e96712778d34aa6d36dba92bf4863866f3e5bb7de48c9a500265a1e914b7b1ec

Analysis

user interaction
yes
max time kernel
20s
max time network
59s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/08/2026, 21:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
larpvirus.bat
Size 2KB
Sample260812-1t3n2seq7s
SHA256 e96712778d34aa6d36dba92bf4863866f3e5bb7de48c9a500265a1e914b7b1ec
MD5 69b6bc750cadd47411fe9bbd6a0d0b0d
SHA1 7e5fe101efa756f1d87b87421d9d7a286f851495
SHA512 a59b9dfc114642173633b54ff1544a3421db168d1148349a7f8d3f4289ed506e114d9cf31f7765eb91435616b6bed9d414d616efe23ab3c00df2083111afed8d
TLSH
T1F54121377388F3513FE08450965568559CAA56C8AD48EEE3B2DDA82AD30F61FE13684C
MD5 SHA1 SHA512 TLSH

Score

8^/10

defense_evasion discovery execution persistence privilege_escalation

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
4	3948	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4752	powershell.exe
2404	powershell.exe
1332	powershell.exe
1676	powershell.exe
1380	powershell.exe
2720	powershell.exe
3948	powershell.exe

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\larpvirus.bat	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\larpvirus.bat	cmd.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3208	cmd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1320	msedge.exe

Delays execution with timeout.exe 4 IoCs

defense_evasion

pid	Process
4156	timeout.exe
1444	timeout.exe
4624	timeout.exe
6104	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2115213192-531537726-3295841909-1000\{F4F1B951-24D3-46BE-9EB0-1B44E748EB1E}	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4752	powershell.exe
4752	powershell.exe
3948	powershell.exe
3948	powershell.exe
2404	powershell.exe
2404	powershell.exe
1332	powershell.exe
1332	powershell.exe
1332	powershell.exe
1676	powershell.exe
1676	powershell.exe
1676	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	4752	powershell.exe
Token: 33	2940	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2940	AUDIODG.EXE
Token: SeDebugPrivilege	3948	powershell.exe
Token: SeDebugPrivilege	2404	powershell.exe
Token: SeDebugPrivilege	1332	powershell.exe
Token: SeDebugPrivilege	1676	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1948	msedge.exe

Suspicious use of WriteProcessMemory 53 IoCs

description	pid	Process	procid_target
PID 3208 wrote to memory of 4752	3208	cmd.exe	90
PID 3208 wrote to memory of 3948	3208	cmd.exe	92
PID 3208 wrote to memory of 2404	3208	cmd.exe	93
PID 3208 wrote to memory of 1948	3208	cmd.exe	94
PID 1948 wrote to memory of 3332	1948	msedge.exe	95
PID 3208 wrote to memory of 3836	3208	cmd.exe	96
PID 1948 wrote to memory of 1320	1948	msedge.exe	97
PID 1948 wrote to memory of 5440	1948	msedge.exe	98
PID 1948 wrote to memory of 5440	1948	msedge.exe	98
PID 1948 wrote to memory of 5440	1948	msedge.exe	98
PID 1948 wrote to memory of 6136	1948	msedge.exe	99
PID 1948 wrote to memory of 6136	1948	msedge.exe	99
PID 1948 wrote to memory of 2356	1948	msedge.exe	101
PID 1948 wrote to memory of 2356	1948	msedge.exe	101
PID 1948 wrote to memory of 2356	1948	msedge.exe	101
PID 1948 wrote to memory of 5512	1948	msedge.exe	102
PID 1948 wrote to memory of 5512	1948	msedge.exe	102
PID 1948 wrote to memory of 5512	1948	msedge.exe	102
PID 1948 wrote to memory of 1840	1948	msedge.exe	104
PID 1948 wrote to memory of 904	1948	msedge.exe	105
PID 1948 wrote to memory of 1840	1948	msedge.exe	104
PID 1948 wrote to memory of 1840	1948	msedge.exe	104
PID 1948 wrote to memory of 904	1948	msedge.exe	105
PID 1948 wrote to memory of 904	1948	msedge.exe	105
PID 1948 wrote to memory of 2268	1948	msedge.exe	106
PID 1948 wrote to memory of 2268	1948	msedge.exe	106
PID 1948 wrote to memory of 2268	1948	msedge.exe	106
PID 3208 wrote to memory of 3324	3208	cmd.exe	103
PID 3208 wrote to memory of 4216	3208	cmd.exe	108
PID 3208 wrote to memory of 2124	3208	cmd.exe	110
PID 3208 wrote to memory of 5812	3208	cmd.exe	111
PID 3208 wrote to memory of 2376	3208	cmd.exe	112
PID 1948 wrote to memory of 3428	1948	msedge.exe	116
PID 1948 wrote to memory of 3428	1948	msedge.exe	116
PID 3208 wrote to memory of 1332	3208	cmd.exe	117
PID 1948 wrote to memory of 3316	1948	msedge.exe	119
PID 1948 wrote to memory of 3316	1948	msedge.exe	119
PID 1948 wrote to memory of 3316	1948	msedge.exe	119
PID 1948 wrote to memory of 4948	1948	msedge.exe	120
PID 1948 wrote to memory of 4948	1948	msedge.exe	120
PID 1948 wrote to memory of 4948	1948	msedge.exe	120
PID 1948 wrote to memory of 1928	1948	msedge.exe	122
PID 1948 wrote to memory of 4960	1948	msedge.exe	121
PID 1948 wrote to memory of 1928	1948	msedge.exe	122
PID 1948 wrote to memory of 4960	1948	msedge.exe	121
PID 1948 wrote to memory of 3172	1948	msedge.exe	123
PID 1948 wrote to memory of 3172	1948	msedge.exe	123
PID 1948 wrote to memory of 3172	1948	msedge.exe	123
PID 1948 wrote to memory of 5068	1948	msedge.exe	124
PID 1948 wrote to memory of 5068	1948	msedge.exe	124
PID 1948 wrote to memory of 5176	1948	msedge.exe	125
PID 3208 wrote to memory of 4156	3208	cmd.exe	126
PID 3208 wrote to memory of 1676	3208	cmd.exe	145

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\larpvirus.bat"
1⤵
- Creates a file in the Startup directory
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3208
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Add-Type -AssemblyName System.Speech; (New-Object System.Speech.Synthesis.SpeechSynthesizer).Speak('GET FUCKED BY THE larp VIRUS')"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4752
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Invoke-WebRequest 'https://th.bing.com/th/id/OIP.s-tpDMHjDshjQkz6blWYfAHaEK?w=324&h=182&c=7&r=0&o=7&pid=1.7&rm=3' -OutFile 'C:\Users\Admin\Pictures\new_wallpaper.jpg'"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3948
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "$code = @'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "https://www.youtube.com/watch?v=3nPcoQwp-Ao"
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1948
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x318,0x7ffba724c188,0x7ffba724c194,0x7ffba724c1a0
    3⤵
    PID:3332
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1660,i,12214895322311339213,17696700867485314936,524288 --field-trial-handle=2392,i,1621136059733320152,15395868103650257435,262144 --variations-seed-version --mojo-platform-channel-handle=2504 /prefetch:11
    3⤵
    - System Time Discovery
    PID:1320
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1528,i,3432473919852285236,6767386228927100214,262144 --field-trial-handle=2392,i,1621136059733320152,15395868103650257435,262144 --variations-seed-version --mojo-platform-channel-handle=2388 /prefetch:2
    3⤵
    PID:5440
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2284,i,16907141225674648399,12704202478156057152,524288 --field-trial-handle=2392,i,1621136059733320152,15395868103650257435,262144 --variations-seed-version --mojo-platform-channel-handle=2628 /prefetch:13
    3⤵
    PID:6136
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3604,i,4337535149102510372,16815549353428779880,2097152 --field-trial-handle=2392,i,1621136059733320152,15395868103650257435,262144 --variations-seed-version --mojo-platform-channel-handle=3868 /prefetch:1
    3⤵
    PID:2356
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3608,i,18356436358582909101,173457553970454882,2097152 --field-trial-handle=2392,i,1621136059733320152,15395868103650257435,262144 --variations-seed-version --mojo-platform-channel-handle=3872 /prefetch:1
    3⤵
    PID:5512
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4196,i,6939914242377848590,16879109663877113270,2097152 --field-trial-handle=2392,i,1621136059733320152,15395868103650257435,262144 --variations-seed-version --mojo-platform-channel-handle=4444 /prefetch:1
    3⤵
    PID:1840
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4300,i,6396005754491969539,4266084789865603040,2097152 --field-trial-handle=2392,i,1621136059733320152,15395868103650257435,262144 --variations-seed-version --mojo-platform-channel-handle=4428 /prefetch:9
    3⤵
    PID:904
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4404,i,12134975692691348183,8777908966819099656,2097152 --field-trial-handle=2392,i,1621136059733320152,15395868103650257435,262144 --variations-seed-version --mojo-platform-channel-handle=4452 /prefetch:1
    3⤵
    PID:2268
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5588,i,16817913938877122598,15399651528152886284,524288 --field-trial-handle=2392,i,1621136059733320152,15395868103650257435,262144 --variations-seed-version --mojo-platform-channel-handle=5564 /prefetch:14
    3⤵
    PID:3428
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5688,i,3830401360629727462,4799245581314500718,2097152 --field-trial-handle=2392,i,1621136059733320152,15395868103650257435,262144 --variations-seed-version --mojo-platform-channel-handle=5692 /prefetch:1
    3⤵
    PID:3316
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=3864,i,14781958895915336634,13241418753751295959,2097152 --field-trial-handle=2392,i,1621136059733320152,15395868103650257435,262144 --variations-seed-version --mojo-platform-channel-handle=5852 /prefetch:1
    3⤵
    PID:4948
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5900,i,6262712920552116296,13159682288366564540,524288 --field-trial-handle=2392,i,1621136059733320152,15395868103650257435,262144 --variations-seed-version --mojo-platform-channel-handle=4364 /prefetch:14
    3⤵
    PID:4960
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3608,i,7347986453046008373,294021276219910359,524288 --field-trial-handle=2392,i,1621136059733320152,15395868103650257435,262144 --variations-seed-version --mojo-platform-channel-handle=5988 /prefetch:14
    3⤵
    PID:1928
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6416,i,4924287279686804442,16889823055681120577,2097152 --field-trial-handle=2392,i,1621136059733320152,15395868103650257435,262144 --variations-seed-version --mojo-platform-channel-handle=6440 /prefetch:1
    3⤵
    PID:3172
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6496,i,6657628615545966594,8348611955154209148,524288 --field-trial-handle=2392,i,1621136059733320152,15395868103650257435,262144 --variations-seed-version --mojo-platform-channel-handle=6628 /prefetch:12
    3⤵
    PID:5068
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2228,i,3101937528147519758,17293651672313668863,524288 --field-trial-handle=2392,i,1621136059733320152,15395868103650257435,262144 --variations-seed-version --mojo-platform-channel-handle=6816 /prefetch:14
    3⤵
    - Modifies registry class
    PID:5176
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7024,i,5413153885322893435,8301943826749547822,524288 --field-trial-handle=2392,i,1621136059733320152,15395868103650257435,262144 --variations-seed-version --mojo-platform-channel-handle=7040 /prefetch:14
    3⤵
    PID:1084
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7024,i,5413153885322893435,8301943826749547822,524288 --field-trial-handle=2392,i,1621136059733320152,15395868103650257435,262144 --variations-seed-version --mojo-platform-channel-handle=7040 /prefetch:14
    3⤵
    PID:2324
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4708,i,14048024277328627016,1574494839532389354,524288 --field-trial-handle=2392,i,1621136059733320152,15395868103650257435,262144 --variations-seed-version --mojo-platform-channel-handle=4684 /prefetch:14
    3⤵
    PID:3412
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4636,i,14230368403140774041,3322735651305172429,524288 --field-trial-handle=2392,i,1621136059733320152,15395868103650257435,262144 --variations-seed-version --mojo-platform-channel-handle=4732 /prefetch:14
    3⤵
    PID:2276
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4648,i,17192746847376889984,6722305863193252870,524288 --field-trial-handle=2392,i,1621136059733320152,15395868103650257435,262144 --variations-seed-version --mojo-platform-channel-handle=7472 /prefetch:14
    3⤵
    PID:5232
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7612,i,12585959928297005024,10711857354202012601,524288 --field-trial-handle=2392,i,1621136059733320152,15395868103650257435,262144 --variations-seed-version --mojo-platform-channel-handle=7604 /prefetch:14
    3⤵
    PID:4616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "https://www.youtube.com/watch?v=3nPcoQwp-Ao"
  2⤵
  PID:3836
- C:\Windows\system32\cmd.exe
  cmd "GET"
  2⤵
  PID:3324
- C:\Windows\system32\cmd.exe
  cmd "FUCKED"
  2⤵
  PID:4216
- C:\Windows\system32\cmd.exe
  cmd "BY"
  2⤵
  PID:2124
- C:\Windows\system32\cmd.exe
  cmd "LARP"
  2⤵
  PID:5812
- C:\Windows\system32\cmd.exe
  cmd "LMAO"
  2⤵
  PID:2376
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Add-Type -AssemblyName System.Speech; (New-Object System.Speech.Synthesis.SpeechSynthesizer).Speak('GET FUCKED BY THE larp VIRUS')"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1332
- C:\Windows\system32\timeout.exe
  timeout /t 2 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:4156
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Add-Type -AssemblyName System.Speech; (New-Object System.Speech.Synthesis.SpeechSynthesizer).Speak('GET FUCKED BY THE larp VIRUS')"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1676
- C:\Windows\system32\timeout.exe
  timeout /t 2 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:1444
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Add-Type -AssemblyName System.Speech; (New-Object System.Speech.Synthesis.SpeechSynthesizer).Speak('GET FUCKED BY THE larp VIRUS')"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1380
- C:\Windows\system32\timeout.exe
  timeout /t 2 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:4624
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Add-Type -AssemblyName System.Speech; (New-Object System.Speech.Synthesis.SpeechSynthesizer).Speak('LMAO')"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2720
- C:\Windows\system32\timeout.exe
  timeout /t 2 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:6104
- C:\Windows\system32\shutdown.exe
  shutdown /s /t 0
  2⤵
  PID:2228

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004F4 0x00000000000004EC
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2940

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1268

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5728

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1156

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:6044

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa39cf855 /state1:0x41c64e6d
1⤵
PID:1676

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k CameraMonitor
1⤵
PID:3656

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ee00825bbd5a4f21308ad2e10e5a9d3c4512f07fbd288ec8ac76788de6019e25
MD5 c3584e6bc22b3ad2f168ede48d20a993
SHA1 ffb4ecef8f65638ca17e16a32806195193977c7e
SHA512 5fd777359305e67e9f30fc404af9013a876846b1d6db271fa73dfcf2ee22fb25a8e26d4d0c970cc3a8219df11038dc6b4c2c411db652593bda1c3d7643753c0b
TLSH
T18AD02B7637C40404C0D0747621F34602D530C520584C81088801B03CCC207C3010A8DB
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c80f71026fa07cc9b3e69c8779d4b4b40710cf7bc2893b740943db0d0f79591a
MD5 590eca05f11ec72644a09f205b548fbc
SHA1 c6521700bee3b500259ee3a70292b90201f20597
SHA512 fddd457c35c61ceb727f99bd39f55314cdeb7d062798c573a377675121f972ed95109fec329f911c502139a1794b70e5a98a57dd3b21b5a70e6518890a361f66
TLSH
T1E7D02B7A37C40404C0D0747221F24602D530C520AC4C81088801702CCC207C3010B8EF
MD5 SHA1 SHA512 TLSH

Submit Download

f_000062

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000062
Size 56KB
SHA256 e5a5b08d10282d3bb102ea60da50511d94b7b5df75c6975bbcb52b8e67a1a66e
MD5 478f8ce6dcfcb252b4f7d031a7a8bdf9
SHA1 019456174b6128f6338f050b7eadbbfabf843d10
SHA512 84ddb1d80040c85fbf2fe0859693bc8fcebf8601a5681553bf2802c5066b2ab6fdab36afdb9f044961fb8cd7b66aa7665c218c6a2cc477677f4acb037eaf17cf
SSDEEP 1536:5Y2SKLfu7ZOkytKkWajYMwpc9nKF6C+i8G:5YNKLmVrMLWvpS9KACrl
TLSH
T1AF4312CB90B721CC13B2D65420E564091A730DC3B06E93D6EB5CCE139627D2BD3ADEA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000064

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000064
Size 283KB
SHA256 b605a27742240cb59789eef6302afb1468b43cf1a44f1396919ca42f6d796dfc
MD5 2b7c6d439d5fe87aad67543be49272f6
SHA1 8244e122fd6e4c31fc111c5f0ee521ffdf37e673
SHA512 b07964b38b26cb22bbed8af5bf7975f454fd2548a7931682953d35e9c297458fc6160a4024d9f979dc909f5feb274bac209d1352492f4d09dc9a5c127af1bd7e
SSDEEP 6144:eXt36VE0oqOFSnrtZGc8w0FP778Pdirx9RlxeaSnKY:e9KXE6rqm0Fz78Qx9f8aI
TLSH
T121542323D271397AB4E369D03BB64DA84DFF73792E64180729D378189660426EC5CE4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\000003.log
Size 210KB
SHA256 270cced850edc34ae02981a7e31da4f9507f6bf21943cae11932c7ca47d87f7a
MD5 6ced4b56fce38134f4bf049d6800aba0
SHA1 c8dc8df2268b7b847bd51949f6f742a468a8a36e
SHA512 1572db71b3a6814f03f242e05f01564920541c78bb1789bc76cc0b14250f6b6408934e195fb99071038902577b5d87b2933703dbd8fc60c654e2bcc4dde53f4e
SSDEEP 3072:7+ppPhPa6y9JbMF9G3vKO4dR3CTOPnICkOWdh3yBY25kbX:BbAOtOIOkbX
TLSH
T14624C814B16173D6F12A433B1A639E23D3759EC44698705AB8A37B0C36F7B853760B2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\LOG
Size 353B
SHA256 b69c0f26e2ca1a64176d5d94ca7e9e60fa6074f6deae922c7815f3a20e62cb3b
MD5 29a21aca38a2752b3949c44d70a7d0e4
SHA1 2c0087caa8c418223893000f9a35887ed995b77c
SHA512 e22694b032c4832e8f1e546825e424dc95dfad83ea3669afb50dcc1e3aa9bf74796dc5498e170506af8190e555503f924b20be2b28ced7a494dc42d4c38f2610
TLSH
T15EE0682884D8C25F53A060D710307B0DE5AB610FA6CDBD410F45C804708A888902E150
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 9d629ac7c40d4140b077e304b93530bf9ecddac6332a9b0ee8bb9d2894fe1284
MD5 88110cd55d196208504e0c51558bf46e
SHA1 4ead8f3b5762da62da5b0d73a6d7b1053cf48094
SHA512 fe24fb48de51ac844b028577535f714b3a8581798a2b31ff677a21149dbd579c1f130eea7c7461cf18867cbf07e49c604f0c108a26503186c73e601c3766b525
SSDEEP 192:DYbmOwXJUALOC62VajhnOv/FBvhGJVOE32rcDdWmEGBugQR:DYbmOwXJUALOC62Va5Ov/FBvhGJVOE38
TLSH
T17302ADF3C7E8C23DD81116F4E6543E1BDE290D2483283C6ADAD9AE0B63E5471E250A5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 017faa9854e780ae951819c1f998ba695676c91c1fb0ed9f94eeb79a5554149e
MD5 adb9165c4f085b155278f191239fb2df
SHA1 760f68b06b86589b3f76d371e7aa0099150ad376
SHA512 0aaa8fb6fece2cdc7a7ddc612df657b621b89db7c97670f66062a90b2eef44b7b7ff9ad459e459cdfd6ff68ed3f6826c48929a7fae1ffed306343acc72f12770
SSDEEP 192:sxRJRhCr1/f8sPyixZtzzoA8pfJM/g6+WNl/TdBvhSMEFL9fkGtIgD/wAxJ:sxRJeB/f8sPyiftie/5Vd+/f
TLSH
T17F42B716B924693B4CC7E259FA55BF13E3F95422A5D41E48EBFC8A1C04EF6DD220380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 423e04af11bc77811439bd386ef2ed891cbebd6fa0d97339f12e5c790b0df6cf
MD5 c6af9cb177e379877b4251d90ca6c7ad
SHA1 155b379490425e8993ce69c2287c3dc317f01548
SHA512 f1fb213e46962fbca56180b39e2ae478c19d27f42c3f7fa8af376386f3f1884487f85954f933c383c728bcc4ac9402ee9e066ed47fbc3d68ece34497bd4c683e
SSDEEP 192:sxRORhCr1/f8sPyixZt4zoA8pFYJM/g6+WNl/TdB8oSMMFLjfJGtIgD/wAHJ:sxROeB/f8sPyiftBr/5VdCi1
TLSH
T13752C656A924693B4DC7E25AFA95BF17E3F91422A5D05E44EAFC891C00EF6DD220380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 c3a8296a4121db1130bf80cf02ac671363712d2d4b8ef74e9a0255a5f8ccc678
MD5 fd0c476c269fb73f98d26a6d9a5583be
SHA1 ded24d68ac8f61b52827c320f57bee7b32ab5e0e
SHA512 e0df6cd1b16a238bb6d7da851c2e684923c335753c1e2fd857108143072704c6c633e46cd10595039a0f9d7ab04255526b51a8a0554d216f3cebcceb3767be61
SSDEEP 768:K80E+67pLuL7FwWgNhfVN8F1+UoAYDCx9Tuqh0VfUC9xbog/OVuwLWjroLuph:K80E+SE7FwWgNhfVNu1jaJgWQLuph
TLSH
T16DC2C87B740CCB7E4F800ADDAC197E9B6DA802CB96D8CD9047FE951C02C6BEA51164DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 216B
SHA256 d66db6c9ef6a765c7190046a2dfb6bbe98fa14932a68f649f9d7392c00577a45
MD5 eee9a3256b32bed1e155e820f5d53071
SHA1 fd6b8f33bc1f85939f4849e00a7b2b9353fd1011
SHA512 2340c2b897c51e92073a9c9f24233e4315f8c8836b4a93678bf85d8a6664b1c27fa2b1565b99511b9dc57d8945d13482961f8e2ae3f7399ebbe550a00c1b4d68
TLSH
T189D023D546318DC2373056C57034159D4115CD0DEDC0DCE0AC44700B227C713C4036AA
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 132B
SHA256 2b40c512d8abd39ee62d3f1cc2b8eedebcaa2c587fd3336b1ff4aecfffe5ecea
MD5 976abc0744fc2b0e2374c5c9bfd8635e
SHA1 dc51cdab4f7d49bf58e4136b318cb75537e292c2
SHA512 4ff138341200b57f4b3ef8a8b11d695532d4f7eb836f0c36e7ccd6921020a8d49d7fd7085afba791967c5dfa2d0ba4217b97bdd83aa250546c5e475a7dc9de6e
TLSH
T177C09BF646114DC77770A7C87034575DD60BC14CD4C0DCF4A54851076269523C401565
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 214B
SHA256 d2a086266c029b96a4413841da8beebf206a7cfd58ad484fca3da053997b1c39
MD5 d94ac59dbef10d2e6f7d0a16f0433228
SHA1 c4cbfbe3fa9a8efdfa3898d2fb35fe230ac8ce07
SHA512 8ac20e9bb630c06cb5c4426efdf26027f338d13a6d5d569a7f3c4448b0a271271e7cdf547ab9838942278c494cb366d758b672584b6ade2faf99f01612d6e033
TLSH
T180D022E94331DD8B3334ABC86034469E811ADC4CD880ECE5EE08F107207C613C501E7A
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 130B
SHA256 cbfd2c4fba82b16596ca0a90d63b43e0000d4a8a8209fe4b969059fb8273fe44
MD5 e13eb082aad79199756b74f7a9f7c9b6
SHA1 3337742b2bb3c630333fa2554e2c78cc54264b8e
SHA512 abecdfbe7914d273815e711bab6fa46e7588a5e7f4fe63e97dd6ded93647ce4bef17e473dab7e45aa28e90368a761324d0ba540226ae2ffe4334e0ee5c89bf82
TLSH
T1F4C092F64721CECB6B74EBC86039A76E960BC28CD8C0DCE4A148910664399238842A66
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe59798b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt~RFe59798b.TMP
Size 137B
SHA256 1ae6f0b12917f226c487953a45f93eec50119b7e46afbc1d88a9c871b844c728
MD5 f858c80650edcf5839d78256f897a9ed
SHA1 f6a4050f9c3d40f703ca21ab850e7b188c153c0a
SHA512 0ce57807935c799db41d3f2d4b39848c219264672dbc99f60cff8063ac981ee48585b29df708095b78251551e72e890e0ce8a7005c2ef764c79c2727ab4a0cd2
TLSH
T158C09BF646214DC7673466C46034575D961BCD8DD8C0DCE4A14971067139527C501565
MD5 SHA1 SHA512 TLSH

Submit Download

f989dac6-17a5-4162-9cee-77a61d120520.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f989dac6-17a5-4162-9cee-77a61d120520.tmp
Size 12KB
SHA256 4d0bba23a75520c4b8c3ab68ab76397eeef3e7ec29762aeac96da935ae665324
MD5 5c067aecdbbfd8737390fc42a1aa3b4a
SHA1 7779fb4b819a38150512c4f838a43186373d9b5a
SHA512 25bd4d4e97238ce520dc70035e38302904dd1be9215b229a68f9ae3dc8761b273ff4bc15e07e1367c937b70a3b687b9da1a3633a863b7f49675b949904364ef9
SSDEEP 192:sxR+RhCr1/f8sZyi3AtXzoA8pf8M/g6+WNlaefBFDMEFLRkGtIgV/J:sxR+eB/f8sZyih1/5XfvH/
TLSH
T16C42C8567928593B4CC7E25DBA55BF63E3F95432A0D51E48ABFC861C04EF6DD120380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 675add3f0aa193a0fece5af4dccdd999d998c96a97484b77beb55d3366e2ff39
MD5 7f3813045ed60e8e1c1a8eb0e68dc453
SHA1 28d94063c0366732729b14248569d7135956dd6d
SHA512 d3be24de41712246757dde0b500ac500a9393cb732c59aaa4b81e54613e62f9124c477a02e74e44fa80c30d6f507ddd0fccba7cf1d3fb3ef0b6f3fceca0687de
SSDEEP 768:Wrv+4UNbdH3oq+LeSFOUvNt1UkX4fouOToPvB2thtA9VAgDeVH1Slo:Wbsbh3XqsnnwthttSEH1b
TLSH
T18E03BF32A4AC8D33DDE6D298714B76832FF4516398800F84DED95B5D068B6DE170FD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 8d03f7ddede6656697106be0e9c8998d1e18790da7371a16daff6aabc558f13b
MD5 613efa9ca2eb8c89ae3dc6f377bdb3fe
SHA1 d7998bc35df7d516f8fcf64d926bb31044ee1363
SHA512 b80438701b2dbedd09a04a81a5e817fb75e7ff83149762250974b76d3ece58808369a3d1261616f463371b19c3feeaf7a9f4b3430d7abaa7e71eafde2088f3cc
SSDEEP 768:Yrv+4UNbdf3CLW+LeSFOUvNt1UeX4fouOToPvB2thtA9VAgDx:YbsbJ31EsnnwthttSx
TLSH
T19703BF32B4AD9D73DCAAD298710A76837FB4116358C10F84DED91B8D058BADE2B0FD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 33ed99294c004a8f92d9b1f593e9ed71ac9d3e8d09896ebe64ff1a710f048e25
MD5 80ae70786356c1f1e448b16ba34cdd59
SHA1 1c81cfabe3d18184a57e5009121f9cf6e970a13f
SHA512 7f5c10c39af4588d4891f8e50b9552ab271fba85e677f1ff6491d4b4ff9087d4f10bc8f35e1fdac80bd44a331acf332fbeff73498ec5d04921dba91a02f90438
SSDEEP 768:srv+4UNbdH3rI+LeSFOUvNt1UkX4fouOToPvB2thtA9VABDeVH1SlX:sbsbh3cqsnnwthttpEH1Y
TLSH
T1C703BF32A4AC8D33DDE6D298714B72932FF4516398800F84DED91B4D068BADE1B0FD66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 82e8cf453eac8344d01f03c89f7453522a9e43567acd0878a6113c2227300897
MD5 fd0d24079ffab3705b3330473273d61f
SHA1 65c2c92241cf857da14fe7f530bcb18e86b3f353
SHA512 cc4b1f3cd55d2208eff6a9c919522c37e63a08f0067d63841889c418948c014df95f12c075f14de9546769f1c0d1c9d271e1779dfe4bbb38cf95d2114b462f1d
SSDEEP 768:DU3NLW+LeSFOUvNt1UnX4fouOToPvB2thtA9VAgDUn2u8c:DU3IXsnnwthttSU2jc
TLSH
T13AF2C072E8A99C63DCEAE296710A32825FF0517368C45F84AEDD575D014BBDF0B0BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 a309a9b780cd6dd36fd416f1a01b2d861518767a6e30c9216abfcd376260a9c0
MD5 ced7ad394c6b7b2cf2fbcc9a20eaa8b8
SHA1 03f430160f9c1cee9719dab2638f2e00ea3a7b34
SHA512 56e791cdbd8730979cbd0b679f32811ce5a132c1eb73affa0cf3135106d1fcbf6ea11ee65f123c727313fc05810c652747f17df03350a81a2a9beaf76988b288
SSDEEP 768:DR3NLW+LeSFOUvNt1UnX4fouOToPvB2thtA9VAgWUn2u8c:DR3IXsnnwthttfU2jc
TLSH
T16EF2C072E8A99C63DCEAE296710A32825FF0517368C45F84AFDD575D014BB9F0B0BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 40a97d1e5634a5f1776f09f3cc504d63dd5b9dfc3efc1886da1bd96a33f18094
MD5 f74e609975501ef7c1071f6bbbcf0786
SHA1 c8483615902b7987413c26cb7ca1006ac6192f6c
SHA512 cb6b7210cc6fb50cbaebb8369b40247d12d641e4f327a3bf135a07715a60fc3061b18b578718190ab965a486c11f485ec42eab92786600cb3065c844471df3ec
SSDEEP 768:arv+4UNbdf3YLW+LeSFOUvNt1U3X4fouOToPvB2thtA9VAgDx:absbJ3XnsnnwthttSx
TLSH
T10303BF31B4AD9D73DCAAE298710A76837FB4116358C10F849ED91B8D068B6DE2B0FD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 0c89f198ea7dd507d7e80c15d337a3e10613951c0ce6382dca810afff9429cb9
MD5 ca8779d74553c614129fdf926baeb529
SHA1 a0b855059de63bc0283160a1049c0fc78cb88e77
SHA512 867e56b33c92b93714f25c3ab5249b82bf4fb1d700e4734e28f0d050d759d00a540f660194f9a02610192acb3fc0d3ec472c18e85f5072b4c17a11e1996a3b8b
SSDEEP 768:grv+4UNbdH34k+LeSFOUvNthX4fouOToPvB2thtA9VAwreVH1SlX:gbsbh30snnwthttiEH1Y
TLSH
T13503CF32A8A88A33DCE6D398720B75533FF4515396900FC49DDD1B4D069B9DE430BD66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

752c3092-8a42-47db-a0bc-8e8c0afe1234.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\752c3092-8a42-47db-a0bc-8e8c0afe1234.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 ea13d57b11af249f90704dbcafd354c5e80b10358db7edb9eaf8f6fd597eb1d4
MD5 ae3a19c226264ff6cb64877f1e7e7243
SHA1 f993431dbd09200fd92b7a04ee6711a54ad95cc9
SHA512 97e5dbf0663585afbb5e0f2b5a36192624eb2c898462abef65225987df632d30f74f05ac5a71175c4c59f75d9ae6d2e640d168e479cb26b9a6857c71efda029a
TLSH
T1C1C02B85CB1E0C854E78153D48420B2727819F0030508534445A490C41741CE00888CF
MD5 SHA1 SHA512 TLSH

Submit Download