hxxps://g-meh[.]com/library/windows/nexus3

Analysis

user interaction
yes
max time kernel
431s
max time network
427s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/08/2026, 23:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://g-meh.com/library/windows/nexus3
Sample260810-262sys1cke

Score

3^/10

discovery ransomware

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1064	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134308771565193179"	msedge.exe

Modifies registry class 23 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\json_auto_file\shell	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\json_auto_file	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\json_auto_file\shell\edit\command\ = "%SystemRoot%\\system32\\NOTEPAD.EXE %1"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\.json\ = "json_auto_file"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\鰀䆟縀䆁	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\json_auto_file\shell\edit	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\json_auto_file\shell\open\command\ = "%SystemRoot%\\system32\\NOTEPAD.EXE %1"	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-668679576-120646659-2289335452-1000\{E04EC57C-6C81-45D9-ADF1-AEE4DDF2E03F}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\.json	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\鰀䆟縀䆁\ = "json_auto_file"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\json_auto_file\shell\edit\command	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\json_auto_file\shell\open	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\json_auto_file\shell\open\command	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe

Opens file in notepad (likely ransom note) 2 IoCs

ransomware

pid	Process
3800	NOTEPAD.EXE
2328	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4860	msedge.exe
4860	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3660	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeRestorePrivilege	4328	7zG.exe
Token: 35	4328	7zG.exe
Token: SeSecurityPrivilege	4328	7zG.exe
Token: SeSecurityPrivilege	4328	7zG.exe

Suspicious use of FindShellTrayWindow 44 IoCs

pid	Process
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4328	7zG.exe
2328	NOTEPAD.EXE

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe

Suspicious use of SetWindowsHookEx 15 IoCs

pid	Process
3660	OpenWith.exe
3660	OpenWith.exe
3660	OpenWith.exe
3660	OpenWith.exe
3660	OpenWith.exe
3660	OpenWith.exe
3660	OpenWith.exe
3660	OpenWith.exe
3660	OpenWith.exe
3660	OpenWith.exe
3660	OpenWith.exe
3660	OpenWith.exe
3660	OpenWith.exe
3660	OpenWith.exe
3660	OpenWith.exe

Suspicious use of WriteProcessMemory 55 IoCs

description	pid	Process	procid_target
PID 4876 wrote to memory of 5000	4876	msedge.exe	84
PID 4876 wrote to memory of 1064	4876	msedge.exe	85
PID 4876 wrote to memory of 1192	4876	msedge.exe	86
PID 4876 wrote to memory of 1192	4876	msedge.exe	86
PID 4876 wrote to memory of 1104	4876	msedge.exe	87
PID 4876 wrote to memory of 1104	4876	msedge.exe	87
PID 4876 wrote to memory of 1104	4876	msedge.exe	87
PID 4876 wrote to memory of 2420	4876	msedge.exe	88
PID 4876 wrote to memory of 4804	4876	msedge.exe	89
PID 4876 wrote to memory of 2420	4876	msedge.exe	88
PID 4876 wrote to memory of 2420	4876	msedge.exe	88
PID 4876 wrote to memory of 4804	4876	msedge.exe	89
PID 4876 wrote to memory of 4804	4876	msedge.exe	89
PID 4876 wrote to memory of 4868	4876	msedge.exe	91
PID 4876 wrote to memory of 1580	4876	msedge.exe	92
PID 4876 wrote to memory of 4868	4876	msedge.exe	91
PID 4876 wrote to memory of 4868	4876	msedge.exe	91
PID 4876 wrote to memory of 1580	4876	msedge.exe	92
PID 4876 wrote to memory of 1580	4876	msedge.exe	92
PID 4876 wrote to memory of 4500	4876	msedge.exe	96
PID 4876 wrote to memory of 4652	4876	msedge.exe	97
PID 4876 wrote to memory of 4500	4876	msedge.exe	96
PID 4876 wrote to memory of 4652	4876	msedge.exe	97
PID 4876 wrote to memory of 968	4876	msedge.exe	100
PID 4876 wrote to memory of 3676	4876	msedge.exe	102
PID 4876 wrote to memory of 3676	4876	msedge.exe	102
PID 4876 wrote to memory of 3676	4876	msedge.exe	102
PID 4876 wrote to memory of 1228	4876	msedge.exe	103
PID 4876 wrote to memory of 1228	4876	msedge.exe	103
PID 4876 wrote to memory of 4900	4876	msedge.exe	104
PID 4876 wrote to memory of 4900	4876	msedge.exe	104
PID 4876 wrote to memory of 4516	4876	msedge.exe	106
PID 4876 wrote to memory of 2388	4876	msedge.exe	107
PID 4876 wrote to memory of 4516	4876	msedge.exe	106
PID 4876 wrote to memory of 2388	4876	msedge.exe	107
PID 4876 wrote to memory of 2388	4876	msedge.exe	107
PID 4876 wrote to memory of 1176	4876	msedge.exe	108
PID 4876 wrote to memory of 3776	4876	msedge.exe	112
PID 4876 wrote to memory of 456	4876	msedge.exe	113
PID 4876 wrote to memory of 2024	4876	msedge.exe	114
PID 4876 wrote to memory of 2956	4876	msedge.exe	116
PID 4876 wrote to memory of 2956	4876	msedge.exe	116
PID 4876 wrote to memory of 2956	4876	msedge.exe	116
PID 4876 wrote to memory of 5808	4876	msedge.exe	124
PID 4876 wrote to memory of 5808	4876	msedge.exe	124
PID 4876 wrote to memory of 4860	4876	msedge.exe	126
PID 3660 wrote to memory of 3800	3660	OpenWith.exe	128
PID 4876 wrote to memory of 5256	4876	msedge.exe	131
PID 4876 wrote to memory of 5216	4876	msedge.exe	130
PID 4876 wrote to memory of 5256	4876	msedge.exe	131
PID 4876 wrote to memory of 5216	4876	msedge.exe	130
PID 4876 wrote to memory of 5928	4876	msedge.exe	132
PID 4876 wrote to memory of 5928	4876	msedge.exe	132
PID 4876 wrote to memory of 5956	4876	msedge.exe	133
PID 4876 wrote to memory of 5956	4876	msedge.exe	133

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://g-meh.com/library/windows/nexus3
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x24c,0x7ff8bdddc188,0x7ff8bdddc194,0x7ff8bdddc1a0
  2⤵
  PID:5000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1760,i,1370312550596745814,10334190838261313043,524288 --field-trial-handle=2440,i,15511997886185818998,12417750374633045241,262144 --variations-seed-version --mojo-platform-channel-handle=2564 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2252,i,12057688872702798651,15943437567561104512,524288 --field-trial-handle=2440,i,15511997886185818998,12417750374633045241,262144 --variations-seed-version --mojo-platform-channel-handle=2584 /prefetch:8
  2⤵
  PID:1192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1632,i,5591941615011373503,7830273213650913442,262144 --field-trial-handle=2440,i,15511997886185818998,12417750374633045241,262144 --variations-seed-version --mojo-platform-channel-handle=2436 /prefetch:2
  2⤵
  PID:1104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3436,i,14157845489125208508,4735054766023415499,2097152 --field-trial-handle=2440,i,15511997886185818998,12417750374633045241,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:1
  2⤵
  PID:2420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3440,i,15461710165185116359,6423475563543272431,2097152 --field-trial-handle=2440,i,15511997886185818998,12417750374633045241,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:4804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4200,i,16489036652232976760,6971381311363103874,2097152 --field-trial-handle=2440,i,15511997886185818998,12417750374633045241,262144 --variations-seed-version --mojo-platform-channel-handle=4228 /prefetch:1
  2⤵
  PID:4868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4236,i,1059768893597118384,1672357584296973347,2097152 --field-trial-handle=2440,i,15511997886185818998,12417750374633045241,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:2
  2⤵
  PID:1580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5656,i,7190278986504991788,89705321741546830,524288 --field-trial-handle=2440,i,15511997886185818998,12417750374633045241,262144 --variations-seed-version --mojo-platform-channel-handle=5388 /prefetch:8
  2⤵
  PID:4500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5664,i,13906281802042821688,10867136003911878674,524288 --field-trial-handle=2440,i,15511997886185818998,12417750374633045241,262144 --variations-seed-version --mojo-platform-channel-handle=5688 /prefetch:8
  2⤵
  PID:4652
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5572,i,5272735309859734922,2424673783701275800,524288 --field-trial-handle=2440,i,15511997886185818998,12417750374633045241,262144 --variations-seed-version --mojo-platform-channel-handle=5544 /prefetch:8
  2⤵
  PID:4272
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5572,i,5272735309859734922,2424673783701275800,524288 --field-trial-handle=2440,i,15511997886185818998,12417750374633045241,262144 --variations-seed-version --mojo-platform-channel-handle=5544 /prefetch:8
  2⤵
  PID:968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6336,i,11130603220886997937,3256436353121618998,2097152 --field-trial-handle=2440,i,15511997886185818998,12417750374633045241,262144 --variations-seed-version --mojo-platform-channel-handle=6332 /prefetch:1
  2⤵
  PID:3676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3680,i,8104803154913478444,1176149398070889209,524288 --field-trial-handle=2440,i,15511997886185818998,12417750374633045241,262144 --variations-seed-version --mojo-platform-channel-handle=3744 /prefetch:8
  2⤵
  PID:1228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6560,i,5714580294588083785,2540121428073443697,524288 --field-trial-handle=2440,i,15511997886185818998,12417750374633045241,262144 --variations-seed-version --mojo-platform-channel-handle=6580 /prefetch:8
  2⤵
  PID:4900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6800,i,2026455599842061037,15316922345465310657,524288 --field-trial-handle=2440,i,15511997886185818998,12417750374633045241,262144 --variations-seed-version --mojo-platform-channel-handle=6532 /prefetch:8
  2⤵
  PID:4516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6804,i,16332123304390681008,763052948599063294,2097152 --field-trial-handle=2440,i,15511997886185818998,12417750374633045241,262144 --variations-seed-version --mojo-platform-channel-handle=6620 /prefetch:1
  2⤵
  PID:2388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6844,i,943487078241062294,14677905942000105654,524288 --field-trial-handle=2440,i,15511997886185818998,12417750374633045241,262144 --variations-seed-version --mojo-platform-channel-handle=4496 /prefetch:8
  2⤵
  PID:1176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7092,i,15497965260390200178,6161680927949090364,524288 --field-trial-handle=2440,i,15511997886185818998,12417750374633045241,262144 --variations-seed-version --mojo-platform-channel-handle=7224 /prefetch:8
  2⤵
  PID:3776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6528,i,6632628819115482399,13409790981465866326,524288 --field-trial-handle=2440,i,15511997886185818998,12417750374633045241,262144 --variations-seed-version --mojo-platform-channel-handle=7228 /prefetch:8
  2⤵
  PID:456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7216,i,10786684868081719539,12353647617615178570,524288 --field-trial-handle=2440,i,15511997886185818998,12417750374633045241,262144 --variations-seed-version --mojo-platform-channel-handle=7256 /prefetch:8
  2⤵
  PID:2024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=5344,i,3238986649827787565,8538591243018153624,2097152 --field-trial-handle=2440,i,15511997886185818998,12417750374633045241,262144 --variations-seed-version --mojo-platform-channel-handle=7236 /prefetch:1
  2⤵
  PID:2956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2068,i,17773193999194962375,6531377511089541282,524288 --field-trial-handle=2440,i,15511997886185818998,12417750374633045241,262144 --variations-seed-version --mojo-platform-channel-handle=6944 /prefetch:8
  2⤵
  PID:5808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4816,i,18045828384147880295,17881479881075630048,262144 --field-trial-handle=2440,i,15511997886185818998,12417750374633045241,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5236,i,12273679083218619048,16893578720200736163,524288 --field-trial-handle=2440,i,15511997886185818998,12417750374633045241,262144 --variations-seed-version --mojo-platform-channel-handle=5020 /prefetch:8
  2⤵
  PID:5216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5244,i,3882406867295244859,17528775026035163439,524288 --field-trial-handle=2440,i,15511997886185818998,12417750374633045241,262144 --variations-seed-version --mojo-platform-channel-handle=5240 /prefetch:8
  2⤵
  PID:5256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3640,i,2249491898539526880,18397969840574739286,524288 --field-trial-handle=2440,i,15511997886185818998,12417750374633045241,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:8
  2⤵
  PID:5928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5756,i,5860365984941416063,10816535223278541088,524288 --field-trial-handle=2440,i,15511997886185818998,12417750374633045241,262144 --variations-seed-version --mojo-platform-channel-handle=6772 /prefetch:8
  2⤵
  PID:5956

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:700

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1828

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Nexus\" -spe -an -ai#7zMap22990:72:7zEvent11853
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4328

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3660
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Public\Documents\reFX\nexus\content_properties.json
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:3800

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Public\Documents\reFX\nexus\settings.json
1⤵
- Opens file in notepad (likely ransom note)
- Suspicious use of FindShellTrayWindow
PID:2328

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 16KB
SHA256 814d47aad78c212b52568b9c7b58d242899d490d3afebce66181cae50c880df5
MD5 8c7cdfea4284ba987d295d82a9c7ddd6
SHA1 7d1a3a66f2d64a383b230196ba89a263ce7ee957
SHA512 59c8229e834c944265aed4131c79f41f9f940a48651b9fb18800cef5bae36d17c7fd5880120c6fee8ce22a157b65bc63846b65765bc4dc86e15926dcce400d0d
SSDEEP 12:sf9iXhV0xoUZxCe+JKlkQuMRxCb8TXuYJ0IJpPK6BsyW1inPiz:U9iRqxoUZxWMk8xVTeYWI31BtXP
TLSH
T105724C85B34498FFC8835E7189BD27903774F6DF1F02866B6A6A760E2E271C84F44224
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 81240d13af4ca099e1358c75991e3fa5640dbb3aac72c2d98006f6159bf74aa0
MD5 96dd753cd2d8557b97ab2cd76f7fc6cf
SHA1 81697ccb13fb04a07bd47b552b3607597251f36d
SHA512 355c412a688a71b124e85c0527177b3f97efceb2a5553f8428e0913940daffd3bd176f5476b940c64eee52d543f0568112ac073984d9a64015adc15cbef552de
TLSH
T174D09224BA29A149E282007AA881EB565219DA95296B9622E620C44DBD2B925A3851C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4bf0783d55eb083b4adaa03ed8b76a2bd35b0819c8ad2530a78e1b8d6856010b
MD5 7a50c2e276f05b686e8cb6c95b86650f
SHA1 bc892af04a9d6b1bee8047f67518d676df864301
SHA512 f1d02fd9f067323214d78de08172e1a78028eba76f4754436f4d77b849e8422865dcea22be13f21c36ac2c5807b393c1dffdb0a3217c3353a517a0467461a474
TLSH
T19BD022203A28A008E282003AA880EB020208CA80282BC322E220C00CAC2B820A3800C2
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log
Size 33B
SHA256 68c7ad234755b9edb06832a084d092660970c89a7305e0c47d327b6ac50dd898
MD5 f27314dd366903bbc6141eae524b0fde
SHA1 4714d4a11c53cf4258c3a0246b98e5f5a01fbc12
SHA512 07a0d529d9458de5e46385f2a9d77e0987567ba908b53ddb1f83d40d99a72e6b2e3586b9f79c2264a83422c4e7fc6559cac029a6f969f793f7407212bb3ecd51
MD5 SHA1 SHA512

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 291B
SHA256 bb8af5ac0d142883368099686c98876b6beea34f419af92a9fe8189bed7d983b
MD5 a03fdac03d88220d05a602b4d21f2117
SHA1 49cccc0b22fd439d5d602bc7ac4e8940bfc0cf71
SHA512 6087cc2f462ddbcf9635864c3ec5279c061b54d853d95c04dd878bbb079e1da65dc6f07a13eb24d9dd37eba6e537a50e094b5e708511efcd212fb9b48dd37fc5
TLSH
T169D07D48C5C0C36A9600D8C75114D70D9144264FD6C4B60E1B50C88C3003088E797686
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 903f4f29ccfae096a112f0d9ddb2c36a5fc8866c63c64cf18c24d94bd80f5cb9
MD5 e326ea8aa83d34fab411aa2358681e1f
SHA1 15ff39e16999f688db932e34dad71a1abd7a706a
SHA512 e3d7f6a15d9193aeeffd633d34339d332948325b111b5022ca454f6d035c29ca2038ccb83c93da07c2480ca9a0f5fc547e03716c94a59590c683efc56fe8f997
TLSH
T1CB818237DA51C423FB5109B298CB09FA767F84DDF0034E4E12235ABD7718B69C2293A4
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 3d79e8e71aab8fc22f315760982ad1686a8e166b1b59e8f20830e58fc25594c6
MD5 57a1288d15ecbf2804497f665ee37038
SHA1 4c596fef6618746b2d3096b3509ddd3edf605285
SHA512 82769b77e610ec90cc5238ff668f7538b343b7bfa3333dddb12e77a6d33bee56bc87bb14320120e5363c2539471f44fab98f2e91e89d6a543316dbde17f42195
SSDEEP 48:7Uzj7TL1mWIxk5qqJnaEVEkWWsTpipCCx9XaYRvE4Csml3BQSEheJcbwu:7UzgWIYnnE1nA+T3BQSEheJcku
TLSH
T1789195BBC611C923FB5609B298C702EA767E84DCF9534E4D12235E7C7708BA9C1297E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe586e55.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe586e55.TMP
Size 3KB
SHA256 8f79eaaaa7a385261c738475ecc2d319c671cd361532f99f067c0b03a723c518
MD5 2c5c6fed870b456f2fc97cfc1aaa509b
SHA1 7a1e78482ea77cbc4245fc507b65cc23a07ccee1
SHA512 1b3cee24182bd43da5b973fb95b7dad3e6e09eb11f007610214da14c8cf2eafebb07ca05779ee3b9332a716bd4a73dc43335fe95ef31296ebb69db0db9bc93a8
TLSH
T166615E378A11C463FB6601B298D301DA747F89ECF4175E8D1117157D3718B2AC268384
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 0fa82f31c39f2b56ae35fc7b872075a89b36f410f848fcfc7bba6f65945a6d9c
MD5 824cf8c5ac0d170e8821cf07c295f039
SHA1 365ae40169b6542599aa722af418c5f3dbcc02d2
SHA512 a50d2de677fc09136eef8edb8e64402cd94b7c50bf8d27aa1ae4fee1a8c006c200a56dcf77a6d8c80a281dfa64f33852efe75d0e8856812ba64cd59d3ba79a65
TLSH
T12F51ACF783F5866ED91152F4AA04AE2FCE5C0515836C7D2A8AD4EF5793E30B1E101A4F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 41f4f9396dfba5e9a9c606446744a782e85f10e8164f782053c31a298fee9fab
MD5 e3562f0e720ce14b3861e485c5f2a534
SHA1 5ad4f64797bec1227512145d9d07e8b884d2c061
SHA512 0c0d9ec580a984bf4e2beb66f4700837777b63586f31a51f5b772065dbcacfff0546bc399197c1004d14342f8551b62ff81a5c76a46e861c5b1e3ee8a79cba28
TLSH
T15A51BDF783B1866EDA1152F09A04AE2FCE5C0115836C793A8AD4AF57D3E30B1E101B5B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 38d62bce33581a6f4b654ed84599d7a146ae723ccb56b63388e3ced4697f94bc
MD5 150b6a19fd40e20c9cfc98d6b3ba316e
SHA1 41e40dbdf33f1910e5f2370d2aef6143bc03f940
SHA512 95204c1c19f3920ee63337d0111eabd249eccd9a825d5b152b20ec9ca3f270379c4313a4089c1eb022516c315a3b6609c1cd26461348b5178c3dd992ae01b065
SSDEEP 192:sxZ8RB9x/fX/sBjnCYIdpm4/HW6+WNP8t5KrIfYC4WrI/Ig5BJ:sxZ8Nx/fPsBjCpjHb+8IfdA9
TLSH
T17C32C7536934A97B8CCBD21ABA15BF13E6FD503291941E58EBFC9A1C08E77DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 26KB
SHA256 e146a443cd7e7023d04dc1e8e56d8690fa947d036a7a372b05f205873faefe4f
MD5 de098e3f11c67914a6ee8e223bef86ae
SHA1 53857b602629650123866b0ede55008494d6d848
SHA512 2554f49f15311d3f161baf52bc8b60752ca7c9f96d5dc09422358bdbe884a550ac89eff870f72485829a65c4ea2399ace3ab74b20f503858025f435b6104f809
SSDEEP 384:sxZ8Nx/fPsBjh66s8qMpRiYnazAW8pZS15posJWeT+1pJHb+1L5I9:s0Nx/f8jh4Mnc7WeT+1zHb+d54
TLSH
T1EEC2F706A824C8379EC39D1D643D7E33EAEC506212C5CEEA5AECCA1C019D1FDAB4B457
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 70943ba1a8d29258dc1d4cf3a5f2a0476d897a7e712d1345591a2c7e69f6178a
MD5 49568bdeafbb8a4bb7b72b59864fa16c
SHA1 d4d0ec812c0f08a89ed29deed70d052c7fe3b5b2
SHA512 f65b36ab3e99b8dd91d95c5cf77af7fb95617c3186b3f21d960a5208dfdc5ad85848977a7c19c1dc87b9f5afe0e0ecd14e33f35fc6aa9671117752b9d7dd2f43
SSDEEP 192:sxZ8RB9x/fX/sBjnCvIdpmy/HW6+WNPt6I/YCAWrI/Ig5BJ:sxZ8Nx/fPsBjCA9HbT/dA9
TLSH
T17A32C7536934A97B8CCBD209BA15BF13E6FD503291941E68E7FC9A1C08E76DD220741F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 1b70e68ab3e8b03d644703d9c412af101c142c5e11d159d6dbe333cb29c84465
MD5 7a9b03bd13699d1d782b1b5ea8e29ec0
SHA1 7698f62bd728d6861c96ba5fc73951af9e0cae9a
SHA512 25fed29f3c02ce51a8442c7eb9461decad02e2443b172d98157fd81682e79ace8f37970600f41aebe12bda05de3517061f62c93a0fefe8757a67df7c4004201f
SSDEEP 192:sxZ8RBkx/fX/sBjuCvIdpmy/HW6+WNPt6I/YCCdrI/Ig5zJ:sxZ8Ux/fPsBjRA9HbT/gA7
TLSH
T1FD32C7536E34A87B8CCAD219BA15BF13D6FD503291941D68EAFC9A1C08E76DD220741F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 b04317b0a1313af08bfe7074200155e6329e058b886db3cb32684605b30b3122
MD5 2d2c66f2c07f8e41f70d0d0b71af1834
SHA1 b9a1d6a36207398a28554ac7e837ad1ee140bc6d
SHA512 bfa15eaff177e8b36cfbd716a62a638d99770195c2a5d34130297da787ac3d307d99cb9e64b9989b376c12db6506e100c3b23ba14a93f9182f90204f1f3acbbd
SSDEEP 768:RfqbUj+WvSCU68F1+UoAYDCx9Tuqh0VfUC9xbog/OVHZLlRTKrOroQ:RfqbUj+WvSCU6u1jaaZLbWrFQ
TLSH
T1AAC2E93B340CCA7E4FC01A9DDD5A6F972EA802C76B588D4447FA994C02C77EA512B4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\dfa4cd3b-6396-44b1-9341-22ecfa35924f\index-dir\the-real-index
Size 360B
SHA256 1852f97010b7f50dcf162f775d528216b9b547670c9fd3ee14c7769e2a32d2af
MD5 9c4495006828ae6c607c0a2b79738fd9
SHA1 6f9ff98b4543c7eb069e0ecd350e668daae070be
SHA512 eb5b7d61646bb0c7f22b7ea6a92a3714182c0cf8e2b8761bee06677a41db8dd506843ca2808aabe0ff9d6a9444a7cd6e542354c383c0af5d5578b733b730c1f7
TLSH
T19CE02B114ED1083ADA201E75147250E9B3F04CFCA611984F243DA66F2C1A34C54562CC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5c9dbe.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\dfa4cd3b-6396-44b1-9341-22ecfa35924f\index-dir\the-real-index~RFe5c9dbe.TMP
Size 360B
SHA256 cf7de33c89df4eda93c8f6c81c471a5051d475cde13de58f0c4910eaa36eed98
MD5 d63d926f5bd1c4226f36ab72a5e4437c
SHA1 784d3f177a424f048ecc01d24f4ec0f901298d69
SHA512 c1e429b70591cc777717b9d3864a7e001803cc0dbd3fe1bac52c694607a001599aa958e0aa3b2b7682d601cf61c460d9303d26a39f3196acfc0c0cdbad6350eb
TLSH
T1C3E02B4587420522D9100576141154AAF3B589A07532B98A346C682E2C2968C955218D
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 aeb95789587f6ee9ecda4116fc6b080a0336feaebc0c2aa4a7291e2542e6707a
MD5 7a554dc0b26a21895ac20b06a8bd455a
SHA1 68d4911d170156040179a9f6f3647684f78f3098
SHA512 ecf0e8f62e219ac5d1e4a1cbd4297de88db05bbf6ca52cf274af380ae636a457d1ae9450da6406940f10f70da834c06077d652a7200b6cd244abf43a46c05d55
TLSH
T117E0D8BA29E72860BC7BA3F5247148E002597998CD86BC9E1069A2D750B3361285AC61
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 37f8461e6863a8e94c0bc8fb1411558ec4d02aff00631ace57d983e8c5d12053
MD5 a0e13bdf41ad507a39361880394f6360
SHA1 0acca8f57ae7a8c08a3d1e6a0832240dcd2d8179
SHA512 6de122967ac83114ac4c9e47e750e34852a8c11dca33ecb1a21ce1b73f481c0e4cb78e787acf45da7cfe014a648e3dff7ab5bada9c371a21527ba3ecc2e1bd8e
TLSH
T139A0021519749261C0400271956312C43750E8500705665644A505649CA0584421603D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe587395.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe587395.TMP
Size 48B
SHA256 2bcd82713f4ec98121c460d1476f65baee7028f832ca604c0928f0b2be894198
MD5 5d801ee38e1b4678071b64faf78ac2a5
SHA1 26def7a3623aef1f195f9889e258982abaca8db3
SHA512 8b730d586d5f483b9a1876492a95b9f8eb4d2546c8d03ec5da1d5940e241d8b1c9fbed0f96d72e5fd42ed205e36f341c27276c5fba51403b6aa33a987eb7003a
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 793B
SHA256 ec68c6a4842c0ef79ee7e903db2e37e01a31aac8f99f4c1321a3d13b05778f6e
MD5 0b2bc526e5a7b8cdf8878909414743bf
SHA1 52df0532f391b8880597b4e84a8294c88d88bef0
SHA512 73ed5bca887b30f895765c5a9346c4d881a5f8b98af42c1ee7965b0c709b863ea942b32465897be12508a7c75ca0bbf00b175f94425abd86cd9454843137da91
TLSH
T157015C12B6BE25013D7F658C8858862A4341349338F4682F3BAC4A5519B7F408FFECED
MD5 SHA1 SHA512 TLSH

Submit Download

c86c4bfb-487e-4c37-b860-1acd238ad638.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c86c4bfb-487e-4c37-b860-1acd238ad638.tmp
Size 10KB
SHA256 45494b9a9155c9260ebf905d781f8aa56df71e9dc1d713a7c3139f9e7c3b6bad
MD5 ed07bb7995653d5455eeb16762c9c206
SHA1 b99f8afcee2c3810e8758713b5c8d2fb89adeda0
SHA512 f24521933752e5c41362e62eb8d0fc214f9bfa47a57c62da28cadb1d1468c667024c9d50c6c1d6155e65f0c6d32bc107bda550c779dc12149b1bb8178a41066b
SSDEEP 192:sxZ8RBkx/fX/sVjuCvIdpmy/HW6+WNPt6I/YCCdrI/IgrJ:sxZ8Ux/fPsVjRA9HbT/gA9
TLSH
T12B32C7536E34A87B8CCBD219BA15BF13E6FD503291941D68EAFC961C08E76DD220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe58ef9b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe58ef9b.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 fab375463fb4ad24df63ce041b4c5edbd0a03fffd7c1edf9901ee2319aedfd0e
MD5 63a0a3a31996202dba2094049e01ff4b
SHA1 1dcc3145b152ceefd2a3e181bdc87492875d5844
SHA512 d4294fa04d503d72814b9c7e2bb7862d648e082367fccca767c58f9ec2a48cc13ac43cc09bf8742053412ca4ffcfdc9d442d9e11c3454087e34ad061e8fa4dfd
SSDEEP 192:u6LsNcOQ9JmceFmbiHjQmiU1sBd4Ea+jN+FdChHtFYamwCrqr646c:zsNcOiO71eyEa+edyjAwLF6c
TLSH
T158425B366C789C3799E6B545F44736139FF881679A8D2FA4D6DC9F0C00DA6AC230BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 5d2b2eb4626fafccc726b496783e6f7cab5bc2ccb0942564720d74b3982a6b6a
MD5 c66dda197d24f8a5c8f6b1c65dca9567
SHA1 9b288793eacc4d868bf6e6cf2f6d8282ba27f3ec
SHA512 a1756324d617de2a02e1625cee14fbed17207381dc1e9741a3d4abd8fbada1f19ca4adaeb5383ac6d05bd87052ee4586bc59ddd18041e1ec2234210c6168901f
SSDEEP 384:YJiFb7ZcIPUsNv8TUNTUlIl1iO7rPyEa+edyj8wLF6T:rFf88wg+m5a30YSsT
TLSH
T18EB22AF258E78836D9AE5B47E77D2D138EBCC067B5845A50B3D89A0CCC961BFC30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 9bb2e87e17ff61e47d7317644a678ea942fe3e83e6ae488ff5e140653fd39469
MD5 ed58bb20986a77be10de903a64a2637a
SHA1 30274e335e79949ab069ca1e7838b3b976f066b6
SHA512 c5b2e34f5e5105a7b5a149d0e4c7864b044f33741fef97246e06da1a040f4cd0713617445959a2f9512c03e7849421649c9d00b733465d9e53ff52718bc00546
SSDEEP 384:YJiFoZcIPnsNw8TUNTUlIR1FO7NPyEa+edyjvwLF6T:rFWvZwgNe5a30jSsT
TLSH
T1A1B22AF258E78836D9AE5B47E77D2D138EBCC067B5845A50B3D89A0CCC961BFC30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 04abeea1e987e8936a8a910860e2ee2a12388a3576e7a22f18b78f54b04772e3
MD5 e0e871dfac3d62d875e7d2a3926a2e16
SHA1 f9828ca41c0fa45c3f249ea9be301c777c2e38dd
SHA512 e1466222da03e5f1f88cdd7e48ad0976f32c60abfaeddff11e1b1d4989f628b338111e700cbb218cda1851b62ac124378439b748a9d2ac6822ff30331c32cc3b
SSDEEP 384:YJiFOZcIPwsNw8TUNTUlIR1FO7+PyEa+edyjawLF6T:rFsYZwgNb5a30WSsT
TLSH
T186B22BF258E78836D9AE5B47E77D2D138EBCC067B5845650B3D89A0CCC961BFC30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 510192041c775e2a9f90144b4299a7a03e3083999595500ba808bac5bfa84dcd
MD5 473b7679a113efadf5e288d7af1f59c4
SHA1 a437d5d9b84eff3ec621f16ebf495b024109ebbd
SHA512 592231bc58e635b48df4037b893c2693307a16c7b1c2474051b9880efc335253762a312ec108041b4ad415708bc8e7f8732795c619b45ceed9684a2928f5d8a3
SSDEEP 384:YJiFGZcIPevsNU8TUNTUlIl1iO7jPyEa+edyjvwLF6T:rFUMZwg+e5a30jSsT
TLSH
T170B22AF258E78836D9AE5B47E77D2D138EBCC067B5855A50B3C89A0CCC961BFC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 9bb044333553755d5e67a6eb7584ff27ebd131a105620e29c34952163f31210c
MD5 e33794decbf15488dde5f2449839432b
SHA1 06a1f118ff8e9bc705ad798baf853a9220e14637
SHA512 e89facf9b30409288194cecf09d612226faf42a7a37333a3c83c48c07cbfbf7e5dd26855b5dd9b8ececdb02633e35a030b7df2896cca78ac7e357af6b270fc47
SSDEEP 384:YJiFVZcIP3sNw8TUNTUlIR1FO79PyEa+edyjwwLF6T:rFt/ZwgNU5a30kSsT
TLSH
T178B22AF258E78836D9AE5B47E77D2D138EBCC067B5845A50B3D89A0CCC961BFC30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 a22ce8de0941c55dc04a401a9130ad542cf01d5e8de07e8363083a07484c01d1
MD5 006fa899602607844463d8440e36bb66
SHA1 b1bb67b6c8754e5702b2b6eff1b764f125821dad
SHA512 3007805880dc3772e289299af8c9be7f2d75e44c655100a960dfd02db495f681c0853afdf033a5f8e0813780150830ba86f6af46269966b14334f8fd76946b9c
SSDEEP 96:EqONkiQsjpf1bxX5ih/cIPURHl8h4otop5VAnDVeBfPgvE5BzatIRdy+0Uf+FdCF:vONu6Db6QmiUy+0HBa+jN+FdCtRgwpU6
TLSH
T1DF02E73568786CBB9AE26E49F48737275FE4203BD99A2B94DADC5F0C00D765C2307836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 17KB
SHA256 887ad88c6a1abaf4f29e4147350559bc6c187f784a1598afde3614a6d76bbf42
MD5 6bb02f104138513d7e1a37b15e3bfcb5
SHA1 ffeba73a1d7da966e29bf8ae44c3a24074bf9adb
SHA512 9fffbe31dca21a28cd8c3acd4f9526d415caedf1779360cbe74f445e564424248bf14396fc4e23a8077439212aa03a3606e40c3ffb2c5c3cf08d9549ba10f502
SSDEEP 192:u6W+xasuheOwQxMZsNcYfQ9JmceFmbiHjQmiU1sBd4Ea+jN+FdChHtFYamwCrqrI:cZcI+sNcciO71eyEa+edyjAwLF6T
TLSH
T180726D326C785C7759EAB546F84636138FF88127A6CD6B94D1ECDF0D00DA5A8130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 3d1d4c12fff790360051a3f84092b38b11c44038a90fe945281f9cc9f4861d88
MD5 6ab270889fcae3e367c7dfa9be8c573f
SHA1 196d158ca55791085b60a79fb9ade58b22678400
SHA512 d124138bc117de6729f9373bd82bfb7618b4aa12a92efea7f8226dbb7e168a9652593906eccea332194f376c1fa749a98eb702f5f5142484840229d6d5d4d2b7
SSDEEP 192:SONV6DbtQmiUyb0uBa+jN+FdChHtFWNzwCrqrU6:SONV6DzuBa+edyjawLU6
TLSH
T17E12193668786C7B9DD27855F88736139EE45127DE8E6B90D6DC5F0C00EBA9C230B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 17KB
SHA256 3c165d46f0206f591932a836eee20edb5a803c4b3949a84cc84def07fad513f4
MD5 965ab757bcc397188a43a577760de71b
SHA1 5acbdd232a2083c317a0c2228ccb8f3649dbc012
SHA512 c7b19ee76921506209940d08a16a20f9417ee76ede9c0a7858fde6dcdd32a05bccc2e989986debe4a953dabf7b1c55cde9335cb3148e31a766dbe6c7aadd6194
SSDEEP 192:uBf+xasuheOwQxMZsNcYQQ9JmceFmbiH8QmiU1sBd4Ea+jN+FdChHtFUamwCrqrI:WZcI+sNc1iO7seyEa+edyjUwLF6T
TLSH
T177726D326C786C7759EAB545F84636138FF88027A6CD6F94D2ECDF0D00DA5A8130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 5d03e7e30075e46b5e511d1b48a484633578cf6efd96676bc112abe8165633cf
MD5 c6d03745a92f1cc3969430413adfd23a
SHA1 433bad727fa26aae897714c520c85b8caba0a18d
SHA512 d303c6101a1ce68523422f106778a1112e52603739e3e8c74e52007727089c541cf5ac45ec01bfd2ffbc4259d63ac3408edc178758e04abc748aa503c7488c27
SSDEEP 384:YJiFPZcIPevsNU8TUNTUlIl1iO7jPyEa+edyjNwLF6T:rFHMZwg+e5a30pSsT
TLSH
T1F7B22AF258E78836D9AE5B47E77D2D138EBCC067B5885A50B3C89A0CCC961BFC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

82abba9b-3546-4a19-91e8-a4f10667e981.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\82abba9b-3546-4a19-91e8-a4f10667e981.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 ab4afad7dcf36423053e39c541df5e1acfb764c644de721c7cb85f5dc83abb6c
MD5 97b53d41bc8381402d6071fd62b75626
SHA1 f96588ba9a5795052dc96ce1dd174ceaf87d494c
SHA512 8333c8d2c13c266bde1d8bc0dc1fc16193015359163d0b3d66e91c480ad62b2bd0d8447c89379e6f097229b4847ab6567cd6394d98588439e5426a1056096552
TLSH
T19B412A58BAFA1118B3B77E56ABF7686D447FB8772E0AD09E00110E4F0672B40C861B37
MD5 SHA1 SHA512 TLSH

Submit Download

Nexus.zip

Path C:\Users\Admin\Downloads\Nexus.zip
Size 8.6MB
SHA256 751b99f4ac429b35b5905af5803d150ae4240f931d2ff4a239d9c1f9babd791c
MD5 3515bebfad2ce1c271f7ed0321aa0924
SHA1 3f9e7682f94cc8c47242bd1617a84a660c1d05ee
SHA512 4ba8fe73bbc140e19b6f7b48a89b2a8a84203d0e822470f648d68ba505baa455cb1894833c8758d0127ea4f8df5927b9916329cf0c057bd712ddce30a1b86fff
SSDEEP 196608:9Fhzxn/EN5hwZ31joTCAAPZY0usOd0QfkOmg9m/XcvAsO+1qkcnS:V9/EGuCPhpusOddrhckgG2S
TLSH
T18096339BCA786E85E970D234D05DB703A3CF21C10E44DAC2564785DA91C1DE2ACAFE9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_properties.json

Path C:\Users\Public\Documents\reFX\nexus\content_properties.json
Size 43KB
SHA256 9286772a43a2db8364141b110e0ca3fe69e7baf04b73b03badb3d5221bd151c3
MD5 f715fe30cc789c06186f0c918498116c
SHA1 7433d40e62865f200c1c95f6ceb1758d3c2d9ed2
SHA512 98c54be39c01efbef1722bd535fc3d83cc9c91612f20d1c5cfd7425eacfc42eaf973c1038e19a305034e42f7f1001dc7d0cf04a6a12698ba9225a2383a3ad20b
SSDEEP 384:jeQr/SR37/fW/+M9YUd353q/QV2yERjW/d/mUPD:jeQr/q37ugyERjWJmUPD
TLSH
T16E13D66ACE244D670CDE90B168EF1D0A3058935B0DD8BE067B6D128D2F4DA5FA6702BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.json

Path C:\Users\Public\Documents\reFX\nexus\settings.json
Size 320B
SHA256 5da71ffe858ca1240540e5ace21ca10dc47161a09c0948a534a01cbfd086a681
MD5 be696826ca325bc112702a2ea96fd141
SHA1 1e4f15a1bcf332dced6b0c37b34a83854873be90
SHA512 fe97f89096ade7912c0f81180328f5ce54b06e48da1d951f1885dfac9d8e824ce82c029f17bccfeb46001f6e4192bf7ccfa22a58f5bc4cb7054c8cc49a129019
TLSH
T198E0C269E5088C3231FA488A086A170B266159134E073D183DCE82CCDF1F26F8AF2F19
MD5 SHA1 SHA512 TLSH

Submit Download