hxxps://drive[.]google[.]com/file/d/1ntb1a9ZzdSZOFwlPREtLm6YZe5XVDhBZ/view

Resubmissions

09/08/2026, 03:32

260809-d3n6page857

09/08/2026, 03:20

260809-dv79laszex6

Analysis

user interaction
yes
max time kernel
147s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 03:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://drive.google.com/file/d/1ntb1a9ZzdSZOFwlPREtLm6YZe5XVDhBZ/view
Sample260809-d3n6page85

Score

7^/10

discovery persistence ransomware

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
2924	RandomFlightGenerator.exe
812	RandomFlightGenerator.exe
5704	RandomFlightGenerator.exe
4264	RandomFlightGenerator.exe

Loads dropped DLL 9 IoCs

pid	Process
2924	RandomFlightGenerator.exe
5704	RandomFlightGenerator.exe
812	RandomFlightGenerator.exe
4264	RandomFlightGenerator.exe
812	RandomFlightGenerator.exe
812	RandomFlightGenerator.exe
812	RandomFlightGenerator.exe
812	RandomFlightGenerator.exe
812	RandomFlightGenerator.exe

Contacts third-party web service commonly abused for C2 1 TTPs 5 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
7	drive.google.com
8	drive.google.com
15	drive.google.com
19	drive.google.com
41	drive.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3188	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134307199462214896"	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1875162379-3804078649-638427191-1000\{3C825B84-208F-4E74-95DA-F6FD25A33E62}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5552	msedge.exe
5552	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeRestorePrivilege	2472	7zG.exe
Token: 35	2472	7zG.exe
Token: SeSecurityPrivilege	2472	7zG.exe
Token: SeSecurityPrivilege	2472	7zG.exe
Token: SeShutdownPrivilege	2924	RandomFlightGenerator.exe
Token: SeCreatePagefilePrivilege	2924	RandomFlightGenerator.exe
Token: SeShutdownPrivilege	2924	RandomFlightGenerator.exe
Token: SeCreatePagefilePrivilege	2924	RandomFlightGenerator.exe
Token: SeShutdownPrivilege	2924	RandomFlightGenerator.exe
Token: SeCreatePagefilePrivilege	2924	RandomFlightGenerator.exe
Token: SeShutdownPrivilege	2924	RandomFlightGenerator.exe
Token: SeCreatePagefilePrivilege	2924	RandomFlightGenerator.exe
Token: SeShutdownPrivilege	2924	RandomFlightGenerator.exe
Token: SeCreatePagefilePrivilege	2924	RandomFlightGenerator.exe
Token: SeShutdownPrivilege	2924	RandomFlightGenerator.exe
Token: SeCreatePagefilePrivilege	2924	RandomFlightGenerator.exe
Token: SeShutdownPrivilege	2924	RandomFlightGenerator.exe
Token: SeCreatePagefilePrivilege	2924	RandomFlightGenerator.exe
Token: SeShutdownPrivilege	2924	RandomFlightGenerator.exe
Token: SeCreatePagefilePrivilege	2924	RandomFlightGenerator.exe
Token: SeShutdownPrivilege	2924	RandomFlightGenerator.exe
Token: SeCreatePagefilePrivilege	2924	RandomFlightGenerator.exe
Token: SeShutdownPrivilege	2924	RandomFlightGenerator.exe
Token: SeCreatePagefilePrivilege	2924	RandomFlightGenerator.exe
Token: SeShutdownPrivilege	2924	RandomFlightGenerator.exe
Token: SeCreatePagefilePrivilege	2924	RandomFlightGenerator.exe
Token: SeShutdownPrivilege	2924	RandomFlightGenerator.exe
Token: SeCreatePagefilePrivilege	2924	RandomFlightGenerator.exe
Token: SeShutdownPrivilege	2924	RandomFlightGenerator.exe
Token: SeCreatePagefilePrivilege	2924	RandomFlightGenerator.exe
Token: SeShutdownPrivilege	2924	RandomFlightGenerator.exe
Token: SeCreatePagefilePrivilege	2924	RandomFlightGenerator.exe
Token: SeShutdownPrivilege	2924	RandomFlightGenerator.exe
Token: SeCreatePagefilePrivilege	2924	RandomFlightGenerator.exe
Token: SeShutdownPrivilege	2924	RandomFlightGenerator.exe
Token: SeCreatePagefilePrivilege	2924	RandomFlightGenerator.exe
Token: SeShutdownPrivilege	2924	RandomFlightGenerator.exe
Token: SeCreatePagefilePrivilege	2924	RandomFlightGenerator.exe
Token: SeShutdownPrivilege	2924	RandomFlightGenerator.exe
Token: SeCreatePagefilePrivilege	2924	RandomFlightGenerator.exe
Token: SeShutdownPrivilege	2924	RandomFlightGenerator.exe
Token: SeCreatePagefilePrivilege	2924	RandomFlightGenerator.exe
Token: SeShutdownPrivilege	2924	RandomFlightGenerator.exe
Token: SeCreatePagefilePrivilege	2924	RandomFlightGenerator.exe
Token: SeShutdownPrivilege	2924	RandomFlightGenerator.exe
Token: SeCreatePagefilePrivilege	2924	RandomFlightGenerator.exe
Token: SeShutdownPrivilege	2924	RandomFlightGenerator.exe
Token: SeCreatePagefilePrivilege	2924	RandomFlightGenerator.exe
Token: SeShutdownPrivilege	2924	RandomFlightGenerator.exe
Token: SeCreatePagefilePrivilege	2924	RandomFlightGenerator.exe
Token: SeShutdownPrivilege	2924	RandomFlightGenerator.exe
Token: SeCreatePagefilePrivilege	2924	RandomFlightGenerator.exe
Token: SeShutdownPrivilege	2924	RandomFlightGenerator.exe
Token: SeCreatePagefilePrivilege	2924	RandomFlightGenerator.exe
Token: SeShutdownPrivilege	2924	RandomFlightGenerator.exe
Token: SeCreatePagefilePrivilege	2924	RandomFlightGenerator.exe
Token: SeShutdownPrivilege	2924	RandomFlightGenerator.exe
Token: SeCreatePagefilePrivilege	2924	RandomFlightGenerator.exe
Token: SeShutdownPrivilege	2924	RandomFlightGenerator.exe
Token: SeCreatePagefilePrivilege	2924	RandomFlightGenerator.exe
Token: SeShutdownPrivilege	2924	RandomFlightGenerator.exe
Token: SeCreatePagefilePrivilege	2924	RandomFlightGenerator.exe
Token: SeShutdownPrivilege	2924	RandomFlightGenerator.exe
Token: SeCreatePagefilePrivilege	2924	RandomFlightGenerator.exe

Suspicious use of FindShellTrayWindow 47 IoCs

pid	Process
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
2472	7zG.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe

Suspicious use of WriteProcessMemory 47 IoCs

description	pid	Process	procid_target
PID 4588 wrote to memory of 5336	4588	msedge.exe	89
PID 4588 wrote to memory of 4780	4588	msedge.exe	91
PID 4588 wrote to memory of 3188	4588	msedge.exe	90
PID 4588 wrote to memory of 4780	4588	msedge.exe	91
PID 4588 wrote to memory of 4780	4588	msedge.exe	91
PID 4588 wrote to memory of 4124	4588	msedge.exe	93
PID 4588 wrote to memory of 4124	4588	msedge.exe	93
PID 4588 wrote to memory of 3548	4588	msedge.exe	95
PID 4588 wrote to memory of 3416	4588	msedge.exe	94
PID 4588 wrote to memory of 3548	4588	msedge.exe	95
PID 4588 wrote to memory of 3548	4588	msedge.exe	95
PID 4588 wrote to memory of 3416	4588	msedge.exe	94
PID 4588 wrote to memory of 3416	4588	msedge.exe	94
PID 4588 wrote to memory of 2868	4588	msedge.exe	96
PID 4588 wrote to memory of 2868	4588	msedge.exe	96
PID 4588 wrote to memory of 2868	4588	msedge.exe	96
PID 4588 wrote to memory of 3516	4588	msedge.exe	97
PID 4588 wrote to memory of 3516	4588	msedge.exe	97
PID 4588 wrote to memory of 3516	4588	msedge.exe	97
PID 4588 wrote to memory of 5500	4588	msedge.exe	99
PID 4588 wrote to memory of 5500	4588	msedge.exe	99
PID 4588 wrote to memory of 3868	4588	msedge.exe	100
PID 4588 wrote to memory of 3868	4588	msedge.exe	100
PID 4588 wrote to memory of 5768	4588	msedge.exe	102
PID 4588 wrote to memory of 1504	4588	msedge.exe	105
PID 4588 wrote to memory of 1504	4588	msedge.exe	105
PID 4588 wrote to memory of 1504	4588	msedge.exe	105
PID 4588 wrote to memory of 5996	4588	msedge.exe	106
PID 4588 wrote to memory of 5996	4588	msedge.exe	106
PID 4588 wrote to memory of 5996	4588	msedge.exe	106
PID 4588 wrote to memory of 5884	4588	msedge.exe	107
PID 4588 wrote to memory of 5884	4588	msedge.exe	107
PID 4588 wrote to memory of 5872	4588	msedge.exe	108
PID 4588 wrote to memory of 5872	4588	msedge.exe	108
PID 4588 wrote to memory of 5872	4588	msedge.exe	108
PID 4588 wrote to memory of 3660	4588	msedge.exe	109
PID 4588 wrote to memory of 4684	4588	msedge.exe	111
PID 4588 wrote to memory of 3536	4588	msedge.exe	112
PID 4588 wrote to memory of 4680	4588	msedge.exe	113
PID 4588 wrote to memory of 5196	4588	msedge.exe	115
PID 4588 wrote to memory of 5196	4588	msedge.exe	115
PID 2924 wrote to memory of 812	2924	RandomFlightGenerator.exe	119
PID 2924 wrote to memory of 812	2924	RandomFlightGenerator.exe	119
PID 2924 wrote to memory of 5704	2924	RandomFlightGenerator.exe	120
PID 2924 wrote to memory of 4264	2924	RandomFlightGenerator.exe	121
PID 2924 wrote to memory of 4264	2924	RandomFlightGenerator.exe	121
PID 4588 wrote to memory of 5552	4588	msedge.exe	122

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://drive.google.com/file/d/1ntb1a9ZzdSZOFwlPREtLm6YZe5XVDhBZ/view
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2c8,0x7ffbcb50c188,0x7ffbcb50c194,0x7ffbcb50c1a0
  2⤵
  PID:5336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1820,i,1622621317864134837,5310962993011892555,524288 --field-trial-handle=2556,i,15194141771116020971,10069294237341206243,262144 --variations-seed-version --mojo-platform-channel-handle=2592 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1604,i,5122742005045541953,7870036057547476089,262144 --field-trial-handle=2556,i,15194141771116020971,10069294237341206243,262144 --variations-seed-version --mojo-platform-channel-handle=2552 /prefetch:2
  2⤵
  PID:4780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2224,i,9148017022563461399,2783604955762923470,524288 --field-trial-handle=2556,i,15194141771116020971,10069294237341206243,262144 --variations-seed-version --mojo-platform-channel-handle=2844 /prefetch:13
  2⤵
  PID:4124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3640,i,9419904798378482518,14296233906987265333,2097152 --field-trial-handle=2556,i,15194141771116020971,10069294237341206243,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:1
  2⤵
  PID:3416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3680,i,2071542724179850083,3855972849956832192,2097152 --field-trial-handle=2556,i,15194141771116020971,10069294237341206243,262144 --variations-seed-version --mojo-platform-channel-handle=3756 /prefetch:1
  2⤵
  PID:3548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4368,i,9617064721767532505,5994189311517382294,2097152 --field-trial-handle=2556,i,15194141771116020971,10069294237341206243,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:1
  2⤵
  PID:2868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4388,i,4526680084318417129,9364484531638373770,2097152 --field-trial-handle=2556,i,15194141771116020971,10069294237341206243,262144 --variations-seed-version --mojo-platform-channel-handle=4508 /prefetch:9
  2⤵
  PID:3516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5312,i,12781463723206311012,323867653485979846,524288 --field-trial-handle=2556,i,15194141771116020971,10069294237341206243,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:14
  2⤵
  PID:5500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5308,i,15926655732720943324,3373145080483641741,524288 --field-trial-handle=2556,i,15194141771116020971,10069294237341206243,262144 --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:14
  2⤵
  PID:3868
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6112,i,12071638320787121371,4519357718097687598,524288 --field-trial-handle=2556,i,15194141771116020971,10069294237341206243,262144 --variations-seed-version --mojo-platform-channel-handle=6096 /prefetch:14
  2⤵
  PID:3692
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6112,i,12071638320787121371,4519357718097687598,524288 --field-trial-handle=2556,i,15194141771116020971,10069294237341206243,262144 --variations-seed-version --mojo-platform-channel-handle=6096 /prefetch:14
  2⤵
  PID:5768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6520,i,13105087002932349870,5833647707941657535,2097152 --field-trial-handle=2556,i,15194141771116020971,10069294237341206243,262144 --variations-seed-version --mojo-platform-channel-handle=6504 /prefetch:1
  2⤵
  PID:1504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6724,i,2973114034613178746,11041758271622295180,2097152 --field-trial-handle=2556,i,15194141771116020971,10069294237341206243,262144 --variations-seed-version --mojo-platform-channel-handle=6692 /prefetch:1
  2⤵
  PID:5996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6540,i,6326874981252193117,639894049274544720,524288 --field-trial-handle=2556,i,15194141771116020971,10069294237341206243,262144 --variations-seed-version --mojo-platform-channel-handle=6592 /prefetch:14
  2⤵
  PID:5884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6960,i,484217275563021759,13071622918222940184,2097152 --field-trial-handle=2556,i,15194141771116020971,10069294237341206243,262144 --variations-seed-version --mojo-platform-channel-handle=6976 /prefetch:1
  2⤵
  PID:5872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5116,i,4541812050389625069,6988752954705049763,524288 --field-trial-handle=2556,i,15194141771116020971,10069294237341206243,262144 --variations-seed-version --mojo-platform-channel-handle=6872 /prefetch:14
  2⤵
  PID:3660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6548,i,10144209188633413181,11120756697571432633,524288 --field-trial-handle=2556,i,15194141771116020971,10069294237341206243,262144 --variations-seed-version --mojo-platform-channel-handle=6872 /prefetch:14
  2⤵
  PID:4684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5124,i,6354462030301161748,5818938179759676651,524288 --field-trial-handle=2556,i,15194141771116020971,10069294237341206243,262144 --variations-seed-version --mojo-platform-channel-handle=7292 /prefetch:14
  2⤵
  PID:3536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5192,i,17799698595994888495,13590292290270692071,524288 --field-trial-handle=2556,i,15194141771116020971,10069294237341206243,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:14
  2⤵
  PID:4680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5652,i,3481736889697901217,18244910549072416980,524288 --field-trial-handle=2556,i,15194141771116020971,10069294237341206243,262144 --variations-seed-version --mojo-platform-channel-handle=5640 /prefetch:14
  2⤵
  PID:5196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=812,i,8312097858434837604,9306817318976903751,262144 --field-trial-handle=2556,i,15194141771116020971,10069294237341206243,262144 --variations-seed-version --mojo-platform-channel-handle=7276 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5552

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1612

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5328

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5716

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\RandomFlightGenerator-win64\" -spe -an -ai#7zMap173:116:7zEvent6386
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2472

C:\Users\Admin\Downloads\RandomFlightGenerator-win64\RandomFlightGenerator-win32-x64\RandomFlightGenerator.exe
"C:\Users\Admin\Downloads\RandomFlightGenerator-win64\RandomFlightGenerator-win32-x64\RandomFlightGenerator.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2924
- C:\Users\Admin\Downloads\RandomFlightGenerator-win64\RandomFlightGenerator-win32-x64\RandomFlightGenerator.exe
  "C:\Users\Admin\Downloads\RandomFlightGenerator-win64\RandomFlightGenerator-win32-x64\RandomFlightGenerator.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\random-flight-generator" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1680,i,11108678916014613420,2800974099159913663,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1672 /prefetch:2
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:812
- C:\Users\Admin\Downloads\RandomFlightGenerator-win64\RandomFlightGenerator-win32-x64\RandomFlightGenerator.exe
  "C:\Users\Admin\Downloads\RandomFlightGenerator-win64\RandomFlightGenerator-win32-x64\RandomFlightGenerator.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\random-flight-generator" --field-trial-handle=2156,i,11108678916014613420,2800974099159913663,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2128 /prefetch:11
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:5704
- C:\Users\Admin\Downloads\RandomFlightGenerator-win64\RandomFlightGenerator-win32-x64\RandomFlightGenerator.exe
  "C:\Users\Admin\Downloads\RandomFlightGenerator-win64\RandomFlightGenerator-win32-x64\RandomFlightGenerator.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\random-flight-generator" --app-path="C:\Users\Admin\Downloads\RandomFlightGenerator-win64\RandomFlightGenerator-win32-x64\resources\app" --enable-sandbox --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=2504,i,11108678916014613420,2800974099159913663,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2500 /prefetch:1
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4264

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ecdd5c8034c45eff453cbaf31d8886e2bd9609a73853367a6d096a69cc81f1be
MD5 a774534a956a5c8affebe08e87c80683
SHA1 b3e4e20a91e4087d3b9247b5ef6815f51858a041
SHA512 27769aee2cac148a0154fe42b51da2a9a1088e9e990873915b4c7ab9bd5442a3facf82b2bd1cbaef75328bd5937813698b96ac06aa76d934d07ab5ebb194a824
TLSH
T103D09B6673449A1CC9C439712461565161115820E41443581C96715CCDE56C707571DE
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 dfacefa73d018d54e3feba3eef28ec722a8422fee8768a2c3d8d6253f863b375
MD5 cb5000b6fab1115bfff50bedcc3eb9fd
SHA1 afbfe0ec03df59e7a1eba1da4227111508419c03
SHA512 aab9a1afd5de2f983466724b6ecf0dbc2e176c5a1eb2f059b9507511cc53643fcf9ed990bd565f22f8d53fb82db71cba238962a75c68db02d5f10b526661bd08
TLSH
T15AD09B667354991CC9C439712462565161015820941443581D96B16CCDE56C707561DA
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 430917400a5306b9e5a9702734ec3c35b54b5bc43a6101be4dba93c86b459449
MD5 7d8d3461d7863303d63f2980ce1ec944
SHA1 32225de1bda4af739d223b2aa2300b3911901dab
SHA512 a09d27dd248091189fa08804e7277d5c6fa7c889661310baf0e5af3697fa3dd077a0a1f8961c8fe2bd87a860572c936b9dc19ad7c05866285812cfcff4b7bf34
TLSH
T1F5714A7423ADE6EDDB656AB323E054442EF888BA1443CE44D304ADF6E892F404DE3853
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 4fc3f045fa27aa54051af9946ee9d41f1da5147859b29669b63ad889b95d81ef
MD5 b0335487614c7c193e2552c1fc50a282
SHA1 86dd85b3b49a637326ccfaab534e3ec7c9e1b519
SHA512 7e78346a9ed618a30c315a5314ce8f9e8a271a852c51a0f60bc8a759825ce24cf9e8ffa94eb80316dd89daacc9a9705a1f525ff341701e89be0652f2fab75664
TLSH
T17E51F834236DE9EDE7295AB363E054483EF480761447DA00E6180DF6D9E2F045CD3853
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 d4568c2b21683a22da3a593785c1771072a39b9fd63dd8baef6eb7a6df2d7c26
MD5 a404df69c8b4f8737049a4b638af1b9d
SHA1 21faf1f6c7507cf7dcaa2d411033e38de50cf3ab
SHA512 1060aa77d5f78d31550bd5d922b328eebaf3e9dbf854ef762c4efe9f73eb90165379d64f858b4be05aa7637e1a2da68075bc674619873de47879d036e26b26ff
SSDEEP 192:DcFovrCvkKgfeRwRWRHG3gaaiZ98V4OmSyu61rQZzwk3Vemn9:DcFovrCvkKgfeu4lSgaaiZ98V4OmSyur
TLSH
T1C0F1ABF7C3D9822DC91156F49715AF1ECE2E0618432C3C2AC8D5BE5B93E2471E21679E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 b163023696160bb0165bf266e87fc7e307fd666940ebca6d978399742372a02d
MD5 ec69b94d6555e7efb7e5a59c7d92545d
SHA1 90aac2a0cff3a4e55ef91a364bfc5f55d73bf7dc
SHA512 4dbcb2ecc9aa0544b1f34b6c99bbea212241fece24cdcc69ca99aa45ec4881a5368eb1d195a9cee063008b6aebeb4b961a27450fa7a8ea9a44b2bf6bf17eda2d
SSDEEP 192:sxRRRkOX/feKsfVKCA94/8zoA8plnUEO/g6+WNwnw/YD9pl6SpGyhIgIJ:sxRRBX/f9sfVZ8+ZK/5B/XSXs
TLSH
T18642B91669286D3B8CCBE21DBB55BF53E6F9103261D01E58E7FC961C04EB6DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 d60bad75169c6d3ea0573d642dfae8d90ac1b12625c816c7c0ec90d1be4ac4da
MD5 5940a0b0f425afedfc91f9c79d88a323
SHA1 825f1f145caaac52addc75b1d815dfa13de1857a
SHA512 ec84c2f62df62b3cfe5002508d8087e937f0a44136fd6ca2e2ffb9e6af2eb54bbef73a4f9db9c2a08b97e2775319a825c86b94898b0b52e16d7575fb77ce155f
SSDEEP 192:sxRWRkOX/feKsVVKCA94/8zoA8plnUEO/g6+WNwnw/YD9pl6SpGyhIgDjJ:sxRWBX/f9sVVZ8+ZK/5B/XSXB
TLSH
T18E42B85669286D3B8CCBD21DBB55BF53E6F9203261D01E58E6FC961C04EB6DE220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 78f4d9b63ff903767bbeca186674c43ce2cf20e0543777d3a1e26aa723aae2fd
MD5 0b6f8352e4bdb6467629074e81a62524
SHA1 f7a996867cc583b96671fef8adf05b02d476e818
SHA512 23657bfae854108c00d0e13e33ed7f2689dcce987138d61805f27edf30722890ab0ad4f1bf0fdc9d971de4650e67a72cdee4ed5f0fab3510dec408c0020edc1d
SSDEEP 192:sxRWRkOX/feKsVqKCA94/8zoA8plnUEO/g6+WNwnwVhB/YD9bo6SpGyhIgDlJ:sxRWBX/f9sVqZ8+ZK/5Bx/mSXr
TLSH
T15642C85669286D3B9CCBE21DBB55BF53E2F9103261D11E58E7FC961C00EB6DE220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 97064accc75dfd0955af36ed21b00e4d992d99ffa24390e1e312770aa9ebe342
MD5 d85693a5de4fbc6b5dbd0a9f3ab8ddd9
SHA1 7c082077675c14442c106224b65d3c9a059e9c79
SHA512 ee6b59c70aaf68a063fceef8f889798c14f458b0627685cc7de7b79c369fb5281c2d97a56a746947a8a096b762a022624bc5628dde2e9223ffb380772c81ef52
SSDEEP 384:a8YfWRmfCtg/NFfHfKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVOe91bRcSropDi:azfWR0Wg/XfHf8F1+UoAYDCx9Tuqh0VO
TLSH
T100B2EA2F600CCB7E9F800AADAD196FD76D9802C797588D4047FE994C02C77EA921A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 1KB
SHA256 0b610c59f9104cee04b2ea2bdc17803c29482f759cc948ce8aa3ce1465f02097
MD5 5ac46ed4b1b6c089b292356c1578381c
SHA1 62b23baade6ed6876798a7b576e4ffa67f054122
SHA512 6fd02e06b85852cd68626e53e4de6a187d31e896cd93b95dc7073ae7e6dd20fb18b4079096a1242a6cdaad29cd0be81497627007507c08b5397fa701d57bb11f
TLSH
T19A219E1261BF06146E3FE60EC278D41AD2417A713826E46BB76880560BE6E945EBCBCD
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

f8d4e4e3-94cb-49ed-894f-7c0528b2c18f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\f8d4e4e3-94cb-49ed-894f-7c0528b2c18f.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 c5ff5050d7adb2c7aa7fa14d4e75331f5e13458032802c2f64255ef85784322a
MD5 090d0916508bc1b3ce71bbc83c5e3f6a
SHA1 e121fc687ad92997a81e38d6bd84c20a405447a6
SHA512 f50bbe300eeaf038430a3082b62ed7e6040d8745241162714debe0d579b505649357554750087aa7518021e5e157db281bbfdb92ef4509b94088ad9fdb4cc998
SSDEEP 768:srv+4UNbdS3/UHaHi0nrEnjN3Gac1FroOw:sbsbg3/UMnQnjMa8of
TLSH
T15403BF31B9689DB38CEBD285B1477A03BEE4475385C40AA4CAC97A0C46DB5ED230B967
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 1e89da44bee0717c12570ab050359aa5c340a0f7bc1ead6ed359c647233ecc5f
MD5 de4a711c4166057cc0319a9241f185cb
SHA1 d467628b182638eb87be48f55be018f887f2f654
SHA512 987d0163270c458c924553a84f7eae731276972fcae21896bdd9496d4814e9106292313664ab3f196526662ec92d243a862095ab19f50450ff7b2be3f7536e7b
SSDEEP 768:+Fhp3gwgYSIIJaHi0HrEnjN3Gac1Fr2ewBKZOTK:up3PxHQnjMa82evZZ
TLSH
T1161348F158D78977C8AE9747A73E2E029DBCC653B4940A64B7C9650CCD831BFD30A822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 ba9d4ed977469912a39a7cce34a5fff9c937bef826b5403977ed0e565e017caf
MD5 03d3cfc2451efc804e6937c49179618d
SHA1 71b7fc31f3b0aab3dd73fa7077257dd759630e1f
SHA512 7346e6ca68959873ace7e03f91eecd3aa23df21d7b7c75e5af00c8159d49a2a3f9e4dde5ab691e89ba2098bd557cb5b01aac1ae33d4ca2c23144a09f7d602b80
SSDEEP 384:JZcIr38NBKbBuFwHa2WZlf8hyEG1bF22ly2rEoajo4cdR8eHhVODjYPNDUMWw2Tm:Br3dLaHi0nrEnjN3Gac1Fr2ewBKZOTK
TLSH
T103F2BF706D789DB38CEBE38576477703AEE44753D5D80AA8CADD760C05D76A8230BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 3088e07d7362f0ced5768cfb213b64a64f338eb513ad87f87573d128fbfbc3e1
MD5 d12c6c309c8707a06469b2aa1bdeed72
SHA1 482f2ea3f509ab08cc9b830234ec87bf75088b3d
SHA512 b847e7a8bc7dfa367a0ae4f6eb03736af37f3d7adb496bb6b3b209192d5f825d0cfcdf7ee1883e7d9461f6474e3b24b3a87136e51924856c0e09f1bfa6c7f8dc
SSDEEP 768:arv+4UNbdS30ci00rEnjN3Gac1oreVH1SCz:absbg350QnjMarEH1V
TLSH
T1CD03CF3169A89A738CE7D38671877A037FF4475386C40BE0C9C96A0D46DB5EC230B967
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 a964dcc750700ef5bd6580e047b702d1b6e18561f78c55dce142fb135bf9f7b4
MD5 5061ff2f1c8933e71119940eb17e75ac
SHA1 d443d1d5c7e8be9daba551cec60e3fad29131c0a
SHA512 425242390c916915212ae7a5b57a9ace94929ca0dd54be367e1d53f28cda840230f3ad5f73583828c200bf805099036069d814db19a46f44b25e1dcdd3e10c53
SSDEEP 768:rrv+4UNbdS32mi0yrEnjN3Gac1ZmeVH1SCz:rbsbg31yQnjMa1EH1V
TLSH
T1BF03CF3169B88A738CEBA38571877A037FF4525385D40BE4C9CD6B0D06975EC230B967
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3a25843-6dae-42fa-a63c-f457bcc345f5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\d3a25843-6dae-42fa-a63c-f457bcc345f5.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

default.exc

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.exc
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Roaming\random-flight-generator\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Roaming\random-flight-generator\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Roaming\random-flight-generator\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Roaming\random-flight-generator\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

D3DCompiler_47.dll

Path C:\Users\Admin\Downloads\RandomFlightGenerator-win64\RandomFlightGenerator-win32-x64\D3DCompiler_47.dll
Size 4.7MB
SHA256 af7b99be1b8770c0e4d18e43b04e81d11bdeb667fa6b07ade7a88f4c5676bf9a
MD5 a7b7470c347f84365ffe1b2072b4f95c
SHA1 57a96f6fb326ba65b7f7016242132b3f9464c7a3
SHA512 83391a219631f750499fd9642d59ec80fb377c378997b302d10762e83325551bb97c1086b181fff0521b1ca933e518eab71a44a3578a23691f215ebb1dce463d
SSDEEP 49152:hCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvdiD0N+YEzI4og/RfzHLeHTRhFRN1:oG2QCwmHjnog/pzHAo/Ayc
TLSH
T13C367C5673EA40B9C1ABD178CE479213EBB1781403345BEB4190C669AF73BE16A3E734
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_100_percent.pak

Path C:\Users\Admin\Downloads\RandomFlightGenerator-win64\RandomFlightGenerator-win32-x64\chrome_100_percent.pak
Size 148KB
SHA256 7dd5485def22a53c0635efdf8ae900f147ec8c8a22b9ed71c24668075dd605d3
MD5 cb4f128469cd84711ed1c9c02212c7a8
SHA1 8ae60303be80b74163d5c4132de4a465a1eafc52
SHA512 0f0febe4ee321eb09d6a841fe3460d1f5b657b449058653111e7d0f7a9f36620b3d30369e367235948529409a6ce0ce625aede0c61b60926dec4d2c308306277
SSDEEP 3072:iz8JCGIdkwTPaNkx0auKdL2o418Gb0+VRLf0ld0GY3cQ3ERVm2I:iz81Idk8aqT5K18Gb0OV8ld0GecQ3Er2
TLSH
T1ADE3D0E773F4ED7DCAA756F7621600B1EDF3462D0691024A168ED8363A66B48DCC8783
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_200_percent.pak

Path C:\Users\Admin\Downloads\RandomFlightGenerator-win64\RandomFlightGenerator-win32-x64\chrome_200_percent.pak
Size 223KB
SHA256 2408969599d3953aae2fb36008e4d0711e30d0bc86fb4d03f8b0577d43c649fa
MD5 e9c1423fe5d139a4c88ba8b107573536
SHA1 46d3efe892044761f19844c4c4b8f9576f9ca43e
SHA512 abf8d4341c6de9c722168d0a9cf7d9bac5f491e1c9bedfe10b69096dcc2ef2cd08ff4d0e7c9b499c9d1f45fdb053eafc31add39d13c8287760f9304af0727bf4
SSDEEP 6144:3DQYajN6svyABnI86fTugx5GMRejnbdZnVE6YoppO4:cfjN6svyABOa6edhVELoXO4
TLSH
T1F124F1DB63F89D7DC9634AB3662601F1ECB2113955B6420B03DFEC357A95B8988C9383
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ffmpeg.dll

Path C:\Users\Admin\Downloads\RandomFlightGenerator-win64\RandomFlightGenerator-win32-x64\ffmpeg.dll
Size 2.6MB
SHA256 113ccc8e701157d0d59283baa5dc1fd3b0eae2571fd825084d7a4d58697a5ec2
MD5 64f3f2ae25b14f5d2d168ba6aae49ab6
SHA1 f43554aeb7a1b20b6e9dcbe5408cc004eb7db27a
SHA512 3ffb531da6ef1955f7b71c5f6e9e3322dafce78735aaf9b245c46bd5ccfa8a6a4b282b31b3aacb4e3b423412b9ab89f792ce37f3a9e6eb83983adfe7df38bfcf
SSDEEP 49152:R1nRu1gjn93AXtsX7I8g4AScbz6Ox+pen6yfmb+ST1PqRrYF:RJsf83Sn6Ox+tP5F
TLSH
T1F6C5AE12F6D640DDD02DC074879F9623F63038468B24AAEF16909A243F6BFD42E7E765
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icudtl.dat

Path C:\Users\Admin\Downloads\RandomFlightGenerator-win64\RandomFlightGenerator-win32-x64\icudtl.dat
Size 10.0MB
SHA256 9ae98c06cbb0ea43c5cd6b5725310c008c65e46072421a1118cb88e1de9a8b92
MD5 ffd67c1e24cb35dc109a24024b1ba7ec
SHA1 99f545bc396878c7a53e98a79017d9531af7c1f5
SHA512 e1a865e685d2d3bacd0916d4238a79462519d887feb273a251120bb6af2b4481d025f3b21ce9a1a95a49371a0aa3ecf072175ba756974e831dbfde1f0feaeb79
SSDEEP 196608:+SPBhORiYAXHiXUxY/iJ53IWhlVjEeIu2Y6U:++wkpHiXUxY/iJ53IWhlVjEeIZU
TLSH
T160B63807A2FB8DC6F9F76F30E8F452679567BD496E32805911042F3B1D332A08661BB6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libegl.dll

Path C:\Users\Admin\Downloads\RandomFlightGenerator-win64\RandomFlightGenerator-win32-x64\libegl.dll
Size 470KB
SHA256 01b8a8c2875ecb9979de339500ce0e0b7ecc3c5387053ce27bea51e6a09e2d72
MD5 b12e3c1e72935273492da1daee50eef1
SHA1 3f93237b71ee1328cf25f8223e685de97d01d773
SHA512 12346000331cde78ea08e9c0fef4635c77f6e85fb0e46706bbec1f23b0d7a7ef99e3930475324306ab4a46587d382ee3beb18d703e2765a8c1b7ece144c57983
SSDEEP 6144:Omi12qlTgeUDsnkcM2nDl83BgENhYCqNSfY24M:Omk2qxgeUDsNnDcgENhYRNSfU
TLSH
T1F4A48E1577E444A9E02BD134CA574642EA76B4820F65FBDF02A493392F7BBF85B39320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libglesv2.dll

Path C:\Users\Admin\Downloads\RandomFlightGenerator-win64\RandomFlightGenerator-win32-x64\libglesv2.dll
Size 7.7MB
SHA256 fb6ea924fbb9417e4695ce414cdcbc299f13451dbedd2d9adb55479bf1cbf57f
MD5 5082e41d7a57506fe6b4bd58f87276b4
SHA1 2842372c18f49c0e1fd8123891be8587cbf13146
SHA512 9e10d0d3269939f9a497f0b0937f0aeb9ec44627d5349cee589b676aaf95dde11c996e2eda158cf8e79778cfd948b10cb61538c9cc056f7b899a057e7e959f76
SSDEEP 98304:DPqhbsPD8TDyGDsTnI5mvmKGtS17QXC3O:DP4m8TDyluKGugmO
TLSH
T1E5868B03F69680D9C04DD2B5975B9227FA35B8840B34B6CF265423253F77BE0AB7AB14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en-US.pak

Path C:\Users\Admin\Downloads\RandomFlightGenerator-win64\RandomFlightGenerator-win32-x64\locales\en-US.pak
Size 454KB
SHA256 41123d72bd8e289e85bd35227aabb4cc61fe1de02b5cd7a7834e5ec200bc2078
MD5 5c52a86b21633b55b383c20f16859b2f
SHA1 126585e68cb17f241351004e21c1d30e65de1cf6
SHA512 2a1b6a4becfb97d470cd7de74857edf2cc9cd4a77f377ccd9bf60c30539862ff1ac3ed6cc849632a3ed4ea0e5b92679f3cc5b4cb26cc7eaaa2bb2f4ae9974a6a
SSDEEP 6144:4U0NFUyUGhhA/4miMP9e2qDWfaYe1Vcg5xdxOng5H/thTwB:4jIy1hhYiM9qDvn5zxZTwB
TLSH
T152A44C1FF7441229069352A27F09A5A2FF32D06CA35112567CBD812C33B6B66C37B6E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

resources.pak

Path C:\Users\Admin\Downloads\RandomFlightGenerator-win64\RandomFlightGenerator-win32-x64\resources.pak
Size 5.3MB
SHA256 a5908171bfbb738ac015e7c9903c838d93359ed12c3b7d86545514dc1f0e9d62
MD5 84df318c3fd9ab693dff15582132fc65
SHA1 6b436939d3dd3d5300af46c238c085276bbf1b55
SHA512 189fd83f008c29d9b38e5024975050c8e3dfd5e99a0c5eccec06fce54e865f0d8bef03a4bf3dc3564f2bb640f38259957f8f38e0d39599aec6ecba95eb21f848
SSDEEP 98304:5N9bNj3xZRkPe04srtXK5EmXJfnimTgK5M/AyrwreSjujBrTAVD:tbNTxTk1rlK9gKckreSjuxTK
TLSH
T1B346330677E1913EC82ED33C42494F76169CBA730665712B718C6269FF391AA4E4E0BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icon.ico

Path C:\Users\Admin\Downloads\RandomFlightGenerator-win64\RandomFlightGenerator-win32-x64\resources\app\icon.ico
Size 10KB
SHA256 5e360b4439a64906c9f3f5c01f12018f15d4c0dc37c78814e8059612a337b249
MD5 4b18ed9cedec3a42d0c01d7a0f20dab6
SHA1 ec9840246f8341d75b33d4b695f26b559726a9ba
SHA512 eb941bbcc1eba9d7d150d5b0fc9f035db187723578b23c4f8d1c58d3d61c0be67e3f34d5e60525690980f6649afe8f7c841cbf26fa766c12d457dd8e895faf64
SSDEEP 192:wThJg3qcil9dTFnz4vJPmd0U7MmColNTrOCsD03a/iX1IHjTab:w0acil9pF8vJK0G7lnI03ENHjeb
TLSH
T10D229ECB87AD6C1AE7554DB0AD8A88E7B27184E73872EC0CCB3B42381316171194BF84
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.html

Path C:\Users\Admin\Downloads\RandomFlightGenerator-win64\RandomFlightGenerator-win32-x64\resources\app\index.html
Size 793KB
SHA256 8a9dbbb3eba56199059421085266be3c0cb37f194088b7a69515119330008738
MD5 2f8d31247da89e190bfcd060529b4353
SHA1 9e5d5fece00ad83dc493f66feb967e39cb25b0bb
SHA512 17fec1d1ca0fc3ca5b534a08a8a938bf8ddbfcbdc68036de983c84c67713cadb874c032577770cab3e3e4d169af71f161756fe5ced1533c9bd98a279044686d7
SSDEEP 3072:xMjMkEvC9+9rjjgbTSStgmlJBrqyG90gSzCoIns7OAz1VUpC6Dj+zNZUTTf4UkZ8:xMYK94r6TN87Ot886x0Tjcfd
TLSH
T14A054195C21A94A7CB6D0BD13DA2D123289C21173B9A395FD4EA03F790BD353219BCBD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

main.js

Path C:\Users\Admin\Downloads\RandomFlightGenerator-win64\RandomFlightGenerator-win32-x64\resources\app\main.js
Size 797B
SHA256 a0500b0710649f461a3218bfbc542532cd793789fde58571162fdf6c90e6b3f6
MD5 456174cf83c4cd3d029fc5140a1382cf
SHA1 29fa354a0979c9cdcc9467c816f6b034ec7eda19
SHA512 78536ed965fc58eaa1dd4d0c4c8a75223503ab9c54e1a593fbe7b211238c70757e66352e0b6e1493eb9e05f3d1def9b50c854e2b5f60077b89f8b72d32c87ee1
TLSH
T11A012515A6BC7338433300A94B6B63165322D413A4076F14B3CD4388DFD235A547A7CC
MD5 SHA1 SHA512 TLSH

Submit Download

package.json

Path C:\Users\Admin\Downloads\RandomFlightGenerator-win64\RandomFlightGenerator-win32-x64\resources\app\package.json
Size 282B
SHA256 f9250abc62662acb180d7603631f184f615bb8d275fa51222db2b9884d9da136
MD5 02fe987e9020c0d56b4d7d0178ca5a78
SHA1 1b947a34e115754625022556f15443de7ccf6176
SHA512 2474c8024ba04fadfc6bcd8ed8d6d8f5edf7ffda9c1302126ad372e64d4b5eeb4aaa864749e191eca4b190e36b0050b19b9c739d7a63c635c90437b529db02c4
TLSH
T15AD02E70B9E0193302DD09A6E821560BA2726C0F250CFC2D636B1019284CFB7A4BE2DD
MD5 SHA1 SHA512 TLSH

Submit Download

v8_context_snapshot.bin

Path C:\Users\Admin\Downloads\RandomFlightGenerator-win64\RandomFlightGenerator-win32-x64\v8_context_snapshot.bin
Size 646KB
SHA256 a8bd22478c4f85afa836c89d3a7f52c606b17872fbbefce268b499bedede10ae
MD5 a62fbbb671bf975ed46b42d9cf437bcd
SHA1 408b595b1dc6658533e0db1d35f509ab9ee70525
SHA512 87c934670df70afcced0ea5c73449a17ad27d5b6a25cedad9eb61634aaff8a42b713f578e861c2efbc77593793bba240a1495822b69c99a8ecaef64b07b6a62c
SSDEEP 12288:f97k1vtORkeGWFDjesZeLEY4QUH7zRpA8W:f97k1v42eGWFDjZ427/RpAB
TLSH
T1A0E4B5A2B784EF56E1DA6EB0DDFAEB923234F5D99E0B419B7149036E323D7242D0450C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vk_swiftshader.dll

Path C:\Users\Admin\Downloads\RandomFlightGenerator-win64\RandomFlightGenerator-win32-x64\vk_swiftshader.dll
Size 5.2MB
SHA256 7005598f9bb8559101458ddaac77e3a23f9876c0a1aaf7136a11f2d1d5173448
MD5 15d9ca6f1d87f15f5c67740df2bfa874
SHA1 6d84c52d33249b216223e02cb445b886bea6b45c
SHA512 24796d3aded0a49713489b285b9d38fd041a7376e900684053c1df106a509a315db9e646c7286fd59c79c664557e6d4e6843a55828abf04fc04d8b307829fc6f
SSDEEP 49152:IgQpJ5yZBtfCp00oSO8hCsDsbJQk/tJ4q0nLhII1ytiT45z+WEjNHsRLf7OFJOMZ:4n5yZBXLxkf5FJIaye
TLSH
T15D463903B2858099F05DD1B9474BA623F632F8801B72B6DF52A41F192E77FE06B39B15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vk_swiftshader_icd.json

Path C:\Users\Admin\Downloads\RandomFlightGenerator-win64\RandomFlightGenerator-win32-x64\vk_swiftshader_icd.json
Size 106B
SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
MD5 8642dd3a87e2de6e991fae08458e302b
SHA1 9c06735c31cec00600fd763a92f8112d085bd12a
SHA512 f5d37d1b45b006161e4cefeebba1e33af879a3a51d16ee3ff8c3968c0c36bbafae379bf9124c13310b77774c9cbb4fa53114e83f5b48b5314132736e5bb4496f
TLSH
T1A6B01211430088B36062AF3C41811F468765411C36020D491040540E83BBDB6A102394
MD5 SHA1 SHA512 TLSH

Submit Download

vulkan-1.dll

Path C:\Users\Admin\Downloads\RandomFlightGenerator-win64\RandomFlightGenerator-win32-x64\vulkan-1.dll
Size 938KB
SHA256 45adc3dac19684ed3af159ae3914fbbf2426a879e5a4c1e678e3c9b451fab01a
MD5 8bd643a9f7ef2619b792cf2544f27a8c
SHA1 8d5aba34d852c9b9f62a4dca5ca138dbc458c931
SHA512 8a81c4edde9d20ee24d3390338915f096a27956bf57815c443a37f15bdb4072a0c959376721d2354fd565045efb3340922a9a22f3293bb3784cc6df6a0ac353b
SSDEEP 24576:gawxZ1onv5Sp+D9R6StDWb36Z5W1DYsHq6g3P0zAk7Mh:dSSApY90IDWb36Z5W1DYsHq6g3P0zAkw
TLSH
T163155B23AA94456AD476D034D9828603CAB178911726B9CF03B81708BF6FFF4777DB29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4264-530-0x00007FFBEC850000-0x00007FFBEC851000-memory.dmp

Download

memory/4264-529-0x00007FFBEBB50000-0x00007FFBEBB51000-memory.dmp

Download

memory/4264-596-0x0000022D57350000-0x0000022D57A46000-memory.dmp

Download