mimikatz | b8200b8a6951f153b55cb09f7f3f5fceef571f87be6c0c7a8459ff11d00cd296

Resubmissions

22/08/2026, 04:10

260822-erlrvsvxbz8

22/08/2026, 03:46

22/08/2026, 02:51

22/08/2026, 02:41

22/08/2026, 02:31

20/08/2026, 01:07

Analysis

user interaction
yes
max time kernel
465s
max time network
466s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/08/2026, 02:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
sample.html
Size 293KB
Sample260822-db99vavtew
SHA256 b8200b8a6951f153b55cb09f7f3f5fceef571f87be6c0c7a8459ff11d00cd296
MD5 4b9c577f4c7e20896c62079fa62d1a60
SHA1 12bad677637d19d587c0878d96c3785c4d9c611d
SHA512 7dc10547b3280beddc37f9b44bafc9b3e6ff073fe275cde442bfcb196fe661fc29adc7389db3bdb580ea62c08d2f39976080c76f31565b3403d1f3cc24336c3e
SSDEEP 3072:GYEDmwzqMgpRbIJ6PFtlf7wVG0/yb5QQ/3IkWXFhy5hL1:GYEDmwzqXpdIJ6B7wVGpVd3IPUL1
TLSH
T10D545B726200B43BB913DDA093BE7F0E3C26E26BDC0646F8A595E534CBE2EB1151671D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware bootkit discovery execution mimikatz persistence spyware stealer

Malware Config

Signatures

Family: Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
mimikatz

mimikatz is an open source tool to dump credentials on Windows 1 IoCs

resource	yara_rule
behavioral1/files/0x0018000000016805-686.dat	mimikatz

Executes dropped EXE 1 IoCs

pid	Process
1868	CCBC.tmp

Loads dropped DLL 3 IoCs

pid	Process
4624	rundll32.exe
5672	rundll32.exe
5784	rundll32.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Contacts third-party web service commonly abused for C2 1 TTPs 8 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
190	raw.githubusercontent.com
191	raw.githubusercontent.com
192	raw.githubusercontent.com
490	raw.githubusercontent.com
491	raw.githubusercontent.com
187	raw.githubusercontent.com
188	raw.githubusercontent.com
189	raw.githubusercontent.com

Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	rundll32.exe
File opened for modification	\??\PhysicalDrive0	tunamor.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FORMS\1033\SHARING.CFG	rundll32.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Web Server Extensions\16\BIN\1033\FPEXT.MSG	rundll32.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Archive.zip	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\DefaultID.pdf	rundll32.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\include\jvmticmlr.h	rundll32.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.PPT	rundll32.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FORMS\1033\APPT.CFG	rundll32.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FORMS\1033\CNFRES.CFG	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\HomeBanner_Dark.pdf	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\HomeBanner_Light.pdf	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\Adobe Cloud Services.pdf	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Welcome.pdf	rundll32.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\deploy\ffjcext.zip	rundll32.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FORMS\1033\NOTE.CFG	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\ENUtxt.pdf	rundll32.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC	rundll32.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\include\jdwpTransport.h	rundll32.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FORMS\1033\INFOMAIL.CFG	rundll32.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FORMS\1033\SIGN.CFG	rundll32.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FORMS\1033\TASK.CFG	rundll32.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FORMS\1033\TASKDEC.CFG	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\PDFSigQFormalRep.pdf	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\Words.pdf	rundll32.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FORMS\1033\OMSMMS.CFG	rundll32.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FORMS\1033\REPORT.CFG	rundll32.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FORMS\1033\TASKACC.CFG	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\MobileAcrobatCard_Dark.pdf	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\MobileAcrobatCard_Light.pdf	rundll32.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\include\win32\jni_md.h	rundll32.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FORMS\1033\SCHDREQ.CFG	rundll32.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FORMS\1033\SCHDREST.CFG	rundll32.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\include\win32\bridge\AccessBridgeCallbacks.h	rundll32.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\javafx-src.zip	rundll32.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.XLS	rundll32.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FORMS\1033\CNFNOT.CFG	rundll32.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FORMS\1033\DOC.CFG	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\MobileScanCard_Light.pdf	rundll32.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FORMS\1033\POST.CFG	rundll32.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FORMS\1033\SECREC.CFG	rundll32.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FORMS\1033\SECURE.CFG	rundll32.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\amd64\jvm.cfg	rundll32.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\include\classfile_constants.h	rundll32.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FORMS\1033\DISTLIST.CFG	rundll32.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FORMS\1033\EXITEM.CFG	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\MobileScanCard_Dark.pdf	rundll32.exe
File opened for modification	C:\Program Files\Microsoft Office\Office16\OSPP.VBS	rundll32.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.PPT	rundll32.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.XLS	rundll32.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FORMS\1033\CONTACT.CFG	rundll32.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FORMS\1033\OOFTMPL.CFG	rundll32.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FORMS\1033\SMIMEE.CFG	rundll32.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SAMPLES\SOLVSAMP.XLS	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\AdobeID.pdf	rundll32.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC	rundll32.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FORMS\1033\OMSSMS.CFG	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\SignHere.pdf	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\Adobe Sign White Paper.pdf	rundll32.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\OUTLPERF.H	rundll32.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FORMS\1033\REC.CFG	rundll32.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FORMS\1033\SCHDCNCL.CFG	rundll32.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FORMS\1033\SMIMES.CFG	rundll32.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\java.settings.cfg	rundll32.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\include\jni.h	rundll32.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\include\jvmti.h	rundll32.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File created	C:\Windows\perfc.dat	NotPetya.exe
File opened for modification	C:\Windows\perfc.dat	rundll32.exe
File created	C:\Windows\perfc	rundll32.exe
File created	C:\Windows\dllhost.dat	rundll32.exe
File created	C:\Windows\perfc.dat	NotPetya.exe
File opened for modification	C:\Windows\perfc.dat	rundll32.exe
File created	C:\Windows\perfc.dat	NotPetya.exe
File opened for modification	C:\Windows\perfc.dat	rundll32.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pikachu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	shutdown.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NotPetya.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NotPetya.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pikachu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pikachu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tunamor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	shutdown.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NotPetya.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3664	msedge.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	OUTLOOK.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	OUTLOOK.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	OUTLOOK.EXE

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	OUTLOOK.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\OUTLOOK.EXE = "10001"	OUTLOOK.EXE

Modifies data under HKEY_USERS 17 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "72"	LogonUI.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134318406887442703"	msedge.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe

Modifies registry class 12 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-668679576-120646659-2289335452-1000\{253D7AA2-D5AC-4D28-96E0-837FA2E8C04D}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings	OpenWith.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5208	schtasks.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
3380	OUTLOOK.EXE

Suspicious behavior: EnumeratesProcesses 15 IoCs

pid	Process
4624	rundll32.exe
4624	rundll32.exe
1868	CCBC.tmp
1868	CCBC.tmp
1868	CCBC.tmp
1868	CCBC.tmp
1868	CCBC.tmp
1868	CCBC.tmp
1868	CCBC.tmp
5672	rundll32.exe
5672	rundll32.exe
5784	rundll32.exe
5784	rundll32.exe
5924	msedge.exe
5924	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 19 IoCs

pid	Process
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4624	rundll32.exe
Token: SeDebugPrivilege	4624	rundll32.exe
Token: SeTcbPrivilege	4624	rundll32.exe
Token: SeDebugPrivilege	1868	CCBC.tmp
Token: SeShutdownPrivilege	5672	rundll32.exe
Token: SeDebugPrivilege	5672	rundll32.exe
Token: SeTcbPrivilege	5672	rundll32.exe
Token: SeShutdownPrivilege	5784	rundll32.exe
Token: SeDebugPrivilege	5784	rundll32.exe
Token: SeTcbPrivilege	5784	rundll32.exe
Token: SeShutdownPrivilege	372	shutdown.exe
Token: SeRemoteShutdownPrivilege	372	shutdown.exe
Token: SeShutdownPrivilege	5896	shutdown.exe
Token: SeRemoteShutdownPrivilege	5896	shutdown.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe

Suspicious use of SendNotifyMessage 50 IoCs

pid	Process
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
3380	OUTLOOK.EXE
3380	OUTLOOK.EXE
3380	OUTLOOK.EXE
3380	OUTLOOK.EXE
3380	OUTLOOK.EXE
3380	OUTLOOK.EXE
3380	OUTLOOK.EXE
3380	OUTLOOK.EXE

Suspicious use of SetWindowsHookEx 15 IoCs

pid	Process
460	NotPetya.exe
5624	NotPetya.exe
5736	NotPetya.exe
5176	OpenWith.exe
4544	Pikachu.exe
3380	OUTLOOK.EXE
3380	OUTLOOK.EXE
3380	OUTLOOK.EXE
3380	OUTLOOK.EXE
3380	OUTLOOK.EXE
5200	Pikachu.exe
3380	OUTLOOK.EXE
3304	Pikachu.exe
3156	tunamor.exe
4856	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4144 wrote to memory of 2632	4144	msedge.exe	87
PID 4144 wrote to memory of 3984	4144	msedge.exe	89
PID 4144 wrote to memory of 3664	4144	msedge.exe	90
PID 4144 wrote to memory of 3984	4144	msedge.exe	89
PID 4144 wrote to memory of 3984	4144	msedge.exe	89
PID 4144 wrote to memory of 4648	4144	msedge.exe	91
PID 4144 wrote to memory of 4648	4144	msedge.exe	91
PID 4144 wrote to memory of 4272	4144	msedge.exe	92
PID 4144 wrote to memory of 4272	4144	msedge.exe	92
PID 4144 wrote to memory of 2100	4144	msedge.exe	93
PID 4144 wrote to memory of 4272	4144	msedge.exe	92
PID 4144 wrote to memory of 2100	4144	msedge.exe	93
PID 4144 wrote to memory of 2100	4144	msedge.exe	93
PID 4144 wrote to memory of 3772	4144	msedge.exe	94
PID 4144 wrote to memory of 1240	4144	msedge.exe	95
PID 4144 wrote to memory of 3772	4144	msedge.exe	94
PID 4144 wrote to memory of 3772	4144	msedge.exe	94
PID 4144 wrote to memory of 1240	4144	msedge.exe	95
PID 4144 wrote to memory of 1240	4144	msedge.exe	95
PID 4144 wrote to memory of 2712	4144	msedge.exe	100
PID 4144 wrote to memory of 3108	4144	msedge.exe	99
PID 4144 wrote to memory of 2712	4144	msedge.exe	100
PID 4144 wrote to memory of 3108	4144	msedge.exe	99
PID 4144 wrote to memory of 3924	4144	msedge.exe	102
PID 4144 wrote to memory of 4056	4144	msedge.exe	104
PID 4144 wrote to memory of 4056	4144	msedge.exe	104
PID 4144 wrote to memory of 3156	4144	msedge.exe	105
PID 4144 wrote to memory of 3156	4144	msedge.exe	105
PID 4144 wrote to memory of 3156	4144	msedge.exe	105
PID 4144 wrote to memory of 2656	4144	msedge.exe	106
PID 4144 wrote to memory of 2656	4144	msedge.exe	106
PID 4144 wrote to memory of 2656	4144	msedge.exe	106
PID 4144 wrote to memory of 3792	4144	msedge.exe	107
PID 4144 wrote to memory of 3792	4144	msedge.exe	107
PID 4144 wrote to memory of 3792	4144	msedge.exe	107
PID 4144 wrote to memory of 3036	4144	msedge.exe	108
PID 4144 wrote to memory of 3036	4144	msedge.exe	108
PID 4144 wrote to memory of 3036	4144	msedge.exe	108
PID 4144 wrote to memory of 1308	4144	msedge.exe	114
PID 4144 wrote to memory of 1680	4144	msedge.exe	115
PID 4144 wrote to memory of 4876	4144	msedge.exe	116
PID 4144 wrote to memory of 1660	4144	msedge.exe	121
PID 4144 wrote to memory of 1660	4144	msedge.exe	121
PID 4144 wrote to memory of 1660	4144	msedge.exe	121
PID 4144 wrote to memory of 4684	4144	msedge.exe	122
PID 4144 wrote to memory of 4684	4144	msedge.exe	122
PID 4144 wrote to memory of 1680	4144	msedge.exe	123
PID 4144 wrote to memory of 1680	4144	msedge.exe	123
PID 4144 wrote to memory of 568	4144	msedge.exe	124
PID 4144 wrote to memory of 568	4144	msedge.exe	124
PID 4144 wrote to memory of 568	4144	msedge.exe	124
PID 4144 wrote to memory of 4340	4144	msedge.exe	125
PID 460 wrote to memory of 4624	460	NotPetya.exe	129
PID 4624 wrote to memory of 2380	4624	rundll32.exe	130
PID 4624 wrote to memory of 1868	4624	rundll32.exe	131
PID 2380 wrote to memory of 5208	2380	cmd.exe	134
PID 5624 wrote to memory of 5672	5624	NotPetya.exe	137
PID 5736 wrote to memory of 5784	5736	NotPetya.exe	139
PID 4144 wrote to memory of 5924	4144	msedge.exe	140
PID 4144 wrote to memory of 5288	4144	msedge.exe	141
PID 4144 wrote to memory of 5288	4144	msedge.exe	141
PID 4144 wrote to memory of 5288	4144	msedge.exe	141
PID 4144 wrote to memory of 5912	4144	msedge.exe	142
PID 4144 wrote to memory of 5912	4144	msedge.exe	142

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ff9c878c188,0x7ff9c878c194,0x7ff9c878c1a0
  2⤵
  PID:2632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1628,i,13432251187447743986,8263518383539389348,262144 --field-trial-handle=3020,i,10547838596242557846,14559581234250600133,262144 --variations-seed-version --mojo-platform-channel-handle=3016 /prefetch:2
  2⤵
  PID:3984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1868,i,2212191997617920207,5583077327259613046,524288 --field-trial-handle=3020,i,10547838596242557846,14559581234250600133,262144 --variations-seed-version --mojo-platform-channel-handle=3056 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2260,i,11845011638881952870,8672063416147426928,524288 --field-trial-handle=3020,i,10547838596242557846,14559581234250600133,262144 --variations-seed-version --mojo-platform-channel-handle=3092 /prefetch:8
  2⤵
  PID:4648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3424,i,16652080115826671835,4979045972849777870,2097152 --field-trial-handle=3020,i,10547838596242557846,14559581234250600133,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:4272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3428,i,359456152674128959,16382174836462264142,2097152 --field-trial-handle=3020,i,10547838596242557846,14559581234250600133,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:2100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4192,i,4922530924702233980,11452655400113140432,2097152 --field-trial-handle=3020,i,10547838596242557846,14559581234250600133,262144 --variations-seed-version --mojo-platform-channel-handle=4208 /prefetch:1
  2⤵
  PID:3772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4224,i,1685167968376205974,12243371239639564995,2097152 --field-trial-handle=3020,i,10547838596242557846,14559581234250600133,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:2
  2⤵
  PID:1240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5124,i,14272150031576761449,4689249487104567504,524288 --field-trial-handle=3020,i,10547838596242557846,14559581234250600133,262144 --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:8
  2⤵
  PID:3108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5036,i,4799676304620282485,1770668103214606139,524288 --field-trial-handle=3020,i,10547838596242557846,14559581234250600133,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:8
  2⤵
  PID:2712
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5860,i,3360029385760352279,7410139999357441857,524288 --field-trial-handle=3020,i,10547838596242557846,14559581234250600133,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:8
  2⤵
  PID:2520
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5860,i,3360029385760352279,7410139999357441857,524288 --field-trial-handle=3020,i,10547838596242557846,14559581234250600133,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:8
  2⤵
  PID:3924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6588,i,18429067424483755766,7852701944764384398,524288 --field-trial-handle=3020,i,10547838596242557846,14559581234250600133,262144 --variations-seed-version --mojo-platform-channel-handle=6596 /prefetch:8
  2⤵
  PID:4056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=4256,i,17103674219614008643,16407409899076747605,2097152 --field-trial-handle=3020,i,10547838596242557846,14559581234250600133,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:1
  2⤵
  PID:3156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=4540,i,8353638927015696400,11966043906019869970,2097152 --field-trial-handle=3020,i,10547838596242557846,14559581234250600133,262144 --variations-seed-version --mojo-platform-channel-handle=3672 /prefetch:1
  2⤵
  PID:2656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6980,i,7800745054128151863,13116997983321660419,2097152 --field-trial-handle=3020,i,10547838596242557846,14559581234250600133,262144 --variations-seed-version --mojo-platform-channel-handle=6864 /prefetch:1
  2⤵
  PID:3792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=5116,i,7234456352837377193,4210831821767830506,2097152 --field-trial-handle=3020,i,10547838596242557846,14559581234250600133,262144 --variations-seed-version --mojo-platform-channel-handle=7084 /prefetch:1
  2⤵
  PID:3036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4532,i,976938134751913673,13347475286975169327,524288 --field-trial-handle=3020,i,10547838596242557846,14559581234250600133,262144 --variations-seed-version --mojo-platform-channel-handle=6736 /prefetch:8
  2⤵
  PID:1308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4504,i,17622967867222397960,12364351560503539226,524288 --field-trial-handle=3020,i,10547838596242557846,14559581234250600133,262144 --variations-seed-version --mojo-platform-channel-handle=6584 /prefetch:8
  2⤵
  PID:1680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3624,i,1783906724008338986,6810954641997092941,524288 --field-trial-handle=3020,i,10547838596242557846,14559581234250600133,262144 --variations-seed-version --mojo-platform-channel-handle=6740 /prefetch:8
  2⤵
  PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=5156,i,10729527003972334800,8489763044258149481,2097152 --field-trial-handle=3020,i,10547838596242557846,14559581234250600133,262144 --variations-seed-version --mojo-platform-channel-handle=2660 /prefetch:1
  2⤵
  PID:1660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5972,i,2134929465736676924,7205276478213573551,524288 --field-trial-handle=3020,i,10547838596242557846,14559581234250600133,262144 --variations-seed-version --mojo-platform-channel-handle=5912 /prefetch:8
  2⤵
  PID:4684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7268,i,6807849107736686118,17478403914267854001,524288 --field-trial-handle=3020,i,10547838596242557846,14559581234250600133,262144 --variations-seed-version --mojo-platform-channel-handle=7256 /prefetch:8
  2⤵
  PID:1680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=7272,i,417105122721980830,2454272823785833405,2097152 --field-trial-handle=3020,i,10547838596242557846,14559581234250600133,262144 --variations-seed-version --mojo-platform-channel-handle=7276 /prefetch:1
  2⤵
  PID:568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7172,i,5560654715905288031,11378486100003730833,524288 --field-trial-handle=3020,i,10547838596242557846,14559581234250600133,262144 --variations-seed-version --mojo-platform-channel-handle=7612 /prefetch:8
  2⤵
  PID:4340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7592,i,16150508657815749471,9747371947762070160,262144 --field-trial-handle=3020,i,10547838596242557846,14559581234250600133,262144 --variations-seed-version --mojo-platform-channel-handle=6756 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=5480,i,14075986573860417390,4093628052670870894,2097152 --field-trial-handle=3020,i,10547838596242557846,14559581234250600133,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:1
  2⤵
  PID:5288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=7612,i,73621123302197343,14054805309043048185,2097152 --field-trial-handle=3020,i,10547838596242557846,14559581234250600133,262144 --variations-seed-version --mojo-platform-channel-handle=7296 /prefetch:1
  2⤵
  PID:5912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=7768,i,2968023528836643658,10270225725213720892,2097152 --field-trial-handle=3020,i,10547838596242557846,14559581234250600133,262144 --variations-seed-version --mojo-platform-channel-handle=7368 /prefetch:1
  2⤵
  PID:5956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=7412,i,1309989868055304824,17201914119816176778,2097152 --field-trial-handle=3020,i,10547838596242557846,14559581234250600133,262144 --variations-seed-version --mojo-platform-channel-handle=7748 /prefetch:1
  2⤵
  PID:5020
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5436,i,11377776236492516181,16701148708823267464,524288 --field-trial-handle=3020,i,10547838596242557846,14559581234250600133,262144 --variations-seed-version --mojo-platform-channel-handle=7536 /prefetch:8
  2⤵
  PID:5816
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5436,i,11377776236492516181,16701148708823267464,524288 --field-trial-handle=3020,i,10547838596242557846,14559581234250600133,262144 --variations-seed-version --mojo-platform-channel-handle=7536 /prefetch:8
  2⤵
  PID:5796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=5372,i,2884535181199778220,6302056798326157549,2097152 --field-trial-handle=3020,i,10547838596242557846,14559581234250600133,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:1
  2⤵
  PID:5904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6556,i,18073621742912651796,4714937504687350311,524288 --field-trial-handle=3020,i,10547838596242557846,14559581234250600133,262144 --variations-seed-version --mojo-platform-channel-handle=4132 /prefetch:8
  2⤵
  PID:5608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5320,i,7755254547088736606,9845111895728816113,524288 --field-trial-handle=3020,i,10547838596242557846,14559581234250600133,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:8
  2⤵
  PID:2436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2696,i,4792270175355296887,4609815197220381369,524288 --field-trial-handle=3020,i,10547838596242557846,14559581234250600133,262144 --variations-seed-version --mojo-platform-channel-handle=5452 /prefetch:8
  2⤵
  PID:5648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=7872,i,11121862924876339330,8490918359008842290,2097152 --field-trial-handle=3020,i,10547838596242557846,14559581234250600133,262144 --variations-seed-version --mojo-platform-channel-handle=7868 /prefetch:1
  2⤵
  PID:5788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7256,i,5695056832714351381,13114482760467577724,524288 --field-trial-handle=3020,i,10547838596242557846,14559581234250600133,262144 --variations-seed-version --mojo-platform-channel-handle=760 /prefetch:8
  2⤵
  PID:3572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5308,i,9627113092843729529,15986462850505596980,524288 --field-trial-handle=3020,i,10547838596242557846,14559581234250600133,262144 --variations-seed-version --mojo-platform-channel-handle=7316 /prefetch:8
  2⤵
  PID:4924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=5408,i,1184060014998601368,13205875544475279282,2097152 --field-trial-handle=3020,i,10547838596242557846,14559581234250600133,262144 --variations-seed-version --mojo-platform-channel-handle=7852 /prefetch:1
  2⤵
  PID:6116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5244,i,6281012854798182876,8216597462138285191,524288 --field-trial-handle=3020,i,10547838596242557846,14559581234250600133,262144 --variations-seed-version --mojo-platform-channel-handle=8080 /prefetch:8
  2⤵
  PID:5760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7352,i,9839465741548395890,13086021660048130243,524288 --field-trial-handle=3020,i,10547838596242557846,14559581234250600133,262144 --variations-seed-version --mojo-platform-channel-handle=6760 /prefetch:8
  2⤵
  PID:5932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --always-read-main-dll --metrics-shmem-handle=5140,i,13698827753761633854,17686316258091075835,2097152 --field-trial-handle=3020,i,10547838596242557846,14559581234250600133,262144 --variations-seed-version --mojo-platform-channel-handle=4028 /prefetch:1
  2⤵
  PID:5772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1296,i,11230489964966178010,15173196056584258293,524288 --field-trial-handle=3020,i,10547838596242557846,14559581234250600133,262144 --variations-seed-version --mojo-platform-channel-handle=7284 /prefetch:8
  2⤵
  PID:2320

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1308

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4020

C:\Users\Admin\Downloads\notpetya\NotPetya.exe
"C:\Users\Admin\Downloads\notpetya\NotPetya.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:460
- C:\Windows\SysWOW64\rundll32.exe
  "C:\Windows\System32\rundll32.exe" C:\Windows\perfc.dat #1
  2⤵
  - Loads dropped DLL
  - Writes to the Master Boot Record (MBR)
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4624
- - C:\Windows\SysWOW64\cmd.exe
    /c schtasks /Create /SC once /TN "" /TR "C:\Windows\system32\shutdown.exe /r /f" /ST 04:55
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2380
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /Create /SC once /TN "" /TR "C:\Windows\system32\shutdown.exe /r /f" /ST 04:55
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:5208
- - C:\Users\Admin\AppData\Local\Temp\CCBC.tmp
    "C:\Users\Admin\AppData\Local\Temp\CCBC.tmp" \\.\pipe\{9851BDC7-4AF3-4DB8-9BFF-DB5AE75C8618}
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1868

C:\Users\Admin\Downloads\notpetya\NotPetya.exe
"C:\Users\Admin\Downloads\notpetya\NotPetya.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5624
- C:\Windows\SysWOW64\rundll32.exe
  "C:\Windows\System32\rundll32.exe" C:\Windows\perfc.dat #1
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5672

C:\Users\Admin\Downloads\notpetya\NotPetya.exe
"C:\Users\Admin\Downloads\notpetya\NotPetya.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5736
- C:\Windows\SysWOW64\rundll32.exe
  "C:\Windows\System32\rundll32.exe" C:\Windows\perfc.dat #1
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5784

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5176

C:\Users\Admin\Downloads\pikachu\Pikachu.exe
"C:\Users\Admin\Downloads\pikachu\Pikachu.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4544

C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE
"C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE" -Embedding
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:3380

C:\Users\Admin\Downloads\pikachu\Pikachu.exe
"C:\Users\Admin\Downloads\pikachu\Pikachu.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5200

C:\Users\Admin\Downloads\pikachu\Pikachu.exe
"C:\Users\Admin\Downloads\pikachu\Pikachu.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3304

C:\Users\Admin\Downloads\monsterv2\tunamor.exe
"C:\Users\Admin\Downloads\monsterv2\tunamor.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3156
- C:\Windows\SysWOW64\shutdown.exe
  shutdown.exe -r -f -t 0
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:5896
- C:\Windows\SysWOW64\shutdown.exe
  C:\Windows\System32\shutdown.exe -r -f -t 0
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:372

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa391f855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:4856

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding
1⤵
PID:5704

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding
1⤵
PID:5276

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding
1⤵
PID:4756

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AUTOEXEC.BAT

Path C:\AUTOEXEC.BAT
Size 68B
SHA256 b1d06274db9b93fdf229e106a4b19b50676f94bef0762dd0bc26b16f07050705
MD5 0f1916e9bbf740149210c5ffaa88158d
SHA1 40f020e60fd31355bd4a7c6916ffdef000a0f5f0
SHA512 6bd6fa7706f91ea2e0363e9a2bb0cbf6d28e0e3dc48a6d32a65966aac58c3d38ed7836ddc5afb69c570172ee7143c8664bcc93393b88d9a442bad451519d78ef
TLSH
T121A002BE4BE341E0F0204896420FCF31426CB8E6F021B0A03642A4D8F8054667D14CAC
MD5 SHA1 SHA512 TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 ab3ce76a66a9c138c660dda911d2c4789271af45c0b29e4ed55e06b18349338d
MD5 2694524dbc8acd5d9484f8e682d92dc8
SHA1 74e91a040b3c4774fd00c02a0af37f93f990c81e
SHA512 3a1c7dddb3ed7b37770a601e2b66c322e9242bdc01b65cd30239503d68540e1eee243b9c5b01f554d8e4e294540f42e63699150ca900fbf7ddadbcdd7a4d54e0
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7T:fwUQC5VwBIiElEd2K57P7T
TLSH
T1D7B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 16KB
SHA256 814d47aad78c212b52568b9c7b58d242899d490d3afebce66181cae50c880df5
MD5 8c7cdfea4284ba987d295d82a9c7ddd6
SHA1 7d1a3a66f2d64a383b230196ba89a263ce7ee957
SHA512 59c8229e834c944265aed4131c79f41f9f940a48651b9fb18800cef5bae36d17c7fd5880120c6fee8ce22a157b65bc63846b65765bc4dc86e15926dcce400d0d
SSDEEP 12:sf9iXhV0xoUZxCe+JKlkQuMRxCb8TXuYJ0IJpPK6BsyW1inPiz:U9iRqxoUZxWMk8xVTeYWI31BtXP
TLSH
T105724C85B34498FFC8835E7189BD27903774F6DF1F02866B6A6A760E2E271C84F44224
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1c8e6fcbb66aba64fe595f222fc4117e00e82ccdc0eef2100a1b4f7babb04f87
MD5 398d1e7948d46a763209c466fdacd0fb
SHA1 b26f2c32bc106089a59ce779d792beaba59f92bf
SHA512 a0bbf31d803e7333d004f03de9c261732d00cceb5d82dd64b5f0decf8adc8b840891187c72bb21cce83873e6d4dd2fab89d4c7efa320afe2ef3589678dcb1424
TLSH
T1B6D080277A196004F3964175A483D7061319956129575711F310C44CA9775D553C11C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5d2c4e39ddbeb0ac61628bae04f1ac5787600ec893b0e230d1a84d61470771a9
MD5 cd6e704306442404371caebfec7f5b29
SHA1 e4beab8b7820af3633bf7c75a5498a958a95832e
SHA512 de66681a9245e8ece7d7e2ea2080251c395f2aeb8a885ac007eaf16f2ee3a3e36610d2afc17be964a038704371cedfbe4da91143ebed5adac20dbda97768d6e6
TLSH
T13AD080273A196404F7964175A483D7061319956129579712F310C44C99775D553C11C2
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 352B
SHA256 2b3a4ad92f80c2dffc08d643e7afae2e7c20ed2b4638e982a6d7750388595e6a
MD5 27155aeea23ca5df0c6e5bc9f4c92c64
SHA1 2e21126a2ecfb15e30f4a2ab45b38a787d4ae2f1
SHA512 5c055b1540e98fe639cc875298cad6001ac0a17cd6d3d1a481035eb2bf0a1de0d19518c8a8d315ba9aaa7fc440e2cb5db013cebd90eecdc24f732152d3e9980f
TLSH
T18BE0DF7F16F5C2A90E03978BE6D8F61C4C11710FDADCD85E230A60CC64E4081725C584
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 158B
SHA256 9348d432e06f74d951db7f8e1614fd5c17a944bcfe3da81a90e03707060d50aa
MD5 0c322daaa89f4064e13b86d401d8f364
SHA1 3767156ca999aa0aa2ddba1717fd2a641f2ce31a
SHA512 7d9a9595bcf9d305ed1f98e30e00e9fecd5ad5b1b76ebb2c6a30cf2cfb4abc6fd1a7d96dbcf51fcf947e2af0a3a831987f34be39a13c1e7dcb5d7b0361db1455
TLSH
T12AC08059BD4C845FC28018BE5726F000176055519417D6570650FDD032407A01F2D264
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_0000bb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000bb
Size 60KB
SHA256 da9ccc6f173123e866b7c028a8cbf6291ee690a2668632d6e7c5580a39a73f25
MD5 d50c83e3a7238000d6154bb3b40c2cbb
SHA1 9d2ac1cd5568fc9d77ab690af0606adc6400b4a8
SHA512 d7bff51b2ce00f3f6667f1a42108709e0486e16293d2a1095c99cce09160af7aa7b3c5879dbafd165554f9fb1f097d9624999198072b6ca7c3418587ebd0f95a
SSDEEP 1536:TSdcVxNLsXuCzizS3TkCWJIap5ObPxP4Kt:TSdcVf2u94rm3pEC8
TLSH
T1B85302E632262FCCD22118FA957197CEAA207EC5432B845DB5D2E1439D99B2F8E7C490
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000bd

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000bd
Size 72KB
SHA256 0156b2821bb7e6a980a9d531ef5838af7879b36860dfa3cc91cea563111026fd
MD5 dbfa409037c32fdc18bffa76d752d5be
SHA1 72ac60c333e6c0f681ee0cfe1ca12b306dc684d6
SHA512 8b156ec696ae87dd88ffe6cc8148c92a4a8467685fd901e41f1b09dd72f9eb1bcfe2c1cdba2cf631fdbe4fd7472ac253ed9d6c3956b8c23559c081fd6f541853
SSDEEP 1536:LQtrwYZn2ARCxwLaZpDsODO9K9mhO5OGQ2RuwlKDiGO4o5AkLPr3PGCe2Os7B:AXZn2YCAYbDQKT5OGP1lwD9QD3OCn
TLSH
T16F73020763FE83F1AD3A09AB8716653209C5582CD66330D872836D6CF1EA0C65DDEC9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000109

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000109
Size 312KB
SHA256 0b6251fd38152a7a7319d54a8e993417dfe359650a9581c135c3950fe5704861
MD5 932d4b5eb7460fda1f102de6f7149790
SHA1 fadbac31c043b89a72bf3abf502f9ee53ccbf86c
SHA512 eaad89143b37482972189a3ff86698a7ae3332c42248d177fc74e0ec6aa9e1756a0699cb77d3b83cd815e2651df267c0cca4e9866d7a59a26d0dbeadb060189d
SSDEEP 6144:Y87U1JYBYrHsCcjPUrsgrwz9Ot6mjoSF7SI/5Czsl/sfz+IeJqJi:REJYqaQ8QN7p5Cz0jqJi
TLSH
T1786423C8B9A7916BD9F3FEECE0C64958B3FE733433C684798421915B87122D882E45D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 11KB
SHA256 f0f372c2a1424213438268ffcf6b0eab6516e02e7355a2c385a37febea522791
MD5 0c4787decc1c0391534b61d36ae87361
SHA1 fb107c2589c810733af1421991a65d5d747a04d0
SHA512 283d0cd634bcec79ec500701936dfd477c6907945611bad2da0a141837e1029dd7c6a86d842723367c74eb4ec022f8cd1b0e6c58d5b4c3a2027e03b357067795
SSDEEP 192:6X1dFgYb16Nyf0n1LFjBbcDfL/+Ot2+gtb176a:+WyfIXWfLGOt2+g2a
TLSH
T18542DAFEB8ADD046DF498E775AE0880135B652D4F80FBF8A2E35543090B37D98D61647
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 11KB
SHA256 6e09651cb1920311557862a99b46a3de9b7070651e7bec2c204af46fd2efa199
MD5 4a72611c143707e90054f163aab1e495
SHA1 23c6434e4e28844bde70cd753f5d61eb5a7a2907
SHA512 d0a803cd7629bdaf03043f00ff9113585036249bb78d9a69b961789bcb930840b33cf4c830c5ab057550316f9534b6ccb7afff7b092dd87736d4117ad9c3ca53
SSDEEP 192:BX1dFgYo6Nyf0n1LFjBbcDfL/+Ot2+gtR176/:tnyfIXWfLGOt2+gc/
TLSH
T13D42C9FEB8ADD046DF498E775AE0880539B642D0F80FBF8A2E35543091A37D98D61647
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 e21ca92c7588a274b15c00c6c8abbfa5a19d4eae2e721801e84137e3109d3a99
MD5 32bd04a2d87da4dfd83b23563b080aed
SHA1 8acc6b59430857f2e83500f948c05fbd896b27f4
SHA512 89df67a766fa177ab066edc314d0e7408470d8573f685fcdc50c7771059ab1137bd72030ed0ae64c3f7d0742bf88cdd7381c82a5ea5c52fcfaaed4bbde26b8e0
SSDEEP 48:tF9VrKDPe9eRhgOrLJDSe/COLUJW7eemhnCzdrKup1iKplJfRBlC0UBEiTw:NVrO+OgsDKOLVmhnCzdZ1iIlJJB+U
TLSH
T1B4B14CFDE599418BEB4CDB7A06E1C00078B164E8F40FBECE7F505830A616BE8C274A94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 7KB
SHA256 83f5474b730603ecb68adc5b0e6ad01eb1d25dafe57f3110a54cf4bdde63a74a
MD5 96547344cc54c43c6df1237c31fd36f1
SHA1 71cf83baaba209ebb84645e84e04761ff8e0e144
SHA512 19e34c45007aea0b37f33e0ffaa34a3ecfc6799899ae0ff33594c39607834b699c848d0e72b9cd5aece5d7ebbee3da25ef452895e84c91154cdb5d41eedc98f3
SSDEEP 96:BLrXb4L1bqg2WN+iXisCw9KCzmyZJcd3tB:BXXb4fpvigQQ3cddB
TLSH
T1B5F15EFFBD5DC44AEB19DE7A46E0801039B155E4FC0FBECE3A7058309576BE88224A94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 362471d9f42b3d0b099467d3292d0523b2fbdbe4705fe0a1b3ee3000b5f67a5e
MD5 a262d301b5444dfef14afa5e5e05869b
SHA1 1aee67555deadc6686508882b59913f2be303e98
SHA512 63d3c12016594c97d9d4f8c61b6f912de57af169c83ad2572571fc1c6bf9f21570ba01b120154d0f4e0fbbacf5c262aa5a1117612fbf011f18da8e3b5b09b218
TLSH
T100714CFD2A52419FF354C2BB40F2D10479F195E8F41FCECABDA04C302616BA5C269B98
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_github.com_0.indexeddb.leveldb\000003.log
Size 28KB
SHA256 27e100ecf2a36cb3e52fb1be17353aa38bcb2ad206e5bc545bdd721497b9389b
MD5 2cc427f044b70f1ef71b1c668bb96bff
SHA1 abf14367143c46a646ed4847caee5d806d183e6c
SHA512 b0a63a82b72c2c7b7daa89c3734cabc687257185d28c3eba26eca712f7de4664ff137415f9bd016f79117eac16ba4a8d587d013af62660317b7df217e6d1c4b8
SSDEEP 384:Ng7lsYlsM67mQ967BpigL7lsYlsa6ZIq7lsYlsM6rGYVpoqG7lsYlsc6md17lsYC:h/pmrTcM
TLSH
T1F7D2FE15B3FD2421FAFB0B3F147628AC4EBAB850789DC8DC00B82D5D4572A80AA75777
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_github.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_github.com_0.indexeddb.leveldb\LOG
Size 341B
SHA256 40ece6d68fa7c43386e14be0ed61cdddb9e442cff376062f39f3510dd075b382
MD5 2a5b0df2c44959a1ce4aa10a20565eaf
SHA1 2a5b7faabca355892cf2363b03708a7ef5b88df6
SHA512 70ece27e135f65eba3bc0bd0cd6ef841012447ce942cfde9b7e79a530c35207ae205cdef921beda4c5f677bf8286fedd086689b94b17d6b32c73f8df7bd97258
TLSH
T121E0D87985CAC16F561455D76534BB0E97B3360BDBC8AD8A4E01D818B086044A9AF351
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_github.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 8dadd39427b04ce5b552562c5392512562ec9cd041640b803b409f1e5faa708b
MD5 82f46f8bc71e0d543ffef77f34df19e6
SHA1 dc7286a8b89cb9c0c07540cc6740cf1a7c97820a
SHA512 62874eddefc522df95f3c895bf11318e7bd00f190aab0026e95d01fdadcfb63bbd20766bfb4baa6585b4865167df71951048958635b37d5d68ba388907d90d41
SSDEEP 192:DJziKpCxj1mRWGKPrRAixVqVjBj7pjfj7jJrGmBmFmDmzmtmH:DJziKpCxhmRWGKPrRAixVqVFnp7vtrG3
TLSH
T1BAD1A0F7C3D4866EC91216F09B197E1BCE2D051A432C3C5A88E4BF5BA3E2470E141A9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 12KB
SHA256 d002109276afe7ef9c9190ee23b9d1ead775dbf4817ad6dc70605e4361e9f89f
MD5 1a1b1a3b21d63eb606d5302f0a940714
SHA1 366cbc96a73ee74c48d434c7c8830ff14f9c570f
SHA512 bc894aa7c2a13bf18fcdc2f8e7e832fa6c5f948c0fb88804710e5835103a65db65407600f49f6a0342f27dc80dd90385a95e129fb83579978fdbd6aa814204b6
SSDEEP 384:DkWU16ttkmDID3sD4Sbhmxqot5GKLjigqVFnpHvtmBmrk75gA/itSEhVuoTrmtgT:jxj2Q7Ni3QhSE
TLSH
T17E4290F783E4866DC90166F09F187E1BCE290515526C3D6B89E4EF8BA3E2472E14174F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 13KB
SHA256 2419958e53906708b1c835891fcd62a1605cdbae31c72b93d9719327789fd88c
MD5 fb90d866950731527faeae0a0c873922
SHA1 ced4fc1efb8eab2075e541662c3b9bc7dd97a691
SHA512 1448fa6fbda5c5ee2d966c3a3f894baaacc307117594e2e4ea1dea12ed96c725a3e742d4720552b53bac04b85eb3e7d6c5cacc6fe4b261d0645fb6809a78ab9f
SSDEEP 384:DJziKpCxhm3ID3sD4SbhmxqoTWGKPrRAixVqVFnp7vtmBmrkmtmDImtmz75cmsAU:pLQjSQ5818zs7
TLSH
T18152AFF7C3D4862DC90166F09F187E1BCE2D095952683D6B89E4EF8BA3E2471E24164F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 699570547584a830025f76d2f9542f18cd45634ba9b7ebb5b1df0aa22c6e3ae8
MD5 88c607d14438ef471239fa2a2097d6f0
SHA1 c9759ec013f4350b994214c6db63db61c314a95b
SHA512 03e60244e50e4014f7d99252e5c90c3d3a79acee268b2d287c72359281a918442dfabf52691303a98df0c105386ea3f0d655ca7a14111c47f9c275f1a41d8bf9
TLSH
T172D023D31A057079559C7FC2C077EC8FC32710504846EDD420D0685C0635C9C0507142
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries~RFe590814.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries~RFe590814.TMP
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 4ecf98c5b728e01275769f14967ab43d01b581fe21be9acb002a85fc032384de
MD5 3340465cf7e1f2398aefc822dca03a76
SHA1 5e943a4537b3a8dfcd62746e8d40803bdcbb5849
SHA512 0ced1b28bb6402e80ba3e6f92cd69f5a5737f3531a8bdce4dc3f43df46e47f749dff4c9926dbe1e80d01a858e03c7a1f733007439d0c5f65475514376c608b47
SSDEEP 192:sxZORwyM/jK1Ml8MkR/fZs/lpIdpd8HW6+WNGYCkjsmDIgrJ:sxZOqMR/fZs/limHbG1G9
TLSH
T17642F8126A34A977CCCBD209FA457F53D6F91473A2910E44ADFCCA1C04EAAED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 5e44bd32b30ed67b7d8e4afaa2dca066ce147e637a663569326adb29fd7fa150
MD5 943ba9f228ba164ece28cdc748c2ba59
SHA1 726ff708a0906c2663b2912c4d97355678bf45b2
SHA512 baef0deac9138af4d3cd04c91548b256538eeb2b9ed0f2756ab647cd3320c527487d7056187964dc196c90fd75b483cc16a4f16c1b19521b1e624548980a424a
SSDEEP 192:sxZQRwyM/jK1Ml8UQ90cB4R/fZsm1FdpvizfSluHhHW6+WNVHsCxdXfHFR/YC/qX:sxZQCqum4R/fZsm1pshHb9LxH/7GcWF
TLSH
T17482E752692499B78CCBE609B9657F63D7F90463D9910E48AEFCC91C00EE6FD220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 cfa66508edf4987bf43c99ddfffeae1ef948cd48f020fd7a39012687e5740368
MD5 7908a3db3d146c933d7587501e57a9ba
SHA1 c4d54c283b5e6881e70807b4ee52b1716e22a3bd
SHA512 245b957a5f9c9c61a60ab4a015fb1e88fcbf8f0dbb6859364a6bdce26005ee4fdb0ec79f9eb6402148ed1aec25ad90745e7be680114b94e62b1dc05602ba4e24
SSDEEP 192:sxZQRwyM/jK1Ml8M0cB1R/fZsm1FdpvizfSluHhHW6+WNVHsCxHFR/YCOqIsmDIp:sxZQCsm1R/fZsm1pshHb9LH/bGnWF
TLSH
T19172C652662499B78CCAE619B925BF23D7F91463D9510E48AEFCC91C00EE6FD220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 19KB
SHA256 e480c92cb286ba2169aaa2c1699e1fdb759ffb68122a0dadc4059f920f33fbff
MD5 6d28cea0602216ba3bcbe06971c23d28
SHA1 a393d5f8e1a7eeff7867b4c03dca94b107b4c324
SHA512 72155866d4f4d01324cecc0d6f3824860f99057056a13e30d4adc66debcfeeb38489803623e609e02b5ca81b7968a2d3273a71aa4d7bc91569c9a0c2b3658eef
SSDEEP 384:sxZQ1Cqum4R/fZsm1HSRSmS3zHb9gitHD/VGcWF:so1Num4R/f31H7mSDHbtVIF
TLSH
T1EE92E852652099778CDBE519B925BF27E3F90463D9914E88ADFCC91C00EEBFD220381B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 0ea54a57a278ea3ed8f4f89824c343d491a7e31342e1ce392847fcb51300776b
MD5 9ed9c4fc16d9daa908fc2d55f775dcd0
SHA1 2c7717a5ec4430c4fe8cd21406b5aba29c206037
SHA512 e9f4dcc585ef2b1336fe311138468c58fa43e03370e60ffc6a892b13a35c1416172dfad3b84b2f9df9635b27ec1d3453b76d27b5ff92f6fc9d9ec82eaa5a9c66
SSDEEP 192:sxZORwyM/jK1Ml8M0cB1R/fZsmlBdpTPfCHW6+WNiFR/YCJjsmDIg5ssuN8o:sxZOqsm1R/fZsml1+Hbe/GGhWF
TLSH
T17862C7526A3499B78CCBE209BA647F53D7F91463D9510E4CADFCC91C04EA6ED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 0495775dfd2059f690827955ec886d02777b78a347574670bec799482baf3680
MD5 15374dcaedb59a7ee36316a4d1e3cbe3
SHA1 d76b9f5a17a83cb40909bcc6c1669bcaed5527b4
SHA512 408fd9a738c2ef1ca2079a84de54d2b68a930b1271ae3943509bf91d34aaa3cac2501bef5f5b402d4f328ab2ea3bb84bcf68440eae6d499981309f9c6941286f
SSDEEP 192:sxZORwyM/jK1Ml8M0cB1R/fZsm1odpTzfSlMHW6+WNiFR/YCsPsmDIg5esuN8o:sxZOCsm1R/fZsm1IjHbe/3GnWF
TLSH
T15662D752662499B78CCBE608BA657F53D7F91463D9510E48AEFCC91C00EEAED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 4635727fad151ab371eaa3638a22b043ca5088f9200e31b49757de5cc027928e
MD5 9bada816cd8abf75559acd137d802a9f
SHA1 c0aca9025475ccbad5277eeb25be8ef8363931d1
SHA512 996a0a90d2ba7a512ce9a6d54974f6ab62b0f857f1d20a69e67358eab63552256abb7c904d6038dd3e420a65794c03cc2f6ec408b12571c18c70fa7d8977149f
SSDEEP 192:sxZQRwyM/jK1Ml8M0cB4R/fZsm1FdpvizfSluHhHW6+WNVHsCxdXfHFR/YC/qrOW:sxZQCsm4R/fZsm1pshHb9LxH/7GcWF
TLSH
T1BC72D752692499B78CCBE209B9647F63D7F90463D9510E88AEFCC91C00EE6FD220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 18KB
SHA256 74b89c980314e461111a504e039748f78464e1ee23d73e2bc7c5a73a6ae55976
MD5 c8ac546847baac83aef4f02028e60d01
SHA1 425e606d897529b3cccd836ac44866ae08e22403
SHA512 02859984a93c1c708477ff9351f1229193b162171512df7baf7511dced25ec026f73444cb04562e5d1bc1d743bd2811e9d9222705289dea33dd5c56c10c37f90
SSDEEP 384:sxZQCqM2m4R/fZsm1/rbdhHb9LitH/CGcWF:soNvm4R/f31/nHb2CIF
TLSH
T18882E752692099B78CDBE119B9257F63E7F90463D9514E48AEFCC91C00EEAFD220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 a24304e8734cc5aec87bce41bd1d52f9bb6ff91c6885d24a69c578d2b709c87e
MD5 fc890cb2582c260a4058a15830ac6037
SHA1 ed77b107733dcc9e8777e376cb369181cc024e76
SHA512 b272eaa2da5a8f3aeaec20691a044a5358872d13e9e9635c521dd32f57262884988f83433efc0509c71b8a0aca2fad6acb20ae67b250c9f58672b9f8bb3c70a3
SSDEEP 768:zQ8bqn+WvSCt68F1+UoAYDCx9Tuqh0VfUC9xbog/OVnZLlRTKVArom:zQ8bqn+WvSCt6u1jaCZLbWVLm
TLSH
T13AD20A3B280CCB7E4F845E5DDC266F962DD801CB6B988D4447FA894C03C76EA511B5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\b72c29a0-bd55-435d-8f59-04769e50d179\index-dir\the-real-index
Size 72B
SHA256 c1e606bab954b60f19e1bb08290fac8f43e63e6ab2b9e3e6bf5795cb153397f3
MD5 0dbde4d164e33244e6c2ed65ac3b3192
SHA1 278e3b00d5d6d1db5266bf171bf75ea56c7d2fc3
SHA512 09b8f0d9fdfcfa9de0c0cae7e1f93d7810af9a9cd75736346689ef83f02306894e2e518b392079c254de4022a4756dbbb3e15d3e69e2e9df3792093fcbf10f20
TLSH
T1D9A0025003828405D52222F1BD5622463305CCA02100930751AA9084CC54550CDC600E
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\b72c29a0-bd55-435d-8f59-04769e50d179\index-dir\the-real-index
Size 72B
SHA256 ebd40d450bc8fdf10985ac141fc6548b64b13bb67c1633f689029de54b731b68
MD5 35a460cfd85cbcde5de81dec0bf68928
SHA1 372951a58a3eb7c4a68f7c56b1386a503259fbf2
SHA512 42756c0a80501b651562c30db8f8e9f87ca16ac60105ea6dc7421cfe93108b21096312f1ff7d42d4b65762b1b70c498a04405db4fdb77f85368a8918d0d12d9a
TLSH
T112A0023D12D17361D00266B429E691D133D1C91402133B375190445BDC50E454D8244E
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\dfa4cd3b-6396-44b1-9341-22ecfa35924f\index-dir\the-real-index
Size 1KB
SHA256 b043ddb4dec1f147d7f655900e218bb9b3a5cfad372ea334be6d8adf679e9255
MD5 20f04996d088a87fb10ccc35dcd87fc8
SHA1 4098a66cec65858a93880a880ebcb8569ea1409d
SHA512 adb9e38825f1486853bcb91c784a0f3595df3407e4405c377ca114f3af765ea8f9bdb20a2f46ddbbbcbde31d31811475223a10a4a9bd3f8be07fbd98c91237c8
TLSH
T1B241838A8D9496AFDC9409B204B2A0A83374CDCC2B019283587C72367C5372A1A4B1AC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\dfa4cd3b-6396-44b1-9341-22ecfa35924f\index-dir\the-real-index
Size 3KB
SHA256 cf3240759ea25bdbcca4fb8dd5914cb7fceea1c0a858dd83bf772097f8b8b739
MD5 b4194bf452c0c223337b77641539c3f2
SHA1 5d91e02ab42c257cd3288c16b25aef66e63a856f
SHA512 6b8d9aba63f0b62de9e3ec4c538500391a19808bdc32f310c2f4e8dcb7219caf89404f633e54a6e32a1b3613aebaaa06a721820ed3b389092c601bda3450fabb
TLSH
T12E51B84F5D4B2E59C96D01F310FA1C42737838EE57448A4765ECB171B8C372A2D1EA6D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5aa9af.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\dfa4cd3b-6396-44b1-9341-22ecfa35924f\index-dir\the-real-index~RFe5aa9af.TMP
Size 1KB
SHA256 716b7218a2ea1748adc65379c958a56477e2a3d1f4a59d3b5412965dd576c2df
MD5 e39e0ef90a81c5d40ab527946724a9dc
SHA1 c08c23ac292e3b21717e21e94c1f028698970eee
SHA512 33d899313905760caaeb22d549b598372959d68b9ea21958accd56ebde7e234d96810c837929519e90cc7903038fc5142049d944b6d87cfe20a97df7bb126ab6
TLSH
T12A41848A4E459A1FECD000B20AD7A4B83379D9405322768794F8563AB8B57BD2E5F1D8
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 7ff625d01fe83c89f4c7046b8c70ad8f235ae734dbf7a3c4de12c3989d38dbe8
MD5 c942649394971159bf0f0f16ae60db32
SHA1 e52420bbed370e09ab4d4ff453a5b3b750760eab
SHA512 ee15ad6e5eb0bf8b50b519b69b28d626e3f8bc77c2c45bf7cf5c84d0b5ba5c825393ef3711930b64fa74be3f17a882da7693cdff7fb8430196e90d4da53d148c
TLSH
T19FE0C0FA2DF72860BCBBE3F5247008E00249B988CD4ABC8F106AA1D710F33613856C60
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 8692f023d5d40e48ffac7a635a3aaa8093c551c6d55266d0076fd0354e1ffef7
MD5 1f1eeae522ca52097a5cd1e463e58bf2
SHA1 20c7d30b4c9745aa98165a126a7d944f95fa0936
SHA512 00fdba8ed9c345ddcabce2a67ee45d1bc8b4c6f9d8b420ed997a70a45eae5e7ec6ab93e53365155ee191aed2a34ad4e8ab78379a7e3d7c667853100335807fee
TLSH
T1F0B0222C283A20C2C2382F3CC0EA00CA3028ACCC0F0A3A30A0BC203C8222B0800AB002
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5b1e14.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5b1e14.TMP
Size 48B
SHA256 6a1305dcb340020571f9b4d634a6c26e283f9cadac879ac543b6b5c3b139858a
MD5 3bceb1cb8ea4290389e4a417f2d4f94d
SHA1 957d91c63ed2a15ba5282020c6d3d1f54d6b346e
SHA512 7ac584a499da519bd79158ac3a66135074a8395841442747e2a8edef5577df0c32acace7d18ee571876a40b8584c99b4e68c297c72d0944717a51c48c763d2a1
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 12f29a745f72c496dfed127ef31a12b4f695ccdd256009848f2f38e9da56d1b8
MD5 ef2f4e52d434b12b95a2054ec1a76347
SHA1 54322c22039907104dd787f6cf0f06735d78205b
SHA512 05877868531054a0e6d25772e61e46ea1a7d2da8bb790286571a53165797eed145ca4b34cb2ca5681c213e194f5b8bdc5979626d347d13594f7debb603d7f316
SSDEEP 96:KA/ArPNhtY5p+L/HYKn9/lYTHnOlP1W9KKe8CaMAKdquz:ynBtXl
TLSH
T138911D22727B120338BE7908A659873B8E5132E33865A46E77FC40610E77E216EFC4DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe596d85.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe596d85.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 5385fd0a3e5c2d628ea2edc7290be4747d69da779cc0adfec50195cf5b44e255
MD5 d36c0466983089044c5b8c8917fd7845
SHA1 e9d86e93a67027aedb10e97d1a67f611c125b8e3
SHA512 eec7be37aa12e1e474a73c0069c36c9706f2d2103344675c83e7c5bea31ffe34dd5a04140a219de268f48e3575579d2efc9b1d49f008b0b34821c869c4cf3f8c
SSDEEP 192:uVm+xasuheOwQxMGsNS8QZMQbiUXQmiU1jBU4Ea+joOmw+4z5FuamnMrqNt4/tyj:HZcIhsNS81tITrEa+UOH+MHWjivduuon
TLSH
T15A826C765D389C7619F6E184F8473A278FBC502796CA6F90D5DCAF1C00EEAD8130782A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 c566a5d8ee01ac4c86327a08115c3065bf67f978b53bada633837cc9773d8162
MD5 cacdff1b758d29f806058682a958482c
SHA1 567a3fcbda4c4839f8debb3551a71d5dad74fa77
SHA512 b70dab9c07497c3076ba61d5f6200912c43d69018a1578bc335da7ceec3ff638c793248034c273bd5d5d0886153f2ccd41b77bafe8c9bde6ace3e86267553d70
SSDEEP 384:fCiFMZcIzsNq8TUNTUlIlt1tlt0s2Ea+UOH+MHAjivduuon:fJFazzwgn0slaJOHZgjiVuus
TLSH
T199C22BF209E78876D9AD9747E77D2D174E7CC063B4859A50B3C85A1CCC9A1BFC306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 329acc47efbb119f98cd3bf737ee548db1678b75796d65b55c241a92bca79935
MD5 bebcd17519aa4978ccaa782f2706d4d9
SHA1 c97b395d582df22696b55822ee89ffc2603e18a8
SHA512 b5756b17b7227d3eb6f2ac0a89b349e087a5e1e652cbe00a0395f28ef1d57927e09200b15a7e43a1805143b89746cc254da356a2b210dedc732e2b0438e372f0
SSDEEP 384:fCiFPZcIzsNp8TUNTUlIlt1tEt0s2Ea+UOH+MHijivduuon:fJFHziwgW0slaJOHZCjiVuus
TLSH
T12BC22BF209E78876D8AD9747E77D2D178EBCC063B5859A50B3C85A1CCC9A1BFC306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 bed05086b87810401aa75155378a1893db6f6ee268a9ae8a02c94aa1453f7294
MD5 1547116c885430846fcde56c0d27421f
SHA1 57e01dbeb41663ff321e07374c4a1094e4cca187
SHA512 896470442daf0f5dd8ba31d2461057807f38b6d7a40bf1af160423f02fe128dd2429e3d5b5fbf3ed4e0fd5f5202820ad1792155f366bffb91490a4c7bca406c8
SSDEEP 192:vONJ6Db6QmiUyW2HBa+joOmw+4sRgn5CU6:vONJ6umHBa+UOH+WQU6
TLSH
T1AD02D835683C5CB79EA26E45F88B37279F94203BD9566B95D6E81F0C00D764C2307836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 e517676b2f50740a198d369210cd53e9e80a49e9ddfdb9c311c0e1d90641749f
MD5 f3417a27176898bcd1628a54755fd7cf
SHA1 c730e5f43c48bb240a915324c963958404aabb4d
SHA512 15f174562b59fcc1d2438056acb7dc012225f9b6d47c8066441c975e318cfbc3b3e2c87e0c3f090cdca111621ebccb993fcd2db13c9cd4fc5553166ff2888f8d
SSDEEP 384:fCiFUZcI0sNa8TUNTUlIRtTLtmt6HEa+UOH+MHVEjivduuon:fJFS0Xwg+6kaJOHZ1EjiVuus
TLSH
T106C22AF249E78876D9AD9747E77E2D178E7CC063B4859950B3C85A0CCC9A1BFC306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 8ed5241b38587bc1e0445e8a7ec033d7d12853725828ce0cdafc0ea074af5955
MD5 ee1ed9fdaa8ee961ddcf0d11a500aa62
SHA1 2896d9ce999ff422e15267bf2b00761e4a56daf0
SHA512 16b573ae22289c306d54b86008b76797722161fc81f58528fb865864f41d059b11df30f0e5ca24f7ef2f4a790facb40ac16f908fe9dd064237acbc6b1f431597
SSDEEP 192:FONb6DbSQmiUy82pBa+joOmw+4z5FiNznMrqNU6:FONb62SpBa+UOH+MH2jU6
TLSH
T18A120936683C9C775DE26594F88736279FA85027D94A7B91D6DC2F0C01EFA9C230B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 6eb93071c29bcd1f62e4d743713ae7f78349b93dd7cfbec3c88786524d12e71d
MD5 25ea53b4c83c360c4f141addec92a3e0
SHA1 0f8969a1412543249246830bce0a40e654507f96
SHA512 2739ca931e46335ca8435d26bad52d29f58747d5ea858e5205827d0d5b7c8120ad40b25e75473dbbde76848f65ae3ccf340e70bc8a6049a0a992fcce8318fc1f
SSDEEP 384:fCiFLZcIDsNa8TUNTUlIRtTLtbt6HEa+UOH+MHyjivduuon:fJFTDXwgj6kaJOHZSjiVuus
TLSH
T17BC22BF249E78876D9AD9747E77E2D178E7CC063B4859950B3C85A0CCC9A1BFC306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 4f6215f7f24725010cd0bbeb71d64f000bbbc769d0c1f7a4690d58597e157a7d
MD5 dd5e42b8b64b6d43c57ff496e56d8bbb
SHA1 6dea2acffd93c05c7d3e63d4f622b6b57456b1a4
SHA512 8c5d0440d4a5ee419a01292d0452a4e574d80696d54bcf2ee9dc0fcf87ce6f1e3cf15cbe7ed47c2db7e057c310962e4598d44f284a85e8aa3f879a7e810bbcde
SSDEEP 384:fCiFiZcI4sNq8TUNTUlIlJ1tht0s2Ea+UOH+MHxjivduuon:fJFQ4zwgD0slaJOHZRjiVuus
TLSH
T165C23CF209E78876D9AD9747E77E2D134EBCC063B4869950B3C85A1CCC9A1BFC306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 e3a5ac2a48e3534f05318af1e6a5af9b79ee4b6694df1f000b86c8691da7200b
MD5 415739a6827ac3fd8f2f83cb2fa012bc
SHA1 8ddf49ca2aa700f9cf8d903be9cc3a58202ad189
SHA512 41c793b8c1195b8f2cca290b38fe435035617f8dbb48d32086551bdae865b6cadf82090f27188ae23de4926d0036d9095807b790bcb6d59ccb53a6737a9c04fe
SSDEEP 384:fCiFrZcIeXsNa8TUNTUlIRtTLtPt6HEa+UOH+MH5jivduuon:fJFzeXXwgD6kaJOHZZjiVuus
TLSH
T19AC22AF249E78876D9AD9747E77E2D138E7CC063B4859A50B3D85A0CCC9A1BFC306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 f30c51f8b2549b76f120e4cea906f07ed2ec03a4d4703fa03c67171710bbd03a
MD5 d6c27d911632cf7268842907c6ffbc25
SHA1 105f9fab3791bd058d4d9e4019292bac55f0f879
SHA512 017511b2b7fc45d0fa7384a61eb1456f67fdc02b89309f77c1dd0c5eadc88e3f5993d2a5436a6fa7c153addfe6a2c35acd33f26156f0bb4eeb6817c6ad6db749
SSDEEP 384:hZcIhsNSJ1thss2Ea+UOH+MHWjivduuon:ph2slaJOHZ2jiVuus
TLSH
T12C827C765D389C761DF6A184F9473A278FBC502796CA6E90D5DCAF1C00EEAD8130782A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 8cc897373135bd126504206df93645089d79bb95ed2651bd7c1cecc343d468fa
MD5 a7bced16476a966f311f6cfccb95ef66
SHA1 2308f5f68858f8161e5951cf37e40b43a580c0c5
SHA512 9a4282f2a9942e17f14472510b4ef497013f6b73c0ce5ceef731075a90b3a85fbd2d9f2759c4342dcff8cd824773e2cdc039c18ef5a4b8675fadf7931120ed84
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 b87e615bc27e03456e666fb5537cac7c115b1eaa78f0c04b6d71f53c1372b354
MD5 ed748c5527dc566ad8194206cdfd43ab
SHA1 ce4e259ecfa6877fd6cf7e81aef2c4b79dd357ca
SHA512 f033087630b5f042e5cd2adbe026aa82857f2bc125457194dfb651cfe09fd887a4124ac6cce410ff138b9855f48de3e96845a4be7ff88a08ee2409cdd276dd06
TLSH
T190E00422E30420BBC06D133201CB9B147BE6902107F203869A62167C7D23B502D34F94
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 80dcf2318b2d7d864ee8555405485f90203dac3eb202fb38acf2a4b075201336
MD5 1f3e74d2a88ea10a309745d012584b10
SHA1 3c5113f864ea41d1e3ce0584d0dbf03c737cfb1a
SHA512 4f44b1f718f579031a1b9b97ee02766a94c4826d45abb559868c41a331c4df6e36cef7bcd37dbaa3786fdddf1ee724ede488acf0aa760a7e6630efea2899c3bb
TLSH
T1D8E00201D3001073C04D133101CB17047BF1C02103F303875661127C7D233002C34F00
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 0e50313662e4931272244733132f6ab4e1c5b4da8e93deaf059ccb6826b2806f
MD5 5562c3a2b61ec85635f91358aad2f71b
SHA1 af141f6545ab1fcd119fe4419b4c5bf080a6b835
SHA512 be85bcf8f25a768a2076b23c316d0ba4b007f750f272d913a9d88f3331189a2d0474c8a898e5c16920cd71871d38748de4e48b10a0fcdae67b5c1d674ba7922e
TLSH
T11AE00121E30420BBC06D133201CB9B147BF6C02103F303879A62167C7D23B502D34F90
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 6b0e863c7b9c00d084b4b04cd1337943e66ffc21bda62887095532cd9367b92b
MD5 59f4ea363c7b71433798da63af500d30
SHA1 59a72eba00d4485e74f9099ea4ff4f2fa18c62ee
SHA512 ba5cada55737bbe1c1959389b597838e32af0688497103b576f19b014d52033ee43da384b69b3dea6e8ab37efd3d50843017a9f47ecf8a1f6d54f4de3c14e5f2
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 ef745e409d5989f069f5665f1c4b68bf12c3c50c47517c2039d5f38dab018ac9
MD5 e6948ef90f3123e7594588ea7c0a35fe
SHA1 2e71bc7f3fb3b028a035d1a318eaf6f6897ee7f6
SHA512 a51804be425ac157ad3ff7785df37b59c4578be84f3af58d110116f6be05d9a762d39503298907cbfa3d0a0ff182d13ad4433031ea0efb86c90025582f342d6a
TLSH
T1B1E00151D30410BBD02C033101C78B243BF1806003F7028A8A221A3C3C23B002938F80
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 2b9e3748b434b5d252d7ba88d88e642a7cb87b814f3d84723a13b235e0234e09
MD5 8c9056a6c7c34938e987140a50177b31
SHA1 205300d72e9dcee35dd52dc8c5cd35e4b74c18f5
SHA512 3a1cb687fee8adf1024aa05fcebf5c3a6707df01833b9597d1478868f0b0dee4b6c6aa80d9afcb90ee39884e3702056ae7a902756a46b0e41b37f30b5c470610
TLSH
T1DAE00191D70410BBD02C033241D78B243BF190A103F7038A87321A3C3C32B002938F80
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 dbc98d4de44139ac6d97749d1e267b34223d50eb1dd18b9b91c1d7663d2edae4
MD5 d4c09e045f7a39b0ca4bb5ffd6e658ec
SHA1 92274f63db0f07083f3a541b3b346e7cbc73a5d1
SHA512 d2722f4816c59a8dd8423ae574e1d329a897564121483c196c21919cfc612b2cb0fb4fea7d89cd75b21223921437290eb0b55e2471e2128ca6651a034ba2c102
TLSH
T182E00422E34820BBD06D133202CB9B287BF2906107F3039A9A621A7C7D23B402A34F95
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 dbfef9f8d9db229c51a4664d31571be9044055391516116ef13bcdfb6550c506
MD5 52da86abf696726b24cd8ae428a78b58
SHA1 0562c2694f8451b84a77daf5e8f1ca8b0024c54d
SHA512 649670a431ebad1acf24a743cb942b278484e0fe8ad3be9f080cd9d88911056feda790c1918f89fd677a4172148a5f0036ad653304d5d4eafc8b7f625973a461
TLSH
T10CE00112D30410B7C05D133101CB17147BF2C02103F303879A62127C7D237002D34F50
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe58f7c9.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe58f7c9.TMP
Size 392B
SHA256 2c78478d6bc1951600c2affa9fb9057d0e3cd991b089320b9e3358d6b0640204
MD5 8ea3dd65e3cad1895c184d7ecacbeeac
SHA1 2da08b9e34c7a218815d83623249ecb34aa5c5e5
SHA512 7f1fe3d8089b41d0cc9fb8d0288c426e40486bebe1e33bfba8a95a901dc025eb558a7de88c1277cabeafcf494eede4ff6fd347e102f858ff60975043bf2f3934
MD5 SHA1 SHA512

Submit Download

5d3bbc84-1607-4f14-a6fd-9f2b27360063.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\5d3bbc84-1607-4f14-a6fd-9f2b27360063.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 ced0fa2a7268d2df885f6c50dd7afc0164020b0000a9892851efdc6af6d43fe3
MD5 0c9145b581bee5a00ff52b8ff16509a1
SHA1 1a0848effaf79a8d6d7963e541734770067920a9
SHA512 116e472d71f63521e472281e94e2ea77838595ae8acc6922373d77b115c578ab0f23ddef3e2d690f564cf5567fc330d2ceec990cbbcf6ba0289fcd6972a2b018
TLSH
T111412959AAEA1148B3736E5A9BF7A46E487FBD372E06849D00110E4E0A63A40DDB1737
MD5 SHA1 SHA512 TLSH

Submit Download

8b0d4544beb97a69dbb9583fca5575a9aba6e37d.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\8b0d4544beb97a69dbb9583fca5575a9aba6e37d.tbres
Size 2KB
SHA256 6fe9d6740a2e65b5d5479689b4a657c8713c027c539c9efd574b85a9f2ce9665
MD5 93f346cde089811248dfe2369c3bc53e
SHA1 4c0c40d54b72de0425d457bd99971cf92a9b657a
SHA512 66b1d7fac832b1f6ba4496e7a7c6ee98134e518248511b412b0318fd784cc571dd7e9a4cf1678434b25e5dbf808fe7e61523591743379b82a603cd97e5a51924
TLSH
T190512E586AFA1148B3B3BF5A9FF6B4AD487FB9732E06949D00110E4F0633A40D962737
MD5 SHA1 SHA512 TLSH

Submit Download

CCBC.tmp

Path C:\Users\Admin\AppData\Local\Temp\CCBC.tmp
Size 55KB
SHA256 02ef73bd2458627ed7b397ec26ee2de2e92c71a0e7588f78734761d8edbdcd9f
MD5 7e37ab34ecdcc3e77e24522ddfd4852d
SHA1 38e2855e11e353cedf9a8a4f2f2747f1c5c07fcf
SHA512 1b037a2aa8bf951d2ffe2f724aa0b2fbb39c2173215806ba0327bda7b096301d887f9bb7db46f9e04584b16aa6b1aaeaf67f0ecf5f20eb02ceac27c8753ca587
SSDEEP 768:wglvV3eE6cYdk8TcqiAjpEhtFLIZJ92evTlvGTIRVIRYcwq22zDcENaiaX+kDt9J:3ihTaAjZNlGT5YcdYENvkA+ChJfSz
TLSH
T1F5435B5A23A001FCE1679231C8B2DA1AE7B3B8166375434F12A4866B6FB37D15D3C772
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

monsterv2.zip

Path C:\Users\Admin\Downloads\monsterv2.zip
Size 28KB
SHA256 a8cb8ff9d5b5110bc392f8356c9d81de2c2fb039b8ffdc12134204adac33c52b
MD5 876e0542cce2b246e2a0794a92f766b7
SHA1 5f30f676836b75503663f5de6683753b8237907f
SHA512 24524b0fa3d7cad4ee04cbc50cf94f0b0f1773a84af07dd187d22432a370fdcf00a4ea8dd3bb7ff0f0712831f07ebcc438432249f07261e4a676f35edfde459c
SSDEEP 768:PRIruUuQ08avVAvV9vuY8k9EPBw0Q49644leebtW/5:PmuBo9vbEPBhQ48nlpW/5
TLSH
T100D2E145FB4A0240CDED5C4ECAF1DC84EEAD9AB9F8CE39652499FAC05920CFE571D406
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notpetya.zip

Path C:\Users\Admin\Downloads\notpetya.zip
Size 321KB
SHA256 9059f513462ad58facc362772193cb9c813adb6df118f88ff2e9c63c508207d4
MD5 251ada7fa63231d80563ef222d2380c6
SHA1 259f55aa2c262aeb250e829700068b5489aa4c01
SHA512 563bd399d6a1d5abc06696554f16853e8853694115866dde188b106db4baa3e8457033f57fe44cdef817b011a9f17b07518b392c63a0013b139aef814715aa9c
SSDEEP 6144:T+IBWEJZ923CF0j/pNAkHYN3bFNq7pvndbaqPEwK30b3nilrdQY/CdUsL:TJBL2Z/ZHTFdbPMwK323odQYaUsL
TLSH
T1DF6422A0EE697F90BC18411D696565DEF01994B5A368B30D48F6134EC860A3FFB370EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notpetya.zip.crdownload

Path C:\Users\Admin\Downloads\notpetya.zip.crdownload
Size 321KB
SHA256 b2303893caaf9c6e048fc2aaf7ecbe6264a629a19169e5395595442d78ba17ad
MD5 cd941cd911bd1ac5c37754d1d022aefb
SHA1 168f20a901b52ca314618a7ebdf0889f8db72b3e
SHA512 45b47529c473ea3b5539c279f6ba7214b320db7c3845eb1e29dc215da6aa85fc06fbfc620a7019a41c2ab6728a5ec78a6804a6912dcd64b9670de49683cc78bc
SSDEEP 6144:B1DSczJ7BsNnX1EPljAetGjN3bFNq7pvndbaqPEwK30b3nilrdQY/CdUT:KiJ7+1iNGoFdbPMwK323odQYaUT
TLSH
T17E6423717FD6FF40B580950CB992F09EE02C94AAD798B34149B9529F8D1033EBB165B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfc.dat

Path C:\Windows\perfc.dat
Size 353KB
SHA256 027cc450ef5f8c5f653329641ec1fed91f694e0d229928963b30f6b0d7d3a745
MD5 71b6a493388e7d0b40c83ce903bc6b04
SHA1 34f917aaba5684fbe56d3c57d48ef2a1aa7cf06d
SHA512 072205eca5099d9269f358fe534b370ff21a4f12d7938d6d2e2713f69310f0698e53b8aff062849f0b2a521f68bee097c1840993825d2a5a3aa8cf4145911c6f
SSDEEP 6144:y/Bt80VmNTBo/x95ZjAetGDN3VFNq7pC+9OqFoK30b3ni5rdQY/CdUOs2:y/X4NTS/x9jNG+w+9OqFoK323qdQYKUG
TLSH
T1BC74126171C341B2F1F38A3455CAB75B8FFDE06687B065CECA2B1A0A1821746F739297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfc.dat

Path C:\Windows\perfc.dat
Size 353KB
SHA256 3edd68a254c5ac127d58e8745f046cdeb8f5e9f20a48fdc0ed3af3395c6624f1
MD5 8e65591bc985e97b1dbedf47e26f2209
SHA1 ae6f678b2d4018211da6ebcd076397fa0a7a4175
SHA512 850b3888d50daa367cbfb08307340fbbf6c98c768f707f33d7caf22405c150fc25de34b5f093a467d2e2f907ba5961f5a6eddf7a0b363dcbca8f442e5953c931
SSDEEP 6144:y/Bt80VmNTBo/x95ZjAetGDN3VFNq7pC+9OqFoK:y/X4NTS/x9jNG+w+9OqFoK
TLSH
T1507402A572C341B2F1F3963458CB772B8BFEB42587F065CACA5B0A0A2821641F6753D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfc.dat

Path C:\Windows\perfc.dat
Size 353KB
SHA256 2bbfb1bd2c32ea35c7fdf821f83bc9d780562dcd4f503da09ab6548d6e36f4ab
MD5 f43e735add22a91af1550a3483e1d97b
SHA1 74f468a5fd205fd591a7db2b8cdaf763d79ec8c9
SHA512 36c5bcffe844ea23dba9aa32d2b12555bc8ae539981b98b2c2499f19a8b2dc97a6f1b0f8a6543d7d3b55ce3430fbff371cb8f3ac6dc8cf944c124dbcab218161
SSDEEP 3072:yjB+snBEA80VFQNTBf3QvHxf1NT0mAKjAetGNT44bhvWhkVBPNZurPCQt5p:y/Bt80VmNTBo/x95ZjAetGDN3VFNq7p
TLSH
T17074E1A536C301B2F1F3863458DAB72B8FFEB424C7F156CACA5B090A6821545F678397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3156-2130-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/3380-2028-0x00007FF9985B0000-0x00007FF9985C0000-memory.dmp

Download

memory/3380-2030-0x00007FF9985B0000-0x00007FF9985C0000-memory.dmp

Download

memory/3380-2029-0x00007FF9985B0000-0x00007FF9985C0000-memory.dmp

Download

memory/3380-2031-0x00007FF9985B0000-0x00007FF9985C0000-memory.dmp

Download

memory/3380-2032-0x00007FF9985B0000-0x00007FF9985C0000-memory.dmp

Download

memory/3380-2033-0x00007FF995C50000-0x00007FF995C60000-memory.dmp

Download

memory/3380-2034-0x00007FF995C50000-0x00007FF995C60000-memory.dmp

Download

memory/4624-680-0x0000000002400000-0x000000000245E000-memory.dmp

Download

memory/4624-673-0x0000000002400000-0x000000000245E000-memory.dmp

Download

memory/4624-693-0x0000000002400000-0x000000000245E000-memory.dmp

Download

memory/4624-683-0x0000000002400000-0x000000000245E000-memory.dmp

Download

memory/4624-681-0x0000000002400000-0x000000000245E000-memory.dmp

Download

memory/5672-721-0x0000000002E10000-0x0000000002E6E000-memory.dmp

Download

memory/5672-714-0x0000000002E10000-0x0000000002E6E000-memory.dmp

Download

memory/5784-731-0x00000000022E0000-0x000000000233E000-memory.dmp

Download

memory/5784-738-0x00000000022E0000-0x000000000233E000-memory.dmp

Download

Resubmissions

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads