a49987d948d18c7c6d3a51a302c4d252970f33279b79ee817b12fab7b06f5e02

Analysis

user interaction
yes
max time kernel
150s
max time network
152s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
23/04/2026, 06:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
sample.html
Size 67KB
Sample260423-hern5ahz2l
SHA256 a49987d948d18c7c6d3a51a302c4d252970f33279b79ee817b12fab7b06f5e02
MD5 45a1d5b801dba18fdee87ed2a5993a18
SHA1 9db006b94ed7727b14b2239f46b548e27f4241f7
SHA512 414b9a6d0dcf7bc9afc11a6de49f2126d701614120f3181fd437a0be6ea317778e0c5435866ddda9d726cf54e907be2e92a87c2119d9236c493b163c269ebb92
SSDEEP 1536:rI1ulWIAPI2Qdg07ZMXjek+w1tgvftsjfUzAux/q:Q0fw1ZQnq
TLSH
T11463C62B66C01425643793F6E7A36369FBB54003C907822C7AEE13964FF2D58C663F98
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery ransomware

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
157	2076	msedge.exe

Executes dropped EXE 3 IoCs

pid	Process
2092	VC_redist.x64.exe
196	VC_redist.x64.exe
4980	VC_redist.x64.exe

Loads dropped DLL 1 IoCs

pid	Process
196	VC_redist.x64.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5068_1404903347\smart_switch_list.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5068_1325326311\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5068_1498672268\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5068_1498672268\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5068_564591639\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5068_564591639\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5068_1404903347\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5068_1404903347\office_endpoints_list.json	msedge.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\VC_redist.x64.exe:Zone.Identifier	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2076	msedge.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000009f1d998fde3c4bea0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800009f1d998f0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff0000000007000100006809009f1d998f000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1a9f1d998f000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d9f1d998f000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134213999937691462"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1383858298-2057492509-1726743289-1000\{79D51676-ACCC-4032-9B38-89A5757A9306}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\VC_redist.x64.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\YUB-X UI.rar:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4944	msedge.exe
4944	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

pid	Process
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeBackupPrivilege	2680	vssvc.exe
Token: SeRestorePrivilege	2680	vssvc.exe
Token: SeAuditPrivilege	2680	vssvc.exe

Suspicious use of FindShellTrayWindow 53 IoCs

pid	Process
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
196	VC_redist.x64.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5068 wrote to memory of 4620	5068	msedge.exe	80
PID 5068 wrote to memory of 2076	5068	msedge.exe	81
PID 5068 wrote to memory of 2788	5068	msedge.exe	82
PID 5068 wrote to memory of 2788	5068	msedge.exe	82
PID 5068 wrote to memory of 2788	5068	msedge.exe	82
PID 5068 wrote to memory of 1084	5068	msedge.exe	84
PID 5068 wrote to memory of 1084	5068	msedge.exe	84
PID 5068 wrote to memory of 3060	5068	msedge.exe	85
PID 5068 wrote to memory of 3060	5068	msedge.exe	85
PID 5068 wrote to memory of 3060	5068	msedge.exe	85
PID 5068 wrote to memory of 4792	5068	msedge.exe	86
PID 5068 wrote to memory of 4792	5068	msedge.exe	86
PID 5068 wrote to memory of 4792	5068	msedge.exe	86
PID 5068 wrote to memory of 4976	5068	msedge.exe	88
PID 5068 wrote to memory of 5036	5068	msedge.exe	89
PID 5068 wrote to memory of 4976	5068	msedge.exe	88
PID 5068 wrote to memory of 4976	5068	msedge.exe	88
PID 5068 wrote to memory of 5036	5068	msedge.exe	89
PID 5068 wrote to memory of 5036	5068	msedge.exe	89
PID 5068 wrote to memory of 132	5068	msedge.exe	90
PID 5068 wrote to memory of 4480	5068	msedge.exe	91
PID 5068 wrote to memory of 132	5068	msedge.exe	90
PID 5068 wrote to memory of 132	5068	msedge.exe	90
PID 5068 wrote to memory of 4480	5068	msedge.exe	91
PID 5068 wrote to memory of 4480	5068	msedge.exe	91
PID 5068 wrote to memory of 956	5068	msedge.exe	93
PID 5068 wrote to memory of 956	5068	msedge.exe	93
PID 5068 wrote to memory of 748	5068	msedge.exe	94
PID 5068 wrote to memory of 748	5068	msedge.exe	94
PID 5068 wrote to memory of 2908	5068	msedge.exe	95
PID 5068 wrote to memory of 1448	5068	msedge.exe	96
PID 5068 wrote to memory of 2908	5068	msedge.exe	95
PID 5068 wrote to memory of 1448	5068	msedge.exe	96
PID 5068 wrote to memory of 3852	5068	msedge.exe	97
PID 5068 wrote to memory of 4552	5068	msedge.exe	99
PID 3852 wrote to memory of 4372	3852	msedge.exe	100
PID 5068 wrote to memory of 5100	5068	msedge.exe	101
PID 5068 wrote to memory of 5100	5068	msedge.exe	101
PID 5068 wrote to memory of 2492	5068	msedge.exe	102
PID 5068 wrote to memory of 2492	5068	msedge.exe	102
PID 5068 wrote to memory of 1280	5068	msedge.exe	103
PID 5068 wrote to memory of 1280	5068	msedge.exe	103
PID 5068 wrote to memory of 980	5068	msedge.exe	104
PID 5068 wrote to memory of 980	5068	msedge.exe	104
PID 5068 wrote to memory of 3016	5068	msedge.exe	105
PID 5068 wrote to memory of 3016	5068	msedge.exe	105
PID 5068 wrote to memory of 2124	5068	msedge.exe	106
PID 5068 wrote to memory of 2124	5068	msedge.exe	106
PID 5068 wrote to memory of 2124	5068	msedge.exe	106
PID 5068 wrote to memory of 1852	5068	msedge.exe	107
PID 5068 wrote to memory of 1212	5068	msedge.exe	108
PID 5068 wrote to memory of 2484	5068	msedge.exe	109
PID 5068 wrote to memory of 3440	5068	msedge.exe	110
PID 5068 wrote to memory of 3440	5068	msedge.exe	110
PID 5068 wrote to memory of 3440	5068	msedge.exe	110
PID 5068 wrote to memory of 4504	5068	msedge.exe	111
PID 5068 wrote to memory of 4504	5068	msedge.exe	111
PID 5068 wrote to memory of 4504	5068	msedge.exe	111
PID 5068 wrote to memory of 3708	5068	msedge.exe	112
PID 5068 wrote to memory of 3708	5068	msedge.exe	112
PID 5068 wrote to memory of 3708	5068	msedge.exe	112
PID 5068 wrote to memory of 1716	5068	msedge.exe	113
PID 5068 wrote to memory of 1716	5068	msedge.exe	113
PID 5068 wrote to memory of 4024	5068	msedge.exe	116

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2ac,0x7ffab6bec188,0x7ffab6bec194,0x7ffab6bec1a0
  2⤵
  PID:4620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1880,i,8034550552669436936,16397700913752148062,524288 --field-trial-handle=2220,i,7784700162523213833,8225679859905285945,262144 --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:2076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1732,i,1637931378319056574,13609736317015917932,262144 --field-trial-handle=2220,i,7784700162523213833,8225679859905285945,262144 --variations-seed-version --mojo-platform-channel-handle=2216 /prefetch:2
  2⤵
  PID:2788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2560,i,2237401161032843686,14816763387508206133,524288 --field-trial-handle=2220,i,7784700162523213833,8225679859905285945,262144 --variations-seed-version --mojo-platform-channel-handle=2568 /prefetch:13
  2⤵
  PID:1084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3496,i,14379886782520119983,1560298816124585572,2097152 --field-trial-handle=2220,i,7784700162523213833,8225679859905285945,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:3060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3516,i,16923076601402739966,13146507799617324383,2097152 --field-trial-handle=2220,i,7784700162523213833,8225679859905285945,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:1
  2⤵
  PID:4792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4128,i,15273673665657875794,4474658749380809526,2097152 --field-trial-handle=2220,i,7784700162523213833,8225679859905285945,262144 --variations-seed-version --mojo-platform-channel-handle=4140 /prefetch:1
  2⤵
  PID:4976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4200,i,3107740219671869073,4037910427953199815,2097152 --field-trial-handle=2220,i,7784700162523213833,8225679859905285945,262144 --variations-seed-version --mojo-platform-channel-handle=4160 /prefetch:9
  2⤵
  PID:5036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4256,i,633492056844282698,8195889524323072,2097152 --field-trial-handle=2220,i,7784700162523213833,8225679859905285945,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:1
  2⤵
  PID:132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4268,i,16442047617209220030,17845270528467407439,2097152 --field-trial-handle=2220,i,7784700162523213833,8225679859905285945,262144 --variations-seed-version --mojo-platform-channel-handle=4440 /prefetch:9
  2⤵
  PID:4480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3484,i,16975523290238678750,93247967017860908,524288 --field-trial-handle=2220,i,7784700162523213833,8225679859905285945,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:14
  2⤵
  PID:956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5384,i,3548657589978592607,15158049873943563767,524288 --field-trial-handle=2220,i,7784700162523213833,8225679859905285945,262144 --variations-seed-version --mojo-platform-channel-handle=4232 /prefetch:14
  2⤵
  PID:748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5396,i,9258515706708030500,16714309104903438333,524288 --field-trial-handle=2220,i,7784700162523213833,8225679859905285945,262144 --variations-seed-version --mojo-platform-channel-handle=5448 /prefetch:14
  2⤵
  PID:2908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5388,i,5305634930164367683,6288085722687825903,524288 --field-trial-handle=2220,i,7784700162523213833,8225679859905285945,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:14
  2⤵
  PID:1448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6004,i,3775691677905727559,8620078110331924968,524288 --field-trial-handle=2220,i,7784700162523213833,8225679859905285945,262144 --variations-seed-version --mojo-platform-channel-handle=6008 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3852
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1132
    3⤵
    PID:4372
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6052,i,8136268463690380093,10151940840794576814,524288 --field-trial-handle=2220,i,7784700162523213833,8225679859905285945,262144 --variations-seed-version --mojo-platform-channel-handle=6068 /prefetch:14
  2⤵
  PID:376
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6052,i,8136268463690380093,10151940840794576814,524288 --field-trial-handle=2220,i,7784700162523213833,8225679859905285945,262144 --variations-seed-version --mojo-platform-channel-handle=6068 /prefetch:14
  2⤵
  PID:4552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6284,i,16073749912847564611,16212967426081268237,524288 --field-trial-handle=2220,i,7784700162523213833,8225679859905285945,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:14
  2⤵
  PID:5100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6492,i,17349403857973086682,12821793643379428240,524288 --field-trial-handle=2220,i,7784700162523213833,8225679859905285945,262144 --variations-seed-version --mojo-platform-channel-handle=6424 /prefetch:14
  2⤵
  PID:2492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6420,i,13283159824232523395,16302887307741601236,524288 --field-trial-handle=2220,i,7784700162523213833,8225679859905285945,262144 --variations-seed-version --mojo-platform-channel-handle=6628 /prefetch:14
  2⤵
  PID:1280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6336,i,18068833906997983765,11414727102607021987,524288 --field-trial-handle=2220,i,7784700162523213833,8225679859905285945,262144 --variations-seed-version --mojo-platform-channel-handle=6324 /prefetch:14
  2⤵
  PID:980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6364,i,5466562833275401475,1446294060199546782,524288 --field-trial-handle=2220,i,7784700162523213833,8225679859905285945,262144 --variations-seed-version --mojo-platform-channel-handle=6820 /prefetch:14
  2⤵
  PID:3016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=5324,i,12854238812847730137,17632051336739739541,2097152 --field-trial-handle=2220,i,7784700162523213833,8225679859905285945,262144 --variations-seed-version --mojo-platform-channel-handle=5356 /prefetch:1
  2⤵
  PID:2124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5076,i,7161685455563439236,7652493750272080115,524288 --field-trial-handle=2220,i,7784700162523213833,8225679859905285945,262144 --variations-seed-version --mojo-platform-channel-handle=4196 /prefetch:14
  2⤵
  PID:1852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5080,i,13884387036331578018,12121327486798191867,524288 --field-trial-handle=2220,i,7784700162523213833,8225679859905285945,262144 --variations-seed-version --mojo-platform-channel-handle=4576 /prefetch:14
  2⤵
  PID:1212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5064,i,6266688072306000471,9905762190076326827,524288 --field-trial-handle=2220,i,7784700162523213833,8225679859905285945,262144 --variations-seed-version --mojo-platform-channel-handle=5032 /prefetch:14
  2⤵
  PID:2484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=6392,i,3127869497556448939,7879233383764969395,2097152 --field-trial-handle=2220,i,7784700162523213833,8225679859905285945,262144 --variations-seed-version --mojo-platform-channel-handle=4248 /prefetch:1
  2⤵
  PID:3440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=4212,i,171136320717469083,1331218173516593152,2097152 --field-trial-handle=2220,i,7784700162523213833,8225679859905285945,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:1
  2⤵
  PID:4504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=4576,i,6040246716318233012,18427973393047001142,2097152 --field-trial-handle=2220,i,7784700162523213833,8225679859905285945,262144 --variations-seed-version --mojo-platform-channel-handle=4216 /prefetch:1
  2⤵
  PID:3708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6316,i,8304995286699493185,13034262263233574583,524288 --field-trial-handle=2220,i,7784700162523213833,8225679859905285945,262144 --variations-seed-version --mojo-platform-channel-handle=6788 /prefetch:14
  2⤵
  PID:1716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6040,i,16203437738189334538,16932094397505990848,524288 --field-trial-handle=2220,i,7784700162523213833,8225679859905285945,262144 --variations-seed-version --mojo-platform-channel-handle=6632 /prefetch:14
  2⤵
  PID:4024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3912,i,1197502474872681578,14401766278633205581,524288 --field-trial-handle=2220,i,7784700162523213833,8225679859905285945,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:14
  2⤵
  PID:2820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=6304,i,10193282204404033240,18381073358919623046,2097152 --field-trial-handle=2220,i,7784700162523213833,8225679859905285945,262144 --variations-seed-version --mojo-platform-channel-handle=6728 /prefetch:1
  2⤵
  PID:3692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4376,i,11208340762272333389,2633890831548469258,524288 --field-trial-handle=2220,i,7784700162523213833,8225679859905285945,262144 --variations-seed-version --mojo-platform-channel-handle=6768 /prefetch:14
  2⤵
  PID:2340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=4912,i,6210697590387087723,13279837882197555294,2097152 --field-trial-handle=2220,i,7784700162523213833,8225679859905285945,262144 --variations-seed-version --mojo-platform-channel-handle=4216 /prefetch:1
  2⤵
  PID:4112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4956,i,16500148314092889491,379650489053825877,524288 --field-trial-handle=2220,i,7784700162523213833,8225679859905285945,262144 --variations-seed-version --mojo-platform-channel-handle=6784 /prefetch:14
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:4152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6304,i,5840081992022358616,8136208426660177971,524288 --field-trial-handle=2220,i,7784700162523213833,8225679859905285945,262144 --variations-seed-version --mojo-platform-channel-handle=4448 /prefetch:14
  2⤵
  PID:2160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=7016,i,1505978194279314732,12551190015683697017,2097152 --field-trial-handle=2220,i,7784700162523213833,8225679859905285945,262144 --variations-seed-version --mojo-platform-channel-handle=6516 /prefetch:1
  2⤵
  PID:4608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=5528,i,14469969255657713000,4109799802140376496,2097152 --field-trial-handle=2220,i,7784700162523213833,8225679859905285945,262144 --variations-seed-version --mojo-platform-channel-handle=6340 /prefetch:1
  2⤵
  PID:3156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4960,i,5590686710807113306,731898437040091858,524288 --field-trial-handle=2220,i,7784700162523213833,8225679859905285945,262144 --variations-seed-version --mojo-platform-channel-handle=7092 /prefetch:14
  2⤵
  - NTFS ADS
  PID:2172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7084,i,8649484894539429762,13717465005034444633,262144 --field-trial-handle=2220,i,7784700162523213833,8225679859905285945,262144 --variations-seed-version --mojo-platform-channel-handle=6036 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4944
- C:\Users\Admin\Downloads\VC_redist.x64.exe
  "C:\Users\Admin\Downloads\VC_redist.x64.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2092
- - C:\Windows\Temp\{C88ED86C-9F80-4451-BA00-F1993CFAAA95}\.cr\VC_redist.x64.exe
    "C:\Windows\Temp\{C88ED86C-9F80-4451-BA00-F1993CFAAA95}\.cr\VC_redist.x64.exe" -burn.clean.room="C:\Users\Admin\Downloads\VC_redist.x64.exe" -burn.filehandle.attached=688 -burn.filehandle.self=696
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    PID:196
  - - C:\Windows\Temp\{874A19DA-2913-46B9-8A76-00EE7D389990}\.be\VC_redist.x64.exe
      "C:\Windows\Temp\{874A19DA-2913-46B9-8A76-00EE7D389990}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{B43F37AD-3F00-4666-A121-3B847D1C6896} {5060711B-A032-4D68-9034-AD5E16D5F4CE} 196
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6376,i,2910598357110343625,14682946713548956709,524288 --field-trial-handle=2220,i,7784700162523213833,8225679859905285945,262144 --variations-seed-version --mojo-platform-channel-handle=5636 /prefetch:14
  2⤵
  PID:5012

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3496

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:2680

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 cf0266ac99d59d8e7bf7d06daaae58886aa69f3d629c74fbbf7794adfd2219a7
MD5 855c93f4f21d237e49deeb0724f94d4d
SHA1 9ddc8ddc10d3e5b48f893c6a47c2caefbff1140f
SHA512 0ffe3618dda92cf0c32f53b88d8586e4100a7bf6ff98a8c85877c4ffa8b392b45a5f3092f9ce911a0b58f4fa82e09244626a391f4deb58dc0c7adc95b0ed3fe9
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P71:fwUQC5VwBIiElEd2K57P71
TLSH
T151B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

protocols.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.10\protocols.json
Size 3KB
SHA256 4fd800e7b1a5fb24b13fac2e31946d205012b7c28d8c61580b0669b2fa3517cc
MD5 1de85fec2dfcc28011a7c2aaab95eb5f
SHA1 80e8c954bfbe8f7ee5a2335c8d969ae033935dc3
SHA512 9c7dd37eb0c094b6aa05201e7c71a8f33b9db81284223bcfa595a44a6ac95d5a6820ab6f07b7aa8d26bf207454e94277bf35332e9c009ee63f083752b6b51750
TLSH
T1D1611DB79A3048090E3412B86B19B35DF63E029F1AD598EB76BE568F1F710F7245C54C
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 92b3fe3c1f53c120f20ea643b0dc7ed8623f9d208eb1c4d7232edcc97f0b69b6
MD5 7c01ab9b4147641f5e78fe413048da53
SHA1 8e1e36c184f8a953d84d6bcf9a23a2aeccf11785
SHA512 f42cfb7a46a1c4450f02942035de8f5b217382c91026f29ea332e7a448ba0045eb1f7a5acb7c8eddde74daa258d80f1a8ba7fcf32be1c93b64cbb997ca2c55ef
TLSH
T1E7D0805C33715C74C8968E71140DBF063699C4B2545553333C332C691C471411ED5297
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 bf89531d0e3eaeb6193d0eb94b0bec959bbc3dbf51f4b1135a0c78cf16adaa46
MD5 38938711ef0446937338851ec79a0894
SHA1 179778fce333dbfd0c0e890d77eef83f40e68189
SHA512 f43a9b63b4232462afb2de768f45ce89cf129900c80bd1d32946f956e184aba1b903c62f63f5ff2ed8fb9fb615cb1ac6ddffb909f174000b4a41a45f7daef6fc
TLSH
T104D0805C33B15C74CC968E71140DBF063699C4B2545553333C332C691C471811ED5297
MD5 SHA1 SHA512 TLSH

Submit Download

28e9bf1a-cad3-4959-9861-d76ec4887b7b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\28e9bf1a-cad3-4959-9861-d76ec4887b7b.tmp
Size 36KB
SHA256 53e43dc3e834382d1ddc00dd7d9be6815924db42e2c6ff39d9fe98c6151367d4
MD5 4c2a1d6407c1f2cf4b0b4d95af2f8448
SHA1 da054123a72733939fa314608ede140507c4f580
SHA512 221c6507069a5c99dbf18d5558744da940445c9332a7ee790d79610214f930faf4e447e35845620622fe832e58ab8c2f98fa1d7dc214361a764b44763c3d372b
SSDEEP 768:4uK2G8g+2eC7pLuLndJWRmdnQaP8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3Ewn8Llw:4uK2G8g+2eaEndJWRmdnQaPu1jaKEwn3
TLSH
T1D3030D3B280CCB7E4F844D9CEC26BE9A6DE8018B9698C99447FA844C03C66EF55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 cd2df20b7cc4584364c858e55ab75865dbbab3c1f45d5ebe2972c71779041462
MD5 9a52433acc819b7e675d365c31daf8ca
SHA1 f7b2a30a7fae20eb0e14e8727a902886b4d6b1b9
SHA512 fb072141312c9b2bcc2d7ce940516f4afcad7784b240d1f100dd58f4d06309115d28f434981203877c58db38aa90e5b98bbae6aa3adf82a26323e66ce92e5d0c
TLSH
T17F610995F0B5C0E9E3F7CD7316A22876B2F09D28060E0F5B92D581BEEABEB554090538
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 9cdaccb135eddeb73e742b2bff95a10b01e1b2955ff8f263f56a82649ea14fbe
MD5 fbb75add7fffb1901639032724642340
SHA1 71c7ab111e6cbbafb2cd0a7d602b4f745e8a88e4
SHA512 3f678f1431b4452a6668444d419ecce796362bd7ce0799923b9e545884c718704039dd2aafb406cd49eb8fed827e39574e04923b0240d65161ca68ac1de41fec
TLSH
T189813E96F0B8C8E8E7F7ECB392911876B1F89D54060F0F5B82C5907DE97EB564050538
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe581bc0.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe581bc0.TMP
Size 3KB
SHA256 a51cebd7ced9aee9d7d61fd1c9bdf86f3e27443f7635d6d7cac1e8703a6dcb40
MD5 f187f56980de29e2e36a5203faba815b
SHA1 f0d74771990058fe621889121403932a069bdd06
SHA512 9e21a5fc539aff52596f02188e68ab3c327e940fe63d57aea9b618d4c668e24f0941a57bd8e1b9f6bde4d1f7cb4f992ae72ea5eb9f8d0f709d429fc56658a829
TLSH
T1E3611AD5F0B5C0E8E3F7CDB316A22476B2F09D28060E0F5B92D581BEEA7EB514080538
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 f47d07f8fa6914277ccfafd56b408169b73331eb80d7c4b5484a39ba0584a8c0
MD5 c9b0bcb76d318886cd6b9cb2587f1cdb
SHA1 e53b4be7ee20dd17a3f211559810fdab8b210cf1
SHA512 37cd751af1f5409aace3d0d5e8289dc1d1b46cdd81341a69245abc9445d85e07753b1975e09936f984b95d90113a0ba99cd369c36d6048120795e45878b38f9f
SSDEEP 192:DhESnp5C9ecv941Z1rrUIXakj6CNJXyKLZHISE:DhESnp5C9ecv941Z1fUIXakGCNJXyKLq
TLSH
T144D19FF7C3E9862DC91156F4AB266F1BCE2D0518432C3C5BC8E9AF4B93E2871D111A5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 26b295ff020c78e1a4ca546eaa18d58242f82ebea37e8a6fed289badfde40d02
MD5 87bc8720516d6601fefa1aac2e3cfc9e
SHA1 a6aee1b29b8a59ba26554d10057e50fa0df254c8
SHA512 db8f17c8f3a4374192a72099a62f4cb6f1984652002f8ae046366a6fd34c88d94241ef6015f995d039fb4d2ec0007de9e67768b2327ea02e99e7a875d53a702b
SSDEEP 192:sxZdRXyM//K1Ml8UQ7ox/fysNSBrmIdpIPaDT/W6+WNGY0xkGRD/Z3Ig5XJ:sxZd9qEx/fysNSZJ/bG51r
TLSH
T14162EA56A6345D77CCDBD219BA41BF93E6F5146392900E44AAFCCA1C01E6AED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 da09d35a8964af5f44275306939251c8c1e987dd39780af6ee4904c4203b337c
MD5 67a98cc0c2cbdbc92b16893112f79c39
SHA1 d5b1d34fbf0f43d9f26683f7a37d92d08245a507
SHA512 72c4524cc8ecba279828fa0bff2b07c148a8de7c7a8799b414ac2116b68d607c0d20dc98379fac5d907e86da34e9aaa54153d265695cb0cc13203a5340088eb7
SSDEEP 192:sxZdRXyM//K1Ml8MFx/fysttZIdpyj/W6+WNGY0xkGRlls3Ig4J:sxZd9dx/fysttys/bG56c
TLSH
T13352F9166A345977CCDBD209BA45BF53D6F91573D2900E44AAFCCA1C04E6AED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 7cd4010722f848b084b69175c9d9e81a51c2a928d73d0298edfa5322febfb33f
MD5 df5d14bd3377a339a4dbc5c219730df7
SHA1 e121204245faa55080cd47c0fd71050e32e3cf8d
SHA512 27855c55fb70144dc48fb58efb5c61d0e86b40a83ec20130a9e4f9870c20a92a84feacd271105b34c321371967e33b150fb784bba3cdc6e88bd5e954455a80be
SSDEEP 192:sxZdRXyM//K1Ml8Mox/fysNSBrmIdpIPaDT/W6+WNGY0xkGRD/Z3Ig5XJ:sxZd9Qx/fysNSZJ/bG51r
TLSH
T1F962E946BA345977CCDBD209BA41BF53E6F5146392900E44AAFCCA1C05E6BED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 8e52fd89634ec61ed4711f9920e3391775078bba436d54af99379f6e31fa71c0
MD5 dc990332446ca9523da3c277308dd7e8
SHA1 af3f8255d5bc63130821539f5f1b18634283d8bd
SHA512 f310e3a4939eba9925fc7121454acb57c2cac0df49cfcc69926e7661fe031d1e3dbeb0519459f50546ebdaed9b62e9e172107aa5b165f456284762b04e542263
TLSH
T109A0021C414EC007D58812B415CD25913BB2FC50575122074FAD28E4C9967C041016A8
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 dbc3f89f2994b23e98724d8700a7cacb9d09b72892f43990d86dd1218523ebe8
MD5 08590937a17b144f71f1a0327a4ffe95
SHA1 775d8f3f36deb0f67482f99f0a5bc034e4d03bac
SHA512 eea581164af6a0767a1a963bb033a70f89503e0f29bc66ed539371359e52813e0727dd4121cecc723e0f09c1afe826281d015a947f734b7910e733fead8efe8d
SSDEEP 96:KAhyKisSu12KWY6KK8K/6g6kKXqmic4KhOr:ol9JfU7LQ
TLSH
T14AE14191F47616413A7E299A81E0B47A12C375633038A43B37B942A60F67E25CFFD9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

f3fcc2eb-aa3a-4509-a60b-33cf92579845.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\f3fcc2eb-aa3a-4509-a60b-33cf92579845.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

office_endpoints_list.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Data Protection Lists\2.0.0.0\office_endpoints_list.json
Size 3KB
SHA256 8480f3d58faa017896ba8239f3395e3551325d7a6466497a9a69bf182647b25e
MD5 94406cdd51b55c0f006cfea05745effb
SHA1 a15dc50ca0fd54d6f54fbc6e0788f6dcfc876cc9
SHA512 d4e621f57454fea7049cffc9cc3adfb0d8016360912e6a580f6fe16677e7dd7aa2ee0671cb3c5092a9435708a817f497c3b2cc7aba237d32dbdaae82f10591c3
TLSH
T1F681BE27C5B58E2796F060119750E654F53D43AFA600C6AFB5FC825C2F373ECE88A4A8
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 14KB
SHA256 d9ec8b31c215607b8054c61aaa5896cad6cb569aa0ec80b22f4b6afe8b5091b2
MD5 a0dfee17565e27f78a9f2bc562c3a511
SHA1 709b0739f30c5faebd8b52698c9c4b943adab959
SHA512 f74ca0c6c915f809b7951a2a4875c63d29484493f4d66c48c281fed8793bd7db1c6e5a3d0ef39c0e764861d938e666d9bd4bbaed285c4ba6f776feb3dd0dea13
SSDEEP 384:nB8NsxEeeFrcQvAwDL86AlSXLJrj/DlnTc1e9:BkVPDwlqLhj/DlnQ1c
TLSH
T1CA623B36A4386C6B59E3AD59B44B7B136FF4501B97C46F48DAE85F0D00DF38C2306A2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 c708953eba88852d453f1748d31e1391c4fa3666958f634063bf6b7ee755d9b7
MD5 b5ded6df782eaccdd0c079bea7ae8891
SHA1 7e488d2af3270ef402dfa8b8462c204d9f2d8a67
SHA512 256ac11821e55df4d8992a5b9d52fd1f1c46833172f37f9ff2c1f0c43f18e4f3b4916a8c4524ec6a42b64a28fc62be1783a03d56f4a44c22c28e1db5c78cdabd
SSDEEP 384:n3UiFz8Nv8TUNTUlIl2Eee+qIVxfY4vAwDL86AlSXLJrjuDlnTc1e9:fFzcwgXL4PDwlqLhjuDlnQ1c
TLSH
T176C261F694E7993BE9AE4B87A33E6E029EBCC05775845984FB844D0CCC861BFC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 381eff3462f3fc5c1906983e777181ba688cd007c0bcfc79ab2e917c0010e0b3
MD5 1432e094827fdcaa534e56dbf8132b5d
SHA1 251bab7ad71efa0382dba355d32c4bc0853d5457
SHA512 df7f9c8c61875801812dd774221843defa808f1d99ef8f8d1126ba4ab73421eda6c301057878b0b41586ccdb07dc47e50c8666b9478157253504cbbdf1c665fc
SSDEEP 384:nz8Ns2EeeK6t2QvAwDL86AlSXLJrj/DlnTc1e9:zjtnPDwlqLhj/DlnQ1c
TLSH
T105623B76A4386C6B59E3AD55B4477B13AFF4501B97C46F48DAE84F0D00CF38C2706A2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 fb9b49af536681c079281b5e95d028f87bc31d476fb183dd318d0c053774ee4e
MD5 45700833fca62f50751ffa046defd87c
SHA1 e8da292b40515f76a645cd67007091582d1f366e
SHA512 863a4fe8055315e4ed7e1458b6f712a5f4429fc601945face06848e6a92cbb89631b1210713ba35b69f823f6dbea2d412b93962b0b6f81e74051b32d516a5fdd
SSDEEP 384:n3UiFg8Nv8TUNTUlIl2EeeKAYVDft4vAwDL86AlSXLJrjmDlnTc1e9:fFgcwg/y4PDwlqLhjmDlnQ1c
TLSH
T1F6C261F694E7993AE9AE4B87A73E6E029EBCC05775845984FB844D0CCC871BFC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 8d74db3bd482c4257dc9d536551ce1433d046b0c443aa18d752c3faf27535c52
MD5 87f525b54df7d1ff354c16a393800127
SHA1 e225c2116a3f24d43b3b21cca985b8fc516b2be6
SHA512 b00fd1087a401cd55b4e3ff8da19b8eefa134923d327d91d3aa751c2c09b55681199f4f9a19a0281f6b49bbdabbf6f7d9502d0a14f34b010c93bfb221108e37b
SSDEEP 384:n3UiF08Nv8TUNTUlIl2Eee+4IVxft4vAwDL86AlSXLJrjuDlnTc1e9:fF0cwgzi4PDwlqLhjuDlnQ1c
TLSH
T1A9C261F694E7993BD9AE4B87A73E6E029EBCC05775845984FB884D0CCC861BFC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 4533e33922ea08f23e3050b5accf4795db0a7d26bb74cc045a903c6b0e2ca6d8
MD5 90381ef274548828f6898cf2710b43dc
SHA1 cd0190155c26c969e89f174397160e69c7685b59
SHA512 d9247403ce5b484baf83796e2f38a689ce32b0857c6bf88eb5ba64ccfbbb5253731f42b88ce90c6093a2f0e87e2a595be74455abbc131bd96167975af9b46a50
SSDEEP 384:n3UiFg8Nk8TUNTUlIl2EeeKlYVDfc4vAwDL86AlSXLJrj4DlnTc1e9:fFgxwgeX4PDwlqLhj4DlnQ1c
TLSH
T1C992F876E864DA6BADF39BC5B606B657AFF0005786C859C8DED85E0C008B2DD130AD1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 851faef62bfedfada829c36d8fa8a51b9f881e7047fed762736524b4402ffff4
MD5 4d90c58465aaee7a82922d8557a97009
SHA1 a35630ea5dcecb966ad0f194b1ebf7693b19faa4
SHA512 8fe11eef21847b8add39da7a5c725fafdb88dbf509823bb3f15171e6fcaab19fc81efe4c985323af503ce39c21ce09102c661fc4ac77519fbe7ae68ac92268eb
SSDEEP 192:0GNV6EajVQmiUyAMoMRvAwD7jzoru9UrlSX8SJrjqup+qfU6:0GNV6EInMRvAwDL86AlSXLJrj9DU6
TLSH
T1D112F935A4787CAB9EE3AD56B0477A17AFE5112BE6842F54DAF80F1C00DB34C1309936
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 14KB
SHA256 b85194095c4404e23eb52cbcf3cb8c21c26ad17f7558fb3e0be2511b80a42cfd
MD5 6b6fc87a8d5c71c151f3ec1114ebd46c
SHA1 fb2726f4334b31aa56708984c7da97f324f7c040
SHA512 0e9c270a239966717dbc238803196d7c58e23012bf583ba98f1cbe7e7075f2dee7260b1323c37b83ba504c7faa2f3a1531c893417166afdc25f67d46979c3bee
SSDEEP 384:nZ8NslEeeFrcQvAwDL86AlSXLJrj/DlnTc1e9:ZYVPDwlqLhj/DlnQ1c
TLSH
T1FD623B36A4386C6B59E3AD55B44B7B13AFF4505B97C42F48DAE85F0D00CF38C2706A2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 70783531dc54b7ddc1afb5d736fce3f13d0107a042e31dbb16f45c7fbd0fc0bb
MD5 cb7e4a9e4fbd7498e333865c9db58797
SHA1 7391c16849a20ed2f511461cf6e7865b392bef77
SHA512 99dab80741510b4dfa96f27e95116347f746c87fe964b2d373d077047a7c97bf0e76bdf05712974339bb571370f56f515efbdfb87db50431d2b39f37f4fc7995
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 a5dfe2d222ff37764225055c6e27b94b33d13da40f5c427a74a019930ef8e417
MD5 c8fc320596d43a3dbdc344d3d0dc1106
SHA1 30bfed033f7d854ebc3046acb06e305f6765d98e
SHA512 4bb77399376f998e5b145d7df97fb793e06bf35acdf3c217be1184e47efe8b8171d866babc397428689320ae59f95d14cc6ce9fa55bd66443146df42e0848da5
TLSH
T1A1E00191A3440467D51D033100DB17283FB1C02423D34317553046BC3CA27402E64941
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 a1c0f49738f25b972a0eabc4c73769db2ba54acbbb007f42cf88cbab5b1e6aab
MD5 2e5bb6fc0074f9961c34eaf849411826
SHA1 703e640606fe391626bbc975cf6e69fb5b8a7606
SHA512 e79e9743a3579bede10f2ae82bb727fbdfa2c2650a6a01f67eeae60023e42b64b0a7e3cf7159db91320100b4c709524807e957934e04b4088de0afed1c4b0dfb
TLSH
T1F0E00291A3440467D51D033100C717283FB1C02433D34317553046BC3C327403D24540
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe58748f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe58748f.TMP
Size 392B
SHA256 6fad1a294a6fb9f9b21379e9228c97020b45b7d3cf3e62410fa363e389f56e92
MD5 23b5c048367ce63d54dee77903ab1762
SHA1 b0ed62db3110d1069d7c771002b6e074135adefd
SHA512 909f22ac017e6b38ba3bcbc19520fc876a745645717383769425d0fa38e1f118ccee69e3a461861e7f374cccf7100fcf9296a7511a5301c9277ef818140e4b18
MD5 SHA1 SHA512

Submit Download

nav_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\WorkspacesNavigationComponent\1.0.0.5\nav_config.json
Size 2KB
SHA256 98252dc9f9e81167e893f2c32f08ee60e9a6c43fadb454400ed3bff3a68fbf0d
MD5 499d9e568b96e759959dc69635470211
SHA1 2462a315342e0c09fd6c5fbd7f1e7ff6914c17e6
SHA512 3a5922697b5356fd29ccf8dcc2e5e0e8c1fd955046a5bacf11b8ac5b7c147625d31ade6ff17be86e79c2c613104b2d2aebb11557399084d422e304f287d8b905
TLSH
T16B51DB73D5988C4B9BF4A29CE919A309F11107CF75D48C0B76BE010C1F7757AB5C6588
MD5 SHA1 SHA512 TLSH

Submit Download

c2a1a9e8-6d83-4bc0-8822-cf1a5f44b13e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\c2a1a9e8-6d83-4bc0-8822-cf1a5f44b13e.tmp
Size 8KB
SHA256 1d779cff90abf63e5df745fbcfb61632ff853663cf34851c6386ee2063735467
MD5 43589079aef56bc8e6c986da5942f0d5
SHA1 c29e83734e3e11ee8867da4d9b1c872f48574620
SHA512 af7edeff0e3ed0fb37fec160958577b365d2d9c55fc9ba22307a09d8f007495d15aadd92fbc5170483370608cb166395b098ca8c766e095f8eb5cbe9dee6c6a4
SSDEEP 192:VGN76EajeQmiUyJw/MonRvAwD7jzoru9Uwq6p+U6:VGN76ENewVnRvAwDL869gU6
TLSH
T13602D835B9787CAB8EB3AD45B04777176FE4112BE6942B48DAE81B1D00EB34C2306926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 30e8b5d48a130d6bf81847b89c208c7a087525e9b7d9a0a97bcf21598332b63b
MD5 bf165c172af1f75083dd4c7e8915ad0e
SHA1 2eb27e18672fd0a1816ab00d00078a570eb62711
SHA512 a58ad7ee2e18750242b9c5d53224218bef54ecd50e067170da12510559c455979fb0523044d4c23d5d5a523562165e471f95d939376df623bfdea9228ca25256
TLSH
T181F09ED29D7E36C0D6E50F6ED44B64FC40D89506F05CB579484CEAD8913950B254287E
MD5 SHA1 SHA512 TLSH

Submit Download

370a55c4-371c-4825-8132-7ee24cbfae93.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\370a55c4-371c-4825-8132-7ee24cbfae93.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

15396a14-6b14-430f-ad66-44c64c1874f6.tmp

Path C:\Users\Admin\AppData\Local\Temp\15396a14-6b14-430f-ad66-44c64c1874f6.tmp
Size 147KB
SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
MD5 9c670f04d98ab7404f16423f6ee6cdfa
SHA1 8d01079b2d065731df8a7ef52f447cd4b7add353
SHA512 102cee76d9dfcfe91e044f529672fbec042b50c5db55a3cc137197b2013dd7f81e47f50dbb0db96cb621c5732610e1eb553c4146837c11075c7c4dbd67546a3b
SSDEEP 3072:F7R0M+jCozOtDTsjMcT0JnFjkbxnEbm/+OdGmlVVklFHEpCm+:F7WxxzyDTM0JnRkb5bJdGmJkvkpx+
TLSH
T12DE3E16D3DE6DE1FC41B58F53E64708BC80E8F0B820A644FB64988345A60B5D1BD6AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c5ac6d1b-9c6b-4c61-9f6d-f171dfc89b94.tmp

Path C:\Users\Admin\AppData\Local\Temp\c5ac6d1b-9c6b-4c61-9f6d-f171dfc89b94.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

785d08d6-e3af-4ffd-b382-f48b225b63eb.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5068_1352795203\785d08d6-e3af-4ffd-b382-f48b225b63eb.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5068_1352795203\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VC_redist.x64.exe.crdownload

Path C:\Users\Admin\Downloads\VC_redist.x64.exe.crdownload
Size 24.4MB
SHA256 cc0ff0eb1dc3f5188ae6300faef32bf5beeba4bdd6e8e445a9184072096b713b
MD5 486f81facf798678c3244c7cf35a557f
SHA1 21ce0ee54bff57f69fafa741025bf2f15b356405
SHA512 e131b93acde5ffc76c19eb0784183a1e94dfa9fe06111a7830eae3ad8583895575dd4dca66aa70efddb243c95735a0105efcd3042b4b5ca445d3d8e8c39d957e
SSDEEP 786432:mjjpx5hYBug51eEdO41UnAyijgtUHFt9q4YYOQdV:kpx56Bu61eGv1pjg6pb
TLSH
T10A473332E0448026EBE61037A168F5206F7CF624A3649ABBD6CCED0D37B649717FB615
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VC_redist.x64.exe:Zone.Identifier

Path C:\Users\Admin\Downloads\VC_redist.x64.exe:Zone.Identifier
Size 211B
SHA256 0f78d8e49972c57affd3760a34a16453147458db4957d5d69bd9d10372c0759f
MD5 a99745a5a2d244ce5acd77fe46c4a83f
SHA1 7fde299be30317b50a29574d857b959e0a7c8a83
SHA512 32837e4fd17435a8702e7ddd4d13865248938f41b06f5629823cc2f02e01cec76f6a4908b351ac0fde80b28a01db187010459f5aba63fe906fb7ff4353ed5151
TLSH
T1B1D022AFC14044201EA4A18A0B8DA200FFDF2A020A86D8CCCC5BC0E8D27529A5C88093
MD5 SHA1 SHA512 TLSH

Submit Download

YUB-X UI.rar:Zone.Identifier

Path C:\Users\Admin\Downloads\YUB-X UI.rar:Zone.Identifier
Size 72B
SHA256 c086b68e414beaf5308152212958d4072c6fe2f79ec24a73449f900dd39e1773
MD5 cf610b897f90fee4bd1aec6e4e98dbba
SHA1 c9e16f033cf6a2f9426e0ad8efba9704901baf94
SHA512 8dfb2418bfcf00158130ef0c0edfd387a613b9e1536971fd058c68577f64d9bd6697b5b753954d7c7612ff2e32d056408be7e9e007c023f64b6db8e96a332906
TLSH
T14EA0118B280888008A0A208828CAA808A00EA2A888008288AC0000A2C880088A2A8882
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5068_1325326311\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5068_1404903347\manifest.json
Size 160B
SHA256 2a7fe18a087d8e8be847d9569420b6e8907917ff6ca0fa42be15d4e3653c8747
MD5 a24a1941bbb8d90784f5ef76712002f5
SHA1 5c2b6323c7ed8913b5d0d65a4d21062c96df24eb
SHA512 fd7dfec3d46b2af0bddb5aaeae79467507e0c29bab814007a39ea61231e76123659f18a453ed3feb25f16652a0c63c33545e2a0d419fafea89f563fca6a07ce2
TLSH
T133C04C23ED18BABA12F587D40971DB43F7F0031B34E169463B39948C5F761B8925175A
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5068_1498672268\manifest.json
Size 135B
SHA256 ba5c9096d20a482aaa1aa9e5f98ad6127d3e97c2f21de84f7c78d9b8073c8e26
MD5 fbebd68ecaa98928909421f66909c054
SHA1 99d787d90f7ed2e5ad924f9c5668eb988b5a6c07
SHA512 749a3b2be47fe28399dc763888654a3e8d397e06e8d3c3af3965bb45846a1336e6ab4ca82c82c3df846b34a2afafa2156f2690e9bf347ab175408dc0171c61cc
TLSH
T158C04C668D51DEAB00A747A56B295315E23B4B4B5044800A7AF5429C1A288964171944
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5068_564591639\manifest.json
Size 160B
SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
MD5 c3911ceb35539db42e5654bdd60ac956
SHA1 71be0751e5fc583b119730dbceb2c723f2389f6c
SHA512 d8b2c7c5b7105a6f0c4bc9c79c05b1202bc8deb90e60a037fec59429c04fc688a745ee1a0d06a8311466b4d14e2921dfb4476104432178c01df1e99deb48b331
TLSH
T1F1C08C73CC08AE7911B14B371B214642E3B8030B600039093A32084C0BA47B00262328
MD5 SHA1 SHA512 TLSH

Submit Download

logo.png

Path C:\Windows\Temp\{874A19DA-2913-46B9-8A76-00EE7D389990}\.ba\logo.png
Size 1KB
SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
MD5 d6bd210f227442b3362493d046cea233
SHA1 ff286ac8370fc655aea0ef35e9cf0bfcb6d698de
SHA512 464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b
TLSH
T1CF312CF34748B7A7D30581351471819AD242FFD8F9CE291E35CD5307664018115C75CF
MD5 SHA1 SHA512 TLSH

Submit Download

wixstdba.dll

Path C:\Windows\Temp\{874A19DA-2913-46B9-8A76-00EE7D389990}\.ba\wixstdba.dll
Size 215KB
SHA256 e921f69b9fb4b5ad4691809d06896c5f1d655ab75e0ce94a372319c243c56d4e
MD5 f68f43f809840328f4e993a54b0d5e62
SHA1 01da48ce6c81df4835b4c2eca7e1d447be893d39
SHA512 a7a799ecf1784fb5e8cd7191bf78b510ff5b07db07363388d7b32ed21f4fddc09e34d1160113395f728c0f4e57d13768a0350dbdb207d9224337d2153dc791e1
SSDEEP 6144:K6EZdi6e93SuDeTKZxQfsRy26BqbUHYJe:K62i6eNSYeuZ2sRDK
TLSH
T15E24AF12B5D0907AEBFB19305939E5216DBDBA210FA0C9CE5348AD2B2E705C1DB36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VC_redist.x64.exe

Path C:\Windows\Temp\{C88ED86C-9F80-4451-BA00-F1993CFAAA95}\.cr\VC_redist.x64.exe
Size 670KB
SHA256 568c9ba533624084ea18f7a562b4aa2249ed4e41281524a061a0d0b1008cf6bd
MD5 bc9c8a6a42e8d3ea18f8da78d5031820
SHA1 07812a4b945364d04627363e46ab38de188281b3
SHA512 b583f41b8f9cbb2b04e4c7403b54241bf4c51caefdb0bbe9184202dc615f599b496d65f6d36984b75f9b9003289c0c13066dc1e6eb294f9139248595114b4f73
SSDEEP 12288:n3mgqnIZuYfCYqFet4CovkM7x61nE4rfDDIcbMZ3Mya:n3WnIZuMCxezot7MhbfDBMZ8ya
TLSH
T10DE49E32A5604033F7F10573B928A6303E7CE3282B51C9A9D7D4AD1D7EB4892A7F7256
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3496-57-0x000001F434CD0000-0x000001F434E7C000-memory.dmp

Download