hxxps://github[.]com/ShiftLeftSecurity/zipdu/archive/refs/heads/master[.]zip

Analysis

user interaction
yes
max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-uk
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-uklocale:uk-uaos:windows11-ltsc_2024-x64systemwindows
submitted
25/08/2026, 17:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://github.com/ShiftLeftSecurity/zipdu/archive/refs/heads/master.zip
Sample260825-vkxhsasyhx

Score

3^/10

discovery persistence ransomware

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2440	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134321510244637212"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3797332335-34111092-3597280141-1000\{BA8420C6-F680-4CA1-A1B4-12ED92207E28}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4904	msedge.exe
4904	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

pid	Process
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe

Suspicious use of SendNotifyMessage 22 IoCs

pid	Process
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5708	OpenWith.exe
1252	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4332 wrote to memory of 2628	4332	msedge.exe	88
PID 4332 wrote to memory of 556	4332	msedge.exe	91
PID 4332 wrote to memory of 2440	4332	msedge.exe	90
PID 4332 wrote to memory of 556	4332	msedge.exe	91
PID 4332 wrote to memory of 556	4332	msedge.exe	91
PID 4332 wrote to memory of 812	4332	msedge.exe	93
PID 4332 wrote to memory of 812	4332	msedge.exe	93
PID 4332 wrote to memory of 5192	4332	msedge.exe	94
PID 4332 wrote to memory of 5192	4332	msedge.exe	94
PID 4332 wrote to memory of 2296	4332	msedge.exe	95
PID 4332 wrote to memory of 5192	4332	msedge.exe	94
PID 4332 wrote to memory of 2296	4332	msedge.exe	95
PID 4332 wrote to memory of 2296	4332	msedge.exe	95
PID 4332 wrote to memory of 1672	4332	msedge.exe	96
PID 4332 wrote to memory of 1672	4332	msedge.exe	96
PID 4332 wrote to memory of 1672	4332	msedge.exe	96
PID 4332 wrote to memory of 5656	4332	msedge.exe	97
PID 4332 wrote to memory of 5656	4332	msedge.exe	97
PID 4332 wrote to memory of 5656	4332	msedge.exe	97
PID 4332 wrote to memory of 2968	4332	msedge.exe	99
PID 4332 wrote to memory of 2968	4332	msedge.exe	99
PID 4332 wrote to memory of 2344	4332	msedge.exe	100
PID 4332 wrote to memory of 2344	4332	msedge.exe	100
PID 4332 wrote to memory of 4796	4332	msedge.exe	101
PID 4332 wrote to memory of 4796	4332	msedge.exe	101
PID 4332 wrote to memory of 1200	4332	msedge.exe	102
PID 4332 wrote to memory of 1200	4332	msedge.exe	102
PID 4332 wrote to memory of 1200	4332	msedge.exe	102
PID 4332 wrote to memory of 768	4332	msedge.exe	103
PID 4332 wrote to memory of 5056	4332	msedge.exe	105
PID 4332 wrote to memory of 2840	4332	msedge.exe	109
PID 4332 wrote to memory of 1496	4332	msedge.exe	110
PID 4332 wrote to memory of 4976	4332	msedge.exe	111
PID 4332 wrote to memory of 4676	4332	msedge.exe	113
PID 4332 wrote to memory of 4676	4332	msedge.exe	113
PID 4332 wrote to memory of 4676	4332	msedge.exe	113
PID 4332 wrote to memory of 2108	4332	msedge.exe	114
PID 4332 wrote to memory of 5880	4332	msedge.exe	115
PID 4332 wrote to memory of 5880	4332	msedge.exe	115
PID 4332 wrote to memory of 5880	4332	msedge.exe	115
PID 4332 wrote to memory of 2564	4332	msedge.exe	118
PID 4332 wrote to memory of 2564	4332	msedge.exe	118
PID 4332 wrote to memory of 2308	4332	msedge.exe	123
PID 4332 wrote to memory of 2308	4332	msedge.exe	123
PID 4332 wrote to memory of 2308	4332	msedge.exe	123
PID 4332 wrote to memory of 3308	4332	msedge.exe	124
PID 4332 wrote to memory of 3308	4332	msedge.exe	124
PID 4332 wrote to memory of 3308	4332	msedge.exe	124
PID 4332 wrote to memory of 4844	4332	msedge.exe	125
PID 4332 wrote to memory of 4844	4332	msedge.exe	125
PID 4332 wrote to memory of 4844	4332	msedge.exe	125
PID 4332 wrote to memory of 5920	4332	msedge.exe	126
PID 4332 wrote to memory of 5920	4332	msedge.exe	126
PID 4332 wrote to memory of 5920	4332	msedge.exe	126
PID 4332 wrote to memory of 4904	4332	msedge.exe	127
PID 4332 wrote to memory of 5652	4332	msedge.exe	128
PID 4332 wrote to memory of 5652	4332	msedge.exe	128
PID 4332 wrote to memory of 5652	4332	msedge.exe	128
PID 4332 wrote to memory of 4348	4332	msedge.exe	129
PID 4332 wrote to memory of 4348	4332	msedge.exe	129
PID 4332 wrote to memory of 4348	4332	msedge.exe	129
PID 4332 wrote to memory of 560	4332	msedge.exe	130
PID 4332 wrote to memory of 560	4332	msedge.exe	130
PID 4332 wrote to memory of 560	4332	msedge.exe	130

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/ShiftLeftSecurity/zipdu/archive/refs/heads/master.zip
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x240,0x264,0x268,0x238,0x284,0x7fff4633c188,0x7fff4633c194,0x7fff4633c1a0
  2⤵
  PID:2628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=uk --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1820,i,1115966912025401653,4910102006116312462,524288 --field-trial-handle=2196,i,13754602571357329594,1507775663894428860,262144 --variations-seed-version --mojo-platform-channel-handle=2240 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1544,i,17313170508781811367,16543747652360110879,262144 --field-trial-handle=2196,i,13754602571357329594,1507775663894428860,262144 --variations-seed-version --mojo-platform-channel-handle=2192 /prefetch:2
  2⤵
  PID:556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=uk --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2428,i,5130610613825164041,3063119235140239871,524288 --field-trial-handle=2196,i,13754602571357329594,1507775663894428860,262144 --variations-seed-version --mojo-platform-channel-handle=3096 /prefetch:13
  2⤵
  PID:812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=uk --js-flags=--ms-user-locale=uk_UA --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3508,i,15698480662922431972,14559408704191656067,2097152 --field-trial-handle=2196,i,13754602571357329594,1507775663894428860,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:1
  2⤵
  PID:5192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=uk --js-flags=--ms-user-locale=uk_UA --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3512,i,925466051930395716,5089047106628740227,2097152 --field-trial-handle=2196,i,13754602571357329594,1507775663894428860,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:1
  2⤵
  PID:2296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=uk --js-flags=--ms-user-locale=uk_UA --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4180,i,12019450829823162762,1592164190002452769,2097152 --field-trial-handle=2196,i,13754602571357329594,1507775663894428860,262144 --variations-seed-version --mojo-platform-channel-handle=4528 /prefetch:9
  2⤵
  PID:1672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=uk --js-flags=--ms-user-locale=uk_UA --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4176,i,15958690494211810425,11594933685728761687,2097152 --field-trial-handle=2196,i,13754602571357329594,1507775663894428860,262144 --variations-seed-version --mojo-platform-channel-handle=4444 /prefetch:1
  2⤵
  PID:5656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=uk --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5296,i,3385447756225502188,1265289827053191254,524288 --field-trial-handle=2196,i,13754602571357329594,1507775663894428860,262144 --variations-seed-version --mojo-platform-channel-handle=5424 /prefetch:14
  2⤵
  PID:2968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=uk --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5300,i,9380107358071921082,6522571960056622071,524288 --field-trial-handle=2196,i,13754602571357329594,1507775663894428860,262144 --variations-seed-version --mojo-platform-channel-handle=5388 /prefetch:14
  2⤵
  PID:2344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=uk --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5972,i,17391586361379504810,10548496206479156988,524288 --field-trial-handle=2196,i,13754602571357329594,1507775663894428860,262144 --variations-seed-version --mojo-platform-channel-handle=5976 /prefetch:14
  2⤵
  PID:4796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --js-flags=--ms-user-locale=uk_UA --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5788,i,7620888965533641023,12948550936607445474,2097152 --field-trial-handle=2196,i,13754602571357329594,1507775663894428860,262144 --variations-seed-version --mojo-platform-channel-handle=5984 /prefetch:1
  2⤵
  PID:1200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=uk --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5688,i,15016583614531013066,3369841720540652597,524288 --field-trial-handle=2196,i,13754602571357329594,1507775663894428860,262144 --variations-seed-version --mojo-platform-channel-handle=6268 /prefetch:14
  2⤵
  PID:768
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=uk --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6812,i,9309597228420510384,7459475391482818798,524288 --field-trial-handle=2196,i,13754602571357329594,1507775663894428860,262144 --variations-seed-version --mojo-platform-channel-handle=6832 /prefetch:14
  2⤵
  PID:6108
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=uk --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6812,i,9309597228420510384,7459475391482818798,524288 --field-trial-handle=2196,i,13754602571357329594,1507775663894428860,262144 --variations-seed-version --mojo-platform-channel-handle=6832 /prefetch:14
  2⤵
  PID:5056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=uk --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6948,i,9724530974468987673,3602964885534099574,524288 --field-trial-handle=2196,i,13754602571357329594,1507775663894428860,262144 --variations-seed-version --mojo-platform-channel-handle=6844 /prefetch:14
  2⤵
  PID:2840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=uk --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=608,i,1051119314005627257,707636869023480190,524288 --field-trial-handle=2196,i,13754602571357329594,1507775663894428860,262144 --variations-seed-version --mojo-platform-channel-handle=4732 /prefetch:14
  2⤵
  PID:1496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=uk --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7440,i,12721941833821912984,14948249122877872419,524288 --field-trial-handle=2196,i,13754602571357329594,1507775663894428860,262144 --variations-seed-version --mojo-platform-channel-handle=7436 /prefetch:14
  2⤵
  PID:4976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --js-flags=--ms-user-locale=uk_UA --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6068,i,6862106838464265075,11489712672788271588,2097152 --field-trial-handle=2196,i,13754602571357329594,1507775663894428860,262144 --variations-seed-version --mojo-platform-channel-handle=5964 /prefetch:1
  2⤵
  PID:4676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=uk --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5196,i,11832584162904910868,1914534483120195451,524288 --field-trial-handle=2196,i,13754602571357329594,1507775663894428860,262144 --variations-seed-version --mojo-platform-channel-handle=6084 /prefetch:14
  2⤵
  PID:2108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --js-flags=--ms-user-locale=uk_UA --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=5688,i,1451504562760734314,16161138466786157286,2097152 --field-trial-handle=2196,i,13754602571357329594,1507775663894428860,262144 --variations-seed-version --mojo-platform-channel-handle=6096 /prefetch:1
  2⤵
  PID:5880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=uk --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7332,i,6437976955982128629,16392022872664305956,524288 --field-trial-handle=2196,i,13754602571357329594,1507775663894428860,262144 --variations-seed-version --mojo-platform-channel-handle=5060 /prefetch:14
  2⤵
  PID:2564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --js-flags=--ms-user-locale=uk_UA --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=5356,i,11398318599257876167,227359110313088228,2097152 --field-trial-handle=2196,i,13754602571357329594,1507775663894428860,262144 --variations-seed-version --mojo-platform-channel-handle=5412 /prefetch:1
  2⤵
  PID:2308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --js-flags=--ms-user-locale=uk_UA --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=3688,i,12942460789744820209,16402256443992582363,2097152 --field-trial-handle=2196,i,13754602571357329594,1507775663894428860,262144 --variations-seed-version --mojo-platform-channel-handle=3740 /prefetch:1
  2⤵
  PID:3308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --js-flags=--ms-user-locale=uk_UA --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=7176,i,2921185237738061597,5511375704266242593,2097152 --field-trial-handle=2196,i,13754602571357329594,1507775663894428860,262144 --variations-seed-version --mojo-platform-channel-handle=5260 /prefetch:1
  2⤵
  PID:4844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --js-flags=--ms-user-locale=uk_UA --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=5436,i,10387288869134245129,15230880334564485634,2097152 --field-trial-handle=2196,i,13754602571357329594,1507775663894428860,262144 --variations-seed-version --mojo-platform-channel-handle=7508 /prefetch:1
  2⤵
  PID:5920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7312,i,5746865021774433761,11803548443016157638,262144 --field-trial-handle=2196,i,13754602571357329594,1507775663894428860,262144 --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --js-flags=--ms-user-locale=uk_UA --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=7800,i,1286070621920947022,13421597187098959310,2097152 --field-trial-handle=2196,i,13754602571357329594,1507775663894428860,262144 --variations-seed-version --mojo-platform-channel-handle=7812 /prefetch:1
  2⤵
  PID:5652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --js-flags=--ms-user-locale=uk_UA --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=7956,i,8817693241220858325,10261963706555241856,2097152 --field-trial-handle=2196,i,13754602571357329594,1507775663894428860,262144 --variations-seed-version --mojo-platform-channel-handle=7692 /prefetch:1
  2⤵
  PID:4348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --js-flags=--ms-user-locale=uk_UA --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=5684,i,4118017048883149464,4509735929507501939,2097152 --field-trial-handle=2196,i,13754602571357329594,1507775663894428860,262144 --variations-seed-version --mojo-platform-channel-handle=5628 /prefetch:1
  2⤵
  PID:560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=uk --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5636,i,8528514439035198841,18060850834300802796,524288 --field-trial-handle=2196,i,13754602571357329594,1507775663894428860,262144 --variations-seed-version --mojo-platform-channel-handle=5632 /prefetch:14
  2⤵
  PID:3948

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4152

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3372

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5136

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\92a4b35f-1c62-4c6d-9547-ad680afbbdaf_zipdu-master.zip.daf\zipdu-master\bombs\42.zip.password.txt
1⤵
PID:768

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5708

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1252

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e413e02b9e80ee8d76d52c1043fc32251e2d7634d4b2fbd970df9ace9d91831a
MD5 22959b3a06a842ac30237dd57e8a3801
SHA1 0b7c28071a592034aa2607038000f085c7bb6362
SHA512 644add9ab912ad7fdfc55bc7a1b84482c75cc9bc69a59d169bae63a0400619d999846ebbadb0ef2bd6d35c2bd08a5f07053b600874dd5dfcbda7e8f3076131fe
TLSH
T1A5D02BE476408A0CC980203335F6524092018910D801D1480040B325CC845C1257F0DF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8aaa68aad07ba45abe53bd513aa5f7e7b21bd1b29db6e1d5c1e0a79a5f4eb890
MD5 74012bbce5fada7634c1da1b567562b3
SHA1 09db27f38f27e35986cfd407b57f6f83c8fc59f8
SHA512 c1a6a98f972793c84274c29552107bfe07b775c7c8121e5fdf137ebf9a7cc3f4eb43fe9eadfc842e7b92ca7281bbcea3d660bdd8fc9adc56add068510c41e48d
TLSH
T1FBD02BE07640890CC980203335F75240920189108401D1480040F335CC845C1257E0CF
MD5 SHA1 SHA512 TLSH

Submit Download

790065e1-528c-4203-bfba-74163829f325.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\790065e1-528c-4203-bfba-74163829f325.tmp
Size 11KB
SHA256 7fbae7a5e17469219cd9c7e18328da55074cb24b678fc1cac02559491892cdd9
MD5 7e32ca09bd4e3421410de684ad38f2af
SHA1 19bcc6ad47f51399c2ecd0148abdb6da39fffce9
SHA512 01939b78deb5446501ad20aab5ba13482508ab25305bdecc681ad8dcd8a1b9802f90ae845c92d764c8f93be81f8601e71d31701dce8dce61112205f24431856a
SSDEEP 192:sxRkRIlh/fSs4DprQ5PzoA8pw/g6+WNIYnYQNZhbGXIgDOJ:sxRkIh/fSs4D7w/5I5kk+
TLSH
T1EC428516AA28A93B9CC7E21DFB55BF53D2F9503261912E48A6FC9B1C04E76DD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 8d351f4394b2a19c45b0d71cef0e6c495fc5d08d2781b5fd1a7557aaf96888fb
MD5 2efd867453084174cbd47888e611cf50
SHA1 140c29986d835674a6724be6dfc90c0500a2f4c2
SHA512 d266c3918c9d755a33e71eb179ce3e00e313408a93ab4ecb36173a7dd84d8f0631b0abf8f1038b0346d5013cad4f7f55aaf1165999b3b1922e845afa741f7933
TLSH
T13151BA99432608C3D35879B1B9E9C4D932F48C99F5371E4EE1F0E1B44866F479103CAD
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59ba3e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59ba3e.TMP
Size 2KB
SHA256 d5ad91eb1254ea79b79b7404a81006a8e66db564219039893e7570cbd41bd735
MD5 5d8ed22e032dab9333799deef81e526c
SHA1 00e448e9942f9b9dd2a032d93d3702a0c6f8ae6b
SHA512 4bcbcf21f9a7214f3eb27d7d8b557aa8bce094803de80263831b90c3d8dd7af57d803ea8c8eef66810679de4e7b9e38123928b01536c62aa4aebeaea92468974
TLSH
T1A951A799432608C3D36879B1B9EAC5D932F48C99F5371E4EE1F0E1B48866F479103CAD
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 b477b1f3fe3ba3227ae7cca98e11a4eebceb7f55c125c8e1b8d55651ebe9358f
MD5 a046118df811b7d695822251fe78481c
SHA1 6fcaa25309b0568971177d2c7e694abdf083aec8
SHA512 6fadfe90cf503a525c0828b31931d8e8851f5629a5cc333c7ed03420fa943b9e6bb767cef66555f58a400b4f01303784c979e2cdc61fc024cbc44158e4bfd309
TLSH
T1B1419DF783F5956E9A1196F0EA18AE1FCF2C0511431C78AA85E0AE27D3F3472E041A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 84def0ec89d5604ba8b58bee6d4326aa532eab17a48951450c83564ffbe3331c
MD5 e41707d48628885c6e141aff96239c3b
SHA1 d73394e1fc70df186f33a8984a64e0bcd6b839c8
SHA512 8c73cd384098e372e08ab28189edf942588f1ff9921bab2428d22f637509195468b59feba4e42c30f332535398d2850a2a7a8bb8600be7845a1b70f5818cde38
TLSH
T19FD022A33210B0B9B5ADFFA2406AFC8FC36A00369D12DEE720E0A8DD153A96D1507A45
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 26b1fb36a6c563623714124af3e3bbd7dbb689e6108017c8c6b5bb2e2e7f2a38
MD5 854479a6483602dbeab165b011e49251
SHA1 8b0a6f18f1e8e1037e4c3f33e9621c038820f710
SHA512 62ff50c3944605931454913529a3eeac1630745080256fc556914b8833d7be3680242172694ea04ad06d0f62cc4c50c4873df2da93e7bf65792f0f04d14d1f2b
SSDEEP 192:sxRkRIkh/fSs4DprQ5PzoA8pi/g6+WNIYnYQNLhbGXIgDOJ:sxRk9h/fSs4D7i/5I5mk+
TLSH
T1BB428616AA28693B9CC7E219FB55BF53D2F9503261D12E48A7FC9B1C04E76DD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 a358a321829c893f0c0dc7399d4899622c80f15db25e0a686db18c89887fcffd
MD5 d824fc8e6206e1bbea492df6a831b1e0
SHA1 a26f0730339ef0bd24d1f6a2eabfa91261f7208e
SHA512 f6dba34a10ef9437b775f50684331ed3caa443dc1499a28b4d783e6705af2d8b4c254750d7db986e2b3b983007cbaaf618eca5f08368365c25b64166637e5a2a
SSDEEP 192:sxRkRIkh/fSs4kprQ5PzoA8pi/g6+WNIYnYUfhbGXIgDsJ:sxRk9h/fSs4k7i/5I5mkk
TLSH
T1B1329616AA28A93B5CC7E21DFB55BF53D2F9503261D12E48A6FC8B1C04E66DD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 004bdbe0b383a5041f9ec55d0af8f453e69f9bae8cc6a0615a25734b376b0680
MD5 e409067a7cc9b276888744eae7dc5e8e
SHA1 3b4a534c6efe617d5476a5e101f1ca17155b537e
SHA512 86dd94871d053d8e58c8fc420660995e90871ea8059eb329671e453bb8d89ffc4963f048c800f20553f442abd622923881f974c004a32e8cf09646325bbbd2a6
SSDEEP 192:sxRkRI8cBWh/fSs4DprQ5CoA8pw0Il+/g6+WNYjg/Yn9QNZhbGXIgDOUVt9+j+G:sxRkZmWh/fSs4DWf/5L/QkkfX0l
TLSH
T1CA62A756A92499778CC7E519FE357F53D6F95022A8911E4CA6FCC60C04EB2EE120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 17fad7b59e758d651f4108cbae3167811e42d50469ffb0e6f8ca4a43639accc7
MD5 a92c81f64b8b4782639fc814ba9c868d
SHA1 b6ca922673f8eb2b88f266c5945989f37478e779
SHA512 08983667ee926ac2c67abe623309499fd77eb38f2a2162bb7269baf4b9247d64c599d8a4ad52a15bf6f9371e4790db305a0f14a8c1a848b4b57f819e6ef7a576
SSDEEP 192:sxRfRIkh/fSsvkprQ5PzoA8pi/g6+WNIYnYUehbGXIgIJ:sxRf9h/fSsvk7i/5I5Bks
TLSH
T1F43296166E28A93B9CC7E21DFB55BF53D2F9503261D12E48E6FC9A1C04EA6DD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 918f757e0bd05a942018b062e9bd8a6bfc30d2329cc2295ad88fbcf28fc269dd
MD5 cb6ab1dbea2640b1ce37ae25241b4c7f
SHA1 767374b269e3cd27781a21459ae8e8ba07596b68
SHA512 a85b42e8b54128a825a984ed82c4717d83cb2ff695f039ded1524a1bf7df8e850bdbb926c5054728fcae98cd1ada92b34f5800475ed1fd2a874c1f04c1e55144
SSDEEP 192:sxRBRI8cBWh/fSs4DprQ5CoA8pwsib4/g6+WNYjg/Yn9QNZhbGXIgDwUVt9+j+G:sxRBZmWh/fSs4DWL/5L/Qkk1X0l
TLSH
T1D762B652592499778CC7E219FE75BF53D3F95022A8915E4CABFCCA1C00EB6EE120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 d2de53839441c014777d51dc3b3bfd0ee4d69b1d0d910b0051848f304b00c8eb
MD5 877c76faa60af096be9c5ea5742d4b4e
SHA1 a3e9fa0ee14e5b5abc5b56fd29048fff0223efac
SHA512 25ceadced6fd90bdf560365aa5efb399a071ae950904c0f58665ced0de762f97f87ecada5831ef5c5ae3f74514277341a637aebc1ddf52589544af977e8f3d89
SSDEEP 384:wum8dzAfCtgoSFf6MKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVU494oRPdrohMY:wb8dz6Wgouf6M8F1+UoAYDCx9Tuqh0VZ
TLSH
T1B7B2EC3B604DCB7E5F800AADEC19AFDB6D9802C79A988D4447FE990C03C77EA51194DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

fadabf89-2fa0-4b58-bbfb-9dd8fdafb277.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\fadabf89-2fa0-4b58-bbfb-9dd8fdafb277.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

436812ea-78cb-4216-8108-8514529c03d6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\436812ea-78cb-4216-8108-8514529c03d6.tmp
Size 22KB
SHA256 6e58e69a07fdfb27891cfa9a663b1cd3f76e4a77ea6f312fab0beb3b92ffb513
MD5 0e9aef861dfc449f7c41490bc0935a6a
SHA1 415c9a9af8ed42ea8a4b1c1714d8ffb40ebd3d5d
SHA512 56b3c671441a5ee97333d065bef62a5294fccb6e759bb5436b832e1cddb040fbe14977a7faf64eeec68ce7a321ba6230984dbe5437efa8d5ac6ce8ba03b4515d
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/uo:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAR
TLSH
T12AA2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 1d3a26c4c2f8d4b8fff4751c1d69d8f615d0956af56baa8e476c0dc801933bad
MD5 92d6f13ac2835a6a3acb6c24cce52f52
SHA1 7b41480f5bc7508611b9e4eb54fda56cb6668281
SHA512 569417ebc9bbb710473fa9a2c88246488215dd2b7befbb0b673ca95b12a5ccebf7af80af5a8f7d68c46048b68b1fdab081024a81fd36719b0823e52322a9296c
SSDEEP 384:kZcI338NlT0jz3Y+NJDZNfNoXOVSUU5VRiCmmETRzcoXfK86sfxEZxxsIj4lBkXF:C333YqDZIO05OCmhNzc4ReyIsPkRbyY
TLSH
T1B3F2AE72AC34CDA7ACF69682FA4736427EF4811B92D82D5495DD6B0C094B2EE034F827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 a88c52058c10670a832839e3a0af03260d7c034ad57e45b54a9503b592c4149f
MD5 a38f850479eb63141875ca8109d48c59
SHA1 f000c46791eefba11abd5e1c32aeb16de517afe0
SHA512 13e2f3d8ba8289cafd7711d5c48264e1856dafed99d0f61464946b6dcfc49a52367bbf281e992f27069bd8d24d6941a6c7eb2854ce40e8f48aa2ea9598531d18
SSDEEP 384:PZcIw38NlO0jcmdYf2NJDZNfNoXOVSUU5VRiCmwETRzcoXfK86sfxEZxxsIj4lBU:Hw3yYfiDZIO05OCmfNzc4ReyIsPkRbyY
TLSH
T19BF2AE72AC25CDA7ACF69282FA4736437EF4811B91C82D5495ED6F0C094B6DE034F827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 e75fd0ba599d0511e51454732aa02f847b62a82d15754a0257a972d24cab9807
MD5 6fddc8d01a78f772d6696547a238eb06
SHA1 7951332765dcffee32789783394162049876d6fc
SHA512 723bf23f4e7c3fadf40d555e0683cafc5b909f7d56fcc42481d235f7dd62df111a11e5bb9dec7e8c799ea8bb616d5d2512dfe798ae42c287748d4bbd7f35be9d
SSDEEP 384:JZcIw38NlO0jcmdYf2NJDZNfNoXOVSUU5VRiCmwETRzcoXfK86sfxEZxxsIj4lBU:Bw3yYfiDZIO05OCmfNzc4ReyIsPkRbyY
TLSH
T130F2AE72AC25CDA7ACF69282FA4736437EF4811BD1C82D5495ED6B0C094B6DE134F827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 a1fe3466e34ec6f4098a52ee4e82c2551d2a4c7413eec5ab72468fc0a3ec1a7f
MD5 e93973f023b91fbfe17b86a8879afe7a
SHA1 fb77ad573a3f5ea01e7a824e2a066e944ad0f993
SHA512 7c3d79067225d8d1c5c81433f420dbeb962622870e5fe4bd44b484bbd7e669af880ecef4d7220dae03171143da110ab5d9699683d23ff31e3be170c3166e4dfc
SSDEEP 768:aFBp3wwgrYfiDZIO05OCmfNzc4ReyIsPkRbyY:mp3DQtc44bssVyY
TLSH
T1FDF2AE739C64C9BBACF69682FA473242AEF4416BC1D969A4D6DD6F0C054B1DD034FC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 8bc40c2647afd7528e6bce3d8618935c2d2594934ccb531b58adbb9ee5b3b23f
MD5 d4c78e8db26e0bb65b1f2570d55ba680
SHA1 d406d51dde878a36795dacde6146b8a0e23c18dc
SHA512 329e1ad70229324401895835eafe43186bc05ddb2c12de27f989f665d912647986a0cf5fd08f6c26e99fc08cc497ae1d96b8fae928d31376de5411bf02ff0dc3
SSDEEP 768:aFHp3wwg9YfiDZIO05OCmblNzc4ReyIsPkRbyY:mp3b2ltc44bssVyY
TLSH
T1F6F29E329C68C9BBACF69682FA473242AEF5416BC1D969A4D6DD6F0C054B1DD034FC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 997d584657e17496ca506946ae5b2346561bcf46bf2aede05ce5a640f5fbb374
MD5 4064b5b0f1c3fa698d681819aab4d124
SHA1 8bfd352de631e66befdf6cdea7082d88da5f7abb
SHA512 af99101756c302b31ad72053690f4eed08ea370e50a289c2961297b13e6665ccff3a632d2a189c4f89920911c9f20cd1e11661347b7415bc709920da22c176e0
SSDEEP 384:rZcIE38Nl30jz3Y+NJDZNfNoXOVSUU5VRiCmmETRzcoXfK86sfxEZxxsIj4lBkXF:zE3bYqDZIO05OCmhNzc4ReyIsPkRbyY
TLSH
T1EAF2AE72AC35CDA7ACF69282FA4736437EF4811B92C82D5495DD6B0C094B2DE434F827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 83c8fd9465dc2330ae3926f97599d1aa76f7ec4298767751e7d7450ba329803f
MD5 fb8dc9f83ef38f25404f41a2a3a05cde
SHA1 95b3882e36749ae66d3a55a31493788179e7ae5a
SHA512 3f4ea40e5c3d64ae46d52ad1797232912ee34f5c959bd0c60f19e76248d2daa4ab9154ab45eeaf3192245bc8b4af6ecef7bd8a02f15074df4dd6b76be079be52
SSDEEP 768:6rv+4UNbds3Z8DZIO05OnNzc4ReyIsXzeVH1S5D:6bsbS3Itc44bsDEH1Y
TLSH
T1D203CF32A8788977ECF66686F54776537EF8912B82C81A94C5DE6F0C464B1DD030B923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 1d674b971adfed31849bad9a6b689a2720ab7b64849460c20f4a97fa8fbb48ff
MD5 422c08c92642f1ad55ddfc13d9ee0e17
SHA1 6edc4b7dc90230f8acfd3b799f98b3ddbb015be6
SHA512 27fd1d6fddaf80de15f5679c8f5fbec5768de9e50d5fece2c19e04d89da3b5efb197e1c3949fe45d95245bbd6969fb815a02fd9277bf6be700bc28ab3d4d97b2
SSDEEP 768:7rv+4UNbds3TY0DZIO05OCmyNzc4ReyIs2keVH1S5D:7bsbS3Mftc44bs7EH1Y
TLSH
T18903CF32A878DA77ACF65686F54772437EF8911B81C91AA4C5DE6F4C0A4B1DD030F923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 867393d0eba1e79c1e134b3aa11e4fe06031138e95ff9ee987ed1988d3f455fe
MD5 31f8b21eeba2f5da7d0df2aa6b6d548c
SHA1 335b9a01aff56261deecc1dab4d12f8e6ca00534
SHA512 f4bf5d8022d4e01384c75639c01eeb72ef261889e6ad4400ed74785c06baae2791ff45b59a6cf9864afb2ef569254a918e928e77e40b997e860e4246f05ea0bd
TLSH
T1B7E00122D704047BD038033200E35B107BB2C12003D30747962205792C567802EB0E40
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 db61d557f06cbaccb95c74e91a09c47e1241e5ab351736e953676fd2ac2aca6c
MD5 7ab8883b714a6481a860d96d054a1f47
SHA1 9e0f521585ae4641a93b115033e2387b1311e227
SHA512 7cd60dd91d036e2da7424cbdd59f8d916986450857d50b62ddf901da3fce167feca3de4d3992a9c3c66e8b77af96bf43fff2a9b8a26eaa71ba5ebdef1b29c7e0
TLSH
T19CE00221D604043FD03C033300E35B107BF1C11002D307479222057D2C567803EB0E40
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe5b466c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5b466c.TMP
Size 392B
SHA256 1219a7744323483cf37fe40d5aab73dd9ca929b150c04f9ca2f1bf34e6ee3d53
MD5 59f7518b1bea6c5c4f4f9bc22848ddb2
SHA1 b20eac8812ff76b6f72bed8e1b6348ffd28eed6f
SHA512 34d44a485e88923a1d6fd4e73489a80fe14492b6972645540d39c86402ca3519bb802393dade1bda778cb1bd46fda10018d06020050e4ef159722e4b392ae2b1
MD5 SHA1 SHA512

Submit Download

9adbda35-0881-4974-8115-d96a08457b84.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\9adbda35-0881-4974-8115-d96a08457b84.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

ClearLimit.xlt

Path C:\Users\Admin\Desktop\ClearLimit.xlt
Size 377KB
SHA256 6d77bee4825b221fcb9b7d9989c97650f6a7cfe297c5f1668a617e0195413490
MD5 a2db4505e84f61c95954ec9d0ecb7e4d
SHA1 fcb6de70c326096efc401384ef42f081a4578e72
SHA512 90a96fb23a85d5b36484391d3ba6e50c3c12ec867d86bdc005285d7bd1a62420bb1034b4f0ccbe855165493b11a1bf4c925eb7237b6a183bce3afe7c2e751c5d
SSDEEP 6144:btBOit86/ZOKAdu2YsuqFTCcsoBB1ngfkI4cV+3oW6WeY1PXtVSGRNAW9XTnLNzW:JBOie28u2Fio1nBj1PpNXZnBzABT
TLSH
T1A28423AECF095E2C52E6EC64CF45B41B0F508DD9DD1E154203BFAE71C28AEA5DB218E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CompleteUndo.m1v

Path C:\Users\Admin\Desktop\CompleteUndo.m1v
Size 532KB
SHA256 6e6bb254a0c67127e952eb312c8468ebe249f464b6aa5915d8d966663c95004e
MD5 0d5e34a300ac62077ed209ed5f0c1853
SHA1 b776ac763dd48ba18b943fd18ab5c919b890edce
SHA512 245a901f881ab6c4be9b8ea9d8020819b8148ec10e42ea2204ddf46980fa3cbb25ce113f99b453e76889beae2371f90d5267516ec2e9382287e53aa14063e54b
SSDEEP 12288:AEDthG0GoF8RIrcbAsxwBqLsbLaXf7yT5gbvym6PqsPVLV1bkhHCvU9:RLGoSUcbAmkevfbvyXvVL4
TLSH
T1DDC4230C9E574833B263715A3E529DDE61A1BFBC0BC8A8E049868D71357E4F587239CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DenyDisconnect.tiff

Path C:\Users\Admin\Desktop\DenyDisconnect.tiff
Size 319KB
SHA256 02cdecd379279886fbdc9c513d8e9ab2c422777ed405249243ffbbeeb5daaac4
MD5 0ab2e46ddd341e0fcc4ba3ee537f2e78
SHA1 800dba5f6f36ac11d49a091d7ee2151ddb2203d2
SHA512 8cfcd7e42e09d184301f4ead40424b3909f1deda0f6960d06d7ecc57e262b81b5a5c3292067132fa3b2cd93069298c27f8b9fa745a5b2bf07037e8c0436ad740
SSDEEP 6144:NjtVJtSqgPUvUXAw5KJNUGPO9BBTpzZqQ5uFS9AYIqgccxhdA7SNGJ++:JtjtDg8MXAwUJNUGQPTpoQ5US61qhcRE
TLSH
T1AA6423F4CB24323B89F73240413F31793EAE991846EA4598BD52DBE416A1F61EC6E06D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ExportRestart.docm

Path C:\Users\Admin\Desktop\ExportRestart.docm
Size 871KB
SHA256 d5841cbe77abda42cec119ce990b2b1060895931475694127c0526d9ec2fda89
MD5 1adfa37c40ed2a7a0815b9ca0027cac1
SHA1 addda6ad7615db2b36a0c58f1786eb4791bf7cbf
SHA512 f5d582339143261d69d04d7a0812b282dafc849ec49c861fd88c2ed503e15a5fbfa112497ea4705861b425dede54273875aa370fea0e78f782df46d59ec23970
SSDEEP 24576:zPxj00lFp6CEkQS0ggcNGcpnXejoc62sr77:zPx4qT0BdOOMys/7
TLSH
T1BB1533445838B6179AC3BD48052B6B26145FF495300BA3207D4ADF63CDDD63B6FE9B28
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GroupEdit.edrwx

Path C:\Users\Admin\Desktop\GroupEdit.edrwx
Size 590KB
SHA256 8893e34de0daa8212d3f01c7032bc3e7e9c2347d79844082fbc28de3104f5d70
MD5 286f872955153b833df4c69f541da317
SHA1 2a368e74652e08ec9c35f24f8b07aa9f468d0ee8
SHA512 e24d584cf16fb09d342c1a16ed5a2a91245364888e5808d0db9d109206ddf5ef2d71ef5d1c3e1fb0d39ccbdb1a8da5bf38472bd9b7d3c717bca388f4dec2082d
SSDEEP 12288:BrKt7plOXaODSu3Zt4m4d4S17/mf3kDy01gt0U26gtV7n6s5cWtH:cxODS24m/0Vgt0UrgtV7n+G
TLSH
T16AD4238947BFDCF665E4FF794B032D0A29AD839BB18B6C897A5F605041843ACDF86C11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InvokeEdit.temp

Path C:\Users\Admin\Desktop\InvokeEdit.temp
Size 300KB
SHA256 c8e8cc04494f03421be438cd9a690de509761f745b0e2e2e78d782621224a538
MD5 225be12a7e3bdefe5ee8c79d98bcb7fd
SHA1 345e1d7c5be83c5bea231aac7fa63c5717349687
SHA512 f8b21680002c206e2e900ff4b2d23f5f0aa2db35a34942e8b3be25d5a8f9ce25194dfee4cb20abcd58e5e18af6622d70f79d096c227afece48bd6636e271c30c
SSDEEP 6144:F+nxkp+uHb49e3OuliNLAKiP2DRwRIHzY2eVqWUF2goB18vpBTg:Fkkg9e3OaiNsKy2DWMYPZxgoB1
TLSH
T1D46423D1CD301AC53B62A790A0E4CF3E4D988CD3C957CAAFCADA8665D24479EC59A370
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MountSave.nfo

Path C:\Users\Admin\Desktop\MountSave.nfo
Size 222KB
SHA256 046a879c1eebc3cb14810a720d0acf67f74490b2f658e5fac018e7f0e4753f9a
MD5 a59945a83b4bf4af7fb0c001b9f4df9e
SHA1 35f2eb5871b2c6e63f7bc306ad8999007757231b
SHA512 b094d46b0df2fd3ef0e6fceecda9a6655d90e93bc964e3b691e06ade305d4140e19d8640d20bb7a61e945f7f6852f5eabee2d7fe49135822e2ce06839945b316
SSDEEP 6144:Tjrm/bGEY4unC0HbjuQp4bBSTFgRuOKbQiqy/DYBx:Tvcqn4unXuQ2bI6YOKbQT
TLSH
T1472423FC0172A958946F23EFC8A54274E7E133E2736ACD2C0B6864F77D8D526540ABC1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OptimizeReceive.vdx

Path C:\Users\Admin\Desktop\OptimizeReceive.vdx
Size 416KB
SHA256 98aaeaa7c3f9d9eeb1b0d5a0bd03353bde7f943de9b30f37679fc2a4a0e8e2b4
MD5 ab1d0756611600a37fd8a06edb76514b
SHA1 84a009fe8af3294ccd911bfb82c30cbbbee78457
SHA512 bfc6cef44a81b15c3cf6164c943858e83bb090d70480e29715722adc55abf51cfdfe05e76e84232f0a1daf67bf7665183202a2526e66afc796273f699b29c3a6
SSDEEP 6144:AQhI5kIG8mMvh/COEIpTxrknzsYey34hXOgmROQtpo75eOQjRVQhqA+s2um9mG1:AaT8mMvUOEuFrknIYNGSPbPco+2uYd
TLSH
T10B942304EB12C9A4F1D069EA402F2BDBAE2E7C5FD4E69EC617915560F4FD830301A6B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PopImport.odt

Path C:\Users\Admin\Desktop\PopImport.odt
Size 493KB
SHA256 27574575e683122d0f6a42324acb50dd3b476bc8f053e899837bfdadfe90f098
MD5 e0da4c8a2481fb9c71e9a232d9bcf556
SHA1 819dc8dd19aaa94ecf42abdfe32f5e6e4f76975e
SHA512 fddeee73290ec6a56a887f7448581943a00956d6c4afc020522ba4feca234305e44e570662dc80546ef2fde28b1641781c9158ce2d9fb070b578cda1fd7492d4
SSDEEP 12288:YLDpfgxxiJZqiInrRgtg+1wvYFKo4MdctNWWoq2vzv8V5FfgMP9v6:wU6s7atgNPvehq2vOFfgMPJ6
TLSH
T16AB423BE76FA3B40B3B44B3EE9F64ED50D608796649C7080C2156A42261F31FB35CE62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PublishTest.ico

Path C:\Users\Admin\Desktop\PublishTest.ico
Size 261KB
SHA256 601697a3afe7502497eadd526f22d4f2881339d514419f36fe8e2ae8d6f8bc2d
MD5 1ac21a12a16c092786f2cb7869a964a5
SHA1 e66a3b72c98997069dd9dd932fda89e6eb95b724
SHA512 ed0c95b579566f61a259cc1ee216d685604d77a4258f6abd51994e1c0567a70fbf826a9149ea65b1a4829444813d3781250cc81b44d5e0417e7bc00704053cb8
SSDEEP 6144:7vl/bQxdsQZO7lXHTyGTnP7KlLsleRIPlMv8t+/Oxi+KVBWso7:7Nsx3ZUjyWP7feitM4+mQ+KfWL
TLSH
T1204423C5C37929360CC2176C3B77F9AE94F9005A680C0F19FEEB2D2664389E9F89D651
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PushCompare.vdw

Path C:\Users\Admin\Desktop\PushCompare.vdw
Size 338KB
SHA256 da43941d831c8a74726cd3dd747cd1585cee57afe1b569d633232785e1bfebb4
MD5 43b489a8804669b346a59f0ae4fecaba
SHA1 cfcfea46b84d7c38f55d0dca622001fb3e4f61de
SHA512 8f525e6e3bb5ee00e45e91383a6ba42b1c8ec39db62a0b762c39b8cb27652e4023100685a8194ca1be371d8655159635d599414bd3e28bcbde9e96572c3c9e16
SSDEEP 6144:zwIIJeQ3pvi8Jd9laDvFhAqNJuh4Lw60YAtdqN3V4vZB/RlMAUvdPPhUyPX:zwHJeYV0NDNJuhwUtdgVgDR231P1PX
TLSH
T1FF7423616974038CF3BD0BC91F9C526B2E43EAF32E5151B5BD8D43654B8262812FE74E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RemoveExit.docx

Path C:\Users\Admin\Desktop\RemoveExit.docx
Size 17KB
SHA256 8c95a629e25a812277cbe7e174a52fe7a98980f63420a4353c7a9fddefe6d5f2
MD5 f20aeb49aba85137dfe3e0c6af4bfafe
SHA1 23978ac8ba4c305349dca556756ab033fa4ff72d
SHA512 cdf3f30505b49a6ea87880b644caa7ae6c7af1b94675918f23a460eb6d2e3c2d2dd24d5b67a458c2dc8d63cb1d40a0a3643501fee9f06dbe1d9505006f6e6843
SSDEEP 384:amrSjV71JBVtS0xgCjEGNNCDdNxt/ZtNNQ2YIFHF6lvE:RSj51HV0UgCjEGNNCTxllNoItE8
TLSH
T1A082B03EE912AAA4EA634A7C786E72F2F01ED9023B10D84735CD9F2E4055D13132B685
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RestartRemove.vbe

Path C:\Users\Admin\Desktop\RestartRemove.vbe
Size 474KB
SHA256 3db41f8ecb7d19b97fac4ab7f9c7d8d0cab345f3d24ee1ca7c9dd9b6fc5063a4
MD5 d9045290da3ac80493ee6f7742a3d93a
SHA1 a70f3a7255f394e6234203a8e78aa15e7811489e
SHA512 39de2f997e46d545eceb3db394cc5d7bd0d410dbc43bfddd64579373243ab89bd643c91741b6ee2a81f64b6e240cc186e6463764957d7cdcd17518fcdb395fbd
SSDEEP 6144:J2RaF1Ttot+xYMuPWcN3Uhb54oOTGQ9tlKVx1ZOEIuDZc+1SG3Zd4MVs6QfO0fFg:J7totbPWM0iVZKnO2DZcLGpVAOi2
TLSH
T164A4232A6DFD8B5C0EFA9541086BC17F06A44E396AE60FC3940B4ADD7B190C9391D39F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SaveDebug.docx

Path C:\Users\Admin\Desktop\SaveDebug.docx
Size 13KB
SHA256 7444fbde6d9c357455362b225ca750438a4bcf7b3261038ba8a56745f3f1d8fb
MD5 3ac1d60b908e582e58bc20aa0336aedf
SHA1 fbd9a9595abdf25e45d299e2e46650624884af8c
SHA512 1ef61b598352ff0b5091ae011c33fbc1b1620bd4363a8931cdfee1f9657df6df0d3a7eb7e54e23726a0ec70d4b42ad5dd2a5025932c9b6aa6763c35b3f5246dd
SSDEEP 192:CtX3b5/p2nPqFd/jCCNxtpgoZ22NNX3M7ROMCeTWNGFHBEG6HGpXHN:aH32nPUjdNxt/ZtNNMlRmIFHvXHN
TLSH
T1AE52BF3ED4057D85FAA34638E02221F7D51954023B92B94721DE6E8F4293F035317EDB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SelectTrace.jfif

Path C:\Users\Admin\Desktop\SelectTrace.jfif
Size 358KB
SHA256 a83378b1534cbdbaf9ec0379b814be4332f02c6a414c83cd5f60ce9b4fd6b8c6
MD5 d5cf0d625ab266348505fffdd0245f92
SHA1 b989ef277f2d0c2d31e61e37a539cb88e421033f
SHA512 d4395026061449bd28a83a2ae86cc7b041319dc93ed2c7885a85c9baf2a7a137673a50b417affabf003e203563af873bc7c850592d0172bd06088b2062964c82
SSDEEP 6144:p+05WZOYn1uFxb7Ly6uvahVmhb3aUunSxGRzChtXlzPfqVGvBfDHwiKe7Mv1AG:p+04n1UOajg3knSx6CPVzPfDHRB7C
TLSH
T1757423503C5E512B7C0F33ED32D475BEE60059E6991E60217B92088BBA2447EAD7E47E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SendWait.html

Path C:\Users\Admin\Desktop\SendWait.html
Size 571KB
SHA256 ab7bdee2b4fe12e785e73e371e8ebf95371cdc88527d35322b2a2b138a040011
MD5 0c955a2c21e1a6c97691024b2a90fd98
SHA1 7e2b2ba8aa6c718b1bfdd1e741dd8a5037424b1f
SHA512 9fdf69727b0511b45a1779f01d0d2027765d2f48df9fd99ea01b410157fc3817720785bac7effd6b2539c4f29902a01b896a36804d39671e7325f657c75401d6
SSDEEP 12288:7Aiqc+8fAdOOWLTU1t4DwjijL1tz7zQq0Adw8Cd1Ios/FMKp:7gdqXwwD7zlbdw4os/FMo
TLSH
T147C42340DF16A0768E2E85D4DA96F233577E1916030C7E43539928379A726E33AF2FB4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SplitUnregister.exe

Path C:\Users\Admin\Desktop\SplitUnregister.exe
Size 396KB
SHA256 1240ed1e3b6399c0cf9452f6fb7cbb80b85216ecbabf21ce1a725c92c6dd1d06
MD5 697b894c25cb94f374f4a36be45b59e1
SHA1 de6d607bdbed49bb2332d9ae25d1fd3fa293ad35
SHA512 2252f1965bcd72632a28df5df256b87b2bd6ce000c69a5a2769e03b84ce33e7adb529ba8cdd80497cc4ddb8062b464c577d6f08f7146fc3d732c361a6e28e598
SSDEEP 12288:44uSgG0SpfKzF4dI0wilM4UrP3WYIYXienCl:ZuzG0ey+dI0wOIUzek
TLSH
T1C28423544B080EBF6B0B607D6CF5699DE8313F2AE3F2943B9D2E0D68911C14EEEAD151
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartFind.mov

Path C:\Users\Admin\Desktop\StartFind.mov
Size 551KB
SHA256 0d34dfde08df0d231719c237d09f70a8644e613b1887faacbee1ebf41d3fef0f
MD5 067072aa7458beb31a37668adab41c3c
SHA1 898f6ca3b7f4d66ad5796814eb3715d02adf5a2d
SHA512 de24f042d834d1bf3a3995317acb649a21f5fd968321dd0c0734574df425321d1d19bab9dd709e27fc3278d3a332f7d290e55abaccf16e704afa70012efd74e0
SSDEEP 12288:C6a9qmrJIkHFdrLljGr6hagWGwCkBCRaSYsP25Zn1:LLLwdflir6hazYk//5Z1
TLSH
T1E0C423A47F97B782101284C5A8D2B37664B46133CE7CD676821FD3AE7863F81039B57A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UndoBlock.otf

Path C:\Users\Admin\Desktop\UndoBlock.otf
Size 512KB
SHA256 954c59871d0dd4dc484c1e67856a2c58545538e47e265a0ce6f897d1e1f14918
MD5 3e281c96af103e38da7547fcb0c85ebb
SHA1 e974842c8c05c5bfb7d58f99c6a91a7925f4dd82
SHA512 6704a65d8f0467219363a52b65c99ece86afd2ba623c4b6c2381391cdb0d2e312f187027f45520e032457a3dd7f43d1aaa1a6da82ba2e033258d238f9b4cefa0
SSDEEP 12288:ZsVojuMud8TCCYHPi84igPHUk6JQOcZcexSI:Zi0d/aiHXctMD
TLSH
T1E3B423B90804549B1A8F7F62DBB23C7C74345909E5298BF27B441A75DE9AFA34E07C83
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UndoPush.doc

Path C:\Users\Admin\Desktop\UndoPush.doc
Size 435KB
SHA256 f9ed9902b3bbae758636db8fef25cbc0a5aebaa3fe170db3cdaad83c6982e558
MD5 8316abdc63b53233f5d9050025cb1dfc
SHA1 f6559b9a4a97c2d688b78605bcbe0359e1e26e4e
SHA512 a7f9f3c897d29e75c95b0a27e3d4bb43039d230c2960f229a40cdbff6f9b01007abc84c9e9ba88e92505779588bb2cb9ca3de96a1917597be54b6d30c682f5e2
SSDEEP 6144:U7eMLkVSVZvKrVasBTyEVIL5CMvLNX00/4ecBrjW+CxMJeslP8VSLAx8i6VWx+o0:xMY8zzaTyDjNkiarj0xCeMMl6VWoo+V
TLSH
T1DD9423F8886C902D47AF49BC49604781C56760EE0EBE09F168C7A7CF4B2587B78957CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UndoUse.js

Path C:\Users\Admin\Desktop\UndoUse.js
Size 609KB
SHA256 d2e03466b2db9ebc8b831b77648865b35c61eeaa51d949ecf7d64767e570c753
MD5 f09a061001270a3cdc76c6be370bbbb8
SHA1 52fcfe2d872c253d1d47ab08608e9ad7498622f9
SHA512 d59f47ded91963c8ec8a4332ded7270b345cd98cae7f79166a3f7cdc34d3f4eb4504363e37b504f1f40411d4f21ffda2efcd2c2a638cd0173e9fb2245dce7e66
SSDEEP 12288:sZSZuJJPDuvoFxbIZvGBA2F2pmUsCjiqNAwNURkXrD9fApShGR:2waDu+xbWvmgMOXni+P9f3UR
TLSH
T10ED4234DF1F4F7A809FB14B4A2F780E247D923C791793889424E7FA4FB68E4968054B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UnpublishStep.ps1

Path C:\Users\Admin\Desktop\UnpublishStep.ps1
Size 454KB
SHA256 63e718aeee507438caa0afdc4ab7fb1a42c07992c9aeab77d073675ce5313882
MD5 51ac2ce13282b71e22f24672118caeb4
SHA1 539758a2c017ca786086d5772911e274daa65b7c
SHA512 1d76f40a5ef91f28e73f7834b0de47948f0f6ed21e54941dd86f3b76a95e6d4655111e282d93289a421ff6fcea502bf013adbda4df31d9ed01231047240f03de
SSDEEP 12288:46cHNLFJ1sssrCBm7E/kRttIfJU9pIxAQxLjqdKHX9hje:nahKhCO/TSJU9phQ5he
TLSH
T116A4237F168E62CD1A70C72CEC662B6B289278758C6D1C6FCC2D144188532F87E5BA78
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WatchResume.lnk

Path C:\Users\Admin\Desktop\WatchResume.lnk
Size 280KB
SHA256 a38406c0022e8de710a0520eae2e63b04e9217ba69bdac5f24ee69d2c7bd6502
MD5 9e6a32a2aeb6370ffe8866778d1183af
SHA1 730dab2d91f0fd04e461d7e9a4b58a9d78f65e56
SHA512 0819c4f413f70e393395c7aed2ce0b8989d747f1868aa7054433def4e8c3e6c8e8c78a23e84c34552f6b831afb3d37cb422ef849acac40da7075e1877958cf8d
SSDEEP 6144:bNAih4f0S/yvYXIJvWhy+5G+hbmJR4OoitiJVLPaK+gbVSsdRV5r2Ge:bNg6w2Wh95GVJBriJVn+WVSYV5r8
TLSH
T11B542329D464B7E349DBDC81F50707F3853AEA1858A2F45E0760B3EFA55B793280B1A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WatchUnprotect.sql

Path C:\Users\Admin\Desktop\WatchUnprotect.sql
Size 241KB
SHA256 d8526839db3475ca5b8eea06d7ac2b272a3f24a17a9f656cde0d2be01c40a186
MD5 aba2e5d53ef4512ca26a957ffcb10b83
SHA1 bbb742bcbb078978d9a9f2bbc36286c557cf8d87
SHA512 d96359dd86eb110a04671a9f671c48ed0502379fd0fc9047e2867f74803b6149a8f003e3765b482bdcffb0708342ff7f90c163eaca0686237853a02661813f97
SSDEEP 6144:WiuiTQ8cV9M8sLguYtIyBB/5M2htInF2zLY:WDQcV9p7BBB/5Pe2XY
TLSH
T1E034234BBA1E0982392E4193F9CCD699D50D87857180A53DCC7AF9AF331A7258FCD281
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WriteSwitch.vsd

Path C:\Users\Admin\Desktop\WriteSwitch.vsd
Size 629KB
SHA256 37970a1c2c1b024a86c0225c68e1dd367067cf4057c89a48889506a9154486c4
MD5 c271011c9a1f16e1237cc4e6e765222a
SHA1 e6fa165590dda600c8e2eb26bc7667b9f6491848
SHA512 b0dbec2e2aaa9ef41fc22562ccfe8b9518007851559d8e225c80b2ee8a52b434888c6999d72b5a35b7dc9871dbda62c1aa5dc7d3f5e2d60f131c0b4cf1980fa7
SSDEEP 12288:w47nq4U7iU/gFskyI4B96FZ2/SdoP6z5nG7Hbm9FoaLqJFTecmk5U2iW5iqxRi:woD4L/gSTcwqdokpK7mQsWi6C
TLSH
T1B5D423859D4807AE27B3895FD0A8792A11CC629E3553B1F32129601D70CE5BF7E6B0EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memz--main.zip.crdownload

Path C:\Users\Admin\Downloads\memz--main.zip.crdownload
Size 16KB
SHA256 7f31295b9b49e2bda0389176279742b7bc0193975a3f4b4a769809cb9378f2e0
MD5 cbc971e22657f8960dadffd80dfdf1fa
SHA1 3bd94ce7e25b2a79918576f8ea5e3f016c76590c
SHA512 b980fb61217aff669a4dfb008fe490aa7066c2e518dc2c64a8b3ca3a88a932b4b8ee62e3f25d9d06ab08fa69b9c811d169aacca953b5eba944de0b6b5e05da5c
SSDEEP 384:8xhzAAZjEDrKsE+p6RDL5cNcQ+ylHuPOVpTTlW3M2/B/P6n:OhzxZSKsEW6RDLucqn/lQdZ/Cn
TLSH
T11B72D00B949D1452D31FCA7BE06244E53BBFEAB0F881D0959D69AC46426C3A0E6E06FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zipdu-master.zip.crdownload

Path C:\Users\Admin\Downloads\zipdu-master.zip.crdownload
Size 164KB
SHA256 8206f54cf976cbe003715124bcaf8b5ab983ea7fe6446bf7904543c40e9fbf95
MD5 f838558705d66647b160b7706fadd392
SHA1 49d6f14c285cd524be26ed159a12c581251654a7
SHA512 5559f54b8d1a868682f54011821d5d20a81ab84ce0292da1400ab4948d6f0baaa8044d7c7a9396976f0d90c988ef6fad8c9dcf70a08e751506f18b4f9d2a27a3
SSDEEP 3072:sSaJFplJkeYjyFm3AAzEmz3FglFfvDVhgZnZG+nQWy+w0xY5VwDOwrqr1RTN7O:SrpleeYWFmw+TTiFfQZnQQyKywDOwrqU
TLSH
T100F302581AC8FEF4CD913AFEA6812631F32C5E1951C9FB692A859436BE0753823416FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Acrobat Reader DC.lnk

Path C:\Users\Public\Desktop\Acrobat Reader DC.lnk
Size 2KB
SHA256 40dc13d054f80cd5b2652a90d7fb0dedfd56071f7600ba6589e3d4a9e4277b63
MD5 123cf5616b10fc4ad0b5fc04844583ac
SHA1 4b39e4dd651aab135ff55957faa2ce34a231bd05
SHA512 7d1ccfe0c96324e4aeef37f38b1fe70c0a3ecd8dd62deae163a8b6954a2706607d7a7c26b5980413ec5bf9261dd66541dd194b1c56ecd6f927c506867e3ade82
TLSH
T1F241AA404FFB1B66F2779AF75BF21962EB21BC55A6148F1E0089434B0D71B01D899F2E
MD5 SHA1 SHA512 TLSH

Submit Download

Firefox.lnk

Path C:\Users\Public\Desktop\Firefox.lnk
Size 1KB
SHA256 2738eda592196fbfce184cd5d87cb0cd3b5a9e2ea6a10ea185663380e6e90b62
MD5 d558acd1b5830adbe4d92ac5da3868fa
SHA1 ba93088719e2017bdba3ad522b97357ef7bcc9f4
SHA512 241dff21aff00b6d2e2719fefcd3eb9cc70e861a1de705ba11bc0164978e5ded5553b1dc8a762c9c7866ef7a2e860683cb10176d67561e6ff7a0637961ab2d4c
TLSH
T1B71159010FFB0A96F1F785326B71AA239733FD03AA25472D818962851E76260955EFA2
MD5 SHA1 SHA512 TLSH

Submit Download

VLC media player.lnk

Path C:\Users\Public\Desktop\VLC media player.lnk
Size 923B
SHA256 4ea3c7b19d90a8f7733c3ca9fe4033d3656e56662ba6b151d83bc4e64d96e5c8
MD5 ffc1122d14fbb3b1163dee34c009f97e
SHA1 67a538f1c87e6802075cadb301d59f2a799466b5
SHA512 2dbf2679997c820f0a87f8dc3a7e48ea04e94cdf0262f9e74f69fbda91b60538c2e732eb5f717780e59c27ac7ff8ce6ea7eef9a01df60843febf678cda60ddc9
TLSH
T1A911D00626B22F2BE39385F1173213B24B36F51D96925B1D4184510A6C34504E529F9E
MD5 SHA1 SHA512 TLSH

Submit Download