overlord | hxxps://ayanami[.]app/x96x4gu_w

Analysis

user interaction
yes
max time kernel
47s
max time network
291s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/08/2026, 03:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
https://ayanami.app/x96x4gu_w
Sample260826-ee111ssarf

Score

10^/10

discovery execution overlord persistence privilege_escalation ransomware rat

Malware Config

Signatures

Family: Overlord
Overlord is an open-source Windows RAT written in Golang.
rat overlord

Detects Overlord RAT 11 IoCs

resource	yara_rule
behavioral1/memory/3428-282-0x0000000244E40000-0x000000024797F000-memory.dmp	family_overlord
behavioral1/memory/3428-293-0x0000000244E40000-0x000000024797F000-memory.dmp	family_overlord
behavioral1/memory/3428-294-0x0000000244E40000-0x000000024797F000-memory.dmp	family_overlord
behavioral1/memory/3428-295-0x0000000244E40000-0x000000024797F000-memory.dmp	family_overlord
behavioral1/memory/3428-296-0x0000000244E40000-0x000000024797F000-memory.dmp	family_overlord
behavioral1/memory/3428-297-0x0000000244E40000-0x000000024797F000-memory.dmp	family_overlord
behavioral1/memory/3428-300-0x0000000244E40000-0x000000024797F000-memory.dmp	family_overlord
behavioral1/memory/3428-301-0x0000000244E40000-0x000000024797F000-memory.dmp	family_overlord
behavioral1/memory/3428-307-0x0000000244E40000-0x000000024797F000-memory.dmp	family_overlord
behavioral1/memory/3428-330-0x0000000244E40000-0x000000024797F000-memory.dmp	family_overlord
behavioral1/memory/3428-423-0x0000000244E40000-0x000000024797F000-memory.dmp	family_overlord

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
6476	powershell.exe
4572	powershell.exe
7468	powershell.exe
6036	powershell.exe
4756	powershell.exe

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\agent-136804667.tmp	JewExecutor.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\agent-3406234278.tmp	ovd_d0f524ca6b0f.exe

Executes dropped EXE 1 IoCs

pid	Process
4684	ovd_d0f524ca6b0f.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\OverlordAgent-d5ee2f13 = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\DeviceSync\\ovd_d0f524ca6b0f.exe\""	JewExecutor.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\OverlordAgent-d5ee2f13 = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\DeviceSync\\ovd_d0f524ca6b0f.exe\""	ovd_d0f524ca6b0f.exe

Looks up external IP address via web service 1 TTPs 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
21	api.ipify.org
63	api.ipify.org

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 1 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
6136	netsh.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4320	msedge.exe
2516	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134321899679676637"	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-552508041-2681165170-3229858294-1000\{1EE5C7EB-5386-4E7E-898C-7EE90FB60BF3}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
6036	powershell.exe
6036	powershell.exe
6036	powershell.exe
4756	powershell.exe
4756	powershell.exe
4756	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	6036	powershell.exe
Token: SeIncreaseQuotaPrivilege	6036	powershell.exe
Token: SeSecurityPrivilege	6036	powershell.exe
Token: SeTakeOwnershipPrivilege	6036	powershell.exe
Token: SeLoadDriverPrivilege	6036	powershell.exe
Token: SeSystemProfilePrivilege	6036	powershell.exe
Token: SeSystemtimePrivilege	6036	powershell.exe
Token: SeProfSingleProcessPrivilege	6036	powershell.exe
Token: SeIncBasePriorityPrivilege	6036	powershell.exe
Token: SeCreatePagefilePrivilege	6036	powershell.exe
Token: SeBackupPrivilege	6036	powershell.exe
Token: SeRestorePrivilege	6036	powershell.exe
Token: SeShutdownPrivilege	6036	powershell.exe
Token: SeDebugPrivilege	6036	powershell.exe
Token: SeSystemEnvironmentPrivilege	6036	powershell.exe
Token: SeRemoteShutdownPrivilege	6036	powershell.exe
Token: SeUndockPrivilege	6036	powershell.exe
Token: SeManageVolumePrivilege	6036	powershell.exe
Token: 33	6036	powershell.exe
Token: 34	6036	powershell.exe
Token: 35	6036	powershell.exe
Token: 36	6036	powershell.exe
Token: SeDebugPrivilege	4756	powershell.exe
Token: SeIncreaseQuotaPrivilege	6036	powershell.exe
Token: SeSecurityPrivilege	6036	powershell.exe
Token: SeTakeOwnershipPrivilege	6036	powershell.exe
Token: SeLoadDriverPrivilege	6036	powershell.exe
Token: SeSystemProfilePrivilege	6036	powershell.exe
Token: SeSystemtimePrivilege	6036	powershell.exe
Token: SeProfSingleProcessPrivilege	6036	powershell.exe
Token: SeIncBasePriorityPrivilege	6036	powershell.exe
Token: SeCreatePagefilePrivilege	6036	powershell.exe
Token: SeBackupPrivilege	6036	powershell.exe
Token: SeRestorePrivilege	6036	powershell.exe
Token: SeShutdownPrivilege	6036	powershell.exe
Token: SeDebugPrivilege	6036	powershell.exe
Token: SeSystemEnvironmentPrivilege	6036	powershell.exe
Token: SeRemoteShutdownPrivilege	6036	powershell.exe
Token: SeUndockPrivilege	6036	powershell.exe
Token: SeManageVolumePrivilege	6036	powershell.exe
Token: 33	6036	powershell.exe
Token: 34	6036	powershell.exe
Token: 35	6036	powershell.exe
Token: 36	6036	powershell.exe
Token: SeIncreaseQuotaPrivilege	6036	powershell.exe
Token: SeSecurityPrivilege	6036	powershell.exe
Token: SeTakeOwnershipPrivilege	6036	powershell.exe
Token: SeLoadDriverPrivilege	6036	powershell.exe
Token: SeSystemProfilePrivilege	6036	powershell.exe
Token: SeSystemtimePrivilege	6036	powershell.exe
Token: SeProfSingleProcessPrivilege	6036	powershell.exe
Token: SeIncBasePriorityPrivilege	6036	powershell.exe
Token: SeCreatePagefilePrivilege	6036	powershell.exe
Token: SeBackupPrivilege	6036	powershell.exe
Token: SeRestorePrivilege	6036	powershell.exe
Token: SeShutdownPrivilege	6036	powershell.exe
Token: SeDebugPrivilege	6036	powershell.exe
Token: SeSystemEnvironmentPrivilege	6036	powershell.exe
Token: SeRemoteShutdownPrivilege	6036	powershell.exe
Token: SeUndockPrivilege	6036	powershell.exe
Token: SeManageVolumePrivilege	6036	powershell.exe
Token: 33	6036	powershell.exe
Token: 34	6036	powershell.exe
Token: 35	6036	powershell.exe

Suspicious use of FindShellTrayWindow 44 IoCs

pid	Process
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 3288 wrote to memory of 3180	3288	msedge.exe	87
PID 3288 wrote to memory of 4600	3288	msedge.exe	89
PID 3288 wrote to memory of 4320	3288	msedge.exe	90
PID 3288 wrote to memory of 4600	3288	msedge.exe	89
PID 3288 wrote to memory of 4600	3288	msedge.exe	89
PID 3288 wrote to memory of 3348	3288	msedge.exe	91
PID 3288 wrote to memory of 3348	3288	msedge.exe	91
PID 3288 wrote to memory of 5628	3288	msedge.exe	92
PID 3288 wrote to memory of 3528	3288	msedge.exe	93
PID 3288 wrote to memory of 5628	3288	msedge.exe	92
PID 3288 wrote to memory of 5628	3288	msedge.exe	92
PID 3288 wrote to memory of 3528	3288	msedge.exe	93
PID 3288 wrote to memory of 3528	3288	msedge.exe	93
PID 3288 wrote to memory of 1456	3288	msedge.exe	95
PID 3288 wrote to memory of 1456	3288	msedge.exe	95
PID 3288 wrote to memory of 1456	3288	msedge.exe	95
PID 3288 wrote to memory of 6020	3288	msedge.exe	96
PID 3288 wrote to memory of 6020	3288	msedge.exe	96
PID 3288 wrote to memory of 6020	3288	msedge.exe	96
PID 3288 wrote to memory of 3560	3288	msedge.exe	98
PID 3288 wrote to memory of 3560	3288	msedge.exe	98
PID 3288 wrote to memory of 3560	3288	msedge.exe	98
PID 3288 wrote to memory of 6072	3288	msedge.exe	99
PID 3288 wrote to memory of 6072	3288	msedge.exe	99
PID 3288 wrote to memory of 5648	3288	msedge.exe	100
PID 3288 wrote to memory of 5648	3288	msedge.exe	100
PID 3288 wrote to memory of 1820	3288	msedge.exe	102
PID 3288 wrote to memory of 5356	3288	msedge.exe	105
PID 3288 wrote to memory of 5356	3288	msedge.exe	105
PID 3288 wrote to memory of 5300	3288	msedge.exe	106
PID 3288 wrote to memory of 5300	3288	msedge.exe	106
PID 3288 wrote to memory of 5300	3288	msedge.exe	106
PID 3288 wrote to memory of 5876	3288	msedge.exe	107
PID 3288 wrote to memory of 4452	3288	msedge.exe	111
PID 3288 wrote to memory of 3816	3288	msedge.exe	112
PID 3288 wrote to memory of 2532	3288	msedge.exe	113
PID 3428 wrote to memory of 6036	3428	JewExecutor.exe	115
PID 4684 wrote to memory of 4756	4684	ovd_d0f524ca6b0f.exe	119

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://ayanami.app/x96x4gu_w
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x29c,0x7ffdbd64c188,0x7ffdbd64c194,0x7ffdbd64c1a0
  2⤵
  PID:3180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1564,i,13663755137422022391,13278561288654101271,262144 --field-trial-handle=2576,i,5061803938536083858,10958051344732153285,262144 --variations-seed-version --mojo-platform-channel-handle=2572 /prefetch:2
  2⤵
  PID:4600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1808,i,922190743184548213,12971918296177076862,524288 --field-trial-handle=2576,i,5061803938536083858,10958051344732153285,262144 --variations-seed-version --mojo-platform-channel-handle=2628 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2240,i,8936379059540854805,15763319031623236301,524288 --field-trial-handle=2576,i,5061803938536083858,10958051344732153285,262144 --variations-seed-version --mojo-platform-channel-handle=2956 /prefetch:13
  2⤵
  PID:3348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3588,i,14871886795526898778,1672280327355793132,2097152 --field-trial-handle=2576,i,5061803938536083858,10958051344732153285,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:1
  2⤵
  PID:5628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3612,i,9051523955362119003,4342239670806745750,2097152 --field-trial-handle=2576,i,5061803938536083858,10958051344732153285,262144 --variations-seed-version --mojo-platform-channel-handle=3664 /prefetch:1
  2⤵
  PID:3528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=2272,i,13572642950306845113,13967870900891925919,2097152 --field-trial-handle=2576,i,5061803938536083858,10958051344732153285,262144 --variations-seed-version --mojo-platform-channel-handle=4320 /prefetch:1
  2⤵
  PID:1456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4388,i,13594052355463828253,9608926644891195421,2097152 --field-trial-handle=2576,i,5061803938536083858,10958051344732153285,262144 --variations-seed-version --mojo-platform-channel-handle=4332 /prefetch:9
  2⤵
  PID:6020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5408,i,13666355687387484551,15943837525510751821,2097152 --field-trial-handle=2576,i,5061803938536083858,10958051344732153285,262144 --variations-seed-version --mojo-platform-channel-handle=5428 /prefetch:1
  2⤵
  PID:3560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3804,i,14442430375176867459,13205366807632450696,524288 --field-trial-handle=2576,i,5061803938536083858,10958051344732153285,262144 --variations-seed-version --mojo-platform-channel-handle=3796 /prefetch:14
  2⤵
  PID:6072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3844,i,2889234861497093826,10038824343446878460,524288 --field-trial-handle=2576,i,5061803938536083858,10958051344732153285,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:14
  2⤵
  PID:5648
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6136,i,3640993750621930081,13403078302895003027,524288 --field-trial-handle=2576,i,5061803938536083858,10958051344732153285,262144 --variations-seed-version --mojo-platform-channel-handle=6156 /prefetch:14
  2⤵
  PID:3152
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6136,i,3640993750621930081,13403078302895003027,524288 --field-trial-handle=2576,i,5061803938536083858,10958051344732153285,262144 --variations-seed-version --mojo-platform-channel-handle=6156 /prefetch:14
  2⤵
  PID:1820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6656,i,16873678914224778655,7005904669449473027,524288 --field-trial-handle=2576,i,5061803938536083858,10958051344732153285,262144 --variations-seed-version --mojo-platform-channel-handle=6664 /prefetch:14
  2⤵
  PID:5356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6760,i,10028478974773668043,17486085027129227523,2097152 --field-trial-handle=2576,i,5061803938536083858,10958051344732153285,262144 --variations-seed-version --mojo-platform-channel-handle=6804 /prefetch:1
  2⤵
  PID:5300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7080,i,6149678103802316315,5376769710764021154,524288 --field-trial-handle=2576,i,5061803938536083858,10958051344732153285,262144 --variations-seed-version --mojo-platform-channel-handle=7276 /prefetch:14
  2⤵
  PID:5876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5080,i,8789676405249420438,12243223611595565602,524288 --field-trial-handle=2576,i,5061803938536083858,10958051344732153285,262144 --variations-seed-version --mojo-platform-channel-handle=4400 /prefetch:14
  2⤵
  PID:4452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5136,i,11305674404806962511,7684049216964569104,524288 --field-trial-handle=2576,i,5061803938536083858,10958051344732153285,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:14
  2⤵
  PID:3816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5140,i,1071205044913026809,14929521139249097840,524288 --field-trial-handle=2576,i,5061803938536083858,10958051344732153285,262144 --variations-seed-version --mojo-platform-channel-handle=4352 /prefetch:14
  2⤵
  PID:2532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6908,i,13649530345361599716,14151437745523906241,524288 --field-trial-handle=2576,i,5061803938536083858,10958051344732153285,262144 --variations-seed-version --mojo-platform-channel-handle=4108 /prefetch:14
  2⤵
  PID:4984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5980,i,18408588148007879617,7871385884401172955,262144 --field-trial-handle=2576,i,5061803938536083858,10958051344732153285,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:10
  2⤵
  PID:6380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5588,i,9842305628467898521,1789820440256559813,524288 --field-trial-handle=2576,i,5061803938536083858,10958051344732153285,262144 --variations-seed-version --mojo-platform-channel-handle=5512 /prefetch:14
  2⤵
  PID:2052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5684,i,11052581673977437420,13120917070219651053,524288 --field-trial-handle=2576,i,5061803938536083858,10958051344732153285,262144 --variations-seed-version --mojo-platform-channel-handle=5620 /prefetch:14
  2⤵
  PID:1400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5852,i,17297154265956914900,8556881587092197830,524288 --field-trial-handle=2576,i,5061803938536083858,10958051344732153285,262144 --variations-seed-version --mojo-platform-channel-handle=5148 /prefetch:14
  2⤵
  PID:7252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3572,i,5929682827602338973,338732225001231390,262144 --field-trial-handle=2576,i,5061803938536083858,10958051344732153285,262144 --variations-seed-version --mojo-platform-channel-handle=1612 /prefetch:2
  2⤵
  PID:2720

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:952

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4684

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4792

C:\Users\Admin\Downloads\Getpass\Getpass\JewExecutor.exe
"C:\Users\Admin\Downloads\Getpass\Getpass\JewExecutor.exe"
1⤵
- Creates a file in the Startup directory
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3428
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$a = New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\ovd_d0f524ca6b0f.exe'; $t = New-ScheduledTaskTrigger -AtLogOn; $s = New-ScheduledTaskSettingsSet -ExecutionTimeLimit ([TimeSpan]::Zero) -StartWhenAvailable; $p = New-ScheduledTaskPrincipal -UserId $env:USERNAME -RunLevel Highest; Register-ScheduledTask -TaskName 'ovd_0a75ad50' -Action $a -Trigger $t -Settings $s -Principal $p -Force | Out-Null"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:6036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --headless --disable-gpu --no-sandbox --disable-dev-shm-usage
  2⤵
  PID:4844
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\HeadlessChrome4844240829437 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\HeadlessChrome4844240829437\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\HeadlessChrome4844240829437 --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x1bc,0x1c0,0x1c4,0x198,0x1c8,0x7ffdbac1c728,0x7ffdbac1c734,0x7ffdbac1c740
    3⤵
    PID:1824
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --headless --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome4844240829437" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=2224,i,1757101654759185685,8992619994447310493,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2220 /prefetch:2
    3⤵
    PID:3528
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome4844240829437" --no-pre-read-main-dll --force-high-res-timeticks=disabled --field-trial-handle=2224,i,1757101654759185685,8992619994447310493,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2420 /prefetch:11
    3⤵
    - System Time Discovery
    PID:2516
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome4844240829437" --force-high-res-timeticks=disabled --field-trial-handle=2224,i,1757101654759185685,8992619994447310493,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2436 /prefetch:13
    3⤵
    PID:3096
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome4844240829437" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=2224,i,1757101654759185685,8992619994447310493,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2952 /prefetch:1
    3⤵
    PID:6160
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome4844240829437" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=2224,i,1757101654759185685,8992619994447310493,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2956 /prefetch:1
    3⤵
    PID:6168
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome4844240829437" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=2224,i,1757101654759185685,8992619994447310493,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3220 /prefetch:1
    3⤵
    PID:6248
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome4844240829437" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=2224,i,1757101654759185685,8992619994447310493,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3316 /prefetch:9
    3⤵
    PID:6260
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome4844240829437" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=2224,i,1757101654759185685,8992619994447310493,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:9
    3⤵
    PID:6272
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome4844240829437" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=2224,i,1757101654759185685,8992619994447310493,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:1
    3⤵
    PID:6288
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome4844240829437" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=2224,i,1757101654759185685,8992619994447310493,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2936 /prefetch:9
    3⤵
    PID:6412
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome4844240829437" --force-high-res-timeticks=disabled --field-trial-handle=2224,i,1757101654759185685,8992619994447310493,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:14
    3⤵
    PID:6748
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --message-loop-type-ui --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome4844240829437" --force-high-res-timeticks=disabled --field-trial-handle=2224,i,1757101654759185685,8992619994447310493,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:14
    3⤵
    PID:8148
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --message-loop-type-ui --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome4844240829437" --force-high-res-timeticks=disabled --field-trial-handle=2224,i,1757101654759185685,8992619994447310493,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4176 /prefetch:14
    3⤵
    PID:8156
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --message-loop-type-ui --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome4844240829437" --force-high-res-timeticks=disabled --field-trial-handle=2224,i,1757101654759185685,8992619994447310493,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5604 /prefetch:14
    3⤵
    PID:8164
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome4844240829437" --force-high-res-timeticks=disabled --field-trial-handle=2224,i,1757101654759185685,8992619994447310493,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3928 /prefetch:14
    3⤵
    PID:5348
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome4844240829437" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --field-trial-handle=2224,i,1757101654759185685,8992619994447310493,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4180 /prefetch:1
    3⤵
    PID:4712
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome4844240829437" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --field-trial-handle=2224,i,1757101654759185685,8992619994447310493,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5624 /prefetch:1
    3⤵
    PID:3032
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome4844240829437" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --field-trial-handle=2224,i,1757101654759185685,8992619994447310493,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5048 /prefetch:1
    3⤵
    PID:7328
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome4844240829437" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --field-trial-handle=2224,i,1757101654759185685,8992619994447310493,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5700 /prefetch:1
    3⤵
    PID:4476
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome4844240829437" --force-high-res-timeticks=disabled --field-trial-handle=2224,i,1757101654759185685,8992619994447310493,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4892 /prefetch:14
    3⤵
    PID:2596
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome4844240829437" --force-high-res-timeticks=disabled --field-trial-handle=2224,i,1757101654759185685,8992619994447310493,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4840 /prefetch:14
    3⤵
    PID:7460
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome4844240829437" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --field-trial-handle=2224,i,1757101654759185685,8992619994447310493,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5076 /prefetch:1
    3⤵
    PID:2368
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome4844240829437" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --field-trial-handle=2224,i,1757101654759185685,8992619994447310493,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5048 /prefetch:1
    3⤵
    PID:1792
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome4844240829437" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --field-trial-handle=2224,i,1757101654759185685,8992619994447310493,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4804 /prefetch:1
    3⤵
    PID:1660
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome4844240829437" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --field-trial-handle=2224,i,1757101654759185685,8992619994447310493,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5636 /prefetch:1
    3⤵
    PID:6320
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome4844240829437" --force-high-res-timeticks=disabled --field-trial-handle=2224,i,1757101654759185685,8992619994447310493,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5584 /prefetch:14
    3⤵
    PID:2484
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome4844240829437" --force-high-res-timeticks=disabled --field-trial-handle=2224,i,1757101654759185685,8992619994447310493,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5556 /prefetch:14
    3⤵
    PID:4316
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome4844240829437" --force-high-res-timeticks=disabled --field-trial-handle=2224,i,1757101654759185685,8992619994447310493,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4824 /prefetch:14
    3⤵
    PID:1112
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome4844240829437" --force-high-res-timeticks=disabled --field-trial-handle=2224,i,1757101654759185685,8992619994447310493,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5068 /prefetch:14
    3⤵
    PID:4496
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome4844240829437" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --field-trial-handle=2224,i,1757101654759185685,8992619994447310493,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2932 /prefetch:1
    3⤵
    PID:5444
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome4844240829437" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --field-trial-handle=2224,i,1757101654759185685,8992619994447310493,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5556 /prefetch:9
    3⤵
    PID:5732
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome4844240829437" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --field-trial-handle=2224,i,1757101654759185685,8992619994447310493,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:9
    3⤵
    PID:4812
- C:\Windows\system32\netsh.exe
  netsh wlan show profiles
  2⤵
  - System Network Configuration Discovery: Wi-Fi Discovery
  PID:6136

C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\ovd_d0f524ca6b0f.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\ovd_d0f524ca6b0f.exe"
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4684
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$a = New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\ovd_d0f524ca6b0f.exe'; $t = New-ScheduledTaskTrigger -AtLogOn; $s = New-ScheduledTaskSettingsSet -ExecutionTimeLimit ([TimeSpan]::Zero) -StartWhenAvailable; $p = New-ScheduledTaskPrincipal -UserId $env:USERNAME -RunLevel Highest; Register-ScheduledTask -TaskName 'ovd_0a75ad50' -Action $a -Trigger $t -Settings $s -Principal $p -Force | Out-Null"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4756

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4608

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2780

C:\Users\Admin\Downloads\Getpass\Getpass\JewExecutor.exe
"C:\Users\Admin\Downloads\Getpass\Getpass\JewExecutor.exe"
1⤵
PID:2524
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$a = New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\ovd_d0f524ca6b0f.exe'; $t = New-ScheduledTaskTrigger -AtLogOn; $s = New-ScheduledTaskSettingsSet -ExecutionTimeLimit ([TimeSpan]::Zero) -StartWhenAvailable; $p = New-ScheduledTaskPrincipal -UserId $env:USERNAME -RunLevel Highest; Register-ScheduledTask -TaskName 'ovd_0a75ad50' -Action $a -Trigger $t -Settings $s -Principal $p -Force | Out-Null"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4572

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:6788

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:6844

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:6868

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:6936

C:\Users\Admin\Downloads\Getpass\Getpass\JewExecutor.exe
"C:\Users\Admin\Downloads\Getpass\Getpass\JewExecutor.exe"
1⤵
PID:6152
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$a = New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\ovd_d0f524ca6b0f.exe'; $t = New-ScheduledTaskTrigger -AtLogOn; $s = New-ScheduledTaskSettingsSet -ExecutionTimeLimit ([TimeSpan]::Zero) -StartWhenAvailable; $p = New-ScheduledTaskPrincipal -UserId $env:USERNAME -RunLevel Highest; Register-ScheduledTask -TaskName 'ovd_0a75ad50' -Action $a -Trigger $t -Settings $s -Principal $p -Force | Out-Null"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6476

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:6344

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004F8 0x0000000000000500
1⤵
PID:5520

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DevicesFlow -s DevicesFlowUserSvc
1⤵
PID:4360

C:\Windows\System32\ShellHost.exe
"C:\Windows\System32\ShellHost.exe"
1⤵
PID:6764

C:\Users\Admin\Downloads\Getpass\Getpass\JewExecutor.exe
"C:\Users\Admin\Downloads\Getpass\Getpass\JewExecutor.exe"
1⤵
PID:7320
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$a = New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\ovd_d0f524ca6b0f.exe'; $t = New-ScheduledTaskTrigger -AtLogOn; $s = New-ScheduledTaskSettingsSet -ExecutionTimeLimit ([TimeSpan]::Zero) -StartWhenAvailable; $p = New-ScheduledTaskPrincipal -UserId $env:USERNAME -RunLevel Highest; Register-ScheduledTask -TaskName 'ovd_0a75ad50' -Action $a -Trigger $t -Settings $s -Principal $p -Force | Out-Null"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:7468

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:7260

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:7764

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
PID:1376

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1144

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Wi-Fi Discovery

T1016.002

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f8dff5315a0bd3856381f405c1a16257337fd6ff2d8043dd8bea22404cd35129
MD5 5e53a2cd139f0cce4f8ceab3e015f7da
SHA1 1bd884dbaaa352a724c53bfb8f4bfad2623c93f5
SHA512 27cc4cb62f9aa4af6b521efd824b001f3b689bae2ffe57263da18e2bb22d0b13ba656141d7e6ea1d1c202d5f461a44243a00d604f78bd5b04fe6b8512e260ac1
TLSH
T178D02B1463108D04D441F13214D13311B1110833A80C96440050E1284CB634206738DD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1f3bc43c50f7d0fa02f98500baf5d78052a5560603459a9325b17de989d121f4
MD5 46a6445fd2c83830bb8c6e03f85bafc0
SHA1 46b07e35efbd47692fdc81ef0e82e2964da2831b
SHA512 800f82b05756fd6fab3fe29924147f0b86afeec21da661e646b431c6ca03903eb45bb09803f5cdaf3d2d1bb16f95d0f2e53a1f9ddde57505b0f3e1580c384ed1
TLSH
T188D02B1063208C04D441F13214D23311B1010833540C96440150E1384CB634206728CD
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 c97ffe1a6558ef4a2170c0644c4a9494273addbc4848094e5ff6f69a8a6c633e
MD5 830d7ca74577ab9b19e7ec8708a38a51
SHA1 30f182659b152cc0cf0679426c4c61ceff25d53e
SHA512 f98419e3880d17768a2f58b9466a3ab28e3dab4993b0b3ef10a5b21702fd6aef66a9225316a3610056234ccb9002148e49d8e2b2bd4e4d7f562afca1811445cf
TLSH
T10251D69E03321AC0E79760B664E4558933F6A60A0A0B5E335750AF337A4BF19E1FE103
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a2d4b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a2d4b.TMP
Size 3KB
SHA256 ce163ab7651bfd868a39fa9d46d6969d8eedec70719d942f7112f0363d9a777d
MD5 f975af26f31cc7130a5b405cf7ba552c
SHA1 cebe60890e142f783b5464b2081d4b6fe0adce25
SHA512 6fca05f7df6ac64d403b6db7696a3fa6a138d54b3fb76c51bf3a8128f53e35be0d061291cfc950f11b4f066fb896871158d8f65467edf2814680782fa9348f9a
TLSH
T16851D69E03221AC0E397A0B664E4158933F6A60A0E0B5E335754AF337A4BF19E1FE103
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 224KB
SHA256 fc625d86cc5bd1e2efa303f98a74ec9fb8a5aaa28a843bc33a3a07a4d56056e4
MD5 8f7b7f4fa4a2878d68a658e043b51ef1
SHA1 596a7558f86cdd260d857ddb14add6a428f3351f
SHA512 e0e7c0009cc6e2ee4ad96eb210da41e97784b4a5ffceea3d901dbe735030f26880a61af0c32a0eb27cd6e1e36b37bf0f75f5bace57d70ca6425bc4539937f23f
SSDEEP 192:r3jBfZ9GhH+bF+UI3iWGVoWN3qL/1VVV63:r3jhZ9GhIkUI3ijVoWN3qL/1A
TLSH
T15F241F5F5F342712CDBD913669E744A35C6DF03F8B1366CA6C6114B4CEE2652A02C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Size 24KB
SHA256 0d5b8f041e42313ae65b4ec6605d7a08ebcd046ff108f76dc4c4476d0cfbab73
MD5 30aefd619528e487bd3d5c735daa288b
SHA1 58141d217b8d10c68ca05ed4a1ad9b4ea96fba46
SHA512 681003e5ea350637993973a0331433f41f80ee257ef4426a67ad31976a6fc470a4ea56c527a4a633bc7540027aab2b0a5fe55feeea92d427b771ba333fe4199c
SSDEEP 48:Txk/LopFMaty423w/a9NUuTxIwZXHNsb7+oXwf2QXjU4:qDeMatha9bIC+jJQY4
TLSH
T157B21F4E1F346221D0B05B77EED184A63F6C111D83636A49A954A0B38DB36ABF9060AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 648224973a1f000e0d1d1113b62c441bc4661d5e141892b47595a5000e9b11a6
MD5 06f5270fafcfd2c5f1e4c038f0e9d7c1
SHA1 6806456d1c365f2687371e7d065a375d0fd9ca33
SHA512 7070a7ac6fa66a0178dbc05771dfa64ec8513e46af2236c3996e0d822c7c00abbc1ec83bce8caa3060b0881d0fda0891ef63638896c87e05b19467570cd46d5b
TLSH
T1EB51ADF783E4852ED90296F0AB14AE1FDE1D0424472C3C2A89D4AE6BD3F3461E105B9F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 5541f2272f175d84a8389a267be5b227b2fadb81ab7b960e169465635db902fb
MD5 d20746fabe248f34eae3c9a626e25537
SHA1 e1267d69e25006681d35caee2678fcff67e46d2d
SHA512 7f813010d3695883427ec546e2a060b20239afea70401725373cf9f204befe921b60e2e3f1c6ec3ff9a052a7a8128bc220be4b8c9f5583f961c55e4bdc772aef
SSDEEP 192:sxRZhR2OhZ/f1Ls6YDde5lSbGzoD8ppf/g6+WNZA//YCdYuOgGNIgDqJ:sxR3Lz/fNs6Yc5lJF/52/kVS
TLSH
T1B942D815A928AD3B9CC7E61DFB55BF53E2F9503261D01E48A7FC861C04EB6DD220B41B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 12012a797da9a3b3c168c4e5b22e565b18ae2eb28997c17f4c70a0ddc59ec83b
MD5 f28e7bb17686407acfb1354e5fc2dcc5
SHA1 27076230e7997f91ba08897922b27bee6e583a83
SHA512 cee784185c82353ee19c32a2fa706ac80d358bb800e6b599391b469ac09979eddc35633f912f945191e78eb4d2e6086d9b96dd311054b45e61d52a6af00521c3
SSDEEP 192:sxRZhR2BhZ/f1Ls6YDde5lSbGzoD8p7f/g6+WNZA//YCdvuOgGNIgDqJ:sxR3Yz/fNs6Yc5lJb/52/RVS
TLSH
T12A42D815A928AD3B9CC7E61DFB55BF53E2F9503261D01E48A7FC861C04EBADD220B41B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 5acbda68e5be644f921bbc44c6eafd6370ccd32f68b073401bb848eecce665de
MD5 aa7e1176202a6b86cc710c8df1212320
SHA1 a01e18532eb50567f2e4f98f7df0917dad0c2420
SHA512 801edc7012d3a060b9c7d188209930ac04d44dd767bb8a95cc2aea82e69e934bd6ce824ba9dcd6c65efa431bb3cd29e64b29a3376846a6a4dabc24ddb80bd7a4
SSDEEP 192:sxRkhR2OhZ/f1LsAODde5lSbGzoD8ppf/g6+WNZA//YCFduOgGNIgIJ:sxRYLz/fNsAOc5lJF/52/HVs
TLSH
T12442B715A928AD7B8CC7E61DFB55BF63D6F95032A1D01E48A7FC861C04EB6DD220B40B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 6319b46efd69ce704679f41fe9c5dd02b09830f79c18df78359f6aff4354982b
MD5 0252b794e88f08f65365451679c02202
SHA1 52aefbe6a190523bb87e02e47af84af84f64dfcc
SHA512 5d0574ccc2fee4183ca8e5f2db04da3df9a20c1de0fa88b0b19adaff8f64cb3433dcd71f860808f130690b4fa79449acdf35edbbad90dce59c2f9a40f567efb9
SSDEEP 192:sxRZhR2OhZ/f1Ls6ODde5lSbGzoD8ppf/g6+WNZA//YCFAuOgGNIgDYJ:sxR3Lz/fNs6Oc5lJF/52/QVY
TLSH
T1B542D715A928AD3B8CC7E61DFB55BF53E2F95032A1D01E48A7FC861C04EB6DD220B41B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 6b823dcf0df93336877e855b3ca17a408ef753f4230b23bbd08e635db08d034b
MD5 d8e0ef0f102988c2cd841cb065e9406e
SHA1 28658aaab651a68e2b3606db836ac4295f901478
SHA512 603e24e129c29ae691145667b6c9c0c41de1586df92198aceb40c4e02602e6146a33989cdd2eaa4673ad8bb06f8a08bd8f1bdd33bab768881144fe1c173def2d
SSDEEP 384:jjm+vhKfCtgQCFf4+KhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVmC9qyRvuroZSY:jC+vhQWgQ+f4+8F1+UoAYDCx9Tuqh0Vc
TLSH
T1CBB2DA2B600DCB7F4F800AADAC196FD76DA802CB97589D5047FED94C02C77EA92194DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 256KB
SHA256 c9eba000fa1a81071836a4e90880a42ae75435b9aa8b851ffcf133c1834bab83
MD5 035cc2c5cf59a03970f5389612aa55dd
SHA1 ab57405d61b5574d5ab121a836ea8a6a88e51c05
SHA512 8e0868f3d9b3887b18d754f8f05b84a7842095791c00a235e11ef59f686e386acbcd9a95bf4a88414858fa15163061f068544ac1f15e03ad263c6ed542167ebf
SSDEEP 384:DNrRZyCSDnxTICbjMEhIKyll7svbFKfk7:xFZJSDnixyI1l7svbF9
TLSH
T12544740A7B747001EDE6D9725CB080771E3CB26DCF22A6916DA254694DB3853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cc0ef25a-0d9a-4bc8-8043-17e676dbce09.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\cc0ef25a-0d9a-4bc8-8043-17e676dbce09.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 84af34d68cff1bb337e32e2368fd0ad74f7fcccb44f0854073c03f7d724b0e3e
MD5 4b64b31b5357b803208bc0587af5dbcf
SHA1 e95ec52f85a6e51d6663c843ad24517d42677753
SHA512 4a92a989f38c3e6972be4ab4c66d6f2fe78fe043686fc047122b4eaa6f18defdf017a7a47ad96e94afa1206b2fbfb43dcd02f63125b1969b848d49f28c8b871e
SSDEEP 768:1I3YtuHVyp8+p3bd66j+4BRv86aLIW9RYTy:1I37VM8+p3Z6n4y3+Ty
TLSH
T199F2AEB2E8A8DD738CE6C645B28636036FF8515396C01DD4D8DC7B1E119B2AE270F836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 82b871d1f96235d37f3debf29d8de8b95b96c02e2b47e15e6b47b6c9ab34bfd6
MD5 e4732eb87622a7287dd6cd8e59dac46b
SHA1 7d6530ef4309b2519bc449495b68d1ab052089e2
SHA512 e61055470ad8b931e6b91af2741b52565057a27ce6c3a1d3075ad5900015ee0c61e8df943b45d611e3f6f58411b48673801f5973f6a28069381182768808d449
SSDEEP 768:KFDu3RwgTtuHhqp8+p3bd66j+4BRv86aLIW9RYTy:Iu3WhU8+p3Z6n4y3+Ty
TLSH
T15E137CF298D79877DCAD8743A37E2E025EBCC153B5801990B7D86A1DCC561BFD30A825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 8e5f28f1e1f5291a5b26e4368ad365a54eed794ec11310747f73bfbe8cdb0a13
MD5 358020ddd975096fb515650e81631250
SHA1 3b57b27acea770173f5eb1426488bf57a378d90e
SHA512 55dae17fd140ba2f73673e146d91254f7d4ca644c451db2c1c940520e3aecd31f6da3aeaaf6d0bcbe99a21a4bd063d77a8e7e191d53e517e0c3b23e322564148
SSDEEP 768:nrv+4UNbdD3Et8HVNp8+p3bd66j+4BRv86aLIT92bwCl1:nbsbp3FVL8+p3Z6n4yo0ww
TLSH
T18203CE72F4A8A9339CE6CA44B14B7A437FF8519396C00ED4D8DD6B4E019E19E630B937
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 3446c53059a0a2bcb4a76e9543673f35ac3779d85a777fc678a7a1b7c592e6d4
MD5 bf9c636d56177641b26337cd329a0457
SHA1 a0f6fbc431f5b4a5e76ab902e5730ce9236de8d0
SHA512 8d58ffe8a96aeab2ab485b25d8958affffd316780ba5cdb19d66d1fe10a0bd7a909da12f826581f1b48e2ac02a7d176983633b77e24333a65ee44b50b65c3640
SSDEEP 768:iP35tuHVyp8+p3bd66j+4BRv86aLIW9RYTy:iP30VM8+p3Z6n4y3+Ty
TLSH
T132F2AEB2E8A8DD739CE5C645B28636036FF8515396C02DD4D8DC7B1E119B2AE270F836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 9f1905cd452cad884cfdb26eb597f15735d5c1b8a8ef4dc8bfa51b1ddb27949d
MD5 337a1a8c5db5575b83cb8d2117528c66
SHA1 a0d2ee759433af082da9498d5aa1a7f072c23982
SHA512 06d77578c868c6503e7286a4030dbfdf632c461cbc6ea36fa321411d0fc198d06ea6542479b01e53239c36d1ca794be16dded522ebced6a8e10776aa559e65b9
SSDEEP 768:vI3rtuHVyp8+p3bd66j+4BRv86aLIW9RYTy:vI3uVM8+p3Z6n4y3+Ty
TLSH
T1CDF2AEB2E8A8DD739CE6C645B2863603AFF4515396C01DD4D8DC6B1E119B2AE270F836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 4a4bebbfaed72f5fd0607e3bbffd05b4920c584843b6fc668e31e7a4562cbb67
MD5 9992d73b069440f539b4fc94c0606a94
SHA1 79d33aa7ab707b8ccaf9de9bcea4d08fa91b7258
SHA512 7ae030324f1e9a1fa2f0dba8654eed7cf040e256c59afeec6e4c9da0ea1d224e48c213132f078a5c1f71d8876e90a0cf4f77fe32e3af77c9796f94f78c210c0e
SSDEEP 768:iI3otuHVyp8+p3bd66j+4BRv86aLIW9RYTy:iI3rVM8+p3Z6n4y3+Ty
TLSH
T1DBF2AEB2E8A8DD739CE5C645B28736036FF8515396C02DD4D8DC7B1E119B2AE270B836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 107745e4d2fc80e9033509b773200eb8a4cfc55c59f0c83693cd371b03acc28a
MD5 7fd1f15cca041876c6c838d82b4163eb
SHA1 ddf942783830ad5beada8a6e71c64f2df07a59bf
SHA512 46057b5515e73295eca2366394094d22662cd27392f667b5acb59593b66fdfbf741e28743936a1adea333d6244e27212adecfd03e15337ebf186d3a17f193376
SSDEEP 768:KFHu3RwgTtuHhqp8+p3bd66j+4BRv86aLIW9RYTy:Wu3WhU8+p3Z6n4y3+Ty
TLSH
T196137CF298D79877DCAD8743A37E2E025EBCC153B5801990B7D86A1DCC561BFD30A825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 e1e5cb48a9d9f73469eb41e717cdfb7d928bfcb740c38f3c483c5ac77014b82e
MD5 a3e051e60f44e270d49efd56f51b8047
SHA1 6acc17f3be8f02c545b970438c68ebc0d9c491cd
SHA512 82467cd8871c969094fc4e7746042977117f9393c9876a420125574ea82e464a1b2ec0a2b0c29c8a324219be881c3a31c94ebf8e086048a4f328afbffe47010c
SSDEEP 768:KF773vwgbtuHhap8+p3bd66j+4BRv86aLIW9RYTy:k734hE8+p3Z6n4y3+Ty
TLSH
T14DF29DB3D898D9779CFACB45F28A36039EF4419396C06DE4E9DC6A1D109B19E130BC36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 6649ef881db552b0fa2c0757ab5ac17ae56e12c5920119b74e1e9633e29cd66e
MD5 4543c2643c263da5e2b25c0f180d650a
SHA1 317918d543d7c8e2f80ceedbefcad452830792fd
SHA512 2833cb788dafdbd96aedcfeaad280d81c851b5a24ca40068a4a31de16e7ad62093deb840015c6f0f583e8689607d24403ae49b0e5202b7cf924f0d7b31b40bd2
SSDEEP 768:Irv+4UNbdD3PceNp8+p3bd66j+4BRv86aLIin2bwCl1:Ibsbp3zL8+p3Z6n4yF0ww
TLSH
T19B03CF73F8A899739CF6C644B2467A437FF861A396C10EC4D5DD2B4E419A19E230BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

814cce58-e431-4bab-85c6-16101a9bd9b8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\814cce58-e431-4bab-85c6-16101a9bd9b8.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 d28ef187840dcd1fe0a8a757ef9cd326023bec38b39ef1338f91d508d55dcf28
MD5 acbc65123954839a819fa2495d239bf7
SHA1 063cff64444a6e3b4be1445b4cecb477e4d6ae47
SHA512 af07d3f6dcf1779bcc864aabe9e08563b20b8df8238df7bb08a5fe3b4e40d10f2e2a4442a042fe5d7a320e3b8195799ecc885549faa8babb5909eb32271e7b91
TLSH
T170216833B3DD8615CC9A413A10CDAC1036B6C7DB40DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 97ca5fb4e009d6f80829163135425888934bfcbd27c15e59937f3f5126e9e4b8
MD5 8f9cceafe6bad287e962f1ed746e7df1
SHA1 a551e090d9e927c592b29228c07f8ec1558c4689
SHA512 df0bb6d23c226288cdfb7c74f8ac049e59ec49a7d15900a0ac0b345e3a6ca95301f08c26c9a99a770398c7f925e16fc3b9372c451c6c8959995b4120fd08c7c2
TLSH
T10C216833F3DD8614C89A413A10CDAC1036B6C7DB40DECEAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome4844240829437\Default\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 4b1073a88d2bb7bc8d81905ab2fe5695a0e351cce926f3ba27b310491dc90e4a
MD5 af31f0033a71637fa33ead321917102b
SHA1 6531ead25dcea36643c4ef924a0d0a0d411ef207
SHA512 f5464dd228961805a69b726c2381b32fe0ed2dc027dc69f8f3df39a260b5398a364d18bd9cba46c7814880defdc5c7f5298413b01a6b42339459e48c00e54da3
TLSH
T13CA0021572D00D41DA69477454522D80B220CE641521531791E0C0858B672E352090C1
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5b44f5.TMP

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome4844240829437\Default\Code Cache\js\index-dir\the-real-index~RFe5b44f5.TMP
Size 48B
SHA256 3f7fec49456d92ed3727b9c557fd52df7b5b49ba982e478c8f5ca109eabbf02e
MD5 1a05d8db06212bd20392a71e58c2916e
SHA1 9bcd1a92f725cb0a059b6a27936f9f52f6f3a774
SHA512 f228c628d0a8a96854738e4d2f47235a906c561ce5cf72223b93c621c6a5e9dfd9415afe2700388c7e8a578bdf7fa6692eb8d290eccb8fa520490aff26dc35a5
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome4844240829437\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome4844240829437\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.109.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

service_worker_bin_prod.js

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome4844240829437\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.109.1_0\service_worker_bin_prod.js
Size 132KB
SHA256 108c7add8cba49512da24b2a1b95cef35d778691ef5a5d01ba66c2ba7dcee00c
MD5 4208fdfeff374e23801e43b0fb3be7d0
SHA1 7115966dc5b13d52e04ecab1915d83ff4f851c0b
SHA512 93c65fa0c727676bd1741fca7d31166798ffeec416322c30dab27f5ae7cf7d77b3d4cfc72e2d75fde9d9c389dfba9a57c2417321ddf29ff01718beba0717c070
SSDEEP 3072:NMMPOfeioQnKd8lIuG5sVFbcBvahMWlURPLVV+9Wy7:NMMZQy8h0ahMWlURPLVV+o0
TLSH
T165D3D9CCB6B5B4224363A5F5002F010BB23AB8A9E44C85A8F188D9E97DB546D4377F7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome4844240829437\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome4844240829437\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome4844240829437\Default\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome4844240829437\Default\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome4844240829437\Default\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome4844240829437\Default\Network\Network Persistent State
Size 879B
SHA256 dfaae930d2721c6a23537ea6d089329b4c1e8f3cfbcc7ea58bd88262be196ed6
MD5 1202a6ac0935701399649d1994edf125
SHA1 8f921876a5ecbb1dc20d0901bb558c4b50a948a2
SHA512 b6527496364004d231adf6affabf3fb8e6b1884ab96da87404a20ead36f71636cec401deaace5abc2cd2d917c3eb4e43480a4292f60339e207c3dec4f556d500
TLSH
T191118CFBC2D8857D494282F8E7156E1BCE7D0904532C3D56D8E46F2F93E2971914055E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5ca9b5.TMP

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome4844240829437\Default\Network\Network Persistent State~RFe5ca9b5.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome4844240829437\Default\Preferences
Size 8KB
SHA256 918b103d0d1b81e45091bf24a9e8a827ac7e794ffeb14b0f6c2f8ddf51f6b665
MD5 e1dcc9d90fa2bc69d0d09ab8d85ebdb6
SHA1 bb0903863bbf295a4fd55fd1cd65a7dac30885c3
SHA512 baec918b1be7850449b432506a343145b34470197198f034582ace67c2626c5a5e5afe3e5b5177822dee18ddfdd36c1e2ffb34cd20aa998fc258e33686e2ea99
SSDEEP 96:zRg6FQi6Hv7T2WME0Ri0M2WAeuX792b+WVoMkm+TeuOjhJQ86P199iy6yIsnIS4G:zRXK1v7TKPRpMyXsb+WN4R9iyIsnAUgE
TLSH
T19402942DAD14A67B9CC6E71DFA657B42E2F5103175A02D08D7FCC92C28EB6CD222B017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome4844240829437\Default\Preferences
Size 9KB
SHA256 236c61731225ec5256876de68de775f072c3392c66ea2e2a24c0d70e97cc081d
MD5 1ed2d78b711fefc41e2b8b622e307912
SHA1 0921db4f52a0d1e292e55138e7d30bcc7cd24e0f
SHA512 85d204e0392ce758c06a73ed03cca0c963d4aa251010c797a373282f17295ec49681c2a82f292f6b6192c29f8b14c5134b0f8594f96e5c8966900f82f7b0a342
SSDEEP 192:zRXK+Iv7TKPRpMyXsb+WN4R9iyIsnAUgE:zRXKLEXvXw46E
TLSH
T1B712A52DAD14A63B9CC6E75DFA657B42D2F5103175A02D08DBFCC92C28EB6CD222B417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome4844240829437\Default\Preferences
Size 7KB
SHA256 5ec06fb64ab8111f22bba4c1a367ac93ad0db5053390e2e59c267936c7f7d42b
MD5 bb209e6607049c0b345e3db408743285
SHA1 620f7ecbb3256215f0226b0bebd9142de288ae74
SHA512 a916b16b7e95335d1101bf93e1f32db7e21a30e97de6e01edbddccfa3acda549138dd02a27fd5b9b287ee9bba55296faca546d067b8d84020f2163cd920011c2
SSDEEP 96:zRg6FQi6Hv7nd2WME0Ri0M2WAeuX792b+WVoMkm+TeuOjhJQ86P199iy6yIsnIS4:zRXK1v7dKPRpMyXsb+WN4R9iyIsnAUgR
TLSH
T1CFF19419AD24653F9CC6E71DFA217B42E2F5103275A42D08D7FC892C28EBACD222B517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome4844240829437\Default\Secure Preferences
Size 11KB
SHA256 74b8f40fe353ac8b90ed55a6e6e00c8e83b2fb0e957eaa4a29572a4da7f7bd8b
MD5 3b6a1b0ffc04c06cbca28a80e3770c9f
SHA1 1ba7c0da341dd7b94b02665d9336633426716be7
SHA512 8901b98c2c2429790579ee66d38492846cf818b53f89d7dd9bfa0b86a7b5cb0b97e1d6ec96c22ed186088b2f40556b9e97e1ed7bd65ce061f22d4095c840b6cb
SSDEEP 192:e/Y4K67z7KxkXqK4I40pUZNCgVLHrKHfFKslEBHJXzKD/QP+ErUkKN9GrtuvvGjM:SYjIz7KxkXqKf/pUZNCgVLH2HfgsloJm
TLSH
T10C32E727A88DAE3F0FD8D55DCD136F8BACB5019762280D2856FB5D1803A57CE124A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome4844240829437\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 0f82fddf80fb515b73c39a4d2d95b7fbc1a646c06b4cc473df5e0501978c1185
MD5 08d9082a0bd202499964af529d2eaade
SHA1 b167a377762cab1e0259c896ccd86ddc9452e23f
SHA512 cb8a5cf7954209ed3a069948946431fe9168991cbe818db8ec7394796914067474c83cb20612ec5a22730c0df6cb00a7629b11791dbb00960b654e55ff182c44
TLSH
T1E9B02222C0028002C0E2C3F0308200CA30A2AF30C20ABE02C3E00FC3C8032F00B38880
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5b434f.TMP

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome4844240829437\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5b434f.TMP
Size 72B
SHA256 c61e67c26b1164572ea55789af71923336ed8f56041732367085a7c56234a743
MD5 ea89bb00813c9ef5823725c19e2b59e0
SHA1 37487dbd52d94efebafa49c9e8cb00b8bdcb3180
SHA512 281f591371593253f31e64254ec137642cf0c3470fc7d6d17a6bf73977f1e88330044afe46ebddd4b07f8514b4303f357e7f6f8ec17f4d25409333f811743d8d
TLSH
T1F9A0029107948510C50116B4BD0197CD1302B9368414022376F6434A8DA0050891158D
MD5 SHA1 SHA512 TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome4844240829437\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\wasm\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome4844240829437\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

c3f957ed-e619-4b91-b521-604eb11f3d0c.tmp

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome4844240829437\Default\c3f957ed-e619-4b91-b521-604eb11f3d0c.tmp
Size 7KB
SHA256 4278a6a6e8f63b9609ebf5cf1ac8c9fa956a4072999b11b7733e902dbca6d7db
MD5 8e29518f69dd023be68653212d71fd15
SHA1 9df512e78e10904334456d667bc582cd6c154bf6
SHA512 0aca7709ba2c0262a33fae1355c8d76ba5ab3102ef79ed4c928a69fce95e14557cea58e4e4e99a087e4b32c008851024216084b064f2ff7f2c63d2620e9f96db
SSDEEP 96:zRg6FQi6Hv7nd2W+E0Ri022WAeuX792b+WVoMkm+TeuOj686Pbiy6yIsnIS4lhBp:zRXK1v7dAPRp2yXsb+WN4hXiyIsnAUgR
TLSH
T1D9F17429AD24A53F9CC6E71EFE217B43E2F5102175A42D08D7FC892C28EB6CD2227417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome4844240829437\Local State
Size 3KB
SHA256 7e9aa0a45b69e2234381c03cf84f3497bfcbc69c204321e451748f5f76f35ef1
MD5 07239196b0de336b954758e3eb590138
SHA1 ecb73d1ea78c8a2e33f6b9cae89bcf80006500b5
SHA512 f2e948346c4c3b160e4001a7e43b38b2af9bd9988d1c7b4b794cabe0082e17db06383d84f05f7db56005d78fd446920a9192cd388ef0a8f762f60a56655097ac
TLSH
T1B181E961B47ABC3759B7C949FA073503CBB42157E152BE98CAEC0E1C15EB6EC130A616
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome4844240829437\Local State
Size 129KB
SHA256 c634e3420d3fb5f74a3834841874a9c775788f73affdbdd3df4d16c58c92c791
MD5 297e52f5a45a6190a3003bc8ee929c04
SHA1 0c5ba1b34fc7c3d257de0d8d6d040c84cb4a5f93
SHA512 c962b972309380f10b1c22d885fe417938c6f72888b77a61fd9e18721fd3b4b05115fd9f4d22c8065e42549ae74fec52d7642d894ccea40080d4c7a4b7636464
SSDEEP 3072:hSq84IbKxdKpL/7ka1AcNrDeoHVwQK8pzs2K1DEWRCRz1GcP:hSrbKKpL/h1L1xKMsln6zQcP
TLSH
T15BD312777B343FEB0BE825B9200F394F4C7F918BAE5937AC479E211685057E59782222
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome4844240829437\Local State
Size 128KB
SHA256 80c8ba38f5cb07cf50131f5e8ee71044f5394fc2150256185eb7966fe5e6fc08
MD5 aed9831166bfd2494d22d43b3c5d9ae8
SHA1 b420cc354f780055924115b7ba81f6bb4a0fabbc
SHA512 535d016207e8228c04d0d61e4b1f1bd9a196f9baf4b3a4b000ff1b961bc91370e910190abbdaa43b5b49c5b5a3b64ba0c92b0437c679c12bbffe0aa015fff285
SSDEEP 3072:jSq84IbKxdKpL/7ka1AcNrDeoHVwQK8pzs2K1DEWRCRz1GcP:jSrbKKpL/h1L1xKMsln6zQcP
TLSH
T184D312777B343FEB0BA815A9200F394F4C7F918BAE593BAC479E311285057E5D786222
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome4844240829437\Local State
Size 3KB
SHA256 5cc95f220602b9497cbaa87a9b578b421d89003f21fc823fdf3a653eec405148
MD5 eb9a28e694459c2f1459b7f4dee1d97a
SHA1 52fe686b0e187b3d0bdc06868337b2a4ebeab842
SHA512 cd33c8f53dd3e73715ee73ae217e26cebc672fa6c065d4fb3915fa03dc0c7e1ca6081fcb8ad66499ed88215b10816e6cb4536f7a55272be9447376c1bbd31c4b
TLSH
T1A081E861B47ABC3759B6C949FA073503CBB42157E152BE98CAEC0E1C15EB6EC130A616
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome4844240829437\Local State
Size 3KB
SHA256 9244207df1630b06e9981caa5af833ea3a8ed7ddf17ad52459a797eeb6f40573
MD5 f0c777d5a1ef81b1977b286c6e47911c
SHA1 adad464fc3bdc2c9a444b9192e7a0e74c9da015a
SHA512 2bdca92f3350dd1ad2a870550da5c2cf2061272660178f9dc62fba7fcedbce9c771de6d5140820f7e3e98aaae68b3b860b5fe062f0548cac4a201b845873e4a1
TLSH
T1AD71D771B4797C3759B6C949FA073A03CAB42157E152BFD8CAEC0E1C15EB5EC130AA16
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe5afabd.TMP

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome4844240829437\Local State~RFe5afabd.TMP
Size 1KB
SHA256 a259b5af234ba0f3212d88e1f81f688e139fac943660a321ed1ba021d261b09e
MD5 0f8d819067ab2a02eee781ee66a7a641
SHA1 f08814f3ed8ad86878cef516ceba2b7ecfd9cc2a
SHA512 b96268cf48f774d054baf4d146ad750873e387d6fe847041c01d7f91c2a85321313110bbdba447dbe6eb0a71d0cb6b76fb957fe7c2777db0cac9b20f6ab08eac
TLSH
T13A11A870343A33306D858A5DFE5366B75F345367D063D98D1FCD092119E57BC2209938
MD5 SHA1 SHA512 TLSH

Submit Download

OnceOhSnd34281.mp3

Path C:\Users\Admin\AppData\Local\Temp\OnceOhSnd34281.mp3
Size 155KB
SHA256 81fbb78441163023454e60aefb0a1c1b71d7627534bf75c42655bc823db3f675
MD5 e7e286c1a3c0cf7a211124277ad80c47
SHA1 e7479ea77fd5cc0a6eb12985583a32811db21b6a
SHA512 40fc084b1dd66ac7d49f8b628e831be8050e57a584440a3bf581a774747bb9d6a6dedf70411cbaae2f71f0f8fcf09588a71e54660fd6a26a512c0a8ebc61959d
SSDEEP 3072:KHYUGwZE8IgiafolT+C+aCHnus9zRvBjwq79svtcK4/JjEm:c/ux5aQJxCus9Rv5wq7+vtu
TLSH
T1ADF3F18A5319449DF1422F3D618FF532EA46292E2D00CCFC24B5AF0552BFA42FBED659
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_k2knln1e.m2f.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_k2knln1e.m2f.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4844_1164273999\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

agent-2258702595.tmp

Path C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\agent-2258702595.tmp
Size 42.0MB
SHA256 a7d4a839148bb888bb76b208e2ff7f8b400c3f9cee52521093288f60f67a529b
MD5 869b0f6f5fe81f75ee37bed50eb0e77b
SHA1 45771883c2e9de6c1dfa41e0f97031c0c4c2e8f1
SHA512 5b80619baee2e39d1f66912022ce84574f97aa5eaef5107051301ba6b148162ef8f1dd29932b50eb55d2cc530b56106acb502b795a519f0a397f7e0ad56e33b6
SSDEEP 196608:9syQQYE3RlWFUCheropcY8PaIwvc/SyaIFoLjv6VnTxmd6RMAWjYs5j7VT:9BQQYEBlM34scFPaIwECLjvgId6+AeD
TLSH
T130A73A63F8D21D94D5EAC170D672817BBBA13C690B7823E70690F7201F3ABD09AB6751
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1376-1174-0x000002ADE1080000-0x000002ADE1081000-memory.dmp

Download

memory/1376-1184-0x000002ADE1080000-0x000002ADE1081000-memory.dmp

Download

memory/1376-1181-0x000002ADE1080000-0x000002ADE1081000-memory.dmp

Download

memory/1376-1186-0x000002ADE1080000-0x000002ADE1081000-memory.dmp

Download

memory/1376-1185-0x000002ADE1080000-0x000002ADE1081000-memory.dmp

Download

memory/1376-1183-0x000002ADE1080000-0x000002ADE1081000-memory.dmp

Download

memory/1376-1182-0x000002ADE1080000-0x000002ADE1081000-memory.dmp

Download

memory/1376-1176-0x000002ADE1080000-0x000002ADE1081000-memory.dmp

Download

memory/2524-590-0x00007FF732DD0000-0x00007FF7378E6000-memory.dmp

Download

memory/2524-604-0x00007FF732DD0000-0x00007FF7378E6000-memory.dmp

Download

memory/2524-469-0x00007FF732DD0000-0x00007FF7378E6000-memory.dmp

Download

memory/3428-282-0x0000000244E40000-0x000000024797F000-memory.dmp

Download

memory/3428-307-0x0000000244E40000-0x000000024797F000-memory.dmp

Download

memory/3428-1530-0x00007FF732DD0000-0x00007FF7378E6000-memory.dmp

Download

memory/3428-1528-0x00007FF732DD0000-0x00007FF7378E6000-memory.dmp

Download

memory/3428-654-0x000000039BF20000-0x000000039BF4B000-memory.dmp

Download

memory/3428-655-0x000000039BF20000-0x000000039BF4B000-memory.dmp

Download

memory/3428-603-0x00007FF732DD0000-0x00007FF7378E6000-memory.dmp

Download

memory/3428-632-0x00007FF732DD0000-0x00007FF7378E6000-memory.dmp

Download

memory/3428-664-0x00007FF732DD0000-0x00007FF7378E6000-memory.dmp

Download

memory/3428-1527-0x00007FF732DD0000-0x00007FF7378E6000-memory.dmp

Download

memory/3428-670-0x000000039BF20000-0x000000039BF4B000-memory.dmp

Download

memory/3428-665-0x00007FF732DD0000-0x00007FF7378E6000-memory.dmp

Download

memory/3428-672-0x00007FF732DD0000-0x00007FF7378E6000-memory.dmp

Download

memory/3428-277-0x00007FF732DD0000-0x00007FF7378E6000-memory.dmp

Download

memory/3428-257-0x000000039BF20000-0x000000039BF4B000-memory.dmp

Download

memory/3428-686-0x00007FF732DD0000-0x00007FF7378E6000-memory.dmp

Download

memory/3428-748-0x00007FF732DD0000-0x00007FF7378E6000-memory.dmp

Download

memory/3428-785-0x00007FF732DD0000-0x00007FF7378E6000-memory.dmp

Download

memory/3428-589-0x00007FF732DD0000-0x00007FF7378E6000-memory.dmp

Download

memory/3428-330-0x0000000244E40000-0x000000024797F000-memory.dmp

Download

memory/3428-1526-0x00007FF732DD0000-0x00007FF7378E6000-memory.dmp

Download

memory/3428-1513-0x00007FF732DD0000-0x00007FF7378E6000-memory.dmp

Download

memory/3428-1032-0x00007FF732DD0000-0x00007FF7378E6000-memory.dmp

Download

memory/3428-960-0x00007FF732DD0000-0x00007FF7378E6000-memory.dmp

Download

memory/3428-1461-0x000000039BF20000-0x000000039BF4B000-memory.dmp

Download

memory/3428-614-0x00007FF732DD0000-0x00007FF7378E6000-memory.dmp

Download

memory/3428-624-0x00007FF732DD0000-0x00007FF7378E6000-memory.dmp

Download

memory/3428-1005-0x00007FF732DD0000-0x00007FF7378E6000-memory.dmp

Download

memory/3428-1460-0x00007FF732DD0000-0x00007FF7378E6000-memory.dmp

Download

memory/3428-301-0x0000000244E40000-0x000000024797F000-memory.dmp

Download

memory/3428-293-0x0000000244E40000-0x000000024797F000-memory.dmp

Download

memory/3428-300-0x0000000244E40000-0x000000024797F000-memory.dmp

Download

memory/3428-294-0x0000000244E40000-0x000000024797F000-memory.dmp

Download

memory/3428-462-0x00007FF732DD0000-0x00007FF7378E6000-memory.dmp

Download

memory/3428-1439-0x000000039BF20000-0x000000039BF4B000-memory.dmp

Download

memory/3428-295-0x0000000244E40000-0x000000024797F000-memory.dmp

Download

memory/3428-423-0x0000000244E40000-0x000000024797F000-memory.dmp

Download

memory/3428-296-0x0000000244E40000-0x000000024797F000-memory.dmp

Download

memory/3428-297-0x0000000244E40000-0x000000024797F000-memory.dmp

Download

memory/3428-1213-0x00007FF732DD0000-0x00007FF7378E6000-memory.dmp

Download

memory/3428-424-0x00007FF732DD0000-0x00007FF7378E6000-memory.dmp

Download

memory/4572-496-0x00000266C2780000-0x00000266C2832000-memory.dmp

Download

memory/4684-278-0x00007FF73ABE0000-0x00007FF73F6F6000-memory.dmp

Download

memory/4684-281-0x00007FF73ABE0000-0x00007FF73F6F6000-memory.dmp

Download

memory/6036-241-0x00000214D8BC0000-0x00000214D8BE2000-memory.dmp

Download

memory/6036-244-0x00000214D8C60000-0x00000214D8C7E000-memory.dmp

Download

memory/6036-245-0x00000214D8C80000-0x00000214D8D32000-memory.dmp

Download

memory/6036-246-0x00000214D8D40000-0x00000214D8D4A000-memory.dmp

Download

memory/6036-247-0x00000214D8D70000-0x00000214D8D8E000-memory.dmp

Download

memory/6152-605-0x00007FF732DD0000-0x00007FF7378E6000-memory.dmp

Download

memory/6152-591-0x00007FF732DD0000-0x00007FF7378E6000-memory.dmp

Download

memory/7320-640-0x00007FF732DD0000-0x00007FF7378E6000-memory.dmp

Download

memory/7468-638-0x0000025320410000-0x00000253204C2000-memory.dmp

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads