hxxps://gofile[.]io/d/YbOUb1

Analysis

user interaction
yes
max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
24/04/2026, 03:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://gofile.io/d/YbOUb1
Sample260424-d5th7ady71

Score

8^/10

defense_evasion discovery pyarmor upx

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
64	2988	msedge.exe

Executes dropped EXE 2 IoCs

pid	Process
4932	plcbugfix.exe
5176	plcbugfix.exe

Loads dropped DLL 18 IoCs

pid	Process
5176	plcbugfix.exe
5176	plcbugfix.exe
5176	plcbugfix.exe
5176	plcbugfix.exe
5176	plcbugfix.exe
5176	plcbugfix.exe
5176	plcbugfix.exe
5176	plcbugfix.exe
5176	plcbugfix.exe
5176	plcbugfix.exe
5176	plcbugfix.exe
5176	plcbugfix.exe
5176	plcbugfix.exe
5176	plcbugfix.exe
5176	plcbugfix.exe
5176	plcbugfix.exe
5176	plcbugfix.exe
2656	msedge.exe

Contacts third-party web service commonly abused for C2 1 TTPs 7 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
28	api.gofile.io
29	api.gofile.io
35	api.gofile.io
36	api.gofile.io
69	discord.com
70	discord.com
72	discord.com

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x002200000002ada9-286.dat	upx
behavioral1/memory/4932-293-0x00007FF7217D0000-0x00007FF721840000-memory.dmp	upx
behavioral1/memory/4932-708-0x00007FF7217D0000-0x00007FF721840000-memory.dmp	upx
behavioral1/memory/5176-717-0x00007FF7217D0000-0x00007FF721840000-memory.dmp	upx
behavioral1/memory/4932-1279-0x00007FF7217D0000-0x00007FF721840000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2656_1761935053\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2656_1761935053\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2656_1761935053\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2656_1761935053\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2656_1761935053\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2656_1761935053\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2656_1761935053\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2656_1761935053\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2656_1761935053\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2656_1761935053\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2656_1477493259\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2656_1761935053\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2656_1761935053\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2656_1761935053\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2656_1895010859\domain_actions.dll	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2656_1761935053\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2656_1761935053\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2656_1761935053\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2656_1761935053\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2656_1761935053\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2656_20941812\autofill_bypass_cache_forms.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2656_1761935053\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2656_1761935053\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2656_1761935053\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2656_1761935053\_locales\mk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2656_1761935053\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2656_1477493259\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2656_1514070641\deny_full_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2656_1761935053\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2656_1761935053\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2656_1761935053\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2656_1761935053\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2656_1761935053\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2656_1477493259\keys.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2656_20941812\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2656_1761935053\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2656_1761935053\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2656_1761935053\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2656_1761935053\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2656_1761935053\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2656_1761935053\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2656_1761935053\_locales\et\messages.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2656_1761935053\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2656_1761935053\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2656_1761935053\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2656_1761935053\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2656_1761935053\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2656_1761935053\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2656_1761935053\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2656_1761935053\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2656_1761935053\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2656_1761935053\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2656_1761935053\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2656_1761935053\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2656_1761935053\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2656_1514070641\deny_etld1_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2656_1761935053\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2656_1761935053\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2656_1761935053\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2656_1761935053\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2656_1761935053\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2656_1761935053\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2656_1761935053\_locales\no\messages.json	msedge.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\plcbugfix.exe:Zone.Identifier	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Detects Pyarmor 1 IoCs

pyarmor

resource	yara_rule
behavioral1/files/0x002200000002ada9-286.dat	pyarmor

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2988	msedge.exe
4676	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134214753671767497"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2397528088-2630719772-1129911217-1000\{1E05EB54-9B30-4DFA-A7B7-B0F058D2CDBB}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2397528088-2630719772-1129911217-1000\{05270C03-4C96-4785-BDF2-481FBB13A759}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2397528088-2630719772-1129911217-1000\{8A682498-FDB2-4E1C-883D-BDC91BC3BCDF}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\plcbugfix.exe:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2656	msedge.exe
2656	msedge.exe
2516	msedge.exe
2516	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe

Suspicious use of FindShellTrayWindow 45 IoCs

pid	Process
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3100 wrote to memory of 3612	3100	msedge.exe	80
PID 3100 wrote to memory of 2988	3100	msedge.exe	83
PID 3100 wrote to memory of 5864	3100	msedge.exe	84
PID 3100 wrote to memory of 3464	3100	msedge.exe	85
PID 3100 wrote to memory of 5564	3100	msedge.exe	86
PID 3100 wrote to memory of 5936	3100	msedge.exe	87
PID 3100 wrote to memory of 3464	3100	msedge.exe	85
PID 3100 wrote to memory of 5864	3100	msedge.exe	84
PID 3100 wrote to memory of 5864	3100	msedge.exe	84
PID 3100 wrote to memory of 5564	3100	msedge.exe	86
PID 3100 wrote to memory of 5564	3100	msedge.exe	86
PID 3100 wrote to memory of 5936	3100	msedge.exe	87
PID 3100 wrote to memory of 5936	3100	msedge.exe	87
PID 3100 wrote to memory of 1092	3100	msedge.exe	88
PID 3100 wrote to memory of 1092	3100	msedge.exe	88
PID 3100 wrote to memory of 1092	3100	msedge.exe	88
PID 3100 wrote to memory of 1160	3100	msedge.exe	89
PID 3100 wrote to memory of 1160	3100	msedge.exe	89
PID 3100 wrote to memory of 3972	3100	msedge.exe	90
PID 3100 wrote to memory of 3972	3100	msedge.exe	90
PID 3100 wrote to memory of 4172	3100	msedge.exe	91
PID 3100 wrote to memory of 3580	3100	msedge.exe	93
PID 4172 wrote to memory of 1180	4172	msedge.exe	94
PID 3100 wrote to memory of 5172	3100	msedge.exe	97
PID 3100 wrote to memory of 5172	3100	msedge.exe	97
PID 3100 wrote to memory of 5172	3100	msedge.exe	97
PID 3100 wrote to memory of 420	3100	msedge.exe	98
PID 3100 wrote to memory of 5460	3100	msedge.exe	99
PID 3100 wrote to memory of 420	3100	msedge.exe	98
PID 3100 wrote to memory of 5460	3100	msedge.exe	99
PID 3100 wrote to memory of 5460	3100	msedge.exe	99
PID 3100 wrote to memory of 2780	3100	msedge.exe	100
PID 3100 wrote to memory of 4932	3100	msedge.exe	101
PID 4932 wrote to memory of 5176	4932	plcbugfix.exe	103
PID 5176 wrote to memory of 2468	5176	plcbugfix.exe	104
PID 5176 wrote to memory of 1576	5176	plcbugfix.exe	105
PID 3100 wrote to memory of 1628	3100	msedge.exe	106
PID 3100 wrote to memory of 1628	3100	msedge.exe	106
PID 3100 wrote to memory of 1628	3100	msedge.exe	106
PID 3100 wrote to memory of 5676	3100	msedge.exe	107
PID 3100 wrote to memory of 5676	3100	msedge.exe	107
PID 3100 wrote to memory of 5676	3100	msedge.exe	107
PID 3100 wrote to memory of 2868	3100	msedge.exe	108
PID 3100 wrote to memory of 3412	3100	msedge.exe	109
PID 3100 wrote to memory of 3412	3100	msedge.exe	109
PID 3100 wrote to memory of 2656	3100	msedge.exe	110
PID 2656 wrote to memory of 5476	2656	msedge.exe	111
PID 2656 wrote to memory of 4676	2656	msedge.exe	112
PID 2656 wrote to memory of 3648	2656	msedge.exe	113
PID 2656 wrote to memory of 3648	2656	msedge.exe	113
PID 2656 wrote to memory of 3648	2656	msedge.exe	113
PID 2656 wrote to memory of 3892	2656	msedge.exe	114
PID 2656 wrote to memory of 3892	2656	msedge.exe	114
PID 2656 wrote to memory of 572	2656	msedge.exe	117
PID 5176 wrote to memory of 2056	5176	plcbugfix.exe	118
PID 5176 wrote to memory of 4560	5176	plcbugfix.exe	119
PID 5176 wrote to memory of 1392	5176	plcbugfix.exe	120
PID 5176 wrote to memory of 4036	5176	plcbugfix.exe	121
PID 5176 wrote to memory of 1632	5176	plcbugfix.exe	122
PID 5176 wrote to memory of 4208	5176	plcbugfix.exe	123
PID 2656 wrote to memory of 3412	2656	msedge.exe	124
PID 2656 wrote to memory of 5676	2656	msedge.exe	125
PID 2656 wrote to memory of 1532	2656	msedge.exe	126
PID 2656 wrote to memory of 4924	2656	msedge.exe	127

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://gofile.io/d/YbOUb1
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x21c,0x240,0x244,0x214,0x2b4,0x7ff9ab8ec188,0x7ff9ab8ec194,0x7ff9ab8ec1a0
  2⤵
  PID:3612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1796,i,7521792895051082740,6294175287114935137,524288 --field-trial-handle=3216,i,1535550290589358681,2514046253685241218,262144 --variations-seed-version --mojo-platform-channel-handle=3244 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:2988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1616,i,1471809313391226481,10408965418240762694,262144 --field-trial-handle=3216,i,1535550290589358681,2514046253685241218,262144 --variations-seed-version --mojo-platform-channel-handle=3212 /prefetch:2
  2⤵
  PID:5864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2272,i,15444549997438277989,7119103140398882598,524288 --field-trial-handle=3216,i,1535550290589358681,2514046253685241218,262144 --variations-seed-version --mojo-platform-channel-handle=3252 /prefetch:13
  2⤵
  PID:3464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3108,i,6035632679439395754,2398100675047464509,2097152 --field-trial-handle=3216,i,1535550290589358681,2514046253685241218,262144 --variations-seed-version --mojo-platform-channel-handle=3424 /prefetch:1
  2⤵
  PID:5564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3104,i,7730073603823138060,6513462682190722175,2097152 --field-trial-handle=3216,i,1535550290589358681,2514046253685241218,262144 --variations-seed-version --mojo-platform-channel-handle=3124 /prefetch:1
  2⤵
  PID:5936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4700,i,5261870753238345772,14149527342102811643,2097152 --field-trial-handle=3216,i,1535550290589358681,2514046253685241218,262144 --variations-seed-version --mojo-platform-channel-handle=3084 /prefetch:1
  2⤵
  PID:1092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3856,i,13293698370818570579,10018198248534736625,524288 --field-trial-handle=3216,i,1535550290589358681,2514046253685241218,262144 --variations-seed-version --mojo-platform-channel-handle=3908 /prefetch:14
  2⤵
  PID:1160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4796,i,1763269985684519738,16077826010414100703,524288 --field-trial-handle=3216,i,1535550290589358681,2514046253685241218,262144 --variations-seed-version --mojo-platform-channel-handle=4976 /prefetch:14
  2⤵
  PID:3972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5724,i,9624524527825375767,7088545014294039290,524288 --field-trial-handle=3216,i,1535550290589358681,2514046253685241218,262144 --variations-seed-version --mojo-platform-channel-handle=5728 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4172
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1108
    3⤵
    PID:1180
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5764,i,6671732077930327668,8876198117220619781,524288 --field-trial-handle=3216,i,1535550290589358681,2514046253685241218,262144 --variations-seed-version --mojo-platform-channel-handle=5780 /prefetch:14
  2⤵
  PID:2144
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5764,i,6671732077930327668,8876198117220619781,524288 --field-trial-handle=3216,i,1535550290589358681,2514046253685241218,262144 --variations-seed-version --mojo-platform-channel-handle=5780 /prefetch:14
  2⤵
  PID:3580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6032,i,14491104085602268715,9494915484271159069,2097152 --field-trial-handle=3216,i,1535550290589358681,2514046253685241218,262144 --variations-seed-version --mojo-platform-channel-handle=6152 /prefetch:1
  2⤵
  PID:5172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6352,i,719515069627183994,13681717334398301420,524288 --field-trial-handle=3216,i,1535550290589358681,2514046253685241218,262144 --variations-seed-version --mojo-platform-channel-handle=4856 /prefetch:14
  2⤵
  PID:420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6300,i,13225424726464835908,4708192835519205790,2097152 --field-trial-handle=3216,i,1535550290589358681,2514046253685241218,262144 --variations-seed-version --mojo-platform-channel-handle=4908 /prefetch:1
  2⤵
  PID:5460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4700,i,5088971387689913254,16456773954684940468,524288 --field-trial-handle=3216,i,1535550290589358681,2514046253685241218,262144 --variations-seed-version --mojo-platform-channel-handle=6732 /prefetch:14
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:2780
- C:\Users\Admin\Downloads\plcbugfix.exe
  "C:\Users\Admin\Downloads\plcbugfix.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4932
- - C:\Users\Admin\Downloads\plcbugfix.exe
    "C:\Users\Admin\Downloads\plcbugfix.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:5176
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.gg/MzeBuGXVxY
      4⤵
      PID:2468
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c cls
      4⤵
      PID:1576
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c cls
      4⤵
      PID:2056
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c cls
      4⤵
      PID:4560
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c cls
      4⤵
      PID:1392
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c cls
      4⤵
      PID:4036
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c cls
      4⤵
      PID:1632
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c cls
      4⤵
      PID:4208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6924,i,2045551863568779268,8259461607187781667,2097152 --field-trial-handle=3216,i,1535550290589358681,2514046253685241218,262144 --variations-seed-version --mojo-platform-channel-handle=7020 /prefetch:1
  2⤵
  PID:1628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=7104,i,3496451957985809487,3461626933493456501,2097152 --field-trial-handle=3216,i,1535550290589358681,2514046253685241218,262144 --variations-seed-version --mojo-platform-channel-handle=7140 /prefetch:1
  2⤵
  PID:5676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6188,i,13398999469321849119,4609829797632658794,524288 --field-trial-handle=3216,i,1535550290589358681,2514046253685241218,262144 --variations-seed-version --mojo-platform-channel-handle=6220 /prefetch:14
  2⤵
  - Modifies registry class
  PID:2868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6260,i,2834336176743734627,10166832374795578564,524288 --field-trial-handle=3216,i,1535550290589358681,2514046253685241218,262144 --variations-seed-version --mojo-platform-channel-handle=6256 /prefetch:12
  2⤵
  PID:3412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2656
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x24c,0x7ff9ab8ec188,0x7ff9ab8ec194,0x7ff9ab8ec1a0
    3⤵
    PID:5476
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1680,i,5647747075269366048,17649639105174986182,524288 --field-trial-handle=2204,i,15126279028012623556,11519928983537836459,262144 --variations-seed-version --mojo-platform-channel-handle=2232 /prefetch:11
    3⤵
    - System Time Discovery
    PID:4676
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1560,i,4957900206841915375,11966604920661851276,262144 --field-trial-handle=2204,i,15126279028012623556,11519928983537836459,262144 --variations-seed-version --mojo-platform-channel-handle=2200 /prefetch:2
    3⤵
    PID:3648
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2112,i,11932967366920389333,4012645918862856997,524288 --field-trial-handle=2204,i,15126279028012623556,11519928983537836459,262144 --variations-seed-version --mojo-platform-channel-handle=2468 /prefetch:13
    3⤵
    PID:3892
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4504,i,5684227940243295539,904781379775461012,524288 --field-trial-handle=2204,i,15126279028012623556,11519928983537836459,262144 --variations-seed-version --mojo-platform-channel-handle=4520 /prefetch:14
    3⤵
    PID:6136
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4504,i,5684227940243295539,904781379775461012,524288 --field-trial-handle=2204,i,15126279028012623556,11519928983537836459,262144 --variations-seed-version --mojo-platform-channel-handle=4520 /prefetch:14
    3⤵
    PID:572
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4504,i,1048985160615737272,17420948630251229636,524288 --field-trial-handle=2204,i,15126279028012623556,11519928983537836459,262144 --variations-seed-version --mojo-platform-channel-handle=4860 /prefetch:14
    3⤵
    PID:3412
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4532,i,14528603542961979071,8021971272361610141,524288 --field-trial-handle=2204,i,15126279028012623556,11519928983537836459,262144 --variations-seed-version --mojo-platform-channel-handle=4564 /prefetch:14
    3⤵
    PID:5676
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4580,i,16219995464103309414,6251107687116046837,524288 --field-trial-handle=2204,i,15126279028012623556,11519928983537836459,262144 --variations-seed-version --mojo-platform-channel-handle=4904 /prefetch:14
    3⤵
    PID:1532
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4532,i,7603310303512232907,4572663808555775545,524288 --field-trial-handle=2204,i,15126279028012623556,11519928983537836459,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:14
    3⤵
    PID:4924
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4988,i,10413486758675939528,278831429560284195,524288 --field-trial-handle=2204,i,15126279028012623556,11519928983537836459,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:14
    3⤵
    PID:4616
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5100,i,17340483071049044337,6577479285640041187,524288 --field-trial-handle=2204,i,15126279028012623556,11519928983537836459,262144 --variations-seed-version --mojo-platform-channel-handle=5104 /prefetch:14
    3⤵
    PID:4964
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5128,i,4759403578206795919,10199839956299253141,524288 --field-trial-handle=2204,i,15126279028012623556,11519928983537836459,262144 --variations-seed-version --mojo-platform-channel-handle=5256 /prefetch:14
    3⤵
    PID:3868
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5100,i,16581947059195255160,5853591698732606389,524288 --field-trial-handle=2204,i,15126279028012623556,11519928983537836459,262144 --variations-seed-version --mojo-platform-channel-handle=5248 /prefetch:14
    3⤵
    PID:5852
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5252,i,1298238836964238658,3389087347105700887,524288 --field-trial-handle=2204,i,15126279028012623556,11519928983537836459,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:14
    3⤵
    PID:3624
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5148,i,8990770348359192695,12541701996321143120,262144 --field-trial-handle=2204,i,15126279028012623556,11519928983537836459,262144 --variations-seed-version --mojo-platform-channel-handle=5256 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2516

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2208

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4376

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4984

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

autofill_bypass_cache_forms.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.32\autofill_bypass_cache_forms.json
Size 161B
SHA256 f7510e38f81f8a84027304070205dd55127e3233fdf011411465ede67b5b5d92
MD5 4b1a79b1996f03fb926a97912835c881
SHA1 ca43e23f7bbb4ff3839751f722df3c38ef7bd8a7
SHA512 c2e07a1b311ab71d94c7b874d645fe1114fdccfe4468875d6b23318fbe327481a60b2782af105b7546b3c1e6c3a7ec67261b21a0587f914cc7bf77c55f1f568e
TLSH
T1E5C08C07ABB804230B414E0B590DEFC9990476F6D5C146FEAB75A5A98A3C6B0005B74A
MD5 SHA1 SHA512 TLSH

Submit Download

edge_autofill_global_block_list.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.32\edge_autofill_global_block_list.json
Size 6KB
SHA256 7d3c45c8207ba69066516e51e10a2137bc4f1fce070a692e0c65225f9856e04c
MD5 5d4464dabc1289c3a010e14c05b92c57
SHA1 d2d185faca1cd13a6d42dea68803a9941074707d
SHA512 f93f4b58efc0127946ffa1b2950a1cf71da6f77a6ab4cf98ad8ada6a751d6261be4818ff8c64fe1f1d45467aa070e0823d15be36c8259c1044fb2d1289df9994
SSDEEP 192:C73stL7O9FnLk25+tF4B8K5b+QiGoztWuDpR6lFuftdHAa4/i:nwJ2r
TLSH
T133D16A2BA91C54B32A044839128E5BE47DDD73B6DD6008D6D650C0B9AEDFCB8203FDA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v1FieldTypes.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.32\v1FieldTypes.json
Size 509KB
SHA256 611e7995ab7599a0c89f98d6c6152a42aaedf7449748109a465bb5b0badd0af2
MD5 b1c140ef49f01eea089d3957da1a529f
SHA1 de64781f20aac98b4d2bbc497e3defa83b25aa8f
SHA512 02ddfcbaf9eaff793f251bd983394cf473b1340182ac1f3217cb7258ddfbd2de066ab08af16b47a378644bcc1871ad6ed8c641f6a053802c90e77f648e4f4be8
SSDEEP 1536:jlKS/dYt+dtxX9U2/W++dGcUooTHR6rF1azQmkEMUmxralqDAtyttVJAC5c8KrVx:B
TLSH
T148B48E2BF9F25C634D822A32053E18996A30615F5CEC6CD4BB3E211F4F2C1791E797A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2172811336537a33607e0aadb9c5ba8cadf28b2a4fcb84d32213c685b1c34544
MD5 c6c88b3fb919f1f75228e4aff327fe5c
SHA1 70428f4ae69437730ef237674398113e1a3f3017
SHA512 1cda50c8b022751e3d3a7c73ffc9350fe02786e3000fa887544b774366bd092e165982f8e834c7eb67dc7a078a4dd76c0d5370912b7c3c7b95fc731b504ce5e8
TLSH
T19FD0803D1572BCB4C499DA714456372B6E1DCCE24DC65F116462356D4D9700186D72D3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1eac715bceeccb15cc45a13a9b914a80ac00eeb9f178f8c94511c17b32720b1a
MD5 b42dc01f081a5fcaa564011a4fcbf9f9
SHA1 8bcee7db87d1cadc63412a4981a1a46bc8ac9a01
SHA512 70a6ffe00e23a197554908a478c6e06671c1c239e2134c7e2eb172c03b4237bd91a7d62847a63e20268dbfb9c9b77ec1b8df3b9c0e528df0aaa3f9289c5d6452
TLSH
T101D0803D1572ACB4C485DA714456372B7F1DC8E24DC65F116462357D4DD700186D72D3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a9f4fecd4e8f8d72ef057367e2946882ee6bc1449adca096e722663d2e3c4180
MD5 a8bcd0df19e6fddac94ec13b4934a713
SHA1 9649e3f5db828d1ef66755ba7b6abd362dba1644
SHA512 106c4b2c5b0c79aafac0106f434986cd40076d1dfd834d7cf88cf1fd516568f3360e8483a28fe959c85d3c4234d97caeab925e789b555bc657387ff1ea9e44f4
TLSH
T1DAD0A739797AE455C5291033426162725B0E894128D64A00F059C04DDE6D26A93D65D2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 153a3ab4537639e314ebb5232944d8c835ca09db9d69c248742d9b8b60bda4a2
MD5 26572fb4bc88f434af27ca121e1dd4d9
SHA1 4cc75426db15890b5ffda20d7f5b9eeed08be7f8
SHA512 73a6f621f4d158869135e642c5650b82e4807296413feaca135030c7ea71c1c630fd512b375761abee2d46cd2aa081731e165517ca4ac1b0a2ce5f1239e5a170
TLSH
T17ED0A7387AB9A458C11604338161A2225B8A88412CD95E41B158D45D9D5867A93D76E2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 82ea554cfb735beb5f18f7beba31cfb3d89c98de1aba803079962a695d19ee68
MD5 199fb8616e1355862b22f93a1fe8125c
SHA1 b7ac9b9ba49eee1d040d5dc01bfee161ba94181d
SHA512 b2d77bb01c987e28ca6f85ab43d8cef090d21a611fd02f065b4ac14397294791568d0b277249094c550b0a251c4865847358eacb20386c465fb15e6e64204212
TLSH
T16FD0A7387AB5A458C10604338161A2225B8A88412CD95E41B158D45DAD5867A93D76E2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 34bf8b5328b6f27fa8ca3d60cf020cc014e59945493c796f406035acb7bd8f49
MD5 c52b3c395125f281a1bf59ed45f7d568
SHA1 b79a3d545297ce9f06b9ecc9554becb75a8b57b5
SHA512 e35c05dadb5e1e00b6bef256594441ffcc272423a4c95cef152f5d3cf278b6f6d60cc3b4f5543a2350025315d3c272eb36ead9d313d37ba204f0d4b92cb20dc4
TLSH
T1E6E022AAC831D86708FD0729A4644B06EB10131B2B908A5F3F3D820C8FF0A3B069586C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 6KB
SHA256 8609dc5401f9b8f3a6912cc5931d6b61091c3584f444551fecb4fcf373ae9a62
MD5 c9282385cf968feb47462943e116b538
SHA1 e12b39d6de6f7f1b32aaf5f4dffd8b820ab95cb3
SHA512 793140fae5ab559508441710d0b21b7463fd6f497dcb08b1cace90f8070d96f53c4750defc6d7341e9407ba1f6ca834f95f657d8ff545256579af2ab94b2c3ef
SSDEEP 96:fdaFRjKi3y/eF4o/Y6irXA5Y9wmhbDYu9zXRdMvMOWTGhhS/N:8R+HeFp/Y6irwcAu9DqMfSh4/N
TLSH
T107D1F55FE0BAF0EDF7F080B35DD72C7A36B16536A1070EA0D5E6943E551DF62A480A12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 1e484df27eec4de451ed4d00976a8b66070a20235f2db9b6de9c5f7b8b40b750
MD5 012c4936e5951aa4dfdbdba9f51ce1be
SHA1 4c90bc35f59aa26b67fb5f7ea2053f70c9998709
SHA512 bde6525cf2a285dec03fc6deb9bb2f16455ffa588e0225c4ece6082c843eadb261c1251631290cc475876212ef48e4f7a596d1371697904b47d43c277167280d
TLSH
T11461BEF783F4866DDA1196F4AA086E2FCE5C0411432C7D6EC5E09E1B93E3571F141A5B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 d6abaa63c42b9cf8ab9c1b51d6ac4a2076e8cbc5ed528edee2f84e1ee2cf485b
MD5 e6438fccd81f81f2fef2790eac7f22d9
SHA1 d0e489dcf80bbc2edbf6499f9b414728181e23b4
SHA512 8a1ca4a54966ddc90534005142e950ea6c9be9e1dff6c3968e87a85f6be46df3bda9ab3d77d76d99cf297b9ac6072eeabe577502fca7e8b4f70ec7c8318ba8f2
TLSH
T120719DF783F8852DCA1196F4AA186E1FCE5C0510432C7D6AC5E49E1BA3E3571F141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 d679af2edb13e9b617513f60ef348d76c151d95104560662dbc3b9c20672f5bc
MD5 0d35d9d67f709591d5b4114ea2315a6b
SHA1 5ca07bf5bccc9cb1b978bb896463b52b06282f56
SHA512 65620fe635292b42b13b0f90c1bbd1686ac7542a2acbcc971a69ac0670f98da9f6563f6dfcf48c91f95a44c73f89ffc658c9952289e83395074ad03a6cc0e23f
SSDEEP 192:sxZ8RlyMqZ/K1Ml8XoO/fws4WpVzCtNIIDPJzzodpx4l8/W6+WNHcNtzR9S/Y0Mt:sxZ8uJO/fws4WvzCXtLOP/bEC/5oPw7Q
TLSH
T11782E906A534897BCCDBD219FA45BF53D6F8152292915E48AAFCCB0C00D7BDD221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 60338c8cf15c4012fc50502b99bcbc392c850a88c34693acac15951a0425e02e
MD5 f9ae1fb49a75c2b6f12f8b66d8b67ffe
SHA1 60d6e93549b8aa9a79cee1ad106eeccbde4e6377
SHA512 8d3807ecff7341162fa54880961c03550b7573c461353afa743ea1ded1d607d342753bb7f737cc10b72f81cceab92e1551ba40d8dd0ea7a0826ef8de8369f293
SSDEEP 192:sxZ8RlyMqZ/K1Ml8MoO/fwsmCtNIIDPXzzodpol8/W6+WNe9S/Y0ETgjkZj2IgjQ:sxZ8uQO/fwsmCXtL4d/bF/5w+jQ
TLSH
T12A72E9056A34997BCCDBD209FA45BF53D6F9156392914E48AAFCCB0C00DBADD221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 9caaab402b66c0ec9306e37273dbdf402d9982692180b557cc50a1e6bbb4341c
MD5 1d46909ecfdfcf31042b7c5b6ca5f1fe
SHA1 eee856ca7008340e5a9f82083cc2c8940de7d99a
SHA512 7338804e188c25894295f5d8212d791c04dd4650db4f959b061cf7b10e49fdabd5e04c271d29c88ddbbe7cce2884313c9127c1322656fe8c3093f3bbeecbb507
SSDEEP 768:UnjXV8Zp2+m7pLuL/AAWRmAoQ7k8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3FDwvLlJ:UnjXV8Zp2+GE/AAWRmAoQ7ku1jaKFDw/
TLSH
T1A1030B3B680CCB7E4F804E9CEC27BE9E6DE8018B9698895447FA444C03C66EF551B1DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 233B
SHA256 a8431cbef31232954d022f8fd49967b1c104d3c6f0f55d6542957fc68c2e1e7b
MD5 c916b2e00cb4374afdd1475e08903e58
SHA1 0c0ca9749b28f9dde21dbe03a1e81595ab26c138
SHA512 a9525e4b096c0f0ecbca82cd0944245b9e5a2cff4e6fcab3fc5bb7718d3341247ad71c55e63f138051002ffee5909f59db581ca2b5fcdafee438a520823449a6
TLSH
T117D0979FF2502880E7B60F922B31086E8E203CCC2494504C940331A90078BA7D220EA2
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 226B
SHA256 cde1ed80e86610d3a3c9375ac58a18d67a61e0ad7e070019844442e785d89ba5
MD5 e544bbed5099cd49acd27704a089c1c7
SHA1 0a78710bf28ab7ecf8a7e3191dabf971eeb7c98e
SHA512 31e188d6f1dd767198e5d87cf08eec3589d7f5779db9708fe364766ffe40626f90df78ce871ae115cb72bcb127015282e2e857f5144a7b5e9434b484c33140b0
TLSH
T19BD0979FF2406580EBFA4F912B21183E8E103CCC20A8608C600301240448AA7D221EA2
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe583ddf.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt~RFe583ddf.TMP
Size 138B
SHA256 36ef5a1d0beb9945f95dc7d6b03950e0cd056a582593d2582ac52ca4d96ae93d
MD5 2f793b4476b8176f08c5b4567e4fcc89
SHA1 189461aa56b4301d13e066c81e76ced77c32d434
SHA512 3ed9a4121b64341e33c8335628aba0cfe2eea1422ace1e695a41d12c88c512b4ed5e94202828ff5bb6ec07e4fd4f4139e38805e774dff3d3325d3bf335888d6f
TLSH
T1D8C02BFBF0400100C7E007521332917E8F077CCC6985908C601330143030F236245FF2
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 ecd1dcdfe8c67b6f0010a5376257d9b799d0b34c90c0371aaa51678089df0bd7
MD5 d24a5ccc76fd6758a417d4b4a8f77022
SHA1 7132aeb5493b8ffb0859549d693640a2eda1fc4a
SHA512 e56e4af6c940b70ac40d8a293f610272d75d89b5020461d58b5ab3901f43727ae25b33082f8dfd781a12f84e322df7faaf206ff642f5cf24f05778d06a02b193
SSDEEP 384:axVJBTwmM9gpJjvp3KLO6cIURI92SWBu0ha6dca16:axVJBTwmM9gpJjvp3KLO6cIURI92SWBg
TLSH
T1F1B22C11357B03C03ABE259A81A1B5AF46C230637118E53B7BF841EA4F66E25DDFE4C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

domain_actions.dll

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Domain Actions\3.0.0.18\domain_actions.dll
Size 83KB
SHA256 d35c8efcb710239f009633bcc5ae904ac6dafa985d451bedf791cf6909f014d4
MD5 956f610121cd5827fd5549097b79cd9f
SHA1 dbd23f99895a3a92fbe04c3c35d475a6f6998fd0
SHA512 3cc4712f64474497495d229ddd743c6bf25c30c3fbfca2525f46227d99a59a0f9e80e2119ffb40bc8a707b539f65f907e2e1565ea937e0387db47cf7269944e6
SSDEEP 1536:sNGnmI1FOxAdgxBf8paY3JQzQik428fKagFVbydki8yyafuzWk:sNG91FPgrfrPza428fIenya2Sk
TLSH
T16D83F180DF58411BF86F4835E0B269857A78E6B50FE092DF2376C9590E12FD1AF39705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 29KB
SHA256 42218692df2e12c89d0f3d60df180de754ebf990417a0c6708f54428b1f09e8c
MD5 6b15ba799d7470e9dc126c1f0ec6b4d1
SHA1 932e4524c324eb9e9a1b00e0f3f016a5e20172bf
SHA512 808f3c66d1c9aaf627e3bceaa6bf53f64b8edfa86ef85b60c69e22f8fe609127195b8f678ab4bfe94b90ff32b0706e333c8185d7e1cd4e09eb248e7283c1a03c
SSDEEP 384:n8iFcjccCs+Bt0S3l8NJ8TUNTUlIR/vHIpKP2BrfPKmruHvYuofTSueqE1AhYB3h:nFaccQFqwgOASKmCHXof25qE1AhA8k
TLSH
T1B1D24B39EC95CDBBE8EA5F84A34E3A439EE00173D5984AD8DBC84F4D00A719DA70BD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 73de4631f5c5b3a140f35bc01fd8a0baf85432ef43ea5041172c870f9fed011d
MD5 4c5989d46f3d97708fece928e6794282
SHA1 f2d3f9c96b45f1d8db3cf56b1408602ffe7521ca
SHA512 1787e1c416b6817ec4114b900e29e433c5a0f1ad210ad48cd084ee24a5a2f95b01204f3af7c6cf8afb044ae80b397437b2b924e192e427b556347d64de6a2a7d
SSDEEP 384:nUiFJjccCs+Bt0S3U38Nz8TUNTUlIRbvHN+KuBrfPKmruHvYuoA4Xa6n83HX4urw:vFJccQ03cwguBKmCHXoA4a6ncRAN
TLSH
T1AAD25C32A864DDA7EDF68F95A34A3B03EEE0116395880AD8DDD95E5D00DB1AE130FC15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 aa083c0e4dfa50323c2a245c2653fd6c0bae64d442001f13d33dc5d18a1f92d3
MD5 43602f11703f25d37cac35ae107b873c
SHA1 cc24e5563d353f3cbf260ad1ea1748fbf76117b8
SHA512 a97bc33b76412e2532dd093ddf85622a6569bad5900a2190a70326bc38d44a703d56e17de31c831bbde24308c9c01aeba3696aa869cf66b4e2bebb52680a4345
SSDEEP 384:nSiFavqMg38Ni8TUNTUlIxBvHT08GBrfPKmruHvYuoJadnS4mtm5PurNlk+5vI+k:ZFayv3Fwgg8iKmCHXoJadS4smVG4
TLSH
T1BFC24B75EC58DAABEDE74F9AA7497A17EEE00167D48C4AC4CAD81D1E00DB1DE130BC12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 7b48211ff59d0e6855238f03e204f8a60f9c46fc352802e3aa8737e8a9c8c86a
MD5 c19fc76289be93b91a6871b8598f5c3a
SHA1 e6403e655d7bc84d349554957fb584241d95c8e1
SHA512 0658385532c7cf764f337eb90a240db534b4ff500ecf8fcadeb25ed2cef524aeec0526990c09f862b5f501299758562f4d692d622917ad93611eb3a99dee38ca
SSDEEP 384:nUiF2jccCs+Bt0S3b38Nz8TUNTUlIR/vHXzKP2BrfPKmruHvYuoA4Xa6n83HX4uU:vFwccQ73cwgFASKmCHXoA4a6ncRAN
TLSH
T1CED25B32A864DDA7EDF78F85A34A3B03EFE0116395880AD8D9D95E5D00DB1AE130FC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 032f76f94ac0849d2c2315a062fb2ebb20c17af7e953fef31e32e6df90cf48fa
MD5 dc5a5c5912cd567d64b1a3b65923d74f
SHA1 f3e66e425f6de6c443a7d204e1350cef0eb04e4a
SHA512 7b075807d8766e8e138a207b633f6377f9f0da785fca13c0812a886e37072bc571b15333e6811ff46ce1e5f1e76c370a45ca96d716f048a606a54f451c73eb15
SSDEEP 384:nUiFcjccCs+Bt0S3l8Nz8TUNTUlIR/vHIyKP2BrfPKmruHvYuoA4Xap0/Jk09Hk7:vFaccQFcwgxASKmCHXoA4ap6X94DcRAN
TLSH
T1EAF2293DAC648D7F98EEBF89630D2A169AE40277C5B845A8DBD50F4D80B719DF30B811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 da34b99d2ad7a387496bb1e354d6b84691bec6b18640e4b7244adaa96d0a614d
MD5 146d4fd528ee78d3304ad4ab74f93589
SHA1 ac1bbbd9a1999d9444fc359621509642d312a67a
SHA512 c6210b40af39c55f3b09afb685bfe6c8edfaa383498874a8cce574b05b63d185f80f6b8d526b55cf044b169bdd2bb11e7e74bdada94759ebf104d101bc10991f
SSDEEP 384:nOiFcjccCs+Bt0S3l8NJ8TUNTUlIR/vHIpKP2BrfPKmruHvYuoA4XapoY783HX4I:lFaccQFqwgOASKmCHXoA4apo4c8k
TLSH
T11AC24B32E864CDA7EDE78E89B34A3743DEE0116399884AD8D9D95E5D00DB1EE130FC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 b6675abc90118d59ab1ddb0efcd410faeb0169e8975231d52b8905e4dbc0c013
MD5 a05124f650aec9401cec48976a173a88
SHA1 d5e4a886cbec680ffe47654906ded098b94887eb
SHA512 01c43a7c0a953708f7dc6987063a4da927967dd7b293d02851ab5b46497b0bc202d2239db01822acb7eba7fc8de8d8f3d9db5efa714a387cb1b969bdb214b34a
SSDEEP 384:n1iFavqMg38Nv8TUNTUlIxBvHR1cBrfPKmruHvYuoA4XarndnS4mtm5PurNlk+5g:8Fayv3swgLEKmCHXoA4arndS4smVG4
TLSH
T1D6C24B71E868DAA7FDE74F8AA7497A17EEE00167D58C4AD4CAD81D1E00CB1DE130BC12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 8cd54097acc7284d20e6903861287b4b5b1c01c26b4af24dce130f56956baf06
MD5 8e07d262abb8b5349c4d4e50cf3d2861
SHA1 5f4b1d7d8510165a2e7099d7a58fe8bde3882e31
SHA512 807ea408557dbc0531a30a78865453f8fb95d4a854db5296809ba30f5094dbe4066f032ed1b14714696ece2351b4f5938ab833a9e68c0622ae8e47e86bbd17b9
TLSH
T1375140E15C3D2AC1D4BD0A6EA88B38FC95ECD71AF494343D6824E9980A7A20C648083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 db393ff82aef84ce474c2a50a0af0cdd1a5387a01ac2a809516d8a0304d3ba5f
MD5 1824848c3e414bdb96f4a054280e453d
SHA1 18cec4add89233a03c2e7c7841588655ca28eade
SHA512 427e71174a916b99f31cd4fa8a3182eac098a97d8b6fbb400405a998d44a778ba6ae4fcb898cdb32ef905aede5260e6c778b50cc2d5bb012018b661ccadb10e3
TLSH
T16F5151E05C3D2AC1E0BD1A7EB48B38FC95ECC72AF4A4347D2814E998467A60C648447F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 bee95520a6b5f3e628f3d00d879ca3571b3971c35abb580be2f448b52470707b
MD5 24b5f513078f65870d0ac29a479d81fd
SHA1 4081d0b8f59987d0130379fee05324b6d8c395dd
SHA512 1a20170f0ea89deaa7dc83216fef110a5a12d1b3a0dcf37a37e36af2c6e7f65bf2d238c1190db8847515b0973cbe7e0eb645a529915a9b9cf32608c0588069c2
TLSH
T1B25150D15C3D1AD1D4BD1A3EA48B38FC95ECC72AF4A4347D6824EA980A7E61C608443F
MD5 SHA1 SHA512 TLSH

Submit Download

3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
Size 147KB
SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
MD5 9c670f04d98ab7404f16423f6ee6cdfa
SHA1 8d01079b2d065731df8a7ef52f447cd4b7add353
SHA512 102cee76d9dfcfe91e044f529672fbec042b50c5db55a3cc137197b2013dd7f81e47f50dbb0db96cb621c5732610e1eb553c4146837c11075c7c4dbd67546a3b
SSDEEP 3072:F7R0M+jCozOtDTsjMcT0JnFjkbxnEbm/+OdGmlVVklFHEpCm+:F7WxxzyDTM0JnRkb5bJdGmJkvkpx+
TLSH
T12DE3E16D3DE6DE1FC41B58F53E64708BC80E8F0B820A644FB64988345A60B5D1BD6AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 54f761e00d363bd15db7bae3cc55144c80148a5fa1db7c3c2049e0e406a9142c
MD5 b1ac780361002049b0a10a7fd30fd809
SHA1 0ee0a7dc27fd175ab7abd6e5649890be3e2795b5
SHA512 1bd8b1d2dc30bc62728d3d08085a446e8c037b02499687affa9a0bb18c6bdfee19104eabdcd8a52c2d0b542046abf26b7fdf81815037d4923e31231b0dfb7d60
TLSH
T156C02B5538F9488C2FA5257ED238092E12E4C912310022B0002ED804103465C13A0C2F
MD5 SHA1 SHA512 TLSH

Submit Download

40a759e7-aeaa-47e2-a8bc-7981b1ac845d.tmp

Path C:\Users\Admin\AppData\Local\Temp\40a759e7-aeaa-47e2-a8bc-7981b1ac845d.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI49322\VCRUNTIME140.dll
Size 117KB
SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
MD5 32da96115c9d783a0769312c0482a62d
SHA1 2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
SHA512 616c78b4a24761d4640ae2377b873f7779322ef7bc26f8de7da0d880b227c577ed6f5ed794fc733468477b2fcdb7916def250e5dc63e79257616f99768419087
SSDEEP 1536:Z9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaLjTz164zEd:ZEnsvReGsWyxLizXFkecbd1aPTzW
TLSH
T10DC38C8572A002FBD16AC274C1A36A17FB75B94487B0A7CF03B58A650F53BE09E3D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI49322\VCRUNTIME140_1.dll
Size 48KB
SHA256 6a99bc0128e0c7d6cbbf615fcc26909565e17d4ca3451b97f8987f9c6acbc6c8
MD5 c0c0b4c611561f94798b62eb43097722
SHA1 523f515eed3af6d50e57a3eaeb906f4ccc1865fe
SHA512 35db454dbcc7ed89842c0440b92ce0b0b0db41dbd5432a36a0b7e1eddf51704b1f0d6cff5e3a3b0c3ff5db3d8632fed000471180ad72e39d8dbe68a757ccdfb0
SSDEEP 768:vzzO6ujT3MbR3v0Cz6Sz5q83ywug1HDV9zxfYbK9z:mq/oMx3hXHDnzxfYiz
TLSH
T1AE236BA453784486D4AB99B0C0DAEE577D7CFA964B10928F0BA0D15C1F637D0EB3D21B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_asyncio.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI49322\_asyncio.pyd
Size 76KB
SHA256 48fdd95938c43b8b3e1f6312de651a53d459e8e2c754fbbdf48e99f5caa1f55b
MD5 3a6186022e5487f7088370c9ade4595c
SHA1 0284e6fcce3034555f1809e01e525c2f5bb17a9b
SHA512 11597e7b6091cacb5fca16ca9c718326233788d4ed9435d43f2d766f09f60716ea63c9b88768d857245f4bd1ee9c4667ee55c76f55c1ab6f87c951a98fa6907b
SSDEEP 1536:sm6uk+xO/OpCvE/8h340gI1DnHQyvcvR9SfIkubo:sm+/OpCvEkh340gI1Dn0H
TLSH
T1C6737D87A2A44186EEF79134CB536FC3FBB1F1915A10939F5194C18E2F533A18BBA721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI49322\_bz2.pyd
Size 85KB
SHA256 a4be36fffeefa8b24c1234d548da8f05558aba53c2ea7d1d2614776eaad8fbf4
MD5 a0946ac3236b70d27de6046ccc467977
SHA1 84f2aa56e58849cf30e632e7eaab4901a681f08c
SHA512 02429781f017b534918657e5c152ea022b52bcddd15ecca7f8b4629940dd4367a09af4d86a1f05d946ca97f2709718b136003693088c480d9b791e4d18361174
SSDEEP 1536:vZAVNz7DkEvkmFfR/l/kM4KPkM/gg8IWRbG3II13VAyvcvR9qfIk2:vGVNzUERn9R4KRg7NlSII13Vk
TLSH
T1A2838E96F3B552B6F59B91B886840793F730BB860750A3AFF14882853F13BD06E5C369
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI49322\_ctypes.pyd
Size 139KB
SHA256 f8a9f7831e81b2bfba12456e589f8198114f24986bd527ac231a844565afcddb
MD5 03fb3055ed0c56155bbf030596726e03
SHA1 fba03bbf844c08ccf20854d717a84fa62ab291fd
SHA512 9ba8f50f75b37858b3d81d6f7323ae981ae21f57a9897955142bc53098ad74c8ae119e61ccd0bb5cd0071e092e8c2bbb5c146688e29f2cf7d1d3740f47ec9117
SSDEEP 3072:HDpx2Lp7KRmFrkdOJWWcovIMzTF4FyxpEI1GPny:jpxCdK8r8WDvIMn+8xpx
TLSH
T160D37E4B736841A6DA678138C6739E47EBB1F452261087CF4264C99B1F633A2AF3F315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_decimal.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI49322\_decimal.pyd
Size 283KB
SHA256 04738ee6b96bcc6351446b011b523d831aa88ec3f11d4b64c33414c965b56b80
MD5 bd5ca697bd7da2b805a8372f879dc4d3
SHA1 41e0bb70c6d08fd646fe0100068dacc4d1a4ace8
SHA512 248fe22d992c68912c31988a7ef6a71cbdd18c7facc4e620eb6c09c78a5b4b7e37adfaf10f4461fffed73fd73f211d9f428e7a60960558be13e992c855e31b15
SSDEEP 6144:n6TEZDpJodlvNDRfAT8GqqM43fIWeA5tMo:n6TaDpJcdND4jKo
TLSH
T1AC547D57A2490CA4EF778434CA479A5BF7B2B8414360D78F42A48AA72F933A3377D744
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_elementtree.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI49322\_elementtree.pyd
Size 135KB
SHA256 fbb615c3373825d4ffd61fef4698aa5b2bce474bc2c3f75dea4b9a06fff23800
MD5 a850b3997225af90363c7f62ee7c2ccb
SHA1 ff450e87a54f95dd0aa877adcdf63963696f7e79
SHA512 90c0a52c37a7f98cc8119896cdcd826a322bd1ba913abda854c0e8a2b1f0e579863822359b7fef0eb202a24eba667519cc4f96064ff6d264d46a3fddc69be34d
SSDEEP 3072:d4oarG330aA+9G5C5E58ABVRdRp8V8KD4cYI1fftrE:B30abIC5E58WRpmZD4cg
TLSH
T1ADD34A8B7265C0ABE452403CE6578B52D7B2F9610E4083CF6294F29E5F373917F6A718
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI49322\_hashlib.pyd
Size 67KB
SHA256 d4524b261f09806a828c62fc97e8517328b23d65ab87d20706a4bafd86bbf345
MD5 3c7f5536fd531f5115738cad734ba92d
SHA1 aaafd1ee00d2da6bdbaad00ef78f8fdf99865f5e
SHA512 492e61def2ec6b01d0df0c55887a7273adc7fb8bb216a6a9bceda9556546fcebde6a7175c16eac4c87ad2313d74adcfc62a571b401ad2ed9eda79217f92c56d6
SSDEEP 1536:Bs0SOWZsPZJWvSLTRfgI1DIAyvcvR9tfIL46:WLYhJWvSLTNgI1DIpl
TLSH
T17D637B8AA6984092D62382B4C9E38F43FAB5F252270197DF6279C18D2F233C35777756
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI49322\_lzma.pyd
Size 157KB
SHA256 f7ad11fbbb7aeaf7b6566a532a3243e3ae5f92bac480dbe5c2ef300fe2c1dabe
MD5 1dfaf924b4576f551f6dfe3cae50b230
SHA1 ef19846989f337e600c8f9ccacbd4276cc4d35f0
SHA512 2df6a600ecd03de76f066f87a8dd13bf138a51f89fe745813d7a00418fb716c670cb04a9b5573d2b852fc8885acac8b960ba4c42d38fcb7e9a1d2aa2e84f90a9
SSDEEP 3072:z+0m6DKDYtwipfxAbDcoAL+Uznfx9mNoV+dREOII1I1+ZgTT:iTCKDYvNoopYOyGOjeT
TLSH
T182F34C86B794F0D6F3628C78D6618F53E7F5781A0320929A01CC976D2B1FB759A2B313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_multiprocessing.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI49322\_multiprocessing.pyd
Size 37KB
SHA256 84a2e86428dde756e6f3e56369daf558180a30f1f7d4781cce295304e19b6fb8
MD5 0ace2b6b944df9590e8783b6c1e94c4f
SHA1 989f766e6dca7c109d016fd2efb9fe215ef0ab7e
SHA512 a39c46b1d83dc1489c29421426827fdcdea99484bf58423a1682ffb8727a36b0d016b1768969a1e4cd320360466d45f2c895df5656392e858cc75d0023cdf10d
SSDEEP 768:RFMV/i/YybyZUlwI17tcYyvcZRYT2Ip4rOTxf1ml9dHR7L9Hc:R7/YybyZKwI17ttyvcvR9ifIbHRn9Hc
TLSH
T114037C85A6680043E5A39A30C6A3EE87F535F3871B22969F7166C1CD1F373D1736A34A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_overlapped.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI49322\_overlapped.pyd
Size 56KB
SHA256 80a2f8feda9255ef611af0a28fd4df311e3cd59c3dc4eaba9a2e97bd42ddbf54
MD5 8b7a961d382aff5a41ac81ae7d24ec1f
SHA1 0423d4ee0c9b926272dcd431e4bf0fe9eb92d377
SHA512 577902a11cbf2af44b5b9ce9f55a5d6f9ed699f199374196c4d411ebd2b542d081d91747a32aea7de9d25ef2d77d92e4cae51454b81dbfedf25ee23ea3eb5dba
SSDEEP 1536:vyjKf/t3jM2PMJg4jGsL8I1CtzyvcvR95vfIbHUn9z:yJg4GG8I1Ct2TA
TLSH
T166436B09A79401D7ED73D579C6A79E47FB70B2930201931F60A8D28A1FB3792A72F385
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_queue.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI49322\_queue.pyd
Size 35KB
SHA256 cb529f77bc4665dfa3b66fae3d00ab84de1e9618d0cb94900efbf28527623c0f
MD5 77eae2640493cbb57e92997366ab6e7a
SHA1 bacd865b27b8bdb9649c569b8f6ff1a758677f54
SHA512 df81c1767dd7b87032838e8817ef6987e93e075f28f557e84c4e5f7029969b8e219bb75da8c63955ec19bdb34a3bef88936edf26ae5f2f272297fbbbdc03b2dc
SSDEEP 768:f7wx6rEOJgBvlAEI1RUuFYyvcZRYT2Ip4ITxf1ml6Z+7EJNgyrma:flEOJgBvlAEI1RUuCyvcvR90fILqFrT
TLSH
T1F5F27C8AAA9C5087E6A3C930C2B2EF53F535F7D357019ADF207881891F233C1A736659
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI49322\_socket.pyd
Size 85KB
SHA256 ff3e97cd11bdc68798e5b3dcd5295d1efba179b7344142d50d066bbf1c2d79cd
MD5 e60e2de0be0f2db133252f103e9b1f8d
SHA1 686000117f1dc472ea8012a7368c936bd04ded08
SHA512 49a002516235cec6870b0d08da61d3aac4440b4ae1437b7357fa493dfcba0b2212cbfefaf5833baa8b6f904f6439389ec3a6b53cd7faa718273ca0c3e00c38fe
SSDEEP 1536:KcVunc70XTxn1egypxz7XP+N6wSzsGNesQAcsqIP4fYEI1GweyvcvR9YpfILO+:zEna2Dypxz7XPs6wSzsDsQ1s6fYEI1Gv
TLSH
T18D835A01AA6040F6EB72C176C6639E63FB74F5C11394A75F1066C65A1F33382BE3AB85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI49322\_ssl.pyd
Size 180KB
SHA256 43e60bbdff2fe41701f39fa25ea6a8251a2b7623ff18f980a209a451eb5e648f
MD5 d900bf186dc66f71d07808eeae323c17
SHA1 9e86985f7cf11165a773a33efaff343da0e34f00
SHA512 d3229f5da6623844b31bb4b7d93d0baa5e7c71a3b3462e5ce3679238d2d10c17ac47e758188314edc0c30a45d9fba9a08c475cc387d7d22f17aab3e5537861f4
SSDEEP 3072:UQjyHsqUEao3kfj6CuHqMX3jYnizXClit8aN4Qp8VuMG4eJ9i1zktdsQ/3/UpnEO:MJUEV3Qj6CuJ3snOUBzCI
TLSH
T165048C47B1846AF7D913E8F9C6234543EBB4F045332297DE48D6DA860F03346AE66B63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_wmi.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI49322\_wmi.pyd
Size 39KB
SHA256 5a7f3444f1c2f85fb5573bc330c1aea2c583912bb6f948ff81f8fd89a30e67be
MD5 6fded560f9627954b2e46f0fdc9d92d8
SHA1 6f359326458d37c266244b2ab674d3cce7a76e1c
SHA512 f4785ef2f6b052deec4755102ec23c9e1fe7890cc4f852c70ac3fafa8b0fa25c17cdb95caee37f32fd8ff1e4e47a54f05e30b84dd40e8c19999a096e80e13bf2
SSDEEP 768:7u2/EEqrVmjsRuJOQMVII13i0YyvcZRYT2Ip4xTxf1mlIJ2l:7TE9BEXJOQMVII13ilyvcvR9jfIk2
TLSH
T146038D89E6680093EB67CA70C5A5CE43F575F7932711878F32A581990F233D1EB3A279
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_zstd.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI49322\_zstd.pyd
Size 491KB
SHA256 536a3b521a3c42d2827ece0ccfbe40b83a2fd96a0f5496cd60b943b10e1266d4
MD5 b89f5d1345ef95f80ddcbe5b3e4e5bb3
SHA1 2daee236009cc3efe02dc9bbbd8c6faa8ac56478
SHA512 fc925424ad4bd8bdfae04b95fdadfcdbffcac76270997b4ce365be8a47d4c636b7e0b31e78d785a3dc6c9b2dd0f108aa716a92ee4f0506f3a0329e4a424b48e9
SSDEEP 12288:X/WcJlzAwk9mH+65GRRfODoHWDTrWl93mFgR:X/WcJywk9mH+KGRRf2o2YR
TLSH
T1A5B48D43F29983EDE17BC4B8CF465A53FBB1780B1214565B93A5CB943F07B309A6A308
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI49322\base_library.zip
Size 1.3MB
SHA256 c0d9e21a5722170e4b0e30e38637baa2e7eea4ea1f01234835f31f9baa274fc1
MD5 6065ff94a4208fe30bea51e8755b0999
SHA1 d5eecf68494f5ddcdb323c0c723e93883cd47572
SHA512 057fb71661bb7662251b4ee8e20e06b629ed2a382558efa94566dd445cf89f62ba3a4181d01f7368d564ef0aa188bcf929e48d32dd15d17915635418ae4faef3
SSDEEP 24576:7WuUFalbesdjLORpHaT3IJhQeOdP2m2dfmZ:6uUFod+RO3Ir/uZ
TLSH
T192552AA1B9917867FEC9F37A35775A0CA715C0109B20D303B4A98DAC6FDF260AE158DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI49322\libcrypto-3.dll
Size 5.0MB
SHA256 e03dd02fdcfb791981c9962827cfcf495f2a47a514c1526efb57f847a9df514a
MD5 8e8f32ae40518478e44269cf22cf4399
SHA1 3bd9ea6294eebd45c867178bac0f4f77a49525a9
SHA512 d2d6bf1aac274fbbecafe2344242dd8edf9894c996d5e7c484cff828971287070de20abee1d2d706492063ffed64223020c9859df7596bd4d16c6d738efca6be
SSDEEP 98304:D03+0YMHT8tCl1r2qxPJ1W1CPwDvt3uFlDC1:DyPYMz8tK1r2qxR1W1CPwDvt3uFlDC
TLSH
T1BE367B6AA7A80149E4BAC13CC9534617D2B1F85A57B097CF18A196BD0F33FDA2B3D740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI49322\libffi-8.dll
Size 38KB
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
TLSH
T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI49322\libssl-3.dll
Size 776KB
SHA256 1e4bc0638682bfcbb36f4465d6a2e9944d917a60f05ecc8ddf9e96847e05e13f
MD5 f31ed8154564b75e48f2525a7e9f5742
SHA1 d2ff57bdca2030379da6d256892350ca85a0411f
SHA512 dc313916fce80ba99461dd758f424987344d5fdecc4ea28d01764440282b5bcde569eaf8a895fd966ee281aaad94d1b937f0e2164a45ddb18d3698e22b0f6ebb
SSDEEP 12288:gwgpFEKP7Mn162zCpbbICGxsQ7caA0V/jcrldFe9XbE:X6P7Mn16sCpbbI1iecoVGFe9Xb
TLSH
T16FF44CADB3B805DDD8B6C17986934623E3B6F4552330EBEF065186790F277D42B3A248
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pyarmor_runtime.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI49322\pyarmor_runtime_000000\pyarmor_runtime.pyd
Size 628KB
SHA256 5a12ebded063844af74ab028f12f36341af8a99b78bb1e158e971ebb86891c70
MD5 20b13f0c71671f59171d3a5828e800a1
SHA1 4b46cee414b3ca567e57aac6f6cb1788de6fdaac
SHA512 dcae3fc8c668ae8f08a461f373d87375437d94c8649456db67d731f5ddff3cfb09313a4b91d9f6f9745e448787086ca1d53ec1b0785696e445a09e568932eccf
SSDEEP 6144:IXMbajDtZ+mstN75wc3tZVdcte7fUoPJeQy57mBTIK24vNJPvjKAugO2nEcPuVZ3:zbGZ+1t95wc9TdcQ7fUoP8zsnRnE75B
TLSH
T16ED4184BE1FA14D0E6B6E17C078BF2337C3ABA588160775B355CD3A627D0A5212E5F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pyexpat.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI49322\pyexpat.pyd
Size 213KB
SHA256 b6d5142424d161039c25bea00e6acd8f7b1a5331d3994d9f3c28bd083ede159f
MD5 657d4314e086cd69fa009888b0f3edf6
SHA1 ed1f4296a5dbb29698c88c105c083ee83168bc0e
SHA512 27e04996f5f10c8954a8030993dd596a51b4ec253223932ce4ab5901ccff3221385d9954356a4af6ba255bf4bdfb9ebc20a3177f5caac59582a876477db979c0
SSDEEP 3072:oS0fqERCueJsIQT7WPczi0NAAO1+prtPqLwfW0opc0pxKWBoDYrDcDQhD7DfDBDE:NanRMs9fWPcihAO1+prMRTrhjba/t
TLSH
T1B2247D9BB260C1E7D853813CE6968B13DAB1B86603909BCF52C4E77C9F2B7513B29315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python314.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI49322\python314.dll
Size 6.4MB
SHA256 1ac15e2224581fc678bbd17728b9aa538d47b891b72c76499ef07e54cd74f151
MD5 5bc0adc1fed509f353832bde6b2add62
SHA1 b2204b0bc93877fcd186d72fbe5006130aa0fb88
SHA512 7b1e52aff81e5e79872d9a22c0218dd8fc46e99cb33adb69d277ea07b21eee0399f0a6a72d190b91f26a96e69aa63a23a06384b9d93db44355f3eb1d7f727650
SSDEEP 98304:YvvKimE4QWS5v+kr/YFboltx9E8rDvQHDMiE2hx0S:qdcQWS5v+kLMolGmidx0S
TLSH
T107668D26737505A5D8BB8076C9034647DBB1BC00AB30D34B49A4B6DA3F733635BAEB85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI49322\select.pyd
Size 32KB
SHA256 05734bd352ce60c944d474aa62468cc5eebf400097f1d9d0c453d37aed26fcca
MD5 bb2472e8821fce27ee535db0aeb667ca
SHA1 b1329b16873db0f667a5b1ff6b2570cf5cb009ba
SHA512 c1a973e9509f407bcff6288b11011647e168f6b1e71fefa9f1859e98c3db08e266a5e0d833ed912ffa33626cb2c8aeda7be336bdd128cb5a8022ffcab3289ff4
SSDEEP 768:0B7YWHfVEaqFEI1RGTYyvcZRYT2Ip4U8ITxf1ml9dHv7L9mEY:0B7b/CaqFEI1RGUyvcvR9UrfIbHvn9W
TLSH
T169E28D8AAB385047E6A3CA71C6A2DE43FA39F7A3565146DF31B991890E173C0B337354
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI49322\unicodedata.pyd
Size 740KB
SHA256 4445b894f836e89a8b9fdcc88b5e59fbc76aca805baaf40aeb69e869978d4e6d
MD5 e521fd8d69046ac8edee6d9f5d9ae80b
SHA1 b1593ef202bb2ca2041567e986c01bc281a4697c
SHA512 7326988e782c7c8cd547300168e26ccc19905ad387c612fd042024e0a5e45b8575b1d4fb27ee9c0385c791786f703fca384764d62280e1785f27d54b7bf4f66a
SSDEEP 12288:jYxAPtrZmDtBPcH+dEYJ5EAub+z70lDJPT36mwtfy:jYi5ZmDPqO5ElDJPTMfy
TLSH
T1F2F4E5F5BB838C16E69B767A48D3610F4E50C2B35F0A8637B2182355D8EB3B44DD582E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

plcbugfix.exe

Path C:\Users\Admin\Downloads\plcbugfix.exe
Size 19.4MB
SHA256 a610d8d1253467a64ffdeaa1c143a71ea92243d0456b2e739979d29d09b2495b
MD5 2823d856bc86a531ad169f68c931efad
SHA1 5c9c6a38b3b7a6a6ffc6f74cb4ca4df4bbb31efa
SHA512 7d27cb07404e31b65439257546ab6124a024394ec20ba2ff939a32d5f83363b3acf92fc4f9f645a521114bbdf119c5d12692a8005c0f0e6a93a637dabf3ff078
SSDEEP 393216:q2znAP/iXgAt2Jy60Z9xDoL1UiNdq1B7LrXIHssqiuaZpi1lOqU1rN:fznxv2JL0Zni1UiNg1VXyAiTZpT
TLSH
T1342733C500E1918BE9D5D1327ABDD6B6C17766203921880F4ED8C76E349FBFA4937AE0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

plcbugfix.exe:Zone.Identifier

Path C:\Users\Admin\Downloads\plcbugfix.exe:Zone.Identifier
Size 156B
SHA256 fc7aad9b77d930619501aedb8b788b92057b2e9db74b0ce379bab40bf91bbaea
MD5 a8fbc865d973bc8330c948258c0f2a03
SHA1 9ea98113373f3ecdf5f80686187c9f0adc6a4478
SHA512 9109542f46c35cb5148fd61e548f70fd687b8687eb7a5f52d7c2ba9cdb9cf30589dbadb56346643cf012cdaa589dbb2e8001490974f621b0751bb6e566810ded
TLSH
T185C08CD344028A26124C32C8245891ACB00FA98CCEA9CA14A821808FA82AC208AD0A7B
MD5 SHA1 SHA512 TLSH

Submit Download

keys.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2656_1477493259\keys.json
Size 8KB
SHA256 ae6e69a145f84c0a261b4e82888779fbf137f193881d687588e1af71609ae947
MD5 d3ebc1cb4b692c6e2d29a4625420fe73
SHA1 4ce74c1e9af6fd34d6379ec0fec6afb24082a7c1
SHA512 e34b855615e6a3bf770f27d85aa29ca57a324c08bd8f8d9c0130e2a142c0e4a5f17bffd0861b725acc8a2316f73b7fe50406b0af26264a5c2d8f37599b260860
SSDEEP 192:uNtGbR+mFGfvPNyR9Pm4lOvMwkoR9PuGMXcy:ORmqwKjA
TLSH
T18402A57F14A41181CE7FC1698F0B78B78FA038065BCA3A83539BFA49494296D173B5B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2656_1477493259\manifest.json
Size 79B
SHA256 7ea98f2308a9c51d17a1ac71b64afbe2a41ff0a083a166a0e4cc428bf44f0715
MD5 817fea104100763cd1bf4f15a51bfe94
SHA1 589717cf98cf7e2d55fc0d6025a4b8e215ed13d6
SHA512 da7b959d93113c5a6be360f90d9c721989c5e7acad7fa592081b582c4c3a0c4a9066a71473fd8492ce7fe7b0fbfd6870d939428a67fbd508fcf6b2c6dc1a41ea
TLSH
T15EA0122058019233108407600360478243551C022015244809461041258813A12A3128
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2656_1514070641\manifest.json
Size 177B
SHA256 096e772e0f2e8c15e6dec9087ee0a1fb8b0c56b25061626aedc9e7e705adfc2e
MD5 2714a51ed8c2a891ad73b7488ab655b9
SHA1 9a8cc479aec8de1b4eb678e5d68b23b16a39dc99
SHA512 4811522c06ad6946626a9f4d12eb62a1d623825d18a1cd0ad7b628f4c059f37d299b5857abffd959e4ea53239412490539f5705b4aa6c6951d13c68e6d5b72ad
TLSH
T1E6C012EFDC509DB215EB4323156D43C4E733CF4B1546490935FB66082A25981C193500
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2656_1895010859\manifest.json
Size 165B
SHA256 daf50c160ae8f5935baa4a7207e9d04afbbc81a6dd9ed02d99de12056743eeb6
MD5 8ff4c35081337b1ba6731cc36163c2a8
SHA1 31c80c4a98e5492fbf1b6b3e050446e7240c24a6
SHA512 1a616b9b797441fb438c89864beae36c1a151b1c85e1288481dc61d9f82df2c1fd5e002dbacc05d3070323f56325ed960df3e353d314eb2ee218f8e93aea3fac
TLSH
T1D6C0805294011D7419CE47150D5CE3889723D7152980B0155BD7C218DC3DC8B68F3B4D
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2656_20941812\manifest.json
Size 119B
SHA256 7169d86e87f904218238cd293e043e20b7828afad9acd1ff2e5d64188530b9d7
MD5 7382260298fc06c135b7c7399e9acff9
SHA1 6a829f795a3b8be25200675e00abfa1908fdefdf
SHA512 f0ce77f9f72fb6721bcfa9b03f77b0771e8217988183787c00dba4f9d9f19cdba252ddd656422336035f81939cb97c8b5dcb4f036a39280198c17cd04faaaed4
TLSH
T191B09273A800E83830E9EB91093A8243F320AB4BA585640A3625485C0B2B9F990606C4
MD5 SHA1 SHA512 TLSH

Submit Download

memory/572-985-0x0000020DD3120000-0x0000020DD32BA000-memory.dmp

Download

memory/3580-382-0x00000252E7540000-0x00000252E76DA000-memory.dmp

Download

memory/4932-293-0x00007FF7217D0000-0x00007FF721840000-memory.dmp

Download

memory/4932-1279-0x00007FF7217D0000-0x00007FF721840000-memory.dmp

Download

memory/4932-708-0x00007FF7217D0000-0x00007FF721840000-memory.dmp

Download

memory/5176-1276-0x000002A4D2C70000-0x000002A4D2E0A000-memory.dmp

Download

memory/5176-718-0x000002A4D2C70000-0x000002A4D2E0A000-memory.dmp

Download

memory/5176-719-0x0000000063300000-0x00000000633AB000-memory.dmp

Download

memory/5176-717-0x00007FF7217D0000-0x00007FF721840000-memory.dmp

Download

memory/5176-1277-0x0000000063300000-0x00000000633AB000-memory.dmp

Download