5eed927d0bd22715ebe9721b5c231aa1d13e01ad30e8a4a295e1f13edd9e40e8

Analysis

max time kernel
148s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/07/2026, 14:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5eed927d0bd22715ebe9721b5c231aa1d13e01ad30e8a4a295e1f13edd9e40e8.exe
Size 5.3MB
Sample260731-r7ttmacb85
SHA256 5eed927d0bd22715ebe9721b5c231aa1d13e01ad30e8a4a295e1f13edd9e40e8
MD5 fc0fff1af2903cc51c788b579787399e
SHA1 2e041578186f57aa388909d9fed1bacd27b855a0
SHA512 83cb2e1e06b9399cce8839c7892b65c67ee8157d3b79b7e09d5cd56e40e18fb22397a4559eb1d76e6dc1c694df69fb7578f64f37ad584f1f5b9a74b7d300ab44
SSDEEP 98304:tugtneKB+ICDtPfeE/jowqK5LN1KQ0oTh2M9QrABlolllKHQ0ft6nu:1F+ICteErownP0oTcMsABqluQnu
TLSH
T105463308B3A809E1EAB3D13985565221D973B4254BB0D1CF03AC9B662F677D0BF3BB54
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence spyware stealer

Malware Config

Signatures

Loads dropped DLL 22 IoCs

pid	Process
1184	5eed927d0bd22715ebe9721b5c231aa1d13e01ad30e8a4a295e1f13edd9e40e8.exe
1184	5eed927d0bd22715ebe9721b5c231aa1d13e01ad30e8a4a295e1f13edd9e40e8.exe
1184	5eed927d0bd22715ebe9721b5c231aa1d13e01ad30e8a4a295e1f13edd9e40e8.exe
1184	5eed927d0bd22715ebe9721b5c231aa1d13e01ad30e8a4a295e1f13edd9e40e8.exe
1184	5eed927d0bd22715ebe9721b5c231aa1d13e01ad30e8a4a295e1f13edd9e40e8.exe
1184	5eed927d0bd22715ebe9721b5c231aa1d13e01ad30e8a4a295e1f13edd9e40e8.exe
1184	5eed927d0bd22715ebe9721b5c231aa1d13e01ad30e8a4a295e1f13edd9e40e8.exe
1184	5eed927d0bd22715ebe9721b5c231aa1d13e01ad30e8a4a295e1f13edd9e40e8.exe
1184	5eed927d0bd22715ebe9721b5c231aa1d13e01ad30e8a4a295e1f13edd9e40e8.exe
1184	5eed927d0bd22715ebe9721b5c231aa1d13e01ad30e8a4a295e1f13edd9e40e8.exe
3100	5eed927d0bd22715ebe9721b5c231aa1d13e01ad30e8a4a295e1f13edd9e40e8.exe
3100	5eed927d0bd22715ebe9721b5c231aa1d13e01ad30e8a4a295e1f13edd9e40e8.exe
3100	5eed927d0bd22715ebe9721b5c231aa1d13e01ad30e8a4a295e1f13edd9e40e8.exe
3100	5eed927d0bd22715ebe9721b5c231aa1d13e01ad30e8a4a295e1f13edd9e40e8.exe
3100	5eed927d0bd22715ebe9721b5c231aa1d13e01ad30e8a4a295e1f13edd9e40e8.exe
3100	5eed927d0bd22715ebe9721b5c231aa1d13e01ad30e8a4a295e1f13edd9e40e8.exe
3100	5eed927d0bd22715ebe9721b5c231aa1d13e01ad30e8a4a295e1f13edd9e40e8.exe
3100	5eed927d0bd22715ebe9721b5c231aa1d13e01ad30e8a4a295e1f13edd9e40e8.exe
3100	5eed927d0bd22715ebe9721b5c231aa1d13e01ad30e8a4a295e1f13edd9e40e8.exe
3100	5eed927d0bd22715ebe9721b5c231aa1d13e01ad30e8a4a295e1f13edd9e40e8.exe
1184	5eed927d0bd22715ebe9721b5c231aa1d13e01ad30e8a4a295e1f13edd9e40e8.exe
3100	5eed927d0bd22715ebe9721b5c231aa1d13e01ad30e8a4a295e1f13edd9e40e8.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\BrowserSetup = "C:\\Users\\Admin\\AppData\\Local\\Temp\\5eed927d0bd22715ebe9721b5c231aa1d13e01ad30e8a4a295e1f13edd9e40e8.exe"	5eed927d0bd22715ebe9721b5c231aa1d13e01ad30e8a4a295e1f13edd9e40e8.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\BrowserSetup = "C:\\Users\\Admin\\AppData\\Local\\Temp\\5eed927d0bd22715ebe9721b5c231aa1d13e01ad30e8a4a295e1f13edd9e40e8.exe"	5eed927d0bd22715ebe9721b5c231aa1d13e01ad30e8a4a295e1f13edd9e40e8.exe

Network Service Discovery 1 TTPs 2 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

pid	Process
2660	arp.exe
4140	arp.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3644_1606461855\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3644_1606461855\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3644_1606461855\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3644_1606461855\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3644_1606461855\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3644_1606461855\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3644_1606461855\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_3644_937776053\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_108_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3644_1606461855\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3644_1606461855\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3644_1606461855\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3644_1606461855\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3644_1606461855\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3644_1606461855\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3644_1606461855\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3644_1606461855\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3644_1606461855\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3644_1606461855\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3644_1606461855\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3644_1606461855\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3644_1606461855\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3644_1606461855\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3644_1606461855\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3644_1606461855\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3644_1606461855\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3644_1606461855\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3644_947028337\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3644_1606461855\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3644_1606461855\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3644_1606461855\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3644_1606461855\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3644_1606461855\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3644_947028337\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3644_1606461855\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3644_1606461855\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3644_1606461855\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3644_1606461855\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3644_2061248613\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3644_1606461855\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3644_1606461855\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3644_1606461855\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3644_1606461855\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3644_1606461855\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3644_1606461855\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3644_1606461855\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3644_1606461855\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3644_1606461855\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3644_1606461855\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3644_1606461855\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3644_1606461855\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3644_1606461855\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3644_1606461855\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3644_1606461855\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3644_1606461855\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3644_1606461855\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3644_1606461855\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3644_1606461855\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3644_1606461855\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3644_1606461855\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3644_1606461855\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3644_1606461855\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3644_1606461855\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3644_1606461855\_locales\mk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3644_1606461855\_locales\id\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4600	cmd.exe
3404	cmd.exe
3676	cmd.exe
5800	cmd.exe

System Network Connections Discovery 1 TTPs 2 IoCs

Attempt to get a listing of network connections.

discovery

System Network Connections Discovery

T1049

pid	Process
880	netstat.exe
1904	netstat.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3512	msedge.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 4 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2108	ipconfig.exe
880	netstat.exe
5452	ipconfig.exe
1904	netstat.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134299830825659968"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-552508041-2681165170-3229858294-1000\{527CD24D-483B-4BCC-BFE6-C838B03CBD7E}	msedge.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1328	wmic.exe
1328	wmic.exe
1328	wmic.exe
1328	wmic.exe
6000	wmic.exe
6000	wmic.exe
6000	wmic.exe
6000	wmic.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 25 IoCs

pid	Process
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	1328	wmic.exe
Token: SeSecurityPrivilege	1328	wmic.exe
Token: SeTakeOwnershipPrivilege	1328	wmic.exe
Token: SeLoadDriverPrivilege	1328	wmic.exe
Token: SeSystemProfilePrivilege	1328	wmic.exe
Token: SeSystemtimePrivilege	1328	wmic.exe
Token: SeProfSingleProcessPrivilege	1328	wmic.exe
Token: SeIncBasePriorityPrivilege	1328	wmic.exe
Token: SeCreatePagefilePrivilege	1328	wmic.exe
Token: SeBackupPrivilege	1328	wmic.exe
Token: SeRestorePrivilege	1328	wmic.exe
Token: SeShutdownPrivilege	1328	wmic.exe
Token: SeDebugPrivilege	1328	wmic.exe
Token: SeSystemEnvironmentPrivilege	1328	wmic.exe
Token: SeRemoteShutdownPrivilege	1328	wmic.exe
Token: SeUndockPrivilege	1328	wmic.exe
Token: SeManageVolumePrivilege	1328	wmic.exe
Token: 33	1328	wmic.exe
Token: 34	1328	wmic.exe
Token: 35	1328	wmic.exe
Token: 36	1328	wmic.exe
Token: SeIncreaseQuotaPrivilege	1328	wmic.exe
Token: SeSecurityPrivilege	1328	wmic.exe
Token: SeTakeOwnershipPrivilege	1328	wmic.exe
Token: SeLoadDriverPrivilege	1328	wmic.exe
Token: SeSystemProfilePrivilege	1328	wmic.exe
Token: SeSystemtimePrivilege	1328	wmic.exe
Token: SeProfSingleProcessPrivilege	1328	wmic.exe
Token: SeIncBasePriorityPrivilege	1328	wmic.exe
Token: SeCreatePagefilePrivilege	1328	wmic.exe
Token: SeBackupPrivilege	1328	wmic.exe
Token: SeRestorePrivilege	1328	wmic.exe
Token: SeShutdownPrivilege	1328	wmic.exe
Token: SeDebugPrivilege	1328	wmic.exe
Token: SeSystemEnvironmentPrivilege	1328	wmic.exe
Token: SeRemoteShutdownPrivilege	1328	wmic.exe
Token: SeUndockPrivilege	1328	wmic.exe
Token: SeManageVolumePrivilege	1328	wmic.exe
Token: 33	1328	wmic.exe
Token: 34	1328	wmic.exe
Token: 35	1328	wmic.exe
Token: 36	1328	wmic.exe
Token: SeDebugPrivilege	880	netstat.exe
Token: SeIncreaseQuotaPrivilege	6000	wmic.exe
Token: SeSecurityPrivilege	6000	wmic.exe
Token: SeTakeOwnershipPrivilege	6000	wmic.exe
Token: SeLoadDriverPrivilege	6000	wmic.exe
Token: SeSystemProfilePrivilege	6000	wmic.exe
Token: SeSystemtimePrivilege	6000	wmic.exe
Token: SeProfSingleProcessPrivilege	6000	wmic.exe
Token: SeIncBasePriorityPrivilege	6000	wmic.exe
Token: SeCreatePagefilePrivilege	6000	wmic.exe
Token: SeBackupPrivilege	6000	wmic.exe
Token: SeRestorePrivilege	6000	wmic.exe
Token: SeShutdownPrivilege	6000	wmic.exe
Token: SeDebugPrivilege	6000	wmic.exe
Token: SeSystemEnvironmentPrivilege	6000	wmic.exe
Token: SeRemoteShutdownPrivilege	6000	wmic.exe
Token: SeUndockPrivilege	6000	wmic.exe
Token: SeManageVolumePrivilege	6000	wmic.exe
Token: 33	6000	wmic.exe
Token: 34	6000	wmic.exe
Token: 35	6000	wmic.exe
Token: 36	6000	wmic.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3644	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5404 wrote to memory of 1184	5404	5eed927d0bd22715ebe9721b5c231aa1d13e01ad30e8a4a295e1f13edd9e40e8.exe	88
PID 1184 wrote to memory of 3404	1184	5eed927d0bd22715ebe9721b5c231aa1d13e01ad30e8a4a295e1f13edd9e40e8.exe	89
PID 1184 wrote to memory of 4600	1184	5eed927d0bd22715ebe9721b5c231aa1d13e01ad30e8a4a295e1f13edd9e40e8.exe	91
PID 1184 wrote to memory of 4140	1184	5eed927d0bd22715ebe9721b5c231aa1d13e01ad30e8a4a295e1f13edd9e40e8.exe	93
PID 1184 wrote to memory of 4456	1184	5eed927d0bd22715ebe9721b5c231aa1d13e01ad30e8a4a295e1f13edd9e40e8.exe	95
PID 4456 wrote to memory of 5628	4456	net.exe	97
PID 1184 wrote to memory of 5864	1184	5eed927d0bd22715ebe9721b5c231aa1d13e01ad30e8a4a295e1f13edd9e40e8.exe	98
PID 5864 wrote to memory of 4420	5864	net.exe	100
PID 1184 wrote to memory of 1328	1184	5eed927d0bd22715ebe9721b5c231aa1d13e01ad30e8a4a295e1f13edd9e40e8.exe	102
PID 5020 wrote to memory of 3100	5020	5eed927d0bd22715ebe9721b5c231aa1d13e01ad30e8a4a295e1f13edd9e40e8.exe	105
PID 1184 wrote to memory of 2108	1184	5eed927d0bd22715ebe9721b5c231aa1d13e01ad30e8a4a295e1f13edd9e40e8.exe	107
PID 1184 wrote to memory of 880	1184	5eed927d0bd22715ebe9721b5c231aa1d13e01ad30e8a4a295e1f13edd9e40e8.exe	109
PID 3100 wrote to memory of 3676	3100	5eed927d0bd22715ebe9721b5c231aa1d13e01ad30e8a4a295e1f13edd9e40e8.exe	111
PID 3100 wrote to memory of 5800	3100	5eed927d0bd22715ebe9721b5c231aa1d13e01ad30e8a4a295e1f13edd9e40e8.exe	113
PID 3100 wrote to memory of 2660	3100	5eed927d0bd22715ebe9721b5c231aa1d13e01ad30e8a4a295e1f13edd9e40e8.exe	115
PID 3100 wrote to memory of 4528	3100	5eed927d0bd22715ebe9721b5c231aa1d13e01ad30e8a4a295e1f13edd9e40e8.exe	117
PID 4528 wrote to memory of 5648	4528	net.exe	119
PID 3100 wrote to memory of 1112	3100	5eed927d0bd22715ebe9721b5c231aa1d13e01ad30e8a4a295e1f13edd9e40e8.exe	120
PID 1112 wrote to memory of 5060	1112	net.exe	122
PID 3100 wrote to memory of 6000	3100	5eed927d0bd22715ebe9721b5c231aa1d13e01ad30e8a4a295e1f13edd9e40e8.exe	123
PID 3100 wrote to memory of 5452	3100	5eed927d0bd22715ebe9721b5c231aa1d13e01ad30e8a4a295e1f13edd9e40e8.exe	125
PID 3100 wrote to memory of 1904	3100	5eed927d0bd22715ebe9721b5c231aa1d13e01ad30e8a4a295e1f13edd9e40e8.exe	127
PID 1184 wrote to memory of 3644	1184	5eed927d0bd22715ebe9721b5c231aa1d13e01ad30e8a4a295e1f13edd9e40e8.exe	130
PID 3644 wrote to memory of 6028	3644	msedge.exe	131
PID 3100 wrote to memory of 2180	3100	5eed927d0bd22715ebe9721b5c231aa1d13e01ad30e8a4a295e1f13edd9e40e8.exe	132
PID 3644 wrote to memory of 2000	3644	msedge.exe	134
PID 3644 wrote to memory of 3512	3644	msedge.exe	133
PID 3644 wrote to memory of 2000	3644	msedge.exe	134
PID 3644 wrote to memory of 2000	3644	msedge.exe	134
PID 3644 wrote to memory of 1624	3644	msedge.exe	135
PID 3644 wrote to memory of 1624	3644	msedge.exe	135
PID 3644 wrote to memory of 3980	3644	msedge.exe	137
PID 3644 wrote to memory of 3980	3644	msedge.exe	137
PID 3644 wrote to memory of 3980	3644	msedge.exe	137
PID 3644 wrote to memory of 4692	3644	msedge.exe	138
PID 3644 wrote to memory of 4692	3644	msedge.exe	138
PID 3644 wrote to memory of 4692	3644	msedge.exe	138
PID 3644 wrote to memory of 1780	3644	msedge.exe	139
PID 3644 wrote to memory of 1780	3644	msedge.exe	139
PID 3644 wrote to memory of 1780	3644	msedge.exe	139
PID 3644 wrote to memory of 1376	3644	msedge.exe	140
PID 3644 wrote to memory of 1376	3644	msedge.exe	140
PID 3644 wrote to memory of 1376	3644	msedge.exe	140
PID 3644 wrote to memory of 5576	3644	msedge.exe	141
PID 3644 wrote to memory of 5576	3644	msedge.exe	141
PID 3644 wrote to memory of 5576	3644	msedge.exe	141
PID 1184 wrote to memory of 3836	1184	5eed927d0bd22715ebe9721b5c231aa1d13e01ad30e8a4a295e1f13edd9e40e8.exe	142
PID 3644 wrote to memory of 5408	3644	msedge.exe	174
PID 3644 wrote to memory of 5408	3644	msedge.exe	174
PID 3644 wrote to memory of 2356	3644	msedge.exe	144
PID 3644 wrote to memory of 2356	3644	msedge.exe	144
PID 3644 wrote to memory of 2356	3644	msedge.exe	144
PID 3100 wrote to memory of 2808	3100	5eed927d0bd22715ebe9721b5c231aa1d13e01ad30e8a4a295e1f13edd9e40e8.exe	145
PID 3644 wrote to memory of 5860	3644	msedge.exe	146
PID 3644 wrote to memory of 5860	3644	msedge.exe	146
PID 3644 wrote to memory of 5860	3644	msedge.exe	146
PID 3644 wrote to memory of 4256	3644	msedge.exe	148
PID 3644 wrote to memory of 4256	3644	msedge.exe	148
PID 3644 wrote to memory of 4256	3644	msedge.exe	148
PID 3644 wrote to memory of 3240	3644	msedge.exe	149
PID 3644 wrote to memory of 3240	3644	msedge.exe	149
PID 3644 wrote to memory of 3240	3644	msedge.exe	149
PID 3644 wrote to memory of 5512	3644	msedge.exe	150
PID 3644 wrote to memory of 5512	3644	msedge.exe	150

C:\Users\Admin\AppData\Local\Temp\5eed927d0bd22715ebe9721b5c231aa1d13e01ad30e8a4a295e1f13edd9e40e8.exe
"C:\Users\Admin\AppData\Local\Temp\5eed927d0bd22715ebe9721b5c231aa1d13e01ad30e8a4a295e1f13edd9e40e8.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5404
- C:\Users\Admin\AppData\Local\Temp\5eed927d0bd22715ebe9721b5c231aa1d13e01ad30e8a4a295e1f13edd9e40e8.exe
  "C:\Users\Admin\AppData\Local\Temp\5eed927d0bd22715ebe9721b5c231aa1d13e01ad30e8a4a295e1f13edd9e40e8.exe"
  2⤵
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1184
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    - Executes a command shell one-liner
    PID:3404
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    - Executes a command shell one-liner
    PID:4600
- - C:\Windows\SYSTEM32\arp.exe
    arp -a
    3⤵
    - Network Service Discovery
    PID:4140
- - C:\Windows\SYSTEM32\net.exe
    net user
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4456
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user
      4⤵
      PID:5628
- - C:\Windows\SYSTEM32\net.exe
    net user /domain
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5864
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user /domain
      4⤵
      PID:4420
- - C:\Windows\System32\Wbem\wmic.exe
    wmic logicaldisk get Name,Size,FreeSpace,FileSystem /format:csv
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1328
- - C:\Windows\SYSTEM32\ipconfig.exe
    ipconfig /all
    3⤵
    - Gathers network information
    PID:2108
- - C:\Windows\SYSTEM32\netstat.exe
    netstat -ano
    3⤵
    - System Network Connections Discovery
    - Gathers network information
    - Suspicious use of AdjustPrivilegeToken
    PID:880
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    - Drops file in Windows directory
    - Checks SCSI registry key(s)
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3644
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2ec,0x2f0,0x2f4,0x2e8,0x300,0x7ffdbc5cc188,0x7ffdbc5cc194,0x7ffdbc5cc1a0
      4⤵
      PID:6028
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1904,i,18031719026750672948,6856736290140679958,524288 --field-trial-handle=2136,i,7895624530831998801,9428121869114273433,262144 --variations-seed-version --mojo-platform-channel-handle=2240 /prefetch:11
      4⤵
      System Time Discovery
      PID:3512
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1640,i,4914120560764055742,18077135819132484033,262144 --field-trial-handle=2136,i,7895624530831998801,9428121869114273433,262144 --variations-seed-version --mojo-platform-channel-handle=2128 /prefetch:2
      4⤵
      PID:2000
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2656,i,6578447758974703452,6676576085568478985,524288 --field-trial-handle=2136,i,7895624530831998801,9428121869114273433,262144 --variations-seed-version --mojo-platform-channel-handle=2252 /prefetch:13
      4⤵
      PID:1624
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3584,i,14045246356827782994,17201865637321878347,2097152 --field-trial-handle=2136,i,7895624530831998801,9428121869114273433,262144 --variations-seed-version --mojo-platform-channel-handle=3836 /prefetch:1
      4⤵
      PID:3980
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3592,i,16447818911403601134,10461539268490701545,2097152 --field-trial-handle=2136,i,7895624530831998801,9428121869114273433,262144 --variations-seed-version --mojo-platform-channel-handle=3840 /prefetch:1
      4⤵
      PID:4692
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4316,i,12826536147277303557,6180056705833360140,2097152 --field-trial-handle=2136,i,7895624530831998801,9428121869114273433,262144 --variations-seed-version --mojo-platform-channel-handle=4480 /prefetch:1
      4⤵
      PID:1780
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4440,i,2883614971498635979,106629632898561791,2097152 --field-trial-handle=2136,i,7895624530831998801,9428121869114273433,262144 --variations-seed-version --mojo-platform-channel-handle=4484 /prefetch:1
      4⤵
      PID:1376
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4332,i,14059118084017727923,1188673024814264493,2097152 --field-trial-handle=2136,i,7895624530831998801,9428121869114273433,262144 --variations-seed-version --mojo-platform-channel-handle=4448 /prefetch:9
      4⤵
      PID:5576
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3976,i,6587627049408721855,1455724137344353542,524288 --field-trial-handle=2136,i,7895624530831998801,9428121869114273433,262144 --variations-seed-version --mojo-platform-channel-handle=4012 /prefetch:14
      4⤵
      PID:5408
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5576,i,17046732324084607728,3628116983367177253,2097152 --field-trial-handle=2136,i,7895624530831998801,9428121869114273433,262144 --variations-seed-version --mojo-platform-channel-handle=5592 /prefetch:1
      4⤵
      PID:2356
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5772,i,13453290825685189226,1542205139881274650,2097152 --field-trial-handle=2136,i,7895624530831998801,9428121869114273433,262144 --variations-seed-version --mojo-platform-channel-handle=5780 /prefetch:1
      4⤵
      PID:5860
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=5604,i,3385501172396072764,8920143250963522654,2097152 --field-trial-handle=2136,i,7895624530831998801,9428121869114273433,262144 --variations-seed-version --mojo-platform-channel-handle=5964 /prefetch:1
      4⤵
      PID:4256
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6120,i,18365908911474988432,9288744310166377533,2097152 --field-trial-handle=2136,i,7895624530831998801,9428121869114273433,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:1
      4⤵
      PID:3240
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=4316,i,17326403094058324521,6220050699123495594,2097152 --field-trial-handle=2136,i,7895624530831998801,9428121869114273433,262144 --variations-seed-version --mojo-platform-channel-handle=2688 /prefetch:1
      4⤵
      PID:5512
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=4024,i,13745834962634339369,5768178851472577232,2097152 --field-trial-handle=2136,i,7895624530831998801,9428121869114273433,262144 --variations-seed-version --mojo-platform-channel-handle=6184 /prefetch:1
      4⤵
      PID:4664
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6452,i,14683953475298419629,3244828039807974793,2097152 --field-trial-handle=2136,i,7895624530831998801,9428121869114273433,262144 --variations-seed-version --mojo-platform-channel-handle=6496 /prefetch:1
      4⤵
      PID:3316
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6616,i,12569873187717384745,8893513420204577625,2097152 --field-trial-handle=2136,i,7895624530831998801,9428121869114273433,262144 --variations-seed-version --mojo-platform-channel-handle=6620 /prefetch:1
      4⤵
      PID:2884
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6336,i,6951660568522142980,16375544232372494822,524288 --field-trial-handle=2136,i,7895624530831998801,9428121869114273433,262144 --variations-seed-version --mojo-platform-channel-handle=6684 /prefetch:14
      4⤵
      PID:5848
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5124,i,6338021690680297283,9560731222907460576,524288 --field-trial-handle=2136,i,7895624530831998801,9428121869114273433,262144 --variations-seed-version --mojo-platform-channel-handle=6792 /prefetch:14
      4⤵
      PID:4140
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=7124,i,13775033813697119361,3301049510814757072,2097152 --field-trial-handle=2136,i,7895624530831998801,9428121869114273433,262144 --variations-seed-version --mojo-platform-channel-handle=7148 /prefetch:1
      4⤵
      PID:5392
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7704,i,11153639491680860646,12921098977758889671,524288 --field-trial-handle=2136,i,7895624530831998801,9428121869114273433,262144 --variations-seed-version --mojo-platform-channel-handle=7752 /prefetch:14
      4⤵
      PID:4052
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7704,i,11153639491680860646,12921098977758889671,524288 --field-trial-handle=2136,i,7895624530831998801,9428121869114273433,262144 --variations-seed-version --mojo-platform-channel-handle=7752 /prefetch:14
      4⤵
      PID:1388
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=7396,i,11199942654029647511,10557968316162109165,2097152 --field-trial-handle=2136,i,7895624530831998801,9428121869114273433,262144 --variations-seed-version --mojo-platform-channel-handle=4488 /prefetch:1
      4⤵
      PID:6112
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=6768,i,9438000307306220247,10326416191207857613,2097152 --field-trial-handle=2136,i,7895624530831998801,9428121869114273433,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:1
      4⤵
      PID:2936
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=7956,i,13718937844581811265,3921688044925924056,2097152 --field-trial-handle=2136,i,7895624530831998801,9428121869114273433,262144 --variations-seed-version --mojo-platform-channel-handle=4428 /prefetch:1
      4⤵
      PID:3948
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7936,i,3147046631428886252,15001508925281857184,524288 --field-trial-handle=2136,i,7895624530831998801,9428121869114273433,262144 --variations-seed-version --mojo-platform-channel-handle=5504 /prefetch:14
      4⤵
      PID:4164
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=7784,i,4558144656264717340,17505701966427675870,2097152 --field-trial-handle=2136,i,7895624530831998801,9428121869114273433,262144 --variations-seed-version --mojo-platform-channel-handle=4892 /prefetch:1
      4⤵
      PID:2780
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7964,i,12382681967751924301,13198933345380589821,524288 --field-trial-handle=2136,i,7895624530831998801,9428121869114273433,262144 --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:14
      4⤵
      PID:3632
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=5088,i,3360458193998538522,3992641410029658797,2097152 --field-trial-handle=2136,i,7895624530831998801,9428121869114273433,262144 --variations-seed-version --mojo-platform-channel-handle=8220 /prefetch:1
      4⤵
      PID:5408
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6612,i,2302028860777166733,4683525982994462379,524288 --field-trial-handle=2136,i,7895624530831998801,9428121869114273433,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:12
      4⤵
      PID:3896
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=5496,i,8373289849134142460,6966815891943577780,2097152 --field-trial-handle=2136,i,7895624530831998801,9428121869114273433,262144 --variations-seed-version --mojo-platform-channel-handle=5476 /prefetch:1
      4⤵
      PID:6052
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=5460,i,13776631193816757206,5629990414351466778,2097152 --field-trial-handle=2136,i,7895624530831998801,9428121869114273433,262144 --variations-seed-version --mojo-platform-channel-handle=5048 /prefetch:1
      4⤵
      PID:4784
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=9124,i,16620300441683143451,3830379700309539977,2097152 --field-trial-handle=2136,i,7895624530831998801,9428121869114273433,262144 --variations-seed-version --mojo-platform-channel-handle=3868 /prefetch:1
      4⤵
      PID:4248
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=9256,i,16764400910627632455,2883523380484171774,2097152 --field-trial-handle=2136,i,7895624530831998801,9428121869114273433,262144 --variations-seed-version --mojo-platform-channel-handle=9240 /prefetch:1
      4⤵
      PID:3664
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9232,i,10240884176468579031,2213899749216184430,524288 --field-trial-handle=2136,i,7895624530831998801,9428121869114273433,262144 --variations-seed-version --mojo-platform-channel-handle=9480 /prefetch:14
      4⤵
      PID:6516
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9280,i,12502500595623997110,6716992868848278637,524288 --field-trial-handle=2136,i,7895624530831998801,9428121869114273433,262144 --variations-seed-version --mojo-platform-channel-handle=9540 /prefetch:14
      4⤵
      PID:6684
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=7816,i,8419843371371643897,1177593396939302788,2097152 --field-trial-handle=2136,i,7895624530831998801,9428121869114273433,262144 --variations-seed-version --mojo-platform-channel-handle=7844 /prefetch:1
      4⤵
      PID:6608
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4476,i,9286143004363735164,13912082774492977856,524288 --field-trial-handle=2136,i,7895624530831998801,9428121869114273433,262144 --variations-seed-version --mojo-platform-channel-handle=4008 /prefetch:14
      4⤵
      PID:6588
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5216,i,12639818179637610516,4364581583878327765,524288 --field-trial-handle=2136,i,7895624530831998801,9428121869114273433,262144 --variations-seed-version --mojo-platform-channel-handle=9320 /prefetch:14
      4⤵
      PID:2412
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9340,i,1959985799862552640,8065327885246918491,524288 --field-trial-handle=2136,i,7895624530831998801,9428121869114273433,262144 --variations-seed-version --mojo-platform-channel-handle=9324 /prefetch:14
      4⤵
      PID:4884
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2532,i,2308897120354793968,13860618084224743014,524288 --field-trial-handle=2136,i,7895624530831998801,9428121869114273433,262144 --variations-seed-version --mojo-platform-channel-handle=6168 /prefetch:14
      4⤵
      PID:7040
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6912,i,9112500618229169945,16569225471725798490,524288 --field-trial-handle=2136,i,7895624530831998801,9428121869114273433,262144 --variations-seed-version --mojo-platform-channel-handle=6888 /prefetch:14
      4⤵
      PID:3356
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6812,i,14518969950469890165,3491092052390035029,524288 --field-trial-handle=2136,i,7895624530831998801,9428121869114273433,262144 --variations-seed-version --mojo-platform-channel-handle=6956 /prefetch:14
      4⤵
      PID:6896
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/gononstopukraine
    3⤵
    PID:3836
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:4884
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:5072
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/Go_nonstop_admin
    3⤵
    PID:4424

C:\Users\Admin\AppData\Local\Temp\5eed927d0bd22715ebe9721b5c231aa1d13e01ad30e8a4a295e1f13edd9e40e8.exe
C:\Users\Admin\AppData\Local\Temp\5eed927d0bd22715ebe9721b5c231aa1d13e01ad30e8a4a295e1f13edd9e40e8.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:5020
- C:\Users\Admin\AppData\Local\Temp\5eed927d0bd22715ebe9721b5c231aa1d13e01ad30e8a4a295e1f13edd9e40e8.exe
  C:\Users\Admin\AppData\Local\Temp\5eed927d0bd22715ebe9721b5c231aa1d13e01ad30e8a4a295e1f13edd9e40e8.exe
  2⤵
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:3100
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    - Executes a command shell one-liner
    PID:3676
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    - Executes a command shell one-liner
    PID:5800
- - C:\Windows\SYSTEM32\arp.exe
    arp -a
    3⤵
    - Network Service Discovery
    PID:2660
- - C:\Windows\SYSTEM32\net.exe
    net user
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4528
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user
      4⤵
      PID:5648
- - C:\Windows\SYSTEM32\net.exe
    net user /domain
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1112
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user /domain
      4⤵
      PID:5060
- - C:\Windows\System32\Wbem\wmic.exe
    wmic logicaldisk get Name,Size,FreeSpace,FileSystem /format:csv
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:6000
- - C:\Windows\SYSTEM32\ipconfig.exe
    ipconfig /all
    3⤵
    - Gathers network information
    PID:5452
- - C:\Windows\SYSTEM32\netstat.exe
    netstat -ano
    3⤵
    - System Network Connections Discovery
    - Gathers network information
    PID:1904
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:2180
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/gononstopukraine
    3⤵
    PID:2808
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:3664
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:1668
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/Go_nonstop_admin
    3⤵
    PID:1368

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2284

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:8

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3056

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:6284

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:6352

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Network Service Discovery

T1046

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Connections Discovery

T1049

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Bookmarks

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Bookmarks
Size 1KB
SHA256 e68f4ed53735a78e7484a5168bc2acb54867af9fd88990048a1c78b4d066021d
MD5 dfbd1dbd6305841eaf77c62e235fbe6d
SHA1 471e8879390de8f7b26a4e14be1183f6c865b203
SHA512 6689d72a35ec3fdd2c265e75151b78d0b0cd302349b52a239dadbf6b4acf1e581249ca21ddfe23b54e68c70bc7eebed66ce19c65345552c77e01d8f7fac43505
TLSH
T16421277BC92A9C0B48F892E492745B57F825172F55802CD339BC49ACDFB58121508B7F
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 16KB
SHA256 405e78fc32811ea1a39b8f539cb6d390a1576a18a0edbb353dc2783a3a8dd557
MD5 c1ccf90d1d850303a9d6d365308a2a89
SHA1 091e2128e612cdc361c855f9b85cbd75d006958b
SHA512 8e05e3d84b1be803e0ee3005262e4d6fbadda866cbd6d279f1810b3120dbcbe89ef282d683648746053462107ca3c56bf61459e98735bfcede2d3b11f7d819d2
SSDEEP 192:MBBSChclv7PT9FP2p8bJvl23sxNkNmOHDiu2669dh6C7hFgGdgk:MBk7Vv7CAJNoVNmOjip66/kvk
TLSH
T1B372DD16D5B44CFB19F6A23ABC3D4342F620872B11541C0B7BFD4A6C1F33A666187E69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1f3bc43c50f7d0fa02f98500baf5d78052a5560603459a9325b17de989d121f4
MD5 46a6445fd2c83830bb8c6e03f85bafc0
SHA1 46b07e35efbd47692fdc81ef0e82e2964da2831b
SHA512 800f82b05756fd6fab3fe29924147f0b86afeec21da661e646b431c6ca03903eb45bb09803f5cdaf3d2d1bb16f95d0f2e53a1f9ddde57505b0f3e1580c384ed1
TLSH
T188D02B1063208C04D441F13214D23311B1010833540C96440150E1384CB634206728CD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f8dff5315a0bd3856381f405c1a16257337fd6ff2d8043dd8bea22404cd35129
MD5 5e53a2cd139f0cce4f8ceab3e015f7da
SHA1 1bd884dbaaa352a724c53bfb8f4bfad2623c93f5
SHA512 27cc4cb62f9aa4af6b521efd824b001f3b689bae2ffe57263da18e2bb22d0b13ba656141d7e6ea1d1c202d5f461a44243a00d604f78bd5b04fe6b8512e260ac1
TLSH
T178D02B1463108D04D441F13214D13311B1110833A80C96440050E1284CB634206738DD
MD5 SHA1 SHA512 TLSH

Submit Download

Bookmarks

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Bookmarks
Size 3KB
SHA256 cf47c65a33c07d5667ce703406cb7c6edc3b02099a1c8dc91e6e108a3760f879
MD5 bcacb7ee72fcca35540910ccd38604d1
SHA1 f0d9387ce0d0f32f01034ae35626073fcfbc7f0e
SHA512 a86ff8909a83f0892307875c92a7397161328875b82b715f09c480427143927e8afb198db91ad1685f6dd085eb3a90d80700a30ed6cad6202749a5166775c413
TLSH
T13151443BD1278C5749F86296D8708387FE02432FE2424E43753D6ADC8F7693A6344EA9
MD5 SHA1 SHA512 TLSH

Submit Download

f_00005a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00005a
Size 30KB
SHA256 e9fca7e9968cc9fec3c7058516eb3c77cb9e3d9340cd0b8190571353107106ba
MD5 ff83ac7472e824fed2f102eba2f8d571
SHA1 a203324389f57958969844f1b708c3490ee38828
SHA512 b988a036283888405017509b249022c8f2387de82bbf160677b40a048ed631e508947784c26dec82f8d8698f606cd2d88a99b2bb5cf57ee3ff7a26ecbfe3fef1
SSDEEP 768:Tf4GGSdhfRpcFAO15fzK91tDka/4Q2gDcnxDVHHOE4om:Tf4GjNRprOXKj1kaSgYxNHO8m
TLSH
T114D2F1FBDE76A24288603A4ADD043958DED7C617857227CEEC1D8844D3ED49D0BF920A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00005c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00005c
Size 80KB
SHA256 39595a1806156cfcadf3cc4e20c5c3f3eec721386a0551790a15f025ba9402bd
MD5 14e39be019da848a73da7658165674cb
SHA1 e016473c4189a8cc3dbff754a48b3e42d68af25a
SHA512 828a383de549871aa80ec960a7e371ef47da96d01ebb9628d1484ceed9eb698aec5109b3de0b24ff8000610a2c2d633616c9fd28d380656fecbaa930cffed029
SSDEEP 1536:kAXTJvOGTDbA80pK0Mdq3wUAVa6BGS8EE/c0Psh6lufc4Ap7QgqHM7zxFX3xzOEm:kAXdJDn3QRoag8pcM6fdAOgq4xNu
TLSH
T17A830296752BB1D4592B012A9EC1F20294222F713DE7D02C15EE4F6E27DBD21698CEA2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000aa

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000aa
Size 55KB
SHA256 52a37b3a78eb5b59df3bdb129b9115c6fed9bec6ca62b55ae56d8c2701de5972
MD5 fdf2600d905a0faa060d691e0212e1a7
SHA1 62550f0993a219e265ff9a0795a4d9f49b28748f
SHA512 7118d2ea3aafe3d77709842da20acbe3faaf4c6c92a50ab05ecd4986916bbb92fe297a1b00357572683b02c61762cdf31dc425f03221dd169803252db5f04f7f
SSDEEP 1536:HYDhrXLgUVTf98fcANMQnJULOK+z2N2Vr8KO:HYDhrbZTF8ffZaOzM2Vr8z
TLSH
T1804301FE4895FEB9B094C7938D7131E02A664022453CBB71774B13B76368E7682892DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000cd

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000cd
Size 55KB
SHA256 c0b1c3c6995c24eabd1a6fcc4f00523e022b546cf1fa4fce6c30d04763244d1b
MD5 cfd886e1ca849a7f8e2600763f236d78
SHA1 c1fc2b10d20c529c01b465a1edc0ed2fe04f0bd5
SHA512 254e37e3650b2c87b524c96f517586b690094abf7c8e0539b050ecdc4c56c2593bedab7b1a830b827ddc19f1c3e05ff4096ebdf4cc969b5bc5fd33cb34e94fd8
SSDEEP 1536:WJG/KL/shmr0SyKV2i0Qz0j72A2+0G+gSRLBeFDP3:liL/8mV2i0ac6A25G+1LBehf
TLSH
T1444302EC6A22F9ADAB11E5E847349AC2F140D6DE34156293509EDB98200F24ECDCB75D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 9KB
SHA256 0fd7fe42c5b5c1c86a37810ebbb69f4b9b2eade464b59c15c50825ab568146f0
MD5 60b52253ec8d90024c82bc503c822562
SHA1 0c34701944c9c3c38930fdd18b58e20e97545f69
SHA512 214e1c59c4a65a1bc70ff98d50b69ab8dc778c9dca8b770e0398a4f6ea69b65293f7d8d0aca439568918458817e6ebeefa8a679491cf1887cc586fbee200c96e
SSDEEP 192:7+4X+rrOu78K1CGj8mZXUzwORwjol09ZMp3C:69XtxYGdEtA1MM
TLSH
T15A121B8992932880DF476271C0987E6C62FA43451AB75B739E656C722B1FFC3D2ED023
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe5bbeb9.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5bbeb9.TMP
Size 3KB
SHA256 6afaa9f56fb12a8ccdcbdf312ca9f304ba53e0a1fa02f68517d6e233c77498f8
MD5 361dd3eea852ee56c516e08f3e11e552
SHA1 c5bee35437efbd9ae16608b0b3e01e4de9368bad
SHA512 536e22f5b7d0f204f16d76c43bd9f5c65219085e01560ce6d37700cb391335ff891fc835a1bfc923cbaeed747cc82ce388a641732722e0716c5836def2d4565e
TLSH
T16351D89E03221AC0E39760B664E4158937F6960A0A075E335754AF337A4BF19E1FE103
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.tiktok.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.tiktok.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

60f0d5c0-2f67-4799-b0e9-1e7eba48056a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\60f0d5c0-2f67-4799-b0e9-1e7eba48056a.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 69ccf31d97ce1327ce41ea2627f813131edc1c9a68ad4f664cf907da36d25a4e
MD5 71dbc6528a6461bdb336a8bb4120b226
SHA1 29ad9e7ed2e9aead120cf25e9d72dcb6cc2a370d
SHA512 8906d2dd9579cddfa53cdb107a02ce0ced2ed2277c56c585cb340c0b0298e489ff6fe164325fbd981522af7cb0fa70ac553764d16b3e367e3b8d48eba17bdff2
SSDEEP 192:DRW55GcQmn3UaVNjh59d1aQQamr02Nnb/pHCvHkzy7v4OkveEF5ztB:DRW55GcQmn3UaVNn9raHamr02Nnb/pHb
TLSH
T1FC02BEF783E9862DDD1156F0A7156E2BCF680924432C3D6A89D4AF2BA7F2470E101B5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 7e9a8792a8175dab2c4ec12eb83e6ab5a29c2aa895a5dd8085e79964b784f3a6
MD5 fb347a1bb77737832f9947c2984bc43d
SHA1 6916034a8e91aaef7526740eed872b8332df08b1
SHA512 6b471cf54592d70551707421d33addfbc8714dfaca323c93a799c96c5d8bb1c1ca530a745fe5f5b4f290cf9f6754a489baad15128e8972dacaa0607197768f6a
SSDEEP 192:sxRERokCz/flsIiopRDde5lSdozoD8pKlA1qFoHg6+WNsDAFZmdXFn+G/YB9kCON:sxREKz/flsboHc5lfem53CLD/55qov
TLSH
T1A052C71B9A38997B4CC6D659FA15BF63D2F61022E2D01E48E7FC8A0C14E67DD6207C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 b49d314b19f18a333fc1092f51a12564520cca997f88a58efb0bc2d6ccd01d5b
MD5 bf61f51db5cd87f9e7b8b6d8f7b27fd4
SHA1 87b94e23bc7a58fea72f381fbac5951e7cc7a3fa
SHA512 f1b8573330610043252d6064fcd2f3ac9aa0ab15a7e6c99c0449ffe8f2d720a8d5aebbab746af972a1462be099a2035db307801eb4fd335861c0ece9302d4076
SSDEEP 192:sxR/RokCz/flsYiopRbZvRzoD8pKlA1iFoHg6+WNsDAF+8zXFnljfz/BqN9uOMGV:sxR/Kz/flsroHVdmm537JRf85qo3
TLSH
T1C152D71B6A38597B4CC7D619FA15BF66D2FA5022E1D01E48E7FC8A1C10EA7DD6207C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 21e0054cdf8301893f152e5c4e714f0b6df31f4f5fe0a03da9b46ebd0e64e2c9
MD5 96f7e701f1744d879e2b34d625ae5905
SHA1 cf4dad562f19ea77322bd63cc5033aea7c78f455
SHA512 308010fe571c0f2aa2fd495a3c0e59e0943a9062e94338ce386b5b136c40c7110bac93972c072e0bd07cb945c816925e6872cac8b873e0bc5b0d134865f353d1
SSDEEP 192:sxR/RokCz/flsYioSRbZvRzoD8pKlA1iFoHg6+WNsDAF+8zXFnljfz/BqNEuOMG/:sxR/Kz/flsroSVdmm537JRft5qoV
TLSH
T12552B71B6A38597B4CC6D619FA15BF62D2FA5022A1D01E48E7FCCA0C10EA7DD6207C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\4cc699dd486af2551d01b1a74abd5337c6e052e5\045b7812-0882-45bd-8b97-0f6a0ac0c485\index-dir\the-real-index
Size 72B
SHA256 df0ebc0a62921239342a9918ffcfd0d1adb40df29893b3db188459492dc1609c
MD5 2d69e37193c5b4451790a51267793e99
SHA1 2990de435e7a9ff9b5b9b8d65bc9030e07e48c1f
SHA512 125681479c6dc60c984c8795d0729172d04c414da8587e706ad9547146657855d36d2130f3e9c3f8d369d92a250f7f1aca3a45a7d4eba639b94880953ea4cff8
TLSH
T173A0021C435CA402C0BF8B70544505506750CD5011251B31DCDF226599722666345894
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5b4812.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\4cc699dd486af2551d01b1a74abd5337c6e052e5\045b7812-0882-45bd-8b97-0f6a0ac0c485\index-dir\the-real-index~RFe5b4812.TMP
Size 48B
SHA256 f747dcd24c22cf75e95845c62483da35d32da66a0573b73329455e255daef3c7
MD5 b24bdb70baec1aa65ba7b887dc9845a4
SHA1 10a0905370e6be9ce3bf37e83938274650c394db
SHA512 09cfc460d428a2dbdc77c30189e91808a24fd38c345313dced2ba336e741534f5e6f2662a6a34ada1c9d937ab6974f2e865685dff0a24b9fa42c87607cef3d86
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\4cc699dd486af2551d01b1a74abd5337c6e052e5\1070f428-b4a2-47bc-abd9-6d65d2ddf977\index-dir\the-real-index
Size 72B
SHA256 b186d4b0528bf9daead64ae1997e769cde1e4c008a01ce2653c5af82c8428c73
MD5 6795ece2e895c867ea38aebabda74a6f
SHA1 e0c57e558d85b2f17c78be6db41795a7de15e418
SHA512 98109c2be588f2d4602b4b6280a434db9ba17bc428a4dbc2390d79633a4460a1d5b7368e8dd19fad394ff78033d78d254425c262eecd661562f252d72cea1bdf
TLSH
T1C3A00225A6444101C106CE71515221C23BA1FC66158783324CD57149AF5865A97225A4
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5b5ace.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\4cc699dd486af2551d01b1a74abd5337c6e052e5\1070f428-b4a2-47bc-abd9-6d65d2ddf977\index-dir\the-real-index~RFe5b5ace.TMP
Size 48B
SHA256 3aff66689c2ff379d9d701037bc00e6964eabe0cbe15275de3878000036bca7e
MD5 cb1545211ee9824b5d683146b15d5c46
SHA1 2b7f50c3c6125af63742a0707bac0116d50a6819
SHA512 6313bbc2516bcd015c933d4ff8a4e611faf324fa8f12d19c8d0946359ff11cf751bc854c9eaf9b57b9fce2c028b0659325948e8930d2894dfd5d0cdf2b871418
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\4cc699dd486af2551d01b1a74abd5337c6e052e5\index.txt
Size 276B
SHA256 712c2ab89edba3e79b94be4ab64a5b73e0a7ba48b7166459d7d56848562dd2f0
MD5 01907cba4f4518706d165b994d12e7fb
SHA1 d5bf57fee4dc34bf953a623dc29e032efe05ca52
SHA512 53b1986a875358e41109e94cdc0cfa248262d4b0f26f95c34e661971f4c7aaa016fdd4d2f64523bd666f8dcc3b531bea0606305434f0bd01964ec54fe56b6da5
TLSH
T1CAD02B1316E95014FFB0AEC875B1A1808D73ACDADCA748CE488272980BF3D418511BB7
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\4cc699dd486af2551d01b1a74abd5337c6e052e5\index.txt
Size 271B
SHA256 96b7edafe8b32503dd7a61815307946d9988ac1874465c194b3ccb4a01afae9d
MD5 9fffaab4f0aa4ba868be98b8026e8cf2
SHA1 3fcf1a868c794c6da001901aeaf6c3efd50c0608
SHA512 617eaa7ecf70787be3eeb7c2cb4cd8f676e6f4e5346dddbd9747522be1240848201b42e1bc86eb6f448a8c8ada38ed1d38f52efbf230eaece7d024230e3163fc
TLSH
T1F5D02B135AE95014FEB0EEC435B5A1548DA3A8D9D8B388CE4C4253980BF3D408811BB7
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5b0646.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\4cc699dd486af2551d01b1a74abd5337c6e052e5\index.txt~RFe5b0646.TMP
Size 165B
SHA256 9ccd225b906a9c57d88031b9ea110bb8e9b49631972d18e0fbedc6f9113e7ec4
MD5 2aeb5f75ce8be0ac26c5d9ec92b2adbc
SHA1 ee78c975e275dbec489e9eb1d41f0b470afa6587
SHA512 6d61ad44b244816f87edeebc47bda8c663b83eaa71546e9949eaa0f91db74a54411aedde1e7aeef4ed68c5d331353be968453cb7856fa378640cbdac472f1b98
TLSH
T143C08C2B167A8018DEF0EDC478B8A1404E7B9EC4ECC289C7A48732D80631D925414FBA
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 288B
SHA256 cb10a6125ac90034a1b49323239c7e986d84982fa0e988f80d80d650ae84fc55
MD5 b971d41eb412bc976b034de987f755dc
SHA1 263aad242d3a65bc8532233ba1ce13fbce4db6dc
SHA512 e9aa4f645581c92d16685369846222309fa230b644dfaa3a6134face5ec3e56717d8d9cfd7520eb007367a4b6ffcd984c565ed70c8b118f669d7505a22c02cdb
TLSH
T16ED02202CC0C8201D8009A3490A212EB6324A8A8D90AA3A8086C348D3EE30924E86205
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5b4284.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5b4284.TMP
Size 48B
SHA256 8e54f3eff275b988abb75144b270810d7f21be1fb725d47959672c7279ed148b
MD5 1cb3abfb5d305b371b19d1900fe2c26f
SHA1 337e99914f76d559290bbeec6f55810247f38e4b
SHA512 31ff588ee6afb9c142fd0aec9cecaf7ea0ab669265113c3386d1bd413aa04c6be24cb18019d0250332a6e4f863dd5dc5e46e17d4d88e7ece3e2605449d834cc1
MD5 SHA1 SHA512

Submit Download

b3ccc8d1-25ed-4391-9068-80efd33bf941.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b3ccc8d1-25ed-4391-9068-80efd33bf941.tmp
Size 27KB
SHA256 02af82f9cb8c2310ad606488c27cbe537d440e8a8e8cf65ecc48be22a3b33692
MD5 a4998c90c704c59b306057d62d284742
SHA1 85e995e6e45c86caf04d7e81a715dc6894698fc5
SHA512 38643f39fe7a3a4c4c25a6b3714711be34ca5ed11073d70c0808d7f4f4639371ec5e3f53cab2e8ab1ecea94e58d92767784631defa359110bff735d94976f38a
SSDEEP 768:jC+vAN7pLuL7JQWgQ+f4+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVyQqcgroZG:jC+vA7E7JQWgQ+f4+u1jaxVcr0
TLSH
T1AAC2EA7B640DCB7F4F800ADDED197E9B6DA802CB5698CD8047FED41C02C6BEA52194DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6cc843b8-ad23-4aff-b634-0639d640a8af.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\6cc843b8-ad23-4aff-b634-0639d640a8af.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 291c9a5cb7a286569f3c1f286c7e37e84e239ff30c08cf4e43fb6b728d1a5ca3
MD5 36d6a86df7f2dde3f2a1b745456862b9
SHA1 b24ff90b302e22bbdbe0bff2900b1fb6a9a8b626
SHA512 a3c67f24d78df34ec30e9a8c7d9e06decd71e54168ae80b76653c5a2545561d9023272724b92f9021980a64f1883abba2234d3e7c5247d5f8254bbd5177f5e41
SSDEEP 768:0rv+4UNbdD3hyHBNp8+p3bd66j+4BRv86aLIWb2bwClW:0bsbp3mBL8+p3Z6n4yZ0wT
TLSH
T1F803BE72F4A8ED739CEAC644B14677837FB821A399C10ED4D4D96B4E014A29E370BD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 ffd35ade727b0e5fb1cb4346329fe88784b7616c462d1af80d97ed8fc31e055f
MD5 0fa674cd2999432f73ec9d761575ddf4
SHA1 05ba72c64fc6fe5abe74f9de4440249896be4b2f
SHA512 434ab70462c97809e6d6a0a6601dd65177a4ed4accdf76c7248c01004d728414febff54c808eb88ade1d78ac0435f12907e475a7ef51179c99f1d67b05ae3316
SSDEEP 768:7FQn3kwgY1m8p8+p3bd66j+4BRv86aLIWbb9MX:On3Ya8+p3Z6n4yZb+X
TLSH
T12A1316F298D78936D8AE8743A37D6E429EFCD063B5845984B7C85E0CCC861BFD706821
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 2e5ded2c3a6719097497987e6c0779b9034d2a5277b174f721d5cc0313999209
MD5 ee81fdd2e5dd0f8037d8bc4a41ee7077
SHA1 0d8a61ea8cad0748b1ff318283f6a5e227e2694e
SHA512 fb67aae1f91b15d7124f9be066eaba7fd2f0b86e972d6f1d1cfabed11210298eb83f20af2093360e7e7a82e6d12b7f2cc4ed492226dbb10017c65f1d7715b9d6
SSDEEP 768:uc3vWHBJp8+p3bd66j+4BRv86aLIWbb9MX:uc3cB38+p3Z6n4yZb+X
TLSH
T109F2BF71E8A9DD738CEAD604B19637836FF42067D6C01EC8D4DCAB0D04472AE2B0B836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 0d7badfc919d676a88856773904bd399bf4ff911618ec86267f0491e9e5d63eb
MD5 1d341fd0fa3a40dbdd5ab7d2ec32f767
SHA1 7f59ea5995f604616ee872c61c1dd91a0fcf296a
SHA512 f49043ce22086c9ce3f113763d8ec85d83aa0292505bae5718cd2c5a915e42db72f60ebf0c252e852e6c370dda7e8c3e69883fbd2f6c8e16769c92eebf622e01
SSDEEP 768:hc3GWHBJp8+p3bd66j+4BRv86aLIWbb9MX:hc3PB38+p3Z6n4yZb+X
TLSH
T107F2AF71E8A9DD738CEAD605B19637836FF42167D6C01ED8D4DCAB0D045726E1B0B836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 a6afc5b7f7c3d4abccf3e54d5fa5f6de3bd524d0a322f722353c22a99bdf2350
MD5 8abf3d325c6e36f112eb50facd4ce8e7
SHA1 3676e2cdc578c81fa562b485b9f4c465275419b6
SHA512 3e1fd9fd7df48de33c1c560ec25b28fc7be041dfa9bbb7297e72af30e0ffdc20dbfa0b6ed6a3808ecf0fe63f85e78474d7fecc0c5f8f1f75644615c577f716eb
SSDEEP 768:Irv+4UNbdD3xceNp8+p3bd66j+4BRv86aLIi72bwCl1:Ibsbp3dL8+p3Z6n4yV0ww
TLSH
T1BA03CE73F8A899739CF6C644B2467A433FF821A396C10EC4D5DD2B4E419A19E630BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 896caf48859a0704b9b3dd13321ffbd84340e0c00875a55c142f3bec4723ab34
MD5 2a7c0883d1fa7bf33150cd5fef3714dd
SHA1 e14b9cdf3dbd2b8d73e0620d3f7a3eaf3496e19b
SHA512 ec9e445fea0866bd8f604b72c6b249f4134c292d26d42ef606992057dd11d3fcb214cb91a77af619caa6137296e4dae56804f73affa19c0b0406969cf8fa1cb1
SSDEEP 768:Orv+4UNbdD3BuHBnp8+p3bd66j+4BRv86aLIWboLw:Obsbp3yBp8+p3Z6n4yZAw
TLSH
T16D03AF72F8A9DD739CF6C644B18677837FB820A395C10DD8D8D86B5E019A19E270BC23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 b40415a7c848a48d3975dfd2f591a1bf8ff57802a30f5ea1c49be4fb35b9e16f
MD5 d2c596018e8a2eb42a2385ea585d8468
SHA1 5423ad56db85760489050e5659fac5c64874c200
SHA512 6da36a6e16dc7c9f762c521a48d4be805162560fa2d7c1c45b6409b0b62c95144abee1bb4ffb29bbad3a516f1c824beb1ca6f3bd5a03923b80c284480110a75d
SSDEEP 768:ic33WHB3p8+p3bd66j+4BRv86aLIWbb9MX:ic3EB58+p3Z6n4yZb+X
TLSH
T1EAF2BF71F8A9DD739CEAD604B19637836FF42067D6C01ED8D4D8AF0D00572AE1B0B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f725e2e4-55ad-4f45-8e2e-235f8710ef49.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\f725e2e4-55ad-4f45-8e2e-235f8710ef49.tmp
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 ea13d57b11af249f90704dbcafd354c5e80b10358db7edb9eaf8f6fd597eb1d4
MD5 ae3a19c226264ff6cb64877f1e7e7243
SHA1 f993431dbd09200fd92b7a04ee6711a54ad95cc9
SHA512 97e5dbf0663585afbb5e0f2b5a36192624eb2c898462abef65225987df632d30f74f05ac5a71175c4c59f75d9ae6d2e640d168e479cb26b9a6857c71efda029a
TLSH
T1C1C02B85CB1E0C854E78153D48420B2727819F0030508534445A490C41741CE00888CF
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5af5850f-7f01-4c70-a051-fb67c9dfc7cc.tmp

Path C:\Users\Admin\AppData\Local\Temp\5af5850f-7f01-4c70-a051-fb67c9dfc7cc.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI54042\VCRUNTIME140.dll
Size 94KB
SHA256 ded5adaa94341e6c62aea03845762591666381dca30eb7c17261dd154121b83e
MD5 a87575e7cf8967e481241f13940ee4f7
SHA1 879098b8a353a39e16c79e6479195d43ce98629e
SHA512 e112f267ae4c9a592d0dd2a19b50187eb13e25f23ded74c2e6ccde458bcdaee99f4e3e0a00baf0e3362167ae7b7fe4f96ecbcd265cc584c1c3a4d1ac316e92f0
SSDEEP 1536:yKHLG4SsAzAvadZw+1Hcx8uIYNUzU6Ha4aecbK/zJZ0/b:yKrfZ+jPYNz6Ha4aecbK/FZK
TLSH
T144936B4A76A442BBD06BD274C1E34A1AF770B8408B3053CF03B686AA5F67BE15E3D355
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI54042\_bz2.pyd
Size 84KB
SHA256 cb2b8853ccf149b0b175769cb8ed6e2f9c2cbec0af3d8835c43570fd91da1b4f
MD5 4fdf3bc5548f98264ccedca2e400e8ef
SHA1 9254a0a3f16a0dabc11504bbd8bd3b425702a0b6
SHA512 3bc15f142da4708c9e564fded1207f9502c5efb93c63e9db34caa931ee3d628c3eef66dc2adb42d796f7a2e1908bbe26d917aecd151fbc241d9efc67c8a7f63d
SSDEEP 1536:U7Sz7efjsrb7QMpfQKeGPHMD6p4fu718oVABfx1iE3nBZIuMVzbyjS:UeztXcUfAG/MD6pUu76oVax1iE3BZIuu
TLSH
T19E838E92F3A056F6F09BF1785661474BE731B80D4390C3BFA2A8429B1F12B517D6932E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_decimal.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI54042\_decimal.pyd
Size 265KB
SHA256 5f8e850820050cabe5aa36838ba9abd62a4f5d5d2aa1b337cbb795077e1d48bf
MD5 2dabdd7b03ee2d8328fad17bc9cf9970
SHA1 b609d222807eeff2dc4ea3a6ab4c36a9bf2067a4
SHA512 4d89f284acd6118fd0a5081cb52dfa8f4453a7980e04b91e4592f8f05fe620729db2bd9178b7df61c1b0b0990096780a81f49414a551b3d9bef6397f3342c60a
SSDEEP 6144:thn7Ki4/DOyyraBcGaWdK9iaweDmLsdmg9qWMa3pLW1A1AomNaZ:OiSOPraBxVKdyLsgiN6aZ
TLSH
T1F6445B56A3490CA4EA73807899979B47E7F278940360D7CF43A48AA73F53792737E348
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI54042\_hashlib.pyd
Size 64KB
SHA256 9a1ffa72a808fdfe88dd8f9e7083b285edf246df07c35ac032dc45d905f58fce
MD5 cc06750ac9811e6b0ebe1482c032b0cf
SHA1 db0e43e4c0082d44b9385d6d94a68ecc72fd99e7
SHA512 ededec073f5651cdf2f0ed6a74278b0df630871f2ccad7d831a908a7e3efa4e5bed96d38647706add29963a515c9a13051f1457ae934d5ff75129e41bb4cd8dd
SSDEEP 768:QDyWRAgSG1MbRSoc0NK5ERnzJXkNeQWC3YcOKPte7F8dCmjDzoxIuYIh6DG4yjXE:SnuSqe4h3QV3jOqm8dCuzoxIuYIcyjU
TLSH
T11253494A968400E4D87741BDD8A31E97E671F5102701A7DF83A4C28F2F23BD367BAB59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI54042\_lzma.pyd
Size 159KB
SHA256 e352c77f7810ea83617ed096626ac9c3d628726def47551f90741d201c1f3b3d
MD5 ce4a35fc25d50497e8be0e75ff8d61b3
SHA1 19325e4bfe74289f062b657df082e47ac7bc14eb
SHA512 380b2be74d440b44c0abad4cfe3cddffbb36ca53d844dfe262b869cff0309f0758a86d220eb8c19eea4f18e823906c90ca2c8566e8e59e5c3e25ddc9d149cdb9
SSDEEP 3072:YaV4kBVeMMbwjQneCHPDLORDEUznfo9mNoRrL4rEZIuD1N2:YaV4kBVHMKQZrUDEKwYORwrEW
TLSH
T189F32886B394F0E6F3328C78DA624F17D6F578190320929A02CD877D2B1F7755A2A727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI54042\_socket.pyd
Size 78KB
SHA256 acb377fd6967b2ce819601c7d6a102d30af570eaee9e312e383f34aecd5df142
MD5 439b4d756cde64fba441e640df56dd60
SHA1 881dbf2366915399b3bb8be6083f94f46eebaaf7
SHA512 ef4b78e9f6cc740696836062dffa956ee5b9d1f0be8d809497ea778fea80761fc5b3baa938756344edc18dbaeeae6fe660f2ee8fcc25e0d7985e55f4461e3c33
SSDEEP 1536:ABCJoimjxvExWxAd9/s+++prjDmrpZMP4kVIuBw/yyO:Tai6lfAd9/sT+pDmrbWVIuBwY
TLSH
T11A735B01A6A051F5E673C076C6678F23F7B0F4801394A39F4164DA6A1F237C2AE3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI54042\_ssl.pyd
Size 151KB
SHA256 75ae15b70eaa1950cf259fed95ade499d7c6dfefffdf4c3292c46bd24da25902
MD5 5e2ee0a0277ffe2bd854abb898310d43
SHA1 774cf06c1e6f68c86bf107353e3f4e9df0ec40dd
SHA512 4b593b35373d69b59dd01164e09919862ac76f0e38a97fec458265add610a0dc9bca7287462668eea5b312c741e3c3644019df2f31b20bc6f764c95c968792bd
SSDEEP 3072:++WZEKFRXUxwSYQyDiyqoIpy07jhpfsEW74OH70NmHh4kwooSLteSdN1SG4ZIuM/:+oKFRXUxrZyDHKvhp2744DthN1SG4k
TLSH
T125E37D43B2441AF7E813E4BDC2634A02E7A4F105231197DE85D6DA860F07B46BE6BF67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI54042\base_library.zip
Size 711KB
SHA256 dc1e739bfe4fb7fc971a983bcd22913e24f7a127f6abe28d816c36a8e0f5cbf0
MD5 2fe4ad01153c8474066bf1f26c615de5
SHA1 fb3749321b2f8d552feabc464435d04a0ecd1609
SHA512 9d4b60cab26906e5f0c643344c749eee38c80fd2c01597271c4911ee9355d077fe0704b1d5ce70e6499a31adb70b0e8335837c3259b5e3fc5882c28aa8fc7fd2
SSDEEP 12288:XhGoQDShh7m4axUfyEek1Q2osQNRs54PK4I11V0condYQX:UoQDSG4sUfyEet2osQNRs54PK4I11V0Z
TLSH
T1CFF4F9807EA56DC7FD09F37D812ACA1C1A6A5378DF88D9036D43C39A3C4A3D41D66A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI54042\libcrypto-1_1.dll
Size 3.3MB
SHA256 664c3e52f914e351bb8a66ce2465ee0d40acab1d2a6b3167ae6acf6f1d1724d2
MD5 63c4f445b6998e63a1414f5765c18217
SHA1 8c1ac1b4290b122e62f706f7434517077974f40e
SHA512 aa7bdb3c5bc8aeefbad70d785f2468acbb88ef6e6cac175da765647030734453a2836f9658dc7ce33f6fff0de85cb701c825ef5c04018d79fa1953c8ef946afd
SSDEEP 49152:6uTKuk2i4IU6ixsOjPWJJrf129Pr1+leV6E3AH/vgpdbZ/NPL0asQa1CPwDv3uF3:6XH+n9Z+1obZ/10asv1CPwDv3uFfJLx
TLSH
T1C5F58D5AA3AC1184E5FAC13CC9574727E7B1B45A83B09BDF08A681780F27BD6363DB44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI54042\libssl-1_1.dll
Size 678KB
SHA256 b7c0e42c1a60a2a062b899c8d4ebd0c50ef956177ba21785ce07c517c143aeaf
MD5 bd857f444ebbf147a8fcd1215efe79fc
SHA1 1550e0d241c27f41c63f197b1bd669591a20c15b
SHA512 2b85c1521edeadf7e118610d6546fafbbad43c288a7f0f9d38d97c4423a541dfac686634cde956812916830fbb4aad8351a23d95cd490c4a5c0f628244d30f0a
SSDEEP 12288:EwIGh2Hjnl6uk51iNXuAX7TBElV57sldbeMR29XxSNreSZYrRnU2lvzsT:Uk51iNZyMR+keSZ6U2lvzsT
TLSH
T1E7E43A95ABB514A9D9E6C17C8A534A33E3BAF41413309FCF0661893E0F177D82B3A758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python39.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI54042\python39.dll
Size 4.3MB
SHA256 8314174dacfc1c4f177be8266c78f147621cf577a39742642a76ec27e7b87b02
MD5 789b4ecbce732a7e8479e8909f097d16
SHA1 a79c2e1ca0ad675a48f3bba0fbdeff1b888f0e74
SHA512 b9b57ff21735c06f4b3957cdd5a3ab54602a7141f1792de52aea0e6fc41be957070b958ab75b1a26a302b6fb17a02e9a187ad289a6af0c72a5ade43b4bf06e6d
SSDEEP 49152:RvVhdnYR7v/ZWQqC/KVBCNE4LWKFj7X6YMpYwgzxsDnfu3pbSLIlTrr4z9IE3uju:/2v/ZWrVVYRKyIFCDHuoPHVM2bwYJk
TLSH
T138267C22A35401A4DAB79477C5278707DBF2FC512B20E34A41A4BAD52F73BA317EE706
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI54042\select.pyd
Size 28KB
SHA256 2a451074afe05260fc274fba6851f8f96cd46ad32b657d876dd55f237244b6e3
MD5 db414debf94abe8d159f42f71fd4c292
SHA1 1b585a565d6c769a9323885d0f3af2038fb06dfe
SHA512 16a35bacd1511a327dd490304b48d7b2b87e906e693283950c46b3ae4da5db1f68d50b937f3e31329d106e92751456a9f31637495b2b8190b5f2a4a49c9146a5
SSDEEP 768:OYyAU1265whK9HqQOc+VIumGHDG4yjfhs:u86GhWKQOc+VIumGhyj6
TLSH
T112D25C55AB6428D2EA77C131A4D19F0FE934B6174710C3CF5269C2691F237C27ABE3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI54042\unicodedata.pyd
Size 1.1MB
SHA256 3efd2cfb8f29e914e002a244b2072ad9ed595abcb9179759020f3a10c9089204
MD5 8a888fc01d0ed182f4c6e3ddc27665eb
SHA1 1c5af90831ca65c4ece4c0b23110ad81c28d281c
SHA512 e3f85f612a02681d972f26683ee69b9f454497e0c32e8d44a8cc63fa496604467a3be3cd924fdb503d1eb6c9af030d44c462da0bdffed3d83e6b42c211ddc19a
SSDEEP 12288:yezMmuZ63NTQCb5Pfhnzr0ql8L8kkM7IRG5eeme6VZyrIBHdQLhfFE+uom7:yezucZV0m88MMREtV6Vo4uYom7
TLSH
T164355909B9C24EE2E89B067940D3117B2F61C1720F1B6B4F76A5532D9C763A34EEA53C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3644_155379302\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

browser.log

Path C:\Users\Admin\AppData\Roaming\desktop-sender\browser.log
Size 128B
SHA256 20a27050987127a9a5d48e9e7c790e823defe1023aa160e28e1018c0bd37fcd1
MD5 1dd2db05a2afd678b1b907db6558a8e1
SHA1 3c680776d565bc1a1080d82dbd3b376fb876e665
SHA512 3e61be393ebde9522d76e45c1935a69dad3d0bf1f26bd18f0cd338580824cfc014d686e9b53862ef4c9b4dd4ee5bf8a66f04e35533e740b46af0eb99bda2ff75
TLSH
T18EB092CB5D7F3DD1A34817067880182A72F46930A4791E0AB7F6288B0E08A0D8FEC938
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Roaming\desktop-sender\browsers\Chrome\Default\Login Data
Size 40KB
SHA256 06aeb2f9c1ee642348c091fb27541c143545354c273055ce30832e0f61aedf81
MD5 ba979c77c714b67908bc582ec373c723
SHA1 ff6b59b47b8d3ad488eaa7a4b0040a9a93eb19fe
SHA512 fc6b860dcb9e00c6ab7aa72555fb17921bbb8b1276acf0ab5fcb20b5f2dbd4bf71946c5c4fcfc46310f8de29491a63e46d43805070d19f290070f60077f80b01
SSDEEP 96:wDaCn8MouB6w9fUP8iZqmvJKLPeymwil:wDaG7Iw9f/iSi
TLSH
T16103440F2E682801C8B94632BCF124E62E7DA03E4F13EED12CB504659D75C52B52E5EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network_Cookies

Path C:\Users\Admin\AppData\Roaming\desktop-sender\browsers\Chrome\Default\Network_Cookies
Size 20KB
SHA256 2ade7ad8f15eccb025798893f007bc3a04679504411bbad75e4d1f35cf47a65e
MD5 40c4021f7a23fc1b361904d0519eb714
SHA1 eb811f03ded3cf26dc320980307be2b2f9335df5
SHA512 6cfd57cdb92272641c9ad007872cf25c11579c5bfd44935b988559b5e0cca1f4eff976265ff2c2b002f5176af6c8c21961f58e8fb108fcedf4370f9d640186ff
SSDEEP 24:TLf91kweka6cLbXYFpFNYba5+6UwcQ8PAl5fB:T79aw/aHLopFMavU1iB
TLSH
T1B392AD8E1F343620C0F44B33F9C249972E7C212C93637A89EE5410F3DD965ABF50A5A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Roaming\desktop-sender\browsers\Chrome\Default\Web Data
Size 138KB
SHA256 f02d21bc04af97d86c8d1d3849061cb55a03473099b5580aa72b237a245049f3
MD5 a97da95ef79dff7be4a0663616ea1ad4
SHA1 caefd602ee83089faa61d012465b789d1fd019f3
SHA512 f49a37d160dbecb1455db3a96341bd500ead73c40c9263c62c119c860350d38bf1b3d655138114db210224eb4cdca9b2a1bef82957211a082d611dadc33b6578
SSDEEP 384:zeuvBnhJsueMEGvIW1DcP2OQKSPkVum8nX:FnbZeMrv/hGtQKenX
TLSH
T195D3864B3A747002EDE59A721CE050BF5E3C716D8F5595D428B620688EF2863B23D4BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Users\Admin\AppData\Roaming\desktop-sender\browsers\Edge\Default\Login Data
Size 50KB
SHA256 92deb9024ca49204bb9a97b2936ac1aaf6e20e437ed40db53a5409bf801c0a20
MD5 9625c2e35b5d9a880a08161bdbb8e27a
SHA1 1441f4838a6ba52b6116c16a4e67dec8eeab6f92
SHA512 5925fbe50c4f8c34d1ad55992d67c5a997410207e3180733ff1a6fb1866b6b467067d17ab77d256335f71e137ed817b1289bed759529a15cf459bea1c023de17
SSDEEP 96:MkYUCn8MouB6w9fUP3mwilmqUvJKLReyG32ff44:uUG7Iw9f2iwcf4
TLSH
T13433451F2F682802C8698632BCB155F2AD7CA13F4B53AED22CB554354DB5852F02D5EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network_Cookies

Path C:\Users\Admin\AppData\Roaming\desktop-sender\browsers\Edge\Default\Network_Cookies
Size 24KB
SHA256 4cc1a146d871eea502899024db7a2ff4ab46d4e787819a0fd75cc74aa7dd9926
MD5 f20c4b926daf368f14b347d55a16cb41
SHA1 aedbb95b2328494e27a76d02ac5409154865d9c3
SHA512 8ec39bf908f1781a50fd054587a2b64f9051fc79ed1482674be1936f614d20bbc49dcef5033e1ecf2f219345414230b4421305de76ba25b28c49d3521d953885
SSDEEP 24:TL8z/bXYFpFNYbatyTM2Wkweka60y6UwbdQ9rPWTZ61:TQz/LopFMaty423w/a9NUuT
TLSH
T140B2594D1F307220C0F44B36EDD189572F7C211CD3A326599E1810F3DE925ABF61956A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Roaming\desktop-sender\browsers\Edge\Default\Web Data
Size 256KB
SHA256 b0c72944fc5bd02ac464a83ac972277e38d0dbc674f2a634c0d432bf882ef89a
MD5 b9ac2e3133012e6df701783726dd2e73
SHA1 2027d37725c5f18085038027fb7ccb6fc6568a24
SHA512 6fa34bb32da7171c554d4b3b2988e25598427f3f485632cbbecb12a545909563b01ec12a1393d4c3307652eaee787977a88538c639221a43d46d1e49411adc04
SSDEEP 384:K8NTRZyCSDnxTICYMEhIKyll7svbFKfk7:KoNZJSDniwyI1l7svbF9
TLSH
T16544640A7B747001EDE2D9725CB080771E3C616E8F26E6816DB654694EB3853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

urls.json

Path C:\Users\Admin\AppData\Roaming\desktop-sender\urls.json
Size 631B
SHA256 2394cbbf6afb9db491c2314ace33304ee5a357f6292622c5aefe72cf3252cd76
MD5 74eda214cd88a3f29382713e97405a39
SHA1 26788f786fe72d64432455cb86b95479ab159268
SHA512 abf77fc96890002e9ca249d43be2928f03c778641865a142cda3831eeef5d40da1f1a25b5e7763615d6dd810e477b31c01292a5d5f3487775a7c143b06b24e4c
TLSH
T1F7F031AB821058245FB9D5D8F478F258FF43165FBDF2EA477079474D1B700B2484C91A
MD5 SHA1 SHA512 TLSH

Submit Download

urls.txt

Path C:\Users\Admin\AppData\Roaming\desktop-sender\urls.txt
Size 267B
SHA256 087bb1a900067c0178478760170f51737d229233ee09d08a127832f3358f829f
MD5 64ffd2ca6f3ac9502a99db6fde35d135
SHA1 c66bf8f6dd0031045b616b7f7d2b6c2b9dde102c
SHA512 23ded3dd17af106b37a17f198317260c1ff5d986fb57d1d0c2ccd49adabdc8ed217dcc3a95ecf46e4f426a93d884960fec646eea59ced399ba429a591755601f
TLSH
T1B5D05B7B051D51584FB7D7C8E839B278CD93101D7CE9F74DA0495B4414501316C6845E
MD5 SHA1 SHA512 TLSH

Submit Download