3d05408c6776d969bb8f435b758563263885323941ebdc1d59ddb94cad1ac700

Analysis

geolocation tags

eueuropefrfrance
user interaction
yes
max time kernel
599s
max time network
602s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
27/08/2026, 07:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
install-marioforever-unimaker.exe
Size 12.1MB
Sample260827-jey9msgf53
SHA256 3d05408c6776d969bb8f435b758563263885323941ebdc1d59ddb94cad1ac700
MD5 587167dace886b5fb24939a5daacf939
SHA1 d90e3a0c1e0197a2fe31bfcc05ad9beead10a795
SHA512 8aa0fc96a0072bc2165d9e48840645f66a053a127969761b9c93eda034f7ff2709f3d46ce84466739c56845212980ae774222f8b3b27c0f867c8f09e904bc30a
SSDEEP 393216:seqMeOG7mFxC02SLp7BoAO3VwA8/z0pxxFpl/Y69J:saeOG7mnD/BBXA8/oVFf/tn
TLSH
T10ED6330D624BD2BBC85C28751C558F73233E7A3A076F5C52685CF6528A329DAF8352CE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery execution spyware

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4045429996-2364296335-1634900306-1000\Control Panel\International\Geo\Nation	Mario Forever Unimaker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4045429996-2364296335-1634900306-1000\Control Panel\International\Geo\Nation	data.exe

Executes dropped EXE 3 IoCs

pid	Process
1168	Mario Forever Unimaker.exe
1956	Mario Forever Unimaker.exe
4544	data.exe

Loads dropped DLL 51 IoCs

pid	Process
1168	Mario Forever Unimaker.exe
1168	Mario Forever Unimaker.exe
1168	Mario Forever Unimaker.exe
1168	Mario Forever Unimaker.exe
1168	Mario Forever Unimaker.exe
1168	Mario Forever Unimaker.exe
1168	Mario Forever Unimaker.exe
1168	Mario Forever Unimaker.exe
1168	Mario Forever Unimaker.exe
1168	Mario Forever Unimaker.exe
1168	Mario Forever Unimaker.exe
1168	Mario Forever Unimaker.exe
1168	Mario Forever Unimaker.exe
1168	Mario Forever Unimaker.exe
1168	Mario Forever Unimaker.exe
1168	Mario Forever Unimaker.exe
1168	Mario Forever Unimaker.exe
1168	Mario Forever Unimaker.exe
1168	Mario Forever Unimaker.exe
1168	Mario Forever Unimaker.exe
1168	Mario Forever Unimaker.exe
1168	Mario Forever Unimaker.exe
1956	Mario Forever Unimaker.exe
1956	Mario Forever Unimaker.exe
1956	Mario Forever Unimaker.exe
1956	Mario Forever Unimaker.exe
1956	Mario Forever Unimaker.exe
1956	Mario Forever Unimaker.exe
1956	Mario Forever Unimaker.exe
1956	Mario Forever Unimaker.exe
1956	Mario Forever Unimaker.exe
1956	Mario Forever Unimaker.exe
1956	Mario Forever Unimaker.exe
1956	Mario Forever Unimaker.exe
1956	Mario Forever Unimaker.exe
1956	Mario Forever Unimaker.exe
1956	Mario Forever Unimaker.exe
1956	Mario Forever Unimaker.exe
1956	Mario Forever Unimaker.exe
1956	Mario Forever Unimaker.exe
1956	Mario Forever Unimaker.exe
1956	Mario Forever Unimaker.exe
1956	Mario Forever Unimaker.exe
1956	Mario Forever Unimaker.exe
4544	data.exe
4544	data.exe
4544	data.exe
4544	data.exe
4544	data.exe
4544	data.exe
4544	data.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 22 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\softendo.com\Mario Forever UNIMAKER\data\about_pt.$$A	install-marioforever-unimaker.exe
File created	C:\Program Files (x86)\softendo.com\Mario Forever UNIMAKER\data\options.$$A	install-marioforever-unimaker.exe
File created	C:\Program Files (x86)\softendo.com\Mario Forever UNIMAKER\data\_cta.$$A	install-marioforever-unimaker.exe
File created	C:\Program Files (x86)\softendo.com\Mario Forever UNIMAKER\data\_cte.$$A	install-marioforever-unimaker.exe
File created	C:\Program Files (x86)\softendo.com\Mario Forever UNIMAKER\data\_exeshell.$$A	install-marioforever-unimaker.exe
File created	C:\Program Files (x86)\softendo.com\Mario Forever UNIMAKER\data\_fmng.$$A	install-marioforever-unimaker.exe
File created	C:\Program Files (x86)\softendo.com\Mario Forever UNIMAKER\data\_memctrl.$$A	install-marioforever-unimaker.exe
File created	C:\Program Files (x86)\softendo.com\Mario Forever UNIMAKER\data\D3DX9_43.$$A	install-marioforever-unimaker.exe
File created	C:\Program Files (x86)\softendo.com\Mario Forever UNIMAKER\data\bc_mdn.$$A	install-marioforever-unimaker.exe
File opened for modification	C:\Program Files (x86)\softendo.com\Mario Forever UNIMAKER\Uninstal.exe	install-marioforever-unimaker.exe
File opened for modification	C:\Program Files (x86)\softendo.com\Mario Forever UNIMAKER\data\about_en.rtf	WINWORD.EXE
File created	C:\Program Files (x86)\softendo.com\Mario Forever UNIMAKER\data\about_en.$$A	install-marioforever-unimaker.exe
File created	C:\Program Files (x86)\softendo.com\Mario Forever UNIMAKER\data\discrpc.$$A	install-marioforever-unimaker.exe
File created	C:\Program Files (x86)\softendo.com\Mario Forever UNIMAKER\data\_ctp.$$A	install-marioforever-unimaker.exe
File created	C:\Program Files (x86)\softendo.com\Mario Forever UNIMAKER\data\~$out_en.rtf	WINWORD.EXE
File created	C:\Program Files (x86)\softendo.com\Mario Forever UNIMAKER\Uninstal.$$A	install-marioforever-unimaker.exe
File created	C:\Program Files (x86)\softendo.com\Mario Forever UNIMAKER\data\discord-rpc.$$A	install-marioforever-unimaker.exe
File created	C:\Program Files (x86)\softendo.com\Mario Forever UNIMAKER\data\data.$$A	install-marioforever-unimaker.exe
File created	C:\Program Files (x86)\softendo.com\Mario Forever UNIMAKER\data\tb_mdn1.$$A	install-marioforever-unimaker.exe
File created	C:\Program Files (x86)\softendo.com\Mario Forever UNIMAKER\data\tb_mdn2.$$A	install-marioforever-unimaker.exe
File created	C:\Program Files (x86)\softendo.com\Mario Forever UNIMAKER\Mario Forever Unimaker.$$A	install-marioforever-unimaker.exe
File created	C:\Program Files (x86)\softendo.com\Mario Forever UNIMAKER\data\cc_mdn.$$A	install-marioforever-unimaker.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3408_1787334039\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3408_1787334039\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3408_1787334039\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3408_1787334039\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3408_1787334039\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3408_1787334039\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3408_1787334039\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3408_1787334039\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3408_1787334039\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3408_1787334039\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3408_1787334039\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3408_1787334039\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3408_1787334039\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3408_1787334039\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3408_1787334039\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3408_1787334039\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3408_1787334039\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3408_1787334039\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3408_1787334039\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_3408_381803300\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_109_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3408_1787334039\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3408_1787334039\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3408_1787334039\_locales\mk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3408_1787334039\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3408_1787334039\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3408_1787334039\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3408_1787334039\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3408_1787334039\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3408_1787334039\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3408_1787334039\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3408_1787334039\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3408_1787334039\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3408_1787334039\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3408_1787334039\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3408_1787334039\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3408_1787334039\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3408_1787334039\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3408_1787334039\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3408_1787334039\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3408_1787334039\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3408_1787334039\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3408_1787334039\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3408_1787334039\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3408_1787334039\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3408_1787334039\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3408_1787334039\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3408_1787334039\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3408_1787334039\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3408_1787334039\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3408_1787334039\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3408_1787334039\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3408_1787334039\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3408_1787334039\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3408_1787334039\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3408_1787334039\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3408_1787334039\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3408_1787334039\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3408_1787334039\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3408_1787334039\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3408_1787334039\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3408_1787334039\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3408_1787334039\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3408_1787334039\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3408_1787334039\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4836	cmd.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4468	1168	WerFault.exe	98

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mario Forever Unimaker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mario Forever Unimaker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	data.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	install-marioforever-unimaker.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
696	msedge.exe
4320	msedge.exe

Checks processor information in registry 2 TTPs 7 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Internet Explorer settings 1 TTPs 8 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4045429996-2364296335-1634900306-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\softendo.com	Mario Forever Unimaker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4045429996-2364296335-1634900306-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\softendo.com\NumberOfSubdomains = "1"	Mario Forever Unimaker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4045429996-2364296335-1634900306-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\Mario Forever Unimaker.exe = "22000"	Mario Forever Unimaker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4045429996-2364296335-1634900306-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\Mario Forever Unimaker.vhost.exe = "22000"	Mario Forever Unimaker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4045429996-2364296335-1634900306-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\Mario Forever Unimaker.exe = "22000"	Mario Forever Unimaker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4045429996-2364296335-1634900306-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\Mario Forever Unimaker.vhost.exe = "22000"	Mario Forever Unimaker.exe
Key created	\REGISTRY\USER\S-1-5-21-4045429996-2364296335-1634900306-1000\Software\Microsoft\Internet Explorer\DOMStorage\softendo.com	Mario Forever Unimaker.exe
Key created	\REGISTRY\USER\S-1-5-21-4045429996-2364296335-1634900306-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage	Mario Forever Unimaker.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134322903365313555"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 43 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4045429996-2364296335-1634900306-1000\{C60FE03F-E1BB-40B8-8228-30179A9C1847}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4045429996-2364296335-1634900306-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	data.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	data.exe
Key created	\REGISTRY\USER\S-1-5-21-4045429996-2364296335-1634900306-1000_Classes\discord-535962784677101570	data.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4045429996-2364296335-1634900306-1000_Classes\discord-535962784677101570\ = "URL:Run game 535962784677101570 protocol"	data.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4045429996-2364296335-1634900306-1000_Classes\discord-535962784677101570\URL Protocol	data.exe
Key created	\REGISTRY\USER\S-1-5-21-4045429996-2364296335-1634900306-1000_Classes\discord-535962784677101570\shell\open\command	data.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4045429996-2364296335-1634900306-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	data.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4045429996-2364296335-1634900306-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\MRUListEx = ffffffff	data.exe
Key created	\REGISTRY\USER\S-1-5-21-4045429996-2364296335-1634900306-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2	data.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4045429996-2364296335-1634900306-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\SniffedFolderType = "Documents"	data.exe
Key created	\REGISTRY\USER\S-1-5-21-4045429996-2364296335-1634900306-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}	data.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4045429996-2364296335-1634900306-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	data.exe
Key created	\REGISTRY\USER\S-1-5-21-4045429996-2364296335-1634900306-1000_Classes\Local Settings	data.exe
Key created	\REGISTRY\USER\S-1-5-21-4045429996-2364296335-1634900306-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	data.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4045429996-2364296335-1634900306-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 020000000100000000000000ffffffff	data.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4045429996-2364296335-1634900306-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	data.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4045429996-2364296335-1634900306-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1"	data.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4045429996-2364296335-1634900306-1000_Classes\discord-535962784677101570\shell\open\command\ = "C:\\Program Files (x86)\\softendo.com\\Mario Forever UNIMAKER\\data\\data.exe"	data.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4045429996-2364296335-1634900306-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0 = 14002e80922b16d365937a46956b92703aca08af0000	data.exe
Key created	\REGISTRY\USER\S-1-5-21-4045429996-2364296335-1634900306-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3	data.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4045429996-2364296335-1634900306-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1"	data.exe
Key created	\REGISTRY\USER\S-1-5-21-4045429996-2364296335-1634900306-1000_Classes\discord-535962784677101570\shell	data.exe
Key created	\REGISTRY\USER\S-1-5-21-4045429996-2364296335-1634900306-1000_Classes\discord-535962784677101570\shell\open	data.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4045429996-2364296335-1634900306-1000\{05D8D915-93F6-4ACC-83BE-74370E179248}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4045429996-2364296335-1634900306-1000_Classes\discord-535962784677101570\DefaultIcon	data.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4045429996-2364296335-1634900306-1000_Classes\discord-535962784677101570\DefaultIcon\ = "C:\\Program Files (x86)\\softendo.com\\Mario Forever UNIMAKER\\data\\data.exe"	data.exe
Key created	\REGISTRY\USER\S-1-5-21-4045429996-2364296335-1634900306-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	data.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4045429996-2364296335-1634900306-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\MRUListEx = 00000000ffffffff	data.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4045429996-2364296335-1634900306-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4"	data.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4045429996-2364296335-1634900306-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616257"	data.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4045429996-2364296335-1634900306-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	data.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4045429996-2364296335-1634900306-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0"	data.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4045429996-2364296335-1634900306-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	data.exe
Key created	\REGISTRY\USER\S-1-5-21-4045429996-2364296335-1634900306-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0	data.exe
Key created	\REGISTRY\USER\S-1-5-21-4045429996-2364296335-1634900306-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell	data.exe
Key created	\REGISTRY\USER\S-1-5-21-4045429996-2364296335-1634900306-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg	data.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4045429996-2364296335-1634900306-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1"	data.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4045429996-2364296335-1634900306-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	data.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4045429996-2364296335-1634900306-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	data.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4045429996-2364296335-1634900306-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\NodeSlot = "3"	data.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4045429996-2364296335-1634900306-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16"	data.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4045429996-2364296335-1634900306-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0"	data.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
2036	WINWORD.EXE
2036	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3408	msedge.exe
3408	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
5292	install-marioforever-unimaker.exe
1168	Mario Forever Unimaker.exe
4544	data.exe
5116	msedge.exe
5116	msedge.exe

Suspicious use of SetWindowsHookEx 22 IoCs

pid	Process
1168	Mario Forever Unimaker.exe
1168	Mario Forever Unimaker.exe
1168	Mario Forever Unimaker.exe
1956	Mario Forever Unimaker.exe
1956	Mario Forever Unimaker.exe
1956	Mario Forever Unimaker.exe
4544	data.exe
2036	WINWORD.EXE
2036	WINWORD.EXE
2036	WINWORD.EXE
2036	WINWORD.EXE
2036	WINWORD.EXE
2036	WINWORD.EXE
2036	WINWORD.EXE
2036	WINWORD.EXE
2036	WINWORD.EXE
2036	WINWORD.EXE
2036	WINWORD.EXE
2036	WINWORD.EXE
2036	WINWORD.EXE
2036	WINWORD.EXE
4544	data.exe

Suspicious use of WriteProcessMemory 49 IoCs

description	pid	Process	procid_target
PID 5292 wrote to memory of 1168	5292	install-marioforever-unimaker.exe	98
PID 1956 wrote to memory of 4544	1956	Mario Forever Unimaker.exe	106
PID 4544 wrote to memory of 2036	4544	data.exe	107
PID 4544 wrote to memory of 4836	4544	data.exe	113
PID 4836 wrote to memory of 1552	4836	cmd.exe	115
PID 1552 wrote to memory of 5116	1552	msedge.exe	116
PID 5116 wrote to memory of 5400	5116	msedge.exe	117
PID 5116 wrote to memory of 2160	5116	msedge.exe	118
PID 5116 wrote to memory of 696	5116	msedge.exe	119
PID 5116 wrote to memory of 2160	5116	msedge.exe	118
PID 5116 wrote to memory of 2160	5116	msedge.exe	118
PID 5116 wrote to memory of 3676	5116	msedge.exe	120
PID 5116 wrote to memory of 3676	5116	msedge.exe	120
PID 5116 wrote to memory of 2524	5116	msedge.exe	121
PID 5116 wrote to memory of 2524	5116	msedge.exe	121
PID 5116 wrote to memory of 1404	5116	msedge.exe	122
PID 5116 wrote to memory of 2524	5116	msedge.exe	121
PID 5116 wrote to memory of 1404	5116	msedge.exe	122
PID 5116 wrote to memory of 1404	5116	msedge.exe	122
PID 5116 wrote to memory of 5092	5116	msedge.exe	124
PID 5116 wrote to memory of 5092	5116	msedge.exe	124
PID 5116 wrote to memory of 5092	5116	msedge.exe	124
PID 5116 wrote to memory of 5508	5116	msedge.exe	127
PID 5116 wrote to memory of 5508	5116	msedge.exe	127
PID 5116 wrote to memory of 5508	5116	msedge.exe	127
PID 5116 wrote to memory of 4820	5116	msedge.exe	128
PID 5116 wrote to memory of 5376	5116	msedge.exe	129
PID 5116 wrote to memory of 4820	5116	msedge.exe	128
PID 5116 wrote to memory of 5376	5116	msedge.exe	129
PID 5116 wrote to memory of 668	5116	msedge.exe	131
PID 5116 wrote to memory of 1164	5116	msedge.exe	135
PID 5116 wrote to memory of 1164	5116	msedge.exe	135
PID 5116 wrote to memory of 1164	5116	msedge.exe	135
PID 5116 wrote to memory of 3408	5116	msedge.exe	136
PID 3408 wrote to memory of 1592	3408	msedge.exe	137
PID 3408 wrote to memory of 4320	3408	msedge.exe	138
PID 3408 wrote to memory of 700	3408	msedge.exe	139
PID 3408 wrote to memory of 700	3408	msedge.exe	139
PID 3408 wrote to memory of 700	3408	msedge.exe	139
PID 3408 wrote to memory of 772	3408	msedge.exe	141
PID 3408 wrote to memory of 772	3408	msedge.exe	141
PID 3408 wrote to memory of 3212	3408	msedge.exe	143
PID 3408 wrote to memory of 3536	3408	msedge.exe	144
PID 3408 wrote to memory of 5508	3408	msedge.exe	145
PID 3408 wrote to memory of 460	3408	msedge.exe	146
PID 3408 wrote to memory of 6020	3408	msedge.exe	147
PID 3408 wrote to memory of 6020	3408	msedge.exe	147
PID 3408 wrote to memory of 236	3408	msedge.exe	148
PID 3408 wrote to memory of 236	3408	msedge.exe	148

C:\Users\Admin\AppData\Local\Temp\install-marioforever-unimaker.exe
"C:\Users\Admin\AppData\Local\Temp\install-marioforever-unimaker.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5292
- C:\Program Files (x86)\softendo.com\Mario Forever UNIMAKER\Mario Forever Unimaker.exe
  "C:\Program Files (x86)\softendo.com\Mario Forever UNIMAKER\Mario Forever Unimaker.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  PID:1168
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1168 -s 3132
    3⤵
    - Program crash
    PID:4468

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5512

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1168 -ip 1168
1⤵
PID:4412

C:\Program Files (x86)\softendo.com\Mario Forever UNIMAKER\Mario Forever Unimaker.exe
"C:\Program Files (x86)\softendo.com\Mario Forever UNIMAKER\Mario Forever Unimaker.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1956
- C:\Program Files (x86)\softendo.com\Mario Forever UNIMAKER\data\data.exe
  "C:\Program Files (x86)\softendo.com\Mario Forever UNIMAKER\data\data.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4544
- - C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Program Files (x86)\softendo.com\Mario Forever UNIMAKER\data\about_en.rtf" /o ""
    3⤵
    - Drops file in Program Files directory
    - Checks processor information in registry
    - Enumerates system info in registry
    - Suspicious behavior: AddClipboardFormatListener
    - Suspicious use of SetWindowsHookEx
    PID:2036
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C "start "" "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument "https://supermarionetwork.blogspot.com.br"
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4836
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument "https://supermarionetwork.blogspot.com.br
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1552
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument "https://supermarionetwork.blogspot.com.br
        5⤵
        Checks processor information in registry
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Modifies registry class
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:5116
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x25c,0x260,0x264,0x258,0x270,0x7ffe62acc188,0x7ffe62acc194,0x7ffe62acc1a0
        6⤵
        
        PID:5400
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1768,i,16557468859324947865,13867342114552109566,262144 --field-trial-handle=2332,i,16445529100151859253,1735815880693181103,262144 --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:2
        6⤵
        
        PID:2160
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1972,i,8816365995976027474,12204419398345247392,524288 --field-trial-handle=2332,i,16445529100151859253,1735815880693181103,262144 --variations-seed-version --mojo-platform-channel-handle=2384 /prefetch:3
        6⤵
        System Time Discovery
        
        PID:696
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2556,i,16785368793139179831,14992555636328721484,524288 --field-trial-handle=2332,i,16445529100151859253,1735815880693181103,262144 --variations-seed-version --mojo-platform-channel-handle=2560 /prefetch:8
        6⤵
        
        PID:3676
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3436,i,11546883845651182766,12768900707841108232,2097152 --field-trial-handle=2332,i,16445529100151859253,1735815880693181103,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
        6⤵
        
        PID:2524
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3428,i,9240860152837008878,11307521841233311793,2097152 --field-trial-handle=2332,i,16445529100151859253,1735815880693181103,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:1
        6⤵
        
        PID:1404
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4916,i,14050506749260743738,16288976002095966289,2097152 --field-trial-handle=2332,i,16445529100151859253,1735815880693181103,262144 --variations-seed-version --mojo-platform-channel-handle=4920 /prefetch:1
        6⤵
        
        PID:5092
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=3512,i,16725179229736217820,7955733026720328764,2097152 --field-trial-handle=2332,i,16445529100151859253,1735815880693181103,262144 --variations-seed-version --mojo-platform-channel-handle=4812 /prefetch:1
        6⤵
        
        PID:5508
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3548,i,15586281181789451219,17975158565671252864,524288 --field-trial-handle=2332,i,16445529100151859253,1735815880693181103,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:8
        6⤵
        
        PID:4820
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3528,i,13276462104289308470,3598053842040694211,524288 --field-trial-handle=2332,i,16445529100151859253,1735815880693181103,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:8
        6⤵
        
        PID:5376
      - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5692,i,5124580895223340628,9952828493819032021,524288 --field-trial-handle=2332,i,16445529100151859253,1735815880693181103,262144 --variations-seed-version --mojo-platform-channel-handle=5708 /prefetch:8
        6⤵
        
        PID:5748
      - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5692,i,5124580895223340628,9952828493819032021,524288 --field-trial-handle=2332,i,16445529100151859253,1735815880693181103,262144 --variations-seed-version --mojo-platform-channel-handle=5708 /prefetch:8
        6⤵
        
        PID:668
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6024,i,11805296009195263359,2411267546199251612,2097152 --field-trial-handle=2332,i,16445529100151859253,1735815880693181103,262144 --variations-seed-version --mojo-platform-channel-handle=6012 /prefetch:1
        6⤵
        
        PID:1164
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
        6⤵
        Drops file in Windows directory
        Checks processor information in registry
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:3408
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x270,0x7ffe62acc188,0x7ffe62acc194,0x7ffe62acc1a0
        7⤵
        
        PID:1592
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1908,i,4691657137189096795,14499873052052189172,524288 --field-trial-handle=2296,i,15549940577700705531,14757799234761484470,262144 --variations-seed-version --mojo-platform-channel-handle=2324 /prefetch:3
        7⤵
        System Time Discovery
        
        PID:4320
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1760,i,5456799782482667879,6188074335755414224,262144 --field-trial-handle=2296,i,15549940577700705531,14757799234761484470,262144 --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:2
        7⤵
        
        PID:700
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2052,i,1850649264700158891,1804026929715468075,524288 --field-trial-handle=2296,i,15549940577700705531,14757799234761484470,262144 --variations-seed-version --mojo-platform-channel-handle=2724 /prefetch:8
        7⤵
        
        PID:772
        
        C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4376,i,8998853403712924707,10785645687361309789,524288 --field-trial-handle=2296,i,15549940577700705531,14757799234761484470,262144 --variations-seed-version --mojo-platform-channel-handle=4392 /prefetch:8
        7⤵
        
        PID:3680
        
        C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4376,i,8998853403712924707,10785645687361309789,524288 --field-trial-handle=2296,i,15549940577700705531,14757799234761484470,262144 --variations-seed-version --mojo-platform-channel-handle=4392 /prefetch:8
        7⤵
        
        PID:3212
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4628,i,7723603001672385151,13233717643950371675,524288 --field-trial-handle=2296,i,15549940577700705531,14757799234761484470,262144 --variations-seed-version --mojo-platform-channel-handle=4392 /prefetch:8
        7⤵
        
        PID:3536
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4636,i,15321101135632267723,13457094422559749087,524288 --field-trial-handle=2296,i,15549940577700705531,14757799234761484470,262144 --variations-seed-version --mojo-platform-channel-handle=4644 /prefetch:8
        7⤵
        
        PID:5508
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4640,i,12197160373215070624,1708912201992602393,524288 --field-trial-handle=2296,i,15549940577700705531,14757799234761484470,262144 --variations-seed-version --mojo-platform-channel-handle=4696 /prefetch:8
        7⤵
        
        PID:460
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=136,i,11464301116073915325,8323412130981266009,524288 --field-trial-handle=2296,i,15549940577700705531,14757799234761484470,262144 --variations-seed-version --mojo-platform-channel-handle=4680 /prefetch:8
        7⤵
        
        PID:6020
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4684,i,16211651002825167911,13618920180247921974,524288 --field-trial-handle=2296,i,15549940577700705531,14757799234761484470,262144 --variations-seed-version --mojo-platform-channel-handle=4736 /prefetch:8
        7⤵
        
        PID:236

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4284

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:780

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1092

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Mario Forever Unimaker.exe

Path C:\Program Files (x86)\softendo.com\Mario Forever UNIMAKER\Mario Forever Unimaker.exe
Size 3.5MB
SHA256 be3912c37a99229cec1a1422303abb0fcbbea2508b0be953017524c14f3a4822
MD5 a0473fe3f9d8603ad3b5e0271a395da7
SHA1 a5af8842d0957b3ff5d50accf992b580be11afcf
SHA512 a83a101b4044b137f489fe970a4f20918c028a09f6465aa0d353aa6cea4af37ea2f2a04909155c1eedd72adef7dc49b26003430625659ee8921bfb22593c2c97
SSDEEP 98304:6QIZulGppF4DiwTv3A2SlIs+NZOACExnXV6NIqNRN:LIZu6F4DiwTv3vSl+NZOAnXcNJB
TLSH
T173F5E092B9419821D4E580B68E7D6A2656B825330B3441D39F580EFB3A7C1E3DE3B5F3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctp.$$A

Path C:\Program Files (x86)\softendo.com\Mario Forever UNIMAKER\data\_ctp.$$A
Size 3KB
SHA256 3e138b571ea424b05a698a1f5b5121ebf22291c944a053b63badd7cd14343195
MD5 ae18e0e654207fb83615f389b5980628
SHA1 d06a4348ee592ece84ae4e5782cf0d896d3452f6
SHA512 b81aeb771787360a26395dd3680d23fd26ca17fd2dd540b800ef553e7fcae77f4380ed5108c252d9f7d8d0971ff7e459d013775ab563ee12f2bf1094182f1e7e
TLSH
T15781D9DAADF2B1CDFC1320BBFE7A07E46BA1BC44113881E673D02168DC615C865B0C99
MD5 SHA1 SHA512 TLSH

Submit Download

5AEEC392E2DF14C357DCF5934A85A029

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\5AEEC392E2DF14C357DCF5934A85A029
Size 346B
SHA256 6a2a2b131452a3003a10b9b475d0cacbab33536e587bc124a0ae67b54b48ee68
MD5 d2888dbdd39e94b1d4d1d990adcaf0b8
SHA1 98647bd025711784bd60026b385ce95d6f1e0668
SHA512 ef2aade5299ad8864e69b26b2f9f18cc347b243bfb356ee22b9d83e5ade641e84ba99f5e79f2c53047812aa30e06d75e79e1b271ebeac23540f2d23a283660d9
TLSH
T163E0C08595BD27A02EF0ED879C41C0471EB943C21A4FB0404730C7704083758D8C52D9
MD5 SHA1 SHA512 TLSH

Submit Download

8B2B9A00839EED1DFDCCC3BFC2F5DF12

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12
Size 1KB
SHA256 63b14543360f5e89942ea8d5113526e64fbc71c1207328f0136b3a495d921dd0
MD5 adac67e1d2da2d706db151c2db316b2d
SHA1 5f6e301d23e33132209707945d0e740d5bcb8996
SHA512 9371b62ac25c6ea8fb6fca19ac47b873ced9b3d0cb45ce4de5ea974b93c12684c65aa23c7d83331c77502853258a08dff73ce5e3fb6170bd3ab1c5b3283a86a9
TLSH
T1DE31AD4EA2153027D5427F72D8CEBE83CEB1364667CAD46B18046E4229AAFC25FC80C9
MD5 SHA1 SHA512 TLSH

Submit Download

B46811C17859FFB409CF0E904A4AA8F8

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8
Size 528B
SHA256 d2bb091268ade68ad8121d2184d0fbce128070156304bd4de312e6fbd267409c
MD5 047f3e9d21d6b325d592b1959e4362e6
SHA1 5aeef5f985171cd69da397fd039854e44ebecdd2
SHA512 4523896ed4a03afafd2075d8c8947236d34fe1da2c246a3f90c2be2a5c151c18bc58a6cde5a209abb8e06e80f662e24d0149640b3e98e8a872bfa8a04ef592a4
TLSH
T147F0500990082252C855FF55DFD6AC97DC76336136E595036D458E410C12F96AF950F5
MD5 SHA1 SHA512 TLSH

Submit Download

F8C11B747BA8E408980C58CE2827951E

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F8C11B747BA8E408980C58CE2827951E
Size 347B
SHA256 2ebc9cb19250a15df82d6972667da21ba665a81224446c0128185feeac957ed1
MD5 73051a8ba647f540ddc87288e5e05086
SHA1 a0b64d41a8a044b564b47a6f2cd3788b63d514f9
SHA512 ca4420454a62196e49ede4050da61db3943afa2d5d14eabdf3ef7e444c2d46743f69c352dc6ea7fb4b759056c44be7088696d6d54bddc3b3b68ab0c63e99aa80
TLSH
T10BE026895DB8375513B0D676E9D8C8836DF4C1CB5A4EF0558B20C7621286B85FD960CD
MD5 SHA1 SHA512 TLSH

Submit Download

595CD0DCED5F6DE43A9C77C525C44511

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\595CD0DCED5F6DE43A9C77C525C44511
Size 192B
SHA256 d809762d1b78f82e3d42674fdc89a6269cf896adaba796a5ef722b02f702751b
MD5 37d144bb619bdfe4745b037c0633ea4a
SHA1 c6707a2cf3ddc6067d27ac9871eac30c3a09dd4d
SHA512 5178f830e7ae92d8a80e6928a5e29b1df16d60a930e3c8fc925493cebd3297ed051efb0c047569d747605c91b594bd1b6a1d4057c9876a51de2284386a0034ea
TLSH
T1D3C02B083F700200F24D033D4ED01B020BF09227CE878B142B71821CC22C60EDE74D06
MD5 SHA1 SHA512 TLSH

Submit Download

5AEEC392E2DF14C357DCF5934A85A029

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\5AEEC392E2DF14C357DCF5934A85A029
Size 192B
SHA256 1d9cdeae3cb72cf830d89e2af1664a4a43295ba7fe543e982a9044f69cd3b9a9
MD5 38e313c72ca0abc268bbe011169cda81
SHA1 5e9812ab7fc12be8cd31d1471665657a73b1f1d1
SHA512 19efee4f09f6beb70416cd50580e8ac5c07e5bc560cc78ee748c26dbe3942ebbdd66388d303cb17c09ab35436bbeed22568ff4163006c9045c776e67900444fa
TLSH
T17FC08C0022B39511F318033D7BE9AB620BF4AB0E848E87182BB4025C920D922AC32F09
MD5 SHA1 SHA512 TLSH

Submit Download

8B2B9A00839EED1DFDCCC3BFC2F5DF12

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12
Size 174B
SHA256 61a21726aec7bd25fdcbe486d90c02326be25e74cec119fd209030b874fa6fd7
MD5 ed03496c152198104330e24c9679d99e
SHA1 ef276716c12e1cab84d4447fc0079289abd49e3c
SHA512 9013948fbb2d3e54df9505cf31f435962db1cecb6486ed03a714b3a4fb32185fc463b96dce526929bbfca89a813aa8128a40b331d9df22138366551eb49eac8e
TLSH
T195C02B0433F58165F2300D7F06C3530147FAE100CD4183100F701218C11CB434CF1C02
MD5 SHA1 SHA512 TLSH

Submit Download

B46811C17859FFB409CF0E904A4AA8F8

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8
Size 170B
SHA256 a510468bdb78a4b34573656fc799270a7c6e428eb3cb62cdfa21825ee0844cd3
MD5 b7ad84497218c53909fb496065b71dff
SHA1 a5b951f21e66278bccfbed3f3431359610dc5702
SHA512 581c56c0109ab52989df47616dd1d179bb9c46fc39d171b203840ad193e3c0513499b5dc84d44b23792df381e86edab50fc8af6d0458dc2dcbe1526e5a2b45a5
TLSH
T183C09B5473758715F10D513E7DD6160417B95155F5CAC3144B741134C5186414C71D05
MD5 SHA1 SHA512 TLSH

Submit Download

F8C11B747BA8E408980C58CE2827951E

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F8C11B747BA8E408980C58CE2827951E
Size 192B
SHA256 5f62852c2b230cd46a78c49038c51dbf86600e6c52ee9253390f092368999113
MD5 d32ed23ccb17ec463fb101887ef14340
SHA1 d2a653fd355227ba72d19fea0cc4b880aa0efb3f
SHA512 8aa18003efb0d6686b2af4e94218c77c41a3fbae3c938ddfc9aedfb7c6925c44f3c6ad4c81a351e719bd91e6b052c8d85e015fa3a13c0f3e7c231ae6aa9ad21e
TLSH
T1EBC08C223BE1832EF234033D06A2C74513FEF210866643090BF4015E8028D0668F0E09
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 44e095af7ccad1927602b4b935aae3524939df30218011b877b59c782e6c6106
MD5 3c1bf221dd0438f719ae47a265c3e436
SHA1 b382689171539f473d331bdcef3739b0fa0b1062
SHA512 b7f8bf66ea12f9b37e5f8d1af222c106c1dfa377331d2153d9380edcc3af7381e9c3490378c0b160e05f5c4fd2e1590d5cb8ed07cdeb7b74fb7b38b0e8e1e57f
TLSH
T18ED080333D4D7015E35D5175A463C7153B7648611497DF01F166CA7CD9F61C466C71C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 fc69248227d1b80ff41106426895bcd599abcddfbfe7fdbeabc0fcc2aca903ae
MD5 be6741080fa256162cf6b0264133ca7c
SHA1 4914334b0edd1e4c3a470920450bdee63ee2f5b6
SHA512 8d42ac6412ff316aaa68e317e92c2167dbcac331381aec8d8be8410c5bfab4657127a0601dfc90f771660e393667d62af5e917155d6fcc5c7aa6a8ca1e03f903
TLSH
T149D08037394D7015E35D5175A463C7152B664C611497DF01F166CA7CD9B61C462C71C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 92d3e64f8d7d488e0cc1e99bb1fc37ad06de2cf091b2bb1940cb0476b7200060
MD5 1522ccbb7dcb1fdaf35d97a6558496cc
SHA1 2a7556782d5783c84e4d54dd2ebd2f593c58d185
SHA512 9da0234d9c7c7620c711a6400886ee5d45a04a2bd4d26fcfe7b29e8a1e8f842b5e38a41c1fb71353547f0bdbabc3608fe3c129c9976dc9750fb2f5198e475db5
TLSH
T16CD09720688CB4E0E029203C01300200358C4C822253A202F0200A688D621C222D58E2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2eb3d1969028fd9bb474b1063a57f61683ae59c43d7e66e8a27be1c2a66ced98
MD5 6536061b854d9b0422bc3c8be4951ece
SHA1 8b2a1dde9b0c345439e0452dfaae8501a572d980
SHA512 c1483e0035936ab6852380336954536c7a5900693b54be3c2c4293805cc0cea619b430deb99581d3388aefa1f0fd2cd7c892e08dea466520871b6c6871d85d47
TLSH
T132D0237474CDF454F13B153E1522532579874D5120E7D503D0A10369BD532C563D50A3
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 f16bea8b10381ef7a67204916338a5e3b17a30e98a078dde862fcc637aa95c51
MD5 5f16ff0e7d783c118ffc92323297b60a
SHA1 20cc20b358c0d9f31fdb3e0470b16c3f3e253c54
SHA512 c971f440046f1605ff481f5daf4163b844cae2c724fd077897d7322c7af7e1f5c41eb9deb57575c5cba04df095a07313112b4094522acb1ee4fde6992902ad21
TLSH
T1F2E022E9CC71AC3708FE0B18A0A10746E755179B2F804C1B363C81188FB163B428A89C
MD5 SHA1 SHA512 TLSH

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 4a1f3171c04f9bd9997c5360cae3f69b9d18256690882e4824a2196b2991a4a7
MD5 2840d1142e10346cc8230227bd38f57d
SHA1 d55f25aedee3eb2e6e08bb5a4714752af60b8201
SHA512 292f2932343a73e3fbbad7b5bbca9111828a654df12adf860b03e349258d34e670595c855d9185465b39642a0f6b853c03ed72b7f65653f7891b339b318af82d
TLSH
T1EAE022EACC71AC3708FE0B18A0A10746E795179B2B804C1B3A3C81188FB163B428A89C
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 0662dd039a4fc5c2891c420c48646aed609119f3ab02d4c1b8ad7634fb31ed14
MD5 93a811a2c29276f8cb196716613a5b46
SHA1 9b827de52222fa2a1a16408167837500d3dab0df
SHA512 a8b2164082692fb44cf0fd2afd8ff10d97cf220486407c3430a8ef9dfe19e9ea6a0feddd35a47f1564bc7b90399ffd8fb585d7ef8a569bfba9ac838d518584fb
TLSH
T1093180F783F4856E8A1196F0EA18BE2FCE2D0511432C7D9A85E4AE27D3E3471E041A5B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 ace20547ee570975c2b355f58da4b181feba7a02fa32b29c6758f630a9f93ad1
MD5 0881c9a83e2d8ea0a9cfabb7e4daa0af
SHA1 38e8547bbdbfaa7af087dd0f067e5c99c7fb3e8d
SHA512 1666d32f64ae8291126777ddba756ce60a7056ec7a64c12552147df0e5683e0018d93f451388f29160ff999ea8541239f89f276f71fbf69ab5e2aceea5a42180
SSDEEP 192:sxZwRUyMqZjK1Ml8sjT/fUsbWpVKEPPYZZyb5zzodpNfHW6+WNGYlH4J1vVIgZtV:sxZwLJT/fUsbWvKEnmZo5o5HbGjfZtV
TLSH
T13E72E705AA286D7BCCDBD609FA557F53D6F85523A1905E4499FCCA1C00EBAEC220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 d736bdd9a759bac3603bd4c92e482ef925618f2f588da5a2c50f5b9946878148
MD5 cd130411c8a96d1eb40055c5cb09fcee
SHA1 658a94a7c8ba81a7130cd922df9da55d0173c83b
SHA512 430196e7824ca8e7468d89dd7b908b027b6502ad0aade4280d69470b6ec3af82552b86dc519c607302bbe21a3ee6fc67ea50f3662637b032169d901abb7dc221
SSDEEP 768:P4E/ael7pLuLnC6WvCuFO8F1+UoAYDCx9Tuqh0VfUC9xbog/OV/6yVLlFX6BaroJ:P4E/aezEnC6WvCuFOu1jaq6yVLfqBRV/
TLSH
T183F20B3B2C0CCB7E4F844E9CEC2A7E9A6DE801CB5698899447FA841C03C67EF55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 24KB
SHA256 2afcd8533a76889e8ca0661f5e6e4b8d4c47bb839bfa80e154c03d9ce9c171c0
MD5 eeb3784c17367c68a6cae45cd6413faf
SHA1 8baf89fc6d56087bf7b660f20d2622cef99339c0
SHA512 74c34b9960c5e084690266a4a9072bdcd29b0d48478110f0efe9773536f475787076f2cf12c9762370750401477fdd78a5aa028d48229286a179c278e9ab5570
SSDEEP 192:OotE42aG3iLEAs1AOvQA7uItfg1MhlfznKzO5tZBBHaFlufF5XYP7cNBv3dR5LAd:8ptDYDcfvNR1ANAJ/XFU
TLSH
T132B27902717B065238BF250CA69799378E4235A33418E4EF7BB914A21F67E225DFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 bcd07cda40e76e1ef77ed296bd6e48518916fb15d385f6bb12811e12e0117eac
MD5 16edd638f6faff75696f9d0882ee2a58
SHA1 ae810c9de0da3cc9bc692fc7c6bccdcb01d8df2c
SHA512 ac1531fece9e5da7c889a81bee2f154e47e99ca188da4650f662f228621ced18464ce548ab7272d6391f83338c7b33b6bd6e8b280ce2844e25180523c67ee094
SSDEEP 384:npiF9ZcIqsNW8TUNTUlI4kcDcYTVEJBfpGR/vMmg7OuKQEzt5huyyQlh8/7IzMi0:AFlq1wgovSGJvb0NKQEzt5hjF4Z
TLSH
T1F6D24C79DCE4CD7BACEE6B84A68E3613CDE44173D5E88AC4D7D85E0D00A319D670B81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 b3437957923c56bad8025f5b08395b4408ca5afd5528cd27d743cdaf567b4754
MD5 d033cf359fb24ad7ee141b22e7ab60b0
SHA1 177ca25cdad154eb6ee28ca7d56e758e8bd984f9
SHA512 f2d384e7db365af8e4a74901861c57cd1ad9b16e7768517b69a3479a9f9853ecdab06a7e2bce03b6f7930bef9b1a25dd6dac8b744c0b75af073156368e7c8ef9
SSDEEP 384:nSiF9ZcIqsNG8TUNTUlI4kcDcYTxEJBfpGR/vMsXKIBYQZMRCq47fJ65huyyQlHB:ZFlqtwgofSGJvZSlRCq47fJ65hjF/b
TLSH
T1FAE22939DC948DBF98EEBB89678E2A129DE41133D6B88994E7C80F0D407359DB70BC15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 15f30e1c6718dfa44a2a54bd29c2187b7f142fc81e8d812ff60753c9119792e6
MD5 7ec9271e8ac52e0a57e591aef8d9a279
SHA1 cdc141efcc919b0090ba4bad953f87a21614a0af
SHA512 10e9575c31082e09421be49e9c6535af0ec94d59e7796185c744cd12d90b926cd755c71bf94212b20fb772df6528c7e007722b9065247c5de11f3b591da338eb
SSDEEP 384:npiF9CcmyWCs3sNMt8TUNTUlImkrDcYhC9JBfpGR/vMzQhkP+lFYS/QfIHy/7Igp:AFccps3twgx+fGJv8QhkoFYS/wiy
TLSH
T17DB26C35ECA4CABBEDE68FD9E74E7A13DEE0016385885AD4EAD81D0D00C719D134BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 c48cf258043d7de12edf1dcc3944276db99238275cc0ab409d9ad3db5e031763
MD5 a4f029c9de0e23f887626f02f6162b02
SHA1 24b40b21c8ab576e1b6ad66e2fc25ac9af09b9b6
SHA512 2313ab04d890360528211113c53a4523bd4dae935c7592dc939d3e8440ea003dbf04f5da05313fdebfd6d782928790d40a7a537f270ead93ae67195e6ce457a5
SSDEEP 384:nSiF9CcmyWCm3sNG8TUNTUlI4khDcYxnEJBfpGR/vMsXKIBYkw65huyyQlHy/7IM:ZFccpm3twgZDSGJvZSB65hjFY
TLSH
T10EC23A36ECA4DEA7EDE65BC5B74A3A03DEE04153968C9AD4DADC1D1C00DB19D130BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 3436ea20b7feb0f4002edaa2945265004f86d621abf93c2ab975c4d7c7c73b5b
MD5 51bac2f48694040842b2286869fb7e6b
SHA1 474161ea2d55ad94e2c6f7db18aceccc9749a061
SHA512 99f653429fd75bd7e9a0b7fe44840b0efdaad262cf5eafb264e534269e6b767a1cc7bef19cafef203de44c7ca1a24d28cb92bb449dc6ee75dff4457586a933e2
SSDEEP 384:nhiF9CcmyWCs3sNa8TUNTUlImkrDcYWGxJBfpGR/vMsXKIBOkwhkP+lFYS/QfIHI:IFccps39wgxlzGJvZ4BhkoFYS/wiy
TLSH
T1EDC24B36E894CABBEDD65BD9A74E3A03DEE04163C68C9AD0EADC1D1D00DB19D434BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 167d743922db7856a170ef7235c0bf22374d8c59b07ec6c8d90e4fc3b7c3dfc6
MD5 b60b0ef5235b5305cc8c2dc1e9245215
SHA1 63744c17f2adcc1549331621f362a17cc139b568
SHA512 1181ec1bb07643d89e610e7e7ed8d89d594e07a68746d6b019b9b54cc29bedeed1c5e94ae5d1717b424520bfbbfbc13451136e151e46770a50acf214f5c82de9
SSDEEP 384:nDiF9ZcIqsNW8TUNTUlI4kcDcYTVEJBfpGR/vMsXKIBIa65huyyQlh8/7IzMi0:uFlq1wgovSGJvZCa65hjF4Z
TLSH
T17AC24B35ECA4CEB7EDE69A85B78A3603DEE45163DAC88AC4E6D85D0D008719D170BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
Size 154KB
SHA256 e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
MD5 a922bd2071b7aa9f2154c991d41885c7
SHA1 c88b22d16c951cbb0bfdab367232cf830e0464d1
SHA512 d8ed2d6b1c3a421a9771e3a5109eaea839bf64be7b7e672ed7b8aa47590ff35c6e78aa79712ce37801cedc56db552fc6a7c3ca55004295a438219ce4a8f007a0
SSDEEP 3072:Aj0amyoD1f5NQQHyR5nYbGnkBEGsvsq5UBkUM4RIJ+37HVeCsKkwQuBp/Z:AoHBD15HEYbQkovswoM4RIIzvXkwtBpB
TLSH
T12BF3F11D7EDAC952C40B92BD3C1AB18BC94B8F0A431674CF264D90248EA578E07E5EFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 a0b1a35a86cbd2e671521525fc6903162d450e3b301948d913d05ef458794c20
MD5 22215f69c4a5231b8c568620e783d7fe
SHA1 c64663b6efe0023ca5978374d785f1202d924d1b
SHA512 9e38513132672de4a65c01a6eca3c8c3a878cc6e11e2c0d2235798b78e3338c9a13a15d261c4b4fc6c60657f42407b98c8435aa4352366d1809843ddda068e22
TLSH
T1A5C02B79481924CC2B00043C6004012B19B0560023C413F48C1B8D80007537CD30817F
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 7199c5c670d93f5309452d5e17af24275491ce01cdabd397a7fd678f821511e1
MD5 334f6856656581ed554c5c513a93ebd4
SHA1 7f5029aa35d228db7cd1164b1799e02d964889ab
SHA512 7935a1fb6e785063bb55fd8c044a4f2cbf6a3794126b1813afcb6b8427b713ec5cb13f5c4459733d9ab8f904a61292f6ebafec9c9c1749c90c588e13c3fe5ee6
TLSH
T1D2411A58A7ED0144B3B77E5AABF6A86D487F78772F06C45D00110D4E0673B40D8A2737
MD5 SHA1 SHA512 TLSH

Submit Download

CGJJ3WHC.htm

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\29LP8YLC\CGJJ3WHC.htm
Size 368KB
SHA256 94fa6942603a22cb14497dba528f823e48107437fc95f739d9a18ac19bffeb90
MD5 84132d06d1909fb6152ce3b0d52c0598
SHA1 a8028a9df26050a4f4560037a3e9fb61e128c383
SHA512 0ea5b956686c1e2129539fdcd88661670826ff234ffe5fcb320ee81551e2225ade5ae1aa3c5d3300a99b4e508caf06560ec9ac36650cf7707f5d7fa6c0fb4eb7
SSDEEP 1536:clTLjvI+64gGS9agyO96/f12Hx1ArQkW3IRHq+qofHBSkOTI5gV5E4vrgi5ze/lv:Y/f9ZZ7RmMWBpEjv
TLSH
T15784313698786AFB445ABA5352AD37CFCD8A4296B2D4D5F0B0790FB103CE5974D230B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b4dbd60352734efca5c92eb4aeb5ebaa[1].json

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\29LP8YLC\b4dbd60352734efca5c92eb4aeb5ebaa[1].json
Size 282KB
SHA256 f12970c51ffe6f36130e74cf0ceb3f0fb0bc2af664a6aed146d585b4c70fcaa7
MD5 b687cdd2dc60befcd4de14182896325f
SHA1 a95617488f3a17171608bed50f17f474ed575f6c
SHA512 2de1d4d1774884970512397f316cb5740437be17389a13e3f7f51cdc690f8a11f03b3c6ab5e4b3131976a4ed68742b8dec2b257d52762fd97b8a7a2c3f0ac8c5
SSDEEP 1536:k5Ps2brKyTaYfOY1IpXlT4SnFejgBC1reXekDFWZ6ejeN0b1TAePT1hcDYTeI173:ki8gBC1wFW/n
TLSH
T1E7548310ED2C453D5A5BB1DB839FBB0597BF53259E442AD5E0EC8D0D08E266C132BA3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f[1].txt

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\29LP8YLC\f[1].txt
Size 197KB
SHA256 dbc3257d7d0c4a7a8954f7836a3b577a635e091df5aeaee3dd6e74c2599fa6f1
MD5 33684536d46b011de7781cf7765568fe
SHA1 9de754360b1a24fa9cd9039133f3aee2899eb03f
SHA512 254848d53e26f6853a4d3ea78fc0efbdbb79e5a2f73df490333a716db4ab26e662fc230005a74a331de1aa80ed402c1df88eab479aaf19ebfd1185adf418b1d3
SSDEEP 3072:iUbWqoeYzsTRChTOj5UylWl/trP2QJeVyF/g2r:iUbWqpkhTOj52Aj2r
TLSH
T1BE14D7C9B692B8B38363A5B4406F410BB13EB863F40888B4F195DDD87E745694237FAD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cfd837a41ecd4e069f9ef8ecf5f8e76f[1].json

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\71GPH5MD\cfd837a41ecd4e069f9ef8ecf5f8e76f[1].json
Size 300KB
SHA256 f80c0ea4565eacee323b1d327386e6c87ad2a5a002eeb504f033d932cf51680e
MD5 226dc7cadaacde1272b78e55b296dcb9
SHA1 7436ef45c79b41b55415d0957138795002f7802b
SHA512 1504ae417f4c671ac11b45c7d8a478e3f6560248d35f971762b7681c7aa4aa042d4aecaba45d4f38e628f421f4e240ae254d3ead6dd401f081500dfc49ac3be0
SSDEEP 768:GDPvyagmzwQP/PUPcPCPcP6PcPDP/POP/P1PcP7P/PeP/PEP/PGP/POP/PyP/PDJ:Wvyagmzwxlu+p17A/Jwvt
TLSH
T1AE6485A7EA807CBE4E5361C1B32A3ACF8CD955E67600DA90F4FC0DA823D64DCA635553
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fbf01fe82d9e424b8745c459799cc58d[1].json

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\71GPH5MD\fbf01fe82d9e424b8745c459799cc58d[1].json
Size 235KB
SHA256 cd435bfc28b73c79f423ba96bd4029a9d0ba7d65a40aa49fb7e4a89b4825a112
MD5 55a898792690b870dd60e999c2095c10
SHA1 a7a7b449902a1cc641f0e8ba4a82e3f9e549e7f6
SHA512 3c673452da8af7643ecba20bb6006a7ae59224499b296054f060ad6fbe30a2f8f28a00189c4b17be894f0410d8aaaa2237082ae6ae1cc72bf30a671d2098962f
SSDEEP 1536:UaLd1cSI9JIUrd4hYL19KE19foWt11k8NIJIUrd4hN7r2Sm115mQYdsDUESZgfDR:GP39Vi
TLSH
T162344419B5284D3EAB87A2CB958F3E019A6E1135BE442DD4F5FCC90814F696C232B71F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

viewer[1].css

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\RGWQPZXA\viewer[1].css
Size 143KB
SHA256 e51b7601fdeb11da54b0325f330996f146d42b29405411a906ff4483f90b2e58
MD5 1ed3fb6f4a8c2942999c9b92d680e223
SHA1 9855816155fa47c7aff4c86671decaf144de401e
SHA512 cdcaa8ce43f5d3f1b51089e5ade8247b52053b328d72f4d15369c840373d36496480425ffac7181e96df0909af88cb7d6a01e3e9350947a2a536f946f9763e27
SSDEEP 1536:rAkN9W35aJPZWXMvRhJkn+iEkUC9qCQ1L87uD5peWo:TQ5YTRh2PJQR56
TLSH
T10DE37535F6913028E5BF4329B792A69C3324DE53F6129EFDF5C9D319C283E86122562C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

viewer[1].js

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\RGWQPZXA\viewer[1].js
Size 2.1MB
SHA256 67e6fa0e533ac2f92d6154bb3941a042dfb0dd5a42b2f5ed7412ca062182e854
MD5 52288c4663d2634a85c162e31c107526
SHA1 ec0f75df20be9e3a1e30f8417f73730760ee0731
SHA512 407a374b094dc2c99592056265ec9dc2d18e7ca7bed383cffd604428286b2d717e953c118d98cdfb72975cb5225656c20286e9ae63c7209d88d31d4df95699d6
SSDEEP 49152:40geNBEx2HKaBsssFOawBtUwFS/05WzoPwFS/05WzofwFS/05Wzoowg/05Wzowwr:2eGK
TLSH
T1EBA52A8C7391762943D7A079507F200AA37F7994A82A8014FB79D6D57C78A8D223BF3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f[1].txt

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\ZGN0KDKI\f[1].txt
Size 197KB
SHA256 1c10c4b88cdd1f20f4b9d8ba68f1292dff28c132e7c7dbd500607fd2595c5a60
MD5 6d2fe31f79904fe34bd88209620fce4a
SHA1 0408010c57f73348d7e25feb53287a4df6980726
SHA512 ce790bc8f97447ff924232cfa3e821b80a6dcebb94634b2d41176ec419cf331a445be5f64f609a69f0de001d90a8668c1ffa3f16a57d4d6e8affc3e6579ca725
SSDEEP 3072:iUbWqoeYzsGRChTOj5UylWl/trP2QJeVyF/g2P:iUbWqpbhTOj52Aj2P
TLSH
T11114D7C9B692B8B38363A5B4406F410BB13EB863F40888B4F195DDD87E745694237FAD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

js[1].js

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\ZGN0KDKI\js[1].js
Size 362KB
SHA256 0ff6697a8d29848128bcfefd767c61d745b367e8cf5907f370fe5ef65bbcd660
MD5 40cfa65b243c0269fdf0ab32585e61b8
SHA1 d1cae1892fca3752366220f9cf667db5af301bd7
SHA512 3286397437caf9b97ec56e2b3d0bebf57c54669dc620e42d533df8df9b4c6d4212a81bbbacaff061294872d20c369eec87cc8dd737e560a64ccd962961621596
SSDEEP 6144:kHyvNUccmkBmL1sGidcbwWtE/v3Ph2YwL7iVqu:kSFQmkuNY8iku
TLSH
T1F38408CDB3D670628393A4B8503F018BB27A7992F84CC895F196D8D42E7469A4237F7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

52ae1cf4-1752-4a6d-a425-c3e78536ab0e.tmp

Path C:\Users\Admin\AppData\Local\Temp\52ae1cf4-1752-4a6d-a425-c3e78536ab0e.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

KcCursor.mfx

Path C:\Users\Admin\AppData\Local\Temp\mrt9684.tmp\KcCursor.mfx
Size 36KB
SHA256 0ded66f7b955cbf24fd70bf8c6366d54895fb879967e7855ce8e90ae85556da9
MD5 8a369effac85d88c993871158aa13128
SHA1 3714d01ef517e34b04a7f3a92f229fab428d1d94
SHA512 b3da0c3d51782d3079515d2cb929ce4f56b23815d4a1182ef942caafb3493a25f41973883cac531c50ecde9566479d2f19fe5c3e2562cbb4d0b549e06ae6be71
SSDEEP 192:lEl05M/ebucdwDphMn38xmrgO5w9LLApekguc/PRaTPA6i+9bw0gP6ZWlLbxo:lK0iGyhDHf6i+9sjP6ZSe
TLSH
T139F26222E3A48059F4B6AB754CBA4131A736FDA3A838DB070690F60E6C71791ED25733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WebView2.mfx

Path C:\Users\Admin\AppData\Local\Temp\mrt9684.tmp\WebView2.mfx
Size 388KB
SHA256 9172ea30fb5da914956d3228584c701c1d4f8568723ba82448e5d84d6e04f294
MD5 217c0d7d5926b374d451cc09046fe6f6
SHA1 37d9bf99f9726cb1dd34c748127c5341d4e1b387
SHA512 c690e6a4e99a0ba8a3b0768a30b2a9e0554cd5802043400b91df27e5712eeac95c48f476b2e1ab8f6f9543b95066dac49d3f517e4bff380e7de26a3c4228de2a
SSDEEP 12288:adhgL5tj1XUNgASK4CTfVf1WZ62Cix6OJs0a8DEdIJZ6rrkO/7UCY4KQo:ugL5tj1XUNgASK4CTfVf1WZ62/5qQO/w
TLSH
T1EF847C01BDC08031D27734350A75D672197DBC307D79EBAEA788187B9F681A3A725E2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aviflt.ift

Path C:\Users\Admin\AppData\Local\Temp\mrt9684.tmp\aviflt.ift
Size 24KB
SHA256 0eeffe2fa3c93f3ef62ec357b481d6caac0d3d190fb997ebea623dc5fd674f8c
MD5 bcb767b3dd8769c14eeb15d44e3e8ee2
SHA1 25c652e80a3d1892f6b351f6bcdd3e950b10af9c
SHA512 2a652d40030b91366fd3fdec8611bfb4643e8f41ac723e513b9e5a5b583c7cf1f11768d41d9379d43f953d748eecca0dd84406af9e03a704cb80e9b87d4a0968
SSDEEP 96:MP78rc9zp9HvjsedGNPUNAjtPq8y37QgavioyUuBdqaIZiMUjLepz5WY8FfH:M+cBvvjsedaPUctzyihSIZ8X+dWBf
TLSH
T111B2B539B38205ABFF1A0E71989733B35730F9B09B9682D74F10E98D2C61613D819B1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bmpflt.ift

Path C:\Users\Admin\AppData\Local\Temp\mrt9684.tmp\bmpflt.ift
Size 24KB
SHA256 b7eb74b793f9fb30439e54af504eefee675e73ec8342bd1be784225ded98cdf4
MD5 ec49eb9e3ce55277caca4acce5080669
SHA1 1e891bf4b6e4db661bf2bc2311f1fb4002f9216b
SHA512 0d27400209366117b868401098fbbb2bdfb6115db7570eeb874a43e9e072b9ba5b082ff46b5bca9ce8119d0dc2ebd14e3aff2ad78ae324ef6e508c5e9b8ced44
SSDEEP 96:JEMZE3IPfw8W3MvThiRz9gB+pOd9i6FsKxQM5/rEb:JESE3IP36M1q6EgdooGW/M
TLSH
T198B2B531A7D705B2EE978F3116A653325365FAF05BE0D3C70E91DA6E4D22482E831B61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fliflt.ift

Path C:\Users\Admin\AppData\Local\Temp\mrt9684.tmp\fliflt.ift
Size 28KB
SHA256 4fff120c0c69c1c853cbb5ff83f16a199bc2e4f45c6f8c564b22c3c10b546732
MD5 0eca70c6c3683aeeed66be7bf98efbcf
SHA1 ab8a7da460e4cf816e7b798d37305b0e5d3a3761
SHA512 0959e988be75d1e99be9a7a93d3c25909acb4c5bcf869e67a1fc814a5575435ffc78c6bf055b495e9b8d2a2952c5636e52478c4d060074b2ca71c07af43f307e
SSDEEP 96:AGmPknHTCymEDV/P8JWYrP2YQaVfsOtUpHtdwReGp6FLiZz5Gu:J3nt1V/EJHrP2YPtsfttGzeidGu
TLSH
T13ED22952E3D594F6E96B857052D75A339230BDB94F88CA8BCF41CE4D0C23242AC25BA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gifflt.ift

Path C:\Users\Admin\AppData\Local\Temp\mrt9684.tmp\gifflt.ift
Size 28KB
SHA256 4aa6628517c02816f033d79d386d7d817e7df74fe8cfae351312069fd4c61471
MD5 6e2b70b830863820e9d6750ac7f7b9e1
SHA1 1d4ddc85bc8dd853e95a65822d0d1966ec602979
SHA512 7f3164202576f1b68f1197fa94423d28edd2d279f11c463c4c1f84ef0f075a4c9fd2c009184b18649b0e15fb7354f80a31e66e847be6fb6e18dc1eaff1a40719
SSDEEP 192:VwanxqXUW6VDpwYMJP0R40392Wtcg4G9MsrhrwfI:cUDiJ00WP9MOZw
TLSH
T15CD21906975449B6E245C2F0265E7B37467237A04EA58B47CCE1DE6E2C22282ED38B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jpgflt.ift

Path C:\Users\Admin\AppData\Local\Temp\mrt9684.tmp\jpgflt.ift
Size 92KB
SHA256 23a54d3586092ccd82bc42bdab0c5ece75f68d1f6313e717a815746b38a7f857
MD5 1b8c0407f421ae454eef87edb2264698
SHA1 e248285cdf8691d56243a81000fd667f84ff9550
SHA512 a9fe4b02d6c58c590c051ed0b9375793cd22c56986072895e988c554d265f4243b45c8569dd300fe5c080c5a9addb5d7faab654a2be375992cbbaec8c94469d8
SSDEEP 1536:b5VFtZCQE7sNB6EuWMVGLBhDeC1vm7X54vBxJbkaqHtFxmdC:bltZCrwn6E9vBeivOr1FxSC
TLSH
T14E936BC1B68740F1D9856B7060ABB7739F381B07158FDB93DB34ED624823622FD252A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kcwctrl.mfx

Path C:\Users\Admin\AppData\Local\Temp\mrt9684.tmp\kcwctrl.mfx
Size 12KB
SHA256 2f0f00f42917792c0c3ae4640009dedee3c96408173211e44cbbdd6a04f4afad
MD5 14e1d33e5c9db83a0dc3101f712b2802
SHA1 37eb0cfc5336681275b9c4e0badc7e25018336bb
SHA512 0c0524b2a2b4f64592bd96486cac5f080adbe8971c8d84d6d240656420c01bcb53d12044a8fab220ab5ec34d3978a81e1d2cc76306153a176a57e88a035372a5
SSDEEP 96:2zZZVjqSq5L4TgQfSxwpwizTi2tk3lFoYKVxo/ofROjMojkYCaeaeMPrB/qb9Y4P:2zlWo3xoxsLWUbRkkm/1YY8
TLSH
T13342D81372D04173D0266372892F136BB33AF10315162DABBD91595EAF6239D9E28A23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mmfs2.dll

Path C:\Users\Admin\AppData\Local\Temp\mrt9684.tmp\mmfs2.dll
Size 459KB
SHA256 c0d56cefb509e5600ac6b430adcaf53b81881d3fff4e62b7ede158d66d826622
MD5 4cf7bb74d8104280b7e986f4df21109d
SHA1 edc21a43136afddbf4786593e84b934d40591b74
SHA512 2bbac48354657659795697e67508d777ee595348e1fb3d4b6c65d8618c346b3be0052b1e2e2fe669dcca19c3c00d59d1833acc21d88a97efbde2694935e3c292
SSDEEP 12288:1F4DiwTv/cRLT6BDhdI+2KPYpzGYxv1g5IQurTUckeEqvI:1F4DiwTv/I8ESAzhxvJrT1kr
TLSH
T191A4AE11F982D232E9BA12728ABCBE6A247D7A71473445E397844DBD2D701D31F327A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

oggflt.sft

Path C:\Users\Admin\AppData\Local\Temp\mrt9684.tmp\oggflt.sft
Size 130KB
SHA256 848d266c7676a5f59e66386d76679b97d2934166a8d829d5d000b217ab7a34cf
MD5 e925b7e0be07bc86cb8042168077bb04
SHA1 233c160b5264e1fa4f3b3ad6464207c09f698d26
SHA512 0063b350116bfa478ecda081ae364e08c84cb97a337ff0b6e0d442653976c2663b8b2b430cca694f1a75fd93414d264b46da1331e7aadc2cdd424d69db27c31a
SSDEEP 1536:sw+JHSmG5I1VKFMHU+lfGTFHKYPoPGTUBjnPabuxepe06DSIiRaEUsXxTTUE7:E5G5iE6qTFHdoPGTUBOKxyfSMR0Ij7
TLSH
T18AD39E529687A0FEE8CE1578546F367FCE221A0E7219CE539314EEF65C61E14BE1830B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pcxflt.ift

Path C:\Users\Admin\AppData\Local\Temp\mrt9684.tmp\pcxflt.ift
Size 24KB
SHA256 81ce5610214cc648f6e968af8f31c1bce0430e4e9dc4427bba743bc6aadcba4e
MD5 dbe5395c9508ef6f4a8cbe3973051a80
SHA1 9b0d43f5ea8c11430aca42dfc381c82e557e31dd
SHA512 c58dd464e755f77ea5da06ca70aa046e88d6a6543f8f0fe29ac16b0d2fc28cebd4a209c6ed1b059f09fe0d6b220e9e01f8c29c29b8336c8c0f1f20a1f99e6a91
SSDEEP 48:CGEoIxd/dFALrcgFTudzDVQLwYdHf29btyU+CgjENjwXmwG8gjw6FQpJ0nwwlums:M/uq/YNufyU+9kw3CE6FQn0wKJz5mB
TLSH
T137B29433B3A605B6EF5B4E7065E2A2335775B9E09FA8C2870F41E69D1C26943EC20713
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pngflt.ift

Path C:\Users\Admin\AppData\Local\Temp\mrt9684.tmp\pngflt.ift
Size 80KB
SHA256 7bdae43096b32eb072731a93e6423a848459f385a2f5859629af40e389273f7d
MD5 95e9db64a6248b00bfb42c2fde7e442b
SHA1 a437b1c8b5a96bc58ff339007243d7be98591307
SHA512 cfaaeab68ec6af3809a880a7abe65c33d8a91c9acd661c552e887b35b5f3426e278fd75aa02f95cc6c63c249474d7be6e57cc10329edb1fed05b4a7e614fc15e
SSDEEP 1536:SfjrUDn1MuGECiFJAunIZd+OBEcbfgV4Ddmd:SfjrIfZof+O2cbYuDdS
TLSH
T1A8838DD3E180C0F1EAC60B3669A7F7379E3967974069DB829F94CF295C13641F628326
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tgaflt.ift

Path C:\Users\Admin\AppData\Local\Temp\mrt9684.tmp\tgaflt.ift
Size 24KB
SHA256 bbfd34aa3f6a66e59f06e30103c6248eee54896364ee0c714819b9286b985880
MD5 47ae23e71eb7daf3ea31cc2110421489
SHA1 c03222469db64ef595afab571ef753af77996e4e
SHA512 f1d33dab09b8c3913f629d459df64b8ddd237eaa7e9a4a136f20e3d7e3f50fa1b0b3bcda1baf4b5851ee726f961e16e6e8dd28b3b77578bc2a64a2c01a4deb4c
SSDEEP 96:Ew31ACNxdaqSRKuUyU+xfE6FAQJz5mpn4/:ErCNxxZ0SRUdmpn4/
TLSH
T13BB2B43167AA1AB7EF974E3824FA52335779B9B01BE0C7824F80C61E0C36543ED50722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.dat

Path C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
Size 301B
SHA256 fd7fac9d071a9addbb13d21b518eec65bff4616bf3aa2b2381ccbc3353eb56cc
MD5 3cda162b243574509d0d4cf632542284
SHA1 baa654409ce29e6e0dd679a63dbb7820f14cbc13
SHA512 ec08460e318a28a3b73a2382c2ba9379453dc02fcbb7e22d3089785ce0b09a375bf935b3846c18e5783125d9d73ea8eab6038b3ab1d8447c20096a1f0aaf8fe6
TLSH
T16AE0B61B1B39DBF4DBBDA3B432F25DE57AE24898D566402A16DD1D840C66607248B402
MD5 SHA1 SHA512 TLSH

Submit Download

Normal.dotm

Path C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm
Size 18KB
SHA256 0dae00fc1c154a30da9dc42383249066c00206e95a04096451a69c61ec1a3cc7
MD5 dab136debbe2570672769ce00f8502e3
SHA1 2b07e6bc15bf8f5235aab41e327a07025f4b429b
SHA512 8540d54866976d567ee22a6a50263d8fa500ac3e8c41190f7bab948acede7e552cb7ede1034e0339bb435fd6732699c434cb5d554f6d49fdaacfcecf8ef29c78
SSDEEP 384:Jt+BNxt/ZtNNcB7dSoIFo0VnkI91qE9rXZZpPj:exllNcB7lIy0V11qGfpPj
TLSH
T141829F38E6456874EBA34B3C60DC11F5E10D0843F616A05A24AEE7EE5795E8B4372FCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AutoRecovery save of about_en.asd

Path C:\Users\Admin\AppData\Roaming\Microsoft\Word\AutoRecovery save of about_en.asd
Size 121KB
SHA256 87d5d61721ae3202259afa5894a00a8908a04b29f849d61376b1d3f33c8a9380
MD5 b673b70d9422fe5de1164fb3a22cbff1
SHA1 257f4388c5468da8abd19bf19457fa1d4e336c0b
SHA512 a6658852a572b3c629389372231aa895e2e33c547219d9af211743ed75730b1c9c0384cc61c07b362eadfb81d31efe4212207d269cc7be452b292077f34afec8
SSDEEP 1536:PzFW3i+a97FWeyAJXu1+LsReDXxGG7zzeJH+m94oXcyi78wwJN4Q20sLdcu:PI3MF0OI+LsRNG7/enDF48nJN4QzIdd
TLSH
T167C3E08BB68B9C03E3237678447BA29CF5287D5ADE50D2471298BBBCAE700715D3DB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1168-111-0x0000000000D00000-0x0000000000D14000-memory.dmp

Download

memory/1168-122-0x0000000000D30000-0x0000000000D54000-memory.dmp

Download

memory/1168-100-0x0000000000CD0000-0x0000000000CE7000-memory.dmp

Download

memory/1956-217-0x00000000027F0000-0x0000000002807000-memory.dmp

Download

memory/1956-239-0x0000000004090000-0x00000000040B4000-memory.dmp

Download

memory/1956-228-0x0000000004060000-0x0000000004074000-memory.dmp

Download

memory/2036-386-0x00007FFE3FAF0000-0x00007FFE3FB00000-memory.dmp

Download

memory/2036-387-0x00007FFE3FAF0000-0x00007FFE3FB00000-memory.dmp

Download

memory/2036-392-0x00007FFE3D280000-0x00007FFE3D290000-memory.dmp

Download

memory/2036-391-0x00007FFE3D280000-0x00007FFE3D290000-memory.dmp

Download

memory/2036-389-0x00007FFE3FAF0000-0x00007FFE3FB00000-memory.dmp

Download

memory/2036-390-0x00007FFE3FAF0000-0x00007FFE3FB00000-memory.dmp

Download

memory/2036-454-0x00007FFE3FAF0000-0x00007FFE3FB00000-memory.dmp

Download

memory/2036-457-0x00007FFE3FAF0000-0x00007FFE3FB00000-memory.dmp

Download

memory/2036-388-0x00007FFE3FAF0000-0x00007FFE3FB00000-memory.dmp

Download

memory/2036-455-0x00007FFE3FAF0000-0x00007FFE3FB00000-memory.dmp

Download

memory/2036-456-0x00007FFE3FAF0000-0x00007FFE3FB00000-memory.dmp

Download

memory/4544-333-0x00000000071B0000-0x00000000071B2000-memory.dmp

Download

memory/4544-336-0x00000000071B0000-0x00000000071B2000-memory.dmp

Download

memory/4544-335-0x0000000067700000-0x00000000677E4000-memory.dmp

Download