4533b738edcc59235ec1649b9dc29083897a3d98cbf12bc6b18fe58d0d2d3f8c

Resubmissions

23/05/2026, 03:44

260523-eaxsssey717

23/05/2026, 03:38

260523-d7cnfsex917

23/05/2026, 03:33

260523-d386vscs4n6

23/05/2026, 03:21

260523-dwe97sew3x7

Analysis

user interaction
yes
max time kernel
83s
max time network
86s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
23/05/2026, 03:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Your-Only-MIH-SteamRIP.com.rar
Size 86.2MB
Sample260523-eaxsssey71
SHA256 4533b738edcc59235ec1649b9dc29083897a3d98cbf12bc6b18fe58d0d2d3f8c
MD5 2002f865fc0a202980f540db4deb1556
SHA1 99e6c5ad06d3634325bedf1a861f7d5bd8ce2d0d
SHA512 5a1f0e97b76fc9967cc30de4c7a023c01396051a687266539ad9c27f74b1653d7bee92dad6f599d873fa76cbc6056eb1820a58b4a6218a8474de673ae011927d
SSDEEP 1572864:h/jZqYmtJUb8JoSMJUNv7WTLYSwbqhmb9TPSqEjR/NjfEgIWV6chQsM8mGaHe:1tdoUbuPhv7rSEVGR/NTEgYcisM83a+
TLSH
T1AE1833D05121F5774F8796E7C723583AF9F1A0CDA73E800F8E7E09AC646AF825856D0A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 6 IoCs

pid	Process
4516	YourOnlyMoveIsHUSTLE.exe
1628	YourOnlyMoveIsHUSTLE.exe
5316	YourOnlyMoveIsHUSTLE.exe
5368	YourOnlyMoveIsHUSTLE.exe
5424	YourOnlyMoveIsHUSTLE.exe
5908	YourOnlyMoveIsHUSTLE.exe

Loads dropped DLL 12 IoCs

pid	Process
4516	YourOnlyMoveIsHUSTLE.exe
4516	YourOnlyMoveIsHUSTLE.exe
1628	YourOnlyMoveIsHUSTLE.exe
1628	YourOnlyMoveIsHUSTLE.exe
5316	YourOnlyMoveIsHUSTLE.exe
5316	YourOnlyMoveIsHUSTLE.exe
5368	YourOnlyMoveIsHUSTLE.exe
5368	YourOnlyMoveIsHUSTLE.exe
5424	YourOnlyMoveIsHUSTLE.exe
5424	YourOnlyMoveIsHUSTLE.exe
5908	YourOnlyMoveIsHUSTLE.exe
5908	YourOnlyMoveIsHUSTLE.exe

Contacts third-party web service commonly abused for C2 1 TTPs 5 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
59	discord.com
60	discord.com
73	discord.com
134	discord.com
137	discord.com

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3356	msedge.exe
5820	msedge.exe

Checks processor information in registry 2 TTPs 24 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134239816002003842"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2409539145-3342400454-2096821238-1000\{415A8621-FF4F-40F0-B3F0-4457903B5904}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2409539145-3342400454-2096821238-1000\{F4D83430-9F72-4203-B09B-D86F0E1C0C82}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
4516	YourOnlyMoveIsHUSTLE.exe
4516	YourOnlyMoveIsHUSTLE.exe
4516	YourOnlyMoveIsHUSTLE.exe
4516	YourOnlyMoveIsHUSTLE.exe
1628	YourOnlyMoveIsHUSTLE.exe
1628	YourOnlyMoveIsHUSTLE.exe
1628	YourOnlyMoveIsHUSTLE.exe
1628	YourOnlyMoveIsHUSTLE.exe
5316	YourOnlyMoveIsHUSTLE.exe
5316	YourOnlyMoveIsHUSTLE.exe
5316	YourOnlyMoveIsHUSTLE.exe
5316	YourOnlyMoveIsHUSTLE.exe
5368	YourOnlyMoveIsHUSTLE.exe
5368	YourOnlyMoveIsHUSTLE.exe
5368	YourOnlyMoveIsHUSTLE.exe
5368	YourOnlyMoveIsHUSTLE.exe
5424	YourOnlyMoveIsHUSTLE.exe
5424	YourOnlyMoveIsHUSTLE.exe
5424	YourOnlyMoveIsHUSTLE.exe
5424	YourOnlyMoveIsHUSTLE.exe
5908	YourOnlyMoveIsHUSTLE.exe
5908	YourOnlyMoveIsHUSTLE.exe
5908	YourOnlyMoveIsHUSTLE.exe
5908	YourOnlyMoveIsHUSTLE.exe
4344	msedge.exe
4344	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2144	7zFM.exe
1396	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeRestorePrivilege	2144	7zFM.exe
Token: 35	2144	7zFM.exe
Token: SeSecurityPrivilege	2144	7zFM.exe
Token: SeDebugPrivilege	932	firefox.exe
Token: SeDebugPrivilege	932	firefox.exe

Suspicious use of FindShellTrayWindow 16 IoCs

pid	Process
2144	7zFM.exe
2144	7zFM.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
932	firefox.exe
932	firefox.exe
932	firefox.exe
932	firefox.exe
932	firefox.exe
932	firefox.exe
932	firefox.exe
932	firefox.exe
932	firefox.exe
932	firefox.exe
932	firefox.exe

Suspicious use of SetWindowsHookEx 26 IoCs

pid	Process
4516	YourOnlyMoveIsHUSTLE.exe
1628	YourOnlyMoveIsHUSTLE.exe
5316	YourOnlyMoveIsHUSTLE.exe
5368	YourOnlyMoveIsHUSTLE.exe
1396	OpenWith.exe
1396	OpenWith.exe
1396	OpenWith.exe
1396	OpenWith.exe
1396	OpenWith.exe
1396	OpenWith.exe
1396	OpenWith.exe
1396	OpenWith.exe
1396	OpenWith.exe
1396	OpenWith.exe
1396	OpenWith.exe
1396	OpenWith.exe
1396	OpenWith.exe
1396	OpenWith.exe
1396	OpenWith.exe
1396	OpenWith.exe
1396	OpenWith.exe
1396	OpenWith.exe
1396	OpenWith.exe
932	firefox.exe
5424	YourOnlyMoveIsHUSTLE.exe
5908	YourOnlyMoveIsHUSTLE.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4516 wrote to memory of 2920	4516	YourOnlyMoveIsHUSTLE.exe	83
PID 2920 wrote to memory of 1592	2920	msedge.exe	84
PID 2920 wrote to memory of 4480	2920	msedge.exe	86
PID 2920 wrote to memory of 3356	2920	msedge.exe	85
PID 2920 wrote to memory of 4480	2920	msedge.exe	86
PID 2920 wrote to memory of 4480	2920	msedge.exe	86
PID 2920 wrote to memory of 1076	2920	msedge.exe	87
PID 2920 wrote to memory of 1076	2920	msedge.exe	87
PID 2920 wrote to memory of 2024	2920	msedge.exe	90
PID 2920 wrote to memory of 2024	2920	msedge.exe	90
PID 2920 wrote to memory of 2024	2920	msedge.exe	90
PID 2920 wrote to memory of 3116	2920	msedge.exe	89
PID 2920 wrote to memory of 3116	2920	msedge.exe	89
PID 2920 wrote to memory of 3116	2920	msedge.exe	89
PID 2920 wrote to memory of 4488	2920	msedge.exe	92
PID 2920 wrote to memory of 4488	2920	msedge.exe	92
PID 2920 wrote to memory of 4488	2920	msedge.exe	92
PID 2920 wrote to memory of 4032	2920	msedge.exe	93
PID 2920 wrote to memory of 4088	2920	msedge.exe	94
PID 2920 wrote to memory of 3108	2920	msedge.exe	95
PID 2920 wrote to memory of 4032	2920	msedge.exe	93
PID 2920 wrote to memory of 4032	2920	msedge.exe	93
PID 2920 wrote to memory of 4088	2920	msedge.exe	94
PID 2920 wrote to memory of 4088	2920	msedge.exe	94
PID 2920 wrote to memory of 3108	2920	msedge.exe	95
PID 2920 wrote to memory of 3108	2920	msedge.exe	95
PID 2920 wrote to memory of 976	2920	msedge.exe	96
PID 2920 wrote to memory of 976	2920	msedge.exe	96
PID 2920 wrote to memory of 2548	2920	msedge.exe	97
PID 2920 wrote to memory of 2548	2920	msedge.exe	97
PID 2920 wrote to memory of 4592	2920	msedge.exe	99
PID 2920 wrote to memory of 4592	2920	msedge.exe	99
PID 2920 wrote to memory of 4592	2920	msedge.exe	99
PID 2920 wrote to memory of 3236	2920	msedge.exe	101
PID 2920 wrote to memory of 3236	2920	msedge.exe	101
PID 2920 wrote to memory of 3236	2920	msedge.exe	101
PID 2920 wrote to memory of 3944	2920	msedge.exe	100
PID 2920 wrote to memory of 3944	2920	msedge.exe	100
PID 2920 wrote to memory of 3944	2920	msedge.exe	100
PID 2920 wrote to memory of 880	2920	msedge.exe	102
PID 2920 wrote to memory of 880	2920	msedge.exe	102
PID 2920 wrote to memory of 880	2920	msedge.exe	102
PID 2920 wrote to memory of 1920	2920	msedge.exe	103
PID 2920 wrote to memory of 3004	2920	msedge.exe	104
PID 2920 wrote to memory of 1920	2920	msedge.exe	103
PID 2920 wrote to memory of 3004	2920	msedge.exe	104
PID 2920 wrote to memory of 5552	2920	msedge.exe	105
PID 2920 wrote to memory of 5616	2920	msedge.exe	107
PID 5552 wrote to memory of 5648	5552	msedge.exe	108
PID 2920 wrote to memory of 6020	2920	msedge.exe	109
PID 2920 wrote to memory of 6020	2920	msedge.exe	109
PID 2920 wrote to memory of 2088	2920	msedge.exe	110
PID 2920 wrote to memory of 2088	2920	msedge.exe	110
PID 2920 wrote to memory of 1008	2920	msedge.exe	112
PID 2920 wrote to memory of 1688	2920	msedge.exe	111
PID 2920 wrote to memory of 1008	2920	msedge.exe	112
PID 2920 wrote to memory of 1688	2920	msedge.exe	111
PID 2920 wrote to memory of 5480	2920	msedge.exe	114
PID 2920 wrote to memory of 5480	2920	msedge.exe	114
PID 2920 wrote to memory of 6084	2920	msedge.exe	116
PID 2920 wrote to memory of 6084	2920	msedge.exe	116
PID 2920 wrote to memory of 4344	2920	msedge.exe	117
PID 4344 wrote to memory of 4828	4344	msedge.exe	118
PID 4344 wrote to memory of 5820	4344	msedge.exe	119

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Your-Only-MIH-SteamRIP.com.rar"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2144

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1260

C:\Users\Admin\Desktop\Your Only Move Is HUSTLE\YourOnlyMoveIsHUSTLE.exe
"C:\Users\Admin\Desktop\Your Only Move Is HUSTLE\YourOnlyMoveIsHUSTLE.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://online-fix.me/
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2920
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x368,0x7fffe17ac188,0x7fffe17ac194,0x7fffe17ac1a0
    3⤵
    PID:1592
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1836,i,12247720283180984140,16302497128095250500,524288 --field-trial-handle=2652,i,10152138737317504762,13316455282106117875,262144 --variations-seed-version --mojo-platform-channel-handle=2760 /prefetch:11
    3⤵
    - System Time Discovery
    PID:3356
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1744,i,14663579071476753759,1999534775709417872,262144 --field-trial-handle=2652,i,10152138737317504762,13316455282106117875,262144 --variations-seed-version --mojo-platform-channel-handle=2644 /prefetch:2
    3⤵
    PID:4480
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2116,i,18110940130747488543,7598201658917748751,524288 --field-trial-handle=2652,i,10152138737317504762,13316455282106117875,262144 --variations-seed-version --mojo-platform-channel-handle=2976 /prefetch:13
    3⤵
    PID:1076
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3532,i,1843582703068590250,817498301049047983,2097152 --field-trial-handle=2652,i,10152138737317504762,13316455282106117875,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:1
    3⤵
    PID:3116
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3536,i,17014163915166290439,4251840546800382081,2097152 --field-trial-handle=2652,i,10152138737317504762,13316455282106117875,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:1
    3⤵
    PID:2024
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4248,i,3597423120872059510,7769148893303760914,2097152 --field-trial-handle=2652,i,10152138737317504762,13316455282106117875,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:1
    3⤵
    PID:4488
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4264,i,2177602862994188669,3741697385603475598,2097152 --field-trial-handle=2652,i,10152138737317504762,13316455282106117875,262144 --variations-seed-version --mojo-platform-channel-handle=4332 /prefetch:9
    3⤵
    PID:4032
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4280,i,2166215593873187583,851071880385714961,2097152 --field-trial-handle=2652,i,10152138737317504762,13316455282106117875,262144 --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:1
    3⤵
    PID:4088
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4384,i,3402804565818465918,10842135921386271908,2097152 --field-trial-handle=2652,i,10152138737317504762,13316455282106117875,262144 --variations-seed-version --mojo-platform-channel-handle=4532 /prefetch:9
    3⤵
    PID:3108
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5452,i,7985631403445305628,9835744387568218920,524288 --field-trial-handle=2652,i,10152138737317504762,13316455282106117875,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:14
    3⤵
    PID:976
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5476,i,17820166716786899771,1269060175640225858,524288 --field-trial-handle=2652,i,10152138737317504762,13316455282106117875,262144 --variations-seed-version --mojo-platform-channel-handle=5620 /prefetch:14
    3⤵
    PID:2548
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=4232,i,3474129452197913395,8903974846727384053,2097152 --field-trial-handle=2652,i,10152138737317504762,13316455282106117875,262144 --variations-seed-version --mojo-platform-channel-handle=5416 /prefetch:1
    3⤵
    PID:4592
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=5884,i,17831138615603609016,14275252706063956270,2097152 --field-trial-handle=2652,i,10152138737317504762,13316455282106117875,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:1
    3⤵
    PID:3944
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=5948,i,8939259508868150462,10565035590153226725,2097152 --field-trial-handle=2652,i,10152138737317504762,13316455282106117875,262144 --variations-seed-version --mojo-platform-channel-handle=5932 /prefetch:1
    3⤵
    PID:3236
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6352,i,3147368592401615989,18209943075957024887,2097152 --field-trial-handle=2652,i,10152138737317504762,13316455282106117875,262144 --variations-seed-version --mojo-platform-channel-handle=6416 /prefetch:1
    3⤵
    PID:880
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6548,i,6247824395418647761,12885236242239495973,524288 --field-trial-handle=2652,i,10152138737317504762,13316455282106117875,262144 --variations-seed-version --mojo-platform-channel-handle=6608 /prefetch:14
    3⤵
    PID:1920
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6552,i,15921127990317221695,8897179019391445313,524288 --field-trial-handle=2652,i,10152138737317504762,13316455282106117875,262144 --variations-seed-version --mojo-platform-channel-handle=6568 /prefetch:14
    3⤵
    PID:3004
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3956,i,1920202125712621968,3478637145260359779,524288 --field-trial-handle=2652,i,10152138737317504762,13316455282106117875,262144 --variations-seed-version --mojo-platform-channel-handle=5452 /prefetch:14
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5552
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
      cookie_exporter.exe --cookie-json=1100
      4⤵
      PID:5648
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7272,i,4783182662860153942,8680425918143686060,524288 --field-trial-handle=2652,i,10152138737317504762,13316455282106117875,262144 --variations-seed-version --mojo-platform-channel-handle=7288 /prefetch:14
    3⤵
    PID:5560
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7272,i,4783182662860153942,8680425918143686060,524288 --field-trial-handle=2652,i,10152138737317504762,13316455282106117875,262144 --variations-seed-version --mojo-platform-channel-handle=7288 /prefetch:14
    3⤵
    PID:5616
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7320,i,17850429042923195004,9864284751383720763,524288 --field-trial-handle=2652,i,10152138737317504762,13316455282106117875,262144 --variations-seed-version --mojo-platform-channel-handle=7324 /prefetch:14
    3⤵
    PID:6020
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5492,i,8777863698128693763,10560145594190108046,524288 --field-trial-handle=2652,i,10152138737317504762,13316455282106117875,262144 --variations-seed-version --mojo-platform-channel-handle=5568 /prefetch:14
    3⤵
    PID:2088
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5712,i,18026054438879989842,4204058493827840495,524288 --field-trial-handle=2652,i,10152138737317504762,13316455282106117875,262144 --variations-seed-version --mojo-platform-channel-handle=7480 /prefetch:14
    3⤵
    PID:1688
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7316,i,9731635265705729081,5104242403700825801,524288 --field-trial-handle=2652,i,10152138737317504762,13316455282106117875,262144 --variations-seed-version --mojo-platform-channel-handle=7520 /prefetch:14
    3⤵
    PID:1008
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7456,i,2400026752281318345,486524644125895848,524288 --field-trial-handle=2652,i,10152138737317504762,13316455282106117875,262144 --variations-seed-version --mojo-platform-channel-handle=5644 /prefetch:14
    3⤵
    PID:5480
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6340,i,9583189958234491215,8928965191533596314,524288 --field-trial-handle=2652,i,10152138737317504762,13316455282106117875,262144 --variations-seed-version --mojo-platform-channel-handle=5712 /prefetch:14
    3⤵
    PID:6084
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4344
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2f0,0x7fffe17ac188,0x7fffe17ac194,0x7fffe17ac1a0
      4⤵
      PID:4828
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1796,i,762208655056220866,9536861083835730854,524288 --field-trial-handle=2112,i,13414753590818412549,7642416505346335287,262144 --variations-seed-version --mojo-platform-channel-handle=2140 /prefetch:11
      4⤵
      System Time Discovery
      PID:5820
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1528,i,950908579221697024,3054772034506503339,262144 --field-trial-handle=2112,i,13414753590818412549,7642416505346335287,262144 --variations-seed-version --mojo-platform-channel-handle=2108 /prefetch:2
      4⤵
      PID:5832
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2404,i,16078402550784716308,4534119369738022359,524288 --field-trial-handle=2112,i,13414753590818412549,7642416505346335287,262144 --variations-seed-version --mojo-platform-channel-handle=2380 /prefetch:13
      4⤵
      PID:5884
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4488,i,4683957626834848428,5864259706425345108,524288 --field-trial-handle=2112,i,13414753590818412549,7642416505346335287,262144 --variations-seed-version --mojo-platform-channel-handle=4504 /prefetch:14
      4⤵
      PID:4768
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4488,i,4683957626834848428,5864259706425345108,524288 --field-trial-handle=2112,i,13414753590818412549,7642416505346335287,262144 --variations-seed-version --mojo-platform-channel-handle=4504 /prefetch:14
      4⤵
      PID:2008
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4376,i,8139992288626776622,13051448228115859338,524288 --field-trial-handle=2112,i,13414753590818412549,7642416505346335287,262144 --variations-seed-version --mojo-platform-channel-handle=4556 /prefetch:14
      4⤵
      PID:1660
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4396,i,5399493921055766675,4613535030127740104,524288 --field-trial-handle=2112,i,13414753590818412549,7642416505346335287,262144 --variations-seed-version --mojo-platform-channel-handle=4828 /prefetch:14
      4⤵
      PID:2488
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4532,i,11357460840816645287,11040870909913041509,524288 --field-trial-handle=2112,i,13414753590818412549,7642416505346335287,262144 --variations-seed-version --mojo-platform-channel-handle=4868 /prefetch:14
      4⤵
      PID:2772

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1628

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5700

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5944

C:\Users\Admin\Desktop\Your Only Move Is HUSTLE\YourOnlyMoveIsHUSTLE.exe
"C:\Users\Admin\Desktop\Your Only Move Is HUSTLE\YourOnlyMoveIsHUSTLE.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1628

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\Your Only Move Is HUSTLE\YourOnlyMoveIsHUSTLE.cmd" "
1⤵
PID:5268
- C:\Users\Admin\Desktop\Your Only Move Is HUSTLE\YourOnlyMoveIsHUSTLE.exe
  YourOnlyMoveIsHUSTLE.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:5316

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\Your Only Move Is HUSTLE\YourOnlyMoveIsHUSTLE.cmd" "
1⤵
PID:4012
- C:\Users\Admin\Desktop\Your Only Move Is HUSTLE\YourOnlyMoveIsHUSTLE.exe
  YourOnlyMoveIsHUSTLE.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:5368

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1396
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\Desktop\Your Only Move Is HUSTLE\OnlineFix64.dll"
  2⤵
  PID:5056
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\Desktop\Your Only Move Is HUSTLE\OnlineFix64.dll"
    3⤵
    - Checks processor information in registry
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    PID:932
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1964 -prefsLen 27098 -prefMapHandle 1968 -prefMapSize 270279 -ipcHandle 1856 -initialChannelId {d692bb8a-fc5a-47a5-8d08-72cfeba9e7eb} -parentPid 932 -crashReporter "\\.\pipe\gecko-crash-server-pipe.932" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
      4⤵
      PID:2340
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2432 -prefsLen 27134 -prefMapHandle 2436 -prefMapSize 270279 -ipcHandle 2444 -initialChannelId {d6b57c48-5759-4dda-89f4-44bcd1b43397} -parentPid 932 -crashReporter "\\.\pipe\gecko-crash-server-pipe.932" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
      4⤵
      Checks processor information in registry
      PID:4788
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3784 -prefsLen 27274 -prefMapHandle 3788 -prefMapSize 270279 -jsInitHandle 3792 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3800 -initialChannelId {3123c96d-9321-4659-a8f2-5bb8c0e4b9f0} -parentPid 932 -crashReporter "\\.\pipe\gecko-crash-server-pipe.932" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
      4⤵
      Checks processor information in registry
      PID:2844
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3952 -prefsLen 27274 -prefMapHandle 3956 -prefMapSize 270279 -ipcHandle 4020 -initialChannelId {c487bd6d-13ee-46fa-b18b-edac46db6472} -parentPid 932 -crashReporter "\\.\pipe\gecko-crash-server-pipe.932" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
      4⤵
      PID:1076
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4464 -prefsLen 34773 -prefMapHandle 4468 -prefMapSize 270279 -jsInitHandle 4472 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4480 -initialChannelId {87135049-58de-4177-a64a-313147c69139} -parentPid 932 -crashReporter "\\.\pipe\gecko-crash-server-pipe.932" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
      4⤵
      Checks processor information in registry
      PID:5648
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5276 -prefsLen 34822 -prefMapHandle 5280 -prefMapSize 270279 -ipcHandle 5292 -initialChannelId {9c0ce8f6-6922-46fd-80ab-9d5f6ffe984b} -parentPid 932 -crashReporter "\\.\pipe\gecko-crash-server-pipe.932" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
      4⤵
      Checks processor information in registry
      PID:1240
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2756 -prefsLen 32952 -prefMapHandle 2760 -prefMapSize 270279 -jsInitHandle 2588 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5136 -initialChannelId {9b894a62-76d3-4b31-adb1-27938774bae0} -parentPid 932 -crashReporter "\\.\pipe\gecko-crash-server-pipe.932" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
      4⤵
      Checks processor information in registry
      PID:1492
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5856 -prefsLen 32952 -prefMapHandle 5860 -prefMapSize 270279 -jsInitHandle 5864 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5052 -initialChannelId {a9171b24-c732-466f-8928-6eeb35b558ad} -parentPid 932 -crashReporter "\\.\pipe\gecko-crash-server-pipe.932" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
      4⤵
      Checks processor information in registry
      PID:5876
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6024 -prefsLen 32952 -prefMapHandle 6028 -prefMapSize 270279 -jsInitHandle 6032 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6036 -initialChannelId {b06521f1-8254-498b-9af4-eb6dff18991b} -parentPid 932 -crashReporter "\\.\pipe\gecko-crash-server-pipe.932" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
      4⤵
      Checks processor information in registry
      PID:2044
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2608 -prefsLen 35062 -prefMapHandle 4780 -prefMapSize 270279 -jsInitHandle 4748 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5816 -initialChannelId {ceb1ba0d-41ba-45c6-8cb0-33b72b1c6740} -parentPid 932 -crashReporter "\\.\pipe\gecko-crash-server-pipe.932" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
      4⤵
      Checks processor information in registry
      PID:3452

C:\Users\Admin\Desktop\Your Only Move Is HUSTLE\YourOnlyMoveIsHUSTLE.exe
"C:\Users\Admin\Desktop\Your Only Move Is HUSTLE\YourOnlyMoveIsHUSTLE.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:5424

C:\Users\Admin\Desktop\Your Only Move Is HUSTLE\YourOnlyMoveIsHUSTLE.exe
"C:\Users\Admin\Desktop\Your Only Move Is HUSTLE\YourOnlyMoveIsHUSTLE.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:5908

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8b98ade942a8747b838525fab33e985cdad967132f18099e1927edd4ddcf705c
MD5 f204288b44f873d17a6ceedad1591584
SHA1 24474f57edf00bb3bed673ea9c6fbba1c2d5706d
SHA512 218a8f5b6756a36d75649cbf0e80cab71506f3cef44c8b62b5d9685a2a249d10ca13547cc8a461116e8dbf2c2b9cddc73426ef41d645a31b93a43585aab2d6c6
TLSH
T169D09B30F7995053D1411131DC915F506655499528AB86815331444CE959094E3D7146
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b0f4f0e283eeb3c4e8086b4f09574714a29ac728593fe24b78fa485a02f7c4e6
MD5 40e4e3ea7f3f303decc45667f17df80b
SHA1 1d896c453eda074ed60476a32725c161153ad2f0
SHA512 7e5062046d6cbf9647908f4d956c6ffcf05a20c6b93a582e127b259565b50e651de6e2f51ce32f134320d4ae5e36069b7b87803a59ffe3aea1f2a9b13007a298
TLSH
T18ED0A924AEB258E2E2A4253959D18E003F8C99825A1B299503620C048CE50E38082AC9
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 408fd3b5c00d9664485ae2a190e841ce101c5a33a3da6ccaf00c5d7aee460d4d
MD5 58c5659923bf6ab84d34e112987f6f18
SHA1 2c030e95260b3eb9382fc7035907f201e4536791
SHA512 354542aec859f18b40e1bf5f25b91810195523ce6c04594bae9defe328efc52c4fff70983a68580dc9e7d90608e1f7408c02abc28472ebf4f98518ab43597155
TLSH
T1B9D0A724AFA508D2D28465396CC69F053F885980554B58A1039158145CC65B6C1C6685
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8ecb01a4cd673c20340bda98a060c6d81b45d3647b198cc224061ba4ab13bcff
MD5 ce4945ff312b2661fce93ec3195e0eb2
SHA1 f9f623843b49577b6995aa63ce634b0688ae3fd6
SHA512 c215307ee1eb459a7ac260698e6e7bb83acdb5bafd5f36758cb7decb6c8c2b9f5507bc8d32a444b3d4919c49870e735ac44992fcce2e8108b9ecc3d63eeb3754
TLSH
T169D0A724AFA548D2D28465396CC59F053F8859C4554B58A1039158144CC65B6C1C6685
MD5 SHA1 SHA512 TLSH

Submit Download

1906934c-84f2-4456-925e-dbf00b22297e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1906934c-84f2-4456-925e-dbf00b22297e.tmp
Size 414B
SHA256 14eb3e1a7779978ba9b871f31af42ff0a5f31fb8ba2c69739848a85af30c56f9
MD5 50b2af8c394164b6ebc3dfa62369f77b
SHA1 143c8b898e0e247342bdd6c0c307dcd350481811
SHA512 612eed98a9d4ef1af99211cd8a782a63f7eb4646bb2a6693c5944b7db9e2de84b73e043b4729ad30d9886de4671dd670fcb462ddd629fbca8a7fb67539a8feba
TLSH
T1A4E02BA6C821DC371DFD1719A0654286DB90236A2B41884F7B3DC20D8FF4A364696C9C
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 7766d5296b6ae57cd834c8856eb71bb1b13db02c24406338c0edc7e2a5ae1ca1
MD5 1260e5f5a0ec91b738312cf3b3d047e5
SHA1 431df673be3660532a5565831e6b795af546857c
SHA512 33b01fd4020c29e58bb15f6da46972a469f4846abdc23bd1b901c3e7dd822ba60ccebe74dbc601d8b48f87640afa07514a8cc463df7e83f08eef2f593e7c4750
SSDEEP 768:QLM2PzJCpwLqyBX17cdtGokOPPtF8PKbKm91ghAvrr:QLM2Pzoiv8rbJlFaKbKGZ
TLSH
T14513D57CB7764E6BC7E315BC381B5E312B38F620E6D0468B63317852835AF6A184E9C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 f970fa65e11bfb27934acdea66ec25f5d6f5ac09a9033e07e01f493f5e006aeb
MD5 d3d91f6c1b4965c96c422ab8843dd19b
SHA1 3c7d77712752250ccb306fe2bb598ed513f22fcf
SHA512 e968e81d9160be8bcdf4f2ef1a096b62c8a066e1ad2a0f825fee2a3a106a38e4740369d39948dbe8d8308b936643f97688ab1ab6d0e5c8bfbc900742bb23224e
SSDEEP 1536:dkRjTH86AjL/V2ML/lSYAsJ47v7RBPYL/1A9LQNPBGnt2pMlKtyi65I5:djL/rL/vAK4RBwL/1YAGnt2ulKj65c
TLSH
T1F84461F74890A01BCBA806F5A3033A3DC137085E7CD5EDA9E6780C856E25B3676BDE51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 6acd06c1d13e309dd1af221cf9350cdeec56bc55512975f11e37e75ef099ee90
MD5 680e4207e3288e513e5791cd2cda2f7c
SHA1 8a4155d19d034438dca7a755f530dfc6f5fd7bfd
SHA512 d0b880e9dfe136b077b2aa740ab54490d343b60bb40ec8f4efa2170e6784f6090754c59539293f59766b36851293749abd367b4beac73cc67c7f00ae02edf07b
TLSH
T19C81C8C2023C8897E394087862DA09E872704D7785135E570B7E587DBB1BF3BCAD9AC9
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log
Size 798B
SHA256 a2f4765271e0a5f8bec5e07531a57e188e857beba530a95151277a5ef7ae0e51
MD5 c6bda62773da4630dda4c9a8d59c7eaf
SHA1 3a052395933147b638f3fc0065bb3091dbe04870
SHA512 a7c65d02572b4c418043e605978386e87ed62546b4ee5189ad32e2687932945e5b28c4c3346cc4f0190c60a5e2064ee36a0d2727f15fbf81611556abc2465567
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 319B
SHA256 dce9d479faf97547c7a31f75d13081d544ab2e7a6584c6d93317820ac1bc11dd
MD5 8a3654b7fc9bae63166fd28218a59aa0
SHA1 728b165c705a9ecb86bff86834ccd1babc1b12d4
SHA512 60dd58939e8b7c46dcd4ad63cea512b63fc21997f2d19ba742b23b98b837be6fc16009ba1766160f91febb2e2c0e2cf656c32e03abf207d39bb43219361c9ffe
TLSH
T143E026282AC8C129A55468E38F6C630CC2E03C13E2883A43170DCC44B1433C2A28AA92
MD5 SHA1 SHA512 TLSH

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.106.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

computed_hashes.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json
Size 429B
SHA256 b829b0df7e3f2391bfba70090eb4ce2ba6a978ccd665eebf1073849bdd4b8fb9
MD5 5d1d9020ccefd76ca661902e0c229087
SHA1 dcf2aa4a1c626ec7ffd9abd284d29b269d78fcb6
SHA512 5f6e72720e64a7ac19f191f0179992745d5136d41dcdc13c5c3c2e35a71eb227570bd47c7b376658ef670b75929abeebd8ef470d1e24b595a11d320ec1479e3c
TLSH
T10AE055170A1A50B79BB8DB90EE525CA2E8A0A6B1C50438D63E608234B68A11F738347D
MD5 SHA1 SHA512 TLSH

Submit Download

verified_contents.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\verified_contents.json
Size 1KB
SHA256 d23b2ba94ba22bbb681e6362ae5870acd8a3280fa9e7241b86a9e12982968947
MD5 738e757b92939b24cdbbd0efc2601315
SHA1 77058cbafa625aafbea867052136c11ad3332143
SHA512 dca3e12dd5a9f1802db6d11b009fce2b787e79b9f730094367c9f26d1d87af1ea072ff5b10888648fb1231dd83475cf45594bb0c9915b655ee363a3127a5ffc2
TLSH
T12B317466C8683D56267A63348E2D0602EB57C2BB0050640EB5AC558D4F7115FE242FAF
MD5 SHA1 SHA512 TLSH

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons
Size 24KB
SHA256 5e7c54b094c02669ebeb3db4dbac4fa889a89ac9c6d38c1e26ee46a2e8bfa6bc
MD5 fdea47bcf4af574bf551745ec6caadb2
SHA1 277c7a83c92ced5642915dd042a9d166910607bd
SHA512 ce322fa88917ce04551c4be88536e60b64a197eb78b09ce5575972d131fbcb5621f50d84f1826d3da145c850f17ea4f0bc927133c3b14fe6c4b19b34975ff0b3
SSDEEP 96:3BCxiveHtgLTcva7oTkVbAFYuRh3OzZSShq:xaAeHQaQoEMFYuRhezZ
TLSH
T19AB2294B0F34B453D6940E3B257E5CB8DE37E79D2FA68CA0316454608DF844EE1388AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 204KB
SHA256 cf5ff3f7af4ae2edc85b5b44f73ef40155818418e76bc8e3277426dd5800f0c5
MD5 cdf4f05c58e515fffc1feabed1c47397
SHA1 dee300b523d9eb7e7b7039721ecef80e7dc3efdf
SHA512 cec58a43d9cb6d26d9201a21aaaec6a8502a0181bd6018b1c0e9fcd348b4e997ea71f6b30f89505a2a7e3a15f0baf5e64a199a287ae504336722691973bcd70f
SSDEEP 192:x7pt0+G83uxXBBK31GkSJ+SZEJH7DNspUU:x7a83uFBBQ1GkSm7DNspUU
TLSH
T12014654F5F302312CD7C803669E744A75DBDF43F8B526A9AB8601471CEE3652A46C8BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log
Size 268B
SHA256 8476d5f9ab6cb68ad17086d760999eb8fc2cafed7dd3189744e31afda6382e8a
MD5 cf534fb60c5c2016d959d1e264969ae8
SHA1 878a9e9d0e557862fc1212c8df4f8611f0ae3e2c
SHA512 80d0f8b48fe519ca23a871b2e6ea7cddb6546c335ca319504cc3ef362c08687369a00534706a0505989edb43009a1d6c6a10c3f62e87907e6d8e90f92a432a13
TLSH
T16BD02BFBC152E42AFB0508B017117034F20A1C7F29C0DDA0C0B076C55EE423C300C511
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 331B
SHA256 5d102d426a2173924eff674c99a6db1be5348062694ac84066140a184fe3f579
MD5 ea54b22ac087cb00f3fbc65b743ece89
SHA1 4c8b3dec622b8983522d6492e968ab4a53a6a788
SHA512 5bd35e8914ab466f5c282cadd20d2cc4dcaf0df64cbfd38eda1a33f6949b8e01f73cd552e7da6e1fd026828fbdd8d47eccce10dda2994175a05cf240c67af974
TLSH
T1AAE0D86867CDC16E514424978718670CC3E03817DB893F431B04DC45B043084ABB5AC3
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 dd38491044fb37bdce4ed7485a03bfad84f92eaa0ab021b96e5b0b35066ac744
MD5 0005cc8547443f03148fe3caa627dd5a
SHA1 5c33595788ab0ad646a1c98c00f2bce26b17f50d
SHA512 cdd01185054556d4e4d39478326545321084126f7ce9ae2076416eb6a39494ccb618df7ee72ee41afba7c5d6e901f52d0c416eb850cb9bda2bce0c08e95e8cec
SSDEEP 192:DveK/tQbeN0M8lalrm+JKNPwWbh3xbJ9I7uAwj6HTLqUUpa:DveK/tQbO0M8lalrm+JKNPwWbh3xbJ9u
TLSH
T181027FF3C2E8C56E982255F87A14AE1BDD5D092957283C1689D4DFC7E3E34B2E200A5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 d91887548e35e592266d4b29732a622986936abdf2e8f8fa84161e6e6b1e2721
MD5 ef9f8518ba65871e62f2b4a689ab1b2b
SHA1 3c0a3add8efba3f3ddf6915052c38de5c13ba639
SHA512 e14d3f1104431f88f14142030c8104aa0f91cdcf59c525132ba4e97cbd188e84a9f02ba0983d16026771ba3d1a6540957377f4d63a61c3d437ba079a3a69fef9
SSDEEP 192:sxZiRMyM/jK1Ml8Sc1/frszyWpV9sLxHIdpPK/W6+WNeYXc/BDhtJL0gaJ3IgyJ:sxZiiQ1/frsuWveLiS/ba/oHO
TLSH
T1CB62E807AA3459778CDBD219FA55BB23D7F9183692904E449AFCCA0C00E67ED2213C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 37KB
SHA256 35a66b76a15f4b1536f25b618ea49190319aa04740d697a0b7e023fbcbe5999f
MD5 5f0b7efc20bb311ae9607cabab3f48e4
SHA1 f762eb92285e02db466ab13df9a2aa123c89769d
SHA512 9cc33a5b147feb7a396f9b26b3d13b73bc84cc6ba7c6308b59f6b2f8efd6caf0a7417bdc803ba378ad41518be6f98d096bf79d48820e716bbd7200f674789a7f
SSDEEP 768:Cac0s8Ww2Ss7pLuLX/fWRm/JQy18F1+UoAYDCx9Tuqh0VfUC9xbog/OV384vOLl9:Cac0s8Ww2SQEX/fWRm/JQy1u1jaK84vA
TLSH
T1C5031C3B2C0CCB7E4F844E9DED26BE8A6EE8018B6698895447FE444C03C76EB15165DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 335B
SHA256 420979152bfcc09c39798d51d72ce528ded381c86cc24399ea12b78ceb6bb149
MD5 18572703528f7ea6f38f68aadb5f01f9
SHA1 1c49ef61251c0f8f25afd58847ded7ffff819780
SHA512 79c7f3c2ced395f1ae230c8d8ccf8c22256b1637b840e9511c8eaf1cef4cb7e81585815d7fe08f539d250dd234849f395eb32a7cd45f4eabd9f5c90fef47dc47
TLSH
T118E04F9436C9D1BDA15521A30ABC830CD2E47827E6D93B522F44CD4461C3685B597E82
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 347B
SHA256 8bc1375f8b30712a2bfec5ea39ea77ea8e11862e3b1df0ad6940cf2b0947f3cc
MD5 01027eac3c9e0816cadb4c10736f6bdd
SHA1 dc5f2f411dd4c72fea7462e064cde34aafc4fb4b
SHA512 b1978822452544eae05427f9780ef331725c20ab78c3e3f49fcb6d93c8ddd4f6e644144ea562fccdbe4296175a18e7504b1fcf400a0271fd4dbb357d06141de5
TLSH
T199E0486437CAD22A658620DB776CD308C1E27817E6C93F612B08ED4472471C57657982
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\000003.log
Size 175B
SHA256 80d1388b9a7150eb0291175fe693dd7b6bce910c3e4fff51e94841d31d771dbe
MD5 cb63c64828a27af7253afb7c7d986654
SHA1 8a54aeb86f79cc69e6f11278d874cebd328ae466
SHA512 e0dbdd6931c9272e0b52bb2ef7895121f6324379f584899343342a057737a9837cc476842ea781a1de5c17a20c06e0a7d24c0ed6ea41fdd95bb99296e8810f9a
TLSH
T135C09BD55F903023FDCA5D3D0DAB53041720C4752F74CF57D28430901C0A285FF61145
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 323B
SHA256 f3f929fbfbd569699fb2d7d0ae6b372abffa2632a4d6f5d4d1d46fd49e3ca016
MD5 97bc0e5e5a44f4576c9bd1cd8d12c05f
SHA1 e9dfd03f76fec647271f01a430792a40f8a83487
SHA512 24a587418f959aed9a564b06eb8b67fb71b8efcf08a68a38d60bcce371dd21a9161efe6394d0ecf467bc91972c3cf614508edeca59a95656a72666600633d54a
TLSH
T138E0867466CAD23960D560D74B68DB0CC2F07C17A7C93BD65B08C844B2431C5F7AAD81
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 42b2677ecf1e2f32b6c80d29b5b45b4230aa328f259512f6dadbbc3761b1eb1b
MD5 dadc6007953d2a74023893943e469070
SHA1 11cb3e56408437c357864f68c293131f98e5dcef
SHA512 410a3d8191c200674f9b29e951d579d8028ce3e0f3b1a05f97fc9038a1337488e64254702f79d7bcbb5d5edd463e67d95ffd88fcad3cda3064cc482839d87324
SSDEEP 48:KoBIlKSIwfy7Z49pvL/grTmzIixgKp1xngtBwUWHz2IvKLi4Tys:KoBmKSIa66oKXqs2kKLiWv
TLSH
T1199186D631BA42113C3E690CE6A187670A8172B77154E42B3BA844B38E67E751CFDBCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 12KB
SHA256 f70e1ea8feb6f5c9014e221bbb1a57e0607021eafeea6f9d22d916db2ed2c874
MD5 855e7602417016a8c9fe6fe7e5bb54cc
SHA1 be3b291204d087eb9ad201f39d754d8087765de5
SHA512 9b440f0dea60efbdedf5ab919163bcbeb9328318f71d17bed4d77bbf7722bb4146ac13334e244a46c5738ccb8f2b01e503fa1a73a1b93e6d8f68aacc638b14d6
SSDEEP 192:qQXIIImbGMIMslYcYCpOJgAsllrqxrsRxn:qQXIIImbGMIMuB0Jps/isR
TLSH
T1C642735A1B162B7BC19F6F7B1252C6945BD588828570212DB1A12C4F8DF3E9783C72F3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 319B
SHA256 30108378ae616bd65d4191ab2a192afb6772437e8f47ae879cfccbc21389d735
MD5 879a9fd49c2d597a904f3b423e1652bd
SHA1 efc9aeca698385c00d63f43a57854fb70ab43f32
SHA512 0865b6981ebe542b01f9cbcee010f93a7e472b6408207231fe440d6d46dc6a20159a17bff0c04403ca5a4faae26dc5b7f6b8781a02ed828d32b03729143c969d
TLSH
T1B6E02618BEC8C26EB15520DB1A298308C2C03C13EA8C2EC61F08C448F2435C1B68A982
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 3418eea60fa134dfda5738d8dab7bafb49792f48a959a89aaaecc14d2968b35a
MD5 bb1e019e1cdb2e5b998312488c4f586d
SHA1 75840c534091a82bbfbd510ad092fd326948b131
SHA512 f11084c871459a033c7f54f8f2290de61ac8455c0dcd26c2263786026186075c58d56edef79884def2c8e5accd9d0fd475b294f14575de72e8167bdff03cf4f2
TLSH
T17C219C91F334C059D14A473B603FAB1A1738D4068FB8EC0F287924283E7BB040D8B6E9
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 337B
SHA256 d22c4226d55dbbbff91b86d4ffe77be0f3eab47711be03dee500509925223340
MD5 0d37dd9516bc1c189444c4c951b7a13c
SHA1 3294d0acdc8dd46ef164f8f99c53bbbebf537aeb
SHA512 5aa90e6f90af7260e25de2313623f3c04087d496b273b78472d4c804c5fdc5798c6a24208b7717a763b607383272ae135d89c981e69131874b1b92875146df38
TLSH
T167E020547EC4C15F619120D306688748C2D13C13EA8C2F831F0CCC48F2435C6764EA42
MD5 SHA1 SHA512 TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe598757.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe598757.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 31e2b308d63a82d329734e44b9dccac2c3472275b269cf5ffbf494de157e2610
MD5 6e644ec94f15aa844b848f82ad1a9ba3
SHA1 67508e068bdc01b11683dd6c5b21d33c292e5053
SHA512 eaa22578a03e9b315bc174166a5b6fde49d765e90c474c4a927e997d35e57bdbdc4a190538c0749169c1573e72295c91378cb18c2227bd2de3e80e5f950324cf
SSDEEP 384:nitNnNnb9G8N7HYptq/+XuUu8YKuscubafjFc+7ydgxIVBb:ijZbYzth3CK1cQabFcTgsBb
TLSH
T11C928D716879BC67ADE36229F64632436F74217BDDC43E58DAE85B0D00CB29C234AD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 5633f8769cba375da422310e8700d0cc227fe325ab8e690fdbb9dbbb2eb3f96b
MD5 b3ab90ef08a5198b8835f1aa315f6f48
SHA1 39954935941b0089bd71afccf7348319fb974e0f
SHA512 0ec254111e48b13c0d5e85c8c025cb75cec7ee7162b041310a2d7de33d1f202758585a2c6669a3b209fe635c14206bfef384822469275a41f493b5e2763d7c6e
SSDEEP 384:nEtNnNnb9G8N7HYptqtMXuUu8YKuscubRo/ylm29wkbnfjFc+7ydgxIVBb:EjZbYztP3CK1cQYyn9ZnbFcTgsBb
TLSH
T18DC24A7D9C25AC3F98EE7708B64D25271E28123BC9B06D5CE7E80B0EC076558F786C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 b1dff23478389b84b5981692e614cc9e63e103423962b2ea0fc80d7a81b7d6d2
MD5 dc81b8ba5935cfb6bf21721129c7960e
SHA1 4e8cfc81dada7e49cd3497763c5df15693ef4d56
SHA512 c343ea86874672e10e3264e65b123f39bad7a6c0be9b974fc4cf9e620d70d215753d5073731e95e633375f53f2e2dbf5528654c3055922ad95225758830f5734
SSDEEP 384:nEtNnNnb9G8N7HYptqtvXuUu8YKuscubRo/ylm29wkbnfjFc+7ydgxIVBb:EjZbYzts3CK1cQYyn9ZnbFcTgsBb
TLSH
T148C24A7D9C25AC3F98EE7708B64D25271E28123BD9B06D5CE7E80B0EC076558F786C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 a5f700749753619a928a8e87f255d92476756dfe61a66c6587e716babcc55863
MD5 4f2a5d4f68057fed59fa18e7e6639a7c
SHA1 ac400b72635061db435b5e2842430de988f78585
SHA512 f1e1d42765e0b20ebe2d854563b7b89b1520a9a53153ff1e2de4622f09a2d0666b6174d3c08596e10b7ef4041dcd7ab018ba02cde730291d21a0d38ca13f0fc9
SSDEEP 192:XGNx6jCQmiUyGIXf4SufoPxzYfSus6OImsSn8zoU6:XGNx6qV8fju8YKusBuoU6
TLSH
T16502D8756C68786B9EB36E49FA8737135FA4213BDA852F44DAE81F1C00D729C2306936
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 c01f7b79fb1232f5e4e329fcb018d00f217bf2d257261caeabe51cc6f2f7a18c
MD5 04a92902d2583c79b2f619b56d0254f2
SHA1 fc723f7977b3a9c600c93e206ba76faf6050c7d6
SHA512 c9a18420e30825a02c082e82293b482fc0bf7b54b0a24ea81d51dcd4a64fdb33219684eb73a4b53f6fd745374bd3c9a48f406ee6e518f89f0f5fe7210d3e1b85
SSDEEP 384:notNnNnb9G8N+eYptqt5XuUu8YKus8PYSkEJpVFxF8t0hdGjFc+7ydgxIV061/7t:ojZbYpta3CK18PhkEJpVFxF8t0h2FcT5
TLSH
T1CAB28D3D9C65AC7B4CEAB708B75E26133FB4113BC9A42E58D7E85B0E006625CB347D22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 176286a629e1d0ef93a12353f6aeb75fbb02f5d7676cf2f28c05c69cf1e5cc40
MD5 c2918b975b03df6fee20860c2b47f03a
SHA1 33bd954fe5f8b5a800f95d5b47e9e1fc66d4fa94
SHA512 e8f3faf54b5e30701c0adee78c56508662614c804318318b2b059a4734b73d5fa91fb0d13680bb103b6784d55b8936e3d2c3ce7cfc97aadfbd7729f53a79aff6
SSDEEP 384:ngtNnNnb9G8NjeYptqt5XuUu8YKuscuhPhfjFc+7ydgxIV061/7Iz9I:gjZbYota3CK1cqPhbFcTgsOI
TLSH
T1EEA28D756879BCA36DE3A22DF75A33437FB42177CD842E58D6EC5B0E1086258234BC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 4e6478522e921b27c33b0506ce39f7ebba42c2ae07daeb9beb1153b70314a3d7
MD5 2890e4b4ca9dcbf63bf363632afc8020
SHA1 f3616e019e1500673a821dc72a42139461e1bf9d
SHA512 2f3d89664e08000b7f697d1bee4df73c1a48747e5d6f0f37327f77223d72dd1de2085b53a37b3ac2a253f56e8926a7e4bea37ecfe91d117d0dc4bef6af6e8163
SSDEEP 192:XGN+6j2QmiUysXa4SufoPxzYfSus6OImZSusOMBg/i4U6:XGN+6Glaju8YKuscumaU6
TLSH
T14B120871686DFC27ADA36658FA8732539FA4203BDD856F44D6E81E1C00DB298334AD23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

64fa8717-bded-423c-a938-404e7fee77c7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\64fa8717-bded-423c-a938-404e7fee77c7.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

0b19f409-0c36-4131-a3a5-1aef16374640.tmp

Path C:\Users\Admin\AppData\Local\Temp\0b19f409-0c36-4131-a3a5-1aef16374640.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4f28979f-2b0d-40de-b1f2-0506f50206ad.tmp

Path C:\Users\Admin\AppData\Local\Temp\4f28979f-2b0d-40de-b1f2-0506f50206ad.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2920_130115179\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

50f4a149-3322-44d6-b3c4-bbf920f9f895.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2920_1995880122\50f4a149-3322-44d6-b3c4-bbf920f9f895.tmp
Size 147KB
SHA256 d766e75ceffe993aa1dadd5619b24043a0ebe9a9689a6796d19d88bf952683d4
MD5 a9f7675ff091bb15c88909424bab4a39
SHA1 90f753d8d7e4397de0f49631fcd9222a7f59148c
SHA512 ff1f89fb04ae9c9a4c6cf6b1475f5a77f1c4f90829acda95cb39889b6b15c3b4f0b3b822a668f8ec8520b002cc90dd397cc26d314ac8fd5f3e2c9826bd458df5
SSDEEP 3072:Ph3iICVe1DvTtr/3tOpPu8LdKBTJyU4AshzWnD7UVDvuZE4tkGL:PgTVWvTZPghwln0AD7UV8Eeky
TLSH
T12BE3E01D29E2846EC82B24F4BA4A718FC71ECF07910BE40F25D984A55C7474E17E2EED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 3993d96beddbbc21572c4e19e618b8edcd4e684b0625e798dcfeb29f908aa97c
MD5 e0d251bc08467ce9aabe98226d25dd89
SHA1 29f92a5c76b2ca162ae5d4ec4c7fce0b0fcdabbe
SHA512 24d645da60b1ab76453f10a3422d8aa875761ee432f942817154de346b8cd895d1e98de1cb40b40b0064b31e6896cf538db5f2cc9e826bb494cc83cf0b34a2eb
SSDEEP 192:aOv5zboHCZU3yjf/L1d66Joz0dzgCl6mc0dz:ZboiZU3yj5d66JozQzgC1jd
TLSH
T140E10064E628867BC444527BDCA21F410F39389BDC4E3F1971EDA4582C572ED368E17D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 2afd2c55a175b8b50cfffd52abee1d1f88f80022c5f1464f87aa398734b4796d
MD5 a916bc16a3c7780d4861c5a5461caa1f
SHA1 8a930616cd378b6ea567ffe358bfbf45d273a30d
SHA512 0bfab24c17e140e0fd469b7319a42483f99037cc1155d52c1022ccd276fb1d0e5bb20a971a1eb057834186ff2fb6cadfcefed9a10144aad6b8a05681c08c6d00
SSDEEP 192:JOv5zboHZU3yj0x31d66Joz0dzgCl6mc0d:GboHZU3yjmd66JozQzgC1j
TLSH
T136D1ED68E629467BC454027BDCA21F400F39389BD85E2F2971EC745C2C572EE7A8E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 a892c21a345dc2774f1bc734a36dae03622ccbc6dfe69656453593d3ee48c91b
MD5 81e1cb26467a23f69d694f5bd383de36
SHA1 cd1fd4f58787289aa271257d287c82684872964d
SHA512 9fb5f0e07a789073ac03fb8ec209c22e1b08872258a410a6699478d9dd5484a8bd47392425ec2e77dcc12f4a19e75adb7ade41322358087f90d337bb8c962d7c
SSDEEP 192:F1d66Joz0dzgCl6mc0deOv5zboHgU3yjf/s:Dd66JozQzgC1jHboAU3yj8
TLSH
T154E11064E628867FC444127BDCA21B414F39389BDC4E3F1931EDA4582C572ED3A8E1BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\datareporting\glean\events\events
Size 1KB
SHA256 8b2a3a42cf05a2acfd060e9dee4930ecae06cdbde8aed11ef931442b01bb8f75
MD5 685251090cfd2d786e0786b8932c8461
SHA1 c7e862245a84424f6a8d4dd4098b132b458d2d69
SHA512 1c1c1a485e1fc51086eb1003e89159be669fdc6037b418e8cff32e9be98c22d2e03250f770baef1b9f13d54df83d22b91e23c5132e6d8f778f23294d9169a129
TLSH
T140216A9C39B95D2AACE7E2AC7461028E53598E4254871C430D13DF8CCDD5AE9326F439
MD5 SHA1 SHA512 TLSH

Submit Download

13a77a32-e959-4a3c-bf00-a979411b59c9

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\datareporting\glean\pending_pings\13a77a32-e959-4a3c-bf00-a979411b59c9
Size 883B
SHA256 befbd38d324c70a44a6157ffd97b4b075a55bf19dcf545bd5fbe8908ac13142e
MD5 81fa0b5cff90e6dee2d5e64891e9f5e5
SHA1 27da5555afb77e609532c30001db9aafaa3adf8e
SHA512 4451ee837fb3530ab921267bce6f578c4444950bb8d18989f15067381547c40114c6b23486a608286aba5b35aa0b6a68f051fd94653b6ca57f6760a7c5aa73c6
TLSH
T12C112351E634B9F3CC68D25B8A517B028FF87523C4D648183DE19D080C7F52963AB70B
MD5 SHA1 SHA512 TLSH

Submit Download

7ae92adc-7dd6-449d-b5d5-754eda555f54

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\datareporting\glean\pending_pings\7ae92adc-7dd6-449d-b5d5-754eda555f54
Size 16KB
SHA256 6935c9d3a6edd105d6599c165ecc3472407c2adb17dbd66db615e99d018c1581
MD5 1071cb5dec05ff08e3284bde1d79c243
SHA1 1ee077c15dc72be774900a3aae28e79d4dfbcc3e
SHA512 5119f27656dd0529e6a5030b4404ba4720114401d67e12c1b8014b2802cbe81fa5379720834afb23c27c57153c357dac60d2fdde829e03ce7819419a0592e368
SSDEEP 192:A6KoPt6KY7wek7XRE9IBBlOkyrM+XNt32V95jSaZqUgi72gXjdsDACnCp8O56ito:vKoYKCANBe7X/2DB8O53tcSRcip/e
TLSH
T10072B956642085BAC651E3AC98FCBFC3E1F538CF4C419FCA97E4BD0869DA06E112784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8d69f21c-40b1-4121-87c7-01cbd283bc2b

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\datareporting\glean\pending_pings\8d69f21c-40b1-4121-87c7-01cbd283bc2b
Size 886B
SHA256 c64c64428e3824a798ed52ce878a6a590cc56c11a4d8dd20c29f892df194b2ff
MD5 7697e2c15439fad97d1a731584f718dd
SHA1 2b8ddbbf386a5b9ff5a93970412551e8b282abe3
SHA512 19b796233bd20e4fb3bcbc6be6175d150d6e5f4b84e1802a37bd4e4d22b4801b73559cbccc0976b6f91e82707d3f81a2f468ef9a80908abe55ed3e09527ac33b
TLSH
T17F114040E66075F3CDA8D29B99A0BB424AE83423C0D60D187DA09F084CFB12A53A7207
MD5 SHA1 SHA512 TLSH

Submit Download

ba61728f-0ae2-4c4c-8070-84bed53d62a2

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\datareporting\glean\pending_pings\ba61728f-0ae2-4c4c-8070-84bed53d62a2
Size 2KB
SHA256 bb4892f9d7c51d1d8e74a31e91ae6ed634a3298a5aaa7faebc732d5c0212dd59
MD5 bb693a74aa26f55a22e2940f2d02ed01
SHA1 f43e20fc7830c7d784e7300a88cb68c7e2e7baac
SHA512 d27f73ac7e0787a3afbffb9581e85a939a60b9090cf08a1be4558cc11b9852d82d4b674c6cf45a69382887f8e317a5e371138c009aa3e5070b89d96e7a5bf7b5
TLSH
T10B41126C75B89CB74D9AE19DD051328E53A08A1300C65CC32EA2EE0C8D967A9337A52B
MD5 SHA1 SHA512 TLSH

Submit Download

ddde71c1-e03c-42e1-85e3-3dea8fb3ad20

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\datareporting\glean\pending_pings\ddde71c1-e03c-42e1-85e3-3dea8fb3ad20
Size 235B
SHA256 d6445ed2e9c69f1d602907c6419e16e4451e5eec9892968bdb18f26aa7502644
MD5 3cc7d8425253aa9f825bc7190147f797
SHA1 79c6b918810b17ddcebd36428d98c0421492d864
SHA512 6608716dc141bdf7fd072e18c29efa20e305380ed010ffd4c5db0c18d99cdbfdd5dd290071a78e9f91ee775c9284a68f1f6a04d9b03d127c34d5f659721a3045
TLSH
T13CD0A7D078E86B6D88144F47F5A179E671548C331874681097E2467C9DF9DCC52A2856
MD5 SHA1 SHA512 TLSH

Submit Download

261ce614-6f9a-46a0-937d-e9adf77d1df5

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\datareporting\glean\tmp\261ce614-6f9a-46a0-937d-e9adf77d1df5
Size 235B
SHA256 df2b7b4cc15a729dae5c29d40b22b181cf65678d681857a8156071218128b074
MD5 edc37fe281305ef23225f6346bdecd00
SHA1 c24475dc8aefef55cb05b2d5769040d33149c779
SHA512 400c54b4a79e4bd363cab3619316a117305b776209f95248c1d298c6cb8018e8c22e895d6210ff29444fd7db9e793a90b5e399e9ce25f257000f3698e6bb7106
TLSH
T16DD097802888A71D58044F03F0A06ADA30498C332460D820DA900174C9FD9C8415181B
MD5 SHA1 SHA512 TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\prefs.js
Size 6KB
SHA256 714a6353efdab061baf889d9d59cd663d20a76e7da0c16b0a472c1ce3ddca43f
MD5 156fb9f4f3b397c42b3400ce693c3538
SHA1 b0031e19446372f3824ed9dda172668befdd81da
SHA512 388342284c488b548f484b50cdde3a4e0a37eb26ef3ff319dc86e14a2736adf01b1e6056e48304a1a88f340bdb7c8c9e4b8f0128a12152e703abc12290f3667a
SSDEEP 96:xHkUTUNqGqZfsD21zS9tSSlqdv9jhnumHb4nNzw9Bw88j8L4cntev:+gRZfsD2ctSS1ob0sBw88x
TLSH
T1E3E13F7891088B7F74B677ACAC6888716AB2413BB7BF68C750B95485014CF3442F96E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wvdcag27.default-release\prefs.js
Size 6KB
SHA256 411d5f0df6183a31e092df21d460aa20fbbd7faa2086256a97be9206ba7a3fc4
MD5 e413f0ff46a21f9ef216d5ca8a06210d
SHA1 bd74a35a21c5da56d701a2675080a6c5a529c52c
SHA512 eab9217110e9be0553b691a653ec80090d5f0d9f250d20ddbe3e4bf3f3dfdc73a7809b66898114185d146452a308d4a7fca81958eaba193c8cb72a064c25900b
SSDEEP 96:xHkUTUNqGqZfsHyCj1zSISSlqdv9jhnumHb4nNzw9Bw88H8L4cntev:+gRZfsvjdSS1ob0sBw881
TLSH
T125E130789408CB7F74B677ACAC688831AAB2413BB7BF68C750B54484014CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

godot.log

Path C:\Users\Admin\AppData\Roaming\YourOnlyMoveIsHUSTLE\logs\godot.log
Size 208B
SHA256 96d5a4f0d2cc9e38d562518591bb299933a0e9d30b6af1edac4bc8621db60681
MD5 0791ccadc98fffdabbe7f9c5f09c5135
SHA1 de6e6de59f6f6aaf947b04450570aa4e669b9c05
SHA512 f409dcf621d4c853e0f763a77e6111319f44db3287224f41a599bc2e828b6672c1fed7f36043c02d832836200c245cf844e91e693e89e7e35dba1f1e12f880cd
TLSH
T1CCD022B91BC5A47BD602EE990538A210E5E94D4CD6D2D40A4A3D323ABB476FC673C930
MD5 SHA1 SHA512 TLSH

Submit Download

OnlineFix.ini

Path C:\Users\Admin\Desktop\Your Only Move Is HUSTLE\OnlineFix.ini
Size 550B
SHA256 009253a67945402821adb94521c0b1991fde5211203f21fbcff69fde6de9109a
MD5 b50ff6df0f43ba9bd13d258f32409394
SHA1 81f637617a6ec4aa2bc8bd7ed77bb11733d31cf2
SHA512 ea3952016294aff33b35a9121eb18ad9c5490ecedd6b1a59960b9d3405d8f8a24d523f7d6cb1efc71f0872471ed4323a7f5ff1b39119082d90a16de22af93b47
TLSH
T1D5F005A9365F377C8A214D5D2E977D5669D43961B1070E1472264B8B2442E22915800D
MD5 SHA1 SHA512 TLSH

Submit Download

OnlineFix64.DLL

Path C:\Users\Admin\Desktop\Your Only Move Is HUSTLE\OnlineFix64.DLL
Size 7.0MB
SHA256 1a799640ab36616fbb8af9540ca24c16a9f3cdf1b1d6e7a119bd1b9ad6d31415
MD5 eddb8b18e993c39fa8c49aa4a707faf2
SHA1 ee88dbd3cb4bac69c71d5f28af1b25fbd91fa12f
SHA512 43db2315327a0b55a678863cf42b79b7f675ce10830326789aed80c039631b8c5a9700ab0dcfda11793372871aa29fd8fceae675e97f2329903e57c42e9439fc
SSDEEP 196608:QRDytzGW6rn9INrVGH/DCFljDEKKrdx8CxeNKHl2:QOiJrn+NrVGbgD+rEC0NKM
TLSH
T16A7622D175C893B8D0CA4A3C7582948E37E0ADE954A8CB09EBC99C237FD1F5D016A763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

YourOnlyMoveIsHUSTLE.exe

Path C:\Users\Admin\Desktop\Your Only Move Is HUSTLE\YourOnlyMoveIsHUSTLE.exe
Size 41.0MB
SHA256 9cb277ae5c9d1c89058426270cdc0c58e22a4d9b148ac3aebf1fe20b50a62bfd
MD5 677c486cadd78c34c882aa6c8161132c
SHA1 f015bfb07d9f8a54bf50937ba8822adb6e9e1cd7
SHA512 485fc618c164697f8a8a4767f0aa495477c417238482e734125e99dcf259aa3527837bfc39787b1b650de937d109d17b8a3406b639e93de4615eed1d60b0dab6
SSDEEP 393216:sAnZtt1CNkTixGEmgiKGWYiGcbfVxBHkSF8uvywzluXQr9LKVF+S3ea3QgiHkXWS:snPEXDyiIQe5l
TLSH
T1B6978D5AA26601EAD07AD0B9EA4BF057F33A305853344BE709A197655F37AF04DBFB00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

YourOnlyMoveIsHUSTLE.pck

Path C:\Users\Admin\Desktop\Your Only Move Is HUSTLE\YourOnlyMoveIsHUSTLE.pck
Size 18.5MB
SHA256 39a4f10c16db81effb8adc4748b001db851a8bffdb88601744261dce9e91e4a7
MD5 58f33366104b9d1c847e833178724663
SHA1 8450f809a3441f80d81058687a858240225d3380
SHA512 9e37b6d7df1d5f3ca3c3ecd872ff1e62d3e4a023e3a9b1936a5c0d49e8e185b8bb211600bbecd7858b5b047b6ba30542625d5515c99a905c62eb24a960904b9c
SSDEEP 196608:9D+ETxd7hCDadWeShLPAJsDsvk+7Y52DpyEGMgqycoMMm7SHZ9mscaz:9aETgzcJosBqqycoVz
TLSH
T17817BE03D682882EE172A139A563CF81CE60D544A76C157BF7B8E93CADF778836CB505
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

steam_api64.dll

Path C:\Users\Admin\Desktop\Your Only Move Is HUSTLE\steam_api64.dll
Size 291KB
SHA256 395c5a430c080b3eb99357da70471c3a87049b3b6170bda65b4f64a7f66b22f5
MD5 1c48d80ac6f880a0e1300ed04d44efc2
SHA1 f6fe3a4513da7bd57e7e546c6e6686ec72434561
SHA512 5e83eaa660ed826a4abf1ace8460e375800b4eba2f692672b5cee51a2ffd2d88afc3eab1cb12d3404a439ce1c3b7d8c2f3857cd2773f28b7b705e4cd307baa0e
SSDEEP 3072:504VEQ2u/niy9UVLCe9ZqdrP+VXvv+sJYB2RHKBi65lhTbCc+hnvvEyP7yq+ueic:QZu/i874ZcrMv2cRh7yqO2CP2HxYq8/B
TLSH
T12D54487AA2710CF4E076C13A88565E0FF671744B63219EFF226053369E576C21E3BBA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1628-1008-0x00007FFFDFAE0000-0x00007FFFE07B9000-memory.dmp

Download

memory/4516-34-0x00007FFFE17E0000-0x00007FFFE24B9000-memory.dmp

Download

memory/5316-1018-0x00007FFFDFAE0000-0x00007FFFE07B9000-memory.dmp

Download

memory/5368-1054-0x00007FFFDFD10000-0x00007FFFE09E9000-memory.dmp

Download

memory/5424-1467-0x00007FFFDFD10000-0x00007FFFE09E9000-memory.dmp

Download

memory/5908-1473-0x00007FFFDFD10000-0x00007FFFE09E9000-memory.dmp

Download