teslacrypt | 67a75f15e3bce2b69039dbf0ec5f657669178f215502bc47023569bce0c94707

Analysis

max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/10/2026, 00:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Size 340KB
Sample261014-a3333att6j
SHA256 67a75f15e3bce2b69039dbf0ec5f657669178f215502bc47023569bce0c94707
MD5 2c354f8807e88fb28ba6f7cd47245890
SHA1 aed49dea36b4f73122de05ee2a72af85d248ba05
SHA512 95a30c8fdab762c24754e9f4296d0e49c5de7eb7a252696070fd856c1e330196e8e1da413601f8d9604af1c083f18246886d9eea86a95eeee573738feb0f28ce
SSDEEP 6144:iwIqK6dwODAr/lFEhiskfGyF6q41hFy7kSdGkLU70L/Rg1NukGq3:rFdbUFEhiNO8Q1hFxS0ks6/e1A9+
TLSH
T1AA74D053CDF7C3E8E9133DF77C7AB5662063F21C811C397A4A35906798A10ACA916BD2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution teslacrypt impact persistence privilege_escalation ransomware spyware stealer

Malware Config

Extracted

Path

C:\PerfLogs\Recovery+xcesd.txt

teslacrypt

Ransom Note

NOT YOUR LANGUAGE? USE https://translate.google.com What happened to your files ? All of your files were protected by a strong encryption with RSA-4096. More information about the encryption keys using RSA-4096 can be found here: http://en.wikipedia.org/wiki/RSA_(cryptosystem) How did this happen ? !!! Specially for your PC was generated personal RSA-4096 KEY, both public and private. !!! ALL YOUR FILES were encrypted with the public key, which has been transferred to your computer via the Internet. !!! Decrypting of your files is only possible with the help of the private key and decrypt program , which is on our Secret Server What do I do ? So, there are two ways you can choose: wait for a miracle and get your price doubled, or start obtaining BITCOIN NOW! , and restore your data easy way. If You have really valuable data, you better not waste your time, because there is no other way to get your files, except make a payment. For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: 1. http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/FE2A5ACC6925BDF4 2. http://tes543berda73i48fsdfsd.keratadze.at/FE2A5ACC6925BDF4 3. http://tt54rfdjhb34rfbnknaerg.milerteddy.com/FE2A5ACC6925BDF4 If for some reasons the addresses are not available, follow these steps: 1. Download and install tor-browser: http://www.torproject.org/projects/torbrowser.html.en 2. After a successful installation, run the browser 3. Type in the address bar: xlowfznrg4wf7dli.onion/FE2A5ACC6925BDF4 4. Follow the instructions on the site. ---------------- IMPORTANT INFORMATION------------------------ *-*-* Your personal pages: http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/FE2A5ACC6925BDF4 http://tes543berda73i48fsdfsd.keratadze.at/FE2A5ACC6925BDF4 http://tt54rfdjhb34rfbnknaerg.milerteddy.com/FE2A5ACC6925BDF4 *-*-* Your personal page Tor-Browser: xlowfznrg4wf7dli.ONION/FE2A5ACC6925BDF4

URLs

http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/FE2A5ACC6925BDF4
http://tes543berda73i48fsdfsd.keratadze.at/FE2A5ACC6925BDF4
http://tt54rfdjhb34rfbnknaerg.milerteddy.com/FE2A5ACC6925BDF4
http://xlowfznrg4wf7dli.ONION/FE2A5ACC6925BDF4

Signatures

Family: TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
ransomware teslacrypt
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Renames multiple (866) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Creates a file in the Startup directory 1 TTPs 6 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\Recovery+xcesd.png	kngduuaukdjk.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\Recovery+xcesd.txt	kngduuaukdjk.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\Recovery+xcesd.html	kngduuaukdjk.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Recovery+xcesd.png	kngduuaukdjk.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Recovery+xcesd.txt	kngduuaukdjk.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Recovery+xcesd.html	kngduuaukdjk.exe

Executes dropped EXE 1 IoCs

pid	Process
4668	kngduuaukdjk.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000\Software\Microsoft\Windows\CurrentVersion\Run\sjbgaqjteatu = "C:\\Windows\\system32\\cmd.exe /c start \"\" \"C:\\Windows\\kngduuaukdjk.exe\""	kngduuaukdjk.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\System\Ole DB\en-US\Recovery+xcesd.html	kngduuaukdjk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Recovery+xcesd.png	kngduuaukdjk.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\fi\Recovery+xcesd.png	kngduuaukdjk.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\zh-TW_FEMININE.pak	kngduuaukdjk.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\WidevineCdm\Recovery+xcesd.png	kngduuaukdjk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\INDUST\Recovery+xcesd.html	kngduuaukdjk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\hr-HR\Recovery+xcesd.png	kngduuaukdjk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\sq-AL\Recovery+xcesd.png	kngduuaukdjk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\EVRGREEN\Recovery+xcesd.txt	kngduuaukdjk.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe\Recovery+xcesd.png	kngduuaukdjk.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.30704.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\Autogen\Recovery+xcesd.html	kngduuaukdjk.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\2.0.1\Diagnostics\Recovery+xcesd.html	kngduuaukdjk.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\Recovery+xcesd.html	kngduuaukdjk.exe
File opened for modification	C:\Program Files\Common Files\System\Ole DB\en-US\Recovery+xcesd.png	kngduuaukdjk.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\bg_MASCULINE.pak	kngduuaukdjk.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\lt_FEMININE.pak	kngduuaukdjk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientVolumeLicense_eula.txt	kngduuaukdjk.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\bg\LC_MESSAGES\Recovery+xcesd.txt	kngduuaukdjk.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\my\Recovery+xcesd.html	kngduuaukdjk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\Recovery+xcesd.html	kngduuaukdjk.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\nl\LC_MESSAGES\Recovery+xcesd.png	kngduuaukdjk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\Recovery+xcesd.txt	kngduuaukdjk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSIPC\pt\Recovery+xcesd.txt	kngduuaukdjk.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\brx\LC_MESSAGES\Recovery+xcesd.txt	kngduuaukdjk.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\fa\Recovery+xcesd.html	kngduuaukdjk.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\it\Recovery+xcesd.png	kngduuaukdjk.exe
File opened for modification	C:\Program Files\Common Files\System\ado\en-US\Recovery+xcesd.txt	kngduuaukdjk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-black_scale-140.png	kngduuaukdjk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSIPC\fr\Recovery+xcesd.html	kngduuaukdjk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft\OFFICE\Recovery+xcesd.png	kngduuaukdjk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\Recovery+xcesd.png	kngduuaukdjk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\de-DE\Recovery+xcesd.txt	kngduuaukdjk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\WATER\Recovery+xcesd.png	kngduuaukdjk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\VBA\Recovery+xcesd.txt	kngduuaukdjk.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\af\LC_MESSAGES\Recovery+xcesd.html	kngduuaukdjk.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\stream_out\Recovery+xcesd.png	kngduuaukdjk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSIPC\sr-Cyrl-BA\Recovery+xcesd.png	kngduuaukdjk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Web Server Extensions\16\BIN\1033\Recovery+xcesd.html	kngduuaukdjk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\Resources\1033\Recovery+xcesd.txt	kngduuaukdjk.exe
File opened for modification	C:\Program Files\VideoLAN\Recovery+xcesd.txt	kngduuaukdjk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\Recovery+xcesd.txt	kngduuaukdjk.exe
File opened for modification	C:\Program Files\Common Files\System\en-US\Recovery+xcesd.png	kngduuaukdjk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSIPC\sk\Recovery+xcesd.txt	kngduuaukdjk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft SQL Server\130\Recovery+xcesd.png	kngduuaukdjk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\Recovery+xcesd.txt	kngduuaukdjk.exe
File opened for modification	C:\Program Files\Windows Media Player\de-DE\Recovery+xcesd.html	kngduuaukdjk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Fonts\Recovery+xcesd.txt	kngduuaukdjk.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\Recovery+xcesd.html	kngduuaukdjk.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\hy\LC_MESSAGES\Recovery+xcesd.txt	kngduuaukdjk.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrome.7z	kngduuaukdjk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC	kngduuaukdjk.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\Recovery+xcesd.png	kngduuaukdjk.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe\AppxMetadata\Recovery+xcesd.html	kngduuaukdjk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\VBA\Recovery+xcesd.png	kngduuaukdjk.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\uz\LC_MESSAGES\Recovery+xcesd.png	kngduuaukdjk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Library\Analysis\Recovery+xcesd.txt	kngduuaukdjk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OutlookLogoSmall.contrast-black_scale-140.png	kngduuaukdjk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft.NET\ADOMD.NET\130\Recovery+xcesd.html	kngduuaukdjk.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\hrtfs\Recovery+xcesd.txt	kngduuaukdjk.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ar\Recovery+xcesd.png	kngduuaukdjk.exe
File opened for modification	C:\Program Files\dotnet\host\Recovery+xcesd.png	kngduuaukdjk.exe
File opened for modification	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\Recovery+xcesd.png	kngduuaukdjk.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ko\LC_MESSAGES\Recovery+xcesd.html	kngduuaukdjk.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe\GameBarWidgetUI\Icons\icon.light.targetsize-44.png	kngduuaukdjk.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\kngduuaukdjk.exe	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\kngduuaukdjk.exe	jaffacakes118_HEUR.Trojan.Win32.Generic.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	kngduuaukdjk.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	kngduuaukdjk.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NOTEPAD.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kngduuaukdjk.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2568	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1704430598-3087477806-3297458608-1000\{24C396E2-FE69-4E2C-B0D1-5E8F4FFF9C17}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	kngduuaukdjk.exe
Key created	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000_Classes\Local Settings	kngduuaukdjk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	NOTEPAD.EXE

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
2540	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4668	kngduuaukdjk.exe
4668	kngduuaukdjk.exe
4668	kngduuaukdjk.exe
4668	kngduuaukdjk.exe
4668	kngduuaukdjk.exe
4668	kngduuaukdjk.exe
4668	kngduuaukdjk.exe
4668	kngduuaukdjk.exe
2468	WMIC.exe
2468	WMIC.exe
2468	WMIC.exe
2468	WMIC.exe
4668	kngduuaukdjk.exe
4668	kngduuaukdjk.exe
4668	kngduuaukdjk.exe
4668	kngduuaukdjk.exe
4668	kngduuaukdjk.exe
4668	kngduuaukdjk.exe
4668	kngduuaukdjk.exe
4668	kngduuaukdjk.exe
4668	kngduuaukdjk.exe
4668	kngduuaukdjk.exe
4668	kngduuaukdjk.exe
4668	kngduuaukdjk.exe
4668	kngduuaukdjk.exe
4668	kngduuaukdjk.exe
4668	kngduuaukdjk.exe
4668	kngduuaukdjk.exe
4668	kngduuaukdjk.exe
4668	kngduuaukdjk.exe
4668	kngduuaukdjk.exe
4668	kngduuaukdjk.exe
4668	kngduuaukdjk.exe
4668	kngduuaukdjk.exe
4668	kngduuaukdjk.exe
4668	kngduuaukdjk.exe
4668	kngduuaukdjk.exe
4668	kngduuaukdjk.exe
4668	kngduuaukdjk.exe
4668	kngduuaukdjk.exe
4668	kngduuaukdjk.exe
4668	kngduuaukdjk.exe
4668	kngduuaukdjk.exe
4668	kngduuaukdjk.exe
4668	kngduuaukdjk.exe
4668	kngduuaukdjk.exe
4668	kngduuaukdjk.exe
4668	kngduuaukdjk.exe
4668	kngduuaukdjk.exe
4668	kngduuaukdjk.exe
4668	kngduuaukdjk.exe
4668	kngduuaukdjk.exe
4668	kngduuaukdjk.exe
4668	kngduuaukdjk.exe
4668	kngduuaukdjk.exe
4668	kngduuaukdjk.exe
4668	kngduuaukdjk.exe
4668	kngduuaukdjk.exe
4668	kngduuaukdjk.exe
4668	kngduuaukdjk.exe
4668	kngduuaukdjk.exe
4668	kngduuaukdjk.exe
4668	kngduuaukdjk.exe
4668	kngduuaukdjk.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
308	msedge.exe
308	msedge.exe
308	msedge.exe
308	msedge.exe
308	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4996	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Token: SeDebugPrivilege	4668	kngduuaukdjk.exe
Token: SeIncreaseQuotaPrivilege	2468	WMIC.exe
Token: SeSecurityPrivilege	2468	WMIC.exe
Token: SeTakeOwnershipPrivilege	2468	WMIC.exe
Token: SeLoadDriverPrivilege	2468	WMIC.exe
Token: SeSystemProfilePrivilege	2468	WMIC.exe
Token: SeSystemtimePrivilege	2468	WMIC.exe
Token: SeProfSingleProcessPrivilege	2468	WMIC.exe
Token: SeIncBasePriorityPrivilege	2468	WMIC.exe
Token: SeCreatePagefilePrivilege	2468	WMIC.exe
Token: SeBackupPrivilege	2468	WMIC.exe
Token: SeRestorePrivilege	2468	WMIC.exe
Token: SeShutdownPrivilege	2468	WMIC.exe
Token: SeDebugPrivilege	2468	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2468	WMIC.exe
Token: SeRemoteShutdownPrivilege	2468	WMIC.exe
Token: SeUndockPrivilege	2468	WMIC.exe
Token: SeManageVolumePrivilege	2468	WMIC.exe
Token: 33	2468	WMIC.exe
Token: 34	2468	WMIC.exe
Token: 35	2468	WMIC.exe
Token: 36	2468	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2468	WMIC.exe
Token: SeSecurityPrivilege	2468	WMIC.exe
Token: SeTakeOwnershipPrivilege	2468	WMIC.exe
Token: SeLoadDriverPrivilege	2468	WMIC.exe
Token: SeSystemProfilePrivilege	2468	WMIC.exe
Token: SeSystemtimePrivilege	2468	WMIC.exe
Token: SeProfSingleProcessPrivilege	2468	WMIC.exe
Token: SeIncBasePriorityPrivilege	2468	WMIC.exe
Token: SeCreatePagefilePrivilege	2468	WMIC.exe
Token: SeBackupPrivilege	2468	WMIC.exe
Token: SeRestorePrivilege	2468	WMIC.exe
Token: SeShutdownPrivilege	2468	WMIC.exe
Token: SeDebugPrivilege	2468	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2468	WMIC.exe
Token: SeRemoteShutdownPrivilege	2468	WMIC.exe
Token: SeUndockPrivilege	2468	WMIC.exe
Token: SeManageVolumePrivilege	2468	WMIC.exe
Token: 33	2468	WMIC.exe
Token: 34	2468	WMIC.exe
Token: 35	2468	WMIC.exe
Token: 36	2468	WMIC.exe
Token: SeBackupPrivilege	1608	vssvc.exe
Token: SeRestorePrivilege	1608	vssvc.exe
Token: SeAuditPrivilege	1608	vssvc.exe
Token: SeIncreaseQuotaPrivilege	696	WMIC.exe
Token: SeSecurityPrivilege	696	WMIC.exe
Token: SeTakeOwnershipPrivilege	696	WMIC.exe
Token: SeLoadDriverPrivilege	696	WMIC.exe
Token: SeSystemProfilePrivilege	696	WMIC.exe
Token: SeSystemtimePrivilege	696	WMIC.exe
Token: SeProfSingleProcessPrivilege	696	WMIC.exe
Token: SeIncBasePriorityPrivilege	696	WMIC.exe
Token: SeCreatePagefilePrivilege	696	WMIC.exe
Token: SeBackupPrivilege	696	WMIC.exe
Token: SeRestorePrivilege	696	WMIC.exe
Token: SeShutdownPrivilege	696	WMIC.exe
Token: SeDebugPrivilege	696	WMIC.exe
Token: SeSystemEnvironmentPrivilege	696	WMIC.exe
Token: SeRemoteShutdownPrivilege	696	WMIC.exe
Token: SeUndockPrivilege	696	WMIC.exe
Token: SeManageVolumePrivilege	696	WMIC.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
308	msedge.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 4996 wrote to memory of 4668	4996	jaffacakes118_HEUR.Trojan.Win32.Generic.exe	89
PID 4996 wrote to memory of 2484	4996	jaffacakes118_HEUR.Trojan.Win32.Generic.exe	90
PID 4668 wrote to memory of 2468	4668	kngduuaukdjk.exe	92
PID 4668 wrote to memory of 2540	4668	kngduuaukdjk.exe	100
PID 4668 wrote to memory of 308	4668	kngduuaukdjk.exe	101
PID 308 wrote to memory of 4168	308	msedge.exe	102
PID 4668 wrote to memory of 696	4668	kngduuaukdjk.exe	103
PID 308 wrote to memory of 3572	308	msedge.exe	106
PID 308 wrote to memory of 2568	308	msedge.exe	107
PID 308 wrote to memory of 3572	308	msedge.exe	106
PID 308 wrote to memory of 3572	308	msedge.exe	106
PID 308 wrote to memory of 3484	308	msedge.exe	108
PID 308 wrote to memory of 3484	308	msedge.exe	108
PID 308 wrote to memory of 3148	308	msedge.exe	109
PID 308 wrote to memory of 3148	308	msedge.exe	109
PID 308 wrote to memory of 3148	308	msedge.exe	109
PID 308 wrote to memory of 5784	308	msedge.exe	110
PID 308 wrote to memory of 5784	308	msedge.exe	110
PID 308 wrote to memory of 5784	308	msedge.exe	110
PID 308 wrote to memory of 1784	308	msedge.exe	113
PID 308 wrote to memory of 2508	308	msedge.exe	112
PID 308 wrote to memory of 1784	308	msedge.exe	113
PID 308 wrote to memory of 1784	308	msedge.exe	113
PID 308 wrote to memory of 2508	308	msedge.exe	112
PID 308 wrote to memory of 2508	308	msedge.exe	112
PID 4668 wrote to memory of 2548	4668	kngduuaukdjk.exe	115
PID 308 wrote to memory of 5356	308	msedge.exe	118
PID 308 wrote to memory of 5368	308	msedge.exe	117
PID 308 wrote to memory of 5356	308	msedge.exe	118
PID 308 wrote to memory of 5368	308	msedge.exe	117
PID 308 wrote to memory of 2816	308	msedge.exe	120
PID 308 wrote to memory of 5424	308	msedge.exe	124
PID 308 wrote to memory of 5424	308	msedge.exe	124
PID 308 wrote to memory of 1148	308	msedge.exe	125
PID 308 wrote to memory of 1148	308	msedge.exe	125
PID 308 wrote to memory of 880	308	msedge.exe	126
PID 308 wrote to memory of 880	308	msedge.exe	126
PID 308 wrote to memory of 4236	308	msedge.exe	127
PID 308 wrote to memory of 4676	308	msedge.exe	128
PID 308 wrote to memory of 2424	308	msedge.exe	129
PID 308 wrote to memory of 3688	308	msedge.exe	130
PID 308 wrote to memory of 3688	308	msedge.exe	130

System policy modification 1 TTPs 2 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	kngduuaukdjk.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1"	kngduuaukdjk.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HEUR.Trojan.Win32.Generic.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HEUR.Trojan.Win32.Generic.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4996
- C:\Windows\kngduuaukdjk.exe
  C:\Windows\kngduuaukdjk.exe
  2⤵
  - Creates a file in the Startup directory
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Program Files directory
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:4668
- - C:\Windows\System32\wbem\WMIC.exe
    "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /nointeractive
    3⤵
    - Reads the TCP/IP host and domain name from the registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2468
- - C:\Windows\SysWOW64\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\RECOVERY.TXT
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Opens file in notepad (likely ransom note)
    PID:2540
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\RECOVERY.HTM
    3⤵
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:308
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x394,0x7ffc2d8bc188,0x7ffc2d8bc194,0x7ffc2d8bc1a0
      4⤵
      PID:4168
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1536,i,1770392935253836294,1918906715863698606,262144 --field-trial-handle=2428,i,5704582224307686494,8761948727422362501,262144 --variations-seed-version --mojo-platform-channel-handle=2432 /prefetch:2
      4⤵
      PID:3572
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1668,i,3306833806231310324,2732847123267553071,524288 --field-trial-handle=2428,i,5704582224307686494,8761948727422362501,262144 --variations-seed-version --mojo-platform-channel-handle=2548 /prefetch:11
      4⤵
      System Time Discovery
      PID:2568
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2196,i,1700883594923819601,37365637224536333,524288 --field-trial-handle=2428,i,5704582224307686494,8761948727422362501,262144 --variations-seed-version --mojo-platform-channel-handle=3208 /prefetch:13
      4⤵
      PID:3484
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3472,i,15519435147898649018,4891996196559938013,2097152 --field-trial-handle=2428,i,5704582224307686494,8761948727422362501,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
      4⤵
      PID:3148
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3488,i,3977305125387553082,13489201375747774986,2097152 --field-trial-handle=2428,i,5704582224307686494,8761948727422362501,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:1
      4⤵
      PID:5784
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4176,i,17021355300000943707,7408332585654276342,2097152 --field-trial-handle=2428,i,5704582224307686494,8761948727422362501,262144 --variations-seed-version --mojo-platform-channel-handle=4440 /prefetch:1
      4⤵
      PID:2508
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4188,i,14696721560494192537,11790729006159651149,2097152 --field-trial-handle=2428,i,5704582224307686494,8761948727422362501,262144 --variations-seed-version --mojo-platform-channel-handle=4908 /prefetch:9
      4⤵
      PID:1784
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3636,i,13885378372750491368,15118465896049967053,524288 --field-trial-handle=2428,i,5704582224307686494,8761948727422362501,262144 --variations-seed-version --mojo-platform-channel-handle=3708 /prefetch:14
      4⤵
      PID:5368
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3644,i,5221874029174223960,4871590066687765764,524288 --field-trial-handle=2428,i,5704582224307686494,8761948727422362501,262144 --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:14
      4⤵
      PID:5356
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5944,i,395941690388211868,742651366708834029,524288 --field-trial-handle=2428,i,5704582224307686494,8761948727422362501,262144 --variations-seed-version --mojo-platform-channel-handle=5964 /prefetch:14
      4⤵
      PID:5448
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5944,i,395941690388211868,742651366708834029,524288 --field-trial-handle=2428,i,5704582224307686494,8761948727422362501,262144 --variations-seed-version --mojo-platform-channel-handle=5964 /prefetch:14
      4⤵
      PID:2816
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6516,i,12391546024926231077,4012931156432121149,524288 --field-trial-handle=2428,i,5704582224307686494,8761948727422362501,262144 --variations-seed-version --mojo-platform-channel-handle=6544 /prefetch:14
      4⤵
      PID:5424
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6544,i,5281872957257477264,4893526207503912058,524288 --field-trial-handle=2428,i,5704582224307686494,8761948727422362501,262144 --variations-seed-version --mojo-platform-channel-handle=6564 /prefetch:14
      4⤵
      PID:1148
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6684,i,5876830741158284834,3811155765006523699,524288 --field-trial-handle=2428,i,5704582224307686494,8761948727422362501,262144 --variations-seed-version --mojo-platform-channel-handle=6808 /prefetch:14
      4⤵
      PID:880
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5032,i,1713914579428468651,11277402186896776194,524288 --field-trial-handle=2428,i,5704582224307686494,8761948727422362501,262144 --variations-seed-version --mojo-platform-channel-handle=6552 /prefetch:14
      4⤵
      PID:4236
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5036,i,14115575844331759966,18044780694254275159,524288 --field-trial-handle=2428,i,5704582224307686494,8761948727422362501,262144 --variations-seed-version --mojo-platform-channel-handle=5296 /prefetch:14
      4⤵
      PID:4676
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5020,i,256728453395433897,14284974410294282643,524288 --field-trial-handle=2428,i,5704582224307686494,8761948727422362501,262144 --variations-seed-version --mojo-platform-channel-handle=5008 /prefetch:14
      4⤵
      PID:2424
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5568,i,2345152032101781006,10210642241791385604,524288 --field-trial-handle=2428,i,5704582224307686494,8761948727422362501,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:14
      4⤵
      PID:3688
- - C:\Windows\System32\wbem\WMIC.exe
    "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /nointeractive
    3⤵
    - Reads the TCP/IP host and domain name from the registry
    - Suspicious use of AdjustPrivilegeToken
    PID:696
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c DEL C:\Windows\KNGDUU~1.EXE
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2548
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\AppData\Local\Temp\JAFFAC~1.EXE
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2484

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1608

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4552

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2248

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2388

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

Recovery+xcesd.html

Path C:\PerfLogs\Recovery+xcesd.html
Size 11KB
SHA256 763e60d524a4bf53366edabbae22cf2f16adac423ec4858bf17e4b1bcd88021c
MD5 c6e4982bf55b3ffaf86ceb395da44777
SHA1 28e269ccb8febb9d96af83708de0db458a8db70b
SHA512 ed954a15469858556b2aa3323336e85e2b6b3331c679ab88d9133ed2fc167a1faca2eb9ac990d0be35f08ce279ebc7edf4726f97ecdc0635fef268df4f43e316
SSDEEP 96:B1N1Dl1Z+uGpGZH+leqLNq4LRixpcSPwmjjCdqCNcCPPC2Cp5CWsCGCPcCzC3CYu:Bzen+L2N3mxw5jnktJknKH
TLSH
T1CB42E8996D4CD1D16D28C2B67B484F5EE2B38D2B016D6F6904E55FC0FAE886120BE3C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Recovery+xcesd.png

Path C:\PerfLogs\Recovery+xcesd.png
Size 61KB
SHA256 931722bd1d551cd294985e831600c058146177a1820f97c09cc437693783701a
MD5 1a3a7fecb4f7994ce6e50923fa6fb326
SHA1 7b713996b5d2ecbab28bc944a3ded716272e4ae6
SHA512 50dc0f8b2fdbddb6455798e766a180f961b4902d2d8dfd8a635c781bd6dde6451fa3933feb4f97a1c6cbe65c0cb9cc345c64475d3bff1e03ee6a098a2fe9d4dd
SSDEEP 1536:O4inwNcwHIMBf+6gqMwiai2QqkVUGTnG9JV2OFrUBszcI0t:O4inw+wH1FgqkTLq/2mUBN
TLSH
T18553CF6A846209E5D2C546B71A5F2F7DB93C0FC2A670710E03369B7E87F6C63B211E49
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Recovery+xcesd.txt

Path C:\PerfLogs\Recovery+xcesd.txt
Size 1KB
SHA256 687465a93191bc8b2eceb15f087df554a225512898ce765961e73c5bd2cc141a
MD5 edd1aebadd3f21b645e97b4f9e1022a4
SHA1 01eda1e6dd7c0df014deddbd47591acca0e9e196
SHA512 e359e61b7bda35c5da6dcc5c08c5aa35bb390d48578b88f4282bbb6dc0e1726e8ed40bcd4dc8e10725b6ddaddd54cfb20897cac96198e9999debf3cdd2b4d395
TLSH
T13441548F6F6125105F91DB837BB84645FB126099267903566C1B891E33219E2F32FA8A
MD5 SHA1 SHA512 TLSH

Submit Download

THIRDPARTYLICENSEREADME-JAVAFX.txt

Path C:\Program Files\Java\jdk-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt
Size 560B
SHA256 f490d6c24a5f853a456e1d2ac61ca0734ba7f753c9ea21efe4e862455b855f38
MD5 6adfbb9c69f6e66c555e2aba47ac930f
SHA1 15124c13f4114d48be48b131f0a28fc8843ac922
SHA512 7978be61aabed786883b63588b6a9138230b19a16753eec3d5e43f45249e5cf2c21125ca41724bcc291926eeda22fd57d4a14daafd4765bee5cf46f57b2df2fc
TLSH
T17DF075835D972122FF08B8780AC38D025D945AD61E495060A800C81113450EB4FECC20
MD5 SHA1 SHA512 TLSH

Submit Download

THIRDPARTYLICENSEREADME.txt

Path C:\Program Files\Java\jdk-1.8\THIRDPARTYLICENSEREADME.txt
Size 560B
SHA256 2bfff25a548fca93d95c03cf167be564ff15b0078b71da1e3014a4c3cf4079ef
MD5 50aeafa6ab1ac606c6d2dd0ac72fc313
SHA1 f2ff56e0139256dc8d1fde914d242c257485b3ed
SHA512 d2be40beb85f6915f199999ad2157abe10b05dc8eca611b74caa52d27b599e2191309e2699a4c3aac89b0cdb28c886d059c7920da6095e94daef4c6a91f6af68
TLSH
T19CF075496BB6510BFC89DE780C834E415C808AEE490628921821C8F455400478A6C620
MD5 SHA1 SHA512 TLSH

Submit Download

README.txt

Path C:\Program Files\Java\jre-1.8\README.txt
Size 416B
SHA256 f04a534f78fb3c0f7cddd12c8c21bf1ef7090ae0401d5c27d1fb2743333892ae
MD5 8b195439722154741f312c84cc8f2469
SHA1 953b0c5b553e702f4789ae4e327ef3823607fdd9
SHA512 8912ef3078226d8c634411d65df2c1cfdf59341d90c1510693bc3971f82dc38d0f62635b12bb927225b7a65c2ad69e77d03506fe81b9a5b7232b5b87855eb920
TLSH
T1F1E0C0499EB123A2FEC9C7B95CA70E254E980EEAD7C62C642C04C674250780F9B6C920
MD5 SHA1 SHA512 TLSH

Submit Download

Xusage.txt

Path C:\Program Files\Java\jre-1.8\bin\server\Xusage.txt
Size 1KB
SHA256 b75b789f45642e4b736d142da3146eb3686fc29c9516a156b409b63538203840
MD5 f77363f863ce1a5d996f7062d496a6f4
SHA1 1bea821ff7f9f2cf5c1a4fd04f5b6871c9402291
SHA512 024537b9e8d98a7044bab001a66ed2346a07d37a88542ec45bc44cdaf34f60e5196af9fd132c92b5f6f0d53253a801b0c46b16fe3dc3bc27b4445153f2c2e2b9
TLSH
T1B631E94ADA660051F61879BBAFDE2B1094516ECEC7020AB15C3EC5A46A5AC2E49B4F30
MD5 SHA1 SHA512 TLSH

Submit Download

ffjcext.zip

Path C:\Program Files\Java\jre-1.8\lib\deploy\ffjcext.zip
Size 14KB
SHA256 f13251b0d3a2fe483dcd29cede64fbffd57f498368cb97b9ac57b86d1486d66f
MD5 c006b6970689a613f50a11c8258aadb7
SHA1 00fc81d5bcf4625764c674851915a49df4c4714d
SHA512 ff9e5de80d47a47a226722fa2bca1fc1fd6fe96c82081f07b418db2db2f50f82cbbedc4a994d81d86585dd9840be4bd425b75de31923492cbe6b70cd61b6c368
SSDEEP 384:p4Hq8YRpvsYXjfqedh9r+nW1x3z16STpr:+Hq/sYXjfqedhcnW1lsSZ
TLSH
T15F62B0418B72AE0DF807633847D6158F149BA71E8DC4FC12A816C74AB745473A6AECFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jvm.hprof.txt

Path C:\Program Files\Java\jre-1.8\lib\jvm.hprof.txt
Size 4KB
SHA256 b26667f8631f9077cec0d0611e9fbe5bc03bc9bddae0e54d9b2c0a4b69fb2ebe
MD5 3e163d5bcda47675873ed461092fab6b
SHA1 5727a743dd499174ce55a6cb0e36c5ba027923e8
SHA512 d93917c85ad4ee641c40c871b38fca224f2e1b4a114976427f578b0cfb7ecdb6975d4fa2c0b22104a772cc89c213715e3357eb75441a9056b59599cb7110fd80
SSDEEP 96:TwRWY95oNoNgK/5o3h90wV7NmrcTiSAu99hO2qjRy:kR1oO+Khyh9170rQiSAu/hO2qjRy
TLSH
T1D2918E2CD56628FFFD00BFB8706AA82D7DFF9BDAB100DD4C976684F4866C0159620D48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ClientOSub2019_eula.txt

Path C:\Program Files\Microsoft Office\root\Office16\1033\ClientOSub2019_eula.txt
Size 416B
SHA256 c536cd9298c6e4f1de77d3a2a77aff66cb8674dab5fcdfc6c9c2cbde987e3811
MD5 3694ac47594c59d9a3de2d2f36b2facd
SHA1 b514a68455f0893632b5eb2350cc7795b94d5280
SHA512 bca09e7cd1baec686e38fca2b1c83e7020f61d63603e068f80f17a45a8645f4d8ab1cf3f0e1e0f5f0264f0782c8a24b30621c402603fe4f0c2384582b076df0a
TLSH
T121E06A485EB52211FD459D741CE30D124D540FFA454A28703C14C970010140F4B3C920
MD5 SHA1 SHA512 TLSH

Submit Download

user.png

Path C:\ProgramData\Microsoft\User Account Pictures\user.png
Size 2KB
SHA256 894c4d7f6e3f1ae698649b749adb15bb0fdaa920dc6cc79622c051543c019ea0
MD5 b751cd52527af8725d41f7b1063e3545
SHA1 a8ba998a944d0fd44d7554f80b79e3f068b5e49a
SHA512 136f335820a66997f336355217c2b0ee66c691f6aaa9a8a1f0ef8de11ed4bd7a078fd1f8be53047d90723b3d5f3d9c3cca3f803af07f75212f35090bd005a32d
TLSH
T103413A419E953F03FA92F9726492C6A86E35DDADC4C4BC5331388294624590D6E21F25
MD5 SHA1 SHA512 TLSH

Submit Download

1b47f0ef-172d-49ba-a29a-a2e2fa5e70d8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\1b47f0ef-172d-49ba-a29a-a2e2fa5e70d8.tmp
Size 40KB
SHA256 7a31e0af11d41878940ddeb588f54773c8a5ebdc5b6be6a8c5f6f36d22816ef1
MD5 c465431d71002f7b7de04b7d67dcebec
SHA1 1b79c5fb983aa282140b9db0f5fd70e7f7235c6d
SHA512 bb8c03fc52f96be6c575c89b608526bb5c745bd914852839abb9455b3b6fbd90a13748a0f8458f9b34cf7b53643ef22805a6aa8849307d9c11c7685f6ab90f65
SSDEEP 768:3P/UxvxjgC+z3gjgUbieO1uZt9/nUPO4Qp7cPAiSm2eo4w4cciGrTFljykJVCHMD:3iZj3+z3+gM3/wQpYoimeoR4ccFFByQh
TLSH
T1B713C071E9A9BE23ACF3A24536592392FFF01573A4C11E98CAEA5F0D414379E0717C1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

47e76774-523e-4b67-aca2-7ace026030a6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\47e76774-523e-4b67-aca2-7ace026030a6.tmp
Size 38KB
SHA256 61adf7a35a557044c56443446de48aa3aab16d865d0f5adaff1b91acc9429198
MD5 2cfa919b5b62883a05ebbb303aa37464
SHA1 3a998190d155d07c180014b6c01f11d350c0dd2c
SHA512 5b7fd7118e6533c3eb74becd1cde30ab6a4055aa7bc1920ad6d697cb17a35dc2d451ca358c9794ccc76f08d41b177396c2b91997380e03e1bb630270b20cef9d
SSDEEP 768:vP/UxvxjgC+5j3VVC98RieO1uZt9jFnUPO4Qp7cPAiSm2eo4w4cciGrTFIjAgZbk:viZj3+5j3VA9+3jFwQpYoimeoR4ccFFZ
TLSH
T1F803CFB5D8A8BE239CF3A244365D6393FFF110A398C11E94CAEA1E0D414779E171BC5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7b465ba0-c810-47ca-bd62-0b53df5e7d01.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\7b465ba0-c810-47ca-bd62-0b53df5e7d01.tmp
Size 37KB
SHA256 e351e3f7e5467f0e819f81f59f51cb7d5b1e0ce60bfad5998576f8f9faa0ae09
MD5 6217e2779cbc407d8f56c378f5a6c827
SHA1 960bf005b9df65c69ced011081070d8119637bb7
SHA512 563c5e48578fa2ff23f02b0259ded99d77a49cf89e1c55220ffd44d45f3693483b78d1df677a3173870b43851b1c9364c564045658186bf4011158f8615bcf15
SSDEEP 768:vw/UxvxjgC+5j3IVq68GieO11jFnUPO4Qp7cPAiSm2eo4w4cciGrTF5RAgZbCM3s:vdZj3+5j3Ic6JKjFwQpYoimeoR4ccFFG
TLSH
T17303BE75D8A8BE33DCF39684361D6342FFF1416395C12AA4CAE91E0D42877AD430BC56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8a913999-dfcf-4ae6-b151-a20d0c390b89.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\8a913999-dfcf-4ae6-b151-a20d0c390b89.tmp
Size 34KB
SHA256 e425195a5e8b9136bf2200d9e7e50b582ccf27105a1081a486f4ea254ef7d71c
MD5 4cd14ef46cde3203e85975b2fbc7348a
SHA1 511f88d3dc4df19252a62823407dd30aef7a4c61
SHA512 111e8130a0e04f8be969df6b0077c767e09b1628c24bd00fc6fd752a7158964e24ebf91ff3709a9fd7615a9704ed08ff660268d87a624cb7ddc097f54cfbefdc
SSDEEP 768:3j63i26UbieO1uZt9+nUPO4Qp7cPAiSm2eo4w4cciGrTFljykJVCE:3j63p6M3+wQpYoimeoR4ccFFByQ7
TLSH
T106F2BFB0E9A5BF33ACF6924575593351BFF05133A9C40E88DAEA6F0D4143B9A071BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8bf8abc7-2f0d-44b2-9eb4-2502e8136378.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\8bf8abc7-2f0d-44b2-9eb4-2502e8136378.tmp
Size 34KB
SHA256 eedb8d8a74d93077f2646de7a4fdc3b5abafb3c43ab4002fdbe32b262d95fc50
MD5 f82d7e1406bbec6b5fd542867cb8231b
SHA1 c52f93e68d8b4d8487bc302b20230dabb7c6cd23
SHA512 1bc571ebdb2e3abaf76a11629066949dcc6485055363706ea8b0e75f8686d6c7b1a1ae0f2051b1cc071d5a8a4166eac5d3bc0a66b4f3fd352727926eeca95255
SSDEEP 768:H63726UbieO1uZt9+nUPO4Qp7cPAiSm2eo4w4cciGrTFljykJVCE:H63a6M3+wQpYoimeoR4ccFFByQ7
TLSH
T191F2BFB0E9A5BF33ACF6924575593351BFF05133A9C40E88DAEA6F0D4143B9A071BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ca1b4d81-0424-4232-bc37-84206ebf8304.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\ca1b4d81-0424-4232-bc37-84206ebf8304.tmp
Size 105KB
SHA256 10bf49f629ba90a1161d0117602435d1a511d1f7a5e47b20fe3a693551550e5a
MD5 71eab00578b8a3050d0ce445655db7b7
SHA1 5d8b06f8805760a18e17cebb8bf5d7f5043e6b1b
SHA512 be43de9b4dd545f3d61990b5e57cf08e702bc1c9f282e5e78b4586dfb34cb8ef3bc6ed1dfaeab69e5117101a833b785cd1e7e844338056be3018d33e6c4afa51
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7P:fwUQC5VwBIiElEd2K57P7P
TLSH
T1A7B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 68f353a62995fc87917d7d1eef768abe00ffab02e1d3e469100f99b6987f6488
MD5 5ba62d3fe2ddefdf87e8dd139f3e421b
SHA1 1986deda7bda2ac5b490eacb9fe2784fb6d01648
SHA512 4e6a767b24298d2e01c8dbefa41509e1bc67cf2c2f34fd0bf866fc1017e1d15a470a5a95feb8ee1cccf4b8ccf5fa9054bcbb93919c00de89eeffec199b68baf9
TLSH
T19CD02BB5DFFCCC62D54820B802518E116085B41519490040DA03FC04DD110814D03555
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 648887a89dac8888df245d8758dcd78e85ae79931c9464f19b0967fcd69c3d2f
MD5 b053e18c94ac6f6c60a9e0a281e1687b
SHA1 17ed2d8ae6844c2878132336a2fea7d044381f8b
SHA512 abf3d05979a55f573445c0c7a95529a5899c0d9f55f350b3eb35132d8502e23e6c764ffc98e92f4374754aa22e9292fd03f8e6e8113c0e919f428e797e339bfa
TLSH
T151D02BB9DFECCD62D54820B402508E116095B4156D490040D903BC04DD110814D03569
MD5 SHA1 SHA512 TLSH

Submit Download

05bf353a-7e16-4e74-a714-c338c6d1efb8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\05bf353a-7e16-4e74-a714-c338c6d1efb8.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

4424bd6e-0d64-47cd-8947-203a38843468.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4424bd6e-0d64-47cd-8947-203a38843468.tmp
Size 11KB
SHA256 062177edac9f3d9fe130d851a19a9e2f2daaef7aabf39e9ef37e81ec8bd5fbd4
MD5 9ace59cc3866bb8f941e570ec00822a4
SHA1 d11e550778460bd1a1e225149a022e91549369e9
SHA512 c7a12e029393994f1ea95303e107a5aaf39be31fe3224d8b0cac4cdcb68d9c41658fa81b88364b6aaae09b1c39193b9bcacd216f05b9153c95cde41a05b5a0f0
SSDEEP 192:sxR/RqCn/fePsVVZICzoA8p4z/g6+WNIYc1tX1iTEGlIgDaVu2NJ:sxR/vn/fePsVb4e/5IjliTpAus
TLSH
T19C42A615AD28B93B8CCBD21DBB55BF53D2F91132A0952E48E6FC8A1C04EB6DD121780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

74fa2fa7-2d34-4ca5-b9b1-ee332ddc0a9a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\74fa2fa7-2d34-4ca5-b9b1-ee332ddc0a9a.tmp
Size 12KB
SHA256 48354a8ae973985cdedf15090f6477bbd80b23e2a8de35ae103ba970dc822131
MD5 4f28b6f42868d1bc82eb8c6cf347ab44
SHA1 04a09bde79fc42f768a11ce6919d67dc2812563e
SHA512 11150ffb83f9b0cddc11fafbe52ab870c71649b7d3daa15ed971ed8f33d6486d899e262a20bf0cc0b82da9a27fcf569385e6795a35d541a32ec9763362043d13
SSDEEP 192:sxR/RqCn/fePsEKVZICzoA8p4z/g6+WNIYcLVhX1iTEGlIgDAVu2NJ:sxR/vn/fePsrb4e/5IrzliTpGus
TLSH
T12D42A615AD28B93B8CCBD21DBB55BF53D2F95133A0952E48A6FC8A1C04EB6DD121780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

901873c6-a60a-4e17-a699-38fb2e5836a3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\901873c6-a60a-4e17-a699-38fb2e5836a3.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 227fce910091142f76e99a197ad0c31d555c404bb4551bf8d6d4e6de4af51554
MD5 196c223f54f63fc35b8f240c725d8ed8
SHA1 b55efcac59dca9933310999c63ba64e0345e4373
SHA512 642b5f261cd6a5d18008e56652d7d67420b8f85ee82f383a3a3e90bad3ccf7facf4d859cadf5bcdd74fdb158a983b24cb856158b32bf4e8a1a82c2b25aee68dd
TLSH
T16661C74512B1E826FB58CC7386D85C8FF634DAA0A1875EC3C287DDBC55773AAF084644
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 bd023a9b3c52a4e430fa7bb4b3220c3b3cd5ffead0f91483e5152f81af1b0275
MD5 0f182b89530211de678eca89ee17b885
SHA1 e4167ac58527ca66ef016c4ba18a80e38e507f31
SHA512 d870e4777e1bfee1d2b96cd0dbe62908d65f991aa3a63b16343c4d4fb6f9a1defca3e8284453a435d919dcea15f13a82948676f966f616386dc8ccd268a00237
TLSH
T16E61B64562B1A825FB58CC7386D85C8FF634DAA0A1875EC3C287DDBC55773AAF084644
MD5 SHA1 SHA512 TLSH

Submit Download

009fcc53-9855-4fe9-ade2-2b96e6fcac9f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\009fcc53-9855-4fe9-ade2-2b96e6fcac9f.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

content.js.mp3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\content.js.mp3
Size 9KB
SHA256 9573fdadcf701f80da09ac3f597b6533ff6b9889578c196d68f278ca2176666d
MD5 b0592a433a7bed9060e60c4ff62ca086
SHA1 e34743626077ca9762d6d93dbdde14a1906858ca
SHA512 0178bad0981a8ba188c45c79c0c7c34c30c45ae51af6097186b27aca199081b0b746847b2d61f01a21e4fa02a373abc99b57c93470612ca64208b5de40464189
SSDEEP 192:kRrcps19EzRh01ODrYiEFQ+bZ2b4XLRC1dKgS:QcC3kDrYZ2sbCIgS
TLSH
T1F822C0A66B960CB8EC820C32191B5900490263CF59A5444F62D3E083F6BCF0ECE3DAB5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js.mp3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\content_new.js.mp3
Size 10KB
SHA256 dfd7da317562c85907c517e1491c0c397beac5ffb5be057b2d6f00f8e1670c5a
MD5 59e7690a8f077bb38a403046a0f4ecb0
SHA1 22bcd1cd7fe4c2604ae18bad994490bee20c41f9
SHA512 35adfad924c38520b7da2dfb6827a6f402dbad8b3ff6dda1f5efd4b5ab629715b4f94f1aa48d8531fd048386421646e587e4336e824fd860b6573a6de813f6e7
SSDEEP 192:kR6cps19EzRh01ODrYiEFQ+bUrwEB5vKQXG7i7HJeIkFu:tcC3kDrYUr/B59GO4Il
TLSH
T1F622AEA68D8B4CB8FDC38C7E6B4D0154DA0233939AA7041E69D351923C7DF48D7169B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

db37a7b9-b73e-4401-b1f7-7e12855c16d5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\db37a7b9-b73e-4401-b1f7-7e12855c16d5.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

e96cd352-a021-42ad-91c4-bfbe04a52efa.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\e96cd352-a021-42ad-91c4-bfbe04a52efa.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 7c31e40b1f5a69348fd1d1942e0f29ec3a5f87bb01be8335ca2803d186951d25
MD5 9ec1a630ead822d7fd9b15a172bce4c9
SHA1 339d6b89920b81ba652e65fb99cc5c8d931384b2
SHA512 3a7da54248f01e9c2c947932d5ae3e9a46780d5cb45fd305854976561322a1275b682aeef941a0cf66eff23cf036f52b098cbfa413de9c17c30fd7032b01b546
SSDEEP 768:DFaka4yG7pLuLbs5Wg1Bf9t8F1+UoAYDCx9Tuqh0VfUC9xbog/OVaE3697gXroM2:DFaka4ymEbs5Wg1Bf9tu1jaRE36xgEM2
TLSH
T1C7D2FB3B744CCB7E4F804A9DEC197E9F6DA802CB9598C94047FE941D03C67EA521A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 b1420378eab87c182f52ed3ab54ef6291a9ef69ed281a47a14c27480f370baf1
MD5 20932eb3d97150e7bcf81710884bc747
SHA1 520b0f76dc8c0fafa731bf70f69a2b09fda58238
SHA512 922b92fe4d68fbe78842566933414fb188ddeeed7e02001197a731a50dcec65e4eace9748bc83711176a1e6cd118602f0afeeec036c59896a1e573d27deb01bd
SSDEEP 96:K84AKNCyzOxqeQ0okY0LPKWkKSBKIkm+erQ1pwt5T/jgfXyzRRgK51RbgdhRi7J3:SPzOxqeQ0oX0LSWyBKIH+erQoXR
TLSH
T1CA911874777E424138BD790861D8A72A468235B33168E62E7BEE45A18E3BE040CBDDDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ab6f0589-6d5c-437a-906d-f65de3d9611f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ab6f0589-6d5c-437a-906d-f65de3d9611f.tmp
Size 11KB
SHA256 025a997ac1a4d998d49aa36f09144eb37fa55e92ffe1caa012836332f9fdd233
MD5 dc3af7c36ba42735fc5dc5e9e5f48f6e
SHA1 dab47b9368c97204ed2859f8cb4475f2f7ebaf72
SHA512 863c2a294e7ca55e6f3998084568d34de0e43cf53632f77aca62d79dddf04d5a878e6d3485066d652639809e3b8b0c56edbd1cb059931e3062d4a7d6e64c8a48
SSDEEP 192:sxR4RqCn/fePslVZICzoA8p4z/g6+WNIYc1tX1iTEGlIgVVu2NJ:sxR4vn/fePslb4e/5IjliTpbus
TLSH
T12F329615AD28B93B8CCBD21DBB55BF53D6F91133A0952E48E6FC891C04EA6DD121780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c6ab260a-5142-4faf-bb14-8d0a09cf0d9b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\c6ab260a-5142-4faf-bb14-8d0a09cf0d9b.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

344a0f1c-188e-4d77-ac4f-6e6782a0e718.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\344a0f1c-188e-4d77-ac4f-6e6782a0e718.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

OneDriveMedTile.scale-100.png

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.scale-100.png
Size 1024B
SHA256 bb7a522950f0bb81257b614356973e0df8b295c1d59e15a0b91f6c651f70c966
MD5 316109036b7177f118308ee9f9d46191
SHA1 a0ded34e412776c10f82627aa1190fdd1e685d1a
SHA512 818ec25c531a61ede8b3b5c724d167fd827eeb9c70313b4134a0d21291981cefaa3cac0390554d237edd3f4e8bdd1570ee6fe86e304239ba99e1f0dbfd823393
TLSH
T1011198CE66932213F58866779D378D371C1B8CCE1604E4B2251A86E461B184B8B6CD20
MD5 SHA1 SHA512 TLSH

Submit Download

OneDriveMedTile.scale-125.png

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.scale-125.png
Size 1KB
SHA256 6b9e985678dd499b81f9226a58a0b2c72601e4b414b9b9394f3a3dd7c5b06ddc
MD5 7583fe0ffeca14c9a3d0bfe5a2abe195
SHA1 71f51b4d0b46f91e7f45ff39672e665e78a88da3
SHA512 fb7841116493e0f695ee01029b094dea2b3f52bf6fd128c593b59f968d1f2a28aec069cec9519ca4e73722677cc11351b596e40808d4f5b540e2f6ee447d65b3
TLSH
T1E521B7428CFDB2ABF95B36B008570D1A58093AEB9E8575623128C131561040BCADE650
MD5 SHA1 SHA512 TLSH

Submit Download

OneDriveMedTile.scale-150.png

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.scale-150.png
Size 1KB
SHA256 0e043a198d180c716b386ff45ccbdd2fd45e07eb44b9142c3459075a344c9530
MD5 7d262e08bb8ae322aa54c2bc8f9bf957
SHA1 a0683fe5af69e4cfb99770f8dc29bb3e1ac87df7
SHA512 56b6b4a6c56e6294637a20f267c081e07bc39dcf8bd5b1ba0f677520c2c17158e998fc3254fa674b09d599c1040579003e2631684a71eae46acf457d08a5b451
TLSH
T1E321CB5A5FA02117E9951E359E731B318DA9189308A35EB6EC108F89C1059CBDE3CE20
MD5 SHA1 SHA512 TLSH

Submit Download

OneDriveMedTile.scale-200.png.mp3

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.scale-200.png.mp3
Size 1KB
SHA256 ce8c553fcb88c2d09007b9eb9a0cafc228b86b152af9cd2a5dec47972edec83f
MD5 f3615c30a0d5a662ce47e2a65118ab5a
SHA1 85869cbbb03289b48bf1752e5b7e6822ef51e24a
SHA512 7780d565814ce550967323aede8c20d94673be3df4c42ffb1d0a2350b4daf5f2fdcb8718b0b95b4f02da7a9482b8840eebcb9cfd76d726c224b86513c79d61a7
TLSH
T183311A160D89E9BBED5AE1B8593E6823D209EF3697375D311A19CBA816417442138E32
MD5 SHA1 SHA512 TLSH

Submit Download

OneDriveMedTile.scale-400.png

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.scale-400.png
Size 3KB
SHA256 f80c4b6d0b967d12ce50ef757480095a69336bd4ee08c2a741ca4af8092c17c8
MD5 4a338cd417936b890f322641b66eb23d
SHA1 03ec2e3a722ab3ae99dc82b89ed8e3d619a4789b
SHA512 3e89661507be8f506b276b45a46d866e9ef81dce26ef428055f009014005f42e41b8f87e3f499646929b512bc5f66736ca6e722807bd5f6293fac053baaa1508
TLSH
T159713BC58A77A749D6439C71B2DE6CB0450855CFCFDBD9E96840CB358E8341753F0625
MD5 SHA1 SHA512 TLSH

Submit Download

OneDriveSmallTile.scale-100.png

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.scale-100.png
Size 784B
SHA256 f3cece24c7bc1878d004b104c313972f0cdf111e8e8d0ed63d20bbf412829931
MD5 8c6e75f03c6bed93ca004890c06093e5
SHA1 c902dd8bc966b745e7bf6a3bd8a961b3a70bea92
SHA512 41b035c310f01d971487c02f2326a0d88fd588eda8daa76c5feea1a3d321c27d694a52eae82b688b4a40aa1b41c249184cda4a7dcd6ea1aaca78dbbfa3405597
TLSH
T16A01650C4BB27551F88D8EBC5AB30B371FAF15D5538DED510958CA3095160479F7CD25
MD5 SHA1 SHA512 TLSH

Submit Download

OneDriveSmallTile.scale-125.png

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.scale-125.png
Size 896B
SHA256 355aafc729e5c9ed953e9c90a202c48069ec43ddf9aa64835fb83c336142a9c0
MD5 afc82668eddf7b27dcabcbfb0c577836
SHA1 cb7211d00400ba7d640e737f99a6ef50250e3659
SHA512 a3aec2a500f115d982441f3fdd788d178e3d6f1b963590af701682a6af0acddc59923d759a66495f1a1da2f1d5b74a9a42d456384251dab536492e47a0384ac4
TLSH
T1BD11232C9F952393FB42D57CFA2315114EB497FC4A9ABC659C70875C111150B72A9D34
MD5 SHA1 SHA512 TLSH

Submit Download

OneDriveSmallTile.scale-150.png

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.scale-150.png
Size 960B
SHA256 3ecccc87f683832502575976f9ae5f2b83c7f23b6230aa17eab155c0eacc7e8e
MD5 aefa6ffdba198d1cf380b95c854c321c
SHA1 dae3e894a58f2f1af107fda4fba65363fae15cc4
SHA512 23d47dff09a8c6c90eb398618e609e1b09fce784b36ea8d13112e048a7630c1e9f54db76af2603cec5cac7619d76319ecf97bf0a10eca28bda949238b363403a
TLSH
T10C11B761AE851153FA88DB787C13011B0E9185DC7D5E3EE06418C3354B12C4BBAFE421
MD5 SHA1 SHA512 TLSH

Submit Download

OneDriveSmallTile.scale-200.png

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.scale-200.png
Size 1KB
SHA256 5f68d68f9e2da26d9dc65b1b1477f566ca4727699bb87de4cbda1dd6957b4205
MD5 457a5ee30e815d7f4d4911aa63ee9481
SHA1 9b262174e55fb87a4b81a9049d5feb467f3dec3f
SHA512 23906b3712062344697be72cc7c6eb0a0d695bca199c453fab1ac538c88fdc920ffc3ac7a6072d1db66437bcb4cba2e2d2bfa865cdca4ba8857bcd1dd0256654
TLSH
T16221F90E8F8DA8C9FA8455B969B348204D5C1B58CB8ABCD339C141642D8998F852C94F
MD5 SHA1 SHA512 TLSH

Submit Download

OneDriveSmallTile.scale-400.png

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.scale-400.png
Size 2KB
SHA256 28e99d3f025598e90ef329ae8800614a54127ea295f6d480123110f3f33ae614
MD5 702cf5d5a55e1904713825038282592a
SHA1 bebc0ced7b75d6457b678cd1453d2b18a6d74915
SHA512 1a32c7ceb5035453e7aafcdcd6f74ddfa73876980871e48d938029390632283560adedd4cc2aaf4b3b43f9e763ea5dfe121299d688f5b077273b1abfdff2febc
TLSH
T14C412CF95D5A676BD058FC72C2911DE8386F0BBF079930EC7D04CAAD4247BA231E0811
MD5 SHA1 SHA512 TLSH

Submit Download

appsconversions.txt

Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{d08fe31f-9864-4012-b4b2-fc1dbc996e2f}\appsconversions.txt
Size 1.4MB
SHA256 c16ae30a3cd770f99f98be63d75b47a46dd7435dd8cc670270756d46242824da
MD5 d8ff7bd6bd850514484ec6935aa7d78d
SHA1 a87112f9d45448a358d40db2516c89f4f0f52b54
SHA512 2f96dd60cdd2c7a93ee8978e70bd3da31525504f9589cd56e35f30b470a32735e803b4e5750e52d22bdb854ad62589ad7ee2717a918d67e100e6d76e767a30c9
SSDEEP 24576:LSCmH+tO4jvzxOyDe9CwcFlvOHE1hKo3xLYXq7HZjmRnHm/2VY3fVyN1U9KZ9:vmD4PxOyoSv71YqBYa7HiHm/2VCIN1Jf
TLSH
T10965338DCF1C5BD6E8ED0838AB61CD066F9E6324B305CB2C82BB55DE8461944065FEF5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appsglobals.txt

Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{d08fe31f-9864-4012-b4b2-fc1dbc996e2f}\appsglobals.txt
Size 331KB
SHA256 3a7d613b889dda6b863d0e6875f5eb31fc26dc6b5e34d0ea4ff41e519fb952cf
MD5 c945edffd882ffc2c0a3624c199f7331
SHA1 96fce684003545a07e020ffe79c110d88577b26f
SHA512 31ae5d4a50860ae93a477be9de31532ebafe76e30315df1b4afed5c368d4324447c4f07e53edf3249f7522ea4d2dc2f338da5e97e2015f7f9d50606195cc9c49
SSDEEP 6144:4RhiYx9bxskKRxRuL4FnIG4BDZQxQwwNPQcRoaxZXORg50wcqJO+7q0qohHwG+Gg:4DiqbdL4NIG4BDaxQFbowXORgYq1qcNm
TLSH
T15A7423987FB18887F799B18FD9DB81317C27A71F235951DFC93274329D94803C6A242A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appssynonyms.txt

Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{d08fe31f-9864-4012-b4b2-fc1dbc996e2f}\appssynonyms.txt
Size 374KB
SHA256 ea1b46a01d0ff83b0ff52b53c5c2b59fbc92ebab2282c3d28afffcf536160f49
MD5 40aeb3d94429f8d5efbbbdabd5bf49c0
SHA1 cbfd579dcb84aa121db27734e67534ef2bdc37c0
SHA512 bab3132c451d2077526f62c4922cae3abb634eb6d5e5389b1742b941ffaacf21a9e1a4a52b7652b59f9ca8be991abf9dcf1a6aea5b893e604935b61da9633929
SSDEEP 6144:8Ri5Y1UNfg63dWy9pg+YkFwM6QZqmWhxv3HLb6C3hxc3IYudIcvR3wHeC:8RzydWGpg+Y3M693rOGhxzvdnve+C
TLSH
T1E584233830AD57A39A9F1AF4BC1E0EA36FC6496B6DDA83FCD0E809DCD3C01419689175
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settingsconversions.txt

Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{d08fe31f-9864-4012-b4b2-fc1dbc996e2f}\settingsconversions.txt
Size 520KB
SHA256 df1af72d31ebd1460284e8b3a60a2269230f26aa1ce9e69e72e19288d25bc730
MD5 b8e109fe73831de3287184dea5454897
SHA1 fdc1d8622cd9e1786db12a88626ed00ce96baf58
SHA512 80a4db3785ff916385522e37b9973602080845e05336b4320abfefc2e138bed1f2fad72dd6bfc8168e1ca8ecc282fe081fed6f7037b88ff564e7fbef0a8a77db
SSDEEP 12288:lBnrxs9KO6pOc01yiMb3ntJanJDe/iDhN:lBnrxs8Oc0AiMbnTanFe/4hN
TLSH
T190B42386EEDC402CDEC479579184F98B35AB4ACD82CA359E0D9CBE29D8B3C8D56F9410
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settingsglobals.txt

Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{d08fe31f-9864-4012-b4b2-fc1dbc996e2f}\settingsglobals.txt
Size 61KB
SHA256 3d93012b0b1724bbcbb258e1bbe81f423717b96f0c95f76435d9e6c164588337
MD5 10318315b6c5835c369f7042655588b1
SHA1 efff830b2219f0f3543fbb596b6bab90a096c9f1
SHA512 68061fd62a2fb53fc8675be09b2e1a38f62f22b4cad88043160f2ed33c34962b3cf6832f98ccef9806a80dad4f72079d9e20f25fb9995aedaed3ce1af7cf74f7
SSDEEP 1536:ZoZe8Z5kMvM+Vsbq35Kl+kZI48Ekx/tnNLQJ5IOIRD+sWf7BlaL:gz5kIelXF8EA/jeu+Df7BlaL
TLSH
T1DF5302576B9120B5FA4B9A314CB6182221D56EF9CFA90680356D5D3D31280E3F63E8EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settingssynonyms.txt

Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{d08fe31f-9864-4012-b4b2-fc1dbc996e2f}\settingssynonyms.txt
Size 126KB
SHA256 18b27dfe9699f0d6abe3e74bf093efcfd820cee3df75c06ec2404f25a6ca07b0
MD5 4758eea656d1119546f861df7a795ca3
SHA1 dc3964c44043c26dba7c2527ff09b3c857ab7018
SHA512 db95b4cc76f9a5304df4d80c1a7304f61879aae4f8ecfd74cf9dad77d6d3bdb4b05361d828da00e2cb18b6a8c4853146e832639f77e33ac86d994e81a15c18d0
SSDEEP 1536:b4hj0syqAoQEXpRSraj1DEn1p5xmB/4euxI3mHE08fhbQmGEaG049nKahFlAjP91:b4hjt9AoQ6XBUPy6kzOcaG0z3jF5a+zL
TLSH
T191C312ADB69A0C16E57CA070C5D9B6EF0FF0138473118EFAF4AA0D7E36E978074A4205
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

675758dc-27da-4ddb-a9c8-7072e815f1aa.tmp

Path C:\Users\Admin\AppData\Local\Temp\675758dc-27da-4ddb-a9c8-7072e815f1aa.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9de029f3-e52a-48ea-b3af-f560baeccd1d.tmp

Path C:\Users\Admin\AppData\Local\Temp\9de029f3-e52a-48ea-b3af-f560baeccd1d.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir308_1038413001\CRX_INSTALL\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AssertGet.pdf.mp3

Path C:\Users\Admin\Desktop\AssertGet.pdf.mp3
Size 281KB
SHA256 9061dc821af669129f30b04d90a644296fb31599d26106a80a73ba5d884180e0
MD5 980872e5b451236b8344719ff640881e
SHA1 74ba452001056dd90c9e96768b8cfddf2f0d552f
SHA512 8dd1c7b7d24c5d70c7e5f141479fb6f076366c79e3786dd1ce04ee528e25e97c22f06034e5a75842d3cf1f1dea564d6db19f7e19d35c98462dd2127e260ff8ad
SSDEEP 6144:LkxfUOCtsE0OzzQKXLrQx70ND1VRA74+dvOWKaIiXVKCzKG8oBw0R2:LycOCtscrQ2Zyk+dvO/GXkCve
TLSH
T173542354D259D6F3D6031239EA5ED9C35A687C10062FD50EAA0AC568E3FABE73E7030D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ExportApprove.jpg.mp3

Path C:\Users\Admin\Desktop\ExportApprove.jpg.mp3
Size 416KB
SHA256 58760b46434c7ac253bb1a55b2e8c03b6798bade130513d30bc6ee2884ca1c76
MD5 920116dc76b2173047861c0bee576cae
SHA1 3de8da63a135de2ae5b8123bb665c0d7c8f079d6
SHA512 a86b03ba04ee3bcc728cd64e3ab4d6fa6c5958940c2926b745177abed07e0901dc1875b21589d836f87f55b8fdc68a0ee47452f2708e7f64a6fa201f0824b597
SSDEEP 12288:XUHbRG1wlIIj+1eINTdcFYID3ky1+M78o+YJ5:k74641eYTSfD3r4M7EYJ5
TLSH
T174942387CC2A7363F0C7019F81DA4ED46ACD41A6D384698BA7039C95A73266F21F7C86
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ResolveUndo.zip.mp3

Path C:\Users\Admin\Desktop\ResolveUndo.zip.mp3
Size 455KB
SHA256 0be06c4e438ae6880a62bcd68aa848eec44c8472937265cfc3174b8205ecfc09
MD5 324d07554439f4e21e3924cdf203fbc2
SHA1 88cf57092bfe7f8d229b81414780e177f7587634
SHA512 22e36c7907e2a8987f98a2a243bb46297f353682150db31929fcce3174191504f6fa133c5fd02f7ec9766f4e18af1e5b7cfe08fb8094e9e7b00b77dc35c52894
SSDEEP 12288:23y853AngAZhzgyVvdAZH8+VcMl+UYh6g:2Xmf1gyxqVVV+Mg
TLSH
T164A423CD7EC991B3DCE51A18B168AE454251FA9271652F8F2F80C6B34FCB2273412B38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevokeMove.txt.mp3

Path C:\Users\Admin\Desktop\RevokeMove.txt.mp3
Size 474KB
SHA256 b8160ac15043f82e4e2bf85b9cc9b66fda76bf6ee59f2591f4a3acebf540457b
MD5 3691ad28f07c6cffb0093bed4ba2d5f9
SHA1 96e56dbb77a3b7396db3626f557b26af12d2985d
SHA512 9dc7e98f39db3bf79d4b55b78b70d9591116dec991d767ed6a16bbc038c2c62547591da03c8d60d5538030d4edd2405e943d0f402f367e2bc6e436d06127410b
SSDEEP 12288:3NOkpXXUtH1EpziPu7zlkwabRxVWEZNb08voTeSZnXHHPbsrS:FpnUtVOzDlkw0V9/0OoVXHvYO
TLSH
T198A4238A8DEA9B36C54FEF7045329F53437B8E192662747009A23C875C0D2FBB6D425E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SaveOut.odt.mp3

Path C:\Users\Admin\Desktop\SaveOut.odt.mp3
Size 397KB
SHA256 59543100be1d9c3b9b0b52c1577dde400d3389c7983ad684a2c9648218ab9a76
MD5 88e0b121e295b6029beac06316a45a56
SHA1 dc57ccdfa360ec1bcb3c96098f1e1fd56e4a451c
SHA512 a5857a7563bb10023db46a6069247b54e9c9fe5f3ac8949c88b3a7e43f6fa8427aef7428d4274b786f9aac6c906661caa4277367fee8f6f2ae5491cd6151f045
SSDEEP 6144:xvOLd6VEelxUnYGEkP93HhMzKiyDJM/8luxl+HnM8xvUKO0QHn6oCciuXUzeDweq:BV1lxBkNH2KfFlI+Hn1xvUKfkrm
TLSH
T1AA8423B66E015BEFD8B181020B5D80D4DD04C9BE7AA523EE9C7FD95180FE0C62AF1896
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SelectConvertFrom.xlsx.mp3

Path C:\Users\Admin\Desktop\SelectConvertFrom.xlsx.mp3
Size 11KB
SHA256 fbe3703d9e037dcf4f96821df09f7d54ff7ab83996d599940b707fc4e73a9d6c
MD5 e041a77485516ce50d4fb93e0c1622f3
SHA1 13a75342a22a4da35ec7a82dcb6d16e2a7a08bb0
SHA512 0dd22a150713d2da2c909298e6979cf22e549c3f81daad0615db1c7c69b7a1491a04705fe2a1aae98518c2ac2e4fdde0a77a83a63eae8505dc20d12e3e7bd1f1
SSDEEP 192:kR1p8Vs9m4tt8xzfPyCZ4Rd1FtY5KKn/Bv4AJd0lTaJ/BVZnz3WQfLQzz6fmSrqF:tQttUzPlSRd1FKFn94AAF0dLzT06wIE1
TLSH
T1A732C0DDA4E6B04AE501547545E323FEBBC4B4C4FA695A4EE908CE06217FD814E7C35C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SuspendUnpublish.dwg.mp3

Path C:\Users\Admin\Desktop\SuspendUnpublish.dwg.mp3
Size 300KB
SHA256 ff6dea20e6004f3c82654b4532dc79f7dd50b8b5bb17712223fb4a79c5e31192
MD5 51bc08c5f1034a847b9436c335ead2ab
SHA1 36b4c481e98884f99686a94418480c22f949fee3
SHA512 4dd29ac2c2b49da62428e174fceb1a1cf951788ba0d453f6e84eacb3a57bef314f25f41b2ef1565283d5a4bfaeb9e1207dead3e6e94f605e9fe3494311844023
SSDEEP 6144:+MRTT6RZJlnruiclHW7TylVDetzFWJQVnjDomSGrXa6IfAv1:HtgZJlr8PDetzFrl/1rNSAN
TLSH
T10E6423AB62D6D997FB0C4C418582FD49F9B84CAA18BB739E89CC9746079C057C3CFA44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SyncRestart.m3u.mp3

Path C:\Users\Admin\Desktop\SyncRestart.m3u.mp3
Size 571KB
SHA256 81df04d2dd57644730cf2ac48520c9f54c74793cb8fca5771590c048a14cf53b
MD5 0a727b231afde1c9f6857d8ae738b77f
SHA1 cd80a89b2b5b433cdd2e3a724cbbeddcde1cf5bd
SHA512 1d60e3029f07c908889b39a211bd3364713dd4eb5c820b12a1e9e3f45293f74b63dd56045068cdb7b5492d6ed788e06fabf6979e770e00bb882085c2688c3103
SSDEEP 12288:8Md4jSmRKMI/miCAXlY2yORmSnALVB1lBDmqPS3vKPhl3OXn1:8bSuKDPXV9Wz3mqP0iPrgn1
TLSH
T187C4234E0CF0BCE38F5A206545B6A20253588657D0BA7C17B4786E7B11E0BDFA42EDF9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UpdateSend.wma.mp3

Path C:\Users\Admin\Desktop\UpdateSend.wma.mp3
Size 339KB
SHA256 9e810b8e1d403981940389b31538d3a01d2b304abd1a6b614d7d61339e97209e
MD5 0a76e856661a0f0caa4a5befe182899e
SHA1 b32f52d3a016f982059c602c83639bf340adbc9b
SHA512 47d79a81922b2f227613e1a356ea4100b20e3b9ce38a390821e653b4f356f377044e3d38f5913a6d886047980278e46f719717b0f4d940f92326ac305657f8c2
SSDEEP 6144:Yaf2k1wgsCqcmktoYVJwWV0c/Job8uXYdRwABLR6RrtD+tJ4Rm3E9/4:YBg1FHtoC/JoZodeW9YtqT4Rm3Y4
TLSH
T1D5742355D918CD632D8B3CAD50B325C0FEFA8AD51A4F15B4284CDF63399406EAB4E3E2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CloseExport.docx

Path C:\Users\Admin\Downloads\CloseExport.docx
Size 831KB
SHA256 bf91b3d180c5ccbe50a6d6509ef308f00cc69fd326f599b3ed1a624678038b51
MD5 6bb130dc99f0de711102b2f190bd6bf9
SHA1 92e77e85d7d92bbddd0c57d83b0bbe69f0dc4975
SHA512 fb9593ce6e322c0a35deeb1f4793484ec837a93082a4f907fa93d0d89bc0ad229593a29bb5160729f41f3bead95f720a398aa8c217a45ca7544270395010c1c1
SSDEEP 24576:cgioanDH82ggb4qVkarG/+yVy3fXOe39MjZiMapHhYVKz:cgioanDXpLVkCGkfXKZi5pHiVU
TLSH
T1AD0533A557BE824AC283D0F882A853C52E46127A037298F1D7A4B877C59D1DC984B7BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DismountSend.wmv

Path C:\Users\Admin\Downloads\DismountSend.wmv
Size 652KB
SHA256 ae76c1e4fb5a35c916327e30877fc59477fc7d1ad61bd086ac91987fa7bee14d
MD5 8b9f2f35b853a1c3974f745bd01809dd
SHA1 edc33a5b429ea3e25aa9de09f1e630574d27f433
SHA512 6297f5fa57a88c71fa87d2a75b274de15f40ffa0c54351b259a369706679b08fcb8ae802bc97b8c378568fd69f599b297ea6ebeab6046707ffd55a6d05b39d7e
SSDEEP 12288:bFso/7NrXyeoMZq2Ri4L6B5g6VZcTrFymJKU3hzN/Ue8e3fgTDs/iYYqiSIZx1:5HjNbUgqwi7aKMrEmFJvgTMYqiSM
TLSH
T158E42351F103ADBFEF5365389F86331A8A98DC48265D1630F39B2D55910983A38DFE98
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EnableComplete.dwg

Path C:\Users\Admin\Downloads\EnableComplete.dwg
Size 759KB
SHA256 77881b2b31dd09f13ee08f6da4fe1336230fff2225304763e061b27c2d3ac567
MD5 860f41179808532091f810ef2c538cea
SHA1 8bf818bed1ee7a026881d1f779a9b8d327426f26
SHA512 bf1c92edffde388426ca4f892e2f63b823eaa8c1a6da11ed7c2686684e8d47e5c2ac996141d366b70e7e048f9018d6114607d3bcebcf4f035550895941e8ec57
SSDEEP 12288:1CBUadie21PGQh/9BMURHGQw3QaLIF49KBXZhdjhlYGC4j4xATOGbAPEqTORz364:1CuaAeqPGY/9dRrDbF49qnjewIGbVqSv
TLSH
T11BF433682874B923758802F7E7DA728E45BDD24047603F3656F72FC76AC29B001B1ADB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kngduuaukdjk.exe

Path C:\Windows\kngduuaukdjk.exe
Size 340KB
SHA256 67a75f15e3bce2b69039dbf0ec5f657669178f215502bc47023569bce0c94707
MD5 2c354f8807e88fb28ba6f7cd47245890
SHA1 aed49dea36b4f73122de05ee2a72af85d248ba05
SHA512 95a30c8fdab762c24754e9f4296d0e49c5de7eb7a252696070fd856c1e330196e8e1da413601f8d9604af1c083f18246886d9eea86a95eeee573738feb0f28ce
SSDEEP 6144:iwIqK6dwODAr/lFEhiskfGyF6q41hFy7kSdGkLU70L/Rg1NukGq3:rFdbUFEhiNO8Q1hFxS0ks6/e1A9+
TLSH
T1AA74D053CDF7C3E8E9133DF77C7AB5662063F21C811C397A4A35906798A10ACA916BD2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4668-4650-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/4668-3305-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/4668-8948-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/4668-9934-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/4668-7430-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/4668-5929-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/4668-9980-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/4668-9894-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/4668-1183-0x00000000022D0000-0x0000000002356000-memory.dmp

Download

memory/4668-1182-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/4668-6-0x00000000022D0000-0x0000000002356000-memory.dmp

Download

memory/4996-10-0x00000000022E0000-0x0000000002366000-memory.dmp

Download

memory/4996-9-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/4996-0-0x00000000022E0000-0x0000000002366000-memory.dmp

Download

memory/4996-1-0x0000000000400000-0x0000000000497000-memory.dmp

Download