hxxp://asdjk[.]adjaskladj

Analysis

user interaction
yes
max time kernel
156s
max time network
158s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
24/07/2026, 22:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://asdjk.adjaskladj
Sample260724-1317kstyht

Score

8^/10

discovery execution persistence

Malware Config

Signatures

Badlisted process makes network request 5 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
232	6916	powershell.exe
234	6916	powershell.exe
260	7904	powershell.exe
262	5124	powershell.exe
264	8064	powershell.exe

Checks for any installed AV software in registry 1 TTPs 5 IoCs

Security Software Discovery

T1518.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\klhk\Parameters	DeviceCensus.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast	DeviceCensus.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avast Software\Avast	DeviceCensus.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\KasperskyLab	DeviceCensus.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\KasperskyLab	DeviceCensus.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 9 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
6928	powershell.exe
7656	powershell.exe
7108	powershell.exe
6472	powershell.exe
8052	powershell.exe
1264	powershell.exe
7616	powershell.exe
2376	powershell.exe
6300	powershell.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
233	raw.githubusercontent.com
234	raw.githubusercontent.com

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Documents\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	firefox.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\D3DSCache	DeviceCensus.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\D3DSCache\90ccb9cba3f45768\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock	DeviceCensus.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\D3DSCache\90ccb9cba3f45768\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx	DeviceCensus.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\D3DSCache\90ccb9cba3f45768\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val	DeviceCensus.exe

Drops file in Windows directory 16 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4300_126061993\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4300_126061993\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4300_126061993\smart_switch_list.json	msedge.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	UserOOBEBroker.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4300_1087181906\typosquatting_list.pb	msedge.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setupact.log	UserOOBEBroker.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4300_1842021628\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4300_126061993\manifest.json	msedge.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setupact.log	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	UserOOBEBroker.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4300_1842021628\data.txt	msedge.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	UserOOBEBroker.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4300_1087181906\manifest.json	msedge.exe

Launches sc.exe 38 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4048	sc.exe
7056	sc.exe
6212	sc.exe
6932	sc.exe
4208	sc.exe
6792	sc.exe
2376	sc.exe
6836	sc.exe
1480	sc.exe
3140	sc.exe
5852	sc.exe
2376	sc.exe
6600	sc.exe
2924	sc.exe
3960	sc.exe
6720	sc.exe
1480	sc.exe
7068	sc.exe
6624	sc.exe
6404	sc.exe
4304	sc.exe
1276	sc.exe
4716	sc.exe
4912	sc.exe
4416	sc.exe
5280	sc.exe
2264	sc.exe
6360	sc.exe
6632	sc.exe
5400	sc.exe
6300	sc.exe
6852	sc.exe
4492	sc.exe
7132	sc.exe
4712	sc.exe
1940	sc.exe
1620	sc.exe
5724	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Executes a command shell one-liner 1 TTPs 37 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
7108	cmd.exe
6584	cmd.exe
6832	cmd.exe
6112	cmd.exe
7056	cmd.exe
6852	cmd.exe
5252	cmd.exe
6456	cmd.exe
3468	cmd.exe
6356	cmd.exe
6720	cmd.exe
7828	cmd.exe
6668	cmd.exe
6464	cmd.exe
2376	cmd.exe
4716	cmd.exe
4120	cmd.exe
7600	cmd.exe
6896	cmd.exe
6728	cmd.exe
4764	cmd.exe
3884	cmd.exe
6460	cmd.exe
1700	cmd.exe
6756	cmd.exe
6924	cmd.exe
4784	cmd.exe
7852	cmd.exe
6132	cmd.exe
388	cmd.exe
6656	cmd.exe
6516	cmd.exe
3988	cmd.exe
6632	cmd.exe
6532	cmd.exe
7128	cmd.exe
6768	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FileCoAuth.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FileCoAuth.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FileCoAuth.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 6 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
6464	cmd.exe
6672	PING.EXE
4764	cmd.exe
5912	PING.EXE
7128	cmd.exe
2384	PING.EXE

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2652	msedge.exe
5572	msedge.exe

Checks SCSI registry key(s) 3 TTPs 18 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	DeviceCensus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	Clipup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	clipup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	clipup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs	clipup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs	Clipup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	clipup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	clipup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs	DeviceCensus.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	Clipup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	Clipup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	Clipup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	DeviceCensus.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	Clipup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	clipup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	DeviceCensus.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	DeviceCensus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	DeviceCensus.exe

Checks processor information in registry 2 TTPs 36 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	DeviceCensus.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	DeviceCensus.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	DeviceCensus.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	DeviceCensus.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	DeviceCensus.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Previous Update Revision	DeviceCensus.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	DeviceCensus.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Status	DeviceCensus.exe

Enumerates system info in registry 2 TTPs 16 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	DeviceCensus.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSVersion	DeviceCensus.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardProduct	DeviceCensus.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardVersion	DeviceCensus.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	DeviceCensus.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	DeviceCensus.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSVendor	DeviceCensus.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSReleaseDate	DeviceCensus.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	DeviceCensus.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	DeviceCensus.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
7900	ipconfig.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134294046951384230"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2684263265-1628758615-802431902-1000\{AFA1B0D6-2CD9-4982-9BE3-C8DEC569155E}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2684263265-1628758615-802431902-1000\{2633DEBE-9C3D-4E8A-9915-62002A6EA1A0}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2684263265-1628758615-802431902-1000_Classes\Local Settings	firefox.exe

Modifies registry key 1 TTPs 64 IoCs

Modify Registry

T1112

pid	Process
4036	reg.exe
4180	reg.exe
3884	reg.exe
6940	reg.exe
6720	reg.exe
7144	reg.exe
3140	reg.exe
7424	reg.exe
7540	reg.exe
6436	reg.exe
3988	reg.exe
6356	reg.exe
6156	reg.exe
7440	reg.exe
6324	reg.exe
6384	reg.exe
6444	reg.exe
6436	reg.exe
7152	reg.exe
7908	reg.exe
6788	reg.exe
2924	reg.exe
2376	reg.exe
6356	reg.exe
3884	reg.exe
4628	reg.exe
5464	reg.exe
184	reg.exe
4416	reg.exe
3348	reg.exe
1276	reg.exe
7296	reg.exe
7132	reg.exe
1940	reg.exe
4712	reg.exe
7140	reg.exe
6324	reg.exe
5464	reg.exe
6928	reg.exe
6592	reg.exe
6444	reg.exe
6932	reg.exe
7464	reg.exe
1468	reg.exe
5752	reg.exe
2276	reg.exe
6300	reg.exe
6532	reg.exe
6600	reg.exe
6436	reg.exe
4304	reg.exe
6720	reg.exe
4712	reg.exe
1276	reg.exe
4628	reg.exe
3140	reg.exe
7060	reg.exe
6584	reg.exe
7780	reg.exe
724	reg.exe
6576	reg.exe
6184	reg.exe
1620	reg.exe
6500	reg.exe

Runs ping.exe 1 TTPs 3 IoCs

Remote System Discovery

T1018

pid	Process
2384	PING.EXE
6672	PING.EXE
5912	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
6916	powershell.exe
6916	powershell.exe
6916	powershell.exe
6940	powershell.exe
6940	powershell.exe
6940	powershell.exe
7140	powershell.exe
7140	powershell.exe
7140	powershell.exe
4300	msedge.exe
4300	msedge.exe
2184	WMIC.exe
2184	WMIC.exe
2184	WMIC.exe
2184	WMIC.exe
6768	powershell.exe
6768	powershell.exe
6768	powershell.exe
7060	WMIC.exe
7060	WMIC.exe
7060	WMIC.exe
7060	WMIC.exe
7100	powershell.exe
7100	powershell.exe
7100	powershell.exe
2376	powershell.exe
2376	powershell.exe
2376	powershell.exe
6760	powershell.exe
6760	powershell.exe
6760	powershell.exe
7108	powershell.exe
7108	powershell.exe
7108	powershell.exe
3960	WMIC.exe
3960	WMIC.exe
3960	WMIC.exe
3960	WMIC.exe
1620	WMIC.exe
1620	WMIC.exe
1620	WMIC.exe
1620	WMIC.exe
6532	WMIC.exe
6532	WMIC.exe
6532	WMIC.exe
6532	WMIC.exe
6404	powershell.exe
6404	powershell.exe
6404	powershell.exe
6156	powershell.exe
6156	powershell.exe
6156	powershell.exe
6300	powershell.exe
6300	powershell.exe
6300	powershell.exe
3960	powershell.exe
3960	powershell.exe
3960	powershell.exe
3880	powershell.exe
3880	powershell.exe
3880	powershell.exe
6532	WMIC.exe
6532	WMIC.exe
6532	WMIC.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3420	firefox.exe
Token: SeDebugPrivilege	3420	firefox.exe
Token: SeDebugPrivilege	6916	powershell.exe
Token: SeDebugPrivilege	6940	powershell.exe
Token: SeDebugPrivilege	7140	powershell.exe
Token: SeIncreaseQuotaPrivilege	2184	WMIC.exe
Token: SeSecurityPrivilege	2184	WMIC.exe
Token: SeTakeOwnershipPrivilege	2184	WMIC.exe
Token: SeLoadDriverPrivilege	2184	WMIC.exe
Token: SeSystemProfilePrivilege	2184	WMIC.exe
Token: SeSystemtimePrivilege	2184	WMIC.exe
Token: SeProfSingleProcessPrivilege	2184	WMIC.exe
Token: SeIncBasePriorityPrivilege	2184	WMIC.exe
Token: SeCreatePagefilePrivilege	2184	WMIC.exe
Token: SeBackupPrivilege	2184	WMIC.exe
Token: SeRestorePrivilege	2184	WMIC.exe
Token: SeShutdownPrivilege	2184	WMIC.exe
Token: SeDebugPrivilege	2184	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2184	WMIC.exe
Token: SeRemoteShutdownPrivilege	2184	WMIC.exe
Token: SeUndockPrivilege	2184	WMIC.exe
Token: SeManageVolumePrivilege	2184	WMIC.exe
Token: 33	2184	WMIC.exe
Token: 34	2184	WMIC.exe
Token: 35	2184	WMIC.exe
Token: 36	2184	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2184	WMIC.exe
Token: SeSecurityPrivilege	2184	WMIC.exe
Token: SeTakeOwnershipPrivilege	2184	WMIC.exe
Token: SeLoadDriverPrivilege	2184	WMIC.exe
Token: SeSystemProfilePrivilege	2184	WMIC.exe
Token: SeSystemtimePrivilege	2184	WMIC.exe
Token: SeProfSingleProcessPrivilege	2184	WMIC.exe
Token: SeIncBasePriorityPrivilege	2184	WMIC.exe
Token: SeCreatePagefilePrivilege	2184	WMIC.exe
Token: SeBackupPrivilege	2184	WMIC.exe
Token: SeRestorePrivilege	2184	WMIC.exe
Token: SeShutdownPrivilege	2184	WMIC.exe
Token: SeDebugPrivilege	2184	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2184	WMIC.exe
Token: SeRemoteShutdownPrivilege	2184	WMIC.exe
Token: SeUndockPrivilege	2184	WMIC.exe
Token: SeManageVolumePrivilege	2184	WMIC.exe
Token: 33	2184	WMIC.exe
Token: 34	2184	WMIC.exe
Token: 35	2184	WMIC.exe
Token: 36	2184	WMIC.exe
Token: SeDebugPrivilege	6768	powershell.exe
Token: SeIncreaseQuotaPrivilege	7060	WMIC.exe
Token: SeSecurityPrivilege	7060	WMIC.exe
Token: SeTakeOwnershipPrivilege	7060	WMIC.exe
Token: SeLoadDriverPrivilege	7060	WMIC.exe
Token: SeSystemProfilePrivilege	7060	WMIC.exe
Token: SeSystemtimePrivilege	7060	WMIC.exe
Token: SeProfSingleProcessPrivilege	7060	WMIC.exe
Token: SeIncBasePriorityPrivilege	7060	WMIC.exe
Token: SeCreatePagefilePrivilege	7060	WMIC.exe
Token: SeBackupPrivilege	7060	WMIC.exe
Token: SeRestorePrivilege	7060	WMIC.exe
Token: SeShutdownPrivilege	7060	WMIC.exe
Token: SeDebugPrivilege	7060	WMIC.exe
Token: SeSystemEnvironmentPrivilege	7060	WMIC.exe
Token: SeRemoteShutdownPrivilege	7060	WMIC.exe
Token: SeUndockPrivilege	7060	WMIC.exe

Suspicious use of FindShellTrayWindow 52 IoCs

pid	Process
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
3420	firefox.exe
3420	firefox.exe
3420	firefox.exe
3420	firefox.exe
3420	firefox.exe
3420	firefox.exe
3420	firefox.exe
3420	firefox.exe
3420	firefox.exe
3420	firefox.exe
3420	firefox.exe
3420	firefox.exe
3420	firefox.exe
3420	firefox.exe
3420	firefox.exe
3420	firefox.exe
3420	firefox.exe
3420	firefox.exe

Suspicious use of SendNotifyMessage 44 IoCs

pid	Process
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
3420	firefox.exe
3420	firefox.exe
3420	firefox.exe
3420	firefox.exe
3420	firefox.exe
3420	firefox.exe
3420	firefox.exe
3420	firefox.exe
3420	firefox.exe
3420	firefox.exe
3420	firefox.exe
3420	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3420	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4484 wrote to memory of 4792	4484	msedge.exe	84
PID 4484 wrote to memory of 2652	4484	msedge.exe	85
PID 4484 wrote to memory of 3856	4484	msedge.exe	86
PID 4484 wrote to memory of 3856	4484	msedge.exe	86
PID 4484 wrote to memory of 3856	4484	msedge.exe	86
PID 4484 wrote to memory of 1896	4484	msedge.exe	87
PID 4484 wrote to memory of 1896	4484	msedge.exe	87
PID 4484 wrote to memory of 5100	4484	msedge.exe	88
PID 4484 wrote to memory of 5100	4484	msedge.exe	88
PID 4484 wrote to memory of 5100	4484	msedge.exe	88
PID 4484 wrote to memory of 2436	4484	msedge.exe	89
PID 4484 wrote to memory of 2436	4484	msedge.exe	89
PID 4484 wrote to memory of 2436	4484	msedge.exe	89
PID 4484 wrote to memory of 4996	4484	msedge.exe	91
PID 4484 wrote to memory of 4996	4484	msedge.exe	91
PID 4484 wrote to memory of 4996	4484	msedge.exe	91
PID 4484 wrote to memory of 4052	4484	msedge.exe	94
PID 4484 wrote to memory of 4052	4484	msedge.exe	94
PID 4484 wrote to memory of 4052	4484	msedge.exe	94
PID 4484 wrote to memory of 3432	4484	msedge.exe	95
PID 4484 wrote to memory of 1348	4484	msedge.exe	96
PID 4484 wrote to memory of 3432	4484	msedge.exe	95
PID 4484 wrote to memory of 1348	4484	msedge.exe	96
PID 4484 wrote to memory of 4196	4484	msedge.exe	98
PID 4484 wrote to memory of 4300	4484	msedge.exe	101
PID 4300 wrote to memory of 3868	4300	msedge.exe	102
PID 4300 wrote to memory of 5572	4300	msedge.exe	103
PID 4300 wrote to memory of 5244	4300	msedge.exe	104
PID 4300 wrote to memory of 5244	4300	msedge.exe	104
PID 4300 wrote to memory of 5244	4300	msedge.exe	104
PID 4300 wrote to memory of 1112	4300	msedge.exe	105
PID 4300 wrote to memory of 1112	4300	msedge.exe	105
PID 4300 wrote to memory of 3824	4300	msedge.exe	108
PID 4300 wrote to memory of 4668	4300	msedge.exe	109
PID 4300 wrote to memory of 4668	4300	msedge.exe	109
PID 4300 wrote to memory of 5676	4300	msedge.exe	110
PID 4300 wrote to memory of 5676	4300	msedge.exe	110
PID 4300 wrote to memory of 248	4300	msedge.exe	111
PID 4300 wrote to memory of 248	4300	msedge.exe	111
PID 4300 wrote to memory of 1324	4300	msedge.exe	112
PID 4300 wrote to memory of 1324	4300	msedge.exe	112
PID 4300 wrote to memory of 2272	4300	msedge.exe	113
PID 4300 wrote to memory of 2272	4300	msedge.exe	113
PID 1556 wrote to memory of 3420	1556	firefox.exe	118
PID 1556 wrote to memory of 3420	1556	firefox.exe	118
PID 4300 wrote to memory of 5008	4300	msedge.exe	119
PID 4300 wrote to memory of 5008	4300	msedge.exe	119
PID 4300 wrote to memory of 572	4300	msedge.exe	120
PID 4300 wrote to memory of 572	4300	msedge.exe	120
PID 3420 wrote to memory of 1992	3420	firefox.exe	121
PID 3420 wrote to memory of 1992	3420	firefox.exe	121
PID 3420 wrote to memory of 1992	3420	firefox.exe	121
PID 3420 wrote to memory of 544	3420	firefox.exe	122
PID 3420 wrote to memory of 544	3420	firefox.exe	122
PID 3420 wrote to memory of 544	3420	firefox.exe	122
PID 3420 wrote to memory of 544	3420	firefox.exe	122
PID 3420 wrote to memory of 2908	3420	firefox.exe	123
PID 3420 wrote to memory of 2908	3420	firefox.exe	123
PID 3420 wrote to memory of 2908	3420	firefox.exe	123
PID 3420 wrote to memory of 2908	3420	firefox.exe	123
PID 3420 wrote to memory of 5824	3420	firefox.exe	124
PID 3420 wrote to memory of 5824	3420	firefox.exe	124
PID 3420 wrote to memory of 5824	3420	firefox.exe	124
PID 3420 wrote to memory of 5700	3420	firefox.exe	125

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://asdjk.adjaskladj
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x308,0x7ffed353c188,0x7ffed353c194,0x7ffed353c1a0
  2⤵
  PID:4792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1800,i,2327253866313710240,3654026973552818172,524288 --field-trial-handle=2328,i,10982009008632671569,2061547004060801269,262144 --variations-seed-version --mojo-platform-channel-handle=2356 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1672,i,11150840987221959370,12746908303987262180,262144 --field-trial-handle=2328,i,10982009008632671569,2061547004060801269,262144 --variations-seed-version --mojo-platform-channel-handle=2324 /prefetch:2
  2⤵
  PID:3856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2468,i,4320923730790461142,7575063964535282860,524288 --field-trial-handle=2328,i,10982009008632671569,2061547004060801269,262144 --variations-seed-version --mojo-platform-channel-handle=2580 /prefetch:8
  2⤵
  PID:1896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3496,i,3225069386621662997,10459949954322199866,2097152 --field-trial-handle=2328,i,10982009008632671569,2061547004060801269,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:1
  2⤵
  PID:5100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3500,i,13603962268925216970,3769169729710590035,2097152 --field-trial-handle=2328,i,10982009008632671569,2061547004060801269,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:1
  2⤵
  PID:2436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4984,i,15868478467067286485,13275515744478606645,2097152 --field-trial-handle=2328,i,10982009008632671569,2061547004060801269,262144 --variations-seed-version --mojo-platform-channel-handle=4976 /prefetch:1
  2⤵
  PID:4996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=3740,i,463348281978477762,8137074208683293577,2097152 --field-trial-handle=2328,i,10982009008632671569,2061547004060801269,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:1
  2⤵
  PID:4052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3216,i,10630673179098234524,14096271104505781272,524288 --field-trial-handle=2328,i,10982009008632671569,2061547004060801269,262144 --variations-seed-version --mojo-platform-channel-handle=4984 /prefetch:8
  2⤵
  PID:3432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5040,i,2924693298863811376,1770243583085516199,524288 --field-trial-handle=2328,i,10982009008632671569,2061547004060801269,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:8
  2⤵
  PID:1348
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5828,i,10725685455018606894,9400966364460765643,524288 --field-trial-handle=2328,i,10982009008632671569,2061547004060801269,262144 --variations-seed-version --mojo-platform-channel-handle=5588 /prefetch:8
  2⤵
  PID:1784
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5828,i,10725685455018606894,9400966364460765643,524288 --field-trial-handle=2328,i,10982009008632671569,2061547004060801269,262144 --variations-seed-version --mojo-platform-channel-handle=5588 /prefetch:8
  2⤵
  PID:4196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
  2⤵
  - Drops file in Windows directory
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4300
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x284,0x7ffed353c188,0x7ffed353c194,0x7ffed353c1a0
    3⤵
    PID:3868
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1896,i,2801545948867076801,13813492419097198919,524288 --field-trial-handle=2276,i,13745899599161165204,17144596179756685879,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:3
    3⤵
    - System Time Discovery
    PID:5572
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1752,i,1742522916673272838,1111246863725590729,262144 --field-trial-handle=2276,i,13745899599161165204,17144596179756685879,262144 --variations-seed-version --mojo-platform-channel-handle=2264 /prefetch:2
    3⤵
    PID:5244
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2600,i,13331977942558885121,7605042389272750382,524288 --field-trial-handle=2276,i,13745899599161165204,17144596179756685879,262144 --variations-seed-version --mojo-platform-channel-handle=2892 /prefetch:8
    3⤵
    PID:1112
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4376,i,10576045367746678777,3396694028568231200,524288 --field-trial-handle=2276,i,13745899599161165204,17144596179756685879,262144 --variations-seed-version --mojo-platform-channel-handle=4392 /prefetch:8
    3⤵
    PID:3588
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4376,i,10576045367746678777,3396694028568231200,524288 --field-trial-handle=2276,i,13745899599161165204,17144596179756685879,262144 --variations-seed-version --mojo-platform-channel-handle=4392 /prefetch:8
    3⤵
    PID:3824
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4572,i,1173258163945338004,5218731463752693304,524288 --field-trial-handle=2276,i,13745899599161165204,17144596179756685879,262144 --variations-seed-version --mojo-platform-channel-handle=4576 /prefetch:8
    3⤵
    PID:4668
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4592,i,4797975238830522005,16637245646775464503,524288 --field-trial-handle=2276,i,13745899599161165204,17144596179756685879,262144 --variations-seed-version --mojo-platform-channel-handle=4712 /prefetch:8
    3⤵
    PID:5676
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4812,i,3104343566018599576,10326306572184622320,524288 --field-trial-handle=2276,i,13745899599161165204,17144596179756685879,262144 --variations-seed-version --mojo-platform-channel-handle=4816 /prefetch:8
    3⤵
    PID:248
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4720,i,10474395799464095031,12321924647074405037,524288 --field-trial-handle=2276,i,13745899599161165204,17144596179756685879,262144 --variations-seed-version --mojo-platform-channel-handle=4700 /prefetch:8
    3⤵
    PID:1324
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4400,i,2924343933999314928,5838590862932896364,524288 --field-trial-handle=2276,i,13745899599161165204,17144596179756685879,262144 --variations-seed-version --mojo-platform-channel-handle=4984 /prefetch:8
    3⤵
    PID:2272
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4948,i,13249167478327844144,12277780796786310575,524288 --field-trial-handle=2276,i,13745899599161165204,17144596179756685879,262144 --variations-seed-version --mojo-platform-channel-handle=4620 /prefetch:8
    3⤵
    PID:5008
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4828,i,1968066032184419789,9006035814670876183,524288 --field-trial-handle=2276,i,13745899599161165204,17144596179756685879,262144 --variations-seed-version --mojo-platform-channel-handle=4832 /prefetch:8
    3⤵
    PID:572
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5076,i,17687726322347412554,9015470590362661869,524288 --field-trial-handle=2276,i,13745899599161165204,17144596179756685879,262144 --variations-seed-version --mojo-platform-channel-handle=5000 /prefetch:8
    3⤵
    PID:2276
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5060,i,14502011225457235636,279511277852520133,524288 --field-trial-handle=2276,i,13745899599161165204,17144596179756685879,262144 --variations-seed-version --mojo-platform-channel-handle=2872 /prefetch:8
    3⤵
    PID:2560
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5064,i,192513714639250955,2822415868609143712,524288 --field-trial-handle=2276,i,13745899599161165204,17144596179756685879,262144 --variations-seed-version --mojo-platform-channel-handle=5080 /prefetch:8
    3⤵
    PID:4928
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4176,i,16576383083260792203,6960531885570641216,524288 --field-trial-handle=2276,i,13745899599161165204,17144596179756685879,262144 --variations-seed-version --mojo-platform-channel-handle=4644 /prefetch:8
    3⤵
    PID:2880
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4820,i,10571246032943086404,9986494322571223659,524288 --field-trial-handle=2276,i,13745899599161165204,17144596179756685879,262144 --variations-seed-version --mojo-platform-channel-handle=5064 /prefetch:8
    3⤵
    PID:6732
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4660,i,5324822462006195829,1393826456576084983,262144 --field-trial-handle=2276,i,13745899599161165204,17144596179756685879,262144 --variations-seed-version --mojo-platform-channel-handle=5064 /prefetch:8
    3⤵
    PID:7852
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4340,i,12802056160417647623,12586602146187629456,524288 --field-trial-handle=2276,i,13745899599161165204,17144596179756685879,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:8
    3⤵
    PID:6944

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4900

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5628

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2868

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1556
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Drops desktop.ini file(s)
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3420
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2024 -prefsLen 27100 -prefMapHandle 2028 -prefMapSize 270279 -ipcHandle 2104 -initialChannelId {b6a3b610-981c-4a07-92be-d68d883a059a} -parentPid 3420 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3420" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:1992
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2464 -prefsLen 27136 -prefMapHandle 2468 -prefMapSize 270279 -ipcHandle 2488 -initialChannelId {9699f716-7a88-4388-b202-7b13f26e7703} -parentPid 3420 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3420" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:544
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3860 -prefsLen 27277 -prefMapHandle 3864 -prefMapSize 270279 -jsInitHandle 3868 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3876 -initialChannelId {f0d9d9d9-ba13-43a0-9319-e2d7ef3f05ff} -parentPid 3420 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3420" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:2908
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4044 -prefsLen 27277 -prefMapHandle 4048 -prefMapSize 270279 -ipcHandle 4148 -initialChannelId {dd493348-0479-46b5-a008-9e20d922db4d} -parentPid 3420 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3420" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:5824
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4484 -prefsLen 34776 -prefMapHandle 4488 -prefMapSize 270279 -jsInitHandle 4492 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4500 -initialChannelId {81995290-41ce-410e-b51b-cdf2d8f23b4d} -parentPid 3420 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3420" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:5700
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4968 -prefsLen 34932 -prefMapHandle 4972 -prefMapSize 270279 -ipcHandle 4892 -initialChannelId {4345a316-558e-4e17-8ccc-1cd0da43d64f} -parentPid 3420 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3420" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:3156
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5352 -prefsLen 32952 -prefMapHandle 5348 -prefMapSize 270279 -jsInitHandle 5344 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5304 -initialChannelId {9e26ffaf-8f8b-45cb-9428-a29acd6dd946} -parentPid 3420 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3420" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:1864
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5476 -prefsLen 32952 -prefMapHandle 5480 -prefMapSize 270279 -jsInitHandle 5484 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5492 -initialChannelId {6c2ff026-175d-4022-9085-0283efeba2a1} -parentPid 3420 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3420" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:2896
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5664 -prefsLen 32952 -prefMapHandle 5668 -prefMapSize 270279 -jsInitHandle 5672 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5680 -initialChannelId {dc53e2ec-b15a-493c-8e02-514324e2a52e} -parentPid 3420 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3420" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:5552
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4452 -prefsLen 33071 -prefMapHandle 2784 -prefMapSize 270279 -jsInitHandle 2788 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4632 -initialChannelId {32a8e4c8-407a-4bc4-bcce-406f638ac011} -parentPid 3420 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3420" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:5956
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6360 -prefsLen 33071 -prefMapHandle 6204 -prefMapSize 270279 -jsInitHandle 6364 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6536 -initialChannelId {9401f2f5-867d-4256-b570-6972adc4b8db} -parentPid 3420 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3420" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
    3⤵
    - Checks processor information in registry
    PID:4612
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6800 -prefsLen 33071 -prefMapHandle 6804 -prefMapSize 270279 -jsInitHandle 6808 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6272 -initialChannelId {812550f2-3289-4697-8f10-9631be529034} -parentPid 3420 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3420" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
    3⤵
    - Checks processor information in registry
    PID:3508

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
1⤵
- Badlisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6916
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c "echo CMD is working"
  2⤵
  - Executes a command shell one-liner
  PID:6460
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c ""C:\Windows\Temp\MAS_14e86a88-c2ce-4ea8-b2e1-59dc48d3c2e0.cmd" -el "
  2⤵
  - Executes a command shell one-liner
  PID:6668
- - C:\Windows\System32\sc.exe
    sc query Null
    3⤵
    - Launches sc.exe
    PID:6720
- - C:\Windows\System32\find.exe
    find /i "RUNNING"
    3⤵
    PID:6728
- - C:\Windows\System32\findstr.exe
    findstr /v "$" "C:\Windows\Temp\MAS_14e86a88-c2ce-4ea8-b2e1-59dc48d3c2e0.cmd"
    3⤵
    PID:1480
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /S /D /c" echo "-el" "
    3⤵
    PID:2012
- - C:\Windows\System32\find.exe
    find /i "/"
    3⤵
    PID:6456
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c ver
    3⤵
    - Executes a command shell one-liner
    PID:6132
- - C:\Windows\System32\reg.exe
    reg query "HKCU\Console" /v ForceV2
    3⤵
    PID:6756
- - C:\Windows\System32\find.exe
    find /i "0x0"
    3⤵
    PID:6764
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /S /D /c" echo "AMD64 " "
    3⤵
    PID:6816
- - C:\Windows\System32\find.exe
    find /i "ARM64"
    3⤵
    PID:6796
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c echo prompt $E | cmd
    3⤵
    - Executes a command shell one-liner
    PID:1700
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /S /D /c" echo prompt $E "
      4⤵
      PID:5400
  - - C:\Windows\System32\cmd.exe
      cmd
      4⤵
      PID:2264
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /S /D /c" echo "C:\Windows\Temp\MAS_14e86a88-c2ce-4ea8-b2e1-59dc48d3c2e0.cmd" "
    3⤵
    PID:7144
- - C:\Windows\System32\find.exe
    find /i "C:\Users\Admin\AppData\Local\Temp"
    3⤵
    PID:7148
- - C:\Windows\System32\fltMC.exe
    fltmc
    3⤵
    PID:7100
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "if ($PSVersionTable.PSEdition -ne 'Core') {$f=[IO.File]::ReadAllText('C:\Windows\Temp\MAS_14e86a88-c2ce-4ea8-b2e1-59dc48d3c2e0.cmd') -split ':pstst';. ([scriptblock]::Create($f[1]))}" 2>nul
    3⤵
    - Executes a command shell one-liner
    PID:6896
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "if ($PSVersionTable.PSEdition -ne 'Core') {$f=[IO.File]::ReadAllText('C:\Windows\Temp\MAS_14e86a88-c2ce-4ea8-b2e1-59dc48d3c2e0.cmd') -split ':pstst';. ([scriptblock]::Create($f[1]))}"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:6940
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c mode con
    3⤵
    - Executes a command shell one-liner
    PID:388
  - - C:\Windows\System32\mode.com
      mode con
      4⤵
      PID:7012
- - C:\Windows\System32\reg.exe
    reg query HKCU\Console /v QuickEdit
    3⤵
    - Modifies registry key
    PID:6436
- - C:\Windows\System32\find.exe
    find /i "0x0"
    3⤵
    PID:7068
- - C:\Windows\System32\reg.exe
    reg add HKCU\Console /v QuickEdit /t REG_DWORD /d 0 /f
    3⤵
    - Modifies registry key
    PID:4180
- - C:\Windows\System32\cmd.exe
    cmd.exe /c ""C:\Windows\Temp\MAS_14e86a88-c2ce-4ea8-b2e1-59dc48d3c2e0.cmd" -el -qedit"
    3⤵
    - Executes a command shell one-liner
    PID:6656
  - - C:\Windows\System32\sc.exe
      sc query Null
      4⤵
      Launches sc.exe
      PID:4048
  - - C:\Windows\System32\find.exe
      find /i "RUNNING"
      4⤵
      PID:2276
  - - C:\Windows\System32\findstr.exe
      findstr /v "$" "C:\Windows\Temp\MAS_14e86a88-c2ce-4ea8-b2e1-59dc48d3c2e0.cmd"
      4⤵
      PID:2012
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /S /D /c" echo "-el -qedit" "
      4⤵
      PID:6752
  - - C:\Windows\System32\find.exe
      find /i "/"
      4⤵
      PID:6384
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c ver
      4⤵
      Executes a command shell one-liner
      PID:6756
  - - C:\Windows\System32\reg.exe
      reg query "HKCU\Console" /v ForceV2
      4⤵
      PID:6840
  - - C:\Windows\System32\find.exe
      find /i "0x0"
      4⤵
      PID:6828
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /S /D /c" echo "AMD64 " "
      4⤵
      PID:1480
  - - C:\Windows\System32\find.exe
      find /i "ARM64"
      4⤵
      PID:6836
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c echo prompt $E | cmd
      4⤵
      Executes a command shell one-liner
      PID:6832
    - - C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /S /D /c" echo prompt $E "
        5⤵
        
        PID:6352
    - - C:\Windows\System32\cmd.exe
        
        cmd
        5⤵
        
        PID:1532
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /S /D /c" echo "C:\Windows\Temp\MAS_14e86a88-c2ce-4ea8-b2e1-59dc48d3c2e0.cmd" "
      4⤵
      PID:6904
  - - C:\Windows\System32\find.exe
      find /i "C:\Users\Admin\AppData\Local\Temp"
      4⤵
      PID:1692
  - - C:\Windows\System32\fltMC.exe
      fltmc
      4⤵
      PID:4628
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "if ($PSVersionTable.PSEdition -ne 'Core') {$f=[IO.File]::ReadAllText('C:\Windows\Temp\MAS_14e86a88-c2ce-4ea8-b2e1-59dc48d3c2e0.cmd') -split ':pstst';. ([scriptblock]::Create($f[1]))}" 2>nul
      4⤵
      Executes a command shell one-liner
      PID:6516
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "if ($PSVersionTable.PSEdition -ne 'Core') {$f=[IO.File]::ReadAllText('C:\Windows\Temp\MAS_14e86a88-c2ce-4ea8-b2e1-59dc48d3c2e0.cmd') -split ':pstst';. ([scriptblock]::Create($f[1]))}"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:7140
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c mode con
      4⤵
      Executes a command shell one-liner
      PID:6924
    - - C:\Windows\System32\mode.com
        
        mode con
        5⤵
        
        PID:4192
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c ping -n 1 activated.win
      4⤵
      Executes a command shell one-liner
      System Network Configuration Discovery: Internet Connection Discovery
      PID:7128
    - - C:\Windows\System32\PING.EXE
        
        ping -n 1 activated.win
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2384
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c ping -n 1 updatecheck312.activated.win
      4⤵
      Executes a command shell one-liner
      System Network Configuration Discovery: Internet Connection Discovery
      PID:6464
    - - C:\Windows\System32\PING.EXE
        
        ping -n 1 updatecheck312.activated.win
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:6672
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /S /D /c" echo "-el -qedit" "
      4⤵
      PID:928
  - - C:\Windows\System32\find.exe
      find /i "/S"
      4⤵
      PID:3960
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /S /D /c" echo "-el -qedit" "
      4⤵
      PID:6728
  - - C:\Windows\System32\find.exe
      find /i "/"
      4⤵
      PID:6344
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v Desktop
      4⤵
      Executes a command shell one-liner
      PID:6456
    - - C:\Windows\System32\reg.exe
        
        reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v Desktop
        5⤵
        
        PID:6760
  - - C:\Windows\System32\mode.com
      mode 76, 34
      4⤵
      PID:6784
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SOFTWARE\Microsoft\Office\ClickToRun\Configuration /v ProductReleaseIds
      4⤵
      Modifies registry key
      PID:6788
  - - C:\Windows\System32\find.exe
      find /i "O365"
      4⤵
      PID:5440
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Office\ClickToRun\Configuration /v ProductReleaseIds
      4⤵
      Modifies registry key
      PID:3988
  - - C:\Windows\System32\find.exe
      find /i "O365"
      4⤵
      PID:6844
  - - C:\Windows\System32\choice.exe
      choice /C:12345678EH0 /N
      4⤵
      PID:6852
  - - C:\Windows\System32\mode.com
      mode 110, 34
      4⤵
      PID:4628
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\taskcache\tasks" /f Path /s
      4⤵
      PID:5724
  - - C:\Windows\System32\find.exe
      find /i "AutoPico"
      4⤵
      PID:4304
  - - C:\Windows\System32\find.exe
      find /i "avira.com" C:\Windows\System32\drivers\etc\hosts
      4⤵
      PID:7152
  - - C:\Windows\System32\find.exe
      find /i "kaspersky.com" C:\Windows\System32\drivers\etc\hosts
      4⤵
      PID:7124
  - - C:\Windows\System32\find.exe
      find /i "virustotal.com" C:\Windows\System32\drivers\etc\hosts
      4⤵
      PID:3140
  - - C:\Windows\System32\find.exe
      find /i "mcafee.com" C:\Windows\System32\drivers\etc\hosts
      4⤵
      PID:7012
  - - C:\Windows\System32\sc.exe
      sc start sppsvc
      4⤵
      Launches sc.exe
      PID:7056
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /S /D /c" echo "1056" "
      4⤵
      PID:5156
  - - C:\Windows\System32\findstr.exe
      findstr "577 225"
      4⤵
      PID:4208
  - - C:\Windows\System32\cmd.exe
      cmd /c "wmic path Win32_ComputerSystem get CreationClassName /value"
      4⤵
      Executes a command shell one-liner
      PID:6112
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path Win32_ComputerSystem get CreationClassName /value
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2184
  - - C:\Windows\System32\find.exe
      find /i "computersystem"
      4⤵
      PID:6404
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c $AssemblyBuilder = [AppDomain]::CurrentDomain.DefineDynamicAssembly(4, 1); $ModuleBuilder = $AssemblyBuilder.DefineDynamicModule(2, $False); $TypeBuilder = $ModuleBuilder.DefineType(0); [void]$TypeBuilder.DefinePInvokeMethod('SLGetWindowsInformationDWORD', 'slc.dll', 'Public, Static', 1, [int], @([String], [int].MakeByRefType()), 1, 3); $Sku = 0; [void]$TypeBuilder.CreateType()::SLGetWindowsInformationDWORD('Kernel-BrandingInfo', [ref]$Sku); $Sku"
      4⤵
      Executes a command shell one-liner
      PID:6728
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c $AssemblyBuilder = [AppDomain]::CurrentDomain.DefineDynamicAssembly(4, 1); $ModuleBuilder = $AssemblyBuilder.DefineDynamicModule(2, $False); $TypeBuilder = $ModuleBuilder.DefineType(0); [void]$TypeBuilder.DefinePInvokeMethod('SLGetWindowsInformationDWORD', 'slc.dll', 'Public, Static', 1, [int], @([String], [int].MakeByRefType()), 1, 3); $Sku = 0; [void]$TypeBuilder.CreateType()::SLGetWindowsInformationDWORD('Kernel-BrandingInfo', [ref]$Sku); $Sku
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:6768
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\ProductOptions" /v OSProductPfn 2>nul
      4⤵
      Executes a command shell one-liner
      PID:3988
    - - C:\Windows\System32\reg.exe
        
        reg query "HKLM\SYSTEM\CurrentControlSet\Control\ProductOptions" /v OSProductPfn
        5⤵
        
        PID:4416
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c "wmic Path Win32_OperatingSystem Get OperatingSystemSKU /format:LIST" 2>nul
      4⤵
      Executes a command shell one-liner
      PID:4784
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic Path Win32_OperatingSystem Get OperatingSystemSKU /format:LIST
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:7060
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$f=[IO.File]::ReadAllText('C:\Windows\Temp\MAS_14e86a88-c2ce-4ea8-b2e1-59dc48d3c2e0.cmd') -split ':winsubstatus\:.*';. ([scriptblock]::Create($f[1]))"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:7100
  - - C:\Windows\System32\find.exe
      find /i "Subscription_is_activated"
      4⤵
      PID:6932
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c $AssemblyBuilder = [AppDomain]::CurrentDomain.DefineDynamicAssembly(4, 1); $ModuleBuilder = $AssemblyBuilder.DefineDynamicModule(2, $False); $TypeBuilder = $ModuleBuilder.DefineType(0); $meth = $TypeBuilder.DefinePInvokeMethod('BrandingFormatString', 'winbrand.dll', 'Public, Static', 1, [String], @([String]), 1, 3); $meth.SetImplementationFlags(128); $TypeBuilder.CreateType()::BrandingFormatString('%WINDOWS_LONG%') -replace [string][char]0xa9, '' -replace [string][char]0xae, '' -replace [string][char]0x2122, ''"
      4⤵
      Executes a command shell one-liner
      PID:7056
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c $AssemblyBuilder = [AppDomain]::CurrentDomain.DefineDynamicAssembly(4, 1); $ModuleBuilder = $AssemblyBuilder.DefineDynamicModule(2, $False); $TypeBuilder = $ModuleBuilder.DefineType(0); $meth = $TypeBuilder.DefinePInvokeMethod('BrandingFormatString', 'winbrand.dll', 'Public, Static', 1, [String], @([String]), 1, 3); $meth.SetImplementationFlags(128); $TypeBuilder.CreateType()::BrandingFormatString('%WINDOWS_LONG%') -replace [string][char]0xa9, '' -replace [string][char]0xae, '' -replace [string][char]0x2122, ''
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:2376
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /S /D /c" echo "Windows 10 Enterprise LTSC" "
      4⤵
      PID:5440
  - - C:\Windows\System32\find.exe
      find /i "Windows"
      4⤵
      PID:6796
  - - C:\Windows\System32\sc.exe
      sc start sppsvc
      4⤵
      Launches sc.exe
      PID:6212
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$job = Start-Job { (Get-WmiObject -Query 'SELECT * FROM SoftwareLicensingService').Version }; if (-not (Wait-Job $job -Timeout 30)) {write-host 'sppsvc is not working correctly. Check this webpage for help - https://massgrave.dev/troubleshoot'}"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:6760
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:7108
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path SoftwareLicensingProduct where (LicenseStatus='1' and GracePeriodRemaining='0' and PartialProductKey is not NULL AND LicenseDependsOn is NULL) get Name /value
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3960
  - - C:\Windows\System32\findstr.exe
      findstr /i "Windows"
      4⤵
      PID:5252
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v PROCESSOR_ARCHITECTURE
      4⤵
      Executes a command shell one-liner
      PID:6768
    - - C:\Windows\System32\reg.exe
        
        reg query "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v PROCESSOR_ARCHITECTURE
        5⤵
        
        PID:6452
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c ver
      4⤵
      Executes a command shell one-liner
      PID:2376
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c ping -n 1 l.root-servers.net
      4⤵
      Executes a command shell one-liner
      System Network Configuration Discovery: Internet Connection Discovery
      PID:4764
    - - C:\Windows\System32\PING.EXE
        
        ping -n 1 l.root-servers.net
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:5912
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\taskcache\tasks" /f Path /s
      4⤵
      PID:5656
  - - C:\Windows\System32\find.exe
      find /i "AutoPico"
      4⤵
      PID:6500
  - - C:\Windows\System32\find.exe
      find /i "avira.com" C:\Windows\System32\drivers\etc\hosts
      4⤵
      PID:6624
  - - C:\Windows\System32\find.exe
      find /i "kaspersky.com" C:\Windows\System32\drivers\etc\hosts
      4⤵
      PID:6632
  - - C:\Windows\System32\find.exe
      find /i "virustotal.com" C:\Windows\System32\drivers\etc\hosts
      4⤵
      PID:6164
  - - C:\Windows\System32\find.exe
      find /i "mcafee.com" C:\Windows\System32\drivers\etc\hosts
      4⤵
      PID:7120
  - - C:\Windows\System32\sc.exe
      sc start sppsvc
      4⤵
      Launches sc.exe
      PID:5852
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /S /D /c" echo "1056" "
      4⤵
      PID:6920
  - - C:\Windows\System32\findstr.exe
      findstr "577 225"
      4⤵
      PID:6680
  - - C:\Windows\System32\sc.exe
      sc query Null
      4⤵
      Launches sc.exe
      PID:1480
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\WinPE" /v InstRoot
      4⤵
      PID:7140
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\State" /v ImageState
      4⤵
      Executes a command shell one-liner
      PID:3468
    - - C:\Windows\System32\reg.exe
        
        reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\State" /v ImageState
        5⤵
        
        PID:6752
  - - C:\Windows\System32\sc.exe
      sc start ClipSVC
      4⤵
      Launches sc.exe
      PID:2264
  - - C:\Windows\System32\sc.exe
      sc query ClipSVC
      4⤵
      Launches sc.exe
      PID:6852
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\ClipSVC /v DependOnService
      4⤵
      Modifies registry key
      PID:6324
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\ClipSVC /v Description
      4⤵
      Modifies registry key
      PID:3884
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\ClipSVC /v DisplayName
      4⤵
      Modifies registry key
      PID:6720
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\ClipSVC /v ErrorControl
      4⤵
      Modifies registry key
      PID:7132
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\ClipSVC /v ImagePath
      4⤵
      Modifies registry key
      PID:2924
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\ClipSVC /v ObjectName
      4⤵
      Modifies registry key
      PID:724
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\ClipSVC /v Start
      4⤵
      Modifies registry key
      PID:4712
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\ClipSVC /v Type
      4⤵
      Modifies registry key
      PID:1468
  - - C:\Windows\System32\sc.exe
      sc start wlidsvc
      4⤵
      Launches sc.exe
      PID:2376
  - - C:\Windows\System32\sc.exe
      sc query wlidsvc
      4⤵
      Launches sc.exe
      PID:6360
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\wlidsvc /v DependOnService
      4⤵
      Modifies registry key
      PID:6356
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\wlidsvc /v Description
      4⤵
      Modifies registry key
      PID:1276
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\wlidsvc /v DisplayName
      4⤵
      Modifies registry key
      PID:1620
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\wlidsvc /v ErrorControl
      4⤵
      Modifies registry key
      PID:6940
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\wlidsvc /v ImagePath
      4⤵
      Modifies registry key
      PID:6576
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\wlidsvc /v ObjectName
      4⤵
      Modifies registry key
      PID:6600
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\wlidsvc /v Start
      4⤵
      Modifies registry key
      PID:4628
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\wlidsvc /v Type
      4⤵
      Modifies registry key
      PID:6444
  - - C:\Windows\System32\sc.exe
      sc start sppsvc
      4⤵
      Launches sc.exe
      PID:1940
  - - C:\Windows\System32\sc.exe
      sc query sppsvc
      4⤵
      Launches sc.exe
      PID:6932
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\sppsvc /v DependOnService
      4⤵
      Modifies registry key
      PID:5464
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\sppsvc /v Description
      4⤵
      Modifies registry key
      PID:6436
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\sppsvc /v DisplayName
      4⤵
      Modifies registry key
      PID:3140
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\sppsvc /v ErrorControl
      4⤵
      Modifies registry key
      PID:7060
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\sppsvc /v ImagePath
      4⤵
      Modifies registry key
      PID:6324
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\sppsvc /v ObjectName
      4⤵
      Modifies registry key
      PID:3884
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\sppsvc /v Start
      4⤵
      Modifies registry key
      PID:6720
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\sppsvc /v Type
      4⤵
      PID:5252
  - - C:\Windows\System32\sc.exe
      sc start KeyIso
      4⤵
      Launches sc.exe
      PID:6836
  - - C:\Windows\System32\sc.exe
      sc query KeyIso
      4⤵
      Launches sc.exe
      PID:4492
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\KeyIso /v DependOnService
      4⤵
      Modifies registry key
      PID:7144
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\KeyIso /v Description
      4⤵
      PID:6212
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\KeyIso /v DisplayName
      4⤵
      Modifies registry key
      PID:6156
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\KeyIso /v ErrorControl
      4⤵
      PID:5912
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\KeyIso /v ImagePath
      4⤵
      Modifies registry key
      PID:6184
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\KeyIso /v ObjectName
      4⤵
      Modifies registry key
      PID:6928
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\KeyIso /v Start
      4⤵
      Modifies registry key
      PID:6584
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\KeyIso /v Type
      4⤵
      Modifies registry key
      PID:6592
  - - C:\Windows\System32\sc.exe
      sc start LicenseManager
      4⤵
      Launches sc.exe
      PID:6632
  - - C:\Windows\System32\sc.exe
      sc query LicenseManager
      4⤵
      Launches sc.exe
      PID:7068
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\LicenseManager /v DependOnService
      4⤵
      Modifies registry key
      PID:4628
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\LicenseManager /v Description
      4⤵
      Modifies registry key
      PID:6444
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\LicenseManager /v DisplayName
      4⤵
      Modifies registry key
      PID:1940
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\LicenseManager /v ErrorControl
      4⤵
      Modifies registry key
      PID:6932
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\LicenseManager /v ImagePath
      4⤵
      Modifies registry key
      PID:5464
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\LicenseManager /v ObjectName
      4⤵
      Modifies registry key
      PID:6436
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\LicenseManager /v Start
      4⤵
      Modifies registry key
      PID:3140
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\LicenseManager /v Type
      4⤵
      Modifies registry key
      PID:184
  - - C:\Windows\System32\sc.exe
      sc start Winmgmt
      4⤵
      Launches sc.exe
      PID:4208
  - - C:\Windows\System32\sc.exe
      sc query Winmgmt
      4⤵
      Launches sc.exe
      PID:7132
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\Winmgmt /v DependOnService
      4⤵
      Modifies registry key
      PID:7152
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\Winmgmt /v Description
      4⤵
      Modifies registry key
      PID:4416
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\Winmgmt /v DisplayName
      4⤵
      Modifies registry key
      PID:4712
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\Winmgmt /v ErrorControl
      4⤵
      Modifies registry key
      PID:3348
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\Winmgmt /v ImagePath
      4⤵
      Modifies registry key
      PID:2376
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\Winmgmt /v ObjectName
      4⤵
      Modifies registry key
      PID:4304
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\Winmgmt /v Start
      4⤵
      Modifies registry key
      PID:6356
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\Winmgmt /v Type
      4⤵
      Modifies registry key
      PID:1276
  - - C:\Windows\System32\sc.exe
      sc start ClipSVC
      4⤵
      Launches sc.exe
      PID:1620
  - - C:\Windows\System32\sc.exe
      sc start wlidsvc
      4⤵
      Launches sc.exe
      PID:5400
  - - C:\Windows\System32\sc.exe
      sc start sppsvc
      4⤵
      Launches sc.exe
      PID:6624
  - - C:\Windows\System32\sc.exe
      sc start KeyIso
      4⤵
      Launches sc.exe
      PID:6600
  - - C:\Windows\System32\sc.exe
      sc start LicenseManager
      4⤵
      Launches sc.exe
      PID:6300
  - - C:\Windows\System32\sc.exe
      sc start Winmgmt
      4⤵
      Launches sc.exe
      PID:5724
  - - C:\Windows\System32\sc.exe
      sc query ClipSVC
      4⤵
      Launches sc.exe
      PID:4716
  - - C:\Windows\System32\find.exe
      find /i "RUNNING"
      4⤵
      PID:5280
  - - C:\Windows\System32\sc.exe
      sc start ClipSVC
      4⤵
      Launches sc.exe
      PID:6792
  - - C:\Windows\System32\sc.exe
      sc query wlidsvc
      4⤵
      Launches sc.exe
      PID:1480
  - - C:\Windows\System32\find.exe
      find /i "RUNNING"
      4⤵
      PID:2272
  - - C:\Windows\System32\sc.exe
      sc start wlidsvc
      4⤵
      Launches sc.exe
      PID:4912
  - - C:\Windows\System32\sc.exe
      sc query sppsvc
      4⤵
      Launches sc.exe
      PID:6404
  - - C:\Windows\System32\find.exe
      find /i "RUNNING"
      4⤵
      PID:6712
  - - C:\Windows\System32\sc.exe
      sc start sppsvc
      4⤵
      Launches sc.exe
      PID:2924
  - - C:\Windows\System32\sc.exe
      sc query KeyIso
      4⤵
      Launches sc.exe
      PID:3140
  - - C:\Windows\System32\find.exe
      find /i "RUNNING"
      4⤵
      PID:724
  - - C:\Windows\System32\sc.exe
      sc start KeyIso
      4⤵
      Launches sc.exe
      PID:4416
  - - C:\Windows\System32\sc.exe
      sc query LicenseManager
      4⤵
      Launches sc.exe
      PID:4712
  - - C:\Windows\System32\find.exe
      find /i "RUNNING"
      4⤵
      PID:7144
  - - C:\Windows\System32\sc.exe
      sc start LicenseManager
      4⤵
      Launches sc.exe
      PID:2376
  - - C:\Windows\System32\sc.exe
      sc query Winmgmt
      4⤵
      Launches sc.exe
      PID:4304
  - - C:\Windows\System32\find.exe
      find /i "RUNNING"
      4⤵
      PID:2664
  - - C:\Windows\System32\sc.exe
      sc start Winmgmt
      4⤵
      Launches sc.exe
      PID:1276
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path Win32_ComputerSystem get CreationClassName /value
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1620
  - - C:\Windows\System32\find.exe
      find /i "computersystem"
      4⤵
      PID:6584
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path SoftwareLicensingService get Version
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:6532
  - - C:\Windows\System32\cmd.exe
      cmd /c exit /b 0
      4⤵
      Executes a command shell one-liner
      PID:4716
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /S /D /c" echo "0" "
      4⤵
      PID:6932
  - - C:\Windows\System32\findstr.exe
      findstr /i "0x800410 0x800440 0x80131501"
      4⤵
      PID:7108
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\Plugins\Objects\msft:rm/algorithm/hwid/4.0" /f ba02fed39662 /d
      4⤵
      PID:1480
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /v TokenStore 2>nul
      4⤵
      Executes a command shell one-liner
      PID:6852
    - - C:\Windows\System32\reg.exe
        
        reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /v TokenStore
        5⤵
        
        PID:6384
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$acl = (Get-Acl 'C:\Windows\System32\spp\store\2.0' | fl | Out-String); if (-not ($acl -match 'NT SERVICE\\sppsvc Allow FullControl') -or ($acl -match 'NT SERVICE\\sppsvc Deny')) {Exit 2}"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:6404
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$acl = (Get-Acl 'HKLM:\SYSTEM\WPA' | fl | Out-String); if (-not ($acl -match 'NT SERVICE\\sppsvc Allow QueryValues, EnumerateSubKeys, WriteKey') -or ($acl -match 'NT SERVICE\\sppsvc Deny')) {Exit 2}"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:6156
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$acl = (Get-Acl 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' | fl | Out-String); if (-not ($acl -match 'NT SERVICE\\sppsvc Allow SetValue') -or ($acl -match 'NT SERVICE\\sppsvc Deny')) {Exit 2}"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:6300
  - - C:\Windows\System32\reg.exe
      reg query "HKU\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion"
      4⤵
      PID:4492
  - - C:\Windows\System32\reg.exe
      reg query "HKU\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\Policies"
      4⤵
      PID:1468
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$netServ = (New-Object Security.Principal.SecurityIdentifier('S-1-5-20')).Translate([Security.Principal.NTAccount]).Value; $aclString = Get-Acl 'Registry::HKU\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\Policies' | Format-List | Out-String; if (-not ($aclString.Contains($netServ + ' Allow FullControl') -or $aclString.Contains('NT SERVICE\sppsvc Allow FullControl')) -or ($aclString.Contains('Deny'))) {Exit 3}"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3960
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$f=[IO.File]::ReadAllText('C:\Windows\Temp\MAS_14e86a88-c2ce-4ea8-b2e1-59dc48d3c2e0.cmd') -split ':wpatest\:.*';. ([scriptblock]::Create($f[1]))" 2>nul
      4⤵
      Executes a command shell one-liner
      PID:6356
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$f=[IO.File]::ReadAllText('C:\Windows\Temp\MAS_14e86a88-c2ce-4ea8-b2e1-59dc48d3c2e0.cmd') -split ':wpatest\:.*';. ([scriptblock]::Create($f[1]))"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3880
  - - C:\Windows\System32\reg.exe
      reg query "HKU\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\PersistedTSReArmed"
      4⤵
      PID:5464
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ClipSVC\Volatile\PersistedSystemState"
      4⤵
      PID:7060
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c "wmic path SoftwareLicensingProduct where (ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f' and PartialProductKey is not null) get ID /VALUE" 2>nul
      4⤵
      Executes a command shell one-liner
      PID:3884
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path SoftwareLicensingProduct where (ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f' and PartialProductKey is not null) get ID /VALUE
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:6532
  - - C:\Windows\System32\reg.exe
      reg query "HKU\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion"
      4⤵
      PID:1448
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c "wmic path SoftwareLicensingProduct where (ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f' AND LicenseDependsOn is NULL AND PartialProductKey IS NOT NULL) get LicenseFamily /VALUE" 2>nul
      4⤵
      Executes a command shell one-liner
      PID:6720
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path SoftwareLicensingProduct where (ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f' AND LicenseDependsOn is NULL AND PartialProductKey IS NOT NULL) get LicenseFamily /VALUE
        5⤵
        
        PID:7132
  - - C:\Windows\System32\sc.exe
      sc query wlms
      4⤵
      Launches sc.exe
      PID:3960
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.exe"
      4⤵
      PID:1480
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SLsvc.exe"
      4⤵
      PID:6792
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sppsvc.exe"
      4⤵
      PID:6156
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sppsvc.exe\PerfOptions"
      4⤵
      PID:6592
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /v "SkipRearm" 2>nul
      4⤵
      Executes a command shell one-liner
      PID:7108
    - - C:\Windows\System32\reg.exe
        
        reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /v "SkipRearm"
        5⤵
        
        PID:7140
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "Get-WmiObject -Query 'SELECT Description FROM SoftwareLicensingProduct WHERE PartialProductKey IS NOT NULL AND LicenseDependsOn IS NULL' | Select-Object -Property Description"
      4⤵
      PID:6928
  - - C:\Windows\System32\findstr.exe
      findstr /i "KMS_"
      4⤵
      PID:5912
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$s=New-Object -ComObject 'Schedule.Service'; $s.Connect(); $state=$s.GetFolder('\Microsoft\Windows\SoftwareProtectionPlatform').GetTask('SvcRestartTask').State; @{0='Unknown';1='Disabled';2='Queued';3='Ready';4='Running'}[$state]" 2>nul
      4⤵
      Executes a command shell one-liner
      PID:4120
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$s=New-Object -ComObject 'Schedule.Service'; $s.Connect(); $state=$s.GetFolder('\Microsoft\Windows\SoftwareProtectionPlatform').GetTask('SvcRestartTask').State; @{0='Unknown';1='Disabled';2='Queued';3='Ready';4='Running'}[$state]"
        5⤵
        
        PID:3140
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /S /D /c" echo "
      4⤵
      PID:5656
  - - C:\Windows\System32\find.exe
      find /i "Ready"
      4⤵
      PID:4492
  - - C:\Windows\System32\reg.exe
      reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /v "actionlist" /f
      4⤵
      PID:2924
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\SoftwareProtectionPlatform\SvcRestartTask"
      4⤵
      PID:6788
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /S /D /c" echo "Removed" "
      4⤵
      PID:7060
  - - C:\Windows\System32\findstr.exe
      findstr /i "Removed Not Found"
      4⤵
      PID:1468
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c "wmic path SoftwareLicensingProduct where (ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f') get ID /VALUE" 2>nul
      4⤵
      Executes a command shell one-liner
      PID:6584
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path SoftwareLicensingProduct where (ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f') get ID /VALUE
        5⤵
        
        PID:6680
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /S /D /c" echo "0724cb7d-3437-4cb7-93cb-830375d0079d 16e50fa1-a5a0-479f-aa81-90756738b4f1 30a42c86-b7a0-4a34-8c90-ff177cb2acb7 32d2fab3-e4a8-42c2-923b-4bf4fd13e6ee 357eb3d2-42c6-4731-ac66-df185cdd3683 59eb965c-9150-42b7-a0ec-22151b9897c5 60b3ec1b-9545-4921-821f-311b129dd6f6 632ffa10-3b75-4180-aed9-4e799a44563b 685e4f86-7690-4334-bf9f-2074335811bf 6c4de1b8-24bb-4c17-9a77-7b939414c298 7a802526-4c94-4bd1-ba14-835a1aca2120 90da7373-1c51-430b-bf26-c97e9c5cdc31 cce9d2de-98ee-4ce2-8113-222620c64a27 d552befb-48cc-4327-8f39-47d2d94f987c e923d769-e71d-4c2a-925a-93547cbe6547 ed655016-a9e8-4434-95d9-4345352c2552 " "
      4⤵
      PID:6068
  - - C:\Windows\System32\find.exe
      find /i "f6e29426-a256-4316-88bf-cc5b0f95ec0c"
      4⤵
      PID:2384
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /S /D /c" echo "0724cb7d-3437-4cb7-93cb-830375d0079d 16e50fa1-a5a0-479f-aa81-90756738b4f1 30a42c86-b7a0-4a34-8c90-ff177cb2acb7 32d2fab3-e4a8-42c2-923b-4bf4fd13e6ee 357eb3d2-42c6-4731-ac66-df185cdd3683 59eb965c-9150-42b7-a0ec-22151b9897c5 60b3ec1b-9545-4921-821f-311b129dd6f6 632ffa10-3b75-4180-aed9-4e799a44563b 685e4f86-7690-4334-bf9f-2074335811bf 6c4de1b8-24bb-4c17-9a77-7b939414c298 7a802526-4c94-4bd1-ba14-835a1aca2120 90da7373-1c51-430b-bf26-c97e9c5cdc31 cce9d2de-98ee-4ce2-8113-222620c64a27 d552befb-48cc-4327-8f39-47d2d94f987c e923d769-e71d-4c2a-925a-93547cbe6547 ed655016-a9e8-4434-95d9-4345352c2552 " "
      4⤵
      PID:184
  - - C:\Windows\System32\find.exe
      find /i "cce9d2de-98ee-4ce2-8113-222620c64a27"
      4⤵
      PID:6324
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /S /D /c" echo "0724cb7d-3437-4cb7-93cb-830375d0079d 16e50fa1-a5a0-479f-aa81-90756738b4f1 30a42c86-b7a0-4a34-8c90-ff177cb2acb7 32d2fab3-e4a8-42c2-923b-4bf4fd13e6ee 357eb3d2-42c6-4731-ac66-df185cdd3683 59eb965c-9150-42b7-a0ec-22151b9897c5 60b3ec1b-9545-4921-821f-311b129dd6f6 632ffa10-3b75-4180-aed9-4e799a44563b 685e4f86-7690-4334-bf9f-2074335811bf 6c4de1b8-24bb-4c17-9a77-7b939414c298 7a802526-4c94-4bd1-ba14-835a1aca2120 90da7373-1c51-430b-bf26-c97e9c5cdc31 cce9d2de-98ee-4ce2-8113-222620c64a27 d552befb-48cc-4327-8f39-47d2d94f987c e923d769-e71d-4c2a-925a-93547cbe6547 ed655016-a9e8-4434-95d9-4345352c2552 " "
      4⤵
      PID:7148
  - - C:\Windows\System32\find.exe
      find /i "cce9d2de-98ee-4ce2-8113-222620c64a27"
      4⤵
      PID:2376
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /S /D /c" echo "0724cb7d-3437-4cb7-93cb-830375d0079d 16e50fa1-a5a0-479f-aa81-90756738b4f1 30a42c86-b7a0-4a34-8c90-ff177cb2acb7 32d2fab3-e4a8-42c2-923b-4bf4fd13e6ee 357eb3d2-42c6-4731-ac66-df185cdd3683 59eb965c-9150-42b7-a0ec-22151b9897c5 60b3ec1b-9545-4921-821f-311b129dd6f6 632ffa10-3b75-4180-aed9-4e799a44563b 685e4f86-7690-4334-bf9f-2074335811bf 6c4de1b8-24bb-4c17-9a77-7b939414c298 7a802526-4c94-4bd1-ba14-835a1aca2120 90da7373-1c51-430b-bf26-c97e9c5cdc31 cce9d2de-98ee-4ce2-8113-222620c64a27 d552befb-48cc-4327-8f39-47d2d94f987c e923d769-e71d-4c2a-925a-93547cbe6547 ed655016-a9e8-4434-95d9-4345352c2552" "
      4⤵
      PID:4416
  - - C:\Windows\System32\find.exe
      find /i "ed655016-a9e8-4434-95d9-4345352c2552"
      4⤵
      PID:6360
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /S /D /c" echo "0724cb7d-3437-4cb7-93cb-830375d0079d 16e50fa1-a5a0-479f-aa81-90756738b4f1 30a42c86-b7a0-4a34-8c90-ff177cb2acb7 32d2fab3-e4a8-42c2-923b-4bf4fd13e6ee 357eb3d2-42c6-4731-ac66-df185cdd3683 59eb965c-9150-42b7-a0ec-22151b9897c5 60b3ec1b-9545-4921-821f-311b129dd6f6 632ffa10-3b75-4180-aed9-4e799a44563b 685e4f86-7690-4334-bf9f-2074335811bf 6c4de1b8-24bb-4c17-9a77-7b939414c298 7a802526-4c94-4bd1-ba14-835a1aca2120 90da7373-1c51-430b-bf26-c97e9c5cdc31 cce9d2de-98ee-4ce2-8113-222620c64a27 d552befb-48cc-4327-8f39-47d2d94f987c e923d769-e71d-4c2a-925a-93547cbe6547 ed655016-a9e8-4434-95d9-4345352c2552 " "
      4⤵
      PID:6308
  - - C:\Windows\System32\find.exe
      find /i "f6e29426-a256-4316-88bf-cc5b0f95ec0c"
      4⤵
      PID:7068
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path SoftwareLicensingService where __CLASS='SoftwareLicensingService' call InstallProductKey ProductKey="QPM6N-7J2WJ-P88HH-P3YRH-YY74H"
      4⤵
      PID:6600
  - - C:\Windows\System32\cmd.exe
      cmd /c exit /b 0
      4⤵
      Executes a command shell one-liner
      PID:6632
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path SoftwareLicensingService where __CLASS='SoftwareLicensingService' call RefreshLicenseStatus
      4⤵
      PID:5996
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c reg query "HKCU\Control Panel\International\Geo" /v Name 2>nul
      4⤵
      Executes a command shell one-liner
      PID:5252
    - - C:\Windows\System32\reg.exe
        
        reg query "HKCU\Control Panel\International\Geo" /v Name
        5⤵
        
        PID:4208
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c reg query "HKCU\Control Panel\International\Geo" /v Nation 2>nul
      4⤵
      Executes a command shell one-liner
      PID:6532
    - - C:\Windows\System32\reg.exe
        
        reg query "HKCU\Control Panel\International\Geo" /v Nation
        5⤵
        
        PID:4492
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$f=[IO.File]::ReadAllText('C:\Windows\Temp\MAS_14e86a88-c2ce-4ea8-b2e1-59dc48d3c2e0.cmd') -split ':sign\:.*';. ([scriptblock]::Create($f[1]))"
      4⤵
      PID:2924
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "Start-Job { Restart-Service ClipSVC } | Wait-Job -Timeout 20 | Out-Null"
      4⤵
      PID:6712
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6472
  - - C:\Windows\System32\ClipUp.exe
      clipup -v -o
      4⤵
      PID:7500
    - - C:\Windows\System32\clipup.exe
        
        clipup -v -o -ppl C:\Users\Admin\AppData\Local\Temp\tem96A8.tmp
        5⤵
        Checks SCSI registry key(s)
        
        PID:7524
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c $AssemblyBuilder = [AppDomain]::CurrentDomain.DefineDynamicAssembly(4, 1); $ModuleBuilder = $AssemblyBuilder.DefineDynamicModule(2, $False); $TypeBuilder = $ModuleBuilder.DefineType(0); $meth = $TypeBuilder.DefinePInvokeMethod('BrandingFormatString', 'winbrand.dll', 'Public, Static', 1, [String], @([String]), 1, 3); $meth.SetImplementationFlags(128); $TypeBuilder.CreateType()::BrandingFormatString('%WINDOWS_LONG%') -replace [string][char]0xa9, '' -replace [string][char]0xae, '' -replace [string][char]0x2122, ''"
      4⤵
      Executes a command shell one-liner
      PID:7600
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c $AssemblyBuilder = [AppDomain]::CurrentDomain.DefineDynamicAssembly(4, 1); $ModuleBuilder = $AssemblyBuilder.DefineDynamicModule(2, $False); $TypeBuilder = $ModuleBuilder.DefineType(0); $meth = $TypeBuilder.DefinePInvokeMethod('BrandingFormatString', 'winbrand.dll', 'Public, Static', 1, [String], @([String]), 1, 3); $meth.SetImplementationFlags(128); $TypeBuilder.CreateType()::BrandingFormatString('%WINDOWS_LONG%') -replace [string][char]0xa9, '' -replace [string][char]0xae, '' -replace [string][char]0x2122, ''
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:7616
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /S /D /c" echo "Windows 10 IoT Enterprise LTSC" "
      4⤵
      PID:7724
  - - C:\Windows\System32\find.exe
      find /i "Windows"
      4⤵
      PID:7732
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path SoftwareLicensingProduct where "ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f' AND PartialProductKey IS NOT NULL AND LicenseDependsOn is NULL" call Activate
      4⤵
      PID:7756
  - - C:\Windows\System32\cmd.exe
      cmd /c exit /b -1073740956
      4⤵
      Executes a command shell one-liner
      PID:7852
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path SoftwareLicensingProduct where (LicenseStatus='1' and GracePeriodRemaining='0' and PartialProductKey is not NULL AND LicenseDependsOn is NULL) get Name /value
      4⤵
      PID:7868
  - - C:\Windows\System32\findstr.exe
      findstr /i "Windows"
      4⤵
      PID:7876
  - - C:\Windows\System32\reg.exe
      reg delete "HKU\S-1-5-19\SOFTWARE\Microsoft\IdentityCRL" /f
      4⤵
      PID:7932
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "Start-Job { Restart-Service wlidsvc } | Wait-Job -Timeout 20 | Out-Null"
      4⤵
      PID:7948
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:8052
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "Start-Job { Restart-Service LicenseManager } | Wait-Job -Timeout 20 | Out-Null"
      4⤵
      PID:7184
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1264
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "Start-Job { Restart-Service sppsvc } | Wait-Job -Timeout 20 | Out-Null"
      4⤵
      PID:4208
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6928
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path SoftwareLicensingService where __CLASS='SoftwareLicensingService' call RefreshLicenseStatus
      4⤵
      PID:7712
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path SoftwareLicensingProduct where "ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f' AND PartialProductKey IS NOT NULL AND LicenseDependsOn is NULL" call Activate
      4⤵
      PID:7752
  - - C:\Windows\System32\cmd.exe
      cmd /c exit /b -1073740956
      4⤵
      Executes a command shell one-liner
      PID:7828
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path SoftwareLicensingProduct where (LicenseStatus='1' and GracePeriodRemaining='0' and PartialProductKey is not NULL AND LicenseDependsOn is NULL) get Name /value
      4⤵
      PID:7844
  - - C:\Windows\System32\findstr.exe
      findstr /i "Windows"
      4⤵
      PID:7784
  - - C:\Windows\System32\reg.exe
      reg query "HKU\S-1-5-19\SOFTWARE\Microsoft\IdentityCRL"
      4⤵
      PID:1332
  - - C:\Windows\System32\ipconfig.exe
      ipconfig /flushdns
      4⤵
      Gathers network information
      PID:7900
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "try { [Net.ServicePointManager]::SecurityProtocol=[Net.SecurityProtocolType]::Tls12; irm https://licensing.mp.microsoft.com/v7.0/licenses/content -Method POST } catch { if ($_.Exception.Response -eq $null) { Write-Host """"[licensing.mp.microsoft.com/v7.0/licenses/content] $($_.Exception.Message)"""" -ForegroundColor Red -BackgroundColor Black; exit 3 } }"
      4⤵
      Badlisted process makes network request
      PID:7904
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "try { [Net.ServicePointManager]::SecurityProtocol=[Net.SecurityProtocolType]::Tls12; irm https://login.live.com/ppsecure/deviceaddcredential.srf -Method POST } catch { if ($_.Exception.Response -eq $null) { Write-Host """"[login.live.com/ppsecure/deviceaddcredential.srf] $($_.Exception.Message)"""" -ForegroundColor Red -BackgroundColor Black; exit 3 } }"
      4⤵
      Badlisted process makes network request
      PID:5124
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "try { [Net.ServicePointManager]::SecurityProtocol=[Net.SecurityProtocolType]::Tls12; irm https://purchase.mp.microsoft.com/v7.0/users/me/orders -Method POST } catch { if ($_.Exception.Response -eq $null) { Write-Host """"[purchase.mp.microsoft.com/v7.0/users/me/orders] $($_.Exception.Message)"""" -ForegroundColor Red -BackgroundColor Black; exit 3 } }"
      4⤵
      Badlisted process makes network request
      PID:8064
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" /v DisableWindowsUpdateAccess
      4⤵
      PID:7396
  - - C:\Windows\System32\find.exe
      find /i "0x1"
      4⤵
      PID:7372
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" /v DoNotConnectToWindowsUpdateInternetLocations
      4⤵
      PID:5908
  - - C:\Windows\System32\find.exe
      find /i "0x1"
      4⤵
      PID:5492
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\SOFTWARE\Policies\Microsoft\WindowsStore" /v DisableStoreApps
      4⤵
      PID:7432
  - - C:\Windows\System32\find.exe
      find /i "0x1"
      4⤵
      PID:7420
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /v DependOnService
      4⤵
      Modifies registry key
      PID:7464
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /v Description
      4⤵
      Modifies registry key
      PID:7424
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /v DisplayName
      4⤵
      Modifies registry key
      PID:6500
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /v ErrorControl
      4⤵
      Modifies registry key
      PID:7440
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /v ImagePath
      4⤵
      PID:6980
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /v ObjectName
      4⤵
      Modifies registry key
      PID:6384
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /v Start
      4⤵
      Modifies registry key
      PID:5752
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /v Type
      4⤵
      Modifies registry key
      PID:7296
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /v ServiceSidType
      4⤵
      Modifies registry key
      PID:4036
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /v RequiredPrivileges
      4⤵
      Modifies registry key
      PID:2276
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /v FailureActions
      4⤵
      Modifies registry key
      PID:7140
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\wuauserv\Parameters
      4⤵
      Modifies registry key
      PID:6300
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\wuauserv\Security
      4⤵
      Modifies registry key
      PID:7540
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "Start-Job { Start-Service wuauserv } | Wait-Job -Timeout 20 | Out-Null"
      4⤵
      PID:7280
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:7656
  - - C:\Windows\System32\sc.exe
      sc query wuauserv
      4⤵
      Launches sc.exe
      PID:5280
  - - C:\Windows\System32\find.exe
      find /i "RUNNING"
      4⤵
      PID:6324
  - - C:\Windows\System32\choice.exe
      choice /C:10 /N
      4⤵
      PID:6308
  - - C:\Windows\System32\mode.com
      mode 76, 34
      4⤵
      PID:7864
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SOFTWARE\Microsoft\Office\ClickToRun\Configuration /v ProductReleaseIds
      4⤵
      Modifies registry key
      PID:7780
  - - C:\Windows\System32\find.exe
      find /i "O365"
      4⤵
      PID:7772
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Office\ClickToRun\Configuration /v ProductReleaseIds
      4⤵
      Modifies registry key
      PID:7908
  - - C:\Windows\System32\find.exe
      find /i "O365"
      4⤵
      PID:7872
  - - C:\Windows\System32\choice.exe
      choice /C:12345678EH0 /N
      4⤵
      PID:8024
- - C:\Windows\System32\reg.exe
    reg add HKCU\Console /v QuickEdit /t REG_DWORD /d 1 /f
    3⤵
    - Modifies registry key
    PID:6532

C:\Windows\system32\DeviceCensus.exe
C:\Windows\system32\DeviceCensus.exe
1⤵
- Checks for any installed AV software in registry
- Drops file in System32 directory
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
PID:2384

C:\Windows\system32\usoclient.exe
"C:\Windows\system32\usoclient.exe" StartScan
1⤵
PID:6932

C:\Windows\System32\slui.exe
C:\Windows\System32\slui.exe -Embedding
1⤵
PID:6452

C:\Windows\system32\Clipup.exe
"C:\Windows\system32\Clipup.exe" -o
1⤵
PID:7364
- C:\Windows\system32\Clipup.exe
  "C:\Windows\system32\Clipup.exe" -o -ppl C:\Windows\TEMP\tem95BE.tmp
  2⤵
  - Checks SCSI registry key(s)
  PID:7416

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:2664

C:\Windows\System32\oobe\UserOOBEBroker.exe
C:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding
1⤵
- Drops file in Windows directory
PID:7208

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
1⤵
- System Location Discovery: System Language Discovery
PID:5908

C:\Windows\System32\oobe\UserOOBEBroker.exe
C:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding
1⤵
- Drops file in Windows directory
PID:7592

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
1⤵
- System Location Discovery: System Language Discovery
PID:7268

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
1⤵
- System Location Discovery: System Language Discovery
PID:7784

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

Software Discovery

T1518

Security Software Discovery

T1518.001

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 16KB
SHA256 452a5479b9a2e03612576c30d30e6f51f51274cd30ef576ea1e71d20c657376f
MD5 cfab81b800edabacbf6cb61aa78d5258
SHA1 2730d4da1be7238d701dc84eb708a064b8d1cf27
SHA512 ec188b0ee4d3daabc26799b34ee471bee988bdd7ceb011ed7df3d4cf26f98932bbbb4b70dc2b7fd4df9a3981b3ce22f4b5be4a0db97514d526e521575efb2ec6
SSDEEP 12:biUXhV0xosU8xCe+JKlkQuMRxCb8ZXfgYJ0IJpP0KLsyW1L7Fx6:bFRqxosU8xWMk8xVZ4YWI30otWn
TLSH
T14F724986B34494EFC883597189BD17903374F6EE5F02839B6A267A0E2E271C44F44220
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 16026bab9b2a087f526ef6e4b3bde300878dbd5dd3f4504726cb3ffabbbc8a1e
MD5 f79493e52660d33f7341262f07b668a9
SHA1 f286d4901d2d569c2a2eb1595a64df68bcc34c97
SHA512 e80798fab0c515581bb09ac70e6866a89a2121787585c7154c78788368467f8aa16b024d6c8819eae86b9ddeb20bb7ea18cda45c412833f67764989eda25e884
TLSH
T116D0A9223A1A75E9E2695271D262860427294AB665579246B324DC4C8A781C2E2A3AC2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 524ae55519907b3ab75a388a7d8adb5b3e5bdde0aabefe20ce772a09ea687d5b
MD5 f6eb566f9aba7efdbfb5c795bd65c547
SHA1 0ce2d6e7d9e58cb863af3f628d52cd4dd694f6fa
SHA512 2b08121677adac5c93abf00acc6bfcb28d8a72bca78fdef9052724d4f592d583e28680a2ae9a96d1bb7c0a432f05c206ebc2ec8238e6cabafaf5ae8743b7260b
TLSH
T19CD0C023360D3004E3494231D002C3042311447810078301F330D88C89241C4D2930C3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9506f75b85b11b8a19272ffc8ada25f9681b3509c537186f2c119edfc800dbe9
MD5 101881b087170d8fc614e46fff054d08
SHA1 10d24d7dfad9f35b3d53e4dff89d2d730e0907c7
SHA512 0f6f6884bedb4dac45cb07cfc043fe4eb717d040848e5bf064f3e65136acf8702a9772fa775d774c241d64588a7bbea4b6c454e4c81ced2782a87d91b7619ce1
TLSH
T1BBD023323A1D3455D34F7630E241C315375157B55417E561F330D95C99742D1D19B0C3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2aafce1c037be05e4c7ebafed37cf7282f3b61da9ab3f68cb43c724193f2a4ab
MD5 1a34bb39930694ea7604881fe671a327
SHA1 984165fe8abd42a03cd121d90e23865b1b24606e
SHA512 c9c7ad13bf7dcca0de7ae942e5c953da986e722b63c12f23dbc118dda97022414b13f1027b23b74906f10699650754782ea88b9d17b1c4e8aad63cf538d45022
TLSH
T147D0C0233A093004E3454231D042C3043321407810078301F330D88C89641C4D2930C3
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 c29b1310407c4092d33ac3b2d5db3945eb6de423de2fb16f3c003787364489bc
MD5 545cb58610d1d8741aa2d37a2eb31036
SHA1 583d80d327d3fa0cef3e55c4eafb4da1369a8b2f
SHA512 aee95413068c545442bdc308ae1b898e174e8d71c1ed328b159bc3307c384e114485bb40b59433abbc59b94579a511ad0f85d147f64d9cab477ecda176cd5dbb
TLSH
T19FE02BD9CC61EC370CFC071865540B42E75413576F80455B3B3D9108CF70B3B429686C
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 64bbc02114f43bdd8c0a156ee23d07d57719e2f63b6cc1e258e917ae569f3589
MD5 e25a1bfc14be736ea5a67e398e86c06a
SHA1 a25157e9b46653ac482a98b18722d7ed6fab106d
SHA512 404de51d46a3f2edacf2c9026e7c4ac947bb7e7c0822e90e41e6dc78e41224ab0e7567b9cbb6461f4a5a51b1291977eb711e57a79ccaa5f8568074523acac1e6
SSDEEP 384:/Rj+WwCdLYU4TiHFDO81YeN3m7eVm/k/:5j+wc6lDOsNMlO
TLSH
T12E13C5BEB2553F6AE6E3033C911B4A79277CC522F6E8A70BBF353550435DB826A0E414
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 0810264628caa2a808afed2e1a5df02461c64c85e451463b12f11bb255a68bed
MD5 78f0f9ff8c439d878dd5f1a9880e5a12
SHA1 51fb7c0716e6861c1a5dbf096d25a458bfa1d1a6
SHA512 f8bbd764e41a37eb283575dd8ed4c4175fe056c7982c0b104603a4c4def80dd4edd1c5ed4eba8621d68ab043ee54b103717cc04c2e4ac500dfe1bb086a02dc3a
SSDEEP 1536:69kFhGFVSKeL/9K57L/fDL/Y71JtUBa04822L/8L/xpuLASBqg3:4eL/8L/bL/sIa04l2L/8L/XXo
TLSH
T178444EF70951A11BCBA802F5E2033E3DD17B455D7CE1E9E9EA7C4C812829B31B6BDA44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 4b9d09ead50b3b2f35765442ead8e81a4666e04b3d8a9db3d7352aa08c82f154
MD5 8505c4cda9fd0b37eaaa5a89efc6b194
SHA1 c7d44f904f3de90225fe236b1e6a3a4bf48d7d3d
SHA512 4dff9c7bd515a2fd74782749c65d9bd4d9063d80d4b083b8a3bf68ef6680a4d6868f3891c95c78cd44f824f63ab0e7922adae5761625f6f0b13da8bedb8351a7
SSDEEP 24576:n56Gol4YBIYxWEHQ7wvL6kupS4Y1E22zwCZag+9LCKO:ncSYmYxWEvLHwS4YHxCgZT
TLSH
T19A167DEDCA6898C3CD639A70B0F0ED477C7413C3B595C1D68C98C584026BBC5BBAA769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 ca92bc1f00b4f60257eeaa92b1f91826a43ace01d7a8e38e2b71a57daa46a80b
MD5 fb779016fc624ac5c4370d812693aa92
SHA1 76164e51997583148d646d6792838c8c1c51f266
SHA512 40f701bd9b8e99014a5ac6f5d8f45a923fcc08b28561c2f6122a8c6d2df4b66c70d0011306b9421259e3f2bbe85845e3c424b4483f6924ca3169fe4395e1a0e0
TLSH
T17F714E2D0E6E03DAE3A0133191F11D91F7708798B5C7CD3A5C677972A81EF71952525C
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG
Size 343B
SHA256 63200ac821ab6a2081c2cd25e7a7122f89f1ca99c98ffbdc876ec076774d65d4
MD5 a889b5f887e9ee3d8bc11417f2a27e08
SHA1 31dfb5373270f93e4cff8135a4fd459b5d0d5de9
SHA512 8b002da979c20032fe7d13677b3d07cf35937a51850d65b56d16f0cdfb132e67a00483d7098b5d275eca1a2f4b0b9eaaf4182005887b555377d2ee325b1e276b
TLSH
T189E0209956C6C22D75A4B8E34134970891D0345FD6D5AD13970CCCC47AC3411FBF57E6
MD5 SHA1 SHA512 TLSH

Submit Download

EdgeHubAppUsageSQLite.db

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db
Size 32KB
SHA256 9ad5628965aa464020c794ce0776ea54614cc38f2bf5ead8b6b08b67757dc811
MD5 33dbf270111e529dd1e9741648dcadc0
SHA1 d8e462c68d1fb90938ae0fd5bbada36ffaf7c48a
SHA512 c3e9ec3d2d181a2163a3c6d1c070a9a35d8b15d7133e3f1f21a9b8d34e62202095572527ea1e9e55512b383f7d3938a4e980d7c261e905719b973c67449c1769
SSDEEP 24:TLAga0Zb7OaIbz+UOxUDDNzWjJ0npnyX7y+jl/AW5Lf2/K5fKFtI2QUqYp4:Tyi+7f+UZD4jJ/B1AWxWCKFO2QUTp4
TLSH
T11AE29B8D3B51F511C4ED733EA0C2C5E0AEBC686C864D7571923C98B68C636A2F49E24E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log
Size 456B
SHA256 c5ce9aaf8ffdcb8a00463a7bf24001885e0a792f110c8db74a1e2f4392cb0e31
MD5 f23d2df21a39aa8d814cade6c37856c8
SHA1 233e65707015a53f83a0d53db03a4af8fab21ea6
SHA512 a7b50b8cafba80f6baca44b260f8379852c4176f3dd57168812f3b4b811d2ff340f09f8ce625cc2adecab2851cc33725cb729548a3da98b041387c7952077918
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 322B
SHA256 77e71fd0400101787f8bd24fd5c2f16f115deca1cbb273420c9b5e6ab7aaa6b5
MD5 359d773f707ec71205c987c28f6e763a
SHA1 0252f41c0ba6d86e2e4629f9794ef8731dc70a86
SHA512 6b2fa91eff1b20c1766e3aa65d623dc411cbd03c097191d6ef18c9950e6559860b433f2f94ffceac184aed988652f2b31ca3dd1a0554f150b582127d27b12cb4
TLSH
T109E026055AC8C229A25AB8E3826E470C92D23B0FA2CC3D629B0CC8646142E41F3FA6D1
MD5 SHA1 SHA512 TLSH

Submit Download

ExtensionActivityEdge

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ExtensionActivityEdge
Size 32KB
SHA256 d86b7b7f10bbecfa155b2aa53e2a61a8b726d075be1073b16322b4446e5f564a
MD5 959fd7a9dd064b5f7fead31a31b71b10
SHA1 fd0d829d81034864d3c8c3f212815cdadc8bed62
SHA512 84099eb90e068a3100530d376ebd68db1a68880d543e8c94c0cd92c292ec0655afe96d491ebb837604bb491b987bfbf18cdf13e6be24aac9ba0c205bd8744d00
SSDEEP 24:TL8JhK3iOvwxwwweePKmJIOAdQBVA/BNj2VTJZwJ9vpV3WOT/uReQQ:Tgm+BE9ZW9v/3WOT/
TLSH
T1A3E23A2A5E7C7521CD667136BC21A4665CB910DA977336F23EE0007D6F8228BC475CEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 331B
SHA256 587865e1546f12bea52f1acdecd6760ad6f497d653fa91b5d376475911034677
MD5 2e6dd27ed8c088ae9fd7990aa004a86e
SHA1 b1f7c568214e5cfb45873b64cb66f27a0d08d63d
SHA512 b187f1d0004aea8d0898067f532f396544fa6f95de3255c048b1678399e7b4b7814ca90ef8019a2fe8f1f0a32afc85ec368a64c8cde5e39de98af2163c1c6b7e
TLSH
T1D3E0206445DDC21D75D4609742156B0CD7B23B0FF6C87E115F0DD956B042404F7F55D1
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Size 20KB
SHA256 5fc6f38f950fb491d0eb754b9a5b3778a0a4c19933b7fd3df27b60a27bfbd929
MD5 b4f2303d14ab2626acddd96bbcf027d3
SHA1 e8489899441bbf2ac14b8c977cc5ad80f9588dfb
SHA512 080f04e850481fc13fe02b90530acbf6a3ec5391214395a1d179e18ed12abcb900b809a787bb87f03d1a7e13d1d94aabd20d937e05ce90ceb7fc8aa690f6e213
SSDEEP 24:TLpLbXYFpFNYbatqn1kweka6za6UwpQ9YH8PATZ6HfBMopo5wO0kmD95IOv+AwH:TNLopFMatSaw/auUOt8BMop2wumQ/AwH
TLSH
T15F92418E1F346211C1F44B36E9D189673F7C111DD3B77A899D1820F38DA215FF0061AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 65a6a31ca8a5d8572b97191252e79ac5358dfc307e554b257395b89952564c09
MD5 e3cec1f12aa407f541d1ac02bd62094d
SHA1 8d78a01a04d4c0f2c6c90e38cc199e2e358380dd
SHA512 02f88cbfbea6aeb92d9884870ef821f5513ffe7d4838a768d172f1775177268aa65bbf5644b20a6f2f3c5588969e35122adf731ca57cec45f1c7d2d710c51fcb
TLSH
T14841C0F3C3E4866DC91156F0AB187E2BCE1D0954832C3D5AC9E4EF1B93E2471E14199E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 9acb00d030503ddde3cf2d6873aa9ee4e9c0f810baf6752b2ffda77b6d1777fb
MD5 463dba8398bc137a8875f9c85e58175f
SHA1 22bc837ed5c7fa59bc9804f7d3e03391e63b90de
SHA512 cc4f920d52b7258628b5997a3c5f7697fe30e247ae82ccdd561a89b344066858e36d92d4626170d2e11b76bc42621fd0980a6c07d6d038a4292c6b397a795293
TLSH
T1FE3190F783F4856E8A1196F0AA18AE2FCE1D0511432C7D9AC5E4AE1B93E3471E141A5B
MD5 SHA1 SHA512 TLSH

Submit Download

Reporting and NEL

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL
Size 36KB
SHA256 ff0d2f1cfb9870acb1b93447049983b1df82f9ff04b5801f69d1f812f79b653d
MD5 54ff19788d3245620d1025323584b28a
SHA1 c65786708c07bd966ff4d64746ead3303ce14235
SHA512 3f9a00a9fef7dd89a5cf8788fa5bdb6cbb8621bf5731cc964a1c59e3a751d367c1dcc2bce96191c69db77347bfafe86115d96107c6402031b347554b713648d0
SSDEEP 96:i/IEumQv8m1ccnvS6m29Ry9f5nFXjUjM4g:i/IEumQv8m1ccnvS6m/gC
TLSH
T134F200FA07236105D98444B0E4009FCEAF16014B47B6B6DC76D447F3F7A21E2B6B979A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 188B
SHA256 a338b55041512e8ab348dc26e3d7627651593a8d5f11858467adc3bbacd731ef
MD5 8e47daaad797d8aeab0379c2457be9b0
SHA1 162ad724f3cbd49c6564df89063b8c2a857c3ef2
SHA512 0ab3a4544ee1d84ed6b2a696d38c11bc3faa1290eabc527b8c000116e2b8ef681380fcf78345106ad5b8dd1e2e686c3c0c38583fecea0bc8190cce4823b60e1f
TLSH
T19EC02222C0F8F43240344ABA19917888A675C830000088A0C8A8C33CB0B04B75A01429
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 f92569a7cd91e45dff70e1d145f2eddb074d0c9263789418385f5acd01235456
MD5 6fbd2bbc6e285d9632248b72227f6d8b
SHA1 1ad29376554c5be20055d848743efa102ff98a31
SHA512 cce158aa12aac83a781d2c326c08c04880c5377401737bfb8101c8c8b07b8c1b596f1ecf86000db9900ea6548e262eabaf2174581fd0d6370b13e6249426ffbb
SSDEEP 192:sxZ6R2yMqZjK1Ml8Xko/fCsZWpV6s8Z5z/6zodpI4HW6+WNGYo33ccrgIgZ0QJ:sxZ6B9o/fCsZWv6sC5rBhHbG+cAZX
TLSH
T16D62D8166A34997B8CDBD209FA557F53D7F91523A2904E4499FCCA0C01F7AEC621382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 ddd93c640e662c502f8eb86638cc1df77a2298622f6e99b3321005e81ad97b67
MD5 05935d2041921213c2915352f66cfcb9
SHA1 da1777fe0ccc73476b61fb62b7ddeaded5a5d048
SHA512 12857425d3c7e0616dd87b28b12e481e52fac401d62cf2d444b3a35b85e2bfac067ef4244c51b9b84be70447d5a8135ce2be134629431716442650f79874268c
SSDEEP 768:cFADqXGWviq5i8F1+UoAYDCx9Tuqh0VfUC9xbog/OVfRLl5bKp7roK/X:cFADqXGWviq5iu1jaSRLDmpIK/X
TLSH
T16DD20B2F684CCB7E4F841E5CEC266F8B6DD802CB6A984D5447EA844C02C77EE512B5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 338B
SHA256 470b33751b2b436e5a8f90bf66429ffcba9cb8b596cf7bab9d8f3738b1df3616
MD5 2d4b2fe2f9067acf83201b7416b60b2b
SHA1 405310efa84c99d91c2a27108bf4094add9e08a2
SHA512 c3c2a7ac09726eb2e49a86ec593d48f0518a97158ceb753e1b8c14dd4d5e5105e46299d61af6ebb83c7f420dbdb7fd39fef305e1479e4bdf9ecfd8655b4d6006
TLSH
T1FAE0D85046C6D2BDB05AA0E30174830C9296751FE2C87915AF48C9885183E04B3BA791
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log
Size 112B
SHA256 26e2951be8be898fd4cea7be64be2fd718c56ac3afced14becf0944d55cbd9f1
MD5 4f45b664fbaec64b7afd8b972d9a3f20
SHA1 4b4e0cddbf7cc5795f1a029c863eecd55e6553fd
SHA512 e34f3d55e6cc12d7a566d5e1fcd03b217466f2978c7fedbeb83c5e24f92c556b1fdb7f74effdb3bd842be646e04553f9e0909d82078d92df0168e69f783621c3
TLSH
T1AAB01202BF416156C5CD08341A64E7807350F44221098B234CC55F100E4B3D83F51CE0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 350B
SHA256 02b8b3259bcff2ea8fa8b404b4812ef3ae412c4ef73a34ddd8d9c2effde6de13
MD5 dba7ae062026b6575b9658b5376203ee
SHA1 d617f7efbf3637960f70e408ed40e3ede8d2dc16
SHA512 5e878c873c9d43e41762859ebb5a7b91074a7bdfbb71fbc2fa33b30c7b91cfdb71abead577e3c69be6581731471aa7f0be2b1361d0a19f616b5fbfb1bcde815d
TLSH
T16AE0D8A416C9C36AB2C6A0DB4225E30C91A2780BD6D87931BB0CD944729B640B3AF1B0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 326B
SHA256 767fc9c13bf2dd47a3161881fd0c667ac5d327eef3070c3e6f9f3cf1164ad0b6
MD5 4650a989fb56919f85932a675fc00c02
SHA1 ee706f700fad163c6f4b52df5d8432ce1a6dc69d
SHA512 c07e348168fa433eda4ccb90e9decb9a53c3818bc928ac29c6c0524d5f9a803934f3cfa37322c2a9414abca2336c1997fa946651fefef875d2be7456989b1940
TLSH
T16AE04FF446D9C3796185A0D68268AB0C96E07C2FA7D87A66A70C8898A142644B3FE6D0
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 22KB
SHA256 093d1246694f39587bf4898255bb46b73e993c68cbeae63ca0186367c69a5b48
MD5 4e133bd1f12bd33211851f382cca2bed
SHA1 54f22003e7fab74a255c3a2aa81185fcdcb3e60d
SHA512 08be6d7270b1cebe6b0faa22933d894de6f9c11ae7b19c7edc3a2322f937653fe04f8bf35c55db06266eb25ec567b5e4a0f1dca95b6202070c074ec673be37c5
SSDEEP 96:KY5mKicqtEYKJ6SOhCKiYZ7yKoAS+/yKosjfmKoYuqugKnKA1OKOACqIgK9KeJ2B:cVSnNDxZ9l3iZ3QxVl/1hVPaRVu
TLSH
T1E4A26A16713A060238BD6D4CB3A68A3B4F4271633418A5EF7FB814760E6AE125DFD8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 26KB
SHA256 317434964913fd2338b29385bd7c62f26b91fd4e17798f75e51dca9d9d9e889a
MD5 4a8b855983b4052dcdcf823bf776b992
SHA1 5a32f93fbaaa80db074613c2ec872dc35d430aa6
SHA512 e6e0da04ab1bceb5080fbb367c2a637da3dba8aa2b2dde1b961c2e9892213fb5e12a9dc40c96a86fe8dd8376790b7f44e6d25760fdd73bda9f8977f4dfc7753d
SSDEEP 96:KY5mKicqtEYKJ6SOhCKiYZ7yKoAS+/yKosjfmKoYuqugKnKA1OKOACqIgK9KeJ2u:cVSnNDxZ9l3iZ3QxVl/1hVPaRV9mF/rg
TLSH
T16FC28716717B060238BD794CB3A69A374F4271633418A5AF7FB810B20E6AE125DFD8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 224KB
SHA256 6f599116f893ff954785cd241621f0ee5efddc8b1c18010337863e11d68c1833
MD5 2fe8b2341e90b140f50e87549c9d49da
SHA1 0d3d8b86e5106d4b251e71a3acd34ce7e6ce2977
SHA512 cad72538be110a34bdc0cd745c95a70fd0957e56d6ac021904efe6566dd4021e60b32c80e81eda266879738b1e159f692da45b016689f981340e61711740867d
SSDEEP 192:P+xWa2s3fT8w0QQnG2IMW1hPJubRd6vPtcdCewdbsc7V1VJ:mxffQ9QQn7IMW1hPJuVd6vPkxW
TLSH
T13824740A7B747001EDE6D9721CB080771E3CB16ECF22A6915DA654694DB2853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default_cloud_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\default_cloud_config.json
Size 13KB
SHA256 f9e4da319fe1f5a7d497c452421f4648a24ec7588f309ebea0f0cd61a6251eef
MD5 256c40bace492c4e28451ce149d2f9ac
SHA1 b48b0eaf986b9efc91d5c8dd394dccb6d82e2adc
SHA512 33b38d1ced015798722180fc8c8ce6daedb18cd5d0e4b3db27d6176c13cf3ccb1bd79f2e68ca390d6eb43ac508c29067e8f1a3ee9f0167cabe37ebbddf6b0ec0
SSDEEP 384:l7BJeojewj9mg1IZyvASoIL5QJwTcoEnE0YU/VwTcoEnE0GU58:l7BJeojewjcg1IZyvASos5FEnE0YREnA
TLSH
T12452007AD2211C7719B8636858BC4692F524137F8281C81F78BC656C8F7FA79A089FDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

favorites_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\favorites_diagnostic.log
Size 2KB
SHA256 88465649c8b3af14898a5cb632688b46c548cf38723c9de70cacc3cedfd4e153
MD5 fe2fb4716b716fecf849166a9ea6ccf6
SHA1 2b6f4bebd1e71483c66ee53615f674f3f87c053d
SHA512 86797861c9a3fd3133b8b7b8c5d6598e05b023ad08ca804bbedc26c7e2433f52d08d64e2f487ffefd11a461c81f136f4b2fc00518b52f478878504fc1c40a346
TLSH
T12551E28193E95885AEC9B881C20A6513EDE17F5F320E68B1672E40F51F48C255F7EE35
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 13KB
SHA256 27576c2e6d794276bdfd98f3cabf52eab459cf62ea97922f617a5727394495b0
MD5 94afbb567c131b5a0088beefd4b7e1f8
SHA1 707901a9a81e498ec0d31a4ea105f022c9ca98a1
SHA512 5b2e09bd48a7f6c2ec9093faae3f48bab75e5e73d2c4b1baee019d733b7e57c9fc252928b90fa99ef9958b7a2640565bf91d9a5d8f06cbfd819fe0fc071e1b27
SSDEEP 192:awO0XAsHl8MyQ2s8rHmXDDQVIII8bMMIMGXYcYH:a0wsFf2sGuQVIII8bMMIM6BO
TLSH
T1AD52742926161F7BC05E1FB753B98B9517CA88814273266D30A25C8F4DF3B5786C92F3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 322B
SHA256 2b41285b2478e2c9548258b835eaf74b166791db112971452e59c6c9ca1acb9b
MD5 8e77a436088a936dcde1eb70125311b0
SHA1 2920a400e8ae50c1f4aefc736709c66c9fdc3e14
SHA512 aa9c0cbd30bf4ad7971cce234a3c6d697690e0e5690fb20c332595d90ad1a9da4f70d6c5b273dc05a3a5353aac019536485a2659360babe71dc9f802ca2aa3e7
TLSH
T1D0E0DF10AAE8CBAEB15470D70129530CE2853A4BFAD9BDA65B08C4ADA047D80B7AA191
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 238c282893cb0a2acf62705464d9b8cf44772a86f352811b8c16c4950ef50e22
MD5 f9ebba5a4c08748e460c175d40a55184
SHA1 48d6a873feaf50e18f19561c232b7c8a12fadfe5
SHA512 93641ec7c60d021c37c29207b02381cad330518eb4d256a2e41ae4803b481eb5d5d23622856b18e88a43f1f4e0f5bfea22041598b459a5bfbcb7ab0d1fc68883
TLSH
T1C921605AF320C158E14E863EA06F97361738D8129FBCED0F547964392E75A010E8B6F5
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 340B
SHA256 be945df2e6a30b58840b4e4ea388c3cb4840470b02afc2699e2d8635bcd69cf2
MD5 21e3e35075bccbefbd43c23bb134bbb6
SHA1 3f0301d73fdd6509e67c3e9fdbd7bbc72e9962ca
SHA512 f784779c4c974115ec2d48c62a7c0c7b4914af90448b254c844ff6429a535d4dc94d1d83dcc65191f9dfc88cff05a4f3b2de23f3951ccf976b09f9ec85af5298
TLSH
T16EE06810EEC5C65F710070D301699348E3863A4BEAD46E911F08DC695002E40BBAA080
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1
Size 264KB
SHA256 d0e4c4b776b6b40faa7634ee73d5176221ae5b3863fc550a618b46595514edb2
MD5 b688255097d217af114ae1405cf5d38d
SHA1 1d4b5f49fe461b32833474621728234f182a2381
SHA512 55ffc3a8c5daa031a27a0dc8cb6b1aa282ceb075ab32f3d2368c41f580290a773d6345ef65350d7675b6445f66b41915c130d23e82ab256bafcac94d63ecd145
SSDEEP 3:MsEllllkEthXllkl2zEfl2ll:/M/xT02z7/
TLSH
T17D440434FFC01405C500103040D3C7503370F4505531D74334D504335CD75400C00000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Browser

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Browser
Size 120B
SHA256 9c70f766d3b84fc2bb298efa37cc9191f28bec336329cc11468cfadbc3b137f4
MD5 a397e5983d4a1619e36143b4d804b870
SHA1 aa135a8cc2469cfd1ef2d7955f027d95be5dfbd4
SHA512 4159ea654152d2810c95648694dd71957c84ea825fcca87b36f7e3282a72b30ef741805c610c5fa847ca186e34bde9c289aaa7b6931c5b257f1d11255cd2a816
TLSH
T1E0B012203BF9062CF3F74D00AA73AA3428BFF4080A14811D505102080C33E19C478FA3
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 3d23c6eb5c8a1d7f0123731bba91c74b5ddfd4c152322d449a41294d9c070984
MD5 f12d4246f3637d632af11a02b15fb142
SHA1 f8a8e458be2b377e507b7a47c41d7ec8a371894f
SHA512 693d5c9955f35ffa5de0e6a1090ccaacba179d5dd0c257f6c58fcabd721c77430ebef3ad7269d6dac8134e9fb733f6a4fcb17100ae3d397f9927380ef591637f
SSDEEP 384:nliFhCcmyWCRsN/8TUNTUlI4kGJl/6SCifbGoalJaJlvdCZMI9lM4OObjI9G6w7w:sFocpRGwg/Fo4Cvd7I9m429Ml+
TLSH
T199E23A39DC54CA7FE8EE7B49A34E25668DE40237C9B889D8E7D50F0C81B609DF706816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 a5f3af520cadd1df37374cebfd57c75368d85fee00052ed68e33b71272a1f4fe
MD5 f8279c90edf70247de9328bb6a9225aa
SHA1 03345b8bc35ee5a62988e16d5030812b4d787516
SHA512 a5e1f5e650fdf83ce6e027d64f3ac5e731001abba8362abde7c3bfcf58769b42f1e7afa86765f73fe0a4f0fa568d41120d32cc29e45f04294511151549dbfca4
SSDEEP 384:nCiF9CcmyWCs3sNC8TUNTUlImkrJ1O/JCifbGoalJaa7QXhkP+lFYS/JF7IgV:JFccps33wgwCo437QXhkoFYS/j
TLSH
T1C7B25C32EC98CABBECE64F96E74A7607DEE41163859C99D4DAD91E0C00DB1DD130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 e7cc2319aa10c5451cd14116576b08b80cd25b97df609d5f8a7ee6e51a5a818d
MD5 e80b899ef96b5378a844c44bb741d825
SHA1 d08e05e6a02548d6572783d1495d81c9786135ad
SHA512 0aafd4da7c184a084f2abe9eb9d1b520a6b91c253101cb91e53644335a5e9eac017b2b34530519ea2bcd2786a60757792c0526bf08314897af2c0774ba88f97b
SSDEEP 384:nPiF9CcmyWCs3sNb8TUNTUlImkrJrOajCifbGoalJaJlvkahkP+lFYS/JF7IgV:aFccps3WwgZUo4CvkahkoFYS/j
TLSH
T168C25B32EC94CA6BFCE64BD5E64A7507DEE04263898C99D4DAD92E1C00EF1ED530BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 a91ebfb7e638bfc6dc861285aa55dfa0545154d78e1520e3e117af1fe4b2b905
MD5 93f78439b74a6be9bdcd6fd9f0d2864c
SHA1 4776d558703e03504f898058093d3e8844864012
SHA512 566b0fb290b790ec71420adff4bfd8bb7880f37687a2863acc97fe8e0fef3e68a30b1c6b516d670d1cbc506f024b80da225e2b7ea9627f4a66c936fc1d7470a7
SSDEEP 384:nWiFuZcIbsNu8TUNTUlI4kKJl/DSCifbGoalJaJlv1VOObjI9G6w7loHA/7Izp:9FMbXwguFo4Cv1V29MlE
TLSH
T18DD25B32EC94CAB7ECEB5A95B35A36539EF01173C98C9AC4E9D99E0C00975ED130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 a096f3eb086f409dc90f74c667b77b667b85b4f40d169c7f51ffe0a93a16d83c
MD5 80bb1d6dd4ccc3358a70a37e8f6db346
SHA1 64545710d204f8fcdba7b701a965284c721c78a8
SHA512 903d6c5b7967029f470885a0e00294f561a3de937a97bf21422224abe1a1ea4ed9f4902f0bb3f46c4dc373b11b1cabf81362f19e5e1167c82dfa2ef667023df9
SSDEEP 384:nliF9CcmyWCb3sN/8TUNTUlI4kGJlbOESCifbGoalJaJlvdaOObjI9G6w7loF7I3:sFccpb3Gwg+LFo4Cvda29Mlx
TLSH
T16ED25B32EC94CAB7ECE74B95B25A3603DEE041678A8C9AD4DADD5E0C01DB1ED530BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 17780afdd0f012b7486637a82e9c7f8d139b62b7852bfb2de70b1c1c71c1e11b
MD5 c5d41a605fbd8b1df815e19119e8afeb
SHA1 8a1651b5cc7217abc186b2d072e3c2a974474d9d
SHA512 2532ef3e97b79626112653421ae1463d96aab6bd10e2aef10f1bab59fa216fb106d92226dfb262a566056454f67a50b9bf617d9f796115816453457a04bdf365
SSDEEP 384:nliFhCcmyWCRsN/8TUNTUlI4kGJl/VSCifbGoalJaJlvdCZMI9lM4OObjI9G6w7w:sFocpRGwgAFo4Cvd7I9m429Ml+
TLSH
T100E23A39DC54CA7FE8EE7B49A34E25668DE40137C9B889D8E7D50F0C81B609DF706816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 618974ec09612d79c9a94e31823fa451995fdde68aa24384c42bcca5ba498f0b
MD5 7279dfb0e2325be821f06a2605df4209
SHA1 70887e7eb455e669fcc60559f0a8359f3c73bc5c
SHA512 91b775d67535ac4589eae9a8351b21c61f7333d00e705ab5a5a405941d966d90143cc163949be9bfdbcf9a674d71f7366b335bb70eb68efdec9f5ccccd10a005
SSDEEP 384:nGiFuZcIbsNu8TUNTUlI4kKJl/DSCifbGoalJaUX7s+KnFE5ObjI9G6w7loHA/7e:tFMbXwguFo47LDKnFED9MlE
TLSH
T184E25C3ADC94C97BE8EF6B85635E36179DE45133C9AC9AC8D7D85F0C00A709DA30B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 193f0eeed14c4ea1ba0047bba924efe2d04cfbbf64d47a58ef045b3bf45f5200
MD5 bf5dfd90663b21b56fcef5b748462419
SHA1 f199f5b4f7cef11bfa8d6db57dc362c8ab56c6ca
SHA512 a797b95e95df0f1187220aecc33dc7b6b4ac5d0db2ff42bb4cf3a8334093e2bac717a85453ca10d4b5deb03efb1c8c9fcce9738c55b2b35cdb076e9f23a1759f
SSDEEP 3:MsEllllkEthXllkl2zEflOr/ll:/M/xT02zR/
TLSH
T1A04404147FC00405CD00107040D1C7743370D450D731774334D304335CCF5400C00040
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 1bdeb86193d41fb9ba1d6050c4b02370fad5313087443b9898b8d99ee078e4d7
MD5 7559a0b8bceb1cdff93d2ddc52afe5fb
SHA1 e049267db994ee1c8f815a5d4d58417e1c09d437
SHA512 ca9bfc1ba98cea17b01b0efd038bdc61616ab55ea42d161f8c69b45ca34061efb3d6c15329a3f6ec0998011f78a6d4fb526237fbec99071036f4b9bf5f39a663
TLSH
T1B34120D11C295AC1C4BD0E7FB4CB39FC81E8D729F19030792898E984066DA1D648543F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 99e7550d1da8381451ab8878d660cb27e583f55733fdb90bcc6a959ff3806248
MD5 15aa5cb325d49c4493699f925decfbc4
SHA1 1487d7a637a563a2d2ec5c815d00ef6537794f25
SHA512 b62a55fdf3f5179387979d431c868965b05d4a77e0f6eb588ba34eb70b4fab6ff7eaaf560498239f40857018e1db1656a5d520eb96f6be5916bc33a24719a730
TLSH
T191412FD15C291AD2C4BD0E7FB4CB38FC86E8D729F1A0307A2858EA944A6DA1D648143F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 e07bc7f75149b389ede359972a2892f52afcdf8dc5866ec12f8ff1890ebfd2ef
MD5 1ad4ee19cc76802681363ef9b33ba341
SHA1 1936b00c41075737ee4ca8de23fd68f84dea105c
SHA512 177ff20a746910d1015d32494972256e3cfddbddc2c788964799454b3cce9801c7f8534466f64f4ca06e1f426d4467919a3c58116d4129d40eb23dbebd3c90e8
TLSH
T1B94132D14C391AC2C4BD0E7FB4CB38FC85E8D729F5D030792898EA94496DA1D648143F
MD5 SHA1 SHA512 TLSH

Submit Download

first_party_sets.db

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\first_party_sets.db
Size 68KB
SHA256 9061cef2dae36773bac05af99d1133ae3692f735df7565ff5f17f40a9deed9ec
MD5 88bf35a77b25e16c2037a71dfa6c2ddb
SHA1 2d6c7cfeea66e7cee4cc057e175d750b3f25d8c2
SHA512 9ae87b7b18aa23df20082c9f55ebc9d731675eeea7cdfe9270bda1f6c72d9c44280986bb3b6415da0ad26735e6949728b8e46327ba31cf424615aeded58b7e55
SSDEEP 768:OQaOTpdNuwT4shrJWRIdaqrLI1WcxKT0dTTTjTVHAM:xLhaqLI1WcxKgdfHJHH
TLSH
T1AD63D9FB495B02D0FB9941F4924B76CCC35B299C8CF8E7D2F96188176AB04B4E255A3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

first_party_sets.db-journal

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\first_party_sets.db-journal
Size 8KB
SHA256 c3274cf8da49c5bd361e79aa3235a64c2de2ccb0673779fceca6a6bce0c39204
MD5 413c1932f3be15bacb76770a917fd02b
SHA1 7b25c0f58e8f6e084da6fd764e1b6a9c8c05a612
SHA512 d5fc86f73979800f35fc8b99d8e2b23dee03f302b89f6d8e3b4633eefb40d34a85c9ee2bd09455410347cfddd08d17db6527a045b1ad0d22949d3ec1e2bd5c6e
SSDEEP 3:N+l/Un3llQ/8QuQll/lZAOSl5eqJ/cSFYojpuyOV9RUId/cqaq5AblGKQlaWJFum:d4/ZlaeyEGyrkqaq695fOK+
TLSH
T1020212431B51CD73DC851B3F66C640DEBFF3261C1965FD0280A4CC174B85649A74856A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 971dee223978c8795b7827654d596048a80a15dc0c535c6f8f152da3159f1614
MD5 3d72eca7ecff36e2b24f21ed3e3e154f
SHA1 b0ab5e3fdc87ee6d16a6da0cd7c18d030a856e38
SHA512 417799de7d621940d15ba2ac2394ea4cfadf56a675c3b91738f2c9e453c421a0461e9b2c7cc9e15634daf13e517b90b8f14127dd8a93a3d4668991a149ec39c8
TLSH
T1E541F85CB6FA1148B7B76E5AABF7686E447FB8372F0BD05E10110D4E0A22A40C971B37
MD5 SHA1 SHA512 TLSH

Submit Download

8b0d4544beb97a69dbb9583fca5575a9aba6e37d.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\8b0d4544beb97a69dbb9583fca5575a9aba6e37d.tbres
Size 2KB
SHA256 1b4e2247658108dbd94f0a30f0d56a392266f367f5ab16961a82c38dee3532c8
MD5 0ae579b9fd0df4b34cdf45018bce5b9c
SHA1 b978974d6c9c13f0aaf15fdcbd711eee30cf3a19
SHA512 e38b0a8e304f248ac88ad1a00c9af8e12070c8496a0080915d67809c7f194898b5f11a1e4b45b3f2972cf3463251c1df654e71a72b21bd3775e21cf957619c89
TLSH
T1B0511C58A6EA1109B3B7AF469BF6786D887FBD372B1BD45E10120D8F0623A40D861737
MD5 SHA1 SHA512 TLSH

Submit Download

4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\92mp7hp0.default-release\cache2\entries\4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF
Size 15KB
SHA256 5f3b85785632fa388c763ca26c0c94e7c77796ff8644b3914e7a1813cbaec5df
MD5 3c652d0649f0c728846d429bc36d1774
SHA1 c9e9869e7be57357a723fba81835d5528e6ef2f8
SHA512 d8d32c46df1d1bb2b0bd624d01735794e4ff6f3518d089b5c1e7ebc20d0e9a6d00886497e66c3e7f293c5c971d1a1fa5181f3f2c88ee48e1554b40bf53f3ac10
SSDEEP 384:HwCe7iO024Y5dcs3hk2nhfdDE2Ba/rIVy8eOKl+SKl+d:QqZY5dv3hk2nhfS2sDIVy8Bs+Ss+d
TLSH
T182729DBADF416C5D1917D989C9AD5366DC05F9B7CFF680B608243449CB84326B0FA48E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7abe2240-cbbe-46dc-9bf1-783b39f8c5b7.tmp

Path C:\Users\Admin\AppData\Local\Temp\7abe2240-cbbe-46dc-9bf1-783b39f8c5b7.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_h4j0s53j.dxi.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_h4j0s53j.dxi.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

cv_debug.log

Path C:\Users\Admin\AppData\Local\Temp\cv_debug.log
Size 2KB
SHA256 7cb44f88754c43efee1b85023a27e7d61bfe9f90878d955f42729e04854d95dd
MD5 22859ba1700aaef43616446bdea2b0a0
SHA1 b846f061601bf7167f83ca68ece3cf6a8631bbab
SHA512 b1dfc19e14bf9a556ea7e24fd6e4f4a491895f934f82b8d098525e137ad5c6e3b217eb8111aca3af88ca0b4e2b78c787f3a6fc46e50067da2605593e6e025f18
TLSH
T15141E6E53935A23F6FC387C460754C845561F181132E9A5CEE16D034FE6CEA2A72E7C6
MD5 SHA1 SHA512 TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4300_1729562893\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92mp7hp0.default-release\AlternateServices.bin
Size 10KB
SHA256 340271d2eeb26bde4cc2d318a6639ddc90aa9580ec12ae33cd99d5b21179ce36
MD5 218d39d4e4d1c3d1e2ac36e0fecf2534
SHA1 28427b53b598b3fd861fae99624c092dea6306c4
SHA512 7d799beb504b99f4bdfd6b7de81115592a7969ce681698fa3314a7f16c08c5c09f4b37c5424efa57f58fb77bc82db6b528a0702d98bf6d46cfa3753f4d85e172
SSDEEP 24:muhMZZ91Na9x+i9B6q9Vv87Z5q9F55A5nsd9lEz9Bb/:S34kQYIB87HI56nYuh9/
TLSH
T1662230F77BB1A462F0A28FF08099B94C8C330325557DA684CA44E0F756D5A99D03EBF8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92mp7hp0.default-release\AlternateServices.bin
Size 18KB
SHA256 11796ceb57b0c87dc8c78abca63a557ba6f8e666d89d8cfb56fc3f34493a57d4
MD5 42cf15fb29585f2a1da59b1c7e2b727b
SHA1 37a7c78ab601ba8f677cc4428fceb4b2d90aed3d
SHA512 420da59ebf036de6cd846dd26f3c99cdd3e8c5b331f39119d19581565231ea187dc0d285f1dca365418d2d41323325429dff5219df9b266c97187847108cdc38
SSDEEP 96:shjLDPfBHBrsI56QZJhFhM/pGgyx2iUyuZimy8tiNy4z57b+4:+rQh22nZZPFtfO7b
TLSH
T13F8244F77BB5A462F0B28FF0809DB89C9C330635546CD694CA44A0E753D9A94D07FBA8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92mp7hp0.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 426064a95d0fd558d4477fc129c9e5f29aa6905dac203d16b8a0bef8531281c4
MD5 fa1a4393ffe77af3dec947737c0f9bb3
SHA1 f51ffac4a004494fd0301c25112aa2a863dda81a
SHA512 6f34a88f2970fe44e2f6e91b9944bb99bab1680c5f671d7fb1c55f7859acb981bacb7069cf3308460f8a713695e9994612594cfd83f17e177425d24f0fc6315f
SSDEEP 192:DrhOv5zboBZpI9yjaT7441d66Joz1zgCl6mc0dz:Dr+boBZpI9yjaISd66Joz1zgC1jd
TLSH
T162D1FD25E638863BC408537BCDA21F404F39398B984E7F19329C650C2C5B2DE7A9E57E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92mp7hp0.default-release\datareporting\glean\events\events
Size 5KB
SHA256 3247a8ba43713b66462dc64b57da1633c90b00810279747efd65cdeca2e51d3b
MD5 096d9a5670cd7de328ec8ee978388904
SHA1 a520eeb3ac53c82a93c55bed15ada2b374055b58
SHA512 fec8f0a35f08e4f102fb43d4a910fad7219e19c0411241f7649da77e635cf62aa6aa8c2f9836649247f976a806073a91a3ee11a30616e7b1f0ee3b6baf833f7f
SSDEEP 48:YEso7Ysp63ilF/aKVuTC6y1i/W2iOLBlgu60FQWo6c4JCQ9WJBAdtzvEWNQdNXdl:Y3uyC6jL9DWH4WSd1gdaA7VKGtKgjx
TLSH
T1C3B1312C35B90C7F68E7D2DCB841468E46D94703809B1D470CEBFE49CEA6A9A325F02D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92mp7hp0.default-release\datareporting\glean\events\events
Size 1KB
SHA256 d193d0a61bc1228b3447f27ac7c2562af8321dc537531a78b76790de443e4760
MD5 f318cd4c9c547c940aa8afb0b768766f
SHA1 3d4325ad6dc13097f09d4041f13f41194b81e3d4
SHA512 ca51b8dc97727aac0cfb13381ee87babf3a312886e49e47cf8c307e1cdd3f696bd16c7fc15a10859352f2754ea6d2c92ba75c1a6c8207b9c1d6eb86cac5c35e6
TLSH
T1AA219A6C39F84D2A98D7E29C7451158E53914E03049B1D430E22FF8DEFE1ED9326A43C
MD5 SHA1 SHA512 TLSH

Submit Download

1be230b1-0987-42f7-87ae-f6c599978523

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92mp7hp0.default-release\datareporting\glean\pending_pings\1be230b1-0987-42f7-87ae-f6c599978523
Size 16KB
SHA256 5870aa7440c1f89692f964c005e363b4a406aae4fc90aa9d63939ede3c7e5f61
MD5 3c28311ec21811d4aea73a5eaed0e6af
SHA1 33feb245e98392e17ff206c406e14ab78cd563c9
SHA512 ea6da77d83fc8551e34ca35c3dd9829f4aa2380a4b410b43e7a4c7d695a18cdef307aff2cfd2e8e0a0f0ef889b12c755714bf8d39d253e8b5a95fa76deed9292
SSDEEP 192:W11P2kBM+2T1b4gU6dKqr897eb5HSDfePRnzh7ifGKZ9VkgjLmbiCOohtzULfPyy:W11lir4G1r81eFyDfeRnF7iuS9GRy
TLSH
T1DE72EB56646045BA8691E3A8C4F8BFC3E6F528CF4C419FCAD7E47D082DDE0AE112794B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

50de9eee-b256-4a21-af8c-4817aecf48de

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92mp7hp0.default-release\datareporting\glean\pending_pings\50de9eee-b256-4a21-af8c-4817aecf48de
Size 235B
SHA256 2fec0314b9a9b158820d26dd2903267e48e6d0d95332eab62ebd3d1720e8c518
MD5 808e1470986d49714a46c2113578cf14
SHA1 83b39222eefe5daf47546207042ef032ca7ff5a2
SHA512 b5cfd193cde7deb0acf5236dcb38d6b67026d851878edc2b899bbe4e8ee9079a7cfc1d95b69b9028179f271af3d5ee8e0d72573c6b3183fed96ee7317157fbc0
TLSH
T1D1D097802498672C18040F03B0B028DA30458C3710B0A824EA9210389AFC9C8012282A
MD5 SHA1 SHA512 TLSH

Submit Download

66ef67d6-fbb9-495f-bd4a-91ce743ca5ad

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92mp7hp0.default-release\datareporting\glean\pending_pings\66ef67d6-fbb9-495f-bd4a-91ce743ca5ad
Size 235B
SHA256 b115b1b65433e2d91d62153f17d5b2bd564f88910c30c8fdde6dfe9bd19a8f2d
MD5 35ee7a3390e07618252ed68457116648
SHA1 ce4e90d08e6e1b1dbd7d4ae43df3012155def516
SHA512 e7e983353f595b0b197e1248dc360c7cbd85d52e36fde1b49613bcc254268e336bfe6312c6347a326e40f0e46e72e2881934231edcf5dce43b35f7537e283d51
TLSH
T1B7D0A7942898AB6D0C245F17B0A47DD771448C3724759850A9B1857899FD9C853A1C9A
MD5 SHA1 SHA512 TLSH

Submit Download

6ddc7527-ce2b-4a3f-9493-72edb4a86966

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92mp7hp0.default-release\datareporting\glean\pending_pings\6ddc7527-ce2b-4a3f-9493-72edb4a86966
Size 2KB
SHA256 21dd026545b88be1ac2a7ddda1d8558e7f7cbf818e473c3178b0362f34302208
MD5 93007674d5996adff5bd706cdfcbeff3
SHA1 3062896203a3538fc30356fbe62e8e55ba423dd0
SHA512 379375a6de24162242127fa748ae16c84246ac01d7cb8fa896787e7d37caee7f15bf93d1723a9802b685bfbb11ccbd71689cecad8ed83920912a7cb9b1ae271d
TLSH
T1C641662C75B89DB78C9AE58DD1D1334D53A08D0300C62CC36EA1EF0C8C856AA736E57B
MD5 SHA1 SHA512 TLSH

Submit Download

788df1c2-2ca5-4842-b839-a29904ef806d

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92mp7hp0.default-release\datareporting\glean\pending_pings\788df1c2-2ca5-4842-b839-a29904ef806d
Size 886B
SHA256 8de61705f590d32aedb38ee8ba3f345913cef092b34f1cf29df8aca6f119396c
MD5 5bdfaa8caaa0d4354ce6ed8836bfedfe
SHA1 92ac213c586324c3ff691b0446e2229fbb8397ca
SHA512 acb7f24326c25cbcd3e54d2dcd9cdf07b55d6682eec2fed30453c6daacd6256f1d7ce417e8a9e81694671560965568f16de9166d56d474e03bdc170f14a9387d
TLSH
T1F91140018530BAB2CCB8D29B85F1BB428BE43467C0C589083E655E080CAE02BB3BE707
MD5 SHA1 SHA512 TLSH

Submit Download

f08772a8-e328-4494-befa-acfb5111977c

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92mp7hp0.default-release\datareporting\glean\pending_pings\f08772a8-e328-4494-befa-acfb5111977c
Size 883B
SHA256 64925aeead50b89a88d8f6832c1742a2d2758c9719761a2706df8b5789729a64
MD5 0641fe2df18c24ebc8a0f1b53c8ef4a0
SHA1 f165e88ad65637ffccc6b4276be7536468f21d1a
SHA512 d3aa11fa2da72ca0aa9580ecc186ac3377e8a6ca6f1822ed8c91e864f5fbea927e9daffc6c551636a79a54e761e5d2ca83ba090cd60af56afb1fa69fe08d6297
TLSH
T185110441A574B9B3CCBCD14BC6A57B014BE4396780CA95043DB55D180D7D52EA36E707
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92mp7hp0.default-release\extensions.json
Size 16KB
SHA256 02b7482a05e40a8cc46a7ac4cd51a52e28beb20a772132b3ea2fef596977cf95
MD5 cdf5a41c336304fac96d6cc9b11d8ad2
SHA1 c36be9f526b60bde15f6ec16998c510fe9b64456
SHA512 2ec41946f6a3d124054b376d66e6c8455b79f86c6420e332a5e7a12cc60c7f92fcf0d1297789de8ffdc6c421e3499d38eb07c55b5839414d291fd2972b675e9e
SSDEEP 384:ZIkI4vOUmldvf8dhWA94zc96oSKL4H9L4PRUL4H2TL4HPFL4HR14ho:tI42RfsXt4k6i4945O4Wf4vl4/46
TLSH
T1F772321545049EB8294FA79AAA36BE01C37D473B60845C78F4DD8FC802FA5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92mp7hp0.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92mp7hp0.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92mp7hp0.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92mp7hp0.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92mp7hp0.default-release\prefs-1.js
Size 8KB
SHA256 0433b5f1be98b6173478519d6ef33655f721daab55c62e88b0be7faa51b725d1
MD5 d2e425d0a78d4044956005881c537094
SHA1 1796f574798b66e714fda2506d2c0228836fc0cf
SHA512 b96589026ae505f10baf2bc39229d75a5f350e2e3bc147d65724ebd5bb056804471525dcb4d32d93beadf2a82348a441facd99a3c74cfa189dec555f7c9d8c95
SSDEEP 96:xHglTUsqGq5fjXlNbzS2SSloldv9j7nRWRFFDdcSXmBw88Ru8L4cnNylFGS:ySR5fjXlTSSNRrRcSXmBw88R+
TLSH
T13E020D389504CF7F74B277ACAC658D705AA2023BB6BF68D310B95485161CF3441FAAEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92mp7hp0.default-release\prefs.js
Size 7KB
SHA256 ef264de2fd32dadd98d3ed01e8f2b0e7aa39b9fa95797f7f8a1f517a848b28a2
MD5 a7d9fbf2744a5a21b16dd95fea97d3a4
SHA1 a905fa291894e760e65d369b2c4c30c88feb2255
SHA512 9b6790800e69a0c4e5159fc2e2eaf6559f301d8e395bcd4c724472e189549086c7fd04460e282a62ea9221fde535189e5a0fae87b476f969a1f85fb3ff9e6b1e
SSDEEP 96:xHgUTUsqGq5f6XlNbzS2SSloldv9j7nRHRDdcSxBw88P8L4cnNyyFGS:yfR5f6XlTSSIRRcSxBw88wf
TLSH
T160E130789508CF7F78B676ACAC6888719AB2013B7ABF68D350B554C5011CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92mp7hp0.default-release\prefs.js
Size 6KB
SHA256 dfc00c4dc1a3736a0b96ce6530075c265a89f127b6b71a485959f0d54205547e
MD5 a118dabcffd3cf7ccbc3888a2d556f41
SHA1 a1a704b8e53f58c639c9bace8ed550679738409a
SHA512 5e29dfa72699926df35fc3884bbde63c29451c5c14254c604e7d693f3d32b7a89bfda57f18d0d4a68cd1029f6d78b2ecc43690a029656200f6409e36474ffa08
SSDEEP 96:xHgUTUsqGq5f6Xl1zS2SSloldv9j7nRHRDdcSxBw88P8L4cnNyy4:yfR5f6XlfSSIRRcSxBw88wI
TLSH
T188E12F789508CF6F74B676ACAC6888719AB2013BBBBF68D350B55485011CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92mp7hp0.default-release\prefs.js
Size 6KB
SHA256 84d6ed80f72885849c06b8396794e0080801bb602b3c403e382131b5e4a14f93
MD5 149a78f9bbc2ee8481510ffbdfa68aa1
SHA1 92b5ef5a1de33a774f548faf98a2099dac328a2f
SHA512 f7f08910bca171e351ee8ab797cdc2a31636ef61276ee0a4e0192c3982d972a3f80218ae92b6e71dfcabfcb78ce37a90fc24f87787c0fef1356e93915199c7b3
SSDEEP 96:xHgUTUsqGq5f6v71zSSSSloldv9j1NnRHRDdcSxBw88P8L4cnNyy4:yfR5f6v73SSi/RRcSxBw88wI
TLSH
T12FE120789408CFAF74B676ACAC6888715AB2017B7BBF68D350B55485014CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92mp7hp0.default-release\sessionstore-backups\recovery.baklz4
Size 2KB
SHA256 30327d0e97d3ef0f0714bb2fdddd18c8b1513d44d3cff894dc69959d255beaba
MD5 766ad52173cab7611dff17cd7f6916ac
SHA1 129b2a631984ef992934f3652fd14fa0a18e743f
SHA512 4539f72789967bb4b4c6f6accbcb4eded8c3c6b5ac5ea49f57a6667cb1a0127dd1aa2085f9e38098e4b183645778490e82ffa796bc7606ae1ee46caf7bb5b490
TLSH
T1BC516DBF1C2B6CFB3875C5A678CF4FC5CE53182009E9A4A57C586D2001FC6099A99A1F
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92mp7hp0.default-release\sessionstore-backups\recovery.jsonlz4
Size 7KB
SHA256 bd744577c01be4d78a2881974ff92c05eeba83c7d5c9da1fbf29e5be34d31ab0
MD5 ce4cbb57a925e6ea1602fa4d66549868
SHA1 a42ae0a9e63e30722cdea1ef9f926e23b3423b60
SHA512 02165a618f006a78fb79eaa4853145615a8f4fa568df7693f5a39bbfbf120f7d340dd50028db512e535163d695e99073a74886ad3017e3fa004dfa5a0dfce469
SSDEEP 192:sd59h+A6yblW1wcVp+hYPOR7Fz5v+UBhwIrwYOL:e5Nn01ghnx5mwwItW
TLSH
T11BF1BF03DD07CE20A6A1910604D3193D2FF71D2D4AF8CD04AD6EAA29829DF2E77B47D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92mp7hp0.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 4.1MB
SHA256 c76d77642877f78471d38734bc4a02302765fecb444b0c16849434e040e9e8f6
MD5 597d679c0cc743efc82e06bcbd76aa68
SHA1 9ca707dc2480b47eb186e1db5c476708ab6249e9
SHA512 3770ca20f66e512d30108e9b4f43944f57658758c1e1851fd3089e6288b3018a9c53ea80409553a58285817c102deb63e5c80f9375ab7bebfafa5d010afd09ad
SSDEEP 49152:Z7wufs3yaP6ryMtPHd1C9S8rRz3UghkR0bPGYRpqg:dLfsiaP6ryMtPHSRz3Ughk8qg
TLSH
T1C41639F824D1A257F3818037668563EB21AFD00C6437DD444BE966F994B8CEF9E05B2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92mp7hp0.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 6.3MB
SHA256 b74918c33273162a7d57a2958241ad0bb8e072397d098c9aec19691acab4031b
MD5 6ca767194f467001bc0cedef708f87d6
SHA1 440711585d5691223f4923a12bbcad41cd6afed5
SHA512 8f6f8a02a95f3491873eabb76d4d88424d0bddd007ebe6aec4ffc62f40e14271cc0ed110c89a774fda9ea90e5600c93abbed92ccf8b0004510342d3d236143d0
SSDEEP 49152:hLqLygaeUT6QC5zYYpT+J5a32TgWNhP9rJpPxVMcxDrR6Rwuk0PyTXL9xzKN4usy:Rt6Rj6TXL9xQMHwR
TLSH
T1AD665BE420E29252F38140B3719953EB11EFC01C6077CE445B9896FAA5B8CEB4E977BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2384-1753-0x00000159948C0000-0x00000159948C1000-memory.dmp

Download

memory/2384-1747-0x00000159948C0000-0x00000159948C1000-memory.dmp

Download

memory/2384-1744-0x00000159948C0000-0x00000159948C1000-memory.dmp

Download

memory/2384-1745-0x00000159948C0000-0x00000159948C1000-memory.dmp

Download

memory/2384-1743-0x00000159948C0000-0x00000159948C1000-memory.dmp

Download

memory/2384-1748-0x00000159948C0000-0x00000159948C1000-memory.dmp

Download

memory/2384-1752-0x00000159948C0000-0x00000159948C1000-memory.dmp

Download

memory/2384-1751-0x00000159948C0000-0x00000159948C1000-memory.dmp

Download

memory/2384-1750-0x00000159948C0000-0x00000159948C1000-memory.dmp

Download

memory/2384-1749-0x00000159948C0000-0x00000159948C1000-memory.dmp

Download

memory/3824-1046-0x00000252D74E0000-0x00000252D84E0000-memory.dmp

Download

memory/4196-280-0x000002694B930000-0x000002694C930000-memory.dmp

Download

memory/6760-1647-0x0000019BB2560000-0x0000019BB26D6000-memory.dmp

Download

memory/6760-1648-0x0000019BB28F0000-0x0000019BB2AFA000-memory.dmp

Download

memory/6916-1589-0x000001F2C05D0000-0x000001F2C0792000-memory.dmp

Download

memory/6916-1578-0x000001F2BFD80000-0x000001F2BFDA2000-memory.dmp

Download

memory/6916-1579-0x000001F2C02B0000-0x000001F2C02F4000-memory.dmp

Download

memory/6916-1580-0x000001F2C0380000-0x000001F2C03F6000-memory.dmp

Download

memory/7364-1762-0x000001EB20AB0000-0x000001EB20AC0000-memory.dmp

Download

memory/7364-1763-0x000001EB20AB0000-0x000001EB20AC0000-memory.dmp

Download

memory/7364-1769-0x000001EB20AB0000-0x000001EB20AC0000-memory.dmp

Download

memory/7416-1764-0x00000275FEF10000-0x00000275FEF20000-memory.dmp

Download

memory/7416-1768-0x00000275FEF10000-0x00000275FEF20000-memory.dmp

Download

memory/7416-1765-0x00000275FEF10000-0x00000275FEF20000-memory.dmp

Download

memory/7500-1778-0x00000179EA420000-0x00000179EA430000-memory.dmp

Download

memory/7500-1771-0x00000179EA420000-0x00000179EA430000-memory.dmp

Download

memory/7500-1772-0x00000179EA420000-0x00000179EA430000-memory.dmp

Download

memory/7524-1777-0x000001E908C20000-0x000001E908C30000-memory.dmp

Download

memory/7524-1773-0x000001E908C20000-0x000001E908C30000-memory.dmp

Download

memory/7524-1774-0x000001E908C20000-0x000001E908C30000-memory.dmp

Download