hxxps://www[.]mediafire[.]com/file/nsrqnf0ne6xioiw/TRIAGE_KIT_v3[.]zip/file

Analysis

user interaction
yes
max time kernel
210s
max time network
211s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260126-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260126-enlocale:en-usos:windows10-ltsc_2021-x64system
submitted
21/04/2026, 23:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.mediafire.com/file/nsrqnf0ne6xioiw/TRIAGE_KIT_v3.zip/file
Sample260421-3f5mlady8k

Score

8^/10

defense_evasion discovery execution persistence ransomware

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 21 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5076	powershell.exe
1912	powershell.exe
6116	powershell.exe
4516	powershell.exe
1316	powershell.exe
1436	powershell.exe
236	powershell.exe
1380	powershell.exe
5384	powershell.exe
5524	powershell.exe
4052	powershell.exe
3596	powershell.exe
1824	powershell.exe
4432	powershell.exe
1888	powershell.exe
448	powershell.exe
5520	powershell.exe
4864	powershell.exe
5500	powershell.exe
5940	powershell.exe
2612	powershell.exe

Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs

persistence

Terminal Services DLL

T1505.005

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SysTelemetryAgent\Parameters\ServiceDll = "C:\\Windows\\System32\\ar-SA\\sechostdrv.dll.mui"	sample_02.exe

Executes dropped EXE 1 IoCs

pid	Process
2288	sample_02.exe

Loads dropped DLL 1 IoCs

pid	Process
1996	svchost.exe

Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
514	api.gofile.io
516	api.gofile.io
510	api.gofile.io
513	api.gofile.io

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Documents\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	firefox.exe

Modifies boot configuration data using bcdedit 3 IoCs

pid	Process
2436	bcdedit.exe
776	bcdedit.exe
1056	bcdedit.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\ar-SA\sechostdrv.dll.mui	sample_02.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2288	sample_02.exe
2288	sample_02.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4852_1138141786\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4852_1138141786\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4852_1138141786\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4852_1138141786\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4852_1138141786\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4852_1138141786\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4852_1138141786\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4852_1138141786\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4852_1138141786\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4852_1138141786\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4852_1138141786\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4852_1138141786\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4852_1138141786\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4852_1138141786\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4852_1138141786\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4852_1138141786\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4852_1138141786\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4852_1138141786\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4852_1138141786\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4852_1138141786\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4852_1138141786\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4852_1138141786\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4852_1138141786\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4852_1138141786\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4852_1138141786\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4852_1138141786\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4852_1138141786\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4852_303230674\autofill_bypass_cache_forms.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4852_1138141786\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4852_1138141786\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4852_1138141786\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4852_1138141786\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4852_1138141786\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4852_1138141786\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4852_1138141786\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4852_416409116\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4852_1138141786\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4852_1138141786\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4852_1138141786\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4852_102174046\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4852_416409116\deny_etld1_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4852_416409116\deny_full_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4852_111534560\data.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4852_1138141786\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4852_1138141786\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_4852_1540545901\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_104_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4852_1138141786\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4852_1138141786\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4852_1138141786\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4852_1138141786\page_embed_script.js	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4852_1138141786\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4852_1138141786\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4852_1138141786\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4852_1138141786\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4852_1138141786\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4852_303230674\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4852_1138141786\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4852_1138141786\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4852_1138141786\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4852_1138141786\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4852_416409116\deny_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4852_303230674\v1FieldTypes.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4852_1138141786\_locales\fa\messages.json	msedge.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1052	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Network Connections Discovery 1 TTPs 1 IoCs

Attempt to get a listing of network connections.

discovery

System Network Connections Discovery

T1049

pid	Process
2284	NETSTAT.EXE

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4424	msedge.exe
3040	msedge.exe

Checks processor information in registry 2 TTPs 30 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Delays execution with timeout.exe 3 IoCs

defense_evasion

pid	Process
2776	timeout.exe
4088	timeout.exe
5376	timeout.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Gathers network information 2 TTPs 2 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2284	NETSTAT.EXE
3128	ipconfig.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
1300	taskkill.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134212877197021037"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-903610002-708294114-949261322-1000\{68818998-D395-45EE-8CE0-DCB139AF6C7E}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-903610002-708294114-949261322-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-903610002-708294114-949261322-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5524	powershell.exe
5524	powershell.exe
5524	powershell.exe
2288	sample_02.exe
2288	sample_02.exe
4052	powershell.exe
4052	powershell.exe
4052	powershell.exe
3596	powershell.exe
3596	powershell.exe
3596	powershell.exe
6116	powershell.exe
6116	powershell.exe
6116	powershell.exe
1824	powershell.exe
1824	powershell.exe
1824	powershell.exe
1316	powershell.exe
1316	powershell.exe
1316	powershell.exe
4864	powershell.exe
4864	powershell.exe
4864	powershell.exe
4432	powershell.exe
4432	powershell.exe
4432	powershell.exe
1912	powershell.exe
1912	powershell.exe
1912	powershell.exe
1996	svchost.exe
1996	svchost.exe
1996	svchost.exe
1996	svchost.exe
1996	svchost.exe
1996	svchost.exe
1996	svchost.exe
1996	svchost.exe
1996	svchost.exe
1996	svchost.exe
1996	svchost.exe
1996	svchost.exe
1996	svchost.exe
1996	svchost.exe
1996	svchost.exe
1996	svchost.exe
1996	svchost.exe
1996	svchost.exe
1996	svchost.exe
1996	svchost.exe
1996	svchost.exe
1996	svchost.exe
1996	svchost.exe
1996	svchost.exe
1996	svchost.exe
1996	svchost.exe
1996	svchost.exe
1996	svchost.exe
1996	svchost.exe
1996	svchost.exe
1996	svchost.exe
1996	svchost.exe
1996	svchost.exe
1996	svchost.exe
1996	svchost.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeRestorePrivilege	5356	7zG.exe
Token: 35	5356	7zG.exe
Token: SeSecurityPrivilege	5356	7zG.exe
Token: SeSecurityPrivilege	5356	7zG.exe
Token: SeDebugPrivilege	5524	powershell.exe
Token: SeDebugPrivilege	2288	sample_02.exe
Token: SeDebugPrivilege	1300	taskkill.exe
Token: SeDebugPrivilege	4052	powershell.exe
Token: SeDebugPrivilege	3596	powershell.exe
Token: SeDebugPrivilege	6116	powershell.exe
Token: SeDebugPrivilege	1824	powershell.exe
Token: SeDebugPrivilege	1316	powershell.exe
Token: SeDebugPrivilege	4864	powershell.exe
Token: SeDebugPrivilege	4432	powershell.exe
Token: SeDebugPrivilege	1912	powershell.exe
Token: SeBackupPrivilege	776	bcdedit.exe
Token: SeRestorePrivilege	776	bcdedit.exe
Token: SeRestorePrivilege	776	bcdedit.exe
Token: SeRestorePrivilege	776	bcdedit.exe
Token: SeDebugPrivilege	1996	svchost.exe
Token: SeDebugPrivilege	1996	svchost.exe
Token: SeDebugPrivilege	1996	svchost.exe
Token: SeDebugPrivilege	1996	svchost.exe
Token: SeDebugPrivilege	1996	svchost.exe
Token: SeDebugPrivilege	1996	svchost.exe
Token: SeDebugPrivilege	1996	svchost.exe
Token: SeDebugPrivilege	1996	svchost.exe
Token: SeDebugPrivilege	1996	svchost.exe
Token: SeDebugPrivilege	1996	svchost.exe
Token: SeDebugPrivilege	1996	svchost.exe
Token: SeDebugPrivilege	1996	svchost.exe
Token: SeDebugPrivilege	1996	svchost.exe
Token: SeDebugPrivilege	1996	svchost.exe
Token: SeDebugPrivilege	1996	svchost.exe
Token: SeDebugPrivilege	1996	svchost.exe
Token: SeDebugPrivilege	1996	svchost.exe
Token: SeDebugPrivilege	1996	svchost.exe
Token: SeDebugPrivilege	1996	svchost.exe
Token: SeDebugPrivilege	1996	svchost.exe
Token: SeDebugPrivilege	1996	svchost.exe
Token: SeDebugPrivilege	1996	svchost.exe
Token: SeDebugPrivilege	1996	svchost.exe
Token: SeDebugPrivilege	1996	svchost.exe
Token: SeDebugPrivilege	1996	svchost.exe
Token: SeDebugPrivilege	1996	svchost.exe
Token: SeDebugPrivilege	1996	svchost.exe
Token: SeDebugPrivilege	1996	svchost.exe
Token: SeDebugPrivilege	1996	svchost.exe
Token: SeDebugPrivilege	1996	svchost.exe
Token: SeDebugPrivilege	1996	svchost.exe
Token: SeDebugPrivilege	1996	svchost.exe
Token: SeDebugPrivilege	1996	svchost.exe
Token: SeDebugPrivilege	1996	svchost.exe
Token: SeDebugPrivilege	1996	svchost.exe
Token: SeDebugPrivilege	1996	svchost.exe
Token: SeDebugPrivilege	1996	svchost.exe
Token: SeDebugPrivilege	1996	svchost.exe
Token: SeDebugPrivilege	1996	svchost.exe
Token: SeDebugPrivilege	1996	svchost.exe
Token: SeDebugPrivilege	1996	svchost.exe
Token: SeDebugPrivilege	1996	svchost.exe
Token: SeDebugPrivilege	1996	svchost.exe
Token: SeDebugPrivilege	1996	svchost.exe
Token: SeDebugPrivilege	1996	svchost.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
5356	7zG.exe
1496	7zG.exe
5704	firefox.exe
5704	firefox.exe
5704	firefox.exe
5704	firefox.exe
5704	firefox.exe
5704	firefox.exe
5704	firefox.exe
5704	firefox.exe
5704	firefox.exe
5704	firefox.exe
5704	firefox.exe
5704	firefox.exe
5704	firefox.exe
5704	firefox.exe
5704	firefox.exe

Suspicious use of SendNotifyMessage 46 IoCs

pid	Process
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
5704	firefox.exe
5704	firefox.exe
5704	firefox.exe
5704	firefox.exe
5704	firefox.exe
5704	firefox.exe
5704	firefox.exe
5704	firefox.exe
5704	firefox.exe
5704	firefox.exe
5704	firefox.exe
5704	firefox.exe
5704	firefox.exe
5704	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5704	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4328 wrote to memory of 4364	4328	msedge.exe	80
PID 4328 wrote to memory of 4424	4328	msedge.exe	82
PID 4328 wrote to memory of 4668	4328	msedge.exe	83
PID 4328 wrote to memory of 4688	4328	msedge.exe	84
PID 4328 wrote to memory of 4668	4328	msedge.exe	83
PID 4328 wrote to memory of 4668	4328	msedge.exe	83
PID 4328 wrote to memory of 4688	4328	msedge.exe	84
PID 4328 wrote to memory of 5920	4328	msedge.exe	85
PID 4328 wrote to memory of 5920	4328	msedge.exe	85
PID 4328 wrote to memory of 1224	4328	msedge.exe	86
PID 4328 wrote to memory of 5920	4328	msedge.exe	85
PID 4328 wrote to memory of 1224	4328	msedge.exe	86
PID 4328 wrote to memory of 1224	4328	msedge.exe	86
PID 4328 wrote to memory of 5308	4328	msedge.exe	90
PID 4328 wrote to memory of 5308	4328	msedge.exe	90
PID 4328 wrote to memory of 5308	4328	msedge.exe	90
PID 4328 wrote to memory of 5288	4328	msedge.exe	91
PID 4328 wrote to memory of 5288	4328	msedge.exe	91
PID 4328 wrote to memory of 5288	4328	msedge.exe	91
PID 4328 wrote to memory of 1180	4328	msedge.exe	92
PID 4328 wrote to memory of 1180	4328	msedge.exe	92
PID 4328 wrote to memory of 1180	4328	msedge.exe	92
PID 4328 wrote to memory of 3200	4328	msedge.exe	93
PID 4328 wrote to memory of 3200	4328	msedge.exe	93
PID 4328 wrote to memory of 3200	4328	msedge.exe	93
PID 4328 wrote to memory of 5952	4328	msedge.exe	94
PID 4328 wrote to memory of 5952	4328	msedge.exe	94
PID 4328 wrote to memory of 5952	4328	msedge.exe	94
PID 4328 wrote to memory of 1540	4328	msedge.exe	95
PID 4328 wrote to memory of 1540	4328	msedge.exe	95
PID 4328 wrote to memory of 1540	4328	msedge.exe	95
PID 4328 wrote to memory of 3484	4328	msedge.exe	96
PID 4328 wrote to memory of 3484	4328	msedge.exe	96
PID 4328 wrote to memory of 3484	4328	msedge.exe	96
PID 4328 wrote to memory of 5116	4328	msedge.exe	97
PID 4328 wrote to memory of 5116	4328	msedge.exe	97
PID 4328 wrote to memory of 5116	4328	msedge.exe	97
PID 4328 wrote to memory of 2520	4328	msedge.exe	98
PID 4328 wrote to memory of 2520	4328	msedge.exe	98
PID 4328 wrote to memory of 2520	4328	msedge.exe	98
PID 4328 wrote to memory of 3188	4328	msedge.exe	99
PID 4328 wrote to memory of 3188	4328	msedge.exe	99
PID 4328 wrote to memory of 1088	4328	msedge.exe	100
PID 4328 wrote to memory of 1088	4328	msedge.exe	100
PID 4328 wrote to memory of 1088	4328	msedge.exe	100
PID 4328 wrote to memory of 5676	4328	msedge.exe	101
PID 4328 wrote to memory of 5676	4328	msedge.exe	101
PID 4328 wrote to memory of 5676	4328	msedge.exe	101
PID 4328 wrote to memory of 3808	4328	msedge.exe	102
PID 4328 wrote to memory of 2544	4328	msedge.exe	103
PID 4328 wrote to memory of 2544	4328	msedge.exe	103
PID 4328 wrote to memory of 2544	4328	msedge.exe	103
PID 4328 wrote to memory of 632	4328	msedge.exe	105
PID 4328 wrote to memory of 3124	4328	msedge.exe	104
PID 4328 wrote to memory of 632	4328	msedge.exe	105
PID 4328 wrote to memory of 3124	4328	msedge.exe	104
PID 4328 wrote to memory of 4852	4328	msedge.exe	107
PID 4852 wrote to memory of 5008	4852	msedge.exe	108
PID 4852 wrote to memory of 3040	4852	msedge.exe	109
PID 4852 wrote to memory of 2780	4852	msedge.exe	110
PID 4852 wrote to memory of 2780	4852	msedge.exe	110
PID 4852 wrote to memory of 2780	4852	msedge.exe	110
PID 4852 wrote to memory of 5908	4852	msedge.exe	111
PID 4852 wrote to memory of 5908	4852	msedge.exe	111

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.mediafire.com/file/nsrqnf0ne6xioiw/TRIAGE_KIT_v3.zip/file
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x240,0x270,0x7ffc28b1c188,0x7ffc28b1c194,0x7ffc28b1c1a0
  2⤵
  PID:4364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1964,i,245238753890758586,18427927453054384220,524288 --field-trial-handle=2332,i,13635595407499575340,11337774030154171523,262144 --variations-seed-version --mojo-platform-channel-handle=2360 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1848,i,9225510032570525282,13177237074846363777,262144 --field-trial-handle=2332,i,13635595407499575340,11337774030154171523,262144 --variations-seed-version --mojo-platform-channel-handle=2328 /prefetch:2
  2⤵
  PID:4668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2396,i,7160399254976066113,15142847517547317946,524288 --field-trial-handle=2332,i,13635595407499575340,11337774030154171523,262144 --variations-seed-version --mojo-platform-channel-handle=2436 /prefetch:8
  2⤵
  PID:4688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3440,i,8239061359845142448,4297651418525525671,2097152 --field-trial-handle=2332,i,13635595407499575340,11337774030154171523,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:5920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3464,i,7524644519520465944,17752212595478756186,2097152 --field-trial-handle=2332,i,13635595407499575340,11337774030154171523,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:1224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4836,i,9190156911842414798,18139243761495965317,2097152 --field-trial-handle=2332,i,13635595407499575340,11337774030154171523,262144 --variations-seed-version --mojo-platform-channel-handle=4976 /prefetch:1
  2⤵
  PID:5308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=5448,i,18200265010845233604,3189238374124879090,2097152 --field-trial-handle=2332,i,13635595407499575340,11337774030154171523,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:1
  2⤵
  PID:5288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3508,i,11997153500625632476,151524455102238038,2097152 --field-trial-handle=2332,i,13635595407499575340,11337774030154171523,262144 --variations-seed-version --mojo-platform-channel-handle=3412 /prefetch:1
  2⤵
  PID:1180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=3632,i,8346118613299150123,15581047807524696286,2097152 --field-trial-handle=2332,i,13635595407499575340,11337774030154171523,262144 --variations-seed-version --mojo-platform-channel-handle=5596 /prefetch:1
  2⤵
  PID:3200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5456,i,4368231026395218513,15441913472156243240,2097152 --field-trial-handle=2332,i,13635595407499575340,11337774030154171523,262144 --variations-seed-version --mojo-platform-channel-handle=3208 /prefetch:1
  2⤵
  PID:5952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5064,i,11938345261369039638,10879948352334827119,2097152 --field-trial-handle=2332,i,13635595407499575340,11337774030154171523,262144 --variations-seed-version --mojo-platform-channel-handle=5056 /prefetch:1
  2⤵
  PID:1540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=4800,i,7038636527025138662,13257210347171626298,2097152 --field-trial-handle=2332,i,13635595407499575340,11337774030154171523,262144 --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:1
  2⤵
  PID:3484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=5948,i,2344432674412078175,10959669342622944719,2097152 --field-trial-handle=2332,i,13635595407499575340,11337774030154171523,262144 --variations-seed-version --mojo-platform-channel-handle=5972 /prefetch:1
  2⤵
  PID:5116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6008,i,13397183656228520068,14211645386214864642,2097152 --field-trial-handle=2332,i,13635595407499575340,11337774030154171523,262144 --variations-seed-version --mojo-platform-channel-handle=6152 /prefetch:1
  2⤵
  PID:2520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6500,i,6121952745983810177,12397059867293941502,524288 --field-trial-handle=2332,i,13635595407499575340,11337774030154171523,262144 --variations-seed-version --mojo-platform-channel-handle=6632 /prefetch:8
  2⤵
  PID:3188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6600,i,6066743038228823087,5562057900508497817,2097152 --field-trial-handle=2332,i,13635595407499575340,11337774030154171523,262144 --variations-seed-version --mojo-platform-channel-handle=6584 /prefetch:1
  2⤵
  PID:1088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=7040,i,16577101242722432448,10355846625876375950,2097152 --field-trial-handle=2332,i,13635595407499575340,11337774030154171523,262144 --variations-seed-version --mojo-platform-channel-handle=7028 /prefetch:1
  2⤵
  PID:5676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6108,i,8450882656212253191,9328851612820169903,524288 --field-trial-handle=2332,i,13635595407499575340,11337774030154171523,262144 --variations-seed-version --mojo-platform-channel-handle=6972 /prefetch:8
  2⤵
  PID:3808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6204,i,14992479895491632335,16557802676312728391,2097152 --field-trial-handle=2332,i,13635595407499575340,11337774030154171523,262144 --variations-seed-version --mojo-platform-channel-handle=5684 /prefetch:1
  2⤵
  PID:2544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6880,i,8341990173497298957,2250416680469606796,524288 --field-trial-handle=2332,i,13635595407499575340,11337774030154171523,262144 --variations-seed-version --mojo-platform-channel-handle=6232 /prefetch:8
  2⤵
  PID:3124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6856,i,2319571795685160858,16569732709062706901,524288 --field-trial-handle=2332,i,13635595407499575340,11337774030154171523,262144 --variations-seed-version --mojo-platform-channel-handle=5480 /prefetch:8
  2⤵
  PID:632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
  2⤵
  - Drops file in Windows directory
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4852
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x308,0x7ffc28b1c188,0x7ffc28b1c194,0x7ffc28b1c1a0
    3⤵
    PID:5008
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1768,i,13327361191480167036,1087213232456200822,524288 --field-trial-handle=2224,i,17006002927330926470,15836910345933087815,262144 --variations-seed-version --mojo-platform-channel-handle=2260 /prefetch:3
    3⤵
    - System Time Discovery
    PID:3040
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1636,i,10440728844488557012,230920684090241041,262144 --field-trial-handle=2224,i,17006002927330926470,15836910345933087815,262144 --variations-seed-version --mojo-platform-channel-handle=2220 /prefetch:2
    3⤵
    PID:2780
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2612,i,16272007853415997141,2302050119132995279,524288 --field-trial-handle=2224,i,17006002927330926470,15836910345933087815,262144 --variations-seed-version --mojo-platform-channel-handle=2628 /prefetch:8
    3⤵
    PID:5908
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4348,i,11651660673280638173,5721463739854073133,524288 --field-trial-handle=2224,i,17006002927330926470,15836910345933087815,262144 --variations-seed-version --mojo-platform-channel-handle=4364 /prefetch:8
    3⤵
    PID:932
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4348,i,11651660673280638173,5721463739854073133,524288 --field-trial-handle=2224,i,17006002927330926470,15836910345933087815,262144 --variations-seed-version --mojo-platform-channel-handle=4364 /prefetch:8
    3⤵
    PID:756
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4632,i,1015145344751168336,11151404046633458030,524288 --field-trial-handle=2224,i,17006002927330926470,15836910345933087815,262144 --variations-seed-version --mojo-platform-channel-handle=4648 /prefetch:8
    3⤵
    PID:3840
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4640,i,9591987046595606399,18227688692258395646,524288 --field-trial-handle=2224,i,17006002927330926470,15836910345933087815,262144 --variations-seed-version --mojo-platform-channel-handle=4684 /prefetch:8
    3⤵
    PID:4684
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4644,i,16536620511225260591,12452070965274868333,524288 --field-trial-handle=2224,i,17006002927330926470,15836910345933087815,262144 --variations-seed-version --mojo-platform-channel-handle=4716 /prefetch:8
    3⤵
    PID:1044
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3004,i,7909827572347088024,3427420541504325459,524288 --field-trial-handle=2224,i,17006002927330926470,15836910345933087815,262144 --variations-seed-version --mojo-platform-channel-handle=3276 /prefetch:8
    3⤵
    PID:3300
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4728,i,17119940270376457835,8021725791843377392,524288 --field-trial-handle=2224,i,17006002927330926470,15836910345933087815,262144 --variations-seed-version --mojo-platform-channel-handle=3004 /prefetch:8
    3⤵
    PID:3260
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4244,i,9860910616849747401,13782974458019163089,524288 --field-trial-handle=2224,i,17006002927330926470,15836910345933087815,262144 --variations-seed-version --mojo-platform-channel-handle=4884 /prefetch:8
    3⤵
    PID:5952
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5012,i,17513735567861013453,3968410644451411657,524288 --field-trial-handle=2224,i,17006002927330926470,15836910345933087815,262144 --variations-seed-version --mojo-platform-channel-handle=4432 /prefetch:8
    3⤵
    PID:5452
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4900,i,14258988472706316256,1040375555391627803,262144 --field-trial-handle=2224,i,17006002927330926470,15836910345933087815,262144 --variations-seed-version --mojo-platform-channel-handle=4660 /prefetch:8
    3⤵
    PID:4988
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4048,i,15314099071672191732,7458617365710880395,524288 --field-trial-handle=2224,i,17006002927330926470,15836910345933087815,262144 --variations-seed-version --mojo-platform-channel-handle=3984 /prefetch:8
    3⤵
    PID:1320
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4976,i,9323176703119502421,11590565770075171400,524288 --field-trial-handle=2224,i,17006002927330926470,15836910345933087815,262144 --variations-seed-version --mojo-platform-channel-handle=3968 /prefetch:8
    3⤵
    PID:4688
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5080,i,11508457011971236106,3504012263149451776,524288 --field-trial-handle=2224,i,17006002927330926470,15836910345933087815,262144 --variations-seed-version --mojo-platform-channel-handle=4956 /prefetch:8
    3⤵
    PID:5424

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5708

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5748

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3244

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2788

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\TRIAGE_KIT_v3\" -spe -an -ai#7zMap12357:88:7zEvent3221
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5356

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\Downloads\TRIAGE_KIT_v3\AUTORUN_v3.bat"
1⤵
PID:6020
- C:\Windows\system32\whoami.exe
  whoami /priv
  2⤵
  PID:5672
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "Unblock-File 'C:\Users\Admin\Downloads\TRIAGE_KIT_v3\sample_02.exe'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5524
- C:\Users\Admin\Downloads\TRIAGE_KIT_v3\sample_02.exe
  "C:\Users\Admin\Downloads\TRIAGE_KIT_v3\sample_02.exe"
  2⤵
  - Server Software Component: Terminal Services DLL
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2288
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c certutil -addstore ROOT .\cer2100.tmp
    3⤵
    PID:3808
  - - C:\Windows\system32\certutil.exe
      certutil -addstore ROOT .\cer2100.tmp
      4⤵
      PID:1300
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c certutil -addstore CA .\cer2101.tmp
    3⤵
    PID:2388
  - - C:\Windows\system32\certutil.exe
      certutil -addstore CA .\cer2101.tmp
      4⤵
      PID:6088
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c color 04
    3⤵
    PID:4804
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:1232
- C:\Windows\system32\timeout.exe
  timeout /t 20 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2776
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM sample_02.exe /T
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1300
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "Get-ChildItem 'C:\Windows\System32\ar-SA\' -Force -EA 0 | Select Name,Length,LastWriteTime,@{N='SHA256';E={(Get-FileHash $_.FullName -EA 0).Hash}} | Format-Table -AutoSize | Out-String"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4052
- C:\Windows\system32\reg.exe
  reg query "HKLM\SYSTEM\CurrentControlSet\Services\SysTelemetryAgent" /s
  2⤵
  PID:680
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "Get-ChildItem $env:WINDIR\System32\drivers\*.sys -EA 0 | Where { $_.LastWriteTime -gt (Get-Date).AddMinutes(-20) } | Select Name,Length,LastWriteTime,@{N='SHA256';E={(Get-FileHash $_.FullName).Hash}} | Format-Table -AutoSize | Out-String"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3596
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "Get-ChildItem $env:WINDIR\System32\*.exe -EA 0 | Where { $_.Name -match '^[a-z0-9]{10,18}\.exe$' -and $_.LastWriteTime -gt (Get-Date).AddMinutes(-20) } | Select Name,Length,LastWriteTime,@{N='SHA256';E={(Get-FileHash $_.FullName).Hash}} | Format-Table -AutoSize | Out-String"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:6116
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "Get-ChildItem Cert:\LocalMachine\Root, Cert:\LocalMachine\CA | Where { $_.Subject -match 'Microsoft Root Certificate Authority 2010|Microsoft Windows Production PCA 2011' } | Select Subject,Thumbprint,SerialNumber,NotBefore,NotAfter | Format-List | Out-String"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1824
- C:\Windows\system32\bcdedit.exe
  bcdedit /enum all
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:2436
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "Get-ChildItem $env:WINDIR\System32\drivers\*.sys -EA 0 | Where { $_.LastWriteTime -gt (Get-Date).AddMinutes(-20) } | ForEach { Copy-Item $_.FullName ('C:\Users\Admin\Desktop\drops\drop_driver_' + $_.Name) -Force }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1316
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "Get-ChildItem $env:WINDIR\System32\*.exe -EA 0 | Where { $_.Name -match '^[a-z0-9]{10,18}\.exe$' -and $_.LastWriteTime -gt (Get-Date).AddMinutes(-20) } | ForEach { Copy-Item $_.FullName ('C:\Users\Admin\Desktop\drops\drop_sys32_' + $_.Name) -Force }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4864
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "$i=0; Get-ChildItem Cert:\LocalMachine\Root, Cert:\LocalMachine\CA | Where { $_.Subject -match 'Microsoft Root Certificate Authority 2010|Microsoft Windows Production PCA 2011' } | ForEach { $p = 'C:\Users\Admin\Desktop\drops\drop_cert_' + $_.Thumbprint + '.cer'; [System.IO.File]::WriteAllBytes($p, $_.Export('Cert')); $i++ }; Write-Output ('certs exported: ' + $i)"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4432
- C:\Windows\system32\reg.exe
  reg export "HKLM\SYSTEM\CurrentControlSet\Services\SysTelemetryAgent" "C:\Users\Admin\Desktop\drops\drop_service_SysTelemetryAgent.reg" /y
  2⤵
  PID:3016
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "Get-ChildItem $env:WINDIR\System32\drivers\*.sys -EA 0 | Where { $_.LastWriteTime -gt (Get-Date).AddMinutes(-20) } | ForEach { $name = $_.BaseName; reg export ('HKLM\SYSTEM\CurrentControlSet\Services\' + $name) ('C:\Users\Admin\Desktop\drops\drop_service_' + $name + '.reg') /y 2>&1 }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1912
- - C:\Windows\system32\reg.exe
    "C:\Windows\system32\reg.exe" export HKLM\SYSTEM\CurrentControlSet\Services\vs4endd22udpwq C:\Users\Admin\Desktop\drops\drop_service_vs4endd22udpwq.reg /y
    3⤵
    PID:2480
- C:\Windows\system32\bcdedit.exe
  bcdedit /export "C:\Users\Admin\Desktop\drops\drop_bcd.bin"
  2⤵
  - Modifies boot configuration data using bcdedit
  - Suspicious use of AdjustPrivilegeToken
  PID:776
- C:\Windows\system32\bcdedit.exe
  bcdedit /enum all
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:1056
- C:\Windows\system32\sc.exe
  sc start SysTelemetryAgent
  2⤵
  - Launches sc.exe
  PID:1052
- C:\Windows\system32\timeout.exe
  timeout /t 45 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:4088
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "Get-CimInstance Win32_Process -Filter \"Name='svchost.exe'\" | Where { $_.CommandLine -like '*TelemetryGroup*' } | Select ProcessId,ParentProcessId,CommandLine,CreationDate | Format-List | Out-String"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1436
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "$p = (Get-CimInstance Win32_Process -Filter \"Name='svchost.exe'\" | Where { $_.CommandLine -like '*TelemetryGroup*' } | Select -First 1 -Exp ProcessId); if ($p) { (Get-Process -Id $p -EA 0).Modules | Where { $_.FileName -like '*.mui' -or $_.FileName -like '*ar-SA*' -or $_.FileName -like '*sechostdrv*' } | Select FileName,ModuleMemorySize,BaseAddress | Format-Table -AutoSize | Out-String }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:236
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "$p = (Get-CimInstance Win32_Process -Filter \"Name='svchost.exe'\" | Where { $_.CommandLine -like '*TelemetryGroup*' } | Select -First 1 -Exp ProcessId); if ($p) { Get-NetTCPConnection -OwningProcess $p -EA 0 | Select LocalAddress,LocalPort,RemoteAddress,RemotePort,State | Format-Table | Out-String }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1380
- C:\Windows\system32\NETSTAT.EXE
  netstat -anob
  2⤵
  - System Network Connections Discovery
  - Gathers network information
  PID:2284
- C:\Windows\system32\ipconfig.exe
  ipconfig /displaydns
  2⤵
  - Gathers network information
  PID:3128
- C:\Windows\system32\fltMC.exe
  fltmc
  2⤵
  PID:5556
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "Get-CimInstance Win32_Service | Where { $_.State -eq 'Running' } | Select Name,ProcessId,PathName,StartMode | Where { $_.PathName -match 'TelemetryGroup|\.mui|ar-SA' -or $_.Name -match '^[a-z0-9]{10,18}$' } | Format-Table -AutoSize | Out-String"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1888
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "$p = (Get-CimInstance Win32_Process -Filter \"Name='svchost.exe'\" | Where { $_.CommandLine -like '*TelemetryGroup*' } | Select -First 1 -Exp ProcessId); if ($p) { $out = 'C:\Users\Admin\Desktop\drops\svchost_telemetry_pid' + $p + '.dmp'; & rundll32.exe C:\Windows\System32\comsvcs.dll, MiniDump $p $out full; Start-Sleep 3; if (Test-Path $out) { Write-Output ('minidump OK -> ' + $out + ' (' + (Get-Item $out).Length + ' bytes)') } else { Write-Output 'minidump FAILED' } } else { Write-Output 'no svchost TelemetryGroup proc found' }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5384
- - C:\Windows\system32\rundll32.exe
    "C:\Windows\system32\rundll32.exe" C:\Windows\System32\comsvcs.dll MiniDump 1996 C:\Users\Admin\Desktop\drops\svchost_telemetry_pid1996.dmp full
    3⤵
    PID:3912
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -EA 0 | Out-String"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:448
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "Get-ItemProperty 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -EA 0 | Out-String"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5076
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "Get-ScheduledTask -EA 0 | Where { $_.Date -and [datetime]$_.Date -gt (Get-Date).AddDays(-1) } | Select TaskName,TaskPath,State,Date | Format-Table -AutoSize | Out-String"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5500
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "Get-CimInstance -Namespace root\subscription -ClassName __EventConsumer -EA 0 | Format-List | Out-String"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2612
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "Get-ChildItem \\.\pipe\ -EA 0 | Where { $_.Name -notmatch '^(lsass|spoolss|srvsvc|wkssvc|netlogon|ntsvcs|scerpc|epmapper|LSM_API_service|eventlog|atsvc|ROUTER|InitShutdown)$' } | Select Name | Format-Table -AutoSize | Out-String"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5940
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "Get-ChildItem 'C:\Users\Admin\Desktop\drops' -Recurse -EA 0 | Select Name,Length,LastWriteTime,@{N='SHA256';E={ if (!$_.PSIsContainer) { (Get-FileHash $_.FullName -EA 0).Hash } else { '' } }} | Format-Table -AutoSize | Out-String"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5520
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "Compress-Archive -Path 'C:\Users\Admin\Desktop\drops\*','C:\Users\Admin\Desktop\report.txt' -DestinationPath 'C:\Users\Admin\Desktop\collected_data.zip' -Force; if (Test-Path 'C:\Users\Admin\Desktop\collected_data.zip') { Write-Output ('zip OK: ' + (Get-Item 'C:\Users\Admin\Desktop\collected_data.zip').Length + ' bytes') } else { Write-Output 'zip FAILED' }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4516
- C:\Windows\system32\timeout.exe
  timeout /t 30 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:5376

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k TelemetryGroup
1⤵
PID:3596

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k TelemetryGroup -s SysTelemetryAgent
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1996

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" a -i#7zMap10696:128:7zEvent24722 -t7z -sae -- "C:\Users\Admin\Desktop\Desktop.7z"
1⤵
- Suspicious use of FindShellTrayWindow
PID:1496

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:2912
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Drops desktop.ini file(s)
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:5704
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1944 -prefsLen 27100 -prefMapHandle 1948 -prefMapSize 270279 -ipcHandle 2032 -initialChannelId {b6614881-d22c-460c-b241-48389b7ee13f} -parentPid 5704 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5704" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:3868
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2432 -prefsLen 27136 -prefMapHandle 2436 -prefMapSize 270279 -ipcHandle 2444 -initialChannelId {7d6c71c0-d3f0-42a5-a3c0-f25cd26bf8ca} -parentPid 5704 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5704" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    - Checks processor information in registry
    PID:1800
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3764 -prefsLen 27277 -prefMapHandle 3768 -prefMapSize 270279 -jsInitHandle 3772 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3788 -initialChannelId {df5de7f1-3178-4cfd-a49a-b10956880a07} -parentPid 5704 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5704" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:5760
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3936 -prefsLen 27277 -prefMapHandle 3940 -prefMapSize 270279 -ipcHandle 4068 -initialChannelId {f790bbb4-dc2b-498b-a949-1141daf64c12} -parentPid 5704 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5704" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:4260
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2908 -prefsLen 34776 -prefMapHandle 2976 -prefMapSize 270279 -jsInitHandle 2980 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3076 -initialChannelId {4f82e7df-caf9-46d4-bc70-d8e2123bde30} -parentPid 5704 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5704" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:1048
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 2868 -prefsLen 35091 -prefMapHandle 5252 -prefMapSize 270279 -ipcHandle 5232 -initialChannelId {cf9896ea-36c0-4510-a9ae-3d7723dce952} -parentPid 5704 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5704" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:4824
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5476 -prefsLen 33030 -prefMapHandle 5480 -prefMapSize 270279 -jsInitHandle 5484 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5452 -initialChannelId {728879e6-db70-4913-93dd-8475d1a22ea3} -parentPid 5704 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5704" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:6004
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5672 -prefsLen 33030 -prefMapHandle 5676 -prefMapSize 270279 -jsInitHandle 5680 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5624 -initialChannelId {5633e832-e5ae-4edb-a088-00e60d6e5adc} -parentPid 5704 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5704" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:4700
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2768 -prefsLen 33030 -prefMapHandle 1568 -prefMapSize 270279 -jsInitHandle 1576 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 1584 -initialChannelId {1fe3dbbe-5fcf-4e16-98ab-9c4bb9ea5fe4} -parentPid 5704 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5704" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:5548
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5676 -prefsLen 33030 -prefMapHandle 5680 -prefMapSize 270279 -jsInitHandle 5664 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6228 -initialChannelId {3d6c2ac5-4ab7-45c7-93b2-67ff4eeccf76} -parentPid 5704 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5704" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:3820
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5644 -prefsLen 33030 -prefMapHandle 6240 -prefMapSize 270279 -jsInitHandle 6348 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5464 -initialChannelId {5730fded-8fb6-45db-a209-6a542402cb4f} -parentPid 5704 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5704" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
    3⤵
    - Checks processor information in registry
    PID:3128

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Server Software Component

T1505

Terminal Services DLL

T1505.005

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Network Connections Discovery

T1049

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 16KB
SHA256 452a5479b9a2e03612576c30d30e6f51f51274cd30ef576ea1e71d20c657376f
MD5 cfab81b800edabacbf6cb61aa78d5258
SHA1 2730d4da1be7238d701dc84eb708a064b8d1cf27
SHA512 ec188b0ee4d3daabc26799b34ee471bee988bdd7ceb011ed7df3d4cf26f98932bbbb4b70dc2b7fd4df9a3981b3ce22f4b5be4a0db97514d526e521575efb2ec6
SSDEEP 12:biUXhV0xosU8xCe+JKlkQuMRxCb8ZXfgYJ0IJpP0KLsyW1L7Fx6:bFRqxosU8xWMk8xVZ4YWI30otWn
TLSH
T14F724986B34494EFC883597189BD17903374F6EE5F02839B6A267A0E2E271C44F44220
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 d3349b5bf8012c8a266ee914d107e2883c01d76e12bd40742b738fea1da00a59
MD5 85eedadb7fa948704041fd8dd1248336
SHA1 72829d64ae73d184b6a96e92a60d5d8971094cd2
SHA512 f8623de7672134043e8adc5bcf89e680c704c6b05758f7a6d288b85b872cca85db2f2377446e83c874c26f783f392289ef237ef5e6405e7efb150e99f348f69c
TLSH
T199D0973033FAB800C05400388610324A2F1D8841389B4725F91010BC892A0107BC4087
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 69a1d6c2546f99910c6f349ddb665d530af289283332c1b54d92ff0340de7fbc
MD5 9dd12f0f7f7c020c27ee69da3c41ea58
SHA1 83e40ce506be9fab44d721ec8ab9f5af9722b38e
SHA512 b7f32c8b78e6734eebbbe7cf2944484340e3f32441ca6943b39c0a677d4424de3f45feaa48338f99996e31b46c55212827a384d66c07ed3571ba6ffd51c436ad
TLSH
T195D0C02C13B12C20C0D89938028C3B4F2E1CCC12054B47153C7338BC0C030103CC91D7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 681328c8413fda75a51189b78f6379b1ee0309d75144ca8ff33a2656ec84cedb
MD5 0ff4eec6742c3eafb3e4d2b1be8a17d3
SHA1 87b776cff4e20b419791c0a7a5a49da8d91229fb
SHA512 525896cf68edf91db0d0dc681112ed436a3ebcab42ad2f03d796fa9e2472cd279feafba9b809dc18476c574b82a1f657dead8511e80a203527b2971ba86c4824
TLSH
T100D0222813B11C20C0C4993802883A4E2A28C812054B47152CA228BC0C430103CC9197
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 e926658468d94a10156eef72669896ec0a1e51a2d566342da04a41c3180726a0
MD5 aa48829d721090e7ac5ce856328f146a
SHA1 6a86ba2edb836780b6cef9bbe73f83049fea2133
SHA512 14e5821e302be609441b67568cfea1e2ef3fad190b930f653091308d2a747ac0e2dfa1662c67fd44f5e9b99eda9c43d392cfacbe0652fffb365dc9c0845e7d8b
TLSH
T1A1E0E5BED821A83B48F8471960940646E711134A2A80990B3A3C83088FB067A4199C3C
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 0b6455d5f504a7c99a4faec3fc04dd75118d5f57272dfdb249b080a1aa89d031
MD5 009739fdfc2d16b38cf8c58461b49a1f
SHA1 463415eee3576678df243413784d6468749b27c6
SHA512 a672fe0e20396ce9147bfd9ae51e61a5305090629fe4989989bcaea026334492f85a8d9cb5b65f65a1670a9e00dba1b3e72888946c2a7cc0c66f0e79b7cbd9a7
SSDEEP 384:9X1QyrXdaqyb7iD7WXfCmW74AO50UWFHyqOM7Qrr0ztqIqSquq0qoKMgU11gOZCP:9Bhi7iDKX6vfk0UAyqOorztKlmD
TLSH
T15513B17CFA10EE42EADFC03E08CB0F797375CB64DAD541135336712A2AA674E989E485
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
Size 520KB
SHA256 48ae0033cac9bcd9378101381e6b2e6ff5e0652af8e1fb4e16eab8d2468c32a7
MD5 5967d9082cc1f8d15ff6b55f8f0aa78d
SHA1 8c73a1cbfbe738868f2088af750703a63d60a2ee
SHA512 889fd03fc26f3fa2921b9fa8b2d3950777323399b4f29d338c10fc9b369a4cf6138ff346daf190265e7d91f39f75d7c95d83a9440283b74c3cc1f8486e79df22
SSDEEP 1536:5kz5BgdZ+QPspPwYpcMgoxKCOpdztyliP2TkZcY2PwLbLEZIIFgIlz5wNQ3mFUB:9SPjgaOpLF/2PwLCFF1iBQIfntEdO
TLSH
T110B492F74881A01BCBA812F5E2133A3DD17B094D2DE5F8E9E6384C965825B31B6FDE44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_2
Size 1.0MB
SHA256 aff9387a6306a1797d809d6cd98850e5b5ea2980440066a4b1866d2afb4dd717
MD5 a8e8e9068be9d9a829a29853390a06cb
SHA1 6ea4a719293e8abeef2c00de0992374cf83234eb
SHA512 82ddbbf1e9d248b14d74b8f54e94f0506188f37bdf95b79188e5ecd3bdf86282ba8f0f64801ab40a6f5cb5b2dec861921b51da6db164b58f405b876c3f373a5a
SSDEEP 6144:rZV5/moGc+FQ/pPeezaOgzFKNy1WRxNQR8sRR38ByskT:NV5/Vn/pGezaOgzANy1Wvws
TLSH
T1B4259DDE8F387882DEA79D70F8E0EC2A7CB412C2B546E0C35804C56456867C67BDB59E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3
Size 8.0MB
SHA256 f1fb670d86901c992708372433e4cc35c7255ceeace74a3a638c96f01fcabb32
MD5 3fc205d5d58ef32b099c5095c48cd6bd
SHA1 e262138e3ba8d29fe712a7a8258dbf675dd9d240
SHA512 96663676a9dd8f4773e391650ebc9978ad939c3c628921004747062e030b83bf8593a73b13cddc1c56db326a7811f7ae65486faa657b3194b9fda75b6c82f840
SSDEEP 49152:SecaRhFP7fLrONI4VXrQrcv2b2eGBF4POZF:RjFTTrOCmv5F4POZ
TLSH
T132869FEECA786C83CE678A30B4E0EC077C7412C3B995D1D38858C55846A77C5BBDA26D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 fe746cb5470f419170c66209793d66f75bfbd8e2e6cae9580d39b30a1653b368
MD5 7c4931b35927815954a52d284ed8c7df
SHA1 67c5a000fb80a215704310db8b382d3dc32b6bb7
SHA512 03645dfe2d6e0bd050d6362531b52cf428e53e99c2ae5b0ccc9da792614d1220f3d5cdcae42f7388a87a5b18bacd373a655beffb29727b7ccf616dedded14562
SSDEEP 48:PBCDNCzWnMkAwXdOpofnjBST+dPE3lhBDha3++LrNuhqbUU5wdeJxt6FCjFhQmBY:eeqIwXdDVd0lh9c3XkhCwYOCTMn/r1
TLSH
T1D8A17F07E0ACDA76F794D13416E63CDE32F0871488571E1E20ACC6F84E517A83214BF6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe57d745.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe57d745.TMP
Size 3KB
SHA256 5ff20ad92937f9efeb238b155d2a2a6d6f283e2bee7fd24f42feb709aefa413d
MD5 0682481a7d48d796c744063d86abf5b7
SHA1 25527bb10102c5762533c14042267a6a0bac1b82
SHA512 4c54be3165f387721e65f039bc7ecb19f044b600e6381d206c689a7df818498686347819a5054161c26e40d63d1f5120e253a4667921d4501b9c266f666e94d7
TLSH
T12F61E70BE16DC979F3A4A0711AE23DDD32F081588C9B2E1D2039D9F08E44BA671547F4
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG
Size 346B
SHA256 fb237442758dd1287bdc0ed0ad85ce6e70d8d15a55a54140e529444825760f40
MD5 d7a9abf6d726ce5b9ac8574c3a97ac92
SHA1 1d88954cade4788fec269a4dc977d18faf4ca625
SHA512 9a6f1bfa151e3374885faafcf5c566135f092e8df268a0a92fb4b738f3fe42af56b0c27e52fecdf691b81cbd87840ecac185a35dafea5cc76282f4163c7e3bfa
TLSH
T122E0D8F595DAC19E65113893563C5B4881803553E7D57D4B3704CCD5B707045F24699A
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 322B
SHA256 fb73f5892ab8537398674447f8bdc3e10b66d20226e70736948e1798422958aa
MD5 d09c70ecdf284a558274c8da3addff49
SHA1 8eb4672b777cb69ed543caeb126ef0e046115034
SHA512 9b134c642aae1359e4cc24954ea0859688d85d650d06bdab45c45070b597ed98b71a3c0924f7dcda6566bb982600514eda34e93430e12fb0b2322253ac7539c2
TLSH
T16CE0866416EAC6EAA01868F3C77C530D82D23447B6D87A8727098C5CE545645F29BA90
MD5 SHA1 SHA512 TLSH

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons
Size 20KB
SHA256 5b47574a6182388406ac203826fc061fb242c231fce114ca5cb0318d00bf72ad
MD5 4ba1785a58bdfae0f8c6260802063aaf
SHA1 031bea02c5c37e24ca6a427751e98b012df2f86d
SHA512 1bb32c6deb31dc2a3de8fc1d8a8ac76179df1c7fc781880918f4360f96c83709a0ef974145155aa1f27d818ca88ed9141586b17dc4e9346ac478b11bc7cea97f
SSDEEP 48:uzBmw6QU1PzQ9Pkvi6xVqKRmYhy4VTz7x:6BCxQ9cKkVqKmAy4hzt
TLSH
T1BB92A4935EB47003DB560C36223B147D893BE16C5FB6DCC5382494228DF884270B99EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 204KB
SHA256 8e9ab9d59cfe22b68fa3240c815a3e1c9e989f712e34743dafcf14b48e2bf4be
MD5 ebeaf42ab6cc23d29b1fbebbfb0c35d9
SHA1 d3e0a1ffa961322356cdec08e51f31880aeadca9
SHA512 e9dde62f9006bae3d878dbcec2b71a96e20f45cd0b22d594b3512217d90727f9747ca211e9f161eb93b0303d3674b8d624be3f19adffff48545cf7132e51143b
SSDEEP 384:eTBLoJSx4R/83uICtTBBxBLUSN7DXspU3if:a5oJWIptTBBx5UXU30
TLSH
T15914A91F5FA06321CD7D507674FB51E31C7DF02A8B1269C668710464CFE6A5270AECAD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log
Size 15KB
SHA256 b83850fe30ac7cdefcd66d67efcd5436eb81f88c2a6384770d3b9742fb581d6a
MD5 244aad184f0c5d3cee44b5e00f756235
SHA1 49ec46b3064c880c7e558aa5c73f5fa5b1e526a1
SHA512 bdeb337895a3ea97611fc8739d1580010de79d50fe9a825ee2b1d42b15eb07917a9de999cdb307301e7f64a5e98d5d8ccec3aad6fe4141eee4f3a548b23fa047
SSDEEP 192:EiQ41uTniSW1uTniSw5d0JCcSUbv9lPsCcSUbv9lPqor53qT1uTNiSL1uTNiSstr:ErMlFUz9Uz75aLYhlz7lzD
TLSH
T14F62C77BD9F0DCA9C62BB9B6DD7FBABCA75A4DE7D480F9E4D444204283481F111C1816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 331B
SHA256 b3b9fdd45ddd96471be35208a6ad8e4b0a6288436a9450f52c0e9b7a039975ab
MD5 953334cd0522cead0a986c195de1d61c
SHA1 6afba16a8b0ba5ae849c199a53de3e5a5e7f8bb7
SHA512 3f090cd64c8ad23d6debdac9907e438231fd9f905cc53e03c62b2aa7d00418d0ea65df1e876144e6af123cf45efa21054c0c9e638645a4db00fa46ce9a3fb606
TLSH
T10FE0DFF046EEC1AA620424AB837CAB0CC3B0350BE6D83A866F04994DF849004F297AD2
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Size 36KB
SHA256 6d359a10df527aa71a836801194ff1d54531af99b392b78b832d0c41bf8320a9
MD5 3886fd292b8a3a72e82dd7ae7db8f88a
SHA1 45374ca8ed6d0246526ffa9e49f433e638a63877
SHA512 eb25758dc6bea46db2dadaacbc0030420313d1f302b543d57c31425c20dad58dfb3800c62c97109b2248a8c881b7d6ccc395bf61a3feb1ecdc634ad65ad761df
SSDEEP 192:i2LaSaSGlaE7wpMuQx2drqJQs96vLMlSLyNi5Gu5CH837KeR1sTgexoC3vMy7fFK:iCvLGlaEXBgls9HlS2HO3777sTRo8ZWr
TLSH
T181F2E75FEEC0C48ACBAF153AC5B3087B650629E91603E6D9BD05C963E83475035D6E36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 20KB
SHA256 24b69dafb07eae4ffbfbfe95c6322ba1f7258cafb21e1ab72ac8eefc1290089a
MD5 05f10596abcea3b82f6a29b08d9bb37b
SHA1 ac4e0200d4c8f123837b6a2bf6eca52184e51eb0
SHA512 b287b96e1d6ba2c1fe8d45a026c38f2b1919c560447e98005475b2c997355ac380bfe9bd5f732efe08c91ca8c31e9c97ad95753b5020f0dce9371fd858e43d54
SSDEEP 384:DKZ+c4hT6Xt5vQePre5JxoPwG1xd/aiGu/y24Ek4tuYdsYXCiYrvLAFZOR4VRM2y:PxRM3hovdy1GWo1Y5I
TLSH
T16D929CF783E5C62E89115BF866106E1BCF1D0669432C3C1589D5EE8BE3E3432E16A61F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 20KB
SHA256 8ec316d7c94cc053410e7936933709cc4c6c8d3f8ba97757483d2f5f1fb6a4a2
MD5 bf9d175472fa3f4e10665050b0c0f94b
SHA1 a8ec1035ceca608ecbfbca8c4c24d572f87f6650
SHA512 f6c1a334d5a02a2c8479469e0e59732c71babd9fb2cf2de6b37622cbbc02a491891310115fb43b1b67de4294b4281dea3fc3b175b2f23a8df842ad8f32348d1f
SSDEEP 384:DTIH1BSE1W+kGZeKCeoJuNKF1MqG8aaiGV7/y24Ek4tuYdsYXCiYrvLAFZOR4VRi:RzWM3hovdy1GWo1Y5E
TLSH
T1C6928BF783E5C52E89115BF866106E1BCF1D0629432C3C1589D5EE8BE3E3432E16A61F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 2KB
SHA256 74d80b46f40007f20c8540acd7eb849b7321db2028045f7e08979043cbc1bff1
MD5 538b29e9539f1a0f4258bdb029203fdf
SHA1 b6f3315d88d198952c5b1b97e72c8b4f61b26dc2
SHA512 b032577c85c2bc09913acbd14fd646f523025203f643773cc559a304d9e95d66e951fa65c994632fd6cf17fdc8dc9a8f5125af97de1eac71b5383e155afbeace
TLSH
T1755168EBCA6EB927247D0E7B2F54B8092D66F83901C1E4F5CFA2916D30D08F31B46066
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 20KB
SHA256 a8b23e2ed1cf14a03b840a8f407f4fbefb7adcd7fc992f42f72091c3aa2c292c
MD5 26bd62011ba594d5c4f29a73f4e910aa
SHA1 81eab4045a13f2633d1d2890f7b253a552dbb44c
SHA512 d451ea9631848aabc820d426a37b313e8cec53bb29122278c7d9d1ff5b17ce228361d18e9cceaddc6573eaefb9578907307fe0a9447f0eed4b10627472da1935
SSDEEP 384:sxZOZBLr/fEskWvROnWMpWRHb//mxbDB79BeyV3ZB5Z9:sSBr/fMYROnYHbHmxbDV9MyDBt
TLSH
T1C8A2C697B534097B8DDAA625F581B73BD2E5042796905E81AFFCCE0C00E7AED6102C7B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 19KB
SHA256 6a67824c08e2d14f4dfb2a93dcc4d429a573c1745582d664527ebe252ae081fd
MD5 2816e7d96d66c047fb2d95b258a011f0
SHA1 6e5b895d4e67a3f696f265e9d71f429c5959843a
SHA512 2f11c8ee955f4dea9f01c66f578b351e9964175a109625d8f5f7bc4ab2ba5dea96153b6069a12c135240b9586b71c72c6c549b94ec3dac656d5016438a4809d5
SSDEEP 384:sxZOZBir/fEscOnWMpfRHbo/mxbDB79BeyV3tg4j9:sSYr/fkOnTHb6mxbDV9Mybgq
TLSH
T14E92C697B5340A7B4DDEA625F581B73BD2E1042796905E81AFFCCA0C00E7AED6106C7B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 80f3f1bc5b385482f8588868e472d608d05ea65a7ec7a0de8c6ef8a938282671
MD5 dfa706f2a32bb0cf1f5b595779958eb6
SHA1 a8c4d85ae05307397e8277796c2578d3b397df45
SHA512 edfec64ca5855a38046113ddde6b79a152e0f3165c78494d7e817131bfb7ac0ce2e6d431dcb1c499f1a6c7d27cfc4fb0fa22e0ee1efdb0fb4b48e09f80b4c2de
SSDEEP 768:vLIL+AI7pLuL/GeWvGSnq8F1+UoAYDCx9Tuqh0VfUC9xbog/OV4D2JLlVzetYroz:vLIL+A0E/GeWvGSnqu1ja5D2JLrCtj62
TLSH
T1EEF21B7B6C0CCB7E4F804E9CDD2ABE8A6DE8018B56D8C9544BFA480C03C66EB55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 335B
SHA256 1db4429324d307a6c5a119de93570a72aaccfc936e564f6ba055d780a4e1a794
MD5 4e8321bb5a9bd2dd5ba9734935b399a8
SHA1 0e09b436db6b9c8d3942ca5c72233cc0032a6d29
SHA512 b7966e6aaf448218c927ec0ca779a7232557c0d4a72fd7b83e39c1116f5c07c77be3ab2760fc69a32d1ec4ec9af23d99e05fb9c137db3a48ab06f51c7763018d
TLSH
T1AEE026E017E8C2BE7016245B0B398B0C82E4F40BFAC83E863F00CC48A947504F1979A2
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log
Size 112B
SHA256 2e5c76f4303d35ced1c5aca4edb2d8f85f2aa41acf1fd92e35c027abfaa33824
MD5 bbb833e7a43dca4394fa4024e834fd83
SHA1 4acd46caa8814c6e85b803a2bd61a197954984ef
SHA512 2d5f05771c56b8c111316228890a813fbe21918073f65cf61102da9af9f62279a8d451bba2d638c556ad83674362b99fa0ed05b3841cc5c77e5f1cebb6c706a0
TLSH
T13EB092856B048202C0AA08B1419297887260A00600004A238D599B200E096A93E008C0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 347B
SHA256 22c4cadf7cbe74514663d7b270b1f6d21decf82466e4e46df69d114b572b74f3
MD5 55cf7f0c560e20d47908ba8854a5b18a
SHA1 39a1f4c622317989280003773a560fbd20b8bc73
SHA512 91dd05f1fd4053f1964ecfa308c4ac0adae57d63d5f90784f368412989b16c80b8f0da2a6a7a5712d6a897cf5c23792101a3e489a12f04f08932c0e7a2da9314
TLSH
T1C6E0D8B066D9C26BB14531AB433CD30881E2B403E6D939563F0CA848A64A540B247990
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 326B
SHA256 c7fbcb739e1fe9a954ea2ecf477151b5948289026c3f5f512274931c5d570688
MD5 f853ade705e7bdbbd9c46c54a4a5ada8
SHA1 155d093e90ca18683f771cad1bbba6aeed4a171e
SHA512 81945bf7816a2988d59301b095e6f2f4635e9ee0077cc2bd5da2406bea09ce3c87ea71cbfc46c03ec7a7ceaf32f027ac61bf63378ba3ba21a272b9bd074d37d8
TLSH
T1ABE086B056EAC27A600870D74778970E82F1B817E7D87A8A771C886CE905544F3ABD90
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 1dc9d782d8879f6dfd6dc4e6996efbcc80080e5720c90eab8496b080232f77d9
MD5 7f207f2e158b2862419ba1a812c89256
SHA1 acac842c78c48560eba6839d73b4438e16561f86
SHA512 da6740a3b486e1391c3270be3b1010a349efc06917f974c46078c02d0c6caf4d4c9f324da35fbb3fef53c28966f464230ee73a353b54f84fab9e69f6f0808a23
SSDEEP 192:W75v/AjXMvdf93ElPpR8VhT/jyneVJ91JLKZJOrxt5f39X3LJ:WdHAzMlfNE9k9ftX7J
TLSH
T1CFB24C3171FAC2103A7D3AD89199BC27474230A27058E83B7FE814A64F67E154DFDAE9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 24KB
SHA256 3ee63cd66b7598bb34c94edb9f1a65cb9ede530d9ff14e52b026617fa342720b
MD5 9e754888ddbe22c4bdfeb01b6d29c5eb
SHA1 a1cf47ce0592702fcf5dc3d160bec5ff3ab304f8
SHA512 d9edfa1b50ee621f3c6e5c0faaf7f54b79e3cd35aeca9bd391b7b61565692dc97a18231601ee27f5eeac0d73cd3cd4805a2df9124e82552960df22507ee1e8d4
SSDEEP 192:W75v/AjXMvdf93ElPpR8VhT/jyneVJ91JLKZJOrxt5f39X3Lo5Z:WdHAzMlfNE9k9ftX7oP
TLSH
T10EB24B3571BAC2113A7E39D89199BC27474230A27058F83B7FE804A64F67E144DFDAE9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 224KB
SHA256 80daede806c8b943305a3636c89d0cfa6d61e991a600d40138b8937c11a52da7
MD5 86fc60c264de00a1c714d609b65a8d40
SHA1 cf1fb6ecbe9a85df3c9e87b3d258fe36cb6899c0
SHA512 c189b65a87ccb9f1836bff0928b5d7e703eba8988b72fe4c5df78b8e21c8f56f98a3e657bf3088ac5d97120ba202307e675a633460f24a302e2610aa86892674
SSDEEP 192:P+xWdkfT8w0QQnG2IMW1hPJubRd6vPtcdCewdbsc7V1VJ:mxZfQ9QQn7IMW1hPJuVd6vPkxW
TLSH
T1B924730A7B747001EDE6D9725CB080771E3CB16DCF22A6925DB254698DB2853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default_cloud_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\default_cloud_config.json
Size 13KB
SHA256 f9e4da319fe1f5a7d497c452421f4648a24ec7588f309ebea0f0cd61a6251eef
MD5 256c40bace492c4e28451ce149d2f9ac
SHA1 b48b0eaf986b9efc91d5c8dd394dccb6d82e2adc
SHA512 33b38d1ced015798722180fc8c8ce6daedb18cd5d0e4b3db27d6176c13cf3ccb1bd79f2e68ca390d6eb43ac508c29067e8f1a3ee9f0167cabe37ebbddf6b0ec0
SSDEEP 384:l7BJeojewj9mg1IZyvASoIL5QJwTcoEnE0YU/VwTcoEnE0GU58:l7BJeojewjcg1IZyvASos5FEnE0YREnA
TLSH
T12452007AD2211C7719B8636858BC4692F524137F8281C81F78BC656C8F7FA79A089FDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 13KB
SHA256 295e1583f490d7354004c4730671bf0a18316df06000d531459a992224b0e422
MD5 6fbe8a2120473399a74a8f68181c83e6
SHA1 c26de216b40e211520f6c43b4519a84c273932cd
SHA512 5bd3272ea6af08506e0210d024e86d236948c666dc34682735e771108d73f71cc1e518c891b8b7dc0b48dfb6bea09d88a04844b30147643f1c075dc845b85d2c
SSDEEP 96:089+dvgxZkfQgOXdZeDWXWY1lDUseChAWVvlrhBvWWVBmdZx1Q1pwl5N80+C010F:GPORTAsvlrhBusEdZ3uel+4XXX
TLSH
T14C5284A72A462733C31EAD7B72BA9B4103D2D8964E1166DF7520145D2EF2B278BC42F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 322B
SHA256 da96fbbf8ad093e114e31a6171402436f64e5729dcef89450f9e9b7d5ce54cac
MD5 830f056a23bd387e1d4106dfbaa88332
SHA1 6a1c695b84b5e3f6c385fd40b1ea5e3b7f17f4fe
SHA512 71f52a2fd79e56f059a9fdd712d5f9dd17849c49425cdbc10888e87cce8403100610c8172367f817225cfbcc3d00dc4ce198a6f4ccf57ca712840898a65abf2b
TLSH
T1CCE02630BBEAC1EFB41820E74338430D82823803FAE83B8B2F00C86CE445100F68B9D1
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 2f42366bdf3c1eab702386af023e135a5363a1c856cff30c78c1703a49dbf624
MD5 693cec97dc1bf0bfe36c5153ed3645c0
SHA1 f7475e60e9d377953692fb65e8a8c5c1314ea796
SHA512 f6761ab08072fb77c2ca1dfb083204b3cf7df78cff72ed597624ea07d602aec3cf8c034591c939332c71a7b63897216e126220f6d1a8484da96fb9173908757f
TLSH
T18A215A16F321D018E18A927E956B97255338E8169FFCEC1F95B920352E72F050E8BAE0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 340B
SHA256 99f0d532352ae0d6d60551b9eebeb6329d265a4fd9f9b98ab95f4899ec0209d5
MD5 b008931739bca1a4b62738a40843f44e
SHA1 ff8de0b658185d76e558f2ebf97cf16f1d0a8dae
SHA512 77e9205f53f3d8199c5839e29a1d8773ace000c4b21a3164400c177834b6c91d1703463036fffd96f86d310dc4d06a99ecbdc91dca50aaf7ae5dcb4f09ccf0ce
TLSH
T1E4E0DFA0B9EAC1EFA01830A30378974D82923C93FBD83E4A2F008C4CE945141F68B992
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1
Size 264KB
SHA256 896fab5e28e77c3576f9e32963b3f413b009b554ae974a97662fa3127545a253
MD5 049ec3de876609e2369df56ee1ec2a5f
SHA1 a87753621497907ca11c17239743fb3cfda7755b
SHA512 34d404afce9c580c9e5d5debc7ac4e578812c200b5c137542457bc8ed1e68abed3f3effff03b40acb06b2a72fe6d8d0617491ff01b98c7e698e2c7515e75d643
SSDEEP 3:MsEllllkEthXllkl2zEfll1:/M/xT02z
TLSH
T11A440404FFC41547CD0050304453D3541774DC144511574775D10C735CC75404C00100
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 31KB
SHA256 1cc2816968b0dacf32bb7ee86d60fc5db380f5b8ea8e579e4f5eb88db94b5910
MD5 2942b96dd849717926eb9d179a9ca539
SHA1 7bdd46650885040cfc99e96d40713892f6fcdcc9
SHA512 e9e08d05c1e893696895bd0b99979d73c5bb5a8edcb58e4632b1144c1c6d24c8fa58fea86eca395a348422898f860d40c9dae6d4245322f823c3c7c9327a7249
SSDEEP 384:n+iFHvqMOsNr8TUNTUlI4kzLFzIitD4fjKQAuHTci+D39rkCe9WdLNjk+5vI+U:VFHy3IwgrBgKQAsTOD39be6o
TLSH
T132E2067CDC54C9BF98EEBF89A30D2A129DE40233D4B88998E7D80F4D807649DF746825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 6d70b8afc834898827c3e01e846623a2164b6b94e1076f5be3be973b11dcdb00
MD5 44ecc8c3b27ae19122969605915224d1
SHA1 63c1dd4fa70e0ebcbc823400a3ca12400a2b0077
SHA512 732a6e08847cc7ae6213b6883ae187cbec19a25294a9b4fc377b41a4ee35d9840e340176fc4105f9a78f6e4360a20191c6e94ddc1d8c732772e8623b22fd7cb7
SSDEEP 384:nJiF4jccCs+Bt0S3CsNp8TUNTUlI4kuLFzIhtD4fjKQAqsTWq7K+ut/WdF7Ig5GW:gFmccQiSwg2CgKQAqcWgK+ut8Ou
TLSH
T1DEC22A3ADC94CD7FD8EA5F88A34E7A538DE04273D5AC5AD8D7D81F5C00A709D930A826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 a02676e4dd13a6d459cbf232139f98691380ff7d64465a4c20d133557ff6a7fa
MD5 3c6ad9c1f5353e5d82a9b3da0266c160
SHA1 0c70150b12a1c327c09d93dfea6bffcb53553187
SHA512 9ffc03636d00d26e42590d17a6c3297a143c4c2edc6c9125664596a92e4d22bae25d49a0745f5f8e5f0768c47a25feebbee0989452551e2886d7c5e95a879abd
SSDEEP 384:nciFavqMg3sNN8TUNTUlImkrLFzXBBD4fjKQADfCIs+5vLNjk+5vI+D:HFayv3+wgxvsKQADfCIs61H
TLSH
T1D3C24A76EC94C9ABEDEA8FC9E74A3613DEE00267D58C5AC8D6D82D0D009B0DE5307C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 0b0e177062374ce9cad093f41c82dcfe597c065227fb23227f9941cd38a867dd
MD5 def2bac9b28ab9673e45a837b3855ede
SHA1 1ec1a3c0478a5d0b7e5e7b8fafbd4bfcd8993e92
SHA512 5bd9d3d41ef5b5192785fbf828ce5e47b3e17034ece1c174f11ac653d56ea19310f740825bd2066a31fbd6b27d393e6dcdda1c9f895d45cc22932d92d5b582c6
SSDEEP 384:n+iFavqMOsNr8TUNTUlI4kzLFzOjtD4fjKQAuHTu9WdLNjk+5vI+U:VFay3IwgrUgKQAsTu6o
TLSH
T147B22876E898DDA7ECE69FC9E70A3643DEE04263958C5AD4D9D82D0D00DB0ED130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 6971264af95aa2bf0bd9474d624effb3327403eac77a8102400088246fbb3a4c
MD5 d7da9dd5a474fd35812e69f5e37d8607
SHA1 332509ec4fa353ef24555231c4c7f3acef80e59f
SHA512 d5bfbe5a983a446038ae3e0613788f03c47786c2c2d687de183f02eb1e62416cf1a146bd0776b95465493456a6957f9f953654711f0d7ab592afb3a468286497
SSDEEP 384:ndiF4jccCs+Bt0S3CsNp8TUNTUlI4kuLFzIhtD4fjKQAuHFE9WdF7Ig5Gf3u:UFmccQiSwg2CgKQAsFEKOu
TLSH
T1A6B23A36EC98DDB7EDE78F99E34A7A43CEE0026395985AD4D9C85E4C00871ED070BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 564f0fbb74a1aaf25239fa037725c838dcba3ec9fbca6edda53f6f5c8c0c3a17
MD5 c1a8b67b6cd0bab0af41cfbda9611d87
SHA1 e50ecae2e091b852bf1cc8cde7503fa765eae240
SHA512 062c3a3d3eb2daa80a894dadd9e443860d5a1424b09b0d315c31767c653c7f303a34405e7887838a6b602b8ab4b395f8cc32f89f10335471f43b56b2dbeaf5b2
SSDEEP 384:nOiFavqMg3sNf8TUNTUlImkrLFzXc8D4fjKQAuHpuCIs+5vLNjk+5vI+D:lFayv3YwgxC3KQAspuCIs61H
TLSH
T14CC24A76E894DDABEDEA8FC5E74A3643DEE00267D58C5AC4D6C82D0D008B1EE530BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 31KB
SHA256 157836b0b331aeba4958c50694e77c64e23020399381b23ae478f06a10008a1f
MD5 e0aaa47644c86a4cdec6e01fdf168ceb
SHA1 4632b160b9553f4db79877d1219defa5490de312
SHA512 8e6985c6ca598ef755eee886801b171f7ac3b68675ed3ed30fde98a7c6303cef328e0ba50d864e67dded7bc3f4b5b11d8ce74396321cdae4d50021d40cdeb8c2
SSDEEP 384:n+iFHvqMOsNr8TUNTUlI4kzLFzI/tD4fjKQAuHTci+D39rkCe9WdLNjk+5vI+U:VFHy3IwgrggKQAsTOD39be6o
TLSH
T156E2067CDC54C9BF98EEBF89A30D2A129DE40233D4B88998E7D80F4D807649DF706825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 565a8f9288844bb65c99b78f312b42f03a4a6523a8ab80d0eaf7ec17de7f708d
MD5 2353a869af79b2854598e783dd3ae393
SHA1 6405f02e838f7f4bff1452b24ec43801948be4ca
SHA512 dc4f58cbcd7b4e9e9ca8f3c7ae0d659cf1168b6383f2c0cf8f65d5204f237f169f8170ce865eeac3eba3542418cf290722fef4ffde32d86e80d7c3f715bbbe5d
SSDEEP 384:n+iF4jccCs+Bt0S3CsNp8TUNTUlI4kuLFzIhtD4fjKQAuHFE9WdF7Ig5Gf3u:VFmccQiSwg2CgKQAsFEKOu
TLSH
T198B23A36EC98DDB7EDE78F99E34A7A43CEE0026395985AD4D9C85E4C00871ED070BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 9aa62018d8e41e0d31c8bd44478fa0a2bb525d86f259888c611360501bd6b9c4
MD5 01952b43f71fd704037085266b52264a
SHA1 fd173297112f4f40d15f2e862925652eb5513a94
SHA512 827cfb3900915c9cbe33833f52846fea43cf4a2180a99fe836f748f410081084797e2810885c256d4e33db4e7b795958dd2354769cea5ca5dbe42cf5731490ca
SSDEEP 3:MsEllllkEthXllkl2zEflL:/M/xT02zC
TLSH
T187440414FFC40457DD0054314055C3501370D4100511574777D305735CC7550CC44100
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 60f0065054c2f9f2f4e339857bef195339d55065fbbab4596e782f4028e400e6
MD5 2d0b56ad8ba5a9ed843de266154da5a9
SHA1 db6f0f4c6174094930c58f774acfe8e7bb00fe10
SHA512 81dfc1e7028c2f947caf56ad028e8ce3d47d7a240b4c4da1f001a0842137be675bc3bfea8e0f8383c0447917913950bc7aed6f16863b6296b7fe032323868441
TLSH
T100414FE04C3D26D1D4BD0A2E749B78FC82DCD729F4A4357D6824EA980A3E61D688443F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 f77cb1d0e860601966742d5c09d98f18e9cc40fc938e6f459656890c9195440c
MD5 9c63b0b85b233f91ed7add63fbd0f94a
SHA1 5c7ae6e476dd35951e2cae58015f6fb33d1b449a
SHA512 80ec0e2cacfe63211f833b3df26b0ec8fee0397ef47fd3b05a9f0dc272b646b09634b204395d13aeb5739e76e4877457a86b336ddcc6059e5ce949269457c0d7
TLSH
T1F54161E04C3D26D1D4FD0E2E709B78FC85D8D729F4A4357D6828EA88053EA1D748043E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 7b22b06ec68aadd097f7856305ee9308298b1c1ad27d2948dc5999f79f2b6ad8
MD5 365f9fda750deb207886737ea48988b8
SHA1 00a3e9bbb10691c486e8a7bdf59a08ba251fb197
SHA512 1148316852b5b6c4745f8f122fb1200224603fae4ae6324fb5c71aa39de8ca1fdc4ef8f689d78a743980d704133b776e8e8ba0ba79947eba96ea90893365a39c
TLSH
T1C14150E04C3D26D1D0BD0A6FB48B38FC85DCD72AF8A4353D6824EA94453A61D648443F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 70113f329d326bf3b09068322248b3bac49ab1f4d22f6722434eda72053cd168
MD5 ff5ca162f754767b06fea1914e8b0bce
SHA1 783a775cbde525fdea171a34739c2dfb2e9e90b4
SHA512 a0716d2213d14da1ee83b9c20a3da8f42f33b4d40c967d2277e1e571a6504a1961e2534cbb917cf5026a3660694d70b4c71717a925febf6cb9c258091a0d9bf0
TLSH
T1BA4153E04C3D26C1D0BD0A6E749B78FC95DCD729F8A4353D6824EA94463E61D788443F
MD5 SHA1 SHA512 TLSH

Submit Download

3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
Size 147KB
SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
MD5 9c670f04d98ab7404f16423f6ee6cdfa
SHA1 8d01079b2d065731df8a7ef52f447cd4b7add353
SHA512 102cee76d9dfcfe91e044f529672fbec042b50c5db55a3cc137197b2013dd7f81e47f50dbb0db96cb621c5732610e1eb553c4146837c11075c7c4dbd67546a3b
SSDEEP 3072:F7R0M+jCozOtDTsjMcT0JnFjkbxnEbm/+OdGmlVVklFHEpCm+:F7WxxzyDTM0JnRkb5bJdGmJkvkpx+
TLSH
T12DE3E16D3DE6DE1FC41B58F53E64708BC80E8F0B820A644FB64988345A60B5D1BD6AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 54f761e00d363bd15db7bae3cc55144c80148a5fa1db7c3c2049e0e406a9142c
MD5 b1ac780361002049b0a10a7fd30fd809
SHA1 0ee0a7dc27fd175ab7abd6e5649890be3e2795b5
SHA512 1bd8b1d2dc30bc62728d3d08085a446e8c037b02499687affa9a0bb18c6bdfee19104eabdcd8a52c2d0b542046abf26b7fdf81815037d4923e31231b0dfb7d60
TLSH
T156C02B5538F9488C2FA5257ED238092E12E4C912310022B0002ED804103465C13A0C2F
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 c8b077628d4e5fd6c8d499286575c8cb48c03cc9e6bf0f5b6e0af00b9a69d19d
MD5 96a0222719da12661f7859fb5fe7d31c
SHA1 af5bda75b49565ccabc482d7ae2a7b10b96ab627
SHA512 eb369fa96390d4836137b6e4088cafaa4d3f3f5aa9d21d9f83d74440ff026cec14ab224ce908c72d4a240090fd7ca28fba3c8fe44275c60708108837da90bedc
TLSH
T101411C68A6EA1148B3B76E169BF6B86D447FBD771F06D49D10010D4F0663A00C8B1737
MD5 SHA1 SHA512 TLSH

Submit Download

8b0d4544beb97a69dbb9583fca5575a9aba6e37d.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\8b0d4544beb97a69dbb9583fca5575a9aba6e37d.tbres
Size 2KB
SHA256 73f9b87fbd19360ade93f64e891f3d19b8e74c9d4a2821659b763e6919f9d874
MD5 ee0f7396af7b0df2fd983388f4ccdbc6
SHA1 5b9ef862526ced2b4efee52a52cc3ecad92bafc5
SHA512 1ee083fb723f5bb216e825d1efb3b2add2103726e81bfbea5cb91485f197d2d99ea582d7e5cb5e2ab62ea32f6177fa67c48ce3e36ed48c698a4111936b867fcd
TLSH
T1CE515A5866ED1108B3737F569BF6A96E893F7D772B07D45E00010E4F4A22A40C9A1737
MD5 SHA1 SHA512 TLSH

Submit Download

CD1C116DEEE8F4F97C1806976E10E7E2B349E486

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\7fsufqe7.default-release\cache2\entries\CD1C116DEEE8F4F97C1806976E10E7E2B349E486
Size 13KB
SHA256 4ba1ae43beea387082a9622d693d82d980faaaad221781682cd274b1cf4a2b8d
MD5 3e7310dbe3b34930369a4543643d20d8
SHA1 751394256e1286cee189c244a6b8903021437249
SHA512 1b91b3e02bb6eba53ed81b6f8d6c2925c544542533a888f131e8b77ae0c8ea60ce1037d98fe1e926797ed873a085733348b971b2859341869ec54a0ba376dfe0
SSDEEP 384:HbaFrLiO024Y7Fuhw+5EL1pPsac4j0lpDII+mBzBW:7aAZY7FuK+5EB9sac4ID8Lr
TLSH
T12C527E7D9F0138BA0A67D1D4D8AA9214CE04D6BBEFE2D16606143C44CA847BDB8F64DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_4jj0by4k.0ms.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4jj0by4k.0ms.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

f51538fc-9f13-45c5-b377-04b9752cabef.tmp

Path C:\Users\Admin\AppData\Local\Temp\f51538fc-9f13-45c5-b377-04b9752cabef.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fsufqe7.default-release\datareporting\glean\db\data.safe.tmp
Size 26KB
SHA256 89e4b31d08d036e122b2574a53281c02c7c0d2a12111c90b8bbeb936e07bbd0b
MD5 ea230bc718e3811eae9b355c175fb003
SHA1 b69475f75233e0d0dcc208338b2c36a176b041fc
SHA512 37dfaf8a23f6d9c02cf9e4556cd1709daeb41574097db95328abad00a150f293c798f880e59c648f3b856cf86c7e9a58a7fb9d721d7eb5ef48e2cd403d017685
SSDEEP 768:3P9G3CnC0zGcmhuwgRoQCvT/bvb4b4bH:43Cnqg0
TLSH
T1F1C2FF44EB1E953FD41912BADC964B002F78F88A59192FA73A4C646C6C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fsufqe7.default-release\datareporting\glean\db\data.safe.tmp
Size 60KB
SHA256 ce877c8b8eae68c7f4044f39cd79f374f7e2e7a3901d0dd7ba4b8c12b2034af9
MD5 87ed8f9db8008cce3abb38bbbfc10ed7
SHA1 9bffc6edea7e0d6446176f033f70244de7396537
SHA512 206c9bc366d9e9dccd18a1b4d6f92bbe876cbac42d724ef538aa85d63de4fe267f97a869d6b91eda0f7e6956a5284544fc9e6c465bfdface9d074e11f84c741b
SSDEEP 768:IIbkhXPNfFVAv9gEWDGcmhueoKWNC8RiEm3EqhAbMb7bLbnb8bSb9bzbjbtUrXIh:IIbkhXPNfFVAvfzoCUrXI1OpjxkEDM
TLSH
T125530144EB1A953FD82802BA9CD21B003F79F8895A1A2FA7375C54786C873DC3D5E16E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fsufqe7.default-release\datareporting\glean\db\data.safe.tmp
Size 29KB
SHA256 18e03fac314e1b729d368682ef5bfc275d1e919c8a9d69aa7b77fcdac746e1e0
MD5 615d025dbc65ec14354f7dadf7a3c7fe
SHA1 d77b7d55780638fbb639ac0f9dfbc632a181c0c7
SHA512 24735cefe5753767514b4793d33d87bf5420e88824594a8bec683bf63133cf1980f65a4b61f9efa0fdb765223b6b56f8d2fe84384404baaa94b79e91efd7001f
SSDEEP 768:8CYP53CnC0zGcmhuwgRoQCvT/bvb4b4bH:U3Cnqg0
TLSH
T18FD20344EB2A953FD41912BBDCA50B002F79BC8959192FA73A4C646C6C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fsufqe7.default-release\datareporting\glean\db\data.safe.tmp
Size 29KB
SHA256 c6e2566863d1b633ee3aad6a6659c40a4250cdfcec0ecb07643c3e3936ccd711
MD5 e7cf88a47064a8dc7ceb2feefb8939a4
SHA1 1ecb6cb40e06ca958335cbfce2621300b2bc0d0c
SHA512 1e11e05b281a0b9436beae4c5e9731d08bb3102bbba750a4f9f74cc32fd3c09feba42d95978f1dab80142e9c58017e1f827e86865db3bd5b284830e6788c239e
SSDEEP 768:uP53CnC0zGcmhuwgRoQCvT/bvb4b4bHEbs:Q3Cnqg0f
TLSH
T15BD20244EB2A953FD41912BBDCA50B002F79BC8959192FA73A4C646C6C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fsufqe7.default-release\datareporting\glean\events\events
Size 1KB
SHA256 fc5f2b7b024bc553b35f3d0c6d78146514e67a18c79356a937d7cedeab70642a
MD5 f25e1a784d5a36ea58301da44b48dbfb
SHA1 0e3f55ccdc261b0107d494a7efd47fec5debce75
SHA512 d1e918861395703bc0d6e63ddf1d79ab13efe34ad93d1e81377484efafa763b80adb8f823ddf41e56bfd17c3816f25dc8f81269eed0f2866102c3b59a243d44d
TLSH
T1AB2160CC39B94D1A68DEE75C7441038E53554E4B05C75C834E92DE8CCCA9AD931AA43C
MD5 SHA1 SHA512 TLSH

Submit Download

3ed54589-6ef5-44fe-8fab-88ca95d5de89

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fsufqe7.default-release\datareporting\glean\pending_pings\3ed54589-6ef5-44fe-8fab-88ca95d5de89
Size 235B
SHA256 8ba5e8d4e3ddf6e88f09f237035f9726ce1b421337df04948e72908b8691aac0
MD5 b0934cf485706a8b4e048bb9e460ae05
SHA1 77b5647dc219a264dc9481c9a788803a138ac4f6
SHA512 0da9bdcfe9d44af830c75ee30317421c9e3bdca3a1ac8d2e7de3b4b85a5fb45231718d77c3b28532fd8aa9b601eb3e2797de12558dd05575f8a6968e20da474f
TLSH
T119D097842488632C48140F1BB0A17EC230844C332462A8208AA14574EEBEEC982A2A97
MD5 SHA1 SHA512 TLSH

Submit Download

487d29ec-b8f4-432a-918a-8cc4f3cf25a3

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fsufqe7.default-release\datareporting\glean\pending_pings\487d29ec-b8f4-432a-918a-8cc4f3cf25a3
Size 886B
SHA256 a558ec90e1455757f2b9893f8678c5eef3f38c64d423b8d5befd3739c9ce931d
MD5 cb31f30189a1774b12b8618e6ed6f1b7
SHA1 f1522cf62aac01bfbc63f38c5de1155dac02b1f9
SHA512 cb7225cf067c7d767390061aea1c272425d393f73a6c513c897626c28c4745d59ce587ce21e1970be781f9b7409f6816ec7088d91392d8eff0102f38edf52b45
TLSH
T17D1123529A74FDB28C6CD38798D0BB534BE47523C4CA58143EE04A0C0DAE61D6796757
MD5 SHA1 SHA512 TLSH

Submit Download

5497566c-21c9-4fcd-bd22-b7672653cb9b

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fsufqe7.default-release\datareporting\glean\pending_pings\5497566c-21c9-4fcd-bd22-b7672653cb9b
Size 6KB
SHA256 f5876043bcc053d1305a4dfd1479e2a6682af009b6fa08dc233122e044cdb70a
MD5 0118c1de312d4b4fb6404a504af9e5c0
SHA1 43d151a2df63a38508add8051187d2c0b5f3f1f9
SHA512 a65de9fc630dfa9691a29680299286ecfc4c1763d1fe4b93c7637176da0df3e6b94a7db5c96c4bc720d3dece938a41c98a62a3cd5613144a25fe70eb7c7b972f
SSDEEP 96:GvBN6sUVzOMMXejhGrflDUEVpatTxzFMwdKTG7O4gne3/k8/mw3MHAeer6MQREIQ:GvyvH0kz/HunTMA6qISU
TLSH
T140D1DCFECD1250433A76F62AF4A9FDAB005A293149C8C79D6BFC483A32D29B71153305
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

89760867-ff42-49db-8c68-02f8fbdd5298

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fsufqe7.default-release\datareporting\glean\pending_pings\89760867-ff42-49db-8c68-02f8fbdd5298
Size 871B
SHA256 a697983b47c286973e912191bf9c0a2c5bcb4212e3fd23b99a572708a85e469d
MD5 cd8aa8fd14a92f874a3c3f29268a38c4
SHA1 fc0bb578b408989f9e96e87935ca0c1fc6561e56
SHA512 cf756bdb54c6c7c5a1fb01e3e0c2ce86b45edda5f73d68482324eaefc23716af5e27b16df42fdc04d88f4160cecc934f9d8c0e5dfc1c3e48536b2f3ab156bc65
TLSH
T1BA112F428674BAB2CC6CE28BC9957F035BE47623C8CAA4103DE00E080D6F51D97A6297
MD5 SHA1 SHA512 TLSH

Submit Download

ac7ac5e0-0ada-4030-aa59-2b3b30404000

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fsufqe7.default-release\datareporting\glean\pending_pings\ac7ac5e0-0ada-4030-aa59-2b3b30404000
Size 235B
SHA256 5643afb89ccc9f24651987c591bf82cc1917f1ad93e47bcdc4a6d0c5024522ce
MD5 1c1cd4d17dabee9e8be2367d0cdd15e1
SHA1 6e83f80531e57c16dd6e80985a39ba3e25ecb049
SHA512 0ba6583c4626876aee9fca0e2bcbb6f53f16eb9eec49b6cc927816c6fcc2df9c203943a755e67331eacffce9d9c7bb9613c8840b63950521522f9d93f58cad19
TLSH
T163D097C058A8236C0C000F0BF1A179CA30988C3314A15820966202789EB9AC48111C5E
MD5 SHA1 SHA512 TLSH

Submit Download

f807ade5-bb66-4c5e-bd1f-710f9f0e80ad

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fsufqe7.default-release\datareporting\glean\pending_pings\f807ade5-bb66-4c5e-bd1f-710f9f0e80ad
Size 2KB
SHA256 6def14e06f13add592ebed0006399096e2185692b89a701466e5b2065af65ed3
MD5 547c74f7a11a1537f88f29fa226e313e
SHA1 c7feac939c60ed95ee9268da9d74b20f27b1b7c0
SHA512 0a4c00fed715cca96ff84e0f13517c6ca88ec3a605b74b6b7d9398830cd559cf281c307d61d8f0a364152b1eb9faee8b6da1afddfdad57e612069294b719da12
TLSH
T1744134BD35B8CE7A5CCAF65C9481379E93244A1340C61C436E81DF0CCC966ED376A52B
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fsufqe7.default-release\extensions.json
Size 16KB
SHA256 caf531b44fcb33fe03356aeae0e88b4e3a7b226e213f6db9293d36ad219d72a5
MD5 6947773bdf340fbf84cddce18888bcf2
SHA1 90ef0e0482d865073cc5c4824e270874a0f9afaf
SHA512 197939ea013c627c11368edffbda03d519c2c32e924fd985480028ee1409ef1f6188959fe976e97d8745cfbaf73337dd74b61ca2cf770d4ded21a9c2ac7512de
SSDEEP 384:LkI4vaWUmldvc8dhW794z/96oeL4H9NL4PaL4HnL4HWL4Hh994h0:4I4iWRf1Xq4B6n4H4w4r484x4i
TLSH
T1B872531545449EB8294F979BAA367E02C37D533B60845C78F4DD8FC802FA5B902FB62B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fsufqe7.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fsufqe7.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fsufqe7.default-release\gmp-widevinecdm\4.10.2934.0\manifest.json
Size 1001B
SHA256 25ac9b79df29fa869b4c9f4ca3bdbc3a85f6122f5a8efab5a1216d577099becc
MD5 580786a5ec9eb650dde3e0e75db8588a
SHA1 8c0835d1a6bf82e753b624440e9674d649696ead
SHA512 c8d41e16b291157e2afbf978469eae4c017d1ce3b941b93ae710e2bbaaf4c3e601db45e579d22b957b7a1ec48cba788015725a2fa23cf02f2d66010ef4fdd0a0
TLSH
T100115B10DD388D9326E4BAA21CC6580957661DAF4CC23F98379E161D8F1C8AFA37366C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fsufqe7.default-release\gmp-widevinecdm\4.10.2934.0\widevinecdm.dll
Size 18.9MB
SHA256 875a76af5b19622842c9b37fe77dce10ee83f27adbdcfcde9c814d4e1226d023
MD5 15fa9ea03f6f451d587b1dabb2f7b036
SHA1 a1a5cf60b693f732931f8e7512627d2840023dee
SHA512 8d5e5aa0a116bb09dd492b6b59bcd9458ded013e6b52a31dd36e81313c3f2d9ea01d5bf3ec4b0f2593633a5313705af773a4e7245d6cfd96f231332db26d75ae
SSDEEP 393216:uD9xOHbGD+l8Vm148M/i5hE4/junbj0OjLFI/USFUzUqr1d4Pg4C5/:tGD+l8VmuZ/S24/junfSFwUqYg4A
TLSH
T13717E149E36310E8E80E89F446AADA72D4743C4E03369BEF17D4BB3559727C06A79F06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fsufqe7.default-release\prefs-1.js
Size 6KB
SHA256 8581b80cf3aee8a00c1ca2a86e6d7f4c1b386a305803fc6a338881f55e9aa9ae
MD5 2e536b7015778b2d423af1045fc9c3d9
SHA1 188daafee78e734342a129cb651ff9e322ec6b00
SHA512 bc0f5d43e602ef20c64a3436a882c8e307c50697049e43a72c6db4d2eab214d34ea2b20d11babdc7ba8c25e403b9f89cd9323c57b6e27d45cccc996c59206922
SSDEEP 96:xHIUTU0qGqldLfn8sa1zSPSSl7dv9joM4n4Hj7Bw88P8L4cnqV/qGS:C3Rl1f8sa0SSi+j7Bw88PG
TLSH
T130E12D7854088F7F78B677ACAC6888315AB2023BBBBF68D650B55484051CF3446F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fsufqe7.default-release\prefs-1.js
Size 8KB
SHA256 ca4f053baa81995f28dad68d9151edbac93e215430601520933fe6cac021e0d0
MD5 301a6c94756118faf2de57fc0047cd1b
SHA1 4d33e5c5041baa9bd38baad2342a911735198b24
SHA512 908eb1d4beaee7d30ba5367d3de73f9b6f055cf3eaea77b79a0c35efed4efd0042b09e4433fe2b1b8122d3fab00ea775690f031f39f784ee0435dec89f593b76
SSDEEP 96:xHIBTU0qGqldLfMsaObzSPSSl7dv9joM4n4WRy3x10Bw88IC8L4cnqVdqGS:CSRl1fMsaFSSiLRYx10Bw88Iw4
TLSH
T15E021EB86404CB3F74B6776CAC2889715AA2023BB7BF68D650B948C5051CF3445F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fsufqe7.default-release\prefs.js
Size 6KB
SHA256 51b4f99cea98d17c2a7848a6801ec33533485390075437d907069aef411d0d6f
MD5 58d0c79b22949802c7a6bc64ccb67802
SHA1 c02eadcef81781f4605fc9f52d5ccd99de8195c6
SHA512 b420d1595b90b4273a36b8efd930fabab5fd935293514f830a46ea2adfb2dfa381e26493cb0c0471ce225fda6fce99b87d50597c93a5f32c0dcfe3619892544e
SSDEEP 96:xHIUTU0qGqldLfn8Kdn51zSMSSl7dv9jmOn4Hj7Bw88P8L4cnqV/j:C3Rl1f8S5dSSGj7Bw88P9
TLSH
T1B4E11E785408CB7F74B677ACAC6888715AB2023BBBBF68D650A544C4050CF3446F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fsufqe7.default-release\sessionstore-backups\recovery.baklz4
Size 2KB
SHA256 aa91c73d3b278ea68a1756023254c6ac0021fc46f58854f1b49f7fe0010cdba3
MD5 aa8b3ee38d5cf06f30ea70b0004ef8c7
SHA1 dfaaca7084900ecd63d4d4c5b50711e0c9edfaf3
SHA512 ceb4e91b38a26b5285ad06625e2dd2eec93d73d401570daf39c63e06eaaadf39fd0bf5ae2e03fbc19012986511d4ba530c7978777a7838c48996f2b99aab3f2a
TLSH
T147411997065E58B1BC3D914CA4C12FD98BE8A02F026C98C0E985748922F84496F7E4DE
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fsufqe7.default-release\sessionstore-backups\recovery.jsonlz4
Size 2KB
SHA256 c296cbe22ac36b7cca85520a317c62cd1df7b5f2a38aa16ef54358a97f98d718
MD5 9ca932eedbbbd76e1ea4b3730c26f031
SHA1 5f7945b56390aa13866deaa9b1dc5c4f4fda4fec
SHA512 390aa451cec20d7a4e17f028df0f15133c93e847a08ad09b2e55807eff18fd9cd5175245e650606bc7017149318a6bc2620655bd8d571f2e194c9ff96f136e7e
TLSH
T11B414B869D06347CB9F89285F1C62A7CC3BD301B02AC0050D68B714201DC446EA7F5C5
MD5 SHA1 SHA512 TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fsufqe7.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 3.2MB
SHA256 5722be94ee07c33ae89ed4d53256a58f7373274ddc7a26cab3b11f623395c96e
MD5 e39048f4c670bcab100b2d179d8e70de
SHA1 247dd5f7d81e84f7ae916ccd9282e7ea317855f0
SHA512 5ff554d4c5e866656ae88d5809a321751df87bf88bcc24bc543c70f27e6c1fbda764513f23beac6fa2c098e9c0e18c35453a2f73c6be21935099080b0c2ab243
SSDEEP 24576:lfiIxyHiWW2b6EBbXyrWOpDhmmBjA4plrZloc:lfmCWJ6GXyrWKDhmAjA4HrZlB
TLSH
T159F53BF820D2B357F3418033A64593EB21AFD00C6467DE044BA956E895B9CEF9E05B7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7fsufqe7.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 5.9MB
SHA256 6ca71108123212745e9c7ec69688d366801362b687a289d0880cd67a87ddef3e
MD5 c08b176a81e030dcc4ca8166ba04ef56
SHA1 13d559502e1a7ba4ba7df88e080b9be50d1b0a4d
SHA512 da7bf2f7a2b3469da68343c8680e94aed86f08fc8907e149946f1d7e0e0768bb1d1e2417570c989e99e2ab8e1c8481a62fb0015c10e010d6c30a77c9839f162c
SSDEEP 49152:mpkbRVaAIoW8zN6wlAtYelxDj+GOd0fJKw1lWcuI+23AuYzf5ebaNGxDwtke0sTg:pdGmKIrJb1qNhF9N8
TLSH
T153565CE420E2D252F38544B3719A53FB10EFC01C60768E44579896FAA9B8CEB4D877BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

report.txt

Path C:\Users\Admin\Desktop\report.txt
Size 5KB
SHA256 430015ab5c4940f2c47a3da75860686f67d2ec96e88189c4858834ed826350d1
MD5 6aad948a898e925474c5abd0d4dbb464
SHA1 4bfdc64ed54da321c1e9105ae459aa7b7cb60071
SHA512 a4c116ab8f9d02c623749f07dbd3327f1d31f87de0e43bcb372687017a11905911863bfd78b492f8474f8be605526fcb7eb71fd97e5d107bc8c6d440a4eae876
SSDEEP 96:S2NMtsdWhDtgxrRY9Lwx4DeS+/SIA4CUpF9n7MFx:NNGGMg/Tx4DeS+/TCUlu
TLSH
T1BCC152710FAAA9B104DEE391BDEE5953E62042097B102528388C703D2FE7359C3FDA34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/236-1046-0x00000234B9DA0000-0x00000234B9DAC000-memory.dmp

Download

memory/448-1125-0x000001DB71AD0000-0x000001DB71ADC000-memory.dmp

Download

memory/1300-566-0x000001FD64B90000-0x000001FD64B9C000-memory.dmp

Download

memory/1316-914-0x000001FC2A860000-0x000001FC2A86C000-memory.dmp

Download

memory/1380-1060-0x00000194FF110000-0x00000194FF11C000-memory.dmp

Download

memory/1436-1029-0x0000028BFA5C0000-0x0000028BFA5EA000-memory.dmp

Download

memory/1436-1030-0x0000028BFA5C0000-0x0000028BFA5E4000-memory.dmp

Download

memory/1436-1033-0x0000028BF81A0000-0x0000028BF81AC000-memory.dmp

Download

memory/1824-867-0x000001F4B5C30000-0x000001F4B5C3C000-memory.dmp

Download

memory/1888-1082-0x00000140EBFE0000-0x00000140EBFEC000-memory.dmp

Download

memory/1912-967-0x000001DA09A60000-0x000001DA09A6C000-memory.dmp

Download

memory/2288-559-0x00007FFC37AB0000-0x00007FFC37AB2000-memory.dmp

Download

memory/2288-560-0x00007FFC37AC0000-0x00007FFC37AC2000-memory.dmp

Download

memory/2288-561-0x0000000140000000-0x00000001407F5000-memory.dmp

Download

memory/2612-1164-0x0000018659290000-0x000001865929C000-memory.dmp

Download

memory/3596-841-0x000001DE222A0000-0x000001DE222AC000-memory.dmp

Download

memory/4052-825-0x000001A456090000-0x000001A45609C000-memory.dmp

Download

memory/4432-948-0x000001D04EAC0000-0x000001D04EACC000-memory.dmp

Download

memory/4516-1204-0x0000025973A90000-0x0000025973A9A000-memory.dmp

Download

memory/4516-1203-0x0000025973BC0000-0x0000025973BD2000-memory.dmp

Download

memory/4516-1214-0x0000025959B80000-0x0000025959B8C000-memory.dmp

Download

memory/4864-927-0x00000265E2710000-0x00000265E271C000-memory.dmp

Download

memory/5076-1138-0x0000027897D60000-0x0000027897D6C000-memory.dmp

Download

memory/5384-1110-0x0000020C796E0000-0x0000020C796EC000-memory.dmp

Download

memory/5500-1151-0x000001E7BCEF0000-0x000001E7BCEFC000-memory.dmp

Download

memory/5520-1191-0x00000192DBAA0000-0x00000192DBAAC000-memory.dmp

Download

memory/5524-556-0x00000178C98C0000-0x00000178C98CC000-memory.dmp

Download

memory/5524-551-0x00000178E2010000-0x00000178E2032000-memory.dmp

Download

memory/5940-1177-0x000001BD6EFC0000-0x000001BD6EFCC000-memory.dmp

Download

memory/6088-567-0x000001E935BC0000-0x000001E935BCC000-memory.dmp

Download

memory/6116-854-0x00000195D07F0000-0x00000195D07FC000-memory.dmp

Download