njrat | hxxps://gofile[.]io/d/yCkbPVTO

Analysis

user interaction
yes
max time kernel
152s
max time network
216s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/09/2026, 10:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
https://gofile.io/d/yCkbPVTO
Sample260925-l8brjsdc72

Score

10^/10

bootkit victim discovery execution njrat persistence privilege_escalation ransomware trojan

Malware Config

Extracted

Family

njrat

Version

<- NjRAT 0.7d Horror Edition ->

Botnet

Victim

h2ackercypranos-49474.portmap.host:49474

Mutex

1fe316dbd95cd9317b608d0662b54703

Attributes

reg_key
1fe316dbd95cd9317b608d0662b54703
splitter
Y262SUCZ4UJJ

Signatures

Family: njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Downloads MZ/PE file 1 IoCs

flow	pid	Process
65	4560	msedge.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 3 IoCs

pid	Process
1656	ShowNow.com
4760	9c09781f0a964c17afa21cf59182bd13.exe
4588	nasm.exe

Modifies system executable filetype association 2 TTPs 34 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\edit\command	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\print\command	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runas	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\ContextMenuHandlers\PintoStartScreen	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\DefaultIcon	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\edit	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\print	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shellex\ContextMenuHandlers	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runasuser\command	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shellex\DropHandler	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shellex	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\DefaultIcon	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\DropHandler	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\runas\command	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\runasuser	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shellex\ContextMenuHandlers\Compatibility	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shellex\DropHandler	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runasuser	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\ContextMenuHandlers\Compatibility	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\ContextMenuHandlers	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\runas	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\runasuser\command	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shellex\{8895b1c6-b41f-4c1c-a562-0d564250836f}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\DefaultIcon	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runas\command	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell	reg.exe

Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
34	api.gofile.io
26	api.gofile.io
27	api.gofile.io
29	api.gofile.io

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	9c09781f0a964c17afa21cf59182bd13.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5072	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9c09781f0a964c17afa21cf59182bd13.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nasm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ShowNow.com

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4560	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134348047184997737"	msedge.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.eml	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.odc\PersistentHandler	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.tlb\PersistentHandler	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\AppXarrs62hke6epkgs4hz21rc31k0p4gqqq\Shell	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{4EB31670-9FC6-11CF-AF6E-00AA00B67A42}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3050F4CB-98B5-11CF-BB82-00AA00BDCE0B}\InprocServer32	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{97A2762C-403C-4953-A121-7A75ABCE4373}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FECEAAA6-8405-11CF-8BA1-00AA00476DA6}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.cmd\PersistentHandler	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\AcroAccess.AcrobatAccess.1	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00044851-0000-0000-C000-000000000046}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{64818D11-4F9B-11CF-86EA-00AA00B929E8}\AuxUserType\3	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C100BED3-D33A-4a4b-BF23-BBEF4663D017}\InProcServer32	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\cmdfile\shell\open	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\FileSyncClient.AutoPlayHandler	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\IE.AssocFile.XHT\shell\print	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.mtv	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.odctablecollectionfile	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00020833-0000-0000-C000-000000000046}\DataFormats\GetSet\2	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\c:\|Program Files (x86)\|Common Files\|Microsoft Shared\|VSTA\|Pipeline.v10.0\|AddInViews\|Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.dll	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.mp3\ShellEx\{e357fccd-a995-4576-b01f-234630154e96}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EABCECDB-CC1C-4A6F-B4E3-7F888A5ADFC8}\DataFormats\DefaultFile	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_8.0_x64\Dependents	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\12B8D03ED28D112328CCF0A0D541598E	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\AppXkndb5xvk0v1ka1efnjajnamxcd3sfae1\Shell\open	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00020830-0000-0000-C000-000000000046}\DefaultIcon	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{05589F80-C356-11CE-BF01-00AA0055595A}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CDC7D25-5AA3-4DC4-8E0C-91524280F806}\VersionIndependentProgID	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BE39F3D7-1B13-11D0-887F-00A0C90F2744}\InprocServer32	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{da4e3da0-d07d-11d0-bd50-00a0c911ce86}\Instance\{71985F48-1CA1-11d3-9CC8-00C04F7971E0}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F0183006-8A05-4180-846E-0A8452F6CA40}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F09D237B-3FD1-4900-BEF2-3471CA68142D}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.3g2\ShellEx\{BB2E617C-0920-11D1-9A0B-00C04FC2D6C1}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.bz2	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.det	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Excel.Chart	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Excel.TemplateMacroEnabled\shell\New\command	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Ietag.OOC\CurVer	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.tlb	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\AllProtocols\shell\openas\command	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{98de59a0-d175-11cd-a7bd-00006b827d94}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.pot	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2DAF8B36-C9B6-44FC-A7D1-993914676A73}\InProcServer32	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Excel.Template\shell\Open\command	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\htafile\DefaultIcon	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\c:\|Program Files (x86)\|Common Files\|Microsoft Shared\|VSTA\|Pipeline.v10.0\|Contracts\|Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.heic	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.pdx	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.pic\PersistentHandler	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00020830-0000-0000-C000-000000000046}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0006F03A-0000-0000-C000-000000000046}\InprocServer32\15.0.0.0	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{07B06095-5687-4D13-9E32-12B4259C9813}\InprocServer32	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{40B783AC-9C9E-4F73-A1C3-E767FC211B2C}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{64818D11-4F9B-11CF-86EA-00AA00B929E8}\InprocHandler32	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\AcroExch.Document\Shell\Open	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{000D0E00-0000-0000-C000-000000001157}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Excel.Template\shell\Open\ddeexec	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\7C9F8B73BF303523781852719CD9C700	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.sed	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\AppX1sy7rwrc20ggq97a6x1mgmjat0rthy51\Shell\open\command	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3050F38D-98B5-11CF-BB82-00AA00BDCE0B}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F4754C9B-64F5-4B40-8AF4-679732AC0607}\Conversion\ReadWritable\Main	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\ExcelChart\CLSID	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{5AAABB05-F91B-4bce-AB18-D8319DEDABA8}	reg.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3752	msedge.exe
3752	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe

Suspicious use of AdjustPrivilegeToken 33 IoCs

description	pid	Process
Token: SeDebugPrivilege	1656	ShowNow.com
Token: 33	1656	ShowNow.com
Token: SeIncBasePriorityPrivilege	1656	ShowNow.com
Token: 33	1656	ShowNow.com
Token: SeIncBasePriorityPrivilege	1656	ShowNow.com
Token: 33	1656	ShowNow.com
Token: SeIncBasePriorityPrivilege	1656	ShowNow.com
Token: 33	1656	ShowNow.com
Token: SeIncBasePriorityPrivilege	1656	ShowNow.com
Token: 33	1656	ShowNow.com
Token: SeIncBasePriorityPrivilege	1656	ShowNow.com
Token: 33	1656	ShowNow.com
Token: SeIncBasePriorityPrivilege	1656	ShowNow.com
Token: 33	1656	ShowNow.com
Token: SeIncBasePriorityPrivilege	1656	ShowNow.com
Token: 33	1656	ShowNow.com
Token: SeIncBasePriorityPrivilege	1656	ShowNow.com
Token: 33	1656	ShowNow.com
Token: SeIncBasePriorityPrivilege	1656	ShowNow.com
Token: 33	1656	ShowNow.com
Token: SeIncBasePriorityPrivilege	1656	ShowNow.com
Token: 33	1656	ShowNow.com
Token: SeIncBasePriorityPrivilege	1656	ShowNow.com
Token: 33	1656	ShowNow.com
Token: SeIncBasePriorityPrivilege	1656	ShowNow.com
Token: 33	1656	ShowNow.com
Token: SeIncBasePriorityPrivilege	1656	ShowNow.com
Token: SeDebugPrivilege	4760	9c09781f0a964c17afa21cf59182bd13.exe
Token: SeDebugPrivilege	4760	9c09781f0a964c17afa21cf59182bd13.exe
Token: 33	1656	ShowNow.com
Token: SeIncBasePriorityPrivilege	1656	ShowNow.com
Token: 33	2780	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2780	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 41 IoCs

pid	Process
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe

Suspicious use of WriteProcessMemory 43 IoCs

description	pid	Process	procid_target
PID 4188 wrote to memory of 2112	4188	msedge.exe	89
PID 4188 wrote to memory of 4560	4188	msedge.exe	90
PID 4188 wrote to memory of 820	4188	msedge.exe	91
PID 4188 wrote to memory of 820	4188	msedge.exe	91
PID 4188 wrote to memory of 820	4188	msedge.exe	91
PID 4188 wrote to memory of 1088	4188	msedge.exe	92
PID 4188 wrote to memory of 1088	4188	msedge.exe	92
PID 4188 wrote to memory of 2316	4188	msedge.exe	94
PID 4188 wrote to memory of 6020	4188	msedge.exe	95
PID 4188 wrote to memory of 2316	4188	msedge.exe	94
PID 4188 wrote to memory of 2316	4188	msedge.exe	94
PID 4188 wrote to memory of 6020	4188	msedge.exe	95
PID 4188 wrote to memory of 6020	4188	msedge.exe	95
PID 4188 wrote to memory of 1276	4188	msedge.exe	96
PID 4188 wrote to memory of 1276	4188	msedge.exe	96
PID 4188 wrote to memory of 1276	4188	msedge.exe	96
PID 4188 wrote to memory of 3860	4188	msedge.exe	97
PID 4188 wrote to memory of 3860	4188	msedge.exe	97
PID 4188 wrote to memory of 3860	4188	msedge.exe	97
PID 4188 wrote to memory of 3304	4188	msedge.exe	99
PID 4188 wrote to memory of 3528	4188	msedge.exe	100
PID 4188 wrote to memory of 3304	4188	msedge.exe	99
PID 4188 wrote to memory of 3528	4188	msedge.exe	100
PID 4188 wrote to memory of 4728	4188	msedge.exe	103
PID 4188 wrote to memory of 5964	4188	msedge.exe	102
PID 4188 wrote to memory of 4728	4188	msedge.exe	103
PID 4188 wrote to memory of 4728	4188	msedge.exe	103
PID 4188 wrote to memory of 5428	4188	msedge.exe	106
PID 4188 wrote to memory of 5464	4188	msedge.exe	107
PID 4188 wrote to memory of 5428	4188	msedge.exe	106
PID 4188 wrote to memory of 1976	4188	msedge.exe	108
PID 4188 wrote to memory of 5464	4188	msedge.exe	107
PID 4188 wrote to memory of 5464	4188	msedge.exe	107
PID 4188 wrote to memory of 6072	4188	msedge.exe	110
PID 4188 wrote to memory of 1708	4188	msedge.exe	111
PID 4188 wrote to memory of 4496	4188	msedge.exe	112
PID 4188 wrote to memory of 2448	4188	msedge.exe	116
PID 4188 wrote to memory of 2448	4188	msedge.exe	116
PID 4188 wrote to memory of 3752	4188	msedge.exe	118
PID 1656 wrote to memory of 4760	1656	ShowNow.com	119
PID 4760 wrote to memory of 4588	4760	9c09781f0a964c17afa21cf59182bd13.exe	120
PID 4760 wrote to memory of 5072	4760	9c09781f0a964c17afa21cf59182bd13.exe	123
PID 5072 wrote to memory of 3264	5072	cmd.exe	125

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://gofile.io/d/yCkbPVTO
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2d0,0x7ff93465c188,0x7ff93465c194,0x7ff93465c1a0
  2⤵
  PID:2112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1860,i,16160240876706957005,12824749576810922951,524288 --field-trial-handle=2232,i,18234976835102151295,2432254927887850049,262144 --variations-seed-version --mojo-platform-channel-handle=2548 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:4560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1552,i,8389650857699832660,18236254830838548891,262144 --field-trial-handle=2232,i,18234976835102151295,2432254927887850049,262144 --variations-seed-version --mojo-platform-channel-handle=2228 /prefetch:2
  2⤵
  PID:820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2384,i,12866417733948944783,2083064672591158516,524288 --field-trial-handle=2232,i,18234976835102151295,2432254927887850049,262144 --variations-seed-version --mojo-platform-channel-handle=2376 /prefetch:13
  2⤵
  PID:1088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3592,i,4443947724097621096,16351823616976718365,2097152 --field-trial-handle=2232,i,18234976835102151295,2432254927887850049,262144 --variations-seed-version --mojo-platform-channel-handle=3676 /prefetch:1
  2⤵
  PID:2316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3576,i,4624640472022354249,15594435211215264744,2097152 --field-trial-handle=2232,i,18234976835102151295,2432254927887850049,262144 --variations-seed-version --mojo-platform-channel-handle=3672 /prefetch:1
  2⤵
  PID:6020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4344,i,1568223610680655498,5682753144142535638,2097152 --field-trial-handle=2232,i,18234976835102151295,2432254927887850049,262144 --variations-seed-version --mojo-platform-channel-handle=4876 /prefetch:1
  2⤵
  PID:1276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4372,i,5748460621972449984,7289116185089245920,2097152 --field-trial-handle=2232,i,18234976835102151295,2432254927887850049,262144 --variations-seed-version --mojo-platform-channel-handle=4880 /prefetch:9
  2⤵
  PID:3860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5348,i,5596583053657746906,17049323474593447854,524288 --field-trial-handle=2232,i,18234976835102151295,2432254927887850049,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:14
  2⤵
  PID:3304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5336,i,17700733301871140594,17647904872913576595,524288 --field-trial-handle=2232,i,18234976835102151295,2432254927887850049,262144 --variations-seed-version --mojo-platform-channel-handle=5276 /prefetch:14
  2⤵
  PID:3528
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6072,i,4112726810150045380,12727156211111474832,524288 --field-trial-handle=2232,i,18234976835102151295,2432254927887850049,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:14
  2⤵
  PID:6028
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6072,i,4112726810150045380,12727156211111474832,524288 --field-trial-handle=2232,i,18234976835102151295,2432254927887850049,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:14
  2⤵
  PID:5964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6168,i,11949589081310238231,8939366545504613904,2097152 --field-trial-handle=2232,i,18234976835102151295,2432254927887850049,262144 --variations-seed-version --mojo-platform-channel-handle=6180 /prefetch:1
  2⤵
  PID:4728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4908,i,9628883022095409745,12626441929570759378,524288 --field-trial-handle=2232,i,18234976835102151295,2432254927887850049,262144 --variations-seed-version --mojo-platform-channel-handle=4780 /prefetch:14
  2⤵
  PID:5428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=4924,i,6811637089631711345,7754823975194900007,2097152 --field-trial-handle=2232,i,18234976835102151295,2432254927887850049,262144 --variations-seed-version --mojo-platform-channel-handle=6664 /prefetch:1
  2⤵
  PID:5464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6728,i,12668363051551446277,11079320166680659899,524288 --field-trial-handle=2232,i,18234976835102151295,2432254927887850049,262144 --variations-seed-version --mojo-platform-channel-handle=6880 /prefetch:14
  2⤵
  PID:1976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7216,i,6875219409575920317,9640486411509539501,524288 --field-trial-handle=2232,i,18234976835102151295,2432254927887850049,262144 --variations-seed-version --mojo-platform-channel-handle=7220 /prefetch:14
  2⤵
  PID:6072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7188,i,2496264817394544237,11443171828978229301,524288 --field-trial-handle=2232,i,18234976835102151295,2432254927887850049,262144 --variations-seed-version --mojo-platform-channel-handle=7260 /prefetch:14
  2⤵
  PID:1708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7196,i,3910765701152948543,17176092303966191269,524288 --field-trial-handle=2232,i,18234976835102151295,2432254927887850049,262144 --variations-seed-version --mojo-platform-channel-handle=7284 /prefetch:14
  2⤵
  PID:4496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5548,i,7528692484884206269,4018686218751673548,524288 --field-trial-handle=2232,i,18234976835102151295,2432254927887850049,262144 --variations-seed-version --mojo-platform-channel-handle=5564 /prefetch:14
  2⤵
  PID:2448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3084,i,11177569926475620080,12156361442549855011,262144 --field-trial-handle=2232,i,18234976835102151295,2432254927887850049,262144 --variations-seed-version --mojo-platform-channel-handle=828 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6152,i,11484353231255641114,3719267738568834751,524288 --field-trial-handle=2232,i,18234976835102151295,2432254927887850049,262144 --variations-seed-version --mojo-platform-channel-handle=5620 /prefetch:14
  2⤵
  PID:4124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3816,i,8504378452266857515,12198428459864529568,524288 --field-trial-handle=2232,i,18234976835102151295,2432254927887850049,262144 --variations-seed-version --mojo-platform-channel-handle=3824 /prefetch:14
  2⤵
  PID:1892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3568,i,2338037129411209248,14849742052855861148,524288 --field-trial-handle=2232,i,18234976835102151295,2432254927887850049,262144 --variations-seed-version --mojo-platform-channel-handle=7284 /prefetch:14
  2⤵
  PID:4772

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1392

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4480

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4684

C:\Users\Admin\Downloads\ShowNow.com
"C:\Users\Admin\Downloads\ShowNow.com"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1656
- C:\Users\Admin\AppData\Local\Temp\9c09781f0a964c17afa21cf59182bd13.exe
  "C:\Users\Admin\AppData\Local\Temp\9c09781f0a964c17afa21cf59182bd13.exe"
  2⤵
  - Executes dropped EXE
  - Writes to the Master Boot Record (MBR)
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4760
- - C:\Users\Admin\Downloads\nasm.exe
    "nasm.exe" -f bin mbr_temp.asm -o mbr_temp.bin
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4588
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c reg delete HKCR /f
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5072
  - - C:\Windows\SysWOW64\reg.exe
      reg delete HKCR /f
      4⤵
      Modifies system executable filetype association
      System Location Discovery: System Language Discovery
      Modifies registry class
      PID:3264

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004C4 0x00000000000004D0
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2780

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Component Object Model Hijacking

T1546.015

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

15c173c9-53d8-4f2b-b949-16488f1e37f1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\15c173c9-53d8-4f2b-b949-16488f1e37f1.tmp
Size 37KB
SHA256 df406352ac0fca6e287f5e3ca226782c60ff0be13f3fb6cfb076936b95428807
MD5 d6d1620c16469f37f558f3215cd3ee7d
SHA1 9be95386f791608d8089a003d7f71a89d7a1c412
SHA512 5bf9c82b4d678c7b72fc4cac70e10225df3a964135704b31d9a84cb097c3d664dd1c61364403626d72c17e276737803db01de4dd810239bd56543c9eac9e3631
SSDEEP 768:O/UxvxjgC+Ft3SHPSFaju2wnqMwQi5BgK5/CwYcluA8Dea:DZj3+Ft3SdcVmBg8/dIA8Sa
TLSH
T14D03C036ECB49E778CFA9254774A638BEFF451A3C480099489ED2E0E06D79AC530BC57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ae4519203ea4a71f8bb5a86dffca3b288f02f1bf4cb8d6f78e8a591b676414b1
MD5 1293a304484c7d4be275f1eb20c69a28
SHA1 b568174debe43e00bc9d8880e0c5166dc6720312
SHA512 ffd84ca0277d7fb25239662676bdc1988ee3267dfd6a7a17da4c4ab32edd7fa146f36c8d8b2c5f1b06efedf5cf636eaa55943e5f89902c62e6a914ebbc3ae1b7
TLSH
T143D02BB1E0DD8473C0503078000581815215F842BEC555801F25D07C091014C234B10C
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a23025f4d05b749cd64019222483e40f71e2bd4380052e2b64a234eb0323dd12
MD5 f2999f57642ce17248d9900b8034961f
SHA1 5a92b97bdc3c0e5222e917e766218a9ee7568f1f
SHA512 001c4dde433f6d4b3121bd2e5736ab1443818c9c8ef22f8298c411039f23f15532e8510ef806e0f54b26c4ef31db9b77ed6c750a42b27167e98f8b691edafe8f
TLSH
T1F4D02BB1E0ED8473C050307C000681815205F8426AC555801F25D07C091014C234B108
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 df9e7e7545b32c0a1bdf08d35b871c1e19670295b04c49fb0c7c044b8f9a7b14
MD5 5c565af342be8314c0a0f380f24baa47
SHA1 fd353b32624836ff94b041b541b7049b4e2dc34c
SHA512 7abaa48e6ddf9e4e2ac9334bdfba6cee7ebc5998377477d1c5afa8f2dd6d1dab0cc899f8b162058bd6b8cd562cab1e1888472cab365d7b205d5725959c14eef8
TLSH
T13BE0DF8805CDC27EA2D0A49741A89B0CC380374F96CC6E2E1B0488C97046948B3B66E5
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 c531b2010f8d8e786add37fa5fa3aaf67cdf9f17cecc81bc70785ea7c260b9de
MD5 ef65c1683902125973afe74c55c72c19
SHA1 30f0fce1bcfca1ff5077a0a6cde5f17cbb3c40a8
SHA512 a638f36338a3a5bfb139e6ddd1ec36b3f4674148a063c3002f2e118dfc3f570aae85bf5d51e3898b4969ff0be9667b89aac9956e181483a24b9b278a0b906ee9
SSDEEP 96:M6jrGI71WTue/YIv0f58v8tjXwytbKzVX6shQK:M6/GI78LYSAN8
TLSH
T1AD912085E5786460DBD460F2D2F235673975A6FC4CC3DE720A46C8FD4BA7BC629041C0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 008d8c8a93ea122aa24a8f5678945a4cabdde9eb399b0a96a094a185fcc87f78
MD5 7c01e7dbabe59931c8868fdefd733eae
SHA1 d0f0fbe2a77485a1075bcc44ba37b38057b0e633
SHA512 270a4ac52a304c692b624efa2b0a82bce2817f8209a2ea7e62166874a75542d3ae84d1fa0483a628253125b37fb4224786baff32951645cbf3459da9b85f9f04
TLSH
T1DD61BCF7C3E8957D8D2156F4AB14AE2BCE5C0515832C3D2AC9D49E1BA3E3871E14164F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 2c95e7ed2aa8a4553da3a20ff8f6302dc1dac703da35a7bf7a6ee8f01d39d22a
MD5 91a16d7f9feedf7782738fc70b627678
SHA1 7f43b350f4ba599f94e55fe58fa8f0ee2d749d30
SHA512 776a59925c6314ae05434566d8f89e6e02dc5bb457ed93af9d1f1ab7f7ed63b70e37b64a0f001368c6dab201cf69165f32a0216f88f7ec3d2c3990a01ed88291
SSDEEP 192:sxRJRHOj/f9sSCQ7R79UdzoA8pMl4/g6+WNMfEXYlacgbG5IgDnJ:sxRJ0j/f9sSCy79UQJ/5HXAF
TLSH
T1CE42C859AE28AD3B8CCBE21DBA657F53E6FD103361901E48B6FC861C14E76DD220341B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 00c6094ca03e396499d08d79a6acf7c0cdf6ec24f42c8d033ae6ee3259e6767b
MD5 2ba04977c19a1fb8509413093153fb05
SHA1 3c8cbfe852a07d5b008e742e4502ecd0bd998562
SHA512 b642aec126423487f9c621529790c2e59381b11d1f1cd7803c9c38425513cd6fa744fea7fbc6d696e2735deaf95ea453d01bbda7012bb39cbe67055e08ac0e6f
SSDEEP 192:sxR6RHbj/f9slqQ7R79UdzoA8pMl4/g6+WNMp+/YlactbG5IgIJ:sxR6Bj/f9slqy79UQJ/5P/1s
TLSH
T1A232B8196E28AD3B8CCBD21DBA65BF53E6FD1033A1941E48B6FC961C14E76DD220341B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 cbb196dfdfc4939d8f787407a4bb005b330b1e72f942c7e32be8644d33f39b93
MD5 f0634da7d38a98450e405e5a10b98c05
SHA1 cefdcb2f7ac782fd05153fff06fb4d91d54a77f1
SHA512 d6316505598e54cfda1a24ad6d0eeb683fd3199989889a0732032b0a652bf3161984229b495cb57afdb8db5f30c8d758d84eefabbb48c625372e96aad040a6aa
SSDEEP 192:sxRJRHbj/f9sSqQ7R79UdzoA8pMl4/g6+WNMp+/YlactbG5IgDRJ:sxRJBj/f9sSqy79UQJ/5P/1H
TLSH
T10032A819AE28AD3B8CCBD21DBA55BF53E6FD1033A1941E48B6FC961C14E76DD220341B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 40c7c28fdbec6c20db38e56f82e447d352feae8a861984c1d11715c03d96ef99
MD5 9ed7e1c047f5e1a874084241cd0af6dd
SHA1 9f142a0cad989a7d4add674996185e9e009af06c
SHA512 50f609a83d6c8c27727ec17c1159db5a84e096322f54b70c4a5f6452c8448a20134ea96d910bd99d708a1a8d3128d9f1abdf169979945d79ee51b2c5dc923a7e
SSDEEP 384:kWdRdcVfCtgSQFffTKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OV4A9+mRfDroe2d:ksRdcJWgSwffT8F1+UoAYDCx9Tuqh0Vx
TLSH
T179B2E93B640CCB7E8F814AEDDC196F976E9C02C796588D8047FE994C02C77EA911A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 5a1739013bd97dfbee8f6eba190f63d0861f5d803077d3bd1609cbaa662e99a4
MD5 d9cdec1415597a8649ef7419c90337e8
SHA1 e81fe857eb200d87f5bfe2bcfa2f33572000371d
SHA512 55a7fa5ebcfff7fdd790e594c30473e418d071612b6101ae0d15506e8a1e4f738bc092222124125f2eed6d9dde99d697ac0c40d57cfc62c332dfeb331fca3fa2
SSDEEP 48:K0dcRtfLPwbD2jISlwK9l1Hwx1gYmnddyLNsh9P7/gbTmzIS1gK911XgxlwY23DD:KMGEKLa2KmoKHK0UwK5y6gMDGiUee
TLSH
T1B0913E12B4BB064179FD294880A5C71B164232B73049FA6F7FBA10B24EAEE541DFD9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

b950aa06-a481-40ea-a4ff-f7a53691fa21.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\b950aa06-a481-40ea-a4ff-f7a53691fa21.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 f319cd03c48a617f711f742427f7e229e0c952b033162719989f78f46fadbddd
MD5 16c339f01f2581aeb15c52e1c15676c1
SHA1 aeac0f2031e68eb94d68f3f96d679b2b859c143d
SHA512 8b6b5dc4637222b87748907cbfd87bc092ed4ad4bb8e8f4f9ea3073dbb785e2f1ef15410b6647b1413d930dca2210cf7982528a09904a3aa1ae275375e5a48df
SSDEEP 768:QF3vS81aSFaju2EynqMwQi5BgK5/CwYcZx2sF9:QF3vTEXVmBg8/dv2sF9
TLSH
T1D7F2AE32ECB08EB71CF99244F6867706AFF45257D599099184DE6B0E06DB9EE030BC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 612831f350f147e0503f9c64114ff4c9504f6ad11ed80386a3430b5d423009ef
MD5 025e59babee77dc8108d616c958d5e25
SHA1 36a8ac8903249d594bb7456b8c127f91d685d0f0
SHA512 be2cfae7a3ff0df13a1ef82a3e5eeb40b069b91d6ab83ec149a07bab1d1858173021c9bbe0af6cba977dba16a57685fb7c773451e187c56309aa22c6f658ad3e
SSDEEP 768:Xd3wS8YaSFaju2EynqMwQi5BgK5/CwYcZx2sF9:Xd3wTTXVmBg8/dv2sF9
TLSH
T145F2AF32ECB08EB71CF99244F6867706AFF45257D599099184DE6B0E05DB9ED030BC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 f576665eb821f8e6cc9f742cbd8220f0e4f1098401ba029525b2e2117292fe28
MD5 d85dc18e017f3ab106c954f15f1588a5
SHA1 b76d16aa6af8d9640b20fdb60f955db5bfc0ff22
SHA512 72e95aa9a14d332f7aecd64782cc137dfe291cc794b0bd27d6059625cb0d4c0a510edbf7f89f7ef903feca542debece248f8f02b41db2e80b2732a9d940192b5
SSDEEP 768:5FQV3bwgsS8IaSFaju2EkZnqMwQi5BgK5/CwYcZx2sF9:YV3STjTZVmBg8/dv2sF9
TLSH
T1E4136AF298E38A7BD8AD8747A77D2E029EBCC153B4944550B3D95A0DCD974BFC30A812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 63f82141720db1441bf3e583ebd3daeb91c5b0bc86e3475a0f65f7ecc3812cb6
MD5 f2c8434e16dce6d37e22f7fa1fec5e38
SHA1 34144069a906551582128a5e0d85c687e12a7a21
SHA512 76695796d0aa723a08b5c38744cf3aa50e4281936777f44477af052a2c6dad47bf195f990bca5091c3a8c6bc28ac4d57a28fe6ca1d2722802ccd3c896c3cf214
SSDEEP 768:g/UxvxjgC+M3u89aSFaju2EynqMwQi5BgK5/CwYcZxAgPH3:NZj3+M3HsXVmBg8/dvAgPH3
TLSH
T19603CF36ECB49D7758FA9254B24A7387EFF45263C48509A448EE6F0E06CB9AD430BC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

9c09781f0a964c17afa21cf59182bd13.exe

Path C:\Users\Admin\AppData\Local\Temp\9c09781f0a964c17afa21cf59182bd13.exe
Size 1.2MB
SHA256 2342b3d3120400baea76a500a710fc239ea8d1c587459c4c20bc070e44281c27
MD5 07b111536b5f2e251b3db0cd83b2d1ee
SHA1 2a1b9c115a5d703a8dbd75796544bc88cf0ae29e
SHA512 b99b35fb10432fa70c233bf6acda5f06047332e5aa631446221284c6659bd9a1ac697c4123cbd4ddce603a4d8810ee4940574bcdef9d59189edb4433c18741f1
SSDEEP 24576:EzYx3PgYWwocek/r2+AAYNh3tBULAkS7LeB:EkoA/qhlL3rmzS7
TLSH
T17C55A522A687D9A3C41E1270DDC7D32977B2E0F46B368B87BA4C87AF7D213A11CC5546
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ShowNow.com.crdownload

Path C:\Users\Admin\Downloads\ShowNow.com.crdownload
Size 55KB
SHA256 861697a79aaac656525e68541b1d9049d8f67e4815a2d771b8f4948b4c381046
MD5 c32c09c598599d86dd67687c0c7b8841
SHA1 e03d8c4bb03725a4c46685c063e032c6f0f2c42c
SHA512 985990d4617881130dbc15c26161f16ff571c479bb42c524b1afa53977bb8d2e0b616b785463187fc45ff31b8f13bc8fbbc1f75cace55f7d3f34a330385191d1
SSDEEP 1536:7Pr8DnjNxaVCae+D/wsNMDNXExI3pmXm:n8Dn68X+D/wsNMDNXExI3pm
TLSH
T14F432744BFEA5A01E2BD8F3469F645150634AA63F532EB1F48D668DB13327C58C80FE6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mbr_temp.asm

Path C:\Users\Admin\Downloads\mbr_temp.asm
Size 1KB
SHA256 9fdfd968643c046a87defa558840a6a523324d8b7d447deb5cd089ab7e456317
MD5 3632f34a0a2e0b39b9adfba26f745b8d
SHA1 199cfd15f8debdf1e77e3e37fcf92f4e0a28f1b6
SHA512 f005ac944ceb38552bacf856bcb4ddb69680f889a9dfd557292e151b01af86495d470a53703fcd19d6dea69d44bc9686635237f23901a9494cdb0f59fbf8cfdd
TLSH
T1F8217B9E6D1247CA45FA161CD4C1EE1FF2AD575F40C52929B71C43378F7A450EBA046C
MD5 SHA1 SHA512 TLSH

Submit Download

mbr_temp.bin

Path C:\Users\Admin\Downloads\mbr_temp.bin
Size 512B
SHA256 032c085f82cde3370e27119e29392d0bec4df704a6c431e9461f8bf1a32a5a06
MD5 0a8589321be2e6c9a0e9a4e4aa46c0fa
SHA1 a548554896bc34d9c7e25dc024050dd44a2825e1
SHA512 9cfc0daaa474f643af5845d3e4a83323a17325446c6b065f3a9d7287a3ff3f3a588bf72209ba0aa3be412b6bdb2f80b84c43c467d48849db5813ecd92fa82bca
TLSH
T16BF0226AA4CE92C9D44601B0603A48B824083AACEA0AE45040682C0BE3D8760CF0E269
MD5 SHA1 SHA512 TLSH

Submit Download

nasm.exe

Path C:\Users\Admin\Downloads\nasm.exe
Size 1.2MB
SHA256 a4735165141570d966b577d594c0541c29baed4978078c1c7237b855f8592a87
MD5 2f17bab79b9e5caa79c4f493a18fb06c
SHA1 f3eb8a09529b82fc08e919517e098644ddc01004
SHA512 37c62999e11f3a44c02bad2ad9941213c0264312f228de32466818ec84d745312f941f4adf6e4bf3f49d5d91e8df56dbf39b7966ed8d4b214b484c93635ca154
SSDEEP 24576:2zYx3PgYWwocek/r2+AAYNh3tBULAkS7Le:2koA/qhlL3rmzS7
TLSH
T1A4459422A687D9A3C40E1270DDC7D32977B2E0F46B368B87BA4C97AF7D213A11CC5546
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4588-361-0x0000000000400000-0x0000000000539000-memory.dmp

Download

memory/4760-352-0x0000000000520000-0x0000000000660000-memory.dmp

Download

memory/4760-364-0x0000000005940000-0x00000000059D2000-memory.dmp

Download

memory/5964-234-0x0000023D91050000-0x0000023D9140B000-memory.dmp

Download

memory/5964-243-0x0000023D91050000-0x0000023D9140B000-memory.dmp

Download

Analysis

Sharing

Errors

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads