f2ebd3f533c68ec53b541ef64f1ac4671bc97adc4ed3fefeee49d0cd4f50f9f2

Resubmissions

09/08/2026, 09:25

260809-ld5fdayscv8

02/05/2026, 21:38

260502-1hcy9ags8s8

Analysis

user interaction
yes
max time kernel
51s
max time network
48s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/08/2026, 09:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
GG.exe
Size 158KB
Sample260809-ld5fdayscv
SHA256 f2ebd3f533c68ec53b541ef64f1ac4671bc97adc4ed3fefeee49d0cd4f50f9f2
MD5 bdcc9fa5ddd7b37bc62c41a896d8d875
SHA1 ef8b9a4b9955aaeca474448c7139cf2accb87d48
SHA512 e20243794597fa00a36e3d7f0f5a4ca67342379908fcafd0dd525921431f78749456f2d3ba5d61dd809b9dd6e3d269697a4b9efafe38658bd33ff222d80adaf2
SSDEEP 3072:1ahKyd2n31V5GWp1icKAArDZz4N9GhbkrNEk/NLAh8vnEDR2TgwW:1ahOFp0yN90QE9
TLSH
T19CF37C5A63E421A6E4F6537498F203875A32BCB16B7492FF13D4D57E0E336C0A532B26
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution persistence ransomware

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
62	1320	powershell.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	GG.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\hintergrund.jpg"	powershell.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1320	powershell.exe

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5864	cmd.exe
6096	cmd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3556	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134307411896783173"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2370214745-1838013427-2987045292-1000\{C643D70F-A449-4AF6-A398-0071000C9FFC}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Opens file in notepad (likely ransom note) 2 IoCs

ransomware

pid	Process
5028	notepad.exe
664	notepad.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1320	powershell.exe
1320	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1320	powershell.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4220 wrote to memory of 1320	4220	GG.exe	85
PID 1320 wrote to memory of 4932	1320	powershell.exe	87
PID 4932 wrote to memory of 1768	4932	csc.exe	88
PID 1320 wrote to memory of 3008	1320	powershell.exe	91
PID 3008 wrote to memory of 2688	3008	msedge.exe	92
PID 3008 wrote to memory of 3556	3008	msedge.exe	94
PID 3008 wrote to memory of 664	3008	msedge.exe	95
PID 3008 wrote to memory of 1188	3008	msedge.exe	96
PID 3008 wrote to memory of 664	3008	msedge.exe	95
PID 3008 wrote to memory of 664	3008	msedge.exe	95
PID 3008 wrote to memory of 1188	3008	msedge.exe	96
PID 1320 wrote to memory of 1144	1320	powershell.exe	97
PID 3008 wrote to memory of 1360	3008	msedge.exe	98
PID 3008 wrote to memory of 1360	3008	msedge.exe	98
PID 3008 wrote to memory of 396	3008	msedge.exe	99
PID 3008 wrote to memory of 1360	3008	msedge.exe	98
PID 3008 wrote to memory of 396	3008	msedge.exe	99
PID 3008 wrote to memory of 396	3008	msedge.exe	99
PID 3008 wrote to memory of 1300	3008	msedge.exe	100
PID 3008 wrote to memory of 3120	3008	msedge.exe	101
PID 3008 wrote to memory of 2764	3008	msedge.exe	102
PID 3008 wrote to memory of 1300	3008	msedge.exe	100
PID 3008 wrote to memory of 1300	3008	msedge.exe	100
PID 3008 wrote to memory of 3120	3008	msedge.exe	101
PID 3008 wrote to memory of 3120	3008	msedge.exe	101
PID 3008 wrote to memory of 2764	3008	msedge.exe	102
PID 3008 wrote to memory of 2764	3008	msedge.exe	102
PID 1320 wrote to memory of 4164	1320	powershell.exe	103
PID 3008 wrote to memory of 3584	3008	msedge.exe	104
PID 3008 wrote to memory of 3584	3008	msedge.exe	104
PID 3008 wrote to memory of 3584	3008	msedge.exe	104
PID 3008 wrote to memory of 1316	3008	msedge.exe	105
PID 3008 wrote to memory of 1316	3008	msedge.exe	105
PID 3008 wrote to memory of 2596	3008	msedge.exe	107
PID 3008 wrote to memory of 2596	3008	msedge.exe	107
PID 1320 wrote to memory of 2952	1320	powershell.exe	108
PID 3008 wrote to memory of 1916	3008	msedge.exe	109
PID 3008 wrote to memory of 1916	3008	msedge.exe	109
PID 3008 wrote to memory of 1916	3008	msedge.exe	109
PID 3008 wrote to memory of 4000	3008	msedge.exe	110
PID 3008 wrote to memory of 1972	3008	msedge.exe	111
PID 3008 wrote to memory of 4000	3008	msedge.exe	110
PID 3008 wrote to memory of 1972	3008	msedge.exe	111
PID 1320 wrote to memory of 2160	1320	powershell.exe	114
PID 3008 wrote to memory of 1868	3008	msedge.exe	115
PID 3008 wrote to memory of 1868	3008	msedge.exe	115
PID 3008 wrote to memory of 1868	3008	msedge.exe	115
PID 1320 wrote to memory of 2172	1320	powershell.exe	116
PID 3008 wrote to memory of 5088	3008	msedge.exe	117
PID 3008 wrote to memory of 5088	3008	msedge.exe	117
PID 3008 wrote to memory of 5088	3008	msedge.exe	117
PID 1320 wrote to memory of 3796	1320	powershell.exe	118
PID 3008 wrote to memory of 1064	3008	msedge.exe	119
PID 3008 wrote to memory of 1064	3008	msedge.exe	119
PID 3008 wrote to memory of 1064	3008	msedge.exe	119
PID 1320 wrote to memory of 980	1320	powershell.exe	120
PID 3008 wrote to memory of 2848	3008	msedge.exe	121
PID 3008 wrote to memory of 2848	3008	msedge.exe	121
PID 3008 wrote to memory of 2848	3008	msedge.exe	121
PID 1320 wrote to memory of 4480	1320	powershell.exe	122
PID 3008 wrote to memory of 4008	3008	msedge.exe	123
PID 3008 wrote to memory of 4008	3008	msedge.exe	123
PID 3008 wrote to memory of 4008	3008	msedge.exe	123
PID 1320 wrote to memory of 3364	1320	powershell.exe	125

C:\Users\Admin\AppData\Local\Temp\GG.exe
"C:\Users\Admin\AppData\Local\Temp\GG.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4220
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -ExecutionPolicy Bypass -File ggs.ps1
  2⤵
  - Badlisted process makes network request
  - Sets desktop wallpaper using registry
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1320
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\qqiz4avx\qqiz4avx.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4932
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1A69.tmp" "c:\Users\Admin\AppData\Local\Temp\qqiz4avx\CSC361B19D63D3040E0A4EB46166C4D611D.TMP"
      4⤵
      PID:1768
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument microsoft-edge:https://wallpapercave.com/wp/wp2474900.jpg
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3008
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x29c,0x2c8,0x2cc,0x2c4,0x2ec,0x7ffafa6fc188,0x7ffafa6fc194,0x7ffafa6fc1a0
      4⤵
      PID:2688
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1904,i,15870777484800286465,2878079395838100297,524288 --field-trial-handle=2544,i,14952583065775982182,12364067138810004766,262144 --variations-seed-version --mojo-platform-channel-handle=2596 /prefetch:3
      4⤵
      System Time Discovery
      PID:3556
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1640,i,16899600414640541763,10238429942697344406,262144 --field-trial-handle=2544,i,14952583065775982182,12364067138810004766,262144 --variations-seed-version --mojo-platform-channel-handle=2532 /prefetch:2
      4⤵
      PID:664
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2180,i,17694630387401260191,12452155392025522345,524288 --field-trial-handle=2544,i,14952583065775982182,12364067138810004766,262144 --variations-seed-version --mojo-platform-channel-handle=2604 /prefetch:8
      4⤵
      PID:1188
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3448,i,1207036563306734151,2291383059894839279,2097152 --field-trial-handle=2544,i,14952583065775982182,12364067138810004766,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
      4⤵
      PID:1360
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3440,i,5463357753835929488,2686532885243877312,2097152 --field-trial-handle=2544,i,14952583065775982182,12364067138810004766,262144 --variations-seed-version --mojo-platform-channel-handle=3444 /prefetch:1
      4⤵
      PID:396
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4196,i,14011140580796215616,12065181218326231383,2097152 --field-trial-handle=2544,i,14952583065775982182,12364067138810004766,262144 --variations-seed-version --mojo-platform-channel-handle=4364 /prefetch:1
      4⤵
      PID:1300
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4208,i,11362122974068457501,10354598879147394258,2097152 --field-trial-handle=2544,i,14952583065775982182,12364067138810004766,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:2
      4⤵
      PID:3120
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4320,i,16104048658249658791,8414919370737487862,2097152 --field-trial-handle=2544,i,14952583065775982182,12364067138810004766,262144 --variations-seed-version --mojo-platform-channel-handle=4416 /prefetch:1
      4⤵
      PID:2764
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5268,i,6470551423551804547,153655016327956861,2097152 --field-trial-handle=2544,i,14952583065775982182,12364067138810004766,262144 --variations-seed-version --mojo-platform-channel-handle=5272 /prefetch:1
      4⤵
      PID:3584
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5420,i,6877583640234536540,10545778496883290404,524288 --field-trial-handle=2544,i,14952583065775982182,12364067138810004766,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:8
      4⤵
      PID:1316
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5604,i,18380074014753863141,17971301191257270873,524288 --field-trial-handle=2544,i,14952583065775982182,12364067138810004766,262144 --variations-seed-version --mojo-platform-channel-handle=5596 /prefetch:8
      4⤵
      PID:2596
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=5788,i,10584700711782450573,969282044632847188,2097152 --field-trial-handle=2544,i,14952583065775982182,12364067138810004766,262144 --variations-seed-version --mojo-platform-channel-handle=5796 /prefetch:1
      4⤵
      PID:1916
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5944,i,16628061968909651184,11337759690281882829,524288 --field-trial-handle=2544,i,14952583065775982182,12364067138810004766,262144 --variations-seed-version --mojo-platform-channel-handle=5804 /prefetch:8
      4⤵
      PID:4000
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5940,i,3026903698074060245,1343444123061849500,524288 --field-trial-handle=2544,i,14952583065775982182,12364067138810004766,262144 --variations-seed-version --mojo-platform-channel-handle=6016 /prefetch:8
      4⤵
      PID:1972
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6424,i,18293466789237597463,1064828846572272660,2097152 --field-trial-handle=2544,i,14952583065775982182,12364067138810004766,262144 --variations-seed-version --mojo-platform-channel-handle=6456 /prefetch:1
      4⤵
      PID:1868
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6600,i,18168318779503872568,3996896666723636031,2097152 --field-trial-handle=2544,i,14952583065775982182,12364067138810004766,262144 --variations-seed-version --mojo-platform-channel-handle=6636 /prefetch:1
      4⤵
      PID:5088
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6472,i,15848033699203590423,8620224086656037922,2097152 --field-trial-handle=2544,i,14952583065775982182,12364067138810004766,262144 --variations-seed-version --mojo-platform-channel-handle=6808 /prefetch:1
      4⤵
      PID:1064
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6988,i,849916765357128422,230775587082396936,2097152 --field-trial-handle=2544,i,14952583065775982182,12364067138810004766,262144 --variations-seed-version --mojo-platform-channel-handle=6996 /prefetch:1
      4⤵
      PID:2848
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6972,i,13781067822633129245,2305714688832570053,2097152 --field-trial-handle=2544,i,14952583065775982182,12364067138810004766,262144 --variations-seed-version --mojo-platform-channel-handle=7160 /prefetch:1
      4⤵
      PID:4008
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=7448,i,16047331889371147519,4544343477465825694,2097152 --field-trial-handle=2544,i,14952583065775982182,12364067138810004766,262144 --variations-seed-version --mojo-platform-channel-handle=7456 /prefetch:1
      4⤵
      PID:4452
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3412,i,570852586316055404,8813872761411919862,524288 --field-trial-handle=2544,i,14952583065775982182,12364067138810004766,262144 --variations-seed-version --mojo-platform-channel-handle=7780 /prefetch:8
      4⤵
      PID:6140
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3412,i,570852586316055404,8813872761411919862,524288 --field-trial-handle=2544,i,14952583065775982182,12364067138810004766,262144 --variations-seed-version --mojo-platform-channel-handle=7780 /prefetch:8
      4⤵
      PID:2216
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5424,i,1255334762630562600,7559863603229430616,524288 --field-trial-handle=2544,i,14952583065775982182,12364067138810004766,262144 --variations-seed-version --mojo-platform-channel-handle=5680 /prefetch:8
      4⤵
      PID:5692
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5644,i,2224994127164412692,8836260531136375544,524288 --field-trial-handle=2544,i,14952583065775982182,12364067138810004766,262144 --variations-seed-version --mojo-platform-channel-handle=7908 /prefetch:8
      4⤵
      PID:5892
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8040,i,10561222006100305855,5099325527865993298,524288 --field-trial-handle=2544,i,14952583065775982182,12364067138810004766,262144 --variations-seed-version --mojo-platform-channel-handle=8076 /prefetch:8
      4⤵
      PID:3992
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5684,i,5254642908811158224,10501877052329301642,524288 --field-trial-handle=2544,i,14952583065775982182,12364067138810004766,262144 --variations-seed-version --mojo-platform-channel-handle=5632 /prefetch:8
      4⤵
      PID:4228
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5448,i,1915037800194788571,13753961486481680696,524288 --field-trial-handle=2544,i,14952583065775982182,12364067138810004766,262144 --variations-seed-version --mojo-platform-channel-handle=8160 /prefetch:8
      4⤵
      PID:5260
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument microsoft-edge:https://wallpapercave.com/wp/wp2474900.jpg
    3⤵
    PID:1144
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument microsoft-edge:https://wallpapercave.com/wp/wp2474900.jpg
    3⤵
    PID:4164
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument microsoft-edge:https://wallpapercave.com/wp/wp2474900.jpg
    3⤵
    PID:2952
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument microsoft-edge:https://wallpapercave.com/wp/wp2474900.jpg
    3⤵
    PID:2160
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument microsoft-edge:https://wallpapercave.com/wp/wp2474900.jpg
    3⤵
    PID:2172
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument microsoft-edge:https://wallpapercave.com/wp/wp2474900.jpg
    3⤵
    PID:3796
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument microsoft-edge:https://wallpapercave.com/wp/wp2474900.jpg
    3⤵
    PID:980
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument microsoft-edge:https://wallpapercave.com/wp/wp2474900.jpg
    3⤵
    PID:4480
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument microsoft-edge:https://wallpapercave.com/wp/wp2474900.jpg
    3⤵
    PID:3364
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\uhuva5hr\uhuva5hr.cmdline"
    3⤵
    PID:4884
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES94C9.tmp" "c:\Users\Admin\AppData\Local\Temp\uhuva5hr\CSCCA020B716AF14BF98290659D4A3F549.TMP"
      4⤵
      PID:5328

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3856

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\5Ln0usYhVkyH.bat" "
1⤵
- Executes a command shell one-liner
PID:5864
- C:\Windows\system32\notepad.exe
  notepad "C:\Users\Admin\AppData\Local\Temp\why.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:5028

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\cbUToj9KhmR6.bat" "
1⤵
- Executes a command shell one-liner
PID:6096
- C:\Windows\system32\notepad.exe
  notepad "C:\Users\Admin\AppData\Local\Temp\why.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:664

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 940d17921bde8de627e1df6a2514c8b3fa162d125a077e8179f39b5b8c9051cb
MD5 8f1976d278f5f3878b71e37366030520
SHA1 2e1a106c74408bccb299bfe5d6c47bfc6830d443
SHA512 8bfb55b62052ebb4ad84ddc2856f84c4fd88e93032fd4fe6b83405a4748dfa127f9c01d819995bc08a7b34a940622e650868f0b9546ac5df1bc6c24f7018fd3f
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7h:fwUQC5VwBIiElEd2K57P7h
TLSH
T1FAB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 94f40511ea08a0b6a5296f0532f655edb1ff5b802568267057a10b9a850c3df9
MD5 1d5dfbc6f7dec6803aa8fc7ec805839e
SHA1 301f0013a4f8dff7ba9babad8791aa3ced8c30a0
SHA512 c72b47d1d5b8cbfb51273c5f54f380345f34c6234f6c4cb560c31768cb9b8965c22d1cff5b0f4f68e25ae5facfd1c5b91e33c6d09e6baea7aea919322ffd1514
TLSH
T1D8D023B4B42A75A1D72F00354430F150A26541737277938671554C0DEA7844497FAFFA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a59087fbda784cffb013f4e2a0bf13a7fca483c48e8a7fc15fa022402eb25d72
MD5 dd54db185d82309b854bfa7657ba4600
SHA1 d01c14e8b4dec85ed2e1671545a868fd7ad4fa95
SHA512 f014ab84dd934b90e006883b74ad349d05f60071e57d2cf0bdf8a9bce118654c92139263e082094b602f6900a71e9a7848754994a2ea88642b2376121b581d07
TLSH
T165D08067354D7815E71F42319413D350576B4072A562D702F314C41D957C4D857D53D7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 39b8627875fea5ac5c5bfb887da12c15116e3fe81f200852c71d5699102c9044
MD5 e3962be2eb3bd350a67bf6309159a1cc
SHA1 c10632202b95ed6f7f4475b6483bf5196e4c5578
SHA512 d12d4acc23b51c071fbc9bf4db2f0575a6b43ec7894b272035e4c01dfce30099cd3ef90a1009dd1e6284cfbcf7a37fd3b79490739946700a2c61ec578374cbe6
TLSH
T173D08C677A0E7815E72F8231A413E360A76B4072A5629702F324C81DA9BC8D85BE63D7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_00008e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008e
Size 147KB
SHA256 f9e37310a63c36d239f54b2881d2268c241ba11fe424172e19562a689ce7bb51
MD5 1af31196eb43d2214e16586322d3a5b5
SHA1 8ed411e4ec98f9b48b86dbb7f82d601ed53da5e6
SHA512 123cfde4235f41ad2cb2cc270e39365373a402510e5d9d1b1bf518189b7401307c82e4b136684bc9d5f33baf817b78e88246c2940a158ef05a59499976de7bd0
SSDEEP 3072:h8/Bd9Ni3Ew6NZu7g2p9FXO/k2NFI7aHUqENmED:G/xNi0rCg2evKaHUvmm
TLSH
T105E3129BF6BD6F85C831233953C391183B6044634AC5BA341374EDA5BADBE366C8D193
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 b81636a94ee445b7cb4fb03fbd59a786c31ea8ef4dcca716ad7d6218a61eb9cd
MD5 def41f716075839ebe9ee38e570c8b62
SHA1 5fd8fa46d1308c5292498c7f5884f1a6909123ac
SHA512 a999056bc4a7ec70c13460a2140bbb634f7273c81c41c17073620fb1b19c86c874f7bcddbec315181024d2739206c59d30800fedcfa3aca288e346183654ae12
TLSH
T14E610B380262C85CD3AC153CF1D15234743F858A9A1BAE652E14BFFDE5C9B71A1D6C0B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe587f4d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe587f4d.TMP
Size 3KB
SHA256 f7c2b99cf48a433d7bf92731116a1bc4439515f6d6a6ab3907e5d1cb739bf828
MD5 fc0901e13a408ff0a9f2c3c8d0f19aa0
SHA1 d0e1570bf7ae6d31e3b992bac744d80d74d7014c
SHA512 f781d059ed9627cb94facc54cc7dd37bcef5a16f8378f8dde3bad4d678b6ffece3ccd247a973bdf2703e0bc4e143bef5f7a941bc10da66d0895c93fe885bc804
TLSH
T13F610C380262C84CD36C153DF1D11234743F868A9A1B6E552E14BFFDE5C9B31A1D6C0B
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 4f40e5c0d41f213581dd1475f85d7a34aaa8926f2ece401ec1b54927c5483e28
MD5 f30b423dab9accd467abbe5284bf6f21
SHA1 66f6bf22451f05682916124f682b788624910459
SHA512 72645281c1904d57b1f5d071052821809dd738b255a33438cc692e2aee5eca672998fda64dd7df6da641906929ead56113f7414db963f0f371996b66898c9fb1
TLSH
T15B41BBF7C2E8866E890156F0AA146E2BCE6D0915432C7C5AC4E8FF5F93E38B1E14154F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 88cad55c95d097c90717e0056a0d6ee1059cf158e4a69474c088bafb76828ce2
MD5 24bda5c699f4772e643adc0568c51859
SHA1 86fb8816e1867786b52819ad760f79320e53f82d
SHA512 2de223fc5b2e23134f73ef9b00dd8fb8009054322af92b12ebf668da513dee37e57adb73dcaead50d9c572e26f90537323e0ce903142457125545c038a9b46ba
SSDEEP 192:sxZCRXyM/jK1Ml8Mia/f3szJgjEdpH/HW6+WNMAG8hYHow5rIg4J:sxZC9qa/f3sdgwfHbPhIc
TLSH
T14342E8126A34A977CCCBD30DFA557B53D6F51463E2900E44A9FC9A1C00E6AEC2217C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 6f45aae056ae98a6bcd9865a1a0513ed6e4fec6e87823028925c6a9a741d7afa
MD5 6d7b668ea843dea00e344405809c54fa
SHA1 1ae68edacdd4681630e0c97e4bbafb9c4a88cd2e
SHA512 7f3ad1ad704244054de488c9818817530d3418919fc8e465e06ae63281d7e648a0b3ad61a7ef0de91e2bef9295f7df2e56ce99622f299b7b93ffee8c06b6ab6c
SSDEEP 192:sxZCRXyM/jK1Ml8yja/f3soxWpV6gtQ//IdpH/HW6+WN+8+AG8hYnMiS5IgyJ:sxZC9za/f3smWv6g1fHbNRhxO
TLSH
T18362E716AA286D7BCCDBD30DFA457F53D6F91472A1901D44A9FCDA1C00E6AEC221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 111f4174868ea5a5279759240cbb7e0ed1dd710bf44c7c0dd4050797c69e40bb
MD5 f427f4e795787001654361bd62d67043
SHA1 dcb8219f5fcf71cade57e7292b4681de95c80152
SHA512 829be4ebb7dcace71279a279525e45764a0717c19e81bb189907e50eff628fba380502c160c758feb64824558a6d6ff55b8c089acd0f15dbc510f8091c5a376c
SSDEEP 768:p4UZYGMWvg0Po8F1+UoAYDCx9Tuqh0VfUC9xbog/OV9eLlPZ4RKroVE0s:p4UZYGMWvg0Pou1jaeeLZmRhNs
TLSH
T13BE20A3F680CCB7E4F844E5DEC2A6F962ED801CB6A584D5447EA894C02CB2EF512759B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 3cc50df419b57422aa5f129bbfb5fc48dd894bc60d754eda703c2e1d969a3e30
MD5 1ec1903f841cbfa0424c4416050c09d9
SHA1 02d7f155719c47f070f3a375e1a3939833f1c611
SHA512 244dd24545f23d88cd5ef94ef928d4e7086759b6c7e7a2bdd6a7a5d6bf51c785a1607dd84f24e5f3e00e436559546c7d3bb42421122aef812e799f73f6185b51
SSDEEP 96:KA1eK2AAv+KAgmiSgKXq8OgKXqSeGbg0GwQxFU1sDsxKr4DmxH+2Ns4p:EU1HQHeGbg0GwQHU1gsK4Dm9+2Ns+
TLSH
T154E1046271BA02422D3E6B1893D4871FCE4276533018E56F7BAC01B18E67E629CFD9DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 629e5c10d63fd641a1741f9d348ef4f1601bc99c6cb15203984d4a449c346d2f
MD5 5b233683f9e26899a0d9a37c7e634851
SHA1 26b921fbfb093f4c020bdea11a5a48d9c6f5bd99
SHA512 0084a8ac8e754edfa37d93bfb25bdaf02cdb3d7c138f966b4925e143ca0806608f33a3b7220aa8606f53526bbe608364693c86bfde3be9f465056f86f0a3ce8d
SSDEEP 192:zFsNKgQuXat8rZQmiU1S7PyzX5Obd+jFO/aouJFd+2MjQJqacjqCB8g:zFsNKgyis6zX5od+hO/VuXd+2Jo3B8g
TLSH
T152422B75A8699C3399E6F249F58736938FB810B7D9852F84E1F81B1C00C72DC274B927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 0c2b48ec39f572d374a59a23b35ac35e5c9bde6caf244a29ba98d1f0393945b7
MD5 68da5b3adb96bdafd42cebdf905fdc96
SHA1 e26ada8dfdf33714d1b4da1f60426c42bbb9d3fa
SHA512 0ef6341cd73a0dd799b696e92bee5ccec556d20d5f89a4ead3fc0e74b281425358fea571a43861f82bf669af060acb0e8ddb62f3ffb8f0397f02ee0cda3e592d
SSDEEP 768:zLqrOgO9utlYkJZtTy41a0mnewBKZOjWn:zLTAb17UPnevZ8c
TLSH
T14DC259B1D8682CF78AD1FAC9A986F5035EB45073959C1A4CE2F8BB3C305F9B81316D25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 c5f9a64e68db16025bba715ffe191ac7bea84a2fa8f133dc18d946d6ba56a25c
MD5 2d2b8825fc4e5db9738fcc22fd4aeb99
SHA1 9e1c998eb47cedef460ce56ce38fda1644d720b9
SHA512 c2ecb46903b2a7dfb104083cd6c823b357ed55ad83e6aff7f97af5a6f3626e64164b5cd1983f70d8c87eb8490a3ac827ada2a32803ecdfdabf6af0c99e611cd3
SSDEEP 192:yONw61VWQmiUyE9gGX5Obd+jFO/aob/aH36iU6:yONw6WDgGX5od+hO/V+qiU6
TLSH
T10402D83569286C778EE2BE49F48737139FA5206BE9952F84D6E81B1C00D769C2347827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 ee36fe98b4d3f32847e7789df9d8fb629249c31063fe0c03b54cb1a498a807f7
MD5 0fa93cf80c4122d61bf1714eb8ef480b
SHA1 947cd67c6ce9bb54171751c5d66b08a04902ea5b
SHA512 6cfef70b979fd35908257055e9c7afdb13b31006924d601ddb2c7965ebc21ba2e9357638684a00ed9f92cdc573e87e6aae7a18782645515a77c16b18e2d02ae1
SSDEEP 192:zFsNK6QuXat8rZQmiU1Z76/zX5Obd+jFO/aouJFd+2MjQJqacjqCB8N:zFsNK6yifKzX5od+hO/VuXd+2Jo3B8N
TLSH
T174423B75A8699C3399E6F249F58736938EB810B7D9852F84D1F82B1C00C76DC274BD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 e339bac18c21f1be920d066e9241e7d0642132855e495cdd52a83edb3cf46f35
MD5 09295a45693f74e36f26388d4cc81fba
SHA1 61b90ae87eacc2c0c3ff7462d8daa03e8da1d143
SHA512 c1a7db4bd7eb8e181c00f41d3ae6fa4872f12d99bcb615384e718d0a457c9a378066d922aa435c6c294cfcc0f83c4410b83c37bab12fb4a0b02e0163148f0b43
SSDEEP 192:zFsNKEQuXat8rZQmiU1A79gzX5Obd+jFO/aouJFd+20jQJqacjqCB87:zFsNKEyiKuzX5od+hO/VuXd+2Bo3B87
TLSH
T12E422A75A8699C33A9E6B249F58736938FB810B7D9852F84E1F81B1C00C76DC274BD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 3da1bdbf35196433bfe68baa32b1c810f0209e356df677fff988962edd72ffec
MD5 9fd31243fd4eca1f80f7ae4f8a9590b6
SHA1 e12414757db5947e99fe4d0da20a5d7b2c67e561
SHA512 e0c6cd5dd2be6448d0970abae4359f44178274de32b714ad76ddc97b8a04b5bfe4d7dff700d98dc3a99ac7dd234a306c7eabf06b4f8908b8a46adc5ea3d2bd9a
SSDEEP 192:OOND61HWQmiUyH9xGX5Obd+jFO/aouJFd+2MjJJqacU6:OOND6YWxGX5od+hO/VuXd+2koU6
TLSH
T14912F835642CEC239EE2B659F4C736939FA820B7E9456F84E2E81B1C00D769C274FC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 da3f664e7cd7a1c1ae5ca400b6b7018e3c501aee8be2b946694124e10ef6bd88
MD5 514e73739e7390937536ceb4c92126c8
SHA1 95563a9db8442f3c44f12f4c833856af786239e0
SHA512 df6fe64b57664de2e8854c4de031983e6e5a325d4c4d32018b935dc9369c3b324c49c90776dabe4c9fb72ab261e01bd5eda11480acc43b6cd0d433bf06dda929
SSDEEP 192:zFONK61t8rHQmiU1z7sZzX5Obd+jFO/aouJFd+2MjQJqacU9:zFONK67eJOzX5od+hO/VuXd+2JoU9
TLSH
T1512208356528EC339DE6B649F48736939FA820B7E8856F84E1E81B1C00D769C274BD17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 c86e4029ae2614c9fed11af7ee935f83845ca68c1b45b6fbf01e17b30e971a53
MD5 167c4fb5b515240168479aa1c46f23af
SHA1 b97c26c284423e6c1645c139f8c91f506d44afcb
SHA512 06b798a1c746619fefa2a180a91900775118a89b9ad85f45944c4d6d0bb564ad0cdac1a9efdd8524b09f04b6fb63563b9773ae1fe79cb223c3537905dfff6877
SSDEEP 192:zFsNKrQuXat8rZQmiU1U7E8UzX5Obd+jFO/aouJFd+2MjQJqacU8:zFsNKryi+EHzX5od+hO/VuXd+2JoU8
TLSH
T1293209356928EC339EE2B649F48736938FA41077A9856F84D1F81B1C01D769C274F927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

975d4106-15d8-4a8f-9ae6-d1c16421548d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\975d4106-15d8-4a8f-9ae6-d1c16421548d.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

050e2936-c33b-42a8-ad64-3f76044276c5.tmp

Path C:\Users\Admin\AppData\Local\Temp\050e2936-c33b-42a8-ad64-3f76044276c5.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ggs.ps1

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ggs.ps1
Size 5KB
SHA256 626b1dc9df3f7783e7df448b99ad4164650b59b3cd1a8bc2fdf2029bde098a6a
MD5 cfacf8ab47b08ada885002dfd0285a20
SHA1 54227324881ac8cab99857b081404b9594ef3d2d
SHA512 54bd04d6c11665f7de7e0ebd185e7a1ec77c22ac072be2ed2cfdbf1defc906602735c2fe15ce468871d78bb1622715b99627d87f8be8abfc2b3eec25754f0926
SSDEEP 96:DTQiCB9lSLto8O+W2MMXYdUWUzpN8Jv8ORSxRdChgljfmQ5qDlR4s3o8ArrQzuvJ:QiCB3SbO+WPMXYdUWUzD8VnORdCh8jfN
TLSH
T196B186397207E25963B14A0F9AD7A48DDF2A10372026DC4D328E9794EF7A406D33C789
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RES1A69.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES1A69.tmp
Size 1KB
SHA256 a95c537215f8347ea65b6d7b7b7ff2879d81000213700996e3a7d2406f424641
MD5 67d406f2c1ad96f17d4d0eeed7e405cf
SHA1 4b3e99dbac2c867afa15eeace72e2b710ceab8c5
SHA512 a6cc9d824450386aedf91df0584ff10c2ae5f8202c8f80b8255eaa13cd710349fcaf19d475001c4ff8c43e6d2ae290985d2139afc26559cc6b1da1758dd97a62
TLSH
T112218C0593EA871FF0B75B3169F6172BA278FD94EF62975B844052281C41504EEE0F72
MD5 SHA1 SHA512 TLSH

Submit Download

RES94C9.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES94C9.tmp
Size 1KB
SHA256 666535b6921d674b73141381b6baec8887968897bfda8433b6e11d9d4df84599
MD5 5011f6a2fcadb880a0d6935e553a4718
SHA1 2f128faa21a0c91ed31241f39dfdcbb9dc3db49f
SHA512 657326f325d2d57a824b7043eb147696b14d1db362ee54cc09cdb0120c89687b20ff26f7f19253080df68e715ac2ca2ddef0d7401960fd6e2a890d22218ad695
TLSH
T1A0218C0583EA471FF07747316AF6072BA265FDA5EFA6636B8640512C1C51504EEA0E72
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_0ti20kzf.vgd.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0ti20kzf.vgd.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

ba67167e-0ed3-4a64-9ee9-b94068525ac8.tmp

Path C:\Users\Admin\AppData\Local\Temp\ba67167e-0ed3-4a64-9ee9-b94068525ac8.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

qqiz4avx.dll

Path C:\Users\Admin\AppData\Local\Temp\qqiz4avx\qqiz4avx.dll
Size 3KB
SHA256 fce371ce1f18a486f05e05dea271828eb7179df3ffaf19fbd7e0254c2550acd6
MD5 07cb62af5e31b34b024ad872a1fff0f3
SHA1 4c59bcc1221a8aed7cc0bad0b1f22bbe92ffbc82
SHA512 44e38b8322295624e2af1a755fd36f7e611b004c6a11bafe5a5a9631767f0042476c18c79eb09c1883f97e5bdc209bea909a99e39f1fe0feceb1d6c86ce97480
TLSH
T11671FC1AA3E44BA7E4B707345EE30B4377B0F9A49B63936E19900218ACA16601A71FB0
MD5 SHA1 SHA512 TLSH

Submit Download

e33af762-ed30-4c21-9335-8ec5a91a7de2.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3008_302477172\e33af762-ed30-4c21-9335-8ec5a91a7de2.tmp
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3008_986717060\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uhuva5hr.dll

Path C:\Users\Admin\AppData\Local\Temp\uhuva5hr\uhuva5hr.dll
Size 3KB
SHA256 04d89773e6c4e8d69dbb1f53dfce97442b0781a17409f8bf68c5c277dac16cd5
MD5 3ecf172795eb6c7503afbe4920ff66a5
SHA1 11136ac9381ce165765dc25b806b4607554dbe95
SHA512 504efeb7688b24653bcacaa4eb8b350552608bc22d1f6bbf2ac763c1efad8ddae42a80359e1c6c84fb2bedc3053ce8fbcfd69a8f9c5b0cee3b6eb1488e09f69b
TLSH
T16F510E1763E8066BE86B0730AEF347133775F810AF73A36D0980426CAC607685E32BB1
MD5 SHA1 SHA512 TLSH

Submit Download

why.txt

Path C:\Users\Admin\AppData\Local\Temp\why.txt
Size 9B
SHA256 a86e17eec9220b34e89ddf98fb03c8a20514224c43c6dd10ecb4c128331210d3
MD5 048dfeb3832b72dc6795d704916fb87d
SHA1 69c4f61e8be7f75c4749cc65b9f51671fe4bfb5b
SHA512 def2625d88e0064b21c2f163c7a47cbb47677ed0fdea5211ff6082f8222194849e64b826cb4d36dc65b21a04c92c201ae831736ba374b2f18970e0d89360b019
MD5 SHA1 SHA512

Submit Download

S1rToDnk6u9N.bat

Path C:\Users\Admin\Desktop\S1rToDnk6u9N.bat
Size 77B
SHA256 3a809a1b7d572426ba272f9938d6521b0d701dd4d3dae2c6397e24c80eb70f32
MD5 cd3668edb9cffe0e5c7b575b5b76e79b
SHA1 8930bf0f64463274812db7611acd6fe35635a6a8
SHA512 9d29b0c63789d5f5c4828a984a88d4d2d3c5a141cca9fda12fbc5efc5398001c8f30e0879b3b467e7d3d24d05ad97ce2829d2a025787a7fba3dc6550316f6702
TLSH
T1FDA001269631842306850870CA577956787E289738889C622596A5A0488A8C1AFBCAB7
MD5 SHA1 SHA512 TLSH

Submit Download

CSC361B19D63D3040E0A4EB46166C4D611D.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\qqiz4avx\CSC361B19D63D3040E0A4EB46166C4D611D.TMP
Size 652B
SHA256 e17f32b3d0ecc12383c32b6f9644c9706382c8f3d942289e2d66465ec7f526e7
MD5 970e81a53b9d4d7ef51aea5e6b06bc6d
SHA1 5a00967fe0d466a07a786ed97763a669848decae
SHA512 25da090ac527ce0e1d5c35375447da2569addb4091af961da07e82c7c5ba2128f3d945b25b60a8370990b3b23433bb72e64bcdb69ea035d60fe8191c9b28f9d1
TLSH
T193F05E09A7F8420EF4F34F30BDF6536391A8BDA4DE3293ED14440319686451099A2FB2
MD5 SHA1 SHA512 TLSH

Submit Download

qqiz4avx.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\qqiz4avx\qqiz4avx.0.cs
Size 434B
SHA256 49fe6ce912c037a26be2d3b68fe604eb212a9133c37ed85f543c66b0c67e4f43
MD5 95ae1715c8b236a71ca9987d1b3c4c37
SHA1 929bd2fe4fb7e351ed8e2bb531a1ce6ea1298961
SHA512 88090a7942ceb320095b7864f43c4b0ebe677329f5fc039ccc11034b2764e764edaadf87e5d5d78d809dcc758fd1b6f1617136336c315da80059d04520c7664d
TLSH
T12BE0AB244302AE71802101013E81E6C6F20BA23531FF7505B99D0B31DF730A5E139DEE
MD5 SHA1 SHA512 TLSH

Submit Download

qqiz4avx.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\qqiz4avx\qqiz4avx.cmdline
Size 369B
SHA256 e66926e19b3fb2972305a904731b6623b6907c75097a892ea2664a73d30fe3ed
MD5 f157e038af0b54330f2afb306e92f9b3
SHA1 adb4024e758fb00c2b36641a16e40dce2407ac65
SHA512 b14ede55101cbde78e06880b4def6be0f24a2aa835e46fa8be459acdc5e69b5a8553bd0e953ce82407220431c8e18ec8917126593d4df80dd9a8f8a06cb199c3
TLSH
T135E0683A4246C2BF19DA1017216AC8ACC272164B69403FC46490442ED02B80867D1B45
MD5 SHA1 SHA512 TLSH

Submit Download

CSCCA020B716AF14BF98290659D4A3F549.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\uhuva5hr\CSCCA020B716AF14BF98290659D4A3F549.TMP
Size 652B
SHA256 07dac5d51ac0afca9b68755a84a9730406dba2035798dd49624b4b5db363266f
MD5 2f1cda0734ed66394d2c4ec7abc95c9b
SHA1 26e64c74a47025c7679bfa3354f727d5aa741630
SHA512 16e8a4dbfd2bb7ae95b5680f651c5167369eae25009ebc6c254d9ebe528f94f90c42d7576a8b8a59cb816a7d259f42f61ee742fdcaca3025f841169fd91305ef
TLSH
T1A7F0540A63F8020EF1F34B30BDF54363A169BC65EE3253FD1940031918645108561F72
MD5 SHA1 SHA512 TLSH

Submit Download

uhuva5hr.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\uhuva5hr\uhuva5hr.0.cs
Size 230B
SHA256 0a91d83379d7d1f541043af0c2bb59ff812b354072b55f451c7582b449e33ea1
MD5 30904225cffd70b824bfff72f1e0400a
SHA1 ef3bea9641efbdc98448689d3173428012738bf5
SHA512 b77725667d3bdfa9ab82bcab0d98f2f7ea3131f315fa377bcd3e036a285cf5ce1cdf9ee8337e6a4d7c6ef3f31b97873df3c54caf19bb7233b66115eefbce75fa
TLSH
T1FCD0972033834AE08823021A5C0260B1F632009036FB7C01B4E502218E9F604123262C
MD5 SHA1 SHA512 TLSH

Submit Download

uhuva5hr.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\uhuva5hr\uhuva5hr.cmdline
Size 369B
SHA256 ab12928c1dd61852e381a7bc9610e0e4978ab50cd1ed5563b7a1429ee1737cd3
MD5 e1de37ba76e01fad4d111cfdcbe41474
SHA1 b1d5df35d1574be8d125e9fadf0df955aff7d766
SHA512 b4e2b0327eeb70d9de9febae560a0099785df042b34c77b4506c5d837056a2947827061ba39982e183bc79982400d9531441e517b8afbcb32c41de5d051d4cf0
TLSH
T1F3E0683B83C6C27F91DD141B21A9C6BC827207432D433F885244480DE1170032BE3753
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1320-27-0x000001D88F150000-0x000001D88F160000-memory.dmp

Download

memory/1320-4-0x000001D88F0D0000-0x000001D88F0F2000-memory.dmp

Download

memory/1320-34-0x000001D88F150000-0x000001D88F160000-memory.dmp

Download

memory/1320-2-0x000001D88F150000-0x000001D88F160000-memory.dmp

Download

memory/1320-38-0x000001D8AC5E0000-0x000001D8AC6E0000-memory.dmp

Download

memory/1320-26-0x000001D88F140000-0x000001D88F148000-memory.dmp

Download

memory/1320-35-0x000001D8AC5E0000-0x000001D8AC6E0000-memory.dmp

Download

memory/1320-105-0x000001D8AC5E0000-0x000001D8AC6E0000-memory.dmp

Download

memory/1320-13-0x000001D88F150000-0x000001D88F160000-memory.dmp

Download

memory/1320-36-0x000001D88F150000-0x000001D88F160000-memory.dmp

Download

memory/1320-28-0x000001D88F150000-0x000001D88F160000-memory.dmp

Download

memory/1320-33-0x000001D8AC5E0000-0x000001D8AC6E0000-memory.dmp

Download

memory/1320-3-0x000001D88F150000-0x000001D88F160000-memory.dmp

Download

memory/1320-37-0x000001D88F150000-0x000001D88F160000-memory.dmp

Download

memory/1320-29-0x000001D8AC5E0000-0x000001D8AC6E0000-memory.dmp

Download

memory/1320-132-0x000001D8AC5E0000-0x000001D8AC6E0000-memory.dmp

Download

memory/1320-30-0x000001D8AC5E0000-0x000001D8AC6E0000-memory.dmp

Download

memory/1320-46-0x000001D8AC5E0000-0x000001D8AC6E0000-memory.dmp

Download

memory/1320-32-0x000001D88F150000-0x000001D88F160000-memory.dmp

Download

memory/1320-1471-0x000001D88F210000-0x000001D88F218000-memory.dmp

Download

memory/1320-31-0x000001D88F150000-0x000001D88F160000-memory.dmp

Download