bf11ab3c3e94ddf40a8edbf1eae52bf518c66d58560fc33defda720acd34506d

Analysis

user interaction
yes
max time kernel
466s
max time network
466s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
13/09/2026, 05:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
VoicemodInstaller_1.6.0-zxtpcu.exe
Size 6.1MB
Sample260913-gla5aascrd
SHA256 bf11ab3c3e94ddf40a8edbf1eae52bf518c66d58560fc33defda720acd34506d
MD5 9686eca7104468acf86f238521842523
SHA1 03cb9b5b0fe2395861fad11ddc44257acdbf37d7
SHA512 66621706b28a856ffd37cf2b61619b061ea2d268ac55426e0d6f6392f22d7514efceab40291f83d69ba12ffa2283d956a9e3df6824027bc504330cfa5fede57a
SSDEEP 98304:U1QTLb/jF2LPpBe5QPHAZqZIbQQm5gre68xhvFAjNfnOx3TX6u0Fm:AKrUPpUMHWbQQmSq6oFApfnSTXjYm
TLSH
T155561223B298A53FD09927348573A52094F7B7BDE817AD12B6F8D48CDF256C01E3A631
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

bootkit defense_evasion discovery execution installer persistence ransomware

Malware Config

Signatures

Disables Task Manager via registry modification
defense_evasion

Contacts third-party web service commonly abused for C2 1 TTPs 6 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
221	raw.githubusercontent.com
222	raw.githubusercontent.com
223	raw.githubusercontent.com
224	raw.githubusercontent.com
219	raw.githubusercontent.com
220	raw.githubusercontent.com

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	凅怦椛怸薃馷珛诚臰据獱鹨愈糣展坉.exe
File opened (read-only)	\??\F:	NOTEPAD.EXE

Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	MBR.exe
File opened for modification	\??\PhysicalDrive0	凅怦椛怸薃馷珛诚臰据獱鹨愈糣展坉.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-101591186-421676486-4137282292-1000\Control Panel\International\Geo\Nation	凅怦椛怸薃馷珛诚臰据獱鹨愈糣展坉.exe

Discovers running processes 1 TTPs 1 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
3252	tasklist.exe

Drops file in Program Files directory 14 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\tv_noise_dirty.wav	Clutt4.exe
File opened for modification	C:\Program Files\tv_super_noise.wav	Clutt4.exe
File opened for modification	C:\Program Files\MBR.exe	Clutt4.exe
File opened for modification	C:\Program Files\bass_beep.wav	Clutt4.exe
File opened for modification	C:\Program Files\piiiuuu.wav	Clutt4.exe
File opened for modification	C:\Program Files\quic_beep.wav	Clutt4.exe
File opened for modification	C:\Program Files\tv_very_dirty.wav	Clutt4.exe
File opened for modification	C:\Program Files\media_snd.exe	Clutt4.exe
File opened for modification	C:\Program Files\annoying_beep.wav	Clutt4.exe
File opened for modification	C:\Program Files\annoying_beep_extended.wav	Clutt4.exe
File opened for modification	C:\Program Files\beep1.wav	Clutt4.exe
File opened for modification	C:\Program Files\beep2.wav	Clutt4.exe
File opened for modification	C:\Program Files\screen_shake.wav	Clutt4.exe
File opened for modification	C:\Program Files\tiny_beep.wav	Clutt4.exe

Drops file in Windows directory 18 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2668_470421144\domain_actions.dll	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2668_919288149\data.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2668_1698351740\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2668_1698351740\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2668_1698351740\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2668_1426990040\deny_etld1_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2668_1426990040\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2668_1362354723\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2668_1362354723\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2668_1426990040\deny_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2668_1426990040\deny_full_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2668_919288149\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2668_1616007145\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2668_1698351740\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2668_1362354723\keys.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2668_1362354723\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2668_470421144\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2668_1616007145\protocols.json	msedge.exe

Executes dropped EXE 5 IoCs

pid	Process
5228	VoicemodInstaller_1.6.0-zxtpcu.tmp
5464	MBR.exe
4168	media_snd.exe
980	Monoxidex64.exe
2912	凅怦椛怸薃馷珛诚臰据獱鹨愈糣展坉.exe

Loads dropped DLL 4 IoCs

pid	Process
5228	VoicemodInstaller_1.6.0-zxtpcu.tmp
5228	VoicemodInstaller_1.6.0-zxtpcu.tmp
5228	VoicemodInstaller_1.6.0-zxtpcu.tmp
2668	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2104	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1868	cmd.exe
4836	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VoicemodInstaller_1.6.0-zxtpcu.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VoicemodInstaller_1.6.0-zxtpcu.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5268	msedge.exe
3348	msedge.exe

Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral1/memory/4508-0-0x0000000000400000-0x00000000004DB000-memory.dmp	innosetup
behavioral1/memory/4508-13-0x0000000000400000-0x00000000004DB000-memory.dmp	innosetup
behavioral1/memory/4508-123-0x0000000000400000-0x00000000004DB000-memory.dmp	innosetup

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134337524193201180"	msedge.exe

Modifies registry class 12 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-101591186-421676486-4137282292-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-101591186-421676486-4137282292-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-101591186-421676486-4137282292-1000_Classes\Local Settings	凅怦椛怸薃馷珛诚臰据獱鹨愈糣展坉.exe
Key created	\REGISTRY\USER\S-1-5-21-101591186-421676486-4137282292-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-101591186-421676486-4137282292-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-101591186-421676486-4137282292-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-101591186-421676486-4137282292-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-101591186-421676486-4137282292-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-101591186-421676486-4137282292-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-101591186-421676486-4137282292-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-101591186-421676486-4137282292-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-101591186-421676486-4137282292-1000\{42904922-31F1-497C-A1EB-BD276EAD8F77}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3336	msedge.exe
3336	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs

pid	Process
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3252	tasklist.exe
Token: SeDebugPrivilege	5264	Clutt4.exe
Token: SeDebugPrivilege	5264	Clutt4.exe
Token: SeDebugPrivilege	2912	凅怦椛怸薃馷珛诚臰据獱鹨愈糣展坉.exe
Token: SeTakeOwnershipPrivilege	2912	凅怦椛怸薃馷珛诚臰据獱鹨愈糣展坉.exe
Token: SeTakeOwnershipPrivilege	2912	凅怦椛怸薃馷珛诚臰据獱鹨愈糣展坉.exe
Token: SeTakeOwnershipPrivilege	2912	凅怦椛怸薃馷珛诚臰据獱鹨愈糣展坉.exe
Token: SeTakeOwnershipPrivilege	2912	凅怦椛怸薃馷珛诚臰据獱鹨愈糣展坉.exe
Token: SeTakeOwnershipPrivilege	2912	凅怦椛怸薃馷珛诚臰据獱鹨愈糣展坉.exe
Token: SeTakeOwnershipPrivilege	2912	凅怦椛怸薃馷珛诚臰据獱鹨愈糣展坉.exe
Token: SeTakeOwnershipPrivilege	2912	凅怦椛怸薃馷珛诚臰据獱鹨愈糣展坉.exe
Token: SeTakeOwnershipPrivilege	2912	凅怦椛怸薃馷珛诚臰据獱鹨愈糣展坉.exe
Token: SeTakeOwnershipPrivilege	2912	凅怦椛怸薃馷珛诚臰据獱鹨愈糣展坉.exe
Token: SeTakeOwnershipPrivilege	2912	凅怦椛怸薃馷珛诚臰据獱鹨愈糣展坉.exe
Token: SeTakeOwnershipPrivilege	2912	凅怦椛怸薃馷珛诚臰据獱鹨愈糣展坉.exe
Token: SeTakeOwnershipPrivilege	2912	凅怦椛怸薃馷珛诚臰据獱鹨愈糣展坉.exe
Token: SeTakeOwnershipPrivilege	2912	凅怦椛怸薃馷珛诚臰据獱鹨愈糣展坉.exe
Token: SeTakeOwnershipPrivilege	2912	凅怦椛怸薃馷珛诚臰据獱鹨愈糣展坉.exe
Token: SeTakeOwnershipPrivilege	2912	凅怦椛怸薃馷珛诚臰据獱鹨愈糣展坉.exe
Token: SeTakeOwnershipPrivilege	2912	凅怦椛怸薃馷珛诚臰据獱鹨愈糣展坉.exe
Token: SeTakeOwnershipPrivilege	2912	凅怦椛怸薃馷珛诚臰据獱鹨愈糣展坉.exe
Token: SeTakeOwnershipPrivilege	2912	凅怦椛怸薃馷珛诚臰据獱鹨愈糣展坉.exe
Token: SeTakeOwnershipPrivilege	2912	凅怦椛怸薃馷珛诚臰据獱鹨愈糣展坉.exe
Token: SeTakeOwnershipPrivilege	2912	凅怦椛怸薃馷珛诚臰据獱鹨愈糣展坉.exe
Token: SeTakeOwnershipPrivilege	2912	凅怦椛怸薃馷珛诚臰据獱鹨愈糣展坉.exe
Token: SeTakeOwnershipPrivilege	2912	凅怦椛怸薃馷珛诚臰据獱鹨愈糣展坉.exe
Token: SeTakeOwnershipPrivilege	2912	凅怦椛怸薃馷珛诚臰据獱鹨愈糣展坉.exe
Token: SeTakeOwnershipPrivilege	2912	凅怦椛怸薃馷珛诚臰据獱鹨愈糣展坉.exe
Token: SeTakeOwnershipPrivilege	2912	凅怦椛怸薃馷珛诚臰据獱鹨愈糣展坉.exe
Token: SeTakeOwnershipPrivilege	2912	凅怦椛怸薃馷珛诚臰据獱鹨愈糣展坉.exe
Token: SeTakeOwnershipPrivilege	2912	凅怦椛怸薃馷珛诚臰据獱鹨愈糣展坉.exe
Token: SeTakeOwnershipPrivilege	2912	凅怦椛怸薃馷珛诚臰据獱鹨愈糣展坉.exe
Token: SeTakeOwnershipPrivilege	2912	凅怦椛怸薃馷珛诚臰据獱鹨愈糣展坉.exe
Token: SeTakeOwnershipPrivilege	2912	凅怦椛怸薃馷珛诚臰据獱鹨愈糣展坉.exe
Token: SeTakeOwnershipPrivilege	2912	凅怦椛怸薃馷珛诚臰据獱鹨愈糣展坉.exe
Token: SeTakeOwnershipPrivilege	2912	凅怦椛怸薃馷珛诚臰据獱鹨愈糣展坉.exe
Token: SeTakeOwnershipPrivilege	2912	凅怦椛怸薃馷珛诚臰据獱鹨愈糣展坉.exe
Token: SeTakeOwnershipPrivilege	2912	凅怦椛怸薃馷珛诚臰据獱鹨愈糣展坉.exe
Token: SeTakeOwnershipPrivilege	2912	凅怦椛怸薃馷珛诚臰据獱鹨愈糣展坉.exe
Token: SeTakeOwnershipPrivilege	2912	凅怦椛怸薃馷珛诚臰据獱鹨愈糣展坉.exe
Token: SeTakeOwnershipPrivilege	2912	凅怦椛怸薃馷珛诚臰据獱鹨愈糣展坉.exe
Token: SeTakeOwnershipPrivilege	2912	凅怦椛怸薃馷珛诚臰据獱鹨愈糣展坉.exe
Token: SeTakeOwnershipPrivilege	2912	凅怦椛怸薃馷珛诚臰据獱鹨愈糣展坉.exe
Token: SeTakeOwnershipPrivilege	2912	凅怦椛怸薃馷珛诚臰据獱鹨愈糣展坉.exe
Token: SeTakeOwnershipPrivilege	2912	凅怦椛怸薃馷珛诚臰据獱鹨愈糣展坉.exe
Token: SeTakeOwnershipPrivilege	2912	凅怦椛怸薃馷珛诚臰据獱鹨愈糣展坉.exe
Token: SeTakeOwnershipPrivilege	2912	凅怦椛怸薃馷珛诚臰据獱鹨愈糣展坉.exe
Token: SeTakeOwnershipPrivilege	2912	凅怦椛怸薃馷珛诚臰据獱鹨愈糣展坉.exe
Token: SeTakeOwnershipPrivilege	2912	凅怦椛怸薃馷珛诚臰据獱鹨愈糣展坉.exe
Token: SeTakeOwnershipPrivilege	2912	凅怦椛怸薃馷珛诚臰据獱鹨愈糣展坉.exe
Token: SeTakeOwnershipPrivilege	2912	凅怦椛怸薃馷珛诚臰据獱鹨愈糣展坉.exe
Token: SeTakeOwnershipPrivilege	2912	凅怦椛怸薃馷珛诚臰据獱鹨愈糣展坉.exe
Token: SeTakeOwnershipPrivilege	2912	凅怦椛怸薃馷珛诚臰据獱鹨愈糣展坉.exe
Token: SeTakeOwnershipPrivilege	2912	凅怦椛怸薃馷珛诚臰据獱鹨愈糣展坉.exe
Token: SeTakeOwnershipPrivilege	2912	凅怦椛怸薃馷珛诚臰据獱鹨愈糣展坉.exe
Token: SeTakeOwnershipPrivilege	2912	凅怦椛怸薃馷珛诚臰据獱鹨愈糣展坉.exe
Token: SeTakeOwnershipPrivilege	2912	凅怦椛怸薃馷珛诚臰据獱鹨愈糣展坉.exe
Token: SeTakeOwnershipPrivilege	2912	凅怦椛怸薃馷珛诚臰据獱鹨愈糣展坉.exe
Token: SeTakeOwnershipPrivilege	2912	凅怦椛怸薃馷珛诚臰据獱鹨愈糣展坉.exe
Token: SeTakeOwnershipPrivilege	2912	凅怦椛怸薃馷珛诚臰据獱鹨愈糣展坉.exe
Token: SeTakeOwnershipPrivilege	2912	凅怦椛怸薃馷珛诚臰据獱鹨愈糣展坉.exe
Token: SeTakeOwnershipPrivilege	2912	凅怦椛怸薃馷珛诚臰据獱鹨愈糣展坉.exe
Token: SeTakeOwnershipPrivilege	2912	凅怦椛怸薃馷珛诚臰据獱鹨愈糣展坉.exe
Token: SeTakeOwnershipPrivilege	2912	凅怦椛怸薃馷珛诚臰据獱鹨愈糣展坉.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
3308	OpenWith.exe
1040	OpenWith.exe
4240	OpenWith.exe
2912	凅怦椛怸薃馷珛诚臰据獱鹨愈糣展坉.exe
4836	OpenWith.exe
4264	OpenWith.exe
4640	OpenWith.exe
460	OpenWith.exe
4400	OpenWith.exe
2824	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4508 wrote to memory of 5228	4508	VoicemodInstaller_1.6.0-zxtpcu.exe	81
PID 5228 wrote to memory of 5756	5228	VoicemodInstaller_1.6.0-zxtpcu.tmp	87
PID 5228 wrote to memory of 5440	5228	VoicemodInstaller_1.6.0-zxtpcu.tmp	90
PID 5228 wrote to memory of 1868	5228	VoicemodInstaller_1.6.0-zxtpcu.tmp	92
PID 1868 wrote to memory of 3252	1868	cmd.exe	94
PID 5228 wrote to memory of 4168	5228	VoicemodInstaller_1.6.0-zxtpcu.tmp	95
PID 5228 wrote to memory of 1248	5228	VoicemodInstaller_1.6.0-zxtpcu.tmp	98
PID 5836 wrote to memory of 2668	5836	msedge.exe	109
PID 2668 wrote to memory of 212	2668	msedge.exe	110
PID 2668 wrote to memory of 5268	2668	msedge.exe	111
PID 2668 wrote to memory of 3896	2668	msedge.exe	112
PID 2668 wrote to memory of 3896	2668	msedge.exe	112
PID 2668 wrote to memory of 3896	2668	msedge.exe	112
PID 2668 wrote to memory of 2020	2668	msedge.exe	113
PID 2668 wrote to memory of 2020	2668	msedge.exe	113
PID 2668 wrote to memory of 3580	2668	msedge.exe	114
PID 2668 wrote to memory of 3580	2668	msedge.exe	114
PID 2668 wrote to memory of 2240	2668	msedge.exe	115
PID 2668 wrote to memory of 3580	2668	msedge.exe	114
PID 2668 wrote to memory of 2240	2668	msedge.exe	115
PID 2668 wrote to memory of 2240	2668	msedge.exe	115
PID 2668 wrote to memory of 5748	2668	msedge.exe	119
PID 2668 wrote to memory of 5748	2668	msedge.exe	119
PID 2668 wrote to memory of 476	2668	msedge.exe	120
PID 2668 wrote to memory of 2224	2668	msedge.exe	121
PID 2668 wrote to memory of 476	2668	msedge.exe	120
PID 2668 wrote to memory of 2224	2668	msedge.exe	121
PID 2668 wrote to memory of 5140	2668	msedge.exe	123
PID 2668 wrote to memory of 4176	2668	msedge.exe	127
PID 2668 wrote to memory of 4176	2668	msedge.exe	127
PID 2668 wrote to memory of 4176	2668	msedge.exe	127
PID 2668 wrote to memory of 1376	2668	msedge.exe	128
PID 2668 wrote to memory of 1376	2668	msedge.exe	128
PID 2668 wrote to memory of 1376	2668	msedge.exe	128
PID 2668 wrote to memory of 4204	2668	msedge.exe	129
PID 2668 wrote to memory of 4204	2668	msedge.exe	129
PID 2668 wrote to memory of 4204	2668	msedge.exe	129
PID 2668 wrote to memory of 1756	2668	msedge.exe	130
PID 2668 wrote to memory of 1756	2668	msedge.exe	130
PID 2668 wrote to memory of 1756	2668	msedge.exe	130
PID 2668 wrote to memory of 4540	2668	msedge.exe	131
PID 2668 wrote to memory of 4640	2668	msedge.exe	132
PID 2668 wrote to memory of 4416	2668	msedge.exe	133
PID 2668 wrote to memory of 5392	2668	msedge.exe	134
PID 2668 wrote to memory of 5720	2668	msedge.exe	135
PID 2668 wrote to memory of 5392	2668	msedge.exe	134
PID 2668 wrote to memory of 5392	2668	msedge.exe	134
PID 2668 wrote to memory of 5720	2668	msedge.exe	135
PID 2668 wrote to memory of 6020	2668	msedge.exe	136
PID 2668 wrote to memory of 4980	2668	msedge.exe	138
PID 2668 wrote to memory of 4980	2668	msedge.exe	138
PID 2668 wrote to memory of 4980	2668	msedge.exe	138
PID 2668 wrote to memory of 1284	2668	msedge.exe	139
PID 2668 wrote to memory of 5876	2668	msedge.exe	142
PID 2668 wrote to memory of 5876	2668	msedge.exe	142
PID 2668 wrote to memory of 5540	2668	msedge.exe	144
PID 2668 wrote to memory of 5540	2668	msedge.exe	144
PID 2668 wrote to memory of 5540	2668	msedge.exe	144
PID 2668 wrote to memory of 5104	2668	msedge.exe	145
PID 2668 wrote to memory of 4236	2668	msedge.exe	146
PID 2668 wrote to memory of 4236	2668	msedge.exe	146
PID 2668 wrote to memory of 1516	2668	msedge.exe	147
PID 2668 wrote to memory of 1516	2668	msedge.exe	147
PID 2668 wrote to memory of 3336	2668	msedge.exe	148

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

cURL User-Agent 3 IoCs

Uses User-Agent string associated with cURL utility.

description	flow	ioc
HTTP User-Agent header	29	curl/8.7.1
HTTP User-Agent header	14	curl/8.7.1
HTTP User-Agent header	23	curl/8.7.1

C:\Users\Admin\AppData\Local\Temp\VoicemodInstaller_1.6.0-zxtpcu.exe
"C:\Users\Admin\AppData\Local\Temp\VoicemodInstaller_1.6.0-zxtpcu.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4508
- C:\Users\Admin\AppData\Local\Temp\is-T6J51.tmp\VoicemodInstaller_1.6.0-zxtpcu.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-T6J51.tmp\VoicemodInstaller_1.6.0-zxtpcu.tmp" /SL5="$401DE,5606367,839680,C:\Users\Admin\AppData\Local\Temp\VoicemodInstaller_1.6.0-zxtpcu.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5228
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" https://api.voicemod.net/ip -H "Content-Type: application/json" -o "C:\Users\Admin\AppData\Local\Temp\\ipaddress.info"
    3⤵
    PID:5756
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" -u us1-d2410d079164564abc5e06843fc67fdb:516itzpaBAGHuMlgh2A6VuTvFKGulyir1mi3OY6kBDLS4XbBnxXtLYe5ngsL2uNv -v https://s2s.mparticle.com/v2/events -H "Content-Type: application/json" -X POST -d "{\"user_identities\": {\"other\": \"bd19434d-e173-4051-ab93-e1b76925f4b9\"},\"device_info\": {\"platform\": \"Android\",\"android_uuid\": \"bd19434d-e173-4051-ab93-e1b76925f4b9\"},\"mp_deviceid\": \"bd19434d-e173-4051-ab93-e1b76925f4b9\",\"events\": [{\"data\": {\"event_name\": \"Installer Open\" , \"custom_attributes\": { \"version\": \"1.6.0\", \"app_version\": \"1.6.0\", \"machine_guid\": \"bd19434d-e173-4051-ab93-e1b76925f4b9\", \"country_code\": \"US\", \"locale\": \"en-US\", \"is_new_user\": \"True\", \"voicemod_system\": \"voicemod-v3-installer-windows\",\"operating_system\": \"Windows\",\"operating_system_version\": \"10 (10.0.19044)\",\"cpu_architecture\": \"x86_64\", \"download_id\": \"zxtpcu\" }},\"event_type\": \"custom_event\"}],\"ip\": \"85.203.46.248\",\"environment\": \"production\"}"
    3⤵
    PID:5440
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /C tasklist > C:\Users\Admin\AppData\Local\Temp\\tasklist_unins000.exe.txt
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1868
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:3252
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" https://api.voicemod.net/ip -H "Content-Type: application/json" -o "C:\Users\Admin\AppData\Local\Temp\\ipaddress.info"
    3⤵
    PID:4168
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" -u us1-d2410d079164564abc5e06843fc67fdb:516itzpaBAGHuMlgh2A6VuTvFKGulyir1mi3OY6kBDLS4XbBnxXtLYe5ngsL2uNv -v https://s2s.mparticle.com/v2/events -H "Content-Type: application/json" -X POST -d "{\"user_identities\": {\"other\": \"bd19434d-e173-4051-ab93-e1b76925f4b9\"},\"device_info\": {\"platform\": \"Android\",\"android_uuid\": \"bd19434d-e173-4051-ab93-e1b76925f4b9\"},\"mp_deviceid\": \"bd19434d-e173-4051-ab93-e1b76925f4b9\",\"events\": [{\"data\": {\"event_name\": \"Installer Page wpWelcome\" , \"custom_attributes\": { \"version\": \"1.6.0\", \"app_version\": \"1.6.0\", \"machine_guid\": \"bd19434d-e173-4051-ab93-e1b76925f4b9\", \"country_code\": \"US\", \"locale\": \"en-US\", \"is_new_user\": \"True\", \"voicemod_system\": \"voicemod-v3-installer-windows\",\"operating_system\": \"Windows\",\"operating_system_version\": \"10 (10.0.19044)\",\"cpu_architecture\": \"x86_64\", \"download_id\": \"zxtpcu\",\"page_number\": \"1\" }},\"event_type\": \"custom_event\"}],\"ip\": \"85.203.46.248\",\"environment\": \"production\"}"
    3⤵
    PID:1248

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch
  2⤵
  - Drops file in Windows directory
  - Loads dropped DLL
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2668
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x25c,0x260,0x264,0x230,0x2c4,0x7ffacfa8c188,0x7ffacfa8c194,0x7ffacfa8c1a0
    3⤵
    PID:212
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1852,i,17573691687641675355,13169232365046828108,524288 --field-trial-handle=2244,i,17978417790214316717,18152985991301530635,262144 --variations-seed-version --mojo-platform-channel-handle=2280 /prefetch:3
    3⤵
    - System Time Discovery
    PID:5268
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1708,i,11469831222605219524,274480720088774000,262144 --field-trial-handle=2244,i,17978417790214316717,18152985991301530635,262144 --variations-seed-version --mojo-platform-channel-handle=2240 /prefetch:2
    3⤵
    PID:3896
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2644,i,5041914328943024016,3686267454287615015,524288 --field-trial-handle=2244,i,17978417790214316717,18152985991301530635,262144 --variations-seed-version --mojo-platform-channel-handle=2780 /prefetch:8
    3⤵
    PID:2020
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3420,i,13125921786715055739,9920002145467101272,2097152 --field-trial-handle=2244,i,17978417790214316717,18152985991301530635,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
    3⤵
    PID:3580
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3424,i,167945087609141714,923448208176436535,2097152 --field-trial-handle=2244,i,17978417790214316717,18152985991301530635,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
    3⤵
    PID:2240
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5100,i,18279957682212938094,9734728784541253812,524288 --field-trial-handle=2244,i,17978417790214316717,18152985991301530635,262144 --variations-seed-version --mojo-platform-channel-handle=5088 /prefetch:8
    3⤵
    PID:5748
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5160,i,10491848395977558814,13697850675503268575,524288 --field-trial-handle=2244,i,17978417790214316717,18152985991301530635,262144 --variations-seed-version --mojo-platform-channel-handle=5248 /prefetch:8
    3⤵
    PID:476
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5180,i,5982232419256830900,93493765392510980,524288 --field-trial-handle=2244,i,17978417790214316717,18152985991301530635,262144 --variations-seed-version --mojo-platform-channel-handle=5220 /prefetch:8
    3⤵
    PID:2224
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5760,i,13964649350266892551,15398310239133973351,524288 --field-trial-handle=2244,i,17978417790214316717,18152985991301530635,262144 --variations-seed-version --mojo-platform-channel-handle=5780 /prefetch:8
    3⤵
    PID:1128
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5760,i,13964649350266892551,15398310239133973351,524288 --field-trial-handle=2244,i,17978417790214316717,18152985991301530635,262144 --variations-seed-version --mojo-platform-channel-handle=5780 /prefetch:8
    3⤵
    PID:5140
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6624,i,5333970108603100610,14441288776645197698,2097152 --field-trial-handle=2244,i,17978417790214316717,18152985991301530635,262144 --variations-seed-version --mojo-platform-channel-handle=6656 /prefetch:1
    3⤵
    PID:4176
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6568,i,7814169334311317013,3245780502541920114,2097152 --field-trial-handle=2244,i,17978417790214316717,18152985991301530635,262144 --variations-seed-version --mojo-platform-channel-handle=5756 /prefetch:1
    3⤵
    PID:1376
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6324,i,2112442174596561970,3244523095277868081,2097152 --field-trial-handle=2244,i,17978417790214316717,18152985991301530635,262144 --variations-seed-version --mojo-platform-channel-handle=6724 /prefetch:1
    3⤵
    PID:4204
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6824,i,9997108859906150025,10055117995387030287,2097152 --field-trial-handle=2244,i,17978417790214316717,18152985991301530635,262144 --variations-seed-version --mojo-platform-channel-handle=6840 /prefetch:1
    3⤵
    PID:1756
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7000,i,14096786320066183784,11362125960858681635,524288 --field-trial-handle=2244,i,17978417790214316717,18152985991301530635,262144 --variations-seed-version --mojo-platform-channel-handle=5832 /prefetch:8
    3⤵
    PID:4540
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6908,i,5042762715153146822,9384536526868202859,524288 --field-trial-handle=2244,i,17978417790214316717,18152985991301530635,262144 --variations-seed-version --mojo-platform-channel-handle=6932 /prefetch:8
    3⤵
    PID:4640
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6096,i,7527703938849188127,9655865622271881240,524288 --field-trial-handle=2244,i,17978417790214316717,18152985991301530635,262144 --variations-seed-version --mojo-platform-channel-handle=6956 /prefetch:8
    3⤵
    PID:4416
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=7096,i,4533414582295717203,13242236252700030411,2097152 --field-trial-handle=2244,i,17978417790214316717,18152985991301530635,262144 --variations-seed-version --mojo-platform-channel-handle=7144 /prefetch:1
    3⤵
    PID:5392
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7088,i,6149303833519632273,15836540965377107170,524288 --field-trial-handle=2244,i,17978417790214316717,18152985991301530635,262144 --variations-seed-version --mojo-platform-channel-handle=7104 /prefetch:8
    3⤵
    PID:5720
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7504,i,15732178148874500049,4298993811628781275,524288 --field-trial-handle=2244,i,17978417790214316717,18152985991301530635,262144 --variations-seed-version --mojo-platform-channel-handle=7536 /prefetch:8
    3⤵
    PID:6020
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=3556,i,15787708953331622568,14249268209894838734,2097152 --field-trial-handle=2244,i,17978417790214316717,18152985991301530635,262144 --variations-seed-version --mojo-platform-channel-handle=3712 /prefetch:1
    3⤵
    PID:4980
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6628,i,6569206039437751507,5030534682080664222,524288 --field-trial-handle=2244,i,17978417790214316717,18152985991301530635,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:8
    3⤵
    PID:1284
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7060,i,9801412824939618112,18099945658344868744,524288 --field-trial-handle=2244,i,17978417790214316717,18152985991301530635,262144 --variations-seed-version --mojo-platform-channel-handle=7012 /prefetch:8
    3⤵
    PID:5876
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=7672,i,16702169301231122187,6642852393752686515,2097152 --field-trial-handle=2244,i,17978417790214316717,18152985991301530635,262144 --variations-seed-version --mojo-platform-channel-handle=5956 /prefetch:1
    3⤵
    PID:5540
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6508,i,1367163693667661749,8443917574641953001,524288 --field-trial-handle=2244,i,17978417790214316717,18152985991301530635,262144 --variations-seed-version --mojo-platform-channel-handle=1572 /prefetch:8
    3⤵
    PID:5104
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7280,i,10346389012091019540,9566940968987677813,524288 --field-trial-handle=2244,i,17978417790214316717,18152985991301530635,262144 --variations-seed-version --mojo-platform-channel-handle=6296 /prefetch:8
    3⤵
    PID:4236
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7552,i,9133591040351937768,13143766592521108596,524288 --field-trial-handle=2244,i,17978417790214316717,18152985991301530635,262144 --variations-seed-version --mojo-platform-channel-handle=4864 /prefetch:8
    3⤵
    PID:1516
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3228,i,4721449796251100396,15260593597453227315,262144 --field-trial-handle=2244,i,17978417790214316717,18152985991301530635,262144 --variations-seed-version --mojo-platform-channel-handle=3080 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3336
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=5320,i,11627937750339992522,11147116524753165200,2097152 --field-trial-handle=2244,i,17978417790214316717,18152985991301530635,262144 --variations-seed-version --mojo-platform-channel-handle=5344 /prefetch:1
    3⤵
    PID:3616
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7656,i,401588373692095531,4349404481415723469,524288 --field-trial-handle=2244,i,17978417790214316717,18152985991301530635,262144 --variations-seed-version --mojo-platform-channel-handle=5396 /prefetch:8
    3⤵
    PID:2072
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6240,i,4390551832603857370,4109458918871817110,524288 --field-trial-handle=2244,i,17978417790214316717,18152985991301530635,262144 --variations-seed-version --mojo-platform-channel-handle=1048 /prefetch:8
    3⤵
    PID:3628
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=5448,i,14974428515999917903,5476249857238197158,2097152 --field-trial-handle=2244,i,17978417790214316717,18152985991301530635,262144 --variations-seed-version --mojo-platform-channel-handle=5472 /prefetch:1
    3⤵
    PID:1188
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2172,i,3567306580720648129,13592586060766044291,524288 --field-trial-handle=2244,i,17978417790214316717,18152985991301530635,262144 --variations-seed-version --mojo-platform-channel-handle=7616 /prefetch:8
    3⤵
    PID:4856
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5916,i,12305985635974649066,468617917046207411,524288 --field-trial-handle=2244,i,17978417790214316717,18152985991301530635,262144 --variations-seed-version --mojo-platform-channel-handle=7248 /prefetch:8
    3⤵
    PID:380
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=772,i,14173441953085025971,17261310751138023548,524288 --field-trial-handle=2244,i,17978417790214316717,18152985991301530635,262144 --variations-seed-version --mojo-platform-channel-handle=6152 /prefetch:8
    3⤵
    PID:3036
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=5644,i,4980404463922025558,1398167427953180580,2097152 --field-trial-handle=2244,i,17978417790214316717,18152985991301530635,262144 --variations-seed-version --mojo-platform-channel-handle=3956 /prefetch:1
    3⤵
    PID:4276
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5880,i,15097843040889695435,16862628888457440759,524288 --field-trial-handle=2244,i,17978417790214316717,18152985991301530635,262144 --variations-seed-version --mojo-platform-channel-handle=7288 /prefetch:8
    3⤵
    PID:2228
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7708,i,7256156729646324086,8536306054303091885,524288 --field-trial-handle=2244,i,17978417790214316717,18152985991301530635,262144 --variations-seed-version --mojo-platform-channel-handle=7712 /prefetch:8
    3⤵
    PID:3700
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=6240,i,9615871058646646855,9059823068988801522,2097152 --field-trial-handle=2244,i,17978417790214316717,18152985991301530635,262144 --variations-seed-version --mojo-platform-channel-handle=5516 /prefetch:1
    3⤵
    PID:4896
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=5160,i,6255344720005850133,17444440402090907833,2097152 --field-trial-handle=2244,i,17978417790214316717,18152985991301530635,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:1
    3⤵
    PID:2544
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6832,i,12669599542181989689,11799530466083047289,524288 --field-trial-handle=2244,i,17978417790214316717,18152985991301530635,262144 --variations-seed-version --mojo-platform-channel-handle=7596 /prefetch:8
    3⤵
    PID:1592
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --always-read-main-dll --metrics-shmem-handle=7544,i,1094369471459764891,4570974192016570457,2097152 --field-trial-handle=2244,i,17978417790214316717,18152985991301530635,262144 --variations-seed-version --mojo-platform-channel-handle=7912 /prefetch:1
    3⤵
    PID:4924
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7952,i,8379070349720124607,7737954733772685783,524288 --field-trial-handle=2244,i,17978417790214316717,18152985991301530635,262144 --variations-seed-version --mojo-platform-channel-handle=8032 /prefetch:8
    3⤵
    PID:3732
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7136,i,12005790981661568651,14181546239659930120,524288 --field-trial-handle=2244,i,17978417790214316717,18152985991301530635,262144 --variations-seed-version --mojo-platform-channel-handle=8080 /prefetch:8
    3⤵
    PID:4920
- - C:\Users\Admin\Downloads\Monoxidex64.exe
    "C:\Users\Admin\Downloads\Monoxidex64.exe"
    3⤵
    - Executes dropped EXE
    PID:980
  - - C:\Users\Admin\AppData\Local\Temp\凅怦椛怸薃馷珛诚臰据獱鹨愈糣展坉.exe
      "C:\Users\Admin\AppData\Local\Temp\凅怦椛怸薃馷珛诚臰据獱鹨愈糣展坉.exe"
      4⤵
      Enumerates connected drives
      Writes to the Master Boot Record (MBR)
      Checks computer location settings
      Executes dropped EXE
      Modifies registry class
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:2912
    - - C:\Windows\system32\NOTEPAD.EXE
        
        "C:\Windows\system32\NOTEPAD.EXE" F:\$RECYCLE.BIN\S-1-5-21-101591186-421676486-4137282292-1000\desktop.ini
        5⤵
        Enumerates connected drives
        
        PID:5864
    - - C:\Windows\system32\NOTEPAD.EXE
        
        "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\7-Zip\Lang\fi.txt
        5⤵
        
        PID:5012
    - - C:\Windows\system32\NOTEPAD.EXE
        
        "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\7-Zip\Lang\mn.txt
        5⤵
        
        PID:5372
    - - C:\Windows\system32\NOTEPAD.EXE
        
        "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\7-Zip\Lang\ne.txt
        5⤵
        
        PID:4528
    - - C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        
        "C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe"
        5⤵
        
        PID:4756
    - - C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        
        "C:\Program Files\Java\jdk-1.8\bin\jdeps.exe"
        5⤵
        
        PID:2664
    - - C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        
        "C:\Program Files\Java\jdk-1.8\bin\jstatd.exe"
        5⤵
        
        PID:820
    - - C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe
        
        "C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe"
        5⤵
        
        PID:5440
    - - C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe
        
        "C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe"
        5⤵
        
        PID:3340
    - - C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe
        
        "C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe"
        5⤵
        
        PID:764
    - - C:\Program Files\Java\jre-1.8\bin\java.exe
        
        "C:\Program Files\Java\jre-1.8\bin\java.exe"
        5⤵
        
        PID:3180
    - - C:\Program Files\Java\jre-1.8\bin\unpack200.exe
        
        "C:\Program Files\Java\jre-1.8\bin\unpack200.exe"
        5⤵
        
        PID:3852
    - - C:\Windows\system32\NOTEPAD.EXE
        
        "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\Microsoft Office\root\Office16\1033\ClientARMRefer_eula.txt
        5⤵
        
        PID:3408
    - - C:\Windows\system32\NOTEPAD.EXE
        
        "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\Microsoft Office\root\Office16\1033\OutlookAddrNaiveBayesCommandRanker.txt
        5⤵
        
        PID:3164
    - - C:\Program Files (x86)\Windows Media Player\wmplayer.exe
        
        "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Open "C:\Program Files\Microsoft Office\root\Office16\MEDIA\HAMMER.WAV"
        5⤵
        
        PID:2408
      - C:\Windows\SysWOW64\unregmp2.exe
        
        "C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon
        6⤵
        
        PID:4120
        
        C:\Windows\system32\unregmp2.exe
        
        "C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT
        7⤵
        
        PID:5524
    - - C:\Program Files (x86)\Windows Media Player\wmplayer.exe
        
        "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Open "C:\Program Files\Microsoft Office\root\Office16\MEDIA\SUCTION.WAV"
        5⤵
        
        PID:4844
    - - C:\Program Files (x86)\Windows Media Player\wmplayer.exe
        
        "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Open "C:\Program Files\Microsoft Office\root\Office16\MEDIA\VOLTAGE.WAV"
        5⤵
        
        PID:6012
    - - C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE
        
        "C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE"
        5⤵
        
        PID:5404
    - - C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE
        
        "C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE"
        5⤵
        
        PID:1160
    - - C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE
        
        "C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE"
        5⤵
        
        PID:5284
    - - C:\Windows\hh.exe
        
        "C:\Windows\hh.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\Office Setup Controller\Office.en-us\PSS10R.CHM
        5⤵
        
        PID:3308
    - - C:\Windows\system32\NOTEPAD.EXE
        
        "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\COMPASS\COMPASS.INF
        5⤵
        
        PID:4476
    - - C:\Windows\system32\NOTEPAD.EXE
        
        "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\QUAD\QUAD.INF
        5⤵
        
        PID:3560
    - - C:\Windows\system32\NOTEPAD.EXE
        
        "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\WATERMAR\WATERMAR.INF
        5⤵
        
        PID:5616
    - - C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe
        
        "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe"
        5⤵
        
        PID:3316
    - - C:\Program Files (x86)\Windows Media Player\wmplayer.exe
        
        "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Open "C:\Program Files\piiiuuu.wav"
        5⤵
        
        PID:5988
    - - C:\Windows\System32\notepad.exe
        
        "C:\Windows\System32\notepad.exe" "C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\de-DE\PackageManagementDscUtilities.strings.psd1"
        5⤵
        
        PID:4780
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Build.bat" "
        5⤵
        Executes a command shell one-liner
        
        PID:4836
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -ExecutionPolicy Bypass -Command "$psakeDir = ([array](dir """C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\vendor\packages\psake.*"""))[-1]; ".$psakeDir\tools\psake.ps1" build.psake.ps1 -ScriptPath "$psakeDir\tools" ; if ($psake.build_success -eq $false) { exit 1 } else { exit 0 }"
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2104
    - - C:\Windows\System32\notepad.exe
        
        "C:\Windows\System32\notepad.exe" "C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Examples\Calculator\Add-Numbers.Tests.ps1"
        5⤵
        
        PID:4904
    - - C:\Windows\System32\notepad.exe
        
        "C:\Windows\System32\notepad.exe" "C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Functions\Assertions\BeLike.ps1"
        5⤵
        
        PID:400
    - - C:\Windows\System32\notepad.exe
        
        "C:\Windows\System32\notepad.exe" "C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Functions\Assertions\BeNullOrEmpty.Tests.ps1"
        5⤵
        
        PID:3584
    - - C:\Windows\System32\notepad.exe
        
        "C:\Windows\System32\notepad.exe" "C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Functions\Assertions\Exist.ps1"
        5⤵
        
        PID:3192
    - - C:\Windows\System32\notepad.exe
        
        "C:\Windows\System32\notepad.exe" "C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Functions\TestResults.Tests.ps1"
        5⤵
        
        PID:5200
    - - C:\Windows\system32\NOTEPAD.EXE
        
        "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Snippets\ShouldNotMatch.snippets.ps1xml
        5⤵
        
        PID:228
    - - C:\Windows\system32\NOTEPAD.EXE
        
        "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\main-cef.css
        5⤵
        
        PID:1996
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\sv-se\ui-strings.js"
        5⤵
        
        PID:3340
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\fr-ma\ui-strings.js"
        5⤵
        
        PID:4840
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\uk-ua\ui-strings.js"
        5⤵
        
        PID:5372
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\it-it\ui-strings.js"
        5⤵
        
        PID:4244
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\pt-br\ui-strings.js"
        5⤵
        
        PID:2592
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\misc\altDekstopCopyPasteHelper.js"
        5⤵
        
        PID:2428
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\eu-es\ui-strings.js"
        5⤵
        
        PID:2840
    - - C:\Windows\system32\NOTEPAD.EXE
        
        "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\css\main.css
        5⤵
        
        PID:3188
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\fi-fi\ui-strings.js"
        5⤵
        
        PID:3896
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\convertpdf-tool-view.js"
        5⤵
        
        PID:404
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\sl-si\ui-strings.js"
        5⤵
        
        PID:1652
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\selector.js"
        5⤵
        
        PID:1348
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\root\ui-strings.js"
        5⤵
        
        PID:520
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\hu-hu\ui-strings.js"
        5⤵
        
        PID:472
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\fi-fi\ui-strings.js"
        5⤵
        
        PID:2552
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\fr-fr\ui-strings.js"
        5⤵
        
        PID:4720
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\hu-hu\ui-strings.js"
        5⤵
        
        PID:1996
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\uk-ua\ui-strings.js"
        5⤵
        
        PID:6044
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\selector.js"
        5⤵
        
        PID:6088
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\es-es\ui-strings.js"
        5⤵
        
        PID:4164
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\ja-jp\ui-strings.js"
        5⤵
        
        PID:5116
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\ui-strings.js"
        5⤵
        
        PID:420
    - - C:\Windows\system32\NOTEPAD.EXE
        
        "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\css\main-selector.css
        5⤵
        
        PID:2644
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\ja-jp\ui-strings.js"
        5⤵
        
        PID:6204
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\nb-no\ui-strings.js"
        5⤵
        
        PID:6292
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\plugin.js"
        5⤵
        
        PID:6316
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\cs-cz\ui-strings.js"
        5⤵
        
        PID:6496
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\tr-tr\ui-strings.js"
        5⤵
        
        PID:6540
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\da-dk\ui-strings.js"
        5⤵
        
        PID:6592
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\he-il\ui-strings.js"
        5⤵
        
        PID:6660
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\ko-kr\ui-strings.js"
        5⤵
        
        PID:6724
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\cs-cz\ui-strings.js"
        5⤵
        
        PID:6832
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\ro-ro\ui-strings.js"
        5⤵
        
        PID:6884
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\nl-nl\ui-strings.js"
        5⤵
        
        PID:7028
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\sv-se\ui-strings.js"
        5⤵
        
        PID:7088
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\root\ui-strings.js"
        5⤵
        
        PID:7116
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\cs-cz\ui-strings.js"
        5⤵
        
        PID:6364
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\de-de\ui-strings.js"
        5⤵
        
        PID:6452
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\sl-si\ui-strings.js"
        5⤵
        
        PID:6628
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\ui-strings.js"
        5⤵
        
        PID:2296
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\plugin.js"
        5⤵
        
        PID:6844
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\ro-ro\ui-strings.js"
        5⤵
        
        PID:6996
    - - C:\Program Files (x86)\Internet Explorer\ielowutil.exe
        
        "C:\Program Files (x86)\Internet Explorer\ielowutil.exe"
        5⤵
        
        PID:7744
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe"
        5⤵
        
        PID:7788
    - - C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe"
        5⤵
        
        PID:8068
    - - C:\Windows\system32\NOTEPAD.EXE
        
        "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\NOTICE.TXT
        5⤵
        
        PID:1072
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8176,i,490903742520604953,4866016144385270137,524288 --field-trial-handle=2244,i,17978417790214316717,18152985991301530635,262144 --variations-seed-version --mojo-platform-channel-handle=8164 /prefetch:8
    3⤵
    PID:4176
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --always-read-main-dll --metrics-shmem-handle=5580,i,11402741151606415607,7951466378283886797,2097152 --field-trial-handle=2244,i,17978417790214316717,18152985991301530635,262144 --variations-seed-version --mojo-platform-channel-handle=6956 /prefetch:1
    3⤵
    PID:2888
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --always-read-main-dll --metrics-shmem-handle=8036,i,15625099428894164336,11908297658295125719,2097152 --field-trial-handle=2244,i,17978417790214316717,18152985991301530635,262144 --variations-seed-version --mojo-platform-channel-handle=7884 /prefetch:1
    3⤵
    PID:1316
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
    3⤵
    PID:1336
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x26c,0x270,0x274,0x268,0x2c4,0x7ffacfa8c188,0x7ffacfa8c194,0x7ffacfa8c1a0
      4⤵
      PID:5312
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1724,i,3617872381401088789,321685682728628641,262144 --field-trial-handle=2932,i,13919965295224435434,1380809281518669762,262144 --variations-seed-version --mojo-platform-channel-handle=2928 /prefetch:2
      4⤵
      PID:4492
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1848,i,3235385937938432178,4010819865460234123,524288 --field-trial-handle=2932,i,13919965295224435434,1380809281518669762,262144 --variations-seed-version --mojo-platform-channel-handle=3108 /prefetch:3
      4⤵
      System Time Discovery
      PID:3348
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2260,i,10255154894664933938,14474587330423062699,524288 --field-trial-handle=2932,i,13919965295224435434,1380809281518669762,262144 --variations-seed-version --mojo-platform-channel-handle=3188 /prefetch:8
      4⤵
      PID:1200
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4116,i,4466232382462105084,9929465231853560863,524288 --field-trial-handle=2932,i,13919965295224435434,1380809281518669762,262144 --variations-seed-version --mojo-platform-channel-handle=2764 /prefetch:8
      4⤵
      PID:6004
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4116,i,4466232382462105084,9929465231853560863,524288 --field-trial-handle=2932,i,13919965295224435434,1380809281518669762,262144 --variations-seed-version --mojo-platform-channel-handle=2764 /prefetch:8
      4⤵
      PID:1668
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4116,i,17215224314756120043,8835065567448523746,524288 --field-trial-handle=2932,i,13919965295224435434,1380809281518669762,262144 --variations-seed-version --mojo-platform-channel-handle=4448 /prefetch:8
      4⤵
      PID:4128
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4452,i,9846154077390143805,11863331063079742965,524288 --field-trial-handle=2932,i,13919965295224435434,1380809281518669762,262144 --variations-seed-version --mojo-platform-channel-handle=4648 /prefetch:8
      4⤵
      PID:4608
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4456,i,4896887494494825312,4805985681528652213,524288 --field-trial-handle=2932,i,13919965295224435434,1380809281518669762,262144 --variations-seed-version --mojo-platform-channel-handle=4684 /prefetch:8
      4⤵
      PID:5124
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4884,i,2757596676640944021,906093087084379719,524288 --field-trial-handle=2932,i,13919965295224435434,1380809281518669762,262144 --variations-seed-version --mojo-platform-channel-handle=4876 /prefetch:8
      4⤵
      PID:5100
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4720,i,6450306000289697374,10333868685890950442,524288 --field-trial-handle=2932,i,13919965295224435434,1380809281518669762,262144 --variations-seed-version --mojo-platform-channel-handle=4912 /prefetch:8
      4⤵
      PID:7400
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4876,i,17711424353728117779,1322701276446793541,262144 --field-trial-handle=2932,i,13919965295224435434,1380809281518669762,262144 --variations-seed-version --mojo-platform-channel-handle=4912 /prefetch:8
      4⤵
      PID:6992
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4008,i,10455223151927348864,6192708621171663337,524288 --field-trial-handle=2932,i,13919965295224435434,1380809281518669762,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:8
      4⤵
      PID:2372

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3948

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3680

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3308

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4756

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1040

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4240

C:\Users\Admin\AppData\Local\Temp\517b2141-92e5-41a4-ade9-eaeac113aff0_Clutt4.0.zip.ff0\Clutt4.exe
"C:\Users\Admin\AppData\Local\Temp\517b2141-92e5-41a4-ade9-eaeac113aff0_Clutt4.0.zip.ff0\Clutt4.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:5264
- C:\Program Files\MBR.exe
  "C:\Program Files\MBR.exe"
  2⤵
  - Writes to the Master Boot Record (MBR)
  - Executes dropped EXE
  PID:5464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/channel/UC9keh4wDjXFyiRhHDE_h90Q
  2⤵
  PID:4452
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://www.youtube.com/channel/UC9keh4wDjXFyiRhHDE_h90Q
    3⤵
    PID:4472
- C:\Program Files\media_snd.exe
  "C:\Program Files\media_snd.exe"
  2⤵
  - Executes dropped EXE
  PID:4168
- C:\Program Files\media_snd.exe
  "C:\Program Files\media_snd.exe"
  2⤵
  PID:4920

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x30c 0x16c
1⤵
PID:2132

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /7
1⤵
PID:2448

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4836

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4264

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4640

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:460

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4400

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2824

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:1512

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:5868

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:5820

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:5380

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:5564

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:2188

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:1992

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:2536

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:3512

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3432

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:4404

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:4948

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:2240

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:3852

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:1980

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:5000

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:732

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:2736

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:1840

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:1356

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:3512

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:4416

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:4028

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:2680

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:1424

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:4504

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:4780

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:5516

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:4248

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:4516

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:3484

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:2552

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:1468

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:3368

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s upnphost
1⤵
PID:2084

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:1860

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:472

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:2644

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:460

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:1392

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:3804

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:2320

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:228

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:3192

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:5344

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:4724

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:1192

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:3444

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:6044

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:2344

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:2588

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:4780

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:4276

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:1812

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:4164

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:4196

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:4868

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:4512

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:4896

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:6192

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:6360

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:6480

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:7512

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:7852

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:7596

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:2188

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:7140

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:7420

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:7756

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:7836

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:7212

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:6404

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:6512

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:7564

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:6400

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:2188

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:7728

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:700

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:2156

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:2324

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:8132

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:4640

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:1056

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:6304

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:7336

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:1812

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:2536

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:6556

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:6424

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:3852

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:7708

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:7628

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:7648

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:6192

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:5344

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:7372

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MBR.exe

Path C:\Program Files\MBR.exe
Size 126KB
SHA256 0c35c0023106f749a65ed182d37bc37382ae342b0bc53ec69aa1f0b9a493a1c4
MD5 51a3dbf64b4f075e07999cea68e1c7f7
SHA1 4037e0784b77e35c64beb7a1031af128dc564202
SHA512 d4b56e23de37af8cba151f2705eb973b1ae4184c0db7064b4b73f0c5a6787e854aa1d5740047ff11bb17f2749c09d4fd12c8839d469787e7f10b2ce5c0d0f928
SSDEEP 3072:Aobe04E85xqoH7x2HJb9EIbe2WYC3WVmW0QLTKfJKqY:AoT582oH7x2pb6Ibe2WYC3WVmW0QLGfp
TLSH
T123C3B7960BA8CE47E3904978A0E4E3BE56BB2EBC9D6B0101F9F67CDFF564B056C11160
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

media_snd.exe

Path C:\Program Files\media_snd.exe
Size 8KB
SHA256 1c34d243b7ce7346157ccd2db383a4275d005c4bf94433e648319d1d99dd1060
MD5 e1e740107963b4d48be8386ea028691a
SHA1 36cf88943c72ba4d8ca33a47a7a3f2828e5d2f1b
SHA512 085794609af243197074e6efb1e968b0817544e6c6a6e71ab6fab6ed265ab4e33725aad9818b135c4f10bf3ef6ad8f63541c511946d5d27986fc81344da395fe
SSDEEP 96:dXP5tTmEqC5oH8TDDm9fg8zg+tkUkZ/aa1LKizL3pEfmku2NzNt:pr7q8y1fggkDLLSfmpi
TLSH
T16E02CA25F3D8C637D9BB0F7658A663401375F7548817EAAE6D8C100BAF1330489A2FA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9e9b606cfbfc7b0fcbfab1ff9a90d94ddcf0c4033903cc47f13cbcd8bcac95cc
MD5 66bd1dbef8b4df50e7a09a2d2848fb79
SHA1 69983a576369225e69f3c4e38eef011e7e436249
SHA512 7f8546014287d3ced2b59766b273c8d8981aee3ef643630332615e594a89f92a95f1ce112c2fa889b0e249a10643792bfc57043bfc523d6ada97b8bc7d6e7d6c
TLSH
T17CD080776B0BF411E35D5131D503C75127BE507179625723F158C41D99B41D697C51C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 35cc5409a0e92c7b1f173401d1114c9d5fdc977752a8e45ce9068d8101c9a651
MD5 4177a98ec95c7b8511089a1be66e9e7b
SHA1 523d632928047252508b7d45169327ef4523179e
SHA512 d9e67625f1cfcaf9b90149a3ed0ce8899f43e93e14c729f7cf114adedf8a6a345c93240cebfa58351038924578a437d9d7144c7dcd826b1b8892dc523920e947
TLSH
T17AD08077670FF411E36D5131D503C75117AE547179625723F118C40D99741D693C51C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 604f2b08c352d2054515105fa8752c7c4641fa2a3dec9504a19689d22139f892
MD5 5d42d0843e9db69a0f52fc9e765991a1
SHA1 b03ac141b107b9f8a15dca26fdfc9eac3dccd045
SHA512 7686192d80e74fb6e26b538662bf60f088cde7af69836166bbba7f6406dd95ad4200c323a192dca47e2af839c5fd6390dbc43fa70b32370e887449a378c6c8a5
TLSH
T199D0232459ADF9F0E13E103D4210031133CC05927B232217F010400ECC3418383C44C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 03968280b00da46b468b462b0a6acfa98c7aa1f1e7a556f99962763d229433fa
MD5 3606d8bc56c0e95819932af87a3c56aa
SHA1 244b4ab297f57151cc4f690e15bf9c9b65512d36
SHA512 b994a4a6ee22aa9e1f2a5658507beba6cc9355b263ebd9cc040246eccf068aa54a25af8cd7f242ed1df7e0735d5d05078646e8abbc2baba06c9870173aad8ad7
TLSH
T1AED02394B30CF930F22B10384A00073633EE86007D236137F054004D0C24D0383C40C1
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 fbf6b19295bb27c4da26ebca50e52c96bda97bcde2eb79ca9ca87d85572902f5
MD5 0e2d335f14eb7f11e33d5d0546679e85
SHA1 df378bf38266eef257214736855c3553be0efe54
SHA512 b0eb811c96c67ecef6630e7d2ce12fceff6b0ea0cfbba855d8e271d41434812efbcb16fbc2b3c77adc6cb85dfe0c502d8424a10b0d510fe6d8e3541266c974d4
TLSH
T182E0E5EDCD21EC2758FC172C68691647E60413262A81491F3A3D55098FB273B568AC9C
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 9KB
SHA256 96b08966ccff1ef32d83145b28c4738a244208d7d8616415a4cc4c2964de084c
MD5 20b5b101df7fe6a7b32580be9ba3d49a
SHA1 e710958eff24112c59a4958c4908d4546507b13d
SHA512 4026e0a6511d0cd10e1f2fb58cc4f54d5009b90c7db417913fe8df0f0fb7c0113033da9a6aa7fb63368f54fc4f7d3a58a3ec8d21d42d4899c6a534787b612db9
SSDEEP 192:NlqRw/SXeUlFgD9b3l8OsGe0v0xaz6Ti+cPO/z6STYd:P1iiDf8O90xaSqPO/z65d
TLSH
T148125EDDC6A3A2CDEB58C4F8BEE0494B317206F48C5F6FB64294D6B57632B9A45E00C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 9KB
SHA256 4f04028b2f999a145d04e6ede301350292ebbdf9d1ce5907d0ebba0c7b40ed37
MD5 e31ebad05d883485c413c11ba3b660a4
SHA1 8a469e04059022580a77dad1d2ac99464b5bf7fc
SHA512 593338f0e6d55cd7c9304ae67706f37d2b16c1fe80550ceccb4c73c74482b885ddc40f55bbea00691abc06cd2ae1256e199d162676db96cde1e63060b8aed314
SSDEEP 192:wlqLD/SXeUltgQy9b3l8OsG20v0xoz6Ti+EPr/z6STYg:0EiqTf8O9sxoS+Pr/z65g
TLSH
T101225FDDC2A3A2DDEB58C0F87EE0494B307206F48C5F6FB64294D6B57A32B9A45E00C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe593e28.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe593e28.TMP
Size 3KB
SHA256 dc1ef63c91d0d2337c0c7b07503e35a0a5b172ee69ff911332d30dafd123a93f
MD5 5f85cdef90f2ae4fdd7f3c16113e72ca
SHA1 5737b1db379abb519b4910f797b5e01a308aac77
SHA512 e0dca989a8ba544a079ad6b91ec6a6b82f871640d09540b54ada2e4a4f342f0ad99d95a0901a796ea45a5e667bf106a00f6d5d63680334f2b0815d583a969262
TLSH
T17B71F8EA01D2CBD2EB58C57DB7C1010A317683B8CD2BBF6A05E0A9F5363976248F01C9
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 a42146a803b96ed36d6dddfa23e8f200041e8937f7ae5ddb23e3cb4ee215e8e9
MD5 df6efed181ab4dcae4db739cc8757565
SHA1 baac4f29ccf63c72d50c9161ece47b8ffa3f94c8
SHA512 a45d3ba7c875c2c09ac1e51703ea46e70a67307b91361ba717cdabc688931e330200158d82d5e9119915069f00bd575d335df6c131131f930a7165f883c259bf
SSDEEP 3:MsEllllkEthXllkl2zEshKlt:/M/xT02zzhKX
TLSH
T1BB440405FFC00455C50014334011C3500370F5100535DF43347D44135CC5D5D1C40134
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 9KB
SHA256 8e6756aaf4247732bad06a7662d346592f6bc084a4306a870da758811953d23b
MD5 2f7fae049f4627b7737f6d190c279456
SHA1 846bef7f201c138d57df4618a2cb34def42943d8
SHA512 e57f19a29b1084b17adf732af24fc1d261c5e0fcabbbf7e6628515113e787a5189c93a696ecd0137fd2df1f7e132701864b264b565768099e40a131be3b99f8b
SSDEEP 192:D1VvrBbeLmrdBxPaaij6R175HLZGTztTzPim6vmMTmBXXtJ/5KtQmCmDiBmzmgmk:D1VvrBbeLmrdBxPaaiGR175HLZGTztTQ
TLSH
T1CD12BCF783E5822DD91156F0AA187E1FCE2D0961836C3C6AC4E4AF5B93F2471E141B9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 d42bd66dab9b8db163d206006abdc11ab43876d0aa1d32b079710f7dbf172fd5
MD5 e7036a4155f147ba54eccc7606b39934
SHA1 0f214cf9855b60641540a79b1427a8d49c8d991f
SHA512 055b4f30fe8a9acaab582960f8b75c51301e3ae4bd73a14d6aacc9bc5c859b5867dcb9d4239691d930a42ecf697de948a8562915874d875d1f852486ee24a2c0
SSDEEP 192:D1VvrBbeLmPaaij6R175HLZGTztTzPim6vmXxTmBkmCmDmtiBmgme:D1VvrBbeLmPaaiGR175HLZGTztTzPimC
TLSH
T106E1BCF783F6862DDA1195F0AA18AE1BCE2C0551836C3C5A84E4AF5BD3F2471E141B9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 209B
SHA256 18d271162b68a778907d7f4757040a1c5b47a61433aa7d892c8e95cf640142c5
MD5 c32feb18fa50f1996778403c07041285
SHA1 3c812de7da9d0abb402fd01f7f660ee7d54901ce
SHA512 f6cfa00081ea602ab2f85fcc08d244f486836bdfd5ed16b90b99db6f54f78db3b7c1a7da4a2dbc48d749f5985f87b17c2f556bd9ef68eca48dabbdc86b2333d9
TLSH
T1CBD02223174070F6A96C7E8594EAEC9FC72600684883DDD510D099A9153686D951B182
MD5 SHA1 SHA512 TLSH

Submit Download

fa4cfacc-8a05-4727-bb97-b08ef5564850.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\fa4cfacc-8a05-4727-bb97-b08ef5564850.tmp
Size 8KB
SHA256 5b22b09dcfaefa860601aef93ee439b8b35ced3817770ea0bffdfa60ffa3b24f
MD5 e02c3990a5cc28d7a16afe8a1f446347
SHA1 3e73a9ddec22b810bccc05f92f2c00ace9d4a327
SHA512 c82c11a53123d10a4382824b32ab8ce6ca7851635fb6730772c75532c316132adf1b4e45a210c26627b84fa44fc18655937f5f445ceb385d6dfa73acdd9a6d08
SSDEEP 192:D1Va0K1mrm5dBxPaaij6R175Hc/GTttjzPimxvmMTmmXtJ/5lQmDiBmDmtmgmzGT:D1Va0K1mrm5dBxPaaiGR175Hc/GTttjC
TLSH
T1E5029CF783F5822DDA1195F0EA18BE1FCE2C0561836C396A85E4AE1793F2471E141B9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 23KB
SHA256 f2c0a9f2e4426eb7101bff6b03108a72126f3c12ed9f847853d70049d3fc8b29
MD5 2fdd7b0e263e1234563e16638c495dad
SHA1 561bbe4683c38ad6c52b98fa3189547b0f850e05
SHA512 0664acdf54ece9d956b7d4321ded77296a3f97f36c683a8587a4783d94a0b6363e5e44533bd97ee13a26789c9dd9cd3cfb8d24b13f85cbdae1e1d4a1a6d26248
SSDEEP 384:sxZfpqmmWJ/fBsaWvjz1IpsxlHbjKtvy//mTLOrlGOOl3:s3wmmWJ/f3YjznHbh4Ckl3
TLSH
T128B2D752A5248977CDDBC519F961BF63D7B81423DA908E48ADFCCA1C04EB6EC6203C5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 21KB
SHA256 169ccb8242050879dafefd78540a611eda27f3a81a9aff8171ec44458bc83f1c
MD5 5cd482c2b6e618eeeb143a70c416dafe
SHA1 6e04495437602b74e3fed34f6e96def5fc6b6ca8
SHA512 10d0df3a73e20d4ae266db52c60c1077cc95df323c13b23f82bdf8dd126a1995110f1758e166b6befe96ad8b41b8cf89d407bd891e5fcaa53657c38d55679d69
SSDEEP 384:sxZfpqnmWJ/fBsjz1WpsqHbgvvy//mpNNlGOOl3:s3wnmWJ/fazsHbdQkl3
TLSH
T11BA2E656A924897BCDDBC509B9617F53E7F81423D9904E48ADFCCA1C04DBAEC2207C6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 19KB
SHA256 5d8a7b0394095a5c660418baaa63a1872822a29aea282c507438e11f720ef9c0
MD5 7756f2095fd95711c613d4d84239c9b2
SHA1 6c26a5680bcf0ebe2d770136cfab7faae4d9581d
SHA512 d2e2e10cdacbffc0a8d3011575dc2e91f138a6c92bf7517d878e0214038083ad0a59e4672cde5dc6883228e94da155c376ea4c970cc1a2a1b8a2fc613c6f85a9
SSDEEP 384:sxZfpsmzJ/fBsjV1WpsqHb2vy//rqF+dGOOl3:s3umzJ/faVsHbR+Ykl3
TLSH
T1F392F75666248977CDDBC609B9657F53D7F81423DA914E4CA9FCCA0C04DB6EC2207C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 409f5080475352ae3a032a66fc05484f349f83cac7c647ea6bd0bbcda98212ab
MD5 94f1e42bc6a5bf0d2cdfab54513d9d71
SHA1 f55ddc0d02670ae384e4ca886c0bb546d87f2289
SHA512 7b0f7dd4810372f8e234273e38531fdf5ba78878c84166922219039cf7d9317caac07e9abb73ff35dfa8ddc4d0ffff8e7df1443ba2cb40834475ff500bfddf32
SSDEEP 192:sxZ2RkyMqZjK1Ml8MWOJ/fBsy2uo43wgBRbPlodp4zHW6+WNBJe/YXwraxDEIgjZ:sxZ2puOJ/fBsyV1Rp6CHbi/nFjZ
TLSH
T1E672F806AA24593BCDDBD219F9457B93D7F85463D2908E48A9FCCA0C04E7ADD2217C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 21KB
SHA256 9fe742e3ebfdc2400d0800a8557f5d3056971cac550cf9fd955cc7bccb5987f4
MD5 4cf19a3eb0112349f315376fe7adb5a6
SHA1 03de13891f553986cdeb6f33d8fa9c05331856ba
SHA512 352e18346ea8289a4408ca1716286d8784cc0f25905640bfebed99fbd8d315a9a6a3e4ceaf0bc6372b402f19c5c726e33e9a8c10e17c21a9cbbdec9d3d6764d8
SSDEEP 384:sxZfpqpmWJ/fBsjz1GpsqHbffvy//mnkNlGOOl3:s3wpmWJ/fazkHbaXkl3
TLSH
T1D5A2F756A924897BCDDBC509B9617F53E7F81423DA814E48ADFCCA1C04DB6EC2207C6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 4f1d4a0f187ce9717a26850537e747983ac61c908aee76b4550631d83901d7fa
MD5 3a4023935edc1ad6dfea488e72b114bf
SHA1 4c13ce6249ccfe9a57502a03077b1b3bf480fd06
SHA512 b82716b695ae3fd31ca1d3ecb38d20f3fc7710ba946e851c2f82462f163e0dff1d74efbb53fbae5077629009a4cc6fbf49193f1a348615fce77f3e61e6441f65
SSDEEP 768:/Zk4Pfe7pLuLnXDWvXt4h8F1+UoAYDCx9Tuqh0VfUC9xbog/OV6eHiLl42vJ4roP:/Zk4PfeEnXDWvXt4hu1jajeHiL+QJDWA
TLSH
T1D9F2FA3B680CCB7E4F804E9CEC2ABE9A6EE8018F5698CD5447FA444C03C76EB51165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\64d35e3d-c11a-4565-9675-8f69df0b3009\index-dir\the-real-index
Size 72B
SHA256 1164768abd595ffd5af050d3f0c9ae930ad44cb3c45740cc4a3c4d66920c0525
MD5 f8c3de8d28b450939ee106dc91b839d5
SHA1 ee1c0011eb58295869280708205552536aea620b
SHA512 4866a705155538b10dea5b3e7bbe4e852c3af9cb2a24c32b509dc90bacdc08190f9a82e00c872d17820dcf43d7d5980b0d218c475423031b934ad276f3cb99bc
TLSH
T1C3A0025043E5C086C46611F59D9242C13350C8A0150813174099004ACCA44806DC100F
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\64d35e3d-c11a-4565-9675-8f69df0b3009\index-dir\the-real-index
Size 72B
SHA256 67df07a2deb3557e6a1049bf3cd8b9e4bd50fb523e1400b0fac09ff4208c512a
MD5 25a6c93ce1404dc3e1de93339a05bece
SHA1 d137a58e773a8369f621f6e0d20b47a9bc28a149
SHA512 05c6259bbc8c06a12b3038538aa729df9ba71f8470600d95a81333baa55a8baba05b2cc929f5d5f981c19e320aa1f5ecbbbb1938bd4cc30aeaef4444c296c567
TLSH
T124A0021403866441C74327B1299601526719CB148315130785A28244CDD06674D4374E
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\99755d9e-864c-41e7-ab4d-7cb31e17682c\index-dir\temp-index
Size 3KB
SHA256 4621004142aed2e193207d2165997e9279b6c40eef5f07d299de145ad18a9c7b
MD5 f0d3cf5e3bb1692144af7bb05d70d44d
SHA1 b57b7505d29b0900488c5f45453383c5db44491a
SHA512 c457f31dc7a3ae745bcd080b1c2d7c3fdb0c82c34e48f4cc57b8faf51ce8629630533cf2c9b05b7aaf90641c643982ca538890ac685dc5b3b67da6873adfa5dc
TLSH
T15A51C70E4D531B6ADDAC227224B50495373869CC13A4291BA1FE923DF8C372C5CD9AA8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\99755d9e-864c-41e7-ab4d-7cb31e17682c\index-dir\the-real-index
Size 2KB
SHA256 3d351a8e68261ccebc6fbc1facc50ffedd10b7c956c98a181028dfbaf11531c1
MD5 4e1f52055674f7fce7077ba2acb273de
SHA1 d8f5651b86c942b242b7389a585b3dbd11f9fcb3
SHA512 536beed931f8f24fa6134846b887e6f5128e64042d7954398bb1b6fe2dd210d7f95693bf6ad2f8d37362cd67f76f99cb858e32ee5304a18603f077aeb7156b15
TLSH
T11C41C88E0D50966FD9B845B30472A0D03B70DCCD1B5596239CBC223AB84736D285B7EC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58a96a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\99755d9e-864c-41e7-ab4d-7cb31e17682c\index-dir\the-real-index~RFe58a96a.TMP
Size 2KB
SHA256 8eb81c392dc29025182f78b42acea8dec4b3adf8cdf61b63bd1586e25529bf44
MD5 71199387294e92ee04d3af6d709af2c0
SHA1 73191bf066a15fc21dd9760c53e51c40b908f58f
SHA512 0fd8a89866c062a34417a29210986ee32c9496dc6b28097e1ca85eb128e078e295fc85302574953e041ffe43ae105f807cd1ac3ccf37ee437ef553531c08f7eb
TLSH
T18341A79A4E42862FD8A440B309D264B43379984087157B4778FC923678E67BD2D5A1D9
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 02652c319d0c4019d89e3667afac3c974069f59a5ebc5293b403a27c2974375c
MD5 6b0550a06a3eb3de792c101af91e9d3a
SHA1 22ba79e2061c11788c2d79a5fb639d8e9d0d337d
SHA512 250aea9a953b4178b54809ff7878852d67d625a0661c1b4c9996cc968975984b1bd9b80fc84a2fed6c253b1e4fdf6158e78b670dba5cb5ebfcc2a202ff73ab3c
TLSH
T10BE020F72DE71D10AD7FC7D1347264610A1179A98904AD4F542E92C7B0A57192816C73
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 7b3c8b8af4df2a51006e3ef3d3dbc6288ed9de166d390bcddb815d0629371e4a
MD5 7ae79c98e30bd79d92bf740558e5c05a
SHA1 0b760a30b9d51d2fd9c1408541d4fec44575bd15
SHA512 a99932e5cbc4b80101d81b5213e8c9ea9fc2952b72128c9cae1e341acea7fb69ffaacf359fef20218161d6a8e38440ccb001339542178ecd581d562237714d35
TLSH
T1ABA002128967858DC000537494764A947314A89906093251D1ECE258D85515491A2445
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58feae.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58feae.TMP
Size 48B
SHA256 186b5661dc4d14b551dc004884bd1508beac20443d02e82535383480e3b5e028
MD5 846db7ddc02e77f80e9e9b5a2b7da38c
SHA1 6e3016b403d4a32e5005d942244be03bb08a4afc
SHA512 b7dbe46e4d4dc256ed225153d4c0c360ce1b6060db1bf3359e801bbd0953be191d6e2d75a215a510ffe303138b816475f11358ce61cf30d601cbc097c1cfbf09
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 3a226e17158049ac0110667ed6bb799ebed447db69695b88774c502536cdb311
MD5 e87d609c3126cc6855836c168dd79f71
SHA1 b0f79017e23d470dc0c937d6ab04922e579802df
SHA512 fdaa1109c91cd55e65c39b1fd14216009b64fb3a54d7d7d865752011e72daf6df293067705b3b9b0d4e2db2b4ace7fd3731e129bd5fa6bffe875f61a1e33d1dd
SSDEEP 192:EtjGz7Y1/St59NZp1ZVzDqHgnmz3th9AZkzPr1PVIfPU1kHPF:EJGnYNSv9PpHV/qj+vF
TLSH
T168B23B13313A03423CBE2909A2A696779E4231B3301DE67F77A904664E67E225DFDDCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

domain_actions.dll

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Domain Actions\3.0.0.20\domain_actions.dll
Size 82KB
SHA256 e5c9378b540360fb4ab0b16bf40ed18bd99cf4a8a5a6923f4f240d373fb441cb
MD5 aeb538c29f46cf0e19827ce47594488b
SHA1 db32b33a5811c303b1e37e1ab956df20ba44b355
SHA512 38488a42e5c532442a65fd4edab683f1f63eea71bae3ba2f801693647f633af9d836171dc751b342dc2e0e7784266eb9a40f677c0d3c9f651e7374f1af707852
SSDEEP 1536:NocewxXknaFpdgxBf8paY3JQzQik428fKagFVbydki806yav7Sz:NZvx3bgrfrPza428fIe76yaDS
TLSH
T1F783F1C0DA6C0117EE6B4D75D17959CA6BB9D6B50BA0B3EB2372845A0E02FC5EF36700
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 d52465cf5e56b3aa7ffc72a643aa2945fc6b390d301e7550cff686b95da9af80
MD5 28a3636423b60c066899ea4730e851f6
SHA1 fcc6ba3df3e6f5fb584842d97485a56d0b93a0b6
SHA512 504c082d5612f295d45ca386beadb7844fc37eecd71f3744aa65cd1d0980bf80de2c6b23139ba313349383eafb01426ddbdc2fb4a062c1b06fdd47e7fa555103
SSDEEP 768:vFTOgAwgw1ekIHH2s1JqI5sqhIQ954kA07TRuue:FOghe1Jr3hfO107TRuue
TLSH
T1D0036DF99CD6983AD8AE6B4B577D2E2299BCD173B5A84584F3840F0CCC2257FE306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 e970b856304ebecf1ba5572513d09663cc8f9812f34ee861df13bbd1ed30933e
MD5 b90d972e7569882c828b857e2b5bc5c3
SHA1 52bc9b1fb709a8b8bfc57defb4505f5f85a53c80
SHA512 deebb6507280502273e60dc57cde1b39c5c588c875357c3eacaec1a244bdf84ca999fe89f3606d08a40b9ce7269a989a57d2682352945cb050df1381a0ffc6e9
SSDEEP 768:BFTOgAwgwmekIgH2s1JqvvPKu2lqTRu1k:TOgh+1JCPKnlqTRu1k
TLSH
T165F2B1F598D7893BE8AE5B4B677D2E1299BCC063B5984984F3D80E1CCC561BFD306806
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 c517f163325b297e5bac685957fe80c8016dc04343253bbd53f4dd13872bbc79
MD5 0c336ead83fd43dfa632cb4a471160f4
SHA1 6f6f61f961e87223cc35b639e8d5b05ab5147543
SHA512 8c77cf32aafedf8c8861b3671b087e78cec00ccc1c527d42fc4879606a74c524a81c50154c5f115409329a7a1301b60b43c5b30dcc852107ddfdb313b1a0ce99
SSDEEP 384:nriFNZcIS3sNz8TUNTUlI4AOTpoNm+gJT2yifgVs5nX59YVIxXuWQWM7O6R2FeoT:GFVS3UwgwFT/Vs1JqI5tQWM7TRuue
TLSH
T157C24B72DCA8DDB7ADFB8AC9A74A7A03EEF04193868C5AD4D9DC5D1D008B59D030BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 d60151b343fad796b4ac22acc8d6755c7eda44fce25e38ff6549d6c0b6e82b44
MD5 af0cde5b1981a5be8cdb870c48309fbc
SHA1 65385cf34a6c05cc12fa5dc470d4ddac8855baf4
SHA512 469aeac121928464f67f647620c50a7a4dfa8149f5c27be3494bda9729db802a7b00784ff8bacc5063b7762cb1f7801b46b3037d9aed40fb6961dcb0d28daaf7
SSDEEP 384:nriFPZcIl3sNz8TUNTUlI4AOTpoNmXgJT2yifgVs5nX59YVIxXuWQqM7O6R2FeoT:GFHl3Uwgw0T/Vs1JqI5tQqM7TRuue
TLSH
T13AC24B72DCA8DDB7BDEB8AC9A74A3A13EEF04193868C5AD4D9DC5D1D008B59D030BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 e63beb1906243c7d29467bfdd3b81d5d405be785b20ed91dbbbdbbec5acab651
MD5 fb394461dbd749c82162b547e0e8f1d7
SHA1 803e0286f68e2141cfcf3dd2c6c69309c473f582
SHA512 58d0b6f47be248888c3766588d8268e6e5b032142876c9577b480e02664eb7911d18aa17af2b1fa26ac650391a930abc784db779027d68ebe73a8453f6af498e
SSDEEP 384:nUiFPZcI53sNz8TUNTUlI4AOTpoNmvgJT2yifgVs5nX59YVIxXuFM7O6R2FeovhJ:vFH53UwgwgT/Vs1JqI5SM7TRuue
TLSH
T121C24B72DCA8DDB7ADEB8AC9A74A3A13EEF04193868C5AD4D9DC5D1D008B59D030BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 b8456b093d51fbee7864903d16d6fb39572b58ccfe69efffbeaa861fd147bd40
MD5 2c0ea9a6b2001b7168bb505892688e90
SHA1 783a84aa07608135eebdb897462b695a7ff50c35
SHA512 cc7d6691794552eb1f32d6a217f7e87acbc4ab9c504458ff849e7ec74bbd26069898786d73be64c702cd8712d7a984bc64641fc9853ba2b17e9d339adb51c359
SSDEEP 384:nUiFyZcIr3sNLA8TUNTUlI4AOTpoNmJggekIPT2y8fgVs5nX59YVIxXuaSM7O6RA:vFAr3gAwgwZekIPTlVs1JqI5AM7TRuue
TLSH
T1F8E2B3F198D79977E8AE4787A77D2E029AFCC153B5885980B7D84D1DCC861BFC30A806
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 a9780f4c2cdad658dfff85793f9bd8c7200111149f93f1d0758d20748459d9fa
MD5 0089a33a1fa19eb27ec225952e8db51a
SHA1 26404cf6cc29579ed2f58efce3756337f7a9ed1e
SHA512 e9c631ad9a0ec2bdf15132f183c7d560d1b7f41624d0f5a8ed3b8391cd2fce8a9a08ba73e541c74879bc6f1b202698e8f2e148dd1f566bbab84f27e037883837
SSDEEP 384:nUiFXZcIb3sNLA8TUNTUlI4AOTpoNmKggekINT2ykf8BVs5nX59YVIxXua9M7O6q:vFfb3gAwgwYekINTTVs1JqI53M7TRuue
TLSH
T123E2C3F298D79977E8AE4787A73D2E0299FCC153B5885980B7D84D1DCC861BFC30A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 5a188f17f4f108b44f1a73e79fdd0a59f8937924fe5266d277a25f5e9725624b
MD5 f2cd2707663629d2004ce01d327c7f7c
SHA1 a3e7fee7df62113e93902944e673fe45740d6d39
SHA512 e315b96dee3d5f6df5abb13b7588d4b79a242fb8b31437a767a82a8e6b943e4fbb94c7e37b815bbe6ff170740202d4fb9b6d1da8e151c7c9fc86a83f38529db4
SSDEEP 768:mpFccps3MwglqWVs1Jq/Q1vhkoFYS/dVI:mds3Ai1JmQxhkoaB
TLSH
T1C2B25B35EC98D9BBEDE64FCAEB4E7A07EEE012A3859859D4DAD81D1C00CB19D1307C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 48af03ee25b949f2303987ed8feaa96297b5c46309e756b389523b5acffacaa4
MD5 80fbb445d51382303729a7d8d4e9af47
SHA1 b852ecde04307e14c8a4be6b291f8c44eb0120bd
SHA512 6f81119b0c0f6eae9a1950c32e11c226e705e111fd8a2a5820c367a72316567dbcdec4de2343b836494a557cce3806b65d3ef8e76b1d3edc2dbfb4f155640bcf
SSDEEP 384:n5iF9CcmyWCZ3sNz8TUNTUlI4ksTpoNmP9yyifgVs5nX59YVIxXuWQWMXQVHy/7k:QFccpZ3UwgK/LVs1JqI5tQWMXDW
TLSH
T15BB23B32ECA8D9B7EDE64BC9F74A3A03DEE05263868C5AD4D9DD5D1C008B19D530BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 3d82544e52c046ea728c78b08c384cbde0a175f7574cafa9f8b572544ab02bcc
MD5 5c9ebca7b7320faf173f20034e2dc89a
SHA1 9e6f59f9964c9034fc4c866e81fea660684ef483
SHA512 a00501312b31d7e25828694a360926faee350f0234cbe575cc7317bf0e138e0590739bb43d135c00a83fed0e2e4338245c0fa25fc0a7747c447e6768cc4b3422
SSDEEP 384:n5iFiZcIL3sNz8TUNTUlI4kOTpoNmTgCyyifgVs5nX59YVIxXuWQWM7O6R2Feovb:QFQL3UwgkzLVs1JqI5tQWM7TRuue
TLSH
T13DC24B72D8A8DDB7BDFB8AC9A74A7A03EEF04193868C5AD4D9DC5D1D008B59D030BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 c3686a8279cc6fee376576883ff1efe698d9350eaf809047a7486e41817c97a5
MD5 c98ddbc4201f586e43f09252b469c5bb
SHA1 8879f6b314558f09a026f5934b573fe7acea85af
SHA512 689742ad419f7c7930e11be29f20e09e025cdb2d94df9fe0223d4dec8ad220416c1043cc7976c25d973935baccc94de7202dce18c40a86cfe6e5e273c7cfbe69
SSDEEP 384:nUiFcZcIF3sNLA8TUNTUlI4AOTpoNmyggekINT2ykf8BVs5nX59YVIxXuatM7O6q:vFKF3gAwgwwekINTTVs1JqI5jM7TRuue
TLSH
T125E2C3F298D79977E8AE4787A73D2E0299FCC153B5885980B7D84D1CCC861BFC30A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 0ebbb060a95fb83d64cee51d953d135123f5f0b20ccd2d64b995edc156acfd97
MD5 6e8f0d05a1222f1f960c8775593c5c7a
SHA1 176d183330ea90e42027e95bf945bd00f1d53305
SHA512 ed0af26a161bc764b7e500f883b94afa3333fd9decdae59a636eea0d53ae120cc9467458425b73ad80a7f6b356ce23db894efb375fdc4961498682299152977b
SSDEEP 768:+Fccps3kwglM6Vs1JqI5tQ6MhkoFYS/dVI:6s3Iw1JrXQthkoaB
TLSH
T198C25C32EC98D96BECE64BD9E74E3A43DEE04263868C9AD4DAD91D1D00CB19D530BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 b1d5df2b93580a4b6681c415ba6df22a144fc1caead4dab5c2a98848c011f62e
MD5 11df638a3112d49871348dbb1d3b8077
SHA1 99cf812d999e2ad26a3eb88e930c00b7c3f882f0
SHA512 d2af7cbe18aef2115fe769d3a2d011be7006cd475dd0c2902aea0fe0fac68bbdad72bcb326b50d50a5d77d0bd3bf1a5dd7b8e2fdda2a42875b37b0dc10f724d8
SSDEEP 384:nUiFsZcI03sNLA8TUNTUlI4AOTpoNmOggekINT2ykf8B2s5nX59YVIxXuazM7O6q:vF603gAwgw4ekINTT2s1JqI5dM7TRuue
TLSH
T1E2E2B3F198E79977E8AE4787A77D2E0299FCC153B5885980B7D84D1CCC861BFC30A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 bce4c7af39aabcc8ae795cc94a5f7cb3d14a5b48321c8de569f9f40184cecf4c
MD5 a63b9d6d57e11379a04996fc4b4f24e3
SHA1 74da584819397db7b8b675cbf2ed1ccb872fe815
SHA512 5ebd2549b1be26d05d662861a682429096abb881b6f5ea8373706ea0db8bec078cdebe72d4fcefda246a938fd136881f513f7485335f4ef1a2150be0aa7ac2b7
TLSH
T127E00212A31001E6C0354371018317702AE2913057B7024A5E2205587C227646F71FC0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 74b40da2a84739fbcfb17478b5f1941bb43665d9455ea89f5f8950a7f368a807
MD5 e4ed0a73c713d89e2dbb6dbc5344bb70
SHA1 bfba98be88141a009458aab41b46d29553dd505c
SHA512 6cbab82c83a22bbcab146b1ebaec085d6b679ed9b167c98e6a0e470f93c14af9b985471cae157aed90299b4fdfedb94976fa43eb5586c1ecac66df986e43eced
TLSH
T133E00106935002BDC03C43710143273417E3C42069F20347991112846C122105F35F94
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 37bf4268c8303d91428d0c15aa17f342786ea632afa30e3e7c3b6564c9efa270
MD5 012d83b5cd2a419fe5d389a3e0f1be31
SHA1 fcafe1d1f636890b56f83377fbad7305e319ed60
SHA512 5d23d649da163b1a999a5dd881af4a6e2952d99ac899a46cecdba7c590a419a31984ede8b8118a1d7e93aa190648a5aaa2bfbe10e31f852ae8c53a878e6a30c4
TLSH
T146E00107D35002BDD03847710283273517E3C43069F20347AD110284BC122105F35FD4
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 246d05e42db0d7ab7f759d1a0e211989aa5eaf40e3113057a1da4f019aaeeb29
MD5 9bf5f6947d6b765296293b40c09df5da
SHA1 102d90af4f799863aef7556f4eb9d182fe389b1b
SHA512 79d03a036e91a49576984cc010a8aa0b43e31d6bfe498381494b7df20d0ca10d2ec4ba8abbc5877de3e7081e7821a7ab03d5f74612c11bff6fbca5513b54987c
TLSH
T1B5E00903936002AED03847710283273527E3C431AAB60347AD110694AC126105F25BE4
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 07cad81cb8c08b78b6c6113ae48fae0ea6a8cd554d060227dffc696714d47114
MD5 b71a77c8cd1f2a7754584161fcf0d8ea
SHA1 5cb6629a277849ec654d2a1aa3c15223eba3dd5b
SHA512 19d839a4316338c32a70aa309d3e9593a2ca462d22cb5fc93e7a7f36cef39833cf2dc1fe2e6a55df9d968cdb8ebaaf44a511cc0eed6ed9581145560d1edb847b
TLSH
T107E00902936002BED039477106C32B356BF28531AAF7138BAE6102A8AD227556F35FE4
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 20d3b37b6bf29aff1e571362b7b1cbb7f8e88d39b506b47d03b9704973ef909b
MD5 805149586efcab64094e9f9452bcbc14
SHA1 996f25acaf8e2cac2a12c1a324674dec10e3cdeb
SHA512 a85b4857135667df1e3059348c3b937779b52573b382ec6e052f7177b3ee3163d965842322de21bfa3d6ab1da43afe59406b74b7ca46e18a0c7b29de45bd8193
TLSH
T11BE04812A32002EAC0358371068327302BF390309BFB028B6E2201A4BC223246F30FD0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 54b9ac7a5ad8d96f7f3bdcd67dfe5a6c1b9de9f8a7521ace2d48ac90fdd66966
MD5 99d226d6e26f90ecab4c185810cdbca8
SHA1 609b1f67fe170c7d1cf5283ccef67d3f024e3480
SHA512 1fbc88649da801a324b06b29dd2505329be7af8f0dca42346740da178ed9af95d84d18955bfc4184c1c85885ae38534d4b26bd88838f019209b34d2962be150d
TLSH
T1E5E00206D35002FCC03C43710103273407D3C43058E103479D1012847C122105F35ED4
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 11e97b268465195eb35a9296f0f395df380840c600b52ff7e59612e0f2328b80
MD5 7a603d9b22775d929a8c31448bef70c7
SHA1 4cb728b22457ba8982e5fec22a186fddd7664621
SHA512 347eea3e0cb245c5e1f93f18d4cfbdbcc5c06a0e43231acf4539ffd701ee20e4b3cf9413e88108555f966af121a7fa516270b7d8e895fee97c116ba3b69fe505
TLSH
T16CE04812832002AAC0354371068327302BF29030A7FB024A6E2101A478223202F30FD4
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 c3d119f7305b4f5189c42bc80fa88663fe063f915cd710d3f45b15ac3c57a0a7
MD5 4687e0841512a1200e29efa39a302521
SHA1 c5e2f21848198f164da3f67fa9b9e6a7e35ad9ee
SHA512 252593f8f45355744ad389f347d8818772ffceb080a496972d76dec41f6f7541c0f97bf68654e27ac7fec9f4df603cd96560724ec30aa64d1f409116cc784d8c
TLSH
T185E00212936102BED0354371058327756BF3953056FB134B5E6111547D227656F35FD4
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe591b8d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe591b8d.TMP
Size 392B
SHA256 0157411a443cfc233f860ec902e0969baa437166bd0ecc2ee28011f51c138c2d
MD5 c6e030beacbfa609f1785bb076770eae
SHA1 a8ca3a2d809b2c23b29d0ab52b922d6dc9f7407f
SHA512 cbbc6113153c01fe1c92e23338c89ee4bd98c15a9fa8aef2b0121753a2a9196bd0836c4e6466843b2ddc883dc77b0beb432ae34d02432f56f96cd307e06eafae
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 1cdd0ee7c71e7e0e3b3c75e7db9e2e88bf27b0ef4ab6294ee0ce6b56fccfee01
MD5 2d6175a5ab7870fa3ff7de58664d75fc
SHA1 30c876145aa4b6bd67b4dbd81cf11a91eba7c4bf
SHA512 210d5861be1893813944751fd204ee248d8a400e79e2562fb1ed1f6d146742ea57a953aba42be41f6e8737d275e0449a7aa13b4cc40ecdc135a5dc03e39e7265
TLSH
T16A411EE01C7E9AE5C5BD0EAFB4D735FC94E8D726B5A4343C2898D9684A2D50E704183F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 546ffe6160f5abff3c02c25998706a5d7fb2d5ba4451ead74483e54cfcd53199
MD5 54aa5e63ea14bc3a8e53e0ec6b070bc1
SHA1 433c5f37b562beaf6ab345024d20a1020c002f68
SHA512 23ce235e7ba972617367c00d91db17e6413cbabfea93a07fd0a64d1fab2bc58f3296b652806731988cfaa2d836519a493100172b8529c5e7eaa5be5c2272bdf8
TLSH
T18F412DD01C3D5AE5C5BC0E6FB49639FC94E8D726F5A4303C2898D9584A2D50E704183F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 5896e22a19d99ea3e91e95a825cfe68d1ffe8bb4074f8f2d25569af3c98a1742
MD5 f43f6e657cb88821f7efb5935e2672ef
SHA1 c1e93c26bb8cd3ad76762823a2846dbdc866b063
SHA512 1536096e9fefb7b0fab8e541d4ca69bc7d7d461e9b0d39a9e2e810ff9cf834977b11203308f7085838acf7c9decd3d7265d3e2f417c7828d698937f3f973ce85
TLSH
T1D6313FD05C390AE5C5BC0EAEB89738FC85E8E636B0A4347C2888E8680B6D60D745583F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 72182d69c19d82a6a9fe06fe23b000fe420ba3c8a4f5a04486ed9b472ac4e260
MD5 b169bb455e47999187a1241dbcb57b9d
SHA1 fa562498f61090968fd808b26560a8d7d283992c
SHA512 84a75b4d5b8437bca47b0fe98ae6b7bb3a79af5308624b149f94b8104950e811bc6099fc92a93b15a659e3c889b38dea608bc7997c1c9f7a50a4e208dba67384
TLSH
T1B5412DD01C395AE5C5BC0E6FB49339FC84E8D726B4A434382888E9680A2D50E745183F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 d92c3bb5b5a9ca786c5f81e249c8a04041ddcd76739b1d31d29d6a9753233f6a
MD5 98d2cce0ead08eb8e10f80b0f91ba42a
SHA1 79d5ce1d9ade417a03e542cb8f64af3787d326a1
SHA512 2c87b8c580ee108a21694c34e3571e6181a092b57c36e37e88f23c6ed3eaf1c72d842407de517752a981b571877a39b6f6dd6ee04aa0a25837bc22ffe33f652f
TLSH
T1C0311DD058391ED1C4BD0AAEB89738FC85E8D72AF1A4747D5898E8A80B2D64E744583F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 8ca1547ec200a9d507fd1301cad90678b6a5f33809759e26a5aae5b565157105
MD5 ab43947c544b0b8460b473a2fd76b30e
SHA1 3e8827aec3bc1a288c401e69b11129755a0bd49d
SHA512 cab8bb717b1e41459b3248a519e7258982b2971f491d2089ecaec7242a122aa00428503c5f08b815a385e4f3d28eafe6d0c88768e74b227acbd981f1642ba690
TLSH
T13A311FD05C390ED5C5BD0AAFB89739FC85E8D73AB1A0347C6888E8980B6D64D745583F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 eadf2fc6e179f251e307eee3db2125d80fd3127306f9ba3d04b78e97b09925e8
MD5 51ad36c4052bd023a1f03c02f89ab1c4
SHA1 118dbab2e3c51250f5b70e26408db3f4fef2f7ff
SHA512 9761613b9e8852a3cee6413482f142e4a15c26d3b267553a8109b5c1406238a94afcf037a7b6cd139b5670e2afba4beb8411349b29056d76e9917df211f2aafd
TLSH
T1C0412DE05C3D5AD5D5BD0EAEB49735FC94ECD326B4A0343D2898E9584A6A50D304083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 af977f9ad8443c4f799d1aef8cffcaaad277d93664151c120bf11b861d20463b
MD5 637d78a4811fc5673c0fb68f98b7769e
SHA1 9c18a687a1783d4fe173a818600f164b0b881f07
SHA512 6cdef3fecc3d71d787946204ae7d728f3c730ebd3e6649e911c435f6ce5abb57e6c01a5d8bead9ebb4d6a04279325699daa4c022e590b15f877c3ad341518c65
TLSH
T135413CD05C394AE5C5BD0EAFB89739FC85E8E726F4A4303C2888E9980B2D50E745183F
MD5 SHA1 SHA512 TLSH

Submit Download

CurrentDatabase_400.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
Size 896KB
SHA256 c4bb8e2ed8c715ff2648b75b5438676ba07bd13a8946262a81119ce814ea33ea
MD5 f57802011f2125b98222bd01456e5f4e
SHA1 623bbd9b7c743e26ae125d7d980445055abdf591
SHA512 967684a9841f23f1ba7af3d46bb6620ebf501fd2b7c681762df299e55be32bdf5b58a71004e18e463325c4b70023c1bad6c45ca6a304319af9db43ce052de69e
SSDEEP 768:af0aleDxcg7KGVp3zT13VuI61HOdrrA9abhr1vfEwPRzitFrzAqUmNKX08oJImdd:a69ZP2tFPuNnY4UmqEMioTaBacg
TLSH
T169153137D560A089CF2C35B1E5AD5F0CBE23610B12E042465FB4A67FBA633C99D1B1E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 318823b13261351bab85d7bcf80dab0a15229b87dc5b89fe5cb43a3fa6e38fa8
MD5 a3602adff1b87981a027ed1e274624e6
SHA1 9f38f35f17b8a931cd83e32dd6912a22b724b108
SHA512 3a7aefe1a852ad061c89214275bea18ae4fcefa965ce51c1a65e3e87ccc58bede843a8c18d9c12c8a8a16466d452c252fb249134acb40848bae7152299af8380
TLSH
T19141F858A6EA1154B3B76E5A9BF3646D487BBC772E0AD55E00010E4F4A63F40C8B2B33
MD5 SHA1 SHA512 TLSH

Submit Download

WMSDKNS.XML

Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML
Size 9KB
SHA256 cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
MD5 7050d5ae8acfbe560fa11073fef8185d
SHA1 5bc38e77ff06785fe0aec5a345c4ccd15752560e
SHA512 a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b
SSDEEP 96:/YkZRAF6zyHUhm77yB1pZYCEnfHrHH7B6xTGH+YCLV3zwULJEYCJWyHBt3zwFRh+:/2FV0bBPCfUdY
TLSH
T10022A2A194818DD206290E275DB95C0DDA8CE9D3832C24997C9EEB7FDFB1C00355FB6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_1lwju1jz.vqo.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1lwju1jz.vqo.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

ipaddress.info

Path C:\Users\Admin\AppData\Local\Temp\ipaddress.info
Size 22B
SHA256 1027da3e32d0ba09273fb298d3a1bc4312e54b2f5ef0ae23d8d42049fa41f279
MD5 dad54d807c8bb57bba3392758c9c1695
SHA1 15f535b5d0e65743892716dcdd525d2ccc2352ec
SHA512 0924511f31594f7d4085b2438d0971ec006de5d331ac1e51479aa0d754e6c65fb2204d9a9d1844cba95f7a8cb56515dc63e496054b2881ae6d3e36c1761fee68
MD5 SHA1 SHA512

Submit Download

bg-bottom.png

Path C:\Users\Admin\AppData\Local\Temp\is-HTUBE.tmp\bg-bottom.png
Size 4KB
SHA256 ff17916663af2e4b08def48861eb38e8cd2ab4e4317e64ddab205803c9bdfad8
MD5 3ada9688e90538e60978fb6ee09041fe
SHA1 91cf49d4a1c98b5280c0ca9c37d2a93a65bb427c
SHA512 c77ae881b18a91e4870d7e94a5b2f63c43cb455ae28244526fb27e603e1c21f83662b044856adbfd4d63056c06d288e28ba68ef97d335310032f4f737c577138
SSDEEP 96:VSQN0gHNh7LMbm5KA3PgKGISXugE6zRGLrma0A3nuFNrEBvl:VSinz5opXuP6zErmHAefKl
TLSH
T1D8917E3B6D2D44B3840E82F38B8BD855653EFBB1647662121E57123D091ECD18698E83
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bg-inner.png

Path C:\Users\Admin\AppData\Local\Temp\is-HTUBE.tmp\bg-inner.png
Size 6KB
SHA256 8fe4a3f95d5309e692c4142f460bebe4e4e24844f5a2071d466bd964c5d04dcf
MD5 a034eeaf19bb82b2ae63f4fa10c26476
SHA1 617c9ef4b889e424e754574d62649f04c97bcc67
SHA512 c1ffd444da1378620428b374501de974a33e898e38a9d94e88ee5977951aba89fbad033ffbac65051e021fb96dfa9039872f8dc6441de1dfea01c39c8a8ecb20
SSDEEP 192:sSTdK8Lk27YvkgtGwZfgSwPLX51gjmzGj:r48Lk27YMSZIrPLXIck
TLSH
T19CE1AFEAD7970B2830739A902189B07B695FD8723354F315DD3AD30B191A4ECC61F563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bg-top.png

Path C:\Users\Admin\AppData\Local\Temp\is-HTUBE.tmp\bg-top.png
Size 20KB
SHA256 bdc753b2b19ee8b573b8e676f18dae42494b99b6bd738194dcdd67f244085f36
MD5 220fe6e00519a633d9ad7d1d50adc4c7
SHA1 cfcadd75996d6f1cb42c43480d24e52dd72bd917
SHA512 1f00db2aab3585aff016188f12f953e832d027161076887cde42b99dab581e2396c9bfb919c43e01fd8c823f79a81425238a8c5235b47be55d7dfdcc1d190ec3
SSDEEP 384:P5Z7BD9bMqsjNoUbBj1N/YsHFc9e0UV7Js52F0pTogUm8GhDpy01BtXUIKH5Xb:BZn4q5kBx2sl2+JK2FSTlUm84YqtXv6r
TLSH
T11992E18DB6680FF386C4F03C992BC03BE679FD69986567059A050FD51C627C94DF2A01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

botva2.dll

Path C:\Users\Admin\AppData\Local\Temp\is-HTUBE.tmp\botva2.dll
Size 35KB
SHA256 a4b61626a1626fdabec794e4f323484aa0644baa1c905a5dcf785dc34564f008
MD5 0177746573eed407f8dca8a9e441aa49
SHA1 6b462adf78059d26cbc56b3311e3b97fcb8d05f7
SHA512 d4ac96da2d72e121d1d63d64e78bcea155d62af828324b81889a3cd3928ceeb12f7a22e87e264e34498d100b57cdd3735d2ab2316e1a3bf7fa099ddb75c5071a
SSDEEP 768:Aoi9qZO9Q4rAJa4debLTMkUuzXIu53w4eGlV:Av9qZMQVGLyu5r3V
TLSH
T180F26B51D9A1C031C085DEBD6D31E21A936F3A201FD64B691A6E5ACCEE4FF03952C2DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

buttons.png

Path C:\Users\Admin\AppData\Local\Temp\is-HTUBE.tmp\buttons.png
Size 1KB
SHA256 d236f88ef90e6d0e259a586f4e613b14d4a35f3a704ff559dadda31341e99c24
MD5 87cc673665996a85a404beb1c8466aee
SHA1 df01fc67a739544244a0ddabd0f818bd960bf071
SHA512 2058e3fd362c689a78fb3d0a163fd21bfe472368649c43dc8e48b24fa4bc5ed1307faf1cab2c351a4dd28f903a72d4951a72d7eb27784fee405884661a259c32
TLSH
T11341FC65E38A45BBF034A13935251813A4041C3BB04FEE2545A375AF2363F2ABD31E47
MD5 SHA1 SHA512 TLSH

Submit Download

idp.dll

Path C:\Users\Admin\AppData\Local\Temp\is-HTUBE.tmp\idp.dll
Size 232KB
SHA256 54e7e0ad32a22b775131a6288f083ed3286a9a436941377fc20f85dd9ad983ed
MD5 55c310c0319260d798757557ab3bf636
SHA1 0892eb7ed31d8bb20a56c6835990749011a2d8de
SHA512 e0082109737097658677d7963cbf28d412dca3fa8f5812c2567e53849336ce45ebae2c0430df74bfe16c0f3eebb46961bc1a10f32ca7947692a900162128ae57
SSDEEP 3072:dnSx3lws+iWbUmJmE8dxMw7r+mjT5PbzEFwyGIyTcHY10tSB9j:IP0bUmQEUr+mRcbTx4N
TLSH
T13434AF00B6CBC073D98F0778842B975C0B7AB95557348ACBEB985DADCD213C2AD371A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VoicemodInstaller_1.6.0-zxtpcu.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-T6J51.tmp\VoicemodInstaller_1.6.0-zxtpcu.tmp
Size 2.5MB
SHA256 6af83b4f0b8247e35ae14eed77ef588fc4e1a531f8d952267e42ba2713015aba
MD5 0d53a2a513c63b3138342b2db8914e03
SHA1 3f6c011bd12f245011eafa9f76a841efbfd2dcf7
SHA512 eed458278ce2e9cbcfb6ba5d65f60f4994d4f940c0da3dd72174d680a6bdeb5338793ff6c8c70c45c479f021feab49524232f443a520d87fe52cc3b27b9d6cec
SSDEEP 49152:k/bMELtKnwSaPuqrUJlORnUjzV8VkLwk5:kjMzVPeVCx
TLSH
T102C54B12B284B13FD06A2B35653FC660993FBA6179B38D1B6BF41D0C8F355802F3A656
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tasklist_unins000.exe.txt

Path C:\Users\Admin\AppData\Local\Temp\tasklist_unins000.exe.txt
Size 7KB
SHA256 87be9c76133eb69727f8abdf612b0f003ef9a407154e5aa858cbbdba01f57bc2
MD5 c67e8a66b5a72648572597051830f1ff
SHA1 f9a59ed5270d46b95ececb770ccd1a5a057ccad4
SHA512 81f9b7172cc55bae89fd640c2e2485f6949f8cacd620a97aa2726a9130e903eec1799e9091c6d591139955530c42f8603c23399fa39c81ce97be9678ff587a9e
SSDEEP 192:n06FzmgOMuEyIN0pCGxRDhgOJDxD3uN+ePrCTtgQJEJT6N8Sz9Gwt2RA7hUJTARp:n06FzmgOMuEyIN0pCGxRDhgOJDxD3uNi
TLSH
T170E1F38184DF85EC922DD3993E230002EB4E650031AAADD93ADD14EC77E5F1CD3EBA60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

凅怦椛怸薃馷珛诚臰据獱鹨愈糣展坉.txt

Path C:\Users\Admin\AppData\Local\Temp\凅怦椛怸薃馷珛诚臰据獱鹨愈糣展坉.txt
Size 260B
SHA256 c0622c7e26ebaa79fb4950d39b656e29a2392b5fb3de15bb22ce031d8c6ceffa
MD5 de9cc24f9cdb9b50e5713a854e7d2fe3
SHA1 da895eb00e8999da35f4bd3906b5c08cface6bff
SHA512 75d1ce72321502b35082c0191a7c8b4b171990c1a5f4f62be69153ee5e73f5c6b0bcd6014dbca7fdfa68021896af982873137722074290f6f5ba1fc22ea1fb09
TLSH
T132D0019549FA9261D3FE9AB8563AA182203238116E06128D84854AC50822A298430F63
MD5 SHA1 SHA512 TLSH

Submit Download

AiVDsDOsA.zip

Path C:\Users\Admin\Downloads\AiVDsDOsA.zip
Size 11KB
SHA256 cbc417be191ab85dc7fae87b03d5550daa710b97855e87451d52525f0443ee93
MD5 a78ff9ecbeb347651594a4b08018dce8
SHA1 7eee824f060c74ff2cce656a6cedd2004596f241
SHA512 2886e65a8565fc35e528bb86beb61bf9f74e233752aceb81faad831bac1241c1963b3bf3657ee9373f0ca38ce5edc1f6c52e67be3c62338b8d1662e2d5953181
SSDEEP 192:3/QcXIB9J5alzSMpk/HdI1gvufHAuJ/eH52V4ByyPif9je65bspJbDze2w:3/Qq0v5aFXCfAgvyHAQe5a3yPif5N5b7
TLSH
T1D032CF6D9D436692CA3D3B7A7744DBB20FBEA80E221FC5D77D1D412086540DA3BE2B44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Clutt4_PACK.zip.crdownload

Path C:\Users\Admin\Downloads\Clutt4_PACK.zip.crdownload
Size 9.3MB
SHA256 36589a58d3ff5f7c69da76d7348a767e270b6cdc2d53b7436c2723e32877eb0b
MD5 26083159195056b8262b402aacfbef69
SHA1 e473c0954a8114d7d93287a5dbe28f20210cc45f
SHA512 71ec8a6671107cc50ddbe11e3f3639e92da00b995eeb99bd73a2c475e82e3846ed69d125c5b29a2257c4b4676350421b28290e778e144028f2cd1877a76dfbf3
SSDEEP 196608:fcYPeCrC7o+OM21Bjx+XZ5TqjvrB3huaQ:fVeX2bjAX7EvrB3IP
TLSH
T12DA633017C0668DCA83792D17DAC6B440B0AE31BFEA1DE6ECBC9DA7573C56B08D15523
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MEMZ.zip

Path C:\Users\Admin\Downloads\MEMZ.zip
Size 8KB
SHA256 61ca4d8dd992c763b47bebb9b5facb68a59ff0a594c2ff215aa4143b593ae9dc
MD5 69977a5d1c648976d47b69ea3aa8fcaa
SHA1 4630cc15000c0d3149350b9ecda6cfc8f402938a
SHA512 ba0671c72cd4209fabe0ee241b71e95bd9d8e78d77a893c94f87de5735fd10ea8b389cf4c48462910042c312ddff2f527999cd2f845d0c19a8673dbceda369fd
SSDEEP 192:8xI2dw4xXlsUjs1ScK3ZeD6dUqENj710+MZ9R1SVBIpp:b2dHiosKA6OqEx2t9R1SLIL
TLSH
T15D029FCB578EB156D8A819E541CD213BD7C0395963E89B38D80C40680FE8B6BAE7C7CC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Monoxidex64.exe

Path C:\Users\Admin\Downloads\Monoxidex64.exe
Size 330KB
SHA256 ae9405b9556c24389ee359993f45926a895481c8d60d98b91a3065f5c026cffe
MD5 692361071bbbb3e9243d09dc190fedea
SHA1 04894c41500859ea3617b0780f1cc2ba82a40daf
SHA512 cfdd627d228c89a4cc2eac27dcdc45507f1e4265eff108958de0e26e0d1abe7598a5347be77d1a52256de70c77129f1cd0e9b31c023e1263f4cf04dbc689c87e
SSDEEP 3072:7/yvAAdLz9aha9RMXtdf+IBC2nQ4oUehONFlT7vJ333AlOi9E3AAqgm:z6dLzgiMXzBTJTDqlOi9E3AAqgm
TLSH
T13174C3027151DA99D8214130CC2ECAF67E227CE4C6B149E736F2BF7F7D7524269AA720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Trojan.Ransom.Satana.zip.crdownload

Path C:\Users\Admin\Downloads\Trojan.Ransom.Satana.zip.crdownload
Size 34KB
SHA256 50716abdde2a383ed8c5da0c10d7c42e52a0d1c7b38878f1b130d08e13d5c5a5
MD5 18881d488739f0fffa5f08c18d8a650d
SHA1 f1ad045b8d0a53c13cce1a18f1a2f59b5ca2dba9
SHA512 a0c303a37ad4dc56e938463003544bff50eddb8d13390d6890fe16a1d02b5e9f05a75cb5cf2cb0e6baad31514a025f7c07d8185f30facdff4051981524ecaf7c
SSDEEP 768:rZuS5bFDAovPXSyiIHcNNVt173snyUJNEbV33ARp:rZuS5jvPNih/H1738DQpQP
TLSH
T19BF2E0E8CE3F1732446F01E057E26019E96F5DD9816E252F623061A44BBFF78B987182
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Virus.DOS.Jesus.zip

Path C:\Users\Admin\Downloads\Virus.DOS.Jesus.zip
Size 1KB
SHA256 699fe02c95389bcf222d303c70fee6d0c809becda744279919512ba0300d6a8f
MD5 e270d4efb15d7c29818d195d62084e68
SHA1 6c7d4b0fa751af537b4328199bee00665af5d0e9
SHA512 aab5f982ac6c0d8e38593ba46625e5890aa0840a78a16176b122010d7c11260747f6023a9507d10a9bcac69a833bbc1661e2846e0c3ba012b1bc06609efa0d31
TLSH
T1DF21E7040F069436E551A3BAACC0B31604D1A0DD45F0A28F560C7BF0DCD80BEE1EB1F9
MD5 SHA1 SHA512 TLSH

Submit Download

WaffMEMZ-1.0-Destructive.7z

Path C:\Users\Admin\Downloads\WaffMEMZ-1.0-Destructive.7z
Size 10KB
SHA256 d76514431f556a3b5bcff9d9222c94ff97ed4139b157d8c73966a18607a8c86f
MD5 527d8596b05f8a5ea645a2327bc083fe
SHA1 985960a519cac4977c849d34fda06d016fa75f95
SHA512 07d3832e04dc9d4482ad2f67d32922ab980e22f0f3539ad97091cac83fe4966c2605a67282eae4df5d0a0dd35d390b80f9f6a25db4c7eac4263eaa53ece26492
SSDEEP 192:MAgxv8STCX5EuBlt/xHRsjgHMclxkbatifgAzS01AgI3T6dmVXFN+Ic/uf1:e9CXdBD/xhMmxm3fgx0YmdmVXFN+D/ud
TLSH
T10822BEA017121805AFCB14FD25D74CBD8198AE58C04EAF2CFC355F8BD061EA15ED7B90
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Other

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1336_1119385347\Mu\Other
Size 34B
SHA256 2b4a47b82cbe70e34407c7df126a24007aff8b45d5716db384d27cc1f3b30707
MD5 cd0395742b85e2b669eaec1d5f15b65b
SHA1 43c81d1c62fc7ff94f9364639c9a46a0747d122e
SHA512 4df2ce734e2f7bc5f02bb7845ea801b57dcf649565dd94b1b71f578b453ba0a17c61ccee73e7cff8f23cdd6aa37e55be5cb15f4767ff88a9a06de3623604fbf0
MD5 SHA1 SHA512

Submit Download

hyph-bn.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1336_2144574221\hyph-bn.hyb
Size 703B
SHA256 c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
MD5 8961fdd3db036dd43002659a4e4a7365
SHA1 7b2fa321d50d5417e6c8d48145e86d15b7ff8321
SHA512 531ecec11d296a1ab3faeb2c7ac619da9d80c1054a2ccee8a5a0cd996346fea2a2fee159ac5a8d79b46a764a2aa8e542d6a79d86b3d7dda461e41b19c9bebe92
TLSH
T13001E1B0B7014F4BC635EDB0117A4A6D9664C43553BE051D84B1F9634F19714E70A8A8
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-mr.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1336_2144574221\hyph-mr.hyb
Size 687B
SHA256 f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
MD5 0807cf29fc4c5d7d87c1689eb2e0baaa
SHA1 d0914fb069469d47a36d339ca70164253fccf022
SHA512 5324fd47c94f5804bfa1aa6df952949915896a3fc77dccaed0eeffeafe995ce087faef035aecea6b4c864a16ad32de00055f55260af974f2c41afff14dce00f3
TLSH
T14801E178BE13888BC6784DB1054115AA0320F90EF296021B4262B13ACB18FD61C95484
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-nn.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1336_2144574221\hyph-nn.hyb
Size 141KB
SHA256 5bcbb58eaf65f13f6d039244d942f37c127344e3a0a2e6c32d08236945132809
MD5 f2d8fe158d5361fc1d4b794a7255835a
SHA1 6c8744fa70651f629ed887cb76b6bc1bed304af9
SHA512 946f4e41be624458b5e842a6241d43cd40369b2e0abc2cacf67d892b5f3d8a863a0e37e8120e11375b0bacb4651eedb8d324271d9a0c37527d4d54dd4905afab
SSDEEP 3072:pPTHXHEm69FrOP8d4hRLiinKL4Qshbv2fuOQXCxj+60EoM8WC5zgY:p73HEUP8dsiinTThjy90VKY
TLSH
T1C1E319F3A3394AC29420A8A4DF593B7E4044FA944D80E197B5EC2038E667CBC76D579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2104-2321-0x00000239791D0000-0x00000239791F2000-memory.dmp

Download

memory/2408-2271-0x0000000006D70000-0x0000000006D80000-memory.dmp

Download

memory/2408-2270-0x0000000006D70000-0x0000000006D80000-memory.dmp

Download

memory/2408-2266-0x0000000006D70000-0x0000000006D80000-memory.dmp

Download

memory/2408-2267-0x0000000006D70000-0x0000000006D80000-memory.dmp

Download

memory/2408-2268-0x0000000006D70000-0x0000000006D80000-memory.dmp

Download

memory/2408-2265-0x0000000006D70000-0x0000000006D80000-memory.dmp

Download

memory/3316-2283-0x000002A0394C0000-0x000002A0394CA000-memory.dmp

Download

memory/4168-1864-0x000000001BB00000-0x000000001BCA7000-memory.dmp

Download

memory/4168-1853-0x0000000000380000-0x0000000000388000-memory.dmp

Download

memory/4508-13-0x0000000000400000-0x00000000004DB000-memory.dmp

Download

memory/4508-123-0x0000000000400000-0x00000000004DB000-memory.dmp

Download

memory/4508-0-0x0000000000400000-0x00000000004DB000-memory.dmp

Download

memory/4756-1951-0x00000000008D0000-0x00000000008DE000-memory.dmp

Download

memory/4920-2269-0x000000001B3D0000-0x000000001B577000-memory.dmp

Download

memory/5228-102-0x0000000006400000-0x0000000006540000-memory.dmp

Download

memory/5228-5-0x0000000002550000-0x0000000002551000-memory.dmp

Download

memory/5228-82-0x0000000006400000-0x0000000006540000-memory.dmp

Download

memory/5228-28-0x0000000003FB0000-0x0000000003FBE000-memory.dmp

Download

memory/5228-15-0x0000000002550000-0x0000000002551000-memory.dmp

Download

memory/5228-122-0x0000000000400000-0x0000000000697000-memory.dmp

Download

memory/5228-92-0x0000000006400000-0x0000000006540000-memory.dmp

Download

memory/5228-87-0x0000000006400000-0x0000000006540000-memory.dmp

Download

memory/5228-97-0x0000000006400000-0x0000000006540000-memory.dmp

Download

memory/5228-14-0x0000000000400000-0x0000000000697000-memory.dmp

Download

memory/5264-2280-0x000000001C250000-0x000000001C3F7000-memory.dmp

Download

memory/5264-2411-0x000000001C250000-0x000000001C3F7000-memory.dmp

Download

memory/5264-1927-0x000000001C250000-0x000000001C3F7000-memory.dmp

Download

memory/5264-1854-0x000000001C250000-0x000000001C3F7000-memory.dmp

Download

memory/5264-2238-0x000000001C250000-0x000000001C3F7000-memory.dmp

Download

memory/5264-1838-0x000000001C250000-0x000000001C3F7000-memory.dmp

Download

memory/5264-2312-0x000000001C250000-0x000000001C3F7000-memory.dmp

Download

memory/5264-1812-0x000000001C250000-0x000000001C3F7000-memory.dmp

Download

memory/5264-2227-0x000000001C250000-0x000000001C3F7000-memory.dmp

Download

memory/5264-2325-0x000000001C250000-0x000000001C3F7000-memory.dmp

Download

memory/5264-2119-0x000000001C250000-0x000000001C3F7000-memory.dmp

Download

memory/5264-2337-0x000000001C250000-0x000000001C3F7000-memory.dmp

Download

memory/5264-1749-0x000000001C250000-0x000000001C3F7000-memory.dmp

Download

memory/5264-1881-0x000000001C250000-0x000000001C3F7000-memory.dmp

Download

memory/5264-1954-0x000000001C250000-0x000000001C3F7000-memory.dmp

Download

memory/5264-1696-0x0000000000060000-0x0000000000B8E000-memory.dmp

Download

memory/5264-2433-0x000000001C250000-0x000000001C3F7000-memory.dmp

Download

memory/5264-2438-0x000000001C250000-0x000000001C3F7000-memory.dmp

Download

memory/5264-2450-0x000000001C250000-0x000000001C3F7000-memory.dmp

Download

memory/5264-2461-0x000000001C250000-0x000000001C3F7000-memory.dmp

Download

memory/5264-1987-0x000000001C250000-0x000000001C3F7000-memory.dmp

Download

memory/5264-2482-0x000000001C250000-0x000000001C3F7000-memory.dmp

Download

memory/5264-1741-0x000000001C250000-0x000000001C3F7000-memory.dmp

Download

memory/5464-1740-0x0000000000BA0000-0x0000000000BC6000-memory.dmp

Download

memory/5464-1748-0x000000001C1D0000-0x000000001C377000-memory.dmp

Download