asyncrat | hxxps://github[.]com/cabeto850128/comicsam

Analysis

user interaction
yes
max time kernel
370s
max time network
365s
platform
windows10-2004_x64
resource
win10v2004-20260513-es
resource tags

arch:x64arch:x86image:win10v2004-20260513-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
09/08/2026, 16:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://github.com/cabeto850128/comicsam
Sample260809-tpwava1frd

Score

10^/10

fgn discovery asyncrat hijackloader loader rat

Malware Config

Extracted

Family

asyncrat

Version

1.0.7

Botnet

sutamarchan7777.duckdns.org:7777

Mutex

DcRatMutex_qwqdanchun

Attributes

delay
1
install
false
install_folder
%AppData%

aes.plain

Extracted

Family

hijackloader

Attributes

directory
%APPDATA%\baseapi_x86
inject_dll
%windir%\SysWOW64\input.dll

xor.hex

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Family: HijackLoader, IDAT loader, Ghostulse,
HijackLoader is a multi-stage loader, first seen in 2023.
loader hijackloader

Async RAT payload 2 IoCs

rat

resource	yara_rule
behavioral1/memory/3388-570-0x0000000002CB0000-0x0000000002CC2000-memory.dmp	family_asyncrat
behavioral1/memory/4876-651-0x0000000002DB0000-0x0000000002DC2000-memory.dmp	family_asyncrat

Detects HijackLoader (aka IDAT Loader) 1 IoCs

resource	yara_rule
behavioral1/files/0x000900000002450f-592.dat	family_hijackloader

Loads dropped DLL 6 IoCs

pid	Process
3388	AdaptiveC.exe
920	libhost.exe
700	AdaptiveC.exe
3492	libhost.exe
4876	AdaptiveC.exe
456	libhost.exe

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
98	raw.githubusercontent.com
96	raw.githubusercontent.com
97	raw.githubusercontent.com

Suspicious use of SetThreadContext 6 IoCs

description	pid	Process	procid_target
PID 5020 set thread context of 3388	5020	setup.exe	127
PID 5020 set thread context of 920	5020	setup.exe	128
PID 4836 set thread context of 700	4836	setup.exe	135
PID 3032 set thread context of 4876	3032	setup.exe	137
PID 4836 set thread context of 3492	4836	setup.exe	136
PID 3032 set thread context of 456	3032	setup.exe	138

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	libhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AdaptiveC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AdaptiveC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	libhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	libhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AdaptiveC.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4324	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134307656818349542"	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1788976790-1541110888-1636651838-1000\{789FAEDE-0B13-49E0-B552-7E0D7384B66B}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 50 IoCs

pid	Process
5020	setup.exe
5020	setup.exe
5020	setup.exe
5020	setup.exe
5020	setup.exe
5020	setup.exe
3388	AdaptiveC.exe
3388	AdaptiveC.exe
3388	AdaptiveC.exe
3388	AdaptiveC.exe
4836	setup.exe
920	libhost.exe
920	libhost.exe
920	libhost.exe
920	libhost.exe
920	libhost.exe
920	libhost.exe
920	libhost.exe
920	libhost.exe
4836	setup.exe
4836	setup.exe
4836	setup.exe
3032	setup.exe
3032	setup.exe
3032	setup.exe
3032	setup.exe
700	AdaptiveC.exe
700	AdaptiveC.exe
700	AdaptiveC.exe
700	AdaptiveC.exe
3492	libhost.exe
3492	libhost.exe
3492	libhost.exe
3492	libhost.exe
3492	libhost.exe
3492	libhost.exe
3492	libhost.exe
3492	libhost.exe
4876	AdaptiveC.exe
4876	AdaptiveC.exe
4876	AdaptiveC.exe
4876	AdaptiveC.exe
456	libhost.exe
456	libhost.exe
456	libhost.exe
456	libhost.exe
456	libhost.exe
456	libhost.exe
456	libhost.exe
456	libhost.exe

Suspicious behavior: MapViewOfSection 6 IoCs

pid	Process
5020	setup.exe
5020	setup.exe
4836	setup.exe
3032	setup.exe
4836	setup.exe
3032	setup.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3388	AdaptiveC.exe

Suspicious use of FindShellTrayWindow 43 IoCs

pid	Process
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe

Suspicious use of WriteProcessMemory 53 IoCs

description	pid	Process	procid_target
PID 4636 wrote to memory of 1040	4636	msedge.exe	84
PID 4636 wrote to memory of 4324	4636	msedge.exe	85
PID 4636 wrote to memory of 3580	4636	msedge.exe	86
PID 4636 wrote to memory of 3580	4636	msedge.exe	86
PID 4636 wrote to memory of 3580	4636	msedge.exe	86
PID 4636 wrote to memory of 3068	4636	msedge.exe	87
PID 4636 wrote to memory of 3068	4636	msedge.exe	87
PID 4636 wrote to memory of 4552	4636	msedge.exe	88
PID 4636 wrote to memory of 4552	4636	msedge.exe	88
PID 4636 wrote to memory of 1844	4636	msedge.exe	89
PID 4636 wrote to memory of 4552	4636	msedge.exe	88
PID 4636 wrote to memory of 1844	4636	msedge.exe	89
PID 4636 wrote to memory of 1844	4636	msedge.exe	89
PID 4636 wrote to memory of 940	4636	msedge.exe	91
PID 4636 wrote to memory of 5116	4636	msedge.exe	92
PID 4636 wrote to memory of 940	4636	msedge.exe	91
PID 4636 wrote to memory of 940	4636	msedge.exe	91
PID 4636 wrote to memory of 5116	4636	msedge.exe	92
PID 4636 wrote to memory of 5116	4636	msedge.exe	92
PID 4636 wrote to memory of 3348	4636	msedge.exe	96
PID 4636 wrote to memory of 2512	4636	msedge.exe	97
PID 4636 wrote to memory of 3348	4636	msedge.exe	96
PID 4636 wrote to memory of 2512	4636	msedge.exe	97
PID 4636 wrote to memory of 2984	4636	msedge.exe	99
PID 4636 wrote to memory of 3864	4636	msedge.exe	110
PID 4636 wrote to memory of 3864	4636	msedge.exe	110
PID 4636 wrote to memory of 3864	4636	msedge.exe	110
PID 4636 wrote to memory of 3396	4636	msedge.exe	111
PID 4636 wrote to memory of 3396	4636	msedge.exe	111
PID 4636 wrote to memory of 3396	4636	msedge.exe	111
PID 4636 wrote to memory of 4884	4636	msedge.exe	114
PID 4636 wrote to memory of 4836	4636	msedge.exe	115
PID 4636 wrote to memory of 1764	4636	msedge.exe	116
PID 4636 wrote to memory of 700	4636	msedge.exe	118
PID 4636 wrote to memory of 700	4636	msedge.exe	118
PID 4636 wrote to memory of 700	4636	msedge.exe	118
PID 4636 wrote to memory of 1560	4636	msedge.exe	117
PID 4636 wrote to memory of 1560	4636	msedge.exe	117
PID 4636 wrote to memory of 4316	4636	msedge.exe	119
PID 4636 wrote to memory of 5116	4636	msedge.exe	125
PID 4636 wrote to memory of 5116	4636	msedge.exe	125
PID 5020 wrote to memory of 3388	5020	setup.exe	127
PID 5020 wrote to memory of 3388	5020	setup.exe	127
PID 5020 wrote to memory of 920	5020	setup.exe	128
PID 5020 wrote to memory of 920	5020	setup.exe	128
PID 4836 wrote to memory of 700	4836	setup.exe	135
PID 4836 wrote to memory of 700	4836	setup.exe	135
PID 4836 wrote to memory of 3492	4836	setup.exe	136
PID 3032 wrote to memory of 4876	3032	setup.exe	137
PID 3032 wrote to memory of 4876	3032	setup.exe	137
PID 4836 wrote to memory of 3492	4836	setup.exe	136
PID 3032 wrote to memory of 456	3032	setup.exe	138
PID 3032 wrote to memory of 456	3032	setup.exe	138

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/cabeto850128/comicsam
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2b4,0x7ff953b2c188,0x7ff953b2c194,0x7ff953b2c1a0
  2⤵
  PID:1040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=es --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1760,i,5732337159899747361,3233199708763223409,524288 --field-trial-handle=2328,i,5699475823824817225,255012351876850031,262144 --variations-seed-version --mojo-platform-channel-handle=2364 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1632,i,1624174790626629077,14850436634025222497,262144 --field-trial-handle=2328,i,5699475823824817225,255012351876850031,262144 --variations-seed-version --mojo-platform-channel-handle=2324 /prefetch:2
  2⤵
  PID:3580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=es --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2344,i,18420350333891147235,10040911426185097432,524288 --field-trial-handle=2328,i,5699475823824817225,255012351876850031,262144 --variations-seed-version --mojo-platform-channel-handle=2588 /prefetch:8
  2⤵
  PID:3068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3424,i,3581947289485483581,13721374937740233839,2097152 --field-trial-handle=2328,i,5699475823824817225,255012351876850031,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:4552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3448,i,10731706586151161865,15167730089216370072,2097152 --field-trial-handle=2328,i,5699475823824817225,255012351876850031,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:1844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4252,i,11286897078875148813,6173107366824751732,2097152 --field-trial-handle=2328,i,5699475823824817225,255012351876850031,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:1
  2⤵
  PID:940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4244,i,3913698106091800938,1614739058873634745,2097152 --field-trial-handle=2328,i,5699475823824817225,255012351876850031,262144 --variations-seed-version --mojo-platform-channel-handle=4352 /prefetch:2
  2⤵
  PID:5116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=es --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3464,i,16133612053207520402,3607328925675859206,524288 --field-trial-handle=2328,i,5699475823824817225,255012351876850031,262144 --variations-seed-version --mojo-platform-channel-handle=5148 /prefetch:8
  2⤵
  PID:3348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=es --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3484,i,7236645389910322305,17238856802726400454,524288 --field-trial-handle=2328,i,5699475823824817225,255012351876850031,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:8
  2⤵
  PID:2512
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5856,i,3114938303787799759,5060850980239006158,524288 --field-trial-handle=2328,i,5699475823824817225,255012351876850031,262144 --variations-seed-version --mojo-platform-channel-handle=5872 /prefetch:8
  2⤵
  PID:552
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5856,i,3114938303787799759,5060850980239006158,524288 --field-trial-handle=2328,i,5699475823824817225,255012351876850031,262144 --variations-seed-version --mojo-platform-channel-handle=5872 /prefetch:8
  2⤵
  PID:2984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=4476,i,408185760062544887,14834567327836878987,2097152 --field-trial-handle=2328,i,5699475823824817225,255012351876850031,262144 --variations-seed-version --mojo-platform-channel-handle=4488 /prefetch:1
  2⤵
  PID:3864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6236,i,7407499479094288630,12501859745423830766,2097152 --field-trial-handle=2328,i,5699475823824817225,255012351876850031,262144 --variations-seed-version --mojo-platform-channel-handle=3696 /prefetch:1
  2⤵
  PID:3396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=560,i,13602626520326172821,9171964193092257642,524288 --field-trial-handle=2328,i,5699475823824817225,255012351876850031,262144 --variations-seed-version --mojo-platform-channel-handle=6156 /prefetch:8
  2⤵
  PID:4884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6216,i,9042315863154581780,5406851139126779264,524288 --field-trial-handle=2328,i,5699475823824817225,255012351876850031,262144 --variations-seed-version --mojo-platform-channel-handle=6284 /prefetch:8
  2⤵
  PID:4836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6280,i,18209829659113841539,1316597374903080370,524288 --field-trial-handle=2328,i,5699475823824817225,255012351876850031,262144 --variations-seed-version --mojo-platform-channel-handle=6388 /prefetch:8
  2⤵
  PID:1764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=es --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6384,i,5494073282881373521,9810770224750482794,524288 --field-trial-handle=2328,i,5699475823824817225,255012351876850031,262144 --variations-seed-version --mojo-platform-channel-handle=6156 /prefetch:8
  2⤵
  PID:1560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6380,i,5382864302831826040,5184782949580399129,2097152 --field-trial-handle=2328,i,5699475823824817225,255012351876850031,262144 --variations-seed-version --mojo-platform-channel-handle=6352 /prefetch:1
  2⤵
  PID:700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4300,i,1449167031783363720,10566790896471763038,524288 --field-trial-handle=2328,i,5699475823824817225,255012351876850031,262144 --variations-seed-version --mojo-platform-channel-handle=6544 /prefetch:8
  2⤵
  PID:4316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=es --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6864,i,15812431703495942067,13306673626485132634,524288 --field-trial-handle=2328,i,5699475823824817225,255012351876850031,262144 --variations-seed-version --mojo-platform-channel-handle=6868 /prefetch:8
  2⤵
  PID:5116

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4144

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5116

C:\Users\Admin\Downloads\archivo\archivo\setup.exe
"C:\Users\Admin\Downloads\archivo\archivo\setup.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:5020
- C:\ProgramData\AdaptiveC.exe
  C:\ProgramData\AdaptiveC.exe
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3388
- C:\Users\Admin\AppData\Roaming\baseapi_x86\libhost.exe
  C:\Users\Admin\AppData\Roaming\baseapi_x86\libhost.exe
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:920

C:\Users\Admin\Downloads\archivo\archivo\setup.exe
"C:\Users\Admin\Downloads\archivo\archivo\setup.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4836
- C:\ProgramData\AdaptiveC.exe
  C:\ProgramData\AdaptiveC.exe
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:700
- C:\Users\Admin\AppData\Roaming\baseapi_x86\libhost.exe
  C:\Users\Admin\AppData\Roaming\baseapi_x86\libhost.exe
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:3492

C:\Users\Admin\Downloads\archivo\archivo\setup.exe
"C:\Users\Admin\Downloads\archivo\archivo\setup.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3032
- C:\ProgramData\AdaptiveC.exe
  C:\ProgramData\AdaptiveC.exe
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4876
- C:\Users\Admin\AppData\Roaming\baseapi_x86\libhost.exe
  C:\Users\Admin\AppData\Roaming\baseapi_x86\libhost.exe
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:456

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AdaptiveC.exe

Path C:\ProgramData\AdaptiveC.exe
Size 546KB
SHA256 1d1d2245651632f1fce464eda9d5c5ea6ca43b4a04424601ce8c890951111028
MD5 c39a4cca58bedd9b3ceda4d0d3e1e94a
SHA1 0ea31e219e83aa4ba169ef2a132af8fb52f54bf4
SHA512 673794aee7f54a6a1191069a1647ff085c8da6c9bdcb8e358e9969c51c9782993c5e73b938bb4388af012a6cb279e1faf324af55c49748a85b8159c170f4252f
SSDEEP 3072:BBPlwpY3YKF0MrrJq+DNBg0DJtOJs9cAg0Fub+A5aiMqKIDqLqprqpB:rc2XFRJ3DNuzAOS9F4DqLqprqpB
TLSH
T199C43821B4C1E47AC862073008E9E6B57579FC215E72863F33F47F2F3B762816565AA2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CCL.dll

Path C:\ProgramData\baseapi_x86\CCL.dll
Size 2.3MB
SHA256 6f354f31168f51f80714935ae3f2e17eeff626800565a592b0922514d53dd95e
MD5 ed83c1e65cb3937382fe31caac5a8bb9
SHA1 32640d96244a05d6d7f8606e9fa988e82bf277f5
SHA512 5525100a933282e176d3242c30477c8156af2a549e764c6b1715da0e6f4bf49974a1184a81ef7a021926f60b2b68cf6d8c77287d6d41e887feb19425ae305095
SSDEEP 49152:20zO0U4Wqr1N6ZsA9X/9Jtr7mXMP1GFNfgVGrR7xVVZoTwIbIRn:2L0UJEX6Zs+/9Jtr78wCNfgVGr3VP
TLSH
T1DDB58D227590803AD26F0735991DB36D72BDF9B04BF052C7B2A81EAD29718C35639F63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

compilerparam.idx

Path C:\ProgramData\baseapi_x86\compilerparam.idx
Size 1.1MB
SHA256 ea7cb1883a8b4b79e63ce93d42f65cc1dc11ca3d0bd3bffc5fd8013e178d50ff
MD5 1006b6d85e424c452bae130a00c4f590
SHA1 ff387d6461d019050493228db2ebcc761b4e6ce0
SHA512 dd1d19e1c66057a1052bccd45f7e468fb5d324061ba1b26832250433c6e9dafb8c804cd223a73469328e9795f39ac2a7299a489cc60c6d51f3e3d1acdbbc4a10
SSDEEP 24576:J4EAUJf/3PTy242x1DAIvk1ProI4zjpxes8ko/pqLuE/gW6OzIzeWfhF:J4EAUB3PTy2Vx1DAoUoIOjpxerjpqaEC
TLSH
T1BC452255A97BC35AC803ACF04125322733EDF79C4936AF10BC59F58CDA166062ABDF92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp_win.dll

Path C:\ProgramData\baseapi_x86\msvcp_win.dll
Size 485KB
SHA256 55043a5dbe9b4bfe50e2e6be0bdf77a69a075becc520700dcaffb1d9f7686138
MD5 bbc3c4543a00bc1e2130921ddc3ed3ca
SHA1 f7fe6df7187c3e11da67bc7f089113d61935364c
SHA512 2c8f44308a7344730423a8cf956d234ee46c9818c8ad13e19ba9019a99f9905aa5e326a2203ba462521ad626f015808abf9c34a3cfe3b660b6f321de540a95ab
SSDEEP 12288:3m8MyfWVRsPsxy60whuhFbCu8hUgiW6QR7t5s03Ooc8dHkC2es/oLG:yy+sPsxy60euPbn03Ooc8dHkC2eyoLG
TLSH
T1F8B43A3377410EB1E59A63B0218E973593F9ECA64761E3C393DAF1A96F243C29533681
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ucrtbase.dll

Path C:\ProgramData\baseapi_x86\ucrtbase.dll
Size 1.1MB
SHA256 71358d729b01bdf38dbe5440705ea68ea9225f93c834f45c5687b0ea2b417c4e
MD5 d4cf3fd5e8ee95431cfea69fa84ae57d
SHA1 80f5188570001e4fd5fdad9cbf38479dd4edd255
SHA512 a30488c43ca41ed36ee2917fe8e7a5280e0565859f719a1f709b13c18c3398f323c8ef24608e8f696214d9fe882c32b1a8686800490ca781196810220b30d43b
SSDEEP 24576:YWisOihSAdUDRdwE0OpuE4N7qWkGA+g7lyD6ZQtpmcvIZPoy4cncF4dN:zisOihSlDZuNN7qLZyD6yt6nccN
TLSH
T1B6453A093585E0AEDC6D3679136BB522346C76924BA8ECC373840BE98E305D17736EDB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

viewport4.conf

Path C:\ProgramData\baseapi_x86\viewport4.conf
Size 30KB
SHA256 92d5806a4677ac4882502f773de383396cdf6f1729d3983bc746e0a413eb5b2d
MD5 a8d3f0347923a556edff3288252f8a40
SHA1 0f5f65d427f99a5689c098ca630e4a83b459112c
SHA512 1ee15018cb07303ebfb3d00429ebdbd0f7a7d9e62c4335d656485c66739ed384916730eb2916cd7c6b05dd0b37c41ae44de720ef96a688114efaebe141751f61
SSDEEP 768:FEekEvn5oKZYBgiL+HMsmwuCxmh9m4B/dAY6iJdzpEhb9kDPkJ8:CCGKZ3iiHMRHzd5ibE88
TLSH
T15EE28DA64BA73F52980DA87E841CA0A7C215F6F23E1914F3FADD095B74119EEE410ED3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AdaptiveC.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\AdaptiveC.exe.log
Size 425B
SHA256 34ba0ab8d1850e7825763f413142a333ccbc05fa2b5499a28a7d27b8a1c5b4bb
MD5 4eaca4566b22b01cd3bc115b9b0b2196
SHA1 e743e0792c19f71740416e7b3c061d9f1336bf94
SHA512 bc2b1bf45203e3bb3009a7d37617b8f0f7ffa613680b32de2b963e39d2cf1650614d7035a0cf78f35a4f5cb17a2a439e2e07deaefd2a4275a62efd0a5c0184a1
TLSH
T112E0AB303321E0D489422F821C1C769503EF0359A110EE183848125FD4251172B312E3
MD5 SHA1 SHA512 TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 6130c8553b6b7a2db7b2e45115438707d58889218f67855fd135e735b457363a
MD5 12be8df10fec41dbf27a25c1c279b0c1
SHA1 33b90875d0895cce19bba03a50342a2ac338b0cf
SHA512 048871038871b434c649aecafc4bbbe60a8a78f34616d97c98e037db9c3622825294e8f24d0f7f5626a5b30b862451ae61f9803a791c84140586e516e5f58d6d
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7C:fwUQC5VwBIiElEd2K57P7C
TLSH
T136B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6d0f88884e23b1418c456620b79662feebdfd970ca9325ba2981c94b3b0f0b2f
MD5 7060eae8ec426d15de2849b1f7d261b4
SHA1 b252d90b9d7050d0b9b7c03141d9d3b7cae404ac
SHA512 8791005fae20dc1dc5dc5b0086efe814e0b1e36781ef1931cc1fc699fc4cb34d62ab3f9a83f4967824f3bb71aef6adc6ad457ab7a6addcba99f9e9b473eabb4d
TLSH
T118D01222BE08A415E65BA271A502C7141F5954A124938651E224D86CD9F84D49696387
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5fd0dfd3d3bf3e7005f86201a11a7b14e5b70a804c20d2fab2dc7e18e83479c7
MD5 59dfe5a6038e1ae4c00480b3fa70dfbf
SHA1 d8b171ed62e85a9877f2b32db7bf807cb4576c47
SHA512 0cff21ef0bd37ce3d4f98e7940c908c3201d89cc50406b17dab09361007866bd0951b42f1ffce2eceef6f25882ea83f6afe53c995d82bb88973ce086556c906e
TLSH
T1BBD09730FD10A5A1D22A0071001006001E1404B220A782D1A024181CC9B8040C2EABAA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4d517b88a0fb88494276c126764235de9ee52961c86cc4d3abaf517b10a649a8
MD5 dde9ea8dd9c7e315ef614ab3476af02c
SHA1 e03e201e89770d15b4040d579c2cce8684959a2c
SHA512 410e016336529d709de957d44e67238e4f6592b9ce6646395a9e45ce592e7810b4cb6b1b6df5d8b26875a6aa235b77d41c0983ccc055556f8b8c02224093fdd1
TLSH
T16DD012227E08A415E65BA271A502C7141F5954A124938651E224D86CC9F94D49696387
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 6KB
SHA256 ed33a99b751feabc00e5917ea0805327340c79b9e24aec12affe395153527208
MD5 83323c00000530df333529ff3c6c6b0d
SHA1 6772ea67ce87566fdb7e81f0d45970d91af93af3
SHA512 9c9987d531209f3490a81454e07b6527982486d10567f1c4af742d7aace782c3fdc95fe67432de5cf869867de8f7c8af651aefcf9963110da21039145595c936
SSDEEP 96:zks3ObkCIDyY4GUkZM+ZIWv4eaT0UFt5qg1yuW:zn3OQjY9kZpIs4D0UFv1yuW
TLSH
T1A2D1F642B1B2469CD3808CB583ED90F835F16F6834FB4E5FA61C9DF05AADB13815B4A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 f7dc637f62901a0779b0e09a83e5ed29f37a0bd1c21cf95820ff95f145438340
MD5 05fd7c0fe1948663f76b270a8ba7f4fd
SHA1 9eb446f394e6664ad1dae8cfee8611f86640007e
SHA512 da0ee2433dcd2a9c3a78bde616ea9cbf8f3202fcbc11d7ae389c8966b7b09fcf63f94c7968c8cc09f6cb3d2dad6e52eea6fc0fc33bf2a92590455d9694d07d1b
TLSH
T10981938482A346E0E3C005B9D7F9A1FD31B6A67835DF6E6AF85C90345F3DB11866F428
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58b002.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58b002.TMP
Size 3KB
SHA256 49d167eb33e9937693b68e3c50f45f4d8cac658aad77a9a6279725ff335f42c1
MD5 f45de99c8c66283bd2d35ed0932ed676
SHA1 c463d5e36081988564d725bf1a9198c8cdd2a9c4
SHA512 329a5b4c4a49f6a5ecfc97bf340744d846e02a8ef3c0b5da2db01f3c8e281cced83a6e36f908604843971d364d2af7bbf55e9a0156b14035ba08674142ae4ec0
TLSH
T13881A48482A386E0E3C005B9D7F9A1FD31B6A67835DF6E6AF85C90305F3DB11855F028
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 fafb37b8710774438f18e7cc52d2ad82e8e1004feb3cda29d9b75d5bf65391ca
MD5 4915ebddfd9493741f6968b210cba39f
SHA1 24da3e3581bb7260a08c458cc7f31333fff3023b
SHA512 53e9810b27987095be00d26470a90f5c2db175b8678704b6db2fc04bb457492b5c7bfade120a3bf478fecd28c8216122d47f47d29fa0ad1c2c4eb3563d406b28
SSDEEP 3:MsEllllkEthXllkl2zE/lj+llll:/M/xT02zG+tl
TLSH
T1E74404047FC00407C70013304451C35013F0DD500713D74334550D335DC77C00C00001
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 d6725548df54729e7f6d7ec8db44772305bbc10d5780cdaafca06c958170c603
MD5 ba986fef1f36708ced18cf3e0e826763
SHA1 3ed4a100fde8aee9ae85a34a9c5bbb25cdb2eb2f
SHA512 afe7aacfcf3684c19ec4a1b84f0f7c340d98bb3510e7ae2c56302ff04a6300753d69be7a1a8c574cf65d205e651a5dbd4553609220c06391c29d3ff7736df85b
TLSH
T1003133F747F2956D9B1255E0AA08EE1BCE2C0120831C787985E07E56D3F3872E101B5F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 009e5116b902fc068104fd15632df695c6c563c2f44b0559f72d881d8fab0119
MD5 d566a40374c2fd407a6e6f82ad7ef325
SHA1 d4affe148ff34ff1525c78b3513bb939757bc7a2
SHA512 28a0b1cd3b3924fb5d8dbe08e90e8a6847740c09c713f993b798824c1ca0ebd1adecefe291b9311780c7e111d066079e09d350a233624f6620576590da99b9db
SSDEEP 192:sxZo/ywFaKOMl8Mkk/fH/sKaIVaIupJHW6+WNGYvxkCtjIgrJ:sxZoFMk/ffsKaXJHbGkh9
TLSH
T18342F9116B34A977CCCBD209FA55BF53D6F91562E2940E48A9FCD61C04E6AEC220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 5e339ee2c8d8c490ea94369a05a409f65a65ddbf00fdd004cb6d8ed3d265bfcd
MD5 68db9649b45ae738244cf35467ed5bca
SHA1 3efe06f297f503ba41df270d63d80f9e65c89866
SHA512 8a9c07a2792d6c79a1925495cc5cd18e0e77729ee3bf6e90a345350513344fb8883528fe8ef540feb1e11033eeeaee4969a937ae4c1cec4252bb9b51b5063878
SSDEEP 192:sxZj/ywFaKOMl8v9k/fH/sFWpVGX2VaIupvDXSHW6+WNXRu1/YPfjWjVIgbLEJ:sxZjXEk/ffsFWvGXFjSHbK/7FXI
TLSH
T11062E7116A34997BCCCBE209FE45BF63E6F91422D5D00E549AFCA91C01E7BED220781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 227d633d0a72b74e80ab44ffb30b8b93ce867139f740ff5114f40e1c8a4a2b5a
MD5 0c852ff44bb4e32ab56013ef19f10ab8
SHA1 527290f629c0020bbeae08161cf85b56a8ff9c0f
SHA512 08800421d49b7550532b6f879fbbd2fdea3e3a5f23f80ba2a5292e833b30d8a9d54f2586a606e490040afd7d8b6199a5794b304260e155ecbfaaa42d4bca63a2
SSDEEP 192:sxZj/ywFaKOMl8M9k/fH/s5XTVaIup9DXSHW6+WNYu1/YvXECtjIg5LEJ:sxZjX1k/ffs5Xw5SHbX/6hdI
TLSH
T19752F9516A34597BCCCBE209FA45BF53E6F51422D1D40E58AAFCAA1C01E3BED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 f43a279a5946b8424780972d60041392f9bd2ac5534dd570c65e711dfe2f2abb
MD5 46e3cae7e198f85fde8173ef80991bfd
SHA1 ae3454455f37c5f74c7fd236f52c8b559e3558d0
SHA512 a3bde9951b2e28f4705237d7c3979859864e2f9ae6ef1391651fa81a3265b766c83dc0c7750b0f2f0862e912f901596555edfb928c1c453b2c1051b03ed35e95
SSDEEP 192:sxZj/ywFaKOMl8Mkk/fH/s5XTVaIup9DXSHW6+WNYu1/YvXkCtjIg5LoJ:sxZjXMk/ffs5Xw5SHbX/ehdM
TLSH
T18B52E8116A349D7BCCCBD209F945BF53E6F51462D1940E58AAFCAA1C04E77ED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 d0b67050228f1643eb96987b4f3aa2319a3664d726b6f266baa0fd6f918ea2b8
MD5 f331bc21b2ddfc8570d196a34830283a
SHA1 b9c8ca12e368b62fd8b9007bce7abfcc642a8804
SHA512 6c91afc6c650fc29436134a38db561e04a5fab9cc8f38afab4a2f222d6dee97084a1f2205abd03b58c0fe77283af7f7919e50151d005419119734f9638270f72
SSDEEP 768:KyseJ3xWvhfyn8F1+UoAYDCx9Tuqh0VfUC9xbog/OVLcLly0pp5ro+h4:KyseJ3xWvhfynu1jaWcL88pyi4
TLSH
T121D20B2B280CCB7E4F844E6DEC2A6F966EE801CB57944D5487EA980C03C77EB51275DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 f287c8ffe5c12a75532244e4c627036c6537cf7d21021d9c05ed35ae186fec9b
MD5 c6c65a8a31037041ff8f15d0bdbcbbbd
SHA1 ae5ddec137c09f586ebf0eb79c284d58e95ddc7d
SHA512 a50b7b5cdac52f40256f7b83bc9b8c9aae0a795a13b07713ba9665ba29ae83734ec83c7ef304788d5ba4041f61a8da7db39e3cf28f5111ee301a692cfbd2f237
SSDEEP 96:KYH+Kggm6UAKZKCCAgK92i5+KqAqyu0KPKC:49HX7gxPR
TLSH
T1FFE15406733A1342383E294CB79995370E8331A37418B5AF7BB911A24E66F125DFCACD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 e7dfcd2af3cefc7ce57f7bf6991d35a5d20958cb42766f953d9e1c76fae333b6
MD5 5cb2b7e81b4702abd9866dd283d10b96
SHA1 5384d524ca48437435a367dbbc158070ce70493b
SHA512 c5558f99f45f9b2e4cc7c7fd80211556401a16d808a8b34aaccf6cba23f5b5a5e834235a19cf251015bda0baa50c8bea1b0a20624e7e483f5a039e0d86134f85
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/uQ:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAZ
TLSH
T168A2B81DC81C7E3257CA2F7D6A2F9DB276CA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe594be4.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe594be4.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 c95bdfe0f8a873ea951230a7e2b865a36a99b61526a50ce70b15f54c94a06c8f
MD5 cf1c5353897890f2e99c24f3c0358d32
SHA1 d91427e95638f4bdae9f9b9e74dde219c83a25c7
SHA512 18683b97a5a8118ab0259917d004e19dbe055b789ba4dc09c29b7a3a605b4063e7fbd551e24956599aa249b05d8a2077c1b7842a1cf87610e6cdf3c1a51991ea
SSDEEP 192:jLsNJ3Q4gM7KTSQmiU1Of/n4MTq+FdLTqxm9Ifuap8z1qqHUMZ:/sNJ3XR7gOS4odyxm4uaOPUMZ
TLSH
T113421B316C749C37AE63B185F48B36136EF4856BDAC42FA4B6DD6F1C01DA2AC130B916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 1ce51503474513a01929dece3e9cc1a2215aec800f673a86cf7d75536ac1f750
MD5 c8666e320c558220800467005d3c4b1a
SHA1 81dea3c91d00bd6727d4ba0e9c704837e048522b
SHA512 d664c5fc409ff70dfca23ddc2b7aae49cc1ec5768befe5d4a16c9d34f82c8ee187538cd5ea91a001719d3e07395eac75503ce22b83e6c3e036bc29de2e1908f2
SSDEEP 192:uCc+xasuheOwQxMRsNJYGQ4gM7KTCQmiU1Of/n4MTq+FdLTqxm9Ifuap8z1qqHTo:SZcIasNJLXR7g+S4odyxm4uaOPTo
TLSH
T131726C725C749C37A9B3B145F48A36175EF8906BE6C81FA4B6ED7F0D01DA268030BD1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 29KB
SHA256 635ae1f6e4c36bfadceb3f59c787770a4092c586020ae09cfd0e7ab410ecf6bd
MD5 4f7c311797a4fbcabf85e0624b9f0ec1
SHA1 f75e40b3edfdf53d1d2730ce0f2aa9edc5eabf4f
SHA512 b30842a5bfc95db069a4f837ce3902301d9f6a2cbc4539ddf7bb880a4bfea4c6430ec66ec3068c20aaa34e1685af5a7f0b9d1f2ac3d1745eec72c9088973ab25
SSDEEP 384:067F8ZcIRU8sNQ8TUNTUlIlLXR7g7k4odyxm4uaef4vKASBcp/su9T86rTo:ZFq1Twg1RtrhHqtStu9gSTo
TLSH
T1BBD24BF188D74CB6D46D9BC7A77DAD0619BCC137B4845928B3E56A2DEC4A0BFC302811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 69c82adc400c7d5f519bcfcd394446d7684f2a2a26f80913f806ba99f1de6aa3
MD5 d989a3d553fe9c4eee530dabae7db97b
SHA1 f2b2bc1cc2f1d6c0986f3c442c9de6ebf6e1150d
SHA512 7f7904e368dd8c65b735a2d8b4ee7b568e904fe8c47d2cab48e19655c8d1c89e80f5f6da57c2b262dd2c9514d855e4f1a91bf9a72b2eb96c99a33293004548c2
SSDEEP 192:lONQ6vMtPQmiUyAf4ThTq+FdLTqxm9D847k1U/u:lONQ6UtRUTzdyxm1IU/u
TLSH
T11902F835AC686C7BEAA3AE46F48A27171FE451BFE5D01B54EAE82F1C00D765C1307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 f32b4c5a56e59d0231afa3f7af8d472e4aebb5c001600b09a9cb494d63b268b1
MD5 59bb159f4a10c6ebe31c8e791a9b5580
SHA1 2cc46a38a32ae378031af606ea29d31dd3e055bb
SHA512 e0d47756e297094b6e7de0666e0af20bdaf04041baa94c61712d70ea4063914710483751fcf9bdf8b539ab57206487e928852dd4ea5cf18eb3e7568459184540
SSDEEP 192:uCm+xasuheOwQxMGsNJXQ4gM7KTSQmiU1Of/n4MTq+FdLTqxm9Ifuap8z1qqHTCN:EZcIhsNJXXR7gOS4odyxm4uaOPTo
TLSH
T1B1626D725C749C37A9B3B145F48A36175EF8902BE6C81F64B6EDBF0D01DA668030BD1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 2353827cec7cdf3b741557e58208471b50035f088bd615a2b71c4f1bfc0545c7
MD5 ee74331c82468af2a7cc77d65a648e78
SHA1 33fc2e484fd8399bdc1c094934e120f5abbea86d
SHA512 5078f573316d66dfa4df6401d18477d873e480af374efc5219e56ba5705461817badbc5f598da82cf3bcea68423ebbf26e979f0c96cb96ebea190b3fe4e9ff80
SSDEEP 192:YONU6vMFPQmiUynf4IhTq+FdLTqxm9Ifuat80IqqHU/u:YONU6UFR5Izdyxm4uaSPU/u
TLSH
T185120B36A8649C2BAE63B545F08636171EF4926BDAC46F64FADC3F1C01DF65C130B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VariationsRuntimeSeedV1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\VariationsRuntimeSeedV1
Size 484B
SHA256 9fd2b7fae87c2d863b486a425834283f19b1444749c84650d5a48c9eadb12e2b
MD5 e9289cc1f579fdfa9d46acfae9b38330
SHA1 7eac8e241d8c35d873280d6b9dbc1cca7a9b2231
SHA512 b1f37da50e387c8408a960ef5276a51336510286c1db7eaea4cde65af4efc343f8ac1d9de65df1fd0818513823a485733e5c155da615344bc044f46021ecf586
TLSH
T134F0543C33D821A4F08C46B23596ED8B88BF313247DC2631CA50F550315387701B5095
MD5 SHA1 SHA512 TLSH

Submit Download

VariationsSeedV1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\VariationsSeedV1
Size 2KB
SHA256 748f39f9162824da17850cd7eeb10b521a1f8dda1e2447b584675f8ef032d467
MD5 3c51a041afe5b8fefea3abd9b2fa71ba
SHA1 a47c9586db28334a1f5077c9b40254154dcb0d93
SHA512 b7f8b8e45173cbce4eacfde9a22ad058dfbeac0292dd7387f0aebac951d643b8089120e7a2e0b08cc13e13eb23d98a52b96de6d9279a115b4641c961fe813479
TLSH
T171512E1CDABADF4D0534DBFADB90713B364E7EC93276112D9E4169C10AD456F40554D0
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 e88a26001d5dd95a6667fae4ada164496188ba299fa99ced9c4df74290044011
MD5 ad7142222047d9a20db72478a475a348
SHA1 727012e625c917f8df47e6622b64f3733db1b3e5
SHA512 eb0640a6d6c1a28aaff915f62213f3bf7a2015f0ff0cb2f4bee8fb222043829c2555d3b3ffda42f27164136a73f8cffe037ddc4d29b1e687b60b78df5f98809f
TLSH
T190412958B6FA1108B3776F1A5BF6A46E487FB9372F06D45E10110D4F4662B41C872B37
MD5 SHA1 SHA512 TLSH

Submit Download

657C24C.tmp

Path C:\Users\Admin\AppData\Local\Temp\657C24C.tmp
Size 1.6MB
SHA256 d2d7bc1a9b298899b6821172e6b99d2d2e22207bc6b43021e602a50766758025
MD5 219ce137d0bd6bc0b4f0e40714073e9c
SHA1 b89db86037f7f1948429272996c3b8886357e016
SHA512 7593600b070a0fdf8db5dc0927836ed4b2f080c48ef076b7ab8f6442b2b764b085facd3d1ac96065985cd4a61c661e54407ea2eb9a3f7e0a4b447d1d8e78b51b
SSDEEP 24576:5VewzMvYfRX3UqISYtLZw7yuxm0pkW81HO3QDdagthVLJGz8TabmkejanWREAmSr:awYvY5HBsZGyEQDdaYNIbmL00QLqhea
TLSH
T17B753302C70C3292CA8169C5D7FFFB6791FE7C9B54351940798814E7BBB52A26872F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

657C24C.tmp

Path C:\Users\Admin\AppData\Local\Temp\657C24C.tmp
Size 1.6MB
SHA256 3baada13022ee7fcf647d5cfdc2c96697575064e4b91842a5582e0f9f4e9cecd
MD5 0eadfcc718c8a8644f604a76edfb4260
SHA1 193d0880742b4f29c599f8fa92ca086f5e6c3078
SHA512 4a2876c7fec6dc9d2afb409884a6944b74941adefe2240218844d1a69f32eb3d3e4d2459442b4b6ac9bae704c792e70b3452a5c9002abe1c35ecbf5a0b0e8bfd
SSDEEP 24576:LVewzMvYfRX3UqISYthZw7yuxm0pkW81HO3QDdagthVLJGz8TabmkejanWREAmSr:MwYvY5HBWZGyEQDdaYNIbmL00QLqhea
TLSH
T1D5753302C70C3292CA8169C5D7FFFB6791FE7C9B54351940798814E7BBB52A26872F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

A7FEDD3.tmp

Path C:\Users\Admin\AppData\Local\Temp\A7FEDD3.tmp
Size 40B
SHA256 c570a4499585549200cc7a34132f5391eb591398e069a862386b5652fe8b6d3e
MD5 b17f6ba24f158b25ab0e302dc6ce9038
SHA1 7f2f64bca9f61ee7dd862c687a2cd05b46327089
SHA512 d05da05112452dc3ffd65c8a7004ec61accc14d9f5309fdeedea1fec7a4d8814e09e6039511e6e0144a7d58e26db86c39aa2f852e69566ca9ddfbcfe94646868
MD5 SHA1 SHA512

Submit Download

B104C03.tmp

Path C:\Users\Admin\AppData\Local\Temp\B104C03.tmp
Size 1.6MB
SHA256 23d0da4e8e87d39427cb0777aaa59a81087750c329fbb273df08ef0082994b03
MD5 e5fd8ac205b34ad6d873076cb263df01
SHA1 4f1bdcec2e1a8c99d09608a21bf7d221dda640d1
SHA512 f80c7c406498b10724fdaa956fd12c7a6276597303e2a90f539377999c1db6017827240df40c45f52c8f746497256264abfcfb4ed6f0f274ed93399ec0b46cf6
SSDEEP 24576:pVewzMvYfRX3UqISYtLZw7yuxm0pkW81HO3QDdagthVLJGz8TabmkejanWREAmSr:qwYvY5HBEZGyEQDdaYNIbmL00QLqhea
TLSH
T14B753302C70C3292CA8169C5D7FFFB6791FE7C9B54351940798814E7BBB52A26872F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

B104C03.tmp

Path C:\Users\Admin\AppData\Local\Temp\B104C03.tmp
Size 1.6MB
SHA256 288eab191b32e4908ecf41fa81db330ab0a22ef0791a445181ff0cc2ca697179
MD5 5d63369564dbf68e4bf653b5ebbcfd9b
SHA1 7ce170ca9f001377377adc81fe7d7cee3be29c54
SHA512 268b77b054bfab6e718037d4ff5b77d321b51b78004fbc8f0ebe147c30ce95a208c5e3d1d5b7b23163536889142f4c1ff26b78c48741c86d402cf8ee0e1b0833
SSDEEP 24576:7VewzMvYfRX3UqISYtLZw7yuxm0pkW81HO3QDdagthVLJGz8TabmkejanWREAmSr:cwYvY5HBsZGyEQDdaYNIbmL00QLqhea
TLSH
T12E753302C70C3292CA8169C5D7FFFB6791FE7C9B54351940798814E7BBB52A26872F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

C1CFEB9.tmp

Path C:\Users\Admin\AppData\Local\Temp\C1CFEB9.tmp
Size 1.6MB
SHA256 bda92586e764383e7f97b225ddf6e04b6392c114f6d4f8c0be31fdfe17c9b0e5
MD5 fcf511902fef4816e893903e6eda5ae2
SHA1 13b5e7e8a79f853c3bcac5cf81696f745d7528eb
SHA512 9def14ea3513542d14ee8f4f83456ffa40d82e7213a2cab83e700469a313e6b92cf93b259b154941e1787d009997d55b59ec7b1434d533e3156c29ea98c9ba86
SSDEEP 24576:VVewzMvYfRX3UqISYtLZw7yuxm0pkW81HO3QDdagthVLJGz8TabmkejanWREAmSr:WwYvY5HBsZGyEQDdaYNIbmL00QLqhea
TLSH
T163753302C70C3292CA8169C5D7FFFB67A1FE7C9B54351940798814E7BBB52A26872F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

C1CFEB9.tmp

Path C:\Users\Admin\AppData\Local\Temp\C1CFEB9.tmp
Size 1.6MB
SHA256 ec75ffbd1f3da091c452c35a6715684875dd47371115584f476875ba4ea8d464
MD5 d03853e5a3ede7dfca933a572e4da4f8
SHA1 b65b1abf4ad6203325866439199497c6d96df639
SHA512 00ec072c39ec9ac724412117d31bf1d815bcae578630155230f63efcc396d3f36b0678863e8b30ce2676ab971597e3cfced0f20d27d9da34e68cceec932222f3
SSDEEP 24576:7VewzMvYfRX3UqISYt2Zw7yuxm0pkW81HO3QDdagthVLJGz8TabmkejanWREAmSr:cwYvY5HBBZGyEQDdaYNIbmL00QLqhea
TLSH
T113753302C70C3292CA8169C5D7FFFB67A1FE7C9B54351940798814E7BBB52A26872F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

E046B07.tmp

Path C:\Users\Admin\AppData\Local\Temp\E046B07.tmp
Size 40B
SHA256 b9d7f9bb51107a01c9d8258461e2c5726baabd7fcddbd573c2d8c66ecd95c00b
MD5 8a8c38421aa1c5f029cb11234b467c69
SHA1 5b329b7bf6541021a4f7b9d91fa566887139f86c
SHA512 18a4f6cda134fceb54076e582fa36d9191fc499979c87619bb0c8abc61b5213be3f75983ee9108a2a06439d4f7eb7576dd4da654c862af3fb357e42a496e99a6
MD5 SHA1 SHA512

Submit Download

F051D40.tmp

Path C:\Users\Admin\AppData\Local\Temp\F051D40.tmp
Size 40B
SHA256 cb1572a9b3c49dcf5adcec9a3e5bc578fcf5e4057c0a325c56b4472b648c942f
MD5 679e3955ebfcb451c5f8e447e52caf57
SHA1 6e1ac22f79106a310e459cdfb9d6e5d1f1436ccc
SHA512 aa2454bb275f2e6ef1f19859fa15a4c49030d7699fb5d4c337f750665d0f3924fe5a934b5f58883ef64aac93be8d98e09bc001b7d2f227a3e4d82a4b8f73606f
MD5 SHA1 SHA512

Submit Download

libhost.exe

Path C:\Users\Admin\AppData\Roaming\baseapi_x86\libhost.exe
Size 432KB
SHA256 3c73732dbf5dd0a75d1c909436983bfc4f20d8fa5bd9cd9a7a31e105dd2b71d9
MD5 300414008e092e1e17ff64e831723d58
SHA1 be381def442f9d0275c80afbc3ce1f1f646dc7de
SHA512 60948e7357978e147073826070cee78021f2d3302145b1b4ab27065e2a57604ac34908cfdd679f388b5a16018cf64b07e0efe78a98c3883a127b52e8e8ef5a5f
SSDEEP 6144:rxQoGR3T8fG9QAgvF6CFpTBL4Qgy9hbWYdB9zlu9BUdN99H4+29Tg:WoKjrjgvF6ChgeFd/lu9BRS
TLSH
T184947B12F1E08031D27235320A75D77689BDB4309A646ACF67D8487FAF71AC19B2672F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

archivo.zip.crdownload

Path C:\Users\Admin\Downloads\archivo.zip.crdownload
Size 3.7MB
SHA256 f292489c2e5c3bb3beae70db350f499cd14513f499b30e455a9722cb8cafcc2f
MD5 71fed4613e9bd8da8f24787aff3bc370
SHA1 7af5e7c35cd28fa3e64a50868827b8f03b6e4401
SHA512 161b9e81cbd194f4b063b45b0e6cc6b950af3ecbac588f58b57d081e20abc0d0455a924b1a4a52748068d5c542669900e942eec447416dee9f48f57e56b69d0d
SSDEEP 98304:vBUvEBTW64Aix1IRDjNDjzQJQPhH2xFjFd9GY61cmleNCmcBP5:GvE9WQix1SRDjzvPZ2xfdZEcmwCmmR
TLSH
T11F06337E678DDE9EB883C9F9F7E76EC42046B1319702CC718C8396A04A52F8E75484D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/456-646-0x00007FF9615F0000-0x00007FF9617E5000-memory.dmp

Download

memory/700-621-0x0000000000DD0000-0x0000000000E07000-memory.dmp

Download

memory/700-620-0x00007FF9615F0000-0x00007FF9617E5000-memory.dmp

Download

memory/700-600-0x0000000000DD0000-0x0000000000E07000-memory.dmp

Download

memory/700-639-0x0000000000DD0000-0x0000000000E07000-memory.dmp

Download

memory/920-575-0x00007FF9615F0000-0x00007FF9617E5000-memory.dmp

Download

memory/3032-601-0x0000000074150000-0x000000007419F000-memory.dmp

Download

memory/3032-623-0x0000000074150000-0x000000007419F000-memory.dmp

Download

memory/3032-614-0x0000000074150000-0x000000007419F000-memory.dmp

Download

memory/3032-602-0x00007FF9615F0000-0x00007FF9617E5000-memory.dmp

Download

memory/3388-560-0x0000000000B30000-0x0000000000B67000-memory.dmp

Download

memory/3388-570-0x0000000002CB0000-0x0000000002CC2000-memory.dmp

Download

memory/3388-580-0x0000000006940000-0x0000000006EE4000-memory.dmp

Download

memory/3388-565-0x00007FF9615F0000-0x00007FF9617E5000-memory.dmp

Download

memory/3388-577-0x0000000005E70000-0x0000000005F72000-memory.dmp

Download

memory/3388-579-0x00000000062F0000-0x000000000638C000-memory.dmp

Download

memory/3388-578-0x0000000000B30000-0x0000000000B67000-memory.dmp

Download

memory/3388-581-0x0000000006400000-0x0000000006466000-memory.dmp

Download

memory/3388-566-0x0000000000B30000-0x0000000000B67000-memory.dmp

Download

memory/3492-629-0x00007FF9615F0000-0x00007FF9617E5000-memory.dmp

Download

memory/4836-598-0x0000000074150000-0x000000007419F000-memory.dmp

Download

memory/4836-583-0x00007FF9615F0000-0x00007FF9617E5000-memory.dmp

Download

memory/4836-594-0x0000000074150000-0x000000007419F000-memory.dmp

Download

memory/4836-582-0x0000000074150000-0x000000007419F000-memory.dmp

Download

memory/4876-625-0x0000000000D20000-0x0000000000D57000-memory.dmp

Download

memory/4876-637-0x00007FF9615F0000-0x00007FF9617E5000-memory.dmp

Download

memory/4876-640-0x0000000000D20000-0x0000000000D57000-memory.dmp

Download

memory/4876-651-0x0000000002DB0000-0x0000000002DC2000-memory.dmp

Download

memory/4876-652-0x0000000000D20000-0x0000000000D57000-memory.dmp

Download

memory/5020-445-0x0000000074150000-0x000000007419F000-memory.dmp

Download

memory/5020-558-0x0000000074150000-0x000000007419F000-memory.dmp

Download

memory/5020-427-0x00007FF9615F0000-0x00007FF9617E5000-memory.dmp

Download

memory/5020-426-0x0000000074150000-0x000000007419F000-memory.dmp

Download