hxxps://matpatgt[.]itch[.]io/chimp-rooms?secret=K9wMOeUHQblwPo3CYtWgCVCBYA

Analysis

user interaction
yes
max time kernel
1798s
max time network
1794s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/07/2026, 21:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://matpatgt.itch.io/chimp-rooms?secret=K9wMOeUHQblwPo3CYtWgCVCBYA
Sample260717-1d2f2set6r

Score

6^/10

defense_evasion discovery execution persistence ransomware

Malware Config

Signatures

Deobfuscate/Decode Files or Information 1 TTPs 3 IoCs

Payload decoded via CertUtil.

defense_evasion

Deobfuscate/Decode Files or Information

T1140

pid	Process
5208	certutil.exe
3004	certutil.exe
108	certutil.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4800	powershell.exe
4444	powershell.exe
4312	powershell.exe
1984	powershell.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2336	cmd.exe
4576	cmd.exe
2268	cmd.exe
4648	cmd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4168	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134287975831479300"	msedge.exe

Modifies registry class 11 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-552508041-2681165170-3229858294-1000\{EF366668-280B-44D4-B459-D81F2FAB57A7}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	NOTEPAD.EXE

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
2072	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4800	powershell.exe
4800	powershell.exe
4800	powershell.exe
4712	msedge.exe
4712	msedge.exe
4444	powershell.exe
4444	powershell.exe
4444	powershell.exe
4312	powershell.exe
4312	powershell.exe
4312	powershell.exe
1984	powershell.exe
1984	powershell.exe
1984	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 3 IoCs

pid	Process
4444	powershell.exe
4312	powershell.exe
1984	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
5672	msedge.exe
5672	msedge.exe
5672	msedge.exe
5672	msedge.exe
5672	msedge.exe
5672	msedge.exe
5672	msedge.exe
5672	msedge.exe
5672	msedge.exe
5672	msedge.exe
5672	msedge.exe
5672	msedge.exe
5672	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4800	powershell.exe
Token: SeDebugPrivilege	4444	powershell.exe
Token: SeIncreaseQuotaPrivilege	4444	powershell.exe
Token: SeSecurityPrivilege	4444	powershell.exe
Token: SeTakeOwnershipPrivilege	4444	powershell.exe
Token: SeLoadDriverPrivilege	4444	powershell.exe
Token: SeSystemProfilePrivilege	4444	powershell.exe
Token: SeSystemtimePrivilege	4444	powershell.exe
Token: SeProfSingleProcessPrivilege	4444	powershell.exe
Token: SeIncBasePriorityPrivilege	4444	powershell.exe
Token: SeCreatePagefilePrivilege	4444	powershell.exe
Token: SeBackupPrivilege	4444	powershell.exe
Token: SeRestorePrivilege	4444	powershell.exe
Token: SeShutdownPrivilege	4444	powershell.exe
Token: SeDebugPrivilege	4444	powershell.exe
Token: SeSystemEnvironmentPrivilege	4444	powershell.exe
Token: SeRemoteShutdownPrivilege	4444	powershell.exe
Token: SeUndockPrivilege	4444	powershell.exe
Token: SeManageVolumePrivilege	4444	powershell.exe
Token: 33	4444	powershell.exe
Token: 34	4444	powershell.exe
Token: 35	4444	powershell.exe
Token: 36	4444	powershell.exe
Token: SeIncreaseQuotaPrivilege	4444	powershell.exe
Token: SeSecurityPrivilege	4444	powershell.exe
Token: SeTakeOwnershipPrivilege	4444	powershell.exe
Token: SeLoadDriverPrivilege	4444	powershell.exe
Token: SeSystemProfilePrivilege	4444	powershell.exe
Token: SeSystemtimePrivilege	4444	powershell.exe
Token: SeProfSingleProcessPrivilege	4444	powershell.exe
Token: SeIncBasePriorityPrivilege	4444	powershell.exe
Token: SeCreatePagefilePrivilege	4444	powershell.exe
Token: SeBackupPrivilege	4444	powershell.exe
Token: SeRestorePrivilege	4444	powershell.exe
Token: SeShutdownPrivilege	4444	powershell.exe
Token: SeDebugPrivilege	4444	powershell.exe
Token: SeSystemEnvironmentPrivilege	4444	powershell.exe
Token: SeRemoteShutdownPrivilege	4444	powershell.exe
Token: SeUndockPrivilege	4444	powershell.exe
Token: SeManageVolumePrivilege	4444	powershell.exe
Token: 33	4444	powershell.exe
Token: 34	4444	powershell.exe
Token: 35	4444	powershell.exe
Token: 36	4444	powershell.exe
Token: SeIncreaseQuotaPrivilege	4444	powershell.exe
Token: SeSecurityPrivilege	4444	powershell.exe
Token: SeTakeOwnershipPrivilege	4444	powershell.exe
Token: SeLoadDriverPrivilege	4444	powershell.exe
Token: SeSystemProfilePrivilege	4444	powershell.exe
Token: SeSystemtimePrivilege	4444	powershell.exe
Token: SeProfSingleProcessPrivilege	4444	powershell.exe
Token: SeIncBasePriorityPrivilege	4444	powershell.exe
Token: SeCreatePagefilePrivilege	4444	powershell.exe
Token: SeBackupPrivilege	4444	powershell.exe
Token: SeRestorePrivilege	4444	powershell.exe
Token: SeShutdownPrivilege	4444	powershell.exe
Token: SeDebugPrivilege	4444	powershell.exe
Token: SeSystemEnvironmentPrivilege	4444	powershell.exe
Token: SeRemoteShutdownPrivilege	4444	powershell.exe
Token: SeUndockPrivilege	4444	powershell.exe
Token: SeManageVolumePrivilege	4444	powershell.exe
Token: 33	4444	powershell.exe
Token: 34	4444	powershell.exe
Token: 35	4444	powershell.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
5672	msedge.exe
5672	msedge.exe
5672	msedge.exe
5672	msedge.exe
5672	msedge.exe
5672	msedge.exe
5672	msedge.exe
5672	msedge.exe
5672	msedge.exe
5672	msedge.exe
5672	msedge.exe
5672	msedge.exe
5672	msedge.exe
5672	msedge.exe
5672	msedge.exe
5672	msedge.exe
5672	msedge.exe
5672	msedge.exe
5672	msedge.exe
5672	msedge.exe
5672	msedge.exe
5672	msedge.exe
5672	msedge.exe
5672	msedge.exe
5672	msedge.exe
5672	msedge.exe
5672	msedge.exe
5672	msedge.exe
5672	msedge.exe
5672	msedge.exe
5672	msedge.exe
5672	msedge.exe
5672	msedge.exe
5672	msedge.exe
5672	msedge.exe
5672	msedge.exe
5672	msedge.exe
5672	msedge.exe
5672	msedge.exe
5672	msedge.exe
5672	msedge.exe
5672	msedge.exe
5672	msedge.exe
5672	msedge.exe
5672	msedge.exe
5672	msedge.exe
5672	msedge.exe
5672	msedge.exe
5672	msedge.exe
5672	msedge.exe
5672	msedge.exe
5672	msedge.exe
5672	msedge.exe
5672	msedge.exe
5672	msedge.exe
5672	msedge.exe
5672	msedge.exe
5672	msedge.exe
5672	msedge.exe
5672	msedge.exe
5672	msedge.exe
5672	msedge.exe
5672	msedge.exe
5672	msedge.exe

Suspicious use of SendNotifyMessage 20 IoCs

pid	Process
5672	msedge.exe
5672	msedge.exe
5672	msedge.exe
5672	msedge.exe
5672	msedge.exe
5672	msedge.exe
5672	msedge.exe
5672	msedge.exe
5672	msedge.exe
5672	msedge.exe
5672	msedge.exe
5672	msedge.exe
5672	msedge.exe
5672	msedge.exe
5672	msedge.exe
5672	msedge.exe
5672	msedge.exe
5672	msedge.exe
5672	msedge.exe
5672	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5672 wrote to memory of 4256	5672	msedge.exe	89
PID 5672 wrote to memory of 4952	5672	msedge.exe	90
PID 5672 wrote to memory of 4168	5672	msedge.exe	91
PID 5672 wrote to memory of 4952	5672	msedge.exe	90
PID 5672 wrote to memory of 4952	5672	msedge.exe	90
PID 5672 wrote to memory of 3692	5672	msedge.exe	92
PID 5672 wrote to memory of 3692	5672	msedge.exe	92
PID 5672 wrote to memory of 5584	5672	msedge.exe	94
PID 5672 wrote to memory of 5584	5672	msedge.exe	94
PID 5672 wrote to memory of 5584	5672	msedge.exe	94
PID 5672 wrote to memory of 5528	5672	msedge.exe	95
PID 5672 wrote to memory of 5528	5672	msedge.exe	95
PID 5672 wrote to memory of 5528	5672	msedge.exe	95
PID 5672 wrote to memory of 3348	5672	msedge.exe	96
PID 5672 wrote to memory of 3616	5672	msedge.exe	97
PID 5672 wrote to memory of 3348	5672	msedge.exe	96
PID 5672 wrote to memory of 3348	5672	msedge.exe	96
PID 5672 wrote to memory of 3616	5672	msedge.exe	97
PID 5672 wrote to memory of 3616	5672	msedge.exe	97
PID 5672 wrote to memory of 4780	5672	msedge.exe	99
PID 5672 wrote to memory of 4780	5672	msedge.exe	99
PID 5672 wrote to memory of 3756	5672	msedge.exe	100
PID 5672 wrote to memory of 3756	5672	msedge.exe	100
PID 5672 wrote to memory of 3064	5672	msedge.exe	102
PID 5672 wrote to memory of 5364	5672	msedge.exe	104
PID 5672 wrote to memory of 5364	5672	msedge.exe	104
PID 5672 wrote to memory of 5364	5672	msedge.exe	104
PID 5672 wrote to memory of 4600	5672	msedge.exe	105
PID 5672 wrote to memory of 4600	5672	msedge.exe	105
PID 5672 wrote to memory of 2544	5672	msedge.exe	106
PID 5672 wrote to memory of 2544	5672	msedge.exe	106
PID 5672 wrote to memory of 2544	5672	msedge.exe	106
PID 5672 wrote to memory of 5696	5672	msedge.exe	107
PID 5672 wrote to memory of 3716	5672	msedge.exe	109
PID 5672 wrote to memory of 4576	5672	msedge.exe	110
PID 5672 wrote to memory of 2596	5672	msedge.exe	111
PID 5672 wrote to memory of 4032	5672	msedge.exe	112
PID 5672 wrote to memory of 4032	5672	msedge.exe	112
PID 5672 wrote to memory of 2336	5672	msedge.exe	114
PID 2336 wrote to memory of 3180	2336	cmd.exe	116
PID 2336 wrote to memory of 1448	2336	cmd.exe	117
PID 2336 wrote to memory of 5916	2336	cmd.exe	118
PID 2336 wrote to memory of 5740	2336	cmd.exe	119
PID 2336 wrote to memory of 3836	2336	cmd.exe	120
PID 2336 wrote to memory of 4364	2336	cmd.exe	121
PID 2336 wrote to memory of 3992	2336	cmd.exe	122
PID 2336 wrote to memory of 6064	2336	cmd.exe	123
PID 2336 wrote to memory of 3376	2336	cmd.exe	124
PID 2336 wrote to memory of 5852	2336	cmd.exe	125
PID 2336 wrote to memory of 2428	2336	cmd.exe	126
PID 2336 wrote to memory of 2596	2336	cmd.exe	127
PID 2336 wrote to memory of 3132	2336	cmd.exe	128
PID 2336 wrote to memory of 3612	2336	cmd.exe	129
PID 2336 wrote to memory of 4800	2336	cmd.exe	130
PID 5672 wrote to memory of 4712	5672	msedge.exe	133
PID 5672 wrote to memory of 4696	5672	msedge.exe	136
PID 5672 wrote to memory of 4696	5672	msedge.exe	136
PID 5672 wrote to memory of 4284	5672	msedge.exe	137
PID 5672 wrote to memory of 4284	5672	msedge.exe	137
PID 5672 wrote to memory of 3608	5672	msedge.exe	138
PID 5672 wrote to memory of 3608	5672	msedge.exe	138
PID 5672 wrote to memory of 2228	5672	msedge.exe	139
PID 5672 wrote to memory of 2228	5672	msedge.exe	139
PID 5672 wrote to memory of 2776	5672	msedge.exe	140

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://matpatgt.itch.io/chimp-rooms?secret=K9wMOeUHQblwPo3CYtWgCVCBYA
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2c8,0x7ffe8c0ec188,0x7ffe8c0ec194,0x7ffe8c0ec1a0
  2⤵
  PID:4256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1616,i,3667916680065770152,5268863705695601958,262144 --field-trial-handle=2360,i,13507343827153929138,13524153386768266311,262144 --variations-seed-version --mojo-platform-channel-handle=2356 /prefetch:2
  2⤵
  PID:4952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1820,i,16358630803515848561,3551097159982795273,524288 --field-trial-handle=2360,i,13507343827153929138,13524153386768266311,262144 --variations-seed-version --mojo-platform-channel-handle=2432 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2276,i,12506822365900460111,15640076102961274453,524288 --field-trial-handle=2360,i,13507343827153929138,13524153386768266311,262144 --variations-seed-version --mojo-platform-channel-handle=3188 /prefetch:13
  2⤵
  PID:3692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3572,i,12748702517290102265,1615444973214839779,2097152 --field-trial-handle=2360,i,13507343827153929138,13524153386768266311,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:1
  2⤵
  PID:5584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3596,i,5100141723601234010,1628797836926623802,2097152 --field-trial-handle=2360,i,13507343827153929138,13524153386768266311,262144 --variations-seed-version --mojo-platform-channel-handle=3648 /prefetch:1
  2⤵
  PID:5528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4304,i,6454871935927057825,14414313623168241037,2097152 --field-trial-handle=2360,i,13507343827153929138,13524153386768266311,262144 --variations-seed-version --mojo-platform-channel-handle=4472 /prefetch:1
  2⤵
  PID:3348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4320,i,16801568459289971483,1750357970105843929,2097152 --field-trial-handle=2360,i,13507343827153929138,13524153386768266311,262144 --variations-seed-version --mojo-platform-channel-handle=4476 /prefetch:9
  2⤵
  PID:3616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5440,i,10282688868302981302,14847848496205345893,524288 --field-trial-handle=2360,i,13507343827153929138,13524153386768266311,262144 --variations-seed-version --mojo-platform-channel-handle=4480 /prefetch:14
  2⤵
  PID:4780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5444,i,11916815457134975032,15139192957226197100,524288 --field-trial-handle=2360,i,13507343827153929138,13524153386768266311,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:14
  2⤵
  PID:3756
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6140,i,5962418901908892892,15465744154394753439,524288 --field-trial-handle=2360,i,13507343827153929138,13524153386768266311,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:14
  2⤵
  PID:3376
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6140,i,5962418901908892892,15465744154394753439,524288 --field-trial-handle=2360,i,13507343827153929138,13524153386768266311,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:14
  2⤵
  PID:3064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6392,i,8370593986957332985,11881585892882803560,2097152 --field-trial-handle=2360,i,13507343827153929138,13524153386768266311,262144 --variations-seed-version --mojo-platform-channel-handle=6408 /prefetch:1
  2⤵
  PID:5364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6524,i,8906955522150156268,6645322908045624234,524288 --field-trial-handle=2360,i,13507343827153929138,13524153386768266311,262144 --variations-seed-version --mojo-platform-channel-handle=6736 /prefetch:14
  2⤵
  PID:4600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6708,i,14235241906206656644,2323635278245250988,2097152 --field-trial-handle=2360,i,13507343827153929138,13524153386768266311,262144 --variations-seed-version --mojo-platform-channel-handle=6764 /prefetch:1
  2⤵
  PID:2544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7176,i,4799718602940731810,16529067548165669908,524288 --field-trial-handle=2360,i,13507343827153929138,13524153386768266311,262144 --variations-seed-version --mojo-platform-channel-handle=7048 /prefetch:14
  2⤵
  PID:5696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5716,i,14941390794931583031,15992516043079848858,524288 --field-trial-handle=2360,i,13507343827153929138,13524153386768266311,262144 --variations-seed-version --mojo-platform-channel-handle=5068 /prefetch:14
  2⤵
  PID:3716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4716,i,17940725423904073981,4144991351616334693,524288 --field-trial-handle=2360,i,13507343827153929138,13524153386768266311,262144 --variations-seed-version --mojo-platform-channel-handle=7396 /prefetch:14
  2⤵
  PID:4576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6148,i,229871585748258522,11348061351393369290,524288 --field-trial-handle=2360,i,13507343827153929138,13524153386768266311,262144 --variations-seed-version --mojo-platform-channel-handle=4496 /prefetch:14
  2⤵
  PID:2596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6896,i,12753706183450925078,7501502539371974155,524288 --field-trial-handle=2360,i,13507343827153929138,13524153386768266311,262144 --variations-seed-version --mojo-platform-channel-handle=3900 /prefetch:14
  2⤵
  PID:4032
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\AutorunsLite (1).bat" "
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2336
- - C:\Windows\system32\reg.exe
    reg query "HKLM\Software\Microsoft\Windows\CurrentVersion\Run"
    3⤵
    PID:3180
- - C:\Windows\system32\reg.exe
    reg query "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce"
    3⤵
    PID:1448
- - C:\Windows\system32\reg.exe
    reg query "HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run"
    3⤵
    PID:5916
- - C:\Windows\system32\reg.exe
    reg query "HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce"
    3⤵
    PID:5740
- - C:\Windows\system32\reg.exe
    reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Run"
    3⤵
    PID:3836
- - C:\Windows\system32\reg.exe
    reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce"
    3⤵
    PID:4364
- - C:\Windows\system32\reg.exe
    reg query "HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices"
    3⤵
    PID:3992
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon"
    3⤵
    PID:6064
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved"
    3⤵
    PID:3376
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler"
    3⤵
    PID:5852
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad"
    3⤵
    PID:2428
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers"
    3⤵
    PID:2596
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Run"
    3⤵
    PID:3132
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Office\Outlook\Addins"
    3⤵
    PID:3612
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -File "C:\Users\Admin\Downloads\_alite_tmp.ps1"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6612,i,15817860526448940944,4111434150204835659,262144 --field-trial-handle=2360,i,13507343827153929138,13524153386768266311,262144 --variations-seed-version --mojo-platform-channel-handle=6572 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3748,i,16683178760265238623,15177723470246896036,524288 --field-trial-handle=2360,i,13507343827153929138,13524153386768266311,262144 --variations-seed-version --mojo-platform-channel-handle=6068 /prefetch:14
  2⤵
  PID:4696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6412,i,12733966372100579371,1461486190703554506,524288 --field-trial-handle=2360,i,13507343827153929138,13524153386768266311,262144 --variations-seed-version --mojo-platform-channel-handle=5484 /prefetch:14
  2⤵
  PID:4284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5584,i,1619692617959596614,16183436916083848412,524288 --field-trial-handle=2360,i,13507343827153929138,13524153386768266311,262144 --variations-seed-version --mojo-platform-channel-handle=6704 /prefetch:14
  2⤵
  PID:3608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6504,i,17505631382458158216,1130617227907189804,524288 --field-trial-handle=2360,i,13507343827153929138,13524153386768266311,262144 --variations-seed-version --mojo-platform-channel-handle=5556 /prefetch:14
  2⤵
  PID:2228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5536,i,13837165079359428131,1767936525724508631,524288 --field-trial-handle=2360,i,13507343827153929138,13524153386768266311,262144 --variations-seed-version --mojo-platform-channel-handle=6428 /prefetch:14
  2⤵
  PID:2776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=3772,i,12281753681611034470,1434620589489311544,2097152 --field-trial-handle=2360,i,13507343827153929138,13524153386768266311,262144 --variations-seed-version --mojo-platform-channel-handle=5296 /prefetch:1
  2⤵
  PID:5428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=4460,i,10342436180766589468,2856544336426565250,2097152 --field-trial-handle=2360,i,13507343827153929138,13524153386768266311,262144 --variations-seed-version --mojo-platform-channel-handle=4448 /prefetch:1
  2⤵
  PID:3456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7076,i,8725020552936102893,14714654900611617155,524288 --field-trial-handle=2360,i,13507343827153929138,13524153386768266311,262144 --variations-seed-version --mojo-platform-channel-handle=6756 /prefetch:14
  2⤵
  PID:4792
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\AutorunsLite (2).bat" "
  2⤵
  - Executes a command shell one-liner
  PID:4576
- - C:\Windows\system32\certutil.exe
    certutil -decode "C:\Users\Admin\AppData\Local\Temp\_alite_14790.b64" "C:\Users\Admin\AppData\Local\Temp\_alite_14216.ps1"
    3⤵
    - Deobfuscate/Decode Files or Information
    PID:5208
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Normal -File "C:\Users\Admin\AppData\Local\Temp\_alite_14216.ps1"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    PID:4444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7008,i,14049226279786428063,14102221727023978454,524288 --field-trial-handle=2360,i,13507343827153929138,13524153386768266311,262144 --variations-seed-version --mojo-platform-channel-handle=6996 /prefetch:14
  2⤵
  PID:4712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=600,i,4769462364414589035,9956798278660260013,2097152 --field-trial-handle=2360,i,13507343827153929138,13524153386768266311,262144 --variations-seed-version --mojo-platform-channel-handle=5640 /prefetch:1
  2⤵
  PID:5780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=6876,i,11503562099476633911,13136663549390252847,2097152 --field-trial-handle=2360,i,13507343827153929138,13524153386768266311,262144 --variations-seed-version --mojo-platform-channel-handle=7000 /prefetch:1
  2⤵
  PID:5424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7020,i,1884769582458025184,12181043314793595183,524288 --field-trial-handle=2360,i,13507343827153929138,13524153386768266311,262144 --variations-seed-version --mojo-platform-channel-handle=3084 /prefetch:14
  2⤵
  PID:5648
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\AutorunsLite (3).bat" "
  2⤵
  - Executes a command shell one-liner
  PID:2268
- - C:\Windows\system32\certutil.exe
    certutil -decode "C:\Users\Admin\AppData\Local\Temp\_alite_15600.b64" "C:\Users\Admin\AppData\Local\Temp\_alite_25613.ps1"
    3⤵
    - Deobfuscate/Decode Files or Information
    PID:3004
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Normal -File "C:\Users\Admin\AppData\Local\Temp\_alite_25613.ps1"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    PID:4312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=4436,i,12095531223459632814,12895231569680997665,2097152 --field-trial-handle=2360,i,13507343827153929138,13524153386768266311,262144 --variations-seed-version --mojo-platform-channel-handle=7408 /prefetch:1
  2⤵
  PID:3992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=5296,i,6217492366943924257,11283245391555806361,2097152 --field-trial-handle=2360,i,13507343827153929138,13524153386768266311,262144 --variations-seed-version --mojo-platform-channel-handle=3736 /prefetch:1
  2⤵
  PID:5532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5324,i,9958237036808506555,7570554926003650790,524288 --field-trial-handle=2360,i,13507343827153929138,13524153386768266311,262144 --variations-seed-version --mojo-platform-channel-handle=5504 /prefetch:14
  2⤵
  PID:2800
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\MatsTools.bat" "
  2⤵
  - Executes a command shell one-liner
  PID:4648
- - C:\Windows\system32\certutil.exe
    certutil -decode "C:\Users\Admin\AppData\Local\Temp\_mtools_17514.b64" "C:\Users\Admin\AppData\Local\Temp\_mtools_32723.ps1"
    3⤵
    - Deobfuscate/Decode Files or Information
    PID:108
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Normal -File "C:\Users\Admin\AppData\Local\Temp\_mtools_32723.ps1"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    PID:1984

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2140

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1596

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\AutorunsLite_Report_YRWKJLDU.txt
1⤵
- Modifies registry class
- Opens file in notepad (likely ransom note)
PID:2072

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2660

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:3236

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Deobfuscate/Decode Files or Information

T1140

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

342a9bb7-bce4-4f37-a5c4-ef7e4e60992f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\342a9bb7-bce4-4f37-a5c4-ef7e4e60992f.tmp
Size 42KB
SHA256 015780cf891c444f60b6bb37314c76d578197b57481b8317c20a1afb02157d3d
MD5 3e658061e8e0f770dbf1d4cfa0dbe30d
SHA1 cdc3f60591b0417765fee9c5d145deaceac4974a
SHA512 cb79bfc7eb41e27f294664ecb1e7cd719a1865db6e2737747d7dc22c7176f8aa579ad95d6cb05d9b7c504dbda4040383060b8907ef1e62d43e3f804d47ed8b14
SSDEEP 768:VFvj+9Z3dwg3i4RKmp8+p3bd66j+4BRv86aLIWFb9MW:O9Z32a8+p3Z6n4yrb+W
TLSH
T1BB136BF298D78976DCAD8B47B77E3E425EBCC163B6801984B7C86A0DCD461BFC206815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f8dff5315a0bd3856381f405c1a16257337fd6ff2d8043dd8bea22404cd35129
MD5 5e53a2cd139f0cce4f8ceab3e015f7da
SHA1 1bd884dbaaa352a724c53bfb8f4bfad2623c93f5
SHA512 27cc4cb62f9aa4af6b521efd824b001f3b689bae2ffe57263da18e2bb22d0b13ba656141d7e6ea1d1c202d5f461a44243a00d604f78bd5b04fe6b8512e260ac1
TLSH
T178D02B1463108D04D441F13214D13311B1110833A80C96440050E1284CB634206738DD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1f3bc43c50f7d0fa02f98500baf5d78052a5560603459a9325b17de989d121f4
MD5 46a6445fd2c83830bb8c6e03f85bafc0
SHA1 46b07e35efbd47692fdc81ef0e82e2964da2831b
SHA512 800f82b05756fd6fab3fe29924147f0b86afeec21da661e646b431c6ca03903eb45bb09803f5cdaf3d2d1bb16f95d0f2e53a1f9ddde57505b0f3e1580c384ed1
TLSH
T188D02B1063208C04D441F13214D23311B1010833540C96440150E1384CB634206728CD
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 b34c9cb684f549d4c7408a77587c4a9613033d42393b8469ad350c414588c892
MD5 0cef5d0a8826a1c681396b950a18803c
SHA1 8763834be7e7272c49acae905244419a8757dee3
SHA512 9c82839df2e14c03fc3fda2dc86708d459b9df3ae98e2aba01a2d99cbd3f819eba55b12690e4b6a7b7a602b706078a6e5dc438a9247e43219a68bf64084ec571
TLSH
T155E0268505CBCBAEE250674B816E570C9680364EA3C8BA8A778488D87281180F382FA0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 2ab1d2523f3e54b2bb642d21ea9074715f03c867f45d3f311109829e50fef2ab
MD5 f01159ad90087749834d5bf67c80076f
SHA1 c136beb215950d22ab368c70c977be0ba5729395
SHA512 8bc69bb5c34c01d4fc536f95e21820b9cde6ab6f1c8951628e609a3a449da36d382be355acddacc0023eef655e23f0caa8ef9881f957b3060104fc7904db58c1
TLSH
T1FCE0208544C5C39DD2C1694F82F9770C91803B0EA7C4BA491B8084C47201AD0B7D57E0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 2a78b5ac15710ad08966daefcc22cdf664dd2d6b351e0d323b52dc3000fa94e0
MD5 45ab30e53e817a62bad399c41a5de0a3
SHA1 4fc791c6bfa2e851ade3620f559e1ce0bc602f55
SHA512 493693213ae0d0ff1e0b23372d5301dfca2670c5d301d8b5a3bc3956c7ed5e0480bafdeacc698997dc90b2491b3fe7d01a567ce4781014b1099bed6d4d5d3907
TLSH
T11AE07DC915CACBEEE3546757C26CA70C82C0360EF2C8BF0A574484D47281840F3D3AA1
MD5 SHA1 SHA512 TLSH

Submit Download

f_000068

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000068
Size 71KB
SHA256 de6c2421a670d8814709136a89d788b7a4eef2e711c0fc13fe2a717d1f367df4
MD5 ac7c55c87b3445c0af52abd9be5fd9f6
SHA1 4f3474d44fd507f27caa57051cc9084fa9c28b90
SHA512 33dd66bb44ac03d39f761a50b0239b2e2361350b2c5cb7f02db3a757aca4c52a32c95cdb29944b3a7379a9d80e95016338c4709a7812d4be37cf396df45434b2
SSDEEP 1536:AfpByKZNePMBSmjsBnNJA8XYuAOl9tZDAyUGJG:QHDePMBSFJA8XYMBEIG
TLSH
T10163014871D019F1FFD38963D29B960B576700FC1451CA6E9E4DCBA1F0122DAA2B98EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 8cd7da41769cee072dd82a2cc83fd063bbe4247825e6a912aee40f2f161d622d
MD5 740c4ccf928bb7cace8a59f445d4dbaa
SHA1 210187e089db9ecb9105046a62718856b53d090b
SHA512 dcf20179dd9f1f454d2953b09f24fc55e2209c42ca149d81e2a1289d97693624a7872530b4d540584d1dd4ba83ead7e90cc8e36b7b04b97793d7bef5c84fac0e
TLSH
T10961CFB807B12AF2CBA446764AE1E50E32F8889500B3DE5B40401CF55B07F5D57D2FAB
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 f3632988c33e1af3fdc66ed3bdae02dfa6c1450293d5964f3af7ba75796a2f83
MD5 492a99f76bbb27548e3f295c8225567c
SHA1 87a148758fe2560ed1cf2b525c008ae681566f27
SHA512 fce240c33d2589a7784d2a8705e7053265f774beae400c483a620692b21b0089c4c0ebe30038da81d1d50339024c2c0f2202eed4ab2b023455af622b081e8ee6
TLSH
T17E61C0B807A12AF3CBA446764BD1E10A36F8889600B7DE4B40401CB15B07F6D57D2FAB
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 9b4f8ba4d5ddada06d16ea2dfe2536e9063a5c185964e075e9843e5daf7c04e2
MD5 7c70787652b7c35862222d89ea745fac
SHA1 3b240d759467f2cdd7b81369b76323800ae8c5a4
SHA512 24507f38e72a00fec1670f47d45e2bc8c5c487444aa492eea998a7eeb621183f35b5bef6085497b501c0a3e0cee07f25ba41a839db1a4299c919c63c969dbe5a
TLSH
T1ED61D1B807B12AF2CBA4467A4AD1E50A32F8889500B3DE5B40401CF15B07F6D57D2FAB
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 17b36828fa4c085d4a7f0a5e7b37ba7a499273204fb6e1d9e958c34757acf9d2
MD5 e83fa946c1976337b6e4e10005863066
SHA1 b02a6c2749633161ef3ee40e1a5492388db18ab1
SHA512 c35390b668a24b5128234c09998287fe1e6f4d7bf1eefafc2392c899a2388d17a07573e5abd00e24c6fc9de6f63ad5ced1d2c8834b240cbcd5112c2186954670
TLSH
T1AB61D0B807B12AF2CBA4467A4AE1E10E32F8889504B3DE4B40401CF55B07F9D57D2FAB
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 81d62706165da06521f763d2f548ca2a053178d2c0ea31eaa6a9bb12b021cdbd
MD5 04837c8aa9527ab59ce5722007708329
SHA1 0ef93cd4054185eaf8c1c7a657fdb51f776f5d9b
SHA512 6ac84c73e929423b2f8d949162a1b69cbc0979fd5c377d2e6f5db028d8073dc960c4b0d5e4ff2abb7080e1e57ae0c94529b3df37bce4b10ad9679fd4e6a47b60
TLSH
T1F261B0B807B12AF2CBA4467A5AD1E20A32F8889540B7DE4A40401CF55B07F6D57D2FAB
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59d586.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59d586.TMP
Size 2KB
SHA256 d82e3fba90f192220bad5cc80d5b6cfa585a5ec656f398d519370be82e3eaa33
MD5 9b86f7fea0f8b97c9fdbc7314b71a309
SHA1 971d4c9a75d23acf5155cf0551e992cc505805e2
SHA512 c9b32698605a6c443efa1953ce58bb83452a2cbba136d1f1b6da6194658991129963cc80b1085ba0b52d70ab126217cc7913c6ffee6f8e338712902de3097923
TLSH
T156519EB807B129F2CBA446755AD1E60A32F8889A00B7DE5B40401DB55B07F6D17D2FAB
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 85941a92ba4e2e6b6f750723ade4418ac4f7a661fad307a89e908fb93604fd4c
MD5 4c7a5405371b65ac7f14e967b614b1d6
SHA1 ae4aefb1fdde9b784ec05a6c94a0ffb2dbd15d5b
SHA512 74128139bad697ffe4e2c22e9e35512f1eed76c23a51f75042097f6e8b308c8bf18741b6843523ee6cdc1369bff06f92f014015559cb73b332baaa5c2b46cf45
TLSH
T12861BEF7C3F4497DCA0156F4AA156F2BDE1D0955436C3C1A89E4AF1BA3E2471E280A4F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 8fd25b873dcad2ebf55cd43a53b9b82d15fdb945a825cac3383a9aea180c9a61
MD5 637b76b2c04d701e482a1f0a99a8e99d
SHA1 3d5e1fa2d0af7508b794d68f31ad3dff8ec59af8
SHA512 694bf919c39c4b3d1f24fbb5bc781b165a3fa12f0f10f332dacb194c679e2c0e552b9f95fdb3fa4587a6bf34e7b13ef413afdcf44760523d2b64cc7fd07525ff
TLSH
T14851AFF3C3F4497DCA0156F0AB156F2BCE190955436C3C1A89E4AE1FA3E28B1D28094F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 4fbfe61125dc07f01398c9ce8805d519cd1b2f47b93a6df9078195f28caf155b
MD5 9a6ecae10b8a12982bfd5571c7ce84cf
SHA1 0ec4deaf3379b25e970bbc8b49ad4168e097f323
SHA512 2ce3bf08b66700a21d68e98ffaa2fcf274e68c761d0b78bfb2b01e16c4408e4945a5feb48e8ad87b4aabd9d304ca6371c59879efda46e0d5f83e3fe33e0223fe
TLSH
T11061C2F7C3F4457DCA0156F0AA156F2BDE1D0859436C3D1A89E4AF1BA3E24B1E240A4F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 a9eec4983e250c0111bc710e2d480b9be416813347e71e5af7e199fa261ff5a0
MD5 b9a82d04f82730e065f34965feb49fa4
SHA1 614149d18462d8957a6afdfc03ac0422adf4de7a
SHA512 f78de7d2d7547d25d05b23ee72d2e2cf6909317da8f304970ec42fd94056c60596edb37fdf55050e6ee74104e302858f2ebbff1bbb6f18a8bf98fea9bf7caf07
TLSH
T19561D1F7C3F4457DCA0156F0AA156F2BDE2D0955436C3D1A89E4AF1BA3E2471E280A4F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 b810bf20096850663e8a93bffae86a70983b829389cfc8e3cb8105db0153b692
MD5 a1fc323786db330db2e1e5969652b357
SHA1 78011677b267f809496c045a0f3a3654fc347520
SHA512 f27ad17ee262574640e502d4cf0ad61522ad9818728b812e95ec631f1120ed60635a9a50924762705093bfcd2275e0e5e589b35f5ebd56a84c62636136b330a3
TLSH
T18061E0F7C3F4457DCA0156F0AA146F2BDE2D0855436C3C5A89E4AF1BA3E2471E280A4E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 5b272c0245bec48890806a794ff1ae5e84dcb3fa43a15cac574bd788e08aaf3c
MD5 f81924147e38935f7374e6323318a3f9
SHA1 0123e13b7f794aa9ed8cbe8c75c6692b56e55182
SHA512 cafe7fdd89a767ae5ac4e429a28addd3de6d75f37fc3b0447b6367064c6941bc834130d699ab7f2d40998ca5e93021929b0024cecea7c01d341d7d85133f3f10
SSDEEP 192:sxRUkRpb3/fYsGiGyDde5lSr2zoD8pWlr/g6+WNs9C/YCruOOlGoIgIJ:sxRf/3/fYsGidc5lTQ/5v/Pas
TLSH
T17332A6166E28A93B8CC7E61DBA55BF53D2F95032A1D01E48A7FCC60C14E67DD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 7bc7c26a79b814dddd04f4e000a3955178c409e58accf4e65ca7c1938655dabf
MD5 1cddd53b10bfb04278709d667895566a
SHA1 fb02f5ffec7f1bcae464089f2c75a64db0554c30
SHA512 fd65caff4b4744514acad3425ac98301ec5cc193ebd5ef03e46fc0b4ed7921f40f09e62a5d48e056ba94cb80d91a93c4213ae281c4dd859efc613138dc9b4c3e
SSDEEP 192:sxRrkRpB3/fYsFUGyDde5lSr2zoD8pwlr/g6+WNs9C/YCyuOOlGoIgDBJ:sxRg93/fYsFUdc5lTy/5v/Yaf
TLSH
T17942A616AA28993B9CC7E60DBA55BF53E2F95032A1D01E48A7FCC70C15E67DD120741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 bdfcec564c0e7bceb2179cf20291aa1657959611e285f9e31b89accd27d193e6
MD5 74fa1473b82e337b0883be37c9ead3d6
SHA1 284776e1597d3b556a7df34596ff78726ff76939
SHA512 245bc301b3eade64e82e7b6fae1c4813a2c1989b16b0e8026eabb1386126b75c454b4270f77d8bdc3488a8f4be98da7e5a6848bf47368c119d4aaf464c6c19bf
SSDEEP 192:sxRrkRpO3/fYsFUGyDde5lSr2zoD8pWlr/g6+WNs9C/YC9uOOlGoIgDBJ:sxRgC3/fYsFUdc5lTQ/5v/laf
TLSH
T17E42A616AA28A93B9CC7E60DBA55BF53E2F95032A1D01E48A7FCC70C15E67DD220741F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 2091ea28cb815ac4dda4ad4875f826a955451de337df3010ec45923237f139cd
MD5 bd39eb2776431312536a9765dd994ae1
SHA1 aa1ce373ebd675d0e43e32c2930b0072ef650354
SHA512 68d8496032461fbc351406cd939495155f07354fa03aed7f2de4ff4a16dff7ce20a8bcb8249fc352f05154012145b093d101599c2aa0b8fe3549c8d3767de2da
SSDEEP 192:sxRrkRpO3/fYsFiGyDde5lSr2zoD8pWlr/g6+WNs9C/YCruOOlGoIgDfJ:sxRgC3/fYsFidc5lTQ/5v/Pal
TLSH
T11242A616AE28A93B8CC7E61DBA55BF93D6F95032A1D01E58A7FC870C04E67DD220741F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 26KB
SHA256 10bb830eb18bafe919be068a1feaf23ecc7b6c5e3ff03e27a9e99d7b96fbbf53
MD5 45a9092cc4badadf7fd821986051b99c
SHA1 b157fadcaeeaaac57ec3d7fce6c2f39d715023f3
SHA512 bf69e3884ba2449461d0c5d138c4204e6c85decde35ad4c9c86e132428753cee8fb8920740b482845dabf503a95b9c07fbb560e068b920c5c399692ee129ff95
SSDEEP 384:sxRgC3/fYsFW66s8qMpRiYnazAW8pZS15posJWeT+Hdc5lTy/5v/Waf:scC3/f5W4Mnc7WeT+HdEle/5XWe
TLSH
T1EBC2F7059928C83B9EC3AD18693D7E33DAEC506262C5DEDA56ECCA0C019E1F9AB07457
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 26KB
SHA256 b31c83c604651e1e07d442822584025e5acb96809eb52efac9e02183023c8689
MD5 2c4b9ad0de1afe2a81b3a9ac73580dd7
SHA1 1b1d683e4b34627857e2f0246e0f574e427d8f4f
SHA512 cc929355fb22dfea6ccaf22772e5f15ff00d8c2f59233c58480257868a61580c19be5fb23fd7bc3c3db345cdb62bef74f8109c1bb7f259bf96553a216d53dd04
SSDEEP 384:sxRg93/fYsFW66s8qMpRiYnazAW8pZS15posJWeT+Hdc5lTy/5v/Yaf:sc93/f5W4Mnc7WeT+HdEle/5XYe
TLSH
T18AC2F7059928C83B9FC3AD18693D7E33DAEC506262C5DEDE56ECCA0C019E1F9AB07457
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 9af3bbe18cdbec5f65fdf1f8a823b094220a2476c539ae5664059b76ffba3698
MD5 59f5b6d6008cbd903ef2a1a525922079
SHA1 83bc771b0fa858994c0b079f705afd6fa46ac02f
SHA512 1ab12edf6047cc8dfcfc6c182e42d907d02de9d72bb9be1d7ea05b3d11fc86197219731bfa54b957ab8986058d95f4c782f9847a4524a42c7792e4769e1a33d3
SSDEEP 384:jjm+vhKfCtgQCFf4+KhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVmC9qyRvzroZSj:jC+vhQWgQ+f4+8F1+UoAYDCx9Tuqh0VY
TLSH
T115B2EA2B600DCB7F5F800AADAC196FD76DA802CB97589D4047FED94C02C77EA92194DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\d24e123b-1ea1-4f2b-b26f-1ce25d3e458f\index-dir\the-real-index
Size 360B
SHA256 6479f9c8cc9526e3eea46f2bf043d784e2fbd5d2fb62a67cfabc9de94d667958
MD5 de1ee1e4c20a3cf310d6b86c34908860
SHA1 a79a2f404a79675f787c427ceef49326823086d7
SHA512 22a7dd1f52eb98ece591675efbd1c6e56e95662ae97646e8a62756e86fdff746f6c68fc706055e324f0c1b6956571dce673922f92792887a81fb1f317a8898fa
TLSH
T1BDE0EBCF8CA24813C9212CBA0673102D333B03FE2600AA2610BE102EA492A3CC184709
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5df7e0.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\d24e123b-1ea1-4f2b-b26f-1ce25d3e458f\index-dir\the-real-index~RFe5df7e0.TMP
Size 360B
SHA256 8da2a5293e10d3461d7c7c3861346804de58b2074d544109bf77e44776e1094d
MD5 3d4ce4822c9f3720c759600ad6b766c1
SHA1 2c43a834fe117bf88374377917ffcfa5ca39d6d2
SHA512 e860cb6e89b251a10e9767f62d8fd5333a5156f04e0eca96737d4ad4fe74c78f289552bce8398278364325eb5eafa51737109d8ae307a81746e047477e2471e4
TLSH
T1AAE02BCF40916D62CA2659791503512A333F08242515D62A50AE546F55217AC8589A0A
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 df5d55fae0a2de619b245ad0ff8f9ae4b2ae299d4f82e9d985e5bce77882f2d4
MD5 e73fedaef9df3b320f9ee25047c038ea
SHA1 0823efeeb1e7712a4d370118d80f20fabd599ad2
SHA512 ccc06c06f50672ae24a2a14903415238d926e8e8fb44ff7ff263be6c4df5b96890a41a4f8cf8acd597ea05d53de47ee65923c6f6d2555778fa05537d15804fb2
TLSH
T185E0C0F33ED31824E9FB87D524B120A040447C04E888FC4F902EDBC340F53686506D75
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

0d628a80-c522-4f56-b444-18cd3db8cddc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\0d628a80-c522-4f56-b444-18cd3db8cddc.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 fabb07ad063b5eb842ff7554cb9b3ffdce8cb5fa230bfc3ac174daf7989e4c59
MD5 f2135f1df2f134440fc1e50f9d329b71
SHA1 a796c5d31d32e8b70c4a85defaffdf99653e6763
SHA512 599c5bb50a8c3b4bdbd5f450198a9fb29817aad04d24e9dee19da32be5c6145be00a786dff3e14d0434fc90891288b2f9b7aaaad802bacf12846f09a8fc968dc
SSDEEP 768:Sj+9f3Gi3RKkbp8+p3bd66j+4BRv86aLIWkb9MW:h9f3H398+p3Z6n4ymb+W
TLSH
T1EFF2AE72E8A99D738CE2C694B5563743AFF4156793C01EC4E9DC7F0E01872AD570742A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 a360e9d4aaa2dbd176539f0fa125fa15fcd6e300968cfd74e6774326c3b7b801
MD5 8eec05b17dbccaaee2e2bfe85d3e8746
SHA1 2ccbca096bf971cb82c48f929a93f6f0b8590b20
SHA512 2b7b96c0b1c62a1dee0e2c2d9501988a0133756ea233407b3ee3cd34ef2737249ac88f3bb944e149c33e2950c50a8e729fb9ccc50f1866b4e1f396d21e3afa8b
SSDEEP 768:Drv+4UNbdt3Li3RKkbp8+p3bd66j+4BRv86aLIWkot:DbsbL3G398+p3Z6n4ymq
TLSH
T11E03AE72F8A8ED739CF6C644B14636437FB8155396C00ED4E9DD6B4E019B1AE230B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 42KB
SHA256 f90c3eb3aa09dea88e2ef6af08a428ceac4089bebc9070597bdb004d079f9366
MD5 9305b59824012be569a262333de81e8e
SHA1 3ae34a3ee1f11476b52aacdfff4ec0811331984a
SHA512 f9b928b696f265999f252c77a231a33fe58d0feddbfa42e9378218fe895adac4b1413dab278e91ed9ef62aa4a8550b779f095af0b3fe2e6f6e577d8566593f33
SSDEEP 768:VFqj+9/3dwg3iYRKyp8+p3bd66j+4BRv86aLIWkb9MW:N9/32a8+p3Z6n4ymb+W
TLSH
T102135BF298D78976DCAD8B47B77E3E429EBCC163B5801984B7C86A0DCD461BFC206815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 42KB
SHA256 b7c6524ae17c3ef7be81d6ec20af5dfbda9419b5f07aec8026891aa994d69e82
MD5 5abe5ee39352bf2c6fce2f99c5f91fa3
SHA1 df245d6210891e6e28326b4df0a8666c60e69522
SHA512 864a948fff4091f09da5d099a5480b3620e95933fca68a20726c2063221fda4178806742789a471423e68ffaa9cbce4dc10d627a37afbe1f505078e326e5db54
SSDEEP 768:VFKj+9+3zwg6imRKTp8+p3bd66j+4BRv86aLIWkb9MW:t9+3ZV8+p3Z6n4ymb+W
TLSH
T146136BF298D78976DCAD8B47B77E3E429EBCC163B5801984B7C86A0DCD461BFC206815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 fa0821ac876e0120ee7dacfa99349cc967c216735d66fc12ca701d174068f03e
MD5 b98ef2a31aae6d5bf1e17c4544a6bd38
SHA1 9c8182d7ee7ede742836450df6e4cf280447a3ab
SHA512 0e2d300fe90ac943489346a7304f714973b83f47abdf685e88adeed8990e265add6428632f9f74b0fcfc6b10c73b02e22de74f65d77416cfc582f0fa65ccf677
SSDEEP 768:Irv+4UNbdD3pcwNp8+p3bd66j+4BRv86aLIiR2bwCl1:Ibsbp3HL8+p3Z6n4yz0ww
TLSH
T1C203CE33F8A899739CE6CA44B24676437FF811A396C00EC4D5DD2B4E419A29E630BC37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 42KB
SHA256 05946d5997bb48183eb53dfd4fcc0f9252a7cfa35a4bcf1e91d9b3f470f58c3a
MD5 7419a9850e623004958f875f2425f5c5
SHA1 4fbbad86ab56bab2b5972612478639fffaf6dc14
SHA512 fbe9f200382949dd8bd03b295b9f11de3501fc6f24bfdda9616c72ede8e96ff92ed0843fe40fcfcb431092d07690861f270d896031c8ece764982718dc510605
SSDEEP 768:VF7j+903Uwg6i3RKvp8+p3bd66j+4BRv86aLIWkb9MW:S903WE8+p3Z6n4ymb+W
TLSH
T175136BF298D78976CCAD8B47B77E3E425EBCC163B6801984B7C86A0DCD461BFD206815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 42KB
SHA256 944dc62510890e28fea355b15f08d897d0deaa19e8349e98cd31028d2b2b9eed
MD5 f03ce9dfc371d8e38e7d33f277e73cf3
SHA1 48cde01f192b89dd4dedaa799697cd923519cbc7
SHA512 76d1ef3abe7b6998b12829a26b2e9b317a29c0df49e0d2b558f2d213623da458fb2f5892f449f2c078d8221464d3a0c410f98adbfe6b0a1c30dbd1891ab0d861
SSDEEP 768:VF2j+9M3dwg3iTRKDp8+p3bd66j+4BRv86aLIWkb9MW:x9M32I8+p3Z6n4ymb+W
TLSH
T14B135BF298D78976DCAD8B47B77E3E429EBCC163B5801984B7C86A0DCD461BFC206815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 42KB
SHA256 331cde4d6f60198f0ff09712dfe524143de1f4ea5195b19fafa40682cbb9cbf6
MD5 4d4dd2b55b27ee1bbe91a1d222ca145d
SHA1 e7653e0f7aa28ebae1b25582424d1b28ed72532b
SHA512 ebffc0ce3028ed8ee56264dcdff4e7edb683af90b03369c754fa0bfe3f822168a61dc56f22aae75aa51c2488a5fe1b118a67629b01b8981c561cf64b41149b4c
SSDEEP 768:VFYj+9+3dwg3iaRKPp8+p3bd66j+4BRv86aLIWkb9MW:79+32t8+p3Z6n4ymb+W
TLSH
T133135BF298D78976DCAD8B47B77E3E429EBCC163B5801984B7C86A0DCD461BFC206815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3ec35817-ba60-40f9-a7f9-2a0384b27b3f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3ec35817-ba60-40f9-a7f9-2a0384b27b3f.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 67KB
SHA256 0f7ad9abdcd636c2c6889999c25838241b47d0a25155ace08f64e55a25eb3ff9
MD5 7aa40f01332d390a0557187ed788e89f
SHA1 7d7c1a1c58e25749832d6634611c29cc8fabbf19
SHA512 1d9d4d55030ef6e8d1e386e61671f00bc271b8df8179ca19846c2b39cbb2bca110b67b3d4a6d1f200966057f5c6cea3f4dd1ad02d11e42ec7d013c6803954966
SSDEEP 1536:iKLmShYoNz8KMSfKQ1EflJntHY9h4iUxaR40i71Yi68nvwAOdB4V3CNBQkj2jaVP:iKLmShYoNz8KMSfKQ1EflJnpY9qiUaR9
TLSH
T135637292E9204E75E1A66F3EF15622627C30394690F8153211DC25EFA987D930B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 ff4ab87609ebf4d46ed235dafa0f7014c33adeb6839ff33f83afbd39a4a6a32d
MD5 1b8b68c3a2eaa6bb537e2e543adb7632
SHA1 d313aa734b6ee4ad0cc8e1010ca0947dbfcea25b
SHA512 ccdb599921bdd4bab9b725ca071039d211862421a217d2201df231e87f69dd808e19540b8dcc8e5cbffd4c2d5efb13eaf6971af52e95ab124bf4ea4c294380e1
TLSH
T1E3318637F3DD8216D899403A10DEAC0036B6C7DB40DECF5BAB81D619A43F699CEA0454
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 f04a31279e9edbc05f87a668e4fb2f527e3927ceb851f31dcabe74bb21f5629c
MD5 661a7c6c380fb4de2d8b6686291a8b39
SHA1 eb07cffbe4bb630ddab9096ce4ed0d8bb7bcdd8d
SHA512 0d07520bcde6bdac1d3b5b7985273bf0124e387e92fc839f5b9859d8890137ebf4c32e7f88859ba0888ae597ab8bc398172ebd1383102c91377058bfe8c94b7e
TLSH
T1B3319837F3DC8216D889403A10CEAC0036B6D7DB40DECF5BAB81D619B43F699CE60550
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 e3060da1cfb41f842c281d2be6faf88b8df46153a440fe60da48a8ac05200f2a
MD5 b8262cc15c5de7633bcdbc29616fc341
SHA1 df64692d997707e2ca999625b5f2c1bd13c494a4
SHA512 a320a08c5964bc29f8a5680b1fd1e3129cd35c72a662f5e0cb0654720739c4c0c10959a462d25f72758b20d9e0468cb3ed21a4118ef9c8a70f0584e58029b67c
TLSH
T1B0216A33B3CC8654C89A413A10CEAC0036A787DB809EDEEB7B84D549A42F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_qkzc3y2g.g1l.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_qkzc3y2g.g1l.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

_alite_14216.ps1

Path C:\Users\Admin\AppData\Local\Temp\_alite_14216.ps1
Size 12KB
SHA256 da1991f0c25b2e902ae6a3dd20cc96cc4a87ce96dfdc92c9b121bf5d9b5c1220
MD5 17703a94ec404c73900fea917e11f2bb
SHA1 7fd014dbe134a59f6da9a7eb459062d4c3ba6674
SHA512 fe6b20c863bb844a51b2a375555b1271d8f65d71e5ef546ae16a87dfacabcc697a2724d60a5962e0ff8c8e4e8e794c30b0c4d8e38e41103f2a26a52784ad42ef
SSDEEP 192:nGSMpSCyiQ55yiQ6BfCiQ9LhiQ7J8iQ/yiQ6iQlYHr0BLr+E+MFd7BCMsNN70nCj:n/3YNJrW+eFdl0NN9H8qH3iy2u
TLSH
T15B52756D72FC919297D32129A9CB6A856A29927F144C6E0439DCC2C0FF89079C7F83E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_alite_14790.b64

Path C:\Users\Admin\AppData\Local\Temp\_alite_14790.b64
Size 2KB
SHA256 aafc7c2d47f4bf55f8c90e082e238ff28e2fff9ed3a7ef496d8c402ca4a3782a
MD5 a9833cfa572e83b1dc88278e49c4f1ff
SHA1 862a3523a37522b71785321e627a82bb90f66f2a
SHA512 4beef68015006b48b2d39f49cd72b83e199442e2e7a592bd14e4b9c0c23d72cf853d1b16f07bf3aff705d8c233a88f584a6d95835a0685f78e5cc91edef46b98
TLSH
T1A751740EEE931EA9936111E221ED18D7162C638F36E0199D8C17DA815B5E4A934CE2DA
MD5 SHA1 SHA512 TLSH

Submit Download

_alite_14790.b64

Path C:\Users\Admin\AppData\Local\Temp\_alite_14790.b64
Size 3KB
SHA256 3c1ee1aca0b71a5e571e4b7801044d4eab57ab33ad13db1fa73ffda3c6b4f8b5
MD5 d6cef8d82a08b390f1e4a82be596785a
SHA1 06333ca8acdb77dec0f0ca8e82610574da30f283
SHA512 c13007f58489d430f0f7e60a2128140656a2f409f8d41c759ef5baa10f7ffcd7154ca069f1e123d4e81b2c4c56595a0b2885a08319a33fc46ccac86b7b73bdeb
TLSH
T14D51950EEE931EA8937111E211DD14D7172C638F32F018DC8C57E9815B9E4E835CE2DA
MD5 SHA1 SHA512 TLSH

Submit Download

_alite_14790.b64

Path C:\Users\Admin\AppData\Local\Temp\_alite_14790.b64
Size 4KB
SHA256 1af0e232cff64a458570e5bcf922fa5bb3027ea3a9c32b3d8a25d4d7aafbfd3d
MD5 7368bb83ba64cd99b260be7a456ff472
SHA1 3d2ecddf53dff532734f95099f85586b71e5077e
SHA512 5de2cb9747c508bb42770a95947fe108b6d73c4bc1b28d1959ee03defe76d0f7eb583689bc5b9449503ec5a8dce62db41daf0b575006d4d2388fa845a60fd1d1
SSDEEP 96:QZI2E9fAJr/q+onBro6+ybiy9fdZUjkpYVCJKDmlkOi:gzUzB86y2Lg4Q/
TLSH
T15B91950EDD532EA8A36002D221DD24D2166C678E31F16CDD5C1BE9C55FAE4F931CA2EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_alite_14790.b64

Path C:\Users\Admin\AppData\Local\Temp\_alite_14790.b64
Size 17KB
SHA256 e53e2dde997396237e4aa33ad2c84ef5bf0f0c89610bfa228f92b94132c23aeb
MD5 93594737d42cbd8e5b3a86818b0cbeee
SHA1 73554da9bb5df4f9b71af8893120f812ff4a19ef
SHA512 4bd05fd9ea985f42d822672f25843de5dec74ff5f1bca42a1dfcd2f96fad1a09d0d922713b41f41b874b026b96ea69de74ff6c08b574458186d82057ff7375ac
SSDEEP 384:gzQB86y2LfMqVgfyt/5lA3YjXoP7W8xv8J51o3GMRKemtIsiKMnz:1b1oZ8aKxtIHz
TLSH
T1FD823D8DDD572E48EBA002B131DE28D00B2D6B9F34F11D9E291FDA850D9E4BA31D98D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_alite_15600.b64

Path C:\Users\Admin\AppData\Local\Temp\_alite_15600.b64
Size 25KB
SHA256 5e4a974d09a515dba998df89b72c35d982a15fa389bf9a2a270bcfbd3e717c1d
MD5 7b10833b65f81e0181ae2f2b99e6bc24
SHA1 86070cdaccd7a887abe75bab573a675fb27f73b9
SHA512 2cb1f2737b0d1e4848c6ab3c845d5378f449b65cf06dc0d52f99eca24b2c1b149db4a96710e6bcc3b4e30135f4f669c0000c34eda1c9673a01b72ecbdc071b0e
SSDEEP 384:Gv+IHvbL/ej3cK3sfcl1EorehFGY09C2UJx8LjobCG7ZxZQzT//vBQW9hvj3vAuM:Wi3Fd/LrkGPvYzZAeAvV+18u0Q
TLSH
T1B1C22B858C5F3E89EFD0166131DD79C009BC5BCF36F1189E221EEE824D9E1A632D94D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_alite_15600.b64

Path C:\Users\Admin\AppData\Local\Temp\_alite_15600.b64
Size 2KB
SHA256 36820c917d7289e07baa18adc22fdbe0824855b732b8162066cd10fabff8d4e2
MD5 aadafec37b2404a474201550a6288b5f
SHA1 27e2fd00d869f13e5853d01e236e12954c9c348f
SHA512 b27ccd4dcb2ba1605323be1c268c7a5c2c93c658315ecb8876ba61a71e6863aad8b04a5af8357195e112c2fa4c5bdf9da7733ba0740c930f7d94d28d0c10b0a1
TLSH
T1B241940EAC533DC5AB2111D330EE64C01ABCB7CF39A299DC0417E7851B2A8E176D96A1
MD5 SHA1 SHA512 TLSH

Submit Download

_alite_15600.b64

Path C:\Users\Admin\AppData\Local\Temp\_alite_15600.b64
Size 2KB
SHA256 0cbf5f87cea83ebae27072ea277c6f7947b850a5e5cb5af541eddb2a763279a8
MD5 b6c275f5dde7664df75d242e467d3ae8
SHA1 3519d2b2675111be20cd8055c6cd2977b0551997
SHA512 037aa2a2d0f9e2a60f685a570db429f85d2201a485e801377243256d7cf1463015ef753c5d7aa7a407c85e645ee9f15384469d2e6c1465d62185502f8e4ef1b4
TLSH
T14151541EEC033DC5AB21029330EE78D01AACEB9F3AB195EC4417D7C61B294E126D9695
MD5 SHA1 SHA512 TLSH

Submit Download

_alite_15600.b64

Path C:\Users\Admin\AppData\Local\Temp\_alite_15600.b64
Size 4KB
SHA256 19b9b8d56ed6a47b85973ab0ca52347b928e64250fb4d8f809a28c6569ff8c54
MD5 56952d55c17fd72efdc2d0f75d498a0c
SHA1 7d9aef70ebfc47329b00b5f91498f3c4306de277
SHA512 deb8ac697ab519bdaa44ffa2fe0acaadf5c262ee0f4c0af613acb37fdb8b71b0b1a5e6283e14329d18154305d63aa3da79e43f8b659385e2e322c9075328dffc
SSDEEP 96:Qqsyeu4jGcuq4LKJ+kETHo6+FEwNbMG/ejGUplnJJF98:jhejf4uJ+k+IHFJbL/ejpbJg
TLSH
T1C891851EED072EC9BB21165330EE64D11AECAB8F36B148EC4417EFC92B690D126D9295
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_alite_25613.ps1

Path C:\Users\Admin\AppData\Local\Temp\_alite_25613.ps1
Size 18KB
SHA256 d4350ed91b8e96bef5d01dcaa2c6a1f99afec794269a59279804029b38de5d00
MD5 af20f0ef9e73e4a28c63b3d1cd2668ac
SHA1 ee21fbd24fb80bcb2283185ead808b6b325c15ac
SHA512 c22e64d5eea341b951ba8d59ff80858ffe646869d7049cb48125f217ffd89945fd1bf827384e5e83a35750531d5e5ed650443fffd8b4a50b55b3975068806f45
SSDEEP 384:n9uYN7r8sBGEPouHCVdMGitPdL2NlK/Kuq9oqHQYycY:9uYhr8FP1sPdLC4YoYDycY
TLSH
T13B82A73C76AD95A257C3112AA9CB1A85EB25927B064C6E007EDCC2C4FF85069C3F87E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_mtools_17514.b64

Path C:\Users\Admin\AppData\Local\Temp\_mtools_17514.b64
Size 4KB
SHA256 9fb50c6d2ac3740a78cf2d82473a545d3700ce0764b29e2a64cae9dfedd6ab16
MD5 227d79ce82e72397a19a585740103137
SHA1 27bc0eb181a1f92ff2f610a48d6933a47710392b
SHA512 3007c807bc54735d1413f598d145cd5c588475c7dc9b12b422a3e22aa056dae15fb1c9848f3da4107ebc5be31af877cd97c52b91b3579ce249a0037592a1a836
SSDEEP 48:3KKxYuz/2K4gVKLZMvjmEjSWba7698Jt/y/gbOxww+BzbZGr2kWMOktJ39s0zPU8:hxZz14/aM6CFyuzsrh7JNrVTRhabaKi
TLSH
T13591F976CC9B2C9CBD83975C2DCE95D2692D03DF16820C951E0EB4A64F4DABB10C74E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_mtools_17514.b64

Path C:\Users\Admin\AppData\Local\Temp\_mtools_17514.b64
Size 47KB
SHA256 252daab09fb8bd60b4b08567f8298075810eaaebbe74e7b2f1de414dafeef6af
MD5 42744d84cec6821f7449ffa11b4fb49d
SHA1 9099f2a30163bb8980d2cb291a67cf161cf1ac23
SHA512 8468db3c76497e0096bae58652e59916bbd7e9a0ad962ff5d6a2b413f9a4fb318a7e1b72be12bd483fe6bcf899c7938cd7ad02634500074e6190c85c6dd7b260
SSDEEP 768:fQyD8zJ1deRX0k1rZBgjaUtUIVo0G2MFskgaPlHeB/R7hOK6w:fQyD8zJ1deREOamIV2Ij
TLSH
T1152308B68D5B2E8DFB82429C2CCD24E1091D578F29B009AE1E1F9E414F8DC6735E78D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_mtools_32723.ps1

Path C:\Users\Admin\AppData\Local\Temp\_mtools_32723.ps1
Size 34KB
SHA256 0f0f884ccb6300aad0d514da7948f145e49ad24d3fb7476ac175db227502140e
MD5 f655c18b875af787b7ad21ddf0d6e9c6
SHA1 2625ebb7773f23151e476e82f1f5312627d28e57
SHA512 ffc99053f7c5bfedfc37bac4362fa79190522b06239f056a7f76c060c6528d5a590f03329e40eb3c818ca1f617b012aac22c0780975f0f99629d4c8f5c7ee877
SSDEEP 768:dinm7ClWfDzvtWZrt/vu0cuL05rtdwKlw99A/X9nAEH:h7ClY0q555XSsf9nAEH
TLSH
T1B5F2A52C722DD1E29783105F9ACB5A81AE2922774588ED007DDED2C4FF99369C3F43A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AutorunsLite (1).bat

Path C:\Users\Admin\Downloads\AutorunsLite (1).bat
Size 8KB
SHA256 a4d0798897590df45aacde39da0dfe33eb760a3843dcddae88747c46665252cd
MD5 1456b9678091fdb47fda711d2515507a
SHA1 12ac20be4a896b584eb40845c78948a60ac6f7b1
SHA512 e3230e3b8941e1f6b1336b1307f26846762c7bc053cb59eda8d65ace20b27846a8a79f594e174d4ad4c3070c2e3a981b624a800dc281bcdf36f049f3b0ce7d9c
SSDEEP 96:U2JF4aQdDQrsPGQRCpI/wtlAVKfkPa4fE51bYtWLGsqy20a0+pQ8Gq/0jfhFlruY:jog51bMl0jfjNuSZ
TLSH
T14402E14DBD24A5029BE2E3045E2F8455E7A4B39B5C43FD0530BEB138237BBDAA17D186
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AutorunsLite (2).bat.crdownload

Path C:\Users\Admin\Downloads\AutorunsLite (2).bat.crdownload
Size 22KB
SHA256 bdd124c026760eb3eeb67992a8f6e51dd7e35168e3f4ac0ef630c726eccf3c79
MD5 36dce1723e36ae4d259732b109766444
SHA1 fa72522e7dafd07dd13dda5d92a3cb50a94d4b3b
SHA512 1b3a74271a5da757b9e5fe0fdde80277c881e171b2a33b669fa9404eebbf639bb9420158a6b51d50dc13d14cb93199920b736c6fbdb3ddbfabc9463ccba75bd7
SSDEEP 384:0pLfBDg0KybnhTzg1k/P6R43s58T7Wxj+IlshHBsVRHfsEi7rS:sfjN9bm7Hk/e
TLSH
T188A2E64D6F6E1E249FB0021CD9FD14C822AF1B5B02B3AC85319FE97188752913BCED96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AutorunsLite (3).bat.crdownload

Path C:\Users\Admin\Downloads\AutorunsLite (3).bat.crdownload
Size 32KB
SHA256 41c67e3b2eb247103397bdb34bb3a9361ab1cfffa79f0147f4d9e191cd2c88da
MD5 2aa3a8a107c4c1378ccb74e4531444f2
SHA1 ae8e56504ea04fac3dcbde81091d92b162f9b5a0
SHA512 993fb47cbb37be07fd9b651bbe57fe84040be5c3b6d42d9fd9aee7a9194886311f52c7c573eb9b666930b4542890f5a76c3573a54c68bbd45ccf28600e446b21
SSDEEP 384:fCf7M/boWbjOPPhECmom0lf4yYFkRMWx2d7gLeh5CfSZw8A0/1vUxWB1KhDFK5KC:xnOREcl+kK5JZDzkUt1+LGR
TLSH
T131E2C5496F2E2D245FB0021CE9FD65C821EE1B8B1673AC45318FEEB188652D13BCDD96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AutorunsLite_Report_YRWKJLDU.txt

Path C:\Users\Admin\Downloads\AutorunsLite_Report_YRWKJLDU.txt
Size 6KB
SHA256 94d2310b2502df69ad046c8f1bd2e7d64676a705caeb5b6f6479db380f9d6e93
MD5 a379ca9043ac79bd5b090c916fee3d2f
SHA1 562a3433a7b55a42373abe47b08e7cb3b165b3e2
SHA512 2f3e9c864d7b70b6a3b5360c676fa3d8e78e31934d4d004e2fdd9f84ad65fe1fb1f0033f6186673ed707079b7a165c754dc2e49bec696aa780039285b866db39
SSDEEP 96:X7ftKF4qRl3XesRWVGzyJQrVJfgwdQCki24djTTPM+pRENskePoW1AnSZeFIHgb2:K+aiQr39c4RELzl4oQ
TLSH
T185D1ED14943B8271D37ECB022B5E9502A6B9321F69835B0A76CC86444F77BCB84FEB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AutorunsLite_Report_YRWKJLDU.txt

Path C:\Users\Admin\Downloads\AutorunsLite_Report_YRWKJLDU.txt
Size 7KB
SHA256 749e27394ba6b3da9e86eea1299b24edd2984b8f0dafe2538b8271b7d5f754cc
MD5 2b0c6710c860247dfd42af9665186eb3
SHA1 a34c2f8b6bfb9ce82774b4a1330c28c74fac536d
SHA512 15fe28785fb0b25e20c2caa92c74fef07655b125d71eaf7baca76f9dae8258d396fe73338165c7bdd638a5544ee1dc640c5750046a1e5857238e4a1da913eda6
SSDEEP 96:X7ftKF4qRl3XesRWVGzyJQrVJfgwdQCki24djTTPM+pRENskePoW1AnSZeFIHgb/:K+aiQr39c4RELzl4oj7B
TLSH
T1EEF11114A43B4275D37ECB012B5E9501A3B8325B69835B0E36CC86445F73BCB85FEB99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MatsTools.bat.crdownload

Path C:\Users\Admin\Downloads\MatsTools.bat.crdownload
Size 59KB
SHA256 878695e41560f1e0d9e3222914fb0f1d37532b4e37882d76474cdbbb5dad0fcf
MD5 16d1f9f837a7f426782272451bdcf14b
SHA1 2e16ffd3ea55f17a2e275836857742c9d8c084e9
SHA512 5e33c39099f5a291c93bff0bb13da017e9157053510ca1a63dbc65920ff0944c998743fbed11f188462ac296e539e401503f8262b32ce156e09f7ad98ff2b516
SSDEEP 768:OO6KRETgGqyWGz2p87bjDGFNyV4+IvrBEEWcFvNDS6H+HO7X4e1:OO6KRETgGqBkZC+6Ki
TLSH
T1C253D75D6F2E1D686F72020CDCFC24D8209F575B0672AC85358FED718A68A913BDEC86
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_alite_tmp.ps1

Path C:\Users\Admin\Downloads\_alite_tmp.ps1
Size 1KB
SHA256 ef817a2838d73c661eeb6a9d89a1674f87fae5a643d268cd05e313e3fbfadb27
MD5 874e2c7f694edadc0c4f36dfd2924762
SHA1 f9b4eb8eb83d00a442c14e86441f7e99d135114c
SHA512 b0a2f45e5ebecd2f5265dee68f0900d5f6080c9cd5c207a58b5ac0e5a476ea9e049b685f694584ec2355d38dabd67f9dcb55c866133ab357510e31137014b990
TLSH
T194216749BC15821BE5B2372D5E16A444FEDB43FF88845E41740EAE403FB942EC668EDE
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1984-1993-0x000001E720400000-0x000001E72040A000-memory.dmp

Download

memory/1984-1997-0x000001E720460000-0x000001E72046A000-memory.dmp

Download

memory/1984-1996-0x000001E720450000-0x000001E720456000-memory.dmp

Download

memory/1984-1995-0x000001E720420000-0x000001E720428000-memory.dmp

Download

memory/1984-1994-0x000001E720430000-0x000001E72044C000-memory.dmp

Download

memory/4444-824-0x000001BF448F0000-0x000001BF44914000-memory.dmp

Download

memory/4444-823-0x000001BF448F0000-0x000001BF4491A000-memory.dmp

Download

memory/4444-822-0x000001BF44800000-0x000001BF448B2000-memory.dmp

Download

memory/4800-392-0x0000016CD1860000-0x0000016CD187E000-memory.dmp

Download

memory/4800-391-0x0000016CD1810000-0x0000016CD181A000-memory.dmp

Download

memory/4800-390-0x0000016CD1C10000-0x0000016CD1CC2000-memory.dmp

Download

memory/4800-389-0x0000016CD1820000-0x0000016CD183E000-memory.dmp

Download

memory/4800-385-0x0000016CD17B0000-0x0000016CD17D2000-memory.dmp

Download