e4891bf28e653087e3c6b90eb6323f1bdcdb041b97c7779f43a28f26cbf00ffd

Analysis

user interaction
yes
max time kernel
1048s
max time network
1049s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/08/2026, 20:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
New Text Document (2).txt
Size 220B
Sample260812-za5tmathrd
SHA256 e4891bf28e653087e3c6b90eb6323f1bdcdb041b97c7779f43a28f26cbf00ffd
MD5 e30852e62cccbefc48464f9b6790ed9c
SHA1 c0f1c5c9bbc781486677e8445f8c7449272e315d
SHA512 7f6828d6ce0a39d6f66059adb5c482d92659e33fcb187645d9393d2aa7cd39411d0c406f45d43831f715d7cc430fd19b81bbec3a73e02c090fd664915a020ae7
TLSH
T110D022FB98074953532F88C8F0A130DEC8394B0DDCD3098AA610C818040EB3A2E8380E
MD5 SHA1 SHA512 TLSH

Score

8^/10

discovery persistence ransomware

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
236	2652	msedge.exe

Executes dropped EXE 7 IoCs

pid	Process
4524	windowsdesktop-runtime-10.0.11-win-x64.exe
3676	wixstdba.exe
6048	windowsdesktop-runtime-10.0.11-win-x64.exe
4672	windowsdesktop-runtime-10.0.11-win-x64.exe
2496	windowsdesktop-runtime-10.0.11-win-x64.exe
3692	wixstdba.exe
4124	windowsdesktop-runtime-10.0.11-win-x64.exe

Loads dropped DLL 40 IoCs

pid	Process
4684	MsiExec.exe
4684	MsiExec.exe
3820	MsiExec.exe
3820	MsiExec.exe
1196	MsiExec.exe
1196	MsiExec.exe
3828	MsiExec.exe
3828	MsiExec.exe
4608	MsiExec.exe
4608	MsiExec.exe
1960	MsiExec.exe
1960	MsiExec.exe
4048	ObfuscatorGUI.exe
4048	ObfuscatorGUI.exe
4048	ObfuscatorGUI.exe
4048	ObfuscatorGUI.exe
4048	ObfuscatorGUI.exe
4048	ObfuscatorGUI.exe
4048	ObfuscatorGUI.exe
4048	ObfuscatorGUI.exe
4048	ObfuscatorGUI.exe
4048	ObfuscatorGUI.exe
4048	ObfuscatorGUI.exe
4048	ObfuscatorGUI.exe
4048	ObfuscatorGUI.exe
4048	ObfuscatorGUI.exe
4048	ObfuscatorGUI.exe
4048	ObfuscatorGUI.exe
4048	ObfuscatorGUI.exe
4048	ObfuscatorGUI.exe
4048	ObfuscatorGUI.exe
4048	ObfuscatorGUI.exe
4048	ObfuscatorGUI.exe
4048	ObfuscatorGUI.exe
4048	ObfuscatorGUI.exe
4048	ObfuscatorGUI.exe
4048	ObfuscatorGUI.exe
4048	ObfuscatorGUI.exe
4908	msedge.exe
4908	msedge.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{96749152-C361-49E0-BAC6-818F491B9276} = "\"C:\\ProgramData\\Package Cache\\{96749152-C361-49E0-BAC6-818F491B9276}\\windowsdesktop-runtime-10.0.11-win-x64.exe\" /burn.runonce"	windowsdesktop-runtime-10.0.11-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{96749152-C361-49E0-BAC6-818F491B9276} = "\"C:\\ProgramData\\Package Cache\\{96749152-C361-49E0-BAC6-818F491B9276}\\windowsdesktop-runtime-10.0.11-win-x64.exe\" /burn.runonce"	windowsdesktop-runtime-10.0.11-win-x64.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
109	api.gofile.io
106	api.gofile.io
107	api.gofile.io

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\ThirdPartyNotices.txt	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.11\System.Diagnostics.Contracts.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.11\it\WindowsFormsIntegration.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.11\ko\UIAutomationClientSideProviders.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.11\System.Xml.ReaderWriter.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.11\fr\ReachFramework.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.11\ko\PresentationUI.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.11\ko\System.Xaml.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.11\System.Net.ServerSentEvents.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.11\System.Resources.Reader.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.11\System.ServiceModel.Web.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.11\System.Windows.Forms.Design.Editors.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.11\es\WindowsBase.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.11\it\System.Windows.Input.Manipulations.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.11\pt-BR\System.Windows.Forms.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.11\ru\UIAutomationProvider.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.11\System.Threading.AccessControl.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.11\de\System.Windows.Controls.Ribbon.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.11\es\System.Xaml.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.11\fr\WindowsFormsIntegration.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.11\pl\System.Windows.Input.Manipulations.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.11\ru\UIAutomationTypes.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.11\zh-Hans\PresentationUI.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.11\ja\System.Xaml.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.11\System.Net.WebHeaderCollection.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.11\System.Security.Cryptography.X509Certificates.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.11\fr\Microsoft.VisualBasic.Forms.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.11\pt-BR\Microsoft.VisualBasic.Forms.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.11\System.Runtime.Serialization.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.11\clrgcexp.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.11\fr\PresentationUI.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.11\tr\UIAutomationTypes.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.11\System.Windows.Input.Manipulations.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.11\de\System.Windows.Input.Manipulations.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.11\it\System.Windows.Forms.Primitives.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.11\System.IO.IsolatedStorage.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.11\System.IO.Pipes.AccessControl.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.11\System.Numerics.Vectors.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.11\System.Private.Xml.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.11\System.Security.Principal.Windows.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.11\System.Text.Encoding.Extensions.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.11\clrjit.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.11\UIAutomationClientSideProviders.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.11\System.Collections.Specialized.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.11\System.Reflection.Primitives.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.11\PresentationUI.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.11\System.Reflection.Emit.ILGeneration.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.11\System.Reflection.Emit.Lightweight.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.11\System.Configuration.ConfigurationManager.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.11\pt-BR\PresentationFramework.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.11\pt-BR\System.Windows.Forms.Primitives.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.11\pt-BR\WindowsFormsIntegration.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.11\zh-Hans\System.Windows.Controls.Ribbon.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.11\System.Globalization.Extensions.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.11\System.Private.DataContractSerialization.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.11\System.Threading.Timer.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.11\ko\Microsoft.VisualBasic.Forms.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.11\System.IO.UnmanagedMemoryStream.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.11\System.Net.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.11\System.Runtime.Extensions.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.11\pt-BR\PresentationCore.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.11\System.Buffers.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.11\de\ReachFramework.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.11\pt-BR\UIAutomationClientSideProviders.resources.dll	msiexec.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1608_1219549950\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\Installer\e5b7641.msi	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4908_758599348\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4908_1283409437\hyph-mr.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4908_1283409437\hyph-mul-ethi.hyb	msedge.exe
File created	C:\Windows\SystemTemp\~DF8DD2276F0317309E.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4908_867341450\travel-facilitated-booking-kayak.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4908_14884793\Mu\Fingerprinting	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4908_1283409437\hyph-de-1901.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4908_1144119376\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4908_758599348\sets.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4908_1208953669\ranked_dicts	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4908_1283409437\hyph-de-ch-1901.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4908_1283409437\hyph-und-ethi.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1608_1219549950\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1608_1219549950\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1608_1219549950\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI431C.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4908_875113772\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4908_595669023\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4908_1785235973\data.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1608_1219549950\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1608_984700756\manifest.json	msedge.exe
File opened for modification	C:\Windows\Installer\MSI9B3A.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4908_1208953669\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4908_1283409437\hyph-fr.hyb	msedge.exe
File created	C:\Windows\Installer\SourceHash{E1510730-5A34-4EF3-B865-84351D8BF1BA}	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1608_1219549950\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1608_1219549950\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1608_1219549950\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4908_14884793\Mu\Content	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4908_14884793\Mu\Entities	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1608_1219549950\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1608_1219549950\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4908_1283409437\hyph-kn.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4908_1283409437\hyph-pt.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4908_1283409437\hyph-sv.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1608_1219549950\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\~DFB98CDB7D941F2ED7.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF9A6F27609662738F.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4908_14884793\Mu\Advertising	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1608_1219549950\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1608_1219549950\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1608_1219549950\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4908_990356887\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4908_14884793\Sigma\Advertising	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1608_1219549950\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1608_1219549950\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1608_1219549950\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1608_1219549950\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4908_1283409437\hyph-ta.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1608_1219549950\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1608_1219549950\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1608_1219549950\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1608_1219549950\_locales\cs\messages.json	msedge.exe
File opened for modification	C:\Windows\Installer\e5b7636.msi	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4908_1283409437\hyph-cy.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4908_1283409437\hyph-en-us.hyb	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_1608_274449015\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_108_1_0.crx	msedge.exe
File opened for modification	C:\Windows\Installer\MSI3F33.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIAE07.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF1B2B52DBA55E56FD.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1608_1219549950\_locales\or\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wixstdba.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-10.0.11-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-10.0.11-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wixstdba.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-10.0.11-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-10.0.11-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-10.0.11-win-x64.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2652	msedge.exe
4396	msedge.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	taskmgr.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	taskmgr.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 16 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2A	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2c	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2C	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134310403461301734"	msedge.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2B	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\28	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\29	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2d	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FB0EF24091E00E748846224F387C486E\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1FE3F4B01F604E646B263AD3CE0C1214\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{96749152-C361-49E0-BAC6-818F491B9276}\Dependents\{96749152-C361-49E0-BAC6-818F491B9276}	windowsdesktop-runtime-10.0.11-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\93BFA97052F56B875A679F3A630341A6\0CF3D802295B1224E835B61226E19915	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FB0EF24091E00E748846224F387C486E\Version = "1345117748"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\windowsdesktop_runtime_80.44.56884_x64	windowsdesktop-runtime-10.0.11-win-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	ObfuscatorGUI.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4"	ObfuscatorGUI.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4"	ObfuscatorGUI.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_80.44.56884_x64\DisplayName = "Microsoft Windows Desktop Runtime - 10.0.11 (x64)"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0CF3D802295B1224E835B61226E19915\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0CF3D802295B1224E835B61226E19915\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	ObfuscatorGUI.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg	ObfuscatorGUI.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	ObfuscatorGUI.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0370151E43A53FE48B564853D1B81FAB\ProductName = "Microsoft .NET Host - 10.0.11 (x64)"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1FE3F4B01F604E646B263AD3CE0C1214\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{96749152-C361-49E0-BAC6-818F491B9276}\ = "{96749152-C361-49E0-BAC6-818F491B9276}"	windowsdesktop-runtime-10.0.11-win-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_80.44.56884_x64\Dependents\{96749152-C361-49E0-BAC6-818F491B9276}	windowsdesktop-runtime-10.0.11-win-x64.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\NodeSlot = "7"	ObfuscatorGUI.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{f86fa3ab-70d2-4fc7-9c99-fcbf05467f3a}\Instance\	ObfuscatorGUI.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16"	ObfuscatorGUI.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	ObfuscatorGUI.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0370151E43A53FE48B564853D1B81FAB\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0370151E43A53FE48B564853D1B81FAB\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{E1510730-5A34-4EF3-B865-84351D8BF1BA}v80.44.56884\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1FE3F4B01F604E646B263AD3CE0C1214\PackageCode = "7C8DEECE7F8929048ABD501C37A7F727"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1FE3F4B01F604E646B263AD3CE0C1214\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\FB0EF24091E00E748846224F387C486E	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg	ObfuscatorGUI.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1"	ObfuscatorGUI.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0370151E43A53FE48B564853D1B81FAB\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0CF3D802295B1224E835B61226E19915\PackageCode = "C232BDCA57CB2D7409D23564629F8AD4"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FB0EF24091E00E748846224F387C486E\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FB0EF24091E00E748846224F387C486E\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{042FE0BF-0E19-47E0-8864-22F483C784E6}v80.44.56884\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\{96749152-C361-49E0-BAC6-818F491B9276}	windowsdesktop-runtime-10.0.11-win-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_10.0_x64\Dependents\{96749152-C361-49E0-BAC6-818F491B9276}	windowsdesktop-runtime-10.0.11-win-x64.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0"	ObfuscatorGUI.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_80.44.56884_x64\DisplayName = "Microsoft .NET Runtime - 10.0.11 (x64)"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_80.44.56884_x64\Dependents	windowsdesktop-runtime-10.0.11-win-x64.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295"	ObfuscatorGUI.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\93BFA97052F56B875A679F3A630341A6	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0CF3D802295B1224E835B61226E19915\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{208D3FC0-B592-4221-8E53-6B21621E9951}v80.44.56884\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3dfdf296-dbec-4fb4-81d1-6a3438bcf4de}\Instance\	ObfuscatorGUI.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{24ad3ad4-a569-4530-98e1-ab02f9417aa8}\Instance\	ObfuscatorGUI.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0CF3D802295B1224E835B61226E19915	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2115213192-531537726-3295841909-1000\{CD2617B5-82B6-4334-B834-73C11E130656}	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{96749152-C361-49E0-BAC6-818F491B9276}\ = "{96749152-C361-49E0-BAC6-818F491B9276}"	windowsdesktop-runtime-10.0.11-win-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0370151E43A53FE48B564853D1B81FAB\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	ObfuscatorGUI.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	ObfuscatorGUI.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_80.44.56884_x64\Version = "80.44.56884"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1FE3F4B01F604E646B263AD3CE0C1214\SourceList\PackageName = "dotnet-runtime-10.0.11-win-x64.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1FE3F4B01F604E646B263AD3CE0C1214\SourceList\Media	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	ObfuscatorGUI.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0CF3D802295B1224E835B61226E19915\InstanceType = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0370151E43A53FE48B564853D1B81FAB\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0370151E43A53FE48B564853D1B81FAB\SourceList\Media\1 = ";"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0370151E43A53FE48B564853D1B81FAB\Clients = 3a0000000000	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1FE3F4B01F604E646B263AD3CE0C1214\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FB0EF24091E00E748846224F387C486E\SourceList\Net	msiexec.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202020202	ObfuscatorGUI.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	ObfuscatorGUI.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5496	msiexec.exe
5496	msiexec.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
5496	msiexec.exe
5496	msiexec.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
5496	msiexec.exe
5496	msiexec.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
5496	msiexec.exe
5496	msiexec.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4048	ObfuscatorGUI.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	6048	windowsdesktop-runtime-10.0.11-win-x64.exe
Token: SeIncreaseQuotaPrivilege	6048	windowsdesktop-runtime-10.0.11-win-x64.exe
Token: SeSecurityPrivilege	5496	msiexec.exe
Token: SeCreateTokenPrivilege	6048	windowsdesktop-runtime-10.0.11-win-x64.exe
Token: SeAssignPrimaryTokenPrivilege	6048	windowsdesktop-runtime-10.0.11-win-x64.exe
Token: SeLockMemoryPrivilege	6048	windowsdesktop-runtime-10.0.11-win-x64.exe
Token: SeIncreaseQuotaPrivilege	6048	windowsdesktop-runtime-10.0.11-win-x64.exe
Token: SeMachineAccountPrivilege	6048	windowsdesktop-runtime-10.0.11-win-x64.exe
Token: SeTcbPrivilege	6048	windowsdesktop-runtime-10.0.11-win-x64.exe
Token: SeSecurityPrivilege	6048	windowsdesktop-runtime-10.0.11-win-x64.exe
Token: SeTakeOwnershipPrivilege	6048	windowsdesktop-runtime-10.0.11-win-x64.exe
Token: SeLoadDriverPrivilege	6048	windowsdesktop-runtime-10.0.11-win-x64.exe
Token: SeSystemProfilePrivilege	6048	windowsdesktop-runtime-10.0.11-win-x64.exe
Token: SeSystemtimePrivilege	6048	windowsdesktop-runtime-10.0.11-win-x64.exe
Token: SeProfSingleProcessPrivilege	6048	windowsdesktop-runtime-10.0.11-win-x64.exe
Token: SeIncBasePriorityPrivilege	6048	windowsdesktop-runtime-10.0.11-win-x64.exe
Token: SeCreatePagefilePrivilege	6048	windowsdesktop-runtime-10.0.11-win-x64.exe
Token: SeCreatePermanentPrivilege	6048	windowsdesktop-runtime-10.0.11-win-x64.exe
Token: SeBackupPrivilege	6048	windowsdesktop-runtime-10.0.11-win-x64.exe
Token: SeRestorePrivilege	6048	windowsdesktop-runtime-10.0.11-win-x64.exe
Token: SeShutdownPrivilege	6048	windowsdesktop-runtime-10.0.11-win-x64.exe
Token: SeDebugPrivilege	6048	windowsdesktop-runtime-10.0.11-win-x64.exe
Token: SeAuditPrivilege	6048	windowsdesktop-runtime-10.0.11-win-x64.exe
Token: SeSystemEnvironmentPrivilege	6048	windowsdesktop-runtime-10.0.11-win-x64.exe
Token: SeChangeNotifyPrivilege	6048	windowsdesktop-runtime-10.0.11-win-x64.exe
Token: SeRemoteShutdownPrivilege	6048	windowsdesktop-runtime-10.0.11-win-x64.exe
Token: SeUndockPrivilege	6048	windowsdesktop-runtime-10.0.11-win-x64.exe
Token: SeSyncAgentPrivilege	6048	windowsdesktop-runtime-10.0.11-win-x64.exe
Token: SeEnableDelegationPrivilege	6048	windowsdesktop-runtime-10.0.11-win-x64.exe
Token: SeManageVolumePrivilege	6048	windowsdesktop-runtime-10.0.11-win-x64.exe
Token: SeImpersonatePrivilege	6048	windowsdesktop-runtime-10.0.11-win-x64.exe
Token: SeCreateGlobalPrivilege	6048	windowsdesktop-runtime-10.0.11-win-x64.exe
Token: SeRestorePrivilege	5496	msiexec.exe
Token: SeTakeOwnershipPrivilege	5496	msiexec.exe
Token: SeRestorePrivilege	5496	msiexec.exe
Token: SeTakeOwnershipPrivilege	5496	msiexec.exe
Token: SeRestorePrivilege	5496	msiexec.exe
Token: SeTakeOwnershipPrivilege	5496	msiexec.exe
Token: SeRestorePrivilege	5496	msiexec.exe
Token: SeTakeOwnershipPrivilege	5496	msiexec.exe
Token: SeRestorePrivilege	5496	msiexec.exe
Token: SeTakeOwnershipPrivilege	5496	msiexec.exe
Token: SeRestorePrivilege	5496	msiexec.exe
Token: SeTakeOwnershipPrivilege	5496	msiexec.exe
Token: SeRestorePrivilege	5496	msiexec.exe
Token: SeTakeOwnershipPrivilege	5496	msiexec.exe
Token: SeRestorePrivilege	5496	msiexec.exe
Token: SeTakeOwnershipPrivilege	5496	msiexec.exe
Token: SeRestorePrivilege	5496	msiexec.exe
Token: SeTakeOwnershipPrivilege	5496	msiexec.exe
Token: SeRestorePrivilege	5496	msiexec.exe
Token: SeTakeOwnershipPrivilege	5496	msiexec.exe
Token: SeRestorePrivilege	5496	msiexec.exe
Token: SeTakeOwnershipPrivilege	5496	msiexec.exe
Token: SeRestorePrivilege	5496	msiexec.exe
Token: SeTakeOwnershipPrivilege	5496	msiexec.exe
Token: SeRestorePrivilege	5496	msiexec.exe
Token: SeTakeOwnershipPrivilege	5496	msiexec.exe
Token: SeRestorePrivilege	5496	msiexec.exe
Token: SeTakeOwnershipPrivilege	5496	msiexec.exe
Token: SeRestorePrivilege	5496	msiexec.exe
Token: SeTakeOwnershipPrivilege	5496	msiexec.exe
Token: SeRestorePrivilege	5496	msiexec.exe
Token: SeTakeOwnershipPrivilege	5496	msiexec.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
3676	wixstdba.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe
1972	taskmgr.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
5496	msiexec.exe
4684	MsiExec.exe
1972	taskmgr.exe
3820	MsiExec.exe
1196	MsiExec.exe
3828	MsiExec.exe
4608	MsiExec.exe
1960	MsiExec.exe
4048	ObfuscatorGUI.exe
4048	ObfuscatorGUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1608 wrote to memory of 4552	1608	msedge.exe	89
PID 1608 wrote to memory of 4236	1608	msedge.exe	90
PID 1608 wrote to memory of 2652	1608	msedge.exe	91
PID 1608 wrote to memory of 4236	1608	msedge.exe	90
PID 1608 wrote to memory of 4236	1608	msedge.exe	90
PID 1608 wrote to memory of 1212	1608	msedge.exe	93
PID 1608 wrote to memory of 1212	1608	msedge.exe	93
PID 1608 wrote to memory of 2768	1608	msedge.exe	94
PID 1608 wrote to memory of 2768	1608	msedge.exe	94
PID 1608 wrote to memory of 2768	1608	msedge.exe	94
PID 1608 wrote to memory of 5144	1608	msedge.exe	95
PID 1608 wrote to memory of 5144	1608	msedge.exe	95
PID 1608 wrote to memory of 5144	1608	msedge.exe	95
PID 1608 wrote to memory of 3472	1608	msedge.exe	96
PID 1608 wrote to memory of 3472	1608	msedge.exe	96
PID 1608 wrote to memory of 3472	1608	msedge.exe	96
PID 1608 wrote to memory of 5512	1608	msedge.exe	97
PID 1608 wrote to memory of 5512	1608	msedge.exe	97
PID 1608 wrote to memory of 5512	1608	msedge.exe	97
PID 1608 wrote to memory of 3928	1608	msedge.exe	110
PID 1608 wrote to memory of 3928	1608	msedge.exe	110
PID 1608 wrote to memory of 2924	1608	msedge.exe	100
PID 1608 wrote to memory of 2924	1608	msedge.exe	100
PID 1608 wrote to memory of 2924	1608	msedge.exe	100
PID 1608 wrote to memory of 840	1608	msedge.exe	101
PID 1608 wrote to memory of 840	1608	msedge.exe	101
PID 1608 wrote to memory of 3828	1608	msedge.exe	102
PID 1608 wrote to memory of 3828	1608	msedge.exe	102
PID 1608 wrote to memory of 4248	1608	msedge.exe	103
PID 1608 wrote to memory of 4248	1608	msedge.exe	103
PID 1608 wrote to memory of 4248	1608	msedge.exe	103
PID 1608 wrote to memory of 2620	1608	msedge.exe	105
PID 1608 wrote to memory of 2776	1608	msedge.exe	108
PID 1608 wrote to memory of 2776	1608	msedge.exe	108
PID 1608 wrote to memory of 4720	1608	msedge.exe	109
PID 1608 wrote to memory of 4720	1608	msedge.exe	109
PID 1608 wrote to memory of 4720	1608	msedge.exe	109
PID 1608 wrote to memory of 3928	1608	msedge.exe	110
PID 1608 wrote to memory of 3928	1608	msedge.exe	110
PID 1608 wrote to memory of 4800	1608	msedge.exe	111
PID 1608 wrote to memory of 4800	1608	msedge.exe	111
PID 1608 wrote to memory of 2928	1608	msedge.exe	112
PID 1608 wrote to memory of 2928	1608	msedge.exe	112
PID 1608 wrote to memory of 4280	1608	msedge.exe	115
PID 1608 wrote to memory of 4280	1608	msedge.exe	115
PID 1608 wrote to memory of 2752	1608	msedge.exe	116
PID 1608 wrote to memory of 2752	1608	msedge.exe	116
PID 1608 wrote to memory of 2752	1608	msedge.exe	116
PID 1608 wrote to memory of 4492	1608	msedge.exe	117
PID 1608 wrote to memory of 3344	1608	msedge.exe	118
PID 1608 wrote to memory of 3616	1608	msedge.exe	119
PID 1608 wrote to memory of 872	1608	msedge.exe	120
PID 1608 wrote to memory of 5468	1608	msedge.exe	121
PID 1608 wrote to memory of 5468	1608	msedge.exe	121
PID 1608 wrote to memory of 5924	1608	msedge.exe	122
PID 1608 wrote to memory of 5924	1608	msedge.exe	122
PID 1608 wrote to memory of 5924	1608	msedge.exe	122
PID 1608 wrote to memory of 4952	1608	msedge.exe	123
PID 1608 wrote to memory of 4704	1608	msedge.exe	124
PID 1608 wrote to memory of 4704	1608	msedge.exe	124
PID 1608 wrote to memory of 4704	1608	msedge.exe	124
PID 1608 wrote to memory of 4656	1608	msedge.exe	125
PID 1608 wrote to memory of 4656	1608	msedge.exe	125
PID 1608 wrote to memory of 5688	1608	msedge.exe	132

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\NOTEPAD.EXE
C:\Windows\system32\NOTEPAD.EXE "C:\Users\Admin\AppData\Local\Temp\New Text Document (2).txt"
1⤵
PID:4396

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\SaveEnter.xml
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x320,0x7ffccf0ec188,0x7ffccf0ec194,0x7ffccf0ec1a0
  2⤵
  PID:4552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1988,i,12208799208850132462,15126081701382168253,262144 --field-trial-handle=2540,i,14011074215358046614,4587998763104288024,262144 --variations-seed-version --mojo-platform-channel-handle=2532 /prefetch:2
  2⤵
  PID:4236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2180,i,1825973511202920146,3513968104838434245,524288 --field-trial-handle=2540,i,14011074215358046614,4587998763104288024,262144 --variations-seed-version --mojo-platform-channel-handle=2648 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:2652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2664,i,5532712237430397487,2436766834119918863,524288 --field-trial-handle=2540,i,14011074215358046614,4587998763104288024,262144 --variations-seed-version --mojo-platform-channel-handle=3064 /prefetch:13
  2⤵
  PID:1212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3620,i,17452470688003472290,5343161084781882060,2097152 --field-trial-handle=2540,i,14011074215358046614,4587998763104288024,262144 --variations-seed-version --mojo-platform-channel-handle=3708 /prefetch:1
  2⤵
  PID:2768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3624,i,11302369461047403434,16653201669007749425,2097152 --field-trial-handle=2540,i,14011074215358046614,4587998763104288024,262144 --variations-seed-version --mojo-platform-channel-handle=3712 /prefetch:1
  2⤵
  PID:5144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4312,i,3432820823426057800,14230474859565985077,2097152 --field-trial-handle=2540,i,14011074215358046614,4587998763104288024,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:1
  2⤵
  PID:3472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4376,i,14964382767055930028,4549704609236558589,2097152 --field-trial-handle=2540,i,14011074215358046614,4587998763104288024,262144 --variations-seed-version --mojo-platform-channel-handle=4332 /prefetch:9
  2⤵
  PID:5512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5328,i,16664825182032693531,9001890571509638991,524288 --field-trial-handle=2540,i,14011074215358046614,4587998763104288024,262144 --variations-seed-version --mojo-platform-channel-handle=5308 /prefetch:14
  2⤵
  PID:3928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5504,i,4235574503586450554,15505894711965042537,2097152 --field-trial-handle=2540,i,14011074215358046614,4587998763104288024,262144 --variations-seed-version --mojo-platform-channel-handle=5512 /prefetch:1
  2⤵
  PID:2924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5616,i,6180884601890192778,900082597257510947,524288 --field-trial-handle=2540,i,14011074215358046614,4587998763104288024,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:14
  2⤵
  PID:840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5612,i,7331618506910701550,18271942416100049501,524288 --field-trial-handle=2540,i,14011074215358046614,4587998763104288024,262144 --variations-seed-version --mojo-platform-channel-handle=5628 /prefetch:14
  2⤵
  PID:3828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6164,i,16265898008861294955,6060692126033518720,2097152 --field-trial-handle=2540,i,14011074215358046614,4587998763104288024,262144 --variations-seed-version --mojo-platform-channel-handle=6180 /prefetch:1
  2⤵
  PID:4248
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6404,i,6055622883637294975,11551952884153939725,524288 --field-trial-handle=2540,i,14011074215358046614,4587998763104288024,262144 --variations-seed-version --mojo-platform-channel-handle=6208 /prefetch:14
  2⤵
  PID:4340
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6404,i,6055622883637294975,11551952884153939725,524288 --field-trial-handle=2540,i,14011074215358046614,4587998763104288024,262144 --variations-seed-version --mojo-platform-channel-handle=6208 /prefetch:14
  2⤵
  PID:2620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6984,i,6296363012863261453,9644883834564507303,524288 --field-trial-handle=2540,i,14011074215358046614,4587998763104288024,262144 --variations-seed-version --mojo-platform-channel-handle=6896 /prefetch:14
  2⤵
  PID:2776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=7164,i,16444272046050117000,15998469791746433284,2097152 --field-trial-handle=2540,i,14011074215358046614,4587998763104288024,262144 --variations-seed-version --mojo-platform-channel-handle=7160 /prefetch:1
  2⤵
  PID:4720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6900,i,6887833165333852072,8938729501257640635,524288 --field-trial-handle=2540,i,14011074215358046614,4587998763104288024,262144 --variations-seed-version --mojo-platform-channel-handle=7336 /prefetch:14
  2⤵
  PID:3928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7216,i,11474745093752153158,14635854082589130017,524288 --field-trial-handle=2540,i,14011074215358046614,4587998763104288024,262144 --variations-seed-version --mojo-platform-channel-handle=7364 /prefetch:14
  2⤵
  PID:4800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7100,i,17932179860392357415,16915257261449772336,524288 --field-trial-handle=2540,i,14011074215358046614,4587998763104288024,262144 --variations-seed-version --mojo-platform-channel-handle=7352 /prefetch:14
  2⤵
  PID:2928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7064,i,14416325871023515324,13703757621561348455,524288 --field-trial-handle=2540,i,14011074215358046614,4587998763104288024,262144 --variations-seed-version --mojo-platform-channel-handle=4100 /prefetch:14
  2⤵
  PID:4280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=5172,i,11835202389963885696,3059116117994065822,2097152 --field-trial-handle=2540,i,14011074215358046614,4587998763104288024,262144 --variations-seed-version --mojo-platform-channel-handle=4060 /prefetch:1
  2⤵
  PID:2752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7424,i,6237507188192833851,13390291797690266895,524288 --field-trial-handle=2540,i,14011074215358046614,4587998763104288024,262144 --variations-seed-version --mojo-platform-channel-handle=7392 /prefetch:14
  2⤵
  PID:4492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1272,i,15361812539390619080,10964529969416252476,524288 --field-trial-handle=2540,i,14011074215358046614,4587998763104288024,262144 --variations-seed-version --mojo-platform-channel-handle=7180 /prefetch:14
  2⤵
  PID:3344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1280,i,7256370454339536372,3058109445270974259,524288 --field-trial-handle=2540,i,14011074215358046614,4587998763104288024,262144 --variations-seed-version --mojo-platform-channel-handle=6256 /prefetch:14
  2⤵
  PID:3616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1264,i,14446421429864683718,4977185927809303128,524288 --field-trial-handle=2540,i,14011074215358046614,4587998763104288024,262144 --variations-seed-version --mojo-platform-channel-handle=1400 /prefetch:14
  2⤵
  PID:872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6212,i,4264733719992909292,15796902475366167674,524288 --field-trial-handle=2540,i,14011074215358046614,4587998763104288024,262144 --variations-seed-version --mojo-platform-channel-handle=4072 /prefetch:14
  2⤵
  PID:5468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=1268,i,15210596177596058766,12664356342279365692,2097152 --field-trial-handle=2540,i,14011074215358046614,4587998763104288024,262144 --variations-seed-version --mojo-platform-channel-handle=1276 /prefetch:1
  2⤵
  PID:5924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4868,i,5534964240656655644,13971474546415394347,524288 --field-trial-handle=2540,i,14011074215358046614,4587998763104288024,262144 --variations-seed-version --mojo-platform-channel-handle=4888 /prefetch:14
  2⤵
  PID:4952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=4508,i,18372864460749893069,16030053822628885933,2097152 --field-trial-handle=2540,i,14011074215358046614,4587998763104288024,262144 --variations-seed-version --mojo-platform-channel-handle=4872 /prefetch:1
  2⤵
  PID:4704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5772,i,14052934712534312375,17410321134026779951,524288 --field-trial-handle=2540,i,14011074215358046614,4587998763104288024,262144 --variations-seed-version --mojo-platform-channel-handle=4864 /prefetch:14
  2⤵
  PID:4656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7096,i,3555443491343166522,5492393074925912761,524288 --field-trial-handle=2540,i,14011074215358046614,4587998763104288024,262144 --variations-seed-version --mojo-platform-channel-handle=6316 /prefetch:14
  2⤵
  PID:5688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=6780,i,1794164136057884400,17424462858403930030,2097152 --field-trial-handle=2540,i,14011074215358046614,4587998763104288024,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:2896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=1276,i,358215418088451853,2018499693030091073,2097152 --field-trial-handle=2540,i,14011074215358046614,4587998763104288024,262144 --variations-seed-version --mojo-platform-channel-handle=5028 /prefetch:1
  2⤵
  PID:6020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=7172,i,14936932721274501376,6866280319340405298,2097152 --field-trial-handle=2540,i,14011074215358046614,4587998763104288024,262144 --variations-seed-version --mojo-platform-channel-handle=4944 /prefetch:1
  2⤵
  PID:5012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4076,i,9744993441406070277,1388545450436877757,524288 --field-trial-handle=2540,i,14011074215358046614,4587998763104288024,262144 --variations-seed-version --mojo-platform-channel-handle=7252 /prefetch:14
  2⤵
  PID:4352
- C:\Users\Admin\Downloads\windowsdesktop-runtime-10.0.11-win-x64.exe
  "C:\Users\Admin\Downloads\windowsdesktop-runtime-10.0.11-win-x64.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4524
- - C:\Windows\TEMP\{DBC8D954-010A-482C-88C8-3CFFAFB549B4}\.ba\wixstdba.exe
    "C:\Windows\TEMP\{DBC8D954-010A-482C-88C8-3CFFAFB549B4}\.ba\wixstdba.exe" -burn.ba.apiver 569705357157400576 -burn.ba.pipe BurnPipe.{E26C3BE6-4F82-4B41-9544-FDC8B4E11A39} {F8644827-BF4A-41B4-BE09-FBD8D6B20C10}
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    PID:3676
- - C:\Windows\TEMP\{DBC8D954-010A-482C-88C8-3CFFAFB549B4}\.be\windowsdesktop-runtime-10.0.11-win-x64.exe
    "C:\Windows\TEMP\{DBC8D954-010A-482C-88C8-3CFFAFB549B4}\.be\windowsdesktop-runtime-10.0.11-win-x64.exe" -q -burn.elevated BurnPipe.{1F996FA4-DF78-4774-8C4D-0F4FC8D9E59B} {5F37BC12-2A61-4F07-8505-10CE21860122} 4524
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    PID:6048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4060,i,9870513936170261882,8613887594897335440,524288 --field-trial-handle=2540,i,14011074215358046614,4587998763104288024,262144 --variations-seed-version --mojo-platform-channel-handle=7776 /prefetch:14
  2⤵
  PID:1996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  PID:4908
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2a4,0x7ffccf0ec188,0x7ffccf0ec194,0x7ffccf0ec1a0
    3⤵
    PID:1120
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1664,i,18191641920457653837,16734764296249348324,262144 --field-trial-handle=2340,i,10041740640331800368,7939118069663789581,262144 --variations-seed-version --mojo-platform-channel-handle=2336 /prefetch:2
    3⤵
    PID:120
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1836,i,7970596180096023976,13577252419057326008,524288 --field-trial-handle=2340,i,10041740640331800368,7939118069663789581,262144 --variations-seed-version --mojo-platform-channel-handle=2380 /prefetch:11
    3⤵
    - System Time Discovery
    PID:4396
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2496,i,17526825616130509881,4098205186280818336,524288 --field-trial-handle=2340,i,10041740640331800368,7939118069663789581,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:13
    3⤵
    PID:3468
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4476,i,6069205358799410159,18164521651784613223,524288 --field-trial-handle=2340,i,10041740640331800368,7939118069663789581,262144 --variations-seed-version --mojo-platform-channel-handle=4492 /prefetch:14
    3⤵
    PID:2304
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4476,i,6069205358799410159,18164521651784613223,524288 --field-trial-handle=2340,i,10041740640331800368,7939118069663789581,262144 --variations-seed-version --mojo-platform-channel-handle=4492 /prefetch:14
    3⤵
    PID:2912
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4548,i,17967949249651061073,13504912251539021664,524288 --field-trial-handle=2340,i,10041740640331800368,7939118069663789581,262144 --variations-seed-version --mojo-platform-channel-handle=4908 /prefetch:14
    3⤵
    PID:3820
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4488,i,16750993266774791187,7785542786918851413,524288 --field-trial-handle=2340,i,10041740640331800368,7939118069663789581,262144 --variations-seed-version --mojo-platform-channel-handle=4476 /prefetch:14
    3⤵
    PID:4700
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4940,i,12449280425864028815,15166374652000240360,524288 --field-trial-handle=2340,i,10041740640331800368,7939118069663789581,262144 --variations-seed-version --mojo-platform-channel-handle=4980 /prefetch:14
    3⤵
    PID:3364
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5048,i,14085389212630555142,7209296334685232075,524288 --field-trial-handle=2340,i,10041740640331800368,7939118069663789581,262144 --variations-seed-version --mojo-platform-channel-handle=5008 /prefetch:14
    3⤵
    PID:2384
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5048,i,9930176313582449491,18172439109644052517,524288 --field-trial-handle=2340,i,10041740640331800368,7939118069663789581,262144 --variations-seed-version --mojo-platform-channel-handle=5000 /prefetch:14
    3⤵
    PID:252
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5128,i,5274468707064687669,9782426376309220418,524288 --field-trial-handle=2340,i,10041740640331800368,7939118069663789581,262144 --variations-seed-version --mojo-platform-channel-handle=5052 /prefetch:14
    3⤵
    PID:4852
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5128,i,17465063632546846656,8560177443221354563,524288 --field-trial-handle=2340,i,10041740640331800368,7939118069663789581,262144 --variations-seed-version --mojo-platform-channel-handle=5308 /prefetch:14
    3⤵
    PID:5384
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5312,i,2924558849388652407,6790291820281757822,262144 --field-trial-handle=2340,i,10041740640331800368,7939118069663789581,262144 --variations-seed-version --mojo-platform-channel-handle=5308 /prefetch:10
    3⤵
    PID:3040
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5312,i,8734776281032602309,17843289791416686527,524288 --field-trial-handle=2340,i,10041740640331800368,7939118069663789581,262144 --variations-seed-version --mojo-platform-channel-handle=5260 /prefetch:14
    3⤵
    PID:6132
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4648,i,16092638599588733830,8920443794488100128,524288 --field-trial-handle=2340,i,10041740640331800368,7939118069663789581,262144 --variations-seed-version --mojo-platform-channel-handle=4752 /prefetch:14
    3⤵
    PID:2032
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5340,i,15644337165415965514,12072822483040321022,524288 --field-trial-handle=2340,i,10041740640331800368,7939118069663789581,262144 --variations-seed-version --mojo-platform-channel-handle=3916 /prefetch:14
    3⤵
    PID:5992
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4160,i,10525541439096360007,797374804402823925,524288 --field-trial-handle=2340,i,10041740640331800368,7939118069663789581,262144 --variations-seed-version --mojo-platform-channel-handle=3920 /prefetch:14
    3⤵
    PID:3624
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3872,i,9867544370305439562,14056253150565343593,524288 --field-trial-handle=2340,i,10041740640331800368,7939118069663789581,262144 --variations-seed-version --mojo-platform-channel-handle=3992 /prefetch:14
    3⤵
    PID:256
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5272,i,6028012706985971582,15099213495161052197,524288 --field-trial-handle=2340,i,10041740640331800368,7939118069663789581,262144 --variations-seed-version --mojo-platform-channel-handle=5288 /prefetch:14
    3⤵
    PID:4088
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5192,i,338625592423165852,2130197931852842735,524288 --field-trial-handle=2340,i,10041740640331800368,7939118069663789581,262144 --variations-seed-version --mojo-platform-channel-handle=3816 /prefetch:14
    3⤵
    PID:692
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3840,i,12242410548862346025,14701446617381493051,524288 --field-trial-handle=2340,i,10041740640331800368,7939118069663789581,262144 --variations-seed-version --mojo-platform-channel-handle=3932 /prefetch:14
    3⤵
    PID:5848
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5192,i,8429512932359056096,3682601170415272207,524288 --field-trial-handle=2340,i,10041740640331800368,7939118069663789581,262144 --variations-seed-version --mojo-platform-channel-handle=3964 /prefetch:14
    3⤵
    PID:3912
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5204,i,322507203718585375,6975224924032918369,524288 --field-trial-handle=2340,i,10041740640331800368,7939118069663789581,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:14
    3⤵
    PID:1788
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4596,i,12851634589295137556,13835788449571827926,524288 --field-trial-handle=2340,i,10041740640331800368,7939118069663789581,262144 --variations-seed-version --mojo-platform-channel-handle=3932 /prefetch:14
    3⤵
    PID:1972
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5608,i,2198464759188854321,6689731095885779032,524288 --field-trial-handle=2340,i,10041740640331800368,7939118069663789581,262144 --variations-seed-version --mojo-platform-channel-handle=5684 /prefetch:14
    3⤵
    PID:4052
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4680,i,5859495196148642413,5352964763717992697,524288 --field-trial-handle=2340,i,10041740640331800368,7939118069663789581,262144 --variations-seed-version --mojo-platform-channel-handle=5656 /prefetch:14
    3⤵
    PID:4796
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3340,i,8577921884719879676,10663076320501719869,524288 --field-trial-handle=2340,i,10041740640331800368,7939118069663789581,262144 --variations-seed-version --mojo-platform-channel-handle=5688 /prefetch:14
    3⤵
    PID:3608
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5176,i,2989305486842713168,13501828217100238978,524288 --field-trial-handle=2340,i,10041740640331800368,7939118069663789581,262144 --variations-seed-version --mojo-platform-channel-handle=2988 /prefetch:14
    3⤵
    PID:2912
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2988,i,14787731684852199741,5057214353909173258,524288 --field-trial-handle=2340,i,10041740640331800368,7939118069663789581,262144 --variations-seed-version --mojo-platform-channel-handle=2984 /prefetch:14
    3⤵
    PID:672
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5180,i,281569376543373632,10629696463714656549,524288 --field-trial-handle=2340,i,10041740640331800368,7939118069663789581,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:14
    3⤵
    PID:6096
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3932,i,690084184536247648,10727811901770686060,524288 --field-trial-handle=2340,i,10041740640331800368,7939118069663789581,262144 --variations-seed-version --mojo-platform-channel-handle=5500 /prefetch:14
    3⤵
    PID:3664
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4768,i,9606852466534107015,16156894352614823628,524288 --field-trial-handle=2340,i,10041740640331800368,7939118069663789581,262144 --variations-seed-version --mojo-platform-channel-handle=5684 /prefetch:14
    3⤵
    PID:3452
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3336,i,16189535319244023263,13842050007202641010,524288 --field-trial-handle=2340,i,10041740640331800368,7939118069663789581,262144 --variations-seed-version --mojo-platform-channel-handle=5580 /prefetch:14
    3⤵
    PID:2228

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1916

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2928

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5416

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2824

C:\Users\Admin\Downloads\Obfuscator\Obfuscator\bin\ObfuscatorGUI.exe
"C:\Users\Admin\Downloads\Obfuscator\Obfuscator\bin\ObfuscatorGUI.exe"
1⤵
PID:4440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://aka.ms/dotnet-core-applaunch?framework=Microsoft.NETCore.App&framework_version=10.0.0&arch=x64&rid=win-x64&os=win10&gui=true
  2⤵
  PID:1572

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5572

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:5496
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 6419265B51270C6FD9FD9CB9ECBD0186
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:4684
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 6B0D4455C5E6F0D75A8C487C2D46FB02
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:3820
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 28D8C28C3B6638FE2F863600DE160372
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:1196
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding E956BAACDB0F3F09052A0B699FDC0793
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:3828
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 52F331A4B8B586C491E4D60CCCDBA4AD
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:4608
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 209964FA85A736F27DC72445E9BEF105
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:1960

C:\ProgramData\Package Cache\{96749152-C361-49E0-BAC6-818F491B9276}\windowsdesktop-runtime-10.0.11-win-x64.exe
"C:\ProgramData\Package Cache\{96749152-C361-49E0-BAC6-818F491B9276}\windowsdesktop-runtime-10.0.11-win-x64.exe" /burn.runonce
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4672
- C:\ProgramData\Package Cache\{96749152-C361-49E0-BAC6-818F491B9276}\windowsdesktop-runtime-10.0.11-win-x64.exe
  "C:\ProgramData\Package Cache\{96749152-C361-49E0-BAC6-818F491B9276}\windowsdesktop-runtime-10.0.11-win-x64.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_10.0.11_(x64)_20260812213355.log"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2496
- - C:\Windows\TEMP\{0C5A1820-D172-4A9E-B741-29F986F2B6C6}\.ba\wixstdba.exe
    "C:\Windows\TEMP\{0C5A1820-D172-4A9E-B741-29F986F2B6C6}\.ba\wixstdba.exe" -burn.ba.apiver 569705357157400576 -burn.ba.pipe BurnPipe.{C39417B7-5E26-4D54-A1CF-52C48B2EC905} {2D9E031C-286A-4013-8EB4-28CFE97794EE}
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3692
- - C:\ProgramData\Package Cache\{96749152-C361-49E0-BAC6-818F491B9276}\windowsdesktop-runtime-10.0.11-win-x64.exe
    "C:\ProgramData\Package Cache\{96749152-C361-49E0-BAC6-818F491B9276}\windowsdesktop-runtime-10.0.11-win-x64.exe" -q -burn.elevated BurnPipe.{1141DAA0-35FB-41BF-8322-CA178B43DA01} {F787270C-941E-47BD-9A31-9A1645B3AA5F} 2496
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:4124

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1972

C:\Users\Admin\Downloads\Obfuscator\Obfuscator\bin\ObfuscatorGUI.exe
"C:\Users\Admin\Downloads\Obfuscator\Obfuscator\bin\ObfuscatorGUI.exe"
1⤵
- Loads dropped DLL
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4048

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:5860

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e5b7639.rbs

Path C:\Config.Msi\e5b7639.rbs
Size 11KB
SHA256 bc40d6bc1d91b6645b517126d40e0e7054661a74bfee57dc1440bb1b8a1fe7e0
MD5 364bfa8823d0a03eee3cf5228ea2392c
SHA1 fc999e9397eb782ac8161e5a20a829d0089824ec
SHA512 90d5a27e9f4d9cf7a0888aa821b277cd08fee04aa0eb908ae95775315e917a985ae2600273f6a32a9189f1f84e42af5eec3382aefc07e0dc5fd17622f5f2c2de
SSDEEP 192:W0vCC9Fdt+5HdBn9CWmEkI9Ek/WEnRmCLupyL:W0vCC9Fdt+5H30EtE6b
TLSH
T1B8325283BA04C6E3E8D72734C71317613BA2D7998724234B15CC9269DF43BD45FBA299
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5b7640.rbs

Path C:\Config.Msi\e5b7640.rbs
Size 9KB
SHA256 6c99450d48b3a9898feadb6446846da4422221760e2186117393536583231f34
MD5 6a407febb2cc482261221d3597b4321e
SHA1 71f1cb3b0b51c0623087b546bd563323a106712d
SHA512 2fe454f24a2a1d61ec2cf780a56f4ad6153e94158a7c0cc10b401f758fd51d2796b639d97c5472424e12ee4b48ca9868957660aa7493f02d834982a14a61f119
SSDEEP 96:TxmgPDuA5rs3XCrhfNUrWeD2SRCsTlYUrWeD2SRC6jliGnRTlOnttE5P7pm/5VQW:Q1oiCNmrNkINrNkkcEdAVrup7jK
TLSH
T16A121F02B740C2E2ED971B35C7A327B53BA7D3999218635F08CD92205E477891F652AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5b7645.rbs

Path C:\Config.Msi\e5b7645.rbs
Size 49KB
SHA256 66ac554e3c1ba8e30c01569349d4696a592e666247defc4872500a67908d5b4b
MD5 0846ce43d88bdfa67e0b9d35134d9716
SHA1 4df22fef350a34d54376514525b247f73ad18a8c
SHA512 ecb358bfd5175768d1d20d9746ec2e55ed1c208eecc57d6241be185e113132dd25979f073d22c7b23f426120d178b53e87bf13e6845e8b8aa6f7d6d884842de4
SSDEEP 1536:gDADsBBFes69yTMH4b+k7TSROW5GIefFoTw7cfgvC00acxaJburYdBpJUGmCisfV:tO4zO
TLSH
T1C1331231BB88E1E3FB333D742322DC047B26CD56DA08949947C99576CE96AC8DF9C096
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5b764a.rbs

Path C:\Config.Msi\e5b764a.rbs
Size 71KB
SHA256 15143550c3ea193b28839bbcb6753b5863f3437a90d8901ea9c043a91f0c8943
MD5 586551da88002fa0c7975e9679c14d6a
SHA1 4aa55cf3039502d6accb9b4101a54f705c98782f
SHA512 29d4f1a39691f9dbb603e23ecb814163e29449017904d792500ce4cd50ebd56cbed8aced72bf78150b45c5983e70ddbd46c7bab2327ff84f60d81d0371c6ca52
SSDEEP 1536:9mt6bF33Jl/g1pnw428wpLKx/lL7bNohLS66Ua4qh2AVdo4bri5BJcseKMPxLVfL:GetJ30sJGxZtCeE8iqOk+SimUQ
TLSH
T1246333662B10C0D9BD3329969F3BEA059E074CA216844D3F01C56B39DEF7E8A5F6C1E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5b764e.rbs

Path C:\Config.Msi\e5b764e.rbs
Size 3KB
SHA256 1a85c4462c63a6535ee8370d8eaf3bbff3784f13fa0f98482e8057525d584b29
MD5 3d9b9e8b9929ccb74ea6ad08102806b8
SHA1 fa4d0b321bf7f1f22ddedd00cfd4a32c88db1226
SHA512 5cd7488fb6f33e7b7bc2fe079189b92b0eef1dffd60dbd5a66f33745eb48fb31d8cd683e754da7f879da20782d0d7f967a73894d1a53c700c1c18f9a31d71896
TLSH
T18671AA13A644E2D3DCA61B30CD1B0B513777D7DAD3294387058CA5708E9B785AFEA18A
MD5 SHA1 SHA512 TLSH

Submit Download

e5b7651.rbs

Path C:\Config.Msi\e5b7651.rbs
Size 3KB
SHA256 b9af03f822c815b1627a30be21247a75d8aa6fbab765a2c6b570961272ab97d0
MD5 56fb58bebe50a1cf10ca9923eb8529d2
SHA1 839b3260e43026a81cf5e16a7cf9a7545d045302
SHA512 e5239c807bf20c6db112084ecc47402318783e87142e8a193d70c5ee591d0f157e2fa31cabca98e67bcef8ed2572a0788e4e1c2e7894014229e814fd1b34a67d
TLSH
T13381AD03AA04D693FDA75B31CD1B0B6137B7CADA8394434B05CC92B04E97BC9EE99649
MD5 SHA1 SHA512 TLSH

Submit Download

ThirdPartyNotices.txt

Path C:\Program Files\dotnet\ThirdPartyNotices.txt
Size 77KB
SHA256 deb4427a295e1ed474b0d81c5a0d972c1b550b9a715cda939cdfa9236b1b418f
MD5 0d8867a25ba926e6e40cd52ab3536b5c
SHA1 89390dc8b8318d0bfef1c6a2fb4783537e28a465
SHA512 317ca335405274f4f91b173651ca2826760acb5ba5cf41aff51adc55c2cda9059fb268333665f13f62fa48119e55a303720a780dd58d28dd9967db4c88407d61
SSDEEP 1536:HA9jHwsGfgg39/zwgAVkguQxrDjugtSEGepkWvrpX7anuqdLSVnfiStPq+3LefrL:HA97w/ogz1AVxuMjHtSFULryLOgrGWm+
TLSH
T17773A45F7E45077319E2C3916569A8C5F22FA02E3B6B2A44346EF248133B42DD6FF858
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 163KB
SHA256 ab1b71fd3dd71062e074c9fab8312081a81b7f2b3e0327c48c4d249c8d1a3135
MD5 fce677b017799edcce6777162fb482a4
SHA1 91ead8264f578e76f910e5db41d0aab8681cb903
SHA512 54d7e79725fa56f301f49177d071390c1481fdbb4943123c81ba92ab4b32a9585fe315eb7241828e1178156ab909f100695fa51d8655fc0d06581116a4740304
SSDEEP 3072:9GgP19lIuvTSBbQ/En4SbDqIG//k7l55wKjvyN:9GelIubgbQuDvqI7t3s
TLSH
T1DCF3061AD65811AAD16E9575CB528941BB337C668BE0E3CB13C0F8BE0F726905EF9703
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8ec36895d743d8e4469cc4f9fbf5cc2744d7a861e9b00c3cc5f4f838cadf1e58
MD5 224ef95b48e31f3ce2071ce3884b1727
SHA1 5c2f2f234d1245f707e38b5f8ec27ef3c2f1ae87
SHA512 78b3882d4aa7bdab3c0e1346f7d91e9a7edac4c0e2f447391fe1b02593e29f4f00c57203eab0a2a67e397accdee3ce445bd3d6acbf415badb0600f50a37abcc2
TLSH
T1B6D0A7747A9962A2D12C417941705A01653586A27ADB9247A451580D8970182A1DAEEB
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0b1d263040bb50630d75732fcc78ef4d321897fdafddb61ca4d7512b3855b3a9
MD5 4f1ac27aff1a77560e7c2e0ba8e6f10e
SHA1 946e3717c9e9e280391732201649e614787e2729
SHA512 1d22ee254a5ed4c12e2c6d96b6760e1e08eadd7b34e4d2a8c6bef28fe8f953d3c544c012a82bdf88e9748a5d84bd287e0cad2c4fabedeb8b997b12f8aa0827ae
TLSH
T1E9D097BD798A4202C6884072A0620B003332813038DEE913D4E6280C492014162CE5EB
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c80f71026fa07cc9b3e69c8779d4b4b40710cf7bc2893b740943db0d0f79591a
MD5 590eca05f11ec72644a09f205b548fbc
SHA1 c6521700bee3b500259ee3a70292b90201f20597
SHA512 fddd457c35c61ceb727f99bd39f55314cdeb7d062798c573a377675121f972ed95109fec329f911c502139a1794b70e5a98a57dd3b21b5a70e6518890a361f66
TLSH
T1E7D02B7A37C40404C0D0747221F24602D530C520AC4C81088801702CCC207C3010B8EF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ee00825bbd5a4f21308ad2e10e5a9d3c4512f07fbd288ec8ac76788de6019e25
MD5 c3584e6bc22b3ad2f168ede48d20a993
SHA1 ffb4ecef8f65638ca17e16a32806195193977c7e
SHA512 5fd777359305e67e9f30fc404af9013a876846b1d6db271fa73dfcf2ee22fb25a8e26d4d0c970cc3a8219df11038dc6b4c2c411db652593bda1c3d7643753c0b
TLSH
T18AD02B7637C40404C0D0747621F34602D530C520584C81088801B03CCC207C3010A8DB
MD5 SHA1 SHA512 TLSH

Submit Download

5fc51276-7792-4617-99ca-51075458e04d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\5fc51276-7792-4617-99ca-51075458e04d.tmp
Size 414B
SHA256 f1694ee3ea5c238f0bdfd2fa890cd03f33d2e9f0e94abc35ba87274ff3685e5a
MD5 0f7516d5cddf6c32c52d89450caf7da7
SHA1 22b05308f10ae866a30e1197cce279f660ce26f0
SHA512 24242a9a3d46d34a40b45cd7e6973544adc6566f48128da971eca1d8200c6b723f97cacc8a528d8da21794f4599d9dcc42be969bd0a99fe300c1547776989f0d
TLSH
T1CCE02BA9CC21A8271CFD175959A40E45EB6123972B514A5F3B3DD11C8F7463A0585C1C
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 e81aab5092c64b5b3bced545c5f4b188e582d9023da6c0cc2370e683b02f136e
MD5 9e8815133b424bc4c6d0ced90c4f0961
SHA1 17db682e1c119b262caf353752d5ea2c79093900
SHA512 b86b53f3589e412fbc8c00536470e4ccd9b8477c3d3a4d640cd3118f8c653c50808c3efe9dc086aea068d7a90ac7e7b616fd59b33e4511a76bdb1951d77bf64f
TLSH
T135E0DF8C05E8C36EEB40FA87516D430CC2C0360BB3C8FA0A1B4488C77205884B2CA6B1
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 b49565d973414509b19237647f16b0c1b76c51bbda757ed8b11e306e014feefd
MD5 b0c34caf99bb573de0a1af7d167a4efa
SHA1 8d8561378742b5ed501bfda28ca68b499e0ebdcb
SHA512 56cd6ea8522b40f41a9858ab8d097bec16d474acfbad7ce158ea1b71872c824937f03a044e803df3d2e9879c27a8adff27d7cd91c7bd46b0ff9ce2b99fd79f8a
TLSH
T163E0268C19D8CB6EEA40B6875178934CD2E0360BB3D8F90A1B0888C67345854F3D7AB1
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000060

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000060
Size 204KB
SHA256 651cf39004a97fae1697e05838779d65160549547af23fd87bdd2a0bf570ba1d
MD5 b06cfbefbce56cf92ac6627482be4408
SHA1 7e12458646e2efd8e3dfaef5e80cc5a932126769
SHA512 9ff860e0da15105d3f96c18acae439cfeeef432cf464ec940c9af7a50ed1130487dd83c89358baa7dc54eb5836c964430239028589d06f01afadd8a4b6f859ba
SSDEEP 3072:Q01eNEpWIkCBnxGDB0GraR4dgMmM9G37gDkAPobkbAooM:F1eWpWyBnxk+GraR0ttGLgD1Q2oM
TLSH
T1F51423D5B5B00CBCBD6DE216809F517A3CF69CDFD56860937B8C8CA89B5C972041D472
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 07ecf589f46edb06fb54daa0ba599bcb1cebe49e915fef13ebbdd252552bbb54
MD5 21af8b93c80c82ce5f1d9160b57e379b
SHA1 61cf194278a3ad95c2e1dbe177f06d8b66d71a58
SHA512 b843b2871f74d1a0409ab675f2697b76462bacb33ea42269884b796d0b854f0ce7884cb8ffa5d87c4e78543f059d05beddb63d8ca4e546e1dd960c1cad53df17
SSDEEP 96:TBOH8s6dQ4F5YmPynmz6dkZCV0BpWKF9jEt:C6dHgEymzOkZCuBRc
TLSH
T14CC1D9B8169329F1FBE99FF051DD1C9937F280550D537AAA86083D76ED06FA912C0243
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 b7f3d25e5cc76861ecdc00f9b5af86a9f4e5c4abe85d88f22817fbe99becb1f2
MD5 5a20e67ded66f0d662cdab50a1474a7e
SHA1 f369964b5015fa9c86a6226c6420a12916ccff27
SHA512 e4646e78b9c7a34c526df95d110e2555d048cc658dbc83170ebe58ebd9dabcf421008b7bdd89af591d4c41e24161c103d9e02d636ecfbf4a11438812f1ca7548
SSDEEP 96:fPWCH8s6oQ4cQ2YP1Q4YurKkZTV0uVxCWKmTx5/:N6oHHddYuWkZTuUxtP
TLSH
T1F9C1C7AC06972AF1FFE95FF044DC189933F681554D237E6B8A082C76EE16FA942C0253
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe5aad29.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5aad29.TMP
Size 3KB
SHA256 aca5c3a457d87347bdb98bd1ec7d1890b3dd9f98eb8e494697ddb6a62f5e1cb7
MD5 b31b158e11bfe549ba4d33715b7d6460
SHA1 19e4496ac0b9871c35491535ca0fef56867eae6e
SHA512 f50c5a8ecd081b5cc87fa587bbffd516c043826979e83d055c6427d9e12bfdc949c82b8c3463b5da1f3c94c4220f9dbdb9a5193dc9bd02e8f35ef22881ce078c
TLSH
T100613C5C2B5905F1D7DC5CB981AD54A932FB84540E0BBA01C45C6DB7EC2AF3852C1363
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.108.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

computed_hashes.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json
Size 429B
SHA256 b829b0df7e3f2391bfba70090eb4ce2ba6a978ccd665eebf1073849bdd4b8fb9
MD5 5d1d9020ccefd76ca661902e0c229087
SHA1 dcf2aa4a1c626ec7ffd9abd284d29b269d78fcb6
SHA512 5f6e72720e64a7ac19f191f0179992745d5136d41dcdc13c5c3c2e35a71eb227570bd47c7b376658ef670b75929abeebd8ef470d1e24b595a11d320ec1479e3c
TLSH
T10AE055170A1A50B79BB8DB90EE525CA2E8A0A6B1C50438D63E608234B68A11F738347D
MD5 SHA1 SHA512 TLSH

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons
Size 24KB
SHA256 24d9a76b07b9602dc5099231b38749b17d176d2f1153fd8e7884d04f50571069
MD5 3ddabb563eea5ee15845a73212d27a8f
SHA1 1b66f09d972898e8fe04944d641394dfecd3085b
SHA512 b58f6109d605ec78fde5168313adaecddf0986735218abe30ccf822fec9f6860268bd3bbfe4e04350945db5d7ad55f556010d9e662837e94047440ec4830e5f4
SSDEEP 96:kBCxSUvW1fIO8XqBIg1KW1r48Xq1ZDcomvW1HIO8XqHIg6hW1+48Xqp0tyyXPTOv:2aytzo15l0MorXKPX9caj7A307B/xB
TLSH
T10AB2D647EE307413CF202A76376E5030DB37850AAF97DED87C618410D9B66A6C0622AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 224KB
SHA256 101feb11e9c06f6ee600c6b9ac554155d40ad8a8a513fc32a6508548253db33a
MD5 9e5011d3fdc85fdd923342038c8ae519
SHA1 bf666c761835a7890915dccb07eb0db127a4ca9a
SHA512 67ea3f7e74736fb9f0d26ea49169e16fa5438ad66a7ce1e85a97e7019e9234317c26ec5ffb3f0c2f8f456674c2bdd12622b9e400377f06f293b2ae237d2c4b13
SSDEEP 192:GK74ksVZTJPfcdhiH+bF+UI3iWGV+WN3qL/1oDaLVVV63:GKgJPfcdEIkUI3ijV+WN3qL/iaLA
TLSH
T1FC24B65F9F302612CD7C513669EB44A29D6EF42FCB43A6CA6C600460CEF3A52A01C5EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 4c0e83bf203b232176475a737f044089a1469af4dab347b31d1f41d77d6e448f
MD5 763d6c58120c3258d37a7214fcefbcbd
SHA1 8d99c82d9f9ccbc7c087f1cce95756ccf951c29f
SHA512 b4c3c7c00f3f90783b5d5a6598fcb256dc3bd6aa94afe5511c6f88bf40da86dbdceeb7fa574ea77818cc6a258852b7dccb31deb0edab337772dbe204ea6d6556
SSDEEP 192:DiCG+WbcTVajhnVBZaPShZz88ycWXcZ5BYGhtvOza1J:DiCG+WbcTVa5VBZaPShZz88ycWXcZ5BD
TLSH
T1D2D1A9F3C3E9826DD91156F4AA146F1BCE1C0455436C3E6A89E4AE1BE3F2871E141B8F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 c1c5593adf9dfc99d36717c4f13c264402358460b82b927af3eec8e1f754cd9a
MD5 f1c157bac69399ba5ca5e9691f08d9a5
SHA1 17c9538cdaf8cb20bd7bd15be736ac9429810ca8
SHA512 c77f66dbebd9cc7e8b52ff413fe5ddae7c2a74508952b1865e7ee46512ef93f27de03260af429c07b1ff7808eee6a09d65c31a4fae5730eb3ebc1ccdf91f9398
SSDEEP 192:DiCG+WbcTVajhnVBZaPShZz88DXcZbK1RGje5k4bKfdlG3cPtG0/tj:DiCG+WbcTVa5VBZaPShZz88DXcZbK1Ru
TLSH
T15BF1CBF383E8816DD91196F0AA14AF1BCE1C0415436C396A89E4AE1BE3F3472E141B8F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 129cddbea06e627a4c6547557accf90dbf9052b00c9ea45028c4879f51fa3e0e
MD5 ce7bc1dc8a3582d8123bbdf0089a0144
SHA1 7f665dfb863181e47901025f399e7ddd5d3f2a9a
SHA512 dcb237727027768098c9bdbef4bb0b93dfff9067a382ea3016145e52ab74b6d4c35674d8599a486f562001cddc2d86daf4be1df363bf1408d56ed4abe261cf6f
SSDEEP 192:sxR3RBCH/fwsM33AtSTbJ+DP2oA8pJD1lr/g6+WNyt448qNz/lqlC9FLyQNGYbIS:sxR32H/fwsM3ve9/5vA/oi7zJ
TLSH
T17952D7126924593B5CD7E21AFA55BF63E7F91023A1D15E58BAFC8A0C04EA7DD2203C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 26daf046fc3e09bc87d4b0f1233bbf3ad77122ffda6e868dd38e5429274a83f9
MD5 b2c43558de6ac9a6e9663e4763c27375
SHA1 0685ca088453cb459ceaec2a2b85f62892bbccbf
SHA512 00f7f256a77af77fa7efbd3b972ce5e788ad2eedf51182d2bc8680563200594d386e5f84bcd52b9e726796d52f5fbd54d26505922d4f2350094adb3346398420
SSDEEP 192:sxRwQUnYRBEH/fwsDPxZpbgN4JxbW7+q2oA8pJD1lr/g6+WN5Pt5e1BSNz/lqlC6:sxR2nYIH/fwsDPfK2cz9/54o/oi7zW
TLSH
T1F472D8126924593B9CD7E22AFA56BF63E7F8502295D55F44E7FC8A0C04EA7DE2203C07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 f743f4b0c456e0c3c34ff38d162737b8619c8d7ab1f54d7ef618728744da1a84
MD5 0d4471f88c2e40992e033d1cbb53c274
SHA1 73bf02b9be98b779fd464dab25216577863fdec8
SHA512 a115fd4dcbde5c691fab808c64ca5c889ef75617b78f37c6f57979a35fa92ca546579ef20b1089f2dc029b0cd674bfd52ca987ef9d64254b111c6d1a5b0cdb70
SSDEEP 384:sxR2nPHH/fwsDPfZ2cz8/5DCo/siBzqpB:scPHH/fHPh2P/5bsiQpB
TLSH
T15082B756A52489778CC7D619FA25BF22E7F9102399915F4CAAFCCA1C04EE7ED2203C17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 18KB
SHA256 43750318a9255973a7d7707d3c9a93d32bdd84a287326b3dbd074c9e8158ea93
MD5 de176bd2d08dfbefd9aa659e0ab081e9
SHA1 f0ed10b0b37891860a50ba8c38aa1eea47084f60
SHA512 4f55c03fa79b1cf9568626039021b2b6ea54048c2949a22e694e853abbc03e9050c5501f36a15c76a527ecb3cf2d9ee367e5b8bf668bff969bc15ab3f5f848b7
SSDEEP 384:sxR2nPwH/fws0WvdPfqmwG/5ZCo/silzzqpB:scPwH/fwYdPiK/5Fsil6pB
TLSH
T15E82C756652489778CD7D629FA25BF22E7F9102299915F4CEAFCCA1C04EE7ED2203C07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 54ca17cb358309481053e82a2ee86d39d1f4fa2283cdf223c3d11d6c9ea06f29
MD5 dd95b229af949803b130b9e18ce7a776
SHA1 bb6ce51e9cffbd9d773cb84be9d43f31cddd887a
SHA512 27f661345b1666ba86fb3fa6d1da31e0696b332dfab52adfb36d0c28886c83a099eb71dc16ecbe237924f18a8ded9f45b9dfd0da1e2f08c142c7d7c8dd0a476e
SSDEEP 192:sxRwQUnPRBEH/fwsDPxZpbgN4JxbW7+q2oA8pXD1lr/g6+WN5Pt5e1BSNz/lqlCJ:sxR2nPIH/fwsDPfK2czP/54o/oiezqpB
TLSH
T18B82C816652489378CC7D619FA25BF62E7F9502399915F4CAAFCCA1C04EE7ED2203C17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 19KB
SHA256 3ed10ee581aa7bcc3f3d737f6cab40831c199748899117cfef4f36e54911b3e2
MD5 23fe8610dff3e6cac084a889b76a2434
SHA1 c37533bba33172db9bffdd38664040ac190b256e
SHA512 5ce651624a998fbece2fd4987ad6117fc165dfca7e708757df51d2d8e0861a687644caae1b2f8b666f90d204af37dbb2a7a7b161e3babe48d94c7ae088f56496
SSDEEP 384:sxR2nPwH/fws7WvxRfMzgmwG/5ZCo/silrWzqpB:scPwH/fvYxRxK/5FsilrBpB
TLSH
T19892D846652489778CD7E629FA25BF22D7F9102299915F4CEAFCCA1C04EE7ED2202C17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 c23053ba780bba078e0ee251113658b6f6bacbfd4ef3df29f24845a5c0a994b8
MD5 d5bd6547d159cd42f97ccb746cf9970b
SHA1 385e4524fcc3a040b828547ca967e143656adbe0
SHA512 f6c8b368bbae148ff0a5e61eb92ccd203aa1603702fa94bd3f5f0be392e8c40c1d58133b1fdf9014b192da8548d7450cc0f09473186e6db245c269be7649c464
SSDEEP 192:sxRwRBCH/fwsD3xZp5gI6bJ+q2oA8pJD1lr/g6+WNyt448qNz/lqlC9FLyQNGYbk:sxRw2H/fwsD3fcIIz9/5vA/oi7zk
TLSH
T13B62E8126924593B4CD7D22AFA55FF63E7F91023A6D45E58E6FC8A0C04EA7DD2203C07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 2424e7c4a8fe45b498dc933ffaa1bdcd8b59e4a501bf2b2d2df23ae9d67a1030
MD5 35d754a5adbf7fb6582a3564ed577dfe
SHA1 ecef646f76d4a25cc7ce25e08e674c98df795c49
SHA512 4b892e3ced89d059fd2a3fc669cea1cb220a8e71009a285010b38f432d88a16ed48b3604dffdeabebcd60ea5b7370f521bfa6033e0bc4442201bdcb3fc67e0d4
SSDEEP 768:K80Esc7pLuLfrwWgNhfVN8F1+UoAYDCx9Tuqh0VfUC9xbog/OVgCowLWBroLLcC:K80EsAEfrwWgNhfVNu1jaHCogW6LLcC
TLSH
T113D2D97B640DCA7E4F800ADDAC197E9B6DA802CB96D8CD8047FE855C03C6BEB51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 77cbb943315a3cd31019be573622641b2050c48346f7e4ef050c5df30a86f1f9
MD5 e21d6ad9d0a71eed8f5df2a694355638
SHA1 938377d0d77d79f9c424c87f3e1445e439331f94
SHA512 80789c2ec0c0a40dcb4f31f741900e1173e7f8497db9701905443baa0d58092d43adfb1d203a546a4b50ca398c6c04fe229f2a09d2c90ccc4f2d5fbe60c9576e
SSDEEP 768:K80E+67pLuL7FwWgNhfVN8F1+UoAYDCx9Tuqh0VfUC9xbog/OVgCowLWBroLucMk:K80E+SE7FwWgNhfVNu1jaHCogW6LucMk
TLSH
T1B3D2D97B640DCB7E4F800ADDAC197E9B6DA802CB9698CD8047FE855C03C6BEB51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0761bebc-ebdf-4e80-8b7d-785587e9a995\index-dir\the-real-index
Size 96B
SHA256 63a185d350fb72670a903c65b2511f8bdca8a5b4ea25b0e58676811ace8750f3
MD5 e0b43f5418b40858e428171412ebc29f
SHA1 a53eb554becb7bd67f7d75fb71227c6f75ca658e
SHA512 5dac1cf876cb888cfc2727cd04a2281fa58de66933b2bcaacf2395c980a34407ab7fea05ad1abdd861c83b3538c8aa9c49a61e998411506d68a7c5e0d630d4a5
TLSH
T100B0228CB002FB03E08303B220C208B032B0BCC0230C332330AC003CF388380008B038
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5b6a7e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0761bebc-ebdf-4e80-8b7d-785587e9a995\index-dir\the-real-index~RFe5b6a7e.TMP
Size 48B
SHA256 8731fbf12f0035dc0b14c0186a5cb206c01396fc335cf435e1142ed777275646
MD5 a0e31d696fe65f112903910cb2715f24
SHA1 946e91face0c4ac442192a91cbbeefa37c8b08dc
SHA512 5f4a65330cf4ef6624f5f4e91b7eae94bab6d58979df4714bd4e2d42d7b94c601c5de862108f69130b0e7cf5dc9e1126fd51061378f67c19d1ac05f79efe897f
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\3f0e9dae-3c86-489a-b162-8d7c0763199d\index-dir\the-real-index
Size 72B
SHA256 5ee457c884d99c8d0c7f173d17153c077ec94d75d7fc4846d7599db47c621762
MD5 63f4483809d543253d70f84898caa615
SHA1 570a69e01a8492154211f4dba8eeb2c7140e0077
SHA512 1451fc308b242dba375910ede833b9c723cc58d1b0557756940ab4eabdcbe9a3ff346aefc5cd660bbf5b902d8f6b2d65266d78a1a3d5feee1ffdbba3fdb75629
TLSH
T1A8A002DE0A851206C0440BB4704A31C0D34A4C7460EC130540E0508F89610A9419B01D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5b6a8e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\3f0e9dae-3c86-489a-b162-8d7c0763199d\index-dir\the-real-index~RFe5b6a8e.TMP
Size 48B
SHA256 1bde8e2f97cf0dce353a5428d5fe086b449d3c4a6fafa3419a3f81bcc6dc95f5
MD5 48558a12d10fd8eefd96fd594570c704
SHA1 07e185f9ae088b1d0c750bf836f4c63aa045c0c2
SHA512 7de383050c8665af72a6c9dc696349cb486700a9efea21d95508848d58bb7db28a8830c8fbafa24083587dd273b7d7ed9457e267d378970c20ec239e980948f5
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\647a1225-3ff1-4a47-ada6-633e5baaf9fa\index-dir\the-real-index
Size 3KB
SHA256 cb70c7dfd87db18761f75f3d09826529347a814e8c86eb6cf9be63ddeedcf5c7
MD5 e4fb3b29a8ecc8829e37a314dc3b8365
SHA1 c6613260625e74dab3250a430c7a597a12dea2ad
SHA512 58d63402485710d3b6dc11a60e67a0acaa1208d5c0e26754c95d4437d73a7ec709f193c10f229cb11bbf28db2cd3c6d9e770a121092ecaa5957a225e2b688882
TLSH
T1E2511A8E4C4A2C6ED8BD11B22CF60481B37568FE0784EA0B27ACA6307CC333E1D51115
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\647a1225-3ff1-4a47-ada6-633e5baaf9fa\index-dir\the-real-index
Size 720B
SHA256 26d8a388c7d5bbf4498ce62a02ea1c8419edba7ae82d5932e6541331e10dc7e8
MD5 22b8e44b4ed7c984f775fd13c932c1f7
SHA1 e756e8328ad3a1810f277750c3526172fc84055a
SHA512 9b6a9694519bcfbba541960b07f80cd1bb33d5faa0d161b8795d3c26b4e58eb0ee6237dcb0c94ed8516a51c5a3ee5f22c4e4a6bbe6c8bddb4280bfaede898171
TLSH
T10E01C08B8CD55847DD2379BA263A204A333904FD164BDD8B006DB43D8D66A3C5640245
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59e97c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\647a1225-3ff1-4a47-ada6-633e5baaf9fa\index-dir\the-real-index~RFe59e97c.TMP
Size 720B
SHA256 5758e104b042adbec3e9f073b664b91f516b7be226d28bd47c8ed4ab7df770f8
MD5 a098ad13f040d88d872398d0c44cf589
SHA1 d7238026d4a8dc423a61ed7b237a8e6f92680e50
SHA512 2fdfe421009118c0c830130cb283398361c6e50bcdb429c547588073b4545a7f763545c91edbe0ad8fe73ac42e459e41bb4e85001f8502e54d8e38311b269716
TLSH
T1CA0154DB00D2EC43DE16B0F9311B7016733F4830216ADA4F60DA78BE8D76B384680691
MD5 SHA1 SHA512 TLSH

Submit Download

623cd082b6202da0_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\8e79bef1-9161-4dc6-a461-aa332c0d647e\623cd082b6202da0_0
Size 61KB
SHA256 a59200244cd031e628e47e8e4a8d390bb91c6394fb83d4b92877627e6feef8d0
MD5 80b8d227bd7511e9e4b047b61f4dea2e
SHA1 60dc9e2b09b19be0026e2ed90abd2c20d775a21f
SHA512 e517f848937553d48948e44c4806ee84297265d6a81e8df69442c3dd4b5c06da1b1493263f359405eec39c8bc719a51782ec738969989e0e4b6ebb299638fa18
SSDEEP 1536:75tc/QE4JfCS+ksYyiApR+M0DpbarcjHh8BZlK5HPwqpzGA/a:7Lc348bC6Rx0DND5B/a
TLSH
T112533AA7B2626035CBAC21D6A49A7F00F12B17561904C9ECF0BD75513B18E8B57B3BBC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\8e79bef1-9161-4dc6-a461-aa332c0d647e\index-dir\the-real-index
Size 72B
SHA256 feac85a358c0368c454bd326520404d7bb6a276cd96d88fe1e56b49df2bf0f94
MD5 06a4981ed70c7cb391056b451b92ed39
SHA1 ceccab2ec5eb43c0b4009b139332fafbbaa8af1d
SHA512 ad0afb9f9cfc823ecbef39d8aad1a8d46e913567ebc0d383fada2ee9942f642a3c2a852230589cc1c7c720ab0b72b3a1e3cf9f4a7de9ae55297bdbe196e4d8e2
TLSH
T12EA0021462E16006C01292B027EB128162204E12170B571DD1A012D4CC5195586A121D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\8e79bef1-9161-4dc6-a461-aa332c0d647e\index-dir\the-real-index
Size 72B
SHA256 8f18b6e6c71cc06f5402056d687b6af17e5ebb82e13f2fb2d8a0f4033a562075
MD5 4114cefcec061103295ce42a73b233c1
SHA1 b684cf48813cea85158088b8fb3112c9d3f832c9
SHA512 3ae18faa9aa429d0fd1cc4426fcb7a78e06392bec5db279b15ae7c95768c1b8f532da53685916a6790f53a86e45a2d90770abb8eb3c59fcd4112966a8a2bed7a
TLSH
T10DA0021413A13001D56293F027E7254123108E10070BB30DC19052D4C854E55979520C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\8e79bef1-9161-4dc6-a461-aa332c0d647e\index-dir\the-real-index
Size 72B
SHA256 eeeadf63b7c4b3f60d7848f0210bd1ee35daf2aa1949008b3dfa1e2bd1d55dc6
MD5 0a9371f010da4a0d100143ff780c16a8
SHA1 4ca6e639864b995a6422ec96227a6148f44554ae
SHA512 0dc64c8969aedce1eecaa58fefce5432f250344ef0c32d85bd56dc627ffd4e5fb6602e90a6a95cb860201e6144930b2002deae00100a9099203df5eb661e455e
TLSH
T134A0021553D08205C02B11B11962C34932848C105500734EB0D50494CC518C5458115D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\f6ebe3a0-1d61-4b7b-88b4-dfe50554c6a7\index-dir\the-real-index
Size 72B
SHA256 6642901258672bca5e36fc193292a1a84ce46912d8ef9f5e1cf253284caf838f
MD5 ae1676cd2e313ff5143c10532df029d6
SHA1 9ab64624caf9169ed6a2b7c29f767d661df281a5
SHA512 84f7377f6c6770bf9b1f3f55e54f119d0f5354581304cb7a8c9a66d642b5bdae60cd476b7192d4603989415c0b51a1dc531639e9a403df8902ee407618f5ab75
TLSH
T1AFA0022531D4D240C0420571EA42D55037845C990110870E70D10895C9550EDD506886
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 519B
SHA256 bb13405dc7a0639f06660af2d430d931ef9da2600deb9789acce33d16678bb9f
MD5 acc51782f80098313a60ee2bd3da5441
SHA1 8933a1e7fe46336e6e5c245716de8a57c56a90b2
SHA512 aaa3c57f867839989fe40459a970740352e3dac29cc48139debb135585eb571ae4b156dfcdef9bb6b88eb990893ce771540c2beab86b363b3e0ddee1ca6d63e4
TLSH
T189F059B27EF21850F96FA3E564B198A141253C449580FF0E505BB78710B22A2344ACB2
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 d20526793b700b6377c9010456cc38361678645153947ded159b299bac5ca40f
MD5 8f6542d62e900ed3805700840245561c
SHA1 d9f9dc26d140927759d8796b8022fc334451dc22
SHA512 aac9fa39a9c61beafc9572e1cdf96f9bf0f99d1e71ead3b938a34453e22ca2ffa3bace3eece2516aab027750342629ac90aa829a2b82f9e3e1f39af1250003c6
TLSH
T1BCE068F63DB31850F95BE3D224B1D8A042113844A580FF4E6029978B00E12A23406C71
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 624B
SHA256 63cb2fdbc3cc88408c9c5e62f29f8820ceaaba0b6de097e0090567c3b2037f2e
MD5 6091e02f27dbfba140279c8bfdbbd3ba
SHA1 59cc0a1abca5929f0dbce3e60e5f7182045e6a70
SHA512 ee998c498fe37d509feca1f5164a9ad95ee08ed3cd01961b2b774951ada119bc4857f46579abf6b8ed06ac0a4b6e1a90f5883e930f1cefdbd2215372f82344e8
TLSH
T148F078B23EF72844F86FA3E5207594A505257C08C590FE0F141AB78B40F23A5204DCB2
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 619B
SHA256 a4ba124ab6535cf15e99c741dd65dc56c7ff139cd55f8800e095d7d0a0a01c9e
MD5 32401953d286a9b3c03b4a6914ea657e
SHA1 7fcefa82e2f49b4128dd990f23997cc1b3df90be
SHA512 3463c60f349c0bf1ab338b851a2694eb142ecebbcc232da4491ac8ba4229771a1ed7d0c68cf7dd800946773c5e6be74c6bd13c5b90146b0c49856d2121488e42
TLSH
T1D4F028B23EF71844F8AFE3E52071946541257C08D5A4FE4F181AA78B40F27A5208ACB2
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 338B
SHA256 18c1e8d5fa99c8c5633eed5f1e1887472f0d09a873de6b4250e8e5f14e349220
MD5 5b5f6ae56abeaece593056c101b2d81b
SHA1 54409f77b0df28910932f25d4cfb361ad7618b8e
SHA512 b9fdde44e4cc049d4e81053bb58641188ff63de5ff8d3a42435b247a40a8efd47ff4ad35452f7b61fb08b6c0c8850fa0bc9174f955d86a877ab3e1c707389b0f
TLSH
T1DBE0207416C4C37DE457B6870324870892D8751BE7C8BD011F44D8405387906F55F270
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 fb4312b10d51a615335a76113c209235ee0d3e78ade70bb02498aedfc31ec3c0
MD5 32103d73ea9d128624b538c10e26c293
SHA1 64e403a66691bd1a2c508044b1cfb70dac1582c6
SHA512 2ae8e466d8474b528ff1c8dbcdea812368ae2b22359fc580cb61eaa7118244ce88f0b7eac54d66e1af3acab9338117c032f5d8df6b4a6a0501607211ac50cdd1
TLSH
T1C1A002218E5AD055D4C94FF032B551CC73594CB94315231A5DD890AC9DB55A261C6A09
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a43e0.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5a43e0.TMP
Size 48B
SHA256 1b63c16b5aa85398309f281452aa5ccee5f97e43021d859984a1c2716cc35f8a
MD5 e43be003881ddbcede6d08d2844d6f81
SHA1 d7ca46a2b110532437d4bd6ba80281c1edcf7db3
SHA512 d60e76417634b70867da935b082bf19abb666fa5315903b918860b29bebd4e0eac1f129878a7090386254bb9b6f913a257b8af0e947e3b065d20cb718141315f
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log
Size 256B
SHA256 1abb25978570b36970ae187171cfac884e77f42f1b26258bb400b8836d03bac8
MD5 64fc1baacabdec0b3458b8502ad12643
SHA1 1a0e9c445439657c8969ff5c7c6e34ea9b7c75e0
SHA512 9cd98f0070cbc856ec48a94b450f397a35e17aad9a01e6171b385b202eabbd12822738a93ffed038b7f4d17ea6d76c6bef6d5eb48f4302b3af968962fb74bdee
TLSH
T129D0970CB780000ECD8F187C09402B4AB301FA2215848203C41CCEA23E06A20AC2E1F8
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 350B
SHA256 085ead2317a2bfaeda22974e9664e53e8cf6b70d520e4640db0fadf1549a5a19
MD5 a4d03720dbd91212d1cfe5201f8b297c
SHA1 994fcfdd01925deac70c1fc73cecef68bb62db00
SHA512 bb9d1df538960a817a0cd96c27570f4a3511b37c9d627581ce129f748f796f7608ffbfe1ff5c8eac451ac29963e8bfcf27db765491868a694a48fbcaefeaf5e6
TLSH
T19EE0D83416CAC76EA586B5DB5328E308D2E27517E6D8F9112F0CE440634F940F68F161
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\000003.log
Size 175B
SHA256 80d1388b9a7150eb0291175fe693dd7b6bce910c3e4fff51e94841d31d771dbe
MD5 cb63c64828a27af7253afb7c7d986654
SHA1 8a54aeb86f79cc69e6f11278d874cebd328ae466
SHA512 e0dbdd6931c9272e0b52bb2ef7895121f6324379f584899343342a057737a9837cc476842ea781a1de5c17a20c06e0a7d24c0ed6ea41fdd95bb99296e8810f9a
TLSH
T135C09BD55F903023FDCA5D3D0DAB53041720C4752F74CF57D28430901C0A285FF61145
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 326B
SHA256 5d5c54c37ce7bc0e70410b499ec591290be18c9f9e31c536f76100ae1d86e8d8
MD5 1bd32eb33dfba92d32aded6ee0e3834a
SHA1 68f97f6e3759167097322f844cb9548c27e50356
SHA512 526b6bf044aac13be5ff45259e68c79c2494a186f4bc853b3687bb3e48e9147578871107353b29fdd007054fa43d895a96e666d1d36ae94e1e9268314b38c1d6
TLSH
T10FE026744AC8C7B99A42F5D74368978D92F0B817E3C8BB425B086840A342501F2AB1A0
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 71831e7c0e91ba3294bf2fb71f3c913b3b4e804c3f746cea9353c0bb04e7a4c7
MD5 4c262747797296d09f34d1479efa9467
SHA1 e0b7c806fbd59bb644e37c29cb98b3a0d95b8759
SHA512 7fecfeca3e3afa06875ec66d92f22c8ea008051bbe078cf33218689b39a1c3c43c21d6c1339caa8db1fb1570ded9882768eb28c43d4338d60671fcf68bf19e2c
SSDEEP 96:KROjyuIQAWWQVdguWK4zgsWcGONcOHKL/LcL7LPLNLhL1LM9LxL6LXDLHLMKLLZI:COjyuIQAhQVuu+zgsFGONcOHTHl6
TLSH
T1E0916422367A42503D3EFA5C92A8D91F429175B33468E86B7BE810910FA7F424DFC4ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 8b507080044f001b00f358631779f4ff901ffe3b83a8be33bdef998c35525c03
MD5 50f4c9611829a84976cf489152cbe55c
SHA1 8af27b5ec5f74da983923e2291e8ce90b55abf65
SHA512 c5b5ed1e25cf9574cff43595a068fd5f9e7a54666ed17892a5e034cb34e12e030501a75fdbe70d7a0e5df6ba15efc01f4d0c8b3c83fa1d9e9bb2a77093d83c94
TLSH
T16D210465F330C508E25A8339607E9B360338D8538FB8ED0F55B620396DB6B141E8B2E1
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 337B
SHA256 2dfc3c7f2443c0ed68b040d170fdce6d5a6a16f7a96ad1d61dfeee0994191cd6
MD5 78b2d0658cc32be04f9a07f2022177d5
SHA1 9896a1687a19b9a73dbba3d1310056bbbd9f18d9
SHA512 1a013df8bd57381dddab243a716d1565e6f8386179de5101de267ade0141fe11f447afecb8654a3d795f2ec733e83e5c601b99433a2a5896d08e544ca3d014dd
TLSH
T1CDE0DF18B9CAC2AF9852B5C30264C348C2D13883FAD8BE025F00C984A34A742B78F1A9
MD5 SHA1 SHA512 TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5ac91e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5ac91e.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 44KB
SHA256 daf8729e886160dc165a3bd85a75297a017d6eefefefadea164a4f923677e38b
MD5 a81b7e97366fd144f42efdd55c646cc9
SHA1 7c2863fc90d00cac518928313e8b6942789c4d90
SHA512 d5d17bb0fa6f791855d3e3450df439132f66e5115b60269cc9db278f186931c26a7f8a35d27be301009bd006cd3de31b2aecbcf7f10c9e3bfd73bd281ef160f3
SSDEEP 768:7FH439wgpMrF1OUDcX4fouOToPvB2thtA9VAgnUn2LY:V43XsnnwthttSU2E
TLSH
T1E61328F298D78937E8AE9797633D6D419AFCC06374845A84BBC85E4CCC462BFC70A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 16cdf23b5504c549ce37be454d8a23ecbd992bd360c12f9b4fd65aaed4abb8de
MD5 4756f40ddfd4dfe4fcd89abc58ebb314
SHA1 5149b2c2ba03052910ffb6c15495afcc33134451
SHA512 2964b29bc93f42d4471bb8901e73ac66be327730cfa623fd860ba8aaf8078788e09de5037d64579a8cffc9b1673b304b29d1eb32aeb5723557b176445601d4c5
SSDEEP 768:grv+4UNbdH3QA+LeSFOUDHX4fouOToPvB2thtA9VAweeVH1SlX:gbsbh3isnnwthtt/EH1Y
TLSH
T1BF03CF32A8AC8933DDD6D398310B72572FF4515396900FC499DD2B4D069B9DE070BD66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 f3e19db5ab3f91039a402c48175faf450017a03f2a2d0a099aba6a2a705d5e6d
MD5 b8e03f4659c709e364488a7a9d610164
SHA1 32832c1e7fd8f326b17017bf98db47adcb45c1fe
SHA512 e529214115d5fb8114143fc480cf2f12f38cd8d471cbf91c1abbabb18474c2ec42a04638557fc2341a1b027af15ab1690b603520598eadca168e59b8cb4f1775
SSDEEP 768:7FF43SwgnMrc1OUDAX4fouOToPvB2thtA9VAgnUn2LY:z43hsnnwthttSU2E
TLSH
T161039D72D8A8C92BECE6D796B3097682DFE050A385C99EC4DED85E5C00876DE070BC15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 46KB
SHA256 ca7d51765db7eee3d91320a4541f810ce60bb7c1eba926803f6596160f094670
MD5 c22d3d1d8fe1ae4724936f5fd06512e1
SHA1 b2fa1b238c4c952ed092e33a67162c78d5b6db36
SHA512 c9e097582d8fce70e4a25373d56d0e5b800494871466cc5613ac44237fb2c118a73d84e9a886721fdf3866744c17d63b26e80431d4e52aef83dbb4460361c2e7
SSDEEP 768:NFcY3CwgYMx1/uqv+2k1OUDmX4fouOToPvB2thtA9VArO69d/n2L0:AY3K7snnwthttag/2g
TLSH
T1EA2338F588D7893BD8AEA787633D6D158ABCC123B4A55984FBC80A4CCC526BFD306C15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 bb69d650ca526bab9a6ac017468aad2dc23fc39513a764298c2ce5034c7781cc
MD5 5f98139e3f3c5b15ff43cb68917e0d85
SHA1 98246996986bb244313cceb3f05c8f58b9f08e8a
SHA512 05b6c2aa5873a2347cf1c23584a5a184c52775c4b99a5e023c37ea172a5235c975bc7174ac974f46e5730d63783b4fed5034fef554540630354794e0409eebec
SSDEEP 768:N138Mi+LeSFOUDhX4fouOToPvB2thtA9VAgnUn2LY:N13ZsnnwthttSU2E
TLSH
T191F2CF71ECA84C73DCEAE395724A7692AFF0506354C50F849ED8971D05477DE0B0BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 50KB
SHA256 01ec7e57786b92a173507fd9c67d862e5d501a0785ae471558ce0fe22584977f
MD5 b7baf5f6fd3df043db422099ba8ef0d2
SHA1 15bfa781e150f559ded44e69723c7d65dfc03996
SHA512 534af5d432d088aa0f9bc691a8fc915c326189c346766100a88180b77fcb38685ee0fbdd247c703bbf25c8b1afbbe3f1a1312089f306998e8948edfc2aa9aaad
SSDEEP 768:7FcY39wg5Mr+1OUDcX4fouOToPvB2thtA9VAgo7h9dkUn2LY:iY3MsnnwthttHtkU2E
TLSH
T12933C2F98CD7893ED8AEA747232C6D558ABCC173B4A45984FB840B4CCC625BFE706815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 99518eb922ed74f4769e8954454f26b0d735089a881a6353d38b625bcfe7526d
MD5 f8847ea54c9f6f9169b154f7d359a55f
SHA1 e85766353cdd6c20526a7de5308893ea6647e590
SHA512 e9cd4e70ad34ba25e0d0109a577d86e27922a3b81a32790726b07059e1c2b9c9b4baed8cde75ebd05ceb4b2faac3f7a425118062f14a95a07a9696558b6db156
SSDEEP 768:/rv+4UNbdH3PD+LeSFOUDxX4fouOToPvB2thtA9VABneVH1SlX:/bsbh3ksnnwthttdEH1Y
TLSH
T1A603CF32A4AC8933DDE6D398714B72936FF4516395800FC4DAD91B5D0A4B6DE1B0FC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 7c0399fbe9403f40e5d63e74121e8c8f2126b0279a10d50c4b0b93b10d0e1836
MD5 96da98368cf17b8dc0a179f146fc0868
SHA1 66e8be4de81fb7cb7cf69567a4029b7d8b0e501f
SHA512 1f97c9ab9f1a94a6ff024340739f1fd54ca81c11e6f2a75a719a30f7e2bbbedb91acf716730478df96c9c3df2e42d17f041b57f26d70eb57d247033588d7cba1
SSDEEP 768:Y03DMi+LeSFOUDhX4fouOToPvB2thtA9VAgnUn2LY:Y03GsnnwthttSU2E
TLSH
T15BF2CF71E8A84C63DCEAE3A5320A72929FF0506354C01F84AED9971D0547BDF0B0BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 4029ba92e8625900de1cd798f1f50e5009abf899f2369a9b4346752dee176157
MD5 9d31c01b40348cf7b20dceb511289f1c
SHA1 1a8c37ef51836b3770605c7ca29889d7f60c1918
SHA512 84e3fd47799b9808750005ad016181b7c5dc1ddea932eab02f76127bb453cd5d0e7bcea8952d3fa41e172bda46beb0f94306dea52afd7bb1980670a6998a075a
SSDEEP 768:8rv+4UNbdH3CMi+LeSFOUDxX4fouOToPvB2thtA9VAgnc:8bsbh3bsnnwthttSc
TLSH
T1CC03BE31A4AD8D33DDE6E2A8720B76936FF0106359C10F84DAD91B5D0A4B6DE2B0BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

campaign_history

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history
Size 20KB
SHA256 bd398207bf8820e03f322bb31e32f96cf3b8d7f3a8c127f858390e9a58b10189
MD5 0c5437edaa2fdf886d282a2884512944
SHA1 060ef1aeb05096df7b69bb21c5fbed8ecf4a3282
SHA512 93e46aeae97ac151d80562ad23e0baf047eabe2a156524dc2b0ed1cacba70619255dc4c937fdf11d993dde588b6ecb22bfa639950404593d02c4a52d61afb88c
SSDEEP 12:TLuKqJiEZXiDiIF8izX4fhhdWeci2oesJahvGFUxOUDaa1i3isLgxwzbdNBQQtyG:TLej0afDdWec9sJVUO3ZyKGVjy
TLSH
T19692C36279302427E8EB1BB5FC834D900EFD13AF8E5B745099E04D9119A1BC2AB955FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 930b8ee392fec2c83dd8db7d50242066139146ce49d258be2e99e5742c3fe327
MD5 01e209b1d49c0a26f2c7291390094936
SHA1 583a645377e81e094ce0db2a16ee1ad31ddeaa30
SHA512 cacca920965cc84e03bbb951e973948d0b675eb7bed514ec0d71da4092eb8aa496a449e8d881f97f22fca1921f12c1d99444a140cd1786b87bba9dc1b9b0b3fb
TLSH
T1BBE00212D30040BEC43C533444031B300BD6802501F102065D3001543C733102F31FD0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe5b3797.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5b3797.TMP
Size 392B
SHA256 f8762d8d2b7286479491d62a86fb520a483f8b2e50446d08a2a45559ee4a0bce
MD5 f02993696c6ea00e4e05c69f1be321de
SHA1 a0958a11b87ac8dd2d842f9c5ec40c04c241a5a1
SHA512 eab6701dde9dae01ff4ec6ae2fc692ecbd18d88b2693aa21c5e126aa4c36f4660289c97d51b9e5ddc0e4f9ac4b0b2d2cde85ce4a65e1032a2842f0876939f4e8
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 8fc62d30466ca4508ec24df9b24dd34e6ef6572ab5bf32f6c07d092e74525ea8
MD5 de5c30affbe3ecb1ac5069002571462c
SHA1 91a3d9c1c67359b3d7745a1477a06bb097f68813
SHA512 1f1b46ef21a3f4c674a505d93b763ec8d3e91ea3968b53802f26f569d8d7ca503e2d4d80e1c76bdd108208b2db3429cdf962875777d31d70f653a9747c7ed47a
SSDEEP 3:MsEllllkEthXllkl2zEEKt/:/M/xT02za
TLSH
T1E04404047FC00C45DD00303170D3C7500370F4500511D74735530C135CC75F00C04401
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 732B
SHA256 cb8ef7f24da42d8261a8c200448795c80fe123528996f9a778e764d154011823
MD5 f193e9ddc7acaf712b2c5d32d891f01b
SHA1 d42f240db1cef5b2d79892616f9a2104e6bee28a
SHA512 e1108d42c4b3fd167c609adbcdd1240b63af2f7a400a19253f661ba01206428e02dc239eba94a224f7a58b41e1c9c3289981ffe5b6e3061c55c407db12360454
TLSH
T19D01F4E15C7925D7C97E0EAE908727DC54D46562B09C74741CCCF964D17850D2491C7E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 f7102660d3670bd9965dbbd60c289be4c8b9d8ba6eed56b9b6360a15059d96a8
MD5 5ce120e35cd3f5ccc8b143f1cf74106f
SHA1 52e43b0973b76c2bbceec684c7cfe08e1fae70c8
SHA512 06a4bbcff384a3b0fac2b82001b15b04c1e37361bda90fb1a0f24eb944b07e94accdbfc4b4f1e6d0b7c2820c03634da8d8bdb23b6aad713776fb5851204426e7
TLSH
T192111FE15C7A19D2C4BE0EAFA0833AED50E8A222F49870382888FD68923D51D155187F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dd7bc84ed2f9555e6c33ea7dfdabb6d041d1a22333214c04a784a1ddbe2c19d8
MD5 b7e49fc52cda37d0a33ab9f82a7876b9
SHA1 7e88535e1e9600b7d547544b8bd05550e1cac293
SHA512 fd747247c2dafe87deb071b8f69557008e0ecf4cb77bdde3e32f391bab2c78c693b5adeca22bea4342edd05293ff110ab82c12cf6def55990cf9d814b876318d
TLSH
T1C3E0C0D0DC3A25D5C9B61F6FE44702E840D469277089687848CDE9A8E13A15F12418BE
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 852B
SHA256 e47becb373ef0c9171cf496e3ffa4ccc4ee3a81f66df695f4aa790c9cf715b60
MD5 be57cef35adeda4316a539031459d1d4
SHA1 2fc15e7441933f7bd0881e518119a537b408eb24
SHA512 eb641e69de397d66ac3cb388cbf256395c285506ae1116594c25052437e11038ff6ff34bab85f09483272dca521ae3ffa47449f3b3a8ede1cb3078db05110cf5
TLSH
T1C50141E14CBF25C7C97F0E6FA08726ED54D8A622F05870781CC8FA64917840D244187E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 612B
SHA256 886a0ed8050f9d127f465bd2040e87cd5eb8910e2cae6b5a4e6d7b483ceee596
MD5 dd8bd4305ff4d907ebffcc702af54603
SHA1 9b37fe5f3370ebe8d5ddf330e46c9c0ece240fe1
SHA512 e549a1410ae891ea994b5fe5551d21e35477fac7155930960658767ef25b396280a144378f62334daaf73c627058b54e5a8810b3b99e4bbe6edfb774913cb3a3
TLSH
T1BAF041E18C3A26C3C47A0EAFD08713EC50C4A523B09874781CCCF9A4C13980E148183F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 972B
SHA256 c3669aa4a87432e7e13b388c8bd8f452de599e1e6790d44ea2052cce719cb104
MD5 5e5ea259c881a4679aa804546232b7b0
SHA1 09fd3cf3898fe1fc85807b0c4647bf06fe18c7b0
SHA512 f2091b31b8af2819d4d5e65ae573e79bc588e4cd74b509885f9e6e56f790099b9f01b650fa1867a2f834c4b73dac9a2c9073f071b16390dc6eb6042b5b77e70c
TLSH
T1621104E15D7E19C7C5BF0E6FA0833AED50D8A622F49870781CC8ED54927850E155187F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 9504ad1a3f3ef4927e5ce1873a612a255d9056a85df9f8ab9ba878c2027de1a6
MD5 ebc95e2e57e199a5236f35c5bbcbaa9e
SHA1 f086ab5bac978c361d0b9246dc63b5beb9d74879
SHA512 0c89b368fadf323ed837b04d1504ce21831ae8a2aef53a2bfdf061b3c4cebe663c1de28bec4f52f96e4a6b03d90a038f15413a7f09974b7448fc242b0d2ce9f6
TLSH
T1B8310FE05C3D29D5C4BE0DBFB0CB35FC94D89722F494703868A8E968967DA1D254083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 a1e62c1c1018d49868c0f64d9b1962b8e8a8cbad217bd8b1ac0021b673c01597
MD5 90e469373869a40f6d9f9cac5507b4db
SHA1 0a57eafab16b7c7ca468ce933e2047197ce6dc60
SHA512 36ac263419a86c2e336aa462891495f441322cc03864eb58c05b8acb63ede9def53ee9e35339cba05d65f7b4d81e9d01bea13374540710d551503605e048d9e7
TLSH
T19C410EE05D3D2AD1D4BD0DBFB4CB39FC94D89622F494703878A8E969963DA1D258083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 13bb0f789b12a9d4214d5de1cb5f04b44db3e94b61e8fe1e118f5eb45fc8405e
MD5 49c0faa37cfc1e66edd50adf237f2c65
SHA1 734abd42400aaeb311037b98e7cdaa227fb0a050
SHA512 5d1b4d9fc412aa376ecd2b942f05def0ad5f3dc5399df8bbe798c52996bd37980a5fda7fbe756abcff0b246baa44cfc40fcc11c13b1cd734e311ea793db711a3
TLSH
T139F0DCE1CC3A35D7C8BA0E6E900717E8A4D46A17B0DCB87858CDEAA8D17A41F118187E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 426168bf0bc3327e71d9da29d0256f5b18bf4e0526c27cce153779d98bd09072
MD5 b201f3c2908e888d18b34d5605639ce9
SHA1 33ddc5671d31c2a9e1bcbf7a55ba6d4556832821
SHA512 8d8b6e6bd799cdbe21b0c081c2569eca7cae95d101767b3eaccd3734c0f568420392e4ddeca343d11d731769f33d3049abd0c34473faa94173822dab8ce8067f
TLSH
T18E311FE15C3D29D2C4BE0EAFA08736EC54E8D222F49470386898ED58963960E254087F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 0ce04c19e1ba609feffaeba173edc2abe2a2d382a6308c565cc4aee4c45fe928
MD5 c1255a9a96a584995062a598d64ee038
SHA1 a697d5b6038305f1d772e404dad85f806211c78c
SHA512 b96cd44f46aeb10d94aae81032804225f0ea31dbbd7b400882e2360514af48401c4b2a20ed68b17aaec75e8bcb61787ab26ff744fb26a927c5756bf8ffc1a6d6
TLSH
T11B3144E05C7D29D1C07E0DBFB08735EC54ECD212F49474392898ED68967D50D254087F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 c1c0c3d04b02aa010f7d3809e5961e3fe74eacb065c66f976f9ae4309e9048b1
MD5 ef94ea2c6c0601c55ff56a22a1c03cdb
SHA1 e1f4aff9d97456264a45fa205912fc64fddab6a4
SHA512 8f0a1421638b0300baa9683f610de2530d3476478b9fe70685f1eb2ec620e8fc08e52bfa6f20c49e894dfd86e36169e6cf1390a8cbde6b0a638e469b142f17ac
TLSH
T11A3100E05C7D29D2C4BE0DBFB08B35FC54D89322F8A470386898ED68963D61E254087F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 4dc65bd715918f91de4900eb13e3b9c95e8e110a1045e1c9f700e980eeb289a8
MD5 9d4c6e993585f3de6e180751bf038107
SHA1 f8df985c3b23129409d942b2fea64c66d12f2f56
SHA512 9d960447f356b380b4c7ccb2a999f14487cde9dd3fb763851e51ed0e8252ad3a8bdf845606ef5c704d8bac1a65c7b81071cfd700e76506df9c3f4ca57e236c69
TLSH
T1A441FEE05D3856D1D4BD0E7E70CB39EC85E8DB22F45034397C98E9589A7A61D248583F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 1c735e0e515376c011fa81b30fc841560ed7650399a168670dbaa9c03ee10c2d
MD5 98ddec7ce89a463f023a22f615b04ab7
SHA1 89900cd7cddcd4531c30a9697aa0fd9eacf9ed8d
SHA512 cec06c3d76e1c8a60239e3fdb333ce641c93b7ff2b632cc94a8db8fe98a775b22b5f8404e74b81433665a1d0bd68170b800d026aa0f53a31aae9f1272ed08ea2
TLSH
T188410FE05C396AE1D0BD0E7E74D739EC95DCD722F45470397898DA58867E60D248483F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 a1ddf47ab299c455e3d9efd9f3167bd5e589765d9324e75657a727041d305b78
MD5 c71b50f4c7f70367189f76e081c16246
SHA1 7f0be379cfba475303d322076b8e1e0d102a3d4f
SHA512 454a97e0196709d2b24a067ec5ce29cc750f76845fc978ef92cf09aa27f470481ae326167bce66c513622cb4a2a49844ef69841af6ff956801e8b8b7272d922f
TLSH
T1DD410DE05D392AE1D0BD0E6E749739FC95D8D722F46470393898E958867960D258483F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 1f411265174a025c4024d4c5abd2fb216020df7e6a7fbc6aabf65bc9b637534f
MD5 6b4aedb01cb16cc71898bbaa81bd6417
SHA1 68350698aa67be6a339d08a74db3a00beff8e53d
SHA512 2d11c5e9f456c4d4ac96833daed0ce9bf87a67a795fc8bd05ba35be7ce280c07591271be2627ac3828a68025783e633aba6c959be742747ed0eec8b099b13dc5
TLSH
T1EE2142E15C7E29D2C07E0DAFA0872AEC50EC9211F49830382898ED68967D61D259087F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 6db2db764bce07bbad50526c60226add96ab857bdf91a67613ea16bdbd378276
MD5 879681ec2b44854b9a1ed9b540373ea9
SHA1 69e0d20001066d28218c1b94b9313f3160f48594
SHA512 d2e984c3d39afc1607208e79ff89457baa20a657c60f40ef597d21c5bf29bf813c51a7e37fb46784cd6b4ee57b925e85ff1616d7adbb92973f0404dbfe98969d
TLSH
T1812114F15C7E19D2C47E0DAFB08726ED50D89251F49474382C98FD64923D61D154087F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 d7b5be61cb7479baac88a69158b11abf52b6fd608ba7e8a22fb77f84e86f8900
MD5 559ec598a93abcc0660018007bdf6db6
SHA1 e35b5c9da1f085d4a7220b86ff422813c00eba34
SHA512 47ff978ef038b7622e413b1dbd75436d2764af605be9a3926d9b72809500f8c760989bd05e5d3793eda6298b4719783115c5f93f5aa939dadd129ed8e369e08b
TLSH
T17E411EE05D382AE1D0BD0EBF74C739EC94E8D732F46470383898E968867A60D258083F
MD5 SHA1 SHA512 TLSH

Submit Download

299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b13f521a-1fd5-4d40-89f8-ea997b43a356.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\b13f521a-1fd5-4d40-89f8-ea997b43a356.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

metadata.json~RFe5a036c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json~RFe5a036c.TMP
Size 132B
SHA256 ea13d57b11af249f90704dbcafd354c5e80b10358db7edb9eaf8f6fd597eb1d4
MD5 ae3a19c226264ff6cb64877f1e7e7243
SHA1 f993431dbd09200fd92b7a04ee6711a54ad95cc9
SHA512 97e5dbf0663585afbb5e0f2b5a36192624eb2c898462abef65225987df632d30f74f05ac5a71175c4c59f75d9ae6d2e640d168e479cb26b9a6857c71efda029a
TLSH
T1C1C02B85CB1E0C854E78153D48420B2727819F0030508534445A490C41741CE00888CF
MD5 SHA1 SHA512 TLSH

Submit Download

d9ea63dc-d2c0-4b40-b3ce-8b48facaf751.tmp

Path C:\Users\Admin\AppData\Local\Temp\d9ea63dc-d2c0-4b40-b3ce-8b48facaf751.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1608_234439392\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ccba5a5986c77e43.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
Size 10KB
SHA256 024cfb384464b77e19106550d06973b9dda98af860026d1b7892f4901bc7db6b
MD5 12f2c6e637c71cf7ae124cc00b6c2c90
SHA1 4352f6700177d7123198ec8dfbcb3a19ae34493f
SHA512 73614ebfed0badb9b0bca436673d3def50a1d6cde17775f32b1d2dfaf28fb07fa8c701aa44e7834330af90a79354419385f0a3c326bebba22bda83e29ff1acfa
SSDEEP 96:2rwAJPQULMkwcMMjqBGJyudjcBGJVudjfwGJrudjn8rfGJnIudj+:UpaUQFMjSGEujwGfuj4G5ujnkGBIuj+
TLSH
T1762203005FE61E46F2F3AEB1A5726726FF77B9055A088A0E41D941090C72F449AADFB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Obfuscator.zip

Path C:\Users\Admin\Downloads\Obfuscator.zip
Size 274KB
SHA256 34a3a30d4425942aab3e9054c0050593ea75f466ff383782592643c9e7a6b87e
MD5 fbbba329c27b046be15ce090b7b0de64
SHA1 46d1222be911cdfb377da4fea283c08a14a68b0e
SHA512 eec1a27af38cdc4cb11d6708d5be9998eaece2e8b7406f54ea64dcf3d3ffa64d1d422f60626b66706eb6e95e8003ee03ad984098dc74784d70784db0017f68ca
SSDEEP 6144:73amJm0/Zo4GYMlLSN8Cdt+yVrLpXlO2+mn+yk357+a6:73tX/ZQYMlLA8CdwwpXA2N+FF+n
TLSH
T1E25413C69F4AE65FE04CF630549AD70512A38F863BA134497F34AC797C794922362BCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RykerPaid.js.crdownload

Path C:\Users\Admin\Downloads\RykerPaid.js.crdownload
Size 1.1MB
SHA256 43bb68d59d74ce8c8629c7ebf3005debfe5e055198a216052f4dbf02bc318d85
MD5 841e256f95a9ea06da37c9d9c7fb866d
SHA1 39fff9e88bb0acbefd99e195f23a40613817c7d1
SHA512 d87b07ce071ed7bec0b068727dd6124ec88eeaec6312cd82564894c483c684fe3e6950f1ebe14dcb8ad7351178e8e4429518934a2dd0525da58c5b4211081c7a
SSDEEP 12288:THOreuoTaSo0rEKjnLZhmE4iY+ZZ7313VNlILwyReC:ireuB/0YWLtVp13VNmLwyl
TLSH
T11C356D5A14FB207881E3B16E4BDB41493632D5137A0ADDA4FF9C82245FAA13846F3F9D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI8358.tmp

Path C:\Windows\Installer\MSI8358.tmp
Size 411KB
SHA256 ac54078e0387d2a8ddcdbee3967da6ea6ec6508172505aca3d27a75fa43ce34f
MD5 1981cd407f5b5e81c70ba2729c56b381
SHA1 e0b6d311930ab3557d5a0a8769edefb49c32aa3f
SHA512 3b7c18ca780cf05a01062661156d71e0a4626469f28040e46f07c7deb8f9a643b838bbc88eda515362c5895171a337a3f5d9b8e321e539408fc1ae47e6ae4181
SSDEEP 6144:GDvoaVoIMrKAzCsTI+q6JL9eZYr1JJS5qZ47BwhYjzmHim:QvoaVo/2WCsT7pXJS5qgBwhYg
TLSH
T135947B29B3E418EDD4B682B6C5A78430FF75744D332095AF8BA4916D1F3BAA470BB701
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5b7636.msi

Path C:\Windows\Installer\e5b7636.msi
Size 848KB
SHA256 9b5a284ef59186a406f17adba632320c9445283df25fc1d8c91e6cf9c0aebba6
MD5 6d87594596de8309932f98f4a86e0017
SHA1 e94732591daeae78ab4b7f1ba9ddf96400546b9b
SHA512 f4af95ad47758ef6705ebbe7bb1ac5299a0bed6536ff3ee83012c95a39240e59ce894e9cbfe6fe880ae828155722bcf2c2b0986d4a376ae97ba55e7e92e87974
SSDEEP 12288:8BGQ4cABdUb/aVo/2WCsT7pXJS5qgBwhYENSpP:8GyASwoO2T7RgZMYdt
TLSH
T193055A1BBF9414A9D8A24EB1C4B78321FE357C082320959F46A4B12DDEFB6E4647B7C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5b7642.msi

Path C:\Windows\Installer\e5b7642.msi
Size 28.0MB
SHA256 e82639829de6ee49da7b508ad629a747ec3a86b2ffab20f0f9983740644f32d3
MD5 a8dc7f3ac09e8736d0e57c4d47cd6d9c
SHA1 371115f7ee565dc16e4c4f721b80823fe1f45ddd
SHA512 47d78d3f510be0af5406e6c2c067138357a76645295fd6509af24e29ebcf769ce9f71214c2b2cafb14e8239a4e33878951f93faf3e13ea2fec826f358b63e10e
SSDEEP 786432:ORXHSvEHL1IPHptj74pZ2Mb3TJVQAWkBZ5TPMH:yXHjr1WHptIpZ2W96M7TE
TLSH
T10A5733277FE205FDD4268DB089B78770AE767C082721895B0664722DEEFB2E014B63D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hyph-bn.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4908_1283409437\hyph-bn.hyb
Size 703B
SHA256 c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
MD5 8961fdd3db036dd43002659a4e4a7365
SHA1 7b2fa321d50d5417e6c8d48145e86d15b7ff8321
SHA512 531ecec11d296a1ab3faeb2c7ac619da9d80c1054a2ccee8a5a0cd996346fea2a2fee159ac5a8d79b46a764a2aa8e542d6a79d86b3d7dda461e41b19c9bebe92
TLSH
T13001E1B0B7014F4BC635EDB0117A4A6D9664C43553BE051D84B1F9634F19714E70A8A8
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-mr.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4908_1283409437\hyph-mr.hyb
Size 687B
SHA256 f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
MD5 0807cf29fc4c5d7d87c1689eb2e0baaa
SHA1 d0914fb069469d47a36d339ca70164253fccf022
SHA512 5324fd47c94f5804bfa1aa6df952949915896a3fc77dccaed0eeffeafe995ce087faef035aecea6b4c864a16ad32de00055f55260af974f2c41afff14dce00f3
TLSH
T14801E178BE13888BC6784DB1054115AA0320F90EF296021B4262B13ACB18FD61C95484
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-nn.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4908_1283409437\hyph-nn.hyb
Size 141KB
SHA256 5bcbb58eaf65f13f6d039244d942f37c127344e3a0a2e6c32d08236945132809
MD5 f2d8fe158d5361fc1d4b794a7255835a
SHA1 6c8744fa70651f629ed887cb76b6bc1bed304af9
SHA512 946f4e41be624458b5e842a6241d43cd40369b2e0abc2cacf67d892b5f3d8a863a0e37e8120e11375b0bacb4651eedb8d324271d9a0c37527d4d54dd4905afab
SSDEEP 3072:pPTHXHEm69FrOP8d4hRLiinKL4Qshbv2fuOQXCxj+60EoM8WC5zgY:p73HEUP8dsiinTThjy90VKY
TLSH
T1C1E319F3A3394AC29420A8A4DF593B7E4044FA944D80E197B5EC2038E667CBC76D579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Staging

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4908_14884793\Mu\Staging
Size 36B
SHA256 411a706def2e70f96a507208bf80bceb93e950c4c2d671cd1ddb4134ce54b2a9
MD5 0163de1b14421d4eee3757ff76fd81e4
SHA1 96c75c4fe1e3f33a367f45293bd1bd8bff1c06f4
SHA512 80114d59db8f3654dd6821589e5ad03daa923a35610a372756a8865b3e769621e32ef2aed92c2494de2b9fc06d9796b12f1e3bb75873ed794e8c9ae8a0d5e965
MD5 SHA1 SHA512

Submit Download

BootstrapperApplicationData.xml

Path C:\Windows\TEMP\{DBC8D954-010A-482C-88C8-3CFFAFB549B4}\.ba\BootstrapperApplicationData.xml
Size 9KB
SHA256 ea4712ff76997fee669ac541f82d0701471eb301495fde62e50dba3b418b98b4
MD5 8a2948efbb7ec8a1b544086aead7b4e0
SHA1 57643916e9635753db4c06e09a3bcb1f2eaba339
SHA512 8c36ec4b1d9480b4e2303845fe9fa524ada14e2e53727f5bf8825efb81324a7efb2097b971e138709085c0a87dc3caea0b1f0812d9193511845d17ad67e09801
SSDEEP 192:B8zanZTsX/rv9RNnEXenqlaTaJjfAmcsCsysz:HnJusCsysz
TLSH
T15712E2113BFD0218F0F3AF48EFF6A5555A3ABD552E39C92D01201D0E49B2E819962FB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DotNetLogo_256x.png

Path C:\Windows\TEMP\{DBC8D954-010A-482C-88C8-3CFFAFB549B4}\.ba\DotNetLogo_256x.png
Size 2KB
SHA256 0f571f95d8eab48dbc81b0ec5e9f7225e349e26ef50868bfaab556f3c2443b01
MD5 39aa52615723b782c92dec710caaec7f
SHA1 760b49e256a7979fe50a56a2b1be3688a474b886
SHA512 89d1baa3820154667747b25e9e2fd321bfb2ec71dc309915b0a28dacdc80822a4943b639ebb37c37bd2559d5a4306d2096119cd970c84a0d331f6c68b0456dc9
TLSH
T1534195CF1BFD78D7E6E557918E1A8DD232738483B4B3A42CCE7B10B8274A5642B87940
MD5 SHA1 SHA512 TLSH

Submit Download

dotnet.ico

Path C:\Windows\TEMP\{DBC8D954-010A-482C-88C8-3CFFAFB549B4}\.ba\dotnet.ico
Size 44KB
SHA256 61a2cbd12868cb9b359e0c78961d409b7875f072eb8e53ea88d3e6bfe2961a18
MD5 b8096652d9ec286709a2c863b244b110
SHA1 b3b7f0f4d608fad7cb59ba499d4d17c2b873a7af
SHA512 492a5aa83220bb77c178b7c5b50bf44968c0427e9e45bb97a33df14d7fb4c667ca7adde0ebb3874c7b6011057b01144e4e6651fbad62c6bcf5e0b93586c4bc7a
SSDEEP 96:r+gfbzo+wHK9NbwOY4tIWQeVlV1W9+H+guapUjFamINUItzf1dBNaIZ:ro5HuNcH4tIzeVlV1WEOFDgUWzf1PIm
TLSH
T1E913EF6DE68547C1C10C2032DB4AC792B5233C72E4DAE0C4F9D4FA7E177906965C6E6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Windows\TEMP\{DBC8D954-010A-482C-88C8-3CFFAFB549B4}\.ba\thm.wxl
Size 7KB
SHA256 b00edd703dd8a475119d0e4dd70a3aaa47f0e95361af290e76d367a8edef3432
MD5 8b2c667a8bbad3153068c0ed90df7ec4
SHA1 c9e04a3a37e5e6262ab9bfecf78280171b8f7b74
SHA512 5269f00d474acccb4c48cb7bcfdf19e63557a388572d3a6335aa39191319691d924e27f70da3f3495387c319396476c63a8fd7b35835cca0901220e39783847b
SSDEEP 96:HiTgM1+XSNEzA0HtYQstYCpCwZQpCeyk5HQJM9ouvj9urz8:Ew9EmtYQstYCPC9e8
TLSH
T191E1026F68DFDEE03A732651B2B3698D6919C29A136F1CF0F869084B47635016377A03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.xml

Path C:\Windows\TEMP\{DBC8D954-010A-482C-88C8-3CFFAFB549B4}\.ba\thm.xml
Size 11KB
SHA256 dfee8e2d075087227f19c835c145c5bb8e72a46880ea24080bb2472fd3a521be
MD5 4329e418dc56b1386d7ea29a0dcfab5b
SHA1 58387f92e89ca21b4179fb697c7de9675c59142f
SHA512 6934873d27e6efbb94da4f13ee8369b29995490051016fdf82800256b924902306d328bf1d4ebbf266d1a53eb24adb6478d1a67de4ecc3e3bcbe561968f24922
SSDEEP 96:HgvPkoeWEH3IWTaQfSJgHzth5mFahbuB8pR5+Vpwe+UIJLg1gEp+6F5pQnxc:AvoWydmQfVHMyyj5Z
TLSH
T14B42FC6851DC7811C532D702AB9371D3FF12BDA6C6C85A58B48E256B1FF262028B739C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wixstdba.exe

Path C:\Windows\Temp\{DBC8D954-010A-482C-88C8-3CFFAFB549B4}\.ba\wixstdba.exe
Size 431KB
SHA256 e9aad13949cd910523bf9547fc5c23bd2c26595e024809a9f8fa866c8d8e555b
MD5 14e0c606e68508fa618bd5c514015577
SHA1 f8c28db9d2810e872f6ffe7607019851f250c5f9
SHA512 c29fedca692ca2f9c5e63f360aeb95399f2f15f1576a0d06fcf9f0919f6b658329973803bc870b0b1e954b0105757630ca3f4b3ac64f4b80e91742d612fd5b73
SSDEEP 6144:N7lQcp03E0PKVMP/PwMFJ3zdoZmb8LSQsCjzYkffTTp6EoNXJrprSU0e:Np6mM/wML3/QsJDLXJrow
TLSH
T16D942A3165F04023D6F94572E915FA30AF39F208670085EBA3C0DD297968AE6A7FB357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

windowsdesktop-runtime-10.0.11-win-x64.exe

Path C:\Windows\Temp\{DBC8D954-010A-482C-88C8-3CFFAFB549B4}\.be\windowsdesktop-runtime-10.0.11-win-x64.exe
Size 968KB
SHA256 1950ffbecb490c67326b9301c212ce4c0bbcdb9fbb883d1d855ee11f1f866739
MD5 e884480fadaeed6e10810ef7c8854bfa
SHA1 4510ae5b7b0fbc0e1f4b70a64f834dba1cd820c9
SHA512 bddbf08bfb3b608f4218b41676c6b8c67f28b7b4449696c5146fd12b9e7a9cde4657ee344fb998b0dbbd14a8a19f4b795dfbb368ed9799b953b18ae2b34d4100
SSDEEP 12288:j/hzPsOEX5eZbWC1I0iqm+4/Pm0zykD7xnawDmIRn1NnKQi2ejDkS:jZzPRq5eZbpTh47zykJawFRHKmKk
TLSH
T1A1256C31A566241BE6F40973F914D6307E28E7082B5C85B6C6D0DC0C79A89FA6FF724B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1972-1926-0x000001E4917F0000-0x000001E4917F1000-memory.dmp

Download

memory/1972-1928-0x000001E4917F0000-0x000001E4917F1000-memory.dmp

Download

memory/1972-1936-0x000001E4917F0000-0x000001E4917F1000-memory.dmp

Download

memory/1972-1937-0x000001E4917F0000-0x000001E4917F1000-memory.dmp

Download

memory/1972-1934-0x000001E4917F0000-0x000001E4917F1000-memory.dmp

Download

memory/1972-1932-0x000001E4917F0000-0x000001E4917F1000-memory.dmp

Download

memory/1972-1935-0x000001E4917F0000-0x000001E4917F1000-memory.dmp

Download

memory/1972-1933-0x000001E4917F0000-0x000001E4917F1000-memory.dmp

Download