hxxps://gofile[.]io/d/nxWC6TLH

Analysis

user interaction
yes
max time kernel
115s
max time network
117s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
11/10/2026, 04:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://gofile.io/d/nxWC6TLH
Sample261011-fdpr2awsbs

Score

6^/10

discovery execution ransomware

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
25	api.gofile.io
26	api.gofile.io
29	api.gofile.io
36	api.gofile.io

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4480	cmd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4744	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 16 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\.go	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\.go\ = "go_auto_file"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\go_auto_file\shell\edit	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\go_auto_file\shell\open\command	OpenWith.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1696934516-3600988056-1840298893-1000\{010457FB-F31E-4AA0-985D-5E49FBC86740}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\胟憆ࠀ耀	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\go_auto_file\shell\edit\command\ = "%SystemRoot%\\system32\\NOTEPAD.EXE %1"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\go_auto_file\shell\open	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\胟憆ࠀ耀\ = "go_auto_file"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\go_auto_file	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\go_auto_file\shell	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\go_auto_file\shell\edit\command	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\go_auto_file\shell\open\command\ = "%SystemRoot%\\system32\\NOTEPAD.EXE %1"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Local Settings	OpenWith.exe

Opens file in notepad (likely ransom note) 2 IoCs

ransomware

pid	Process
2172	NOTEPAD.EXE
3560	NOTEPAD.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4276	vlc.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
1612	OpenWith.exe
4276	vlc.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe

Suspicious use of FindShellTrayWindow 56 IoCs

pid	Process
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
4276	vlc.exe
4276	vlc.exe
4276	vlc.exe
4276	vlc.exe
4276	vlc.exe
4276	vlc.exe
4276	vlc.exe
4276	vlc.exe
4276	vlc.exe
4276	vlc.exe
4276	vlc.exe
4276	vlc.exe
4276	vlc.exe
4276	vlc.exe

Suspicious use of SendNotifyMessage 45 IoCs

pid	Process
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
4276	vlc.exe
4276	vlc.exe
4276	vlc.exe
4276	vlc.exe
4276	vlc.exe
4276	vlc.exe
4276	vlc.exe
4276	vlc.exe
4276	vlc.exe
4276	vlc.exe
4276	vlc.exe
4276	vlc.exe
4276	vlc.exe

Suspicious use of SetWindowsHookEx 31 IoCs

pid	Process
1612	OpenWith.exe
1612	OpenWith.exe
1612	OpenWith.exe
1612	OpenWith.exe
1612	OpenWith.exe
1612	OpenWith.exe
1612	OpenWith.exe
1612	OpenWith.exe
1612	OpenWith.exe
1612	OpenWith.exe
1612	OpenWith.exe
1612	OpenWith.exe
1612	OpenWith.exe
1612	OpenWith.exe
1612	OpenWith.exe
1612	OpenWith.exe
1612	OpenWith.exe
1612	OpenWith.exe
1612	OpenWith.exe
1612	OpenWith.exe
1612	OpenWith.exe
1612	OpenWith.exe
1612	OpenWith.exe
1612	OpenWith.exe
1612	OpenWith.exe
1612	OpenWith.exe
1612	OpenWith.exe
1612	OpenWith.exe
1612	OpenWith.exe
4276	vlc.exe
3432	OpenWith.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 3384 wrote to memory of 1132	3384	msedge.exe	87
PID 3384 wrote to memory of 4744	3384	msedge.exe	88
PID 3384 wrote to memory of 2516	3384	msedge.exe	89
PID 3384 wrote to memory of 2516	3384	msedge.exe	89
PID 3384 wrote to memory of 2516	3384	msedge.exe	89
PID 3384 wrote to memory of 3576	3384	msedge.exe	90
PID 3384 wrote to memory of 3576	3384	msedge.exe	90
PID 3384 wrote to memory of 736	3384	msedge.exe	92
PID 3384 wrote to memory of 2368	3384	msedge.exe	93
PID 3384 wrote to memory of 736	3384	msedge.exe	92
PID 3384 wrote to memory of 736	3384	msedge.exe	92
PID 3384 wrote to memory of 2368	3384	msedge.exe	93
PID 3384 wrote to memory of 2368	3384	msedge.exe	93
PID 3384 wrote to memory of 1544	3384	msedge.exe	94
PID 3384 wrote to memory of 4396	3384	msedge.exe	95
PID 3384 wrote to memory of 1544	3384	msedge.exe	94
PID 3384 wrote to memory of 1544	3384	msedge.exe	94
PID 3384 wrote to memory of 4396	3384	msedge.exe	95
PID 3384 wrote to memory of 4396	3384	msedge.exe	95
PID 3384 wrote to memory of 3064	3384	msedge.exe	100
PID 3384 wrote to memory of 2052	3384	msedge.exe	101
PID 3384 wrote to memory of 3064	3384	msedge.exe	100
PID 3384 wrote to memory of 2052	3384	msedge.exe	101
PID 3384 wrote to memory of 868	3384	msedge.exe	103
PID 3384 wrote to memory of 4932	3384	msedge.exe	104
PID 3384 wrote to memory of 1604	3384	msedge.exe	105
PID 3384 wrote to memory of 4932	3384	msedge.exe	104
PID 3384 wrote to memory of 1604	3384	msedge.exe	105
PID 3384 wrote to memory of 1604	3384	msedge.exe	105
PID 3384 wrote to memory of 3928	3384	msedge.exe	106
PID 1612 wrote to memory of 3560	1612	OpenWith.exe	119
PID 3384 wrote to memory of 1644	3384	msedge.exe	122
PID 3384 wrote to memory of 2592	3384	msedge.exe	123
PID 3384 wrote to memory of 3184	3384	msedge.exe	124
PID 3384 wrote to memory of 2864	3384	msedge.exe	133
PID 3384 wrote to memory of 2864	3384	msedge.exe	133

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://gofile.io/d/nxWC6TLH
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x210,0x248,0x7ff928a2c188,0x7ff928a2c194,0x7ff928a2c1a0
  2⤵
  PID:1132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1900,i,4555702788730009787,5272689710578842672,524288 --field-trial-handle=2300,i,1971603197955151740,12464047086906823711,262144 --variations-seed-version --mojo-platform-channel-handle=2344 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1788,i,15035861823190047195,3879553289851556211,262144 --field-trial-handle=2300,i,1971603197955151740,12464047086906823711,262144 --variations-seed-version --mojo-platform-channel-handle=2216 /prefetch:2
  2⤵
  PID:2516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2612,i,4783269118335000178,16370520661813771103,524288 --field-trial-handle=2300,i,1971603197955151740,12464047086906823711,262144 --variations-seed-version --mojo-platform-channel-handle=2624 /prefetch:8
  2⤵
  PID:3576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3420,i,17554168329654631556,17938901834981764714,2097152 --field-trial-handle=2300,i,1971603197955151740,12464047086906823711,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3424,i,2664674077159672733,10081214513737480417,2097152 --field-trial-handle=2300,i,1971603197955151740,12464047086906823711,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:2368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4220,i,14659369902560775712,16903382608205228227,2097152 --field-trial-handle=2300,i,1971603197955151740,12464047086906823711,262144 --variations-seed-version --mojo-platform-channel-handle=4108 /prefetch:1
  2⤵
  PID:1544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4272,i,10800611358565063524,17600709853736901553,2097152 --field-trial-handle=2300,i,1971603197955151740,12464047086906823711,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:2
  2⤵
  PID:4396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5172,i,14971225006846609629,5317849713459218434,524288 --field-trial-handle=2300,i,1971603197955151740,12464047086906823711,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:8
  2⤵
  PID:3064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5176,i,10604887200464652674,3988037484195125815,524288 --field-trial-handle=2300,i,1971603197955151740,12464047086906823711,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:8
  2⤵
  PID:2052
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5872,i,11040931830903623042,14328503009449936410,524288 --field-trial-handle=2300,i,1971603197955151740,12464047086906823711,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:8
  2⤵
  PID:368
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5872,i,11040931830903623042,14328503009449936410,524288 --field-trial-handle=2300,i,1971603197955151740,12464047086906823711,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:8
  2⤵
  PID:868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6248,i,9830024741446398944,4536954908697311843,524288 --field-trial-handle=2300,i,1971603197955151740,12464047086906823711,262144 --variations-seed-version --mojo-platform-channel-handle=6308 /prefetch:8
  2⤵
  PID:4932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6260,i,7927945294435364713,15218618989539857507,2097152 --field-trial-handle=2300,i,1971603197955151740,12464047086906823711,262144 --variations-seed-version --mojo-platform-channel-handle=6364 /prefetch:1
  2⤵
  PID:1604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6568,i,5372479800214126498,14455563809805998205,524288 --field-trial-handle=2300,i,1971603197955151740,12464047086906823711,262144 --variations-seed-version --mojo-platform-channel-handle=6608 /prefetch:8
  2⤵
  PID:3928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5012,i,14030660044009151573,18034755984608208827,524288 --field-trial-handle=2300,i,1971603197955151740,12464047086906823711,262144 --variations-seed-version --mojo-platform-channel-handle=4488 /prefetch:8
  2⤵
  PID:1644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4288,i,1626367991930713012,10125992569678491053,524288 --field-trial-handle=2300,i,1971603197955151740,12464047086906823711,262144 --variations-seed-version --mojo-platform-channel-handle=4444 /prefetch:8
  2⤵
  PID:2592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4240,i,1401053612074981990,5335098675580798440,524288 --field-trial-handle=2300,i,1971603197955151740,12464047086906823711,262144 --variations-seed-version --mojo-platform-channel-handle=564 /prefetch:8
  2⤵
  PID:3184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6332,i,3302135803249787846,8798224708996408727,524288 --field-trial-handle=2300,i,1971603197955151740,12464047086906823711,262144 --variations-seed-version --mojo-platform-channel-handle=6216 /prefetch:8
  2⤵
  PID:2864

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4572

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1880

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Temp1_xerox.zip\xerox\available.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:2172

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1612
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Temp1_xerox.zip\xerox\main.go
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:3560

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\Temp1_xerox.zip\xerox\go.mod"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4276

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\xerox\xerox\start.bat" "
1⤵
- Executes a command shell one-liner
PID:4480

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3432

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1862c7c7-9822-4d8c-b6a7-17fb16ed309a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\1862c7c7-9822-4d8c-b6a7-17fb16ed309a.tmp
Size 18KB
SHA256 fa86be7f481f8a1ed63bb238a57ee753fcca8d8205dd3a7ec52c96eef5b25189
MD5 faebcc953b23b3b87c40891c8b837c8f
SHA1 7064545316264163a801701088db697f966ed56f
SHA512 dde68c64902a1ef8115b29cb2c7a1cd3c4d82e03ce1fb43c87d9d5c3400079ca4ad1ca5318dc957279abfbd63d96680587d1ca3731d8da0898acdf35f92dadc6
SSDEEP 192:u7O+xasuheOwQxMDsNdYOQeleYmwpuA9SQmiU1etmM49iX5FNH7Jd6kiICqCCVTB:tZcI4sNdnFleKpuSOg4D9iX5F1V7CMTB
TLSH
T14D828E367C345C7B59D3E664F44A36135FB89067EBC41F88D5EDAB2D06DA2980307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3e991ecc-a9cd-4c7d-a280-7e6dde2cb903.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\3e991ecc-a9cd-4c7d-a280-7e6dde2cb903.tmp
Size 8KB
SHA256 9be7a5451a8491a2acbea12d8b467e235948fcd167e8bce84cc20c9a1cc61e8a
MD5 6007829f82457f15253b22a4889cb7f6
SHA1 c61d6a37312689b80cb002f796c0546a67418df0
SHA512 da1cc761ec7806fc85b868240e2ab2b71731e741642a36b9b024b77d6acbd5403d5ab0b0aabc742b3d38ad8f4f748af159ec85edd9da4c22aacd96ef5bf5af3c
SSDEEP 192:LONY6AmwpeQmiUyisORsiX5FNH7Jd6slRCqCU6:LONY6ipaRFRsiX5F1VLCU6
TLSH
T148120B36B874AC3B4DD2E964F08736135E655167EB887F84C9EC272C06DF19C530A432
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6340dc03-ce0d-4ef2-abe4-ad216387c7d8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\6340dc03-ce0d-4ef2-abe4-ad216387c7d8.tmp
Size 18KB
SHA256 df772f4242294628b20beff4dbcb2652069c91b2628d99f0dba08dee88809174
MD5 9dd9d1c3fec6ca314414b54d59ee98d6
SHA1 de2ca0489e3ce65dba3853682c426b33c277d5ad
SHA512 7c9912f7922b97d511ce7121e28d78ccfe2e0174012b055410f129dbb394ec6d598aec83ef34b36d89ec27db00973eeca22ededd2ba664022905c66b00069a01
SSDEEP 192:u7m+xasuheOwQxMDsNdrQeleYmwpuA9SQmiU1etmM49iX5FNH7Jd6kiICqCCVTE8:/ZcI4sNdrFleKpuSOg4D9iX5F1V7CMTB
TLSH
T16A828E3678346C7B5DD3E664F44A36135FB89077EBC41F88D9EDAB2D06DA2980307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6d3a6e68-a7ef-43d4-881f-4a7210dacdbf.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\6d3a6e68-a7ef-43d4-881f-4a7210dacdbf.tmp
Size 26KB
SHA256 a92d0b73113195c83b79a8270f28ca7b754c909e9892863d923a73f912adfd95
MD5 e68b1255da320f29b7329879d6fe97af
SHA1 4c8b0c771b763db2688b1de600ae2ae5f56115f8
SHA512 8a7fb02e34c493899f3a86a2321dd988623f3186c4816e7ad15ad9b3c29d9b189bc249015354fcb8790bf2c4dcf3c8e75508bc057f720ff8ba8a3094edc566b4
SSDEEP 384:BiFeZcI8isNn8TUNTUlIlAFleKpuSOgiD9iX5F1V6CMTB:oFctCwgeleKKBa+CMTB
TLSH
T181C229F258E7883AD99E9B13B77D2D028EBCC063B6845A44B7CC5A1CCD961BFC306811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8576330f-e217-4e26-a589-81b4abf879e8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\8576330f-e217-4e26-a589-81b4abf879e8.tmp
Size 18KB
SHA256 f1de15e0f2baee5cf95f1745ff220f7932aea8e0e52bd60f297d22c96ff90eb2
MD5 c7f40758a75345b5203f380a2da2e3ea
SHA1 a8645afe45702732dc2794d583ffc9604e71d493
SHA512 fa7c586e4d6b63935ba95c09fc588c519e89b9a8e8b2868a8ccca30eb6e08f09cf30888758517f041bf3fa26dad1632985fec788e893becf218627ef9ecb98a0
SSDEEP 192:u0O+xasuheOwQxMDsNdYLQeleYmwpuA9SQmiU1etmM49iX5FNH7Jd6kiICqCCVTB:cZcI4sNdAFleKpuSOg4D9iX5F1V7CMTB
TLSH
T1D8829F367C346C7B5DD3E664F44A36139FB89067EBC41F88D5EDAB2D06DA2980307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7e85110f-ca3f-4185-b8fe-fa40faf885b2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\7e85110f-ca3f-4185-b8fe-fa40faf885b2.tmp
Size 105KB
SHA256 9ea13bef147b77cf059af0bbd32c4029231ee71a5eeb87da41465837f995c823
MD5 57517d7e9ca7c7dbf0369b56fc0b7190
SHA1 a15c2c9123a0f7f8e518a208d6f83aaea1923b00
SHA512 b584ef39e653fe4d5ada82f1439bada3ed13f5368752b2c2bfc5418788b2c6d6c615bca5636bbeb2f36bed6c3cf3f63c9dff735604a91156a020790610f0581d
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7u:fwUQC5VwBIiElEd2K57P7u
TLSH
T15EB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3a9e2856f7b8bdcf4e651903050a9f78a4dcadbc91b2bacca38c04067256642f
MD5 8eed843072749c683b08c3e5dbce9bd8
SHA1 87464a0b34e45a134ed6f01b613378b3b1c952ad
SHA512 ce7dc7d95703c8a1e763fcb3eae4091d89a746632583bc1fc73a8c189a11f08c6f50e2ee328053aab1da82c11d6f5f81942259c5654861d13f267c34e76feb7c
TLSH
T199D02B6CBE989EA0E40210340231910431CBC8178442200648B1065708003C303448B0
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 221e3dccb30d516b1b3c2d51c604a308dfba3aa3dbe8e11c2d09e185e21df465
MD5 7c97d945db36fde78f76660ee3165916
SHA1 fa851b1197f5a5f6ba4d935baba30b0465e8ad12
SHA512 73a256bc0b95a0662925ed2ac0e1668d7a760da5001e2b32fe139724419020254e080420b21ccad1896c60c44ca2663c2a3d2eccb8cb4180b6b0ad628c68d676
TLSH
T14FD02B6C7ED89EA0E80210340230910431CBC8178442210748B1065708013C303448B0
MD5 SHA1 SHA512 TLSH

Submit Download

0a93dea6-ac59-4150-9846-c832cd556a97.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\0a93dea6-ac59-4150-9846-c832cd556a97.tmp
Size 10KB
SHA256 b348b3ecc80b1c350621a7f4d03e646c4ace67055db665b9a5a9f5ca0950aea9
MD5 390b9d9c4f3f52676bafd2ae3db82cf0
SHA1 c431591baf44b40ea4fb00ca48f2995f59d4c767
SHA512 30573199ef1bdeb171d7c5417b4e40b46e67e100a8b6d1f84bde1800444058d420e3ee8fe02142a4a60444fbcce483c25884841f5021bd76729365791d7a71f8
SSDEEP 192:sxZcRynn/fcsf2PIdpjlDHW6+WNecS/Y3cWVIg5gJ:sxZcqn/fcsf2gdHb0/U6
TLSH
T10222B8567E38AA7B8CCAE21DBA597F53E6F9403261D01E48A6FCC61C05E76DD120740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4dc839aa-5850-40c3-b79a-ecf67960ee90.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4dc839aa-5850-40c3-b79a-ecf67960ee90.tmp
Size 10KB
SHA256 12aee82ec6d87be41987308d752f2a093f2be4e829c3e4c249506ec80c201042
MD5 f67e9c2b2b7bb2239ccfef5614abad2a
SHA1 ea23f1f3b1edc35319bcca49929b168a0ab5d0d3
SHA512 68ae47ea01cdb0227019f5e33071ee78a55a3e4286d0369312acc576fa3692a271ef251dd6c7ef8d773be91c5fed43525a3b53eafac99eac33180029ac31aedb
SSDEEP 192:sxZcRynn/fcsfSPIdpjlDHW6+WNecS/Y33WVIg5KJ:sxZcqn/fcsfSgdHb0/Ng
TLSH
T15722C8567E38AA7B8CCBD21DBA59BF53E6F9403261D01E58A6FC861C04E76DD120740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

842f3a32-9016-4363-85bb-d081000686e0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\842f3a32-9016-4363-85bb-d081000686e0.tmp
Size 10KB
SHA256 3a7dc2f0386d597f6ce378a1a7dc3d170140a4a911b8fe2e63260a1486fd25d6
MD5 fc1025899a7939dc67772fcebf0d3328
SHA1 99f4a7515fb21f8313cdacb25de4f983bacf1231
SHA512 b2ba1f2bcd9363a2aab34d735d8f0cd82b5531c8c8bb04ae5fc38513e33a1016b8ce36ea2d511270832434e0e89bb8b4e8c3071543067e9e638d1b0f740dbc57
SSDEEP 192:sxZcRynn/fcsf2PIdpRlDHW6+WNecS/Y3DWVIg5gJ:sxZcqn/fcsf2gXHb0/L6
TLSH
T11822C8567D38AA7B8CCBE21DBA59BF53E6F9403261D01E48A6FC861C05E76DD120740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

98597914-3b74-422c-9e3e-b3ce25e39a2d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\98597914-3b74-422c-9e3e-b3ce25e39a2d.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

9b8ac887-4786-4bb4-828b-fcdf7daa4357.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9b8ac887-4786-4bb4-828b-fcdf7daa4357.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 4KB
SHA256 783fa5f1c75842b43ec701cfa088587fa2331fefc1f21ce3d8216024fe2700a7
MD5 2046b65f41b92d1e6fcc2661f41fa2be
SHA1 4a4ebe4ac8d0364a559e44242e1652b7f39c5fc3
SHA512 7a92a95b3b0683590f67d27b1652fbe10b1592088389b549f68ea68e9f91b08e3bb6d42f2a9ec8a0caffc1f434f540aaeab0267206d5ba56c8e503b2cfc5de34
SSDEEP 96:8Fe9HeIPZ28jxIvC/0/tuHw/YdIzkJTkL:8s9HnPbxJ/ktuQ/Ys
TLSH
T17D91A4403A129A53F75831B8CDC930AAFD71348350639D92A240FF784A0ABC97F75393
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 7f834188a8204dea602a35344c10e4ec718ada1e9099287eba99ae52ec2acdcd
MD5 a3c95fbdfb84803d7417969a125be317
SHA1 5646310c20860fb873e1231f2880ea502682eda4
SHA512 19b748228c8a5dac81ece1c9d052eb8e2082e31690dc76009b594674a3b9991f8f2e1269769965a18e7396ed739ccdfa077f37212cf26cc8bb4a7ddb0f1f28ef
TLSH
T15461A3410B135A97FB9835F0DED930ABFDB0788061739ED29350EF78860AF855D9A290
MD5 SHA1 SHA512 TLSH

Submit Download

d0a42750-ad6f-43cc-b54d-e218b33687ad.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\d0a42750-ad6f-43cc-b54d-e218b33687ad.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

02affcac-9678-4022-bfce-387709ab6d8e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\02affcac-9678-4022-bfce-387709ab6d8e.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

4c20abcd-ca91-4bce-88fb-5ff80c80169e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\4c20abcd-ca91-4bce-88fb-5ff80c80169e.tmp
Size 1KB
SHA256 07ea42c638de8029248fbc7879922ee6630ae0a3e0c8af04bcc53d5836afade7
MD5 c60633f1b2c0e9066ebf5de344c33c14
SHA1 8678ab412ed6beecdca82be86353f993b97ced30
SHA512 ae8096aa7024c35d482e8c8e15502cf7864f19a7916e34d39dd77b0d414d1a74423aa3fbaf971887fed01fb8947d6ddf98c61397a3f75d5b19bf1cb7c1fb95a2
TLSH
T18B2199F3C3E9956E892556F0AE14AE1BCE1D0516832C7D2989D0AE2793E3871E10169B
MD5 SHA1 SHA512 TLSH

Submit Download

5bd4451c-fc32-4913-af0e-d59c62644ed0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\5bd4451c-fc32-4913-af0e-d59c62644ed0.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 fa68c60bc3c308fc66f22312811518a2037d3ba783bde360f8278fac2924ec2c
MD5 fa2af12ee59d95e755a975f996ae58db
SHA1 fb22576cbd404a384c8bda95e65a8522211da6b8
SHA512 f4e05017cba23599278dc5c13feaaa6aea9f172f73326bec64d870d5453236ae067659ed21409f3114b6d81d418bcd8ba93763041728863986b096e06480a02a
SSDEEP 96:KVFsXTtDnr0XmaarrKiSahr2FdOPnYfnSx9nBhx0dksaVxKi4aHx2/X8VMbWKcga:GH7QVL
TLSH
T12A913301336B12423CBE264D84B6866F464171B77064B52BBFBE42628E2FE544DFE8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c04fc5d8-6ce8-43ed-accb-a5d2e3055c43.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c04fc5d8-6ce8-43ed-accb-a5d2e3055c43.tmp
Size 27KB
SHA256 14e7c572e8c2ee7963ce82933679e4e6252511c5cf9d4da2f43e8c592cf10b36
MD5 7367db48b1466026faf7d80064dd87f6
SHA1 1bb8334f878a5023d262b68ccacef8a256c09885
SHA512 eabd06119425575cbf27ba28ad258f5fb386b4bc8eadf06febef235891368694c1f545ba7523e0eace6e085baeee04dc3402e2f64a10cc0a60821462d82955f6
SSDEEP 768:a630AbSWvS2l98F1+UoAYDCx9Tuqh0VfUC9xbog/OVGmLlLJ72JrolZMN:a630AbSWvS2l9u1jaLmLZ12iq
TLSH
T16BC2EA3B640CCB7E4FC05A9DDC6AAF9B6E9C02C796648D4047FA944C02C77EA91274DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c67a492a-2330-442f-8cd2-7d4957fd1fe9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c67a492a-2330-442f-8cd2-7d4957fd1fe9.tmp
Size 9KB
SHA256 1ed5199cc9243347a26d2dd955814cb97dcc569f2b63e8029d8acca81533194a
MD5 1ac93105248adfd5344f9e22a96dc0d8
SHA1 6f202f6d87c3ebf53097efe94897f105c4be542d
SHA512 1f1d245dee4a6432aca4a3800b5704b6bed56235e6984922ebe5efaf869bfbf45c3eb1de816b2cd823ff0bccc5ec75c19843e6664bc6c240cf6679ce6131a646
SSDEEP 192:sxZcRynn/fcsVPIdpjlDHW6+WNecS/Y31WVIgrJ:sxZcqn/fcsVgdHb0/h9
TLSH
T18F22B8527E38A97B8CCBE21DBA59BF53E6F95032A1D01E58A6FC861C04E76DD120740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e682052b-4872-43e7-b3c2-2765abcf055e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\e682052b-4872-43e7-b3c2-2765abcf055e.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b2867d5a-950e-41ee-a871-fef5f8e12449.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\b2867d5a-950e-41ee-a871-fef5f8e12449.tmp
Size 8KB
SHA256 401ce62727309c76594a4001115895df6460b1b98d6f6186d691bc93ce6ea00e
MD5 22d64fea911b8d58b058be91c24bb184
SHA1 3de9698961dd5a2902b56daa07073736b1d01901
SHA512 99d73498b92d9e8a25a291ac7f9b2b9572d550af1cc0fc43c8fdd000d8dd41154037920b81fbab349a4069b4885a55c5dbf48dbc9d554e40c2552bf912071762
SSDEEP 96:gqONkGQsjpfuMVwptaL5ih/cIPURHl8h4otop56iCDuBIPuva6zx8X5Fxux++Yvg:LONS6AmwprQmiUy6O6siX5FNHkJidYU6
TLSH
T13C02EA35BD686C7B8DE3AE54F54B37235FA5116BEA942F84CAE81B2C01D764C1306832
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ba3c5cb9-978a-442e-91ab-bbe741448c3f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\ba3c5cb9-978a-442e-91ab-bbe741448c3f.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 5758af4d3cc129816b433311fc7154a7693e01ac114f6aaff0720efc0e796df2
MD5 ab530780fbee861d8c8fa3abd0bf3c86
SHA1 a08806d0b7710b52ba1e1eb63a37f723c498a8cd
SHA512 b512d819bd44596639cce5774859b22ec2990da26f267c4225b366e00d3907e15626ed87955364a84087981bbb659f0778c56fc2510c7c716da74dd9ffa78583
TLSH
T1C8413B58BAFA1148B3776E5A9BF6A82D587E79732F07C05D10110E8E4623B40DDB1B37
MD5 SHA1 SHA512 TLSH

Submit Download

vlc-qt-interface.ini

Path C:\Users\Admin\AppData\Roaming\vlc\vlc-qt-interface.ini
Size 101B
SHA256 984ddf294d1d34f64f4873e8ea4a09847dfb30aee36169451689430ed420a414
MD5 c43599bcd4a96bc0abeee303c85dc9af
SHA1 21811568aabf00b83ec2b8aa200ef16f17781943
SHA512 481a8eab14db984d629809742db62bfadbb8abc34e5f665f5428316ce0fc73e992ce490812faf9044827159f3f97b4c2b4aee450d359ee5d199eb7178378376d
TLSH
T12FB01200808D463ADA8C445325DC424E3069F51C50D433507766A00800D0C7B37CDA79
MD5 SHA1 SHA512 TLSH

Submit Download

vlc-qt-interface.ini

Path C:\Users\Admin\AppData\Roaming\vlc\vlc-qt-interface.ini
Size 100B
SHA256 00bef12c77dc962c036c8cd5559721d816926cfa079284bdfcdfc9e853819b00
MD5 d6ac13d3bee97da15875331d196f2776
SHA1 37874244b9fb05c6a14d2d95e7573b06f5dba907
SHA512 90888a53e3eb6d2148696d1a79654b86fb58f936b1ec44157ee65635f70af2f4d5fbbab81c17782e0c138f54cd00934dda9845eaaa803d728f519907c9b675d7
TLSH
T191B01200808D4616CA8C445325EC435E30A5E51C50D033507356640805D0C7B37CDA79
MD5 SHA1 SHA512 TLSH

Submit Download

3ef468aa-7602-4dc2-9979-1e449c767753.tmp

Path C:\Users\Admin\Downloads\3ef468aa-7602-4dc2-9979-1e449c767753.tmp
Size 4KB
SHA256 e6c18d26da23fd0bb419c501d58817ab4878ba7f73fd657256e09c88a7248c37
MD5 d7956c1d00ed7b9506f0bb7185d90c29
SHA1 a4b4e6984f64d67340f372cadaaf25228ac539a7
SHA512 85319e4ba83e16a09b76185e10f1a0456347cbfe7c254a3f9806a44635e5e953ac60d749e6879ca9157a922abc7c439cd413271a35dd5e1049d9317dd277985a
SSDEEP 96:nJpc4wVkmZfsR6m2Q6K4XmrOVzQnbGkNNdWzn07QpGQinCloSAePq9:Jgkkvu4X12SkNNIz0UGQiCCSAeC9
TLSH
T1BF916C31C6A83894D71D8D3D595C812D84CF77004A9EAB9546BC139070AFAE0B17FFE5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4276-375-0x00007FF922EC0000-0x00007FF923176000-memory.dmp

Download

memory/4276-399-0x00007FF922150000-0x00007FF9221FB000-memory.dmp

Download

memory/4276-378-0x00007FF926250000-0x00007FF926272000-memory.dmp

Download

memory/4276-377-0x00007FF926280000-0x00007FF926299000-memory.dmp

Download

memory/4276-376-0x00007FF928AC0000-0x00007FF928AD1000-memory.dmp

Download

memory/4276-373-0x00007FF60C8A0000-0x00007FF60C998000-memory.dmp

Download

memory/4276-381-0x00007FF925C60000-0x00007FF925C74000-memory.dmp

Download

memory/4276-383-0x00007FF922A50000-0x00007FF922B22000-memory.dmp

Download

memory/4276-384-0x00007FF9227B0000-0x00007FF922A46000-memory.dmp

Download

memory/4276-387-0x00007FF925BF0000-0x00007FF925C31000-memory.dmp

Download

memory/4276-395-0x00007FF922320000-0x00007FF92252B000-memory.dmp

Download

memory/4276-403-0x000001F3F5530000-0x000001F3F5549000-memory.dmp

Download

memory/4276-402-0x000001F3F5510000-0x000001F3F5521000-memory.dmp

Download

memory/4276-405-0x000001F3F5550000-0x000001F3F5560000-memory.dmp

Download

memory/4276-404-0x00007FF918620000-0x00007FF918865000-memory.dmp

Download

memory/4276-401-0x00007FF922110000-0x00007FF922122000-memory.dmp

Download

memory/4276-400-0x00007FF922130000-0x00007FF92214B000-memory.dmp

Download

memory/4276-379-0x00007FF926220000-0x00007FF92624B000-memory.dmp

Download

memory/4276-398-0x00007FF922200000-0x00007FF922225000-memory.dmp

Download

memory/4276-397-0x00007FF922230000-0x00007FF92227F000-memory.dmp

Download

memory/4276-396-0x00007FF922280000-0x00007FF922318000-memory.dmp

Download

memory/4276-394-0x00007FF922530000-0x00007FF922541000-memory.dmp

Download

memory/4276-393-0x00007FF922550000-0x00007FF922561000-memory.dmp

Download

memory/4276-392-0x00007FF925620000-0x00007FF92563A000-memory.dmp

Download

memory/4276-391-0x00007FF922570000-0x00007FF92259D000-memory.dmp

Download

memory/4276-390-0x00007FF9225A0000-0x00007FF9225C6000-memory.dmp

Download

memory/4276-389-0x00007FF925640000-0x00007FF925658000-memory.dmp

Download

memory/4276-388-0x00007FF925660000-0x00007FF92568F000-memory.dmp

Download

memory/4276-386-0x00007FF9225D0000-0x00007FF9226B3000-memory.dmp

Download

memory/4276-385-0x00007FF9226C0000-0x00007FF9227A8000-memory.dmp

Download

memory/4276-382-0x00007FF925C40000-0x00007FF925C51000-memory.dmp

Download

memory/4276-380-0x00007FF922B30000-0x00007FF922EC0000-memory.dmp

Download

memory/4276-374-0x00007FF928A60000-0x00007FF928A94000-memory.dmp

Download

memory/4276-416-0x00007FF922EC0000-0x00007FF923176000-memory.dmp

Download

memory/4276-414-0x00007FF60C8A0000-0x00007FF60C998000-memory.dmp

Download

memory/4276-415-0x00007FF928A60000-0x00007FF928A94000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads