overlord | hxxps://cdn[.]discordapp[.]com/attachments/1518253681391173642/1531819382593032404/agent-windows-amd64-ccf9a769[.]exe?ex=6a6a9978&is=6a6947f8&hm=00e202124fe8e80f2984e352a7181f705ff89bdd7a3bf493e1b6f4c242ccd16f&

Analysis

user interaction
yes
max time kernel
320s
max time network
320s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
29/07/2026, 00:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://cdn.discordapp.com/attachments/1518253681391173642/1531819382593032404/agent-windows-amd64-ccf9a769.exe?ex=6a6a9978&is=6a6947f8&hm=00e202124fe8e80f2984e352a7181f705ff89bdd7a3bf493e1b6f4c242ccd16f&
Sample260729-aps1yadj51

Score

10^/10

discovery overlord persistence ransomware rat

Malware Config

Extracted

Family

overlord

leasing-editorial-families-automation.trycloudflare.com

Signatures

Family: Overlord
Overlord is an open-source Windows RAT written in Golang.
rat overlord

Downloads MZ/PE file 1 IoCs

flow	pid	Process
29	3776	msedge.exe

Executes dropped EXE 1 IoCs

pid	Process
4160	agent-windows-amd64-ccf9a769.exe

Drops desktop.ini file(s) 7 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Videos\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	wmplayer.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\L:	unregmp2.exe
File opened (read-only)	\??\O:	unregmp2.exe
File opened (read-only)	\??\Y:	unregmp2.exe
File opened (read-only)	\??\H:	wmplayer.exe
File opened (read-only)	\??\P:	wmplayer.exe
File opened (read-only)	\??\D:	unregmp2.exe
File opened (read-only)	\??\M:	unregmp2.exe
File opened (read-only)	\??\Z:	unregmp2.exe
File opened (read-only)	\??\D:	wmplayer.exe
File opened (read-only)	\??\I:	wmplayer.exe
File opened (read-only)	\??\T:	wmplayer.exe
File opened (read-only)	\??\W:	wmplayer.exe
File opened (read-only)	\??\K:	unregmp2.exe
File opened (read-only)	\??\P:	unregmp2.exe
File opened (read-only)	\??\Q:	unregmp2.exe
File opened (read-only)	\??\R:	unregmp2.exe
File opened (read-only)	\??\V:	unregmp2.exe
File opened (read-only)	\??\K:	wmplayer.exe
File opened (read-only)	\??\U:	wmplayer.exe
File opened (read-only)	\??\G:	unregmp2.exe
File opened (read-only)	\??\J:	unregmp2.exe
File opened (read-only)	\??\X:	unregmp2.exe
File opened (read-only)	\??\B:	wmplayer.exe
File opened (read-only)	\??\R:	wmplayer.exe
File opened (read-only)	\??\Z:	wmplayer.exe
File opened (read-only)	\??\A:	unregmp2.exe
File opened (read-only)	\??\B:	unregmp2.exe
File opened (read-only)	\??\T:	unregmp2.exe
File opened (read-only)	\??\J:	wmplayer.exe
File opened (read-only)	\??\M:	wmplayer.exe
File opened (read-only)	\??\V:	wmplayer.exe
File opened (read-only)	\??\X:	wmplayer.exe
File opened (read-only)	\??\I:	unregmp2.exe
File opened (read-only)	\??\S:	unregmp2.exe
File opened (read-only)	\??\U:	unregmp2.exe
File opened (read-only)	\??\N:	wmplayer.exe
File opened (read-only)	\??\Q:	wmplayer.exe
File opened (read-only)	\??\Y:	wmplayer.exe
File opened (read-only)	\??\H:	unregmp2.exe
File opened (read-only)	\??\W:	unregmp2.exe
File opened (read-only)	\??\A:	wmplayer.exe
File opened (read-only)	\??\G:	wmplayer.exe
File opened (read-only)	\??\L:	wmplayer.exe
File opened (read-only)	\??\O:	wmplayer.exe
File opened (read-only)	\??\S:	wmplayer.exe
File opened (read-only)	\??\N:	unregmp2.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll	svchost.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3836	460	WerFault.exe	130

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmplayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	unregmp2.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3776	msedge.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	agent-windows-amd64-ccf9a769.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	agent-windows-amd64-ccf9a769.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134297582369314666"	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-42486406-2033776002-1658862356-1000\{9DFF9A66-EDAD-4E16-BF5C-543DF6701802}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-42486406-2033776002-1658862356-1000\{B47BD591-70C6-470C-81F7-0664DA8402C0}	agent-windows-amd64-ccf9a769.exe
Key created	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000_Classes\Local Settings	taskmgr.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
3088	vlc.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1136	taskmgr.exe
1136	taskmgr.exe
1136	taskmgr.exe
1136	taskmgr.exe
1136	taskmgr.exe
1136	taskmgr.exe
1136	taskmgr.exe
1136	taskmgr.exe
1136	taskmgr.exe
1136	taskmgr.exe
1136	taskmgr.exe
1136	taskmgr.exe
1136	taskmgr.exe
1136	taskmgr.exe
1136	taskmgr.exe
1136	taskmgr.exe
1136	taskmgr.exe
1136	taskmgr.exe
1136	taskmgr.exe
1136	taskmgr.exe
1136	taskmgr.exe
1136	taskmgr.exe
1136	taskmgr.exe
1136	taskmgr.exe
1136	taskmgr.exe
1136	taskmgr.exe
1136	taskmgr.exe
1136	taskmgr.exe
1136	taskmgr.exe
1136	taskmgr.exe
1136	taskmgr.exe
1136	taskmgr.exe
1136	taskmgr.exe
1136	taskmgr.exe
1136	taskmgr.exe
1136	taskmgr.exe
1136	taskmgr.exe
1136	taskmgr.exe
1136	taskmgr.exe
1136	taskmgr.exe
1136	taskmgr.exe
1136	taskmgr.exe
1136	taskmgr.exe
1136	taskmgr.exe
1136	taskmgr.exe
1136	taskmgr.exe
1136	taskmgr.exe
1136	taskmgr.exe
1136	taskmgr.exe
1136	taskmgr.exe
1136	taskmgr.exe
1136	taskmgr.exe
1136	taskmgr.exe
1136	taskmgr.exe
1136	taskmgr.exe
1136	taskmgr.exe
1136	taskmgr.exe
1136	taskmgr.exe
1136	taskmgr.exe
1136	taskmgr.exe
1136	taskmgr.exe
1136	taskmgr.exe
1136	taskmgr.exe
1136	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 3 IoCs

pid	Process
4160	agent-windows-amd64-ccf9a769.exe
3088	vlc.exe
1136	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeDebugPrivilege	1136	taskmgr.exe
Token: SeSystemProfilePrivilege	1136	taskmgr.exe
Token: SeCreateGlobalPrivilege	1136	taskmgr.exe
Token: SeShutdownPrivilege	460	wmplayer.exe
Token: SeCreatePagefilePrivilege	460	wmplayer.exe
Token: SeShutdownPrivilege	4956	unregmp2.exe
Token: SeCreatePagefilePrivilege	4956	unregmp2.exe
Token: SeTcbPrivilege	4208	svchost.exe
Token: SeRestorePrivilege	4208	svchost.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
1136	taskmgr.exe
1136	taskmgr.exe
1136	taskmgr.exe
1136	taskmgr.exe
1136	taskmgr.exe
1136	taskmgr.exe
1136	taskmgr.exe
1136	taskmgr.exe
1136	taskmgr.exe
1136	taskmgr.exe
1136	taskmgr.exe
1136	taskmgr.exe
1136	taskmgr.exe
1136	taskmgr.exe
1136	taskmgr.exe
1136	taskmgr.exe
1136	taskmgr.exe
1136	taskmgr.exe
1136	taskmgr.exe
1136	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
1136	taskmgr.exe
1136	taskmgr.exe
1136	taskmgr.exe
1136	taskmgr.exe
1136	taskmgr.exe
1136	taskmgr.exe
1136	taskmgr.exe
1136	taskmgr.exe
1136	taskmgr.exe
1136	taskmgr.exe
1136	taskmgr.exe
1136	taskmgr.exe
1136	taskmgr.exe
1136	taskmgr.exe
1136	taskmgr.exe
1136	taskmgr.exe
1136	taskmgr.exe
1136	taskmgr.exe
1136	taskmgr.exe
1136	taskmgr.exe
1136	taskmgr.exe
1136	taskmgr.exe
1136	taskmgr.exe
1136	taskmgr.exe
1136	taskmgr.exe
1136	taskmgr.exe
1136	taskmgr.exe
1136	taskmgr.exe
1136	taskmgr.exe
1136	taskmgr.exe
1136	taskmgr.exe
1136	taskmgr.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3088	vlc.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 2344 wrote to memory of 5064	2344	msedge.exe	83
PID 2344 wrote to memory of 3776	2344	msedge.exe	84
PID 2344 wrote to memory of 4524	2344	msedge.exe	85
PID 2344 wrote to memory of 4524	2344	msedge.exe	85
PID 2344 wrote to memory of 4524	2344	msedge.exe	85
PID 2344 wrote to memory of 4104	2344	msedge.exe	86
PID 2344 wrote to memory of 4104	2344	msedge.exe	86
PID 2344 wrote to memory of 3976	2344	msedge.exe	88
PID 2344 wrote to memory of 3976	2344	msedge.exe	88
PID 2344 wrote to memory of 1420	2344	msedge.exe	89
PID 2344 wrote to memory of 3976	2344	msedge.exe	88
PID 2344 wrote to memory of 1420	2344	msedge.exe	89
PID 2344 wrote to memory of 1420	2344	msedge.exe	89
PID 2344 wrote to memory of 2064	2344	msedge.exe	90
PID 2344 wrote to memory of 4556	2344	msedge.exe	91
PID 2344 wrote to memory of 2064	2344	msedge.exe	90
PID 2344 wrote to memory of 2064	2344	msedge.exe	90
PID 2344 wrote to memory of 4556	2344	msedge.exe	91
PID 2344 wrote to memory of 4556	2344	msedge.exe	91
PID 2344 wrote to memory of 1624	2344	msedge.exe	96
PID 2344 wrote to memory of 1624	2344	msedge.exe	96
PID 2344 wrote to memory of 2944	2344	msedge.exe	97
PID 2344 wrote to memory of 2944	2344	msedge.exe	97
PID 2344 wrote to memory of 4780	2344	msedge.exe	98
PID 2344 wrote to memory of 4780	2344	msedge.exe	98
PID 2344 wrote to memory of 1988	2344	msedge.exe	99
PID 2344 wrote to memory of 4780	2344	msedge.exe	98
PID 2344 wrote to memory of 1988	2344	msedge.exe	99
PID 2344 wrote to memory of 3332	2344	msedge.exe	100
PID 2344 wrote to memory of 2864	2344	msedge.exe	102
PID 2344 wrote to memory of 2864	2344	msedge.exe	102
PID 2344 wrote to memory of 1152	2344	msedge.exe	103
PID 2344 wrote to memory of 1196	2344	msedge.exe	118
PID 2344 wrote to memory of 1048	2344	msedge.exe	112
PID 2344 wrote to memory of 3092	2344	msedge.exe	113
PID 2344 wrote to memory of 4588	2344	msedge.exe	120
PID 2344 wrote to memory of 4588	2344	msedge.exe	120
PID 2344 wrote to memory of 1428	2344	msedge.exe	121
PID 2344 wrote to memory of 1428	2344	msedge.exe	121
PID 2344 wrote to memory of 1428	2344	msedge.exe	121
PID 2344 wrote to memory of 1392	2344	msedge.exe	122
PID 2344 wrote to memory of 1392	2344	msedge.exe	122
PID 2344 wrote to memory of 1392	2344	msedge.exe	122
PID 4160 wrote to memory of 3344	4160	agent-windows-amd64-ccf9a769.exe	123
PID 4160 wrote to memory of 3632	4160	agent-windows-amd64-ccf9a769.exe	124
PID 460 wrote to memory of 4872	460	wmplayer.exe	131
PID 4872 wrote to memory of 4956	4872	unregmp2.exe	132
PID 4208 wrote to memory of 2232	4208	svchost.exe	137

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://cdn.discordapp.com/attachments/1518253681391173642/1531819382593032404/agent-windows-amd64-ccf9a769.exe?ex=6a6a9978&is=6a6947f8&hm=00e202124fe8e80f2984e352a7181f705ff89bdd7a3bf493e1b6f4c242ccd16f&
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x270,0x7ffb8bbfc188,0x7ffb8bbfc194,0x7ffb8bbfc1a0
  2⤵
  PID:5064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1972,i,6112788739946980940,10451531750026110771,524288 --field-trial-handle=2272,i,2636363469791283662,6248606926118578543,262144 --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:3776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1712,i,16899484158097867144,17098243685403434464,262144 --field-trial-handle=2272,i,2636363469791283662,6248606926118578543,262144 --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:2
  2⤵
  PID:4524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2620,i,16957014026698589220,3812474987943987792,524288 --field-trial-handle=2272,i,2636363469791283662,6248606926118578543,262144 --variations-seed-version --mojo-platform-channel-handle=2840 /prefetch:8
  2⤵
  PID:4104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3448,i,17745969317591778094,5973929151277210381,2097152 --field-trial-handle=2272,i,2636363469791283662,6248606926118578543,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:3976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3452,i,16506542499471549676,3032646341515616972,2097152 --field-trial-handle=2272,i,2636363469791283662,6248606926118578543,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:1420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4212,i,14047125570707788389,11637859954720326359,2097152 --field-trial-handle=2272,i,2636363469791283662,6248606926118578543,262144 --variations-seed-version --mojo-platform-channel-handle=2600 /prefetch:1
  2⤵
  PID:2064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4224,i,10057434545762378506,6312828434445420860,2097152 --field-trial-handle=2272,i,2636363469791283662,6248606926118578543,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:2
  2⤵
  PID:4556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5200,i,3571214705735156956,5848413887437221216,524288 --field-trial-handle=2272,i,2636363469791283662,6248606926118578543,262144 --variations-seed-version --mojo-platform-channel-handle=5236 /prefetch:8
  2⤵
  PID:1624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5212,i,7689782413420034792,11371570228591755555,524288 --field-trial-handle=2272,i,2636363469791283662,6248606926118578543,262144 --variations-seed-version --mojo-platform-channel-handle=5256 /prefetch:8
  2⤵
  PID:2944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5844,i,6893740811519303472,5739519020615778445,2097152 --field-trial-handle=2272,i,2636363469791283662,6248606926118578543,262144 --variations-seed-version --mojo-platform-channel-handle=5868 /prefetch:1
  2⤵
  PID:4780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5832,i,8823964463912923993,15176421719305823273,524288 --field-trial-handle=2272,i,2636363469791283662,6248606926118578543,262144 --variations-seed-version --mojo-platform-channel-handle=5776 /prefetch:8
  2⤵
  PID:1988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6392,i,8772394942995122592,17226093003789777369,524288 --field-trial-handle=2272,i,2636363469791283662,6248606926118578543,262144 --variations-seed-version --mojo-platform-channel-handle=6388 /prefetch:8
  2⤵
  PID:3332
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6380,i,7832704107065522132,6165747783439276944,524288 --field-trial-handle=2272,i,2636363469791283662,6248606926118578543,262144 --variations-seed-version --mojo-platform-channel-handle=6456 /prefetch:8
  2⤵
  PID:4332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6596,i,11203648032616635196,3672394302857989484,524288 --field-trial-handle=2272,i,2636363469791283662,6248606926118578543,262144 --variations-seed-version --mojo-platform-channel-handle=6616 /prefetch:8
  2⤵
  PID:2864
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6380,i,7832704107065522132,6165747783439276944,524288 --field-trial-handle=2272,i,2636363469791283662,6248606926118578543,262144 --variations-seed-version --mojo-platform-channel-handle=6456 /prefetch:8
  2⤵
  PID:1152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4320,i,6462343291440168967,13982762962830487698,524288 --field-trial-handle=2272,i,2636363469791283662,6248606926118578543,262144 --variations-seed-version --mojo-platform-channel-handle=6380 /prefetch:8
  2⤵
  PID:1196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4264,i,6392281149157658707,11485905126860536055,524288 --field-trial-handle=2272,i,2636363469791283662,6248606926118578543,262144 --variations-seed-version --mojo-platform-channel-handle=4488 /prefetch:8
  2⤵
  PID:1048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4500,i,12070068802637084571,7500832578150891108,524288 --field-trial-handle=2272,i,2636363469791283662,6248606926118578543,262144 --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:8
  2⤵
  PID:3092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6020,i,4369365456066868895,8486295511560831513,524288 --field-trial-handle=2272,i,2636363469791283662,6248606926118578543,262144 --variations-seed-version --mojo-platform-channel-handle=5428 /prefetch:8
  2⤵
  PID:4588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=4348,i,13818094349022203735,4585498035909906822,2097152 --field-trial-handle=2272,i,2636363469791283662,6248606926118578543,262144 --variations-seed-version --mojo-platform-channel-handle=2600 /prefetch:1
  2⤵
  PID:1428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=4368,i,547849524700005191,13820502354448556712,2097152 --field-trial-handle=2272,i,2636363469791283662,6248606926118578543,262144 --variations-seed-version --mojo-platform-channel-handle=5804 /prefetch:1
  2⤵
  PID:1392

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:632

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3324

C:\Users\Admin\Downloads\agent-windows-amd64-ccf9a769.exe
"C:\Users\Admin\Downloads\agent-windows-amd64-ccf9a769.exe"
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:4160
- C:\Windows\system32\conhost.exe
  \\?\C:\Windows\system32\conhost.exe --headless --width 120 --height 36 --signal 0x644 --server 0x640
  2⤵
  PID:3344
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe
  2⤵
  PID:3632

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc
1⤵
PID:1196

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\New Text Document.txt
1⤵
PID:4952

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1136

C:\Program Files (x86)\Windows Media Player\wmplayer.exe
"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Play -Embedding
1⤵
- Drops desktop.ini file(s)
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:460
- C:\Windows\SysWOW64\unregmp2.exe
  "C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4872
- - C:\Windows\system32\unregmp2.exe
    "C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT
    3⤵
    - Enumerates connected drives
    - Suspicious use of AdjustPrivilegeToken
    PID:4956
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 460 -s 3240
  2⤵
  - Program crash
  PID:3836

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s upnphost
1⤵
- Drops file in Windows directory
PID:5012

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4208
- C:\Windows\system32\dashost.exe
  dashost.exe {f059f561-58d0-4fff-83f5bcd93d44651d}
  2⤵
  PID:2232

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\ResolveSync.mpg"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3088

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 460 -ip 460
1⤵
PID:1580

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 bba2e49c11cb10e1da3782e96a0839de38ec558ccceb0d68515b04792179f852
MD5 34d661b06bc0857903247c15b32b3124
SHA1 72b12aeb58848c0b8474acb525b5e3c41cf32367
SHA512 ff623932c1d85ab3c9cf10c993d26b94c5e1d9968c6a6f9a48925137edcf7379ba3bc8d216e7fc052000ec59dab883f4b498f2262f7941a46d3328c62092e788
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7U:fwUQC5VwBIiElEd2K57P7U
TLSH
T1E0B3A931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6a64f2ae6a6617d628aecf24522b5fc03d56fd3b87da29c09e359aa8c784278c
MD5 319f3e9547ae8f5bd93b63a209353feb
SHA1 2cbbe39cbb469d1b008a38a5f66950de62d7be5d
SHA512 2335ad7dd232ded853c12042411a51f4c045d5ae5954aac7df9f840b69e4aee72129d3b0d5a528b94f8c84e50d9f92ecc1fcda50496c846e7b2b716f7e287127
TLSH
T115D080F777586105E75DD131EC13CB111B65195215D7DB02E314C99CA4644F566871C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 65787a63e65b03e7f0c3f181917f7d124153d59176fa8c9c1da9a40869e3e392
MD5 73065ef8024b53d7f6e81674bd8d07d1
SHA1 03d331cf822f86ad7538a945a1c377b6994318ed
SHA512 c73ac7d557117eea9bc5cbe34829bad1fff87f5f87ff34068570e9267abadd5dbe1b1d50d00a3cdcc81d49ab080c2673f2544242b7b09b508700acaf4567947b
TLSH
T12DD023F5B63053D0C12C00384C20091026240A7321EFD78353540C4CD8300D1E1CB9C5
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5c85913b3d3cab7ba2879d18441341b2b4fd7ad9ce12d0c3ebfe421e6267c647
MD5 962c87a3f67f82f2083d6294250d9e58
SHA1 cfe9fd1f6729400cde038cbdead8751b96eacaca
SHA512 059eed3376b6b470a0be74a5db7d47fa3bae4b0557c4216789040d711e15417470e3ff6f96808c2e42bf6080c9af25da282ed4dabe378bd81b0971591713ef3b
TLSH
T11FD080F737586105EB5DD131EC13CB111B65195215D7DB03E314C99C94654F566871C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 ddd823755aa2f0109e2fd935194b92ba2333b79b6bf1b1ac11e622b409c705b1
MD5 8b2ca8a7d5ceb2d1e889071aa18f4ad0
SHA1 113dc512b317df7294aabddf08a08db2e6c8b5bf
SHA512 64a2483dd25395ca8810b5e036f964fe40cccce7c0cca1fb2935fa8985916d9c2da5dc944eea6336e95a3cb751bab0bf1f5d5d52031ee304d5eea3e6e3ab7d4b
TLSH
T14871082C060E48F1EF61CE3E64E1E35C367286B6C74B2E1621DCD8A53111FA2476179D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 cbb9375083e1dffe52152f8d10c0dbf97b02dc2add47787b06e16d42757cf491
MD5 0c8a484dd906ec365b288bf16e684520
SHA1 0a724922a8ab24eaf36226e5eff11550bc4d521d
SHA512 0834303249f041a1b3bc164363941335f91f8e3a010aae7e710c20d23906f7f21bcb211389df094e329a4034b20ad6db3e35fb054589bce14a152ced6af99265
TLSH
T17671282C020E48F1EF21CF3E60E1D31C767282B2C70B2E0621DCD8A43111BA2476179D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe587d0b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe587d0b.TMP
Size 3KB
SHA256 5dfda88043d29e7a7e6427b87fa5a46b8a16f63f963f96b63f26bc6a3a96019b
MD5 9986a2342f961f0e766f7fe3650a05f1
SHA1 5c34cd2dcae1a474d19fcecf354ba1e8ff1fae3d
SHA512 34aba0ee90c85db001aab7df85e7169e3313e97658db3f203b32913ca1c5808856ec70c4adf5ee3f19590af6b14fffcbaf453fc929769420bdea6b21eb7a95f2
TLSH
T1A671282C060E48F1EF21CF3EA4E1D31C367282B6C70B2E1621DCD8A53111BA2476179C
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 ec75e11d2f376ef9cbbaea3df1cc0692bd26779fb01fe8a624439f291c9d9b45
MD5 c50ddb0cf37ad65ef4c45fa71fcc96dc
SHA1 4e88b0d71eba1a30c48b5308bda9c806e75af0fa
SHA512 0b318837241f81d708bf0004c160d0ebae4d1935c544009307a775f116e976d67a62eda62626c2c87cb4e4eac728d70c5424ae20b06016a76414af1e08e26e22
SSDEEP 3:MsEllllkEthXllkl2zE/l8nuyt:/M/xT02zPnuy
TLSH
T1AF4404047FC00407C5001130C4D5C3501370D4144717575334530473DCD77501C05000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 e9709705d986c9eb53bc6933de99c1d08427c3a2a8b70bc3d9e32e13ffbf2be1
MD5 de31d20970db130b593126836a1b6022
SHA1 2bf8969727db8e7c8105dcb4e7d4c26c51861d72
SHA512 f3dec853215bf23fe57b6ee25c6e8140228e3a94a819cc83387cfbb82c916d15cd1b5ead3b51b42c28c966f86cd907d776f93be4f8417de9f68c9d952f496d8a
TLSH
T17921AAF7C3D5866EC91516F06A246E2BCE2D051583287D1AC9D4EFABD7E3072E10194F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 8a7327e65b034076e9cde7657c6e983ba6878457635dc6ed754c0da68e821fb0
MD5 8436e188e35f004e6ecda05d7ad75f0e
SHA1 2e2fcc84f7d9a212032a91689a1878cc81935dac
SHA512 c28cc11ef8fe3bccd81403b8bb370648709fae3595e389c29ece1624050e9c82a51dfd386f43a3f45e13e695307a811027bc79adbd1f44bae1b0373a3630c7a4
TLSH
T1D141BAF7C7E5865EC91116F06A146E1BCE2C091643287D1AC5D4EF5BD7E30A2E141A8B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 3f79645e5f4cb793ac0f207ab531aef46fdac9b15634660775d388221be5731a
MD5 23ad08ba1f1123192c3e97aabab9b891
SHA1 27c0e636848639879b9017eff4ebcf02e079ff45
SHA512 3eab177e9425d443f3a5b1a35f490d9ff0e819f101a4db9662a29db4fd0c4e45bcc397eb63cfef8eeaa5619058dae6468ad8ccf09f87ec174acfcf0c54351231
SSDEEP 192:sxZ27R01yM/jK1Ml8M9G/ftYsd3OIdpJHW6+WNGYwwb47ZIgrJ:sxZcaP1G/fisd3fJHbGD9
TLSH
T1B042D8156B385977CCCBD209FA557F53D5F50462E2940D44A9FCCA0C04E6AED231782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 a1d986d50fc6c540681181fe6bf4bb6dc7ecb88e1d0bc9e1d4f325a22959a9cc
MD5 08f77c0fac09f8294c780ff848d97266
SHA1 45f675ec544b79ea7247a3028fbde9ed38c6b5df
SHA512 456d1ab5f8a02ca1be79b8f2af55d468b2e9db9b73fe8d747415edf1b6cb6529357a089f18f2f2a4715c4b50a3955d0ccf04f76ac805c8e58976f2a9d7cbff41
SSDEEP 192:sxZ27R01yM/jK1Ml8e9G/ftYs9xWpVMnV1IdpiZHW6+WN7QzH4/YIw32rfIgbAJ:sxZcaJlG/fisHWvMVGeHbk4/3Q
TLSH
T12062D816AA3859B7CCDBD209FA557F63D6F50462D2901E4499FCCA0C01E6BED231781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 ac4ff91138efa0a8996415145c09c36fecbe3d2da538e78847e888035fb7c510
MD5 6fcda3e8cbbb07dd9cf7687ab51da455
SHA1 95116eaca789486bc871dcf82ca98cf9f6bcb0a2
SHA512 2bd0f268e4748318c5a7987ec520bdf7b4dd3840dbc04aa7bff6aee9ada33ad05f915869fb35b532a290932ccdcd4b0ff43c40c211a7ab30f3c59c64b2251fb4
SSDEEP 192:sxZ27R01yM/jK1Ml8M9G/ftYs9jnV1IdpiZHW6+WNHzH4/YwwNfEZIg5AJ:sxZcaJ1G/fis9VGeHbD4/rW
TLSH
T18D52D816BA385A77CCDBD209F9517F53D6F50462E2540E44AAFCCA0C05E6AED231782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 252515ab2864e4bfcc9604dcfafa21a2669936decf962d51f595ce5a60fe7b99
MD5 cca28835491a4c24089c5718a583f6c2
SHA1 8f4c3b3261bad3a153837f8dcfb6d5c3e0377f35
SHA512 b0aad0b5deb0e87eb84b5cbc344e5a2357eeebbbf8e28568d89e944349f42f2614ed0f6f52044ac213527ed2547be5b1288e46869d9b549d0575706144fb9215
SSDEEP 768:BK4TaXWWvyaZy8F1+UoAYDCx9Tuqh0VfUC9xbog/OVvhLlJX656roKyiTCAa:BK4TaXWWvyaZyu1jaihLHq5xvAa
TLSH
T1D4D20B3B684CC77E4F840E5DEC2A6F976ED801CBA7984D5447FA484C02C77EA512A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 7KB
SHA256 769dfbd179fb5e625e37e32432ec47d039fcbdcd8ebda7561f1903d525d6a3a5
MD5 aa6d9a5984100d5983f0e6c086fb7472
SHA1 2bb4b4d7ff9a17272b642730afea30b8cf8db82e
SHA512 bbb9d9e1a695e7aa90d163a110ddb8d511dee0c5d907e718f8b4a1f5e281e0121c027eb5435fdc89e4afea8068fd8918e860d6c1eb67f1ea401f8e81b078a5a0
SSDEEP 96:KsOeOROAOkOeOQOwOx7OEOrOsJOsOxKhO4JO+OxtOGOOOzOsOwOSGhyKKMaCA+Kx:mJIrXJ7bc36rvF4Qpih5yvbSpFKJHF8
TLSH
T14FE11412327A128339BE280CA7B7873B4E4231733058E66F7BA850655E66E525DFC9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

caf30e08-20a2-4e36-a97c-967b5c85a1a8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\caf30e08-20a2-4e36-a97c-967b5c85a1a8.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 a048d997a3608cb7c880d110e71c696425377da9bad6b5e7d536967188845f9d
MD5 fca72c6781ba14ba14d5ac6724633a1d
SHA1 4bd72f60d54f6cc592bb5bfa7d7f4edf2792d8cf
SHA512 6cc501df145ec794b4a1171c3724186da6fb1c8609f87f5079ad743e8749e533c53ee313e538105019879ab95ca8b798b39fc7382cb6089993ca20c6009f2109
SSDEEP 384:mZcIUsNquk8VpJA9bAdUiX1aTv4Scjmw0:0Uvk4SB241jY
TLSH
T135928E76A8B8AC7659E7A045F4873B138FB45073DBD85F84D9EDAB0D01D91B8030B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 c59fdf3ff032675fdf1d6777e3661f12812e6bbe117675360477ab85a5369178
MD5 8660a049c067c173794499292ac3f094
SHA1 988de98254e39a9d66d6c5e8a68a61c8b81a1183
SHA512 961764cbe75647726de4f18a40732500c2749d602de9686f67f5cef7993f4ee4c1ecd345cd71b088ed64e8b79c1825221824571aa98f19d88f127bcc4f561835
SSDEEP 384:WiFrZcI0esNt+8TUNTUlIlATVpJAQ7dUiX1aTaGvEX79mkgGScjmw0:9Fzhi+wgs4CBD5X79oG1jY
TLSH
T134D25C7E9C649C3F48EEB708B58E2A238DB45077C6B89698E7D85B0DC17649CF306D24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 8831646dc54b371b678e7b811deec2b0ecfffe335baef2e4ad448aed821b3192
MD5 5b798a33197a88c02c2b34eb17ab810e
SHA1 e264618d4ce63ed2fc2622b4cc2336e4cfd6a2a0
SHA512 f76f1e94b5c2f7f35f8362f2f9d73e016d4569ee31e8953a6082ddaa4f916696dc609a6ab207a42ed29fe595e70be19165fe248ba847f4025e77a65dcf240d53
SSDEEP 384:0ZcIUsNquATVpJA9bAdUiX1aTv4Scjmw0:yUvz4SB241jY
TLSH
T13E928E76ACB8AC7759E7A045F4873A139FB45073DBC85F80D9EDAB0D01D91A8030B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 87c5e90388f3a45eff53572666a46d494915bf1c0ee850336f75a4aab0c5da1c
MD5 77b6c5ebecb06473dfda3bde43e13dc1
SHA1 31666325cb74a4cfc062ec3e0c2d872b180669d1
SHA512 ad60c1735d6032a3708fe83f26b74700474e1e81417ce4b989141eb91d45d56a462a1af30fc92dc2a5978c09498718ae3426991542c8a7c18339e5436365b606
SSDEEP 384:WiFPZcI0esNq+8TUNTUlIlATVpJAQpdUiX1aTF4Scjmw0:9FHhv+wgs4aBi41jY
TLSH
T128B26D77ACA8D87BADE79545F84A3613CEB450B3CAD4AB90D6DC9F0C01DA1AC030BD25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 6378807c536ce51f1a3af00696dd2d74c5504b01ea71a9cc2c4ff4b19ce09815
MD5 c44eda8e0ad905cfde62e4323f546d39
SHA1 8e830379afcbfa07700a2ba2a4927e5da225c5d2
SHA512 a0f0697b48f41d73379c6d1be78e15ab2c9e95cdcd61bb552bafabe702f210f4904fc4f25e4f7e2ea19183e1245f57ea2d64286433dd6aa526fcf034685851c2
SSDEEP 384:FZcIUsNquA8VpJA9bAdUiX1aTv4Scjmw0:9UvE4SB241jY
TLSH
T126928E76ACB8AC7659E7A045F4873B138FB45473DBC85F84D9EDAB0D02D91A8030B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 0e65ed5055944d0942047cdbcf2461b597b804eb6185c836841112b3b8204524
MD5 5e31947f5078f7d4272e324b6fb450cf
SHA1 9365772f742c3a7488f700261b63cd1b20a7ac42
SHA512 22a4de18f4769fd87b5966d247411d3c078c2c6655321b2be9e96809c162a2d18bd3d3d54ef5ca3d29328f22c21dbf93cf18197c8e7318687edda182d06c7478
SSDEEP 192:mQJONG6zZU77QmiUyjKzmaU9X1J3wEM55U6:m2ONG6t2t9zmaU9X1zOU6
TLSH
T117020939B8696C7B8DE3AE45B48B3B135FD5103BEA952F94CAE81B0C01D725C1307936
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 4cceb57160d7b03bc30503b69396700e8cf8cfef7a0d89eafd611c35d7c08c04
MD5 7a52355320bc7fc0c80cf22b12d13cc7
SHA1 fc17c2440a68f4797c54eca1c7033544b89cd543
SHA512 2bd1958523b1a97bae191b368b0b50c9297d6d6185a509dc622e2defbc5ee7b58ec0e498b81e2aa337604926f5caf03b2eeb72e601a5f3e84baf2ee1af5ba469
SSDEEP 192:fONm76zZU27QmiUyrKz/U9X1JIeEos/SqIU6:fONm76tDtRz/U9X1aTD4U6
TLSH
T116121B3AB4A8AC7B4DD3A451F48737139FA55127DF8C6F90DADC2B1C02DF168530A926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

CurrentDatabase_400.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
Size 64KB
SHA256 f1a4a978ce1c4731df1594043135cf58d084fdf129dd1c8e4507c9e06eac5ea8
MD5 987a07b978cfe12e4ce45e513ef86619
SHA1 22eec9a9b2e83ad33bedc59e3205f86590b7d40c
SHA512 39b86540e4d35c84609ef66537b5aa02058e3d4293f902127c7d4eac8ffc65920cb5c69a77552fc085687eed66e38367f83c177046d0ecb8e6d135463cc142aa
SSDEEP 3:Akallkltlsl7pl+e/lls4XplsMlOI1Xlldl0lcNklltlwzl4hR/mll:AN+1E3+e9XplskOI10cAe
TLSH
T1FD539204E3609562C8048377A4EA0B47B331F0690A1AEB1B602A64381C422DA2CA0180
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CurrentDatabase_400.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
Size 1024KB
SHA256 62b2630a4fb937ec4379dad1cd2e94ef71d247d7dbec26b749ee10bfd9a77207
MD5 9eea16a5ff20f81456aeab5d9f489508
SHA1 a2aa85e6a2428ee1931856a22249e17dcbe4bf1b
SHA512 e355b5a1fffc2671e6a932d5338bde02b112964dbf107cffdfc9f04df96cd833e913b13559f1e5b76cae6cb07795d2b09f1e7325ab4c7fe92aa733d645df4849
SSDEEP 768:90aleDxcg7KGVp3zT13VuI61HOdrrA9abhr8fEwPRzitFrzAqUmNKX08oJImdbaM:rZP2tFP3vqY8QqEMX8TaBacg
TLSH
T198257437D190B0C5CE2CB171E9ED8F09BA23A10B11A052465FF8A57E7A533D99D0B1FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LocalMLS_3.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\LocalMLS_3.wmdb
Size 68KB
SHA256 ce2768e921336e3d88b9798b096a94cbf4670e4fd9b6e4c96fbb363a9131c362
MD5 21fb5dd483f14c9fa1bfdf69938af742
SHA1 5d340197f7b454e6b0a61a639bc2fafe8bfa181d
SHA512 1ab3e3e0a30a50cff0277513fe2d168510ad3131bf722b1022d81e2414b7549b8137e26e168e3ceddf5998e88ecb66e83122930f499da558fec180ee91e37375
SSDEEP 96:L0QwOzvI33S38O1eltTRNXtuUMUstM7XtlUMbstCUMlstXOXtEL2t1LXt/tGAtmt:L0QwcvI33S38O1tnan3nS
TLSH
T14163B39522E55A49F3FB6E747AF655231F3AB8E25EB6D14D0214424D0CA2F2CD930F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 bc95a0d2a4fbddeb50b9622bdd2f88b82965910aa5569f90bf359c79e5a66b4d
MD5 3ab49d3e7cbb1fb4c08c8b057029ac28
SHA1 e3bc0a88d4f864f12593f45649383ccdc4d00f67
SHA512 68986c91e2791db9e8c1c48453d5a922662d670744fe9524b0d1760de51972dff8a2fde099411278ccd764a33ba534bdf50a1d0443cf17dcdf14fd15ba08796e
TLSH
T1B241075DAAEA1108B3777F56ABF7A86D847A78732E06D45D10010E4F0622A40D9B1B33
MD5 SHA1 SHA512 TLSH

Submit Download

WMSDKNS.DTD

Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.DTD
Size 498B
SHA256 644fbcdc20086e16d57f31c5bad98be68d02b1c061938d2f5f91cbe88c871fbf
MD5 90be2701c8112bebc6bd58a7de19846e
SHA1 a95be407036982392e2e684fb9ff6602ecad6f1e
SHA512 d618b473b68b48d746c912ac5fc06c73b047bd35a44a6efc7a859fe1162d68015cf69da41a5db504dcbc4928e360c095b32a3b7792fcc6a38072e1ebd12e7cbe
TLSH
T15BF027AD4BE26C59323110903E78A0B0DD05F0B3645B3A6970CE5C7679E7D9C0407FD1
MD5 SHA1 SHA512 TLSH

Submit Download

WMSDKNS.XML.bak

Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML.bak
Size 9KB
SHA256 cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
MD5 7050d5ae8acfbe560fa11073fef8185d
SHA1 5bc38e77ff06785fe0aec5a345c4ccd15752560e
SHA512 a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b
SSDEEP 96:/YkZRAF6zyHUhm77yB1pZYCEnfHrHH7B6xTGH+YCLV3zwULJEYCJWyHBt3zwFRh+:/2FV0bBPCfUdY
TLSH
T10022A2A194818DD206290E275DB95C0DDA8CE9D3832C24997C9EEB7FDFB1C00355FB6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmsetup.log

Path C:\Users\Admin\AppData\Local\Temp\wmsetup.log
Size 1KB
SHA256 57e4bdbf8d257617d77de9d5a934c5b4970c5ac6a11d2260194b1db0de8b677e
MD5 218aa0d7a8b616b3a7bff983815c1927
SHA1 665b66743a3cd7a6f1c786c50ea1c29d46187a8c
SHA512 431958c8740ad0b618bd933d0a6acc05ca2cc264c12f2fdd1b8b56bc3efa33c1d9e25120ed20a59eb929face9bd39abc9ba51da99aa979fe2e2b8b5d31936484
TLSH
T133213E570A8E98B1C9A103F71DDCCE2573B7C7CE9760D496B28D903D480116D6B3E56D
MD5 SHA1 SHA512 TLSH

Submit Download

74d7f43c1561fc1e.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\74d7f43c1561fc1e.customDestinations-ms
Size 1KB
SHA256 4e2bbf3da79a3b98853745ba9dd0174efd0297aa137cc560ad6638a9ce34253c
MD5 c48a486092dde964a208e31a8832b588
SHA1 1fdc53c7eb317376409b5628fbd953f7ac887b47
SHA512 f414ced7f0734de1eeeab53c38bc4d9a48e956b0ac81d4701deec034cc61f37689d1261333cff699740f27654f62121727f04f078009282819130fd1e94f45c0
TLSH
T16F31EF0013C5154AE8A35537BD3B6B057B35BC029B1E968F418C52490CB2100BD6FB6B
MD5 SHA1 SHA512 TLSH

Submit Download

74d7f43c1561fc1e.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\74d7f43c1561fc1e.customDestinations-ms
Size 3KB
SHA256 7d0b68c56a6f02df15d6bedd9028459f34d7c13999afab87aa106df3314e5ddd
MD5 81b9f7dae1a5d823ce6962dfc546c496
SHA1 5dd7ce37e03a51adbd4ef3bee012e3980df99aec
SHA512 81d2f1b44307c6913c6d270f68088210e0a2d9cc5fdc52e0a7b5935ace385ba8504abcce7227a904849cf28203a0e99a5a911662cdf330f96bc534936073bb50
TLSH
T16271AF0013D5154AE8A25937B97B6B05BB367C029B1A969F818D528A1CB2100BD7F76B
MD5 SHA1 SHA512 TLSH

Submit Download

agent-windows-amd64-ccf9a769.exe.crdownload

Path C:\Users\Admin\Downloads\agent-windows-amd64-ccf9a769.exe.crdownload
Size 11.8MB
SHA256 1d5b35adeb1ab7cba49578101896ab686d084a50f5cab83ec34d963a80fcbdc1
MD5 d12a6035552c836b2e687b0ec306bcfb
SHA1 6c9180460d0ebeab6986c33ddda2ec57b59de24d
SHA512 918d95ebe9cac9ec712b86a5217f0ae7d3bbb3839d087305d71eb7f45f91479fba211365465ba9223833e33bd15037ff4efc7be0b2a1cec74d699847804f6460
SSDEEP 98304:aZiFdOQQXr26aRzcoTosirv1D5uLB9h7EREE:+CgQCQVg1D54n2R9
TLSH
T13BC64907E9A949E8C1ADC530C576A223BB717C894B3127D72B50B6787F76BD0ADB9300
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/460-490-0x0000000007E70000-0x0000000007E80000-memory.dmp

Download

memory/460-511-0x0000000007EB0000-0x0000000007EC0000-memory.dmp

Download

memory/460-546-0x0000000007EB0000-0x0000000007EC0000-memory.dmp

Download

memory/460-544-0x0000000007E70000-0x0000000007E80000-memory.dmp

Download

memory/460-545-0x00000000086E0000-0x00000000086F0000-memory.dmp

Download

memory/460-542-0x0000000007EB0000-0x0000000007EC0000-memory.dmp

Download

memory/460-543-0x0000000007E70000-0x0000000007E80000-memory.dmp

Download

memory/460-484-0x00000000086E0000-0x00000000086F0000-memory.dmp

Download

memory/460-485-0x00000000086E0000-0x00000000086F0000-memory.dmp

Download

memory/460-486-0x0000000007E70000-0x0000000007E80000-memory.dmp

Download

memory/460-487-0x0000000007E70000-0x0000000007E80000-memory.dmp

Download

memory/460-540-0x0000000007E70000-0x0000000007E80000-memory.dmp

Download

memory/460-541-0x0000000007EB0000-0x0000000007EC0000-memory.dmp

Download

memory/460-491-0x0000000007E70000-0x0000000007E80000-memory.dmp

Download

memory/460-492-0x0000000007EB0000-0x0000000007EC0000-memory.dmp

Download

memory/460-489-0x0000000007E70000-0x0000000007E80000-memory.dmp

Download

memory/460-494-0x0000000007EB0000-0x0000000007EC0000-memory.dmp

Download

memory/460-493-0x0000000007EB0000-0x0000000007EC0000-memory.dmp

Download

memory/460-496-0x0000000007EB0000-0x0000000007EC0000-memory.dmp

Download

memory/460-497-0x0000000007EB0000-0x0000000007EC0000-memory.dmp

Download

memory/460-495-0x0000000007EB0000-0x0000000007EC0000-memory.dmp

Download

memory/460-498-0x0000000007EB0000-0x0000000007EC0000-memory.dmp

Download

memory/460-499-0x0000000007EB0000-0x0000000007EC0000-memory.dmp

Download

memory/460-503-0x0000000007EB0000-0x0000000007EC0000-memory.dmp

Download

memory/460-502-0x0000000007EB0000-0x0000000007EC0000-memory.dmp

Download

memory/460-501-0x0000000007EB0000-0x0000000007EC0000-memory.dmp

Download

memory/460-500-0x0000000007EB0000-0x0000000007EC0000-memory.dmp

Download

memory/460-504-0x0000000007EB0000-0x0000000007EC0000-memory.dmp

Download

memory/460-505-0x0000000007EB0000-0x0000000007EC0000-memory.dmp

Download

memory/460-507-0x0000000007EB0000-0x0000000007EC0000-memory.dmp

Download

memory/460-508-0x0000000007E70000-0x0000000007E80000-memory.dmp

Download

memory/460-538-0x0000000007EB0000-0x0000000007EC0000-memory.dmp

Download

memory/460-510-0x0000000007E70000-0x0000000007E80000-memory.dmp

Download

memory/460-509-0x0000000007E70000-0x0000000007E80000-memory.dmp

Download

memory/460-513-0x00000000086E0000-0x00000000086F0000-memory.dmp

Download

memory/460-537-0x0000000007EB0000-0x0000000007EC0000-memory.dmp

Download

memory/460-516-0x0000000007EB0000-0x0000000007EC0000-memory.dmp

Download

memory/460-519-0x0000000007EB0000-0x0000000007EC0000-memory.dmp

Download

memory/460-520-0x0000000007E70000-0x0000000007E80000-memory.dmp

Download

memory/460-522-0x0000000007E70000-0x0000000007E80000-memory.dmp

Download

memory/460-524-0x0000000007E70000-0x0000000007E80000-memory.dmp

Download

memory/460-523-0x0000000007E70000-0x0000000007E80000-memory.dmp

Download

memory/460-526-0x0000000007E70000-0x0000000007E80000-memory.dmp

Download

memory/460-529-0x0000000007EB0000-0x0000000007EC0000-memory.dmp

Download

memory/460-528-0x0000000007EB0000-0x0000000007EC0000-memory.dmp

Download

memory/460-527-0x0000000007EB0000-0x0000000007EC0000-memory.dmp

Download

memory/460-525-0x0000000007EB0000-0x0000000007EC0000-memory.dmp

Download

memory/460-530-0x0000000007EB0000-0x0000000007EC0000-memory.dmp

Download

memory/460-531-0x0000000007EB0000-0x0000000007EC0000-memory.dmp

Download

memory/460-535-0x0000000007EB0000-0x0000000007EC0000-memory.dmp

Download

memory/460-534-0x0000000007EB0000-0x0000000007EC0000-memory.dmp

Download

memory/460-533-0x0000000007EB0000-0x0000000007EC0000-memory.dmp

Download

memory/460-532-0x0000000007EB0000-0x0000000007EC0000-memory.dmp

Download

memory/1136-436-0x000001F4D1040000-0x000001F4D1041000-memory.dmp

Download

memory/1136-443-0x000001F4D1040000-0x000001F4D1041000-memory.dmp

Download

memory/1136-437-0x000001F4D1040000-0x000001F4D1041000-memory.dmp

Download

memory/1136-448-0x000001F4D1040000-0x000001F4D1041000-memory.dmp

Download

memory/1136-447-0x000001F4D1040000-0x000001F4D1041000-memory.dmp

Download

memory/1136-446-0x000001F4D1040000-0x000001F4D1041000-memory.dmp

Download

memory/1136-445-0x000001F4D1040000-0x000001F4D1041000-memory.dmp

Download

memory/1136-444-0x000001F4D1040000-0x000001F4D1041000-memory.dmp

Download

memory/1136-442-0x000001F4D1040000-0x000001F4D1041000-memory.dmp

Download

memory/1136-438-0x000001F4D1040000-0x000001F4D1041000-memory.dmp

Download

memory/4160-296-0x0000014AD9B80000-0x0000014ADA2A6000-memory.dmp

Download