hxxps://gofile[.]io/d/3yZXgY

Analysis

user interaction
yes
max time kernel
498s
max time network
602s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-ja
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-jalocale:ja-jpos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 05:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://gofile.io/d/3yZXgY
Sample260730-ftrlkacb82

Score

8^/10

defense_evasion discovery execution persistence ransomware

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
57	1412	msedge.exe

Sets service image path in registry 3 TTPs 1 IoCs

This determines the executable launched when a service starts. It can be used to establish persistence.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\JWRexCXwjvIdLoYHOHmJU\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\JWRexCXwjvIdLoYHOHmJU"	WoWx64.exe

Executes dropped EXE 6 IoCs

pid	Process
4656	Loader.exe
5532	Loader.exe
4352	svc_240915546.exe
6432	WoWx64.exe
5812	Loader.exe
4928	svc_241154812.exe

Loads dropped DLL 1 IoCs

pid	Process
6924	wompwomp.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Contacts third-party web service commonly abused for C2 1 TTPs 5 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
123	api.gofile.io
21	api.gofile.io
22	api.gofile.io
24	api.gofile.io
29	api.gofile.io

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Drops file in System32 directory 18 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\wbem\repository\MAPPING2.MAP	svchost.exe
File opened for modification	C:\Windows\system32\wbem\repository\OBJECTS.DATA	svchost.exe
File opened for modification	C:\Windows\system32\LogFiles\WMI\FaceTelManually.etl	svchost.exe
File opened for modification	C:\Windows\system32\wbem\repository\WRITABLE.TST	svchost.exe
File opened for modification	C:\Windows\system32\wbem\repository\MAPPING3.MAP	svchost.exe
File opened for modification	C:\Windows\system32\wbem\repository\MAPPING3.MAP	svchost.exe
File opened for modification	C:\Windows\system32\wbem\repository\INDEX.BTR	svchost.exe
File opened for modification	C:\Windows\system32\wbem\repository\MAPPING2.MAP	svchost.exe
File opened for modification	C:\Windows\system32\wbem\repository\INDEX.BTR	svchost.exe
File opened for modification	C:\Windows\system32\wbem\repository	svchost.exe
File opened for modification	C:\Windows\system32\wbem\repository\MAPPING1.MAP	svchost.exe
File opened for modification	C:\WINDOWS\SYSTEM32\WINBIODATABASE\51F39552-1075-4199-B513-0C10EA185DB0.DAT	svchost.exe
File created	C:\Windows\System32\Tasks\WoWx64.sys	svc_240915546.exe
File opened for modification	C:\Windows\system32\wbem\repository	svchost.exe
File opened for modification	C:\Windows\system32\wbem\repository\MAPPING1.MAP	svchost.exe
File opened for modification	C:\Windows\system32\wbem\repository\OBJECTS.DATA	svchost.exe
File created	C:\Windows\System32\Tasks\WoWx64.exe	svc_240915546.exe
File opened for modification	C:\Windows\system32\wbem\repository\WRITABLE.TST	svchost.exe

Launches sc.exe 4 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
7092	sc.exe
1644	sc.exe
6292	sc.exe
6840	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5204	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 19 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
7080	cmd.exe
7104	cmd.exe
4976	cmd.exe
1556	cmd.exe
5312	cmd.exe
1932	cmd.exe
4456	cmd.exe
4800	cmd.exe
6420	cmd.exe
6804	cmd.exe
7152	cmd.exe
4112	cmd.exe
6280	cmd.exe
6612	cmd.exe
7128	cmd.exe
1728	cmd.exe
3444	cmd.exe
6192	cmd.exe
6500	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UD.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1412	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe

Delays execution with timeout.exe 2 IoCs

defense_evasion

pid	Process
1160	timeout.exe
2188	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134298618353881547"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe

Modifies registry class 50 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\3 = 14001f481cffcda87848be43b5fdf8091c1c60d00000	UD.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6	UD.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	UD.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	UD.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	UD.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 03000000020000000100000000000000ffffffff	UD.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\3\MRUListEx = ffffffff	UD.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	UD.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{f86fa3ab-70d2-4fc7-9c99-fcbf05467f3a}\Instance\	UD.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616257"	UD.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0"	UD.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1875162379-3804078649-638427191-1000\{8C004BBF-E1FD-412F-90A6-3DBF2FBC0B97}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	UD.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{24ad3ad4-a569-4530-98e1-ab02f9417aa8}\Instance\	UD.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}	UD.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4"	UD.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 020000000100000000000000ffffffff	UD.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell	UD.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	UD.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	UD.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202	UD.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\3\NodeSlot = "6"	UD.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\SniffedFolderType = "Documents"	UD.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3dfdf296-dbec-4fb4-81d1-6a3438bcf4de}\Instance\	UD.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{d3162b92-9365-467a-956b-92703aca08af}\Instance\	UD.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg	UD.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16"	UD.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings	UD.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	UD.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	UD.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	UD.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	UD.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202020202	UD.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	UD.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1"	UD.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1"	UD.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	UD.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\3	UD.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	UD.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0"	UD.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1"	UD.exe

Runs net.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
6924	wompwomp.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4908	msedge.exe
4908	msedge.exe
4352	svc_240915546.exe
4352	svc_240915546.exe
4352	svc_240915546.exe
4352	svc_240915546.exe
4352	svc_240915546.exe
4352	svc_240915546.exe
4352	svc_240915546.exe
4352	svc_240915546.exe
4352	svc_240915546.exe
4352	svc_240915546.exe
4352	svc_240915546.exe
4352	svc_240915546.exe
4352	svc_240915546.exe
4352	svc_240915546.exe
4352	svc_240915546.exe
4352	svc_240915546.exe
4352	svc_240915546.exe
4352	svc_240915546.exe
4352	svc_240915546.exe
4352	svc_240915546.exe
4352	svc_240915546.exe
4352	svc_240915546.exe
4352	svc_240915546.exe
4352	svc_240915546.exe
4352	svc_240915546.exe
4352	svc_240915546.exe
4352	svc_240915546.exe
4352	svc_240915546.exe
4352	svc_240915546.exe
4352	svc_240915546.exe
4352	svc_240915546.exe
4352	svc_240915546.exe
4352	svc_240915546.exe
4352	svc_240915546.exe
4352	svc_240915546.exe
4352	svc_240915546.exe
4352	svc_240915546.exe
4352	svc_240915546.exe
4352	svc_240915546.exe
4352	svc_240915546.exe
4352	svc_240915546.exe
4352	svc_240915546.exe
4352	svc_240915546.exe
4352	svc_240915546.exe
4352	svc_240915546.exe
4352	svc_240915546.exe
4352	svc_240915546.exe
4352	svc_240915546.exe
4352	svc_240915546.exe
4352	svc_240915546.exe
4352	svc_240915546.exe
4352	svc_240915546.exe
4352	svc_240915546.exe
4352	svc_240915546.exe
4352	svc_240915546.exe
4352	svc_240915546.exe
4352	svc_240915546.exe
4352	svc_240915546.exe
4352	svc_240915546.exe
4352	svc_240915546.exe
4352	svc_240915546.exe
4352	svc_240915546.exe

Suspicious behavior: GetForegroundWindowSpam 4 IoCs

pid	Process
4352	svc_240915546.exe
4020	UD.exe
6924	wompwomp.exe
4928	svc_241154812.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
6432	WoWx64.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4756	svchost.exe
Token: SeDebugPrivilege	6432	WoWx64.exe
Token: SeLoadDriverPrivilege	6432	WoWx64.exe
Token: SeAssignPrimaryTokenPrivilege	6656	svchost.exe
Token: SeIncreaseQuotaPrivilege	6656	svchost.exe
Token: SeSecurityPrivilege	6656	svchost.exe
Token: SeTakeOwnershipPrivilege	6656	svchost.exe
Token: SeLoadDriverPrivilege	6656	svchost.exe
Token: SeSystemtimePrivilege	6656	svchost.exe
Token: SeBackupPrivilege	6656	svchost.exe
Token: SeRestorePrivilege	6656	svchost.exe
Token: SeShutdownPrivilege	6656	svchost.exe
Token: SeSystemEnvironmentPrivilege	6656	svchost.exe
Token: SeUndockPrivilege	6656	svchost.exe
Token: SeManageVolumePrivilege	6656	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	6656	svchost.exe
Token: SeIncreaseQuotaPrivilege	6656	svchost.exe
Token: SeSecurityPrivilege	6656	svchost.exe
Token: SeTakeOwnershipPrivilege	6656	svchost.exe
Token: SeLoadDriverPrivilege	6656	svchost.exe
Token: SeSystemtimePrivilege	6656	svchost.exe
Token: SeBackupPrivilege	6656	svchost.exe
Token: SeRestorePrivilege	6656	svchost.exe
Token: SeShutdownPrivilege	6656	svchost.exe
Token: SeSystemEnvironmentPrivilege	6656	svchost.exe
Token: SeUndockPrivilege	6656	svchost.exe
Token: SeManageVolumePrivilege	6656	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	6656	svchost.exe
Token: SeIncreaseQuotaPrivilege	6656	svchost.exe
Token: SeSecurityPrivilege	6656	svchost.exe
Token: SeTakeOwnershipPrivilege	6656	svchost.exe
Token: SeLoadDriverPrivilege	6656	svchost.exe
Token: SeSystemtimePrivilege	6656	svchost.exe
Token: SeBackupPrivilege	6656	svchost.exe
Token: SeRestorePrivilege	6656	svchost.exe
Token: SeShutdownPrivilege	6656	svchost.exe
Token: SeSystemEnvironmentPrivilege	6656	svchost.exe
Token: SeUndockPrivilege	6656	svchost.exe
Token: SeManageVolumePrivilege	6656	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	6656	svchost.exe
Token: SeIncreaseQuotaPrivilege	6656	svchost.exe
Token: SeSecurityPrivilege	6656	svchost.exe
Token: SeTakeOwnershipPrivilege	6656	svchost.exe
Token: SeLoadDriverPrivilege	6656	svchost.exe
Token: SeSystemtimePrivilege	6656	svchost.exe
Token: SeBackupPrivilege	6656	svchost.exe
Token: SeRestorePrivilege	6656	svchost.exe
Token: SeShutdownPrivilege	6656	svchost.exe
Token: SeSystemEnvironmentPrivilege	6656	svchost.exe
Token: SeUndockPrivilege	6656	svchost.exe
Token: SeManageVolumePrivilege	6656	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	6656	svchost.exe
Token: SeIncreaseQuotaPrivilege	6656	svchost.exe
Token: SeSecurityPrivilege	6656	svchost.exe
Token: SeTakeOwnershipPrivilege	6656	svchost.exe
Token: SeLoadDriverPrivilege	6656	svchost.exe
Token: SeSystemtimePrivilege	6656	svchost.exe
Token: SeBackupPrivilege	6656	svchost.exe
Token: SeRestorePrivilege	6656	svchost.exe
Token: SeShutdownPrivilege	6656	svchost.exe
Token: SeSystemEnvironmentPrivilege	6656	svchost.exe
Token: SeUndockPrivilege	6656	svchost.exe
Token: SeManageVolumePrivilege	6656	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	6656	svchost.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
4352	svc_240915546.exe
2680	SecHealthUI.exe
4020	UD.exe
4020	UD.exe
6924	wompwomp.exe
6924	wompwomp.exe
4928	svc_241154812.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2088 wrote to memory of 5628	2088	msedge.exe	88
PID 2088 wrote to memory of 1412	2088	msedge.exe	90
PID 2088 wrote to memory of 3136	2088	msedge.exe	91
PID 2088 wrote to memory of 3136	2088	msedge.exe	91
PID 2088 wrote to memory of 3136	2088	msedge.exe	91
PID 2088 wrote to memory of 2320	2088	msedge.exe	92
PID 2088 wrote to memory of 2320	2088	msedge.exe	92
PID 2088 wrote to memory of 2212	2088	msedge.exe	93
PID 2088 wrote to memory of 2956	2088	msedge.exe	94
PID 2088 wrote to memory of 2212	2088	msedge.exe	93
PID 2088 wrote to memory of 2212	2088	msedge.exe	93
PID 2088 wrote to memory of 2956	2088	msedge.exe	94
PID 2088 wrote to memory of 2956	2088	msedge.exe	94
PID 2088 wrote to memory of 3628	2088	msedge.exe	96
PID 2088 wrote to memory of 3628	2088	msedge.exe	96
PID 2088 wrote to memory of 3628	2088	msedge.exe	96
PID 2088 wrote to memory of 4212	2088	msedge.exe	97
PID 2088 wrote to memory of 4212	2088	msedge.exe	97
PID 2088 wrote to memory of 4212	2088	msedge.exe	97
PID 2088 wrote to memory of 4356	2088	msedge.exe	98
PID 2088 wrote to memory of 4356	2088	msedge.exe	98
PID 2088 wrote to memory of 4356	2088	msedge.exe	98
PID 2088 wrote to memory of 5936	2088	msedge.exe	100
PID 2088 wrote to memory of 5936	2088	msedge.exe	100
PID 2088 wrote to memory of 5984	2088	msedge.exe	101
PID 2088 wrote to memory of 5984	2088	msedge.exe	101
PID 2088 wrote to memory of 1148	2088	msedge.exe	103
PID 2088 wrote to memory of 5956	2088	msedge.exe	106
PID 2088 wrote to memory of 5956	2088	msedge.exe	106
PID 2088 wrote to memory of 5956	2088	msedge.exe	106
PID 2088 wrote to memory of 4216	2088	msedge.exe	107
PID 2088 wrote to memory of 4216	2088	msedge.exe	107
PID 2088 wrote to memory of 3292	2088	msedge.exe	108
PID 2088 wrote to memory of 3292	2088	msedge.exe	108
PID 2088 wrote to memory of 3292	2088	msedge.exe	108
PID 2088 wrote to memory of 2000	2088	msedge.exe	109
PID 2088 wrote to memory of 4656	2088	msedge.exe	110
PID 2088 wrote to memory of 3812	2088	msedge.exe	112
PID 2088 wrote to memory of 3340	2088	msedge.exe	113
PID 2088 wrote to memory of 4456	2088	msedge.exe	114
PID 2088 wrote to memory of 3184	2088	msedge.exe	115
PID 2088 wrote to memory of 3184	2088	msedge.exe	115
PID 2088 wrote to memory of 4908	2088	msedge.exe	117
PID 5532 wrote to memory of 4352	5532	Loader.exe	121
PID 5532 wrote to memory of 4800	5532	Loader.exe	122
PID 4800 wrote to memory of 4112	4800	cmd.exe	125
PID 4112 wrote to memory of 1160	4112	cmd.exe	126
PID 2088 wrote to memory of 616	2088	msedge.exe	128
PID 2088 wrote to memory of 2424	2088	msedge.exe	129
PID 2088 wrote to memory of 616	2088	msedge.exe	128
PID 2088 wrote to memory of 2424	2088	msedge.exe	129
PID 2088 wrote to memory of 3448	2088	msedge.exe	130
PID 2088 wrote to memory of 3448	2088	msedge.exe	130
PID 4352 wrote to memory of 6280	4352	svc_240915546.exe	142
PID 6280 wrote to memory of 6292	6280	cmd.exe	143
PID 4352 wrote to memory of 6420	4352	svc_240915546.exe	144
PID 6420 wrote to memory of 6432	6420	cmd.exe	145
PID 4352 wrote to memory of 6468	4352	svc_240915546.exe	146
PID 4352 wrote to memory of 6484	4352	svc_240915546.exe	147
PID 4352 wrote to memory of 6500	4352	svc_240915546.exe	148
PID 6500 wrote to memory of 6512	6500	cmd.exe	149
PID 6512 wrote to memory of 6528	6512	net.exe	150
PID 4352 wrote to memory of 6612	4352	svc_240915546.exe	151
PID 6612 wrote to memory of 6624	6612	cmd.exe	152

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://gofile.io/d/3yZXgY
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7ffb5540c188,0x7ffb5540c194,0x7ffb5540c1a0
  2⤵
  PID:5628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=ja --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1796,i,18126301057308277126,10740544283727215805,524288 --field-trial-handle=2192,i,3464409292564781644,650413775744929769,262144 --variations-seed-version --mojo-platform-channel-handle=2220 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:1412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1528,i,10179311175100903384,393436462104174760,262144 --field-trial-handle=2192,i,3464409292564781644,650413775744929769,262144 --variations-seed-version --mojo-platform-channel-handle=2188 /prefetch:2
  2⤵
  PID:3136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=ja --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2384,i,4370964879719142803,5874762525345730212,524288 --field-trial-handle=2192,i,3464409292564781644,650413775744929769,262144 --variations-seed-version --mojo-platform-channel-handle=2856 /prefetch:13
  2⤵
  PID:2320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=ja --js-flags=--ms-user-locale=ja_JP --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3584,i,15571716709325097107,16196007432946943324,2097152 --field-trial-handle=2192,i,3464409292564781644,650413775744929769,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:1
  2⤵
  PID:2212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=ja --js-flags=--ms-user-locale=ja_JP --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3628,i,1826398830998651260,17457773050903615818,2097152 --field-trial-handle=2192,i,3464409292564781644,650413775744929769,262144 --variations-seed-version --mojo-platform-channel-handle=3688 /prefetch:1
  2⤵
  PID:2956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=ja --js-flags=--ms-user-locale=ja_JP --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4292,i,8490890297627805387,9710463716449636768,2097152 --field-trial-handle=2192,i,3464409292564781644,650413775744929769,262144 --variations-seed-version --mojo-platform-channel-handle=4840 /prefetch:1
  2⤵
  PID:3628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=ja --js-flags=--ms-user-locale=ja_JP --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4304,i,14976940314789582777,15238619323926808145,2097152 --field-trial-handle=2192,i,3464409292564781644,650413775744929769,262144 --variations-seed-version --mojo-platform-channel-handle=4844 /prefetch:9
  2⤵
  PID:4212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=ja --js-flags=--ms-user-locale=ja_JP --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5260,i,15128537055018503202,16183777982587764766,2097152 --field-trial-handle=2192,i,3464409292564781644,650413775744929769,262144 --variations-seed-version --mojo-platform-channel-handle=5220 /prefetch:1
  2⤵
  PID:4356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=ja --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5528,i,10761452590162159934,16194351426090913929,524288 --field-trial-handle=2192,i,3464409292564781644,650413775744929769,262144 --variations-seed-version --mojo-platform-channel-handle=5008 /prefetch:14
  2⤵
  PID:5936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=ja --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3900,i,18360247781671897539,3156212869757578198,524288 --field-trial-handle=2192,i,3464409292564781644,650413775744929769,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:14
  2⤵
  PID:5984
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=ja --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6076,i,9145263803981619834,11352557487483384106,524288 --field-trial-handle=2192,i,3464409292564781644,650413775744929769,262144 --variations-seed-version --mojo-platform-channel-handle=6096 /prefetch:14
  2⤵
  PID:4656
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=ja --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6076,i,9145263803981619834,11352557487483384106,524288 --field-trial-handle=2192,i,3464409292564781644,650413775744929769,262144 --variations-seed-version --mojo-platform-channel-handle=6096 /prefetch:14
  2⤵
  PID:1148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=ja --js-flags=--ms-user-locale=ja_JP --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6484,i,7038364259123056128,16392262346868143815,2097152 --field-trial-handle=2192,i,3464409292564781644,650413775744929769,262144 --variations-seed-version --mojo-platform-channel-handle=6556 /prefetch:1
  2⤵
  PID:5956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=ja --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5340,i,8496682602942328829,16010248438630132024,524288 --field-trial-handle=2192,i,3464409292564781644,650413775744929769,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:14
  2⤵
  PID:4216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=ja --js-flags=--ms-user-locale=ja_JP --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=5240,i,8394054464124840404,16494455627423249906,2097152 --field-trial-handle=2192,i,3464409292564781644,650413775744929769,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:1
  2⤵
  PID:3292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=ja --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6400,i,3652404812459068165,1184755416005495862,524288 --field-trial-handle=2192,i,3464409292564781644,650413775744929769,262144 --variations-seed-version --mojo-platform-channel-handle=7204 /prefetch:14
  2⤵
  PID:2000
- C:\Users\Admin\Downloads\Loader.exe
  "C:\Users\Admin\Downloads\Loader.exe"
  2⤵
  - Executes dropped EXE
  PID:4656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=ja --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4864,i,6826654990997879511,15893348283788091521,524288 --field-trial-handle=2192,i,3464409292564781644,650413775744929769,262144 --variations-seed-version --mojo-platform-channel-handle=4876 /prefetch:14
  2⤵
  PID:3812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=ja --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5300,i,1153203389981705716,8813313259713799812,524288 --field-trial-handle=2192,i,3464409292564781644,650413775744929769,262144 --variations-seed-version --mojo-platform-channel-handle=5052 /prefetch:14
  2⤵
  PID:3340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=ja --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5292,i,4126538574261761934,10124194554383839693,524288 --field-trial-handle=2192,i,3464409292564781644,650413775744929769,262144 --variations-seed-version --mojo-platform-channel-handle=5108 /prefetch:14
  2⤵
  PID:4456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=ja --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3536,i,8657865278046555321,14874321221378576026,524288 --field-trial-handle=2192,i,3464409292564781644,650413775744929769,262144 --variations-seed-version --mojo-platform-channel-handle=6912 /prefetch:14
  2⤵
  PID:3184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6876,i,17024035956711033116,17717614400845949105,262144 --field-trial-handle=2192,i,3464409292564781644,650413775744929769,262144 --variations-seed-version --mojo-platform-channel-handle=6868 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=ja --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3920,i,17020089598342480434,9786841575909993104,524288 --field-trial-handle=2192,i,3464409292564781644,650413775744929769,262144 --variations-seed-version --mojo-platform-channel-handle=3648 /prefetch:14
  2⤵
  PID:616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=ja --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6160,i,7823158498748347227,5424354895308546605,524288 --field-trial-handle=2192,i,3464409292564781644,650413775744929769,262144 --variations-seed-version --mojo-platform-channel-handle=6040 /prefetch:14
  2⤵
  PID:2424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=ja --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3672,i,11153260347914327753,4206483347355376526,524288 --field-trial-handle=2192,i,3464409292564781644,650413775744929769,262144 --variations-seed-version --mojo-platform-channel-handle=3912 /prefetch:14
  2⤵
  PID:3448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=ja --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6216,i,10568545359536038,13507603196618602587,524288 --field-trial-handle=2192,i,3464409292564781644,650413775744929769,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:14
  2⤵
  PID:6744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=ja --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3456,i,12322490776920195734,12733059870277977476,524288 --field-trial-handle=2192,i,3464409292564781644,650413775744929769,262144 --variations-seed-version --mojo-platform-channel-handle=3648 /prefetch:14
  2⤵
  PID:7064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=ja --js-flags=--ms-user-locale=ja_JP --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=6224,i,4224622169654630532,18088907752315026217,2097152 --field-trial-handle=2192,i,3464409292564781644,650413775744929769,262144 --variations-seed-version --mojo-platform-channel-handle=5592 /prefetch:1
  2⤵
  PID:972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=ja --js-flags=--ms-user-locale=ja_JP --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=3724,i,8559929245997559832,15441768445665261806,2097152 --field-trial-handle=2192,i,3464409292564781644,650413775744929769,262144 --variations-seed-version --mojo-platform-channel-handle=7024 /prefetch:1
  2⤵
  PID:3636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=ja --js-flags=--ms-user-locale=ja_JP --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=5372,i,16707999470727968687,4547433026692105094,2097152 --field-trial-handle=2192,i,3464409292564781644,650413775744929769,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:1
  2⤵
  PID:592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=ja --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5060,i,2640917625151735340,4146337048802412343,524288 --field-trial-handle=2192,i,3464409292564781644,650413775744929769,262144 --variations-seed-version --mojo-platform-channel-handle=7000 /prefetch:14
  2⤵
  PID:1476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=ja --js-flags=--ms-user-locale=ja_JP --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=5992,i,5263046533620098911,9265700205859822841,2097152 --field-trial-handle=2192,i,3464409292564781644,650413775744929769,262144 --variations-seed-version --mojo-platform-channel-handle=7496 /prefetch:1
  2⤵
  PID:4344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=ja --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6984,i,14318277201857372815,13913954238905674196,524288 --field-trial-handle=2192,i,3464409292564781644,650413775744929769,262144 --variations-seed-version --mojo-platform-channel-handle=7656 /prefetch:14
  2⤵
  PID:5908

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2484

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:6016

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5168

C:\Users\Admin\Downloads\Loader.exe
"C:\Users\Admin\Downloads\Loader.exe"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5532
- C:\Users\Admin\AppData\Local\Temp\svc_240915546.exe
  "C:\Users\Admin\AppData\Local\Temp\svc_240915546.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4352
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c sc stop winmgmt >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:6280
  - - C:\Windows\system32\sc.exe
      sc stop winmgmt
      4⤵
      Launches sc.exe
      PID:6292
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Windows\System32\Tasks\WoWx64.exe C:\Windows\System32\Tasks\WoWx64.sys >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:6420
  - - C:\Windows\System32\Tasks\WoWx64.exe
      C:\Windows\System32\Tasks\WoWx64.exe C:\Windows\System32\Tasks\WoWx64.sys
      4⤵
      Sets service image path in registry
      Executes dropped EXE
      Suspicious behavior: LoadsDriver
      Suspicious use of AdjustPrivilegeToken
      PID:6432
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c del /f /q C:\Windows\System32\Tasks\WoWx64.exe >nul 2>&1
    3⤵
    PID:6468
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c del /f /q C:\Windows\System32\Tasks\WoWx64.sys >nul 2>&1
    3⤵
    PID:6484
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c net stop winmgmt /y >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:6500
  - - C:\Windows\system32\net.exe
      net stop winmgmt /y
      4⤵
      Suspicious use of WriteProcessMemory
      PID:6512
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop winmgmt /y
        5⤵
        
        PID:6528
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c net start winmgmt /y >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:6612
  - - C:\Windows\system32\net.exe
      net start winmgmt /y
      4⤵
      PID:6624
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 start winmgmt /y
        5⤵
        
        PID:6640
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c sc stop winmgmt >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:6804
  - - C:\Windows\system32\sc.exe
      sc stop winmgmt
      4⤵
      Launches sc.exe
      PID:6840
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c sc start winmgmt >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:7080
  - - C:\Windows\system32\sc.exe
      sc start winmgmt
      4⤵
      Launches sc.exe
      PID:7092
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Windows\Temp\DeepClean.bat --silent
    3⤵
    - Executes a command shell one-liner
    PID:7104
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c del /f /q C:\Windows\Temp\DeepClean.bat >nul 2>&1
    3⤵
    PID:7116
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Windows\Temp\Tracers.bat --silent
    3⤵
    - Executes a command shell one-liner
    PID:7128
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c del /f /q C:\Windows\Temp\Tracers.bat >nul 2>&1
    3⤵
    PID:7140
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Windows\Temp\Undetected.bat --silent
    3⤵
    - Executes a command shell one-liner
    PID:7152
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c del /f /q C:\Windows\Temp\Undetected.bat >nul 2>&1
    3⤵
    PID:7164
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Windows\Temp\Deep.bat --silent
    3⤵
    - Executes a command shell one-liner
    PID:4976
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c del /f /q C:\Windows\Temp\Deep.bat >nul 2>&1
    3⤵
    PID:5296
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Windows\Temp\vms.bat --silent
    3⤵
    - Executes a command shell one-liner
    PID:1728
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c del /f /q C:\Windows\Temp\vms.bat >nul 2>&1
    3⤵
    PID:6120
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Windows\Temp\CLP.bat --silent
    3⤵
    - Executes a command shell one-liner
    PID:1556
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c del /f /q C:\Windows\Temp\CLP.bat >nul 2>&1
    3⤵
    PID:5620
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c sc start winmgmt >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:3444
  - - C:\Windows\system32\sc.exe
      sc start winmgmt
      4⤵
      Launches sc.exe
      PID:1644
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Windows\Temp\MachineGuid.bat
    3⤵
    - Executes a command shell one-liner
    PID:6192
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "$g=[guid]::NewGuid().ToString('D').ToUpper(); reg add 'HKLM\SOFTWARE\Microsoft\Cryptography' /v MachineGuid /t REG_SZ /d $g /f >nul 2>&1"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:5204
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c del /f /q C:\Windows\Temp\MachineGuid.bat >nul 2>&1
    3⤵
    PID:984
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cmd /c timeout /t 1 && del "C:\Users\Admin\Downloads\Loader.exe" && del "C:\Users\Admin\AppData\Local\Temp\svc_240915546.exe"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4800
- - C:\Windows\system32\cmd.exe
    cmd /c timeout /t 1
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4112
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:1160

C:\Program Files\WindowsApps\Microsoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe\SecHealthUI.exe
"C:\Program Files\WindowsApps\Microsoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe\SecHealthUI.exe" -ServerName:SecHealthUI.AppX8tam42xc7v2czs3s1nt0nkxvfjtepzp9.mca
1⤵
- Suspicious use of SetWindowsHookEx
PID:2680

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:2100

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {E041C90B-68BA-42C9-991E-477B73A75C90} -Embedding
1⤵
PID:1624

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5196

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k WbioSvcGroup -s WbioSrvc
1⤵
- Drops file in System32 directory
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4756

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1536

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:5056

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:6656

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
- Drops file in System32 directory
PID:6880
- C:\Windows\system32\wbem\WMIADAP.EXE
  wmiadap.exe /F /T /R
  2⤵
  PID:1272

C:\Users\Admin\Downloads\UD\UD\UD.exe
"C:\Users\Admin\Downloads\UD\UD\UD.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4020

C:\Users\Admin\Downloads\UD\UD\x64\wompwomp.exe
"C:\Users\Admin\Downloads\UD\UD\x64\wompwomp.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:6924
- C:\Users\Admin\AppData\Local\Temp\svc_241154812.exe
  "C:\Users\Admin\AppData\Local\Temp\svc_241154812.exe"
  2⤵
  PID:4376

C:\Users\Admin\Downloads\Loader.exe
"C:\Users\Admin\Downloads\Loader.exe"
1⤵
- Executes dropped EXE
PID:5812
- C:\Users\Admin\AppData\Local\Temp\svc_241154812.exe
  "C:\Users\Admin\AppData\Local\Temp\svc_241154812.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:4928
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cmd /c timeout /t 1 && del "C:\Users\Admin\Downloads\Loader.exe" && del "C:\Users\Admin\AppData\Local\Temp\svc_241154812.exe"
  2⤵
  - Executes a command shell one-liner
  PID:5312
- - C:\Windows\system32\cmd.exe
    cmd /c timeout /t 1
    3⤵
    - Executes a command shell one-liner
    PID:1932
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:2188

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004C0 0x00000000000004C8
1⤵
PID:6152

C:\Users\Admin\Downloads\Loader.exe
"C:\Users\Admin\Downloads\Loader.exe"
1⤵
PID:3304
- C:\Users\Admin\AppData\Local\Temp\svc_241349031.exe
  "C:\Users\Admin\AppData\Local\Temp\svc_241349031.exe"
  2⤵
  PID:52
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cmd /c timeout /t 1 && del "C:\Users\Admin\Downloads\Loader.exe" && del "C:\Users\Admin\AppData\Local\Temp\svc_241349031.exe"
  2⤵
  - Executes a command shell one-liner
  PID:4456

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

8B2B9A00839EED1DFDCCC3BFC2F5DF12

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12
Size 1KB
SHA256 63b14543360f5e89942ea8d5113526e64fbc71c1207328f0136b3a495d921dd0
MD5 adac67e1d2da2d706db151c2db316b2d
SHA1 5f6e301d23e33132209707945d0e740d5bcb8996
SHA512 9371b62ac25c6ea8fb6fca19ac47b873ced9b3d0cb45ce4de5ea974b93c12684c65aa23c7d83331c77502853258a08dff73ce5e3fb6170bd3ab1c5b3283a86a9
TLSH
T1DE31AD4EA2153027D5427F72D8CEBE83CEB1364667CAD46B18046E4229AAFC25FC80C9
MD5 SHA1 SHA512 TLSH

Submit Download

B46811C17859FFB409CF0E904A4AA8F8

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8
Size 528B
SHA256 d2bb091268ade68ad8121d2184d0fbce128070156304bd4de312e6fbd267409c
MD5 047f3e9d21d6b325d592b1959e4362e6
SHA1 5aeef5f985171cd69da397fd039854e44ebecdd2
SHA512 4523896ed4a03afafd2075d8c8947236d34fe1da2c246a3f90c2be2a5c151c18bc58a6cde5a209abb8e06e80f662e24d0149640b3e98e8a872bfa8a04ef592a4
TLSH
T147F0500990082252C855FF55DFD6AC97DC76336136E595036D458E410C12F96AF950F5
MD5 SHA1 SHA512 TLSH

Submit Download

8B2B9A00839EED1DFDCCC3BFC2F5DF12

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12
Size 174B
SHA256 c0a75b21d4b151f1b7307e194f27629b4892fa3267d828cb0fdb4de15e2b1cd1
MD5 603e5bfc756c7060aabd58b22313a78b
SHA1 3c29710b896a12a9e6e94297e49ebbb0eb5346b7
SHA512 5fe4da2944adb3c6f0bd7c2b087bc5dd4e670efcca4d9c86ee7b63a14da0ae7120acb6cb3487e3479161958277058e62b02b48691e01e95fb43c8b8685645a4d
TLSH
T17BC02B0433B14155F1304D7F0A43930147FAE105CD42C3000F30221CC11CB428CF0C02
MD5 SHA1 SHA512 TLSH

Submit Download

B46811C17859FFB409CF0E904A4AA8F8

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8
Size 170B
SHA256 c222949183ee360fc435d01fad588d470a507668b4fe198d63cde340b02e5572
MD5 d4c3e232fb8fee4e6d8bdd5829f2ec29
SHA1 6fce1c5780f4fea0387d2fee078554872c7eaa70
SHA512 1431231d8c44e111e79a9c000f6b39147b36bfa19ed749eda4299c8ff76e3cb3ade72eb0009155963e36696c7e9f53b678d4891c3c29e3452dd628012eb7de59
TLSH
T119C09B1473654715F14D517D79D6560417B54106F5C7C3044B7851359518A500871D05
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ecdd5c8034c45eff453cbaf31d8886e2bd9609a73853367a6d096a69cc81f1be
MD5 a774534a956a5c8affebe08e87c80683
SHA1 b3e4e20a91e4087d3b9247b5ef6815f51858a041
SHA512 27769aee2cac148a0154fe42b51da2a9a1088e9e990873915b4c7ab9bd5442a3facf82b2bd1cbaef75328bd5937813698b96ac06aa76d934d07ab5ebb194a824
TLSH
T103D09B6673449A1CC9C439712461565161115820E41443581C96715CCDE56C707571DE
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 dfacefa73d018d54e3feba3eef28ec722a8422fee8768a2c3d8d6253f863b375
MD5 cb5000b6fab1115bfff50bedcc3eb9fd
SHA1 afbfe0ec03df59e7a1eba1da4227111508419c03
SHA512 aab9a1afd5de2f983466724b6ecf0dbc2e176c5a1eb2f059b9507511cc53643fcf9ed990bd565f22f8d53fb82db71cba238962a75c68db02d5f10b526661bd08
TLSH
T15AD09B667354991CC9C439712462565161015820941443581D96B16CCDE56C707561DA
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 fc2f13d5ab45a7d6483e8dc033ec7782cadef1aff9d2b225a9cc3ce23d90ed25
MD5 b5ab8ed95db498a9b84d19e7a58cf448
SHA1 3098c0913486b13edc45388e3a5eb1c4be435506
SHA512 bd798a55a14831df03f62febeed6a3d7eaa5165e1c52f99f9203f8cdec96ba04f2acb8df4cace0bd45159eebe22e9f0f71424b9cd816d114f98f7991333f0212
TLSH
T17AE086A449CAC26EE209758782A967CCC3A0360BA6C8794A1B058DDE7143558EB9A6D0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 bfed00796383d4eb89d8c3f4252723b0a6caa9bd673b15c31152a15afabee98d
MD5 9a199c21f056dc213e12367b67def9e2
SHA1 001ee8b9e1130f40c78bfde14d0b7151625ebe4c
SHA512 7fe60d8bfce3c1312b53ae73f2388d08d1ec0d9c7ede74cbc727bb52e0fc58a48a195d13caf6584fbd4b05a4c2ca7d6adc9a678379c7d6a9ae3a1de8499f36ac
TLSH
T111E026AC84CBC36EE2086457427C93CCC2E03B0B92C86E4A1B0889DC750A849EBC66E0
MD5 SHA1 SHA512 TLSH

Submit Download

f_000065

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000065
Size 405KB
SHA256 1b60a6c04cc80fa726e3c5026255272c3b75303cc1666700305b3f9acf8b2226
MD5 e6b338d0fcf0d823a1874c7606dc62dc
SHA1 501f5d87f43ac13f1545286e3fde99eb15c5c5a7
SHA512 5cb49ce345babefaa0b4070245244a8cf2611000c2fd124532f43c764022177192f62a14090d3b5945544449788612326e215446cbe5f1830c4309720cedeec9
SSDEEP 12288:Ph3qrs26+46/k68I6l0X7+uHw8AVTQPUg2tQVy:PhqrL6+vkzI6yIVkY
TLSH
T16894237C930EA8852F3F559A617D2C8A1884F8F5CFD95E81BDE3E7E150A0D090B5B328
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00006c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006c
Size 60KB
SHA256 09942f492f93e5748a18748a9d5703c1d9fb2371e88bc2a01fa7779650dc40dc
MD5 bdb48354eacf1843569fdf0898e71667
SHA1 c0090b0822e5bf07180d4366700316f8de682397
SHA512 49eef2ef2dbce4b0af131555846b2f3e5180e25f1b4fd2f8cfea9d103811e6b954d1209b70ce85fcbf88eabb48399e6240a1db02544d056ae55a22b10a5f0bd4
SSDEEP 1536:l6QKCA9YwCpxAMmNB56jI+BCDMv7FoRRQOYLG/:l6QcYjaFN+8uCIDFw2K/
TLSH
T104530213EE0C472D26E597594723CF026AFD0456AF0AF40D6F8BDEF0A2686C5A35E834
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000076

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000076
Size 27KB
SHA256 fb3af27a0d28b794aa8077e5f5644163497833b4bbff85d65f3442da43c08671
MD5 ada046d4a194e9673559623cbf360db4
SHA1 a1eabc7efde6217952a52d8db4e37901776bc2ad
SHA512 8ad275b2fdfdcdba2b162aaf39aea514b755700ee1e1311319c721e8dbff503222c94fcdcec120141f59659622f79149065ae14f4449e721d5a894ed27b37462
SSDEEP 768:ZiXDrZ/IXu5rO0bVrWyhVuWDLzFwhYEK+K/6N:Zif9O6rtb9WaVtLzuhYEK+K/c
TLSH
T1DCC2D0466B47E178108DD77E95BBB144963314EF02220E987B26BEDF4817FC45E49F84
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000077

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000077
Size 17KB
SHA256 ce83192a06afab5ecb50741023496477f6242c24201d8f25dffb4e52117f6abc
MD5 cd21fc6dc77cabbda4f5ace875b147e6
SHA1 daace7b6604408c87c51e0b35009694e27348e11
SHA512 37a70397be01e6b45d58124ba1a996422b3843ce3ebf40a1340889189b22af9404a970ccc5655b0f5ac0fd97e206a093c175e452bcb21ea6e991f5d9df6cafd5
SSDEEP 384:979cSNMOuvoEAvky8nmH5+XByEi7k1du32ovQ1:BiSmOuv+l8mH5+Xseru32ovq
TLSH
T13382E1AC730552ED1A829801355B28D0E517D7B50B6C562E6768312E8324F3D6FC6F7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00007f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007f
Size 28KB
SHA256 9776795bbeca4e4230abdb1fecacef472b2699cc7d5a62ac10872d355b25c201
MD5 799b054d892dcd18a291f352e7f381d7
SHA1 f738293a1d83a4f158ab66909343896e66f50117
SHA512 cfb3d1f543a579b9b3d0d380ed463e124a1ba8f76b457ce2af24abc065206e41d81315dcb464b819fa4b057aa0b79f095a5bc02520eb318d9c1f645296905faa
SSDEEP 768:ZDaAOQKsmsIQu4xwRfGwUQeT742JOzJy9hV/hfGC5:ZDaV8mgu4xwZF27bM89hV/95
TLSH
T1A4D2E1CD3950FBEAFD40432A5BD109C06091C392F5DAA0257F9895AC1CFEF9433886B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000080

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000080
Size 39KB
SHA256 1b0cd0cb476418065c9ffcdd3b31692da58b3ac8fcc32e7e175a64230694ef90
MD5 42ae92ea9e371d15635464fa4c2c59f4
SHA1 02618d416899ece6b641d4ae4c0129965eccb0b5
SHA512 37c0a4d536defff707e95bc1660508486d3c132eb4a369dadd49e24e428b51fe5df0eb3f480d4989ac3d921b42f38d73b408b009bc3f3257d13d995fe556dcc0
SSDEEP 768:ZUGBv2ks6wmtnl/N+SH3oqPfpp58muw3R91cIjmK/ZrdqRMNk90:ZxOksERlF+SHT3pp58m1L1pqK/ZrMv90
TLSH
T14303F265376860190FCF49F5230179DFB157030997209F7CAE24CB9E11872D6F7768A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000081

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000081
Size 32KB
SHA256 02f37493461fce72f42175ae17b135cd011764a2ee505d450559e21991d9228e
MD5 3d8c22b216457fab52ae01a877c77cd7
SHA1 fbfd3af856d716d5395af7612f6942075afa3495
SHA512 21862b425a4215483331118ae49ae86c5db259a01c555d93175f4ec882936ec13be886ba32bf65c1022dfd1078808c1d247350cb0aba2cfd0d3f504d47d1f451
SSDEEP 384:oIozNFH90NyYjxFqMdC2AfsBG8bL6d3M11jCrgS5nLqv1YqxxgWKfL:onTd5nfuG0+cjCES5L41Yqx+
TLSH
T193E2E13EBBA54C31CE5A30786C3F75A7D7A931F1F166705B4F4E088B415418795AE224
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008b
Size 30KB
SHA256 046c11606137c8b1ce58d96f8db6ca00523c87cd34b94905465c196857577d12
MD5 f5cdf0faf4fd94520822b7e20f5c1bf4
SHA1 7096cc57b35bff92aeb59f8c00201c93df7dfa77
SHA512 d841b7f009f73a8951f1ce1cf9f2dc40b3b45db7e426bb12d72d86aad4853aa08a69bb88343d330a0708302821b7ee200f63892bd1daa3fb7291d213993e8c49
SSDEEP 768:Z79NclEeL+XCrgoAVoB88M6MDLpv3XqPXUxT9N8tt:Z79ilE8+XYgiB8H6MnMPEvKT
TLSH
T1F6E2F1F620C4D9D4BA318CC745966688A0EFC06F551C320F6DB258ED3B8F19FA29EB45
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 f5e96a638aadce6b8829e53262fe8b5ecd7b347456ad04628cd74db9cf41354d
MD5 9c96b0d5972a406d834678d25e7388df
SHA1 eb00b904a72308283dc4ff48472366e24a820ccf
SHA512 f26a32aba5a81627800cf0e7c772f35aee8ef77c221f9cdbe6e238e6e2469bd16220ccb8e4849024ac702dd57bf488859ac8b2bad10b90a5bdd7d35e79db2da7
SSDEEP 48:ikYj89hVZneybzOLg4lQBOceyq1n7fG4ioJsiSoUAvT9/kHbzY:BlhV9eyP2leZeyGn7fG0SorT98HbzY
TLSH
T1C391C88266EF085BCB341DB9E5E98EE43132847941233BF764F24634DA9B3C4338553A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 245b21b608eee0226e923a205f0f612244e4cca443586611e90064d26e6a6763
MD5 d5931d644a3726d2d2be259edd11b1b5
SHA1 59f8bf17583b6e521335991d11ec7aa8bb8507b4
SHA512 31d2c86519608c2d202dd05508aaa0e324ebfcf2fe311b6cc45789b606b08b2266156f50de58d94f6e65eacb6873b31b4684d406bba15a283b970d78a6f13007
TLSH
T1AF51DB516BBF15D2D3B8997962D097A47276A23A00233FF332D25370DE973C82088522
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a05fc.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a05fc.TMP
Size 1KB
SHA256 4734605de3be0ab39fb3b211614af9af4b1a0f8be16834b1ea1c7750f473e135
MD5 0ef1c92a596438fae43db153bd5387a9
SHA1 a05341f9fafcbc5c3f9bba4bed8666da33c83920
SHA512 1c566a8992a38a817a950d3443e002b5c56c9350f39a552656fb5b2db584c8b05bf1de81d99b533d736d2676130f9f5dfd6aeaeb27c29601ee549193aeb517b3
TLSH
T11B310C916BBF05D1D79559BA21E087F8B275802A00276FB336E25375CEC33D8315D463
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 0b2a7e0662d13126523b4a4ae93233f9749c14befadc246cab44707fd4ae025a
MD5 5676507b072097cf6aafd63dd2653ef7
SHA1 b997baf487dc7ce4dc80cb3025f38a695cd6b5c6
SHA512 62521fb59ae83b5d96d6f491d2f3f618eef06369d6d19eea7ba31c0cd302984d79edb58171a0d754e0d13107993216c95606440fcce9890e08a1e0fb7e2e354c
TLSH
T1CA416AF783F8956D8A1192F4AB046F1BCE581515832C796AC9E06E1BA3E3871E140A5F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 b0ea1ed43acdfdaa61a8979fda56637f1ee227624a4e830c225d9cd211c2ace6
MD5 c53441cc4a289f984a60af26bce52553
SHA1 980006a32f3e97a9ac3593a4d12bf88f8d220fb2
SHA512 2385047cff03c214ccb5be5c68565a293b2e834caacd89b95a23037ce551134567be48b7a94ec98c343b8a154ebfb3fa0c01dd5f63e5045bcc00026e5b14077c
TLSH
T1A821CDF3C3E8567D890181F867182E1BCE2D0815832C3E5AC8D4AB5BA3E18B1E24095E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 2c22cbc5dc35e03f5426e55161fa88a432c4a70b51059a2ffb1f9eb6d06eaec4
MD5 bb876a6981a304d9719d424948012133
SHA1 4072a7096589e1d8a4ddf8ffe0953cab43e65ff0
SHA512 c3aa79ec1c4e21e3cc7a78686c6239d58c27a1eb18c4d1122acb1903900e4e2777bca1119e4d407c4c7001a0131a18281901aa7b6b3dbbfaf4c2a1a7897cdb4e
SSDEEP 96:DfNho7RvXiZVwBj4/QSP+yXBGOl5GzGHrVt7XJ/k:D1ho7FXiZVkj44SPhx7l5GzGLVt7XJ/k
TLSH
T14E91ACF7C3F5466DD91192F0AA146F1BCE580456836C3D5A89D46F0BA3F2871E141B8F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 b8c9da8445c559569bafe328d289ab90662af89ac5f5c441ee870d25ee35475e
MD5 edbbc53dc560665c97ccd5b2f103e913
SHA1 f8c78dbc6bb8b73348b6f12bbbb671c9208ef4c8
SHA512 dbf96c4cdff6c51305214b6f793f1c3afaca5b94a23b7fbedcbc097bdbfe8bd182cb3e1d55ad736845d1ab51d3376e468470112c211182fb047c0d1d9122cc28
SSDEEP 192:sxRLmBb6/fqseZTAKCA94/KzoA8pMlQ/g6+WNM4I/YD956SvGQ4IgDF6J:sxRLqm/fqseZEZ8Id/5M/fS2p2
TLSH
T19342C716AA28693B9CCBE21DBA56BF53E2F9503361905E48A7FC970C05E76DD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 26KB
SHA256 fcac6c2e12ddd6633b33a7a309d5a5fd58083f30c0ee8f80c7a908441540f268
MD5 99dde10e90503e9d04b72970a9a24277
SHA1 ceaafd96165a4472456cfd0b06fac10f1f10aca2
SHA512 4fc5291510c4ab5f69d29aeaaac14d77bea09a3b67d6aa647ea295195ebe70bbb7de06f94b196f4b8076aa3eb0ccd83e3294fde4741438dcdfa92e3be066f4a1
SSDEEP 384:sxRLqm/fqseZT66s8qMpRiYnazAW8pZS15posJWeT+eZ8IH/5M/GS2p2:sPqm/fAT4Mnc7WeT+eZ5/5uGSp
TLSH
T149C2F7059924C83B9EC3AD18693D7E33EAEC506222C5DEDE56ECCA0C019E1FDAB47457
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 26KB
SHA256 3a06b6314b27abbc89c03704bb13ccfb3b8b3d15f6f9ac75b85400f7ca350059
MD5 78afd85524a6f7aec4b5f8815f816b98
SHA1 a3db4e46ddca0b6f6029ffe88569766b89dbb908
SHA512 613751b6c99b310b33808e07f71b92e191baeae43103a3d719caa3ccb1f9bcab5313cc87d80b848276361670ddb2a46199502ccb246a04c77d6f459d9b69e576
SSDEEP 384:sxRLhm/fqseZT66s8qMpRiYnazAW8pZS15posJWeT+eZ8IH/5M/GS2p2:sPhm/fAT4Mnc7WeT+eZ5/5uGSp
TLSH
T1D4C2F7059924C83B9EC3AD18693D7E33EAEC506222C5DEDE56ECCA0C019E1FDAB47457
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 6e447a9c19555a632ba85319d7778401d5b15f388378a013dfa5212ff708cf27
MD5 01e2b6bf5209ed624edf04282311220e
SHA1 eae4883e6354838563b4f130a9452d2dde7c602b
SHA512 d2d7c02858e1a084453e653e09700da5d5ec370e27fd80be809dbcb95f09dee903356113d307d418999bf8f1cbfd2719496204eb74d4f11b5e5b8a51cd067327
SSDEEP 192:sxRgmOb6/fqs3TwKCA94/KzoA8pMlQ/g6+WNM4I/YD9s6SvGQ4IgIJ:sxRghm/fqs30Z8Id/5M/4S2s
TLSH
T1A832C8165A28A93B5CC7E21DBA16BF53E2F95033A1D05E48B7FC960C04E76DD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 e7a40eb81535465a7075786b58a152754b1ecc6159387c4bdafec38fced981fa
MD5 27e213ae5e6aa8012ed35a57d8eab024
SHA1 ffecef546bdd0d0edac6c808dad34eee31311c15
SHA512 b488c1a4c3bb9b6fa895cae529ef3787adfc6b1f3622d014809c3cfd71c9ac714d364aa488c5998b5edb94c9a3a308f6f734b17303758246546555b247cb9a1f
SSDEEP 192:sxRLmBb6/fqseZTwKCA94/KzoA8pMlQ/g6+WNM4I/YD9A6SvGQ4IgDFoJ:sxRLqm/fqseZ0Z8Id/5M/kS2pM
TLSH
T12042C716AA28A93B5CCBE21DBA567F53E2F95033A1D05E48A7FC960C04E76DD230740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 28KB
SHA256 9d1b1690698095f78e286d220e57e5447318bf1bc0d86ecf6cc34a07fa1273db
MD5 fc0815c36d92351e2e7a1b36bdf3adae
SHA1 41f4eb564e5fbff1344ee3ee9ecfcb1bb6ededf7
SHA512 7f28dd693712bb10d720b76d2c51837fcde1b988de521b90656226bb0527aa11ffd1f00d6431a5e38d9a83e94525882136baa72638c994b580472be38a08caa5
SSDEEP 384:sxR7hPm/fqseZT66s8qMpRiYnazAW8pZS15posJWeT+eZ8PwFj/5kW/pS2p2:sfFm/fAT4Mnc7WeT+eZo6/5bpSp
TLSH
T18BD208059914C83B9EC39D18A83D7E33AAAC506362C5DEDE66FCCA0C019D1FDAB47857
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 89e2fbefd2db7ac03d059b0591c29eaf9cb6bdd41941941e405b33004a9cda15
MD5 1b55568312a769bbbc3fdf1a749fd1e5
SHA1 6ccfad08abc01cb237c6c800518dccaeb3acfbb2
SHA512 65f482887d2310fda4d1334a96be7af828017c83ed5abd35cac6f032faac411b078ef7edbf89174ddd5cae35290f453895f907b039e3f7d1e90fee3f052f39e9
SSDEEP 384:a8YfWRmfCtg/NFfHfKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVOe91bRcJropDh:azfWR0Wg/XfHf8F1+UoAYDCx9Tuqh0Vw
TLSH
T162B2EA2F600DCB7E5F800AADAD197FD76D9802C79B588D4047FE994C02C77EA921A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\1889e20e-956b-4630-a77c-80e93f26e431\index-dir\the-real-index
Size 120B
SHA256 9bfc9ae930ca230ade9d4b6181aedd4bf2f5717a062affa8cefc79dd9f335c12
MD5 78f8c426bba0dea7ae7ae0bca176d2d8
SHA1 5d4f3247e7f8edd10ebdf83f41fcf8f16a2dc644
SHA512 5c9ca3f581d00b6769e96a5bec2d5882c270187c47cb33380ec28f26ab991f1dd541a1d507b92c14e8d957d650f10d926f70faa7293b594980fe296463f8fdc7
TLSH
T1FAB012004C4D0C92CD0B05714A776298273707EC0D110B1310CC100698920AD9036405
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\1889e20e-956b-4630-a77c-80e93f26e431\index-dir\the-real-index
Size 2KB
SHA256 992aa6538d345891d4ef206055d572c1b6c94fa285d76fa1ef81eaf7b22ccdc3
MD5 a5488db5b5d6a12384739d78b9a93b31
SHA1 1acf70ad4a591b291798381ef32ef0a697ab161b
SHA512 5b5e9265a16f0ea256c9defffa3073733a6cbe146b55140dd9e4ac5f261661708beb75147161684d131d6899ba185f67bcfd321140165693063128f5e48fe86b
TLSH
T11A51FA4E8D4A6B67CEBD14B328B70486373534FE5A848F07954CA97478C32241D6EE14
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5e2e03.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\1889e20e-956b-4630-a77c-80e93f26e431\index-dir\the-real-index~RFe5e2e03.TMP
Size 120B
SHA256 f2445d05bc39d3dea989ae5bccea278c4314c36803891da77aa37a1926f1f71e
MD5 bb134d437c734fbf86bdde5eb582d7b6
SHA1 7166d8ace798c2347a6c1233fac897bb166c8b2a
SHA512 af80022ce30cfccb025ff1ad0564d8672639dfc4763cc721726f13571bcff5fa1580532e6f6d075459f2541c6ba1270a3bbc21d83783411b1550ba3a6a6f8865
TLSH
T131B0112202880EE0CC0E02B022A38B88333A0CA80820832330EA08AB88A30C8A082808
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\c944588f-74e1-42da-b6ba-10071240ad2a\index-dir\the-real-index
Size 96B
SHA256 5f00f96010136a4a191f6e8c9bf28748812d97bd3d25e3359f54c76d5bc49b81
MD5 1ad4d1d78e1dec0624cb2093a192db53
SHA1 814f4a7050c464e6532696b807061d944fb2bc0d
SHA512 f7a57569efb3597b129b4b4c59790d27e50282367efa27bcc7c1fd514a1318d88ddfa9d020e55a9fcb1499236769e66c7f3e11e411d4015b31efeb66e10b48f5
TLSH
T11AB0223002C0200AC00A03B223C230823323EC08820302A308E3008BCC30A000F0A00C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\c944588f-74e1-42da-b6ba-10071240ad2a\index-dir\the-real-index
Size 96B
SHA256 382fc5ffac04c76512f2875c820312f6eabb18aa256908bcd5dafbcd9a9f859a
MD5 5ef6673eaa18c30e08de644e453fa504
SHA1 77757dea4f980ae8c9dcc706e7681b92546a6400
SHA512 f6f47df538025a8c40cc49fe562ba1928a9f171fec6cd13ca36875ab38b9f01a1600c6c1d3d54d62d179552a3011816f8e1aca2d9da330f4307e467a143d9390
TLSH
T1F5B0223822C00023C00303B83BE3288A3A28CF308303B30208A00380C8B8E8F8E2322E
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 370B
SHA256 dcc0a41add483deac0f601c2754bb46bdf96654c96119dd6f582ae3efee41b53
MD5 2424f7ae3059faa785fea29dcb3aa170
SHA1 39fc58c7c5e3df2cbd790e2bce69ce5f3be984aa
SHA512 7a3969b584312040d4f05e2f3af0ffafb6c2685330888dd0d1713f1311f564b3091c19e8b6b1a07f315b0790261bc6d9fdb06b889b5e880eaf14d550eab51586
TLSH
T1D0E068762EE71860FC6B83F2347148B80105F818C545FD6F006A9A8B80E23102413C27
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 4a218fd2fe90f78d42133f0a3edc9548429b41dfc7134ae622a58bb58b340b89
MD5 3c7c5a3c44272c21bab60ca0cbfffad7
SHA1 73863a1833cdf568c42b86d0265a054d40c7740c
SHA512 009dee853dbc0563a7a0b2bd4a772600bbfcd1ab8e6c00de973f483fbbca495988bd1e7fc9c07365b7a5cda82b34c63b011bfd301a9361c238c4872b70ab696c
TLSH
T111E068772DB71850FC6B83E2347148740545F818C545FE6F402A968BC0E23102417C26
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 dcadd04f5c5848b2c868be8e6fb4477aab6650c3fdba6e9d67f8cb06019a8697
MD5 e5a34a5b725007d4d048222f9e45e2f1
SHA1 0998e1a7c2f89f322dea50e08f5410afafb02e09
SHA512 1043fe3213c176fb6cf4de989a1a6ff2fa9d8aca51bc1b6bc659f9ef7a42f0cd08a4bc2caec97a8689349613074768aabd90bb0a0016fcd081332c2f99c1293a
TLSH
T1F0A00294C959D047C45806705EA55340BBD14CF9010652118AA892F88CA528052C5A02
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5f5c61.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5f5c61.TMP
Size 48B
SHA256 bc2934aa0b271582fc72fefba19e22458bfb45a35bbba1db9affa99e131e8b15
MD5 ecee1a910402e7fe5a5ae82afbe51799
SHA1 1207d44fea33b6bc6d5c1f7b5948a841543cfb5f
SHA512 1c4f424b91dcb56be966b2c037ddbb90f5f8352c3b787d750ac49c3bd4135d16a2508a5e8a8041ed457b230d9b6056e07290147c35864d6ff2cd3b47bf6b969d
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 ca3573f877bb4aef5680546f2c45bbc734e3831cc2ee148aafc8bfe09c32599a
MD5 9e57500c8c6118762ce5732bb0a05521
SHA1 5062e65b25f7222d142630bcded42727675190d3
SHA512 438fef1055b6b271840b1e63575474a9b8e82debcf33dd239cee8598bda4d7cba11d4f930c440f0e90b9c7981037dad2bcf7539f7938ac5126bfb6cffb8548b9
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/uF:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAI
TLSH
T1AAA2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a8667.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a8667.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 f3acec53906a9af00bb898dc0b77b450b7b7128f88d0a8a79ff2f048c1a3035f
MD5 8b806b430d03a553c23147f2a50e59c7
SHA1 c34e4196783efed7050a8d7fe6c1e0abd1c7a8ac
SHA512 a40bb1542351a04e653e0b634dd5e05f65343c1e1fe9fe2b247a340af13907d9b42573009a07963cfefcdb2dc7b648d3e04c1c20e4f6a36d0b2add938ceea289
SSDEEP 768:sFsP3MwgaCD6i0lFlmwrEnjN3Gac1Fab9MqCk:hP3o0IwQnjMa9b+qCk
TLSH
T1AA136BF658D78977C8AE9783677E2E129EBCC253B5944A90B3C8650CCD534BFD306812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 14f2c05ab0520179eb67bca29555059303c1466753924328d5f96f86dff91dfa
MD5 bff3faa83b47a6f8a9b24864c2edb01a
SHA1 eb7aa2ab86a9507ee135f21e62ca9e0e5b02cbca
SHA512 224086e4ebd359e936edeb65e64ca2ba5893c39dee65248a19dd8c07452572dc701fb2f5eac48abc7467cb73d4ae75fca2806da595bbc9e4082594cad70b26b9
SSDEEP 384:BZcIQ238NpiVCWiYhNWZlf8hyEGnEgF6Cmxty2rEoajo4cdR8eHhVODjYPNDUMaL:J/3rCo6i0lFlmNrEnjN3Gac1Fab9MqCk
TLSH
T1E1F2B035AD649DB38CEBE38271433712AEE05663C6D84FD496CDBB0D06979AC530B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 1a0638d02b4e9f039b2e4397e41ad57bf18706d77ff205379ccc91a16935ba27
MD5 f444fcd837c929a0ab874c6e42891dd0
SHA1 61577ef43309eefe3a3b8e56c0c053e7302da400
SHA512 ea2f3ff66469be2f3fdd176658bf73627c7b3eac5d09539f6be323115f8fc757df1c6062ece22ed23506159376e6abdf3ebe0a7d03ab26338ab99dbadf69bacc
SSDEEP 384:TZcIQ238NprVCWiYhNWZlf8hyEGnEgF6Cmxty2rEoajo4cdR8eHhVODjYPNDUMaL:L/3oCo6i0lFlmNrEnjN3Gac1Fab9MqCk
TLSH
T19FF2BF35AD649DB38CEBD38271433B12AEE05663C6D84BD496CDBB0D06979AC530B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 22c8cc99b2444f33c17914accb48bf062b6a1232d1704ad60e4f03d634d257fc
MD5 5112ae54935077be6d462058da9033f5
SHA1 433a31ad6724a46b7516645c3401973327567c92
SHA512 286c0bf83ddeb52673a86acf71e0e53876eb05baaa043223ed2d79096cb6d5669e9bbcd05e30fecaaab95c899c3f9ccb9cc29d56c97ad238312fae10841f3578
SSDEEP 768:sFHb34wgZCj6i0lFlmsrEnjN3Gac1Fab9MqCk:Ub3fUIsQnjMa9b+qCk
TLSH
T121136BF658D78977C8AE9743677E2E029EBCC253B5944A90B3C8660CCD934BFC306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 759367016c56583b6b3dbaf8474fc7d7c56ca2eb6c34bd2bf4cd1d02b8512a35
MD5 f4759f25ae65ff86fc16ebefb6473429
SHA1 1071f748192091c677c13542538828421d6ca29a
SHA512 d60a181e56687c0d1011de9338336820fbab21ab46eb790bf24c4c18cce0536856a1d493b75c27f144758fc052d407f7cf321beec4b3d8ce1e35ba28d7c2a589
SSDEEP 768:sFgb34wgZCj6i0lFlmsrEnjN3Gac1Fab9MqCk:9b3fUIsQnjMa9b+qCk
TLSH
T109136BF658D78977C8AE9743677E2E029EBCC253B5944A90B3C8660CCD934BFD306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 1b3fcb8d417f9ddfb1a9390e7f229cff0b2e0cd5a830103d4a4e5d294e10d1ef
MD5 b934dce743ea84234fb2c5d53e1ad1ca
SHA1 d9d73f11ee2e489bdef16631f7ca315ca2ce53b4
SHA512 987d503b3ff354735c1c1831f7abff04633df2ee0cd02999ee51d793589292bff2f8044f6231f9e8b5c9daced987fffddcc062c1496dc7febe47b7962f7824be
SSDEEP 384:hZcIQ238NpXVCWiYhNWZlf8hyEGnEgF6Cmxty2rEoajo4cdR8eHhVODjYPNDUMaL:p/30Co6i0lFlmNrEnjN3Gac1Fab9MqCk
TLSH
T162F2CF35AD649DB38CEBE38271433B12AEE14663C6D84BE495CDBB0D06D79AC530B427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 d6ad3806464b9b4868bbaeb79c1b0e9d1b91ead2c9dcbc2f89feadf3e9e09d6d
MD5 254316dc31cb8248b8249af151d9c5b3
SHA1 320249ef62a87ddf769c167b22feb761829c582d
SHA512 2bb4d8b6172496ca7f7ec57a55f41773f4a852922769adba8fe2341c4045d805f36bc0ad20751e3e4f274678f97c36cebc893b22a9d35b33407f7db468741a48
SSDEEP 768:sFFO34wgwCv2Hi0lFlmarEnjN3Gac1Fab9MqCk:4O3eQIaQnjMa9b+qCk
TLSH
T1CB136BF558D78977C8AE9743637E2E029EBCC253B5944A90B7C86A0CCD934BFD306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 948b8f4ccc5f1441ed8f40bb3837836f058ec688d5f930a01fcce33f5467e180
MD5 cc543af13b7ddbfdbdcf63e749b085fb
SHA1 dc89187787e15151d37429a74307aa8c60d88ca0
SHA512 003fab14b2779059029ec80c8c0762fd416aacc744882ce52f6d0866d3516314920b7f13488b7210215773f7d1bba14fe8ad2d1b354278a910f01f5e929223d2
SSDEEP 768:rrv+4UNbdS3Hmi0lFnrEnjN3Gac1ZveVH1SCz:rbsbg3UrQnjMa4EH1V
TLSH
T1D403CF3669A88AB38CEBE385714776037FF4125385940BE4CADD6B0D02DB5EC230B867
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 80215185219b4a1f67894a18c7196b2f4f70f0cbe7cd312727b13aefc476a0c8
MD5 86b392d4b4ea33461944080a2b24abbd
SHA1 90d9af58d8548c7899f89bc854d8791814831b38
SHA512 0e61942aedbc821f6271647a4ad794a34dc29cbed7f70856611fbda5908b048ade05138016714cbe8b9f4d6b6e67730b116808f9c81e1e1ea665cd17631372c6
SSDEEP 384:hZcI+38NpXVCWilNNWZlf8hyEGnEgF6CmIy2rEoajo4cdR8eHhVODjYPNDUMahOE:p+30C56i0lFlmsrEnjN3Gac1Fab9MqCk
TLSH
T15EF2CF35AC649DB38CEBE38271433B12AEE15663C6D84BE495CDBB0D16939AC530B427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 20c3e39d4b26d8ec2a8e68232d9f0ee203fe88fe995850dd9f45fb624311cc7d
MD5 5709852856b48c339daa83f9ed7110fc
SHA1 ebebd0bc778b59fed44961fcb9aa252a4b7f5246
SHA512 1b0ca69aa82ca76911c25b8d8eab22d93f87c4239fd55784b309dc6df28d6e5a527616ee2ae2fd83a063a97ff361abb73a6f6fa13c358ac4e6d2b2a3b9a98e38
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter~RFe5f0b63.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5f0b63.TMP
Size 392B
SHA256 ee19792782c27e61b934dc16c52dbbb9f851719553f2ebe2929f9df781589303
MD5 754116a3bf729709a7ba0d1c5a7cea63
SHA1 d6be1cac2a4ecbdfd7551ca055672f64fe9e0355
SHA512 d3fb961c7260cdaf0cef0b30c506485002e0e130ddd9a8fc3fb16b5253ade1f8e5bc375765419e48a94de588cec792155819b0595c5b8fd91642e5d496cc54d4
MD5 SHA1 SHA512

Submit Download

801fe3ea-d6bd-4a13-8a1e-300dee349726.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\801fe3ea-d6bd-4a13-8a1e-300dee349726.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

svc_240915546.exe

Path C:\Users\Admin\AppData\Local\Temp\svc_240915546.exe
Size 14.1MB
SHA256 a9fb57cdebfc32b603f758d5914216f01e140f6c6951cf643ac649d14af5b40c
MD5 83232c7874c2ad1f35ec16f5aa6ba09e
SHA1 3c0221d0e5a5424429a31d00a7c28f14ca9b3a66
SHA512 3a0d09224686b335092fed9ce47502d5a80d078346f3ecdd66f0c095bcf6fd81beccd65d40971af66df5e39f2bf4775230ff7355c08084a998d3cc0ab81a3264
SSDEEP 196608:MUUys4EPkw8Gj65PIq/GZKHpTGnx8/1pD7avw2Gd3gDV659z+cQ1NWVzD+dlQFGr:JePHTKtETooqXzD+d2SlaSNj
TLSH
T1FBE612D454E5857DC4528234E1491BFAF08979CC0EFD8C2BBFD319112F3889AD8A6AB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svc_241349031.exe

Path C:\Users\Admin\AppData\Local\Temp\svc_241349031.exe
Size 2.3MB
SHA256 bf692d4a056c4c61e4406d8e61fdf06c3e3ee8706e30caf9b693dcd84fdee2cb
MD5 8665e330515d657a0799ed7d74fad976
SHA1 a0d75a3d682cff682792ae08ca6b8b42cf5403f3
SHA512 5e16690fa34d419104cb4df839aabe97a2adcb0a9e76790be92820575d8c80895bd441751bb2d17fd0c41908a38f7c6dafb50c7c0577565969233903e6c73bfe
SSDEEP 49152:MhKJ002/6hMwfbQskSQIlWYR3MXvLa0VBvDdXl6Lpk+OBPVb98MfRdl62BeQ:MUU/6hZ0hIlNEPkkFx6uvwBQ
TLSH
T132B5E1D528D482ACC492C734D28A1AFDF0CA798A4DBA981BBFC719013B31C55C9F6D76
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Loader.exe.crdownload

Path C:\Users\Admin\Downloads\Loader.exe.crdownload
Size 265KB
SHA256 94496fac28ffa28faafefc627a4022b9764c4fe4b79c2b759e9b5b7af018a52f
MD5 88e5ac818068eacd7a024b04bfda2cef
SHA1 170e6fe2d68b55aa13087a7ced6c7ce7c15c3ace
SHA512 f0ed42e403fa3f1c8c7ca0fb5742022a7f3c276dc9de28b919590dee45e6109ca4891ab7a743d0cfe1f7bba3b6cd08daa975e354120ce200b3624b7d12744ff3
SSDEEP 3072:c9VdTj0+5j5IBgL9DwCvqM42dABtBeOOybJ//ubdm4UgfCj8EfRVQyjB0ESJxrXx:7IFqM42GBtcOOWGbd32xQuUp2B
TLSH
T1CE448D15B7A50CF9ED77C67CC9624906EB72BC164760EACF03A00AA61F276D09E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UD.rar.crdownload

Path C:\Users\Admin\Downloads\UD.rar.crdownload
Size 25.3MB
SHA256 60d1da34b15ff2f004ad7348b2b84578fbd202090ee55af8d33cff783700fe9c
MD5 b02adfe0810abbe247819d8e84754f97
SHA1 aacc0d0de3c9a8ccca1ebfa777745f4b6bc5281d
SHA512 e44cf055b3fa0340558b85c3047edbf47ab26b5c802e6be7def0a051a3281cac448a07fe9acadff1fbff1421185d4580d4bbdcce80b90927a4af8dd69d9cfa76
SSDEEP 786432:qFKtj9ezwT+kPckjv0BR7VI1JIlYyAYKqs0Guht:qwl93HY5I1WCqsnuf
TLSH
T19F4733C0EC9D28FBCF7183A1B6F6BE83DB91919874BBD2E0DDEAD4361625E9494441C0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WoWx64.exe

Path C:\Windows\System32\Tasks\WoWx64.exe
Size 568KB
SHA256 365345d06316f22b4bfce15883d1507d15bbbe1dc42df3e8d9c8ef19085e1a27
MD5 e0fddcfe7a3d1cb266108c6d5557f7aa
SHA1 d52d16688b1f3370ce58619087ecb548d4838c94
SHA512 c94f2c6d24fba582ce809fdf3485437dc095a5b107f796142086b9c1e59fe2c28a67c55bd90e9a79ba55a5f56d93d88b755d68272f9d43e40ce0506dc1512016
SSDEEP 3072:RbzMBb9WEkTCBznyQWj/qUe4AVgPKdB4k9W5t3Rg9e97JXS7JqqdwgBPzgXG2AwG:lMBu2BzneZFvNIPzGLxWli67scaX
TLSH
T16EC4D6C7DD135BD9F396EB7875A23323B85B37AA0B28C6BF15C01C625619380529738E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WoWx64.sys

Path C:\Windows\System32\Tasks\WoWx64.sys
Size 30KB
SHA256 a590cea768dc696d667dc1ebfe405de09f7af4fea29e65a44d0324a1bf22cbbc
MD5 7c2b420e575bd800ed9d6fc1b9f129b2
SHA1 c2f2be94e3b0b8899bf2d04b7a066e75245f8e3b
SHA512 d5286f2f119eb54234e4b265f29e1c343ebe1d6467e8f276cf06bba2e7fb9e9a20c787c054959bd5d553432d0006177d29a2b84c10e81a0661883ff45931bf12
SSDEEP 384:wkEH/C0RFTSjqOLp3BKfHty5xCYWZz4c15gCZSbpRLbUcQUByNalaQ95IH9mi8:hEH/tF6RLNoAWYWjbv2R/4VNuREdr8
TLSH
T11EE2C70AE6EA20E9E0F6E07C95927229B4B1FC644335DFDF46504E1B1B32BE4A53E744
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MachineGuid.bat

Path C:\Windows\Temp\MachineGuid.bat
Size 171B
SHA256 b81f91f03a10b99e10921ad4adc3705c64f2a6a2933c4d18d3c881ca05cfc8bc
MD5 c9257ae868af80a12a2b656fc16d2f0e
SHA1 fb557bde8ce9786f5d58e6f240eadaffd266c55f
SHA512 4d8a49e1238ae72695e3d2cc2a7d428eabf7ab78286783d8c23d96ad43d4b42983cd11431eb6d5a76c27921cccc19ad689995878ec80eddae2cacb3fead82903
TLSH
T18DC0801623101417F98874B500E7C55033C882CF02A3DEE77AAF6112D56124D5D765EA
MD5 SHA1 SHA512 TLSH

Submit Download

MAPPING1.MAP

Path C:\Windows\system32\wbem\repository\MAPPING1.MAP
Size 211KB
SHA256 52f554ae3be6532d6a899f919ce9fd6ac1799a138f58d9d950046b8ce89e8351
MD5 77d23d050082a65a0bcaccf05493c523
SHA1 e96ad86220d644676b8b5b879c26dab1aa445422
SHA512 c95db897413b750a7ca37976386182b8a3a037fd9fb206c5b9a0bb9acfcc4c365d37ecfb53302a773603f9fe9c2630b9c272702778f32b3b07127d1320658731
SSDEEP 3072:d9iDCAIL9XzCnmNAImSq+44kKb+anDxkw32QkU1ITBMF6nKIevAokHKlYn:KDYV4mNySDvfHDew32QVITGbB1kHKlI
TLSH
T16B24064ADBE0FF53D55B3433809A9F1A07E5C5201BA18B4B22AC9715BA073265EF32DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4352-438-0x00007FF6E45D0000-0x00007FF6E6294000-memory.dmp

Download

memory/4352-437-0x00007FFB785B0000-0x00007FFB785B2000-memory.dmp

Download

memory/4928-1599-0x000001F1F8C80000-0x000001F1F8C81000-memory.dmp

Download

memory/4928-1595-0x000001F1F8C30000-0x000001F1F8C31000-memory.dmp

Download

memory/4928-1590-0x000001F1F87C0000-0x000001F1F87C1000-memory.dmp

Download

memory/4928-1568-0x00007FFB785B0000-0x00007FFB785B2000-memory.dmp

Download

memory/4928-1569-0x00007FF63F300000-0x00007FF640FC4000-memory.dmp

Download

memory/4928-1589-0x000001F1F87B0000-0x000001F1F87B1000-memory.dmp

Download

memory/4928-1591-0x000001F1F8BE0000-0x000001F1F8BE1000-memory.dmp

Download

memory/4928-1592-0x000001F1F8BF0000-0x000001F1F8BF1000-memory.dmp

Download

memory/4928-1606-0x000001F1F94F0000-0x000001F1F94F1000-memory.dmp

Download

memory/4928-1609-0x000001F1F9520000-0x000001F1F9521000-memory.dmp

Download

memory/4928-1611-0x000001F1F9540000-0x000001F1F9541000-memory.dmp

Download

memory/4928-1610-0x000001F1F9530000-0x000001F1F9531000-memory.dmp

Download

memory/4928-1608-0x000001F1F9510000-0x000001F1F9511000-memory.dmp

Download

memory/4928-1607-0x000001F1F9500000-0x000001F1F9501000-memory.dmp

Download

memory/4928-1605-0x000001F1F8CE0000-0x000001F1F8CE1000-memory.dmp

Download

memory/4928-1604-0x000001F1F8CD0000-0x000001F1F8CD1000-memory.dmp

Download

memory/4928-1596-0x000001F1F8C40000-0x000001F1F8C41000-memory.dmp

Download

memory/4928-1593-0x000001F1F8C00000-0x000001F1F8C01000-memory.dmp

Download

memory/4928-1588-0x000001F1F87A0000-0x000001F1F87A1000-memory.dmp

Download

memory/4928-1601-0x000001F1F8CA0000-0x000001F1F8CA1000-memory.dmp

Download

memory/4928-1603-0x000001F1F8CC0000-0x000001F1F8CC1000-memory.dmp

Download

memory/4928-1602-0x000001F1F8CB0000-0x000001F1F8CB1000-memory.dmp

Download

memory/4928-1600-0x000001F1F8C90000-0x000001F1F8C91000-memory.dmp

Download

memory/4928-1594-0x000001F1F8C20000-0x000001F1F8C21000-memory.dmp

Download

memory/4928-1598-0x000001F1F8C60000-0x000001F1F8C61000-memory.dmp

Download

memory/4928-1597-0x000001F1F8C50000-0x000001F1F8C51000-memory.dmp

Download

memory/5204-470-0x000002617F5F0000-0x000002617F600000-memory.dmp

Download

memory/5204-469-0x000002617F9D0000-0x000002617F9F2000-memory.dmp

Download

memory/5204-466-0x000002617FA70000-0x000002617FB04000-memory.dmp

Download

memory/5204-471-0x0000026180000000-0x000002618010E000-memory.dmp

Download

memory/6924-1529-0x0000000058D80000-0x0000000058D95000-memory.dmp

Download

memory/6924-1523-0x0000000058830000-0x0000000058D7A000-memory.dmp

Download

memory/6924-1522-0x00007FFB4F8B0000-0x00007FFB4FDDE000-memory.dmp

Download

memory/6924-1615-0x0000000058D80000-0x0000000058D95000-memory.dmp

Download

memory/6924-1658-0x0000000058D80000-0x0000000058D95000-memory.dmp

Download