
2584	2- Samsung 300K Tool.exe
2584	2- Samsung 300K Tool.exe
2584	2- Samsung 300K Tool.exe
2584	2- Samsung 300K Tool.exe
2584	2- Samsung 300K Tool.exe
2584	2- Samsung 300K Tool.exe
2584	2- Samsung 300K Tool.exe
2584	2- Samsung 300K Tool.exe
2584	2- Samsung 300K Tool.exe
2584	2- Samsung 300K Tool.exe
2584	2- Samsung 300K Tool.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
808	Process not Found
808	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

pid	Process
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe

Suspicious use of FindShellTrayWindow 41 IoCs

pid	Process
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2584	2- Samsung 300K Tool.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3188 wrote to memory of 5076	3188	msedge.exe	87
PID 3188 wrote to memory of 4192	3188	msedge.exe	89
PID 3188 wrote to memory of 5740	3188	msedge.exe	88
PID 3188 wrote to memory of 4192	3188	msedge.exe	89
PID 3188 wrote to memory of 2480	3188	msedge.exe	90
PID 3188 wrote to memory of 4192	3188	msedge.exe	89
PID 3188 wrote to memory of 2480	3188	msedge.exe	90
PID 3188 wrote to memory of 248	3188	msedge.exe	92
PID 3188 wrote to memory of 248	3188	msedge.exe	92
PID 3188 wrote to memory of 248	3188	msedge.exe	92
PID 3188 wrote to memory of 252	3188	msedge.exe	93
PID 3188 wrote to memory of 252	3188	msedge.exe	93
PID 3188 wrote to memory of 252	3188	msedge.exe	93
PID 3188 wrote to memory of 4628	3188	msedge.exe	95
PID 3188 wrote to memory of 4968	3188	msedge.exe	94
PID 3188 wrote to memory of 4628	3188	msedge.exe	95
PID 3188 wrote to memory of 4628	3188	msedge.exe	95
PID 3188 wrote to memory of 4968	3188	msedge.exe	94
PID 3188 wrote to memory of 4968	3188	msedge.exe	94
PID 3188 wrote to memory of 1944	3188	msedge.exe	97
PID 3188 wrote to memory of 1944	3188	msedge.exe	97
PID 3188 wrote to memory of 1868	3188	msedge.exe	98
PID 3188 wrote to memory of 1868	3188	msedge.exe	98
PID 3188 wrote to memory of 4440	3188	msedge.exe	100
PID 3188 wrote to memory of 460	3188	msedge.exe	103
PID 3188 wrote to memory of 460	3188	msedge.exe	103
PID 3188 wrote to memory of 460	3188	msedge.exe	103
PID 3188 wrote to memory of 4436	3188	msedge.exe	104
PID 3188 wrote to memory of 4436	3188	msedge.exe	104
PID 3188 wrote to memory of 5928	3188	msedge.exe	105
PID 3188 wrote to memory of 5928	3188	msedge.exe	105
PID 3188 wrote to memory of 5928	3188	msedge.exe	105
PID 3188 wrote to memory of 6124	3188	msedge.exe	106
PID 3188 wrote to memory of 5084	3188	msedge.exe	107
PID 3188 wrote to memory of 5084	3188	msedge.exe	107
PID 3188 wrote to memory of 4816	3188	msedge.exe	109
PID 3188 wrote to memory of 2104	3188	msedge.exe	110
PID 3188 wrote to memory of 2576	3188	msedge.exe	111
PID 3188 wrote to memory of 2584	3188	msedge.exe	112
PID 2584 wrote to memory of 4664	2584	2- Samsung 300K Tool.exe	113
PID 3188 wrote to memory of 1916	3188	msedge.exe	114
PID 3188 wrote to memory of 1916	3188	msedge.exe	114
PID 3188 wrote to memory of 1916	3188	msedge.exe	114
PID 3188 wrote to memory of 5900	3188	msedge.exe	115
PID 3188 wrote to memory of 5900	3188	msedge.exe	115
PID 3188 wrote to memory of 5900	3188	msedge.exe	115
PID 3188 wrote to memory of 4936	3188	msedge.exe	116
PID 3188 wrote to memory of 4936	3188	msedge.exe	116
PID 3188 wrote to memory of 4936	3188	msedge.exe	116
PID 3188 wrote to memory of 544	3188	msedge.exe	117
PID 3188 wrote to memory of 544	3188	msedge.exe	117
PID 3188 wrote to memory of 544	3188	msedge.exe	117
PID 3188 wrote to memory of 2824	3188	msedge.exe	118
PID 3188 wrote to memory of 2824	3188	msedge.exe	118
PID 3188 wrote to memory of 2924	3188	msedge.exe	120
PID 3188 wrote to memory of 2924	3188	msedge.exe	120
PID 3188 wrote to memory of 2924	3188	msedge.exe	120
PID 3188 wrote to memory of 4692	3188	msedge.exe	121
PID 3188 wrote to memory of 4692	3188	msedge.exe	121
PID 3188 wrote to memory of 4692	3188	msedge.exe	121
PID 3188 wrote to memory of 5656	3188	msedge.exe	122
PID 3188 wrote to memory of 1720	3188	msedge.exe	123
PID 3188 wrote to memory of 5656	3188	msedge.exe	122
PID 3188 wrote to memory of 5656	3188	msedge.exe	122

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://disk.yandex.com.tr/d/QI19y4a98I6DpQ
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2c0,0x7fff2822c188,0x7fff2822c194,0x7fff2822c1a0
  2⤵
  PID:5076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1852,i,10868101822531820737,17867731754380857064,524288 --field-trial-handle=2100,i,17480961343005700006,11466873653550962457,262144 --variations-seed-version --mojo-platform-channel-handle=3112 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:5740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1552,i,1377294648027036493,14501610224422737801,262144 --field-trial-handle=2100,i,17480961343005700006,11466873653550962457,262144 --variations-seed-version --mojo-platform-channel-handle=2092 /prefetch:2
  2⤵
  PID:4192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2232,i,13683558240465725864,8411204604523676109,524288 --field-trial-handle=2100,i,17480961343005700006,11466873653550962457,262144 --variations-seed-version --mojo-platform-channel-handle=3236 /prefetch:13
  2⤵
  PID:2480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3652,i,8206918719245031993,5920017799279625447,2097152 --field-trial-handle=2100,i,17480961343005700006,11466873653550962457,262144 --variations-seed-version --mojo-platform-channel-handle=3704 /prefetch:1
  2⤵
  PID:248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3656,i,7515220685955457918,9320935903884609109,2097152 --field-trial-handle=2100,i,17480961343005700006,11466873653550962457,262144 --variations-seed-version --mojo-platform-channel-handle=3712 /prefetch:1
  2⤵
  PID:252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4292,i,11399840840388072906,11169539564951682184,2097152 --field-trial-handle=2100,i,17480961343005700006,11466873653550962457,262144 --variations-seed-version --mojo-platform-channel-handle=4884 /prefetch:1
  2⤵
  PID:4968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4296,i,7553563531083422039,6240949791442081841,2097152 --field-trial-handle=2100,i,17480961343005700006,11466873653550962457,262144 --variations-seed-version --mojo-platform-channel-handle=4888 /prefetch:9
  2⤵
  PID:4628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5392,i,7795040019424623810,5970218713104844395,524288 --field-trial-handle=2100,i,17480961343005700006,11466873653550962457,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:14
  2⤵
  PID:1944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5396,i,2199924246791455176,4855105002089597084,524288 --field-trial-handle=2100,i,17480961343005700006,11466873653550962457,262144 --variations-seed-version --mojo-platform-channel-handle=5492 /prefetch:14
  2⤵
  PID:1868
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5984,i,18027833288754123442,16857784099096912043,524288 --field-trial-handle=2100,i,17480961343005700006,11466873653550962457,262144 --variations-seed-version --mojo-platform-channel-handle=6000 /prefetch:14
  2⤵
  PID:4840
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5984,i,18027833288754123442,16857784099096912043,524288 --field-trial-handle=2100,i,17480961343005700006,11466873653550962457,262144 --variations-seed-version --mojo-platform-channel-handle=6000 /prefetch:14
  2⤵
  PID:4440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6556,i,11705463422047433942,5932977796833222961,2097152 --field-trial-handle=2100,i,17480961343005700006,11466873653550962457,262144 --variations-seed-version --mojo-platform-channel-handle=6632 /prefetch:1
  2⤵
  PID:460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6724,i,12468540116567204152,3348470179288509034,524288 --field-trial-handle=2100,i,17480961343005700006,11466873653550962457,262144 --variations-seed-version --mojo-platform-channel-handle=5008 /prefetch:14
  2⤵
  PID:4436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=5088,i,16198439002429726352,10903745397796178922,2097152 --field-trial-handle=2100,i,17480961343005700006,11466873653550962457,262144 --variations-seed-version --mojo-platform-channel-handle=6040 /prefetch:1
  2⤵
  PID:5928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5024,i,14413174066526469281,10921231872333788166,524288 --field-trial-handle=2100,i,17480961343005700006,11466873653550962457,262144 --variations-seed-version --mojo-platform-channel-handle=6876 /prefetch:14
  2⤵
  PID:6124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7248,i,11234403229345044752,3907236902927085353,524288 --field-trial-handle=2100,i,17480961343005700006,11466873653550962457,262144 --variations-seed-version --mojo-platform-channel-handle=7260 /prefetch:14
  2⤵
  PID:5084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7112,i,16495935775713025452,11499652151346001508,524288 --field-trial-handle=2100,i,17480961343005700006,11466873653550962457,262144 --variations-seed-version --mojo-platform-channel-handle=5024 /prefetch:14
  2⤵
  PID:4816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5040,i,1130718944201246553,17847936311056438339,524288 --field-trial-handle=2100,i,17480961343005700006,11466873653550962457,262144 --variations-seed-version --mojo-platform-channel-handle=600 /prefetch:14
  2⤵
  PID:2104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7088,i,8693250740583854834,13520126524509904485,524288 --field-trial-handle=2100,i,17480961343005700006,11466873653550962457,262144 --variations-seed-version --mojo-platform-channel-handle=7224 /prefetch:14
  2⤵
  PID:2576
- C:\Users\Admin\Downloads\2- Samsung 300K Tool.exe
  "C:\Users\Admin\Downloads\2- Samsung 300K Tool.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2584
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://forum.gsmhosting.com/vbb/
    3⤵
    PID:4664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=5008,i,8078290111800666643,8292127104651108120,2097152 --field-trial-handle=2100,i,17480961343005700006,11466873653550962457,262144 --variations-seed-version --mojo-platform-channel-handle=5544 /prefetch:1
  2⤵
  PID:1916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6600,i,619629320139779066,7002082029543526775,2097152 --field-trial-handle=2100,i,17480961343005700006,11466873653550962457,262144 --variations-seed-version --mojo-platform-channel-handle=3800 /prefetch:1
  2⤵
  PID:5900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6876,i,3985926171041836510,8220310976079001144,2097152 --field-trial-handle=2100,i,17480961343005700006,11466873653550962457,262144 --variations-seed-version --mojo-platform-channel-handle=6680 /prefetch:1
  2⤵
  PID:4936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=6992,i,17390034931989526223,2414299684320507499,2097152 --field-trial-handle=2100,i,17480961343005700006,11466873653550962457,262144 --variations-seed-version --mojo-platform-channel-handle=6996 /prefetch:1
  2⤵
  PID:544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5492,i,12984044363897074515,13663471883149185005,524288 --field-trial-handle=2100,i,17480961343005700006,11466873653550962457,262144 --variations-seed-version --mojo-platform-channel-handle=5740 /prefetch:14
  2⤵
  PID:2824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=7788,i,7311163319033045909,5838476756423767425,2097152 --field-trial-handle=2100,i,17480961343005700006,11466873653550962457,262144 --variations-seed-version --mojo-platform-channel-handle=7784 /prefetch:1
  2⤵
  PID:2924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=6284,i,9281285740542785045,16112767096891164111,2097152 --field-trial-handle=2100,i,17480961343005700006,11466873653550962457,262144 --variations-seed-version --mojo-platform-channel-handle=6300 /prefetch:1
  2⤵
  PID:4692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=816,i,10119574333156257454,15886632548449553278,2097152 --field-trial-handle=2100,i,17480961343005700006,11466873653550962457,262144 --variations-seed-version --mojo-platform-channel-handle=6612 /prefetch:1
  2⤵
  PID:5656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=7820,i,14223191614993713097,14335471291081568793,2097152 --field-trial-handle=2100,i,17480961343005700006,11466873653550962457,262144 --variations-seed-version --mojo-platform-channel-handle=5524 /prefetch:1
  2⤵
  PID:1720

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1272

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3040

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Phishing

T1566

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f8dff5315a0bd3856381f405c1a16257337fd6ff2d8043dd8bea22404cd35129
MD5 5e53a2cd139f0cce4f8ceab3e015f7da
SHA1 1bd884dbaaa352a724c53bfb8f4bfad2623c93f5
SHA512 27cc4cb62f9aa4af6b521efd824b001f3b689bae2ffe57263da18e2bb22d0b13ba656141d7e6ea1d1c202d5f461a44243a00d604f78bd5b04fe6b8512e260ac1
TLSH
T178D02B1463108D04D441F13214D13311B1110833A80C96440050E1284CB634206738DD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1f3bc43c50f7d0fa02f98500baf5d78052a5560603459a9325b17de989d121f4
MD5 46a6445fd2c83830bb8c6e03f85bafc0
SHA1 46b07e35efbd47692fdc81ef0e82e2964da2831b
SHA512 800f82b05756fd6fab3fe29924147f0b86afeec21da661e646b431c6ca03903eb45bb09803f5cdaf3d2d1bb16f95d0f2e53a1f9ddde57505b0f3e1580c384ed1
TLSH
T188D02B1063208C04D441F13214D23311B1010833540C96440150E1384CB634206728CD
MD5 SHA1 SHA512 TLSH

Submit Download

60fdea80-e67d-478c-9b75-86e62b8415f1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\60fdea80-e67d-478c-9b75-86e62b8415f1.tmp
Size 14KB
SHA256 1c547f8771cbf44bc44cef818cff2301685095908d108501160eb5c0874f9b90
MD5 bfedcf81d830ad6d78ca5bb866cecb75
SHA1 e236c0cafda4b72cff5fe4b57d85d302c0ee0251
SHA512 2d557e9f0cdfd288aa306fa5e1c5b858f65d6052d90f03884e803e7d93c0436b0c0d3212ca01b2828dd495cd6697769ce3e1b910e2f5813ebd7e0b14966a40d2
SSDEEP 192:sxRLRGyM/jK1Ml8wbz/fu+sNH27Dde5lSUzoD8psU/g6+WND1l/YCtuO4GIIgmOJ:sxRLwlz/fVsg7c5l7x/5P/94ma
TLSH
T1BD62D9165A249D7BCCDBD20DFA517F93D6F81573A2901E48AAFC8A0C04E6BDD221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00004f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00004f
Size 69KB
SHA256 7897789a62c7e3bf48f97aa9367789b744ca015cbb45f87328f3df32678fadaf
MD5 5b43a5b179a105c475f6f6abc37c06e1
SHA1 f17b36d0457f74e7f9b09c0cd0d5c82e656ca632
SHA512 c5afeca82c3060bb9a236eeb9ee4d969f617738f5abb81edc9b887729c635e0b0a923fe709efe74ff63b12baf84e6bf447b2a6dda5d5afbd1827f2c55669407a
SSDEEP 1536:a88RSXXv4SnPTFGWXTPQZw4jczWPC09xIY99v:9Jw2pG4TkdaG99v
TLSH
T15863013705067B1997D9981E1A91AEC3F7637035307AC4BB3258844EF222F8AF917F69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 b0874e36de84cf61450617c8a4f93673501b765869920f228d2ac872884c7c87
MD5 9023e368ab312e4c8b07cc6940449e40
SHA1 eac9ae019efd95d8b9e02af2fe4524626d5f3296
SHA512 5c0009a3a93a4e8c4a401019e4b7712813086386f388769de62bd5c5c4aee2d8e982892a47decac984a686d95ee614f46821a97e8e1da9a386547cfc4366ce46
TLSH
T12F617342172279C2E33554F287E494C5B3F9B7EA490B5EEE120D1D7A4A0EF8490C803F
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 e437ef7cf47b2d92cb87ced2fe019aa6857eec399de6b80a3246fbafe15ebbd5
MD5 5a795d7dbf617a2e076e676d308300a9
SHA1 9d50f8303f0fcd972a0737f81311006066e357da
SHA512 d07c04fe32281713d58e1e030459165a2384514be6851e741303b2e0552ee9aea34fb8e05e34ad31c6ef00b86b3a7ac0980609e6afc036b575bb0048ac76e632
TLSH
T1EC719742176279C2E72461F296E4A4D5B3F9B7EB490B5EFE160C1D7A8A4EF8440C843F
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59fb5e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59fb5e.TMP
Size 2KB
SHA256 9aa1216a5222208c33fae3703b994a3ffeed8b27cf24308732f919e0624a9fcd
MD5 c227cc5c42aed0ab2289c1a02082d749
SHA1 c4cb155edd7c34f5ee3100015f06bc6a05965c80
SHA512 7713d37be03a533d64390d027422de34ebbfd5a4e61375e913ec388f13e16950b4b6a8676676faf365b17cb11246aaefa94c86607f8ed9919157ee1970f9e34c
TLSH
T10C51528203263AC1E77954F29BE844C8B7F9B3A9080B5EFA120C1C7A4E4EF4490C812F
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 c23af7552ea077f0e1a00fa2f2089aa087b84e8075cb9c6ad02a23c99c3ca9c7
MD5 9438af8c468ec5997b27c3ff06d0e603
SHA1 73895c649a66a98fe87a34fd6163208172b754f7
SHA512 ac4f3746cd544332fe252488c90af7766cd1a26aad39ceb6ed4685ad5f6236d32d1c5542bcef361818943e2b4c26f933e6ef88941e1c5db584bfd63a1bb1c22b
SSDEEP 96:DsDGa91WiNjhiziGwBpRpopwpzpppTpnpENat:DsDGa91WiNjhiGGkpRpopwpzpppTpnpv
TLSH
T1C8918BF383F4DA6D890256F0AB146E2BCE190924932C3C6AC9E4FF5B97E2472D14564E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 f050af67ad002178bf3dcbffa5b254443d19b9b3714597317b4af73d9367ea2a
MD5 e495f60841513b9d662205662cc3f1ae
SHA1 5e1ede5511cf94f4f79051ca82bc3a84d618e1e2
SHA512 bd4238ba2d6d6b9255923e679f425694092c1a8baeec1f7662f4ce63c70665f81125fc8bc7de1d1d0903aa32ba60f95c803e6c35703876d74904cf993c793458
SSDEEP 192:sxRkRGyM/jK1Ml8wOz/fu+swH2YDde5lSUzoD8pFzU/g6+WND1l/YCGuO4GIIgDE:sxRkwIz/fVs3Yc5l76/5P/I4kh
TLSH
T15462B716AA245D7BDCDBD20DFA417F93D6F85173A2901E44AAFC8A0C04E67DD221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 b116e403fde2e91f25086ece1be6c2d0f026cb29e084ac40bac3a701dfc47f1e
MD5 0c8d7ce76e018ad4b3e10415bb763e6f
SHA1 3fb34702d024ed85e795bef9cd215a72ea85e3d2
SHA512 d8b09e65f38e1209a6df99e4417549d3a0d4c5b1775835cd774dfd5f5b41fecdeb6292e20c761a8a3a10d858ebf3e369562b4861573e12bc505a32af0286be99
SSDEEP 192:sxRkRGyM/jK1Ml8wbz/fu+swH27Dde5lSUzoD8pFzU/g6+WND1l/YCtuO4GIIgDO:sxRkwlz/fVs37c5l76/5P/94Kh
TLSH
T12362C8166A245D7BCCDBD20DFA417F93D6F81573A2901E44AAFC8A0C04E67ED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 d5177b963c0c55eb6c75fc7811d2bb5b47f780656bcb65163b74113116df5eae
MD5 a1336970a656be38344de83b46c82ec7
SHA1 e1eae08219c00d1dc6d5cebc5900e2257bae13b0
SHA512 6c47dd682ec0e92cf722847f1de58a9fcbe55da686144e8b712353d71bd083bffd6c9f5d9646bb4e2ba83d69eb450fa0954d7ca8cf89501f820b2cbc0154e709
SSDEEP 768:j/8vrQWgQ+fB+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVCQqqmrovZ:j/8vrQWgQ+fB+u1ja3Vqdh
TLSH
T18AC2EC3B640CCB7E4F844EADEC29BED66DD801CF5B588D5447EA890C03C67EB521A4DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 ad98adb52f9e4b0cf04ad1f0c7e5616c791fba33fad07f726ffa89b9435e387b
MD5 0bc4b0fd1ad3324b4e722cc71cf7b2dd
SHA1 b275e5f45c2694e87a3cbfb066a51925c68889d9
SHA512 c4b274712cc18cf78a42932320f06ad2e002ad7eaad9d5a74ca06bbfc261f3d5e4fa6bedd55de0d3bd9230a6abe66b93c1ed173290d53d57c70cf85885de9cdc
TLSH
T1B8A0022401CE3452C4211774615E39C4375448510D3242776C92A5A9CCE52909141111
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59bd7a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59bd7a.TMP
Size 48B
SHA256 9a61e61bb508741965ffdac3ceaa1f2f3eb19a05d6168d760313c1cdb6ad2624
MD5 da1b8a224d9ca1d8f27e9e2cdd156718
SHA1 6c4eb21a8ecc8a7a3be2444eeb051ebb31b18996
SHA512 97005b1d966f0caf62826f013c3dc47e91012a7c4fdfe0151fa3b9630533645ed91e7cc9163d87fc17ac1f283f2e611c12fbacd1475d03124abfe56322cfdaf9
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 fc32360dd47560d2a56d05eb62ff1e821b2eec52c8b55a211af36402a1ec93a3
MD5 c844d236e66fa27774083ff87573e43f
SHA1 20c1a5737c7f5b06359d0dba27700370481f8aa1
SHA512 6dbd642dbc21aec1491b75008e93af5de7648fee162523bf64ad00aec97ef52ec7522d2e3f67833c055c729fe4254f01d386502a0ba06cb6c2ebe6559c088eb3
SSDEEP 96:KRbEBVj5J1WdSIg91K4EgT1c7j6dJOHuDSOowg2Ww19gO2K4TgM2cmut8un6KwKM:CbEBVj5JAdSp9/EgTK7j6dJOHuDSOowR
TLSH
T186911E01713A1285387E6A08D0B9892A86C274737419FA6F3BED45A60F37F479DFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a345f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a345f.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 81bac27cc2fab82b144172d098f47a8059a7a31e1fded2464c6259d6642ad9ff
MD5 5390c3a98286345c84290835ca5fc9c0
SHA1 d7d3a485f316537dae379c2b7f5f079b56e7915a
SHA512 055a921acef6b061acbb88d1febfa6dc8ca26e37c9d9bdfea1646a79c53cf7a535fc514316da6841872252e3851ddfdf34a14f4d0d8e07424c1acecaebf7a3bf
SSDEEP 768:Xj+973EPJgXSrp8+p3bd66j+4BRv86aLIWKb9Mcl:a973tSN8+p3Z6n4ygb+e
TLSH
T1B2F2AF32EC959E734CE6C689B2563B43AFF411A796C01EC8D4DC6F0E05DB2AD570782A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 62eae7681bd6c506a4271923137e146905e34dea01f7977da2ed957dead2bae7
MD5 a6f94cf5e9d160e9df393e1201ff58ed
SHA1 56d151e5f882d8d02e99b72845f93a85de0096e9
SHA512 b57adcb07fbf56736bb33cc35e908a69f97c0da8c95d21e63188df45559cf55443828d6be4ecb99b10912395a15b699f94f22a94e2a73ca2d2cd23ff03f5987f
SSDEEP 768:WFDj+973MwgEPqXaGp8+p3bd66j+4BRv86aLIWKb9Mcl:b973aaw8+p3Z6n4ygb+e
TLSH
T124039E33EC99CA779CE6CB89B25A3643AFF411A786C05D98D6CC6F0D019B1AD4307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 041df771e5778af0f21c379d5fcd73e9c9ff95663d9f2c2f2ecf0d034cf58b7d
MD5 755869de2aede49f5f29bbe14ef47b48
SHA1 d8be3518fc92628429f3634633909b289fab4087
SHA512 2615ee4fd63044fea542b3e1b111576199e19aab0a88a28f1cce6d6602cfaccd3f7d8d0329110c2ee6e2e166d0c4ff674b14d8a39707317d4c367dcd349acab7
SSDEEP 768:Fj+9B3uPJgXSrp8+p3bd66j+4BRv86aLIWKb9Mcl:w9B3vSN8+p3Z6n4ygb+e
TLSH
T102F2BF32EC999E734CE6C688B2563643AFF411A792C01EC8D4DC6F0E05DB2AD570782A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 58cfc67b52a87736c3ba2ec8260184a0ae1b858176b244123b37b339cdc6ba4a
MD5 036491a36b0c1969b11dd7fbf1e94c04
SHA1 7dbc98b1bb32661a7f48d44080384ac2242b26bc
SHA512 3c0f4269d78d0fbe1c170e1100b40e08f6a8b977b463474b93323e362b7488d14f89045a457ce9437cbedc661d90c4771cc33bad713bcea4dff5238449829311
SSDEEP 768:Kj+973xPJgXSrp8+p3bd66j+4BRv86aLIWKb9Mcl:p9736SN8+p3Z6n4ygb+e
TLSH
T1E6F2AF32EC959E734CE6C689B2563743AFF411A796C01EC8D4DC6F0D05DB2AD570782A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 c17279927066b286aa3cb20fb645710c94bb944f4a6fb0737c0bbf1f61632ac9
MD5 cc1dbd788c96ec9ae2d82e0ddb8d5a70
SHA1 155679bf55107bf8d400b4e6884809769c0f1be0
SHA512 0df4d0f5895fd7d8dc3c12bf44bb915ff98e93ae08207bb94dd80c724c8ff7568664c7f7d43b523a83dfe3e31a5970488f15f4476a7207286239684a1be4124b
SSDEEP 768:Irv+4UNbdD3iccNp8+p3bd66j+4BRv86aLIiw2bwCl1:Ibsbp3CL8+p3Z6n4yG0ww
TLSH
T10E03CE73F8A899739CE6C644B2467A437FF811A3A6C00EC4D5DD2B4E419A19E630BC37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 0a37f5422a856af795d2ad6e82fafaf4894e2de2fb4ae2720dde62bbb988d512
MD5 93f39fc38ab6e77e82c6f682235e7402
SHA1 2858d9675d3f7f97cb38ffabbb612b61075655be
SHA512 fa71cc0efbe38ec9aa65dff2c4df5702276f8ed7cab6298f12fe95317c577af08f1db04dfead99a0e7819924703b463e65281dfd122714db079ffc753d6035ef
SSDEEP 768:Krv+4UNbdN3WPuXSKp8+p3bd66j+4BRv86aLIWKpc:Kbsbf33S08+p3Z6n4ygO
TLSH
T15003BE32F8A8D9739CF6C648B1563A437FF8109396C01ED8D5DC6B4E019B19E170B927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 3988ed32c0357384fe8ff3a4913a0a1e89bc75e24dcb54d786017eaa8ec5f18d
MD5 5501d23aa5a3de9540d0816dfcbdbd38
SHA1 a6e99c283523de4c4df12588e07bd38ea16b1ab2
SHA512 3c59d8249c0120dff7db73034017168e95bc7a2de7a7a36703bad55cd01c8e9874ffbca5cfdc31e3dca3ec97319d28d415ac207ddd5f3320d89e68badb995ba1
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 8828182347482dbbe48ed2a826f526353cee468c5f501f036ff0f000c31dc75e
MD5 d1d53dd9d589b24e46d5e3671273bee8
SHA1 3a3543a256ef4e1eae1f02bebe53faf1898b1e92
SHA512 9dd7e6bdbb58648794d22627a90b942e6b336a5fefe19fd8e9493f3c2a6a98962750e3316dc41014dd55a76bbf18682d20bb726bfeb20517887a381c43ac1b92
TLSH
T121E001029200405AC034433004C71F203EE5901206A3020A5731027C2C363003A10A80
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe5a3143.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5a3143.TMP
Size 392B
SHA256 452564ecbe9a2a0597383380a609ad1b6353502c7ffec84aaa43c8c208d446ac
MD5 29ad9025888f071569b193599a0a10e1
SHA1 3acd51d2ff1a203f769abb4be2944a6d1ad80b8a
SHA512 2b9e689b247aa433d3415f8b3abefb7552f09524b2421462aa085d1f353b865c9704e50ab636634bf2c7d8d20f4b8b11fe45425a13963463dfaa6070f56d027b
MD5 SHA1 SHA512

Submit Download

6ef4c2ce-141c-44bf-9b43-0f26246ecf34.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\6ef4c2ce-141c-44bf-9b43-0f26246ecf34.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

2- Samsung 300K Tool.exe.crdownload

Path C:\Users\Admin\Downloads\2- Samsung 300K Tool.exe.crdownload
Size 661KB
SHA256 53b59f77d730c0d20539f72b85767609f809a690b1b493eeda1eb9ccd1ed816a
MD5 cf71b9d21035ae67513fa11726483a2b
SHA1 500baec57fdaf6137801b28e37bcbf42159d87f6
SHA512 4bdb8d6682108c5c00d5932157ed0bcbab3e76ab9abb6a23f36fc89eb9ce4290e4890c15b934b3262116e26063cebac517dd00ebc69461be02000f8195244d54
SSDEEP 12288:MtaPfM5taOqOiy5Q7FRq3RGXRaQCToldp8iPxoyO6sOP+h6:eaPfM5kWiya7Fs3Ua903p8iqosOm6
TLSH
T131E423274BF514CBC89017368A90B2655B84DDDAE57A6BAE884EB10F8C9F3472F0C6D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2584-502-0x0000000000400000-0x000000000069F000-memory.dmp

Download

memory/2584-433-0x0000000000400000-0x000000000069F000-memory.dmp

Download

memory/2584-407-0x0000000000400000-0x000000000069F000-memory.dmp

Download

memory/2584-562-0x0000000000400000-0x000000000069F000-memory.dmp

Download

memory/2584-579-0x0000000000400000-0x000000000069F000-memory.dmp

Download

memory/2584-589-0x0000000000400000-0x000000000069F000-memory.dmp

Download