hxxps://h5[.]upjoyjoy[.]com/tnd/index[.]html

Analysis

user interaction
yes
max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/10/2026, 04:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://h5.upjoyjoy.com/tnd/index.html
Sample261030-e9clxaaw7m

Score

3^/10

discovery persistence ransomware

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1152	msedge.exe

Checks processor information in registry 2 TTPs 26 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 16 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\crdownload_auto_file	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\.crdownload\ = "crdownload_auto_file"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\crdownload_auto_file\shell\edit	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\crdownload_auto_file\shell	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\crdownload_auto_file\shell\edit\command\ = "%SystemRoot%\\system32\\NOTEPAD.EXE %1"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\ㄆⴻ戀蠀\ = "crdownload_auto_file"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\crdownload_auto_file\shell\edit\command	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\crdownload_auto_file\shell\open\command	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-747854149-4118156852-591593384-1000\{4AD7F686-0487-4574-BD05-24CC1828243E}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\ㄆⴻ戀蠀	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\crdownload_auto_file\shell\open	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\.crdownload	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\crdownload_auto_file\shell\open\command\ = "%SystemRoot%\\system32\\NOTEPAD.EXE %1"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings	OpenWith.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
2560	NOTEPAD.EXE

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
3284	OpenWith.exe
3832	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2276	firefox.exe
Token: SeDebugPrivilege	2276	firefox.exe
Token: SeDebugPrivilege	2276	firefox.exe

Suspicious use of FindShellTrayWindow 56 IoCs

pid	Process
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2276	firefox.exe
2276	firefox.exe
2276	firefox.exe
2276	firefox.exe
2276	firefox.exe
2276	firefox.exe
2276	firefox.exe
2276	firefox.exe
2276	firefox.exe

Suspicious use of SendNotifyMessage 40 IoCs

pid	Process
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe

Suspicious use of SetWindowsHookEx 53 IoCs

pid	Process
3284	OpenWith.exe
3284	OpenWith.exe
3284	OpenWith.exe
3284	OpenWith.exe
3284	OpenWith.exe
3284	OpenWith.exe
3284	OpenWith.exe
3284	OpenWith.exe
3284	OpenWith.exe
3284	OpenWith.exe
3284	OpenWith.exe
3284	OpenWith.exe
3284	OpenWith.exe
3284	OpenWith.exe
3284	OpenWith.exe
3284	OpenWith.exe
3284	OpenWith.exe
3284	OpenWith.exe
3284	OpenWith.exe
3284	OpenWith.exe
3284	OpenWith.exe
3832	OpenWith.exe
3832	OpenWith.exe
3832	OpenWith.exe
3832	OpenWith.exe
3832	OpenWith.exe
3832	OpenWith.exe
3832	OpenWith.exe
3832	OpenWith.exe
3832	OpenWith.exe
3832	OpenWith.exe
3832	OpenWith.exe
3832	OpenWith.exe
3832	OpenWith.exe
3832	OpenWith.exe
3832	OpenWith.exe
3832	OpenWith.exe
3832	OpenWith.exe
3832	OpenWith.exe
3832	OpenWith.exe
3832	OpenWith.exe
3832	OpenWith.exe
3832	OpenWith.exe
3832	OpenWith.exe
3832	OpenWith.exe
3832	OpenWith.exe
3832	OpenWith.exe
3832	OpenWith.exe
3832	OpenWith.exe
3832	OpenWith.exe
3832	OpenWith.exe
3832	OpenWith.exe
2276	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2884 wrote to memory of 3120	2884	msedge.exe	85
PID 2884 wrote to memory of 4020	2884	msedge.exe	86
PID 2884 wrote to memory of 1152	2884	msedge.exe	87
PID 2884 wrote to memory of 4020	2884	msedge.exe	86
PID 2884 wrote to memory of 4020	2884	msedge.exe	86
PID 2884 wrote to memory of 1552	2884	msedge.exe	88
PID 2884 wrote to memory of 1552	2884	msedge.exe	88
PID 2884 wrote to memory of 3864	2884	msedge.exe	89
PID 2884 wrote to memory of 4648	2884	msedge.exe	90
PID 2884 wrote to memory of 3864	2884	msedge.exe	89
PID 2884 wrote to memory of 3864	2884	msedge.exe	89
PID 2884 wrote to memory of 4648	2884	msedge.exe	90
PID 2884 wrote to memory of 4648	2884	msedge.exe	90
PID 2884 wrote to memory of 5044	2884	msedge.exe	91
PID 2884 wrote to memory of 5044	2884	msedge.exe	91
PID 2884 wrote to memory of 4896	2884	msedge.exe	92
PID 2884 wrote to memory of 5044	2884	msedge.exe	91
PID 2884 wrote to memory of 4896	2884	msedge.exe	92
PID 2884 wrote to memory of 4896	2884	msedge.exe	92
PID 2884 wrote to memory of 4044	2884	msedge.exe	96
PID 2884 wrote to memory of 4044	2884	msedge.exe	96
PID 2884 wrote to memory of 4044	2884	msedge.exe	96
PID 2884 wrote to memory of 4472	2884	msedge.exe	98
PID 2884 wrote to memory of 2512	2884	msedge.exe	99
PID 2884 wrote to memory of 4472	2884	msedge.exe	98
PID 2884 wrote to memory of 2512	2884	msedge.exe	99
PID 2884 wrote to memory of 4228	2884	msedge.exe	101
PID 2884 wrote to memory of 5116	2884	msedge.exe	110
PID 2884 wrote to memory of 2632	2884	msedge.exe	111
PID 2884 wrote to memory of 1148	2884	msedge.exe	112
PID 2884 wrote to memory of 1980	2884	msedge.exe	114
PID 2884 wrote to memory of 1980	2884	msedge.exe	114
PID 2884 wrote to memory of 1980	2884	msedge.exe	114
PID 2884 wrote to memory of 384	2884	msedge.exe	115
PID 2884 wrote to memory of 384	2884	msedge.exe	115
PID 2884 wrote to memory of 2384	2884	msedge.exe	116
PID 2884 wrote to memory of 2384	2884	msedge.exe	116
PID 2884 wrote to memory of 2456	2884	msedge.exe	117
PID 2884 wrote to memory of 2456	2884	msedge.exe	117
PID 2884 wrote to memory of 2456	2884	msedge.exe	117
PID 2884 wrote to memory of 5092	2884	msedge.exe	118
PID 2884 wrote to memory of 5092	2884	msedge.exe	118
PID 2884 wrote to memory of 4356	2884	msedge.exe	119
PID 2884 wrote to memory of 4356	2884	msedge.exe	119
PID 2884 wrote to memory of 4356	2884	msedge.exe	119
PID 3284 wrote to memory of 2560	3284	OpenWith.exe	125
PID 3832 wrote to memory of 2268	3832	OpenWith.exe	128
PID 2268 wrote to memory of 2276	2268	firefox.exe	130
PID 2268 wrote to memory of 2276	2268	firefox.exe	130
PID 2276 wrote to memory of 1552	2276	firefox.exe	132
PID 2276 wrote to memory of 1552	2276	firefox.exe	132
PID 2276 wrote to memory of 1552	2276	firefox.exe	132
PID 2276 wrote to memory of 3548	2276	firefox.exe	133
PID 2276 wrote to memory of 3548	2276	firefox.exe	133
PID 2276 wrote to memory of 3548	2276	firefox.exe	133
PID 2276 wrote to memory of 3548	2276	firefox.exe	133
PID 2276 wrote to memory of 2512	2276	firefox.exe	134
PID 2276 wrote to memory of 2512	2276	firefox.exe	134
PID 2276 wrote to memory of 2512	2276	firefox.exe	134
PID 2276 wrote to memory of 2512	2276	firefox.exe	134
PID 2276 wrote to memory of 4988	2276	firefox.exe	135
PID 2276 wrote to memory of 4988	2276	firefox.exe	135
PID 2276 wrote to memory of 4988	2276	firefox.exe	135
PID 2276 wrote to memory of 4220	2276	firefox.exe	136

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://h5.upjoyjoy.com/tnd/index.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ffbc930c188,0x7ffbc930c194,0x7ffbc930c1a0
  2⤵
  PID:3120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1740,i,15413841745154145919,1965612073236397941,262144 --field-trial-handle=2244,i,3001176629274470349,5738026230975833113,262144 --variations-seed-version --mojo-platform-channel-handle=2240 /prefetch:2
  2⤵
  PID:4020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1960,i,13035338168179647770,6656055403550697770,524288 --field-trial-handle=2244,i,3001176629274470349,5738026230975833113,262144 --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2516,i,18198837117344642108,8218511661953259698,524288 --field-trial-handle=2244,i,3001176629274470349,5738026230975833113,262144 --variations-seed-version --mojo-platform-channel-handle=2576 /prefetch:8
  2⤵
  PID:1552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3424,i,13747693677008445774,16747443933472630690,2097152 --field-trial-handle=2244,i,3001176629274470349,5738026230975833113,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:3864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3428,i,4668854603144602458,12264637399528067606,2097152 --field-trial-handle=2244,i,3001176629274470349,5738026230975833113,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:4648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4212,i,4370186649304333228,3913493399058108361,2097152 --field-trial-handle=2244,i,3001176629274470349,5738026230975833113,262144 --variations-seed-version --mojo-platform-channel-handle=4248 /prefetch:1
  2⤵
  PID:5044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4240,i,1700164541478365201,15156482264897140954,2097152 --field-trial-handle=2244,i,3001176629274470349,5738026230975833113,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:2
  2⤵
  PID:4896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3472,i,10837278086883570678,7214386148434625736,2097152 --field-trial-handle=2244,i,3001176629274470349,5738026230975833113,262144 --variations-seed-version --mojo-platform-channel-handle=5064 /prefetch:1
  2⤵
  PID:4044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5188,i,8813394200454821927,13672296250606804577,524288 --field-trial-handle=2244,i,3001176629274470349,5738026230975833113,262144 --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:8
  2⤵
  PID:4472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5284,i,9540501934606741805,16626221451928625833,524288 --field-trial-handle=2244,i,3001176629274470349,5738026230975833113,262144 --variations-seed-version --mojo-platform-channel-handle=5316 /prefetch:8
  2⤵
  PID:2512
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6064,i,12959868602504334915,1618695263044313214,524288 --field-trial-handle=2244,i,3001176629274470349,5738026230975833113,262144 --variations-seed-version --mojo-platform-channel-handle=6080 /prefetch:8
  2⤵
  PID:1100
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6064,i,12959868602504334915,1618695263044313214,524288 --field-trial-handle=2244,i,3001176629274470349,5738026230975833113,262144 --variations-seed-version --mojo-platform-channel-handle=6080 /prefetch:8
  2⤵
  PID:4228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6416,i,7368330264918073138,9622198695590655065,524288 --field-trial-handle=2244,i,3001176629274470349,5738026230975833113,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:8
  2⤵
  PID:5116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5044,i,15258859883549524580,12894371820369617013,524288 --field-trial-handle=2244,i,3001176629274470349,5738026230975833113,262144 --variations-seed-version --mojo-platform-channel-handle=6156 /prefetch:8
  2⤵
  PID:2632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4316,i,16700937460502662931,11925895514034548012,524288 --field-trial-handle=2244,i,3001176629274470349,5738026230975833113,262144 --variations-seed-version --mojo-platform-channel-handle=4800 /prefetch:8
  2⤵
  PID:1148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=5044,i,17899774529326587194,11650970751292964511,2097152 --field-trial-handle=2244,i,3001176629274470349,5738026230975833113,262144 --variations-seed-version --mojo-platform-channel-handle=6108 /prefetch:1
  2⤵
  PID:1980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5128,i,8084014173833399526,1678272958341641015,524288 --field-trial-handle=2244,i,3001176629274470349,5738026230975833113,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:8
  2⤵
  PID:384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5984,i,13893358034597733254,4950004194343560589,524288 --field-trial-handle=2244,i,3001176629274470349,5738026230975833113,262144 --variations-seed-version --mojo-platform-channel-handle=6012 /prefetch:8
  2⤵
  PID:2384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=5460,i,15580827090853420311,561172180014070618,2097152 --field-trial-handle=2244,i,3001176629274470349,5738026230975833113,262144 --variations-seed-version --mojo-platform-channel-handle=5440 /prefetch:1
  2⤵
  PID:2456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6156,i,12481816887076488470,5609949427127920974,524288 --field-trial-handle=2244,i,3001176629274470349,5738026230975833113,262144 --variations-seed-version --mojo-platform-channel-handle=6904 /prefetch:8
  2⤵
  PID:5092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=4776,i,16538399785366180109,18282769666952503633,2097152 --field-trial-handle=2244,i,3001176629274470349,5738026230975833113,262144 --variations-seed-version --mojo-platform-channel-handle=6928 /prefetch:1
  2⤵
  PID:4356

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2616

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\0d15f9bba562442dba7c93bf279b562d /t 3368 /p 2884
1⤵
PID:3572

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2272

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3284
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\master.apk.crdownload
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:2560

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3832
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\Downloads\master.apk.crdownload"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2268
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url C:\Users\Admin\Downloads\master.apk.crdownload
    3⤵
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2276
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2008 -prefsLen 27099 -prefMapHandle 2016 -prefMapSize 270279 -ipcHandle 2100 -initialChannelId {76d3a2f0-acfb-4829-90d7-bc9f657ce2e4} -parentPid 2276 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2276" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
      4⤵
      PID:1552
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2500 -prefsLen 27135 -prefMapHandle 2504 -prefMapSize 270279 -ipcHandle 2512 -initialChannelId {2177bec7-5f1b-4144-881a-06b3390107db} -parentPid 2276 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2276" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
      4⤵
      PID:3548
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3904 -prefsLen 27276 -prefMapHandle 3908 -prefMapSize 270279 -jsInitHandle 3912 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3920 -initialChannelId {3051e404-820d-403c-9c14-a34de038740f} -parentPid 2276 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2276" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
      4⤵
      Checks processor information in registry
      PID:2512
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4064 -prefsLen 27276 -prefMapHandle 4068 -prefMapSize 270279 -ipcHandle 4140 -initialChannelId {fa2d770c-58cc-4fd4-8998-13c3f054ce18} -parentPid 2276 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2276" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
      4⤵
      PID:4988
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3376 -prefsLen 34775 -prefMapHandle 3028 -prefMapSize 270279 -jsInitHandle 3100 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4332 -initialChannelId {aec5da61-f862-456e-86e6-0db4660dcaee} -parentPid 2276 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2276" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
      4⤵
      Checks processor information in registry
      PID:4220
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4956 -prefsLen 35012 -prefMapHandle 5116 -prefMapSize 270279 -ipcHandle 2808 -initialChannelId {d5280f00-43cc-4afb-a747-5638cc0979c7} -parentPid 2276 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2276" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
      4⤵
      Checks processor information in registry
      PID:5448
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5320 -prefsLen 32900 -prefMapHandle 5324 -prefMapSize 270279 -jsInitHandle 5328 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5336 -initialChannelId {69b1f1b6-c948-4406-88ef-aa5f2b754fe4} -parentPid 2276 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2276" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
      4⤵
      Checks processor information in registry
      PID:5628
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5380 -prefsLen 32900 -prefMapHandle 5384 -prefMapSize 270279 -jsInitHandle 5388 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5396 -initialChannelId {ce1bba23-a784-4dd8-bdf6-6acab2be775c} -parentPid 2276 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2276" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
      4⤵
      Checks processor information in registry
      PID:5636
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5752 -prefsLen 32952 -prefMapHandle 5756 -prefMapSize 270279 -jsInitHandle 5760 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5764 -initialChannelId {c3c2353a-6772-4170-94cd-7ea9ce1642af} -parentPid 2276 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2276" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
      4⤵
      Checks processor information in registry
      PID:5668

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\Downloads\master.apk.crdownload"
1⤵
PID:6068
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url C:\Users\Admin\Downloads\master.apk.crdownload
  2⤵
  - Checks processor information in registry
  PID:6088

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0cf4ba73-dffa-4d42-8c69-8ab5ae307b05.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\0cf4ba73-dffa-4d42-8c69-8ab5ae307b05.tmp
Size 18KB
SHA256 5508e3bd8dedd4193005b59f3149bd5b73d0b5ea799c63e9b88e1911516ff9e1
MD5 8b02bca4db93216c15e9dcf5338b18ed
SHA1 1d6643d69c0f283b576857249ca900e42f360661
SHA512 c9de32a08eee1b10d73a74f101f261f7d29f3151ed220edb7938c00d7d4fe02376090944ae3a0b8b0335988195a5d6708aff2df1d7e55c41ab0e415f2e72d492
SSDEEP 384:rQkUSv0sNAng292z5Hm7BGYX5EOv8bOXC42IpuCBIIlS:l0M292zYVGYuO2eC45puCBLI
TLSH
T173826C36ACB97C775EE2A150F50E35039FA8901BD7C86F90D6DD6F2C01DA198134BA27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

16dec52f-edff-4bee-bf84-8eedda5aa65d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\16dec52f-edff-4bee-bf84-8eedda5aa65d.tmp
Size 8KB
SHA256 f4887b63e97cff8d19fcb4ac90f8f75232c28a0554a64a372e9174f3759835f0
MD5 0ff93ccff7ea53a2d00ee23716360f9b
SHA1 de8d15ba5cfb6e98b7c363af46fb8c522b8a0b7e
SHA512 8e4ed32f3fc1ae7a674c0909b718fd5031f06d51f05f9b9266b70180d52eb29e374eab641ca63791080e8dedc5b6ee1f40f6ea46a2c3f1e7bce22f7300d82d9f
SSDEEP 192:LJONS6DphmqQmiUyaBq8wGYX59ezXCHjzor4Rukk7sFgU6:lONS619/RwGYX5EOv8R/U6
TLSH
T15F02E835A8787CBB5EE3AE45B54B36139FD8202BAA952F54D6EC1E1C00D764C1306937
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

286d6c78-cac4-4da1-ae11-57c2501bfaa7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\286d6c78-cac4-4da1-ae11-57c2501bfaa7.tmp
Size 8KB
SHA256 1cb4e8ff7303169efea0477fb76924f0043d06cbd7516ba2754a0e5f6c6c4942
MD5 b7d2519497535f4b8129eb64fa4dac5c
SHA1 2e00af7f9f16d01173e5d991060cbfbffa50b7a3
SHA512 1b398af384ffa6f3592e5f663b33f4ae522d3cca8ca14f3415b56c38823500184ddf5fc6f03e52cc54aabd5a4d123a1f2f438fa259df7e96ef6dfbd6427fa0c6
SSDEEP 192:kON56DphnqQmiUy3Ba2wGYX59ezXCHjzor4RyOX+eBkIIsmrq5HU6:kON5614WZwGYX5EOv8bOXk4U6
TLSH
T1DF121936A8B8BC7B1DD3A551B44B35139EA8512BEB896F50D6EC2F1C01EF19C130A937
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2d2054c8-3b79-4164-9c54-8a51c176caab.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\2d2054c8-3b79-4164-9c54-8a51c176caab.tmp
Size 21KB
SHA256 4c0def72f113f5a49e1256ecf9c50f718c759636bb3298ed3e264864e0a0e753
MD5 1fe1d050dd289b5d34a3267faf772ac8
SHA1 001d3aff7b7cb5ff6ad7ac3e7b93721c67c89b36
SHA512 fb1fd30a364d5645dc047ddc9cff29e77da3af63625cf717b44113e6d967e36099cf789b85fe7e41f63120b57e0914387e0c402b876c80a6f242e1c8447858ea
SSDEEP 384:niFzQkUSvYzsNA8TUNTUlIlig292z5HJ82BGYX5EOv8bOXP42IpuCBIIlS:iFdk9wgV292z38wGYuO2eP45puCBLI
TLSH
T1BAA25C379CA4AD7B9EE69A50F50E3103DEB45027CA99AB90E7CD6E1C01DB1CC134BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5cbdb232-5163-43ab-aa5a-565a3575f9b6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\5cbdb232-5163-43ab-aa5a-565a3575f9b6.tmp
Size 392B
SHA256 a9066a9b25608a1eaa0b3c823b1bb2383e57deda322d9c127d913cd7564de896
MD5 b5c295dbacb099f4611ccff9b79b09f4
SHA1 e79ac0b4e8a030067ceabd2d4911e06ffe02b4c9
SHA512 9d001e34e3d4ffe7c718a00949c8941c006cc441251c9d54accd7a47a64933237927461c0e9a0d7304a826080d9d9305025354c950d45fcc87cee74418e68a1d
TLSH
T15DE00403D31005D5D0F40730044F1D1155D3507001F303140D3001553C133011D34741
MD5 SHA1 SHA512 TLSH

Submit Download

cb78217d-3e71-4dd2-ba29-82c975a4463a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\cb78217d-3e71-4dd2-ba29-82c975a4463a.tmp
Size 105KB
SHA256 e2d1a78ddd4a2613e2e137a9b8a6ee6a025f24ce78c71783944f051445e3063d
MD5 a68138180bf134fe6e360a0e37c3184b
SHA1 359c64103a0eb1cbba384f963ad47bd6cac7e41c
SHA512 a8338bac44852d511db583b349822cd7e5ec3c426141655b68ecc184832731c5830c69e5af34998dd6e85c0ddb2400530e818deb283053d561c8afc2b615cacf
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P78:fwUQC5VwBIiElEd2K57P78
TLSH
T178B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 27f6aa5d39c98b4843eaed7972cf93d10e75e08f497afafa54ccf4057f6d52c9
MD5 a91eafa1aeb7b35d5c7abac6d2c83384
SHA1 a76b97105496dbfe28857282f5b661789a032b25
SHA512 4bebba8a121156a8e7e31bb49955c0375f1ca3be7dcd3c9b113d261a4618ecdf6781fce438d8e56020e438286e1619d3844f48e91b2b2c3cbb4a55d4c199972a
TLSH
T17AD02B24C9E41E90D0131434002241453F8CC03858023012D0B812AE15419D60A21020
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0e364ae2365b95ee5142a1a0abe3ee5065b85c554bc5cb9fcb1f31bcd0a1af4e
MD5 75bc6f9debcf49d2312740dfba56733a
SHA1 af0f5dfe4b330cf62c24c0003f6c57159b23e268
SHA512 c0a6cf9272c224460d1e7d25cf8159aa43733ebfb5f2761293ec6a5f2b4d71e061daa60092335856322f566a072c79184d7ad45d2b04b7cf8f3628e3a4bd4d35
TLSH
T176D02B2489E41E90D4131434002141453F8CC03858027113D0B812AE05429D60A21020
MD5 SHA1 SHA512 TLSH

Submit Download

309840bf-4dcd-412c-ad89-1e5832a0e46d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\309840bf-4dcd-412c-ad89-1e5832a0e46d.tmp
Size 10KB
SHA256 1bdcccf7892e91ad7b1d17f682be34805426337edf8feac76c3ae6bd9513b34b
MD5 f50f28ba5e604b538bc448250c6f8b03
SHA1 f450401f0453456b26d9f44d9eb7103071e0d74f
SHA512 95ab23070f5802b29a537acb54b3f77d36936e9d8a812726ecfc21b25a2b3be251d4a916830e957b0eac2b3baaf393ee23f1beaeecd63d5c790aac417d02b868
SSDEEP 192:sxZfRqWt/fSsNdbIdpPTHW6+WN5yT1xYgJxyRYIg5wJ:sxZfTt/fSsPErHbqxb6
TLSH
T1BD32C8566E38A97B8CCBD20DBA15BF13E6F9503252911E88A6FCC61C05E77DD220781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

35ce4d94-9921-4ab6-bc33-cc2bdc1e8129.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\35ce4d94-9921-4ab6-bc33-cc2bdc1e8129.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

4a2494e3-5882-4417-a6c5-92894471729c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4a2494e3-5882-4417-a6c5-92894471729c.tmp
Size 10KB
SHA256 d903a11bb1595f0c7724a30a4cbc7c7ff683fe9b7c181160ce38076ec750210c
MD5 1a8f849b883fbf8702711aa636c04797
SHA1 4f1123b56f01098107ce34a9fd70f89d20e32fdb
SHA512 01ed4c51266f7df392eaac11b2786e95fb11158e64d7e823ee516f882314e7cfd5276864b86d82d0affefad057c920606966308c73592d346859bb9f036fa66e
SSDEEP 192:sxZfRqnt/fSsNdbIdpPTHW6+WN5ixFYgZxyBYIg5wJ:sxZf2t/fSsPErHbSFD6
TLSH
T1B732C9566E38A97B8CCBD20DBA15BF13E6F9503251911E48A6FCC61C05E77DD220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5cb238ec-fca6-4418-b3a7-2e3edd60bee2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\5cb238ec-fca6-4418-b3a7-2e3edd60bee2.tmp
Size 10KB
SHA256 5a25bc31e049448bbbc6f85fe7dcdd49f5437ac0e63d0887fdd5c4fe4de48d4c
MD5 eeb8d84d5fd8bd7d96e9298b1039e2c2
SHA1 af2f8262e30fb9b97683d85062809ab8e6558118
SHA512 87141f14ba1fe78742485a0bd971c5c370c0c512c57a199c7917a94eb10fc2af0d570fc69e55e0e32035665c41f3ba8907bdf9d858356cfe884e12df16618951
SSDEEP 192:sxZfRqWt/fSsUd1IdpJAyHW6+WN5NIK/YgbXRYIgrJ:sxZfTt/fSskGOyHbLd/Q9
TLSH
T12422B9566E38A97B8CCBD20DBA19BB13D6F9503251941E58A6FCC61C04E66DD220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 3d37d52a58bc10374b80a9f93fe05b54d78d26eb487d7061038af875c499fe75
MD5 fa61ae9537af8c14539b729a99157071
SHA1 0b5ebbcd536baf3432e9dac267babdf68154079d
SHA512 2c07ebd502fd9b0facc43060dd966f30ec7deb6cd41d2ec32097e6af803805e9186db6d8e4e03041582b46b653f8c87a2a01953ad1f8ef6850d7a81cad4ee94f
TLSH
T17BE026E886C8C22EE209B54B027A578C8BA1371ADBC0F95E2B14F9CC7005058E3836D0
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 59dfbce508db4585e1e7bf24e1a19ec8cf1f705252b2f45b02588ef94feef723
MD5 4bab263dd262ca366b4c80d73be66907
SHA1 1f7e9ad2a6c2ef97e28c7d083744391ba90723ca
SHA512 d2a18d8f45204d4c38f427ceab2b807bf3de43927f56a7c3ff07b7072c91ad31e42403ae93ea24311e878ad3fe409e116cae14a8cc16af99e59050a26125e486
TLSH
T1D66196C037D8A278F7A081B486D921B3B5B895BB3C876F0B00E4F978550AB6A5D07F60
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 ab4528dae0a2efd15e5a30b0c2cdf18f52436a6532a59b09ee4664e079e96f6f
MD5 d01f4e51b6910af6f0f9a87abc1c3057
SHA1 e637b641f3247d67b0922bfa20095a8cf1174f38
SHA512 1dd2a11ec5d480b2aaa96dd45a4973b61b8e4b7c04e265c8cdbc80a8f8166beccd0930ebe7b8c2f4e968ad61465fbf8053c54f678fd784a39b69fe59d52be08b
TLSH
T1835197C467D8A678F75484B086D921B371F885BB3C875F0B00E4F979590E72B5D07B60
MD5 SHA1 SHA512 TLSH

Submit Download

cbeb4666-d368-4758-b84b-e85c7a0997a2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\cbeb4666-d368-4758-b84b-e85c7a0997a2.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

09d33245-341c-408c-807d-f8e85831c519.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\09d33245-341c-408c-807d-f8e85831c519.tmp
Size 3KB
SHA256 56b6f2ca001151c572fef6a7fd8d216eeb863e112068554cb4c3528c35636953
MD5 205e8af3e9ae33dba18936e09da25cdf
SHA1 0bf39d0bdaf5004d5abed76c9b647301e846c81a
SHA512 49447a1be38a0cbd82964456e776a39098054f9eb509d7fd4d42b3c8f9650facf36703fc8ab3806bb2c892180d3a9eb698df63b9214ad749b7d154105f53f0c8
TLSH
T1B8718BE3C7E8967D9C2552F0BA252D2FCD5A091553283D6B89E8AF8AD3F5031D2019CF
MD5 SHA1 SHA512 TLSH

Submit Download

446d6510-9bc2-41ae-b577-c2c650575565.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\446d6510-9bc2-41ae-b577-c2c650575565.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

b1db0608-8087-4ef4-8240-2f583900066c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\b1db0608-8087-4ef4-8240-2f583900066c.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 3731cbfc51ff96b452aa36a72bffd164b6830b4e4ca8209251b386d4b3ac8ba5
MD5 0a3939bf2a83693698c399e7599b8f5d
SHA1 b52f7a0477206c7afd493d6679c52f69f12fe2e0
SHA512 95060ed4e1dea3788f470728ed4c5b18fda5c9e17b9d3c9f53afce3aa2550b0a67d8e8b2884eb6cfa90d5e625c31c189042657c83c7b04be5f2904981288b620
SSDEEP 96:KjeX0QeEkxVwFsfIxKn4f+x7WO9IkS60wKVaagAKVmKc:ceX0QeEk7wF0Ia4f+tWO9IkSPSjc
TLSH
T1F291A340316F0641387D26488176862E125135F33018FA2B7FBC86E65E6FE05AEFE9D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 159B
SHA256 98573bfa2ba9fc36c321c15de2ba7f70eb9244a67407993b1cd23686744f69e0
MD5 f73ab54ef453a3a03fd5a92318a9e1b3
SHA1 f88c3c5d50a5cab03d95d99042ba0e3a276aa3e9
SHA512 2d8dfdc6071f4d4e590b0056a5293ea4b86bbda5f2f0335ef46eb49b10ae79e3d824d6caef6d817e961dea54ea91f820a142e795be0a99180efa941b4d8a600c
TLSH
T1F4C04CF7942589EFAB75A6E45025761DD5174E488CD4CDF4A41970122179A239803935
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt.tmp
Size 152B
SHA256 7e28557a434aee5caf5f5c110dd80dcbe5e1e2788064d590d2f8cbc835ca2f45
MD5 5318b982ae8de36d32f1f7e3da67ed57
SHA1 22685012288358edf3a7909fd72e2608cb125bef
SHA512 4ff9cb6d5b7a6f716626a07581ff13f0078f456e73af993fca069833e8e010fa6edbeae647f11bc8247038d7f58ac2bc415747b0b176c75a2c3d7345deb14d02
TLSH
T18DC04CF7442485EFAB74ABE85165B71ED507464C8CD4CDF4A41850122579B229813935
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt.tmp
Size 236B
SHA256 8f31538d4dbfa21ea5991679c11a68cdea0f23baebe2afbc86273696f2f2a762
MD5 9c0c2dd8c1a405ab4e8191e991044e12
SHA1 961a8974ae4a9031d9effa9cdc1353ff06534b2a
SHA512 101419b4ef44fb179904a0c51d1be1258b1fe63b60d4419ed89985552c234156a9c40598e1fc035d43432286a3eca4ca879583b12cba12efde6972709cc5488d
TLSH
T19BD0A7E78131C5DB7774ABE49524B20FC5074D1CDDC4CDE9941470123578B12D403935
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\IndexedDB\indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

aaf1a9af-3868-44e0-801f-7ba188233211.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\aaf1a9af-3868-44e0-801f-7ba188233211.tmp
Size 10KB
SHA256 ef3cc9d9ca751f9446c709acaa9c52762ac47b2b75f82d284261ae698a778734
MD5 0bba499c522d6b102313ed4c2494e778
SHA1 e78e1731d476289226866e5b03a8fab3cfa3ff20
SHA512 9c12a61ddffc78ac6ec9c43570bcfa6adac403db72cd122039ffc29cccb287e15f77457e756a2f1006ad15aa7a2818377948265026d7cada1cdf187533abfade
SSDEEP 192:sxZfRqWt/fSsed1IdpJAyHW6+WN5H8XYgCXRYIg5aJ:sxZfTt/fSsCGOyHbuXZg
TLSH
T10C22C8566E38A97B8CCBD20DBB19BF53D6F9503291901E98A6FCC61C04E67CD220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c7d1b9bb-e3c3-40f1-ad84-5350ef9fa234.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c7d1b9bb-e3c3-40f1-ad84-5350ef9fa234.tmp
Size 27KB
SHA256 7e327e479af785530d3d18431068b9c908721c2bb4577de31b22a363c48cd777
MD5 c4a3de3bfe93ff7d400b67791ebc651c
SHA1 c8d7be94e1094a7aeecdfbfb581d859cb7b3fae5
SHA512 42afc8fc81bdd983d5865da768d75bfa5be548ef75c78a9f20b41ea94222f93bb1f30e07b1441aaedab3e8acb662ca34cba4bf9b7d782185b50a0d9e7ff7e60a
SSDEEP 768:iDichfPWvPZpl8F1+UoAYDCx9Tuqh0VfUC9xbog/OVu+LlEKXzlroB1m:iDichfPWvPZplu1jan+LKgzejm
TLSH
T15FC2FA3B640CCB7E4FC01E5DDD5A6F9A7E9802C7A6588D4047FA984C02C77EE51264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c88b6a25-39fb-4106-b812-c7c6afe4699b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c88b6a25-39fb-4106-b812-c7c6afe4699b.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d84efa77-30ba-48ec-8dcc-bcb421898d5f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d84efa77-30ba-48ec-8dcc-bcb421898d5f.tmp
Size 10KB
SHA256 fd328b5b3fe6eab749a504eec67286071956868579856cb98b49b20c2a99aca4
MD5 8abe9dd600bc17bfd2cf77f807465fe7
SHA1 c71a7542b67c6678c536b841e8fae189284b3df3
SHA512 dd53312d2feaaaa4728096a7a251662584055cc9561c40af31ce6bc7f4abbded43432a903547580f661915bcbb2feaccea492741c89aab31cd2ddf87e7ebe38a
SSDEEP 192:sxZfRqWt/fSsNdNIdpJTHW6+WN5/kdYgdlRYIg5wJ:sxZfTt/fSsPuFHbudY6
TLSH
T11A22C8566E38697B8CCBD20DBB19BF13E6F9503251951E88A6FCC61C05E6BCD220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

e9293c41-9802-40ed-8d0f-37312d2de32b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\e9293c41-9802-40ed-8d0f-37312d2de32b.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 59ddf5bb390d61e7ad5b54742dbcab58097edb34c3a1d84eb6dc6e90103b3323
MD5 b81fb97332b67bd4d1ba6cc523094726
SHA1 dd868cd25d2449610c742f7620ae3e84d6d3b988
SHA512 e51c16da4cb358e07a675a7148503b3d9d603eb950f572a0c5e1cf2bf37629e10465b67ea8d022be179e951ad05aa1b5d6e54b4ac9941b97bbe8e695a0762ca0
MD5 SHA1 SHA512

Submit Download

c261777d-f13a-4094-ba82-6ed2cc83a577.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\c261777d-f13a-4094-ba82-6ed2cc83a577.tmp
Size 18KB
SHA256 8d0780cab3572483016f79ebb9d126a0812d60f1f023202266ece357a6475f4f
MD5 0147f8b66e2113d93fe0622c215cae09
SHA1 f99e8e43131fdf59817d52df20ed7c825b4fedd9
SHA512 d1004350af7230053d650166f3a73dd2c4e09e9561effd51078e08fa671fdac50d72720811912ff8470f04730e479a4978c5d47eb8db39d910b46cfeef811f68
SSDEEP 384:mQkUSv0sNAig292z5HJ82BGYX5EOv8bOXC42IpuCBIIlS:G0T292zb8wGYuO2eC45puCBLI
TLSH
T187826C36ACB97C774ED6A150F50E35039FA8901BDBC86F90D6DD6F2C01DA198234BA27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

28d97713-9d63-4cab-8344-7736cc2c217d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\28d97713-9d63-4cab-8344-7736cc2c217d.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 1ca2338071b7095cba35e1611658c7de49787662385497d4fdb18d6603f77782
MD5 d87480881b29494ed90249a134b6124e
SHA1 3840130b6b814964bdc59418bf26c84ebfeea7ac
SHA512 ead9299226f24ece5d7cb3e894ef60c4302bd094702f29da080839955088838bba9f3d8107b742d7121d4510adb79ec6eecdf1673b723c8233ce75dc4f2c7384
TLSH
T1E5414B5CA6E91108B3B77F4AABF7A86E447ABD372E0AD45E10110D4E0A27A41C871737
MD5 SHA1 SHA512 TLSH

Submit Download

activity-stream.contile.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\activity-stream.contile.json
Size 4KB
SHA256 4082febcab5972f203233424888bde67255c455bc4a3246ddbd869f95f593dc0
MD5 976a058bc8f7bd8e2523609ee4ff2a02
SHA1 cd5bc2b888540132e17bdba045f0e3964da4915c
SHA512 a7e70d8b9bd59ec2c8ff27168a09017baa5852268caeb2b66445feda28c8d79bdbffed56ada743a15e8997b4a49b669a533ad89c1db042d02edc6e7c9053483f
SSDEEP 96:TFGVMEIvMmPVCfAAT+mRIQnVo5jai9cqfklz:BYMEkM88fARmRIQV2jaiuqfkF
TLSH
T14391954F85648C966B30F5D6EC8B2398F107B406D9F08F9CB2759C6146787EBC1CB98A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\activity-stream.discovery_stream.json
Size 74KB
SHA256 756dd9977f448fead9fb915ac7b114046b2b0fe4852ed8c3071d6d50df261645
MD5 5b597fbca999f4e4b7176bcc4158b367
SHA1 8930abface9ebee40b5a39f12dd7b1fb5793da9d
SHA512 032d60bd83f45461d251a6d79e9a705ee074bdbbfdb175d39bbee540e27792d574d2c32aa56248f992ec867b9ed622490faba43a90e3cd10bef553158e0f6b1f
SSDEEP 768:QyXGiZ92ogrWWz5RHdQ5ecZEV7GEp4k45Qe44TMkNnvk89b9H6nL:LW69ICWPHd8iJqh44TMkl9BaL
TLSH
T17E7309A366E8B1BF1F903BD72C0B795766E50186E38505C8FDEECB0D81CD694123A5AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\activity-stream.discovery_stream.json
Size 75KB
SHA256 4690030884ba405d0a66b337ac0912df7a975ba2a60fb6a4eb699570598ae0ff
MD5 86e18a566a4a440592af060f08f7f4bc
SHA1 4710451dd6fe1157ab782682b34d704cb96af5b0
SHA512 d16c41ea184eeddc99f9f21800cf863af7ec45051677a8cb6f72fa8fd4c6638974f380630f8e1d681923e827879796acdbdaa05e483d8c978daf5c9b168bf0cb
SSDEEP 768:QygkIQsDsSOoPQG0zi+1du149C519iSS7dk4T84iROOrFKALDPSahXBOoQ:LgkQcV014kLy7e4IFvLTSahi
TLSH
T14D73F9A3A6A8B1FF0F9137C72C0F795B92E20185E34506C9EDADCD1CC1DD655123A6AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\startupCache\webext.sc.lz4
Size 105KB
SHA256 746c2dc4c57d963343bdfee963cae7394200f3b70adb69f43dc8bc46db0b57f4
MD5 275b0f33f05e90fc2fa9a344d4e2b090
SHA1 2a0e06f142d74952adebff86741f8cabcd32d62d
SHA512 0b77bff268bcc1ca7d760298329cd15e03e754bcbe40d5d21728225c1a0d339a08e3d49c67ebddb4124393df47906ac81fffb204dd7f15cb7e3d1e1b4d26562b
SSDEEP 3072:j3lj5uQdZXYMXv8uv27T5bOTvGscgl7c5i:pjvZXYAv/GgCsV
TLSH
T198B3AEF7DBA2C93D55FFD428AB82883EFD222054B3A73009C9636714A1C6F787675648
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 dc13f7a85a02aebe735d86263b6b7d454aade41d35cd2099802fab3198b9edd7
MD5 a608788df2b2d952562e692cff791030
SHA1 16d5cbb4f741c28af115395285fc343948ea06dd
SHA512 0dad94934f87a62eb3d1ef3cde588e8e7c3244bafe0703ecf36f253734f34c2e4b084ffd40b37dc5f04fa817d2651f43e349a157d54d7dabe06264f810aae19d
SSDEEP 192:eIh1d66JozGzgCl6mc0d7X9Ov5zbowbOVZyjifO:bd66JozGzgC1jkbowbO7yj
TLSH
T163D12164E628863FC048423BCDA61F444F76389B9C8E7F2931AC65482D5B3DE768D1BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 7cf4dffd12256bbad818d7db5b69c2d1b69e2edc7eee7703872530213f225de3
MD5 f16e623023dd5e30536b6990d4555208
SHA1 ceb094502c01f7069882b3beb63a3e4b3cdd2b6d
SHA512 be8a76b368b402587ec3c6e22e8ee10cc8d65995e4796a360840ca1f7f8e5aaa9e11cdd6a8873cfd3e7a844ca799e913744097597529eb1223f36ea3d3609609
SSDEEP 192:BX9Ov5zboPJZOVZyjifOaIh1d66JozGzgCl6mc0dz:AboxZO7yjZd66JozGzgC1jd
TLSH
T124E122A4E628863FC008027BCDA61F440F75389A9C8E7F29759C644C2D5B3DD768E1BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\datareporting\glean\events\events
Size 1KB
SHA256 ed45668eb13c2508ebdafba3f0b1bdfc6d1faf5839aaf7938ee030b918f4bba4
MD5 e126e2bd49cfaf50121c6115a78480ef
SHA1 d1b9d8b29e29f0a9758609a81b509116689fb219
SHA512 5de843a357779aa32500dd09a23e7fa3d33cef50faa07fdc6929db95e4687ce5359bcd14b10d307e4037b8779e50d042e3ae0d6ee26861884acb58804c2bcf92
TLSH
T15C115C5C3EF98D2AADCBE6AC7451128E93524E0B058B1D434D52DFCDCD81AE932AE43D
MD5 SHA1 SHA512 TLSH

Submit Download

1c728db1-c5e2-4f82-836c-af4e24e00acf

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\datareporting\glean\pending_pings\1c728db1-c5e2-4f82-836c-af4e24e00acf
Size 235B
SHA256 e7c45aac3987da681f41a710116c8589720adab1cee13c192317e7842bd1b06f
MD5 afcc187d27ac2a4495c9789478965c6d
SHA1 8d12b1805fcf6be37c85b042c8a2c0e11a492052
SHA512 1551bb94a5c4ef8c3e590321a002bd4ab19fbade1eb13ef3b3a04b94eead8b449f1cd32f2a51fd41f7886c4fa1c7bf5102c5c7a50fc63c772d40be6e0ec35e2e
TLSH
T159D097C024CC672C48104F0BB0E0A9C630484C3720686810F6A440B48AF9DE401A1A1A
MD5 SHA1 SHA512 TLSH

Submit Download

52cef387-b32c-429e-b16c-afa9916309dd

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\datareporting\glean\pending_pings\52cef387-b32c-429e-b16c-afa9916309dd
Size 235B
SHA256 5ace6f960d58f7a32a16a359373fad4a0f9550a96a9101ca94a866b586a8594f
MD5 93108232a913c059686ac2a83aa67d86
SHA1 30e09ab109d4de7539d5d9aba389281f0695ddc1
SHA512 0def5312f16861b2a8bd0a48d9d4f5d0a676217da00378ccc51c7ef3810cfe4fdc99ac8cf39606740cefa8fa2fb5db5577bb1b6ba5c6304758348b2e672126df
TLSH
T190D0978068ACA75C48044F03B0A06AD230554C3310706810E9904138AABEAC41171A2B
MD5 SHA1 SHA512 TLSH

Submit Download

5c6d2232-964c-4483-8f5b-fd676a731bf7

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\datareporting\glean\pending_pings\5c6d2232-964c-4483-8f5b-fd676a731bf7
Size 886B
SHA256 b61510c015cdca4dfe3df407c88e1fbe59b508d6c794694e0948265ec7a3a2aa
MD5 d7e4ee4d2ffc4fecba79d3f6ac222bd2
SHA1 d7578d5deeabc44b0d9af01112509ebf711f0bd7
SHA512 5b76f6a6ffc648edbb7495aa0d8fb449b1eb079ea243483e7b295f1939369966571fa672db8ad7b2ee579a18a07d454438b9498ea1283a1f7d68aa0da55afd7c
TLSH
T11A1100809634B9B2CC68D28BDAA077428BE4693380C958247F648F084DBE61EE367547
MD5 SHA1 SHA512 TLSH

Submit Download

62b6a89e-2bef-4282-94f4-c607f9555a7a

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\datareporting\glean\pending_pings\62b6a89e-2bef-4282-94f4-c607f9555a7a
Size 2KB
SHA256 38581516b6bff494eb2948e0905e581476c8701672165d2543649ac381e8ddac
MD5 d2eee0bd73a57c410f529d81426776f4
SHA1 c72c5a7dc0b7978a71da364b13759873315b1f3f
SHA512 26c50a8643ad8afd1cac1ea619470f57736c83c1b21d84d27d4bd4d5b81d98c20869698e6a018921a6aa3343b94fa812f05d2b549932c6ab7a545a928074f86c
TLSH
T12441415C76B89C379CDAE14D9692238E57A04E5300C218436E91EF4CCDF679A237B46B
MD5 SHA1 SHA512 TLSH

Submit Download

7b05137e-a9b2-4476-93cf-619b57b634e8

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\datareporting\glean\pending_pings\7b05137e-a9b2-4476-93cf-619b57b634e8
Size 883B
SHA256 c7d49764ccba8ab9ed37524e8f9f75f42d7586bfefa26ffedfe79e552598ce25
MD5 eae1266f53a37fd220a641cff63f8860
SHA1 30812754dccfe1007913b3517522ce1ef74d4e1d
SHA512 9505b6e2c5df57f77cefec6c98de2e1025c718c339cbff893fefc7939e1e2904182cf3e39b52de7c2d8e3d1552c97f85cf47050de6d0b1cfc4bfd4175229684d
TLSH
T15E112380E636B972CC68D24BCA7137015BE4783380C994283EB04E084D7EB1ED36B747
MD5 SHA1 SHA512 TLSH

Submit Download

f4294d25-b473-4c0b-a19f-aa5b5d46feda

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\datareporting\glean\pending_pings\f4294d25-b473-4c0b-a19f-aa5b5d46feda
Size 15KB
SHA256 b4d7d5e421f3753f3d264945209d3bd81e269bd3a2d252ee6e2d2c44948657f8
MD5 e5dd3efc1e055f6f3f85a135743d4ebe
SHA1 30009d23dc4aa5be59c4dd94d7b039595248c90b
SHA512 8c010459db96a3cd4b2f13de3ea52efbe185068f1386679752fc63645d733ea98d27b68615b8d66defa702e229a106199d8b27407387921cf019176e8766f02e
SSDEEP 192:2IDILY+3CStSAt71DOe34l0T11NDyB3CQfiN2tP9SAGWE1zvbH7Fze5RiWbci3:2y+y7At5OSaeRyFHQZC5RiWbcM
TLSH
T18072DA56286049BA8251E36994ECBFC3E5F538CF4C419FCECBE4BD0859DE06E112794B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\prefs.js
Size 6KB
SHA256 6b2d5c85d97d9a17e55611f821ac74bd691dacbb8dc4eea7d4b92f1976fbf7c2
MD5 5f2cdebbf1c071a1664507900b8fe560
SHA1 782b100e7c3f1b2ec9c21ef2c6defa95ce0194ca
SHA512 3fa09e3f3a2ec62b674d13126e55e4ab2d2cc41562bc2588cdc25fe64f4f334fda33d78b447081e174e50d860786b1b48e87bf3d3fc5f729986b92d2234cfe91
SSDEEP 96:xHYUTUzqGqZEfUUqK1zSnSSlSdv9jLRfnvHhW/YBw88n8L4cntGUI6:KORZEfUUqKiSS0Ho/YBw88n6
TLSH
T1D2E12E789008CB6F64B6776CAC688C316AB2413B7BBF28C750B594C4055CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\prefs.js
Size 6KB
SHA256 a9f60b12c7596609d997c6d0979747f812e3ca9026d3b4f94bea0ccba58d7f56
MD5 29202c27d971877d276e3ea9d55daba6
SHA1 7436cc61fea659b70b436ae8911dc38063fd2faf
SHA512 6356e11ecd75c5229162263dd6544a958a24cdcadadf0bf3accfe37f59371fb280f45a2bd5101cbd4e587931520117eda8cfc6bb89c1fc97a95081d8fd7d8df0
SSDEEP 96:xHYUTUzqGqZEfUpH1zSJSSlSdv9jdnvHhW/YBw88n8L4cntGUI6:KORZEfUpHoSSGo/YBw88n6
TLSH
T126E11E7890088B6F74B6776CAC688C316AB2413BBBBF28C750B584C5015CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\sessionCheckpoints.json
Size 90B
SHA256 00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2
MD5 c4ab2ee59ca41b6d6a6ea911f35bdc00
SHA1 5942cd6505fc8a9daba403b082067e1cdefdfbc4
SHA512 71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2
TLSH
T1D4B01205C8181030CD43140873743B429B2E00B231500100317CF88C203B0134556883
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\sessionCheckpoints.json
Size 53B
SHA256 792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da
MD5 ea8b62857dfdbd3d0be7d7e4a954ec9a
SHA1 b43bc4b3ea206a02ef8f63d5bfad0c96bf2a3b2a
SHA512 076ee83534f42563046d25086166f82e1a3ec61840c113aec67abe2d8195daa247d827d0c54e7e8f8a1bbf2d082a3763577587e84342ec160ff97905243e6d19
TLSH
T10190024AC8590431DE42251823647B90A61E04A254250101526CBC88046B0155486483
MD5 SHA1 SHA512 TLSH

Submit Download

targeting.snapshot.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\targeting.snapshot.json
Size 3KB
SHA256 3c08e4cf08fab5cf8cea969066d75578532cf871d3550adad1ad250ceb382b80
MD5 402c7a7ded36a27f17391e3c699477ae
SHA1 d68eb48b8928802993704acde6f7416ae0960f82
SHA512 0c2506af69c9ef513919349e15a77f7167937edeb85a5e6b34dd52d0e79f928baab76c3627712f0c92cf1d3df50dfebedbbd3dc3f1f387fc395720874ce6a6d1
TLSH
T14E71810C951CA4BEA66BC3C0D6847F978BBD053370407468DAFE460C45FB5FB162621B
MD5 SHA1 SHA512 TLSH

Submit Download

da10d806-f8f0-4752-9498-c2bc1c4646f5.tmp

Path C:\Users\Admin\Downloads\da10d806-f8f0-4752-9498-c2bc1c4646f5.tmp
Size 16KB
SHA256 26593fe93e0c3dc2b9cf3d1cf71771f64338f436d382703fc90d299ce496b10d
MD5 660c7cc1734d9c16973c7ef15276ecfd
SHA1 67ce1b0d4491e93ae5564e577a442b60e9d38b14
SHA512 f114e066de1532a3a92926f903baf650b2b14259e14afe0c3ff8e34a1d76923adc039d5e13052fc65045581493180d4ba64f7ca346a590560eaae705e9f0223a
SSDEEP 384:GwrxegS34Baamb1h8uMp2OLCzcTiz2aW5XWw:n9egS34xRuMYKE2rpXj
TLSH
T18872AFD7803EFDDE92A472B10A465962C26D1AA490FE7D0F49E2DE4C213CAC425E635F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads