hxxp://google[.]com

Resubmissions

25/06/2026, 04:41

260625-fa5zvahv4r

25/06/2026, 04:34

260625-e7hp5shs5110

Analysis

geolocation tags

nanew-jerseynorth-americaunited-statesususa
user interaction
yes
max time kernel
266s
max time network
279s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/06/2026, 04:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
http://google.com
Sample260625-e7hp5shs51

Score

10^/10

bootkit discovery execution persistence privilege_escalation

Malware Config

Extracted

Language

Deobfuscated

Source

URLs

exe.dropper
https://www.win-rar.com/fileadmin/winrar-versions/downloader/versions.xml

Extracted

Language

Deobfuscated

Source

URLs

exe.dropper
https://www.win-rar.com/fileadmin/winrar-versions/winrar/winrar-x64-722.exe

Signatures

Badlisted process makes network request 3 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
346	3660	powershell.exe
347	5828	powershell.exe
349	5496	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1520	powershell.exe
5496	powershell.exe
3660	powershell.exe
5828	powershell.exe

Downloads MZ/PE file 2 IoCs

flow	pid	Process
344	1960	msedge.exe
347	5828	powershell.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation	geometry dash auto speedhack.exe
Key value queried	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation	wrarinstaller.exe
Key value queried	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation	geometry dash auto speedhack.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 18 IoCs

pid	Process
6116	WinRAR-722.exe
3276	wrarinstaller.exe
5340	uninstall.exe
6636	WinRAR.exe
6752	WinRAR.exe
6856	WinRAR.exe
6892	WinRAR.exe
6920	WinRAR.exe
7076	WinRAR.exe
7136	WinRAR.exe
4984	WinRAR.exe
5304	geometry dash auto speedhack.exe
5444	geometry dash auto speedhack.exe
5456	geometry dash auto speedhack.exe
5484	geometry dash auto speedhack.exe
4632	geometry dash auto speedhack.exe
5572	geometry dash auto speedhack.exe
5372	geometry dash auto speedhack.exe

Loads dropped DLL 16 IoCs

pid	Process
6116	WinRAR-722.exe
6116	WinRAR-722.exe
6116	WinRAR-722.exe
6116	WinRAR-722.exe
6116	WinRAR-722.exe
6116	WinRAR-722.exe
6116	WinRAR-722.exe
6116	WinRAR-722.exe
6116	WinRAR-722.exe
6116	WinRAR-722.exe
6116	WinRAR-722.exe
6116	WinRAR-722.exe
6116	WinRAR-722.exe
6116	WinRAR-722.exe
3268	Process not Found
3268	Process not Found

Modifies system executable filetype association 2 TTPs 8 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR32	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}	uninstall.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	geometry dash auto speedhack.exe

Drops file in Program Files directory 60 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\WinRAR\Uninstall.lst	wrarinstaller.exe
File opened for modification	C:\Program Files\WinRAR\Uninstall.exe	wrarinstaller.exe
File opened for modification	C:\Program Files\WinRAR\UnRAR.exe	wrarinstaller.exe
File opened for modification	C:\Program Files\WinRAR\RarExtPackage.msix	wrarinstaller.exe
File created	C:\Program Files\WinRAR\Zip32.SFX	wrarinstaller.exe
File created	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-48.png	wrarinstaller.exe
File created	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-64.png	wrarinstaller.exe
File created	C:\Program Files\WinRAR\Uninstall.exe	wrarinstaller.exe
File created	C:\Program Files\WinRAR\WhatsNew.txt	wrarinstaller.exe
File created	C:\Program Files\WinRAR\Order.htm	wrarinstaller.exe
File opened for modification	C:\Program Files\WinRAR\License.txt	wrarinstaller.exe
File opened for modification	C:\Program Files\WinRAR\RarFiles.lst	wrarinstaller.exe
File created	C:\Program Files\WinRAR\Default.SFX	wrarinstaller.exe
File opened for modification	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-32.png	wrarinstaller.exe
File opened for modification	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-48.png	wrarinstaller.exe
File opened for modification	C:\Program Files\WinRAR\WinRAR.exe	wrarinstaller.exe
File opened for modification	C:\Program Files\WinRAR\RarExt.dll	wrarinstaller.exe
File opened for modification	C:\Program Files\WinRAR\RarExtInstaller.exe	wrarinstaller.exe
File created	C:\Program Files\WinRAR\__tmp_rar_sfx_access_check_240846343	wrarinstaller.exe
File created	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-32.png	wrarinstaller.exe
File created	C:\Program Files\WinRAR\WinRAR.chm	wrarinstaller.exe
File opened for modification	C:\Program Files\WinRAR\Descript.ion	wrarinstaller.exe
File created	C:\Program Files\WinRAR\Uninstall.lst	wrarinstaller.exe
File created	C:\Program Files\WinRAR\Resources.pri	wrarinstaller.exe
File opened for modification	C:\Program Files\WinRAR\Resources.pri	wrarinstaller.exe
File opened for modification	C:\Program Files\WinRAR\Default.SFX	wrarinstaller.exe
File opened for modification	C:\Program Files\WinRAR\WhatsNew.txt	wrarinstaller.exe
File created	C:\Program Files\WinRAR\RarExtInstaller.exe	wrarinstaller.exe
File opened for modification	C:\Program Files\WinRAR\WinRAR.chm	wrarinstaller.exe
File created	C:\Program Files\WinRAR\zipnew.dat	uninstall.exe
File opened for modification	C:\Program Files\WinRAR\Rar.txt	wrarinstaller.exe
File created	C:\Program Files\WinRAR\RarExtPackage.msix	wrarinstaller.exe
File created	C:\Program Files\WinRAR\Default32.SFX	wrarinstaller.exe
File created	C:\Program Files\WinRAR\WinCon.SFX	wrarinstaller.exe
File opened for modification	C:\Program Files\WinRAR\Zip.SFX	wrarinstaller.exe
File created	C:\Program Files\WinRAR\RarFiles.lst	wrarinstaller.exe
File opened for modification	C:\Program Files\WinRAR\RarExt32.dll	wrarinstaller.exe
File created	C:\Program Files\WinRAR\UnRAR.exe	wrarinstaller.exe
File created	C:\Program Files\WinRAR\Descript.ion	wrarinstaller.exe
File opened for modification	C:\Program Files\WinRAR\7zxa.dll	wrarinstaller.exe
File created	C:\Program Files\WinRAR\RarExt.dll	wrarinstaller.exe
File opened for modification	C:\Program Files\WinRAR\Order.htm	wrarinstaller.exe
File created	C:\Program Files\WinRAR\Rar.exe	wrarinstaller.exe
File opened for modification	C:\Program Files\WinRAR\WinCon.SFX	wrarinstaller.exe
File opened for modification	C:\Program Files\WinRAR	wrarinstaller.exe
File created	C:\Program Files\WinRAR\ReadMe.txt	wrarinstaller.exe
File created	C:\Program Files\WinRAR\License.txt	wrarinstaller.exe
File created	C:\Program Files\WinRAR\RarExt32.dll	wrarinstaller.exe
File created	C:\Program Files\WinRAR\Zip.SFX	wrarinstaller.exe
File opened for modification	C:\Program Files\WinRAR\Zip32.SFX	wrarinstaller.exe
File opened for modification	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-64.png	wrarinstaller.exe
File opened for modification	C:\Program Files\WinRAR\Rar.exe	wrarinstaller.exe
File opened for modification	C:\Program Files\WinRAR\WinCon32.SFX	wrarinstaller.exe
File opened for modification	C:\Program Files\WinRAR\ReadMe.txt	wrarinstaller.exe
File created	C:\Program Files\WinRAR\Rar.txt	wrarinstaller.exe
File created	C:\Program Files\WinRAR\WinRAR.exe	wrarinstaller.exe
File created	C:\Program Files\WinRAR\WinCon32.SFX	wrarinstaller.exe
File created	C:\Program Files\WinRAR\7zxa.dll	wrarinstaller.exe
File opened for modification	C:\Program Files\WinRAR\Default32.SFX	wrarinstaller.exe
File created	C:\Program Files\WinRAR\rarnew.dat	uninstall.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WinRAR-722.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	geometry dash auto speedhack.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	geometry dash auto speedhack.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	geometry dash auto speedhack.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	geometry dash auto speedhack.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	geometry dash auto speedhack.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	geometry dash auto speedhack.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	geometry dash auto speedhack.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1960	msedge.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134268357165024057"	msedge.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.tbz	uninstall.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.lzh\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.7z\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\DefaultIcon	uninstall.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\InProcServer32\ = "C:\\Program Files\\WinRAR\\rarext32.dll"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA}	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.rar\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.uu	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shell\open\command	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.rev	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.rev\ = "WinRAR.REV"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.arj\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.7z	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\shell\open	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\WinRAR	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.tlz	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\ = "WinRAR ZIP archive"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.z	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\ContextMenuHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.zip\ShellNew\FileName = "C:\\Program Files\\WinRAR\\zipnew.dat"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.xz\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.bz	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA}\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\DragDropHandlers\WinRAR	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.tar	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.uue	uninstall.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	WinRAR.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.lz\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	WinRAR.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR32	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\WinRAR	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\ContextMenuHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\DragDropHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\DropHandler\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.tbz2\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.bz\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.tzst	uninstall.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\ContextMenuHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.cab\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.lz	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.lzh	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.tbz2	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.txz	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\WinRAR	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.zip	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.gz\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\ = "WinRAR archive"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	WinRAR.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\ContextMenuHandlers	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\ContextMenuHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.zip\ShellNew	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.bz2	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.z\ = "WinRAR"	uninstall.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4568	msedge.exe
4568	msedge.exe
3660	powershell.exe
3660	powershell.exe
3660	powershell.exe
5828	powershell.exe
5828	powershell.exe
5828	powershell.exe
1520	powershell.exe
1520	powershell.exe
1520	powershell.exe
6116	WinRAR-722.exe
6116	WinRAR-722.exe
6116	WinRAR-722.exe
6116	WinRAR-722.exe
6116	WinRAR-722.exe
5496	powershell.exe
5496	powershell.exe
5496	powershell.exe
5444	geometry dash auto speedhack.exe
5444	geometry dash auto speedhack.exe
5444	geometry dash auto speedhack.exe
5444	geometry dash auto speedhack.exe
5444	geometry dash auto speedhack.exe
5444	geometry dash auto speedhack.exe
5456	geometry dash auto speedhack.exe
5456	geometry dash auto speedhack.exe
5444	geometry dash auto speedhack.exe
5444	geometry dash auto speedhack.exe
5456	geometry dash auto speedhack.exe
5456	geometry dash auto speedhack.exe
5444	geometry dash auto speedhack.exe
5484	geometry dash auto speedhack.exe
5484	geometry dash auto speedhack.exe
5444	geometry dash auto speedhack.exe
5444	geometry dash auto speedhack.exe
5444	geometry dash auto speedhack.exe
5484	geometry dash auto speedhack.exe
5484	geometry dash auto speedhack.exe
5456	geometry dash auto speedhack.exe
5456	geometry dash auto speedhack.exe
4632	geometry dash auto speedhack.exe
4632	geometry dash auto speedhack.exe
5484	geometry dash auto speedhack.exe
5484	geometry dash auto speedhack.exe
5444	geometry dash auto speedhack.exe
5444	geometry dash auto speedhack.exe
4632	geometry dash auto speedhack.exe
4632	geometry dash auto speedhack.exe
5456	geometry dash auto speedhack.exe
5456	geometry dash auto speedhack.exe
4632	geometry dash auto speedhack.exe
5444	geometry dash auto speedhack.exe
5444	geometry dash auto speedhack.exe
4632	geometry dash auto speedhack.exe
5484	geometry dash auto speedhack.exe
5484	geometry dash auto speedhack.exe
5444	geometry dash auto speedhack.exe
5444	geometry dash auto speedhack.exe
4632	geometry dash auto speedhack.exe
4632	geometry dash auto speedhack.exe
5572	geometry dash auto speedhack.exe
5572	geometry dash auto speedhack.exe
5456	geometry dash auto speedhack.exe

Suspicious behavior: GetForegroundWindowSpam 3 IoCs

pid	Process
1644	OpenWith.exe
6920	WinRAR.exe
4984	WinRAR.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 22 IoCs

pid	Process
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	3660	powershell.exe
Token: SeDebugPrivilege	5828	powershell.exe
Token: SeDebugPrivilege	1520	powershell.exe
Token: SeDebugPrivilege	5496	powershell.exe
Token: SeDebugPrivilege	5784	taskmgr.exe
Token: SeSystemProfilePrivilege	5784	taskmgr.exe
Token: SeCreateGlobalPrivilege	5784	taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
6116	WinRAR-722.exe
6752	WinRAR.exe
6920	WinRAR.exe
6892	WinRAR.exe
6856	WinRAR.exe
7076	WinRAR.exe
4984	WinRAR.exe
7136	WinRAR.exe
4984	WinRAR.exe
4984	WinRAR.exe
4984	WinRAR.exe
4984	WinRAR.exe
5784	taskmgr.exe

Suspicious use of SendNotifyMessage 61 IoCs

pid	Process
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
5784	taskmgr.exe
5784	taskmgr.exe
5784	taskmgr.exe
5784	taskmgr.exe
5784	taskmgr.exe
5784	taskmgr.exe
5784	taskmgr.exe
5784	taskmgr.exe
5784	taskmgr.exe
5784	taskmgr.exe
5784	taskmgr.exe
5784	taskmgr.exe
5784	taskmgr.exe
5784	taskmgr.exe
5784	taskmgr.exe
5784	taskmgr.exe
5784	taskmgr.exe
5784	taskmgr.exe
5784	taskmgr.exe
5784	taskmgr.exe
5784	taskmgr.exe
5784	taskmgr.exe
5784	taskmgr.exe
5784	taskmgr.exe
5784	taskmgr.exe
5784	taskmgr.exe
5784	taskmgr.exe
5784	taskmgr.exe
5784	taskmgr.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
1644	OpenWith.exe
1644	OpenWith.exe
1644	OpenWith.exe
1644	OpenWith.exe
1644	OpenWith.exe
1644	OpenWith.exe
1644	OpenWith.exe
1644	OpenWith.exe
1644	OpenWith.exe
1644	OpenWith.exe
1644	OpenWith.exe
1644	OpenWith.exe
1644	OpenWith.exe
1644	OpenWith.exe
1644	OpenWith.exe
1644	OpenWith.exe
1644	OpenWith.exe
1644	OpenWith.exe
1644	OpenWith.exe
1644	OpenWith.exe
1644	OpenWith.exe
1644	OpenWith.exe
1644	OpenWith.exe
1644	OpenWith.exe
1644	OpenWith.exe
1644	OpenWith.exe
1644	OpenWith.exe
6116	WinRAR-722.exe
3276	wrarinstaller.exe
5340	uninstall.exe
5304	geometry dash auto speedhack.exe
5444	geometry dash auto speedhack.exe
5456	geometry dash auto speedhack.exe
5484	geometry dash auto speedhack.exe
4632	geometry dash auto speedhack.exe
5572	geometry dash auto speedhack.exe
5372	geometry dash auto speedhack.exe
4632	geometry dash auto speedhack.exe
5444	geometry dash auto speedhack.exe
5484	geometry dash auto speedhack.exe
5572	geometry dash auto speedhack.exe
5484	geometry dash auto speedhack.exe
5444	geometry dash auto speedhack.exe
4632	geometry dash auto speedhack.exe
5572	geometry dash auto speedhack.exe
4632	geometry dash auto speedhack.exe
5444	geometry dash auto speedhack.exe
5484	geometry dash auto speedhack.exe
5572	geometry dash auto speedhack.exe
5572	geometry dash auto speedhack.exe
5484	geometry dash auto speedhack.exe
5444	geometry dash auto speedhack.exe
4632	geometry dash auto speedhack.exe
5444	geometry dash auto speedhack.exe
4632	geometry dash auto speedhack.exe
5484	geometry dash auto speedhack.exe
5572	geometry dash auto speedhack.exe
5572	geometry dash auto speedhack.exe
5484	geometry dash auto speedhack.exe
5444	geometry dash auto speedhack.exe
4632	geometry dash auto speedhack.exe
4632	geometry dash auto speedhack.exe
5444	geometry dash auto speedhack.exe
5484	geometry dash auto speedhack.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2700 wrote to memory of 4840	2700	msedge.exe	89
PID 2700 wrote to memory of 1960	2700	msedge.exe	90
PID 2700 wrote to memory of 4816	2700	msedge.exe	91
PID 2700 wrote to memory of 4032	2700	msedge.exe	92
PID 2700 wrote to memory of 4816	2700	msedge.exe	91
PID 2700 wrote to memory of 4816	2700	msedge.exe	91
PID 2700 wrote to memory of 4032	2700	msedge.exe	92
PID 2700 wrote to memory of 3304	2700	msedge.exe	93
PID 2700 wrote to memory of 4496	2700	msedge.exe	94
PID 2700 wrote to memory of 3304	2700	msedge.exe	93
PID 2700 wrote to memory of 3304	2700	msedge.exe	93
PID 2700 wrote to memory of 4496	2700	msedge.exe	94
PID 2700 wrote to memory of 4496	2700	msedge.exe	94
PID 2700 wrote to memory of 204	2700	msedge.exe	95
PID 2700 wrote to memory of 224	2700	msedge.exe	96
PID 2700 wrote to memory of 204	2700	msedge.exe	95
PID 2700 wrote to memory of 204	2700	msedge.exe	95
PID 2700 wrote to memory of 224	2700	msedge.exe	96
PID 2700 wrote to memory of 224	2700	msedge.exe	96
PID 2700 wrote to memory of 2928	2700	msedge.exe	101
PID 2700 wrote to memory of 2928	2700	msedge.exe	101
PID 2700 wrote to memory of 2928	2700	msedge.exe	101
PID 2700 wrote to memory of 748	2700	msedge.exe	102
PID 2700 wrote to memory of 3000	2700	msedge.exe	103
PID 2700 wrote to memory of 748	2700	msedge.exe	102
PID 2700 wrote to memory of 3000	2700	msedge.exe	103
PID 2700 wrote to memory of 1808	2700	msedge.exe	105
PID 2700 wrote to memory of 3372	2700	msedge.exe	113
PID 2700 wrote to memory of 3372	2700	msedge.exe	113
PID 2700 wrote to memory of 3372	2700	msedge.exe	113
PID 2700 wrote to memory of 1068	2700	msedge.exe	114
PID 2700 wrote to memory of 1068	2700	msedge.exe	114
PID 2700 wrote to memory of 1068	2700	msedge.exe	114
PID 2700 wrote to memory of 2924	2700	msedge.exe	116
PID 2700 wrote to memory of 1744	2700	msedge.exe	117
PID 2700 wrote to memory of 980	2700	msedge.exe	118
PID 2700 wrote to memory of 1596	2700	msedge.exe	119
PID 2700 wrote to memory of 1596	2700	msedge.exe	119
PID 2700 wrote to memory of 1596	2700	msedge.exe	119
PID 2700 wrote to memory of 4984	2700	msedge.exe	120
PID 2700 wrote to memory of 4984	2700	msedge.exe	120
PID 2700 wrote to memory of 4984	2700	msedge.exe	120
PID 2700 wrote to memory of 5096	2700	msedge.exe	122
PID 2700 wrote to memory of 5096	2700	msedge.exe	122
PID 2700 wrote to memory of 5096	2700	msedge.exe	122
PID 2700 wrote to memory of 748	2700	msedge.exe	123
PID 2700 wrote to memory of 748	2700	msedge.exe	123
PID 2700 wrote to memory of 748	2700	msedge.exe	123
PID 2700 wrote to memory of 3628	2700	msedge.exe	124
PID 2700 wrote to memory of 3628	2700	msedge.exe	124
PID 2700 wrote to memory of 3628	2700	msedge.exe	124
PID 2700 wrote to memory of 2020	2700	msedge.exe	125
PID 2700 wrote to memory of 2020	2700	msedge.exe	125
PID 2700 wrote to memory of 2064	2700	msedge.exe	126
PID 2700 wrote to memory of 2064	2700	msedge.exe	126
PID 2700 wrote to memory of 2064	2700	msedge.exe	126
PID 2700 wrote to memory of 2444	2700	msedge.exe	127
PID 2700 wrote to memory of 4368	2700	msedge.exe	128
PID 2700 wrote to memory of 4368	2700	msedge.exe	128
PID 2700 wrote to memory of 4368	2700	msedge.exe	128
PID 2700 wrote to memory of 2444	2700	msedge.exe	127
PID 2700 wrote to memory of 1052	2700	msedge.exe	129
PID 2700 wrote to memory of 4544	2700	msedge.exe	131
PID 2700 wrote to memory of 1824	2700	msedge.exe	132

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://google.com
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2b0,0x7fffde1fc188,0x7fffde1fc194,0x7fffde1fc1a0
  2⤵
  PID:4840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2004,i,4228227194713549647,12939838789113911143,524288 --field-trial-handle=2348,i,6571496073978570833,2838541356364875136,262144 --variations-seed-version --mojo-platform-channel-handle=2376 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:1960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1632,i,1442625548832009248,12379574310713104259,262144 --field-trial-handle=2348,i,6571496073978570833,2838541356364875136,262144 --variations-seed-version --mojo-platform-channel-handle=2344 /prefetch:2
  2⤵
  PID:4816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=784,i,16103535737044448809,8527150507741112780,524288 --field-trial-handle=2348,i,6571496073978570833,2838541356364875136,262144 --variations-seed-version --mojo-platform-channel-handle=2392 /prefetch:8
  2⤵
  PID:4032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3444,i,13284033555691367131,6291972754340393443,2097152 --field-trial-handle=2348,i,6571496073978570833,2838541356364875136,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:3304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3448,i,15920422653576888937,6768661301067288312,2097152 --field-trial-handle=2348,i,6571496073978570833,2838541356364875136,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:4496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4216,i,3265935559948785548,11987552124404896518,2097152 --field-trial-handle=2348,i,6571496073978570833,2838541356364875136,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:1
  2⤵
  PID:204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4264,i,11857366305624464669,5437313832013871878,2097152 --field-trial-handle=2348,i,6571496073978570833,2838541356364875136,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:2
  2⤵
  PID:224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5088,i,4114297944275804547,6540285787085714284,2097152 --field-trial-handle=2348,i,6571496073978570833,2838541356364875136,262144 --variations-seed-version --mojo-platform-channel-handle=5068 /prefetch:1
  2⤵
  PID:2928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3540,i,12386430108724230432,18002130652109672653,524288 --field-trial-handle=2348,i,6571496073978570833,2838541356364875136,262144 --variations-seed-version --mojo-platform-channel-handle=3692 /prefetch:8
  2⤵
  PID:748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3464,i,8008717738528377465,3942729715046006818,524288 --field-trial-handle=2348,i,6571496073978570833,2838541356364875136,262144 --variations-seed-version --mojo-platform-channel-handle=3748 /prefetch:8
  2⤵
  PID:3000
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5912,i,14986872620713613105,17526133253979055921,524288 --field-trial-handle=2348,i,6571496073978570833,2838541356364875136,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:8
  2⤵
  PID:4452
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5912,i,14986872620713613105,17526133253979055921,524288 --field-trial-handle=2348,i,6571496073978570833,2838541356364875136,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:8
  2⤵
  PID:1808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5924,i,9688860614417763518,4773418068226084586,2097152 --field-trial-handle=2348,i,6571496073978570833,2838541356364875136,262144 --variations-seed-version --mojo-platform-channel-handle=4964 /prefetch:1
  2⤵
  PID:3372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=4264,i,15110840463866155757,17487402125010019154,2097152 --field-trial-handle=2348,i,6571496073978570833,2838541356364875136,262144 --variations-seed-version --mojo-platform-channel-handle=6392 /prefetch:1
  2⤵
  PID:1068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6344,i,14159250848329516564,4993913297319646199,524288 --field-trial-handle=2348,i,6571496073978570833,2838541356364875136,262144 --variations-seed-version --mojo-platform-channel-handle=3664 /prefetch:8
  2⤵
  PID:2924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6360,i,8666051994173624872,5636712713557661160,524288 --field-trial-handle=2348,i,6571496073978570833,2838541356364875136,262144 --variations-seed-version --mojo-platform-channel-handle=6304 /prefetch:8
  2⤵
  PID:1744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6236,i,14831705584539743725,5932249395123884002,524288 --field-trial-handle=2348,i,6571496073978570833,2838541356364875136,262144 --variations-seed-version --mojo-platform-channel-handle=6580 /prefetch:8
  2⤵
  PID:980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6604,i,14199784056331775767,7832798410037861778,2097152 --field-trial-handle=2348,i,6571496073978570833,2838541356364875136,262144 --variations-seed-version --mojo-platform-channel-handle=6612 /prefetch:1
  2⤵
  PID:1596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6352,i,12559163116532711071,8362074798807393682,2097152 --field-trial-handle=2348,i,6571496073978570833,2838541356364875136,262144 --variations-seed-version --mojo-platform-channel-handle=6204 /prefetch:1
  2⤵
  PID:4984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=2876,i,3841593050584025834,16399886144081303166,2097152 --field-trial-handle=2348,i,6571496073978570833,2838541356364875136,262144 --variations-seed-version --mojo-platform-channel-handle=4496 /prefetch:1
  2⤵
  PID:5096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6548,i,5769681017535903015,16752378057082677031,2097152 --field-trial-handle=2348,i,6571496073978570833,2838541356364875136,262144 --variations-seed-version --mojo-platform-channel-handle=6760 /prefetch:1
  2⤵
  PID:748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6748,i,5289315537173008659,1236454089433129975,2097152 --field-trial-handle=2348,i,6571496073978570833,2838541356364875136,262144 --variations-seed-version --mojo-platform-channel-handle=6724 /prefetch:1
  2⤵
  PID:3628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6444,i,12698671700721609874,1338799316054280790,524288 --field-trial-handle=2348,i,6571496073978570833,2838541356364875136,262144 --variations-seed-version --mojo-platform-channel-handle=5296 /prefetch:8
  2⤵
  PID:2020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=5976,i,7662569368014583234,6961374382406387925,2097152 --field-trial-handle=2348,i,6571496073978570833,2838541356364875136,262144 --variations-seed-version --mojo-platform-channel-handle=4464 /prefetch:1
  2⤵
  PID:2064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4284,i,18365430858678648547,4671975791260819055,524288 --field-trial-handle=2348,i,6571496073978570833,2838541356364875136,262144 --variations-seed-version --mojo-platform-channel-handle=4500 /prefetch:8
  2⤵
  PID:2444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=3688,i,5241255837515745913,745316295087378474,2097152 --field-trial-handle=2348,i,6571496073978570833,2838541356364875136,262144 --variations-seed-version --mojo-platform-channel-handle=6368 /prefetch:1
  2⤵
  PID:4368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6996,i,15098925143869749370,5278320351549090534,524288 --field-trial-handle=2348,i,6571496073978570833,2838541356364875136,262144 --variations-seed-version --mojo-platform-channel-handle=5856 /prefetch:8
  2⤵
  PID:1052
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6792,i,7164365304630469617,11172340588605390614,524288 --field-trial-handle=2348,i,6571496073978570833,2838541356364875136,262144 --variations-seed-version --mojo-platform-channel-handle=6948 /prefetch:8
  2⤵
  PID:2196
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6792,i,7164365304630469617,11172340588605390614,524288 --field-trial-handle=2348,i,6571496073978570833,2838541356364875136,262144 --variations-seed-version --mojo-platform-channel-handle=6948 /prefetch:8
  2⤵
  PID:4544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=6944,i,7553961631923752834,16520825574627278763,2097152 --field-trial-handle=2348,i,6571496073978570833,2838541356364875136,262144 --variations-seed-version --mojo-platform-channel-handle=6980 /prefetch:1
  2⤵
  PID:1824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5872,i,2135834046493244614,12492693428418025806,262144 --field-trial-handle=2348,i,6571496073978570833,2838541356364875136,262144 --variations-seed-version --mojo-platform-channel-handle=5868 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=5856,i,6521625400342966772,15906687279670286498,2097152 --field-trial-handle=2348,i,6571496073978570833,2838541356364875136,262144 --variations-seed-version --mojo-platform-channel-handle=5984 /prefetch:1
  2⤵
  PID:2364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4172,i,4574652370016572033,14979598003769489024,524288 --field-trial-handle=2348,i,6571496073978570833,2838541356364875136,262144 --variations-seed-version --mojo-platform-channel-handle=6812 /prefetch:8
  2⤵
  PID:2580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=7344,i,13942468788224369777,4470788473053312466,2097152 --field-trial-handle=2348,i,6571496073978570833,2838541356364875136,262144 --variations-seed-version --mojo-platform-channel-handle=7444 /prefetch:1
  2⤵
  PID:4656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=7556,i,4230936787064087118,9162570570447885107,2097152 --field-trial-handle=2348,i,6571496073978570833,2838541356364875136,262144 --variations-seed-version --mojo-platform-channel-handle=7572 /prefetch:1
  2⤵
  PID:4688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=7464,i,16118327720543927521,4480913802774509142,2097152 --field-trial-handle=2348,i,6571496073978570833,2838541356364875136,262144 --variations-seed-version --mojo-platform-channel-handle=7568 /prefetch:1
  2⤵
  PID:2572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=7432,i,14432018089424564729,7303407156184902321,2097152 --field-trial-handle=2348,i,6571496073978570833,2838541356364875136,262144 --variations-seed-version --mojo-platform-channel-handle=6888 /prefetch:1
  2⤵
  PID:4292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=5976,i,976363629668934402,17335064144001943838,2097152 --field-trial-handle=2348,i,6571496073978570833,2838541356364875136,262144 --variations-seed-version --mojo-platform-channel-handle=7900 /prefetch:1
  2⤵
  PID:5912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7888,i,9696126148667668741,13264011537314941734,524288 --field-trial-handle=2348,i,6571496073978570833,2838541356364875136,262144 --variations-seed-version --mojo-platform-channel-handle=8036 /prefetch:8
  2⤵
  PID:5988
- C:\Users\Admin\Downloads\WinRAR-722.exe
  "C:\Users\Admin\Downloads\WinRAR-722.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  PID:6116
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -Command "try { $WebClient = New-Object System.Net.WebClient; $WebClient.DownloadFile('https://www.win-rar.com/fileadmin/winrar-versions/downloader/versions.xml', 'C:\Users\Admin\AppData\Local\Temp\wrtmp\versions.xml'); Write-Host 'SUCCESS' -NoNewline; exit 0 } catch { if ($_.Exception -is [System.Net.WebException]) { Write-Host $_.Exception.Response.StatusCode.value__ -NoNewline; exit 1 } else { Write-Host $_.Exception.Message -NoNewline; exit 2 } }"
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3660
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -Command "try { $WebClient = New-Object System.Net.WebClient; $WebClient.DownloadFile('https://www.win-rar.com/fileadmin/winrar-versions/winrar/winrar-x64-722.exe', 'C:\Users\Admin\AppData\Local\Temp\wrtmp\wrarinstaller.exe'); Write-Host 'SUCCESS' -NoNewline; exit 0 } catch { if ($_.Exception -is [System.Net.WebException]) { Write-Host $_.Exception.Response.StatusCode.value__ -NoNewline; exit 1 } else { Write-Host $_.Exception.Message -NoNewline; exit 2 } }"
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Downloads MZ/PE file
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5828
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -noninteractive -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File .\script.ps1 C:\Users\Admin\AppData\Local\Temp\wrtmp\wrarinstaller.exe C:\Users\Admin\AppData\Local\Temp\wrtmp\downloadedCertificate.txt -FFFeatureOff
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1520
- - C:\Users\Admin\AppData\Local\Temp\wrtmp\wrarinstaller.exe
    "C:\Users\Admin\AppData\Local\Temp\wrtmp\wrarinstaller.exe" -s1 -d"C:\Program Files\WinRAR"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Drops file in Program Files directory
    - Suspicious use of SetWindowsHookEx
    PID:3276
  - - C:\Program Files\WinRAR\uninstall.exe
      "C:\Program Files\WinRAR\uninstall.exe" /setup
      4⤵
      Executes dropped EXE
      Modifies system executable filetype association
      Drops file in Program Files directory
      Modifies registry class
      Suspicious use of SetWindowsHookEx
      PID:5340
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -Command "try { $headers = @{'User-Agent'='MyApp/1.0 (Windows NT 10.0; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Edg/128.0.0.0'; 'Content-Type'='application/json'}; $body = @{ payload = @{ website = 'b2afcf08-4ca2-48e4-a206-1e275ef84749'; hostname = 'test'; screen = '1920x1080'; language = 'en-US'; title = 'tracking'; url = '/track'; referrer = '/tracker'; name = 'finished installation'; data = @{ Language='en'; SetupType='Easy Setup' } }; type = 'event' } | ConvertTo-Json -Depth 6 -Compress; $null = Invoke-RestMethod -Method POST -Uri 'https://umami.win-rar.com/api/send' -Headers $headers -Body $body; Write-Host 'SUCCESS' -NoNewline; exit 0 } catch { if ($_.Exception -and $_.Exception.Response -and $_.Exception.Response.StatusCode.value__) { Write-Host $_.Exception.Response.StatusCode.value__ -NoNewline; exit 1 } else { Write-Host $_.Exception.Message -NoNewline; exit 2 } }"
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5496
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Program Files\WinRAR\WinRAR.exe"
    3⤵
    PID:6300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4504,i,2142039301448433737,5070786482961944270,524288 --field-trial-handle=2348,i,6571496073978570833,2838541356364875136,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:8
  2⤵
  PID:708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8120,i,4927072715845274906,9600158353702942856,524288 --field-trial-handle=2348,i,6571496073978570833,2838541356364875136,262144 --variations-seed-version --mojo-platform-channel-handle=7424 /prefetch:8
  2⤵
  PID:4348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7408,i,7617167648026520918,7050910788158919921,524288 --field-trial-handle=2348,i,6571496073978570833,2838541356364875136,262144 --variations-seed-version --mojo-platform-channel-handle=7800 /prefetch:8
  2⤵
  PID:4612
- C:\Program Files\WinRAR\WinRAR.exe
  "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\Admin\Downloads\memz.by.iTzDrK_.rar"
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of FindShellTrayWindow
  PID:6752
- C:\Program Files\WinRAR\WinRAR.exe
  "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\Admin\Downloads\memz.by.iTzDrK_.rar"
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  PID:6856
- C:\Program Files\WinRAR\WinRAR.exe
  "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\Admin\Downloads\memz.by.iTzDrK_.rar"
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of FindShellTrayWindow
  PID:6892
- C:\Program Files\WinRAR\WinRAR.exe
  "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\Admin\Downloads\memz.by.iTzDrK_.rar"
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of FindShellTrayWindow
  PID:6920
- C:\Program Files\WinRAR\WinRAR.exe
  "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\Admin\Downloads\memz.by.iTzDrK_.rar"
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  PID:7076
- C:\Program Files\WinRAR\WinRAR.exe
  "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\Admin\Downloads\memz.by.iTzDrK_.rar"
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  PID:7136
- C:\Program Files\WinRAR\WinRAR.exe
  "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\Admin\Downloads\memz.by.iTzDrK_.rar"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of FindShellTrayWindow
  PID:4984

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2980

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1644

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6356
- C:\Program Files\WinRAR\WinRAR.exe
  "C:\Program Files\WinRAR\WinRAR.exe"
  2⤵
  - Executes dropped EXE
  PID:6636

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2132

C:\Users\Admin\Downloads\memz.by.iTzDrK_\geometry dash auto speedhack.exe
"C:\Users\Admin\Downloads\memz.by.iTzDrK_\geometry dash auto speedhack.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5304
- C:\Users\Admin\Downloads\memz.by.iTzDrK_\geometry dash auto speedhack.exe
  "C:\Users\Admin\Downloads\memz.by.iTzDrK_\geometry dash auto speedhack.exe" /watchdog
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:5444
- C:\Users\Admin\Downloads\memz.by.iTzDrK_\geometry dash auto speedhack.exe
  "C:\Users\Admin\Downloads\memz.by.iTzDrK_\geometry dash auto speedhack.exe" /watchdog
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:5456
- C:\Users\Admin\Downloads\memz.by.iTzDrK_\geometry dash auto speedhack.exe
  "C:\Users\Admin\Downloads\memz.by.iTzDrK_\geometry dash auto speedhack.exe" /watchdog
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:5484
- C:\Users\Admin\Downloads\memz.by.iTzDrK_\geometry dash auto speedhack.exe
  "C:\Users\Admin\Downloads\memz.by.iTzDrK_\geometry dash auto speedhack.exe" /watchdog
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:4632
- C:\Users\Admin\Downloads\memz.by.iTzDrK_\geometry dash auto speedhack.exe
  "C:\Users\Admin\Downloads\memz.by.iTzDrK_\geometry dash auto speedhack.exe" /watchdog
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:5572
- C:\Users\Admin\Downloads\memz.by.iTzDrK_\geometry dash auto speedhack.exe
  "C:\Users\Admin\Downloads\memz.by.iTzDrK_\geometry dash auto speedhack.exe" /main
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Writes to the Master Boot Record (MBR)
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:5372
- - C:\Windows\SysWOW64\notepad.exe
    "C:\Windows\System32\notepad.exe" \note.txt
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5632

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /0
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5784

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Component Object Model Hijacking

T1546.015

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Uninstall.exe

Path C:\Program Files\WinRAR\Uninstall.exe
Size 402KB
SHA256 b35ff0d49825c222aa5af767b2ea6d04c5324b8c2de68e2d7b257bf8f2dedf87
MD5 150ab639be8319e6b030557c434f4305
SHA1 4d3d6d61f9fdc089a7e653a98b1786f6bd91f3bf
SHA512 44823fc75f74149728cf4725daa66eaae4898efeef99b8e8fdb5e9f8f13dcd34b6b46ed8dd4b6134bf7365e857fd384753cde5dac63077a5c91629718bc47ec1
SSDEEP 6144:aljRoo4zIa63bknS2ecOTJDPvDOnSfIHbqeC2PIII+Sn5HBK7jcRkj6:KjF3QnS2EJzLOSwxC2PIIvS5ejc6m
TLSH
T125948C1DE3A555FAE5B7D53CC8A24606E6723C558BB1C3CF03A1099A2F237D09E39722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WinRAR.chm

Path C:\Program Files\WinRAR\WinRAR.chm
Size 320KB
SHA256 68038b348e071df04fc97407f6e0d4135cda3f6520410c917533091a57f13477
MD5 943c004c4be680c15dfbf5ffb572633a
SHA1 8f19755ab1a6dfd7d6fad988a3ad9114df3f0add
SHA512 b1f1f0562a2956fbbf2b24298349766ad4672f822d8b789623cd6eebdfa1dfca18b97a529a47901a7f2abb6ded621829b4e196cd47132f2b0de642a1cfcc50cf
SSDEEP 6144:80W9Q/Hy3rKBB5k2UEiG63C0s3Vphf3rn333NWVBtKX4ngVTom6XNRLCHSR:I9iygYuV3f3j33cKo8oDfyG
TLSH
T1CD64121E7D9E8131E4E57D71EACC07CD2320B82A00C27F112D4FAAB6A5D8FED8169794
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WinRAR.exe

Path C:\Program Files\WinRAR\WinRAR.exe
Size 3.2MB
SHA256 93197a5e32265778176e53103e56666f45a085ee579d668317fe1cdbff5767cf
MD5 a129e870a870acd3d59cc1b49404cbb8
SHA1 04121c5d4abe73472329f2914ce1c0d9f661165b
SHA512 03515ddd51ff47d16b72d267a9288c7ad484adfa49ac54c2d36eb600a839f1af278876b47dcaf378f8a81663297477842f302a323f33f81b0e3bfd07c3b9728d
SSDEEP 49152:XzksfrJMv7WyI3kkv6h1oD8eiMv3SmGlO3m17PnKtbtYbsfUeT+uXEkjNEEBHLus:oUyhvdc8a+uUkjDBHLus
TLSH
T12AF59D0AA3E406ACE0F7C679DED6C553E776780D07B0A69F029098A64F772609F39713
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 1KB
SHA256 e2486a1bdcba80dad6dd6210d7374bd70ae196a523c06ceda71370fd3ea78359
MD5 4280e36a29fa31c01e4d8b2ba726a0d8
SHA1 c485c2c9ce0a99747b18d899b71dfa9a64dabe32
SHA512 494fe5f0ade03669e5830bed93c964d69b86629440148d7b0881cf53203fd89443ebff9b4d1ee9d96244f62af6edede622d9eacba37f80f389a0d522e4ad4ea4
TLSH
T17A316C303221B5D84D436F5309286AD5A3FF8749ABA89F5CB569231DCD2A44BD7221F3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 083d78ea5ea69126b24164f2e05fc467ce21fdcdf2ec67f8e94c4366a1284886
MD5 da79f81681859af2b76762aa37a5f73e
SHA1 53d69c959eb46848bc7ed7b5c480df864295389e
SHA512 f647681c342e36fa2f41fb9d54d089303f98b802703a42609226ef5755aafc91ef00af41a82f980c0f2819709322c59ef6cd1c18725ef5133691894902fc44c1
TLSH
T1FCD09B7077CDAC11D5450471D45547535D96CA4C24D7DB076011801D68557D9B35E067
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 965e5ede1dd95e7182bc6ed8b645e4796c53616af10fe7a02b411984e0f5fca1
MD5 252c38f22d645a5fc39fa9f1fdd92b34
SHA1 70c6079cc3ffdcb0efb6f56834b64311e1e951bc
SHA512 e23e1b164567d933593229d39744ddacb3330f715193f293c7aee9a5a95fc433809933ab830a7a1c5cdf37824965c32650c227083092c2a6488a2ab768744ad1
TLSH
T110D09B7077CDAC11D9450471D45547535D96CA4C24D7DB076011801D58567D9B35E067
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000050

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000050
Size 323KB
SHA256 43f247cffa3e721d4e8f168489e4bcdff76d1d9c8dbbc9a258371e7b2f19ef70
MD5 e5838926a0e49a49209479fd520f0c0b
SHA1 adcee138437cb64db453ee5b4d77f5320ad723fe
SHA512 df39ac1b2509c7d47843fa4401a8395055ff3ecb3471ca085f9f949e78be2bd4c9ec3b8413b325fe0a80f4a935a4f29c5af1db309bc36d1cedb02ea4d17a2426
SSDEEP 3072:cZE9a/Jh5/J6/Jp/Jg/JMrG/Jx/Jo/J1/Jn/JwPYqS7Q0V5LKAPI1P1+q5XFZ15I:sEEAd7pV5LKAPIX+cl87ccGO3oTu
TLSH
T15F645DB66200AD3BDA174DE4A7396F0E3C2AE31BDD6604B4D6F4EE398BD6D75240244C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00007a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007a
Size 32KB
SHA256 eff9dfe4ebe815c15fa6087a8b712ccacea7a59dddcb55a5c819293252d73c32
MD5 cba69340542e691fa9e4b30334a07507
SHA1 4af443e83868d3a18fc9ad853e58eaf39bb065f7
SHA512 4f8d78c0ae8e04e27dfbcef602d3d46cdefd8f01085cc549edd35805d775065c4f78b75da617adf5f8f699a9edf7fa69db7c267917e5f9cb967e59563f905227
SSDEEP 768:wOsAPzChBrMSp8DxHnpmf3ILP1KpbjtXPgYVkutZ:lsArKDqtO8KZtXPgYXtZ
TLSH
T17AE202DF0C15679A01C371AE6A7C6024EBB3E07B3035CA1B1E764CD250B6660E5DB8BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00007b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007b
Size 96KB
SHA256 11de5a5aa3d08f69e1db14ac9c5347b7d09b8ec8fa89a4dd48a53ac13bfc3af2
MD5 601873d8a87f7b6dc6d2be569d361b63
SHA1 90ddce036c5ac461fc0e2ad6d2549625f35fcad8
SHA512 8d0aa2ed004fd07ff6c8cf0b2f96bf2addadcc481e811d3070d206a2862ebd154f857021dc0186eff184667914b6e23239b3886e18521bbe109e9c70df09ea1e
SSDEEP 3072:TY9ViJr6dK5Zi9YhM9Dic9o4EKgg3Wn41QA2kCISlb5:EeV6dmIx9lSg3c4FCIgl
TLSH
T18DA3020ABF4FE1AE46B742548AB607CE7A906241D0369997871107CEB1F78FE5C183D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00007c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007c
Size 400KB
SHA256 eb0abb8af74b31f981d59c5e1b3e64570b8f174dbf9c1456f8334e222e56b1fc
MD5 a259ae818f2947ad7da2f8769004d828
SHA1 cb2e6339e7c9e73b7ca74deb801bbf1b2f9a1488
SHA512 ca6934f9de4a4d2d06795f768b6db35bf980f32b289f8019d18bd2a5d70770ed88bd25b98b89ba628d5ec2110cc884eea22094c38a652183a56d7dccb8ba800d
SSDEEP 12288:jAU+Scsc4W0CMCnbLW9ZeNuYmFT4hes33:F+/sDJCM6bLlNm1633
TLSH
T1DE9423809EB26F7776493C641AF91AA0A3CE01BEE734976E9D1896C11348741ECF53C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000e6

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000e6
Size 309KB
SHA256 0271095f0ad5c6f26c9738ed5636e751b8868c1ae3b08d5d8c5218121d9feeaf
MD5 7a18839fe61e9cde0e8fea3100acfb2b
SHA1 9476c97a73e027016e9f6f2f20c2fb19264cd837
SHA512 93931f232ced61279bfc0b06569e32a1f730961fee67354f1d136c6d652158d67f6b0d1fa386ae2b05dd69493cacfb1c088f2209c8cabb162118d0a7ee780c03
SSDEEP 6144:OTA8oPwUhcX7elbKTusBknJgjRasYyvy+YNrhvbJZZQs6pQwrHxxmvY0:OTAy3X3usBzlasYeYthvzZQs0Q4w
TLSH
T1DC6412529790C522D4F74A305D71DB3A9776FD224AA483436340369A7B32783AF4FEB1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 6KB
SHA256 364a103eb6eb0766221395ec82d6a5efd4cb97f1ff5ff6676f74b48ff616c36d
MD5 49d55749a3429a8547f381b86ac6003c
SHA1 818b93ea295d1a7d6feae1c70f389d1ee47d5f3f
SHA512 4e4c22fe77b301b71b757aef3fe8220e558788a1f730a763c6897b78b0b330284018b680c813191f0b297e72582aa731f60ad5a6761ce37f0ab41def705afd27
SSDEEP 192:BqZoishhs2O1SpYpDkIcGn3EQBHcL6zX8tc5X4n9s/Lff2JckvKohwjRdLlJDd2V:gZZshm2OUpYpDkIfn3ESHcL6zX8tEX4f
TLSH
T198D1832C4D105069DB70D731CAE2171A3B3598F963377EB9818489BF96123AEFB36028
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 7KB
SHA256 d6574977152b52248a4bc23140335c671b40514bfe304e136e57ef23c63cf03d
MD5 4812a2f487e057100c19df5a7e0f6416
SHA1 a1c8b3c062538c059aa37920f915b568fc87ab20
SHA512 0e00337417ad74e06bb983badcb872305965d5f7e471fef2509c98234ef8b49ef4adc5dfdfdeacbc3d18d804c3aa3d414a5e6562089be2f73a3f213e89285b32
SSDEEP 192:LqZtW2isZhhs2Jhw1SpHKcLYpDkIcGn6sYEelJBHcguL/bMBhuzX8tc5XlSn99si:eZtWPsZhm2JhwUpHKcLYpDkIfn6sYEeJ
TLSH
T1BEF1962C49106069DB70D731CADA171A3F3598F962377EB4C184897F9A163AEE73602C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 228db8bd1e12299ac4c527407a4408d96d275c43361bb9f7ee6fcceaef9dcafd
MD5 253adb63fc5060afa03af7beac2e67ed
SHA1 ff1a2f11d0e8860f785f94748fdc01ea92913b61
SHA512 5edb431eaa5d47275006574911b74b14b4044984f5403b726e864f644411282c6871818de2f6d970e688bb592f06af0dd0cb07a6f77e5f2352edc297fbde435f
SSDEEP 96:9y7djGDM3xOykr/6gPM3pD1z0S0IrPkEbplf6SBdcLdy8h41n3b5Cwc5X+bPU2xp:9yBjGwhOykr/6gPM3pD1z0S0IrPkEbpl
TLSH
T16AC1A3280D40607ADB70DB31CCE11A5F3B359DFA61279EF8054488BFAA173E6DB36428
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 11KB
SHA256 d28c89335524061bd814cef435c1df579e15eac627233d8638a5333ed7e2abdd
MD5 28cbfae66672766e59e38c58e936bbde
SHA1 3b259010e13437b903a1d017dfb331831286c27d
SHA512 8f1799b8ed27c0567ba072365d2149aac856913cc0fd1356695dc1cc703cb276478c93f1430240a6ef9a70f4b1ad75db096ed6b0231e12d781ba412e966e2f7c
SSDEEP 192:JU1iZpsrINfcwoY/OzOnxzElDWvEB+j/OI6o2zU33i7V+NvqOIkG56yZyUHx+uSl:a4ZurINfcwoYWzOnxzElDGEB+TOI6o2q
TLSH
T11B42212C59481866DFF78BB1CED62AC73F3444A916232EA5C250A57E49373EDE73211C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe5920cd.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5920cd.TMP
Size 2KB
SHA256 aff7c0387017def4c1d6873966f3334886b93aa560d3bb68b81826e2ba36e32f
MD5 66a108fb964a7e5ce8f78d1220ac6cee
SHA1 605c0f8b52344bbe4784fd1be1b01fc911ae87a7
SHA512 bad4b44f761719f83e494ebfe3d648cf20ee15475a9562057b569f4346481e6e408314138d9fd294e54276b47e5585956bb2f4f4c0b1b10ed87ac920256ae47c
TLSH
T169514D180652649EE730D231C4E01B03BE36C1F989BB8E390290E9BF97277E79B6901C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 9KB
SHA256 a3a29a29fcb00eb7fa0bda43d9c73998f08da40b7f0273fc8f863e0671ec250e
MD5 cd864e3d14fa6c4c42346e16d715f9ac
SHA1 7f59428c304bcab6f9c50f4065bd855078548f94
SHA512 8961eef07ae35f15566c60ca96d417bd182716d0dd23e4fd3ce6477988d0f78a04a2fcd0338a1a93b43ee74c5820cd8f62b59552ff2f07c258da21d73d7dea76
SSDEEP 192:DZGkVFgIgk3JmoWJjJ2N0f6AIkiaPls2/vnBfPANP8N0mtmhmDmrmg7g5zOcxZ8Q:DZGkVFgIgk3JmoejJ2N0f6AIkiads2/Z
TLSH
T10912CCF7C3E9822DC91155F4AB25AF1FCE1D0914432C3D2A88E4AF4AD3E2871E25675E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 de1d823fc6a85245976cffa98d04515079d210e70ad2910513c56f4c2607b471
MD5 69b6d219165ece2ff689a0e7de8c5ecd
SHA1 da741b2ad1c8dd6930ef60b83e5b7732268f5219
SHA512 e931b4e7d8e4de026338966194ec5696f0335d68e852b62c4f2e18a5539b84b0595126bc8e58e4ac0e0b52bedd06cc6355fbe797de8aa6da5a4ce017965bec1c
SSDEEP 192:DZGkVFgIgk3JmoWJja6sPIkiaPimrmFmDmbum92/vnBfPANPcE:DZGkVFgIgk3Jmoeja6sPIkiaqmrmFmDy
TLSH
T123D1ACF7C7D9811DC95656F4AB25AF1ECE1E0A14431C3C2688D8BF4AD3E2432E21675E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 10KB
SHA256 dacc06d12e909d56d06d6309160ef4c4bbe18802b11ff64a04f0c7fff1735e56
MD5 2f31a30f9be23bd9b46d69f109e83e80
SHA1 10896f0c58fdc2f20e03ae28857bb86b6b2e6720
SHA512 f1798e960b0e31c3b758832022d6558d15c33a59de473612c4f35d7e4da7480302cc9f8ee2fd0c887e49338eff30b97f93b6884e17a5f55f5919eabfe542021d
SSDEEP 192:DZGkVFgIgk3JmoWJjJ2N0QwT46AIkiaPls2/vnBfPANP8N0mtmhmDmrmgzOxF/Kx:DZGkVFgIgk3JmoejJ2N0QwT46AIkiadG
TLSH
T13E22ADF7C7E5822DC91155F4AB24AF1FCE1D0914432C3D6A88E4AF4AD3E2871E25674E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 fc50f0a62ef8035c0ed545607ff14dfc497e306fc8283be6f4585737683c4ac2
MD5 ff58ac9d931570edcda987e26b04d13f
SHA1 7a3f3d329c7d6db3c613c4a04f60efa6ebe76b43
SHA512 b8ec890cbd474bd3cab95991e9344097c0b9fe2b845325189db5ae2f96fc8cfa6271daca1f2d68e43a95ddaa9bf6a91eed13d0450275e26dec1a4396819b2adc
TLSH
T1DBD02357130434B956DD7F818075AC8FC36600200942FDDD20D0565D153145D470F144
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries~RFe5a9ee1.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries~RFe5a9ee1.TMP
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 ae375791fbafdc8e90a673fe77060739903977eebe2c7196adecc869bf43d26d
MD5 a2ba88a37c1ab78b7da8c633b33e6f3e
SHA1 2810d8b06f365ac06653b9239feaf777d43d9fab
SHA512 40cfb44ee53c3558d86cf13da9c8d04d932a55cdae72c2e1c2bb440185882bdc0e1c575419205009716e3e34cb16b35b236ea82911a2aa555ec11118a78f37ce
SSDEEP 192:sxZwRVyM/jK1Ml8MkT/f1sVLDjkIdpqLTHW6+WNrG0/YwqcEEIgrJ:sxZwrMT/f1sVz9iHbh/h9
TLSH
T12152E7026A34997BCCDBD20DFA55BB53D6F54522A2940E84A9FCDA0C05E7EED220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 dd72bdbd798a1b01242eedec617004bbfbb6c2b2fdbdc7224922f3e065a27f2d
MD5 6345371363e20285822de64d3a6dc81c
SHA1 356219223792b4495466b57445f5c001c4db6c76
SHA512 e8acd634b5c24a98d3071bf88ef1394741f032e59f21e0b1ac523208b2e6ceb7f3c997888111d29ca924ec1bc65a5600aabe78c81f059c7be227679cc8241541
SSDEEP 192:sxZ7RVyM/jK1Ml8UQH9T/f1sjLDS0IdpvcKr2SHW6+WNAEcdFddQ0+MTZYw9DYED:sxZ7rqdT/f1sjitbHbI1VFZpD
TLSH
T1E972D8526A34597B8CDBD21DF955BB57E7F54462A2900E84AAFC9A0C00E6FED330381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 20KB
SHA256 5a4991241d543b7ad936aeb27b42f245501dfdbd844954897f21c849956b5f8a
MD5 ae8f07574fd7775392380b142a931237
SHA1 9025a09ab6dc974eb8cf3987d4702de13ca7fe02
SHA512 096ea67caa5897d4c6b57dc8be52dc05f73dddfcdf92af7a8214042610e4594c51c930f06ddfef7e9d73946294a0d3b62e5b7fb98b9be186db4f7a4e85eada38
SSDEEP 384:sxZNn6rqUm4T/f1sjitQQHbT1VDMFZhLGWzr:s16GUm4T/fmiDHbTGnr
TLSH
T1B5A2D9535530897B8DDBD219F921BF66DBF41453DA945F88AAFCCA0C04E6AED230381B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 b3b5b371afa97094251da15ccb16dd5aeb1134f784c758143bfa5288a9161952
MD5 a7245227809955737d8407ecf7be093a
SHA1 93d52feda1764339a8b62de0103cd6bcbd84ec4e
SHA512 a14f100a0be4dc41e858071e4984d40fab4f6189d826ffd883a9e7eb5e670ea5fb9e53397dde8b6c7de1eb41359238b40716c7f9642783885768f55305b9e899
SSDEEP 192:sxZ7RVyM/jK1Ml8MkT/f1sjLDS3Idp9cB1jHW6+WNxQccXYwlcEEIg5MJ:sxZ7rMT/f1sjiYiHbKXeS
TLSH
T19562D7526A34597BCCDBD209F945BB57EBF54522A2900E44AAFCDA0C05E6FED230381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 dd983645431ff65ec8adc4b269ddac3d61859010a21672f5952b63d96e387120
MD5 1ce8af253a7183bf25f14515f58b9b6b
SHA1 12045bc13b63ccab5799fbb4d4f1dad4497b5f01
SHA512 ccade47c8d4eed17cd686c3bdc266c8922e958a3924ac523454aa2fbac650c9d05e45fddca1cf26cc851cff9f9dc8ce8ee2a892be4602903025a4b71d587ce07
SSDEEP 192:sxZ7RVyM/jK1Ml8M9T/f1sjLDSBIdpvcKr7SHW6+WNAEcdFd+MTZYwkbYEIg5MJ:sxZ7r1T/f1sjiqAHbI1FZgS
TLSH
T13162C75266345A7B8CDBD21DF945BB57D7F54462A2900E84AAFCCA0C04E6FED330381B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 a56e988f381245655f9686f36ba7adbeb1f371d000552a3013647c1f112fa93d
MD5 1b01f08a1b7249b9918aca2e2048b1d7
SHA1 c75f6a4d6a128006dfe47e4d7e385c73b1c61ecb
SHA512 9e914be165733f8c0d9908fa809978bac3931b28eb7f8b792ecedccca6e80d3d26448216d6ffa4b0a5fb0846a00a52eb94f49ee41b421e420cd9f7f9842b4231
SSDEEP 768:od4jeXmWvmKLE8F1+UoAYDCx9Tuqh0VfUC9xbog/OVhPLlrZ+dHrohecLau:od4jeXmWvmKLEu1jacPLZQdUTp
TLSH
T1DDD20A3B280CCF7E4F844E5CEC26AE976ED801CB6A584D5047FA494C03CB6EB512B49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\06cdf1d3-b695-4c71-9713-e0c03943cb59\index-dir\the-real-index
Size 3KB
SHA256 26e5bb01449daeb0dd6874166db79a514bc5bb0b521d6f9d3f112a024b4cbd47
MD5 fdd1e0d75da12915cfaeeafd4ec95d30
SHA1 c0b11737c48e90e221d5d6d840393b0acc28b4ba
SHA512 014fc04a429bc1826cff9cd68ad2b20f6081a8c50ee9e07152f15fa6950c8e3b2fe676b9e444b71a998924d58fad88d630b84872db47525d54f94fb2069a1c7b
TLSH
T1E351D85D1C4B6F17CCAC22B324B90089373675EE5A488F0324BC76397CA333E2995E48
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\834819d4-20b9-424f-9271-71c3bb438301\index-dir\the-real-index
Size 72B
SHA256 d2e161e6fbc9667afa0cc0095d711d2eed0dfd8bceba1b445ba6e91bed2387f3
MD5 032b1102d2657f5a789b3991805afd6f
SHA1 372ebf83a8e99c9924a201b1dc535b0d514f0b7d
SHA512 f6c1ee9edf4e5a81b694ab0390cbdeb64b1d0a57b5edb6b788255cf073238a53cdc8fb6c904d436d5813e9e20de237caec30f84bfe83c3a5ce1b9e027a2620ac
TLSH
T1ECA0022922D10151C12252F36A96015A3252CA208701571751D2365DCC589554A55C5D
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 81f2a120a293bfba67e8ad06c7ca76fa6e8d58389afe14373ed7b7e773b5e908
MD5 e928597bf7ae6bc437264fe92382869b
SHA1 6108da4efdb6226340d60ca95c7b6d0968298a5d
SHA512 5feee5cca104d40cc61c4c2f09ae65efa354bec0adc16055bd60b648ddee0adb455ce21c98465126693216dfc8b65366ef6a5569c782404ea7fda546d02bd000
TLSH
T174E020F63DE73D20BC7F57E628B245B44146F468C955FC8F2416E2E751B13682016C75
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 7e2d35a55b8d132e5c6eccb86116d8e6535419ad4391b3fd5ee06f2a57d56490
MD5 f7a22f1e15d81246b612c82a8013f656
SHA1 75971ace7e83a73ebc3f4acad5f9088c7dff9bd9
SHA512 ed4809c14e15a23d77b6ab9aeb69aec0b1f5af6a528a84253bacf00b6c1524f89c13b60fc4e1b4d0e23c8db40c9ba59bfc40a5996c8ab27f2b0034344e9c0717
TLSH
T18CA002B1934B5805E60517B135499141F351EC91070553535A91E0E8ACA72A09545101
MD5 SHA1 SHA512 TLSH

Submit Download

04999daadcdabfe4_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\04999daadcdabfe4_0
Size 194KB
SHA256 b7d1bcc3a4dedd48c67fbcf4c7b4a01d87b3f0725252beb377024a566632312f
MD5 3740a1e1890aee179c78c653a1f53b97
SHA1 411668e6b439f1ca155cc50dd1d1d0094d0d2398
SHA512 71703fa49303c09be58641cbab5c5e4eff74779634ce5b80d6821f6a07cb042b97870dbf133ed210b6213478dbef24f9e40dfa5d0929849f468bd4e1d4c1c4a6
SSDEEP 3072:IegF1cJu9zByRIZa8vj0QbJI1lXrZ1lThh:IegF1cc9zByRIZa8HlI93h
TLSH
T133146B316300F43BA9139E61A27F7F4E3C35A16BDD0686FCA1E4E870AEE6CB60515758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 96B
SHA256 5cadcef2e6e4fff24a2dc20392b6528275658bf3687ab7714be105808a1e035d
MD5 458f09df66edf872c99ecaf91e0036bd
SHA1 512c249624fb7472836e32e487d58ad38b353eb9
SHA512 e8d71b3570c545273be14a7ded82428ee8622283be8c6c2903d7feda5c4a0e6f53b4684790d493d3dc7edb49acaa0c83eac0031664a285bedb55d7250477014e
TLSH
T1AAB0223CF8EC8802EC00033A2BC200803BB03C203302EE0388E000808C833CBA3032A8
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 2788443f3a112529052c555d38f995610cb3598b101660f9300a066c15e2421c
MD5 c3348871e6c2a18138df17b0e64e5bc5
SHA1 742ba833de56cfad7c924cdf377047fcb1b03db3
SHA512 ccec4603da52b0fcd7d50ace912db341d7ecaa05273048812083e4885cf51e413b7881fe44c1f741d1e7987d3c1e50cc16450afcad1f674fa0f05678a33d1be6
SSDEEP 96:KYBdTRxx89ssmlxKe4mzxibDUlxSWpKKCw1k4KR2qSqIKrCX:Wvdxjf4
TLSH
T126C1D09A30BF02163D7D2509A2A4C7274F4176A37015E42B7B6940B60DA7E354CFCDED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59451d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59451d.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 e2b6f98279b5dbf9cd957e122fabc76f55b9409b6aff16d2b3d13a6d3e02779e
MD5 8bab79417100c62fb2289c87233bc2bc
SHA1 f16c7f32816054fa132017dfdbcb955be321ea05
SHA512 4ec16653258d09d0e77b4c8e11a0dca96acdf6a7e26b30864d6d2292f7972b627341d5932e86fd9cadb3cb3595739fbe7db0c50056477b90d6e3d30a8373106c
SSDEEP 384:MziFYtNn/s3n9SVHsNH8TUNTUlIlSL0b1xf+MOetB+20FQLcG0FrMA1HnQ:nFYj+9iUwg35hOqBlSQoG0fw
TLSH
T1A4C21AF244D78836D9AE8B47F73E2D164EBCC167B5816A94B3885A0CCC875BFD306811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 defd42b54dbaaeb0e0286924eaa80abab6931ecac29ee7277ff4db74d76b5b5d
MD5 b7e726c9573f9f41e8b3e4d7d55324d2
SHA1 3a8cd789a71107e683bbe47e5987ca6a18869cf5
SHA512 ceef1a8b08b0d97b6070b24ae20de51d3c3f68fa3fd3b8d43230df92e743161376c7f802af0463c43e516535a69c0609d398af58445f70da6d0d5cf79188c056
SSDEEP 384:MziFztNn/s3n9SVosNH8TUNTUlIl5T90//1f+MOetB+2eFQLcG0FrMA1HnQ:nFzj+9FUwgU1hOqBlQQoG0fw
TLSH
T172D21AF249D78836D99E8B47F73E2E164EBCC167B5816A94B3885A0CCC865BFD306811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 7d6aecd594b0c1d1c4e5934208d8b19d63147a25c47bf5aed1e703e767ade82c
MD5 c2144b081930c1e6088516af49cb9389
SHA1 48b662af95413f5575e3e4b13442329712f8bd76
SHA512 bcbfb2a48fd25fb2ebdb8f27094ea803a14efe26b47346d76064025ece839836f6811a54f9840111d139e36162037f3848b47c39ac7a0479418ccde0bbc42a8e
SSDEEP 192:EONg6hZ0QmiUydtpc/+jVqO1Qz5wOZJT9U6:EONg6o8pu+MOeK2JBU6
TLSH
T18102E83568686C778EE2AE45F48737235FE4117BE9956F84D6E81B1D00C779C2307832
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 d0c45dbdd4ba1630436bf02a75458bf18fa9a0d9767a257d5971a9d474a3823a
MD5 78d497850ab7119e36780945d45ffabd
SHA1 812f44f1806323030ce7d5bf5848ea50b67607a0
SHA512 2b933102e2642b546baf2d29706a50e29924b02f9ddc0206c5d3b12526cfefb03a6d6b60334b6906707a8eaaa4e94b6d5f8f7e343956647de33fe1b1d6d7358f
SSDEEP 384:6tNn/s3n9SfsN2GL0Rwxf+MOetB+25FQLcG0FrMA1HnQ:6j+9Us5hOqBlTQoG0fw
TLSH
T10A927C329965AC365DE69645F40736174FF4926B9AC23FD4E5EC6F0D00DBBAC230B812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 b75532bc99b4771a2835c4ae99d0082d58ffcf17500cf89e6920cfc8f4a60503
MD5 d0e060b428ab2a07214ca5af713c30c3
SHA1 649ec805a137a7457c8d19ff3f3f72cbad14a568
SHA512 8b6c635e7cbfa5adc31fcbb481967d34ec93066bcb3ea5a91826587c5a3ecdd2110dbdc5e0a29a50e07f938dc25a01680617bb8a77403a73566cb8a4ad7bf103
SSDEEP 384:MziFKtNn/s3n9SVLsNH8TUNTUlIl5T90up62f+MOetB+2DFQLcG0FrMA1HnQ:nFKj+9uUwgj6mhOqBlxQoG0fw
TLSH
T153D21AF248D78836D9AE8B47F73E2D164EBCC167B5816A94B3885A0DCC865BFD306811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 0f003f523f4f3a482608e00ba8ff0b1671c052d11a1128ce89a4edb381db4440
MD5 ba7b64131cfb0368f9f22ee4d7157301
SHA1 d480fb740505b16ec3e12ba0fe409e4117784f50
SHA512 0651afee69bc7ae3db3a38a7da2dd3018e8f022fc0d2c08b330ba640f60bf27f3a5e3a8fa8a30836d744fdfdfefad7f8cefc035cd470dacd1c351994b20fa503
SSDEEP 192:JTONX6hZ9qQmiUy0tDc/+jVqO1QtB+2by5cOqVq9U6:RONX68nDu+MOetB+2R9QU6
TLSH
T1AB120A366968AC775DE2A655F48736174FE4522BEAC5BFC0D5DC2F1C00DBAAC230B812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 4c7f9fc9adf3ed6120e3c1545d37a3f4e06b1aa92bacce62f1b55256fa277b6d
MD5 410a23a78f617a2034c41b677d4db673
SHA1 d2216aa39441fe4ee898161488586499e62281c5
SHA512 93e3381204db6cfcaa908aecf0e0e675bb62f2be83944b8cc80c378e30e8a5db7bf4bd4c6e20abfb6074777633d53653f0492cc6722bc5fc6bcf858c8a86753b
SSDEEP 384:MziF1tNn/s3n9SVzsNg8TUNTUlIlGL0R1xf+MOetB+2lFQLcG0FrMA1HnQ:nF1j+9G1wgp5hOqBlfQoG0fw
TLSH
T116C21AF244D78836D99E8B47F73E2E164EBCC167B5816A94B3885B0CCC865BFD306811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 0c394d2bec0f887f644db5092afdc929030f38a19b195270f1f6c4078c3fd1e3
MD5 5d276ae6f641247ea5f513f36c01e631
SHA1 6e1b9bd60d5c3117feb7f845fbdadf8d164c1693
SHA512 ea7b60ef743dee156da68e8c0106e74567dc6518f42f73b15a1ce1dda60788a50e863196d52c09c191ab260517b87b1690591a22b253bbe1ffc93c780e6f3cc2
SSDEEP 384:XtNn/s3n9SfsN2GL0Rwxf+MOetB+25FQLcG0FrMA1HnQ:Xj+9Us5hOqBlTQoG0fw
TLSH
T1D3927C329965AC265DE69685F00736174FF4926B9AC63FD4E5EC6F0D00DBBAC230B812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 cc0ed660d1ca1483f6b4a76276a94c123d40b6453edee2775d08f2693ad45330
MD5 31297e695b22bcb9d30c31d24a2bf327
SHA1 994dd5d5453cdb204f149f6fdc7af8a67276456f
SHA512 dc22b99c76ac2b565fd19ada28e3ba3bf794969f9ebf466beeb4a2e4387c517d78a62d134daef164e224db3f2432b392d7ed232ac9ebca407828d0339587e787
SSDEEP 384:MziFZtNn/s3n9SVOsNY8TUNTUlIR5Tw0o/1f+MOetB+2BFQLcG0FrMA1HnQ:nFZj+9Lhwgi1hOqBlbQoG0fw
TLSH
T111D219F248D79836D9AE8B47F33E2D164EBCC167B5816A94B3885A0CCC875BFD306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 758808f3e9ee0c4e9ca79141e928ffe30041bb3d620c9336705e28ea4d37a530
MD5 4148518670c05afa8ffd7a628140d867
SHA1 a083def538f3b05c927e9b66ec0f819530b6aae9
SHA512 203a6172d1acb88bbc0c48e1b2d0d4b5452ee57cdd5b3408d6e7cc920cfffb23375617b920b045589b66c8213b18c9743b9273555d2f61af4037940cc44f9147
TLSH
T13FE00200D304007FC0AE033004CB1B306771C01012D24327522021747C203147FB0CC6
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 a5b43d42a07a42bbdbb290bd72134f18c515f13a13f4b2c3b6b94c4815fe71d2
MD5 93920ee102882147760fdc90e60850a9
SHA1 9d0759bfea4a386fd04935032ef603a3a3b25560
SHA512 868645d9585d342c04be653f156c619dd19076b54918c8495e025df5463684ef954bac7b655dbf544cdbdab1fd86f0dc4442ae21496fcd0656336db2499addfe
TLSH
T1E3E001009304007FC0BE133044CB1B306B72C01013D24327522021686C207547FB1CC6
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 75605f4d702335fd0c8346bd846f416c84552107726a3c3444c72b40cfa55c8c
MD5 debfcbf4994ec9019c8deb5fab7e8417
SHA1 173a799c3184c9a362406d504af8f74826a9fa01
SHA512 b67f5aae84c59c1bf59314a696cc8e55415ff05ba6b9f8b2f73e48fd4a9d50c99048003bd03f4f4f782e0c9e7cc6a9aba070294c3cf28b94d2edea3928a30f3e
TLSH
T16DE00111D70500BFC0BE133444CB1B306772D06116E24327562021647C317547FB1DC6
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 406e8906398454cb91f15cc2d63d9252575f91c78b871a6160d9115c3b758616
MD5 dd7c181f259bc2828b4f437ed4b6c401
SHA1 ee528c4fa105974e821b2e7a1f9977dda7087a9f
SHA512 a0bdbbf659eb545c116d54256f673d3c5b162d2b4d4dadd634ee318b3355defe72c2352fcef9c3dd3539342d88849accd029b425ac0b6ae0e359468115ef246b
TLSH
T17FE00922D70900BEC0BE5734489B1B316BB2D16156E243275A602169BCA27546FB5ECA
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 2df686644978a1ca8b1109e26b38e15e308e392bb72efa443ab1d3a5bf57996e
MD5 81eb806d480cc0af38119cfbf2edec63
SHA1 19f22c066ac16162fa69b29279baa0ff4a03adc4
SHA512 d342b73654288f3784bd217900aba668710b3f58ee46f5cef5a27163de42a360ab92ae7d70f709d885d4d9ef948560eb9dc3d55c59eb09fb7c17411a8e9e9f18
TLSH
T1C0E00112D70900BFC0BE133448CB1B3163B3D07156E243275A202161BC627546FB5EC6
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 0e5146fd41f3d65b957c788ee17a786ef133fdb7a3e148a7c520c0a68051202f
MD5 f6e5045e9eddecbc5ef9f9828f3fad0d
SHA1 b06124c1444d62cb1bdaf8e1fe87e4094bb0c830
SHA512 c9dddd92219cf739c74cb2b5eaa94f854ab33de8a477aedc72c62623aff2ac3ab094eea80547c20a5c115afbd16ed5f5ae158f44b0eb9791385b69fdd8c37412
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter~RFe58e0e5.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe58e0e5.TMP
Size 392B
SHA256 83ba35dd688f8d066285957351d34418abe3b85d8d9967247c66d60e00f0a64e
MD5 372eb385c58f5ed5b4d68eafb71dcab5
SHA1 c8dcfbe79f41fc0effed786d2b12d6ea8ecf3598
SHA512 f1900254117d65eac33f9cbe83548fe8f573b9b152fec0f5cf39a8c0260f50fdee436c5160e19469c0b01cf274311ec374f299be01dec67999984a202fb3a307
MD5 SHA1 SHA512

Submit Download

08002252-5d31-4ff8-8b35-5a5062499394.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\08002252-5d31-4ff8-8b35-5a5062499394.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 bee6f69dc1b583f2a01504c05ac212d30219b2611d83d9d812515a5921f385fb
MD5 ed1ec996582d5071b7208dbd73a1ef41
SHA1 d59c3e7eaa5cd43aaf10eafd90fb8b573aaad987
SHA512 306e477484ea73ad14715c9c232377296944c7b5ffd1ca7ccde5cb0c1314c0d8748bc0621dc74a4bee60d251ad9c965f4f422b25705ba28b4bcd428494e34354
TLSH
T1ED411759A6FA2108B3B77E569FF2A86D447BB8772F0AD55D00010D4F0A62B40C972B37
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 16KB
SHA256 7fd84a4b8e5b56e8ae0b0ca2bf6df4a3fcc09f670fa797d34af72d9628f40731
MD5 a11139e861f8c50abea697f93e95f6ed
SHA1 63c5dfc3309fd81c91690610dc3c6661f2df4d01
SHA512 ee842e253fd5e1295c3d9ad10d14b6df189501d7911ef71818b048a2ba79ad2abbd84109e0f0c4723a4dec96d4ba1bc54a6bd7a4c5a587f649215a117d14a738
SSDEEP 384:Qrf+Jt9p+VH3Gmf43Bbi6JkWo9lTM6seYwK/993rowl43l0kEWUvZ:KfNHPK2fblTT+vrZgBEWq
TLSH
T1EF72C56E610F26D3C4C21378D10B095FE4F2DE8D431A07D9BB5A9F3B4AACA5E503D598
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 16KB
SHA256 be4ad531c6b4e892f0111446e97f38621a67bfe70fd9faee34af7c815339f000
MD5 ad0cdd9dd0abf75a167f2696201fa896
SHA1 44460fbe9a9c454883dfdf2ade2381a5f16a09e8
SHA512 8d806db0be0b0f3a54907584216e12cad58a2a22930a1584a1d8518852d039d33aa0c1f438b76c032cde67ab2d191a1dd0199466fcb22c2f3c8f7c404515c756
SSDEEP 384:wrf+JTp+8mzvctQwQN8rEo9oqY1ATudoW22jaXTIdydZl/kscoOg:qfl8JzFpoqh0oW1mTIQdgst
TLSH
T11872099D625F27E7C0E113B4C42B43EFDEB14DCE438407ED6B88183B05DA76654AA0E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_k3tswhhr.zrs.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_k3tswhhr.zrs.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

Banner.dll

Path C:\Users\Admin\AppData\Local\Temp\nslA990.tmp\Banner.dll
Size 4KB
SHA256 42c9387cb1749bf8338d5a6e6e8f598a22997e4cb9472da8dccc75c44b48f59c
MD5 2dffef22d117e60be69ad89cdd01dc19
SHA1 d39efb73bdc7a5c8f89c1427f0d9d284c501bf13
SHA512 9705ce9b0c2cd1eeeebcb9a951b029ca7b990cf4c4bddac2dbe1c57a6f5dca3f8b47d96a29d3cfa070c317837f9c219646489ef6435ef5014f1b143041770ac2
TLSH
T1F281633BB2F04EF7E563023300830BD3259BA9546728471A4D6791ED7A4A9D7D53DB02
MD5 SHA1 SHA512 TLSH

Submit Download

Header.bmp

Path C:\Users\Admin\AppData\Local\Temp\nslA990.tmp\Header.bmp
Size 174KB
SHA256 30b2605b256df27baa509ee27209cec3f28ee1fcfe721484bc63dbe644b961bd
MD5 6107dcfb93cad5b9ea18a60c37e3c837
SHA1 a4d8207b7ecd28e4d04ba2ec3735e174ede9f307
SHA512 54154f5da1fd737c341579607a7a278e26abab5531ef93486d518a8bad24d1d4bbaee8b4fc431ade1af7d55964715d75bb7ff0a96c32be24a41a3f8655996d82
SSDEEP 1536:RTL1VM9PTqDF7ZB29FdtXqFZOHJa/Oz8pazH3:NLkTcn0R0Ia/OgqX
TLSH
T181041848F153C90729D2CF3536AEC97A49E278504B9A64F817EA007DB0FE9F046EE572
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InstallOptionsEx.dll

Path C:\Users\Admin\AppData\Local\Temp\nslA990.tmp\InstallOptionsEx.dll
Size 119KB
SHA256 b03cedb899c8737fabb3efb1d02bb8330ee73ce667aa406a5e52a10aff180db7
MD5 b8c7fda6ec3c8a8ead7d7eccae0b17f7
SHA1 bb1444aa3300e9ab4a7a10c7913ae5e4320b953d
SHA512 52d3ce369418c9fbc7645e8ab272199dd836ebf13fe5019694f01f1686e0708853188b5a2ba8241739620dce98765bdb4fee488189d40c37222a0230b79e6e91
SSDEEP 1536:yU+yEIWirTd+OY4M8D1fb8Li7c3bSC2RVNCSivZYrgr+9MmHZ+WIwvtu1/5bCl:b+y5TlhR8DL2d14MMmHZvtq/5bw
TLSH
T19BC38D403AD1D073D1EA647C9559F37187BF7971AC6688477FA02B7B5F202809E2A336
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MultiLanguage.ini

Path C:\Users\Admin\AppData\Local\Temp\nslA990.tmp\MultiLanguage.ini
Size 1KB
SHA256 6a30f542fc48a246b26bb7c3fa3d5d037a251bc48e479404f6ec5d22c988db9d
MD5 4609c05c04eaca3fcc3ef16cad6d814a
SHA1 dfcbf4e61235c8ce708adedda5ddb4aa9670a453
SHA512 bf978dfecbd67db58b7d57566ce9b42ab561edaf9ec39be7be33b70b31a9323872468cb6c9f6696873b7f5fefd0da95970c513a9f99a8a91aa35a1f5b9db640b
TLSH
T186316D0366F88118F2FABB18FEB041309B35BC55AC7DD50D82D1090F45E9A808972BFB
MD5 SHA1 SHA512 TLSH

Submit Download

MultiLanguage.ini

Path C:\Users\Admin\AppData\Local\Temp\nslA990.tmp\MultiLanguage.ini
Size 1KB
SHA256 d54f003230d58345b3b3d1a659f9867b7cbbdff110d3e2ef366950a2ec700aa3
MD5 b8b3485993911a9871b21713ab960497
SHA1 764e8cabd5738c239db08dd81d761c3b0c48b567
SHA512 7819ff0a542a458677e84a68987950621934d453121a019e68641fb1fcdd49723527d5b97f3ab7081090f253bc202c705d817b46bf0f5fe1ea8e7d9461dae3ee
TLSH
T1E0315E5366E88118F2FABB18FEB041319B35BC55AC3DD50D42D10A0F85E9A40D576BBB
MD5 SHA1 SHA512 TLSH

Submit Download

MultiLanguage.ini

Path C:\Users\Admin\AppData\Local\Temp\nslA990.tmp\MultiLanguage.ini
Size 1KB
SHA256 13dd670d8b88ef221d9bab6f7fee7bc02a106dc1308fc05e6c7535c04a070d7d
MD5 ba063f3d5718cbce4bad24d4c487cdde
SHA1 345598f4e8656675be465f757d46fa5960de7222
SHA512 70aaebe0338cf8b890c9028933a11db79bfe351450654351795b08a3bb97fb0c4d861f747dd3d2571d012d507b1ae2af441f6e6d67acadf7bda48c8813b5d31f
TLSH
T1C0315E136AE98518F2F7BB08FFB040719B35BC55AC3DD50E82D10A0F85E5A409976BBB
MD5 SHA1 SHA512 TLSH

Submit Download

MultiLanguage.ini

Path C:\Users\Admin\AppData\Local\Temp\nslA990.tmp\MultiLanguage.ini
Size 1KB
SHA256 eaf72ebd37e43dba25e30c36dfdf499262b9c09ace9a931b473179e39437c569
MD5 9ca813ab8f00089ea19b9a47559f68c0
SHA1 d3e8f487c4f275e1a41100aff57a23e1c6e38459
SHA512 bff0295dc4d7b6e66e5012ac972562ae751f6fe1542358b813a1bf692d3ee9550d90a3dc7be35facaee893672ab53a9955f6a9e8aca5578f12e2bf3ab506b37c
TLSH
T164316D136AE88518F2F7BB08FFB040719B35BD55A83DD50E82D10A0F85E5A409976BFB
MD5 SHA1 SHA512 TLSH

Submit Download

SetupType.ini

Path C:\Users\Admin\AppData\Local\Temp\nslA990.tmp\SetupType.ini
Size 3KB
SHA256 f55f7ccfa7ea9cc492851f2407776e6c0bedfcfbebfbd6c33cb52cd6b140e31a
MD5 efb96995adf00b4bbc4462a002c59c6f
SHA1 1896073e4416a8dc9024a074038b10527aabdbdb
SHA512 a04b96bc7fc6c9e3cc09d0053e8b907a171e071032da39e64bb62621565493891f59c0956b6a1fa19968a72cc02ed14e66f00fdc71ca301b222d7c20fd782970
TLSH
T19D618D233EFC5124E1BAB648EBF58035A7397845581DC81ED1D10A0F49E5A804677BEF
MD5 SHA1 SHA512 TLSH

Submit Download

SetupType.ini

Path C:\Users\Admin\AppData\Local\Temp\nslA990.tmp\SetupType.ini
Size 3KB
SHA256 78cf0b1e53254fd18bd400d221b74cbbc98ad0c574ade290fcbb0686a49475eb
MD5 c3d4c9cc3053619b9f0674a19eeaeea1
SHA1 df8cc332d8bd361bff5cda782f3002287d9b67db
SHA512 e11d8da636c4400059f90a7acb802a25a145e0979aac2d85edb9e5006d4daf446e64e1d58b95cf81d3d0d7e55970fe21721e398e84732d377925260f95cbdbaf
TLSH
T120616C233EFC5124E1BAF648EBF58035A7397845581DC81ED1D10A0F48E6E80966BBEF
MD5 SHA1 SHA512 TLSH

Submit Download

SetupType.ini

Path C:\Users\Admin\AppData\Local\Temp\nslA990.tmp\SetupType.ini
Size 3KB
SHA256 1844602c0c90f84ccff2b541a29ad391f7360aaeb5659c39877f02d6c3b0ea8f
MD5 c3101e1f297af9fd75534a99175adcd3
SHA1 11a27ffc90161c9d8c37cb676c1d58105e389464
SHA512 bd1a1fb6d51036a55d76f5c5bad2f0160e19eb6709679b223e44469b8f7b11dbd69a9e0d4331e05e2b3bfa16ec886658d2e0092b92d73bb7a204bcfec8f11d78
TLSH
T183616C233EFC5124E1BAB648EBF58035A7397845581DC81ED1D10A0F48F6E80966BBEF
MD5 SHA1 SHA512 TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nslA990.tmp\System.dll
Size 12KB
SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
MD5 9b38a1b07a0ebc5c7e59e63346ecc2db
SHA1 97332a2ffcf12a3e3f27e7c05213b5d7faa13735
SHA512 26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
SSDEEP 192:kjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ40QPi:U/Qlt7wiij/lMRv/9V4b4r
TLSH
T1E8427C1297B089F2F151093419667F2A6FBEAC5D17F405A3CFE304C63D212CB9839243
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nslA990.tmp\ioSpecial.ini
Size 344B
SHA256 28bb063cbd9d8eec0dad21e815091c9a176f15035d5af2d41db4ea6a1f9ff3c7
MD5 55680fc0cd3ba2f74f5eebb05839203c
SHA1 302995226fce4f7025274c3817fdd2e2b5e0941c
SHA512 dc7c53a627ff278fa8961f71d955454253623a4fc176b1c0ae929db1b83d521550a27490e2e9cf1a3a27f98b0e83d8a8088b2292b9b1e96809ec215d8e2c0f5b
TLSH
T147E0E24B25E89415E09AE11CFBF98076D3387408480EC90EC2E34A4F88ECA40102BBEF
MD5 SHA1 SHA512 TLSH

Submit Download

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nslA990.tmp\ioSpecial.ini
Size 1KB
SHA256 396b7557f97eea6bbfbe9bbe1fa6aa189ba8650ea89c7872461f38c3da1fe708
MD5 308dd356bd8d39d1e54be247d0b8d870
SHA1 e4fd3b66b6cd3845fb20be244590200d6e07a2db
SHA512 ca6c4f55cb13e5b569c4ccb9cfb942117b14d8b930900146821a5533c9e44f194b658f48bbed840d049797a058f26599eb081c27a97ec675d9a741011b3c4454
TLSH
T1FD113D032EF94015E2AAF648EBF54130DB393859582DC51E81D10E0F45F9B808437BEF
MD5 SHA1 SHA512 TLSH

Submit Download

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nslA990.tmp\ioSpecial.ini
Size 1KB
SHA256 84d7edadb217569149ba9a101dd700d462b2f695ba56497ce850e5dc112ebb57
MD5 0cc83a6d3a6235c5e8ead7b05c36a10e
SHA1 273f3bee99a7c8378ed9d64225a8406d32d919a5
SHA512 413f17f2367320d5b634cf0591702f2ebc74787729f3b9bf34655176ed30dc8f3cb97095813ff826ffa389bf2d20228340a351e437f1005ceb4281ceb58f67d8
TLSH
T1DA214F432EF94014E2AAF648EBF581319B3A7859582DC51E81D10E0F45F9BC08437BEF
MD5 SHA1 SHA512 TLSH

Submit Download

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nslA990.tmp\ioSpecial.ini
Size 1KB
SHA256 4b28bade317708e73987a3aa9822093a1959c9e0b3836bbb4c4cefbd3db8d207
MD5 9a0c61e64443397b7f8e89b608b4d90e
SHA1 c5c215aaab59f00b8037deb8d5dc4af64b2f9033
SHA512 265b75b1af03a714229771849134d9bf72c1a626f72eb03397aa74a95d37e9c2931319e74a429f9008afdf26dece2ed2bd407fe19a28ceb6ec6dc35ab83bf83f
TLSH
T18C2160072EF90429E1BBF648EBF5413597393855642CC51E81D10A0F45FAA819827BEF
MD5 SHA1 SHA512 TLSH

Submit Download

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nslA990.tmp\ioSpecial.ini
Size 1KB
SHA256 31cb32d0c7f5c14caad4373dc25c2ed2ccf9b6bb5859d3505fd916c49bd5d229
MD5 bb793772baa19bb623da158c7b5634c2
SHA1 17b0d6b8a4a692606f35e07cd219b66d125efc4d
SHA512 ad03d04277fb7630c25b68152b0061e612a0d8e889973ec8a4ca8a0a10895ecd40c56903393aac4d78dda3edf7df7942820171045ec25508d53844fb8b6953ac
TLSH
T15F3181072EFD0429E1BBF648EBF5813597393955642CC51E81D10A0F45FAA809927BEF
MD5 SHA1 SHA512 TLSH

Submit Download

nsArray.dll

Path C:\Users\Admin\AppData\Local\Temp\nslA990.tmp\nsArray.dll
Size 12KB
SHA256 216d68d3f0b37bb2203b3a438a84a089e8c388608f46377ad7e7d6a2709cf9b0
MD5 da4bc09439ed21faf7620a53433aac92
SHA1 94e3347aebe16cb88b9f29f00134d9e0fb67e508
SHA512 920294456e8fee0c4137e4b4ba1389f09ade297d6ed49d78a9593d129dbb5eb048da2cbff7ac29687999991d5f38657cb31af73e2ccf6b8b9ce29480d4d81ec6
SSDEEP 192:LULA8tZt1pehCUVFpZ/XXz5F8qioPYtS/Z8i4NVhWp1h2ph30R:gLAe1peEUD/X1F8qiAFLhOh
TLSH
T14142F8429F9142F2F9F74276B9BD1930292DAD01AB2ABDDB032750582D20DE33E35753
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsExec.dll

Path C:\Users\Admin\AppData\Local\Temp\nslA990.tmp\nsExec.dll
Size 7KB
SHA256 b121689861b506dbc9c3797b49bc8a90d555cb7db58cb959165cc758391c00bb
MD5 8fe362ffdfa66269b8a64e3a87f68e52
SHA1 b5daaa60a6b8591a670da9fc3a2d6f896d55f568
SHA512 8f2904e01b0835683a0f11114a09da291ba527d867e73db2765185f780f2278debd9c5fc4281a42a6065c5ef5947bdc6239ae4c5835df62c71e1fce80d8bf942
SSDEEP 96:JXzdzBzMDhOZZDbXf5GsWvSv1ckne94SDbYkvML1HT1fUNQaSGYuHnDQ:JgQHDb2vSuOc41ZfUNQZGdHD
TLSH
T1F8E1193571C02DF7E08D89707816BD2F83F4D43627BA05A04A771AD579D0AF6EE28B42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsProcessW.dll

Path C:\Users\Admin\AppData\Local\Temp\nslA990.tmp\nsProcessW.dll
Size 4KB
SHA256 30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11
MD5 f0438a894f3a7e01a4aae8d1b5dd0289
SHA1 b058e3fcfb7b550041da16bf10d8837024c38bf6
SHA512 f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7
SSDEEP 48:Sz4joMeH+Iwdf8Rom/L+rOnnk5/OCnXeAdbdOAa4GPI+CJ87eILzlq7gthwIsEQW:64c/eFdfS/SSnkxNa4G+ueqPuCtGsj
TLSH
T11191D87597D804B1C197093276620A672FBD843603A7651FE7836E962ED0EFBE874321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsisXML.dll

Path C:\Users\Admin\AppData\Local\Temp\nslA990.tmp\nsisXML.dll
Size 12KB
SHA256 35e54b12771f671bd8d9677369eb8216b54de0608a07a92ef17a4c29a841935f
MD5 c5285d861243f3b41648af5c0ffd5678
SHA1 50012e20b898e2f1abad27a4bdca12033e618add
SHA512 92c687319e989199e392a81bbd16c00a551c1df9fc3535e98b2da0604424b148a4c379578837aacfa4e204d494c0f0b0ed4f7638cbf7462bc937b4e198631350
SSDEEP 192:3/ufSdX+LHASTxwSODR2bzdA74gB0jpYEfb:3mfSEL9lwpRv50FXj
TLSH
T1D542B5033FB6D9F7C84A1275BF8AA796D6F4630524800C06D3560E1E6F318AAFD7DA19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

downloadedCertificate.txt

Path C:\Users\Admin\AppData\Local\Temp\wrtmp\downloadedCertificate.txt
Size 476B
SHA256 4c36de43aede9c106d04c24d8f2bcbe7e74cb92b42fd88177c6ed932812bf9d9
MD5 e360e7700227921533270fa0ba500cdd
SHA1 ca21c2d3940d5543d4403e8b03a9563c2f375933
SHA512 456c20e23b4fa7a72ee32044d86f581a46fcd5b55c562085fb94dd6a00d823338bda9e313e936f6e5d0898905e3e97b3581532bb601e667cd9054d9913da1d46
TLSH
T150F097787314D9AAEA3D3CE5CC040BA1C709155A83D4E8A0A23D88173997023EF2B3D5
MD5 SHA1 SHA512 TLSH

Submit Download

script.ps1

Path C:\Users\Admin\AppData\Local\Temp\wrtmp\script.ps1
Size 656B
SHA256 1a569fbaca7103ba08baa6c817826fbb907772bb46c6c836999ca956819269e4
MD5 17444f73a11cd36991f6a7416a0ccc21
SHA1 d9e162bc3df5220403078756b41d49eebf56af57
SHA512 355091a8bf0b77d904944a2d59913941114fe2bc57b64ab97a75224668771b86d879cb580248474edb37102f6132a5bb513c31b2eccb931ea81d5bc20fba533e
TLSH
T13BF04E18DC457D13A95297B8DB1378ED8D4D81FF41825841B0F29A897299531DBFC2CB
MD5 SHA1 SHA512 TLSH

Submit Download

versions.xml

Path C:\Users\Admin\AppData\Local\Temp\wrtmp\versions.xml
Size 5KB
SHA256 fa760322211562ee18380210801229e4aaa856eef6acc0fd8f17acd53df06eef
MD5 0419a920900212168587652176729c94
SHA1 8ff62eee04235c273655a39e05feea8f83d33390
SHA512 e1bd434987f4d1a7ad83426ddd5245d037832bb405074c9282121b9164560fc9a3cee2d707bec688b313cd350591867fe133650cd589ebc21bd20a21315d6e5c
SSDEEP 48:cfixoqACD8MbRmK4pr544GMAyMiXMsItlnxoToNmiOuaJV0TiIMFu5tCt1196uIi:8lpC4OdGbXIdd6Ft
TLSH
T112C12E3B9942FFB31D9C779C71D66CDDF233603CBCAA50CE9CB98A0A4A5711A2471149
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wrarinstaller.exe

Path C:\Users\Admin\AppData\Local\Temp\wrtmp\wrarinstaller.exe
Size 3.6MB
SHA256 bbc088fc6e1b99042567144cd6601901d955703d8062e299bdb91ea7f869436c
MD5 a03af0edbd39e51377977a17184b0960
SHA1 35039beb903ed4d8b45d89d2165bea330d78a08f
SHA512 b064aebe7e9c3362d7509ed735fa5e045ee78957caecfe65d01442ffd256fb064f6f8ca11d7ef4cc773d79a31542511d1a7b038bdd44f328b2b113bec7d6d1d2
SSDEEP 98304:x4BA9vcjkuKA1ukzK5P/HVPpu1l700HzTEt:ftuKA1uk25nHVPE3oEct
TLSH
T12906232DE3D154F8E27BE634C8A28607E6B23C9E5760D2CF23E5169A1F376904E39711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memz.by.iTzDrK_.rar.crdownload

Path C:\Users\Admin\Downloads\memz.by.iTzDrK_.rar.crdownload
Size 17KB
SHA256 3d5d9bc94be3d1b7566a652155b0b37006583868311f20ef00283c30314b5c61
MD5 352c9d71fa5ab9e8771ce9e1937d88e9
SHA1 7ef6ee09896dd5867cff056c58b889bb33706913
SHA512 6c133aa0c0834bf3dbb3a4fb7ff163e3b17ae2500782d6bba72812b4e703fb3a4f939a799eeb17436ea24f225386479d3aa3b81fdf35975c4f104914f895ff23
SSDEEP 384:7FbiYdriLCwBoe6POLT9bxaF851AfS9KL6bPsn/OMrZAGE:7FbldrliOSbxr1AfS9KM+/OMa1
TLSH
T18282D04E4133B86024BE329DE1B9477AABC65B8A3CC4345EAAFC5F13C14CC30EA255A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1520-3212-0x000000006FA20000-0x000000006FD74000-memory.dmp

Download

memory/1520-3227-0x0000000007510000-0x0000000007532000-memory.dmp

Download

memory/1520-3210-0x00000000071A0000-0x00000000071D2000-memory.dmp

Download

memory/1520-3211-0x000000006F4D0000-0x000000006F51C000-memory.dmp

Download

memory/1520-3228-0x00000000085D0000-0x0000000008B74000-memory.dmp

Download

memory/1520-3220-0x00000000065A0000-0x00000000065BE000-memory.dmp

Download

memory/1520-3221-0x0000000007270000-0x0000000007313000-memory.dmp

Download

memory/1520-3222-0x0000000007360000-0x000000000736A000-memory.dmp

Download

memory/1520-3223-0x0000000007580000-0x0000000007616000-memory.dmp

Download

memory/1520-3224-0x0000000005DA0000-0x0000000005DB1000-memory.dmp

Download

memory/3660-2193-0x0000000006970000-0x000000000698E000-memory.dmp

Download

memory/3660-2183-0x00000000062B0000-0x0000000006316000-memory.dmp

Download

memory/3660-2180-0x0000000003390000-0x00000000033C6000-memory.dmp

Download

memory/3660-2181-0x0000000005B90000-0x00000000061B8000-memory.dmp

Download

memory/3660-2196-0x0000000006EC0000-0x0000000006EDA000-memory.dmp

Download

memory/3660-2195-0x00000000081B0000-0x000000000882A000-memory.dmp

Download

memory/3660-2194-0x00000000069C0000-0x0000000006A0C000-memory.dmp

Download

memory/3660-2182-0x00000000059C0000-0x00000000059E2000-memory.dmp

Download

memory/3660-2192-0x0000000006390000-0x00000000066E4000-memory.dmp

Download

memory/3660-2184-0x0000000006320000-0x0000000006386000-memory.dmp

Download

memory/5496-3356-0x0000000007D60000-0x0000000007F22000-memory.dmp

Download

memory/5496-3357-0x0000000008D20000-0x000000000924C000-memory.dmp

Download

memory/5784-3900-0x000001EBBF880000-0x000001EBBF881000-memory.dmp

Download

memory/5784-3901-0x000001EBBF880000-0x000001EBBF881000-memory.dmp

Download

memory/5784-3897-0x000001EBBF880000-0x000001EBBF881000-memory.dmp

Download

memory/5784-3898-0x000001EBBF880000-0x000001EBBF881000-memory.dmp

Download

memory/5784-3893-0x000001EBBF880000-0x000001EBBF881000-memory.dmp

Download

memory/5784-3891-0x000001EBBF880000-0x000001EBBF881000-memory.dmp

Download

memory/5784-3892-0x000001EBBF880000-0x000001EBBF881000-memory.dmp

Download

memory/5784-3899-0x000001EBBF880000-0x000001EBBF881000-memory.dmp

Download

memory/5784-3903-0x000001EBBF880000-0x000001EBBF881000-memory.dmp

Download

memory/5784-3902-0x000001EBBF880000-0x000001EBBF881000-memory.dmp

Download

memory/5828-3194-0x0000000006160000-0x00000000061AC000-memory.dmp

Download

memory/5828-3177-0x00000000055C0000-0x0000000005914000-memory.dmp

Download

memory/6116-2286-0x0000000002A70000-0x0000000002A93000-memory.dmp

Download

memory/6116-2219-0x0000000002980000-0x00000000029A3000-memory.dmp

Download

Resubmissions

Analysis

Sharing

Errors

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads