ratonrat | 2a9b7d697b3342b1c1a4e3c5a20fce99d709b4a54c5eed13aa1da36dc74026ff

Analysis

user interaction
yes
max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/08/2026, 10:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ratonClient2.exe
Size 2.4MB
Sample260811-mt968s1erd
SHA256 2a9b7d697b3342b1c1a4e3c5a20fce99d709b4a54c5eed13aa1da36dc74026ff
MD5 12dd94bcf857ca42d1fa84d3f2ee102f
SHA1 11cc77737fe450801b3cfd2d860493134d28d7e5
SHA512 2266d0db72ad7af6841dc3c20f54715f6ab14775080f3a5f25557d7a6eb8e3cb9dfcf0ddc6a0c4dc8394f8b9669d27f7adf1b3b272eb205fed450f6a8091954b
SSDEEP 49152:oNgVUlsHjkmiGWU5+5WDtsclR0BxMzaRw4BKA:QgVUuHjkDGjYQDGuRxzew
TLSH
T196C5016833F9860CF1BF0BF8A4B149664B71FC079C96D76D18A579DE04B6F44AA10B23
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution ratonrat stealer

Malware Config

Extracted

Family

ratonrat

Version

Professional

37.30.16.2:4782

Mutex

NTZUlt6BdZqHiASFAYRxYlE

Attributes

assist
false
box
false
box_icon
Error
box_msg
I'm the message box description
box_title
Hello World
defender
true
delay
1
hide_file
true
open_website
true
password
t.me/junk_code
process_critical
false
raw
silly21
reconnect
5
startup
false
tag
VM
uac
false
vm
false
website
https://youtube.com

Signatures

Family: RatonRAT
RatonRAT is an information stealer written in C#.
stealer ratonrat

Detects RatonRAT payload 2 IoCs

resource	yara_rule
behavioral2/memory/5856-1-0x00000169FCF90000-0x00000169FD206000-memory.dmp	family_ratonrat
behavioral2/files/0x000d00000001c4fb-62.dat	family_ratonrat

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3216	powershell.exe
3216	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
5672	ratonClient2.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4120_2038290332\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4120_2038290332\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4120_2038290332\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4120_2038290332\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4120_2038290332\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4120_2038290332\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4120_2038290332\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4120_2038290332\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4120_2038290332\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4120_2038290332\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4120_2038290332\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4120_2038290332\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4120_2038290332\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4120_2038290332\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4120_2038290332\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4120_2038290332\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4120_2038290332\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4120_2038290332\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4120_2038290332\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4120_2038290332\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4120_2038290332\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4120_2038290332\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4120_2038290332\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4120_2038290332\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4120_2038290332\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4120_2038290332\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4120_2038290332\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4120_2038290332\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4120_624069119\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4120_2076847242\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4120_2038290332\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4120_2038290332\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4120_2038290332\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4120_2038290332\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4120_2038290332\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4120_1199467966\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4120_2038290332\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4120_2038290332\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4120_2038290332\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4120_2038290332\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4120_2038290332\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4120_2038290332\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4120_539110758\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4120_2038290332\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4120_2038290332\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4120_2038290332\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4120_2038290332\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4120_2038290332\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4120_2038290332\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4120_2038290332\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4120_2038290332\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4120_2038290332\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4120_2038290332\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4120_2038290332\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4120_2038290332\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4120_2038290332\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4120_2038290332\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4120_2038290332\_locales\mk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4120_539110758\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4120_1199467966\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4120_2038290332\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4120_2038290332\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4120_2038290332\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4120_2038290332\_locales\fr\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4608	cmd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2492	msedge.exe

Delays execution with timeout.exe 2 IoCs

defense_evasion

pid	Process
5968	timeout.exe
4600	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134309188509883422"	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-552508041-2681165170-3229858294-1000\{B2B2381B-287B-407C-8F20-68CAE9875A68}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-552508041-2681165170-3229858294-1000\{FB211DC7-C7BC-4582-AC13-03A8E83D7F84}	msedge.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
3216	powershell.exe
3216	powershell.exe
3216	powershell.exe
2788	msedge.exe
2788	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe

Suspicious use of AdjustPrivilegeToken 23 IoCs

description	pid	Process
Token: SeDebugPrivilege	5672	ratonClient2.exe
Token: SeDebugPrivilege	3216	powershell.exe
Token: SeIncreaseQuotaPrivilege	3216	powershell.exe
Token: SeSecurityPrivilege	3216	powershell.exe
Token: SeTakeOwnershipPrivilege	3216	powershell.exe
Token: SeLoadDriverPrivilege	3216	powershell.exe
Token: SeSystemProfilePrivilege	3216	powershell.exe
Token: SeSystemtimePrivilege	3216	powershell.exe
Token: SeProfSingleProcessPrivilege	3216	powershell.exe
Token: SeIncBasePriorityPrivilege	3216	powershell.exe
Token: SeCreatePagefilePrivilege	3216	powershell.exe
Token: SeBackupPrivilege	3216	powershell.exe
Token: SeRestorePrivilege	3216	powershell.exe
Token: SeShutdownPrivilege	3216	powershell.exe
Token: SeDebugPrivilege	3216	powershell.exe
Token: SeSystemEnvironmentPrivilege	3216	powershell.exe
Token: SeRemoteShutdownPrivilege	3216	powershell.exe
Token: SeUndockPrivilege	3216	powershell.exe
Token: SeManageVolumePrivilege	3216	powershell.exe
Token: 33	3216	powershell.exe
Token: 34	3216	powershell.exe
Token: 35	3216	powershell.exe
Token: 36	3216	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4120	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5856 wrote to memory of 4608	5856	ratonClient2.exe	88
PID 4608 wrote to memory of 2004	4608	cmd.exe	90
PID 4608 wrote to memory of 5968	4608	cmd.exe	91
PID 4608 wrote to memory of 5672	4608	cmd.exe	92
PID 4608 wrote to memory of 4600	4608	cmd.exe	93
PID 5672 wrote to memory of 4120	5672	ratonClient2.exe	94
PID 5672 wrote to memory of 3216	5672	ratonClient2.exe	95
PID 4120 wrote to memory of 5132	4120	msedge.exe	97
PID 4120 wrote to memory of 4324	4120	msedge.exe	98
PID 4120 wrote to memory of 2492	4120	msedge.exe	99
PID 4120 wrote to memory of 4324	4120	msedge.exe	98
PID 4120 wrote to memory of 4324	4120	msedge.exe	98
PID 4120 wrote to memory of 6016	4120	msedge.exe	100
PID 4120 wrote to memory of 6016	4120	msedge.exe	100
PID 4120 wrote to memory of 3236	4120	msedge.exe	101
PID 4120 wrote to memory of 3236	4120	msedge.exe	101
PID 4120 wrote to memory of 3236	4120	msedge.exe	101
PID 4120 wrote to memory of 1516	4120	msedge.exe	102
PID 4120 wrote to memory of 1516	4120	msedge.exe	102
PID 4120 wrote to memory of 1516	4120	msedge.exe	102
PID 4120 wrote to memory of 2460	4120	msedge.exe	104
PID 4120 wrote to memory of 2460	4120	msedge.exe	104
PID 4120 wrote to memory of 2460	4120	msedge.exe	104
PID 4120 wrote to memory of 4488	4120	msedge.exe	105
PID 4120 wrote to memory of 4488	4120	msedge.exe	105
PID 4120 wrote to memory of 4488	4120	msedge.exe	105
PID 4120 wrote to memory of 2108	4120	msedge.exe	106
PID 4120 wrote to memory of 2108	4120	msedge.exe	106
PID 4120 wrote to memory of 4576	4120	msedge.exe	109
PID 4120 wrote to memory of 4576	4120	msedge.exe	109
PID 4120 wrote to memory of 4576	4120	msedge.exe	109
PID 4120 wrote to memory of 2016	4120	msedge.exe	110
PID 4120 wrote to memory of 2760	4120	msedge.exe	111
PID 4120 wrote to memory of 2016	4120	msedge.exe	110
PID 4120 wrote to memory of 2760	4120	msedge.exe	111
PID 4120 wrote to memory of 5692	4120	msedge.exe	112
PID 4120 wrote to memory of 5692	4120	msedge.exe	112
PID 4120 wrote to memory of 5692	4120	msedge.exe	112
PID 4120 wrote to memory of 2028	4120	msedge.exe	113
PID 4120 wrote to memory of 2028	4120	msedge.exe	113
PID 4120 wrote to memory of 2608	4120	msedge.exe	115
PID 4120 wrote to memory of 2908	4120	msedge.exe	118
PID 4120 wrote to memory of 2908	4120	msedge.exe	118
PID 4120 wrote to memory of 4112	4120	msedge.exe	119
PID 4120 wrote to memory of 4112	4120	msedge.exe	119
PID 4120 wrote to memory of 3520	4120	msedge.exe	120
PID 4120 wrote to memory of 3520	4120	msedge.exe	120
PID 4120 wrote to memory of 3080	4120	msedge.exe	121
PID 4120 wrote to memory of 3080	4120	msedge.exe	121
PID 4120 wrote to memory of 5412	4120	msedge.exe	124
PID 4120 wrote to memory of 3612	4120	msedge.exe	125
PID 4120 wrote to memory of 3612	4120	msedge.exe	125
PID 4120 wrote to memory of 2568	4120	msedge.exe	126
PID 4120 wrote to memory of 2920	4120	msedge.exe	127
PID 4120 wrote to memory of 2876	4120	msedge.exe	128
PID 4120 wrote to memory of 5836	4120	msedge.exe	129
PID 4120 wrote to memory of 5836	4120	msedge.exe	129
PID 4120 wrote to memory of 1160	4120	msedge.exe	133
PID 4120 wrote to memory of 1160	4120	msedge.exe	133
PID 4120 wrote to memory of 4896	4120	msedge.exe	134
PID 4120 wrote to memory of 4896	4120	msedge.exe	134
PID 4120 wrote to memory of 4280	4120	msedge.exe	135
PID 4120 wrote to memory of 4280	4120	msedge.exe	135
PID 4120 wrote to memory of 2788	4120	msedge.exe	136

C:\Users\Admin\AppData\Local\Temp\ratonClient2.exe
"C:\Users\Admin\AppData\Local\Temp\ratonClient2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5856
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\cleanup_cx4CO7KqCK4EC6fq88EXqIv2PxpzfB.bat""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4608
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:2004
- - C:\Windows\system32\timeout.exe
    timeout /t 2 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:5968
- - C:\Users\Admin\AppData\Roaming\PlatformRuntime\ratonClient2.exe
    "C:\Users\Admin\AppData\Roaming\PlatformRuntime\ratonClient2.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:5672
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtube.com/
      4⤵
      Drops file in Windows directory
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Modifies registry class
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:4120
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x318,0x7ffde4e8c188,0x7ffde4e8c194,0x7ffde4e8c1a0
        5⤵
        
        PID:5132
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1608,i,514798083240574691,7603966053213510697,262144 --field-trial-handle=2660,i,2274129585722065075,11112044479825322587,262144 --variations-seed-version --mojo-platform-channel-handle=2656 /prefetch:2
        5⤵
        
        PID:4324
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1860,i,8225207361878197133,16402734510481189797,524288 --field-trial-handle=2660,i,2274129585722065075,11112044479825322587,262144 --variations-seed-version --mojo-platform-channel-handle=2688 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:2492
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2216,i,17702508761719387448,12474969753860673285,524288 --field-trial-handle=2660,i,2274129585722065075,11112044479825322587,262144 --variations-seed-version --mojo-platform-channel-handle=3108 /prefetch:13
        5⤵
        
        PID:6016
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3608,i,1920948216627055650,4814736558155299110,2097152 --field-trial-handle=2660,i,2274129585722065075,11112044479825322587,262144 --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:1
        5⤵
        
        PID:3236
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3636,i,15804885240196786021,12615575327902105318,2097152 --field-trial-handle=2660,i,2274129585722065075,11112044479825322587,262144 --variations-seed-version --mojo-platform-channel-handle=3696 /prefetch:1
        5⤵
        
        PID:1516
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4328,i,5052779273829065542,8848949066890237182,2097152 --field-trial-handle=2660,i,2274129585722065075,11112044479825322587,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:1
        5⤵
        
        PID:2460
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4372,i,6401575759467205403,679757500301684617,2097152 --field-trial-handle=2660,i,2274129585722065075,11112044479825322587,262144 --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:9
        5⤵
        
        PID:4488
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3676,i,12789646781269982783,7258408213660874,524288 --field-trial-handle=2660,i,2274129585722065075,11112044479825322587,262144 --variations-seed-version --mojo-platform-channel-handle=3800 /prefetch:14
        5⤵
        
        PID:2108
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=3808,i,660237306252859618,3848421101825590521,2097152 --field-trial-handle=2660,i,2274129585722065075,11112044479825322587,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:1
        5⤵
        
        PID:4576
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3800,i,7053687752250320262,4308307734819500809,524288 --field-trial-handle=2660,i,2274129585722065075,11112044479825322587,262144 --variations-seed-version --mojo-platform-channel-handle=3788 /prefetch:14
        5⤵
        
        PID:2016
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5300,i,9398313392084219820,8378930698340342146,524288 --field-trial-handle=2660,i,2274129585722065075,11112044479825322587,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:14
        5⤵
        
        PID:2760
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=5596,i,9402001039056670565,1996641895890532882,2097152 --field-trial-handle=2660,i,2274129585722065075,11112044479825322587,262144 --variations-seed-version --mojo-platform-channel-handle=5872 /prefetch:1
        5⤵
        
        PID:5692
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6228,i,8993792516542889730,2070958505495945904,524288 --field-trial-handle=2660,i,2274129585722065075,11112044479825322587,262144 --variations-seed-version --mojo-platform-channel-handle=6236 /prefetch:12
        5⤵
        
        PID:2028
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6944,i,6962510818676876033,1273513870606693974,524288 --field-trial-handle=2660,i,2274129585722065075,11112044479825322587,262144 --variations-seed-version --mojo-platform-channel-handle=6656 /prefetch:14
        5⤵
        
        PID:2004
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6944,i,6962510818676876033,1273513870606693974,524288 --field-trial-handle=2660,i,2274129585722065075,11112044479825322587,262144 --variations-seed-version --mojo-platform-channel-handle=6656 /prefetch:14
        5⤵
        
        PID:2608
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7152,i,17579017222346448216,11412017948260457794,524288 --field-trial-handle=2660,i,2274129585722065075,11112044479825322587,262144 --variations-seed-version --mojo-platform-channel-handle=7156 /prefetch:14
        5⤵
        
        PID:2908
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6520,i,10727589343812020637,6003397781165897037,524288 --field-trial-handle=2660,i,2274129585722065075,11112044479825322587,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:14
        5⤵
        
        PID:4112
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6628,i,13608068341532942474,10543717139540253112,524288 --field-trial-handle=2660,i,2274129585722065075,11112044479825322587,262144 --variations-seed-version --mojo-platform-channel-handle=6576 /prefetch:14
        5⤵
        
        PID:3520
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7004,i,536196650541333174,1512859492061708050,524288 --field-trial-handle=2660,i,2274129585722065075,11112044479825322587,262144 --variations-seed-version --mojo-platform-channel-handle=6420 /prefetch:14
        5⤵
        
        PID:3080
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6656,i,5790465866663171799,18344656677374837615,524288 --field-trial-handle=2660,i,2274129585722065075,11112044479825322587,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:14
        5⤵
        Modifies registry class
        
        PID:5412
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7032,i,13905617542317441627,7656834617398532548,524288 --field-trial-handle=2660,i,2274129585722065075,11112044479825322587,262144 --variations-seed-version --mojo-platform-channel-handle=6944 /prefetch:14
        5⤵
        
        PID:3612
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6420,i,1028547355638574099,1475339424767735646,524288 --field-trial-handle=2660,i,2274129585722065075,11112044479825322587,262144 --variations-seed-version --mojo-platform-channel-handle=7248 /prefetch:14
        5⤵
        
        PID:2568
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3812,i,3902066292172687117,15755146757265894764,524288 --field-trial-handle=2660,i,2274129585722065075,11112044479825322587,262144 --variations-seed-version --mojo-platform-channel-handle=7328 /prefetch:14
        5⤵
        
        PID:2920
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3736,i,5661146663085667348,7410960001732871219,524288 --field-trial-handle=2660,i,2274129585722065075,11112044479825322587,262144 --variations-seed-version --mojo-platform-channel-handle=7228 /prefetch:14
        5⤵
        
        PID:2876
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6388,i,6355955332372431463,11538297951922975755,524288 --field-trial-handle=2660,i,2274129585722065075,11112044479825322587,262144 --variations-seed-version --mojo-platform-channel-handle=6444 /prefetch:14
        5⤵
        
        PID:5836
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7604,i,14340007660994266598,16077307028272233105,524288 --field-trial-handle=2660,i,2274129585722065075,11112044479825322587,262144 --variations-seed-version --mojo-platform-channel-handle=7584 /prefetch:14
        5⤵
        
        PID:1160
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6792,i,4384009543537515938,14997077822282559035,524288 --field-trial-handle=2660,i,2274129585722065075,11112044479825322587,262144 --variations-seed-version --mojo-platform-channel-handle=7592 /prefetch:14
        5⤵
        
        PID:4896
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7744,i,9241219746759783735,13760415165587062003,524288 --field-trial-handle=2660,i,2274129585722065075,11112044479825322587,262144 --variations-seed-version --mojo-platform-channel-handle=7596 /prefetch:14
        5⤵
        
        PID:4280
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6612,i,15556529827558331856,4985197870107297131,262144 --field-trial-handle=2660,i,2274129585722065075,11112044479825322587,262144 --variations-seed-version --mojo-platform-channel-handle=5752 /prefetch:10
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2788
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4508,i,3075161422705282334,14565627418381482871,524288 --field-trial-handle=2660,i,2274129585722065075,11112044479825322587,262144 --variations-seed-version --mojo-platform-channel-handle=3444 /prefetch:14
        5⤵
        
        PID:5976
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass "Add-MpPreference -ExclusionProcess 'C:\Users\Admin\AppData\Roaming\PlatformRuntime\ratonClient2.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3216
- - C:\Windows\system32\timeout.exe
    timeout /t 1 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:4600

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:552

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5088

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5348

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f8dff5315a0bd3856381f405c1a16257337fd6ff2d8043dd8bea22404cd35129
MD5 5e53a2cd139f0cce4f8ceab3e015f7da
SHA1 1bd884dbaaa352a724c53bfb8f4bfad2623c93f5
SHA512 27cc4cb62f9aa4af6b521efd824b001f3b689bae2ffe57263da18e2bb22d0b13ba656141d7e6ea1d1c202d5f461a44243a00d604f78bd5b04fe6b8512e260ac1
TLSH
T178D02B1463108D04D441F13214D13311B1110833A80C96440050E1284CB634206738DD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1f3bc43c50f7d0fa02f98500baf5d78052a5560603459a9325b17de989d121f4
MD5 46a6445fd2c83830bb8c6e03f85bafc0
SHA1 46b07e35efbd47692fdc81ef0e82e2964da2831b
SHA512 800f82b05756fd6fab3fe29924147f0b86afeec21da661e646b431c6ca03903eb45bb09803f5cdaf3d2d1bb16f95d0f2e53a1f9ddde57505b0f3e1580c384ed1
TLSH
T188D02B1063208C04D441F13214D23311B1010833540C96440150E1384CB634206728CD
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 e8d36ed6e820ff2bb271ec8044540745d510be37d28e2c7aeaa6499b4297c629
MD5 0307e8085b1abbbabc52508d16625006
SHA1 9090145ae1b30135dfe02c21f309851e2ddf0c08
SHA512 22a817d5107092a95a02a34714ffd2b7bf36ed79111249dc90493b478c8ab3e60999e7590eef409095adfe8e2814b76c2ed05b7cd8d1cd679e275a65edcfa332
TLSH
T14E51FD1CC7AF56C8CB21923E73E99A153636C7F69153EEB9A0506C346807791E1F04B2
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a64c6.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a64c6.TMP
Size 2KB
SHA256 b3ea824a06ef3ae702f68467e2f31820aa5052facdf9da62eff2a6f9d7dd45be
MD5 eb2da2195a6e1f4001c3912834642e4b
SHA1 ab405a774307357a6dfaf1607b9e2b7609fb7ebe
SHA512 eab55de8eaaed1db3fd77c2fe1124b9ef2d14460c4b6628da8cc0bc412bb40a1db3ff23e2094924f0d80a37701e9fcebc9b2eb71c7c28c230cdf4f9544f0416f
TLSH
T10641B90CC36F14DCC725847EB3F98569363A92F8D183EEB9A0A065756807760E1F04B0
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\000003.log
Size 116KB
SHA256 4eedc6fa2d15cde574b39c99440a681773ca14e1c72bae96ae587a415b245c70
MD5 5e5d5363f0fd9ebeddc47ddbf653638c
SHA1 72de8b460299b1670ba4f665c9bc561594642050
SHA512 807e6cf7563a95945e404526467c7691f7d611a514ad4897f9014cfded1b413e6fcb14ce96a420308d249606a76d619140a6115bab13afefe3c043f5f0933c61
SSDEEP 1536:7OxqbgESWukt4L4iFyWOEkEB2S7B454KAo/oHK8hw5:7Oxq8EtSL4iFy6kEB2S7B45mo/oJ65
TLSH
T1D4C39A4A12E472DBC20EC17B14514A995FBE2D0B185C709FF895B96CFAF6E922330D1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\LOG
Size 353B
SHA256 fef5cb96d4b81777eced9991375717b174fd4d07ff14b39ee6f1eb55884596b4
MD5 6fefe74be3c14f634463cde3a96e215e
SHA1 d7ab1f95959828069072ff31132113b9875edaa7
SHA512 828ba8abe6c8033e90e93af9d4c0e5e4f6e0620773038b65e99b9c66e0eab10f9f8a930dd0158f4b7f1ac145ecabe8a1af66cc801100379f446f2c15f20a9a54
TLSH
T1D9E0D82884CDC16F555464FB66347B0ED6EB661E96CCBE560E54CC04B047488956E251
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 3e4d70f79c289774d684f0e37c74b77d2874cc4703ac4255140049f7b65ae691
MD5 374c9a6e80e70dfac5c7146682735a77
SHA1 1f86c4a8f73f20de43aa17adf76562eb76971e4d
SHA512 91f48cc1933f936386f7d175ce01d31660d1bc53f9c91ca9e588614691bfcfefc1792cc8c893e778b469867ff5329e0f92301cf630623e1b6975af69a797e32d
SSDEEP 96:DcOunVutuau1VuRuqaVZjhx1zWnuAuKu4u58uZugxtusMucouP4uIwQ:DXmKJ6E5aVZjhx1yn3/BDyVtcRoXrT
TLSH
T1A0C18DF7C3E8823DDD1256F4A6183E1BDE6D0D2483283C6AC9D5AE1B93E6471E24064E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 f5173876521723692395df1bf89a45ce089997c5bb28a7e63f410ca4d88c9978
MD5 84b74d15655641bb6396df50a075f0fe
SHA1 7de18146173f7f967c92f0becb54a052dc8d87ca
SHA512 d805952b92e398fe77f695f2b73138c5e4ee4c5b5caba00617d154794a4f239ede4d69a21e87cc5aa72d7d044a28436f2315b874911ce1a313e7474feeb132f3
SSDEEP 192:sxREFFRpCR/f6slRdYZUvzoD8pFm4asUzfJ/g6+WNl1F/BeCXH3uOKG4IgDlP7KJ:sxRwOR/f6slvmU/cJ/5p/vOo
TLSH
T18152C817A934693B8CCBE21DBA15BF63E2F95032A0D41E5CA7FD961C10EB6DD520380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 8656e12e9a1efcb45c7f9d18caa1b34ea6dc9219cc930dd21956ec46812b7a26
MD5 954ca9b8b32cf1719e081bf082e0d9e5
SHA1 80e2f30858774d8aeb995f7af19d5e16c39d5cf9
SHA512 66ae36ff1716455964aface0df1589971f757aa3b2f6e869cc5cfee3c0cde7f8940ce53a5f6ed0d1bcb963c89db9d1d63dec0ceeb1114ccb43cd91ce9fe16297
SSDEEP 192:sxRaRpCR/f6smR6YZU9zoD8pfUzfJ/g6+WNl1F/BeCOVuOKG4IgVP7KJ:sxRaOR/f6smomUZ0J/5p/MOM
TLSH
T12442C8176A34A93B8CCBD20DBA15BF63D2F95032A1D41E5CA7FD961C00EB6DD520780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 1b521599abfd1d593ad5a70dd3827ee74067010c682af933d9623041e4ec7914
MD5 47d514183decd002eadd8750321f02d7
SHA1 6bd28e7d5e1c696e311a5b8551bef4f08723eb02
SHA512 2ae454d52d4780d8f754b3b86ced4f3ff168df9b0eeb77e377afcf053a5b9d8f4de8dfc2cd17b26cc233eaea86fde42df6a724663fde71937f2a6fd488dc4592
SSDEEP 192:sxRlRpCR/f6slR6YZU9zoD8pfUzfJ/g6+WNl1F/BeCOVuOKG4IgDnP7KJ:sxRlOR/f6slomUZ0J/5p/MOO
TLSH
T1B842D917AA34A93B8CCBD21DBA15BF63D2F95032A1D41E5CA7FD961C00EB6DD520780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 232b052d743cbeb2961d6928822452ab6b40668150796880ef632891616c5f44
MD5 f2005e432be22017734989f7971f4db9
SHA1 f3cada297f808f8b040cf418ddf0fd52ac938234
SHA512 7342e17c4e533c46fee95125f6d88224172d57fff2ac0659508e38cf67b95af344c696bb5b45966871341418e97f1b1392c7e5f2b0a6e2e0f236fe1eb35a19d8
SSDEEP 768:jC+vNX7pLuLfDQWgQ+f4+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVQq0QqcYroZ+:jC+vNREfDQWgQ+f4+u1jafq0Vcjw
TLSH
T131D2EA7B640DCB7F4F804ADDEC197A9A6DA802CB9698CD5047FE841C02C6BEB52164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\0fdb9c46-c194-476c-a98d-3e83bd9fcda3\index-dir\the-real-index
Size 2KB
SHA256 8f87d177cad30c27b082884a0484635997626f819f598a602bf5cefdd83c0410
MD5 4c69916e7f2a20c52e4b5f2f8f2a3a49
SHA1 5985283e7e343a4f9d81b1c48c01eaca5f95fe44
SHA512 db130fa851f665343872bd42440053eaa40b4b6b1e4767ec71d5409e243a3f460a3e747fc0c9d02a8b6f09547f5db866ca7c709bba829be305842cd06f475513
TLSH
T1DF418B4CCC9457BEDCB451BE1D5415F247752C28FC58C3624064B6B17413AA517476FC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a1e28.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\0fdb9c46-c194-476c-a98d-3e83bd9fcda3\index-dir\the-real-index~RFe5a1e28.TMP
Size 48B
SHA256 1d4ee8f6926fbb7d8224cb1105dc70b2bbe107b03e71a4e191f8d739b831fe8f
MD5 02431a2db2e5c483eba174686702c6c1
SHA1 8fb72136356b3c2137d19272020387c6e0509f06
SHA512 e12350a2307bc1e0f453f91db6d2b7368d3336abb352f4cc09cf9702689c4e664a4d8b6a50c3f38c3fd7c3f58d8ab8c9031ffcae8ee710c492afc397f952e9b7
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 214B
SHA256 be822b19f8a46c641af8372190072c1efe2a57864ed01335fd682fa3d021ecb3
MD5 c6209925bd53949c299eb35653dc5824
SHA1 49c53ee9501da773c0d6d66576fd6d6500f9df40
SHA512 1023d763751d9feea118a381dab8942e4276157cc321e647f50bbde02fb05c9083cd7c662319cb0ff345cde2ea8f8fc3a04faf3b9561c2d33791f95e0db92f81
TLSH
T1ADD023D94170474715B4FE883034259C51378E09E5C4C8E4D4487057F4FC503C446565
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 130B
SHA256 21cebffad2605708d297505612fbea97f30caea1977a006c142bf34b926ceaac
MD5 bbbea45a63a0ef32ac55861ef2fb1d2a
SHA1 e6562d3b0a2575a58da6bd649771ff7abf45a17a
SHA512 055a7b6cc0b713d2eafe5ad14cf81601175599fd3ded51fcda88f392ac23bd7962c01a8f0b7e5b861f93e6b06963f28a6b6a1e61a733b6e8dfdc78f8b95bd49c
TLSH
T126C09BF60410978B0974FBCC3038635D962B465DD4C4CCF5A04C5006B4785138846965
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 132B
SHA256 4f0289d0e7cb5b9385156b780d3ebe8abbdd77ce8bfa2928767a818782417712
MD5 d679c60d98530b82355a65c0f795f6be
SHA1 040fd31ca448ff0e90f7bee9a93916b6bf9c85ea
SHA512 bc1fb3ae1d7167f583291aefc62a80397f5c35a3f3f5bca8dbe827d966de2d63e83a912f663e6c3845c8d14efec23be26fcbf3b120d022e470438346fe52da9f
TLSH
T18FC09BF7081047C709B0F7CC3039675D962B85DDD4C4DCF9A44C540776B85538845975
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe59c9bf.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt~RFe59c9bf.TMP
Size 137B
SHA256 8bec6577e495c67cc6e341c44c52a04cfd0a168f1a0e5bc8286ca118784a14ad
MD5 64fdd8a4e614c96af07f5c780b505447
SHA1 9747139288da31c206441efe9114aec2aebf64ae
SHA512 b074f31bd7eb064d9766de05acdcdd62a8c5bde1954708cf926517aa82b61fb21ae13ecfea958b0b12a9dafec6affaa7baca0562234b85bf3acf79ca8d2474f5
TLSH
T1C1C09BF6041047870B70B6C83038625DD63B4D5DD8C4CCF5D04D70067078513CC45965
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 cd75d6f6d84cb39c0ff0fa5561c22f8b7246d27ad4f310f1d9a5a589a0e2fe10
MD5 e640bbd9ec74667e58db5fe0e03918d9
SHA1 86fa00b296d380377019bd8bc38eccb7e14f0ee4
SHA512 1faa3b720ad6d54a88fcd3da34728032c58d2d7286239f1b6b9480ac33115c5fe9ef0e523b38db3e6b2eef54714698e02fcfcf25feca12e21adb318efb36bf07
TLSH
T1D1A0021411491602C84007F55D451298275389910709420144A8E1E9BDD9151B34A102
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a185c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5a185c.TMP
Size 48B
SHA256 cd163eed9f967447dcd71886aefb9618508d98dc3620bb37be1fe6c7907282bd
MD5 d2b56a328c5c0d043f92384c1514d58b
SHA1 c46090d44616b298cb300810f5978cfb1217b976
SHA512 7bef782a5b4dbeb2f9a11f4309c7545e10f119eea305d411c610c075901389377dcdb2c6ac3d94b5a347694c05922066fc16c3e50f266c6a8868b7e0ab7a7c88
MD5 SHA1 SHA512

Submit Download

99dc7361-5627-4b63-baf7-a1dda0764c2e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\99dc7361-5627-4b63-baf7-a1dda0764c2e.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 ec4984cb815a18c94ba817c2b93a0b0fdbf315803e7c1c7949105e276eb2bc45
MD5 61ddf007b0cee62238cf6e9337d87554
SHA1 a25339c7934729b7556843b5dad4067ac3e7de1e
SHA512 a678f2cb81aef741e98e4c9e8d6a4191e5d76f0604af1fc879724bd33eaf7d76e3bcf51f2cc4e414c598173d0e6ea83b9ff302549d39f34aeacb03a87cee74ab
SSDEEP 768:Hc3JTuPARp8+p3bd66j+4BRv86aLIWWPi9PC:Hc3hP8+p3Z6n4ywPF
TLSH
T1F6F2AFB1E8A99D639CFAD744B25637836FF8257395C00E98E4DDAB0D058315E170BC3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 4557851c163c37138218f26ad7ea74b214ffe5983d33e7004005d98c19b24d8f
MD5 7da2030da2bf79ba9a332d87c581e01e
SHA1 83c237614e2844587c13c010fa813807c05f3692
SHA512 4fe2e41feb2de52be342bf86ae62ff41857081ba6fa262e504395c56211225eefb2dd6c29cdc7b9375d16d21bab4aab5fe6eaeb30b264c5ee22f57785a0a16a8
SSDEEP 768:/FQB3ewgtTtmtp8+p3bd66j+4BRv86aLIWWPi9PC:CB3z8+p3Z6n4ywPF
TLSH
T1AF1329F194D79937D8AE8783A37D2E429EBCD163B5844994B7C95E0CCC821BFC70A825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 62dc235ec8425343cb9a30b48bde0edea02bcf92a324b9bb0f7f325c8a0f5448
MD5 47168486656c211b48e35604b3ccc853
SHA1 de33d810bd42aa050fd4a98fd82f17e50b2d3966
SHA512 e4625843c12a8e8e06a155e1d0f34fac830585f036c160fafd07ed7fd68bee92fe3228949d76bfb0582879944113bbb5225c1dac2a41c03688556b806bfffd48
SSDEEP 768:Irv+4UNbdD3ncPZNp8+p3bd66j+4BRv86aLIi/2bwCl1:Ibsbp3oL8+p3Z6n4yx0ww
TLSH
T16003BE33F9A899739CF6C644B24676437FF851A396C10EC4E4DD2B4E419A19E630BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 91cfb4466425a76ce11e45df251d3789038362921b862799b65229e205c86ddd
MD5 b1ca3e8cae6740d64c7cea2e8a16f953
SHA1 051a48c2c396a8eb42cd1e4d21990caef3e0f66a
SHA512 e8c1be4e7e0accabd25ec68841626ce03d768491906a05e8bb04966e095aabce017f0ecd64d83ea4c926bc9d3ab17d1da3ea5990281c099bc20c2cedd0efc4dc
SSDEEP 768:crv+4UNbdD3NT8PANp8+p3bd66j+4BRv86aLITW2bwCl1:cbsbp33L8+p3Z6n4yn0ww
TLSH
T17B03BE72F4A9E9339CE6C644B14677837FB821A399C10ED4E4D96B4E015A19E270BC37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 408b543c9e5a255dc6f30369984c578ce4f0f10164c54d84e1977bdc0a51b6d6
MD5 1036e744946caeec1f3b4a5545dc9be7
SHA1 8d4ebf9fa8daede68a110c410b4cc449848cac2d
SHA512 144dacab5765d1979ceebe8c4ce7dc8135794ca644c4ee52a2acb67f5c0b113acfd0d58786cda4fb11e59090849dbb739f03434c4f4665d35dfba9bb8167d128
SSDEEP 768:Urv+4UNbdD3dTuPAtp8+p3bd66j+4BRv86aLIWWR:Ubsbp3Fr8+p3Z6n4ywR
TLSH
T10E03BF72F8A9DD338CF6C644B1467B937FB821A359C00E98E8CA6B5D054619E270FC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 ea13d57b11af249f90704dbcafd354c5e80b10358db7edb9eaf8f6fd597eb1d4
MD5 ae3a19c226264ff6cb64877f1e7e7243
SHA1 f993431dbd09200fd92b7a04ee6711a54ad95cc9
SHA512 97e5dbf0663585afbb5e0f2b5a36192624eb2c898462abef65225987df632d30f74f05ac5a71175c4c59f75d9ae6d2e640d168e479cb26b9a6857c71efda029a
TLSH
T1C1C02B85CB1E0C854E78153D48420B2727819F0030508534445A490C41741CE00888CF
MD5 SHA1 SHA512 TLSH

Submit Download

aforge.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\aforge.dll
Size 17KB
SHA256 966a474060a8aca70c73ba09d0b6fe2353035961c7107b9003ef879c010ff8da
MD5 02c63f568e598aad85dd401d7b26e82a
SHA1 2da9ec7612835e1f69d4a93aa2d49ec9bdff7f7c
SHA512 da9bff86be8fa890dda80a35ee6c851aa655f087f81804a23c73f8c586b7e13ac5a643e0a516a35787cd97b392aec16bfb95210080e4e53e6144fec9316acdb1
SSDEEP 384:aJtTjIFgPn1Q11umcaOxIapDtoTFC6dmoU:KRcFKoumc9ICDyxmoU
TLSH
T18582B50DEF9CC267CE6F5A7460DB13598335C70AA653DB6784EC04A4AC47389ADA3293
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aforge.video.directshow.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\aforge.video.directshow.dll
Size 60KB
SHA256 666d44798d94eafa1ed21af79e9bc0293ffd96f863ab5d87f78bcee9ef9ffd6b
MD5 17ed442e8485ac3f7dc5b3c089654a61
SHA1 d3a17c1fdd6d54951141053f88bf8238dea0b937
SHA512 9118bf11760354e9971ae8b27f7f6a405e46145b39ca6e6b413cb2e729e51304b895965e9140f66c9e3ef7caa4f344762bf059688b23dd32e4c2df271394fea2
SSDEEP 1536:XwumrikcyTpOKVi+Dqp6viPUCcvKWz3NTpAK+7KI4v8U:6dOKViKa6pOWbhpAKyKIVU
TLSH
T156535BA273B8C633C4AE17F6A4331F4017B1A7495223D79E1F9A519D7CB7B804A50B93
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aforge.video.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\aforge.video.dll
Size 20KB
SHA256 bafa6ed04ca2782270074127a0498dde022c2a9f4096c6bb2b8e3c08bb3d404d
MD5 0bd34aa29c7ea4181900797395a6da78
SHA1 ddffdcef29daddc36ca7d8ae2c8e01c1c8bb23a8
SHA512 a3734660c0aba1c2b27ab55f9e578371b56c82754a3b7cfd01e68c88967c8dada8d202260220831f1d1039a5a35bd1a67624398e689702481ac056d1c1ddcdb0
SSDEEP 384:Wu9f/hWFwLX+WJ7gfZLTswhHDlOdKaCxkyf0l:HfpZL9uxE9Cxd8l
TLSH
T135924C0AD31CC23FCB6E077EA472026287B0C3626643E7EA5CA951B9BC6736549437D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

costura.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\costura.dll
Size 5KB
SHA256 7a9e767ad824afa2c1b0aed513fe1cf2b8dac6d40f24e7c4075af32b1cf23a20
MD5 109bd38d2107f41573c48544992ead99
SHA1 028e9832f421f11f9497c610f1734e0f3d868037
SHA512 459945f338679c77acca8f1192907cd3ce8e19f270589d34ce8227b8eaf0c7c8c9922e52b8310d037c4d5c0c639de42a6e3b0f7d44d493fc50644b6fcf7cd4e5
SSDEEP 48:6gMX2nhx3BTjtRiaAVLEP4iZ6iMtTg70uElaQ40JFuUPtomCH9gWk1qyFVA2IbS:HHtRYVLEmYZEZ9ruUPqJmW/2
TLSH
T10BB1FB2867B8573BEF7B4BB65863534257B4B950CC279B1F0985B3166C223544931732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

microsoft.win32.registry.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\microsoft.win32.registry.dll
Size 22KB
SHA256 619737e2af8fb713085726631dd2e522fe130cac1d388a59c38907a47d7aadea
MD5 da40f3db8b34571684c0cb5bcecd2a79
SHA1 1c27a41fd84d6bfe99dabae2e59fcf12fccf6213
SHA512 e656d72e111eaca7c8e9b7d4106030c1104286395046c2de58a04edd590cb2714dcf3aeca2b93f843b4663f1d1e630cc19f1e4eae2fa62f0d382fa18cc8a5981
SSDEEP 384:z8a6WQCgE7MHVia7Z7aLPQmlJLfbTWnWDxW8QHRN74fZalxA2:AJCp70ViyrmlDt84a
TLSH
T18FA22A02EFE8402FFFF70E3519B5D9225D76FAC62902864E1958D2CE5DB2BC4D630629
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

naudio.asio.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\naudio.asio.dll
Size 33KB
SHA256 504dd507c34817a8a8be1965e82dd091ff0f5a85ba444ea784783f196677bfd1
MD5 01a76191d31b3d6042484e452bd66ce0
SHA1 c84ecf4875c17d9cc91c911feabca640c7ffc661
SHA512 09fa738e43b1a4272a9e16045bcc0fd00858f4367d41b1f9fe3cf97589379b5fcd1fcbd1a24bca74a08187f080941cb575332d3725f620f93fd0b414dea0a9bd
SSDEEP 768:EehRrWpB5henH0HTYdpVCYKo9coe6ttHjBR/:EehRr68U47QGtHFx
TLSH
T10BF22B71EBD84A27C92E2779A0F2040407B5F191F623EB4F9A4C94A96FE73594790373
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

naudio.core.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\naudio.core.dll
Size 183KB
SHA256 4f8d8c4140146674b103c8a3c46fbc4c768a86c0012a167168e3f7da2b3e5c09
MD5 4e4302ce791e48f985a3a221a19a272b
SHA1 d2b0fd622daf57a012c3cf5bdf4b187f27d5d080
SHA512 1685a17be6d64c222ec606488e3f8e9707a8b7709054e9e99cb53c7b438f5b993820e2e9773e02455525ee06e18aa65ae150420224311f6c69d795c3d129e312
SSDEEP 3072:6lnWpdQWUY6GwfIGsnlLieRT0TWsPtt3RBntgqK2QlVEOPkk6uSYsM+S70I:FpdQJY6GwfIGOLi7tt3RBntgn2QlVEEO
TLSH
T151045B2563E48266E66F9BB5F0F204178BF0F4463437DB4E5E806AE92A07B01C592F77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

naudio.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\naudio.dll
Size 7KB
SHA256 5dca4b3b7f1f2abdd2f94d3a056e4c414605da248612f02a0d2ab38083aa8ef8
MD5 e90ac3063409ef6876e26422dc61d0eb
SHA1 3cd158d0f9a4f9a78a7ae56ecb0df0360a413181
SHA512 a04dc95e234652c8f4a8ddec88ee3ebd87e68d826eac008625f994323e569d3a3026c7cd7ce2d790ae2ac3018fadf10e600e7ba13cab9bbcc49192263a32fe6a
SSDEEP 96:QDBFskeJHnqvjZkcLqED5Iyr2T7AVUhkon1MrtrRGc5pkQrESd2uYO:QD7kHnqNkcLWyr2T7zSon1MRlwQoStY
TLSH
T1FDF1D724A398CA77CE6347B1A86706401379FA80A917CB2E0D8CA18FBD537594BB27D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

naudio.midi.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\naudio.midi.dll
Size 45KB
SHA256 7796a9ec97a1ff29e682855839845da9fe26b6ddcc34addbb514cd73e7a9f02a
MD5 f6940019dad6c782bcb645c2f7d52db5
SHA1 1bbe492757bf99840d923fdd44c6a3f34b336cf7
SHA512 1da566cd9f7b0a81f9d858b48306111b0791991f867e77d24f87f26badf93ca6e6414b12669d83b4d3f0b96959c48172f4a77119dbd12e6d8b9e0d0b48caa006
SSDEEP 768:xwuDUaOqgwjYpA2knmsbS+O/RXgQPODHM0Mx7hlEmmyFyaetiWvmYRMUQ6LUOu5r:xwuDU7fwT2kmsbRMZgQP6HM0Mx7DP3eT
TLSH
T15C232A15A3F8861AE2BF3779FC7056110BB2B9867A32D74F0AD468AD1D237844C61773
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

naudio.wasapi.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\naudio.wasapi.dll
Size 176KB
SHA256 a05e371abf96195770ac4f84653d987d63731fed528e98c7fe0d10ce66e37d7e
MD5 bb660a4efbf5c0fdaeeddd4cc9ab9600
SHA1 6dbd30a9216590d012a7feb802831f538345756e
SHA512 7452a8e8c7b3183fcdf2d8546a3d154ce1ae0b7756281bcf5b454b10292356615f70593a73be36095e9eec7f78cf8ec46f14aa52d2b3ed7aa9a59505fd2ca725
SSDEEP 3072:6S40MR31DisfSmJyuhrkf3Pr/duoSIlKjaBIWbiFyryvpwAk:6SWZiUBhrkf31bIgQvp
TLSH
T16D047B223AAC9D76C5AF43B9F8F30D03CBB1D4463A17AF495AC15B255D13B924808B7B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

naudio.winforms.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\naudio.winforms.dll
Size 33KB
SHA256 82a92cb6b9001e013c653c65e4ae460346770ec7512856879e63018d9cafc41a
MD5 115137414b41a26d6e73738cd94c036c
SHA1 e9e87ec6227bc9d8a971d2aa687dcd4e392a8d43
SHA512 d30fd0043bb483e67700de48283d632811d45e89564ea6d9454b6a38dc3fee5440719224ec4085c70d21c665222f27dbb482ac5f578326a7698ecb7b46599b4c
SSDEEP 768:qNMJ4j7TupqLC+VHDvtiT8dMRrvCPRtbQDmZ1RnT+Geh:8uiCP8dIvMzbQDmcV
TLSH
T188E228195398CBBBC77E0E7944A211060376EA81B501FBED5EC8B1DD8D937520B60BE3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

naudio.winmm.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\naudio.winmm.dll
Size 56KB
SHA256 3c8359bb74c6dabd2ec8ba561ffa163f24859ff5aef724fb5794073e2e883a02
MD5 c1b78af3d6402be8f259dbbe9250e7fb
SHA1 98e2c38597c50390852801d46ff342889c7351ae
SHA512 776d15d506798eb4a66d5cb5b45591e1767f4030f14aa91198fdf0bcad2e689835418629a1cd3f2af36add4809adb04dd3a850d9d8f2594b0737e72cecc437cf
SSDEEP 768:jpQFu52mn7eYuo4OzgyA90g01OcjDHvgxLMgGd8GbIDrXa8Rcer+7bE:lQ8hexo4QguNHvgxLufIDudE
TLSH
T1BA433B017BDD427AD2FE1B3DA0F30A524734A892756BFB4F1998F1DA9853B8049017B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

newtonsoft.json.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\newtonsoft.json.dll
Size 704KB
SHA256 f0c07af0e84d4dd4da4bd7823ba4535bc0481b3bf623ed40b659b68147a6bb75
MD5 24704261e701b49b51e40c1292ed149e
SHA1 db8ce5e0b7d8c14920bc9c4eebe51bdf706e3fc6
SHA512 8ef6a6196044862a9d8d53c6a88e68d9591edf244385bc4888cb9c16c942eeb4a1689c49245d6cf80d619e95f0745898513ed2b67a6fc4c65fbc06b872f72184
SSDEEP 12288:65RsO50fsVuW3icGomHAQ/DUHIdGFRrDTOAPKfhUUNSUmTIcvABXyoJl8fCfB5qm:om2VuaOKdKSUNz0IpBXyov8fC3
TLSH
T178E45B2177FC8E16D9EF2375B430D9181BF1F956A2BAE78FA504D9A51C837918C203A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

stuff.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\stuff.dll
Size 12KB
SHA256 d8ee0fc96ce8de2e37bc8fdc051da7c1852b9a510270e663ba17281de23f049b
MD5 f8d5274e3368aa40cc0fd5798d19c783
SHA1 87f87d8c2b468fb87d82c3f5a849936c08d7a67c
SHA512 fa3f106d4ab31c0d516b4623f3108b29c05993a6e65e6e1f1a49e7d101860f78c63843743c3e560c2891fccade27e6024e7b1566d4b99dd0fa90480c1d1a45bc
SSDEEP 192:cl/e0xEXKl04vygxTppSYgDnWgdCpZ8u8u8u8u8u8u8u8u2JHqW6LvEX6KSf5V00:cl/nxEXKl04vygkJ9dddddddBAW6AX6d
TLSH
T15D42192DB784866FD96C0B3EB86622541772EA30AE63DF8F1CC4B03E7D6735885505B8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

system.buffers.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\system.buffers.dll
Size 20KB
SHA256 accccfbe45d9f08ffeed9916e37b33e98c65be012cfff6e7fa7b67210ce1fefb
MD5 ecdfe8ede869d2ccc6bf99981ea96400
SHA1 2f410a0396bc148ed533ad49b6415fb58dd4d641
SHA512 5fc7fee5c25cb2eee19737068968e00a00961c257271b420f594e5a0da0559502d04ee6ba2d8d2aad77f3769622f6743a5ee8dae23f8f993f33fb09ed8db2741
SSDEEP 384:/rMdp9yXOfPfAxR5zwWvYW8a2cyHRN7vCvlbLg:/rMcXP6N6e
TLSH
T156926D12DBAC4213DE3B2E7012A4C9C62E3AD3C66A11DB5E1848F5591ED37CACF11B6D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

system.memory.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\system.memory.dll
Size 138KB
SHA256 bf3fb84664f4097f1a8a9bc71a51dcf8cf1a905d4080a4d290da1730866e856f
MD5 f09441a1ee47fb3e6571a3a448e05baf
SHA1 3c5c5df5f8f8db3f0a35c5ed8d357313a54e3cde
SHA512 0199ae0633bccfeaefbb5aed20832a4379c7ad73461d41a9da3d6dc044093cc319670e67c4efbf830308cbd9a48fb40d4a6c7e472dcc42eb745c6ba813e8e7c6
SSDEEP 3072:nUGrszKKLB8a9DvrJeeesIf3amN32AW/rcyw/s:OB8l3/aK32qU
TLSH
T1BAD37D6857C6DE56DB5FEC70E02052016631C52F5742BBEE5DC8B8F026923EA28193FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

system.numerics.vectors.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\system.numerics.vectors.dll
Size 113KB
SHA256 1d3ef8698281e7cf7371d1554afef5872b39f96c26da772210a33da041ba1183
MD5 aaa2cbf14e06e9d3586d8a4ed455db33
SHA1 3d216458740ad5cb05bc5f7c3491cde44a1e5df0
SHA512 0b14a039ca67982794a2bb69974ef04a7fbee3686d7364f8f4db70ea6259d29640cbb83d5b544d92fa1d3676c7619cd580ff45671a2bb4753ed8b383597c6da8
SSDEEP 1536:nPOw0SUUKw+GbgjMV+fCY1UiiGZ6qetMXIAMZ2zstK/hV+sUwS:nWw0SUUKBM8aOUiiGw7qa9tK/bJS
TLSH
T174B387E37F1EA476C7CE857F24F74E1D62B52A57C523D6B640CA5AA2016339B28040FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

system.resources.extensions.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\system.resources.extensions.dll
Size 78KB
SHA256 b69c9547c7bf0d6e357993d41228b6cef033f4f2e0ecba9f07325c7e980139ae
MD5 058062075dae2f0db660018d899358da
SHA1 4489f30223d4f80ad7c220615be2047afa82f085
SHA512 d2a568d19a0dfe06f9d9916c335fa1d752ed7ca78844124079e41b34c2342cbe3486f1d77a68c6cdd576d30fe84d03b12a7c7a5aabd09ee98174b0a167af01c7
SSDEEP 1536:PElSh0fXNlYQRZLj2O5xEMXfy6lNQYjLTb+G8uNsHQEispJnuFvTbp6wy/ei+zq9:PlLQCpuh6wMs+9
TLSH
T12973B51173FC5319F6FB2FB865F151118A3ABDA2A931D62D198160DE1AB2BC08D70B73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

system.runtime.compilerservices.unsafe.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\system.runtime.compilerservices.unsafe.dll
Size 16KB
SHA256 70868cd40021b6df1195ba764a6672d8e19ab58b86a263992986361f316a51ce
MD5 b78649f583f2b905c1cbf79ab90cc108
SHA1 847ec2fefaddbd2420e20065193497fa1ef2b489
SHA512 e9e99c5e60388956ac7cc8c2ae963364ad74a89432c5fae514648a68e24c13a684577313056ac9b6a264729f5c99de68bc809c14482d4f9dd12835f3cd13522d
SSDEEP 192:9Y4tIhywFXXbxfxdPWg9hWMW65FdQHnhWgN7aJeWPLyFqnajRRuvp7:9Y8ItFXXb/dPWg9hWOQHRN7WrolVRuvF
TLSH
T178723B999BA81103EE631F3096A5C943FE3CB3D61902D31D3985F7785C9E7D4AE20638
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

system.security.accesscontrol.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\system.security.accesscontrol.dll
Size 30KB
SHA256 aced52254a8c3cb6ad30f99f8b745296926c49373cab00824c2c4c10ad325b10
MD5 2d3e0b4ddf8628b41057b2aceef296eb
SHA1 8a3b1bd9df5d052c24de2304a2928fad86927f6d
SHA512 faac4233c45a773c4470071b0b2a75ee81eefa45f88b76fea305443514ff9c8429af3d394884933712d1fb7a7a03701f3d9df0f1de345078ddfeeeb5b4dc094b
SSDEEP 384:3RFGaTHrxhDRtGP/Ksmvt4kyvaMAdB+w3G5h9M9ZV3Mfpcrqmf9wEJqIxVRvFNgp:hAajzDRtGUl4kdWBkyHp98I
TLSH
T1FCD2C501ABF81159FAFB4B707AB99E121DBBFAD53D22C50C0514A19E59A2F90CA31733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

system.security.principal.windows.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\system.security.principal.windows.dll
Size 14KB
SHA256 c3ae599b5218516915f6542779ef577d5ad5de3d84a116e671c09e15e4591285
MD5 b40bda63658a012d46f930c243b77056
SHA1 2aed74577f5f623f7e910adda8ef74a11eea0437
SHA512 6c60d39858788775e265476b309a04bd8ab6054b30aa37199f199f19907aa103a68fe28cad4db22b2d7091f31448b0d1ab1f54ea7db78735af9a8b5356961734
SSDEEP 192:oQqIMZJxX3x4YjjEHxj7ligqWFLpW0W65FdQHnhWgN7aJeWyDM0884LfqnajOdoG:3qIAh4YvUqWFLpWGQHRN7WbJlqdo1sl
TLSH
T1C56239A1CBE84113EDB32E7056B6C6833C3DE3E7295246671AD1F1492CA33C5CB1022E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e4cde927-44c6-49b4-a804-eca161fd0906.tmp

Path C:\Users\Admin\AppData\Local\Temp\e4cde927-44c6-49b4-a804-eca161fd0906.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4120_838395353\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ratonClient2.exe

Path C:\Users\Admin\AppData\Roaming\PlatformRuntime\ratonClient2.exe
Size 2.4MB
SHA256 2a9b7d697b3342b1c1a4e3c5a20fce99d709b4a54c5eed13aa1da36dc74026ff
MD5 12dd94bcf857ca42d1fa84d3f2ee102f
SHA1 11cc77737fe450801b3cfd2d860493134d28d7e5
SHA512 2266d0db72ad7af6841dc3c20f54715f6ab14775080f3a5f25557d7a6eb8e3cb9dfcf0ddc6a0c4dc8394f8b9669d27f7adf1b3b272eb205fed450f6a8091954b
SSDEEP 49152:oNgVUlsHjkmiGWU5+5WDtsclR0BxMzaRw4BKA:QgVUuHjkDGjYQDGuRxzew
TLSH
T196C5016833F9860CF1BF0BF8A4B149664B71FC079C96D76D18A579DE04B6F44AA10B23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cleanup_cx4CO7KqCK4EC6fq88EXqIv2PxpzfB.bat

Path C:\Users\Admin\AppData\Roaming\Temp\cleanup_cx4CO7KqCK4EC6fq88EXqIv2PxpzfB.bat
Size 550B
SHA256 71d4620af5cab587c9c46ab8f73d093362122a171c39796774084a5ee6e7ce18
MD5 3d6043df28aa4eb603f066decf3fb827
SHA1 1ba8d4f86b90036a5620fe97d7c7b4a84987400f
SHA512 56b2f8216514718e294419b260be56bfed4a3033eb6c149e31398e471108dc3aad3deb35ad754c46d1337f643fe6938fa6054762f5618e4388aa5087d0e936dc
TLSH
T10BF02451338E87691410A13B4EB770CDD0AA885BBFD675013F28C05E379A00BE7C7BA1
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3216-138-0x000001C0ED4D0000-0x000001C0ED4DA000-memory.dmp

Download

memory/3216-136-0x000001C0ED6F0000-0x000001C0ED70E000-memory.dmp

Download

memory/3216-137-0x000001C0ED710000-0x000001C0ED7C2000-memory.dmp

Download

memory/3216-124-0x000001C0ED410000-0x000001C0ED432000-memory.dmp

Download

memory/5672-97-0x00007FFDE89F0000-0x00007FFDE9394000-memory.dmp

Download

memory/5672-64-0x00007FFDE89F0000-0x00007FFDE9394000-memory.dmp

Download

memory/5672-77-0x00007FFDE89F0000-0x00007FFDE9394000-memory.dmp

Download

memory/5672-735-0x00007FFDE89F0000-0x00007FFDE9394000-memory.dmp

Download

memory/5672-87-0x00007FFDE89F0000-0x00007FFDE9394000-memory.dmp

Download

memory/5672-88-0x00007FFDE89F0000-0x00007FFDE9394000-memory.dmp

Download

memory/5672-86-0x00007FFDE89F0000-0x00007FFDE9394000-memory.dmp

Download

memory/5856-56-0x00007FFDE89F0000-0x00007FFDE9394000-memory.dmp

Download

memory/5856-0-0x00007FFDE8B7F000-0x00007FFDE8B80000-memory.dmp

Download

memory/5856-49-0x00000169FF990000-0x00000169FF99A000-memory.dmp

Download

memory/5856-38-0x00007FFDE89F0000-0x00007FFDE9394000-memory.dmp

Download

memory/5856-31-0x00007FFDE89F0000-0x00007FFDE9394000-memory.dmp

Download

memory/5856-24-0x00007FFDE89F0000-0x00007FFDE9394000-memory.dmp

Download

memory/5856-2-0x00007FFDE89F0000-0x00007FFDE9394000-memory.dmp

Download

memory/5856-1-0x00000169FCF90000-0x00000169FD206000-memory.dmp

Download

memory/5856-55-0x00007FFDE89F0000-0x00007FFDE9394000-memory.dmp

Download

memory/5856-60-0x00007FFDE89F0000-0x00007FFDE9394000-memory.dmp

Download

memory/5856-61-0x00007FFDE89F0000-0x00007FFDE9394000-memory.dmp

Download