hxxps://oss[.]buidc[.]cn/user/share[.]php?token=260d43963c659bbcfa20911d9c4a6b3ae0012e5c26aaed74a3091a09add93da9&pwd=

Analysis

user interaction
yes
max time kernel
1056s
max time network
1059s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 22:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://oss.buidc.cn/user/share.php?token=260d43963c659bbcfa20911d9c4a6b3ae0012e5c26aaed74a3091a09add93da9&pwd=
Sample260810-153s7aah56

Score

7^/10

discovery execution installer persistence ransomware upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x0011000000011599-452.dat	acprotect

Executes dropped EXE 3 IoCs

pid	Process
4948	To_zdnttjqb_Desk 4.9.7.3.tmp
3956	agent.exe
4352	ToDesk_4.8.8.9.exe

Loads dropped DLL 4 IoCs

pid	Process
3956	agent.exe
4352	ToDesk_4.8.8.9.exe
4352	ToDesk_4.8.8.9.exe
4352	ToDesk_4.8.8.9.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
3132	wscript.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0011000000011599-452.dat	upx
behavioral1/memory/4352-455-0x0000000073E10000-0x0000000073ECA000-memory.dmp	upx
behavioral1/memory/4352-574-0x0000000073E10000-0x0000000073ECA000-memory.dmp	upx
behavioral1/memory/4352-581-0x0000000073E10000-0x0000000073ECA000-memory.dmp	upx

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	agent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ToDesk_4.8.8.9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	To_zdnttjqb_Desk 4.9.7.3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	To_zdnttjqb_Desk 4.9.7.3.tmp

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4328	msedge.exe

Inno Setup is an open-source installation builder for Windows applications. 2 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral1/memory/5632-412-0x0000000000C10000-0x0000000000D20000-memory.dmp	innosetup
behavioral1/memory/5632-447-0x0000000000C10000-0x0000000000D20000-memory.dmp	innosetup

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134308737096414620"	msedge.exe

Modifies registry class 11 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1738198120-2966725515-3980530802-1000\{85659B5A-D3F8-429E-B4E4-3CD974A44230}	msedge.exe

Suspicious behavior: EnumeratesProcesses 36 IoCs

pid	Process
5992	msedge.exe
5992	msedge.exe
4352	ToDesk_4.8.8.9.exe
4352	ToDesk_4.8.8.9.exe
3956	agent.exe
3956	agent.exe
3956	agent.exe
3956	agent.exe
3956	agent.exe
3956	agent.exe
3956	agent.exe
3956	agent.exe
3956	agent.exe
3956	agent.exe
3956	agent.exe
3956	agent.exe
3956	agent.exe
3956	agent.exe
3956	agent.exe
3956	agent.exe
3956	agent.exe
3956	agent.exe
3956	agent.exe
3956	agent.exe
3956	agent.exe
3956	agent.exe
3956	agent.exe
3956	agent.exe
3956	agent.exe
3956	agent.exe
3956	agent.exe
3956	agent.exe
3956	agent.exe
3956	agent.exe
3956	agent.exe
3956	agent.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3956	agent.exe

Suspicious use of WriteProcessMemory 58 IoCs

description	pid	Process	procid_target
PID 1208 wrote to memory of 3452	1208	msedge.exe	88
PID 1208 wrote to memory of 4328	1208	msedge.exe	90
PID 1208 wrote to memory of 1736	1208	msedge.exe	92
PID 1208 wrote to memory of 1736	1208	msedge.exe	92
PID 1208 wrote to memory of 3356	1208	msedge.exe	91
PID 1208 wrote to memory of 3356	1208	msedge.exe	91
PID 1208 wrote to memory of 3356	1208	msedge.exe	91
PID 1208 wrote to memory of 5048	1208	msedge.exe	94
PID 1208 wrote to memory of 5048	1208	msedge.exe	94
PID 1208 wrote to memory of 5048	1208	msedge.exe	94
PID 1208 wrote to memory of 468	1208	msedge.exe	95
PID 1208 wrote to memory of 468	1208	msedge.exe	95
PID 1208 wrote to memory of 468	1208	msedge.exe	95
PID 1208 wrote to memory of 264	1208	msedge.exe	96
PID 1208 wrote to memory of 120	1208	msedge.exe	97
PID 1208 wrote to memory of 264	1208	msedge.exe	96
PID 1208 wrote to memory of 264	1208	msedge.exe	96
PID 1208 wrote to memory of 120	1208	msedge.exe	97
PID 1208 wrote to memory of 120	1208	msedge.exe	97
PID 1208 wrote to memory of 3292	1208	msedge.exe	99
PID 1208 wrote to memory of 3292	1208	msedge.exe	99
PID 1208 wrote to memory of 5620	1208	msedge.exe	100
PID 1208 wrote to memory of 5620	1208	msedge.exe	100
PID 1208 wrote to memory of 5764	1208	msedge.exe	101
PID 1208 wrote to memory of 4680	1208	msedge.exe	102
PID 1208 wrote to memory of 5764	1208	msedge.exe	101
PID 1208 wrote to memory of 4680	1208	msedge.exe	102
PID 1208 wrote to memory of 4680	1208	msedge.exe	102
PID 1208 wrote to memory of 5364	1208	msedge.exe	104
PID 1208 wrote to memory of 3548	1208	msedge.exe	108
PID 1208 wrote to memory of 856	1208	msedge.exe	109
PID 1208 wrote to memory of 1776	1208	msedge.exe	110
PID 1208 wrote to memory of 2724	1208	msedge.exe	111
PID 1208 wrote to memory of 2724	1208	msedge.exe	111
PID 1208 wrote to memory of 2724	1208	msedge.exe	111
PID 1208 wrote to memory of 5348	1208	msedge.exe	112
PID 1208 wrote to memory of 5348	1208	msedge.exe	112
PID 1208 wrote to memory of 5992	1208	msedge.exe	114
PID 1208 wrote to memory of 2484	1208	msedge.exe	116
PID 1208 wrote to memory of 2280	1208	msedge.exe	115
PID 1208 wrote to memory of 2484	1208	msedge.exe	116
PID 1208 wrote to memory of 2280	1208	msedge.exe	115
PID 1208 wrote to memory of 432	1208	msedge.exe	117
PID 1208 wrote to memory of 432	1208	msedge.exe	117
PID 1208 wrote to memory of 4220	1208	msedge.exe	118
PID 1208 wrote to memory of 4220	1208	msedge.exe	118
PID 1208 wrote to memory of 2812	1208	msedge.exe	120
PID 1208 wrote to memory of 2812	1208	msedge.exe	120
PID 1208 wrote to memory of 2812	1208	msedge.exe	120
PID 1208 wrote to memory of 4060	1208	msedge.exe	121
PID 1208 wrote to memory of 4060	1208	msedge.exe	121
PID 1208 wrote to memory of 1732	1208	msedge.exe	125
PID 1208 wrote to memory of 1520	1208	msedge.exe	126
PID 1208 wrote to memory of 1520	1208	msedge.exe	126
PID 1208 wrote to memory of 1520	1208	msedge.exe	126
PID 5632 wrote to memory of 4948	5632	To_zdnttjqb_Desk 4.9.7.3.exe	134
PID 4948 wrote to memory of 3956	4948	To_zdnttjqb_Desk 4.9.7.3.tmp	135
PID 4948 wrote to memory of 4352	4948	To_zdnttjqb_Desk 4.9.7.3.tmp	136

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://oss.buidc.cn/user/share.php?token=260d43963c659bbcfa20911d9c4a6b3ae0012e5c26aaed74a3091a09add93da9&pwd=
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2ac,0x7ffd1ae6c188,0x7ffd1ae6c194,0x7ffd1ae6c1a0
  2⤵
  PID:3452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1840,i,10998812159505241965,11117299735447749230,524288 --field-trial-handle=2620,i,13144120510749095224,13275041285535164306,262144 --variations-seed-version --mojo-platform-channel-handle=2668 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1588,i,4843973496864960402,15311349950001331678,262144 --field-trial-handle=2620,i,13144120510749095224,13275041285535164306,262144 --variations-seed-version --mojo-platform-channel-handle=2616 /prefetch:2
  2⤵
  PID:3356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2244,i,16157385152525782686,5950488666421227589,524288 --field-trial-handle=2620,i,13144120510749095224,13275041285535164306,262144 --variations-seed-version --mojo-platform-channel-handle=2756 /prefetch:13
  2⤵
  PID:1736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3636,i,3480431226289315541,15437523850036834479,2097152 --field-trial-handle=2620,i,13144120510749095224,13275041285535164306,262144 --variations-seed-version --mojo-platform-channel-handle=3712 /prefetch:1
  2⤵
  PID:5048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3640,i,1372334651332936426,3575862535594583534,2097152 --field-trial-handle=2620,i,13144120510749095224,13275041285535164306,262144 --variations-seed-version --mojo-platform-channel-handle=3768 /prefetch:1
  2⤵
  PID:468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4332,i,12110766619949794057,1310520414251987823,2097152 --field-trial-handle=2620,i,13144120510749095224,13275041285535164306,262144 --variations-seed-version --mojo-platform-channel-handle=4856 /prefetch:9
  2⤵
  PID:264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4312,i,8802042321349950442,13719494764632798091,2097152 --field-trial-handle=2620,i,13144120510749095224,13275041285535164306,262144 --variations-seed-version --mojo-platform-channel-handle=4852 /prefetch:1
  2⤵
  PID:120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5384,i,4844421253146452739,16129074639264108709,524288 --field-trial-handle=2620,i,13144120510749095224,13275041285535164306,262144 --variations-seed-version --mojo-platform-channel-handle=5424 /prefetch:14
  2⤵
  PID:3292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5392,i,5934762726261026627,8174899479013652557,524288 --field-trial-handle=2620,i,13144120510749095224,13275041285535164306,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:14
  2⤵
  PID:5620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5992,i,2203491571029674852,10894576096759874990,524288 --field-trial-handle=2620,i,13144120510749095224,13275041285535164306,262144 --variations-seed-version --mojo-platform-channel-handle=5996 /prefetch:14
  2⤵
  PID:5764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6000,i,1889642178294879129,6554238481600353826,2097152 --field-trial-handle=2620,i,13144120510749095224,13275041285535164306,262144 --variations-seed-version --mojo-platform-channel-handle=6016 /prefetch:1
  2⤵
  PID:4680
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6816,i,12191802656342396068,4048830932658992498,524288 --field-trial-handle=2620,i,13144120510749095224,13275041285535164306,262144 --variations-seed-version --mojo-platform-channel-handle=6832 /prefetch:14
  2⤵
  PID:4516
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6816,i,12191802656342396068,4048830932658992498,524288 --field-trial-handle=2620,i,13144120510749095224,13275041285535164306,262144 --variations-seed-version --mojo-platform-channel-handle=6832 /prefetch:14
  2⤵
  PID:5364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6880,i,5754278081098545898,14291664224883304340,524288 --field-trial-handle=2620,i,13144120510749095224,13275041285535164306,262144 --variations-seed-version --mojo-platform-channel-handle=6908 /prefetch:14
  2⤵
  PID:3548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6816,i,1175896208405593509,15132674655856194969,524288 --field-trial-handle=2620,i,13144120510749095224,13275041285535164306,262144 --variations-seed-version --mojo-platform-channel-handle=5064 /prefetch:14
  2⤵
  PID:856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6808,i,16110348451497552360,5716929723595265706,524288 --field-trial-handle=2620,i,13144120510749095224,13275041285535164306,262144 --variations-seed-version --mojo-platform-channel-handle=5076 /prefetch:14
  2⤵
  PID:1776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6012,i,6048086969077386825,15311778189060199859,2097152 --field-trial-handle=2620,i,13144120510749095224,13275041285535164306,262144 --variations-seed-version --mojo-platform-channel-handle=6108 /prefetch:1
  2⤵
  PID:2724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6336,i,1616544191251211579,3457231689511918249,524288 --field-trial-handle=2620,i,13144120510749095224,13275041285535164306,262144 --variations-seed-version --mojo-platform-channel-handle=4876 /prefetch:14
  2⤵
  PID:5348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7164,i,11782138333986688103,5175337569697841074,262144 --field-trial-handle=2620,i,13144120510749095224,13275041285535164306,262144 --variations-seed-version --mojo-platform-channel-handle=5724 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5828,i,7696636013510127817,11793875305613061881,524288 --field-trial-handle=2620,i,13144120510749095224,13275041285535164306,262144 --variations-seed-version --mojo-platform-channel-handle=5428 /prefetch:14
  2⤵
  PID:2280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5308,i,6368692881097698999,10723460337998928833,524288 --field-trial-handle=2620,i,13144120510749095224,13275041285535164306,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:14
  2⤵
  PID:2484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5628,i,7390467953484400168,11312809129622031812,524288 --field-trial-handle=2620,i,13144120510749095224,13275041285535164306,262144 --variations-seed-version --mojo-platform-channel-handle=6700 /prefetch:14
  2⤵
  PID:432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6016,i,7982001902149536993,14197875047136872578,524288 --field-trial-handle=2620,i,13144120510749095224,13275041285535164306,262144 --variations-seed-version --mojo-platform-channel-handle=6004 /prefetch:14
  2⤵
  PID:4220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=5612,i,3025922327842480468,6387182717139767846,2097152 --field-trial-handle=2620,i,13144120510749095224,13275041285535164306,262144 --variations-seed-version --mojo-platform-channel-handle=5808 /prefetch:1
  2⤵
  PID:2812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5804,i,12095887353301596350,15414308384756616112,524288 --field-trial-handle=2620,i,13144120510749095224,13275041285535164306,262144 --variations-seed-version --mojo-platform-channel-handle=5704 /prefetch:14
  2⤵
  PID:4060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=316,i,7402922282045361587,12257844346108809403,524288 --field-trial-handle=2620,i,13144120510749095224,13275041285535164306,262144 --variations-seed-version --mojo-platform-channel-handle=6108 /prefetch:14
  2⤵
  PID:1732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=6108,i,13099946257374819931,14393633803747821568,2097152 --field-trial-handle=2620,i,13144120510749095224,13275041285535164306,262144 --variations-seed-version --mojo-platform-channel-handle=6188 /prefetch:1
  2⤵
  PID:1520

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:6032

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1728

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1912

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:3576

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4896

C:\Users\Admin\Downloads\infectedvt0 20260810\To_zdnttjqb_Desk 4.9.7.3\To_zdnttjqb_Desk 4.9.7.3.exe
"C:\Users\Admin\Downloads\infectedvt0 20260810\To_zdnttjqb_Desk 4.9.7.3\To_zdnttjqb_Desk 4.9.7.3.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5632
- C:\Users\Admin\AppData\Local\Temp\is-Y4NW48O9TE.tmp\To_zdnttjqb_Desk 4.9.7.3.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-Y4NW48O9TE.tmp\To_zdnttjqb_Desk 4.9.7.3.tmp" /SL5="$80364,124068868,1054720,C:\Users\Admin\Downloads\infectedvt0 20260810\To_zdnttjqb_Desk 4.9.7.3\To_zdnttjqb_Desk 4.9.7.3.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4948
- - C:\Users\Admin\AppData\Local\Temp\b6126aa70d1e9854e70bebec5e972499.bak\agent.exe
    "C:\Users\Admin\AppData\Local\Temp\b6126aa70d1e9854e70bebec5e972499.bak\agent.exe" -Embedding
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:3956
- - C:\Users\Admin\AppData\Local\Temp\b6126aa70d1e9854e70bebec5e972499.bak\ToDesk_4.8.8.9.exe
    "C:\Users\Admin\AppData\Local\Temp\b6126aa70d1e9854e70bebec5e972499.bak\ToDesk_4.8.8.9.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:4352

C:\Windows\system32\wscript.exe
C:\Windows\system32\wscript.exe C:\ProgramData\interfaceNT\kcrjubsu.vbs
1⤵
- Executes a VBScript file via the Windows Script Host.
PID:3132

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ac1b1f93ff87eb876027f4166d705375c0f5d3d22dcb03f6a66f6100e88dd10f
MD5 b99f03c5cfe71b03836f8b5fcf09425b
SHA1 8a5078499c0b5ea40183efb77f9c1028c196409c
SHA512 6b9feec4ead7bf05f67d0d480907e21a3b770d8d12dedd2b0d785904186eac7448583e61abacb23582948de55c8ea2043bfd6908efd7faecdd82cee91404cfe6
TLSH
T16DD02BE037909D18C440353163D0122091006C30880923090100A02C8D3E2C3054F0BE
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c95a47aec5edba88214fad580cb869417b6620a91d8ee97e2d0b7801d3372be5
MD5 aad5f2ca0dd16bb2ea6c7757ea569c50
SHA1 5228b0b132542be004ea1bb32f3748964d065af5
SHA512 9d59c0291d741bd9d6cf50c22972d4baef00e7c1a48d6a3311a6cc82c04ceeba6e2be9458334cb954878915cc9eb91a8fd8bc4a47c966d57a2a05d6ee8211640
TLSH
T1D4D09BE177A19D18C545353567D1522591416D31451927194241E13D9D7E2C3455F0AA
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 a7a910eb2e4c70c1fbb7acbd74cf8a7985590353d8dceaea028160707d9b5c45
MD5 5c4e5366ed366f20700ae6df14f81d8f
SHA1 41edf1fd36479931f171957b0bed1c53b599e45e
SHA512 b54f3b66f66fb5321ed1b0ff67bc08193b08989aca4af8a3f142e5ec66661408b4aac2fc26c8744c090b4b6c60795cd867d3540c1d294be783d861ff0330e8e2
TLSH
T1CFE026C50ACEC3AEFA506647516C530CD280760AA3DCFD0AAB0C858870C5044BB836B0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 30a00e08343af4ff5112259823900bd07125a447750d574a616c5f09f35c2982
MD5 ad8746b88fb85f677dee6734890b3b15
SHA1 6a3b9b5553b01238b7bbeb712313170b42bfa19c
SHA512 49156130931e5c162fe3314f3cbc539f9c7decf3092d4ea6f302870bf9375567a7eedd7af5aa5be6647f810d94d0dccb69cc26e165a8ac026420d675bb1e07a7
TLSH
T1A1E0DFA404DCC36EAF40F48B52F8530C8280370E9BC8FD4A174888887181444AB836B5
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 5312940b590cdba45a3b449b00ea1b15bab7e568c0637058e066e82bbc951e31
MD5 7d3c38740caa13352900b8d91ac7645b
SHA1 9f1a2e73d83837856238d7e147a4a9d74ae46a9e
SHA512 811771ee05a7a7a72337e0df9f6e9f1c094e05a2f8bc32768f68ce72a26628095ed6a10e1205267fc710a1f9ce6742eded60de862348b43b4092b47c3f8c27f5
TLSH
T144E026C905DDC32FFA50B587A1FC530C8AA0370AD3CCFD8A2704C584B442944AB83AF0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 02c0e0ef4aa5faef5a716caf888cd1899602a619b633b7cc85141105a450a588
MD5 e30baf4e017dd1f384f9fdb6661f51aa
SHA1 9290a3d2ce5cdc296a944974740f97629176f961
SHA512 9442ba0f78bf76ff50be0b444cdaa5de942d55fbb5dbceda9e40d0c1139c37a20bc5d791ef784d2371d046bb67f1374888816725d4c58c26e61dc4cfeb1f3f23
TLSH
T18161509B935109CEDB248E7852D0F44E3BF8E47D8717AE1461E76DB0940AFC4D2D002B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe595e72.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe595e72.TMP
Size 3KB
SHA256 7c9c72625829f34ea6f6f19acce5aec2705681fe9ac7b398d0c15ab9ace5b238
MD5 c90d6e6c57d9816689e51d6d770eabf1
SHA1 beecca7c5f9638af30b3ba692fac12e04937083b
SHA512 e850b96728ceb2f908df5bbdf8b509035e7891eb88f6f51d4ccf3c35f71c2b90bb8c5b4266c0d93b33b57c5b5a98fdc0748454f691538c53992d02aec805c7d6
TLSH
T15361309B935109DEDB258EB852D0F44E3BF8E47D8717AE1461E76DB0940AFD4E2E002B
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 202a3f294c83b514b32b522fcfaf1e7ba4aeba3254816a71d3d22e8d40647198
MD5 662992e596837ef40bd784d863b14593
SHA1 6d37e6dbb8b4e7522e12465ba24cc129a65faabf
SHA512 1311506e520713b01803733b1ff6b35d62094d7aa75e3376d2dad6ae8398a80040d79c6b4e7494edf4351a196c2373aa759da806ce2d0482cb684d2ed7c85c26
TLSH
T180319CF783F4957E9A0196F0AA14AE2FCE2D0515831C7C6AC5E4AE2793E3462E041A5F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 c74bbb985fa26108161e6eacd5a914cb6c8c0ff2991fef8e01ab4383cbdd5c5a
MD5 a89a61f32e3bafd666522dd971c526a9
SHA1 e8d7d8cd2cec81dac3cafbe7b9ddacc56392ee41
SHA512 7ceeb5c62a8e2a77f7b1cb29d3deb30273009f497388dd06a05588473d927c1ae0329e44ec9b289b4d979f3046305e3659ab6971ff33e55350e0bdc1d7569701
TLSH
T16631BEF747B4956EDA1196F0AA18AE2FCE2C0511431C7C69C5E0AE2793F3472E042B6B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 e747b360b0d6ed5ccd51d48c77e25782668d3638f6ca5282efc396ffa8401eba
MD5 13ae9604e56999424efd18d92727f058
SHA1 d3b161aff4915fc0f41fbb261630cf83fa99a683
SHA512 be4f05c526d4a7c689e6578ee25ef086f79b82d039f20d283b99606d7250a28ab8507c03d03b0863cf3f073d233201a584115eef373c68b7b664f7c06b37dc48
SSDEEP 192:sxRDR3UOX/f2sglwGJzoA8pi/g6+WNIYoMzxCYvG7IgDKJ:sxRDxDX/f2sglpUi/5IWU5q
TLSH
T17832C7566928A93B8CCBE21DFB65BF53D2F95032A0D42E58A7FC961C04E76DD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 40088e61a6e59f338cb49cb670757f320988400bb4c39c2677a7be76ed5d0d7d
MD5 e3ec38139f99da4d76f0ca6ee6ee0ca3
SHA1 fa3c66f1c7345a94fa37788f8a7ad76a573f3d83
SHA512 a41eaab04886ca82cce2a42d2a6b426c95de44a47875b7259fb047fbfe0482b578e4c07e07a7882b471993fae97d914b91f5ddecd7ca6191d2e9e93c75b3c8be
SSDEEP 192:sxRcR3UOX/f2sVGwGJzoA8pi/g6+WNIYotz1CYvG7IgIJ:sxRcxDX/f2sVGpUi/5INA5s
TLSH
T1CB32C7166A28A93B8CCBE21DFB65BF53D2F91033A1D42E58E6FC961C04E66DD120740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 745c9e8dd5635c5513de9bf3f224dc3614183ec796efdf8ed03f8e6f38f57fa6
MD5 11515a73424213e38ee8f992c7d2fd1b
SHA1 61f646f85cc15c9664ab3f19c7a4fa9110679e5a
SHA512 573b1d460c8859f83de5b232cfa5c7315094ce812e1979f3b141f7c65a7dc1b039e88987e734856ee94df3f19c3bf39eb896303fc965c00b42d6da391644e793
SSDEEP 192:sxRDR3UOX/f2sgGwGJzoA8pi/g6+WNIYotz1CYvG7IgD4J:sxRDxDX/f2sgGpUi/5INA5g
TLSH
T15032C8566928A93B8CCBE21DFB65BF53D2F91032A1D42E58E6FC961C04E76DD120740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 b89ac690f23aea8b098a282328930565556841d218267d52f6f7db863ba5bd80
MD5 a502f4770323b40993c8bf9acefb402c
SHA1 19a5cfe235642469643572cbd4679d57f33b713d
SHA512 88c4585d715dacb8b35e80d6363d919df3f38a1d3f005df33e62ae920e37f1e681a2c5f9f90b0b0cadbad0d87656f0716c2ec6c7f3ac9196813c12c225385e72
SSDEEP 384:jzK6H0dfCtgsqFf02KhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVvf9uaRXyro98n:j26H0RWgs2f028F1+UoAYDCx9Tuqh0VF
TLSH
T1A9B2DB2B640DCBBE5F800A9DDC19AFDB6D9802C79B588D4047FE994C03C77EA911A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\519add53-5ce5-463c-ad3a-13b0f175f812\index-dir\the-real-index
Size 528B
SHA256 5285966a6d12306f4f6f5fac7ef74d24f4bd3745f5e7327296dba81dad50198a
MD5 e3f5041b41ba16d2853c5f1efde3417c
SHA1 a505e6a0d7e98bde049000b3023fab03f4a9219a
SHA512 238f378a46d86f01cd1d91690c39368cdc32245f23831c07ac1366831e7f2b98fce742499d0cfa510fa0cb35722095c95c0b4ff28593e13bd5a2a8704f03fbc3
TLSH
T114F0F1E7CCA5E447D922BCBB163A255B333E01FD26019D96006D702D9A2693C4341302
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5d9f50.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\519add53-5ce5-463c-ad3a-13b0f175f812\index-dir\the-real-index~RFe5d9f50.TMP
Size 528B
SHA256 7e6724b62aac19de13dd578f1e4e4a5498507c369dd035ad627ce640c398b8c6
MD5 94f0958c342d481f8f558cb5098f65ff
SHA1 ed32603d482190fc5b430c062638a6d7969a4a0d
SHA512 e893af000eefbe7cec71b5552db1eda9ec7b388e399fc0d3a21959dd66c29b44de554a72667bd5811c58648feb73859ca92cffa209fee063748ab686edafd2be
TLSH
T126F0C0FB40A1FC92D925A9F56506601F733F0C303625E65F609B342E59726B9C782B46
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 76f3cb7d3947b65e706f87128fbf774df149f15ba0ea9ed6df59e03dcefa0dc1
MD5 7776ce3421116f2bf63da8479164133b
SHA1 da738f8b86edbb09ea224845196b33f73c3d6deb
SHA512 f41ef6969ebba0a07727b4a89003c287531d421d76d6d4f071def2350b2a5248dcfa89ada869cd300f387d940f76a8a2e9896b23a9b64f68876a7c0ba93291f1
TLSH
T1DAE0D8B639D72810ECBF97E55830E4940241B554D408EC8F611E92C750F22923C9AC71
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

d6b22ff1-b7dc-4a1a-8131-8e6b0e0d54de.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\d6b22ff1-b7dc-4a1a-8131-8e6b0e0d54de.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 eee1f2f81f6b3aba144769eccbc756b8d59b63c3b8662b843e2088855fab1b31
MD5 9f5c1249964cde19e092d2089fe39c45
SHA1 1b766b60262b51ca0b3979ffb4fcaa8fc54a0492
SHA512 24fd55e306e95fc3cd91738dd11d6c51adc303e483a475a900f5989607421ebf5a0add06851954e680b0d4df0d309a5d85894d37b7a4d2e273352aad060f7b7b
SSDEEP 768:pL3vgwX/TBOWsLQjtbONXyer1IRCzni9hhy6Dq/Ww:pL3vgAQ0SIqnaT0x
TLSH
T148F2BF30D590AE274CE6F396B5463743AEF85017D6C84BA0AAEE6F1E05C755E130F81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 52a6a35337058567e49732a655b5a480c16b348567b650e02517e326ce61dedb
MD5 3bc8f6d37a3b85cbe3b908ec3a90bd9c
SHA1 2ac9f7135ca7c79e39947591635959a635524ce0
SHA512 52c05e5e371ed37073a1b96b4fe27a5232f82eadf2739e5f603703fe31d402ce9577cb1a487f52394d94261b775b650969196708354132354b5405f8191ac09f
SSDEEP 768:zrv+4UNbdA3vnwX/TBOWsLQjtbONXyer1IRCzni9heVH1SKa:zbsbK3vnAQ0SIqnaEH1Q
TLSH
T1BF13BF31A598AE338CE6A3D6B14772437FB8501BC6C407A0D9EA1F5E06DB59E130F91B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 2c4c5ec99da49b106d108f7361d6f6f7bdfb43fa2ef987ae17bba9689ab63498
MD5 869d75bad1de95b1e62d0153082dc0ac
SHA1 0de5a79cf5645ffc63d94da1210eb555f6f47d40
SHA512 da1c983fb1d0ece904857031cce13fdd17d4fd5764c04411e762edab5f5eecb961c52aefa4ac7200a1cc6deacc5fd72f0158e19b921236c177fef68ae695980d
SSDEEP 768:srv+4UNbdA36nxX/TBOWsLQjtzONXyer1IRCzni9heVH1SK3:sbsbK36nNQ6SIqnaEH1R
TLSH
T11913BF31A5A8AE334CE2A3D6B14772437FB8501BC6C407A0E9EA2F5E06DB59D130F917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 c568e2153f3a81ad9af269ba3973f92d1f2c041f52d96b9d0069a058fde9ca99
MD5 0fddee19b420f608b01b8420fad3cecb
SHA1 4a325c87332d31998300f1ce00bc1e46ee0674a7
SHA512 db8cecb66772d04962e788df2e5c885978255f5f6347e336fd21c2ee3155deb4ec597c767338103add53a1d2312980b5e5ea8894bc94d4ec4f7f01968e2f6de6
SSDEEP 768:9F8B3xwgXpoX/TBOWsLQjtyONXyer1IRCzni9lhy6Dq/Ww:4B3npoQ9SIqnCT0x
TLSH
T1AD03AF31D594DE379CAAA7C6F54A3303AFF80067CAC497A0ABDE6E1D018759D130F81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 4c7a7e7754115eccec581fbaac3f271b0df49ac635ca1cf29f530eec327f5123
MD5 0ee7919dcfcedd454e0f9932d5b9ef96
SHA1 e7f15bbbfa83a89d0b3ad5b1f3ebc5c0c000bcea
SHA512 24c6ab21be92bb81fbfaeb34dbdfa3d5d0a35549801e6958dae5f85cc98a1c72742d94f0de048c2cddea365ebaa711c9d786e07bd0d18dd5278976810b3a7886
SSDEEP 768:9FQf3rwgbgwX/TBOWsLQjtYONXyer1IRCzni9hhy6Dq/Ww:Mf3VgAQLSIqnaT0x
TLSH
T19A03AF32D5949E378CEAA7D6F54A3303AFF85067CAC496A0ABDE6E1D018759D030F817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 b63fc6f14df0e2f3791130fb8f9d3c9c6838a7daf70922db014d7520180c12c7
MD5 878179844d631437de3f9a078223acae
SHA1 9c196a98ed8d9d5d7c36f78c50be31c54778f9f1
SHA512 764e16e624e0114adb0409ba0c6e434dd32be3af3ae8cd41e37b5a4a78c3780eb4c66fd4ea582ac6ee318f74421131195071a72c291fc55e4a3c10ef8cc4e564
SSDEEP 768:5rv+4UNbdz3Nl/TBOWsLQjtYONXyer1IRCzniwheVH1SK7:5bsbV3nQ/SIqnlEH1l
TLSH
T17A03BF32A598DE334DE2A3D6B04772037FB8605BC68407A0EDDA2F5E069B59E130F957
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 c90ae091148b9a6124763ed0f9b02e5607892310473111cf516679e90a616b6e
MD5 a77939e585053789ef5e5e610fb2da14
SHA1 e9a67925ef14fa902d5e1be62efcdba11a0fe44a
SHA512 4407f29e77fa32e02c4b6a3ca40413e9fefc5b3f09f2e8508ece05f3f0bd686b34c7336f854e6180564c9bb7743522fbcd2a722d05c5e8e8b47040ada34c39d9
SSDEEP 768:hrv+4UNbdz3Qz/TBOWsLpONXyer1IRCzniBaeVH1SK7:hbsbV3cQpSIqnBEH1l
TLSH
T10903BE36E4A89E378CE2A3C6B14773037FB86057D68407A0D9DE1F4E069B59D130B957
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

GameuxInstallHelper.dll

Path C:\Users\Admin\AppData\Local\Temp\b6126aa70d1e9854e70bebec5e972499.bak\GameuxInstallHelper.dll
Size 100KB
SHA256 877458d4d3d525c3a96ed5ea9b7e42b74f15eae671cf9d6fb7389ea07202f17b
MD5 c731c48c1ac5cb5043c86a77b07c3e82
SHA1 3941fd66a561ef703d09b74ff08d7d4e5aaffc22
SHA512 9a91e44635358fd2fb3a040fac91b952d649757995607826554b05ba4f510ee413a03075b251170db3c256985fadf3a86d9d4aa33a9056da6cf6ed93c952c01d
SSDEEP 1536:bMftYHteQD4BW0c+iZHSMUryRixmuaVdLYuPhMmKL2CIOYGi/QL01:bgtYN4WDQJrmixgjnSL2gYGigS
TLSH
T126A35C81FAC341F2E93B56B08CD7A7BF8631B3124579DDFBE68C9B44B813B011949289
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

agent.exe

Path C:\Users\Admin\AppData\Local\Temp\b6126aa70d1e9854e70bebec5e972499.bak\agent.exe
Size 111KB
SHA256 f90b1a6b44010a5393c62431eccb7a3318f42e63cf8a66edd9ebe1305e2f395e
MD5 35ca55c796a7abb13ca96711fe010401
SHA1 720a6f37de959db9a0dee8e0533037df25990599
SHA512 12e4cab24bf51961d547bc290d747d1bb496eb5fd2748ddb574e9b88e553f2b764ed12acf6b7530bc33563b2aa07ccfaefbfb65d2a3512f45a67969f02a7a980
SSDEEP 1536:WhSUvJEGEfSySB59j+I3eTw/b7jZFVc5D4BtTGYywBu3PmeVYzi7+eLcYQ+hAnLV:ET+fSrbInY3eD4Btn2P9Ym+MrAnLvrh
TLSH
T1B6B3AE423790D072E0621A309965C6718F377C329BB985CB37907E7E3EB17C1A93636A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

To_zdnttjqb_Desk 4.9.7.3.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-Y4NW48O9TE.tmp\To_zdnttjqb_Desk 4.9.7.3.tmp
Size 4.3MB
SHA256 3f564dbe365c1e7e994d05d530c4c9c6cbee8ee5f379f24de99b833a12aa0692
MD5 651f52361c61f557c34bfae67205c4cc
SHA1 b76b0e6f92b2aca7fca8fd684bc7e48945a31d8c
SHA512 86912c444843d876cf1a506db229ee98a79d6212478f6d32f50a1ff047486a6f965f7e3cee8c19a66c7d498f11a3ab0abda559405239c4232166be76ae497e2a
SSDEEP 98304:i9SZUvl30aj90ZFcvdQ0hdgvminQLMj+J/3337:pItJj90Z6RgKwk
TLSH
T113268E03B388753AE4B71A3A883FA650583F7E213926CD4B6BF4395C4F395416D2A787
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsqD669.tmp\System.dll
Size 12KB
SHA256 6950991102462d84fdc0e3b0ae30c95af8c192f77ce3d78e8d54e6b22f7c09ba
MD5 8cf2ac271d7679b1d68eefc1ae0c5618
SHA1 7cc1caaa747ee16dc894a600a4256f64fa65a9b8
SHA512 ce828fb9ecd7655cc4c974f78f209d3326ba71ced60171a45a437fc3fff3bd0d69a0997adaca29265c7b5419bdea2b17f8cc8ceae1b8ce6b22b7ed9120bb5ad3
SSDEEP 192:BenY0qWTlt70IAj/lQ0sEWc/wtYbBH2aDybC7y+XB9IwL:B8+Qlt70Fj/lQRY/9VjjlL
TLSH
T121427D1193B089F2F590593805A67F2A6FBEAC6C27E44963CFE345853D702DFA47A243
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsNiuniuSkin.dll

Path C:\Users\Admin\AppData\Local\Temp\nsqD669.tmp\nsNiuniuSkin.dll
Size 287KB
SHA256 33e460a080a621cda7896e96b6f1beee802b485cf99e18b27463cd362c484b08
MD5 bb0cdff5ac2d64723007a0b4f7962a02
SHA1 410889522ee8ea7308b054f71bc4cab078295e06
SHA512 b4dc2614f01f5f01d5dec9e6a41e072d01e924d8a94ac0dc1050399fd1dc3cc8d53d7ccf162d750d166fca200771b0850191b30c7caada8edea9ba6d686e2402
SSDEEP 6144:EfuMPhou62ZrZxAxgGTpMayh91VDrH10nCRwbDB0Q5MeKxhwNsN:M3hC2lZxAxSpRbWnmADBpM+iN
TLSH
T15A5422462F7D6833F8FC0E3A76844625B513E253A431C4C912BDDB80E97572B6B8A24B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

skin.zip

Path C:\Users\Admin\AppData\Local\Temp\nsqD669.tmp\skin.zip
Size 854KB
SHA256 9afa065f2fdda10faad78086a2468141a903e8359dfcfa8f3e281e2c0a954d7e
MD5 a6b30245b1b794d3a6f9e72c8cfd98d7
SHA1 cd32bb02f91ecfdf4dfb59e87cd69f9460b5379d
SHA512 a09b0729f48afd2880835248afede9a36f53c333819a3faa009fb7d5a0a353fe57cca2b2d6f8324f9429e3d1e2429464c349a1fa8f1733347f069221985aa1bb
SSDEEP 24576:bzEezYdwD3qufpJu0vTRG0L1izNhoumS2IAwPR:bHzYd89pJ/paTo3IAW
TLSH
T1A01523D7EB5778EFD919C73A30A70A8DAC69C1020791A7073FEA71B86D42F084B69711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

infectedvt0 20260810 (1).zip.crdownload

Path C:\Users\Admin\Downloads\infectedvt0 20260810 (1).zip.crdownload
Size 9.0MB
SHA256 af14facf07dd1fe6111f54a8b61f94eb58b5c6e6a11852ee5c23fa3f86e13b9c
MD5 b033196cb690fb091854294908b11ca5
SHA1 1d386ea0efbe8775474fa44b22f07af1521898a0
SHA512 e63e599adfeece190d61925682364614af8423a2678299fe56a3722cec9c683b890e9198004622cde1e1a18d8cae447f782147bdbb60802e30329dd175b94619
SSDEEP 196608:yRwA5CUQS0XwNd1Uw6pIqWbAqbKZoVEOZ3mC43Cyx5ROI:kqULqwNLUzS3EqUohty3zOI
TLSH
T14C96331C726AE7E774D44B6845418F68F602852A6AA193C07499FEFC23EAF431B484ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3956-505-0x00000000027F0000-0x0000000002864000-memory.dmp

Download

memory/3956-536-0x0000000003170000-0x00000000031B8000-memory.dmp

Download

memory/3956-583-0x0000000004330000-0x0000000004459000-memory.dmp

Download

memory/3956-565-0x0000000004330000-0x0000000004459000-memory.dmp

Download

memory/3956-482-0x0000000000580000-0x0000000000586000-memory.dmp

Download

memory/3956-485-0x0000000010000000-0x000000001002D000-memory.dmp

Download

memory/3956-498-0x00000000027F0000-0x0000000002864000-memory.dmp

Download

memory/3956-508-0x00000000027F0000-0x0000000002864000-memory.dmp

Download

memory/3956-509-0x00000000027F0000-0x0000000002864000-memory.dmp

Download

memory/3956-506-0x00000000027F0000-0x0000000002864000-memory.dmp

Download

memory/3956-507-0x00000000027F0000-0x0000000002864000-memory.dmp

Download

memory/3956-567-0x0000000004330000-0x0000000004459000-memory.dmp

Download

memory/3956-514-0x00000000027F0000-0x0000000002864000-memory.dmp

Download

memory/3956-513-0x00000000027F0000-0x0000000002864000-memory.dmp

Download

memory/3956-495-0x000000006F0E0000-0x000000006F0F0000-memory.dmp

Download

memory/3956-518-0x00000000027F0000-0x0000000002864000-memory.dmp

Download

memory/3956-523-0x00000000027F0000-0x0000000002864000-memory.dmp

Download

memory/3956-516-0x00000000027F0000-0x0000000002864000-memory.dmp

Download

memory/3956-521-0x00000000027F0000-0x0000000002864000-memory.dmp

Download

memory/3956-522-0x00000000027F0000-0x0000000002864000-memory.dmp

Download

memory/3956-520-0x00000000027F0000-0x0000000002864000-memory.dmp

Download

memory/3956-519-0x00000000027F0000-0x0000000002864000-memory.dmp

Download

memory/3956-517-0x00000000027F0000-0x0000000002864000-memory.dmp

Download

memory/3956-515-0x00000000027F0000-0x0000000002864000-memory.dmp

Download

memory/3956-524-0x00000000027F0000-0x0000000002864000-memory.dmp

Download

memory/3956-531-0x0000000003170000-0x00000000031B8000-memory.dmp

Download

memory/3956-533-0x0000000003170000-0x00000000031B8000-memory.dmp

Download

memory/3956-532-0x0000000003170000-0x00000000031B8000-memory.dmp

Download

memory/3956-530-0x0000000003170000-0x00000000031B8000-memory.dmp

Download

memory/3956-525-0x0000000003170000-0x00000000031B8000-memory.dmp

Download

memory/3956-535-0x0000000003170000-0x00000000031B8000-memory.dmp

Download

memory/3956-566-0x0000000072CB0000-0x0000000072CD1000-memory.dmp

Download

memory/3956-539-0x0000000003170000-0x00000000031B8000-memory.dmp

Download

memory/3956-545-0x0000000003170000-0x00000000031B8000-memory.dmp

Download

memory/3956-544-0x0000000003170000-0x00000000031B8000-memory.dmp

Download

memory/3956-543-0x0000000003170000-0x00000000031B8000-memory.dmp

Download

memory/3956-542-0x0000000003170000-0x00000000031B8000-memory.dmp

Download

memory/3956-541-0x0000000003170000-0x00000000031B8000-memory.dmp

Download

memory/3956-540-0x0000000003170000-0x00000000031B8000-memory.dmp

Download

memory/3956-538-0x0000000003170000-0x00000000031B8000-memory.dmp

Download

memory/3956-537-0x0000000003170000-0x00000000031B8000-memory.dmp

Download

memory/3956-546-0x0000000004330000-0x0000000004459000-memory.dmp

Download

memory/3956-563-0x0000000004330000-0x0000000004459000-memory.dmp

Download

memory/3956-562-0x0000000004330000-0x0000000004459000-memory.dmp

Download

memory/3956-561-0x0000000004330000-0x0000000004459000-memory.dmp

Download

memory/3956-560-0x0000000004330000-0x0000000004459000-memory.dmp

Download

memory/3956-559-0x0000000004330000-0x0000000004459000-memory.dmp

Download

memory/3956-558-0x0000000004330000-0x0000000004459000-memory.dmp

Download

memory/3956-557-0x0000000004330000-0x0000000004459000-memory.dmp

Download

memory/3956-556-0x0000000004330000-0x0000000004459000-memory.dmp

Download

memory/3956-555-0x0000000004330000-0x0000000004459000-memory.dmp

Download

memory/3956-554-0x0000000004330000-0x0000000004459000-memory.dmp

Download

memory/3956-553-0x0000000004330000-0x0000000004459000-memory.dmp

Download

memory/3956-552-0x0000000004330000-0x0000000004459000-memory.dmp

Download

memory/3956-551-0x0000000004330000-0x0000000004459000-memory.dmp

Download

memory/4352-455-0x0000000073E10000-0x0000000073ECA000-memory.dmp

Download

memory/4352-574-0x0000000073E10000-0x0000000073ECA000-memory.dmp

Download

memory/4352-581-0x0000000073E10000-0x0000000073ECA000-memory.dmp

Download

memory/4948-445-0x0000000000A90000-0x0000000000EFB000-memory.dmp

Download

memory/5632-412-0x0000000000C10000-0x0000000000D20000-memory.dmp

Download

memory/5632-447-0x0000000000C10000-0x0000000000D20000-memory.dmp

Download