valleyrat_s2 | fd1d756b6620d2410f80cb9bbdb9b21b920fb4b8606d2dc51f738fba7c058937

Analysis

max time kernel
149s
max time network
153s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
02/04/2026, 03:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
fd1d756b6620d2410f80cb9bbdb9b21b920fb4b8606d2dc51f738fba7c058937.exe
Size 4.6MB
Sample260402-edfcxsby2j
SHA256 fd1d756b6620d2410f80cb9bbdb9b21b920fb4b8606d2dc51f738fba7c058937
MD5 2f16be03c052cd57450b5e35e584c17b
SHA1 be0c8d9fdad18ef9087c5881913d6c0bdbfdfcfd
SHA512 57f98faee31166a8c95d0a3c10abfe032895d34214f8dd617252143731afc3594c90ac5605842ec9fbef4da605a81e71a97f117cf68e62d0fef34de19e8ceb63
SSDEEP 98304:0V/jxI32sKznk/ZUa6ntzGRb0eh//IvlVixsIG7GqCC04tzAUnQGWaC/TJ:0VyGBnkxmtzGRAkov3Us/7GqnxAUQ7/1
TLSH
T169262311BAF4FAB1D82416362D9243B205382DF5FE2167EB5FDA356A16344C24E21FB3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor defense_evasion discovery valleyrat_s2

Malware Config

Extracted

Family

valleyrat_s2

Version

v1.0.0

47.84.113.80:6666

Attributes

campaign_date
2026.03.22

Signatures

ValleyRat
ValleyRat stage2 is a backdoor written in C++.
backdoor valleyrat_s2
Valleyrat_s2 family
valleyrat_s2

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WUDFHost.lnk	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WUDFHost.lnk	cmd.exe

Executes dropped EXE 6 IoCs

pid	Process
5044	wudfhost.exe
5084	wudfhost.exe
1044	WUDFHost.exe
5976	WUDFHost.exe
3212	WUDFHost.exe
2248	WUDFHost.exe

Loads dropped DLL 3 IoCs

pid	Process
5084	wudfhost.exe
3212	WUDFHost.exe
2248	WUDFHost.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3112_986786897\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3112_986786897\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3112_986786897\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3112_942639317\_metadata\verified_contents.json	msedge.exe
File opened for modification	C:\Windows\en-US\db.log	fd1d756b6620d2410f80cb9bbdb9b21b920fb4b8606d2dc51f738fba7c058937.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3112_986786897\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3112_986786897\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3112_986786897\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3112_986786897\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3112_986786897\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3112_986786897\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3112_986786897\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3112_986786897\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3112_986786897\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3112_986786897\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3112_2048005923\deny_etld1_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3112_986786897\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3112_986786897\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3112_986786897\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3112_986786897\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3112_986786897\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\en-US\WUDFHost.exe	fd1d756b6620d2410f80cb9bbdb9b21b920fb4b8606d2dc51f738fba7c058937.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3112_986786897\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3112_986786897\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3112_986786897\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3112_942639317\manifest.json	msedge.exe
File opened for modification	C:\Windows\en-US\app-3.16.5\WUDFHost.lnk	fd1d756b6620d2410f80cb9bbdb9b21b920fb4b8606d2dc51f738fba7c058937.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3112_986786897\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3112_2048005923\deny_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3112_2048005923\manifest.json	msedge.exe
File created	C:\Windows\en-US\app-3.16.5\msvcp140.dll	fd1d756b6620d2410f80cb9bbdb9b21b920fb4b8606d2dc51f738fba7c058937.exe
File created	C:\Windows\en-US\app-3.16.5\WUDFHost.lnk	fd1d756b6620d2410f80cb9bbdb9b21b920fb4b8606d2dc51f738fba7c058937.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3112_986786897\_locales\es\messages.json	msedge.exe
File opened for modification	C:\Windows\en-US\app-3.16.5\bootfix.bat	fd1d756b6620d2410f80cb9bbdb9b21b920fb4b8606d2dc51f738fba7c058937.exe
File opened for modification	C:\Windows\en-US\app-3.16.5\vcruntime140.dll	fd1d756b6620d2410f80cb9bbdb9b21b920fb4b8606d2dc51f738fba7c058937.exe
File created	C:\Windows\en-US\My trip.pdf	fd1d756b6620d2410f80cb9bbdb9b21b920fb4b8606d2dc51f738fba7c058937.exe
File opened for modification	C:\Windows\en-US\WUDFHost.lnk	fd1d756b6620d2410f80cb9bbdb9b21b920fb4b8606d2dc51f738fba7c058937.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3112_986786897\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3112_986786897\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3112_986786897\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3112_986786897\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3112_986786897\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3112_1497045179\manifest.json	msedge.exe
File opened for modification	C:\Windows\en-US\2026od8a.dat	fd1d756b6620d2410f80cb9bbdb9b21b920fb4b8606d2dc51f738fba7c058937.exe
File created	C:\Windows\en-US\app-3.16.5\vcruntime140.dll	fd1d756b6620d2410f80cb9bbdb9b21b920fb4b8606d2dc51f738fba7c058937.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3112_986786897\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3112_986786897\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3112_986786897\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3112_986786897\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3112_986786897\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\en-US\app-3.16.5\vcruntime140_1.dll	fd1d756b6620d2410f80cb9bbdb9b21b920fb4b8606d2dc51f738fba7c058937.exe
File created	C:\Windows\en-US\WUDFHost.lnk	fd1d756b6620d2410f80cb9bbdb9b21b920fb4b8606d2dc51f738fba7c058937.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3112_986786897\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3112_986786897\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3112_942639317\keys.json	msedge.exe
File created	C:\Windows\en-US\3.bat	fd1d756b6620d2410f80cb9bbdb9b21b920fb4b8606d2dc51f738fba7c058937.exe
File created	C:\Windows\en-US\auto.vbs	fd1d756b6620d2410f80cb9bbdb9b21b920fb4b8606d2dc51f738fba7c058937.exe
File created	C:\Windows\en-US\service.exe.mui	fd1d756b6620d2410f80cb9bbdb9b21b920fb4b8606d2dc51f738fba7c058937.exe
File opened for modification	C:\Windows\en-US\1.bat	fd1d756b6620d2410f80cb9bbdb9b21b920fb4b8606d2dc51f738fba7c058937.exe
File created	C:\Windows\en-US\2026jksd.dat	fd1d756b6620d2410f80cb9bbdb9b21b920fb4b8606d2dc51f738fba7c058937.exe
File opened for modification	C:\Windows\en-US\app-3.16.5\vcruntime140_1.dll	fd1d756b6620d2410f80cb9bbdb9b21b920fb4b8606d2dc51f738fba7c058937.exe
File opened for modification	C:\Windows\en-US\service.exe.mui	fd1d756b6620d2410f80cb9bbdb9b21b920fb4b8606d2dc51f738fba7c058937.exe
File created	C:\Windows\en-US\图标3.ico	fd1d756b6620d2410f80cb9bbdb9b21b920fb4b8606d2dc51f738fba7c058937.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WUDFHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WUDFHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wudfhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fd1d756b6620d2410f80cb9bbdb9b21b920fb4b8606d2dc51f738fba7c058937.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5212	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
2760	taskkill.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134195753668001177"	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-600123060-2148212387-2211176695-1000\{92B315A6-9939-48FD-91D4-CEB1FA28C502}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Local Settings	fd1d756b6620d2410f80cb9bbdb9b21b920fb4b8606d2dc51f738fba7c058937.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4384	msedge.exe
4384	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2760	taskkill.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3112	msedge.exe

Suspicious use of WriteProcessMemory 53 IoCs

description	pid	Process	procid_target
PID 2552 wrote to memory of 3704	2552	fd1d756b6620d2410f80cb9bbdb9b21b920fb4b8606d2dc51f738fba7c058937.exe	78
PID 2552 wrote to memory of 5044	2552	fd1d756b6620d2410f80cb9bbdb9b21b920fb4b8606d2dc51f738fba7c058937.exe	79
PID 5044 wrote to memory of 5084	5044	wudfhost.exe	80
PID 3704 wrote to memory of 5900	3704	WScript.exe	81
PID 3704 wrote to memory of 4012	3704	WScript.exe	83
PID 3704 wrote to memory of 2864	3704	WScript.exe	85
PID 4012 wrote to memory of 2760	4012	cmd.exe	87
PID 5900 wrote to memory of 3112	5900	cmd.exe	88
PID 3112 wrote to memory of 5392	3112	msedge.exe	89
PID 3112 wrote to memory of 5212	3112	msedge.exe	92
PID 3112 wrote to memory of 788	3112	msedge.exe	93
PID 3112 wrote to memory of 788	3112	msedge.exe	93
PID 3112 wrote to memory of 788	3112	msedge.exe	93
PID 3112 wrote to memory of 2104	3112	msedge.exe	94
PID 3112 wrote to memory of 2104	3112	msedge.exe	94
PID 3112 wrote to memory of 1956	3112	msedge.exe	95
PID 3112 wrote to memory of 3800	3112	msedge.exe	96
PID 3112 wrote to memory of 1956	3112	msedge.exe	95
PID 3112 wrote to memory of 1956	3112	msedge.exe	95
PID 3112 wrote to memory of 3800	3112	msedge.exe	96
PID 3112 wrote to memory of 3800	3112	msedge.exe	96
PID 3112 wrote to memory of 2376	3112	msedge.exe	99
PID 3112 wrote to memory of 2376	3112	msedge.exe	99
PID 3112 wrote to memory of 2376	3112	msedge.exe	99
PID 3112 wrote to memory of 5856	3112	msedge.exe	100
PID 3112 wrote to memory of 5856	3112	msedge.exe	100
PID 3112 wrote to memory of 5856	3112	msedge.exe	100
PID 4012 wrote to memory of 1044	4012	cmd.exe	101
PID 1044 wrote to memory of 3212	1044	WUDFHost.exe	103
PID 5976 wrote to memory of 2248	5976	WUDFHost.exe	104
PID 3112 wrote to memory of 4296	3112	msedge.exe	105
PID 3112 wrote to memory of 4736	3112	msedge.exe	106
PID 3112 wrote to memory of 4296	3112	msedge.exe	105
PID 3112 wrote to memory of 4736	3112	msedge.exe	106
PID 3112 wrote to memory of 412	3112	msedge.exe	107
PID 3112 wrote to memory of 2116	3112	msedge.exe	109
PID 412 wrote to memory of 4984	412	msedge.exe	110
PID 3112 wrote to memory of 5084	3112	msedge.exe	118
PID 3112 wrote to memory of 2984	3112	msedge.exe	119
PID 3112 wrote to memory of 2464	3112	msedge.exe	120
PID 3112 wrote to memory of 5380	3112	msedge.exe	121
PID 3112 wrote to memory of 5380	3112	msedge.exe	121
PID 3112 wrote to memory of 4672	3112	msedge.exe	122
PID 3112 wrote to memory of 4672	3112	msedge.exe	122
PID 3112 wrote to memory of 5432	3112	msedge.exe	123
PID 3112 wrote to memory of 5432	3112	msedge.exe	123
PID 3112 wrote to memory of 1064	3112	msedge.exe	126
PID 3112 wrote to memory of 1064	3112	msedge.exe	126
PID 3112 wrote to memory of 5216	3112	msedge.exe	127
PID 3112 wrote to memory of 5216	3112	msedge.exe	127
PID 3112 wrote to memory of 4384	3112	msedge.exe	128
PID 3112 wrote to memory of 4624	3112	msedge.exe	129
PID 3112 wrote to memory of 4624	3112	msedge.exe	129

C:\Users\Admin\AppData\Local\Temp\fd1d756b6620d2410f80cb9bbdb9b21b920fb4b8606d2dc51f738fba7c058937.exe
"C:\Users\Admin\AppData\Local\Temp\fd1d756b6620d2410f80cb9bbdb9b21b920fb4b8606d2dc51f738fba7c058937.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2552
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Windows\en-US\auto.vbs"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3704
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c "C:\Windows\en-US\auto.vbs\..\1.bat"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5900
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Windows\en-US\My trip.pdf
      4⤵
      Drops file in Windows directory
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Modifies registry class
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:3112
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x368,0x7ffcaabbc188,0x7ffcaabbc194,0x7ffcaabbc1a0
        5⤵
        
        PID:5392
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1800,i,15246453893384296351,1409112256315238438,524288 --field-trial-handle=2548,i,1480874413326799800,5872734268341990812,262144 --variations-seed-version --mojo-platform-channel-handle=2596 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:5212
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1588,i,13844987829117420960,7879238147805977264,262144 --field-trial-handle=2548,i,1480874413326799800,5872734268341990812,262144 --variations-seed-version --mojo-platform-channel-handle=2544 /prefetch:2
        5⤵
        
        PID:788
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2092,i,11380575788980503796,6757265288767531690,524288 --field-trial-handle=2548,i,1480874413326799800,5872734268341990812,262144 --variations-seed-version --mojo-platform-channel-handle=2644 /prefetch:13
        5⤵
        
        PID:2104
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3480,i,16693723552957866718,14287936386490965647,2097152 --field-trial-handle=2548,i,1480874413326799800,5872734268341990812,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
        5⤵
        
        PID:1956
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3488,i,5335306855402610301,15878512160435145103,2097152 --field-trial-handle=2548,i,1480874413326799800,5872734268341990812,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
        5⤵
        
        PID:3800
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --init-isolate-as-foreground --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4736,i,3356886242721114914,16806827942439821269,2097152 --field-trial-handle=2548,i,1480874413326799800,5872734268341990812,262144 --variations-seed-version --mojo-platform-channel-handle=4784 /prefetch:9
        5⤵
        
        PID:2376
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --renderer-sub-type=pdf-renderer --pdf-renderer --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags="--ms-user-locale= --jitless" --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=5032,i,2766095430859142147,3944360967422139509,2097152 --field-trial-handle=2548,i,1480874413326799800,5872734268341990812,262144 --variations-seed-version --mojo-platform-channel-handle=4800 /prefetch:15
        5⤵
        
        PID:5856
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5276,i,3044173807958268843,13389958368630525204,524288 --field-trial-handle=2548,i,1480874413326799800,5872734268341990812,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:14
        5⤵
        
        PID:4296
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5280,i,16149558791658363514,7011472782352153607,524288 --field-trial-handle=2548,i,1480874413326799800,5872734268341990812,262144 --variations-seed-version --mojo-platform-channel-handle=5308 /prefetch:14
        5⤵
        
        PID:4736
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6140,i,8206813114519812449,342362578054153383,524288 --field-trial-handle=2548,i,1480874413326799800,5872734268341990812,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:14
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:412
      - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=1128
        6⤵
        
        PID:4984
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6184,i,8125249721633013953,6721453488865260829,524288 --field-trial-handle=2548,i,1480874413326799800,5872734268341990812,262144 --variations-seed-version --mojo-platform-channel-handle=6200 /prefetch:14
        5⤵
        
        PID:5284
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6184,i,8125249721633013953,6721453488865260829,524288 --field-trial-handle=2548,i,1480874413326799800,5872734268341990812,262144 --variations-seed-version --mojo-platform-channel-handle=6200 /prefetch:14
        5⤵
        
        PID:2116
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6204,i,2188072062169411686,4404121359425921450,524288 --field-trial-handle=2548,i,1480874413326799800,5872734268341990812,262144 --variations-seed-version --mojo-platform-channel-handle=6660 /prefetch:14
        5⤵
        
        PID:5084
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6260,i,17036294115319567842,15517553904651006749,524288 --field-trial-handle=2548,i,1480874413326799800,5872734268341990812,262144 --variations-seed-version --mojo-platform-channel-handle=6216 /prefetch:14
        5⤵
        
        PID:2984
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6264,i,14146894348566611869,3328077149337143270,524288 --field-trial-handle=2548,i,1480874413326799800,5872734268341990812,262144 --variations-seed-version --mojo-platform-channel-handle=6728 /prefetch:14
        5⤵
        
        PID:2464
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6724,i,12787389543000067158,15516614190597933219,524288 --field-trial-handle=2548,i,1480874413326799800,5872734268341990812,262144 --variations-seed-version --mojo-platform-channel-handle=728 /prefetch:14
        5⤵
        
        PID:5380
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6720,i,2342529924727773769,5810469999467761696,524288 --field-trial-handle=2548,i,1480874413326799800,5872734268341990812,262144 --variations-seed-version --mojo-platform-channel-handle=6724 /prefetch:14
        5⤵
        
        PID:4672
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5396,i,17188249685112825227,4109520444599841900,524288 --field-trial-handle=2548,i,1480874413326799800,5872734268341990812,262144 --variations-seed-version --mojo-platform-channel-handle=5648 /prefetch:14
        5⤵
        
        PID:5432
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6032,i,17991018582340577738,2132004738548525450,524288 --field-trial-handle=2548,i,1480874413326799800,5872734268341990812,262144 --variations-seed-version --mojo-platform-channel-handle=6732 /prefetch:14
        5⤵
        
        PID:1064
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6516,i,7263740723831456016,17515564217963808270,524288 --field-trial-handle=2548,i,1480874413326799800,5872734268341990812,262144 --variations-seed-version --mojo-platform-channel-handle=6264 /prefetch:14
        5⤵
        
        PID:5216
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6000,i,850524588564438532,9738440058796351158,262144 --field-trial-handle=2548,i,1480874413326799800,5872734268341990812,262144 --variations-seed-version --mojo-platform-channel-handle=5672 /prefetch:10
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4384
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=864,i,16544742530116860687,12831352616985648146,524288 --field-trial-handle=2548,i,1480874413326799800,5872734268341990812,262144 --variations-seed-version --mojo-platform-channel-handle=5672 /prefetch:14
        5⤵
        
        PID:4624
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c "C:\Windows\en-US\auto.vbs\..\2.bat"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4012
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im "WUDFHost.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2760
  - - C:\Windows\en-US\WUDFHost.exe
      WUDFHost.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1044
    - - C:\Windows\en-US\app-3.16.5\WUDFHost.exe
        
        "C:\Windows\en-US\app-3.16.5\WUDFHost.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:3212
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c "C:\Windows\en-US\auto.vbs\..\3.bat"
    3⤵
    - Drops startup file
    - System Location Discovery: System Language Discovery
    PID:2864
- C:\Windows\en-US\wudfhost.exe
  "C:\Windows\en-US\wudfhost.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5044
- - C:\Windows\en-US\app-3.16.5\wudfhost.exe
    "C:\Windows\en-US\app-3.16.5\wudfhost.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:5084

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:696

C:\Windows\System32\WUDFHost.exe
"C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-f865698f-81bd-42c1-a9ee-243f2e6df49b -SystemEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-05dec155-8f33-4e06-99aa-be9628a3c2ee -IoCancelEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-5cc33a4e-c68b-47ae-a7db-7d555763d5c1 -NonStateChangingEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-b83a01d2-2674-4c51-9494-40e6754e8836 -LifetimeId:60293810-172f-4ca8-94aa-9670309f27c7 -DeviceGroupId:WudfDefaultDevicePool -HostArg:0
1⤵
PID:3852

C:\Windows\en-US\WUDFHost.exe
C:\Windows\en-US\WUDFHost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5976
- C:\Windows\en-US\app-3.16.5\WUDFHost.exe
  "C:\Windows\en-US\app-3.16.5\WUDFHost.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2248

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4288

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

autofill_bypass_cache_forms.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.32\autofill_bypass_cache_forms.json
Size 161B
SHA256 f7510e38f81f8a84027304070205dd55127e3233fdf011411465ede67b5b5d92
MD5 4b1a79b1996f03fb926a97912835c881
SHA1 ca43e23f7bbb4ff3839751f722df3c38ef7bd8a7
SHA512 c2e07a1b311ab71d94c7b874d645fe1114fdccfe4468875d6b23318fbe327481a60b2782af105b7546b3c1e6c3a7ec67261b21a0587f914cc7bf77c55f1f568e
TLSH
T1E5C08C07ABB804230B414E0B590DEFC9990476F6D5C146FEAB75A5A98A3C6B0005B74A
MD5 SHA1 SHA512 TLSH

Submit Download

edge_autofill_global_block_list.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.32\edge_autofill_global_block_list.json
Size 6KB
SHA256 7d3c45c8207ba69066516e51e10a2137bc4f1fce070a692e0c65225f9856e04c
MD5 5d4464dabc1289c3a010e14c05b92c57
SHA1 d2d185faca1cd13a6d42dea68803a9941074707d
SHA512 f93f4b58efc0127946ffa1b2950a1cf71da6f77a6ab4cf98ad8ada6a751d6261be4818ff8c64fe1f1d45467aa070e0823d15be36c8259c1044fb2d1289df9994
SSDEEP 192:C73stL7O9FnLk25+tF4B8K5b+QiGoztWuDpR6lFuftdHAa4/i:nwJ2r
TLSH
T133D16A2BA91C54B32A044839128E5BE47DDD73B6DD6008D6D650C0B9AEDFCB8203FDA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v1FieldTypes.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.32\v1FieldTypes.json
Size 509KB
SHA256 611e7995ab7599a0c89f98d6c6152a42aaedf7449748109a465bb5b0badd0af2
MD5 b1c140ef49f01eea089d3957da1a529f
SHA1 de64781f20aac98b4d2bbc497e3defa83b25aa8f
SHA512 02ddfcbaf9eaff793f251bd983394cf473b1340182ac1f3217cb7258ddfbd2de066ab08af16b47a378644bcc1871ad6ed8c641f6a053802c90e77f648e4f4be8
SSDEEP 1536:jlKS/dYt+dtxX9U2/W++dGcUooTHR6rF1azQmkEMUmxralqDAtyttVJAC5c8KrVx:B
TLSH
T148B48E2BF9F25C634D822A32053E18996A30615F5CEC6CD4BB3E211F4F2C1791E797A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5d8c0ebc33f7882ac8aaa0f941413384749c7672a7744de3485d53f3d7a832ce
MD5 fb7d9391eb1040937b5c31ff61febe79
SHA1 0be0bde544b492ac590e441f96bf8d0a378d3782
SHA512 d4a405f080afee18100d407e824cc3366114b1acd56307d247bc25ee87ffaba37406581a2dfcfe9320df4d014582f86fd300e9f67a54b4fcd2e471e1358c493d
TLSH
T1AED0804425F15CB6D046C57115457B053955D6A79E539B1A35F36C784C4300115511F7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 71f86f37b013034051fae2e3307728bc40653c617383d6aa85219dd8ea093ca3
MD5 2ee9c9062df63fee32f65bc087b93005
SHA1 2874f6b34fdb5f9ff64aed6e38005f7940050b27
SHA512 99729f971f840d780b0e5404260284b048d532cb0dbd20969536cacd61a2d2c52568d6b9d96f6f0168b93eaa3c7236b49d8aafb6138d1b1fcbe89990c6af5af3
TLSH
T1AFD08C4821F66CBAD09ACA7219057B0A2959EAA79E93AB2A39B36C784C4300115911F7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 3814e9018b591587fdbaf2907d684f46cb442af699f6e5d41e4183a79350f7b6
MD5 1ad5fcb440b63d87bde7cbd5ed51ee66
SHA1 a5f964d59d716b8ff9683e1380c9f02fb9b63839
SHA512 039a774b5d12a3bf4b139ee1e489042a98f3fa28596c41fb87f8028c44d61a2189929be2d105a569568c769b0e2638d6c882ffa61aad3c1a1c6f256f4aaa97de
TLSH
T1BBE0AB6ACC24EC3308FD0B1818000B41F71103232A40550F7E3D920C8F7163A05D685C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 2407a95938525e065838d5087eb7ad5301d895ddd789bf150c614dc81df66c13
MD5 9739c75fc6df10f936b8869accad6d56
SHA1 5dcc58b41069a2dc943fe568a5bc3ca7814d90a9
SHA512 91edd3f50c2950c131176db6a82dc190b9df190304bd04f14ecbca788c313ae5e19e94ede3fd3c301810762c68dd301d9593363130af5283955684a0c24ca1ab
TLSH
T1B351A3BF47B1885BEBEA43FB12DC6188763CCA69DC0F8F50389648FD6E1CB101269414
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 668a338c521b231cdd9b4a1a78d9e831021f9e3a720ce86eff5a9e9a30632d09
MD5 da73cc4763e42502618acdb7d320812e
SHA1 07361b3af5811ae4e81a0da91594971db5f8a852
SHA512 440e5b46bea452bdccbb4d544d4408c3ae6792f453e027bc27e7a8d972ac513277fd56a9caaaa62fe3fb442275eaa6ae55cba39b7ea2cb2f4d0aca5b56bb1633
TLSH
T18951C6BF47B68457EBEA47F712DC2188763CCAA9CD0F8F55389A44FD5E1CB101159410
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 77f6cbfe0323105f0017d1273afd17de439be3185432d1ac41dcab345b557252
MD5 bddc1228ce2a6991a67d964210f286b9
SHA1 fe5b3621843da45bdfd48d07dd48e769c5430064
SHA512 0cd28a00b7af8f7210e854b46d620e5e594b33662bcdaa4cbebca2a861de066c857c2b98cdfafd07e98603125e714205531197101359567495f7bba4f732ca7a
TLSH
T16941BDF3C3E8856D891156F0AA18AF2BCE1D0551436C7C5AC9E4AF1B93E2871E14199F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 121484b75d38e8126f7e25748839e39fcaaaa33ed8b58c10cad1772971acd5ae
MD5 a64bc8e006f52bdeed8cba833e5d0ba4
SHA1 743bfb170977b7ddf469dfc772682c2c8d0b85c4
SHA512 fe1bae581f2bfa46e26bf5caddf17d8d33af090d50c433fadb814460cd7181c2a3c2b959aafa5e681e01612ebbab166403d4a16f8154af8ce4e64b1853ff5194
SSDEEP 192:sxZAvRzyMqZ/K1Ml8UQAc9/fJsNaPztsTP6//zodpER/W6+WNGY0r3nOw0RiHfIc:sxZ8Aq/9/fJsYPaT9I/bG57Ofi/sC
TLSH
T1C972F909AA389977CCDBD619FA45BF53D6F9116291840E48ADFC8B0C04D6AED721382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 424b53967859a1ebf917d68ecdcc3004fad356d2f19b1bb662d3b74727ce5ca0
MD5 be92445e2205bd87a7cf3cf230cee2e4
SHA1 527ae89b539948cf17c192f842cb0880f5b451ca
SHA512 f844acec6268f6a6b1fe469b4e6c7a5becb4a3a4451972eda106ba6f16029d74bff97b22ad8f9ec3aede1e3260726190c4f46721e0426987a49edb409734dc8c
SSDEEP 192:sxZAvRzyMqZ/K1Ml8Mc9/fJsAaopztsTP6//zodpER/W6+WNGY0rD2Ow0aiHfIgg:sxZ8A09/fJsnUaT9I/bG5mO8i/jM
TLSH
T17B62F8056A3899778CDBD619FA45BF53D7F9117391840E48AEFC8A0C04E6AED321382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 91ce91122e98ea6cad17fa8f83ada6eccf63a1b19968084f3c0ad9b6131013b1
MD5 9cdd151e96774f378c6b5ca9166d9f62
SHA1 8876ff0e66fb74bd4d7d227854bd6c64e0d63165
SHA512 28e4a8a385995db3dd99ff546e5a5a7edad05766203d91cfd7fe9acc06b3da78c79872f11f8835909e637938d726bdd794f10564e8fe46c53ac9630ef289173f
SSDEEP 768:kA4so86s2+q7pLuL/HzWRmH9QYR8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3tU3SLlI:kA4so86s2+CE/HzWRmH9QYRu1jaKtU3V
TLSH
T11A031D3B680CCB7E4F844E9CEC2ABE8A6DE8018F95988D9447FA444C03C67EB55165DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 24KB
SHA256 7c3fa45f4ef38f6638329d5902aa9b335d316109e1eecad4ed9ef176cfe5ba7a
MD5 282fafa54d58fff51afcb36c897445b6
SHA1 007159003809555c53bd93aa24e417d82ca4bffa
SHA512 9782c5fc08726a08f8534c5c33d15dd0b4d89cd0b53ad906710ddd329008f871d2e9ac8efd84db43cbcf1e34dbf98f52b7e1f4ad3fa32b3492e3984c73e95aac
SSDEEP 96:KkGQKTyeupuKK8DF6KOkKeFGKWoJp+K6wKK6UKXqAugKHqC6S0KzSA+IK/qa2jST:ubB91NPhfYXHkvl7X3S9r4dFbDfadg
TLSH
T1E4B24991757B02907A7E259E8596B87E52C231637118E46B3BF900B60F6BE20CDFDCC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 4e58ad8fd36189eab54be37a82e672722079353371544aa9d9c992051c4acaab
MD5 46e66d9dcf3e2400027783ab1fd67a65
SHA1 9f28829e50f83ad7b6facf029f4528acba038aa1
SHA512 6fe15f88d1a9e94c1ff884b7ed22449ffca8d98bed7804975a0ec6b948a5bfd3122e87c7281e3e0323791605dc3dd35ad10eda470ea9e51101b3c9ea555e00bb
SSDEEP 384:nb2iFaTumV7IhV2oX38NK8TUNTUlIR6gPSY5Hb3VFfLYAmA9TMrw5IZBSNBA1/hK:JFD6IDNX3lwgzxbYAJdOw5IZ/tj4
TLSH
T113D24D35ECA8CD67ADEA4FC5A7197643AEE01063D98C5ED8DAC45E1C00C71DE270B916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 eac43683742d80919726d88bc25850c48b2bcaa898e40deeec65b7977f243061
MD5 cd9a0c89e7b3bfb02db7ab980169e47d
SHA1 a0c2198b76095a6d55d4e82431312ea60c25018c
SHA512 8611701f701b2435857969d0b010687c4e3a079fce8a39892a023f99b5aa5e8cd4811d77db4f773a2efc0061e6e8b3254ff05a05cf3f1cb9dd92d3ea80eac842
SSDEEP 384:nKAiFavqMg38ND8TUNTUlIxBgPSY5oetOVFfLYAmA9L1fRYV/Vw1mRaCe02rN1kY:CFayv3gwgGDtEYAJF1fRYk1m0/0ad
TLSH
T11CC26D35EC68CEABEDEA4FC9D70A7A02EEE00167D99C4AD4D9D81D1D00D709E270BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 d2ff818c488931b59e8a0c1ff721237ff104ea509fceecc9a2d7f0a053e742ec
MD5 f8481db5d7c7533a4ebec167a22a00d4
SHA1 fc0f1871076e8d3ebbeecbf7b80590225a19c9df
SHA512 452fa5ff90694e714c75ab5369ff3b4da54093bcd5792ef163972a0b6e55a9c87a00a0ab56f0cd3518c00269bdddd8f1241aaf6ea95fa6493be2578e9970b468
SSDEEP 384:nbAiFaTumV7IhV2o/38NK8TUNTUlIR6gPSY5Hb3VFfLYAmA9TMrn5IZBSNBA1/hK:/FD6IDN/3lwgzxbYAJdOn5IZ/tj4
TLSH
T14CD25D35ECA8CDA7ADEA4FC5A71A7643AEE01063D98C5ED8DAC45E1C00C71DE270BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 34e6472f698fb7f0e5a4bb8adb0a67308fe4ef5f5ebb8772e7732459184a45fe
MD5 80328c86fc5597b8a5c6fd9dbcc6345a
SHA1 170a4ac62993f6a7110facc1c3891b1c91bbf345
SHA512 eb3ef0632ea4624eb9d7345c8c51a85b8a30fdf5cf8dc89b6ce76ffdfe0001b1ed5d4b9dffa5924617367b82cae6fb4fb9968d37ddbe8c4966cddfd9c6616d4b
SSDEEP 384:nEAiFaTumV7IhV2o/38NK8TUNTUlIR6gPSY5Hb3VFfLYAmA9TMrn5IZBSNBA1/hK:UFD6IDN/3lwgzxbYAJdOn5IZ/tj4
TLSH
T16DD24C35ECA8CDA7ADEA4FC5A71A7643AEE01063D98C5ED8DAC45E1C00C71DE270BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 ba0eb0c3ffd57a3afcc31428e99a0f8eae0d972a04dd2d36c9c7bfaca1da2d80
MD5 a470694c02829b765b97b0d186e1c4a6
SHA1 4fc77dee5ca07d279ff1fdae6dd9ca267361c23f
SHA512 b7e870872d4ba3857fc3f4ae3df5f8bd4820435cc2d0cce8159031d29cfe404b1cf1730add914b9c7f53e5da98f3460616f63a29612ecf22bb5d713ff6b06f0a
SSDEEP 384:nEAiFpTumV7IhV2oo38NK8TUNTUlIRegPSY5Bb3VFfLYAmA9TMrn5IZBSNBA1/hK:UFk6IDNo3lwgzzbYAJdOn5IZ/tj4
TLSH
T112D24C35ECA8CDA7ADEA4FC5A70A7643AEE01063D98C5ED8DAC45E1D00C71DE270B916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 ba6043a3ca63e2324fa9d5b92fabc86196d496fd6ec83ab09211a303d21675cf
MD5 8355051f1632ff1b90f26d147d3c1cf5
SHA1 d91a6eae742ff97529a6b3fd585e1034c789eb4b
SHA512 9cb787771207ee0ad35b9a2170b7bdf77173fa67c4c0072666eb2f8462a9dc63ab1a1b535504201cda0eb46575199bbd3b23a9397470edc8744984af32631cef
SSDEEP 384:nvAiFavqMg38N+8TUNTUlIxBgPSY5r8EVFfLYAmA9TMrY5IRYV/Vw1mRaCe02rNz:DFayv31wgG22YAJdOY5IRYk1m0/0ad
TLSH
T1B2C26C71E868CEA7EDEA8FC5E70A7A43DEE01163C98C4AD4D9D81D1D00D719E270BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\TrustTokenKeyCommitments\2026.3.23.1\manifest.json
Size 79B
SHA256 7ea98f2308a9c51d17a1ac71b64afbe2a41ff0a083a166a0e4cc428bf44f0715
MD5 817fea104100763cd1bf4f15a51bfe94
SHA1 589717cf98cf7e2d55fc0d6025a4b8e215ed13d6
SHA512 da7b959d93113c5a6be360f90d9c721989c5e7acad7fa592081b582c4c3a0c4a9066a71473fd8492ce7fe7b0fbfd6870d939428a67fbd508fcf6b2c6dc1a41ea
TLSH
T15EA0122058019233108407600360478243551C022015244809461041258813A12A3128
MD5 SHA1 SHA512 TLSH

Submit Download

36a457bc-68d5-42bd-b395-54fbfcf362da.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\36a457bc-68d5-42bd-b395-54fbfcf362da.tmp
Size 2KB
SHA256 b1ec49c62d6adbd0f7de55fa7ffd471f508c1d02421c260fd293bc1ac7671f76
MD5 b529ea835df4140e06bca61941c55cb6
SHA1 caaa7b6540da54f1a872f3c5335b86fb75366cf2
SHA512 6918b5270b775b3e14885be433565b996dc296e79b95efbb78beaf306455ebb7b1ef1345ef2a09273b36519b0b9aa501a71926c75f6b592915442ed61519bf98
TLSH
T1335163D18C7D5AD1D4BD0A7EB09B78FC84DCC626F4A4347D2868E9980A7EA1D604143F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 1d485657d00c777425dd935afad77620c8bc8b147912c07d91231451603a9113
MD5 e09060efd8d2875da7a8ce7a11c28a01
SHA1 444f3d1fe55ad9189fdc6be3bd6dfda21f2a99bb
SHA512 27338303ea2eecffc2a9ab68871583d0a9c1024394a548bca452de4483be9d129b88e85153c194f3380116271648193de6ac95c0e3982b69614ba9fd48154cfd
TLSH
T1815151E05C3D1AD1E0BD0A7EB49B38FC80DCC626F4A4347D2864E9984A7A60D248043F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 9d273a8d21c2431856aae2b272137fe07c1f57c13bc51e02088b2c2af515d387
MD5 2c7ebd73bc896407ed997fe16dc52340
SHA1 538e4fd97741e368738fa09e3bafd5d38001f04a
SHA512 8fb84e7773eba4542622f7d5f020d196747a7362323dc8e8348304b8eea59581eec7099608f9310c2ccfe322abceaa1e072230c4e45d36d61c68a014f7d31bdb
TLSH
T17D5160E04C7D1AD1D0BD0A7EB49B38FD80ECC62AF4A4347D2864ED980A7E60D248083F
MD5 SHA1 SHA512 TLSH

Submit Download

ec68b308c1b5444ed4d179df510a843fe2d464fefb631f11fd4b9310fda986bd

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\ec68b308c1b5444ed4d179df510a843fe2d464fefb631f11fd4b9310fda986bd
Size 146KB
SHA256 ec68b308c1b5444ed4d179df510a843fe2d464fefb631f11fd4b9310fda986bd
MD5 fa032a5db34ff20ecbcb6654b02cd7c7
SHA1 3a0c7141dc03421536419c33cb5f9ebd5a4e0289
SHA512 3a3d99e5b9794db882760f754b9b58bebf77e88ce8d0bef61f3ae82c4d3c9631e524a98389f74f7f9215674d60a6d06c10b9e5d0760c908dc19412955ea8522e
SSDEEP 3072:Hl6RntNhz5AkVuPmNptLSZPunVlkDS6it9TyZpd21+PIpGE8aK5KyTmBpw:HM3z5A41L+gXkDS624Xwp1XKgyKzw
TLSH
T170E3E16C6EEAC81AD10F60BA795DB08FC8068F16C107645FB2558418CA64B8D57E2FFF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 49dee4519296cfe64f14418c408fb1e26710c833bfdd59a67e61c6f0c8461eca
MD5 4253fdd629204a9f147b4a12aaf2b5fd
SHA1 1048580ca1f0a5a753787848b82bc8c165fd4d8f
SHA512 67a37d1b7f80d171c80e8e8ada648bc184f7dc4e44c8ace55a38fd45c368efc17ee3f0838d824e1cb0507033f5a43c5808dd629c852a03551216d1b122603c37
TLSH
T18BC09B47695E1EC54E58067D45054D368AD6574563655175380B7904047431D435145F
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3112_1497045179\manifest.json
Size 119B
SHA256 7169d86e87f904218238cd293e043e20b7828afad9acd1ff2e5d64188530b9d7
MD5 7382260298fc06c135b7c7399e9acff9
SHA1 6a829f795a3b8be25200675e00abfa1908fdefdf
SHA512 f0ce77f9f72fb6721bcfa9b03f77b0771e8217988183787c00dba4f9d9f19cdba252ddd656422336035f81939cb97c8b5dcb4f036a39280198c17cd04faaaed4
TLSH
T191B09273A800E83830E9EB91093A8243F320AB4BA585640A3625485C0B2B9F990606C4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3112_2048005923\manifest.json
Size 177B
SHA256 096e772e0f2e8c15e6dec9087ee0a1fb8b0c56b25061626aedc9e7e705adfc2e
MD5 2714a51ed8c2a891ad73b7488ab655b9
SHA1 9a8cc479aec8de1b4eb678e5d68b23b16a39dc99
SHA512 4811522c06ad6946626a9f4d12eb62a1d623825d18a1cd0ad7b628f4c059f37d299b5857abffd959e4ea53239412490539f5705b4aa6c6951d13c68e6d5b72ad
TLSH
T1E6C012EFDC509DB215EB4323156D43C4E733CF4B1546490935FB66082A25981C193500
MD5 SHA1 SHA512 TLSH

Submit Download

keys.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3112_942639317\keys.json
Size 8KB
SHA256 ae6e69a145f84c0a261b4e82888779fbf137f193881d687588e1af71609ae947
MD5 d3ebc1cb4b692c6e2d29a4625420fe73
SHA1 4ce74c1e9af6fd34d6379ec0fec6afb24082a7c1
SHA512 e34b855615e6a3bf770f27d85aa29ca57a324c08bd8f8d9c0130e2a142c0e4a5f17bffd0861b725acc8a2316f73b7fe50406b0af26264a5c2d8f37599b260860
SSDEEP 192:uNtGbR+mFGfvPNyR9Pm4lOvMwkoR9PuGMXcy:ORmqwKjA
TLSH
T18402A57F14A41181CE7FC1698F0B78B78FA038065BCA3A83539BFA49494296D173B5B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1.bat

Path C:\Windows\en-US\1.bat
Size 24B
SHA256 8a99300f4353dcc4c6c9d51616b335ceb012ef8dd2243a716bca969bd1b6783c
MD5 4cfe4b03d1f71785481350bc749c09be
SHA1 74631bfa276c24ce0a08068dc396357e424d59e0
SHA512 2bad3755e3ca03798a19a921cd30bbf0a3cd246f189db87cc8955a514d4eb078e9cd8bfebfd2d8e41ba78b69ce5cc5798ff8d0901ed3c253133767e8a3779c5f
MD5 SHA1 SHA512

Submit Download

2.bat

Path C:\Windows\en-US\2.bat
Size 54B
SHA256 be1252d456a8f10c21b15028d6e1f21bb9d0a4f67a1a228dd810e090143b4112
MD5 cb50524770f032f6c0d05f8cfa51c1e0
SHA1 fa32c7ecb2561f10647589ca2f84115b65de21d3
SHA512 f1f06c536834e6af0a4857eff6a887544c068346ff73d5a00eba019903f335135159735c2c5ef2a8272c9839198a5c815361d37f061c2c1100e10997965e1bf0
TLSH
T187900243840364309297048651841511BB43C1291C1401802401207D2040948F9DB3EC
MD5 SHA1 SHA512 TLSH

Submit Download

3.bat

Path C:\Windows\en-US\3.bat
Size 92B
SHA256 92bdd8cc499f61710e05685b1dde331e991d25b981ded51fad228ee1db19dcbd
MD5 2f34de662d82c041429bf2efcbdafbf8
SHA1 f7ac5e3d3facb35562d7bdc1dc92707f6bbde07f
SHA512 f976f5a02a3f4a5de418ca6005f6ce8dff2e3579454597d21d368e696abacd35d7516e9473a7148bd93312c52b20b5f3bb5334f5e6c46c414aaf995471bdd681
TLSH
T1E0B0120280348803C1613D40354E1F0472059ED3720ADFA220481866CC06AD8C0692C7
MD5 SHA1 SHA512 TLSH

Submit Download

My trip.pdf

Path C:\Windows\en-US\My trip.pdf
Size 2.6MB
SHA256 0819c5d3ba20d479a7d74e6b8e7545933a91957759c6496966cac52d1c77fcad
MD5 03f298ab80deece538a3f32e8a73670d
SHA1 592ace197b284167ba04fa5a061beda2eb028646
SHA512 8e019474ef44e5fddd99c81caacb49628a8f1d0ada56109fa1dd52f03f6b73aa19b293beb6b5598e11a01efe29ae7853657593cd80140d26b3da30b73599e842
SSDEEP 49152:iGMa7OZhGcccccscccRUgccckccccc0AqveOdf:iG+Zgcccccsccc6gccckccccc7OJ
TLSH
T18DD5D8139C188F83A128C7E9BF435E6C5F162B0CE98536FF54260EDB7E646261C8D16E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WUDFHost.exe

Path C:\Windows\en-US\WUDFHost.exe
Size 242KB
SHA256 c9e3b700e048840e1fc4d652064bc1a982c82c719cc58f3174a12bfdddf04f1d
MD5 c8fc735e08be71ca1619c1ef50dbf987
SHA1 91f1c39529523046ec2afebf692193af6e1a2f15
SHA512 38d97fbedc92a6cc59f6bcc5166c9855f684c4b4701ccdca04982807cb8bcc5008c635db8eafdcf86a231eecb1c1178d26df04476e30084bfa77671112db709a
SSDEEP 6144:qZzvhs2Z4n1E7g34XtVYAOfTd/z44JsQw7UK:qJ+2Z4nShVY5JUBU
TLSH
T15F348C1175D38472E5B20A3008F4E6B5AA7DFC710E659E7B63D9072E0F702C19A36EB6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WUDFHost.lnk

Path C:\Windows\en-US\WUDFHost.lnk
Size 1KB
SHA256 3d9db5f2b6a706f016351b4fed35568e7ebd291ba6180fd22ad8c837d7346535
MD5 09c1ba9d5c7991708dde4dbafaae72ec
SHA1 51b9eb372a8be95b519d9d731f455e54c530ea35
SHA512 085f85202431adde68842e83d70d6a4b8515f7d5ed23445a93e27e80fa79b8991d9c0cc8970dbde77239c8d26eb928276c942109d253fe978c266961a6ff173a
TLSH
T1382121338CD10629D6764739812BA2419671AE61E54B9B2E8040530808D2A3BFCA9F3B
MD5 SHA1 SHA512 TLSH

Submit Download

WUDFHost.exe

Path C:\Windows\en-US\app-3.16.5\WUDFHost.exe
Size 661KB
SHA256 727d6989e0d368898aad322cd6c72c33843d37d6ff22542780414cc88685d28a
MD5 9f483c51d7debb591ec1ffe1f1e8b648
SHA1 458a35054015603b2820cedb15a5b6f7bd47c020
SHA512 92d64ed3a27b7f4437405c685b74097af7a9333cc88ea0eb2f2d82cf24724cda27f860842a21aec9fb520e42394cb0bc05e40dd6d749d134fbecf65ff17b5cc3
SSDEEP 6144:odLArrY2sJ5MMOmM2nQ7h+leuvvqmG6IaAGZ1RZUfFuAdz:odLAXkDOmMqQ7hWqw7d/Adz
TLSH
T1C3E4A5DE8B74F64CF0A2CD38C21198FA559AADAAD491B2137539BC917F334868C670D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

auto.vbs

Path C:\Windows\en-US\auto.vbs
Size 292B
SHA256 0e6cf668ad4846ce80f70d7a75d8b7f5c8ef8b0cc0060946d360223503b0f84a
MD5 fedc480ae3cdf684cd656c9eb184630c
SHA1 d351569f703200211d42dd20781be8de838c16c5
SHA512 fdc704d611c620fa73fa930bf8f961a8f36bc3b5a5654e8ca44610ddacd4023386f4aa2a52624089a803e69afb5e88af01a14d0815936846ea0dd1861747c8d9
TLSH
T11AE0125BCC5CCC24650E81730A76DD2D4FCCA76E0321E965F50088BDE16D0F00E212E2
MD5 SHA1 SHA512 TLSH

Submit Download

service.exe.mui

Path C:\Windows\en-US\service.exe.mui
Size 177KB
SHA256 e29cf36d43951156d020e7af0c11e4cef3c15a2114ddffd14784b6b45f22a26d
MD5 eeaed30ec454478d1c485a6cdc177bab
SHA1 4cd2b30fd4c36943cf6c9411365a98c0791009cd
SHA512 92e3d68eb93f3f4729d127e5e890d43ba20f20cf2a28a85b36d700cea6bfb68be0c6bf94971319c6e57c5a6eaa99ec2973714ef2f2331da5705445f16af1f563
SSDEEP 3072:UyywJEk+KIgUKoPlkCKUFZ4GlVCKAiNNppqwfT8BqLsd:UaJEk+KIVPaCKWlV7fZ8Bp
TLSH
T102047BF057C84890FDD2A71054FCFE612B71799BA9CE4DBD5BB2A080655E2B33A1CA4C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1044-295-0x0000000001270000-0x000000000134F000-memory.dmp

Download

memory/2248-160-0x0000000180000000-0x0000000180029000-memory.dmp

Download

memory/2248-313-0x00007FFCB2070000-0x00007FFCB20BB000-memory.dmp

Download

memory/2248-323-0x0000000180000000-0x0000000180029000-memory.dmp

Download

memory/2248-322-0x0000000180000000-0x0000000180029000-memory.dmp

Download

memory/2248-337-0x00000229DEC90000-0x00000229DEC99000-memory.dmp

Download

memory/2248-154-0x0000000180000000-0x0000000180029000-memory.dmp

Download

memory/2248-346-0x0000000180000000-0x0000000180029000-memory.dmp

Download

memory/2552-53-0x0000000000A00000-0x0000000000ADF000-memory.dmp

Download

memory/2552-56-0x0000000000400000-0x0000000000470000-memory.dmp

Download

memory/2552-0-0x0000000000400000-0x0000000000470000-memory.dmp

Download

memory/2760-114-0x00000000007B0000-0x000000000088F000-memory.dmp

Download

memory/3212-335-0x00000144DDCD0000-0x00000144DDCD9000-memory.dmp

Download

memory/3212-153-0x0000000180000000-0x0000000180029000-memory.dmp

Download

memory/3212-312-0x00007FFCB2070000-0x00007FFCB20BB000-memory.dmp

Download

memory/3212-147-0x0000000180000000-0x0000000180029000-memory.dmp

Download

memory/3212-338-0x0000000180000000-0x0000000180029000-memory.dmp

Download

memory/3212-324-0x0000000180000000-0x0000000180029000-memory.dmp

Download

memory/3212-325-0x0000000180000000-0x0000000180029000-memory.dmp

Download

memory/3704-58-0x0000000000BC0000-0x0000000000C9F000-memory.dmp

Download

memory/4984-163-0x0000014F11E00000-0x0000014F121BB000-memory.dmp

Download

memory/4984-165-0x0000014F13D10000-0x0000014F13D19000-memory.dmp

Download

memory/5044-116-0x0000000000A10000-0x0000000000AEF000-memory.dmp

Download

memory/5084-107-0x00007FFCB9CC0000-0x00007FFCB9D0B000-memory.dmp

Download

memory/5900-67-0x0000000001940000-0x0000000001A1F000-memory.dmp

Download

memory/5976-296-0x00000000012D0000-0x00000000013AF000-memory.dmp

Download