hxxps://github[.]com/manisaiprasad/I-Love-You/blob/master/ILOVEYOU[.]vbs

Analysis

geolocation tags

nanew-jerseynorth-americaunited-statesususa
user interaction
yes
max time kernel
898s
max time network
730s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/07/2026, 17:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://github.com/manisaiprasad/I-Love-You/blob/master/ILOVEYOU.vbs
Sample260720-vs8wsahs7n

Score

6^/10

discovery execution

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
106	raw.githubusercontent.com
107	raw.githubusercontent.com
108	raw.githubusercontent.com

Executes a VBScript file via the Windows Script Host. 1 TTPs 5 IoCs

execution

Visual Basic

T1059.005

pid	Process
1880	WScript.exe
4592	WScript.exe
4252	WScript.exe
464	WScript.exe
5016	WScript.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
724	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134290413971916415"	msedge.exe

Modifies registry class 12 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1788976790-1541110888-1636651838-1000\{A2B2713F-0D7E-410A-9DA2-F250E7C8D725}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1896	msedge.exe
1896	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4704	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe

Suspicious use of FindShellTrayWindow 42 IoCs

pid	Process
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4704	OpenWith.exe

Suspicious use of WriteProcessMemory 52 IoCs

description	pid	Process	procid_target
PID 1296 wrote to memory of 2984	1296	msedge.exe	87
PID 1296 wrote to memory of 724	1296	msedge.exe	88
PID 1296 wrote to memory of 4856	1296	msedge.exe	89
PID 1296 wrote to memory of 4856	1296	msedge.exe	89
PID 1296 wrote to memory of 4856	1296	msedge.exe	89
PID 1296 wrote to memory of 1280	1296	msedge.exe	91
PID 1296 wrote to memory of 1280	1296	msedge.exe	91
PID 1296 wrote to memory of 3956	1296	msedge.exe	93
PID 1296 wrote to memory of 3956	1296	msedge.exe	93
PID 1296 wrote to memory of 880	1296	msedge.exe	92
PID 1296 wrote to memory of 3956	1296	msedge.exe	93
PID 1296 wrote to memory of 880	1296	msedge.exe	92
PID 1296 wrote to memory of 880	1296	msedge.exe	92
PID 1296 wrote to memory of 208	1296	msedge.exe	94
PID 1296 wrote to memory of 204	1296	msedge.exe	95
PID 1296 wrote to memory of 208	1296	msedge.exe	94
PID 1296 wrote to memory of 208	1296	msedge.exe	94
PID 1296 wrote to memory of 204	1296	msedge.exe	95
PID 1296 wrote to memory of 204	1296	msedge.exe	95
PID 1296 wrote to memory of 3928	1296	msedge.exe	100
PID 1296 wrote to memory of 3928	1296	msedge.exe	100
PID 1296 wrote to memory of 2584	1296	msedge.exe	99
PID 1296 wrote to memory of 2584	1296	msedge.exe	99
PID 1296 wrote to memory of 4476	1296	msedge.exe	102
PID 1296 wrote to memory of 3640	1296	msedge.exe	114
PID 1296 wrote to memory of 1532	1296	msedge.exe	115
PID 1296 wrote to memory of 608	1296	msedge.exe	116
PID 1296 wrote to memory of 3360	1296	msedge.exe	118
PID 1296 wrote to memory of 3360	1296	msedge.exe	118
PID 1296 wrote to memory of 3420	1296	msedge.exe	119
PID 1296 wrote to memory of 3420	1296	msedge.exe	119
PID 1296 wrote to memory of 3420	1296	msedge.exe	119
PID 1296 wrote to memory of 3156	1296	msedge.exe	120
PID 1296 wrote to memory of 1880	1296	msedge.exe	121
PID 1296 wrote to memory of 8	1296	msedge.exe	125
PID 1296 wrote to memory of 8	1296	msedge.exe	125
PID 4704 wrote to memory of 4592	4704	OpenWith.exe	126
PID 1296 wrote to memory of 548	1296	msedge.exe	133
PID 1296 wrote to memory of 548	1296	msedge.exe	133
PID 1296 wrote to memory of 1896	1296	msedge.exe	134
PID 1296 wrote to memory of 2916	1296	msedge.exe	135
PID 1296 wrote to memory of 2916	1296	msedge.exe	135
PID 1296 wrote to memory of 1476	1296	msedge.exe	136
PID 1296 wrote to memory of 1476	1296	msedge.exe	136
PID 1296 wrote to memory of 3756	1296	msedge.exe	137
PID 1296 wrote to memory of 3756	1296	msedge.exe	137
PID 1296 wrote to memory of 208	1296	msedge.exe	138
PID 1296 wrote to memory of 208	1296	msedge.exe	138
PID 1296 wrote to memory of 4344	1296	msedge.exe	139
PID 1296 wrote to memory of 4344	1296	msedge.exe	139
PID 1296 wrote to memory of 4928	1296	msedge.exe	142
PID 1296 wrote to memory of 4928	1296	msedge.exe	142

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/manisaiprasad/I-Love-You/blob/master/ILOVEYOU.vbs
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7fff2847c188,0x7fff2847c194,0x7fff2847c1a0
  2⤵
  PID:2984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1840,i,3129520913541306834,3855635886964545044,524288 --field-trial-handle=2324,i,14551364672183510807,13070009265718096829,262144 --variations-seed-version --mojo-platform-channel-handle=2360 /prefetch:3
  2⤵
  - System Time Discovery
  PID:724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1708,i,5110273456014354078,1078481703721000375,262144 --field-trial-handle=2324,i,14551364672183510807,13070009265718096829,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:2
  2⤵
  PID:4856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2496,i,11373541031956249274,4468336012420406413,524288 --field-trial-handle=2324,i,14551364672183510807,13070009265718096829,262144 --variations-seed-version --mojo-platform-channel-handle=2756 /prefetch:8
  2⤵
  PID:1280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=2500,i,7588772155239954886,12319713006794778356,2097152 --field-trial-handle=2324,i,14551364672183510807,13070009265718096829,262144 --variations-seed-version --mojo-platform-channel-handle=3380 /prefetch:1
  2⤵
  PID:880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3376,i,10194984031458597667,16586268844872673098,2097152 --field-trial-handle=2324,i,14551364672183510807,13070009265718096829,262144 --variations-seed-version --mojo-platform-channel-handle=3384 /prefetch:1
  2⤵
  PID:3956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4208,i,18173474870474775437,15738063855059730296,2097152 --field-trial-handle=2324,i,14551364672183510807,13070009265718096829,262144 --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:1
  2⤵
  PID:208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4220,i,11771417268359731063,10048695656718214556,2097152 --field-trial-handle=2324,i,14551364672183510807,13070009265718096829,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:2
  2⤵
  PID:204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5076,i,16918251367469360581,7027126032509537347,524288 --field-trial-handle=2324,i,14551364672183510807,13070009265718096829,262144 --variations-seed-version --mojo-platform-channel-handle=5068 /prefetch:8
  2⤵
  PID:2584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5128,i,17912340931646324337,11006264879987823930,524288 --field-trial-handle=2324,i,14551364672183510807,13070009265718096829,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:8
  2⤵
  PID:3928
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5892,i,15658525438782639032,7385013925910403448,524288 --field-trial-handle=2324,i,14551364672183510807,13070009265718096829,262144 --variations-seed-version --mojo-platform-channel-handle=5944 /prefetch:8
  2⤵
  PID:4344
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5892,i,15658525438782639032,7385013925910403448,524288 --field-trial-handle=2324,i,14551364672183510807,13070009265718096829,262144 --variations-seed-version --mojo-platform-channel-handle=5944 /prefetch:8
  2⤵
  PID:4476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4356,i,15257300831563866690,1606403592881727393,524288 --field-trial-handle=2324,i,14551364672183510807,13070009265718096829,262144 --variations-seed-version --mojo-platform-channel-handle=560 /prefetch:8
  2⤵
  PID:3640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4364,i,15047191376862655947,6253962244128911114,524288 --field-trial-handle=2324,i,14551364672183510807,13070009265718096829,262144 --variations-seed-version --mojo-platform-channel-handle=4540 /prefetch:8
  2⤵
  PID:1532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4860,i,15167703135670160591,2746195443611163448,524288 --field-trial-handle=2324,i,14551364672183510807,13070009265718096829,262144 --variations-seed-version --mojo-platform-channel-handle=4536 /prefetch:8
  2⤵
  PID:608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5176,i,13388260253348429921,7451144379566230268,524288 --field-trial-handle=2324,i,14551364672183510807,13070009265718096829,262144 --variations-seed-version --mojo-platform-channel-handle=5072 /prefetch:8
  2⤵
  PID:3360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=5252,i,2736460915056591063,17394146853603857878,2097152 --field-trial-handle=2324,i,14551364672183510807,13070009265718096829,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:1
  2⤵
  PID:3420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6588,i,10103771670115617274,1938272588134272993,524288 --field-trial-handle=2324,i,14551364672183510807,13070009265718096829,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:8
  2⤵
  PID:3156
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Downloads\ILOVEYOU.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:1880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6388,i,14065827471181707035,6622046914469786515,524288 --field-trial-handle=2324,i,14551364672183510807,13070009265718096829,262144 --variations-seed-version --mojo-platform-channel-handle=4852 /prefetch:8
  2⤵
  PID:8
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2648,i,16306332060630180710,7032962970129066880,524288 --field-trial-handle=2324,i,14551364672183510807,13070009265718096829,262144 --variations-seed-version --mojo-platform-channel-handle=744 /prefetch:8
  2⤵
  PID:548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5136,i,8875730467488646101,9602513120967306670,262144 --field-trial-handle=2324,i,14551364672183510807,13070009265718096829,262144 --variations-seed-version --mojo-platform-channel-handle=6208 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4028,i,18355647572871285294,8164017087863002342,524288 --field-trial-handle=2324,i,14551364672183510807,13070009265718096829,262144 --variations-seed-version --mojo-platform-channel-handle=5468 /prefetch:8
  2⤵
  PID:2916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4188,i,9066705979427911462,5477171502285980057,524288 --field-trial-handle=2324,i,14551364672183510807,13070009265718096829,262144 --variations-seed-version --mojo-platform-channel-handle=3424 /prefetch:8
  2⤵
  PID:1476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5136,i,11197232320101403261,9182918615821591100,524288 --field-trial-handle=2324,i,14551364672183510807,13070009265718096829,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:8
  2⤵
  PID:3756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1308,i,13357833094649655979,8276877018105234602,524288 --field-trial-handle=2324,i,14551364672183510807,13070009265718096829,262144 --variations-seed-version --mojo-platform-channel-handle=5276 /prefetch:8
  2⤵
  PID:208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5068,i,17129308116963420446,608065792288059853,524288 --field-trial-handle=2324,i,14551364672183510807,13070009265718096829,262144 --variations-seed-version --mojo-platform-channel-handle=6212 /prefetch:8
  2⤵
  PID:4344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4284,i,1472986727792577606,4870934689579080660,524288 --field-trial-handle=2324,i,14551364672183510807,13070009265718096829,262144 --variations-seed-version --mojo-platform-channel-handle=3732 /prefetch:8
  2⤵
  PID:4928

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4964

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4980

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4704
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Downloads\ILOVEYOU.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:4592

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Downloads\ILOVEYOU.vbs"
1⤵
- Executes a VBScript file via the Windows Script Host.
PID:4252

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Downloads\ILOVEYOU.vbs"
1⤵
- Executes a VBScript file via the Windows Script Host.
PID:464

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Downloads\ILOVEYOU.vbs"
1⤵
- Executes a VBScript file via the Windows Script Host.
PID:5016

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 3bc6f5c22e10305be021a6318b0eabf0a6abf49a3bdc5b39af41db7ab0278e3f
MD5 04168e374d81980fc5f3466ce4149565
SHA1 292f2330e00859ee9546278a7256f137039595ee
SHA512 87855cfb3a78e7d87b2345fa049ddcadfc780ea959a15238de760aadddea6c61d083e45f41ffc37deb36919420f10e888485a11d7239e8afc3ab6380c8ac066f
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7X:fwUQC5VwBIiElEd2K57P7X
TLSH
T132B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6d0f88884e23b1418c456620b79662feebdfd970ca9325ba2981c94b3b0f0b2f
MD5 7060eae8ec426d15de2849b1f7d261b4
SHA1 b252d90b9d7050d0b9b7c03141d9d3b7cae404ac
SHA512 8791005fae20dc1dc5dc5b0086efe814e0b1e36781ef1931cc1fc699fc4cb34d62ab3f9a83f4967824f3bb71aef6adc6ad457ab7a6addcba99f9e9b473eabb4d
TLSH
T118D01222BE08A415E65BA271A502C7141F5954A124938651E224D86CD9F84D49696387
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4d517b88a0fb88494276c126764235de9ee52961c86cc4d3abaf517b10a649a8
MD5 dde9ea8dd9c7e315ef614ab3476af02c
SHA1 e03e201e89770d15b4040d579c2cce8684959a2c
SHA512 410e016336529d709de957d44e67238e4f6592b9ce6646395a9e45ce592e7810b4cb6b1b6df5d8b26875a6aa235b77d41c0983ccc055556f8b8c02224093fdd1
TLSH
T16DD012227E08A415E65BA271A502C7141F5954A124938651E224D86CC9F94D49696387
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 2d4ca1d39a7fb4ae5adb1d01d06e13c33bce17644d2ae86ab6b0c74e499577fc
MD5 bc47f867217375fd17b770f48de9023d
SHA1 9a51d0b9c1552ca4cc18f067ffee418ebc3ce7fe
SHA512 44b80c4dbecec50fc002f2685fc44394ff6f27f1daf6455cdb5eea111e57f1a1209535f034cae5e176729718541f00c0fc6672ae1495556a8e7f3c3fb99bff7e
TLSH
T18DE07D8544C8C22EF640A4CB51EC530C83A13E4FDAC8790E1708E59934C3050F3F67D0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 58c1bfe815af4e8692a645a2354ef09e27b71d6dd5c9b8b723bf5c2f327889a8
MD5 3af4aaaeb720e8bae192ce84f1de6f41
SHA1 b9ad2ac417ccf42cf44f74fb4e5360a84b4ba0e9
SHA512 45566b1c1e2463a3ae7eefbacb5b28e2f5f8aa04cfa1bf06bccb25363a074fab6cbf78644c2c193b306d000b2fb75b6f96b55912bfcd9637af4a1e1899fd63f6
TLSH
T171E026852AC8C22FDE50A44B42ACA30CC2C2364ED3C87A0E170D88993081050E3B3598
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 352B
SHA256 4a67020085327b365670193035b560609ca5761b82be978abc1800bd1535bdc2
MD5 d0a0f5fb92380d5903b4dffbd5e9893a
SHA1 26dba3ee327f4b4fe50316a1deba35c1e156c27d
SHA512 1e1848c79cbafe6cfaaea5c8122dda32a48c1a40ee7c59c20a5f3d8ca15b2ec1a30c1ea1f8015780ef373fa83bef87c5f8795c8fd6d6e39b67322cd725998245
TLSH
T121E0205813ADD1B4CB4594E7C0DD731CC190F14BB66CD89E324EA29E248300653755C4
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 158B
SHA256 249358b1eab901f0b034023569e7f01b1f94c9179591789d99d6f279761d6e1c
MD5 e3fe72c0f542fbb29d9eb8933eefb382
SHA1 fce9a5a6bf89b76d58b4c0f0c691531330ab3b3e
SHA512 f71315278d44c74df19833e56e16d62705ddd45cc9bbabd13be55f51927a3d7464736846a1c4bcda6770c5b8c0720e1defbfbddb5206de648079efb1a9250340
TLSH
T17EC080D9BD4D845FD385187E5716F00007906511942796171650FDC032419A01E29220
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 dc65f9a8facbc74b1904209b5fc78c64685f4fbb065f87e11e7f9ce804e5e4c7
MD5 2ee70ace2e6ad3fd53b0835c86d61ccf
SHA1 682ed2fe4669959f57f52820216820b6d013ae22
SHA512 99af58eb68f43772410146dcba71c156f135393d40b676e30b02e5dc2582d56993c87d9dfa16b177d1173bb6da28e7a56ec1fa1b31da91228ceb79aedd85a852
SSDEEP 96:AVUe/+9GocvNI5cbmcX1B/+lIZ9bNjDrn1Dsgimjn:UUd9BQtJX+lAbZfzi2n
TLSH
T1E0C14DB520010152EB218B3050E336F579FCA2F4FE5F6EF5696C8BB65406350B6AD4CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58be3a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58be3a.TMP
Size 3KB
SHA256 b1bb2064c4b3ff1c4a1b9666391bbfdbae64ee0794e2128c4d863e59c6029443
MD5 2cf9d51ee5086c0b4cf8ccf3005563ac
SHA1 0b264667801c687dbb3bb0c303aad366280440ce
SHA512 30057cb060cb77ba0bf1b8fb6d56db74b08ab442fda81476593ace8e029cf298b4f59aff8d942e54487fcecb51044bec37a672644095b5bdce614958d4e6419b
TLSH
T17F712AB620010153EF210F70909372F27DFCB6E9F6579EF92D7089B765063A086AD94C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 73e616cbcdbafc13b5cd1c7869135ff74587c4ca40fb9aeb7d88d18bcdc4fe72
MD5 b33c5ebd21e40bd078e91ad13675853a
SHA1 53374a334718fcc556dc6028fa65f1df9561ffc7
SHA512 a3a4ce712d76ba0f4eca61ee9c86bdbe27a32c137e446bcbf79864cc9e09b79d59703b7f403a76d76e78a3abc8275e5dff8ef649727f2a25e035c1300471e0f9
TLSH
T1564159F787F2956D9A025AF0AA18EE2ACE2C0510831C787985E0BE56D3E3871E10176F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 5d6d076a3ebe56af93f6c4c0a9bc75f6c5c2491b74e6822a731df331b4de2676
MD5 21f4f7455d49074a7a1b72b59b5fd17e
SHA1 19c3655151da1ccd82d8787c0108935884c637ea
SHA512 250d7cc402b25947b6f9c52af9eb5e2abf9dc25593cc178b1fd040da7094c5eae362b23577f7d17853ae4341c2a3af7f7f26fe61953dfaa59b57e343001cec12
TLSH
T14D4127F747B295AD9B1255F0AA08EE1B8E6C0111831C787985E0BE56D3E3871E102B6F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 69203140dfa9da3d6d3198fd269f9ed96fb280c82c522fd895eba0d335a56100
MD5 2397bd465da92698d9fb5b89291e4b2f
SHA1 17854b45cfe0be69504d5faa1978c396b72d864f
SHA512 a224ff97b91b2cef4dc563974befdac8b8933f532ce6b93b3c45355f9d9b8b583a99864fcb915855b56283d9164efe48de1e72d7fd4a74ca855ec96d641c8247
SSDEEP 192:sxZIwD+RLQyM/jK1Ml8Mkb1/f7DsIyBIDVLHIdp9IcUI9HW6+WNYIxe/Yv1RIjfI:sxZ8+MB/fvsIyBhpHb0/6Wm9
TLSH
T10352D5966A349977CCCBD209FA41BB53D6F51562E3900E44AEFC8A0C05E6AED6307C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 d4ffeaf7e5910d681acf4daa30ffb8aa6eeb969d713d7d17842c76fd91585433
MD5 5cc0b4f557554b0f15f8bb66fe39462c
SHA1 9726c5bdf7d0ad5683f457f991de8b356999d756
SHA512 3350154e40ce508309e94c24ddeb005f60ecb780cb8de275f8dd682a9d5edea9c9000c1c9046d7a1dba32c32c8f5ba34ca6bd72c6d3cedc26442923180c41fe1
SSDEEP 192:sxZIwD+RLQyM/jK1Ml8UQbFjb1/f7DsbryjkIDVLHIdpvIcUI9HW6+WNYIhBXYve:sxZ8+qVB/fvsvyIhbHbbXiTWm5C
TLSH
T1DD62D656AA345977CCDBD209FA41BB53E6F50562E2900F44AAFC9F0C01E6AED630781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 fa4c4f55bc1dcdfb392e92f9a6b96b6f62aea363c5d9b1cd2699781cf3ea850d
MD5 ebd7fac09acc456e7631aa6bb5b85274
SHA1 739d4a627527aeba3b025c1f490342794dd89986
SHA512 ea89b0766bc810301e524f403dbad32b1cb258f989c5a4d7dfd7e32f63b08aad8fe0df624bfbcc1ecc4e102a066488505d40a5d95fd70de6b4248d920a619393
SSDEEP 192:sxZIwD+RLQyM/jK1Ml8M9b1/f7DsbryjkIDVLHIdp9IcUI9HW6+WNYIhBXYv1KIl:sxZ8+1B/fvsvyIhpHbbXPWm5C
TLSH
T13452D5566A34597BCCDBD209FA41BB53D6F51522E3900E44AAFC9B0C01E6BED630781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 491f762f043b4b3c810eef0112e1d4c4ca81643a8b03e8c924c8234cb4157f58
MD5 e105ef0095bdeabdcef40c5f181315f3
SHA1 8be705b7dc1cd4a51bb4945a660e4483f98ba079
SHA512 9f908d5f887ca7f8f57599380cf889d4a3cf632b29f08a60a44ef82f68718cfb88eea4d027c48efc0cabcc7d4189c1f8252f0649e6b551b533fe22f14fdac200
SSDEEP 192:sxZIwD+RLQyM/jK1Ml8Mjb1/f7DsbryjkIDVLHIdp9IcUI9HW6+WNYIhBXYv1KIn:sxZ8+bB/fvsvyIhpHbbXtWm5C
TLSH
T1C052D656AA34597BCCDBD209FA41BB53E6F51522E3900E449AFC9B0C01E6BED630781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 35636101b8ece3ddd84f10905696ef8bd7b917ef8955b0d3294c9087dda1e560
MD5 9d54a7762737b67523bf43757089443d
SHA1 0458d278b73a4825b91234c8b709a0525b721bd3
SHA512 2f0276c72c8edb7904ad3060813cd14d947fda5830bccd2f1ae3c0a4cbb8328791a591fa3cfce429bb2821a020005303aafad138b1ba932524abb3de72b26eb3
SSDEEP 768:LHseJ3xWvhfyn8F1+UoAYDCx9Tuqh0VfUC9xbog/OVYcLly0ppAroeA8:LHseJ3xWvhfynu1jaVcL88pL2
TLSH
T123D20B2B280CCB7E4F844E5DEC266F966EE801CB67984D5487EA884C03C77EB51275DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\c41e8016-acfe-4596-96f4-a749f543712c\index-dir\temp-index
Size 1KB
SHA256 50cf20017c375bc52e2bce7161e173fc7ebd12b4acb92e51d73a3c24fad0d545
MD5 ff0516f12d42afb88a5eaaad172388b3
SHA1 968be40bfb9328f9503bcd3e353fd32f8e411548
SHA512 b02a7cea548ef16311ab088f9c7f1e2ef15a13d2e6d9c337bb2c2121e631ba22724257a73256e4d5cfe8812c2fec1aefca0b643e63032dcd5e1c8474e50198de
TLSH
T1B231414E8E51959FE9A888B2107660F433F0C9EC1B2162634C7C263E7C2A39A1A4B19C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5d00ce.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\c41e8016-acfe-4596-96f4-a749f543712c\index-dir\the-real-index~RFe5d00ce.TMP
Size 1KB
SHA256 8bb1b487cc8a1a981b8d0ac4b6e93a0da0046b7122dfd72df5c4fe08f3d043ff
MD5 4b0b2d4d1559c01436a9336e8276c165
SHA1 446471c793417b13d4cadea2e8b1c875b7804e9a
SHA512 7b5489551c006ea8c9c26c7c79038ba193fd16609b64baa245043d75f8bec4b4385401e233c4d386b4cd9a630bbaa204664b750ab5307ccc05d4165b524b1c55
TLSH
T1B731468F4A459A1FE8D441B2055664B83376C94053127783987D623DBC757AD5E5F0C8
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 d333348791b6b931e9c0461b0740d8c8641257fcf875c589684ddeae3aa71345
MD5 ba3b3064b9e6b9b964b433d7c9ef8e8c
SHA1 821be37c1d8ae5c258aba8f0514150fd3db4ea04
SHA512 b032e3ae4bb03564799ebade05cdc1d60dd12f92137865aa545af40326e5cbfa840daea354fb29d877a03b15ec2f593572c660eac85b623c0807cd80cfd0307b
TLSH
T112E0C0762DD72460BEAFC3D120308090060A749DF941FC4E541BF6D310B235530D7C35
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 d2dda95cc993b285fc8263b87892ae46c35f9df39ed4a2a5234ec67b177ad042
MD5 8a69264b4e4d481708574ab8aace6119
SHA1 4d33cc3efd139871bd4753671a52906545ca5b9b
SHA512 de23ab658f729d0456fd6c27575cc3e2fff1a9be1efe4e1c0efac972aeb75dc5dcf0f8ed73328c070248d4c1064b6ec5c97f1c49caabf4d5ecf00894346adbd7
SSDEEP 48:KYHIhKggkXy8+FCuEA8kMADPIDmkKqBickWO0VjEO5y083ocGO+2kOh9ILc2KWT9:KYH+Kggmu32KYAe+ReKSoo
TLSH
T1A091781331BB020238BD664DB297A63B8F4172973454A4AF7B7904A24E27E261DFD8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe594f4f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe594f4f.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 87af910a94701eca246fcd116d714b2cdb40b19e8036b2fd9d4ef89587851ab3
MD5 5480a45e034e1c5c41ed11180b3c9a52
SHA1 014c5851e764d3ae1c0f5c6d25bde5ef20776aa0
SHA512 3115aa952b1aeabaf9c4d541d3e7bdbd350cd1fb5dd054c4141c69d6d7f3b8b0c12777fa1875c901616dbb825f9a34d12ada32d262bbf2eeb894838119e1e238
SSDEEP 384:TtNn/s3n9SKsN0UIRJr7+RvT9dcSwZAPW:Tj+99lrwhdlwmPW
TLSH
T18C625BB66C795D2B9CE39580F04A33471EF4826B96C42F54E9EC6F0D02DB69C5307A2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 23KB
SHA256 02200c1626220a6d36c476ac10ae75862756b225558e824b0ed71d51a2e38afb
MD5 6fad901a664f6b9dea86f4a8280d9c5f
SHA1 89794f80cdd3a46e671067eca230ea57c9ebf111
SHA512 63243c4198dcd5acdfe927fd6c712378d63e16852b39b830829f8e1050fbc2abef74638aa28d90c1236c619427555ffc33ddfb91665300b7f1b53f62c71317c3
SSDEEP 384:ciF6tNn/s3n9SZesN18TUNTUlIlIRJr7+RqT9dcSwZAPW:HF6j+9/4wgWrZhd3wmPW
TLSH
T170B2E6F358D7893AD8AE8743A37E2E025EBCC167B5815A50B7985E0CCD861BFC306915
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 d9f2e6c0d4f524de1bbe1e1a45e8209be26459e640d53a747a112918b9cd43e7
MD5 221cdddf6fae4125609f07defcc82f83
SHA1 00dfa9975cd30dadbb2334dc8626f03f40d79e8c
SHA512 3ece62e23cf75b6da5188bc4c245ca89c5c4fb10569bfe81fe722359c8357d6a6278bf96e01b1abfd40bcc543826e1abb91004e9b9961e569527a7d79e0c8898
SSDEEP 192:lONV6vMtPQmiUyIiIZThT/hCi0bC847JB1U/u:lONV6UtRhTSdMlU/u
TLSH
T1B2020A36BC686C6BEEA7AE45F48A23171FE4117FE6905B50EAE82F1D00D765C1303927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 b9ca4d6de1a4075edc8dfc1ed7c818e5cbda5f32b6c7541733954c9684d220ed
MD5 c63e471db5e38ba3398cd4920cd72d98
SHA1 16066578d14dda410ec807cf70943cd670626f8f
SHA512 8468f94fb9233609845fbcd0045b7b695746e07189a7077d0d314b30735ed13d6369988b75dc2ba4ab67b92dfe12fdcc0a6ef083f61855e6f9b650b4194c6aad
SSDEEP 384:mtNn/s3n9ScsN0UcRJr7+evT9dcSwZAPW:mj+9fRrdhdlwmPW
TLSH
T1EE626CB669785D2B9CE39690F04B33471EF4826B97C02F54E9DC6F0D02DB69C5307A2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 75f5acf3df7a6fa40bcd379589488970972dc97e7eb3eac24f408167a50c5c12
MD5 d141eea33073a16aecbae4c3a075e5d0
SHA1 50928f4e4c480cb959bfe995d987de246d6b9203
SHA512 a741362a1bb974601000e8b3ee6bd20fc27b1815594f0d86daddc6dcd5c172daec5173048b1e3414801e5b25ea83eb677e558a5fbe9baf151e5218a6c3a938e7
SSDEEP 384:+tNn/s3n9SfsN0UxRJr7+HvT9dcSwZAPW:+j+9UuryhdlwmPW
TLSH
T162625CB6AD785D2B9DE39690F04B33471EF4826B96C02F54E9DC6F0D02DB69C0307A1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 c16893d38939caf149cf3698756c1dcd32ffd7cbc5b7f009c827079fcb59c6ea
MD5 b842f5244af174cb72c9a4ec24c5dd48
SHA1 f47be68f7ea2c7942e43a49b78e2b25ffcd6cbf3
SHA512 11b7ceb9612f63c7d9a2271a65d625a45510f51328934ed0faaa04892038aedf2b9c19b494284d32cf4a0ba8ce4f2217556d9f376ac8f456d637f0b2ec504ca1
SSDEEP 192:X2ONS36vM/4PQmiUyIHIZeahT/hCi0bcvNd80IJHqtU/u:GONO6UwRMBSdciwU/u
TLSH
T166121CB7AC649C6BAD93A551F48A22071EB0826BEB845F50FADC2F1C01EB65C5307917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4182b764-ec38-473c-9053-0ae27b721bc5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\4182b764-ec38-473c-9053-0ae27b721bc5.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 e25b329a811d79692024068c9498ef1b069574dfcf98f8a881faadeef20f8334
MD5 1377ad8ba2504ff632a5ad2079dc12ad
SHA1 a82cbc2461455ffeca07e85fed32c47f3c274b5b
SHA512 2cddd0b743e72b1e14988a12f6b8ea0877758fb859c8330091151b04f9cedd7240a46dbdd84deb0ffb4a0d558c57aa816a82d07bfb93ba63adc6becc54b90471
TLSH
T164411658AAEE1108B3B36E5A9BF6686D187B7C373E06945E10110D4E4A23F40CC61B37
MD5 SHA1 SHA512 TLSH

Submit Download

ILOVEYOU.vbs

Path C:\Users\Admin\Downloads\ILOVEYOU.vbs
Size 10KB
SHA256 0f229fc818832674422a7c898645c35295821bbcab4c1c09d51d6559ab5c6ce6
MD5 6e1dd3693b56da7ef1e8b4232841cae0
SHA1 a4ddd95e0b91782a9a1e4df8a79aec62a25e22b6
SHA512 65a8e4e6dc8203378bdfc338fe17caf2a47bf780d92e7dfc68cbf66e5d5f411c00d4169d4db0c36ace5603684f260d9311901012cd6af1ac9b00bfa9c244b8a0
SSDEEP 192:wBXDFKIv3c6JuT30y4geMMM+M+MvMsM0MLMsMeMXMMcTMS6PhxSoMiPbZWI4COnC:wBzoo3c6YT30y4Ztr7on1inv45cTP6Zp
TLSH
T1FF22B8127B89D663C6A2B2713205544EF2B044F0C467D7D87C989BC438BAE5D87BDCB6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download