17b84364c195a9c7cd90c9a935261ee1e43ce5347562bbd401511925b1210b33

Analysis

user interaction
yes
max time kernel
15s
max time network
56s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/10/2026, 19:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
xd.txt
Size 70B
Sample261018-yhfzssh14s
SHA256 17b84364c195a9c7cd90c9a935261ee1e43ce5347562bbd401511925b1210b33
MD5 6b2ef9b77a96fb47217dca57f6574c97
SHA1 94080520ad8af9174dd0d578d54bf9ddae942ad4
SHA512 9a26695b309ddbe2d6ed65daa46af3bd121814a40866f71773e348eded372d694a580f77764a270284f6167f746cd3f99aafc24a1caf73ff141ff3da791b51a3
TLSH
T1E3A002A22200007E9F255AA6CE95104F7F299624CE7495E891711214E1910A196DA696
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery execution persistence ransomware

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3360	cmd.exe
5708	cmd.exe
3620	cmd.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2480	msedge.exe
5400	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4154726816-2055034831-2297277433-1000\{BABE4574-017C-4487-9C7B-069F8B6ED810}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe

Opens file in notepad (likely ransom note) 2 IoCs

ransomware

pid	Process
4168	NOTEPAD.EXE
1360	NOTEPAD.EXE

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe

Suspicious use of FindShellTrayWindow 8 IoCs

pid	Process
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4168	NOTEPAD.EXE

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 4604 wrote to memory of 5532	4604	msedge.exe	90
PID 4604 wrote to memory of 2480	4604	msedge.exe	91
PID 4604 wrote to memory of 1684	4604	msedge.exe	92
PID 4604 wrote to memory of 1684	4604	msedge.exe	92
PID 4604 wrote to memory of 1684	4604	msedge.exe	92
PID 4604 wrote to memory of 1448	4604	msedge.exe	93
PID 4604 wrote to memory of 1448	4604	msedge.exe	93
PID 4604 wrote to memory of 5772	4604	msedge.exe	95
PID 4604 wrote to memory of 5772	4604	msedge.exe	95
PID 4604 wrote to memory of 5772	4604	msedge.exe	95
PID 4604 wrote to memory of 4280	4604	msedge.exe	96
PID 4604 wrote to memory of 4280	4604	msedge.exe	96
PID 4604 wrote to memory of 4280	4604	msedge.exe	96
PID 4604 wrote to memory of 3804	4604	msedge.exe	97
PID 4604 wrote to memory of 3804	4604	msedge.exe	97
PID 4604 wrote to memory of 3804	4604	msedge.exe	97
PID 4604 wrote to memory of 1396	4604	msedge.exe	98
PID 4604 wrote to memory of 1396	4604	msedge.exe	98
PID 4604 wrote to memory of 1396	4604	msedge.exe	98
PID 4604 wrote to memory of 4376	4604	msedge.exe	100
PID 4604 wrote to memory of 4376	4604	msedge.exe	100
PID 4604 wrote to memory of 3172	4604	msedge.exe	101
PID 4604 wrote to memory of 3172	4604	msedge.exe	101
PID 4604 wrote to memory of 3172	4604	msedge.exe	101
PID 4604 wrote to memory of 6108	4604	msedge.exe	102
PID 4604 wrote to memory of 4536	4604	msedge.exe	103
PID 4604 wrote to memory of 6108	4604	msedge.exe	102
PID 4604 wrote to memory of 4536	4604	msedge.exe	103
PID 4604 wrote to memory of 3224	4604	msedge.exe	105
PID 4604 wrote to memory of 2712	4604	msedge.exe	106
PID 4604 wrote to memory of 2712	4604	msedge.exe	106
PID 4604 wrote to memory of 6088	4604	msedge.exe	109
PID 4604 wrote to memory of 6088	4604	msedge.exe	109
PID 4604 wrote to memory of 1568	4604	msedge.exe	110
PID 4604 wrote to memory of 1568	4604	msedge.exe	110
PID 4604 wrote to memory of 1200	4604	msedge.exe	111
PID 4604 wrote to memory of 4968	4604	msedge.exe	112
PID 4604 wrote to memory of 1200	4604	msedge.exe	111
PID 4604 wrote to memory of 1200	4604	msedge.exe	111

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\NOTEPAD.EXE
C:\Windows\system32\NOTEPAD.EXE C:\Users\Admin\AppData\Local\Temp\xd.txt
1⤵
- Opens file in notepad (likely ransom note)
- Suspicious use of SetWindowsHookEx
PID:4168

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\GroupSubmit.htm
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f8,0x2fc,0x300,0x2f4,0x30c,0x7ffc6d7cc188,0x7ffc6d7cc194,0x7ffc6d7cc1a0
  2⤵
  PID:5532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2136,i,16008097782699072425,103008270432465538,524288 --field-trial-handle=2400,i,1463298431712203258,7056077236653204913,262144 --variations-seed-version --mojo-platform-channel-handle=2428 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1968,i,13056819037483408531,6682245514487505113,262144 --field-trial-handle=2400,i,1463298431712203258,7056077236653204913,262144 --variations-seed-version --mojo-platform-channel-handle=2396 /prefetch:2
  2⤵
  PID:1684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2680,i,9858899650635185541,14221277390296586472,524288 --field-trial-handle=2400,i,1463298431712203258,7056077236653204913,262144 --variations-seed-version --mojo-platform-channel-handle=2912 /prefetch:13
  2⤵
  PID:1448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3580,i,6069925493264511961,8303857383489528346,2097152 --field-trial-handle=2400,i,1463298431712203258,7056077236653204913,262144 --variations-seed-version --mojo-platform-channel-handle=3688 /prefetch:1
  2⤵
  PID:5772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3592,i,2062386684408704877,1676722214723166781,2097152 --field-trial-handle=2400,i,1463298431712203258,7056077236653204913,262144 --variations-seed-version --mojo-platform-channel-handle=3824 /prefetch:1
  2⤵
  PID:4280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4304,i,2934513212318901255,3061108330198631063,2097152 --field-trial-handle=2400,i,1463298431712203258,7056077236653204913,262144 --variations-seed-version --mojo-platform-channel-handle=4528 /prefetch:1
  2⤵
  PID:3804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4316,i,5906659385977553397,292378735912773513,2097152 --field-trial-handle=2400,i,1463298431712203258,7056077236653204913,262144 --variations-seed-version --mojo-platform-channel-handle=4592 /prefetch:9
  2⤵
  PID:1396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5180,i,4254797232410127065,7581597385509547519,524288 --field-trial-handle=2400,i,1463298431712203258,7056077236653204913,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:14
  2⤵
  PID:4376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5256,i,792740952605803029,14196240096962507550,2097152 --field-trial-handle=2400,i,1463298431712203258,7056077236653204913,262144 --variations-seed-version --mojo-platform-channel-handle=5252 /prefetch:1
  2⤵
  PID:3172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5216,i,1426422990921663968,4599209311884405310,524288 --field-trial-handle=2400,i,1463298431712203258,7056077236653204913,262144 --variations-seed-version --mojo-platform-channel-handle=5588 /prefetch:14
  2⤵
  PID:6108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5432,i,9960899996569061291,11112514709139783981,524288 --field-trial-handle=2400,i,1463298431712203258,7056077236653204913,262144 --variations-seed-version --mojo-platform-channel-handle=5576 /prefetch:14
  2⤵
  PID:4536
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6112,i,7892442234733961472,12600112186596001479,524288 --field-trial-handle=2400,i,1463298431712203258,7056077236653204913,262144 --variations-seed-version --mojo-platform-channel-handle=6136 /prefetch:14
  2⤵
  PID:5140
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6112,i,7892442234733961472,12600112186596001479,524288 --field-trial-handle=2400,i,1463298431712203258,7056077236653204913,262144 --variations-seed-version --mojo-platform-channel-handle=6136 /prefetch:14
  2⤵
  PID:3224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6416,i,47141970668121967,11555892091356158217,524288 --field-trial-handle=2400,i,1463298431712203258,7056077236653204913,262144 --variations-seed-version --mojo-platform-channel-handle=6432 /prefetch:14
  2⤵
  PID:2712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3920,i,3134595969652570759,7816235414573439056,524288 --field-trial-handle=2400,i,1463298431712203258,7056077236653204913,262144 --variations-seed-version --mojo-platform-channel-handle=3872 /prefetch:14
  2⤵
  PID:6088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5076,i,4662994221064144033,16521998779138824171,524288 --field-trial-handle=2400,i,1463298431712203258,7056077236653204913,262144 --variations-seed-version --mojo-platform-channel-handle=4048 /prefetch:14
  2⤵
  PID:1568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=4008,i,9365283925226719166,6817678699996145195,2097152 --field-trial-handle=2400,i,1463298431712203258,7056077236653204913,262144 --variations-seed-version --mojo-platform-channel-handle=6516 /prefetch:1
  2⤵
  PID:1200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6856,i,6987810266978868780,3992422047302226950,524288 --field-trial-handle=2400,i,1463298431712203258,7056077236653204913,262144 --variations-seed-version --mojo-platform-channel-handle=6984 /prefetch:14
  2⤵
  PID:4968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
  2⤵
  PID:4496
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x264,0x268,0x26c,0x260,0x234,0x7ffc6d7cc188,0x7ffc6d7cc194,0x7ffc6d7cc1a0
    3⤵
    PID:5896
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1892,i,6998243185069275596,10980851106217105144,262144 --field-trial-handle=2504,i,10249311435869507794,8004661744139304670,262144 --variations-seed-version --mojo-platform-channel-handle=2500 /prefetch:2
    3⤵
    PID:4900
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2180,i,13661397392895216640,16044821312593210598,524288 --field-trial-handle=2504,i,10249311435869507794,8004661744139304670,262144 --variations-seed-version --mojo-platform-channel-handle=2548 /prefetch:11
    3⤵
    - System Time Discovery
    PID:5400
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2596,i,2303381548412527620,17910894878228601215,524288 --field-trial-handle=2504,i,10249311435869507794,8004661744139304670,262144 --variations-seed-version --mojo-platform-channel-handle=3692 /prefetch:13
    3⤵
    PID:4712
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4432,i,10934903583325985186,589142019081507967,524288 --field-trial-handle=2504,i,10249311435869507794,8004661744139304670,262144 --variations-seed-version --mojo-platform-channel-handle=4448 /prefetch:14
    3⤵
    PID:5152
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4432,i,10934903583325985186,589142019081507967,524288 --field-trial-handle=2504,i,10249311435869507794,8004661744139304670,262144 --variations-seed-version --mojo-platform-channel-handle=4448 /prefetch:14
    3⤵
    PID:5456
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1236,i,12388228633056939351,5813401951605962692,524288 --field-trial-handle=2504,i,10249311435869507794,8004661744139304670,262144 --variations-seed-version --mojo-platform-channel-handle=1232 /prefetch:14
    3⤵
    PID:3984
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1240,i,5256499155147632633,6752190845773780475,524288 --field-trial-handle=2504,i,10249311435869507794,8004661744139304670,262144 --variations-seed-version --mojo-platform-channel-handle=4432 /prefetch:14
    3⤵
    PID:3092
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1248,i,6168154583001096670,15970314897666755956,524288 --field-trial-handle=2504,i,10249311435869507794,8004661744139304670,262144 --variations-seed-version --mojo-platform-channel-handle=4908 /prefetch:14
    3⤵
    PID:3088

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4720

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5432

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:604

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4256

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\release\readme.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:1360

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\Desktop\release\run.bat"
1⤵
- Executes a command shell one-liner
PID:5708
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ver
  2⤵
  - Executes a command shell one-liner
  PID:3620
- C:\Windows\System32\reg.exe
  reg query "HKCU\Console" /v ForceV2
  2⤵
  PID:1484
- C:\Windows\System32\find.exe
  find /i "0x0"
  2⤵
  PID:4956
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo "C:\Users\Admin\Desktop\release\run.bat" "
  2⤵
  PID:6012
- C:\Windows\System32\find.exe
  find /i "C:\Users\Admin\AppData\Local\Temp"
  2⤵
  PID:3260
- C:\Windows\System32\reg.exe
  reg query HKU\S-1-5-19
  2⤵
  PID:5348
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v Desktop
  2⤵
  - Executes a command shell one-liner
  PID:3360
- - C:\Windows\System32\reg.exe
    reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v Desktop
    3⤵
    PID:3948
- C:\Windows\System32\mode.com
  mode 76, 30
  2⤵
  PID:4748
- C:\Windows\System32\choice.exe
  choice /C:123456 /N
  2⤵
  PID:4840
- C:\Users\Admin\Desktop\release\data\spoofer.exe
  C:\Users\Admin\Desktop\release\\data\spoofer.exe "C:\Users\Admin\Desktop\release\\data\driver.sys
  2⤵
  PID:3044

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

040602c7-3a69-4379-a54d-3cc5c44a1492.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\040602c7-3a69-4379-a54d-3cc5c44a1492.tmp
Size 33KB
SHA256 62d40238317bdbb1cc0d2870baa1f6afd8ea624413fff0bdecdb2c9119cf83c4
MD5 777f58beb9f6ad09c6a191479187ad22
SHA1 7184b75579818a2dd9cbd19e002ad5af057b0202
SHA512 e6ade802245e96579ac118ab9204c01c4b5860c23b87033bbe665b2e77f09af8028ac66c5380aedc6086d5ac1fe443751f3c0d213202dd56efb0a9ac02541f3b
SSDEEP 768:FI3cThgyvybNbsMOeRFZD1fTos7RjaxTcL6:FI3Xa/nY1fT/RWOW
TLSH
T1EAF2AF39B8E49D334CEAE241F25A3647BFE45563CDC90A8895DC8B0E04C77EE270B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1fc434ad-08d2-4916-a858-1ab1b9fb59a3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\1fc434ad-08d2-4916-a858-1ab1b9fb59a3.tmp
Size 38KB
SHA256 8ae290abcae1a38b57798c3417f5bb76bb7cd6b5591b6b5a92521f0a84d36aa0
MD5 174c5dbd7766888e5d19a8f15d61b4db
SHA1 cb57079ba03e5b2d31d2295617b3f3de4e7f424d
SHA512 0e55ccf54da076c52454dc4371f2b022ef0278e14c698df12332e425d1dbbe35aa833c4e36c8ec1947e774b2f7c33d3b39c9fcd274fddcc48c8929c447e8351f
SSDEEP 768:YE3YThgsvybNbsiOeRFZD1fTos7Rjb49FsxTcL6:YE3DI/pY1fT/RP6sOW
TLSH
T1B5038E3DACA05D3F88AEB344A10E3916AEA44277D9F90998C7CC4B0DC17BA9DF347815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3a13c81a-2b54-4cec-a943-992b0a07c19b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\3a13c81a-2b54-4cec-a943-992b0a07c19b.tmp
Size 37KB
SHA256 5927fe168e31bb74210f7d2e59cadc9aea7f0ae5326b32136b20d014f91169cb
MD5 75f238463a458e51fe2acbeb98d6b364
SHA1 02b3942b6b04d339276807849de9d335afecdc67
SHA512 5853e1c4ef374ea4f2f9285c3917dd011f0279420e16fb1aebe426a8ca1f808b1f4019be677587de2a78780aab3cb4d574b83f1a67d2a49d7c5ec80beb7d8dbf
SSDEEP 768:z/UxvxjgC+k3QF0ybNbsZOeRFZD1fTos7RzP/+Pu:GZj3+k3QS/cY1fT/RLKu
TLSH
T17903CF39F8D85D378CF6E240B24A760BBFF045B395C91A9809EC6F0E158B7AD1307816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0d39b99b-07ac-494c-8fb6-d1b5044f62a1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\0d39b99b-07ac-494c-8fb6-d1b5044f62a1.tmp
Size 105KB
SHA256 faa1d17dbaa7275c5bf9f5f85c56bfd5886f17e7f8b00784101de8f5c039c356
MD5 d8b17b6bb640bff8fe28ad44a747f3d3
SHA1 42af3c2e122da92ce166cc222fcb6c05cc8e472e
SHA512 bb4055fb646199a59be3e4d455909dff93e1c0cb13653477973c3a58336f13da6f23290ae834b4b70337e52f6ad5c4ba63776e096e692279fc99eb7436a85abb
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7b:fwUQC5VwBIiElEd2K57P7b
TLSH
T1D7B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a201096456be1e380b7687844e70aa8e2d987a06740acf66db0d56e000a3b50d
MD5 36c9bdf74494657a1636bbc59af48eb0
SHA1 aea8177ffde7e43fa1b4cc5ce6c7cf68c2431306
SHA512 2cf6da34ccb1c58e4f6d50681952d27ffc828c4ede6f38ca0a5e429a4f520e426913b04469e4272eed54102a541263bbb54c2628f542fbe357a4afac921bb49e
TLSH
T143D02B79E7DC8512C0C2207C015811A231B37E00EB0802C00905400C18001C20323F0D
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 11bc2699e3423553add2745f1eab8f9851d20a7daa02621b221c83b3cbc8e6c8
MD5 980f505fe59880c22fc5aac96c6fb0af
SHA1 339c784a73142f8e5e3f3501ce4f27d4c8b19dee
SHA512 db727bc0c14445276e8ec3d5d8b5aa116fb6220674dc044ad1802757ee99d944c49b9c66961058aa57a59d3498c41530eaae8a5b05749c45aec2b99ddcbd08ce
TLSH
T116D0C034761A3AACC1EF3038021865803150CF03C30002040D060C2C19200C314B2FEC
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4123fa2cc2e73053b7602d1d53a57b01f3a6cd8872729fcd7ed66886082b1b99
MD5 5100dc5469c5151f9ac793573116a7fa
SHA1 a8ffca7210c348bef0d710a66e334809b7f58988
SHA512 ead3d81382dc13f1d89e928af9189e5eec6cf3fabfb91ed18d73f1fe38b5e9f76e77fae594633baf6da19747d70fbb17eb97a8a36df60510a930f6006986acfc
TLSH
T1F4D02B75E7EC8412C0C2207C015911A231A37E00D70802C00A05801C18001C20322F09
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 396290587e48f5e7b208828e785b2f646d202bf767440dda01dbb15546ed718b
MD5 1d3ef388080e1b46480bd990acc54c90
SHA1 70c9cc23c60c721bc909ec7ac7f6f78053f8a242
SHA512 2877e822490ce9540ebd41d0e4e9aedb1458016d8b847f2cef98fc56fb746d190b0a4c202e01832e997f91c3480fd28d9b3e9e63f495d5fa91edd73b98a80e49
TLSH
T122D080F8F75B351CC6CB6074574EA7D03351DE11D2060578494E051C3500AD125A1FFC
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 38841505ed0b7386f03c6fe801ead9c02ac97ef50361b9aa051cd7baa4509985
MD5 1cbf6e2d8a454b14a6afd40b6713db37
SHA1 73b47cd3f2c6383afba65939224de69977ccb479
SHA512 fb9dab73f4aa01ea175f4f85516e569dbd3e7332921bf09617a68045fe11cedc7dd0824c207582fa8280ea9c721b7c133188432a6377fc6708e742a636fa24c5
TLSH
T19CD08CF8FB5B392CC6DB60B4574EABE03342EE11D2060578494E062C3500AD226A1FEC
MD5 SHA1 SHA512 TLSH

Submit Download

4013fcf1-cf1e-4463-8826-bfdc3b36e23a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4013fcf1-cf1e-4463-8826-bfdc3b36e23a.tmp
Size 13KB
SHA256 19b0aa3bd4cdf464155baa63027a64735e573272eb42f3350c44bbe2e164de3d
MD5 652a6d1386a0895e89e518367c774fc1
SHA1 f1c1f80aa050dafa80b32e0f5de0b24575a9f8c6
SHA512 08654a8e12cbb3d387777f523c0f64285cb29e6426072f4bbabd51a1e6146d7b9cbc3220ff09898b1082c5f433bfe9ae0fb060784f7fada9a61ee79266360e9e
SSDEEP 192:sxRNR3To/f/skdWpVoUZuDJtUzoA8pyOps7/g6+WNB8qB/YD86RhgRIgDoJJ:sxRNJo/f/s0WvoqCZXM/5N/jG
TLSH
T10F52B615AD38A97B4CDBD619FBA6BF13D2FD5022A0D05E48A6FC892C04E76DD530780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

48c4ade6-1b79-4275-a072-b196f62a2156.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\48c4ade6-1b79-4275-a072-b196f62a2156.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6ad9b602-4119-48ec-b57c-5e9a6d3cfcda.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6ad9b602-4119-48ec-b57c-5e9a6d3cfcda.tmp
Size 14KB
SHA256 149314fe4e9bcd92c7e14d8f82103c6abeb181c5726ac22fb66b7caf77eeb773
MD5 4ebad7bd72953c1648b627631c0bd1d8
SHA1 0dc431f226a1c04a2ffd28d9d8034ec42826693c
SHA512 95935993c5938c7c948c7e68f66a111b7d6f13c787c8aa07b365e4704f8228b32b8758eb9c85567bc3204aa267bcde4f9af2da48e522eaeffc25e82e43a9cfc7
SSDEEP 192:sxRNR3To/f/scWpVYUZuDJInaUzoA8pyOps7/g6+WNB8qB/YD86RzGRIgDoJJ:sxRNJo/f/scWvYqC2GXM/5N/HG
TLSH
T1A862C715A928A93F4CDBD619FBA6BF53D3FD5022A0D05E44AAFC892C04E76DD530780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 d54f4ebab96afe97b403f3c3eb27b46609d4fa8ba285faf0c77d3786fe196002
MD5 08960702e18b3489e8435068e38903e4
SHA1 1310ef09dbec842876dbd61cddc02dc4bc94a1d8
SHA512 070aa2582507ee85de3326dfb6460f7966a0d8985cf6c54070cba694a1b83013bbc1255f5373f009c23ae5a71ac5dbc4bbda0ff0fa98421f2d51d18dc0698edf
TLSH
T11EE061A5C832EC2B08FE071C60905746E70513A73E54494B373C910CCFB1B77064589C
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 8c5c904b9233f5292631d20337efaad5af5ea066e86ed380132a6f5236d5ed2e
MD5 33cc7b9cf806c256be6af56346c52b1e
SHA1 c8873f5cbc818a4249cf9aa985ef2d352485bd0c
SHA512 84a0781263cf8377faf1d53ea4624fee199ce79f8a14c6330261db717b57e5221f3ea7847663da73fa6e969955bb93bcf1e2f3ab86aebca31812b5e7d3dff1e8
SSDEEP 384:akvWhylyugf7fqTdgwK9waNo57Y1LWlwai7L:6ylyyTdXia5Ed1ain
TLSH
T17913183E76016E4EEBE350BE609B2BB5A771D0F7E2E1018713B9F5110B26312994F638
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 c93fcfbf91dba43f3a6383844f16aa9d4c8fca1deaeb4285b6bb68f11b5751ad
MD5 7d0984a74fa908027c78e379d4a8a788
SHA1 05f06bad34aad42e61dac8323d50bd445a0df7c9
SHA512 c53ca12364656d5874e9221b124ac5212d00058819d2f84cafbeeee85899959c96ef7f7b19eaf2978fc53df161ec090bf12b1f9031150edf30500c88b5d4a0c7
SSDEEP 1536:+jL//+L/N65orMSjNaxHw3OMfxtx4gqzHO+3mdtK:+jL/WL/3NiQYzuVq
TLSH
T1C6444FF71810605ECFA826F6DA063A7CE277021DECD1EC9DD5398C81A925F31A3B9E54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_2
Size 1.0MB
SHA256 7a044433f994d8bf3e77bb843992640e6b53fc160bf8d2701a2eb346b24ffe43
MD5 d00bc5c1753c04293954c64d294f170e
SHA1 2c5e7e107e1b8a50a31b0405c3fef9cd6a67cab9
SHA512 dceb3bbc6169904cdc2b29b79a42c4ecfd615d8a2328c36e1f03fedf6283f4d67218e5d57486fa45512ea419d5d919ccef896e3eb1424dd777ee670e734e80c1
SSDEEP 3072:0v9G+bWAmwHvb5MlYe1LoOfouoqXMKKl5ZCM9UteAxDVxx8Fx5/0YgrjGB3RPiU2:0Q9yMiULLj8KKfXAdVkFx5cY+ePiUz8
TLSH
T1A7258CEECB682C82DB2B8774B0E0D90B7E312182B65DD0D39944C5D897D6B8475F82BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3
Size 8.0MB
SHA256 c51f59e6fbec6145c5b3d0b5d6468f9d9e48083de5291a568d197aa504fa0d17
MD5 51a760fdbff4f488c1eb2388b6222f90
SHA1 f60204990a49579653b0a4f70da9594897fcb5f8
SHA512 73181bd2ce3260bb9e9fab9000a389cb08a6f2350036f6adeefe596eb1c65ac3da7499967518b57e77fcf9c54001bada581cdc3a2af735a709a8867a04437369
SSDEEP 24576:sbfRxACTkTzDTY9u+KI+6sO0Go8kbhu7GHdQxTSUgh89wdCdou42U7+jQQqdcSSz:2fwTY9u+K6a3yiWEkg
TLSH
T13A869DDEDA3458C2DE538A30F0E0ED977D7013D3B965C4D288A8C195429B7C6BB5A22F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 5KB
SHA256 d584a753650878ce6069739497d8586c1384c525d49679cb58520d7d6fe200ec
MD5 34d7b838caa7e6b08f113f0293e89b60
SHA1 792df17032ade14a66abc7ef324bebd9666cdf43
SHA512 bd7a458780054ed131abefda32cbbea779f738303991e9e36612d91900ec3f0aae827b01562b266958545e2ef63f17a0be196e851e5b3a04d9ccc044a2dd39d9
SSDEEP 96:HczrKKFE3gPd25wjxNSboZaSWdOhbo9Hs1:H2T63Wsujx8bJd6bz1
TLSH
T1DAB11998C250AADCF7F07C3841EB56AB393B85BFD6936E024572F539F74AB800278214
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 88d22311c2feb5c2256be683e3428614c8d889ce7551d166db71559c95b8af3d
MD5 2804bc66116a7a2a6657a078d35f9f99
SHA1 0c81eb45116fbf1956b8d2e860616f4302bbcabf
SHA512 a78a204a061cde2d9ad3bfeb9bf62fc77d9d6f2e33749f4d12e5fa73c8f30105117a7d5d1e90bc77996c86d0324dcb88c2c5e6cb96b2bd0437e2b71d38489d07
TLSH
T16451C3CDD690FCEAD324143082EC228B3A3C91BF9B836E038694D5785B0BBE4534C304
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

7e66377a-26f1-4a06-b4f6-394de38d74a1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\7e66377a-26f1-4a06-b4f6-394de38d74a1.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG
Size 346B
SHA256 82e77395b11b0cdcbbe09323d95154bbf09e17c9587f0329762a1905d006ff00
MD5 39ab39ee7f3a648a9951fe08d074cd7a
SHA1 cac31675494e67b12668eaf77768f6686e6be561
SHA512 95823858c093070dde061396ad386ffb396a0fde03cd3f81aad304e25fdb7a48a78f8c4e08ebc3e837303ccde7036ee5910dffefc519fa63d61a7b6976b0d468
TLSH
T160E0D89468CAC21E6F1436CB42245B09A3A034A7D7D16D471704CCD4760E10AB791667
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log
Size 399B
SHA256 55f8fa21c3f0d42c973aedf538f1ade32563ae4a1e7107c939ab82b4a4d7859a
MD5 a15ac2782bb6b4407d11979316f678fd
SHA1 b64eaf0810e180d99b83bba8e366b2e3416c5881
SHA512 370b43c7e434c6cc9328d266c1c9db327621e2c95ad13d953c4d63457a141fbf2be0b35072de96becc29048224d3646535a149229fc2ba367c7903d3e3e79bdb
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 322B
SHA256 de09fac5ebf3a7fe0f2bc2ac1044da14c4f4d1361edb33fcb765d0ac2ae65596
MD5 bbf254acab6c61961782dd7bbe68c5c3
SHA1 996516b58befe181cf28d4ff625f0af115eda2a5
SHA512 7d3c358a73c84996d2b9e63b78bd4518153b7ffea8576da102aa8e3bca2aa9e7a023d7efc86106067aed30f1e72c084e20488f54a5908d4ecbd79296ba8b64b9
TLSH
T166E07D6404CCC32AD61C699703BC430997F0342AF2883E877F8DC980720234AB3DA3A0
MD5 SHA1 SHA512 TLSH

Submit Download

computed_hashes.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_1\_metadata\computed_hashes.json
Size 429B
SHA256 b829b0df7e3f2391bfba70090eb4ce2ba6a978ccd665eebf1073849bdd4b8fb9
MD5 5d1d9020ccefd76ca661902e0c229087
SHA1 dcf2aa4a1c626ec7ffd9abd284d29b269d78fcb6
SHA512 5f6e72720e64a7ac19f191f0179992745d5136d41dcdc13c5c3c2e35a71eb227570bd47c7b376658ef670b75929abeebd8ef470d1e24b595a11d320ec1479e3c
TLSH
T10AE055170A1A50B79BB8DB90EE525CA2E8A0A6B1C50438D63E608234B68A11F738347D
MD5 SHA1 SHA512 TLSH

Submit Download

verified_contents.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_1\_metadata\verified_contents.json
Size 1KB
SHA256 d23b2ba94ba22bbb681e6362ae5870acd8a3280fa9e7241b86a9e12982968947
MD5 738e757b92939b24cdbbd0efc2601315
SHA1 77058cbafa625aafbea867052136c11ad3332143
SHA512 dca3e12dd5a9f1802db6d11b009fce2b787e79b9f730094367c9f26d1d87af1ea072ff5b10888648fb1231dd83475cf45594bb0c9915b655ee363a3127a5ffc2
TLSH
T12B317466C8683D56267A63348E2D0602EB57C2BB0050640EB5AC558D4F7115FE242FAF
MD5 SHA1 SHA512 TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_1\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons
Size 24KB
SHA256 f3a49c151d95ff4923d384afdbea52cbcfc3806784e1a86c6c5859f73306c25a
MD5 e10d540f47645f87b6df5bc0e72f583c
SHA1 471dfcb8edb5ccec003a7c065638ebecd2938a2c
SHA512 7d18e2fdfb8d737496fe93853072b7e5c0b31c6b8932a3ee251f62e40cc3535245c7a101215d53a99c392a4fc87b521d2589b923c4eea1e7e96d8d7f69148c17
SSDEEP 96:UBCxL4yumOJsUYlTC6ad2bybsq1pW4EM0j:GaEyumtUoTC5IIhEM0j
TLSH
T155B208A75E303007CB051E3F161969B28F3BD26CDFE1EC9570304021E8B889690B09FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 224KB
SHA256 612b317e28c6c259097b6914b761ba415287bd777038ab08fc46541b8c3364a5
MD5 1a686ecdf9ad554431f66100fef03c02
SHA1 0e935dee1e52bf1dcaa35b09fa6790b310bcdc6a
SHA512 a21607fc0bfe933bdd4fc5a6497d56bc44328acc83bb45301e2dc59c22853a4c1f9278d2d7feb083e9a778b3c10a62bd9494eb10a1c9536a8d958c1ce4e1a81b
SSDEEP 192:rzWqX0WB6o2sH+bF+UI3iWGVFWN3qL/3VVV63:rzWqjD2sIkUI3ijVFWN3qL/3A
TLSH
T1D324645F5F242722CD7D913668EB04A35D7DF03FCB1366DA686114B0CEE2692A05C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_github.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log
Size 300B
SHA256 fe7224a5577d4de39ebbe9ee36c5d716a21710d3aad1b634b1ec11baf3adce57
MD5 df51b392d18acaf584141ee7972a0605
SHA1 88648bb3b900710519be4a6ca310173fa0094af5
SHA512 068b7f346528d2bcf2b795b257cdd5c7fd0e7d66eeb660d6e8494f3966a727d6b34f767eea3de9fc2d0a4ac361ceb64327895745e7f994380dec0666e1048673
TLSH
T170E012F74548D49BBF1039F28D99A0A4E63155FBDFC0DAD8C6726E025840CB123CF451
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 331B
SHA256 0de7c464064168f90efdbc4f13517bc17fecaee288def4733eeb7febda8a05d6
MD5 3ce44d31da05097dc9adcd2238a413a7
SHA1 547606d92e78c49923f9a9ded1d17acac67f12bf
SHA512 02de8d9220c8dc613cdcb642350285404bba0fae41306dcef2a9d2004ee1f47da07b9dea0b93355645aa3bd6ba1dd27ccc4739c0b4af6434945db68cacb74184
TLSH
T1F5E0D87046CDC21A560830CF0334BB1ED7B0341EE6842EC52F04E990B096508ABC52E2
MD5 SHA1 SHA512 TLSH

Submit Download

7b7f3866-0149-4379-a225-d8f05fbacf55.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\7b7f3866-0149-4379-a225-d8f05fbacf55.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Size 24KB
SHA256 41eeb4f847af1d60d13d1ac038a0a1cf0a3c66390198f8a30b81a398cba07b72
MD5 5550e219f98f5702b551d9c618dfd40c
SHA1 676a649443c075e9f5cc088d373489b5aca21df0
SHA512 5f59ed3a13b69b48533e9179c695ebbc7d830abd8094822c43aba7286be5a7e84be7718224cf68628df3978ff9c556aa56fba79a4eec2abe9c408c0de4d54f27
SSDEEP 48:Txk/LopFMaty423w/a9NUuTovwLNHN3qttlNNQo4wj9ocggKuK:qDeMatha9K9tfGQRK
TLSH
T16FB2219D1F202616C2F44B76EDE185A62F3C011CC7733A59991864F2CEE29EFF1264B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 15fd8f9468429f4d657995b5d05cf289b56bc982e45ec99f3c971188669ebb5a
MD5 071925b8f6a6d6ec02d936c646e39278
SHA1 c69128dd1e718fa4c3574dcbc5c35d0efd3884f8
SHA512 1ef29721bfb6227ee445681f875db441664882b62ec986b64b6e69c303212cfc43701997437d0b38c1fb83aa18ba1a7ab41c2052b9c07ea6f5ff5e9f345a2d86
TLSH
T186117B93847A787B142E08BB1D48BC45697AA8720021A4F1DAD7C3BDB0C18FB4B11026
MD5 SHA1 SHA512 TLSH

Submit Download

b15e62b9-4c4d-4a74-9a05-505e97c29d17.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\b15e62b9-4c4d-4a74-9a05-505e97c29d17.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

e67135b6-d6bc-4bcb-b5e0-3488fdc61990.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\e67135b6-d6bc-4bcb-b5e0-3488fdc61990.tmp
Size 3KB
SHA256 cb109d8c52e4e66e7ff9fdec8b581b943038dae499493acbe430f04ab96de04c
MD5 cf69bafac878c9a7f29e9c3237dd6868
SHA1 310b16a016cd6a6ca0198757a2cb2e0213b9c54e
SHA512 8ebc8583b445b1c72cdf2fd14549375e040d6050bcf22334a73008d7030385d44a5f98ae31943a49f0505756593f78d8375fd1db0ac1715ce017dc847a8aaaf0
TLSH
T1F2618CF787F5956D9B0255F0FA08AE1BCE2C0520831C78AA84E0AE17D3E3871E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 335B
SHA256 28c2b1c427249877daf16d54e40686708f4b733ca5359f674a09379faee70034
MD5 b7317c9b26048a650f5c0ba666f29ba4
SHA1 a0e2f36be13263f933f25f7cacf1c01853bd8770
SHA512 eb5e32308341bbe401edc47ba115d31b2e90f43e36688d78aba138c7949f453af79c75456d6d4538906438352054ee1f444958c5cb0fdf231437750bebf9dc11
TLSH
T1FFE026A005C8E23EA51B215F03248709A3F47427D2C43DC63F8CCA84614A70AF3D72E0
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log
Size 112B
SHA256 05e07c3613c6cce88bf4deeaef5b8f7d775d73751d3f41d6a7a4608e363edce4
MD5 5de1606ddba9f630c23a4173c673f30a
SHA1 e9f37ab171d7ae7e68a2f833f1eaedd024833bd5
SHA512 3945b4918163e8ef284a3ce8e678fa564a1a4690fa1e411690f61c756f4e3b2eff7bdd1bfa57e5d418a0d3ad69a6d02585302c416a6920e1e476312b5762bc2e
TLSH
T107B012403F004167C8D6053102584FC09F44E403D160697B4F4E9F694DA4AD46F90EA4
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 347B
SHA256 3d88697b9c1553e196472dc09cdb7f947b33e73aff2343bcdf3493e83cca4cca
MD5 47ab7484954869a232b59944f054948d
SHA1 c52c4371c88315ee27363fdd145fd342e2a4c095
SHA512 04f71c626598fff05ca1ac9ad1e968cdedd221d5077c8eef72e2069b3801bc5bab0a44eff82c9fd52a924be5075129a58bf5df185ab78850f2e3ead7600756d9
TLSH
T14FE0D87035C9C32AA24B209F0314D759A3B2F512E6C669953B0DD580620A244B3832A0
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\000003.log
Size 175B
SHA256 80d1388b9a7150eb0291175fe693dd7b6bce910c3e4fff51e94841d31d771dbe
MD5 cb63c64828a27af7253afb7c7d986654
SHA1 8a54aeb86f79cc69e6f11278d874cebd328ae466
SHA512 e0dbdd6931c9272e0b52bb2ef7895121f6324379f584899343342a057737a9837cc476842ea781a1de5c17a20c06e0a7d24c0ed6ea41fdd95bb99296e8810f9a
TLSH
T135C09BD55F903023FDCA5D3D0DAB53041720C4752F74CF57D28430901C0A285FF61145
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 323B
SHA256 26f50e801d22874552d260d8b0bc5ba964f9385b12f0c5b786eed99f36dfa8ba
MD5 d411f6bfaa5dd9ec7d0b5e6632e078e1
SHA1 a8a9d572ceb90791f14d36032d351b7a800fd4f4
SHA512 c72df7ed22d14055f554dfba601af10bc2e6e1235958d281658cbb92712846abf098b05aaa489f5b179f976ad2edc0aca12c288de150be86cc7470844d2840fe
TLSH
T11AE086B84ADAC33B950860C70774970F97F0781697C47ACB672CD4A0B505249BBF66A0
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 7KB
SHA256 320a06d380fac71cf37d85fca597b56074d0a1613f0c4de439f1664507218f60
MD5 c48b2bde525c706c3c54bebf4f541636
SHA1 720836f36147f664c1350ce17e473e209ff5b1b5
SHA512 dec0da184ca8549d6fc45443092bed6fb6f19b4dd790beadb0209f98f22f210540ab08df82049307b3720a337b707fbb0f96b9d791f9b45084f6c57138b48603
SSDEEP 96:Ksy4KTiCOfOKoQD7GKoUSOJeKqLwAKJqGK2EKrCsz:u3tJlhMLPH
TLSH
T1BDF14550346F424138FE2A1951A8866B52523173301DEBBF3FBD41A18E2BE055DFEED9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 377c680565d87edaaadc0d57c089d54ace1ad6363f43cfdba00e0d10d5ff8885
MD5 db931ff111f14ac340387954754d4c21
SHA1 8ff1177fa74dfc22494b75c2fa5f9d8e982ee76e
SHA512 055ad3ca66a691d2a89814f2800de686e5e97387c97d32f3a06a6c8377c921f0b93c6b49545e5ffbe5d2b56c2bb9cb38011aa2c78b4286e41d78aeeffcbc2c9f
SSDEEP 48:KsyIPKTiMLyVfIBKoQUI7I9KoU4vyFJIxKqD7m3L/:Ksy4KTiCOfOKoQD7GKoUSOJeKqm
TLSH
T1D8B1DE9070BF464038BE251A95B5976B42423273311CE77A3FBD10A58E27E086DFEED9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 256KB
SHA256 4289e2ccb730638eb8f7671f5ebd0336ddca5d741c53ec08baf4e346d8aea4e7
MD5 a2eeafd5a131179ea91c4ed6258175ea
SHA1 f11321f819c59c618acee7031ff0b2618156515d
SHA512 95a87a2ebfd46aa8e80d2be69d77d371c9cf6cf809e1d1afa9c979653488f242a07fd939c75be17a1c83c378a183bafa66f54c7bddb56ef0f10d81a81e312150
SSDEEP 384:DNrRZyCSDnxTICpMEhIKyll7svbFKfk7:xFZJSDni/yI1l7svbF9
TLSH
T1C444730A7B747001EDE6D9725CB080771E3CB16D8F22A6D16DA254698DB3853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WebAssistDatabase

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebAssistDatabase
Size 14KB
SHA256 7d97d0ca62fcddb858971c0b2ea676742dcb70708193aa71f74c8033a05a3dc6
MD5 f9995294cbd169095b6ef58c28586141
SHA1 b34bad14dc3e25a8f76e19f6e7db813d54fcfbf0
SHA512 00da4c5d328d7a1f39cb9828a02a9a003fec4e0ad34b545bf4b27d050a76de9a41f74f5c006f035c9c8ee077c708547cc996af3c53127e82e730d61b2b1fe29f
SSDEEP 48:DEK3tjkSI5IUltGhp22iSBgd7E+bE70itEoH1EAW:DEtSyGhp22iSsq0itEo8
TLSH
T1C152DEABFA342222DEA54737CAD001D7BF39D13CCF80D79210E120205BB4550A35E6CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a005e6ee-d1f4-49ce-8efe-bde219ff4093.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a005e6ee-d1f4-49ce-8efe-bde219ff4093.tmp
Size 12KB
SHA256 8ea63266e5816dffcc0243a1fceaa2ce99a86730d66de4fd4a688b547e5ea1ad
MD5 ee0f65970eb6d1cc24e9c185e1fe6cea
SHA1 7c2b45498f17d0352c1bd2e1d979b9f34bc846dd
SHA512 beec36085574afb1dcfdc494d24164a3ce307e78c8faad28e77762e4bd7ecaabd7301be72a91c0d0650bb02281878da8f2024add42d04c87f4789a4e83379a7f
SSDEEP 192:sxRaR/To/f/sG/UZuDJ1UzoA8pyOps7/g6+WNSqB/YDewLGRIgVSJ:sxRado/f/sMqC1XM/59/zE
TLSH
T19C42B815AD28AA3B4CDBD619FB66BF13D6F95032A0D05E48A6FC8A1C04E66DD530780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a0d45f0c-cf8e-4126-9c95-07b60963e8ff.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a0d45f0c-cf8e-4126-9c95-07b60963e8ff.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f8743af6-2c52-4ab2-8c13-98979391328a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f8743af6-2c52-4ab2-8c13-98979391328a.tmp
Size 29KB
SHA256 e2bc8168cd4e13572d90c98f9c3aab5d707847864fc5cf195dfc03861b7c7eea
MD5 12469eabe44b18f6ca00e6f4ebde04ff
SHA1 affa3f791b1c4e7e291007a75cdfe8b821d05f83
SHA512 3372cb849f21a2ca7bb036aca452b4d15249ee9e64eede7436d7bb15b1f7b73fb81344d92795aaa58cfc2364c9683bd073161e34a8f67d343fb0969d8e2c1771
SSDEEP 768:SzYboR7pLuLbxUWgasfA68F1+UoAYDCx9Tuqh0VfUC9xbog/OVITP8WS6roGqzV:SzYboHEbxUWgasfA6u1jabTPtSxfzV
TLSH
T146D2E97B640CCB7F4F904ADDED1A7A8A6D6802CB96D8C98047FE941C02C67EF511A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 19KB
SHA256 1e334b8da358f3a11256404b288239511e2510332462e69d0c6ae4df877b34e0
MD5 0684772cbea73daaf242fe0318b4cd16
SHA1 da0e63eeab63430b063ee0a7ab24d541b4325814
SHA512 8ba1548310f3dba0b433192cc0d79d51da521178165d913e69129957619231744fb98b827382f437bf97d2311d98d3701b4f693bc5e628fb5a6f0c413d4d54f5
SSDEEP 192:X95QkIIIbbLMIMNsYcY76Ox0cAsul8+BusieZete4We2oyGe6oZJ6oZI6oZOa6oz:X95QkIIIbbLMIM2BwxSssssDZbZIZjZp
TLSH
T1EB92FAE762000777C75F2B36476E464E6BE5EC81866241AC3161680ECCF6BB7C2D62F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 319B
SHA256 3be227137f8219511f2ce64e3f7b8a2a86685dadff23134bf5a50c48531f73bb
MD5 8a7f77cd76543cdee85fbbefaa3c801b
SHA1 a82429c328bb58c39613d66e04fe409371a8838a
SHA512 18acc396f5a6dc7b74f64a327e2b513a636ab1d7837fdfd45327cffdea2875706ff4d8c2a51e1cbe87bf39f573f496f488885855f0ada2daa0751dac13bf5fe9
TLSH
T116E080505DC5C23EE61C238B02695349D7B53D37EA846ECB6F48C494610564577D92E1
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 5a63e0f8039a4e840e28d1d0dc965ebe45bc373dddf3a443b4ebdccae14ed302
MD5 85e6c00f12029df6189cd65d2cefe481
SHA1 733952f629a2f36d8fa47b5f22914d8768f8d9d0
SHA512 ecce82c48b172b8b7bcf1dbbf46f23d10e92af8b5045996abc5c26224894769a280e32450346b61b7f53ebab3cf03d325c11311ce7de8821fb61a1be77f12fe8
TLSH
T14D210495F330C108D14A867A607F9B3A1734D8128FBCED0F95BA70756E71B040D4B6E5
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 337B
SHA256 3e996687b07befd754b27487edfb64a31951b2f1df985618dafd0f0a8f4281b9
MD5 9c9ae0029cb3f048a8a660571a2e6703
SHA1 bdc25313a3c8deb6b339f4f3c8be0efb5c33e303
SHA512 a7887dd1c6a4a8a6dad3aca034da470871da34b45ac03a9be79edff7bc4eec9d04075c8a3251dda8a802a7c989e300bb929425516a69ea7a3001fa220aa8bf3f
TLSH
T13BE020106CC4C23FD61C628B02A88349E3B53C63EE802FC76F44CD84510564677CE2E1
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_1
Size 264KB
SHA256 9826f3f7110982d9ef6c7fbbd9a8d0a5cd8abe290067984ca85a43fd0c51ffb5
MD5 8c1a5368a1525d57e348cbd3bef9a7a2
SHA1 40e941f1bc88f252d6d055dc848cdce390a18573
SHA512 88a0ea1024c3cef83706dc7d32320e2e992ca247690ed2f18f02c3ecd004ca75221686520aa8e10a819e0defb7958f8602008f2210a1c9f9cdea89379ecc3739
SSDEEP 3:MsEllllkEthXllkl2zEfl:/M/xT02z
TLSH
T1BD4404047FC43415D50C11304157C3501370D450053157C334F14C335DC75500C00001
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1
Size 264KB
SHA256 06e409e57a022f6097fa120faa3522cba5d729b4ebd547182e68ec71d893557a
MD5 da49c4429dc7353579041c7718f8740a
SHA1 c4798c4fa5ade92e939e1a94185674f9d2fdd61d
SHA512 e32c45d6016b6030825fd97f7757b7194dd7983466f95a861b9799f2c06e59c9d1e494ed0ba0ccffb30a747155e9a2b89670bfe121444a20a892d18f9559d1a9
SSDEEP 3:MsEllllkEthXllkl2zEflk6Kl:/M/xT02zL6Kl
TLSH
T1E3440404FFC00405DD041030415DC7501371D410071157433DF14C337CC75540C01400
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Browser

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Browser
Size 120B
SHA256 9c70f766d3b84fc2bb298efa37cc9191f28bec336329cc11468cfadbc3b137f4
MD5 a397e5983d4a1619e36143b4d804b870
SHA1 aa135a8cc2469cfd1ef2d7955f027d95be5dfbd4
SHA512 4159ea654152d2810c95648694dd71957c84ea825fcca87b36f7e3282a72b30ef741805c610c5fa847ca186e34bde9c289aaa7b6931c5b257f1d11255cd2a816
TLSH
T1E0B012203BF9062CF3F74D00AA73AA3428BFF4080A14811D505102080C33E19C478FA3
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 f18dc8213fd3d2341e6bfa4ffa13c52d38cbb2c14ba1d218123264075b2a68cc
MD5 48d08ce4e2978e1d167b17ad326571c1
SHA1 f4af8ed652dff39c031fe79688034665c4b1dc43
SHA512 539b7330fdf4760768cb351d45f6ec296cbea7d463d236668877f43d8749b8d71f258cf329a827ad53ae89e1963b938c9aa13875f67ca2b394430a0a6560a6fc
SSDEEP 3:MsEllllkEthXllkl2zEfl1R7/:/M/xT02z4
TLSH
T1894404047FC00405D50010344451C3505370D7330513574734D144375CC75500C00000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

e116e8ce-7f98-4f21-ad7e-6e5eb4104a9b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\e116e8ce-7f98-4f21-ad7e-6e5eb4104a9b.tmp
Size 38KB
SHA256 e572bbc675110d0512ee7e10102b045fb7168ad20058a1e50eeb32dd77db31a5
MD5 54652c5cad147c5cb313dce25e9d8243
SHA1 1edf46e0fee1d261885402bbde075214a9fb545d
SHA512 57e196a7b026f3c92d7c6ce133aa35e8e040fdaffe81718185d2ce7f68157c6348e2b93f742ecd2cae843741a30491354b872af383caf60baf077a62a0f2faf8
SSDEEP 768:A/UxvxjgC+k3wGZybNbs/OeRFZD1fTos7RCa/+Pu:tZj3+k3wM/2Y1fT/R5Ku
TLSH
T19803B039F8D89D334CE6E244B14A7787BFF415B389CA1E9849E99F0E058779D130B416
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

38775a72-63e7-4f76-aced-9741ae023042.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\38775a72-63e7-4f76-aced-9741ae023042.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

bb7d03b6-4322-4ac6-8740-d934b82d9189.tmp

Path C:\Users\Admin\AppData\Local\Temp\bb7d03b6-4322-4ac6-8740-d934b82d9189.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

dea644f6-02dc-4cbc-9415-e464103b6e52.tmp

Path C:\Users\Admin\AppData\Local\Temp\dea644f6-02dc-4cbc-9415-e464103b6e52.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4604_561950685\CRX_INSTALL\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ced874f4-8876-4582-b2ed-dea31c71981f.tmp

Path C:\Users\Admin\Downloads\ced874f4-8876-4582-b2ed-dea31c71981f.tmp
Size 15KB
SHA256 ac27f2a1ee7fcfd8be0384b715e50594a3b838945ab427d840008257dba181ee
MD5 a35955ac528c9056974e60937d4a5fe9
SHA1 7aea087c39e490b8f4fcafa8dcf044a5732b237e
SHA512 28dc61d165c7614d7b740c1758b0f14ca72271dee8165e48abbd13ec27b24035bbaf448494eef1abb997c5238469bed8bb23e63adf07629f6b4090946b35d171
SSDEEP 384:XYplkQIKn+e61ZVbeUVTt2K20IAzOC9ZMWuvwwgN4yi+8WDV7v+Ck:XyBD2ZNTtt20IUOgMPowZAZ+Ck
TLSH
T15872E0C2B76B002F3C55AAF44AA8D2E593F3FC1547E5DB2E1713D01284E2B56796E0C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3044-660-0x00007FF758310000-0x00007FF7583A8000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads