hxxps://github[.]com/dcm1-6626/T-1million/raw/refs/heads/main/t1[.]zip

Analysis

user interaction
yes
max time kernel
141s
max time network
135s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
13/07/2026, 15:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://github.com/dcm1-6626/T-1million/raw/refs/heads/main/t1.zip
Sample260713-sr3l9sbs8k

Score

6^/10

discovery ransomware

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 7 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
21	raw.githubusercontent.com
22	raw.githubusercontent.com
23	raw.githubusercontent.com
67	raw.githubusercontent.com
68	raw.githubusercontent.com
69	raw.githubusercontent.com
70	raw.githubusercontent.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5892	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134284297540324152"	msedge.exe

Modifies registry class 38 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\MRUListEx = 00000000ffffffff	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\MRUListEx = ffffffff	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 0100000000000000ffffffff	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\NodeSlot = "6"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	OpenWith.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-226940941-599731907-2645636698-1000\{D0FEA08F-873B-41A4-BDB4-2F89530CCD1A}	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1 = 19002f433a5c000000000000000000000000000000000000000000	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0 = 8c00310000000000ae5c0228110050524f4752417e310000740009000400efbec5525961ae5c02282e0000003f0000000000010000000000000000004a0000000000449f2f00500072006f006700720061006d002000460069006c0065007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100370038003100000018000000	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202020202	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\SniffedFolderType = "Generic"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	OpenWith.exe

NTFS ADS 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\t1.zip:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\t2.zip:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\t3.zip:Zone.Identifier	msedge.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
5248	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4308	msedge.exe
4308	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe

Suspicious use of FindShellTrayWindow 58 IoCs

pid	Process
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe

Suspicious use of SetWindowsHookEx 13 IoCs

pid	Process
2700	OpenWith.exe
2076	OpenWith.exe
2076	OpenWith.exe
2076	OpenWith.exe
2076	OpenWith.exe
2076	OpenWith.exe
2076	OpenWith.exe
2076	OpenWith.exe
2076	OpenWith.exe
2076	OpenWith.exe
2076	OpenWith.exe
2076	OpenWith.exe
2076	OpenWith.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 1244 wrote to memory of 4392	1244	msedge.exe	80
PID 1244 wrote to memory of 5892	1244	msedge.exe	81
PID 1244 wrote to memory of 664	1244	msedge.exe	82
PID 1244 wrote to memory of 664	1244	msedge.exe	82
PID 1244 wrote to memory of 664	1244	msedge.exe	82
PID 1244 wrote to memory of 4540	1244	msedge.exe	83
PID 1244 wrote to memory of 4540	1244	msedge.exe	83
PID 1244 wrote to memory of 652	1244	msedge.exe	85
PID 1244 wrote to memory of 652	1244	msedge.exe	85
PID 1244 wrote to memory of 652	1244	msedge.exe	85
PID 1244 wrote to memory of 5200	1244	msedge.exe	86
PID 1244 wrote to memory of 5200	1244	msedge.exe	86
PID 1244 wrote to memory of 5200	1244	msedge.exe	86
PID 1244 wrote to memory of 5800	1244	msedge.exe	88
PID 1244 wrote to memory of 5460	1244	msedge.exe	89
PID 1244 wrote to memory of 5800	1244	msedge.exe	88
PID 1244 wrote to memory of 5460	1244	msedge.exe	89
PID 1244 wrote to memory of 2344	1244	msedge.exe	90
PID 1244 wrote to memory of 404	1244	msedge.exe	91
PID 1244 wrote to memory of 2344	1244	msedge.exe	90
PID 1244 wrote to memory of 404	1244	msedge.exe	91
PID 1244 wrote to memory of 404	1244	msedge.exe	91
PID 1244 wrote to memory of 2372	1244	msedge.exe	93
PID 1244 wrote to memory of 1660	1244	msedge.exe	94
PID 1244 wrote to memory of 2196	1244	msedge.exe	96
PID 2372 wrote to memory of 5912	2372	msedge.exe	97
PID 1244 wrote to memory of 4592	1244	msedge.exe	99
PID 1244 wrote to memory of 4592	1244	msedge.exe	99
PID 1244 wrote to memory of 4592	1244	msedge.exe	99
PID 1244 wrote to memory of 2424	1244	msedge.exe	100
PID 1244 wrote to memory of 3012	1244	msedge.exe	101
PID 1244 wrote to memory of 3012	1244	msedge.exe	101
PID 1244 wrote to memory of 3012	1244	msedge.exe	101
PID 1244 wrote to memory of 2292	1244	msedge.exe	103
PID 1244 wrote to memory of 5700	1244	msedge.exe	105
PID 1244 wrote to memory of 4712	1244	msedge.exe	106
PID 1244 wrote to memory of 1160	1244	msedge.exe	107
PID 1244 wrote to memory of 5432	1244	msedge.exe	112
PID 1244 wrote to memory of 5432	1244	msedge.exe	112
PID 1244 wrote to memory of 4308	1244	msedge.exe	124

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/dcm1-6626/T-1million/raw/refs/heads/main/t1.zip
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x1ac,0x24c,0x7ffc182ac188,0x7ffc182ac194,0x7ffc182ac1a0
  2⤵
  PID:4392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1732,i,11199859817380546129,18286621989250706166,524288 --field-trial-handle=2184,i,12659288185794140338,11571980357659646374,262144 --variations-seed-version --mojo-platform-channel-handle=2220 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1580,i,11551646188450270469,25335313725002377,262144 --field-trial-handle=2184,i,12659288185794140338,11571980357659646374,262144 --variations-seed-version --mojo-platform-channel-handle=2180 /prefetch:2
  2⤵
  PID:664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2476,i,11597637079820793760,2152233481642430263,524288 --field-trial-handle=2184,i,12659288185794140338,11571980357659646374,262144 --variations-seed-version --mojo-platform-channel-handle=2504 /prefetch:13
  2⤵
  PID:4540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3484,i,12560886588718087085,15328909711992237734,2097152 --field-trial-handle=2184,i,12659288185794140338,11571980357659646374,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3500,i,15170543424334251936,11607448900137896008,2097152 --field-trial-handle=2184,i,12659288185794140338,11571980357659646374,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:5200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4992,i,4348072590560949880,14114513286968161085,524288 --field-trial-handle=2184,i,12659288185794140338,11571980357659646374,262144 --variations-seed-version --mojo-platform-channel-handle=5032 /prefetch:14
  2⤵
  PID:5800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4996,i,13229200832007139004,5726481331756251896,524288 --field-trial-handle=2184,i,12659288185794140338,11571980357659646374,262144 --variations-seed-version --mojo-platform-channel-handle=5052 /prefetch:14
  2⤵
  PID:5460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5428,i,6466031065968986919,1712325292156864897,524288 --field-trial-handle=2184,i,12659288185794140338,11571980357659646374,262144 --variations-seed-version --mojo-platform-channel-handle=5484 /prefetch:14
  2⤵
  PID:2344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5452,i,12949375696395148678,966594932768203323,2097152 --field-trial-handle=2184,i,12659288185794140338,11571980357659646374,262144 --variations-seed-version --mojo-platform-channel-handle=5504 /prefetch:1
  2⤵
  PID:404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6268,i,14846687867366361914,29385135847419270,524288 --field-trial-handle=2184,i,12659288185794140338,11571980357659646374,262144 --variations-seed-version --mojo-platform-channel-handle=6284 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2372
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1140
    3⤵
    PID:5912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6308,i,6273578383694954483,4215954292289189202,524288 --field-trial-handle=2184,i,12659288185794140338,11571980357659646374,262144 --variations-seed-version --mojo-platform-channel-handle=6380 /prefetch:14
  2⤵
  - NTFS ADS
  PID:1660
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6272,i,8077891735716817894,9382074242405162094,524288 --field-trial-handle=2184,i,12659288185794140338,11571980357659646374,262144 --variations-seed-version --mojo-platform-channel-handle=6396 /prefetch:14
  2⤵
  PID:5680
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6272,i,8077891735716817894,9382074242405162094,524288 --field-trial-handle=2184,i,12659288185794140338,11571980357659646374,262144 --variations-seed-version --mojo-platform-channel-handle=6396 /prefetch:14
  2⤵
  PID:2196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6832,i,6238961402158754082,8379406399684994478,2097152 --field-trial-handle=2184,i,12659288185794140338,11571980357659646374,262144 --variations-seed-version --mojo-platform-channel-handle=6396 /prefetch:1
  2⤵
  PID:4592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6392,i,2197024947965646204,14858185670540586904,524288 --field-trial-handle=2184,i,12659288185794140338,11571980357659646374,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:14
  2⤵
  - NTFS ADS
  PID:2424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=5544,i,8541448292607547055,8792445636894938712,2097152 --field-trial-handle=2184,i,12659288185794140338,11571980357659646374,262144 --variations-seed-version --mojo-platform-channel-handle=5736 /prefetch:1
  2⤵
  PID:3012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5788,i,4188663603243886327,14110350028639923034,524288 --field-trial-handle=2184,i,12659288185794140338,11571980357659646374,262144 --variations-seed-version --mojo-platform-channel-handle=6844 /prefetch:14
  2⤵
  - NTFS ADS
  PID:2292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=788,i,13561580399757440957,10490133719227537612,524288 --field-trial-handle=2184,i,12659288185794140338,11571980357659646374,262144 --variations-seed-version --mojo-platform-channel-handle=6936 /prefetch:14
  2⤵
  PID:5700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=784,i,8532206899904755706,4845112914751077731,524288 --field-trial-handle=2184,i,12659288185794140338,11571980357659646374,262144 --variations-seed-version --mojo-platform-channel-handle=6968 /prefetch:14
  2⤵
  PID:4712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6948,i,16407417355958676852,12782994642467336070,524288 --field-trial-handle=2184,i,12659288185794140338,11571980357659646374,262144 --variations-seed-version --mojo-platform-channel-handle=6788 /prefetch:14
  2⤵
  PID:1160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5204,i,13594480027365246525,4316168418668096936,524288 --field-trial-handle=2184,i,12659288185794140338,11571980357659646374,262144 --variations-seed-version --mojo-platform-channel-handle=5624 /prefetch:14
  2⤵
  PID:5432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6208,i,13495353329793678416,13271329528182414970,262144 --field-trial-handle=2184,i,12659288185794140338,11571980357659646374,262144 --variations-seed-version --mojo-platform-channel-handle=6936 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4308

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:784

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2524

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:464

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2700

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2076

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\t1\Lib\token.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:5248

C:\Users\Admin\Downloads\t1\python.exe
"C:\Users\Admin\Downloads\t1\python.exe"
1⤵
PID:4640

C:\Users\Admin\Downloads\t2\python.exe
"C:\Users\Admin\Downloads\t2\python.exe"
1⤵
PID:5804

C:\Users\Admin\Downloads\t3\python.exe
"C:\Users\Admin\Downloads\t3\python.exe"
1⤵
PID:1080

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c17dc8315075bb661bddf6b1efa879b9a3c39af13982f986bd287f5bc861cbdf
MD5 9573474710d1de6302a0d98890d2faae
SHA1 618b9f2079a97625be399f6137e46655659ecff9
SHA512 a345b915a4191d30d0da665ea4f78297c0cd671a5767e05c415403efb649110868fb279d22dc496792452c325e19b00f5e579f6e014a4488c9a4d6fac83d1c46
TLSH
T118D012273B0DB054E7A9C2729613C7921BB6646174434B01E315C95C99B54D412D6183
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7b9dac8593d827b7b825086ba5eeec776b808b8429eb90a6b645c319ec8f1435
MD5 c16a98ebe36bda7f5aece00f9ac1d0d0
SHA1 ef2e2a8775d1ebc0124f0ba983b6f20777919000
SHA512 148affd9dbe6aaee9070c22e41bc916df527cec5741753ca2733855f500e4eef0a257445d281d79c2449f8265c41b54dd53ffe57650802594b1211b0db611349
TLSH
T1ADD012273B0DA054E7A9C2729613C7921BB6646174434B01E315C95C99B54D412D6183
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 76104c15ea978e45329eba0025a8f8fc09468812a7c77e7ff6cb68548ee18052
MD5 8304bfa88a928b9e17aa6799a6d4b643
SHA1 fe8ebec794ca5b02f627ad103b6734ab69992fa7
SHA512 8451d4e4b3b629050cacc2c2b4b32d987b7b94af5bd66c66c0bfcbe374fa3a0c53ddafdb71f327b52db6c0650f987f72cb6afe87327bb95cd66ee764dd3d80ff
TLSH
T198E02BAACC619C3B18FE171850605786F70417575B428A0F3B3CC50D8FB463B4645C5C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 6KB
SHA256 3427b4ba40f34ffa97d1e6afa033e1eb2edf1aeb7a4a9090c37a74087777c96f
MD5 e6c968439abce2ab8f81b6327a351d56
SHA1 a9ff00691be7e04775144c8c10504215803120f2
SHA512 d0950687fdd99a8e9618a52fd2c8e8ef0775e6a526a7344493e59cf53eaddb3f155285c1e6545ff19491ee0522027adb778aefcdbd95ce24e89737a277883c3d
SSDEEP 96:CUOjh8bGudTqcbZzDdjyykTmyisx8X1pEWpgTXKYof5RGX03l:G18D+cbtZjyy6bil4IgTXYfWkV
TLSH
T1EDD13D59CBB10651FBDEF37A94E93513397C71E7E48B4EAD904C487A1405BA3024F87A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe5893bf.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5893bf.TMP
Size 3KB
SHA256 2b088a496b7db9f2c0cafc013fd5cfe2f900192e9c0822f6497ae33413539fdd
MD5 4d903353f2c8451dd227b9dc5ec023b6
SHA1 01021161a99d4eb0ec9b74a36bd1c378f773fbb3
SHA512 89a852d260e574888e9c920ef321157060f45bd846dcebb93a0bea53ff4a64ce52158942a934b4397d149326b15dfe90cfa810aaa9d95a470c08c8806e11bccb
TLSH
T124616122DF531961F3D7133F98F105123D7CB49A998F4E4291D8683B580AFE1432F858
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2717b16d-2c1a-47dd-8ab0-14e77a69741e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\2717b16d-2c1a-47dd-8ab0-14e77a69741e.tmp
Size 3KB
SHA256 26a6d53f125bffbf791cebe267b5bed211e238b4cfe8ff5d04561da98da789d9
MD5 55b35fed8f7a245a22bb5edf20b5fb64
SHA1 ce7972b36d4455be7db44d5ff25c033ae6768379
SHA512 209cb43c70de662a63ff450f7e647e29d718531fc8b75ddecc0e4bea752738adca36d360b364f773972ef059ded21b032fa4c341acc0cf3bd66b0090117e5ee8
TLSH
T10B6159F747B1856E9B1295F0AA18EE2FCE6C0110832C78A985E0BE57D3E3871E141B5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 814c46647aebecb55af67e816e995fc4fbc987872ec54284e252f9fc32f52e3c
MD5 e77761e4784e0176098184418e5658ed
SHA1 4ac5a296ab6a913c688b8c9a0dcf2e794892d703
SHA512 cc457d0cbc45cdd37f2f8441dd19b5be98099232a3a3930de4bbdef7a56c5efe26cc6b1c7124b29703e7bc02e38239a9eed997a05f85029db787f19803443e8a
SSDEEP 192:sxZfRUyMqZjK1Ml8UQ/oM/ffsBmKTGEwmzodpmAnl/W6+WNYWpKZfY0hUNhiIOIq:sxZf1qwM/ffsBmUgP/b4f5kEB++H
TLSH
T1D0720A126A74597BDCDBD219FA55BB93D6F91523D2804E449AFCCB0C04E6BEC221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 d7cde2f24ed2770570a9d56d6970206c404f855180b32b0e81bb7168fb051bb0
MD5 4d6e28119e0af17a7bf5215c08849cd7
SHA1 a5d7e6774d4ca92a51e74db3ee15d298bb9c1b48
SHA512 9e0fd6143983ffc8e702a2ecd24a303e2c6988109614051b19b86a2b3c9c0eb55385ff1075f7ff96446cae24d329a04c97a4c8be81195c96b218171ce296eeba
SSDEEP 192:sxZfRUyMqZjK1Ml8MoM/ffsBwKTGEwmzodpmAnl/W6+WNYWpKZfY0h9mwOIg5g+a:sxZf1QM/ffsBwUgP/b4f56++a
TLSH
T1A862E7126A74597BCCDBD219FA45BB93D6F51522D2804E44AAFCCB0C04E67EC221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 31KB
SHA256 bb38d2843fac1676545fd1dbf46602eafc3617f0c3745aa49a1031db89ab22d5
MD5 c258ab0ffae4e902108528daa451bbb7
SHA1 94e44101cf4854bc8266cb0bf62310392e8e9398
SHA512 3ec692d2f7ea16ccdd85ca60febe9a9af8d14ee54e97dc94bcb3cae8992bb419a44865ee591a8d960ffbbb2f42a725ba3cb82349855708e5bfdcf7a2377fc549
SSDEEP 768:wQAKq8y028bWRmj1QWT8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3L4Ll/f10EMEroSO:wQAKq8y028bWRmj1QWTu1jaKL4LpfiEC
TLSH
T1FFE21B3B284CCB7E4FC44E9CED276E8769D802CBA7588D5447FA494C03CA3EE511A59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 e2dc06ecfb4d1831039f035e080cb67dbdb0744ff13b7a1102e0e5a4af1abde3
MD5 1b0a61aa57267d8604aebab36d6b4cc8
SHA1 b1d1966da8e9424b3867ab907d580bac1cebff38
SHA512 8f95c5f68954612541055481a89e1ef33f5cca14b7a0832e84b3dc25c51b8af83c26d9d0375f3db52c3f6700f86e5b7f05a5dd0884d13e32ab3cd61438c7abd4
SSDEEP 192:GD9R5VJhn/iVJnZFGVApBPisTE/3oNloNPSF53pVWFQ5xfSsD0PnY9JFlPtv0F5k:GZLVDJjEDPV0/Zdm/fV
TLSH
T13EB2681232BA42023C7E391C92969B674A42F163306DED7F7BA900B54E67E125DFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

ad2c9826-9a85-4b42-8a60-480b03cbb142.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ad2c9826-9a85-4b42-8a60-480b03cbb142.tmp
Size 15KB
SHA256 63b86c107dfc7366f9ca88b54c13b1b4227629294b093c364b66114c0fcb3f08
MD5 d7f77fefc2aa36c7e87a45fde3dd3639
SHA1 421e44c9a7a621abf8730d93612fc8f7ba8b3a9d
SHA512 35e8df9cdae7c6bee2738fb20cfc89e977a08233828a33d54f27e6d8f7927c5f71b5c29700f24f76338a2c12a43e1f11dc69d9255a04bb8df716b552d773c0bf
SSDEEP 192:sxZfRUyMqZjK1Ml8MoM/ffs2wKTGJwmzodpmAW/W6+WNYY2/Y0hZmwOIgj+OJ:sxZfbQM/ffs2wUTM/bK/5Kj+a
TLSH
T1D562D7166A78597BCCDBD219FA45BB93D6F51563D3804E44AAFCCB0C04E66EC221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 851d32a9496286bf7c5c7ebbd7159458348ec7549775d06090bcce8685d47ee3
MD5 afeec2eaa2e17101ebb588834d7ad255
SHA1 2386a0560354426191473741e66e8451012a970d
SHA512 228ac31ba41ea36e06dd6469ccf75f5d2b1629b1d6e6a82fc6ef17f5fa2ba5b692966b323dc2e1709c6306cdbdcda32c430a58bf87e33815639f39b98fb3a8e5
SSDEEP 384:nsiFDtNn/s3n9SH8NY8TUNTUlIRqPm3ek32nn9jnRbSSfC8GdyKmCgAJzYUOObjZ:XFDj+9KPwggKekmnNGdyKpaU29MuE
TLSH
T1DAE2D5F198D78977E89E4B97A77E2D169AFCC153B6880984B7C81D0CCC961BFC306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 30f5e9a60251b322973424fb28d186d64b4ccd363f50e2bf143526a62594db19
MD5 34452bd2b96d083be2839dca435a47fc
SHA1 7187de7c4eb3a7a6ee5e2c14c96fb509adcc7468
SHA512 ab77635402d59a6b3c43b43b49f419463256193724a4425981d897be7b07ed2398d2e2a9a836436550e126a24a0ed1cf3f8c7142db30693e4fa2e4782bd4098f
SSDEEP 384:n+iF9CcmyWC738NY8TUNTUlIRNPm3ek32nn9SSbSSfC8GdyKmCgAJzKUecty/7Is:VFccp73PwgnKekmzNGdyKpQUeJ
TLSH
T1CCB22932D8A8DABBACE64FC9F75A7643DEE04163868C4AD4DACD1D1D019B1DD030B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 776d1790992d70b53aac7337befe1742f1530c1d2665844ab73dc61f55a656ff
MD5 be6814df3369d01f5981f7b7687afce5
SHA1 c0f49bbfc036f93b3eb3ce045dd097713bc38c05
SHA512 9a786d9816f3f27d9b5116e8a072d536bc3aa4f1118f91de648db1444403b3f34fcf53128f1ac186159b2235986a4ca5adc27eb591283f521ff88425b8567d76
SSDEEP 384:n+iF1tNn/s3n9SN8NY8TUNTUlIROPm3ek32nn9jebSSfC8GdyKmCgAJzGUOObjIK:VF1j+9SPwggKekmMNGdyKp0U29MuE
TLSH
T194D25B32D854CAB7ADE24FD9B74A3A57DEE0026386CC1AD4EACC6E4D04D71DD430B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 d14e0e41d8f3573fc5afe17e7a95b7fa54c2fbd9af16030e091b2cdfb835f4b4
MD5 c46218a66671d0cdb395e0f1e0e9b23d
SHA1 bc5e52245a04e8736846841bee9e1c95b1d66f4a
SHA512 d1ab0d077b1db7cc436748804fdf6ca52267a232a2f98fd23d0c83bf7b1e765cbec9307b373e3ae186a43d1c29e29c56f39ef2a09eabe3aa4c2a7a619c11bb12
SSDEEP 384:nJiF9CcmyWCs38N28TUNTUlIxBPm3ek32nn9BmQI9sSSfC8GdyKmCgAh/e4KV8pK:gFccps35wgPKekm+L90GdyKph/I8p0J
TLSH
T119B25B31ECA8CABBEDE64F89FB4A6A07DEE01163818C59E4DAD81D1D00971DD134B822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 43210f3fef1fb74661b185252908b5ea80594ff2aaf56f0c5ef14675014e2438
MD5 d468d225b252c5599d2d57bb728ed0d7
SHA1 4f5e409078b756b17cf8690d68947dc52cda5dcd
SHA512 1c80f7cc3cac1763bc08d61fa97a727e024e5762947592ad628a3d6e255d1d332e07e63697c33a4126c4df335016b977d932c7180888e3c0b71bb463035ca7bc
SSDEEP 384:nMiF9CcmyWCs38Nc8TUNTUlIxBPm3ek32nn9YQ9YSSfC8GdyKmCgAJzbUe4KV8pK:3Fccps3fwgPKekmv9YGdyKptUI8p0J
TLSH
T144C25B32E898DABBBDE24FD8F74A7507DDE04223868C5AE4DACC1D5D009B1DD534B822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e2e58f84-202d-4b03-988b-a4ab3fe09577.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\e2e58f84-202d-4b03-988b-a4ab3fe09577.tmp
Size 28KB
SHA256 fb8329e00b056898615c876196fb706affbcda028b9c6b678e8bdaff51fa5836
MD5 43ca4c53c25b61d35425ca64faf77e9e
SHA1 6131020a60523b03365d969d5a6841dc2f3cae39
SHA512 8b7e3a5e7488289b0686ba6c0868fe4e4323020cb0622a00b746e25de727457b28457baf78f7800aaef3f669e20b6356facab9d52dfce34a710831a856aad7f4
SSDEEP 384:nViFDtNn/s3n9Sk8NY8TUNTUlIRqPm3ek32nn9jebSSfC8GdyKmCgAJzGUOObjIK:cFDj+9vPwggKekmMNGdyKp0U29MuE
TLSH
T102D24A32DC54CABBADE24ED9B74A3A57DEE04263868C1AD4EACC6E4D04D71DD430B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

t1.zip.crdownload

Path C:\Users\Admin\Downloads\t1.zip.crdownload
Size 20.9MB
SHA256 592300a78fd752a1432b93f4a7699d23836508c61cb3a52fbb4abd0f5e98e285
MD5 2e26a777127349b2ba3ddf1ac8bd77cf
SHA1 3453e85002a002804230897129e8b3d21a2a62ac
SHA512 e5c50db32e29091f8d4605e6583348b92510f48f249fc67f166820e9d70ba2f870ef10a2de1421f8d0577d32f251a5df95184653f4c0d477e2132af6493108d9
SSDEEP 393216:SHJbQ/dAvcS6m6u+vV9r1BPWCpFD8uXd8G0wim6Cm2lKqEI575UKV5EgPs:SHJbQ/dA16m6XV95BFZ8Md8zwC2wqEyi
TLSH
T109273383C20B1766D94BBF3533EB017B9628D22CB166508B3F6567D02CD56E36E13E1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

t1.zip:Zone.Identifier

Path C:\Users\Admin\Downloads\t1.zip:Zone.Identifier
Size 113B
SHA256 7b79a0d502b4d80b29d156fc20c5ded1c7b1784ba9970274fd871838068c8566
MD5 b29d6eb21d621fcc0d8099a25cfcedf9
SHA1 c31f3e3d6c67ba32ea0ac7bff3c6660a751282c5
SHA512 c5b868b28976e69981a0557791794762aec2225c4e6005315c19e162fe9e79d5bf60700429deeb5c51aa1784f98874ecf5d27782f1c4288aa0ad255fcb679a11
TLSH
T116B0220328080C0C0B3EF0C0B3FC80CC20AE20208C028208C8A08CAEEFC002F82F828C
MD5 SHA1 SHA512 TLSH

Submit Download

t2.zip.crdownload

Path C:\Users\Admin\Downloads\t2.zip.crdownload
Size 20.9MB
SHA256 44b38a0cd590ada2d96dcf98b6a88d3c17997cac574ab9e68b9f33c6f985dec4
MD5 c659f9738716c5bf75ac51bd97923958
SHA1 85514df309cb0a7a799a72bab7a6f01448f2ab91
SHA512 f4986383f160cc646aae637d6bbdbd3cb020c1f163e829df5745ce1048aa05e77d08d3479653afa694f3ccb4ec91172e5dd0cdd7efafcc74dabf7e6ab80ebd9d
SSDEEP 393216:AHJbQLxxGXHqBdAmGusLm6u+vV9r1BPWCpFD8uXd8G0wim6Cm2lKqEI575UKV5Ew:AHJbQL6HqMSam6XV95BFZ8Md8zwC2wq9
TLSH
T177273343C20B03A6DA4BBF3532DB013BA968E22C7576918F3F5593D02CD16D66E13E5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

t2.zip:Zone.Identifier

Path C:\Users\Admin\Downloads\t2.zip:Zone.Identifier
Size 183B
SHA256 46e98e4e61ffebe6ecc4b71ac2c84b380b729f2269e31aeebe2edefb2cf91a22
MD5 c89701ce38ad0752ca0e6f583069d394
SHA1 0a0c2f735e3403dc098e4335a4eaec8b71e13d8e
SHA512 7a86a6e48b6d66a5aa8b64127d9ffadabd897e5bc80bb1d5060bda4bb63484469e9e06695ed6161bb34cc0658b91acb7521012d6c5539d07d185f7600ff6df25
TLSH
T18EC080D729441D9D4F3EB4E8B3B890CC61AF1550AD215548C4605C6EFE8403ECBE768D
MD5 SHA1 SHA512 TLSH

Submit Download

t3.zip.crdownload

Path C:\Users\Admin\Downloads\t3.zip.crdownload
Size 20.9MB
SHA256 7e4afbb8e7d84224ab10d6c02b4988160837964e63515f8dcf0a9211963e9d65
MD5 50dd6fa0902a6fb73a1ce1ffe115f553
SHA1 6f59771b91c228191dc6eec060fabf307f553783
SHA512 ba240edb37dc4d57fa11ae5317edf805bb3cabee5d6d56431a5dc7cf352637ebf4e01a3e05069d3d77f766f4eda6c4825cfe27bbd399dc1917f3645b50f35d41
SSDEEP 393216:7I575UKV5EgPQHJbQtDEYH6255umw6Zm6u+vV9r1BPWCpFD8uXd8G0wim6Cm2lKI:7y75rV5XPQHJbQtdae55m6XV95BFZ8Ml
TLSH
T1B2273383C21A07A6DE4BBF3632DB013B9568D22CB176A48B3F5553D02CD16E75E23E16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

t3.zip:Zone.Identifier

Path C:\Users\Admin\Downloads\t3.zip:Zone.Identifier
Size 183B
SHA256 58fc766cbda5fc3aa2885f4bf3411592c8d031cd359a12f8870d0ba94ad270d5
MD5 2537dd35a6de722623c76350fe406511
SHA1 476439770ec104a97c4758347a9690d53a196747
SHA512 9208a0a10d3430158980b599dd644d94cafc4c42261bd78699f02dda30018112d525fe8320603b3320732d9c79e261f22398deed1d064589810f1365e65d0e68
TLSH
T185C01297294519D90F2FA4E8B2A8918861AA1460BD21558CC4615C6AFF8403ACAE668D
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2196-441-0x00000188880F0000-0x00000188890F0000-memory.dmp

Download