19183c3552bad74cb77748e4dc2e753b4434e0f6d811edf5dc90c03cd739ef34

Analysis

max time kernel
149s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
05/09/2024, 04:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
xePixTvx V18 + Injector/data/mod/AI/dvar_defaults.vbs
Size 380B
Sample240905-enyl9atepd
SHA256 3c54bda1cb2c06206535fe653a431f4d2dad3b78f0d9e12db0b4b1a9754dcc63
MD5 35be91e91d41f4161e711b016f7e5e21
SHA1 63ed6253e9adc2ede41fd1dd3923fdd851d48327
SHA512 d05b0566508a53742d1cf0514228d9afe1f4ac26fac9c5acd74426618d5955967ae9ef6f35437e30a90e790c239f31fe259a08daed6944c5754101796c958f7c
MD5 SHA1 SHA512

Score

7^/10

steam defense_evasion discovery persistence phishing

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
1452	SteamSetup.exe
788	steamservice.exe
1708	steam.exe

Loads dropped DLL 8 IoCs

pid	Process
1452	SteamSetup.exe
1452	SteamSetup.exe
1452	SteamSetup.exe
1452	SteamSetup.exe
1452	SteamSetup.exe
1452	SteamSetup.exe
1452	SteamSetup.exe
1452	SteamSetup.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000\Software\Microsoft\Windows\CurrentVersion\Run\Steam = "\"C:\\Program Files (x86)\\Steam\\steam.exe\" -silent"	SteamSetup.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Detected potential entity reuse from brand steam.
phishing steam

Drops file in Program Files directory 51 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Steam\public\steambootstrapper_german.txt	SteamSetup.exe
File created	C:\Program Files (x86)\Steam\public\steambootstrapper_polish.txt	SteamSetup.exe
File created	C:\Program Files (x86)\Steam\public\steambootstrapper_russian.txt	SteamSetup.exe
File created	C:\Program Files (x86)\Steam\uninstall.exe	SteamSetup.exe
File created	C:\Program Files (x86)\Steam\package\resources_hidpi_all.zip.vz.3de815c3117712cb9eeb7ea4c8b275faf481dcfd_56342	steam.exe
File created	C:\Program Files (x86)\Steam\public\steambootstrapper_english.txt	SteamSetup.exe
File created	C:\Program Files (x86)\Common Files\Steam\steamservice.exe	steamservice.exe
File created	C:\Program Files (x86)\Steam\logs\bootstrap_log.txt	steam.exe
File created	C:\Program Files (x86)\Steam\.writable	steam.exe
File created	C:\Program Files (x86)\Steam\package\resources_misc_all.zip.vz.e86a975545f3ab21a77373870cb311ef93934b8c_2224876	steam.exe
File created	C:\Program Files (x86)\Steam\Steam.exe	SteamSetup.exe
File created	C:\Program Files (x86)\Steam\public\steambootstrapper_turkish.txt	SteamSetup.exe
File created	C:\Program Files (x86)\Steam\package\resources_all.zip.vz.3c8b3203e5c69d75ea0684c2409b86fe4d0d6f83_2856188	steam.exe
File created	C:\Program Files (x86)\Steam\public\steambootstrapper_czech.txt	SteamSetup.exe
File created	C:\Program Files (x86)\Steam\public\steambootstrapper_tchinese.txt	SteamSetup.exe
File created	C:\Program Files (x86)\Steam\public\steambootstrapper_swedish.txt	SteamSetup.exe
File created	C:\Program Files (x86)\Steam\public\steambootstrapper_thai.txt	SteamSetup.exe
File created	C:\Program Files (x86)\Steam\public\steambootstrapper_bulgarian.txt	SteamSetup.exe
File created	C:\Program Files (x86)\Steam\public\steambootstrapper_italian.txt	SteamSetup.exe
File created	C:\Program Files (x86)\Steam\public\steambootstrapper_koreana.txt	SteamSetup.exe
File opened for modification	C:\Program Files (x86)\Common Files\Steam\steamservice.exe	steamservice.exe
File created	C:\Program Files (x86)\Steam\public\steambootstrapper_portuguese.txt	SteamSetup.exe
File opened for modification	C:\Program Files (x86)\Steam\logs\bootstrap_log.txt	steam.exe
File created	C:\Program Files (x86)\Steam\package\strings_en_all.zip.8ebfe5f184cbfe30df39a3dde48e35ccbe8f2da9	steam.exe
File created	C:\Program Files (x86)\Steam\public\steambootstrapper_hungarian.txt	SteamSetup.exe
File created	C:\Program Files (x86)\Steam\public\steambootstrapper_french.txt	SteamSetup.exe
File created	C:\Program Files (x86)\Steam\public\steambootstrapper_vietnamese.txt	SteamSetup.exe
File created	C:\Program Files (x86)\Steam\bin\SteamService.exe	SteamSetup.exe
File created	C:\Program Files (x86)\Steam\public\steambootstrapper_finnish.txt	SteamSetup.exe
File created	C:\Program Files (x86)\Steam\package\steamui_websrc_movies_all.zip.4d2183b0476852dfb695b8d70192a0ccece8c7d0	steam.exe
File created	C:\Program Files (x86)\Steam\public\steambootstrapper_romanian.txt	SteamSetup.exe
File created	C:\Program Files (x86)\Steam\package\strings_all.zip.vz.3b383251b8bf5cca5bd408c9d2864bc078e6d5b2_1993958	steam.exe
File created	C:\Program Files (x86)\Steam\public\steambootstrapper_brazilian.txt	SteamSetup.exe
File created	C:\Program Files (x86)\Steam\public\steambootstrapper_latam.txt	SteamSetup.exe
File created	C:\Program Files (x86)\Steam\package\tenfoot_images_all.zip.vz.193cb8c4eb4446698ea2c0a9e8c4e6b6a623dac7_5572671	steam.exe
File created	C:\Program Files (x86)\Steam\package\bins_codecs_win32.zip.vz.c5ee0d04a6e0bff812ccb807811ce984d9dbf693_5122896	steam.exe
File created	C:\Program Files (x86)\Steam\public\steambootstrapper_indonesian.txt	SteamSetup.exe
File created	C:\Program Files (x86)\Steam\public\steambootstrapper_korean.txt	SteamSetup.exe
File created	C:\Program Files (x86)\Steam\public\steambootstrapper_ukrainian.txt	SteamSetup.exe
File created	C:\Program Files (x86)\Steam\package\public_all.zip.vz.aa9ecccb35e9a29e3145d96f63e00eb525aa9b93_23521009	steam.exe
File created	C:\Program Files (x86)\Steam\public\steambootstrapper_danish.txt	SteamSetup.exe
File created	C:\Program Files (x86)\Steam\public\steambootstrapper_norwegian.txt	SteamSetup.exe
File created	C:\Program Files (x86)\Steam\public\steambootstrapper_japanese.txt	SteamSetup.exe
File created	C:\Program Files (x86)\Steam\public\steambootstrapper_spanish.txt	SteamSetup.exe
File opened for modification	C:\Program Files (x86)\Steam\.crash	steam.exe
File created	C:\Program Files (x86)\Steam\public\steambootstrapper_dutch.txt	SteamSetup.exe
File created	C:\Program Files (x86)\Steam\public\steambootstrapper_greek.txt	SteamSetup.exe
File created	C:\Program Files (x86)\Steam\package\bins_misc_win32.zip.vz.115bcc9d9de122c32d8d720978aab0d2b57cbd2e_10645799	steam.exe
File created	C:\Program Files (x86)\Steam\package\bins_cef_win32_win7.zip.vz.5376139cd5567f2b1e3e8bf6214e993d3e25dea3_84311635	steam.exe
File created	C:\Program Files (x86)\Steam\public\steambootstrapper_schinese.txt	SteamSetup.exe
File created	C:\Program Files (x86)\Steam\package\steamui_websrc_sounds_all.zip.vz.a2b25775b33d943e54c45d176558de379111ef5f_3220470	steam.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	UserOOBEBroker.exe
File opened for modification	C:\Windows\Logs\DISM\dism.log	dismhost.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setupact.log	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	UserOOBEBroker.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\SteamSetup.exe:Zone.Identifier	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FileCoAuth.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SteamSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	steamservice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	steam.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	steam.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	steam.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 42 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steam\ = "URL:steam protocol"	steamservice.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\steam\DefaultIcon\ = "steam.exe"	steamservice.exe
Key created	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\steamlink\DefaultIcon	steamservice.exe
Key created	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\steamlink\Shell	steamservice.exe
Key created	\REGISTRY\MACHINE\Software\Classes\steamlink\DefaultIcon	steamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\steamlink\Shell	steamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\steamlink\Shell\Open	steamservice.exe
Key created	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\steam	steamservice.exe
Key created	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\steam\DefaultIcon	steamservice.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\steamlink\URL Protocol	steamservice.exe
Key created	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\steamlink\Shell\Open\Command	steamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\steam	steamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\steam\Shell\Open	steamservice.exe
Key created	\REGISTRY\MACHINE\Software\Classes\steamlink\Shell\Open\Command	steamservice.exe
Key created	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\steam\Shell\Open\Command	steamservice.exe
Key created	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\steamlink\Shell\Open	steamservice.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-242286936-336880687-2152680090-1000\{3AA1E3A0-A3F0-4988-B227-466C5116310D}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\steamlink	steamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steamlink\URL Protocol	steamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\steamlink\Shell\Open\Command	steamservice.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\steam\Shell\Open\Command\ = "\"C:\\Program Files (x86)\\Steam\\steam.exe\" -- \"%1\""	steamservice.exe
Key created	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\steamlink	steamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steamlink\ = "URL:steamlink protocol"	steamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\steamlink	steamservice.exe
Key created	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\steam\Shell	steamservice.exe
Key created	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\steam\Shell\Open	steamservice.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-242286936-336880687-2152680090-1000\{4B159E81-D62C-4B26-A93D-78EF2EA0B9C9}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\steam	steamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steam\DefaultIcon\ = "steam.exe"	steamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steam\Shell\Open\Command\ = "\"C:\\Program Files (x86)\\Steam\\steam.exe\" -- \"%1\""	steamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steamlink\DefaultIcon\ = "steam.exe"	steamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steamlink\Shell\Open\Command\ = "\"C:\\Program Files (x86)\\Steam\\steam.exe\" -- \"%1\""	steamservice.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\steam\ = "URL:steam protocol"	steamservice.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\steamlink\DefaultIcon\ = "steam.exe"	steamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steam\URL Protocol	steamservice.exe
Key created	\REGISTRY\MACHINE\Software\Classes\steam\DefaultIcon	steamservice.exe
Key created	\REGISTRY\MACHINE\Software\Classes\steam\Shell\Open\Command	steamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\steam\Shell	steamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\steam\Shell\Open\Command	steamservice.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\steam\URL Protocol	steamservice.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\steamlink\ = "URL:steamlink protocol"	steamservice.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\steamlink\Shell\Open\Command\ = "\"C:\\Program Files (x86)\\Steam\\steam.exe\" -- \"%1\""	steamservice.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\SteamSetup.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 867556.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 43 IoCs

pid	Process
4008	msedge.exe
4008	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4356	msedge.exe
4356	msedge.exe
1512	identity_helper.exe
1512	identity_helper.exe
1412	msedge.exe
1412	msedge.exe
1512	msedge.exe
1512	msedge.exe
1792	msedge.exe
1792	msedge.exe
4208	msedge.exe
4208	msedge.exe
2704	identity_helper.exe
2704	identity_helper.exe
2468	msedge.exe
2468	msedge.exe
4620	msedge.exe
4620	msedge.exe
1452	SteamSetup.exe
1452	SteamSetup.exe
1452	SteamSetup.exe
1452	SteamSetup.exe
1452	SteamSetup.exe
1452	SteamSetup.exe
1452	SteamSetup.exe
1452	SteamSetup.exe
1452	SteamSetup.exe
1452	SteamSetup.exe
1452	SteamSetup.exe
1452	SteamSetup.exe
1452	SteamSetup.exe
1452	SteamSetup.exe
1452	SteamSetup.exe
1452	SteamSetup.exe
1452	SteamSetup.exe
1452	SteamSetup.exe
1452	SteamSetup.exe
1452	SteamSetup.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 23 IoCs

pid	Process
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
1512	msedge.exe
1512	msedge.exe
1512	msedge.exe
1512	msedge.exe
1512	msedge.exe
1512	msedge.exe
1512	msedge.exe
1512	msedge.exe
1512	msedge.exe
1512	msedge.exe
1512	msedge.exe
1512	msedge.exe
1512	msedge.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeBackupPrivilege	4052	vssvc.exe
Token: SeRestorePrivilege	4052	vssvc.exe
Token: SeAuditPrivilege	4052	vssvc.exe
Token: SeSecurityPrivilege	788	steamservice.exe
Token: SeSecurityPrivilege	788	steamservice.exe

Suspicious use of FindShellTrayWindow 61 IoCs

pid	Process
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
1512	msedge.exe
1512	msedge.exe
1512	msedge.exe
1512	msedge.exe
1512	msedge.exe
1512	msedge.exe
1512	msedge.exe
1512	msedge.exe
1512	msedge.exe
1512	msedge.exe
1512	msedge.exe
1512	msedge.exe
1512	msedge.exe
1512	msedge.exe
1512	msedge.exe
1512	msedge.exe
1512	msedge.exe
1512	msedge.exe
1512	msedge.exe
1512	msedge.exe
1512	msedge.exe
1512	msedge.exe
1512	msedge.exe
1512	msedge.exe
1512	msedge.exe
1512	msedge.exe
1512	msedge.exe
1512	msedge.exe
1512	msedge.exe
1512	msedge.exe
1512	msedge.exe
1512	msedge.exe
1512	msedge.exe
1512	msedge.exe
1512	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
1512	msedge.exe
1512	msedge.exe
1512	msedge.exe
1512	msedge.exe
1512	msedge.exe
1512	msedge.exe
1512	msedge.exe
1512	msedge.exe
1512	msedge.exe
1512	msedge.exe
1512	msedge.exe
1512	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1452	SteamSetup.exe
788	steamservice.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4820 wrote to memory of 3084	4820	msedge.exe	81
PID 4820 wrote to memory of 3084	4820	msedge.exe	81
PID 4820 wrote to memory of 4628	4820	msedge.exe	82
PID 4820 wrote to memory of 4628	4820	msedge.exe	82
PID 4820 wrote to memory of 4628	4820	msedge.exe	82
PID 4820 wrote to memory of 4628	4820	msedge.exe	82
PID 4820 wrote to memory of 4628	4820	msedge.exe	82
PID 4820 wrote to memory of 4628	4820	msedge.exe	82
PID 4820 wrote to memory of 4628	4820	msedge.exe	82
PID 4820 wrote to memory of 4628	4820	msedge.exe	82
PID 4820 wrote to memory of 4628	4820	msedge.exe	82
PID 4820 wrote to memory of 4628	4820	msedge.exe	82
PID 4820 wrote to memory of 4628	4820	msedge.exe	82
PID 4820 wrote to memory of 4628	4820	msedge.exe	82
PID 4820 wrote to memory of 4628	4820	msedge.exe	82
PID 4820 wrote to memory of 4628	4820	msedge.exe	82
PID 4820 wrote to memory of 4628	4820	msedge.exe	82
PID 4820 wrote to memory of 4628	4820	msedge.exe	82
PID 4820 wrote to memory of 4628	4820	msedge.exe	82
PID 4820 wrote to memory of 4628	4820	msedge.exe	82
PID 4820 wrote to memory of 4628	4820	msedge.exe	82
PID 4820 wrote to memory of 4628	4820	msedge.exe	82
PID 4820 wrote to memory of 4628	4820	msedge.exe	82
PID 4820 wrote to memory of 4628	4820	msedge.exe	82
PID 4820 wrote to memory of 4628	4820	msedge.exe	82
PID 4820 wrote to memory of 4628	4820	msedge.exe	82
PID 4820 wrote to memory of 4628	4820	msedge.exe	82
PID 4820 wrote to memory of 4628	4820	msedge.exe	82
PID 4820 wrote to memory of 4628	4820	msedge.exe	82
PID 4820 wrote to memory of 4628	4820	msedge.exe	82
PID 4820 wrote to memory of 4628	4820	msedge.exe	82
PID 4820 wrote to memory of 4628	4820	msedge.exe	82
PID 4820 wrote to memory of 4628	4820	msedge.exe	82
PID 4820 wrote to memory of 4628	4820	msedge.exe	82
PID 4820 wrote to memory of 4628	4820	msedge.exe	82
PID 4820 wrote to memory of 4628	4820	msedge.exe	82
PID 4820 wrote to memory of 4628	4820	msedge.exe	82
PID 4820 wrote to memory of 4628	4820	msedge.exe	82
PID 4820 wrote to memory of 4628	4820	msedge.exe	82
PID 4820 wrote to memory of 4628	4820	msedge.exe	82
PID 4820 wrote to memory of 4628	4820	msedge.exe	82
PID 4820 wrote to memory of 4628	4820	msedge.exe	82
PID 4820 wrote to memory of 4008	4820	msedge.exe	83
PID 4820 wrote to memory of 4008	4820	msedge.exe	83
PID 4820 wrote to memory of 4536	4820	msedge.exe	84
PID 4820 wrote to memory of 4536	4820	msedge.exe	84
PID 4820 wrote to memory of 4536	4820	msedge.exe	84
PID 4820 wrote to memory of 4536	4820	msedge.exe	84
PID 4820 wrote to memory of 4536	4820	msedge.exe	84
PID 4820 wrote to memory of 4536	4820	msedge.exe	84
PID 4820 wrote to memory of 4536	4820	msedge.exe	84
PID 4820 wrote to memory of 4536	4820	msedge.exe	84
PID 4820 wrote to memory of 4536	4820	msedge.exe	84
PID 4820 wrote to memory of 4536	4820	msedge.exe	84
PID 4820 wrote to memory of 4536	4820	msedge.exe	84
PID 4820 wrote to memory of 4536	4820	msedge.exe	84
PID 4820 wrote to memory of 4536	4820	msedge.exe	84
PID 4820 wrote to memory of 4536	4820	msedge.exe	84
PID 4820 wrote to memory of 4536	4820	msedge.exe	84
PID 4820 wrote to memory of 4536	4820	msedge.exe	84
PID 4820 wrote to memory of 4536	4820	msedge.exe	84
PID 4820 wrote to memory of 4536	4820	msedge.exe	84
PID 4820 wrote to memory of 4536	4820	msedge.exe	84
PID 4820 wrote to memory of 4536	4820	msedge.exe	84

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\xePixTvx V18 + Injector\data\mod\AI\dvar_defaults.vbs"
1⤵
PID:3904

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffe08bb3cb8,0x7ffe08bb3cc8,0x7ffe08bb3cd8
  2⤵
  PID:3084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1904,759983369487159224,6132129746930495588,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1772 /prefetch:2
  2⤵
  PID:4628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1904,759983369487159224,6132129746930495588,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2284 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1904,759983369487159224,6132129746930495588,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2500 /prefetch:8
  2⤵
  PID:4536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,759983369487159224,6132129746930495588,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:1
  2⤵
  PID:2704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,759983369487159224,6132129746930495588,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:4920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,759983369487159224,6132129746930495588,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4908 /prefetch:1
  2⤵
  PID:900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,759983369487159224,6132129746930495588,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4928 /prefetch:1
  2⤵
  PID:5088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1904,759983369487159224,6132129746930495588,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3220 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4356
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1904,759983369487159224,6132129746930495588,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5348 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,759983369487159224,6132129746930495588,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4032 /prefetch:1
  2⤵
  PID:3476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,759983369487159224,6132129746930495588,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4600 /prefetch:1
  2⤵
  PID:4980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1904,759983369487159224,6132129746930495588,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5356 /prefetch:8
  2⤵
  PID:2552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1904,759983369487159224,6132129746930495588,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=4032 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:1412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,759983369487159224,6132129746930495588,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5428 /prefetch:1
  2⤵
  PID:3092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,759983369487159224,6132129746930495588,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5412 /prefetch:1
  2⤵
  PID:3320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,759983369487159224,6132129746930495588,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4832 /prefetch:1
  2⤵
  PID:2772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,759983369487159224,6132129746930495588,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5884 /prefetch:1
  2⤵
  PID:2372

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3856

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1040

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:4940

C:\Windows\System32\oobe\UserOOBEBroker.exe
C:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding
1⤵
- Drops file in Windows directory
PID:764

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
1⤵
- System Location Discovery: System Language Discovery
PID:3904

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4052

C:\Users\Admin\AppData\Local\Temp\D27024A3-0F62-473E-AF6D-E508BFA289BD\dismhost.exe
C:\Users\Admin\AppData\Local\Temp\D27024A3-0F62-473E-AF6D-E508BFA289BD\dismhost.exe {1FF29D38-CD09-4A2C-A1CD-1F8E97D69A37}
1⤵
- Drops file in Windows directory
PID:2860

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffe08bb3cb8,0x7ffe08bb3cc8,0x7ffe08bb3cd8
  2⤵
  PID:3464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1888,10259322826603228856,13858128844946761551,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1908 /prefetch:2
  2⤵
  PID:400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1888,10259322826603228856,13858128844946761551,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2372 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1888,10259322826603228856,13858128844946761551,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2544 /prefetch:8
  2⤵
  PID:2972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,10259322826603228856,13858128844946761551,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:3152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,10259322826603228856,13858128844946761551,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
  2⤵
  PID:3656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,10259322826603228856,13858128844946761551,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4356 /prefetch:1
  2⤵
  PID:1312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,10259322826603228856,13858128844946761551,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4864 /prefetch:1
  2⤵
  PID:3696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1888,10259322826603228856,13858128844946761551,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5072 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4208
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1888,10259322826603228856,13858128844946761551,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5332 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,10259322826603228856,13858128844946761551,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3428 /prefetch:1
  2⤵
  PID:3524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,10259322826603228856,13858128844946761551,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3980 /prefetch:1
  2⤵
  PID:3028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,10259322826603228856,13858128844946761551,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4840 /prefetch:1
  2⤵
  PID:4008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,10259322826603228856,13858128844946761551,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4268 /prefetch:1
  2⤵
  PID:4612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1888,10259322826603228856,13858128844946761551,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3460 /prefetch:8
  2⤵
  PID:4152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1888,10259322826603228856,13858128844946761551,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=4344 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:2468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,10259322826603228856,13858128844946761551,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5496 /prefetch:1
  2⤵
  PID:748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,10259322826603228856,13858128844946761551,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5732 /prefetch:1
  2⤵
  PID:832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,10259322826603228856,13858128844946761551,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5588 /prefetch:1
  2⤵
  PID:1404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,10259322826603228856,13858128844946761551,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2516 /prefetch:1
  2⤵
  PID:1472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1888,10259322826603228856,13858128844946761551,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5600 /prefetch:8
  2⤵
  PID:2672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,10259322826603228856,13858128844946761551,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3980 /prefetch:1
  2⤵
  PID:2440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1888,10259322826603228856,13858128844946761551,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3352 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:4620
- C:\Users\Admin\Downloads\SteamSetup.exe
  "C:\Users\Admin\Downloads\SteamSetup.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:1452
- - C:\Program Files (x86)\Steam\bin\steamservice.exe
    "C:\Program Files (x86)\Steam\bin\steamservice.exe" /Install
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:788

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1056

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4964

C:\Program Files (x86)\Steam\steam.exe
"C:\Program Files (x86)\Steam\steam.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
PID:1708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Steam.exe

Path C:\Program Files (x86)\Steam\Steam.exe
Size 4.2MB
SHA256 12222b0908eb69581985f7e04aa6240e928fb08aa5a3ec36acae3440633c9eb1
MD5 33bcb1c8975a4063a134a72803e0ca16
SHA1 ed7a4e6e66511bb8b3e32cbfb5557ebcb4082b65
SHA512 13f3a7d6215bb4837ea0a1a9c5ba06a985e0c80979c25cfb526a390d71a15d1737c0290a899f4705c2749982c9f6c9007c1751fef1a97b12db529b2f33c97b49
SSDEEP 98304:7JeV/ztZBe91oiImuUiK9N9EGQKF9lSHbr7aw:1S/hwkmg4EpbrOw
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 e9784fcff01f83f4925f23e3a24bce63314ea503c2091f7309c014895fead33c
MD5 2ee16858e751901224340cabb25e5704
SHA1 24e0d2d301f282fb8e492e9df0b36603b28477b2
SHA512 bd9994c2fb4bf097ce7ffea412a2bed97e3af386108ab6aab0df9472a92d4bd94489bb9c36750a92f9818fa3ea6d1756497f5364611e6ebd36de4cd14e9a0fba
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 9e7e47ebf490ba409eab3be0314fa695bf28f4764f4875c7568a54337f2df70f
MD5 ea667b2dedf919487c556b97119cf88a
SHA1 0ee7b1da90be47cc31406f4dba755fd083a29762
SHA512 832391afcac34fc6c949dee8120f2a5f83ca68c159ff707751d844b085c7496930f0c8fd8313fd8f10a5f5725138be651953934aa79b087ba3c6dd22eaa49c72
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 9cbce400d454772a53244742417a4e6b0bd766558a47887bc70009c1a42f7a5b
MD5 eabf916abbaf5373bca47391c71b245f
SHA1 fb1950bb8c394e61abcf86b84e3edb1e32e918d1
SHA512 d642e233aa4b742747f28577018e62e5d2653984372484cb6243487364dc4970b868a759fc25e8de8664cf1b3078ff7804c8a253084d89c7e3a28300ebe0da85
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_0
Size 44KB
SHA256 c06d5af50bb51db462ca0a2c445b63f629949fd1e4cbe055cff087ab1c110dc7
MD5 301b696f603cd042ad47bdcd07c15fe9
SHA1 89af8720d3f00a781ac340aebea1c9a725a38aff
SHA512 5f6b2b9440018e5ba15676e0c8751bc4014b648bfd9931cbaa105057e541aacfb38c83e7aae79e966d1adbce556a025951588de98bd7669e5cdb4a6224ab0e97
SSDEEP 192:9bmRdtpTIgCNRfHRPpTIlC4RLYGDCt/F61C43YgnZUU9BsZYW:9bmftR7GfHRPK8ILYGDGF61C4ogni2s
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_1
Size 264KB
SHA256 fa044600ca3629cbb85dc216f2eca463aed301336a4363ad63e534f09f4523e9
MD5 3c1c78004a59330b0df9066d36a30e83
SHA1 b965d9f4dc64fb6d96b428e332f018f0adf433f8
SHA512 1d02774c2745065b4fc7e9d08dd4a2d25b682cb982c7d3c0c909de95a78120dbbf8f0f5ec38938f123169e92051d0a84230d05b0b29231adc31aa992b60181d2
SSDEEP 1536:3Ii0CAyHQxBwtAjB9P3Yka61sHxbi59vyFUN3YtMifmMWf8V0bKpKMZO:3KjfFa61ixO573YtVfmMW5
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_2
Size 1.0MB
SHA256 d8057270c19c8090e21d1636bd8840ae7c8e0a2cedb3890d5da054119d75c3e4
MD5 f5ac75abb0e5ffb0cb4baf2517dffdf3
SHA1 49360f0f289abfa0aa5e29e7ed8f1b86ddabe16b
SHA512 35c7fb3c504137e4c5b22ccbea1b53c79ce64bfc8300060c3546382867221f1deebf668c2a2b027aa5b1218df43bbe871147b233e95e36fb057c8b2273327a52
SSDEEP 6144:cs5wjgJg7tnWmkjM6p4lswcs4sxsn6dH:coSJWfj/yiwcs4sxsn6d
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_3
Size 4.0MB
SHA256 dd99c67864b246ce3e80f897c0d0504377a7abd95671a4fc3b25ec55fbfe231f
MD5 552f20dfe5cc0c1b8df51e342040c9fd
SHA1 3e5af828ddfa2cfe3a42f09f8a4995f738c1f835
SHA512 76146aa6eb6b4dac4fa55b0c8b02a810b727b67986bd3e7b7bb6548755f48423dd87ac0009a8f48a0cb2208ab9fc26360e7ff66dd9f463abaa59b0aaf07bd0e8
SSDEEP 6144:Wkt/Z89L6d6wEjulrB5/1AyaA5v+0JP50y9kZlsDCcs0OFueIpW9893ks7FmoBMr:9rDa18kZ5zgTpr4qCRsBow9bFta8E
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 2a6a2067909919a4492519165209a08b824228e50952cf80510e0c397959337a
MD5 b16f7635681fc5e98905f5fe7d98dfa9
SHA1 759ca52214e324296c408c979afd1608157b4bc5
SHA512 61097aa529c31994289d7dec46944ff665b5122af7cfb68aae3fc0ebc7012b8a2382d23543a48503f766e073207326b551ef892aa6f5551b68d8579ff4a870ed
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 cad36c0c92863e851d43ce6b252ba26024c316cf176bcb8b3a395277c82f0ad1
MD5 5a6ff5aeb0808e9c0648a1d837594c0e
SHA1 71cbc1a7bdecd687255fe409f072c557d2d54745
SHA512 ef30101b67125c457f3e958088c2cb28fe3459081be345664a2d80f1d7bd27d7fed4d4818eeeaa99c7f88057a33fb4c61fa53d60cdc5d779c1d6c84c0b9e0b28
MD5 SHA1 SHA512

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies
Size 28KB
SHA256 a6d8cef5af8f4e740990d573a735ea58c9d97fc7cbfd7cd1bfcb273c18f57512
MD5 dc5336616f18a02521b0e7675583082c
SHA1 836f99463e43bfbb3a3acd40dc7f5336b0aed2df
SHA512 6492d53c01950d57a8a4287446b9aebe58d51bc1eed3b477ab365133b4d59e84eaa619cface50bead559d1541bc94b34d87949d58db4747f4b59738203418885
SSDEEP 192:FuGXnqtQnVhzP+zMAzB0gTDHFKqUE4oLCEM:zXqAfjYMANvHFFnpM
MD5 SHA1 SHA512 SSDEEP

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons
Size 24KB
SHA256 091b7d9566a97153ea7db3cc5b4b00a513f106347b554a35a57ca6b84fd25304
MD5 dc071a6414d1238cee26463d071d0af6
SHA1 d7a713847ed34c2564cc54ed91be2817583c2cc6
SHA512 4733ce32e7dab95b24715799b09772c12c4a8b741efcc7a4bc49535175bf8ae576b857c68a0311a9c3fbe10c579dc10e79004ae5d78f378b6e33ad2b052bf652
SSDEEP 48:dBmw6fU1z/Qh7G5VXQmBh7G54XQG9cNGkd6ib5rNBAdUO/q5vvRb8TuSmh8:dBC8T7CEuGkgaNO/A8KPh8
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 116KB
SHA256 e49c0f3b4afa3881a0e1fbb74103a3274d1ef48a5a130c5f5c8822dbbdeb6640
MD5 6394d30447f422ebaa14c598df5c1414
SHA1 67b911bf80f9acbb899fb61f45ebfe753238ff64
SHA512 c3ab6cbca86117966b11fb8030e24bce953e9f2895a76ea00443caf25083ecd787748a81ff58f5201025a9034b751c0f55c9f64e0132f2e2aa85e7245987d620
SSDEEP 96:g6iUKqaAY4a/SAW2+A3mmdU+bDoYysX0uhnydVjN9DLjGQLBE3uiV6t:gAda/BW21K+bDo3irhnydVj3XBBE3un
MD5 SHA1 SHA512 SSDEEP

Submit Download

History Provider Cache

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History Provider Cache
Size 3KB
SHA256 b7743695930ac5b003cc2bc0020a1f57fec8edcd8aba026151c58d146e45e166
MD5 963a68bf77bed4ddc9dbb113608ffe2b
SHA1 7d615636110dcfce29df195f15615f7f70841875
SHA512 2022b736cea2733514edc420d719fdc021edab111c9674c574f55b3766e28256437836c28b7fc2c230bbcdfb0140c97cd85115c86ea7331a0ea01ed473d4d97f
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log
Size 186B
SHA256 a0a75ca45ac9ec2c033410935ac083d8f373bac7dabc862fe438a68faaf1be06
MD5 6eb2784bf5354b3efd88fbca93abb31f
SHA1 520660d674e85c30f203f636a72c9a753407738f
SHA512 7278a01198d2e0a3e194a40216ca93bc6772de2e19c484e62416f681f9c0aa0c13af292106c59152df8f29cdb98c87f40fee6490d195c1937b29fce9cb6234c0
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 331B
SHA256 de5b8a6a18aba9b31a568c49073698d65fb15e40e21f3bc07f048bff4b5af233
MD5 10b1b2aa8028e2a5622ce384b9cd8a6b
SHA1 7acf2cb27bd5fd916fa4156917dd074c68041409
SHA512 8542d08710ddcd0564bc6ff0dd9cc449ef6b12e1ec212fada7990deb74315b04771b63598a33edf1dfc1d91f550cd30a90b85a3141e9cf2321617e59a405e429
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 b6b33ec11be3c0497b24c2133100068cbb91e94354a5cb7f2d858fa469470964
MD5 a02815b7ca0cb66f67af4674b3f26e9a
SHA1 d504b5547fdd2f679fd206554ca7a525bc851950
SHA512 b05007dc5bde5ee751d2e9ab167921c6c4b77afdf561ded27f83484d675ba4af30bc16463a867cb0316e2293225a9c826ce27225157a0b25dbbf5e13b66bbce9
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 658c8b28358256775e7c3bf7288fc1f6d9ffeee6fcf6d2a54745bde607625c1b
MD5 e47421ba180df97c4fea3395b125d120
SHA1 014fccf071f0153f1eda8d184ce0263b9414d4de
SHA512 7647dd556db1571994ab67539cfd9e10464c89703d176a6b5ae3a8c807b676672561c036c0ddbf5b60e2e9cb4cbed63c5fd4a77f3d6a85f1a9d4f750c854e7ce
SSDEEP 96:n9Qk35o7+k5cEwSv0MoiVmdHIskJq30WQyV+VpziX3wI3:nSk35o+k5Dv0MAIsiSLx93
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 48ee1c18c6057cd2ee82d13aaceb28bf82838a2c85b9acc650f29acec47529e9
MD5 b016040ada644aebb431da05ff992f38
SHA1 4725001c868860b05de7fe20e640349e7dfbb126
SHA512 2c98306b44dba336a5fcab51a67854304bcb10c671a2a7501c1019de5b8e0527860d6c080bccc41c70f6871fc246fc4224a2d52160f1df6bec68d1b8243e2466
SSDEEP 96:n9Qk3tyb7+kScEwSoB0MoiVmdLup1jIsOJq30WQyV+VpAiX3wI3:nSk3tM+kSDoB0MauphIssSLe93
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 fb365b848e3683ac52a89521fb1685cbc030b0bc5d8909c1a8b789e49d9ca646
MD5 38f3c504aba9f488e61ac4e4609285fc
SHA1 1f25e5a8942b14859818a2715350f36425413d77
SHA512 893592a3d2f8f122a6351988363d8b9c6f1ef3009930b2e53eeaa26a8fcd2a4bbc2caa69f5fd9ca06f894b4c1d510f55ab4b201b683407839081ded50436323e
SSDEEP 96:n9Qk3eb7+kgcEwSoB0MoiV4R+R5mdLup1jIspJe10WQyV+VpAiX3wI3:nSk3g+kgDoB0M2QMuphIsbeLe93
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 9e13557ff07d55473cd0608b2648ce0df32c7aeebe89d28e77bdbd99318660f1
MD5 d65bc8be0bdc4e4b721e56e087ecd2c0
SHA1 2ecbb26970be0b834ad6bd6f27d90839363b71c2
SHA512 25e5506119f578829042f93cce85911fb9f0b23c4b0b1902ad821d3dd772fed253aa59abbec138a903f067b028fbd93314c6240146593d3ee1dc2c3b35df2db6
SSDEEP 96:n9Qk36b7LkgcEwSv0MoiV4R+R5mdLup1jIsOJeYX0WQyV+VpziX3wI3:nSk3kLkgDv0M2QMuphIssvLx93
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 4bb43a8292eb2b0f85789fd34ba54ac7cafb9cf0392fdc5702149f651cf18aca
MD5 0cfaf35de4973d30b7ab97dbaa63ff70
SHA1 4b9f08c14d4db8777c5b52308b1dc18827ebdf23
SHA512 4a785fa682604d3b181aebbc75911bcec18df1326fe06795a829d7de3a81dd48f8d813d6662c63702df4985c47c20ee96cdd2284101c3a678f186699f1b5732a
SSDEEP 96:n9Qk35a7+k5cEwSv0MoiVmdHIskJq30WQyV+VpAiX3wI3:nSk35q+k5Dv0MAIsiSLe93
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 bd99e74191c81cd82374a1343611bd06f781b146db2d24a59ded3a43ce110667
MD5 35ab5f5f2b2e383b0fc06d6805a6c7a4
SHA1 5314b22f1b907e92f62a18290f29340e0b95c953
SHA512 22781733d83d9223891578457a4db9cb9c726c67fb592723a0971cab7ed34d0df26914bff3e957b6f74aee5022a87c2f932ac4d8bc2395c7d49fc855b18d9238
SSDEEP 96:n9Qk3Q7LkScEwSeh90Moi45RvR5mdTYCMkdfResGJeYX0WQyV+VpAiX3wI3:nSk3ALkSDeP0M45NIYCBpes0vLe93
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 3488b98092e68834b27420e5c45b0c7a40c809ba6766489ff018f9501b9898b0
MD5 0053bbec7cf93c5e1e1c37b295af07b8
SHA1 b5ed084be113f79b1c0d1458fd579a35f52994ac
SHA512 e8fbda5bd9213963b2b4140f68357134b44f4d204d48cb357a601401becbfa0391fe0e28aa220bb927d4eeab277ba0effdd76c80c9dc3cf92a95a659cee5fc6f
SSDEEP 96:n9Qk36e7LkgcEwSv0MoiV4R+R5mdLup1jIsOJeYX0WQyV+VpAiX3wI3:nSk3ZLkgDv0M2QMuphIssvLe93
MD5 SHA1 SHA512 SSDEEP

Submit Download

Reporting and NEL

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Reporting and NEL
Size 36KB
SHA256 b6213d10aa236c272e41aeee9e4a118cb2c67bea11fb473709ea974c9dcce99a
MD5 2bdf2cfcd983cd0bc5d606ae44e92e92
SHA1 569fadce16959be04b70b746b00ab42afc82b288
SHA512 fcf47a553173a8848ae9ec58a471b49c955fc81dac9071e0e9b1068af98135f62b9bf501c90925dd85872731ab2cda14e15728c2e466e47f36e7f5b7608230b4
SSDEEP 96:LIEumQv8m1ccnvS68MsLLEQIstjVsYzNPjsRLiQMs1Alswq:LIEumQv8m1ccnvS6sdjPzNP0LiQ9ALq
MD5 SHA1 SHA512 SSDEEP

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log
Size 619B
SHA256 3a5fb1955e8cf5d6dc737e9e0731b5472e261ab5d6d91804f5ea7500eb33bce0
MD5 9042445f4daa41ea04828fdafcd51f07
SHA1 36d282ee7a1e874564c1cbf18137b9b9c81de568
SHA512 f2957cb4a16999cb4033629375cf6b900eeb2286b000cc27ae3f3a603178d534c7a67eb2387123af0e7182757a8a97bfd34b20509cf312725254287f21868d2a
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG
Size 319B
SHA256 beb80f4fadea1009ed282ce2e3eb27f9459de42b5c9da9fe69eb572121e44106
MD5 d2dac5f13b7170bd78fc244d60053b6b
SHA1 79d7b3762030d3550a3cdcbad297a14cdf722268
SHA512 09fb91559cbc64a169af14bd6b004816954936625fab82457658a836cc11ad80113b5690a98a4f148ce899bbccbfd9c3b508f2a586309c31cd173fced22cfd1b
MD5 SHA1 SHA512

Submit Download

Tabs_13369982786370780

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Tabs_13369982786370780
Size 9KB
SHA256 5786d186d4ed11e380a38afdbe6ba928bc601becd33486cc90a9f082ccca8f7b
MD5 b2ab9a64efe356d446377b79be845c9e
SHA1 7c0278e445ab95195033acfa0f5d496697b72f6c
SHA512 2f7a628a19a3f6389c2bdaa6614db93471eb1098dc6b0c627479fe768f44832b4e1e96436297ea7af3bbcaec8f569408939ecda334042dd94484e81585e8874f
SSDEEP 96:3ISw9b8Oa6ibwFvV8UIuAdoMUbXf6sK60+ds+asiJKZT3ZV0i86L6elfq3+JgD:3It9bfvF98xuAdo1bXfPf7j9+eY3+a
MD5 SHA1 SHA512 SSDEEP

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log
Size 112B
SHA256 2a6494794819a05c13c8e838dd37055098a0bb4e4dce02a7c5b68117aad3e5ef
MD5 e45cba910ca190ef8f32e8520a8d0fa8
SHA1 f331cbbb8790085b616fd8a7b9b16184596b9139
SHA512 8c32d33b6e6f0fc1e8077c8954ca5ff30385e060b92c3c37df8ee55e2a4571ff4cc67b44a2fc48c1ba3185b9ad4fa02c164f337aaaceaa82a0044ed53b20e9ce
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 347B
SHA256 143fbbd91d3c4be9010a353d3bb278ea4780d0495d85ac476627801cd7b1cb69
MD5 97a7afb5923cbfa6d51301219fb037e2
SHA1 3e96d0f85fa1d758afc152f89013f57de9bf1d66
SHA512 a0aa9dfd0d9abc4ba048abf45471ac712b98b26f1a5797de7f8fb5f2941d7d5073893be29ed9b11b3715debc33dd58c682d158f06a1e4336ef9e7b41d3992bc6
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 323B
SHA256 62c64056734ba9a4be6155677c31321e8946dcffe151b80c5e337030eceedec1
MD5 34fb5ddd8874e364c8e4b3840202b19d
SHA1 7ba048debcd7d45a02591f19ea321c44d5c5b07a
SHA512 5cf81830b9a681a604fa6d36292934452bcb4365c463220e8432f4c2864ed546dc3d65739439c3453ac2b5faaec8a2b88f409aafe2a9a8aa0bf82a412e361d6a
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 6d640bbf53e773ddf207ab816c34dcfe98b7936af9e919186b7c8a604676cf59
MD5 9be9f95bd11c6a351ebf17bc7c4e45a8
SHA1 336cc3e7cd1e0d7dce27caabd0c8a93caf246d35
SHA512 070ccffa22b2499d1745a86fe91c9fb1f17569f3568ead16d546d8a18a2d5674e942d28517041800e8d4bd341d09df584d346878e726a6eb146fe4881e250d01
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 661ea20151a403deb1bc6dbc84e1dad9c9d86583b33585e1d098d31f078c5ccf
MD5 8ad658466abbaff05856f93a1b71b15b
SHA1 5e85d4ba17c0f7632777563af3bc670e807e66a3
SHA512 75d97e9a6058fe849803c5c59fbd46e3aa8fadb5ad2ba6c69018a4c7e03159e3138aa06965965f9b98323b8d258e09146b4b3ad565759057b9062095839e6d6f
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 298a5b5b94a03edb3e759e6038e37cbf7a001b481b87b41bec0fc8438a93c23c
MD5 088aaadc45fb1413618bb8c3ebe5f51d
SHA1 ed93aae2d2f0e4494dc4207effe2e55f9f5542bf
SHA512 d7506e3938f28c409b4f317d09c8ab3e2146e9c108c7a02d269b7db4a47c6b88ee96eec7745add12d0285510adf70e609d901dfce35d79a35d91d50965f15546
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe581fe7.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe581fe7.TMP
Size 874B
SHA256 285008442e865800bc404203bb212ce85a5094aab4c7ef9b6159429e789bc7c7
MD5 23f162c326101a4c2148ebbe275dc40b
SHA1 217f80653e2a9c5ad6c14bdcddf49ea22d6b27cc
SHA512 099172191222958c598884fea414115fd91f13aa16ee0bfc2ca38dca895a1e3c35d17015fe7e07bc995bef6b01bee00edc572359cdaa231df5360c65bf9dfed7
MD5 SHA1 SHA512

Submit Download

Visited Links

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Visited Links
Size 128KB
SHA256 eddeb35e4e3a44c92bbb29eade088c653b968401bfb13827882b6b3778ab2f66
MD5 63c614932e72c7f6523773c3b146bd67
SHA1 64d27a60c08fd011706c8dd95067917bc7eecc0a
SHA512 d1414d93e2ad44e94ef8c41fc295ae2da7ec43e52b17b8d1ede438b716e284c362c34550b723737b6908c65f239602435e89b24644abd501f0f1c382f01680c7
SSDEEP 3:ImtV+JT5etjZfEl/AzhkZbD/HyN1fI/MY1:IiV+JT5Kl0/Azhkdy
MD5 SHA1 SHA512 SSDEEP

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 112KB
SHA256 32993ee9fbe8187d4b2576f07a7966db85975d83b64a7256673f418f95d4d471
MD5 c3f8ec9e4e3484b70541fba801969494
SHA1 49083fc10b91f568edce768de224e5bab339c67b
SHA512 36379af454b37efc2e9965812abbf60c6bac77191c309e91b03b55ea88f70e4d294d6e5c01d15712a597a45af6188e6e930bd3b5cd9c5053da5a312cffb38ae7
SSDEEP 192:9ogLUJAIH9IqR2nrQTjHbRmn8HKuqrTPk2XVumQ6:9ofJAa9Ijnh8HKuqrTFVumQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 4166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611
MD5 aefd77f47fb84fae5ea194496b44c67a
SHA1 dcfbb6a5b8d05662c4858664f81693bb7f803b82
SHA512 b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3
MD5 SHA1 SHA512

Submit Download

load_statistics.db

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db
Size 44KB
SHA256 070381f11bf7ae084da008796e67bdefac6d45c1fc7d20af0091c803cd1d1546
MD5 ecc08cd424d5a51c11cd086adc237e03
SHA1 4b246efcd757a0d984c318ea671e851acad35d53
SHA512 81171906e5c9bafbf7e7171ca95bf51876db602e403fd4fb462a4ba3fd3ae911d02e50725e22b4dce7f87b36ed0505053f847c50ab8e21e43930bd951febb3bb
SSDEEP 192:0QflbyCSbab2NvCV5NQWdN+Xm9NgGFPaUIb:/flbyCSc2BONf9NgCyJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 38B
SHA256 1c43a1bda1e458863c46dfae7fb43bfb3e27802169f37320399b1dd799a819ac
MD5 51a2cbb807f5085530dec18e45cb8569
SHA1 7ad88cd3de5844c7fc269c4500228a630016ab5b
SHA512 b643a8fa75eda90c89ab98f79d4d022bb81f1f62f50ed4e5440f487f22d1163671ec3ae73c4742c11830214173ff2935c785018318f4a4cad413ae4eeef985df
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 322B
SHA256 dd7c8f41d0b1c47f423d2f8e7e1d75781d4d98f80f4e58c518f275459f777aef
MD5 b1b6ba73e10091ba9579e1d17b9a64bd
SHA1 bdd29567feda9402676410e3f58643d9c9872ce8
SHA512 1f702c2858dca1307b031369f7425b61ca59e7ed11e061ed8f59ab4676dcf6f4096452ddbdc90cf448b6a606954813b2b137cd6fe8b9cff0bbcadf9659866d63
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 340B
SHA256 5d96fb0566ad1d408de7058c6db133f15018af9333425b9006381c11231c2e6f
MD5 7a8a3160597c76dcca376b5e613fc97f
SHA1 47651f171c697d8c73995bf9e3a8ec45ff02e121
SHA512 c65d81ac79a4776ff6a3629446bb38e6148ae014831f2facf84e1d211857fd1262ef68ac041bd54abf3d05b277563a6ed61400af474163ad35c1b807e3fb1b87
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_0
Size 44KB
SHA256 d21780d20333ae48a37700f8d0334a2ec386e9668ec35879b592ba18ec57e544
MD5 db98389e2300260367eeb12536a7a0cf
SHA1 8fc172fa93803a4bccad643259ccbc55f1dcdcc7
SHA512 f7b3dcb6de4564eccdf4c80d6f19d0ca2929a0b8b2be2a1ec7f2159a4d3788a02adbe23769253e2cce9ffec51c3bbc9211583fad3ffbf77ac84fe87cf49b615f
SSDEEP 48:0rr/7j+8kRGKr3D+eBgaS4cgewRK6Sfst3ZKJ:0nlKrFt9cge2/Sfcc
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_1
Size 264KB
SHA256 50b9de6c27e5cc4da551a39c8712468fe45eb589fc4fa6f4d0a89614b9479958
MD5 27d507d9b49596dbcedd0f066ac80cdb
SHA1 89f7a2bb8c0fb7e734189c4487770fdf049004fb
SHA512 4bd4419fa3cfdb0399b8093e61b110cf215cbb4735c37c99cb32afb58d76c857f40b30757e1da6d9deac864259c4753a087d4a5553561b206d251040088e652b
SSDEEP 1536:o91VG7io2ZB9zDkqWytspVMzOscqhcVWWgQHDrGT5DtuD0I1dTV5yMf+sbg2slmd:
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_3
Size 4.0MB
SHA256 fd15b301aee854f58bc9f88a3d502d28c0545f658a0049c978a3056fe130b495
MD5 f9262d3382ef937025e46154e63662f4
SHA1 d90fd496d501f643f7b18f1cb9976e8e4753e060
SHA512 c5c0663db82ceeef41e562b6367c2ee8df35dce185874dda0395245a52e82ba9524b57437dbf77f607c9e4e4de95383f947c42bbe81040c59acaeaccb9f79a0e
SSDEEP 3072:UJX2WBpwo95LTmSeBBuVoJFj5bmVJGNbxswtJAR58iNwgKGkeLIDFu+KWiWrEOyi:xFuj
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\f_000001
Size 20KB
SHA256 9d550015f47a4d5d502f8a2f5b33bd9cbd136f4fea7c64754c8cc5a9651f7fe5
MD5 ef9588ca82f853399e5968af99985e74
SHA1 80d9df4f75c3e789ddf10584d9ff9de2b6154cb0
SHA512 a77b6b0bcea459ab4fc1e5d0983e85b86a6b0835849345f6afbfb27a5e84d8d1a38ff16e21ecf862e95d0a74e3fe97fda28bea66752b8bd64fd44c8ba680a5c1
SSDEEP 192:eARw0VWBObjIojv7nenqWXF14yEQ0J4JSs7BBvtWJ4fbwpNgZY7Aema/8vJxdTFZ:eAwyImWCh4JSsJWJ4DwpSTem
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000002

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\f_000002
Size 17KB
SHA256 cac135de6bdd6eff4da15fee872e4924202afff5d27bc6e293fe59f488c55b18
MD5 ebb13314db719173ebd69a3cf448427f
SHA1 c54da248aa7d65daf7502d9ebd4cb9afa241f35f
SHA512 76d5f4dba24ff673f9d920887442659c0d3c9f3d780e889229eda3871844884a4ef8fbff7dc73e94e0d12f23cd937cc7bbd2f80d248f90c43cb839630ea0a792
SSDEEP 192:kqJlq/j0VGyxpBDBO1rIqUjFNXeXoQ9OPpAqZXF1/PBEQ0cLkU02pozwLisLYn+h:kSBqInB2ikU05qisLAoX
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000003

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\f_000003
Size 16KB
SHA256 70a5906d633b521972c6dcf63ed426886a8baa700ee5a7f97b4ce26970409204
MD5 561286f137ec9aad9f205f382a706371
SHA1 316a7f48f9c726afde87aa0854e0cd11f5b17228
SHA512 fa144bb14bc9813f085e1ee760054afe32a7477df0e843707761f3a01da46e29f3a959e2ef5044ba64e9de257329727cc41e6dcd8162abf9bec15379cfabea83
SSDEEP 192:bEMA/j0VGyxpBDBO1rI4UjFNX371lZm1ZXF1/PBEQ0cLdbro5isLYn9amN/1:bvBqIwB2idbro5isLA9
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000004

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\f_000004
Size 26KB
SHA256 98280dcf81e7ed7a29b2d383c12027481bf771aa6358012ee5ffcc8b3af21e38
MD5 8235f98068f731038d8520df4727c625
SHA1 6ef1e3ca36d59de490e593ec195b632e8e09565d
SHA512 d75d4b688898ee9c9ee07f7be6e9dafd0154518ac54042270666969dd15dbc3b7c8cf92997c510f42f20a5ad8270d5324dd8f2ef91666a9d6d0450d60bacfd83
SSDEEP 384:yyI7WCklrMKMG9GGGLGPGuGFGoG6GbGAGNGNGcGXG6GoG5GCGPGLGqGhGMGCkpS:yy6WCklrkkpS
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000005

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\f_000005
Size 26KB
SHA256 b0ac89e9f894fe05628c1bdead63741499df44688ccd44351d58feab09712246
MD5 ad2134ff16b8955dbcf63336d3e33d58
SHA1 1d818cc140127deca1fb5bbc4ff88fa3ff52d6df
SHA512 d540504b8e393cbe5438849dff802fad000227e114a4b2e155d39fe082683413c3b14b493ac0bd0e6bccf40b9a15a86b508aa76ca58a24a1a2e426b67030f09e
SSDEEP 384:yyI7WCklfMKMG9GGGLGPGuGFGoG6GbGAGNGNGcGXG6GoG5GCGPGLGqGhGMGCkpS:yy6WCklfkkpS
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000006

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\f_000006
Size 20KB
SHA256 4d0624fc5f612d174fb0fc97eeee9ce54e75f21606244733cd6bd92bb9f045d4
MD5 d713ba9b8bc6a09281e1c2166405e4fa
SHA1 da30fc10f5f79c7504081778243123394717159a
SHA512 4ad4ef2739e1f19c9d23b90d367c7185a65cb3ebd8e716297bb21c8d82352eb15eab2dd969a743db37b0316c680227e50c0fc4a96d814b856c73cab5d9f78dd6
SSDEEP 192:fb0VWBObjIW6JfUXWXF14yEQ0Ot4m7pNgZf9Q:ryIAWCmt4m7pSf
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000007

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\f_000007
Size 19KB
SHA256 6b0d53c56c634f65f371f8ea7b4035ee17831bb7a396cbbfd828600239bc0aa8
MD5 ac8a5d1edd8cbc5becf698797911cd1b
SHA1 03e1114f4e992f9f42296d8a61205116d26d08ae
SHA512 b28c2daadad1661443784b07c2eecd818deb1b1daf1f818d8dfc37bb4dd13f7f15b92631ae98e48229d7ac2841ce62bc931d60857c20131d7bc55203135d0471
SSDEEP 192:T/0VWBObjIZ6AfTqWXF14yEQ0OB4/b7pNgZUYl:TyIUWCmB4/b7pSB
MD5 SHA1 SHA512 SSDEEP

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 11B
SHA256 f53ab2877a33ef4dbde62f23f0cbfb572924a80a3921f47fc080d680107064b4
MD5 b29bcf9cd0e55f93000b4bb265a9810b
SHA1 e662b8c98bd5eced29495dbe2a8f1930e3f714b8
SHA512 e15f515e4177d38d6bb83a939a0a8f901ce64dffe45e635063161497d527fbddaf2b1261195fde90b72b4c3e64ac0a0500003faceffcc749471733c9e83eb011
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 713e08940a5ab8c4a25cd32ddb1712d28b64a3cb3b0918deeb374eb9e708cf70
MD5 748757ebed8e5b779620907815d3df06
SHA1 829dbb4672a7fb561e57898b820b0d8c8dcf892a
SHA512 a68502f9dcdc14b5bdaa0cbbc349ca595713c0983b96b77f9438be4713525115f289778b4f2aee04536e15b3470aae0da6921fd86930c8452afc03e13c3ac839
SSDEEP 192:coCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxASG7Kde2RUIhRqNW7mh8AEdv4YE:M9iIxuERzA83h09RZxASGu5ZWNW7m8vu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 1e3b93768b340cabea1e9a44d5c0341c8677d4e3db981b773f70ad7bc0bdcb2b
MD5 8ed0d6fdd4fcac6c7f0e47a025c2ff0f
SHA1 8d45194b58706ac5885b6a245e64e77c8026ef17
SHA512 efbc99e7330e66d02b43c4822bcb7bfba9368d77c23cc0bb7aa974753db7994cfd6bbce34c247527192e3a7783c0dc3ec2b7b70f2a2bee7621daa5be4f68dfcf
SSDEEP 192:boCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxASG7KVe2RUIJSObG/s7mh8AEdvB:L9iIxuERzA83h09RZxASGuRZJpG/s7me
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 2214aa7a6ef65fbed752898adb45ad295511e64da359decdf62d2314bc7d33b9
MD5 c424075fe969fea4d9b8faa5c17b162a
SHA1 b2c9f5440e6305b879466a53d2e9bb12e6ec46df
SHA512 b896d9067544a4463401b55450bbfeddabaed555c5e051d023e27efdc3dcc0b40250990006c659cd81d3b31b2dae0f726df893da2edfa050df8aabfb8867372c
SSDEEP 192:KoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxASGFKde2RUv5SOq5W7mh8AEdv4H:O9iIxuERzA83h09RZxASGU5k545W7m8m
MD5 SHA1 SHA512 SSDEEP

Submit Download

StdUtils.dll

Path C:\Users\Admin\AppData\Local\Temp\nsj58C7.tmp\StdUtils.dll
Size 110KB
SHA256 c602c44a4d4088dbf5a659f36ba1c3a9d81f8367577de0cb940c0b8afee5c376
MD5 db11ab4828b429a987e7682e495c1810
SHA1 29c2c2069c4975c90789dc6d3677b4b650196561
SHA512 460d1ccfc0d7180eae4e6f1a326d175fec78a7d6014447a9a79b6df501fa05cd4bd90f8f7a85b7b6a4610e2fa7059e30ae6e17bc828d370e5750de9b40b9ae88
SSDEEP 1536:cyy+HcFWrX52XWcS15c4DBVOw/bEQvWt6uouMw5m0mhdBu4NpBTvO7Fvo6mVS6oz:fy+8ozImcSNd1YHbMbCk/S
MD5 SHA1 SHA512 SSDEEP

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsj58C7.tmp\System.dll
Size 22KB
SHA256 fa367ae36bfbe7c989c24c7abbb13482fc20bc35e7812dc377aa1c281ee14cc0
MD5 a36fbe922ffac9cd85a845d7a813f391
SHA1 f656a613a723cc1b449034d73551b4fcdf0dcf1a
SHA512 1d1b95a285536ddc2a89a9b3be4bb5151b1d4c018ea8e521de838498f62e8f29bb7b3b0250df73e327e8e65e2c80b4a2d9a781276bf2a51d10e7099bacb2e50b
SSDEEP 384:V8QIl975eXqlWBrz7YLOlE/NyQH38E9VF6IYinAM+oZ5a1TN:VgPgrfYLO+rMEpYinAMxZG
MD5 SHA1 SHA512 SSDEEP

Submit Download

modern-wizard.bmp

Path C:\Users\Admin\AppData\Local\Temp\nsj58C7.tmp\modern-wizard.bmp
Size 150KB
SHA256 16e0edc9f47e6e95a9bcad15adbdc46be774fbcd045dd526fc16fc38fdc8d49b
MD5 3614a4be6b610f1daf6c801574f161fe
SHA1 6edee98c0084a94caa1fe0124b4c19f42b4e7de6
SHA512 06e0eff28dfd9a428b31147b242f989ce3e92474a3f391ba62ac8d0d05f1a48f4cf82fd27171658acbd667eaffb94cb4e1baf17040dc3b6e8b27f39b843ca281
SSDEEP 48:ZQEM+jeAwtwVUoYxq+HQiNE/7o+f3cbqBtpozK8lHl/GGKOFHNPf33zFYsvwL:ZkWeftwV1enu/7ozCeu8RGGvP/jFYsv
MD5 SHA1 SHA512 SSDEEP

Submit Download

nsDialogs.dll

Path C:\Users\Admin\AppData\Local\Temp\nsj58C7.tmp\nsDialogs.dll
Size 20KB
SHA256 91a484dc79be64dd11bf5acb62c893e57505fcd8809483aa92b04f10d81f9de0
MD5 4e5bc4458afa770636f2806ee0a1e999
SHA1 76dcc64af867526f776ab9225e7f4fe076487765
SHA512 b6f529073a943bddbcb30a57d62216c78fcc9a09424b51ac0824ebfb9cac6cae4211bda26522d6923bd228f244ed8c41656c38284c71867f65d425727dd70162
SSDEEP 384:ABSzm+t18pZ0WAg0RhIFgnGNyQH38E9VF6IYinAM+oZfNRoZk:NupZ/Ag0/T8MEpYinAMxZ7oW
MD5 SHA1 SHA512 SSDEEP

Submit Download

nsExec.dll

Path C:\Users\Admin\AppData\Local\Temp\nsj58C7.tmp\nsExec.dll
Size 17KB
SHA256 3e2399ae5ce16dd69f7e2c71d928cf54a1024afced8155f1fd663a3e123d9226
MD5 2095af18c696968208315d4328a2b7fe
SHA1 b1b0e70c03724b2941e92c5098cc1fc0f2b51568
SHA512 60105dfb1cd60b4048bd7b367969f36ed6bd29f92488ba8cfa862e31942fd529cbc58e8b0c738d91d8bef07c5902ce334e36c66eae1bfe104b44a159b5615ae5
SSDEEP 384:PbGgezxEqoyGgmkNFNyQH38E9VF6IYinAM+oZhc3iMy8:T31yGLkbMEpYinAMxZAy8
MD5 SHA1 SHA512 SSDEEP

Submit Download

nsProcess.dll

Path C:\Users\Admin\AppData\Local\Temp\nsj58C7.tmp\nsProcess.dll
Size 15KB
SHA256 bb6ce83ddaad4f530a66a1048fac868dfc3b86f5e7b8e240d84d1633e385aee8
MD5 08072dc900ca0626e8c079b2c5bcfcf3
SHA1 35f2bfa0b1b2a65b9475fb91af31f7b02aee4e37
SHA512 8981da7f225eb78c414e9fb3c63af0c4daae4a78b4f3033df11cce43c3a22fdbf3853425fe3024f68c73d57ffb128cba4d0db63eda1402212d1c7e0ac022353c
SSDEEP 192:WUl64IGsjDNyQDbnPvy2sE9jBF6IYiYF8pA5K+oZ7W76OCwy9GUe:5ZsNyQH38E9VF6IYinAM+oZYsBe
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unconfirmed 867556.crdownload

Path C:\Users\Admin\Downloads\Unconfirmed 867556.crdownload
Size 2.3MB
SHA256 7d3654531c32d941b8cae81c4137fc542172bfa9635f169cb392f245a0a12bcb
MD5 1b54b70beef8eb240db31718e8f7eb5d
SHA1 da5995070737ec655824c92622333c489eb6bce4
SHA512 fda935694d0652dab3f1017faaf95781a300b420739e0f9d46b53ce07d592a4cfa536524989e2fc9f83602d315259817638a89c4e27da709aada5d1360b717eb
SSDEEP 49152:UDP/q9MIX/crfcNVBaXp1m0zyVCMwBHgFzoZhRP8:kC9MI8Hm0GCjgFc3Rk
MD5 SHA1 SHA512 SSDEEP

Submit Download