ee404371b2771b91f2909b2e1c69c3b3170801d9e7eb014ed8141d7c86baa450

Analysis

user interaction
yes
max time kernel
100s
max time network
101s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
26/06/2026, 17:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
lvrium_loader.exe
Size 823KB
Sample260626-vseypsc15w
SHA256 ee404371b2771b91f2909b2e1c69c3b3170801d9e7eb014ed8141d7c86baa450
MD5 014eccc61ff07673d9e106afc7013761
SHA1 d2ed76fcc2d8f7c8d230c59054e191e096a2ea28
SHA512 785c950378b0170f29dcd631735a448fecfdcf9a55d788aaf40fccba72b78a40c770cc51b8c51fbda6de1d3b33ebc00a220a5e0d4f7fe3aa6dde42ac1975f48d
SSDEEP 12288:ZnAVVVVVVVVVVVQhmo5UJgQnJsls9xrdSHH6fuQF2YdnCcP7Iq:ZbhmfJPneleSYdnCcP7Iq
TLSH
T11505E78256EB0CE9DDE36B7C21DBA33AA735FD748B7A4B679204C13159036C16D2EB40
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution impact persistence privilege_escalation ransomware

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Admin\\AppData\\Local\\Temp\\lvrium_loader.exe\""	lvrium_loader.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,,\"C:\\Users\\Admin\\AppData\\Local\\Temp\\lvrium_loader.exe\""	lvrium_loader.exe

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Adds policy Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	lvrium_loader.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\HelperHelper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lvrium_loader.exe"	lvrium_loader.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	lvrium_loader.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\MsMonitor = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lvrium_loader.exe"	lvrium_loader.exe

Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{SvcHostSvc64-lvrium}	lvrium_loader.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{SvcHostSvc64-lvrium}\StubPath = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lvrium_loader.exe"	lvrium_loader.exe

Boot or Logon Autostart Execution: Port Monitors 1 TTPs 2 IoCs

Adversaries may use port monitors to run an adversary supplied DLL during system boot for persistence or privilege escalation.

persistence

Port Monitors

T1547.010

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\AgentAgent	lvrium_loader.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\AgentAgent\Driver = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lvrium_loader.exe"	lvrium_loader.exe

Disables one or more Microsoft Defender components 1 TTPs 1 IoCs

Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

defense_evasion

Disable or Modify Tools

T1562.001

pid	Process
3876	powershell.exe

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe	lvrium_loader.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lvrium_loader.exe"	lvrium_loader.exe

Sets service image path in registry 3 TTPs 1 IoCs

This determines the executable launched when a service starts. It can be used to establish persistence.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NetHost\ImagePath = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lvrium_loader.exe"	lvrium_loader.exe

Executes dropped EXE 1 IoCs

pid	Process
2032	SysHost.exe

Registers new Windows logon scripts automatically executed at logon. 1 TTPs 1 IoCs

persistence

Logon Script (Windows)

T1037.001

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Environment\UserInitMprLogonScript = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lvrium_loader.exe"	lvrium_loader.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Agent32 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lvrium_loader.exe"	lvrium_loader.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WinMgr = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lvrium_loader.exe"	lvrium_loader.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\MsHelper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lvrium_loader.exe"	lvrium_loader.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NetTask = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lvrium_loader.exe"	lvrium_loader.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3876	powershell.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
5	api.ipify.org
6	api.ipify.org

Drops file in System32 directory 5 IoCs

description	ioc	Process
File created	C:\Windows\System32\SvcProc.exe	lvrium_loader.exe
File created	C:\Windows\SysWOW64\HostTask.exe	lvrium_loader.exe
File created	C:\Windows\system32\config\systemprofile\Desktop\AgentMonitor.exe	lvrium_loader.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Roaming\NetAgent.exe	lvrium_loader.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\CoreProc.exe	lvrium_loader.exe

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2404_1190866351\protocols.json	msedge.exe
File created	C:\Program Files\RuntimeMonitor.exe	lvrium_loader.exe
File created	C:\Program Files (x86)\NetCore.exe	lvrium_loader.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2404_1596438782\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2404_1190866351\manifest.json	msedge.exe

Drops file in Windows directory 7 IoCs

description	ioc	Process
File created	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\WinSvc.exe	lvrium_loader.exe
File created	C:\Windows\Svc64.exe	lvrium_loader.exe
File created	C:\Windows\ServiceProfiles\LocalService\Desktop\SysTask.exe	lvrium_loader.exe
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\WinMgr.exe	lvrium_loader.exe
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Local\SysCore.exe	lvrium_loader.exe
File created	C:\Windows\ServiceProfiles\NetworkService\Desktop\AgentMgr.exe	lvrium_loader.exe
File created	C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\MsMonitor.exe	lvrium_loader.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3928	sc.exe
2000	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4480	msedge.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	lvrium_loader.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	lvrium_loader.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Interacts with shadow copies 3 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
1300	vssadmin.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134269677169497827"	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1074038928-2032447174-945360078-1000\{E14300D9-10F7-44D5-9652-3BEEA853550B}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1074038928-2032447174-945360078-1000\{7D0F5505-7CE5-477C-A9B3-1D6A45C3152D}	msedge.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
204	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3876	powershell.exe
3876	powershell.exe
692	lvrium_loader.exe
692	lvrium_loader.exe
692	lvrium_loader.exe
692	lvrium_loader.exe
692	lvrium_loader.exe
692	lvrium_loader.exe
692	lvrium_loader.exe
692	lvrium_loader.exe
692	lvrium_loader.exe
692	lvrium_loader.exe
692	lvrium_loader.exe
692	lvrium_loader.exe
692	lvrium_loader.exe
692	lvrium_loader.exe
692	lvrium_loader.exe
692	lvrium_loader.exe
692	lvrium_loader.exe
692	lvrium_loader.exe
692	lvrium_loader.exe
692	lvrium_loader.exe
692	lvrium_loader.exe
692	lvrium_loader.exe
692	lvrium_loader.exe
692	lvrium_loader.exe
692	lvrium_loader.exe
692	lvrium_loader.exe
692	lvrium_loader.exe
692	lvrium_loader.exe
692	lvrium_loader.exe
692	lvrium_loader.exe
692	lvrium_loader.exe
692	lvrium_loader.exe
692	lvrium_loader.exe
692	lvrium_loader.exe
692	lvrium_loader.exe
692	lvrium_loader.exe
692	lvrium_loader.exe
692	lvrium_loader.exe
692	lvrium_loader.exe
692	lvrium_loader.exe
692	lvrium_loader.exe
692	lvrium_loader.exe
692	lvrium_loader.exe
692	lvrium_loader.exe
692	lvrium_loader.exe
692	lvrium_loader.exe
692	lvrium_loader.exe
692	lvrium_loader.exe
692	lvrium_loader.exe
692	lvrium_loader.exe
692	lvrium_loader.exe
692	lvrium_loader.exe
692	lvrium_loader.exe
692	lvrium_loader.exe
692	lvrium_loader.exe
692	lvrium_loader.exe
692	lvrium_loader.exe
692	lvrium_loader.exe
692	lvrium_loader.exe
692	lvrium_loader.exe
692	lvrium_loader.exe
692	lvrium_loader.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	3876	powershell.exe
Token: SeBackupPrivilege	2272	vssvc.exe
Token: SeRestorePrivilege	2272	vssvc.exe
Token: SeAuditPrivilege	2272	vssvc.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2404	msedge.exe
2404	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
692	lvrium_loader.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 692 wrote to memory of 4044	692	lvrium_loader.exe	88
PID 4044 wrote to memory of 3876	4044	cmd.exe	90
PID 692 wrote to memory of 3252	692	lvrium_loader.exe	92
PID 3252 wrote to memory of 2000	3252	cmd.exe	94
PID 692 wrote to memory of 1688	692	lvrium_loader.exe	95
PID 1688 wrote to memory of 3928	1688	cmd.exe	97
PID 692 wrote to memory of 1956	692	lvrium_loader.exe	98
PID 1956 wrote to memory of 1300	1956	cmd.exe	100
PID 692 wrote to memory of 2620	692	lvrium_loader.exe	103
PID 2620 wrote to memory of 5020	2620	cmd.exe	105
PID 2620 wrote to memory of 4332	2620	cmd.exe	106
PID 2620 wrote to memory of 204	2620	cmd.exe	107
PID 692 wrote to memory of 2404	692	lvrium_loader.exe	114
PID 2404 wrote to memory of 3632	2404	msedge.exe	115
PID 2404 wrote to memory of 4480	2404	msedge.exe	117
PID 2404 wrote to memory of 2512	2404	msedge.exe	118
PID 2404 wrote to memory of 880	2404	msedge.exe	119
PID 2404 wrote to memory of 2512	2404	msedge.exe	118
PID 2404 wrote to memory of 2512	2404	msedge.exe	118
PID 2404 wrote to memory of 880	2404	msedge.exe	119
PID 2404 wrote to memory of 2056	2404	msedge.exe	120
PID 2404 wrote to memory of 2056	2404	msedge.exe	120
PID 2404 wrote to memory of 2056	2404	msedge.exe	120
PID 2404 wrote to memory of 1924	2404	msedge.exe	121
PID 2404 wrote to memory of 1924	2404	msedge.exe	121
PID 2404 wrote to memory of 1924	2404	msedge.exe	121
PID 2404 wrote to memory of 4200	2404	msedge.exe	123
PID 2404 wrote to memory of 4200	2404	msedge.exe	123
PID 2404 wrote to memory of 4200	2404	msedge.exe	123
PID 2404 wrote to memory of 4260	2404	msedge.exe	122
PID 2404 wrote to memory of 4260	2404	msedge.exe	122
PID 2404 wrote to memory of 4260	2404	msedge.exe	122
PID 2404 wrote to memory of 3348	2404	msedge.exe	127
PID 2404 wrote to memory of 3348	2404	msedge.exe	127
PID 2404 wrote to memory of 3348	2404	msedge.exe	127
PID 2404 wrote to memory of 296	2404	msedge.exe	128
PID 2404 wrote to memory of 296	2404	msedge.exe	128
PID 2404 wrote to memory of 620	2404	msedge.exe	130
PID 2404 wrote to memory of 724	2404	msedge.exe	131
PID 2404 wrote to memory of 2020	2404	msedge.exe	132
PID 2404 wrote to memory of 3648	2404	msedge.exe	133
PID 2404 wrote to memory of 2464	2404	msedge.exe	134
PID 2404 wrote to memory of 3448	2404	msedge.exe	135
PID 2404 wrote to memory of 4160	2404	msedge.exe	136
PID 2404 wrote to memory of 724	2404	msedge.exe	131
PID 2404 wrote to memory of 2020	2404	msedge.exe	132
PID 2404 wrote to memory of 2020	2404	msedge.exe	132
PID 2404 wrote to memory of 3648	2404	msedge.exe	133
PID 2404 wrote to memory of 2464	2404	msedge.exe	134
PID 2404 wrote to memory of 3448	2404	msedge.exe	135
PID 2404 wrote to memory of 4548	2404	msedge.exe	137
PID 2404 wrote to memory of 4548	2404	msedge.exe	137
PID 2404 wrote to memory of 1360	2404	msedge.exe	138
PID 2404 wrote to memory of 1360	2404	msedge.exe	138
PID 2404 wrote to memory of 956	2404	msedge.exe	139
PID 2404 wrote to memory of 956	2404	msedge.exe	139
PID 2404 wrote to memory of 4996	2404	msedge.exe	141
PID 2404 wrote to memory of 4996	2404	msedge.exe	141
PID 2404 wrote to memory of 624	2404	msedge.exe	142
PID 2404 wrote to memory of 624	2404	msedge.exe	142
PID 2404 wrote to memory of 5572	2404	msedge.exe	152
PID 2404 wrote to memory of 5580	2404	msedge.exe	153
PID 2404 wrote to memory of 5588	2404	msedge.exe	154
PID 2404 wrote to memory of 5856	2404	msedge.exe	155

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
"C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe"
1⤵
- Modifies WinLogon for persistence
- Adds policy Run key to start application
- Boot or Logon Autostart Execution: Active Setup
- Boot or Logon Autostart Execution: Port Monitors
- Event Triggered Execution: Image File Execution Options Injection
- Sets service image path in registry
- Registers new Windows logon scripts automatically executed at logon.
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:692
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4044
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
    3⤵
    - Disables one or more Microsoft Defender components
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3876
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3252
- - C:\Windows\system32\sc.exe
    sc stop WinDefend
    3⤵
    - Launches sc.exe
    PID:2000
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c sc config WinDefend start=disabled 2>nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1688
- - C:\Windows\system32\sc.exe
    sc config WinDefend start=disabled
    3⤵
    - Launches sc.exe
    PID:3928
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c vssadmin delete shadows /all /quiet 2>nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1956
- - C:\Windows\system32\vssadmin.exe
    vssadmin delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:1300
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c schtasks /Create /F /SC ONLOGON /TN "CoreMonitor" /TR "\"C:\Users\Admin\AppData\Roaming\SysHost.exe\"" /RL HIGHEST
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2620
- - C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
    C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
    3⤵
    PID:5020
- - C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
    C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
    3⤵
    PID:4332
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /F /SC ONLOGON /TN "CoreMonitor" /TR "\"C:\Users\Admin\AppData\Roaming\SysHost.exe\"" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/watch?v=H_WN-xTp7oU
  2⤵
  - Drops file in Program Files directory
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2404
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x35c,0x7ffbe327c188,0x7ffbe327c194,0x7ffbe327c1a0
    3⤵
    PID:3632
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1820,i,4714779213803225679,7917271298575355777,524288 --field-trial-handle=2708,i,17847720782406445865,7475952053554559460,262144 --variations-seed-version --mojo-platform-channel-handle=2736 /prefetch:3
    3⤵
    - System Time Discovery
    PID:4480
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1652,i,18048633018199757520,6611213595395397305,262144 --field-trial-handle=2708,i,17847720782406445865,7475952053554559460,262144 --variations-seed-version --mojo-platform-channel-handle=2704 /prefetch:2
    3⤵
    PID:2512
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2316,i,8997206080712939445,5645924332976658963,524288 --field-trial-handle=2708,i,17847720782406445865,7475952053554559460,262144 --variations-seed-version --mojo-platform-channel-handle=2744 /prefetch:8
    3⤵
    PID:880
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3444,i,18384419902235785166,15071745977859884412,2097152 --field-trial-handle=2708,i,17847720782406445865,7475952053554559460,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
    3⤵
    PID:2056
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3460,i,13319212584039432125,15802560858167125035,2097152 --field-trial-handle=2708,i,17847720782406445865,7475952053554559460,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
    3⤵
    PID:1924
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4160,i,129349651076869904,4900703773959394803,2097152 --field-trial-handle=2708,i,17847720782406445865,7475952053554559460,262144 --variations-seed-version --mojo-platform-channel-handle=4156 /prefetch:1
    3⤵
    PID:4260
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4212,i,15251957888139491586,5384463697551193770,2097152 --field-trial-handle=2708,i,17847720782406445865,7475952053554559460,262144 --variations-seed-version --mojo-platform-channel-handle=4216 /prefetch:2
    3⤵
    PID:4200
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5080,i,8156534844335256560,7989608549615015574,2097152 --field-trial-handle=2708,i,17847720782406445865,7475952053554559460,262144 --variations-seed-version --mojo-platform-channel-handle=5056 /prefetch:1
    3⤵
    PID:3348
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5196,i,4095415161671057383,4936177961934736028,524288 --field-trial-handle=2708,i,17847720782406445865,7475952053554559460,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:8
    3⤵
    PID:296
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6108,i,1331268488385765768,14435441307170896389,524288 --field-trial-handle=2708,i,17847720782406445865,7475952053554559460,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:8
    3⤵
    PID:2452
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6108,i,1331268488385765768,14435441307170896389,524288 --field-trial-handle=2708,i,17847720782406445865,7475952053554559460,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:8
    3⤵
    PID:620
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5368,i,2709474322317598874,16650408358024957150,524288 --field-trial-handle=2708,i,17847720782406445865,7475952053554559460,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:8
    3⤵
    PID:724
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=5416,i,2448566839984395782,8587567052426274318,2097152 --field-trial-handle=2708,i,17847720782406445865,7475952053554559460,262144 --variations-seed-version --mojo-platform-channel-handle=5824 /prefetch:1
    3⤵
    PID:2020
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5516,i,10954351279591281600,15347036467792612261,524288 --field-trial-handle=2708,i,17847720782406445865,7475952053554559460,262144 --variations-seed-version --mojo-platform-channel-handle=5812 /prefetch:8
    3⤵
    PID:3648
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5460,i,7623351060848033128,14903597965151398573,524288 --field-trial-handle=2708,i,17847720782406445865,7475952053554559460,262144 --variations-seed-version --mojo-platform-channel-handle=3664 /prefetch:8
    3⤵
    PID:2464
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5476,i,10698936538667342337,7972785625894794184,524288 --field-trial-handle=2708,i,17847720782406445865,7475952053554559460,262144 --variations-seed-version --mojo-platform-channel-handle=3716 /prefetch:8
    3⤵
    PID:3448
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5880,i,3868368541678229068,7780806379510011446,524288 --field-trial-handle=2708,i,17847720782406445865,7475952053554559460,262144 --variations-seed-version --mojo-platform-channel-handle=3676 /prefetch:8
    3⤵
    - Modifies registry class
    PID:4160
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6668,i,1412941515538432040,13862277112731776965,524288 --field-trial-handle=2708,i,17847720782406445865,7475952053554559460,262144 --variations-seed-version --mojo-platform-channel-handle=6672 /prefetch:8
    3⤵
    PID:4548
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5728,i,6286702102972933847,4687724672157465741,524288 --field-trial-handle=2708,i,17847720782406445865,7475952053554559460,262144 --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:8
    3⤵
    PID:1360
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6972,i,8724085939292541934,8263477250018232041,524288 --field-trial-handle=2708,i,17847720782406445865,7475952053554559460,262144 --variations-seed-version --mojo-platform-channel-handle=7008 /prefetch:8
    3⤵
    PID:956
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6972,i,3573572516883558555,14698415070519481311,524288 --field-trial-handle=2708,i,17847720782406445865,7475952053554559460,262144 --variations-seed-version --mojo-platform-channel-handle=6908 /prefetch:8
    3⤵
    PID:4996
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6184,i,12596650285381103267,9450995255099808044,524288 --field-trial-handle=2708,i,17847720782406445865,7475952053554559460,262144 --variations-seed-version --mojo-platform-channel-handle=6748 /prefetch:8
    3⤵
    PID:624
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5892,i,2193479952086364035,10007575399546516812,524288 --field-trial-handle=2708,i,17847720782406445865,7475952053554559460,262144 --variations-seed-version --mojo-platform-channel-handle=4168 /prefetch:8
    3⤵
    PID:5572
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6012,i,15299348495974206184,8805367390138862394,524288 --field-trial-handle=2708,i,17847720782406445865,7475952053554559460,262144 --variations-seed-version --mojo-platform-channel-handle=6056 /prefetch:8
    3⤵
    PID:5580
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6092,i,11781008243463202350,6504063546843041476,524288 --field-trial-handle=2708,i,17847720782406445865,7475952053554559460,262144 --variations-seed-version --mojo-platform-channel-handle=6728 /prefetch:8
    3⤵
    PID:5588
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6436,i,10902324872271948475,12239389766365915751,524288 --field-trial-handle=2708,i,17847720782406445865,7475952053554559460,262144 --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:8
    3⤵
    PID:5856
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6008,i,4429835907043270704,11117657069397165618,524288 --field-trial-handle=2708,i,17847720782406445865,7475952053554559460,262144 --variations-seed-version --mojo-platform-channel-handle=3712 /prefetch:8
    3⤵
    PID:4152
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=852,i,15735693144520977014,11468120293390322441,524288 --field-trial-handle=2708,i,17847720782406445865,7475952053554559460,262144 --variations-seed-version --mojo-platform-channel-handle=6496 /prefetch:8
    3⤵
    PID:5408

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2272

C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
1⤵
PID:3060

C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
1⤵
PID:4872

C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
1⤵
PID:3472

C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
1⤵
PID:3216

C:\Users\Admin\AppData\Roaming\SysHost.exe
"C:\Users\Admin\AppData\Roaming\SysHost.exe"
1⤵
- Executes dropped EXE
PID:2032

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3064

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Port Monitors

T1547.010

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Boot or Logon Initialization Scripts

T1037

Logon Script (Windows)

T1037.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Image File Execution Options Injection

T1546.012

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Port Monitors

T1547.010

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Boot or Logon Initialization Scripts

T1037

Logon Script (Windows)

T1037.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Image File Execution Options Injection

T1546.012

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Direct Volume Access

T1006

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping2404_1190866351\manifest.json
Size 135B
SHA256 ba5c9096d20a482aaa1aa9e5f98ad6127d3e97c2f21de84f7c78d9b8073c8e26
MD5 fbebd68ecaa98928909421f66909c054
SHA1 99d787d90f7ed2e5ad924f9c5668eb988b5a6c07
SHA512 749a3b2be47fe28399dc763888654a3e8d397e06e8d3c3af3965bb45846a1336e6ab4ca82c82c3df846b34a2afafa2156f2690e9bf347ab175408dc0171c61cc
TLSH
T158C04C668D51DEAB00A747A56B295315E23B4B4B5044800A7AF5429C1A288964171944
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping2404_1596438782\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 bf637ca0b28ebd6e948876848ccfe71d201158d460d4ad944f124f9d17ee5472
MD5 827e00d89fccbbde703c679b5c7ff536
SHA1 6d9e235782beb4e6b38fd4db2946f9bfc725110c
SHA512 1d18100db386f25678d8dabb492ab6e15d08e2c5a7d7e6c76bc253df648e2b5438cbc4fcb5a4033a1e14afbda93b271225eb5f545f12663d6bc35ca51239fcc3
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7X:fwUQC5VwBIiElEd2K57P7X
TLSH
T148B3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

protocols.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.10\protocols.json
Size 3KB
SHA256 4fd800e7b1a5fb24b13fac2e31946d205012b7c28d8c61580b0669b2fa3517cc
MD5 1de85fec2dfcc28011a7c2aaab95eb5f
SHA1 80e8c954bfbe8f7ee5a2335c8d969ae033935dc3
SHA512 9c7dd37eb0c094b6aa05201e7c71a8f33b9db81284223bcfa595a44a6ac95d5a6820ab6f07b7aa8d26bf207454e94277bf35332e9c009ee63f083752b6b51750
TLSH
T1D1611DB79A3048090E3412B86B19B35DF63E029F1AD598EB76BE568F1F710F7245C54C
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 10e097d9c91c5ff3caf4943f063ddb248814916333b20fc4791b29b1c24d2e8d
MD5 132e21fa85085c44431bac3676e74b8a
SHA1 15e7f834e5d2ae3455f3dd783f49e35cfc83aab4
SHA512 35177ea6f78e6b0801ba1b84b0c30b182425a105f7aa792732e65aa491caafa1bbfe43f8220751fb290b81b7296ab8858e3c46888c4a6e80c02976531c324e6b
TLSH
T1ECD023336F59B5D0F2293379E11287412F2A017617C64717B218CC1CDC780C556C5BC7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 98eae6fcc56d922689f3a45ab65635857e6510c437555d4eae3a6cd68dff3acb
MD5 338a3c92e96cad1510815c958fc76de7
SHA1 e1234ace09aad728f9bde0798e2fb22ee82583de
SHA512 e29c9087bb4c9c94c8525a95c307117f14827336de29aa01f837bd02b05b3aecd1c1771970519a60972a1495e05b4f68ab34cf5e4ec9d7060f6383ac019c2ed7
TLSH
T17DD0803337C9A500F6567375F412C7412F2705741586C713A168C45CDC794C557C92C7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 85da5d101c008762046da9670ca95944217bbb1829e60a748f367ee4f9926b13
MD5 ef105d8d3e87a813544857290c28833d
SHA1 bfe7010cf80fb8cbcb9eeb5e0d0b551ece0b3134
SHA512 ae71c302652e2de890fca25723381f403f4f9ee51e2da6583977318de3e7ff00defb73b202e17a287def3ff618de86c0af96c0fca7729ef3efe0a4ba3cfdfc63
TLSH
T16FD0803377C9A100F6567375F413C7412F27057415868613A168C45CDC784C557C92C7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 30008fddec795b476270d37943c242e1357e4653024d025d11924f05257f8f08
MD5 95a0abda0c991a66ed57d4565ecc82ae
SHA1 192baedefc3872a8fb8def21aea738eb00df0927
SHA512 d2ac42456bdce769162dd9e1b96de469b182d2784381f5a9c6a24b4bb76b0229b41801c0ed948417a32af873128017e3320253ba206db4b338d659d0f09b1f24
TLSH
T119811B148AB5C982FB91B830E2E1B1043AFD4899390F3F4E2850587FFA0EBD57160D34
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58cb0b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58cb0b.TMP
Size 3KB
SHA256 01567b813214a37570b1bdb98bf7550d997689cb737d4c9aa8f20988e0658499
MD5 1dd805bb72b7f5705f44724d1e5a6b0f
SHA1 b24fd52c74add72bcb955f055e288f7f4085ed93
SHA512 449841fd975216f7fc47105f73176b08470158c398764845f3333826207c4d4aae06eeff6b21258a67c19b314fdafd987cf0e8e57a8bf05004c62254d7ceadf3
TLSH
T14561C52886B1C985F7967431F2E1B24474FD88993A5F3F4E584059BFFA0EB14B025E38
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\000003.log
Size 293KB
SHA256 419f40c080ee8a3308e44c5c3f41fc2510c86d4ff70238273dcce9569e99961b
MD5 f64a726305c966a48a4e9fdcafbf91c9
SHA1 b8d792c1c40ca7c5f5d17c8269207e0e6f487f4a
SHA512 f5cf6119e86c780c7b36307fe1d75be2927d826c64f24611ae4adff091f6194ab7c3e0e53dc267c1b9e2b54e5d858e918473a8c8c8ddc034a30de8ca777b3f11
SSDEEP 3072:7ARDPqPg6INAyEPAIyjthvPMTNPM/4tAdjPDIy7tKPfYDP2oig360EXlmPNRCr:ZY+TkM3KVVk
TLSH
T17A54E738359272E5A42EC33F1712E947D3BA89CEB5587099B4623E0C26FBB45369073D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\LOG
Size 351B
SHA256 75ca8e2c86cad6276888545371e7344aa96b55cc5ede9cd13f8b6bd017ea616b
MD5 bad145fe5df16e18a746908ce5dc76d8
SHA1 35fbe0aea57a251519a410db094c0b2a45002edb
SHA512 ff300b95e7035a079bc765a76684702351731eca4fa577c1ec172b0fde56c32e56ea12633491f822aa46de0b22877857b683bdd89af68af614ab67c8860c0cf4
TLSH
T179E0C03CCCCCC26F615060D70138BB0ED597A14FD7CDFD4D0F04D8247446148902D141
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 99e37258602657ad9618dbf53217d6fe05c0b421062b1fe464c394e350a7bead
MD5 8d573155eda483c04f072699941c1af8
SHA1 0deb33908918487dbb651a2e93351a3452cd8fb4
SHA512 220c5e932b2984eeb039869424a77724e66327589c922ffe7504fa052f332a4b0c516e9650e180a0b39af5face808a789e5322e6a37343283b05fcaa0e85d31d
SSDEEP 96:Du6VFOu9VuTuQuHuvuqu/uquUmugugVozYNtVuJQH4uRQuRWuEJRuJZPuHt1uXcP:DbIwm5wANU/vmN5o8X8/FfROpMBhn8l4
TLSH
T1C3D1BDE7C3D8822DD86116F4EA247D2ADE2D0E78C3283C29D8E5BF4B63E5471D20564E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 42f5492e066b166560b48a01246cab8023ce32e418b9a54467763d631048cc4a
MD5 94e40e089a1e2e41117ca9fe4c998350
SHA1 88e349a7efc5a0e39848afb22fb89801e9cf543a
SHA512 ce71e6db445e697bf98413f3f49180a523a6e193de16b38b07bd001732b68d6b2fce3b679105e502eb23198968ae4030ec95ae90adad1f1fdabcc7c51f958705
SSDEEP 192:sxZUR0yM/jK1Ml8MjP/fWsSd05qIdp0LFZCHW6+WNnd6/BKR4hXzYIg4J:sxZUG7P/fWsSd8jA4HbQ/ic
TLSH
T1DA52E862AA345A778CC7D619F951BB57D6F90572A2904D54AAFCCA0C00EAEEC2213C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 df46c178ad9afacb7381f7c4c9e0785155510eee83b487c177053cefe61e4595
MD5 1ab7ce83eb9782890dc715d665fca05b
SHA1 a6e126eafaf109667e78805caea2993660d52ba5
SHA512 72c01f7ac4e50606dbc3d63b510eda863e5ae4fb5966b6774225e1b5b5a5d4a5bf4336920b37c6462cd0bd3ae7341324456eb3c3ee5dfa780a9d285eda4a656e
SSDEEP 768:DL8iJcZ7pLuL7xNWvx76r8F1+UoAYDCx9Tuqh0VfUC9xbog/OVvEhALl6opdwroE:DL8iJcvE7xNWvx76ru1jaaEhALocdb+X
TLSH
T1A8F2FA3B6C0CCB7E4F804E9CEC2A7E9A6DE8018F5A98C95447FA845C03C66EE15175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\dff42bc2-9f34-47e4-b25d-fb7e6ec9a2a9\index-dir\the-real-index
Size 2KB
SHA256 b19bde4323b21160f4e65335166869f8eb0dc1a9b770354a33b3481a5d19e9ec
MD5 69f3e032063c7d78d85dfebf279a2c5f
SHA1 b4444ea52f39be3657fc097a6017fded99f9a229
SHA512 2f47f6837e265a44765b85daca90de3567edf2c8bd3ac7e04ed23229a33193565a284301f9e751416065d127af3b0ede3b91e07c0b46901fe0cf5e2e16f95624
TLSH
T10B51778CC980579DCC7562FB1D5415B297B52C24FC0CC39190A8F5A27453AA817472FC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58b4c4.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\dff42bc2-9f34-47e4-b25d-fb7e6ec9a2a9\index-dir\the-real-index~RFe58b4c4.TMP
Size 48B
SHA256 ed3151ca6dff7df93d7d3404cfd905e3dfa8e4334ef10e6e1635d5c34bbc2e14
MD5 8349358fc779078fd368b1c5fffd59ee
SHA1 7a8388e354535f475e33466d0e597fbd07fb5119
SHA512 b396e5f611ea33665a650d8e986d7a8fa9edfa4c7d37e907fba323ab3590c58c829a71f1dee952294f76a45aaa699d69114868f3cdfb64d6672a8487541e0f68
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 214B
SHA256 2ae8e6b646b0c71b8302192fc536623e43b18c9d920680c2ca9f0f2f62de9244
MD5 c83914aa7f16a41d99475aa8f82f23be
SHA1 bbe7f767893198ee3a2fbcf2ff1598520b4fc49f
SHA512 788fae6f68d02d17781983c49ade51b3dbdb8a5180b5e7a76573024b43dc56d9609bd5e89fd024a2f3bc9c981cc9658e268eae4a46aa27898541a53e5f9546ed
TLSH
T108D023D572718A5657F0D99D1035170FD2076D14DCC4DD94C704B563307DB03D801774
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 130B
SHA256 ee0220d46d847548f60b78705f9eacf1a0f945a5f03b6ca0b096683867422553
MD5 5fed8b8598d856cde4943f692405ebb2
SHA1 e41745ce2e8ffb21b0f8b4674457f26a7357d90b
SHA512 4826c75d62c2c7d62473e94c92a9ce9f76320eb87d514ac64c92572136c4f2a57bdb784b5a5731210af8d55b1b9803ce2e5fbc18c169973957aa876fb01c477c
TLSH
T129C09BE6755087570B70DACC1035571FD64B424894D4CDF8560C55476079A135841A25
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 132B
SHA256 df4faaf744ce3834b6771401fd3fde8af99fe4d2f54164bb9929654ddd015e68
MD5 a17bcc16391fa4f65bcf6f4a4bda42bf
SHA1 f404ab6760412a8b850f959ef5102f38c820aaf8
SHA512 c16daafc6673775d5a516d1e29ef7d5e6aad74c2d8d3dea3657425fbb7b76bb91d0fe3f72aeda15b47c432296f54733180d6c39449cd0f461ad184592d00d8d3
TLSH
T1F8C02BE6344003830B309ACC2035170FD20B420884C0CDF85A0C6503E179A034C00A24
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe585fde.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt~RFe585fde.TMP
Size 137B
SHA256 930e56411c9ba4bc0d39b6e0658af9da94effcd1cf3eee20c52c754c87967df6
MD5 3caa8943b88db275c784112591736103
SHA1 8531370e110dadcc0300389feb14909d50fb1868
SHA512 7bf5aa7e4799f221a27fda65bcfc7b61fde6e385491433a729a2d52bb2e347b585ef4c46983ca79bf16ae21d563758e4f5f39f51256bf8eb874b75fb3095c90e
TLSH
T153C02BE2305003430B3055CC1034130FD20B4D0888C0CDF8520C71037039A038800B24
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 a2d24bfa2bd2bf27fec7f38b86a7f4d1b6ea8bb7c370e02177092a5ca8f2daf5
MD5 22c381ceed946a9eb8a480fb49dfcedf
SHA1 8fed6c3076245a5d035fc1dd540c3be19603c032
SHA512 8ba9fbc81f24a58d032f7d1298cc18e818fa47d6059c87ec9b6533a32e383bb8c7b5276778ee2cef3b4cef4c5bf0f06b3ee0adaf8f566d4ca1fcc0e21afcf0fb
TLSH
T11AA0021605581062C81083F09C52028C321158950111171147BDC09CB950189735B004
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58ae5c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58ae5c.TMP
Size 48B
SHA256 9fb4d48b7373d00e551a35680a76ec83f47a31102c08398ae2907ccae6deae72
MD5 040646eb12f5f7a16356619fb43a2f37
SHA1 8cb19f089bda8c03aa0f547687c2bcd18f3163d5
SHA512 53cf28aad35313a38457afc00a03153fb9e48bc5eb2b014ab8a852fdf426f3a7a8306d16d02e91f0d4b5659e9b137b7f1a67450399b44b89b2c77cede2b8acce
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 d8eab63d7c12b11472af52996b2976a66c4594c7ecfd887f66133ad8036a4975
MD5 9e98b86b7c9d04a8d2bf003c2ebd626f
SHA1 4ba2166636a028329ce5f30362e0cda7bc1c202e
SHA512 2252950a9be5dd12037491c5e2285f855373b3ae82c27ebe38e9417d878857d31c954d11ff1d57923ba965e9ad130777078c3f968658550a8942944771ae2714
SSDEEP 24:Kd56f5t525na58d5Q5s5o45Y5E+57Ij5S5oKi5rha5E5o1E5y54Sm5GM5v85a5lJ:KYBIJKCEkTypEIbKxqUFVIhK+EUryFz
TLSH
T1F491821230FB16423DFF250991E4AA1B065271E77555E42B3BE911F21E2BE282EFC4DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe593dea.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe593dea.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 95fc6471be045685f7d5a2e3f74c0f205774442048d0e5fca661e742b761ac0f
MD5 ea6ed6033791828b1564e253cc149362
SHA1 1664e34ab4e9df5df5ebf9eaedc6a843ca1ec13b
SHA512 bb469f6727ffd569302c5c4e645a89cd5a366b47daa31fee1b09899ad3bfce8baf27db43420acd81ccfcd03081b75e3b0dcc921732ba2b10a1e9caf2a3d935c1
SSDEEP 384:natNn/s3n9SCsNXPeweP8sWuckqdhdlxlmn15wbAjEM:aj+9ZH/+dlxlmn12bfM
TLSH
T177929D31A8395D371EE3A54AF147331B6FA854BBD6C42F94D4E8CB4C04CA3D8270AE16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 1c33d904bb6d55f2b98228720108dd807a2a5c8c421d8a5830692104e6303859
MD5 c50ef06d7b15281fb94e840379b6533c
SHA1 73db89290f12bc11417f5a24d86553bf2531fbdf
SHA512 f7e2314ac1b9ae5ca40805f1065ff43d021c5bcf13ab4cfb0fd20ab056a13909ece527a2c5667107ae103386e94cf9b7470b9092cfc6d0737cc5771406363a58
SSDEEP 384:ntiF1tNn/s3n9Sd2sNp8TUNTUlIlyeweP8sWrc0DfYdqdhdlIlmn15wbAjEM:kF1j+9fAwgHO6WdlIlmn12bfM
TLSH
T1C1D2C5F194D78936E9AE4787B73E6E469EBCC0A3B5885984F7C44E4CCC861BFC606805
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 f198bbf121cd18c9f57b5221a8a1688ad6444369e502542709b34708596c282c
MD5 1643cb4d43a41c59461a7b1bb32fe5df
SHA1 481965f378fbbda8b877a1e287b69ac7ccd54aa2
SHA512 1a96fc267b90888887ca37aa85367ec681f7a745502126a9ff6888b704cc64450088ecf03d1718dc14fa53855a1c7e8c3518ca2e10ea30d1531335b813b53905
SSDEEP 96:ZqONk6QsjpfmUTmDK5ih/cIPURHl8h4otop5QA5DhBhPwivh50xy0SFYKIAxteYM:gONO6kDfQmiUyQiXZ903vZQiQqU6
TLSH
T12702F93968786C7B8EA3AE09F58637175FA9202BEAD42FC1D9E41B1C00D764C1307837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 420c755ba40b4a8b4ed7f89d6b26565e45e0a01201b31a73aaaad2298985cbce
MD5 f3444e317d27c88e75a003150de14fa1
SHA1 89b2e3a2ebb7d974ae789861985250641948c97f
SHA512 abc2f659f99608582d5c184f83f1dcf76cca8c223dc3a6509c9c87408252e0c1b78c7add481f583d00d9e628f0fa1bd70f1e8d3ec34c87d83abb50c37e44fc11
SSDEEP 192:0ON66kUQmiUyQHXM903vdhdlrcRYqTTU6:0ON66hnM9qdhdlMlU6
TLSH
T16A122970A8A9AC2B4EE3A505F48737675FA82077EEC59F81E5D44B1C04C76982B0F826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 321f52e87c51a93b193bd423d2dad508e27d9163b94bd5ddf82f3690ca0a5ba6
MD5 07c3e197255ab36ab28b56bb5b427847
SHA1 340727ba18659457bd2e8dd6a1fbc06a8a088d88
SHA512 8615cb06a2a29eadae0aef56b8f56f5697a64ddf4ff89349c61622f038beacb960c5344e4e944f6a7a69febacf68a032748ce439c6c37cf74fb6eaf05d0e457d
SSDEEP 384:n6tNn/s3n9SCsNXyeweP8sWuckqdhdlxlmn15wbAjEM:6j+9ZK/+dlxlmn12bfM
TLSH
T114929C31A8295D271DE3A54AF147331BAFA854BB96C42F94D5E8CB4C04CA3D8270AE26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

8e304b6c-ac47-455e-84a3-5b900578af40.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\8e304b6c-ac47-455e-84a3-5b900578af40.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 8fef4e319f2ee5c8bec251162aca593f133a526d058a0d9f239ce82819b99618
MD5 f0f25dd9edbbc2d81a293ec21caf093d
SHA1 a7f9ff5d79404458415c390a9273d5209d29a3a9
SHA512 33f9807958e9edbedd511e66a8e7cae4ac7db8d9ead6373dfa9eb8c849f54a6a94c6803b3ff36d0cbc2c81b166e043c94c96c187764b05014d590e30db4efebd
TLSH
T17C412B58BAFA1148B3B76F599FF6A86E487FB9372E07845E00110E4F0762A44C971733
MD5 SHA1 SHA512 TLSH

Submit Download

2873ed2f-eef9-4c52-8558-113ed07b8316.tmp

Path C:\Users\Admin\AppData\Local\Temp\2873ed2f-eef9-4c52-8558-113ed07b8316.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_ovuuy4ut.s4w.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ovuuy4ut.s4w.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

af5213f5-452c-43a1-a60b-0e4b75110ca1.tmp

Path C:\Users\Admin\AppData\Local\Temp\af5213f5-452c-43a1-a60b-0e4b75110ca1.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2404_1239478285\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e0b2b7b9-de08-45ad-881e-c6ab3973369e.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2404_1979529353\e0b2b7b9-de08-45ad-881e-c6ab3973369e.tmp
Size 152KB
SHA256 f83832c37a0969ce89f77b16eaa07457b03f43029abaec00eaedce2674adbaf5
MD5 d2e80cd29c43ea745d16284dc1f58ea6
SHA1 53fe0165f9f303b333be9284865c8a74f3553c0b
SHA512 375fd3e65b12f80b92a63c1cf6f0ace9fe878c1a0cb5179d869c99aad0cfde14715fd1499eab22a04f353e5f292c19d6a5aeccb43ec2ff5cd6878a5226b005ca
SSDEEP 3072:bHVqfst2F+fBXzSKmg3n0OIH1iCylcLMLgaK9enj59Ah8MuBX8Yk17CF:b1qkfBXG801idlcLMLgaOeV9A2XdBkda
TLSH
T1DBE3E13C3EDACD26C21B20F97F287587C54D8F17A10BA50BE14A84015A76B5E17E2DEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Core64.exe

Path C:\Users\Admin\AppData\Roaming\Core64.exe
Size 823KB
SHA256 ee404371b2771b91f2909b2e1c69c3b3170801d9e7eb014ed8141d7c86baa450
MD5 014eccc61ff07673d9e106afc7013761
SHA1 d2ed76fcc2d8f7c8d230c59054e191e096a2ea28
SHA512 785c950378b0170f29dcd631735a448fecfdcf9a55d788aaf40fccba72b78a40c770cc51b8c51fbda6de1d3b33ebc00a220a5e0d4f7fe3aa6dde42ac1975f48d
SSDEEP 12288:ZnAVVVVVVVVVVVQhmo5UJgQnJsls9xrdSHH6fuQF2YdnCcP7Iq:ZbhmfJPneleSYdnCcP7Iq
TLSH
T11505E78256EB0CE9DDE36B7C21DBA33AA735FD748B7A4B679204C13159036C16D2EB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/692-838-0x00007FF687F80000-0x00007FF687FE9000-memory.dmp

Download

memory/692-758-0x00007FF687F80000-0x00007FF687FE9000-memory.dmp

Download

memory/692-802-0x00007FF687F80000-0x00007FF687FE9000-memory.dmp

Download

memory/692-885-0x00007FF687F80000-0x00007FF687FE9000-memory.dmp

Download

memory/692-819-0x00007FF687F80000-0x00007FF687FE9000-memory.dmp

Download

memory/692-820-0x00007FF687F80000-0x00007FF687FE9000-memory.dmp

Download

memory/692-868-0x00007FF687F80000-0x00007FF687FE9000-memory.dmp

Download

memory/692-521-0x00007FF687F80000-0x00007FF687FE9000-memory.dmp

Download

memory/692-791-0x00007FF687F80000-0x00007FF687FE9000-memory.dmp

Download

memory/2032-58-0x00007FF784010000-0x00007FF784079000-memory.dmp

Download

memory/3060-44-0x00007FF687F80000-0x00007FF687FE9000-memory.dmp

Download

memory/3216-47-0x00007FF687F80000-0x00007FF687FE9000-memory.dmp

Download

memory/3472-46-0x00007FF687F80000-0x00007FF687FE9000-memory.dmp

Download

memory/3876-0-0x000002A6248C0000-0x000002A6248D0000-memory.dmp

Download

memory/3876-4-0x000002A624880000-0x000002A6248A2000-memory.dmp

Download

memory/3876-1-0x000002A6248C0000-0x000002A6248D0000-memory.dmp

Download

memory/4332-14-0x00007FF687F80000-0x00007FF687FE9000-memory.dmp

Download

memory/4872-45-0x00007FF687F80000-0x00007FF687FE9000-memory.dmp

Download

memory/5020-13-0x00007FF687F80000-0x00007FF687FE9000-memory.dmp

Download