hxxps://gofile[.]io/d/5tI1SO

Analysis

user interaction
yes
max time kernel
628s
max time network
571s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/07/2026, 17:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://gofile.io/d/5tI1SO
Sample260730-vkxtjssgka

Score

8^/10

discovery execution

Malware Config

Signatures

Drops file in Drivers directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	powershell.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	PureCrack.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	PureCrack.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	PureCrack.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5104	powershell.exe
4668	powershell.exe
2108	powershell.exe

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
26	api.gofile.io
27	api.gofile.io
31	api.gofile.io

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3372	cmd.exe
4860	cmd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3764	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134299046519245258"	msedge.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2937465464-4167303362-2236413517-1000\{5AB19B88-51BF-472C-A5B8-F8F58B7909FD}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings	OpenWith.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
5104	powershell.exe
5104	powershell.exe
5104	powershell.exe
4668	powershell.exe
4668	powershell.exe
4668	powershell.exe
2108	powershell.exe
2108	powershell.exe
2108	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4676	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5104	powershell.exe
Token: SeIncreaseQuotaPrivilege	5104	powershell.exe
Token: SeSecurityPrivilege	5104	powershell.exe
Token: SeTakeOwnershipPrivilege	5104	powershell.exe
Token: SeLoadDriverPrivilege	5104	powershell.exe
Token: SeSystemProfilePrivilege	5104	powershell.exe
Token: SeSystemtimePrivilege	5104	powershell.exe
Token: SeProfSingleProcessPrivilege	5104	powershell.exe
Token: SeIncBasePriorityPrivilege	5104	powershell.exe
Token: SeCreatePagefilePrivilege	5104	powershell.exe
Token: SeBackupPrivilege	5104	powershell.exe
Token: SeRestorePrivilege	5104	powershell.exe
Token: SeShutdownPrivilege	5104	powershell.exe
Token: SeDebugPrivilege	5104	powershell.exe
Token: SeSystemEnvironmentPrivilege	5104	powershell.exe
Token: SeRemoteShutdownPrivilege	5104	powershell.exe
Token: SeUndockPrivilege	5104	powershell.exe
Token: SeManageVolumePrivilege	5104	powershell.exe
Token: 33	5104	powershell.exe
Token: 34	5104	powershell.exe
Token: 35	5104	powershell.exe
Token: 36	5104	powershell.exe
Token: SeDebugPrivilege	4668	powershell.exe
Token: SeIncreaseQuotaPrivilege	4668	powershell.exe
Token: SeSecurityPrivilege	4668	powershell.exe
Token: SeTakeOwnershipPrivilege	4668	powershell.exe
Token: SeLoadDriverPrivilege	4668	powershell.exe
Token: SeSystemProfilePrivilege	4668	powershell.exe
Token: SeSystemtimePrivilege	4668	powershell.exe
Token: SeProfSingleProcessPrivilege	4668	powershell.exe
Token: SeIncBasePriorityPrivilege	4668	powershell.exe
Token: SeCreatePagefilePrivilege	4668	powershell.exe
Token: SeBackupPrivilege	4668	powershell.exe
Token: SeRestorePrivilege	4668	powershell.exe
Token: SeShutdownPrivilege	4668	powershell.exe
Token: SeDebugPrivilege	4668	powershell.exe
Token: SeSystemEnvironmentPrivilege	4668	powershell.exe
Token: SeRemoteShutdownPrivilege	4668	powershell.exe
Token: SeUndockPrivilege	4668	powershell.exe
Token: SeManageVolumePrivilege	4668	powershell.exe
Token: 33	4668	powershell.exe
Token: 34	4668	powershell.exe
Token: 35	4668	powershell.exe
Token: 36	4668	powershell.exe
Token: SeDebugPrivilege	2108	powershell.exe
Token: SeIncreaseQuotaPrivilege	2108	powershell.exe
Token: SeSecurityPrivilege	2108	powershell.exe
Token: SeTakeOwnershipPrivilege	2108	powershell.exe
Token: SeLoadDriverPrivilege	2108	powershell.exe
Token: SeSystemProfilePrivilege	2108	powershell.exe
Token: SeSystemtimePrivilege	2108	powershell.exe
Token: SeProfSingleProcessPrivilege	2108	powershell.exe
Token: SeIncBasePriorityPrivilege	2108	powershell.exe
Token: SeCreatePagefilePrivilege	2108	powershell.exe
Token: SeBackupPrivilege	2108	powershell.exe
Token: SeRestorePrivilege	2108	powershell.exe
Token: SeShutdownPrivilege	2108	powershell.exe
Token: SeDebugPrivilege	2108	powershell.exe
Token: SeSystemEnvironmentPrivilege	2108	powershell.exe
Token: SeRemoteShutdownPrivilege	2108	powershell.exe
Token: SeUndockPrivilege	2108	powershell.exe
Token: SeManageVolumePrivilege	2108	powershell.exe
Token: 33	2108	powershell.exe
Token: 34	2108	powershell.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe

Suspicious use of SetWindowsHookEx 23 IoCs

pid	Process
2836	PureRAT.exe
2828	PureRAT.exe
4676	OpenWith.exe
4676	OpenWith.exe
4676	OpenWith.exe
4676	OpenWith.exe
4676	OpenWith.exe
4676	OpenWith.exe
4676	OpenWith.exe
4676	OpenWith.exe
4676	OpenWith.exe
4676	OpenWith.exe
4676	OpenWith.exe
4676	OpenWith.exe
4676	OpenWith.exe
4676	OpenWith.exe
4676	OpenWith.exe
4676	OpenWith.exe
4676	OpenWith.exe
4676	OpenWith.exe
4676	OpenWith.exe
4676	OpenWith.exe
4676	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3544 wrote to memory of 2596	3544	msedge.exe	85
PID 3544 wrote to memory of 3764	3544	msedge.exe	86
PID 3544 wrote to memory of 3320	3544	msedge.exe	87
PID 3544 wrote to memory of 3436	3544	msedge.exe	88
PID 3544 wrote to memory of 3320	3544	msedge.exe	87
PID 3544 wrote to memory of 3320	3544	msedge.exe	87
PID 3544 wrote to memory of 3436	3544	msedge.exe	88
PID 3544 wrote to memory of 3832	3544	msedge.exe	89
PID 3544 wrote to memory of 3832	3544	msedge.exe	89
PID 3544 wrote to memory of 3832	3544	msedge.exe	89
PID 3544 wrote to memory of 2700	3544	msedge.exe	90
PID 3544 wrote to memory of 2700	3544	msedge.exe	90
PID 3544 wrote to memory of 2700	3544	msedge.exe	90
PID 3544 wrote to memory of 2788	3544	msedge.exe	93
PID 3544 wrote to memory of 924	3544	msedge.exe	92
PID 3544 wrote to memory of 2788	3544	msedge.exe	93
PID 3544 wrote to memory of 2788	3544	msedge.exe	93
PID 3544 wrote to memory of 924	3544	msedge.exe	92
PID 3544 wrote to memory of 924	3544	msedge.exe	92
PID 3544 wrote to memory of 840	3544	msedge.exe	95
PID 3544 wrote to memory of 840	3544	msedge.exe	95
PID 3544 wrote to memory of 840	3544	msedge.exe	95
PID 3544 wrote to memory of 2160	3544	msedge.exe	97
PID 3544 wrote to memory of 1132	3544	msedge.exe	98
PID 3544 wrote to memory of 2160	3544	msedge.exe	97
PID 3544 wrote to memory of 1132	3544	msedge.exe	98
PID 3544 wrote to memory of 2400	3544	msedge.exe	100
PID 3544 wrote to memory of 2396	3544	msedge.exe	101
PID 3544 wrote to memory of 2396	3544	msedge.exe	101
PID 3544 wrote to memory of 2396	3544	msedge.exe	101
PID 3544 wrote to memory of 4868	3544	msedge.exe	104
PID 3544 wrote to memory of 4868	3544	msedge.exe	104
PID 3544 wrote to memory of 4868	3544	msedge.exe	104
PID 3544 wrote to memory of 2368	3544	msedge.exe	112
PID 3544 wrote to memory of 2368	3544	msedge.exe	112
PID 3544 wrote to memory of 2368	3544	msedge.exe	112
PID 3544 wrote to memory of 4652	3544	msedge.exe	113
PID 3544 wrote to memory of 4652	3544	msedge.exe	113
PID 3544 wrote to memory of 4652	3544	msedge.exe	113
PID 3544 wrote to memory of 840	3544	msedge.exe	114
PID 3544 wrote to memory of 4800	3544	msedge.exe	115
PID 3544 wrote to memory of 840	3544	msedge.exe	114
PID 3544 wrote to memory of 4800	3544	msedge.exe	115
PID 3544 wrote to memory of 4800	3544	msedge.exe	115
PID 3544 wrote to memory of 3288	3544	msedge.exe	116
PID 3544 wrote to memory of 3596	3544	msedge.exe	117
PID 3544 wrote to memory of 4880	3544	msedge.exe	118
PID 3544 wrote to memory of 4100	3544	msedge.exe	119
PID 3544 wrote to memory of 4100	3544	msedge.exe	119
PID 3544 wrote to memory of 4100	3544	msedge.exe	119
PID 3544 wrote to memory of 2304	3544	msedge.exe	121
PID 3544 wrote to memory of 3624	3544	msedge.exe	122
PID 3544 wrote to memory of 3624	3544	msedge.exe	122
PID 3544 wrote to memory of 1564	3544	msedge.exe	124
PID 3544 wrote to memory of 1564	3544	msedge.exe	124
PID 3544 wrote to memory of 1564	3544	msedge.exe	124
PID 3544 wrote to memory of 4472	3544	msedge.exe	125
PID 3544 wrote to memory of 4472	3544	msedge.exe	125
PID 3544 wrote to memory of 4472	3544	msedge.exe	125
PID 3544 wrote to memory of 4220	3544	msedge.exe	126
PID 3544 wrote to memory of 1284	3544	msedge.exe	128
PID 3544 wrote to memory of 3928	3544	msedge.exe	130
PID 3544 wrote to memory of 3928	3544	msedge.exe	130
PID 3372 wrote to memory of 5104	3372	cmd.exe	137

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://gofile.io/d/5tI1SO
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ffab253c188,0x7ffab253c194,0x7ffab253c1a0
  2⤵
  PID:2596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1948,i,2670081081774842672,2980676690189260595,524288 --field-trial-handle=2324,i,10569892864883749629,16074138221024101732,262144 --variations-seed-version --mojo-platform-channel-handle=2352 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1704,i,9747623990482850071,5845532284959157011,262144 --field-trial-handle=2324,i,10569892864883749629,16074138221024101732,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:2
  2⤵
  PID:3320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2412,i,10292462686617980550,908671795287877616,524288 --field-trial-handle=2324,i,10569892864883749629,16074138221024101732,262144 --variations-seed-version --mojo-platform-channel-handle=2436 /prefetch:8
  2⤵
  PID:3436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3468,i,14790161474912213918,14547546195559014190,2097152 --field-trial-handle=2324,i,10569892864883749629,16074138221024101732,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:3832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3488,i,773199246834985561,3266211606596976559,2097152 --field-trial-handle=2324,i,10569892864883749629,16074138221024101732,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:1
  2⤵
  PID:2700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4256,i,15692286588434738180,17355409350482617564,2097152 --field-trial-handle=2324,i,10569892864883749629,16074138221024101732,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:1
  2⤵
  PID:924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4140,i,13595136784085786914,15431051214661995201,2097152 --field-trial-handle=2324,i,10569892864883749629,16074138221024101732,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:2
  2⤵
  PID:2788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3628,i,1523338808943515410,16850354012096083182,2097152 --field-trial-handle=2324,i,10569892864883749629,16074138221024101732,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:1
  2⤵
  PID:840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3544,i,15214785157512698600,1366146129989595019,524288 --field-trial-handle=2324,i,10569892864883749629,16074138221024101732,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:8
  2⤵
  PID:2160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3556,i,14552841235067686387,17726399578003015658,524288 --field-trial-handle=2324,i,10569892864883749629,16074138221024101732,262144 --variations-seed-version --mojo-platform-channel-handle=5292 /prefetch:8
  2⤵
  PID:1132
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5996,i,8784769690429748064,8947023246988831931,524288 --field-trial-handle=2324,i,10569892864883749629,16074138221024101732,262144 --variations-seed-version --mojo-platform-channel-handle=5696 /prefetch:8
  2⤵
  PID:440
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5996,i,8784769690429748064,8947023246988831931,524288 --field-trial-handle=2324,i,10569892864883749629,16074138221024101732,262144 --variations-seed-version --mojo-platform-channel-handle=5696 /prefetch:8
  2⤵
  PID:2400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6192,i,16809515686719831064,8880760122114662661,2097152 --field-trial-handle=2324,i,10569892864883749629,16074138221024101732,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:1
  2⤵
  PID:2396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6196,i,13108804585007732589,1848834750506589934,2097152 --field-trial-handle=2324,i,10569892864883749629,16074138221024101732,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:1
  2⤵
  PID:4868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=120,i,4961079406077004962,7746820879724176035,2097152 --field-trial-handle=2324,i,10569892864883749629,16074138221024101732,262144 --variations-seed-version --mojo-platform-channel-handle=4320 /prefetch:1
  2⤵
  PID:2368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6516,i,18429684914474793763,3146173187427940221,2097152 --field-trial-handle=2324,i,10569892864883749629,16074138221024101732,262144 --variations-seed-version --mojo-platform-channel-handle=6232 /prefetch:1
  2⤵
  PID:4652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6352,i,7990325975438902109,15126078705011052695,524288 --field-trial-handle=2324,i,10569892864883749629,16074138221024101732,262144 --variations-seed-version --mojo-platform-channel-handle=6176 /prefetch:8
  2⤵
  PID:840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6560,i,11376856447221439148,6333466597639210642,2097152 --field-trial-handle=2324,i,10569892864883749629,16074138221024101732,262144 --variations-seed-version --mojo-platform-channel-handle=6368 /prefetch:1
  2⤵
  PID:4800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6792,i,4879533319116018702,2173976165817385182,524288 --field-trial-handle=2324,i,10569892864883749629,16074138221024101732,262144 --variations-seed-version --mojo-platform-channel-handle=3392 /prefetch:8
  2⤵
  PID:3288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6796,i,4454888639098337818,16602563976976331097,524288 --field-trial-handle=2324,i,10569892864883749629,16074138221024101732,262144 --variations-seed-version --mojo-platform-channel-handle=6860 /prefetch:8
  2⤵
  PID:3596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6800,i,7349651992171115266,4533686015268836887,524288 --field-trial-handle=2324,i,10569892864883749629,16074138221024101732,262144 --variations-seed-version --mojo-platform-channel-handle=6892 /prefetch:8
  2⤵
  PID:4880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6772,i,18422167422751120105,15870659585005145085,2097152 --field-trial-handle=2324,i,10569892864883749629,16074138221024101732,262144 --variations-seed-version --mojo-platform-channel-handle=6948 /prefetch:1
  2⤵
  PID:4100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5324,i,13877901690742781195,13437145516140350032,524288 --field-trial-handle=2324,i,10569892864883749629,16074138221024101732,262144 --variations-seed-version --mojo-platform-channel-handle=5276 /prefetch:8
  2⤵
  PID:2304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5552,i,2570553680730082821,7960835923981954580,524288 --field-trial-handle=2324,i,10569892864883749629,16074138221024101732,262144 --variations-seed-version --mojo-platform-channel-handle=6328 /prefetch:8
  2⤵
  PID:3624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=6352,i,3149575348949110157,5003402304443018026,2097152 --field-trial-handle=2324,i,10569892864883749629,16074138221024101732,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:1
  2⤵
  PID:1564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=4464,i,6273397660581700875,4257483828661946377,2097152 --field-trial-handle=2324,i,10569892864883749629,16074138221024101732,262144 --variations-seed-version --mojo-platform-channel-handle=4396 /prefetch:1
  2⤵
  PID:4472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5164,i,2979248337441780140,347743699864895281,524288 --field-trial-handle=2324,i,10569892864883749629,16074138221024101732,262144 --variations-seed-version --mojo-platform-channel-handle=6960 /prefetch:8
  2⤵
  PID:4220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6540,i,9795890235920745847,12804672270995833209,524288 --field-trial-handle=2324,i,10569892864883749629,16074138221024101732,262144 --variations-seed-version --mojo-platform-channel-handle=4424 /prefetch:8
  2⤵
  PID:1284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6540,i,7682172201931379183,3878534617207868965,524288 --field-trial-handle=2324,i,10569892864883749629,16074138221024101732,262144 --variations-seed-version --mojo-platform-channel-handle=6892 /prefetch:8
  2⤵
  PID:3928

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2484

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3528

C:\Windows\System32\notepad.exe
"C:\Windows\System32\notepad.exe" "C:\Users\Admin\Desktop\PURErat crack_ scode\Launch.ps1"
1⤵
PID:3256

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\PURErat crack_ scode\Launch.bat" "
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3372
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -ExecutionPolicy Bypass -File "C:\Users\Admin\Desktop\PURErat crack_ scode\Launch.ps1"
  2⤵
  - Drops file in Drivers directory
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5104

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\PURErat crack_ scode\Launch.bat" "
1⤵
- Executes a command shell one-liner
PID:4860
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -ExecutionPolicy Bypass -File "C:\Users\Admin\Desktop\PURErat crack_ scode\Launch.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4668
- - C:\Users\Admin\Desktop\PURErat crack_ scode\PureCrack.exe
    "C:\Users\Admin\Desktop\PURErat crack_ scode\PureCrack.exe"
    3⤵
    - Drops file in Drivers directory
    PID:2648

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "-Command" "if((Get-ExecutionPolicy ) -ne 'AllSigned') { Set-ExecutionPolicy -Scope Process Bypass }; & 'C:\Users\Admin\Desktop\PURErat crack_ scode\Launch.ps1'"
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2108
- C:\Users\Admin\Desktop\PURErat crack_ scode\PureCrack.exe
  "C:\Users\Admin\Desktop\PURErat crack_ scode\PureCrack.exe"
  2⤵
  - Drops file in Drivers directory
  PID:1432

C:\Users\Admin\Desktop\PURErat crack_ scode\PureCrack.exe
"C:\Users\Admin\Desktop\PURErat crack_ scode\PureCrack.exe"
1⤵
- Drops file in Drivers directory
PID:4364
- C:\Users\Admin\Desktop\PURErat crack_ scode\panel\PureRAT.exe
  "C:\Users\Admin\Desktop\PURErat crack_ scode\panel\PureRAT.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2836

C:\Users\Admin\Desktop\PURErat crack_ scode\panel\PureRAT.exe
"C:\Users\Admin\Desktop\PURErat crack_ scode\panel\PureRAT.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:2828

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4676
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\PURErat crack_ scode\panel\PureRAT.exe.config
  2⤵
  PID:2136

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

PureCrack.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\PureCrack.exe.log
Size 1KB
SHA256 dfbf4e5c1557bbfa64af79510dde5bad4317274c01cebe81cd4fde099108484b
MD5 927b4de92758c372f8e3dea7c5a2e2a0
SHA1 fddf1b97f5d5cfa8371c254bc9c0c190af26d4da
SHA512 bda6b63b162745a326d9d0832c16bd7c4fe044db479e7f6db5e1b057bcf4af4b749b840dccf281abc43520396e265af7ad3f8bfd13bc96f67d49a2e04fca074a
TLSH
T1DC21CC7032A1B1D44A133F420C5C6A8513FF47586B64AE5CB9AA735EC92A05B8B231F3
MD5 SHA1 SHA512 TLSH

Submit Download

PureRAT.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\PureRAT.exe.log
Size 660B
SHA256 f424c891fbc7385e9826beed2dd8755aeac5495744b5de0a1e370891a7beaf7a
MD5 1c5e1d0ff3381486370760b0f2eb656b
SHA1 f9df6be8804ef611063f1ff277e323b1215372de
SHA512 78f5fc40a185d04c9e4a02a3d1b10b4bd684c579a45a0d1e8f49f8dee9018ed7bc8875cbf21f98632f93ead667214a41904226ce54817b85caeeb4b0de54a743
TLSH
T1CF014970227BA0D888152F942C2E2BC403BF0336B5509E187998729EEE264571F212E6
MD5 SHA1 SHA512 TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 c8f2ecab5bc047971d1de2b124320c10dc1e1bf07846c3aecf9aa630e6862843
MD5 891e012216dd36f3ed35ff123e405eee
SHA1 7c375a15c0336070d0c79ce1d9896c963f301b1d
SHA512 15580fe9113e2c9d8dd676de14a20d8e76eb99f529474ffafd9e5ea9952d0272d2cbf5d7fb4af10956838cef5262b783e47bbf647581abca3048d662e715df0f
TLSH
T19281FD323275B0D4C9667F072A2819D063BF4396EA94AF4CB25C621ED92741BDB122F3
MD5 SHA1 SHA512 TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 bba2e49c11cb10e1da3782e96a0839de38ec558ccceb0d68515b04792179f852
MD5 34d661b06bc0857903247c15b32b3124
SHA1 72b12aeb58848c0b8474acb525b5e3c41cf32367
SHA512 ff623932c1d85ab3c9cf10c993d26b94c5e1d9968c6a6f9a48925137edcf7379ba3bc8d216e7fc052000ec59dab883f4b498f2262f7941a46d3328c62092e788
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7U:fwUQC5VwBIiElEd2K57P7U
TLSH
T1E0B3A931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3eacdfce7dc5d437b4447cf27ab297d2d39d13a22d53487691f060212cddb6b2
MD5 77a76342e47369b91c295856d0d136ad
SHA1 bac334fe99bd25a56aeb5cf09b273fd394730180
SHA512 5594ac61907f341c5e00a7e62a64d33fde684c855aa9b27d0c2756986334fbea5ebaf894d13dfedefe84d1f7ad65aaa17fb6b204714ed08460f06e4ed17ce733
TLSH
T1AAD012223A48F441DB4942709103CF453B26146024579A06E259D86D58B41D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5f21c2484e331c61ddff52b46cbf8498513b5234757c8746e10ae54e51e27f41
MD5 b0a46b7af0b38c25b50c8b3be8ddaba6
SHA1 116fda3e5dd4e6fbb38a6a806bd87ff4bae65ce9
SHA512 c5e35f661bd702679ca4d61b25d042ff3db55d8ecc7c6e4f7b71e1704afc680d61f84cf54b549c0d5de96ec173c72d7d2d837476990bf80dc57bc33a891f9f21
TLSH
T1EBD023707969F5D0C61C017451105E4037364571319B974BE1965C1D9DF00C0D3EFFD5
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7aa2bb81937fdcdafd5d33143cfe61093f5233469b36757de171e12cc0c6215f
MD5 6503f091cfa7258a2190ed65490b1bdd
SHA1 d722a7fd3cd82ec30e4846b9511ec1c22b9dacfd
SHA512 5f2a6a53348e4e1b7810b77abe2dd4c597357ba365cf029977f0efbbb203eab9dfb7771c9edb3561b6d22c8b7354c34611905cfbaab36c763b9d3334beb40b4c
TLSH
T1BAD012223A48F441DB4942709102CF453B26146024579A06E259D86D58B51D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

9037a132-7a3a-497b-8e38-f13f4aaebfb8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9037a132-7a3a-497b-8e38-f13f4aaebfb8.tmp
Size 30KB
SHA256 384729b79908cdb540c900ef8c12621f3c7f2e7e85dc2145b57ed698e07a16df
MD5 2a53b396268f4e20e8e89dd1d430a024
SHA1 b6b4f317435d6ced578bc4a021a5ec862d0118ad
SHA512 63e88354abfc01227257835fc2de93720414842862777657ca3c29e124e1daa86db51720ec0bfa63f4859e235b40ae6838dc621ce62735dfad1c25bb13a1f8f9
SSDEEP 768:XDs6pD1WvxzWj8F1+UoAYDCx9Tuqh0VfUC9xbog/OVEILlWwJNcroNI:XDs6pD1WvxzWju1jahILIsNHNI
TLSH
T1D4D2EA3B680CCB7E4F841E5CEC2A6E967DD801CBAB98895447FA844C03C77EA51275DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 6e0e34753ee9f2049a8ff046107ac89ee9fe739dbbd47b50d62c9831ce6a754e
MD5 871ece83e9e02783fe9ad2f672aaa897
SHA1 a220dd8f1be29be5614f93c1a6ebe0d1fb0e72a4
SHA512 c8855f8f369561f9c91f9af4951ed3c0efc04058bbfeaaa1cbc05f357995666f209cd509fc82a83cf8fb7f9130aa3b914f64c5660b2a64d02f25dad247d468ea
TLSH
T1F4815FA409468993FB2C8D78D0F552B1B47273728AC78FC9814007BFE6AE71A4E47718
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58b198.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58b198.TMP
Size 3KB
SHA256 670a4e1235582048949d3b97e2c260aa92bdf3804785df5d246dedd4128894a9
MD5 785556b8b2b4762a85b778c239f803d3
SHA1 602309b18ba2f30b3eed642a6024c843adbbfc43
SHA512 400d4a573406d128732307510c516e529021187dee6e075a3a588a26d2cb414d19d3b064aa81645d2204de519a6a33d4e6bf177e64536f88c910a0ecf9fc7b28
TLSH
T1FC612AE405028993EF2D8DB0D0F11262B4A0B6B28AC70FCD01501BBFE69A7264D57718
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 7ab1bf0be2109d5c7ca7294af0051cdbe2143ca7649b30d70c9bc79b84fff663
MD5 186c1b5903874a5b04035586b8ec2f7b
SHA1 70135f4c5f5de1c7f8501ea16bd5b7658e8d3113
SHA512 11d1cc78ee1a41af97c39cbd7a916ca4dca62c38d8c61a3ed0066a5056866b69e71d10e2f4d5a861880a8a4d9109251ddb57b15ef227857489d49687af1c9304
SSDEEP 3:MsEllllkEthXllkl2zEbNATa/:/M/xT02zU6
TLSH
T114440204AFD04826CA001035415197900760E4100511A743A45104139D966801C00100
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 6fda8a3b99a8b7312f91a31d501b24ba3474e6ee2b97fc6d846171663ccbd5ca
MD5 e7b5fc28cc8e5eb07fad91b35753c220
SHA1 4e78b4019ba01f3649128f94e7accb7edd46c438
SHA512 4333d5768237af5a9e8ad60ef6f1715d833774e4c14b3274e3ca787e92f8788551b832791098df6a1372892d323b290f75f4b778c2cd2dcd96f37096242fa49c
TLSH
T1E8319BF383F5956E8E2156F0AE14AE1BCE1C0116832C7969C5D0AE17A3E3471E001A5F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 7f85f8f58fc7ae3832e69cb601c952313adf27bb2e5a31f9aa953d51b1feed59
MD5 19f95fe6e448e0c4346e187b60e85545
SHA1 717c7b0be575c6c31ddc114ab86374bfaa643bbc
SHA512 f3b61e1bb8d1a97a946432ecf9084fe9b677e53dacdfa0c466b376c65ddd41481bd9e9e8a80303b1978d7c124cc51cc3d25d0b01aa0036311ebaa31d017dd067
SSDEEP 192:sxZuRIyM/jK1Ml8Mks/f3sDX2IdpjlyHW6+WNe4oC/YLnMCv+zIgrJ:sxZuaMs/f3sDX3YHbzL/kH29
TLSH
T15E52C7156A3459778CDBD209B955BB53E6F94473E2900E44AAFCCA0C04F6AED2217C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 c2ba7a55626ed4a5e2d0434fff404aaad2a48c2a052d082aab4832909f69c882
MD5 c2ba1497e291fdf3bb3a44421856a062
SHA1 792a76ec2b53444e3d80f5ebed8646116488a773
SHA512 8e16ac37480427c2ea951ffeaa66cec045001e4e4295c893f6a4d148280aacd13b6972ebd2afdfad13643ac4dd87eefbd9a8054ff964e15d16183b1d7d84bacb
SSDEEP 192:sxZuRIyM/jK1Ml8Ims/f3s7WpVtI8IdpRlprHW6+WNAJCEGpXYLPWO2uxIgbkJ:sxZuags/f3s7WvtIlRHbCDwX6mIs
TLSH
T10A62B516AA3459778CDBD209FA557F53E6F94473A2901E849AFCCA0C01F6AED2213C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 597324e94c5a6de1d52429975254e1a2d0a2c44061d84b434e1dfec9031edc7b
MD5 30be6f861a7bcff0861bef966a9573ea
SHA1 47d578aa95e8c848f78abd5387b5f5f32d0b0c20
SHA512 7f7c787509ba8b5514c78fbeba6a630737343224e6300aa12a0910d06a1e4d97c352a0a45f61ef1429ab299d23a5f0585e2218093272e608da7533dd2a3dcc4d
SSDEEP 192:sxZuRIyM/jK1Ml8M9s/f3s8I2IdpjlprHW6+WNeEGpXYLbBGv+zIg5OJ:sxZua1s/f3s8I3XHb3wXAe2I
TLSH
T15352C6156A345977CCDBD209BA55BB53E6F94473E2900E44AAFCCA0C04F6AED2217C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 157e0fae66a7c016740eb00faebe99dc35c26037b636502b2ad9009661d39c16
MD5 3570707dee60abafabd01763fbf34f81
SHA1 e6716fadd36694c2bb6f24f895455b0e873f8878
SHA512 d0fceae89b18da11f4fd4989695bddd7d9ce095e553ae00ffe487f416e52dd0c4501e9537804f6b18a2a00a037b5f5fb2689b9a8f7cc771f170d09866360be08
SSDEEP 192:sxZuRIyM/jK1Ml8Mms/f3s8I2IdpjlprHW6+WNeEGpXYLbBGv+zIg5kJ:sxZuaus/f3s8I3XHb3wXAe2y
TLSH
T13F52C7156A3459778CDBD209BA55BF53E6F54473E2900E84AAFCCA0C04F6AED2217C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 555a4cb05ede696789793243b9134509d2487dddb70de3bb9478e18e80f9da3d
MD5 f9ca892d44c6588700e261b59d023dbe
SHA1 fb453f0199c524a5ae1014ba54feecd25259b3e4
SHA512 c45be2de5f31748c99d09092cd3e9b11547e7401fdd99548d810a29a36c464ed71558964c04d19ca1faa57614cee867617dbc54079270439af628f91cd227d7f
SSDEEP 96:KUAAKtePW7iKEM+qCZ67g86wQx5cpszExKL4zaxviqREQSKkwKZiZ:iihRJ67g86wQvcpgE24zaBiqREQSn+
TLSH
T18FD1F51672BA12023D7E2D4893D497678AC272537014A42B3BAD04B6CE57E21CEFD9DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 3fd6da01dbc1b098b1a083368ea35fec77db981d670984e8d9699d8700586e8f
MD5 2f436f420a5bfe27534ce784932b152a
SHA1 0cf47138fb442d54ed6f4ea1a072715c92b24fee
SHA512 8cd66cf4d08c2d91c9503974ccbfae03bdd73decb3e5e3a23d4b83a37e5a8e9d9df24be36dbd59024241dcc24d551725637f32af9f33aa20cd10e7688d315640
SSDEEP 384:RZcIhsNSUQd2qTSa9xO7glzJrRzOObjI9G6w7F:5hxvzDO7g9hRz29MF
TLSH
T199927D31AC284D7659B2A145F9873A175EF8807BE7D91B8491EDEF0C02FB5AC1306C1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 936a671842bee10cb9e240056d91a9baab1288e2a49aa70599254ac346298076
MD5 75d94c06b4d49ca426a72420a53dd4f0
SHA1 3f372d55c8e7acf7f166be3b5bf565f4ed1f9005
SHA512 b4b1df86022ac4e3a513c907b688b17a7bbf7df24e6e97034899ed3462b4bf4c5fbf6f945eb14475d7cfe3f0dc5434dc00f695dfb7db5f7d2e12538976e1ee8b
SSDEEP 384:ydZcIBJsNvUTd2ToSa9xO7glzJrazOObjI9G6w7F:6fXvzDO7g9haz29MF
TLSH
T170C228F158E74972D5AE9303B7BE2D135EBCC027B6851A44B3D89A0CCDA65BFC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 eb10192a0c3d682278d5a039d7e15b3797ea9b3cc2061b441904556e1f525538
MD5 343844a3420156c00bb0138324bcf170
SHA1 1dca46e77cffae66f6c1db784aa2e1514e21ae0d
SHA512 20db9448edcf04213d403563ed4185de90f2b5f1bb612c94cb6e52759184b3f4d4067429fce37b8e4f607c351a7cbed1324c083bad20363e0a35ed6152bd2e0c
SSDEEP 192:qONx6O7+3hQmiUyG40Gttb0gO2VoIgGRmU6:qONx61HGt9xO7+IU6
TLSH
T1EF02E8356D686CB75EF2AD46F98737239FA8103BEA922F40D6E85E0C00D765C2347827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 31KB
SHA256 4a323e6133b5cfc91a39172108506cfdf47149bb97f65d15457d1e80aecc230b
MD5 92d565c5848f63607c4d9c8c25c055b0
SHA1 a6bbcc2bade470ebcb5aa1e16da89ac1f4112519
SHA512 6cab32a9b69c12a45bd841e788b53cbf45923dbee6d10317436713379c72b29d38f89c9abe0167e9dbec76470e9a2e432c409e52a27477cd6e07ed13722e1efa
SSDEEP 384:yJZcIB4sNbUTd2KgSa9xO7glzJrtkk1vKrSBGA/sB3xKBb437COObjI9G6w7F:iyH0zDO7g9htk6iSgBhKBb437C29MF
TLSH
T14AE27CE094D74CB6C09D93C7A77DAD1229BCC037B5890A08B3E9A62DEC9B5BFD311811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 55db3811d9f5ba550e6260fceec1e5ae40ebb2032e985014b8c22010dd59c92c
MD5 15ba218a8ff64e4a6f48a475f9f6d578
SHA1 c25c8831e27b9b7fbe3dbf9907a597dfef52e0c5
SHA512 33af004fa376c841fea89993635eee52b2ec3a85e5f4dd10ac52fbeb51f7af51e28b3df4ff1a363b6c6b931a9d6d7e95f21e8a06638b96b33288ae433ad6295a
SSDEEP 384:rZcIhsNSUXd2qTSa9xO7glzJrRzOObjI9G6w7F:zhOvzDO7g9hRz29MF
TLSH
T1E3927D31AC284D7659F2A145F9863A139EF8807BE7D91B8491EDEF0D02FB5AC1306C1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 9aa5e8e96c1f90d3f596cdd4d17839e422154579873f03f8743a74a7b1ea7bf0
MD5 5e2988fcf1d19c7db80fe8ac05994afa
SHA1 ef3be47d1639690f739c3934e40c3fa8254891d8
SHA512 592bec472d63917471256ba743bfd16bdaae5118a9a5dce9a4fa0e2bd69e6e48d640f8d0f7e3a1e5783eeff04e4564b9be8ad482ad4b071a6b03fa6ede0a415e
SSDEEP 384:yqZcIBzsNSUXd2qoSa9xO7glzJrOzOObjI9G6w7F:lxO0zDO7g9hOz29MF
TLSH
T13BC228F158E74972D5AE9303B7BE2D135EBCC027B6851A44B3D89A0CCDAA57FC306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 aeaecc45841b084e2435635fa1e8644adbf1cef6d78477cc03abe138f1d9f123
MD5 44f416d16eb3852f761a0755aa244fe0
SHA1 4bef4406314d2771720af197dabb3793ce95f344
SHA512 7853773fba01e3fcaf29ed55cc405cce77403d92c8f6888c375adbace8587e8f2d5fbaf8ccb3b91ac481569f9a792d31920c64e8ed1a876698752f57909cd56f
SSDEEP 192:/ONY6O7+3XQmiUyGt0Ottb0gO2VogHF0SJrNkcNpq76U6:/ONY6DWOt9xO7glzJr/zU6
TLSH
T1BD122B3578689C775EE2A045F98735179FA8417BEA862F80D1EC6E0C01EF6AC234AC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

55d2e411-fc4b-472e-8c56-2c60e5c7eebc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\55d2e411-fc4b-472e-8c56-2c60e5c7eebc.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 a3f5dae563535ac64437f77c19e71e0c6631497e051edb04da66fe834e00905d
MD5 c841bd34b4a3c382719a985b5846cc95
SHA1 11b149cd7bc9087dc7b89766afb3ed8604e385c1
SHA512 0f46cc4bb1d0694523d0f542254276f36575f88f5d72ca1f3ecfd0ca1a8bc1fb420d8c2a00bab0cad3c3b6f2b67bad1625ae07ceb58305a4c9c0b592b9a1d1ee
TLSH
T1F341E958A6EA1108B3B76E569BF6A86D447E7D772E0AD55D00110D4F0A37740C871B37
MD5 SHA1 SHA512 TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 53KB
SHA256 499efdc3635b176946654a629ede6dd7fc3d573ead094b77d60b60f97cd208c2
MD5 eb95593cadef8a5dd4ae7059529d25c7
SHA1 464b6fc05fe1c21127a61db0a38e3e9c8c369d18
SHA512 28de4369543ef8f076d7a2169d08c9fca3d57ff2d4b207868227c206839b1e5c4438bf762fdd8a8ed4df6b45c458593c16be02adca044611b8b2c1f44a3afef8
SSDEEP 1536:gC+jH04tAHk1ZSMrxyNhftflJdvYoFi3j39MVvjMlUst+hNOwUp7bNvv+EGa5bxX:gC+jH04tAHk1cMrxyNhftflJdvYoFi3F
TLSH
T128334093E9204D71E1A66F3EF15662227D34394690F8113212DC25EFA983D970B1FAFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 5831d498e327791a4204f0895cb7a6a6d626cb4be44cc2925f4ccf9bac45d34d
MD5 32665376d93d55dc7761b4136a28f77b
SHA1 43390b9bc437935c30c6a7abf646450a10a4cdff
SHA512 19efa637d388cc30335592b9096ea28c7c6587a8c55be93d62e30c296915ea64b761b18950510c20a550398f0232f2641bccd8f4d39faa214f7dd18353c355fb
TLSH
T15D21A82BB3EC8921DCC6113A108DAC5076B793C7809ECF9B6F80D310917FA88CB21190
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 4c5d80dd20d3cf24f4e122d901268ae513b5438882f9143d3829cf3175bcae45
MD5 831a2ac1ce91c4c96c6aa39a006d08de
SHA1 dc19eb637b1403748a2b40e8f6d20aaed9ac1e55
SHA512 071d7528edff81fcd125e360f996314ec3a2d5caf135db5294d9911d1c476f44dc75e53c56bfb4796771f16b3f9f468f79f7b081e235c0f719ce93d3402884f7
TLSH
T14D21782BB3EC8921DCD6153A109DAC5076A693C7849ECF9F6FC0E711957FA88CB21190
MD5 SHA1 SHA512 TLSH

Submit Download

Tmp7432.tmp

Path C:\Users\Admin\AppData\Local\Temp\Tmp7432.tmp
Size 2KB
SHA256 c292044c648fe34df7c96a5e05877e98fc7209a96392ae4bd0e9957ecc7fbc2d
MD5 2073d0ab717387a74b724184c387c77a
SHA1 62ada198f99010fb9e3bc3815fc7c1d93625387c
SHA512 c485d3b04be2e34e86908f2d974da94a1d822aff9d0e9f691c87c03094a7fdb3da71f0a5aee4415769e01a4e55d9cc146da413d273d49f194c158bdfe7d61522
TLSH
T1F2514D5505FD4137FDDEEF8D89987D038642CB80F704610926B1518E5D471F5BEA8782
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_1j3ls1wu.jwa.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1j3ls1wu.jwa.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

agent.pfx

Path C:\Users\Admin\Desktop\PURErat crack_ scode\data\agent.pfx
Size 2KB
SHA256 456075cbeb4f33f44d22d56edbdbfd89052f7cefb68a958f9f645b8bf867e9d5
MD5 357eb572046cddfb1aa9d148b22e6f7c
SHA1 1a94f0d68457889960a7eb3d8200e5c51c44d3b5
SHA512 21adb2e52e9723d3639a4121cc421a9946091119ecad98693e8f88d540711303e0de0150c125a1f48ba60eb0e70feba99c996902abb32780e70c1ca6d5bb2f60
TLSH
T16D411B09AAFFBA54659DE5AC1AF52DABA834F30466BCFC1F322173F90984553290C225
MD5 SHA1 SHA512 TLSH

Submit Download

Settings.json

Path C:\Users\Admin\Desktop\PURErat crack_ scode\panel\data\Settings.json
Size 763B
SHA256 c2d8040873d2018a2936009e8cdfaeab3b25bd10e52f95a8921abff71a9b33f6
MD5 50995ec9f974583bdd7016285a6defbc
SHA1 6107ea4dce0deb68dae7332ee37672cfbfc65ca1
SHA512 a322ddf3b535e5e5363af5d8f7a1d1beab42344fbe5fb40e3d8ac4d729f4481508a3162bb8953f7ef677259478f3a56c519ef018d846a2a4dff1205fb1bfca19
TLSH
T1BF012815903189FD22F9DA1D886AC683E325CF8B27B84C17B1FF4E2E26764361116FC5
MD5 SHA1 SHA512 TLSH

Submit Download

hosts

Path C:\Windows\System32\drivers\etc\hosts
Size 1KB
SHA256 fb1c9fb92af6c147b269ffc5fb100cae2acb439611d42724d442e7c588e844e6
MD5 9f60c50fb8ccd04e31e3e56430242860
SHA1 1fad86cd43ff332e01a5554b714b3a20617ef4c3
SHA512 628ab07e01caa9f9a51c8f9c9a1b3a77031e70c67439da66dee4e4226a4ea4c95eb34681715a51326379d4efc847d4a3c6ee5d85ed0fd63a2a1166bf4cf31573
TLSH
T1F721AD690786516D22F302D60468FC2FE31FC4DB0D7BA9893E9D424E3FA165C6322655
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2648-544-0x000001E07BC60000-0x000001E07C0E2000-memory.dmp

Download

memory/2648-545-0x000001E07B130000-0x000001E07B164000-memory.dmp

Download

memory/2648-547-0x000001E07B170000-0x000001E07B1E6000-memory.dmp

Download

memory/2648-546-0x000001E077830000-0x000001E077838000-memory.dmp

Download

memory/2648-543-0x000001E07B1F0000-0x000001E07B996000-memory.dmp

Download

memory/2648-563-0x000001E07AF00000-0x000001E07AF08000-memory.dmp

Download

memory/2648-562-0x000001E07C0E0000-0x000001E07C106000-memory.dmp

Download

memory/2648-564-0x000001E07C240000-0x000001E07C2E0000-memory.dmp

Download

memory/2648-565-0x000001E07C300000-0x000001E07C30A000-memory.dmp

Download

memory/2648-567-0x000001E077850000-0x000001E07785A000-memory.dmp

Download

memory/2648-568-0x000001E07C2E0000-0x000001E07C2FE000-memory.dmp

Download

memory/2648-569-0x000001E07AF10000-0x000001E07AF1A000-memory.dmp

Download

memory/2648-571-0x000001E07C320000-0x000001E07C336000-memory.dmp

Download

memory/2648-542-0x000001E076A30000-0x000001E077400000-memory.dmp

Download

memory/2836-592-0x00000000020B0000-0x0000000002260000-memory.dmp

Download

memory/2836-668-0x00000000305B0000-0x000000003550C000-memory.dmp

Download

memory/2836-590-0x00000000020B0000-0x0000000002260000-memory.dmp

Download

memory/2836-601-0x0000000010000000-0x0000000010005000-memory.dmp

Download

memory/2836-608-0x0000000010000000-0x0000000010005000-memory.dmp

Download

memory/2836-606-0x0000000010000000-0x0000000010005000-memory.dmp

Download

memory/2836-604-0x0000000010000000-0x0000000010005000-memory.dmp

Download

memory/2836-603-0x0000000010000000-0x0000000010005000-memory.dmp

Download

memory/2836-738-0x00000000020B0000-0x0000000002260000-memory.dmp

Download

memory/2836-591-0x00000000020B0000-0x0000000002260000-memory.dmp

Download

memory/2836-612-0x00007FFAB0BA0000-0x00007FFAB1661000-memory.dmp

Download

memory/2836-613-0x000000002B650000-0x00000000305AC000-memory.dmp

Download

memory/2836-614-0x000000002B650000-0x00000000305AC000-memory.dmp

Download

memory/2836-618-0x000000002B650000-0x00000000305AC000-memory.dmp

Download

memory/2836-626-0x00000000305B0000-0x000000003550C000-memory.dmp

Download

memory/2836-642-0x0000000006A50000-0x0000000006AFD000-memory.dmp

Download

memory/2836-641-0x0000000004980000-0x00000000049A7000-memory.dmp

Download

memory/2836-640-0x0000000004950000-0x0000000004958000-memory.dmp

Download

memory/2836-656-0x0000000006820000-0x000000000682A000-memory.dmp

Download

memory/2836-648-0x0000000006810000-0x000000000681A000-memory.dmp

Download

memory/2836-646-0x0000000006810000-0x000000000681A000-memory.dmp

Download

memory/2836-644-0x0000000006810000-0x000000000681A000-memory.dmp

Download

memory/2836-643-0x0000000006810000-0x000000000681A000-memory.dmp

Download

memory/2836-657-0x00007FFAAFC70000-0x00007FFAAFDBE000-memory.dmp

Download

memory/2836-661-0x0000000006820000-0x000000000682A000-memory.dmp

Download

memory/2836-660-0x0000000006820000-0x000000000682A000-memory.dmp

Download

memory/2836-659-0x0000000006820000-0x000000000682A000-memory.dmp

Download

memory/2836-663-0x00000000305B0000-0x000000003550C000-memory.dmp

Download

memory/2836-664-0x00000000305B0000-0x000000003550C000-memory.dmp

Download

memory/2836-665-0x00000000305B0000-0x000000003550C000-memory.dmp

Download

memory/2836-666-0x00000000305B0000-0x000000003550C000-memory.dmp

Download

memory/2836-669-0x00000000305B0000-0x000000003550C000-memory.dmp

Download

memory/2836-675-0x00000000305B0000-0x000000003550C000-memory.dmp

Download

memory/2836-672-0x00000000305B0000-0x000000003550C000-memory.dmp

Download

memory/2836-670-0x00000000305B0000-0x000000003550C000-memory.dmp

Download

memory/2836-697-0x00000000305B0000-0x000000003550C000-memory.dmp

Download

memory/2836-667-0x00000000305B0000-0x000000003550C000-memory.dmp

Download

memory/2836-674-0x00000000305B0000-0x000000003550C000-memory.dmp

Download

memory/2836-678-0x00000000305B0000-0x000000003550C000-memory.dmp

Download

memory/2836-677-0x00000000305B0000-0x000000003550C000-memory.dmp

Download

memory/2836-673-0x00000000305B0000-0x000000003550C000-memory.dmp

Download

memory/2836-671-0x00000000305B0000-0x000000003550C000-memory.dmp

Download

memory/2836-679-0x00000000305B0000-0x000000003550C000-memory.dmp

Download

memory/2836-676-0x00000000305B0000-0x000000003550C000-memory.dmp

Download

memory/2836-681-0x00000000305B0000-0x000000003550C000-memory.dmp

Download

memory/2836-680-0x00000000305B0000-0x000000003550C000-memory.dmp

Download

memory/2836-682-0x00000000305B0000-0x000000003550C000-memory.dmp

Download

memory/2836-683-0x00000000305B0000-0x000000003550C000-memory.dmp

Download

memory/2836-685-0x00000000305B0000-0x000000003550C000-memory.dmp

Download

memory/2836-684-0x00000000305B0000-0x000000003550C000-memory.dmp

Download

memory/2836-695-0x0000000004980000-0x00000000049A7000-memory.dmp

Download

memory/2836-688-0x00000000305B0000-0x000000003550C000-memory.dmp

Download

memory/2836-687-0x00000000305B0000-0x000000003550C000-memory.dmp

Download

memory/2836-690-0x00000000305B0000-0x000000003550C000-memory.dmp

Download

memory/2836-691-0x00000000305B0000-0x000000003550C000-memory.dmp

Download

memory/2836-693-0x00000000305B0000-0x000000003550C000-memory.dmp

Download

memory/2836-726-0x0000000007700000-0x000000000771C000-memory.dmp

Download

memory/2836-724-0x0000000007700000-0x000000000771C000-memory.dmp

Download

memory/2836-722-0x0000000007700000-0x000000000771C000-memory.dmp

Download

memory/2836-727-0x00000000077A0000-0x00000000079BA000-memory.dmp

Download

memory/2836-720-0x0000000007700000-0x000000000771C000-memory.dmp

Download

memory/2836-718-0x0000000007700000-0x000000000771C000-memory.dmp

Download

memory/2836-717-0x0000000007700000-0x000000000771C000-memory.dmp

Download

memory/2836-716-0x0000000007700000-0x0000000007722000-memory.dmp

Download

memory/2836-692-0x00000000305B0000-0x000000003550C000-memory.dmp

Download

memory/2836-689-0x00000000305B0000-0x000000003550C000-memory.dmp

Download

memory/2836-686-0x00000000305B0000-0x000000003550C000-memory.dmp

Download

memory/2836-732-0x0000000009650000-0x0000000009765000-memory.dmp

Download

memory/5104-524-0x000001FC71BB0000-0x000001FC71BCA000-memory.dmp

Download

memory/5104-523-0x000001FC700B0000-0x000001FC700C0000-memory.dmp

Download

memory/5104-508-0x000001FC6FF00000-0x000001FC6FF22000-memory.dmp

Download