xworm | b7c630399cbaa2883c5165412739c4a610767e14efce092af144c3cc5d7aec0e

Analysis

user interaction
yes
max time kernel
149s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
15/10/2026, 19:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
niga.exe
Size 81KB
Sample261015-x77clsct9k
SHA256 b7c630399cbaa2883c5165412739c4a610767e14efce092af144c3cc5d7aec0e
MD5 0b0d77d21f9d672a2deffe422a97692f
SHA1 5f18fedd54bbeca8dd8c07a2866831ff3d5c3acf
SHA512 0715a41a9d43b71d73cc045c71b29fc1aa90adca2b269a037adc0a63eef66827ac85f944efbb71c3b9debadf9332426bdb89149d803ef7497e3c90f2add9c327
SSDEEP 1536:egh0avkuaTsjlWX8q8n6IF5ziZM7MWDc0hbv1wI:epgaYjlW6nXvIM7MD0hbv5
TLSH
T1C8834C0FF7508949C26D0DB3D973550642F8D89B7537FBBB24C86EE66D228C8CA4B409
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery xworm ransomware rat trojan

Malware Config

Signatures

Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral1/memory/4012-0-0x00000000008B0000-0x00000000008CA000-memory.dmp	family_xworm

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\XBackground.bmp"	niga.exe

Enumerates video capture drivers 2 TTPs 1 IoCs

Queries the legacy Video for Windows capture drivers. This is commonly abused by RATs to check for available webcams on the system before reporting to their C2.

discovery defense_evasion

Peripheral Device Discovery

T1120

Video Capture

T1125

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32\msvideo9	niga.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	niga.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	niga.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2440	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-895009113-1202185046-1686627690-1000\{7C7A1407-C683-4650-B49D-4638D580FF46}	msedge.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
4012	niga.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4012	niga.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 4012 wrote to memory of 4024	4012	niga.exe	106
PID 4024 wrote to memory of 1608	4024	csc.exe	108
PID 4012 wrote to memory of 4184	4012	niga.exe	109
PID 4184 wrote to memory of 3968	4184	msedge.exe	110
PID 4184 wrote to memory of 1700	4184	msedge.exe	112
PID 4184 wrote to memory of 2440	4184	msedge.exe	113
PID 4184 wrote to memory of 1700	4184	msedge.exe	112
PID 4184 wrote to memory of 1700	4184	msedge.exe	112
PID 4184 wrote to memory of 212	4184	msedge.exe	114
PID 4184 wrote to memory of 212	4184	msedge.exe	114
PID 4184 wrote to memory of 4448	4184	msedge.exe	115
PID 4184 wrote to memory of 1144	4184	msedge.exe	116
PID 4184 wrote to memory of 4448	4184	msedge.exe	115
PID 4184 wrote to memory of 4448	4184	msedge.exe	115
PID 4184 wrote to memory of 1144	4184	msedge.exe	116
PID 4184 wrote to memory of 1144	4184	msedge.exe	116
PID 4184 wrote to memory of 2724	4184	msedge.exe	118
PID 4184 wrote to memory of 2724	4184	msedge.exe	118
PID 4184 wrote to memory of 2724	4184	msedge.exe	118
PID 4184 wrote to memory of 2564	4184	msedge.exe	119
PID 4184 wrote to memory of 2564	4184	msedge.exe	119
PID 4184 wrote to memory of 2564	4184	msedge.exe	119
PID 4184 wrote to memory of 5096	4184	msedge.exe	122
PID 4184 wrote to memory of 5096	4184	msedge.exe	122
PID 4184 wrote to memory of 2432	4184	msedge.exe	123
PID 4184 wrote to memory of 2432	4184	msedge.exe	123
PID 4184 wrote to memory of 4320	4184	msedge.exe	124
PID 4184 wrote to memory of 1872	4184	msedge.exe	125
PID 4184 wrote to memory of 4320	4184	msedge.exe	124
PID 4184 wrote to memory of 1872	4184	msedge.exe	125
PID 4184 wrote to memory of 3548	4184	msedge.exe	127
PID 4184 wrote to memory of 3060	4184	msedge.exe	128
PID 4184 wrote to memory of 3060	4184	msedge.exe	128
PID 4184 wrote to memory of 1520	4184	msedge.exe	129
PID 4184 wrote to memory of 1520	4184	msedge.exe	129
PID 4184 wrote to memory of 1888	4184	msedge.exe	130
PID 4184 wrote to memory of 1888	4184	msedge.exe	130
PID 4184 wrote to memory of 2972	4184	msedge.exe	131
PID 4184 wrote to memory of 2972	4184	msedge.exe	131
PID 4184 wrote to memory of 2824	4184	msedge.exe	132
PID 4184 wrote to memory of 2824	4184	msedge.exe	132
PID 4184 wrote to memory of 2716	4184	msedge.exe	134
PID 4184 wrote to memory of 2116	4184	msedge.exe	135
PID 4184 wrote to memory of 392	4184	msedge.exe	136

C:\Users\Admin\AppData\Local\Temp\niga.exe
"C:\Users\Admin\AppData\Local\Temp\niga.exe"
1⤵
- Sets desktop wallpaper using registry
- Enumerates video capture drivers
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4012
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /target:exe /out:"C:\Users\Admin\AppData\Local\Temp\niga.exe" "C:\Users\Admin\AppData\Local\Temp\guardian_src_91f0b462273d45b09ccb0359aee97478.cs"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4024
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESDBC0.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCDCFFE580432A44488075822940435FE2.TMP"
    3⤵
    PID:1608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\How To Decrypt My Files.html
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4184
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x2ec,0x7ff9e06fc188,0x7ff9e06fc194,0x7ff9e06fc1a0
    3⤵
    PID:3968
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1788,i,2897689345037493998,7294044844876142936,262144 --field-trial-handle=2304,i,16473387494441160771,2499659759360677605,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:2
    3⤵
    PID:1700
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1940,i,18444148795716382101,13900661738606937061,524288 --field-trial-handle=2304,i,16473387494441160771,2499659759360677605,262144 --variations-seed-version --mojo-platform-channel-handle=2340 /prefetch:3
    3⤵
    - System Time Discovery
    PID:2440
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2576,i,6933537642997956692,3938136399025845808,524288 --field-trial-handle=2304,i,16473387494441160771,2499659759360677605,262144 --variations-seed-version --mojo-platform-channel-handle=2728 /prefetch:8
    3⤵
    PID:212
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3472,i,12990457322753498363,3127768504341298180,2097152 --field-trial-handle=2304,i,16473387494441160771,2499659759360677605,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:1
    3⤵
    PID:4448
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3476,i,16431018437960020931,9502635064391372342,2097152 --field-trial-handle=2304,i,16473387494441160771,2499659759360677605,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:1
    3⤵
    PID:1144
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4108,i,16978153551294412929,13498414085415759679,2097152 --field-trial-handle=2304,i,16473387494441160771,2499659759360677605,262144 --variations-seed-version --mojo-platform-channel-handle=4144 /prefetch:1
    3⤵
    PID:2724
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4132,i,6956253185054569157,7856387597864819989,2097152 --field-trial-handle=2304,i,16473387494441160771,2499659759360677605,262144 --variations-seed-version --mojo-platform-channel-handle=4176 /prefetch:2
    3⤵
    PID:2564
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3692,i,931849478275076253,18055464343483721735,524288 --field-trial-handle=2304,i,16473387494441160771,2499659759360677605,262144 --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:8
    3⤵
    PID:5096
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3656,i,9520921266603205593,5910719466185085268,524288 --field-trial-handle=2304,i,16473387494441160771,2499659759360677605,262144 --variations-seed-version --mojo-platform-channel-handle=3684 /prefetch:8
    3⤵
    PID:2432
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5248,i,7504781646738514486,16013827489336511592,524288 --field-trial-handle=2304,i,16473387494441160771,2499659759360677605,262144 --variations-seed-version --mojo-platform-channel-handle=5268 /prefetch:8
    3⤵
    PID:4320
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5252,i,13850347871180854711,6677054392070431501,524288 --field-trial-handle=2304,i,16473387494441160771,2499659759360677605,262144 --variations-seed-version --mojo-platform-channel-handle=5288 /prefetch:8
    3⤵
    PID:1872
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5812,i,1364810036782259593,10717182230161977827,524288 --field-trial-handle=2304,i,16473387494441160771,2499659759360677605,262144 --variations-seed-version --mojo-platform-channel-handle=5868 /prefetch:8
    3⤵
    PID:5100
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5812,i,1364810036782259593,10717182230161977827,524288 --field-trial-handle=2304,i,16473387494441160771,2499659759360677605,262144 --variations-seed-version --mojo-platform-channel-handle=5868 /prefetch:8
    3⤵
    PID:3548
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6012,i,9567604364066588237,1053226674505161407,524288 --field-trial-handle=2304,i,16473387494441160771,2499659759360677605,262144 --variations-seed-version --mojo-platform-channel-handle=6008 /prefetch:8
    3⤵
    PID:3060
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6164,i,7314817343833998254,14494393941476684672,524288 --field-trial-handle=2304,i,16473387494441160771,2499659759360677605,262144 --variations-seed-version --mojo-platform-channel-handle=6020 /prefetch:8
    3⤵
    PID:1520
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6108,i,3913673764549773310,9946154561859787682,524288 --field-trial-handle=2304,i,16473387494441160771,2499659759360677605,262144 --variations-seed-version --mojo-platform-channel-handle=6112 /prefetch:8
    3⤵
    PID:1888
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6276,i,10374225791059104928,5127951051091062738,524288 --field-trial-handle=2304,i,16473387494441160771,2499659759360677605,262144 --variations-seed-version --mojo-platform-channel-handle=6260 /prefetch:8
    3⤵
    PID:2972
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6084,i,4195196861086852008,16514506970287955670,524288 --field-trial-handle=2304,i,16473387494441160771,2499659759360677605,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:8
    3⤵
    PID:2824
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5960,i,5330090092014823358,8694865492423008114,524288 --field-trial-handle=2304,i,16473387494441160771,2499659759360677605,262144 --variations-seed-version --mojo-platform-channel-handle=5880 /prefetch:8
    3⤵
    PID:2716
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5872,i,9421344327148785049,15634377307594325446,524288 --field-trial-handle=2304,i,16473387494441160771,2499659759360677605,262144 --variations-seed-version --mojo-platform-channel-handle=4724 /prefetch:8
    3⤵
    PID:2116
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5840,i,8350562209603414232,8348642047003960098,524288 --field-trial-handle=2304,i,16473387494441160771,2499659759360677605,262144 --variations-seed-version --mojo-platform-channel-handle=4720 /prefetch:8
    3⤵
    PID:392

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3660

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Video Capture

T1125

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

14cd82d6-c659-438c-9f4d-dfd16304b691.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\14cd82d6-c659-438c-9f4d-dfd16304b691.tmp
Size 18KB
SHA256 90945575dee43a1924b826b4689e2152ae4e29bd803986da1fda4360cfc6fb13
MD5 9cfcebda0160ff9dd0bc284e4181057c
SHA1 81b94b5c9ab6cb95c5291d7de6d784b2e9684340
SHA512 da1c603f89e2eaaa030c4c6807b814ddbd047d75bdee54b7d14ff4b7ac322f4308fd841995cbaa7c2bdf0d6632bc8c5d149e97ed87a73b54d669e6b2643868d5
SSDEEP 384:nWQkUSvSsN9WhbDOILh//Yhw0MT7JIIlI:2SX9/QO0MT7JLS
TLSH
T1DB827C383879EC375AE7A101F15A36939FB4A0B7EAD10F58D6D9AB2C01C62C82707D17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4b4942c0-b066-4b8f-bcec-90df0d4f0105.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\4b4942c0-b066-4b8f-bcec-90df0d4f0105.tmp
Size 8KB
SHA256 53d5932f429fa105bcade22c77e0bfcbc83cb586141b0696451dd169074b9a51
MD5 616f349077a80522889748f0b5778104
SHA1 395702913f9e7921ae112a19d24276aa34fe72d4
SHA512 202203128204661e06411aff6235f71e9b077b25f7ac1653bd2b59e775210f32921a351043ecbf55f507acc78e0fdc7aaa18c4dc274724b36ecd388500247f2e
SSDEEP 96:KqONkrQsjpfbUmjH5ih/cIPURHl8h4otop5oaD+BKP4v+Y1xf//ojdoxTeYzqsoz:BON/6JUm0QmiUyh+so//YpBCm1EYU6
TLSH
T19802D939BC74BCBB9EE3AE45F48777239FA4106B96915F44DAD82A2C01D725C1307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

713abc00-b9ec-41d5-8182-80e71326742f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\713abc00-b9ec-41d5-8182-80e71326742f.tmp
Size 18KB
SHA256 c23e8603873d39c925e9a25964a34a4cbb1700a6c3ff1c422b25f940e320f9eb
MD5 479023fec7c6294b0444344fc36ef32f
SHA1 ce1a7a1a30b57bdc89d3e08f9297b31fc7cbe328
SHA512 9620adaccb8d9891ad8f631aacbf8e8a333f192b3cd1e0a13e1d9de05ba96f40a0c43d39a1bc188785e02bf438067c834f05a50fe376a61ef5b64a48f4abed9a
SSDEEP 384:nUQkUSv0sN9qhbDOILh//Yh70MT7JIIlI:E0X9/Q10MT7JLS
TLSH
T17B827C383879EC375AE7A111F14A36939FB4A0B7EAD10F58D6D9AB2C05C62C82707D17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 93c2ca3ce74eca17f27aa90cc3323bb8d6aea5c365862a01a512ce14b9f825b4
MD5 e8a3239e6b22580d77fb537c7bea1fab
SHA1 a99ffe9234c27e560f1c607d3b6c6507928368a3
SHA512 17b0e6f99943a02540148a685b91c62eafca3ef65d9a628bfb59d3b69a93b27c7d3ac42bdc808c52b5b1eac9bf4466a1099df17cd3f5df0bbd5b5282ca8b904e
TLSH
T170D0247133D03CCFD7000433015043751C0540F300F5D3104C30D04C07CD055C143440
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 928eda824fe964cd23927cf06086d7d24e20a3a5092daf1acee5b632c76c962a
MD5 4ac43ee6512ba8635b7ba6bd015c291b
SHA1 5f9e2474b00ec0e2a9472c049fbea550e26309aa
SHA512 e5ebf9e92458f66e31e080121135313e828b8ebade0bc0e085221ae0d4f5afe0d2035c566590cbfb5902d96f17befe7b24310b4fb9e647b999113175af800ebc
TLSH
T17BD022B2B3A038CFE300083302A083BA2C0A80F300FAE2208C30E08C0BCC02AC283880
MD5 SHA1 SHA512 TLSH

Submit Download

523ec012-ac0a-46df-b309-1906f621291b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\523ec012-ac0a-46df-b309-1906f621291b.tmp
Size 10KB
SHA256 bf0a4f52e06aff9af59efa3b3fd68e68bbfc6927248695a9ac0a9e6d2cd31a44
MD5 903e08843349591ae710f61123de67d6
SHA1 72164fe9d2152d25c8d6df0d0e97eb821780cd47
SHA512 19667db65a37dd261bb4de74be54bde077f600ab4dd0074cd152577759a76e7ec96b714f62b6016e98bb8cc22ec53e573db661543dcc84517ac2fc63acbc0c85
SSDEEP 192:sxZG3RxV+f/fYs8fDdgIdpd5HW6+WNGY36wrWmjIg5uJ:sxZG3F+f/fYs8rdhnHbGXeg
TLSH
T1EB32B851BE38A97B8CC6E219BA557F03E6F95032A1D11E58AAFCCA2C01E76CD130741F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

61052ef3-04a8-4949-8c06-38f25e14dc89.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\61052ef3-04a8-4949-8c06-38f25e14dc89.tmp
Size 10KB
SHA256 ac79ec5aacd3e36f8dea9ffdc6546343274701ea90cbd1971e6d124768388896
MD5 b8e047bb91c5ddc346874a2235217410
SHA1 01c20451e84f561fb3f660b2360cfcae04090360
SHA512 7a9f36a08bf0bd6b681f57c862e9b878bae4e98e6446d3a31d5e0ba52e110bc9e462d826e9ea9f4937b2a4693b6e0f3f6fa0a45f6bd60b47bf435f2a752a8546
SSDEEP 192:sxZG3Rxs+f/fYs4fDdgIdpd5HW6+WNGY36WBmjIg4J:sxZG38+f/fYs4rdhnHbGXjc
TLSH
T16E22B7516E38A97B8CC7E219BB657F03D6F95032A1D01E58AAFC8A2C05E76DD130741F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6da227b6-1980-4090-b064-b4d978e95506.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6da227b6-1980-4090-b064-b4d978e95506.tmp
Size 32KB
SHA256 d86f9d369add2677eae52e044e7b410987437c88d6f9f15e4f905b94f53a4fd7
MD5 056fe68b6e87f1ce39a1878c60ac90f9
SHA1 53aa70e2e37b0b88bf49897824bb93c4335cb2ca
SHA512 2a427ac337c3b54f9c71253ddabb6b495908f71f4a2e25abc274fcf2560241715ff955f480ebfedb1f69b04b0829831a07995873b9b5a5af0af4dbb3919981e4
SSDEEP 768:33Klme67pLuLjYQWvUYe08F1+UoAYDCx9Tuqh0VfUC9xbog/OV9n8/LlpPs/8roX:33KlmeSEjYQWvUYe0u1jasn8/L/E/nmy
TLSH
T1A9E2EB3B780CCB7E4FC04ADDDC5A7E9E6EA8028B9698CD4047FA945C02C66EE51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6f53ffb2-cb8b-479a-b86d-0444156009a7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6f53ffb2-cb8b-479a-b86d-0444156009a7.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

74aa0b98-9c56-4088-892c-63d771e4fbf4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\74aa0b98-9c56-4088-892c-63d771e4fbf4.tmp
Size 10KB
SHA256 b9bb0af9052c7f2c42be674e84117f110cb46d01e9ecb4562c3015585f778267
MD5 fd22e6a29eba2f895c8930147f7b90b8
SHA1 ae273b4f84529776671b5c20be5060883a28b588
SHA512 b7869c87da5557a3872c6d9a4c3cede750dd635acc2b78fe88930295556848d0366b346207a8c98a3adc2f15132440c75cbd1f344848f6903bef4f14985daf6a
SSDEEP 192:sxZG3Rxs+f/fYsYfDdgIdpd5HW6+WNGY36WBmjIg54J:sxZG38+f/fYsYrdhnHbGXjW
TLSH
T10222A751AE38A97B8CC7E219BB55BF03D6F95032A1D01E58AAFC8A2C05E76DD130741F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 fccfc881582813167518d75f8830f6848898c92f9bab4cb25dcc37940c24e359
MD5 1112bccd282069f0c1c433dd87cb8970
SHA1 0529c809c59c74b7603a2f6da08470f6db519063
SHA512 5d8f7500f9adc313cb31d466bcb435cfbe79847a94d127741118d6e0ad97e1f995176bf9a916b8264568a612219ef376d44b4d443a53b6ffddac0aacbe876b94
TLSH
T1A86196808C80C1D9F3E563B3A1D72CABB5BA50C11DAB0EA1597EEDFD8846F165684E34
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 e4994636e542a8fdfd066f5d354ca6a1b5518850333610450ba1ce299053f14d
MD5 1d5fb204332e8136255867e662bc3232
SHA1 0dbe1077129f45997e40e868ca63e81d0735bc1b
SHA512 a6f74cf198454944390ca75363f020b06c9d0a959d4b95580eea2d487774898d6cb222af07cc4d2deba30e2eb090efc7de1abb35eca463238d6cc85cf52b702e
TLSH
T16D6196808C80C1D9F3E16373A1D72CABB5BA50C11DAB0EA1597EEDFD8846F165AC4E34
MD5 SHA1 SHA512 TLSH

Submit Download

98d60739-f632-4b4b-bbdf-b2e8e8a3d9c7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\98d60739-f632-4b4b-bbdf-b2e8e8a3d9c7.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.111.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

62c475ac-1efa-4624-9b4a-e29f01a2a126.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\62c475ac-1efa-4624-9b4a-e29f01a2a126.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

ed8e90ae-4298-43ba-8cca-b27f6e843ff5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\ed8e90ae-4298-43ba-8cca-b27f6e843ff5.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

a3b32933-1194-4291-9a71-f52b980f1a07.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\a3b32933-1194-4291-9a71-f52b980f1a07.tmp
Size 8KB
SHA256 5b3f6dc91b57e6fc54a1ccabcd0b2a83b848846a5f2e1942e89b810d26a4198c
MD5 eef62031d413c3550fa4e6b517632a90
SHA1 8f63cea477071ac2ab77df591e0acda3e2da4e89
SHA512 dd815221a5499fb53f54a07116b82312b19464bbbd739028891dc5123df2cb7c0e843ae8406462b23ae5903d6d5fa223541ccbbecba55d1fd24773f9c3db134e
SSDEEP 96:0qONkIQsjpfbUVH5ih/cIPURHl8h4otop5olD+BxP4v+Y1xf//ojdoxTeYzqsoVl:/ONQ6JU+QmiUyw+Jo//YhmNxIqfSU6
TLSH
T1861217347879FC775DD7A544F08736639EA420BBEA819F45E6D86B2C05C729C2B0B823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dcb6647b-9b09-4558-99ed-c46e3ae2ec41.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\dcb6647b-9b09-4558-99ed-c46e3ae2ec41.tmp
Size 18KB
SHA256 a515f318159842e0837adc2e32c2127c859c7c381b593a708952f5db61c670a7
MD5 6f486c89838032f6d389e517d4388f3e
SHA1 426eff5f64b6f3b64f8704ec221cbf056c4886e8
SHA512 fbad829defe68d64ccf16e7df11d3bcdb955744fc3c5f75ca5e3025498afad44a7b3c6533aa2213c5b93b92d06c08f63aac9ea37437a7a02e7164b5de2363844
SSDEEP 384:n+QkUSvSsN9bhbDjILh//YhcG0MT7JIIlI:uSj9/QaG0MT7JLS
TLSH
T1F6827D383879EC375AE7A105F15A36539FB4A0B7EAD40F54D6D9AB2C01C62C82B07D17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f39fbf21-4558-49ba-896e-535f68227d44.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\f39fbf21-4558-49ba-896e-535f68227d44.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 76f1cf859fa8f27e0c1f60d79ee0790b044a0646a5b9cf1b4faf5e041527666b
MD5 20ad6907b839a8c6bfbc42b8892ffbcb
SHA1 63f72b7ad946833f4de74cab68ca888f5925770d
SHA512 2cdb4cc904ed8c48d1d0c50d1e14475e1891e5f6a017ea738d3f6393d168c099ffd57bcd42e0c817507251562242896628ded1af895776bd5aca3113cc777e42
TLSH
T12241185CA6EA1148F3B76E16ABF7692E447F79372F06C45E50110E4F0622A40D9B1B37
MD5 SHA1 SHA512 TLSH

Submit Download

59957c97-4eef-4c14-9211-fcfda775558d.tmp

Path C:\Users\Admin\AppData\Local\Temp\59957c97-4eef-4c14-9211-fcfda775558d.tmp
Size 158KB
SHA256 3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
MD5 9c18c4721b560ec55f0d5de055144d5c
SHA1 6af37a3bda916cac276ad5879c9f61262d9ae523
SHA512 51466928eb8d3cf7b917919c98bd8168453583d2c3dc5836036d87ffd0d2c732ab8450212a880fc6de199ea569a96993ba0d250a5012160d2d72211880695f92
SSDEEP 3072:5ZwEurOxn8zXnHc2qHNYEU/rUHCVJWGdi0Ha5HnXk9TFzBsuht7yGik:5ZwPOx8D85UIHEI0HaZ09JzKStjik
TLSH
T1CFF3E13E7EDE891AD80B10BB7F16B18BD80D8E0B460AB44B769D80155B3668D1BD1CFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RESDBC0.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESDBC0.tmp
Size 1KB
SHA256 9a94a713fa3df97963346fd83a114dd4e4ec4111760e8649c4be9974eed1713e
MD5 92f0c423cc45ffc38b5bd8f4837aae5c
SHA1 59eb702dbc2b966f161b862c3a5fc350c1e34850
SHA512 c443d9aa31a6d407ee7f88b383d3c4149703488d6b5e6c8207763976cfbc2f17984b12c148ffe2890bc326e52f1511d8371aaca429754b6ab6a410ff8936445d
TLSH
T1E441204083D84B1FF172473229F79719A778FE55AEAE479EB588522E1E02340DEC36B1
MD5 SHA1 SHA512 TLSH

Submit Download

dfe266fb-1355-48e3-a23c-cc68ec538901.tmp

Path C:\Users\Admin\AppData\Local\Temp\dfe266fb-1355-48e3-a23c-cc68ec538901.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4184_675569781\CRX_INSTALL\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bf1716be-fbe6-4537-aed8-f96c06ec4c0a.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4184_675569781\bf1716be-fbe6-4537-aed8-f96c06ec4c0a.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4184_882398046\CRX_INSTALL\_locales\en_CA\messages.json
Size 711B
SHA256 2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b
MD5 558659936250e03cc14b60ebf648aa09
SHA1 32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825
SHA512 1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727
TLSH
T1460197136240AF18470BF05BB9023442A0B44AC62384E0B775EC982C6656DAFB20B3B0
MD5 SHA1 SHA512 TLSH

Submit Download

How To Decrypt My Files.html

Path C:\Users\Admin\Desktop\How To Decrypt My Files.html
Size 639B
SHA256 5ca82cbc4d582a4a425ae328ad12fd198095e2854f4f87b27a4b09e91173a3be
MD5 d2dbbc3383add4cbd9ba8e1e35872552
SHA1 020abbc821b2fe22c4b2a89d413d382e48770b6f
SHA512 bb5e1bbf28c10c077644136b98d8d02bfec3b3e49c0829b4d4570b30e0aea0276eb748f749a491587a5e70141a7653be1d03c463a22e44efecde2e5a6c6e5e66
TLSH
T1CEF06DE6DB5149A4F533492AB5097719EF717653A0D43D0D360CD2971FF022A8D4BA8C
MD5 SHA1 SHA512 TLSH

Submit Download

ApproveInitialize.xlsm.ENC

Path C:\Users\Admin\Downloads\ApproveInitialize.xlsm.ENC
Size 435KB
SHA256 94aaadf2c399306fb434b8fa6ab7efebc7114a7732b53c83ae8b3eef7a8cef4c
MD5 c39eceafbf53bb29db13134199a91438
SHA1 be7fddb9f303187fae24244c1f43d4de3fc319df
SHA512 be03ef18bef10a88b04be2472dfeb95c3896ab5a45b613606fbe95879983024c73346be67bbf31adf91226ab6466fe78e380deecaeb503ffea0cf127064446a8
SSDEEP 12288:PNo/EGhFS+bPYVd33hbup0R6oth6XkXo5LcG3kxu4TkWPLxk/jG:PGNDbgVyp0R6othm94G72P9yC
TLSH
T1DD94234A23294D66B2DA9C233D33E2793749697C97E1FF2143372AF1041E66D298F069
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ClearComplete.wdp.ENC

Path C:\Users\Admin\Downloads\ClearComplete.wdp.ENC
Size 270KB
SHA256 55e79026686704bb9dc6fc8733642c02e7fbc47244e4003b2b7ee83f39117a8c
MD5 f79e12b3d4fa5f23eba18cb3c6b407fe
SHA1 b2a9164bd285751b012bf2c9edab7e0987160cf7
SHA512 f38662a14a527ab28bb173113768f8f3bcd711bd0c4e58a386ada80cf35fcc7b02bf73a508c0b1978b903857343657899aec4838f86fe056a4834623d3f6fa8d
SSDEEP 6144:dtx17IuRSO6z7Mkex/83ijV1WrVBo4Pzkn7UdRkLw:dtD79T6cx/8oV1qK4Pzkn7ARuw
TLSH
T12844238ABC2BC144840A976F0E57082A9F699F83DCD1732603FAF3965F4EA355C51F52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CompressTest.asf.ENC

Path C:\Users\Admin\Downloads\CompressTest.asf.ENC
Size 480KB
SHA256 072e8ca6eef3706f74c2add6e2f8693bfea3e2a17f5f3df5861a81f43402054c
MD5 95e31dc3a3ac3daeeee3b0ab269ef5d9
SHA1 f7fb4850800e29ada267c263b722b290a6ab9b71
SHA512 29f5d8a1c76fe1c71196e6b47553035dc6162eebb5646ba4861169418d496c14a0447dc93d897d2d0ac6462e6fcd43294d642938262fa26c9f1ba49c4125acc6
SSDEEP 12288:cnA2ULznPuS3wZ7B6PeJ9pM4eVOW+9mOXg4Xxl+D9yhv:EU/nPYZ7B2ezWx+9ZXRSD9yl
TLSH
T1EAA42380D08D83771AC2AE9FF98D390C4E933622692F536CDAD60B7E9A18146537DCD7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NTUSER.DAT{53b39e88-18c4-11ea-a811-000d3aa4692b}.TM.blf.ENC

Path C:\Users\Admin\NTUSER.DAT{53b39e88-18c4-11ea-a811-000d3aa4692b}.TM.blf.ENC
Size 16B
SHA256 c29bf4f8a75bdea3a0cf75e0e4e3ff001c54e152afc8b7e20f921082a2a98879
MD5 b57eb2b423380f8efb4be606779a4517
SHA1 1db0066c17091c0d81896b00a6caa9c4edc4fea2
SHA512 f67336d0e760f3cadc969e6e7494654658e75ce4934c33e89cbed6efab8cc215463129a90d8488d5e764f9ed87d36e5882df010775bce10a7075082ca46214b8
MD5 SHA1 SHA512

Submit Download

CSCDCFFE580432A44488075822940435FE2.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\CSCDCFFE580432A44488075822940435FE2.TMP
Size 1KB
SHA256 63f035da1cd19051fb74bc6a2cd8642d5466d064151d99f7667812602b09892d
MD5 8e51398b5690c411eb06f5b2c418035a
SHA1 031f61222483ee04486549aa9ebfd0beb992f891
SHA512 34c969996b6e94e4ee8dfed2e266ce8e03dd800f9ad44fce2b2a338e5ac4ae8aeac7844897e67f8293ca60d8b706d029f261718238509ad1a7b600e8064d225c
TLSH
T18A21AB81A3E8821EF2B3477079F2D362A2A8BE568D7E47EC3488175B1F2550085836F1
MD5 SHA1 SHA512 TLSH

Submit Download

guardian_src_91f0b462273d45b09ccb0359aee97478.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\guardian_src_91f0b462273d45b09ccb0359aee97478.cs
Size 4KB
SHA256 3ee1bf1ab210527e7543dc78ca3511904bf7770d571eb0d11746edd9f5bf814a
MD5 b7d40eb7e1328728d647678e1ea0a4dc
SHA1 43850a88c7f012df9e7349886497271c83e2bdaa
SHA512 a531df01588357b0d669d563fada88e78b0b3d1453e40605a872e9fba6091bb46a623b0817aafab946b01f92d5810ed7eb97ed9373eaeacb9970b316278667a4
SSDEEP 96:noO1V0E4Yt1YOC3idfygNzkfK1Sg5vpVIHZZ:jl481hC3i1ygNzw5g5vpVw3
TLSH
T19F911298954DA2D69872223AFB03D15BF603103322FF9A20FEADD3505F3D0018678F69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4012-0-0x00000000008B0000-0x00000000008CA000-memory.dmp

Download

memory/4012-4-0x0000000000E80000-0x0000000000E86000-memory.dmp

Download

memory/4012-3-0x000000001B470000-0x000000001B4A2000-memory.dmp

Download

memory/4012-2-0x000000001B4D0000-0x000000001B4E0000-memory.dmp

Download

memory/4012-1-0x000000001B4D0000-0x000000001B4E0000-memory.dmp

Download