hxxps://d1ubcao5pljbpg[.]cloudfront[.]net/4owIMKToN[.]exe

Resubmissions

13/09/2026, 15:32

260913-syv6rsyfkg8

13/09/2026, 15:10

260913-sj6nyshm3y8

13/09/2026, 15:00

260913-sdnaesybrg8

Analysis

user interaction
yes
max time kernel
199s
max time network
201s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
13/09/2026, 15:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://d1ubcao5pljbpg.cloudfront.net/4owIMKToN.exe
Sample260913-sdnaesybrg

Score

8^/10

defense_evasion discovery installer persistence privilege_escalation

Malware Config

Signatures

Downloads MZ/PE file 2 IoCs

flow	pid	Process
19	3684	msedge.exe
62	3684	msedge.exe

Modifies Windows Firewall 2 TTPs 2 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
4680	netsh.exe
5016	netsh.exe

Executes dropped EXE 6 IoCs

pid	Process
936	Sad Satan_AG3ma-5.exe
3324	Sad Satan_AG3ma-5.tmp
3936	qbittorrent.exe
4716	Sad Satan_AG3ma-5.exe
516	Sad Satan_AG3ma-5.tmp
3292	qbittorrent.exe

Loads dropped DLL 2 IoCs

pid	Process
3324	Sad Satan_AG3ma-5.tmp
516	Sad Satan_AG3ma-5.tmp

Checks for any installed AV software in registry 1 TTPs 18 IoCs

Security Software Discovery

T1518.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avast Software\Avast	Sad Satan_AG3ma-5.tmp
Key opened	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Avast Software\Avast	Sad Satan_AG3ma-5.tmp
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVAST Software\Avast	Sad Satan_AG3ma-5.tmp
Key opened	\REGISTRY\MACHINE\SOFTWARE\AVAST Software\Avast	Sad Satan_AG3ma-5.tmp
Key opened	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast	Sad Satan_AG3ma-5.tmp
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVAST Software\Avast	Sad Satan_AG3ma-5.tmp
Key opened	\REGISTRY\MACHINE\SOFTWARE\AVG\AV\Dir	Sad Satan_AG3ma-5.tmp
Key opened	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\AVG\AV\Dir	Sad Satan_AG3ma-5.tmp
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avast Software\Avast	Sad Satan_AG3ma-5.tmp
Key opened	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast	Sad Satan_AG3ma-5.tmp
Key opened	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\AVAST Software\Avast	Sad Satan_AG3ma-5.tmp
Key opened	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Avast Software\Avast	Sad Satan_AG3ma-5.tmp
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVG\AV\Dir	Sad Satan_AG3ma-5.tmp
Key opened	\REGISTRY\MACHINE\SOFTWARE\AVG\AV\Dir	Sad Satan_AG3ma-5.tmp
Key opened	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\AVG\AV\Dir	Sad Satan_AG3ma-5.tmp
Key opened	\REGISTRY\MACHINE\SOFTWARE\AVAST Software\Avast	Sad Satan_AG3ma-5.tmp
Key opened	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\AVAST Software\Avast	Sad Satan_AG3ma-5.tmp
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVG\AV\Dir	Sad Satan_AG3ma-5.tmp

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Sad Satan_AG3ma-5.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Sad Satan_AG3ma-5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Sad Satan_AG3ma-5.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Sad Satan_AG3ma-5.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3684	msedge.exe

Inno Setup is an open-source installation builder for Windows applications. 8 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral1/files/0x000c000000023278-116.dat	innosetup
behavioral1/files/0x0003000000022b2a-241.dat	innosetup
behavioral1/memory/936-262-0x0000000000CA0000-0x0000000000D7C000-memory.dmp	innosetup
behavioral1/memory/936-281-0x0000000000CA0000-0x0000000000D7C000-memory.dmp	innosetup
behavioral1/memory/936-348-0x0000000000CA0000-0x0000000000D7C000-memory.dmp	innosetup
behavioral1/memory/4716-406-0x0000000000CA0000-0x0000000000D7C000-memory.dmp	innosetup
behavioral1/memory/4716-436-0x0000000000CA0000-0x0000000000D7C000-memory.dmp	innosetup
behavioral1/memory/4716-484-0x0000000000CA0000-0x0000000000D7C000-memory.dmp	innosetup

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Sad Satan_AG3ma-5.tmp
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\	Sad Satan_AG3ma-5.tmp
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Sad Satan_AG3ma-5.tmp
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\	Sad Satan_AG3ma-5.tmp

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134337852727605534"	msedge.exe

Modifies registry class 19 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\magnet\	qbittorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\magnet\ = "URL:Magnet link"	qbittorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\magnet\URL Protocol	qbittorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\magnet\DefaultIcon\	qbittorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\magnet\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\is-L8QM94YD6N.tmp\\qbittorrent.exe\",1"	qbittorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\magnet\shell	qbittorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\magnet\shell\open	qbittorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\.torrent\	qbittorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\magnet\Content Type = "application/x-magnet"	qbittorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\magnet\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\is-L8QM94YD6N.tmp\\qbittorrent.exe\" \"%1\""	qbittorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\.torrent\ = "qBittorrent"	qbittorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\magnet\shell\	qbittorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\magnet	qbittorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\magnet\shell\open\command	qbittorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2091445952-3649787497-104050984-1000\{0F32380F-AEFA-44BD-B3E8-917E7AE58147}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\magnet\shell\ = "open"	qbittorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\magnet\shell\open\command\	qbittorrent.exe

Script User-Agent 2 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	78	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	280	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
3936	qbittorrent.exe
3292	qbittorrent.exe

Suspicious behavior: EnumeratesProcesses 30 IoCs

pid	Process
3324	Sad Satan_AG3ma-5.tmp
3324	Sad Satan_AG3ma-5.tmp
3324	Sad Satan_AG3ma-5.tmp
3324	Sad Satan_AG3ma-5.tmp
3324	Sad Satan_AG3ma-5.tmp
3324	Sad Satan_AG3ma-5.tmp
3324	Sad Satan_AG3ma-5.tmp
3324	Sad Satan_AG3ma-5.tmp
3324	Sad Satan_AG3ma-5.tmp
3324	Sad Satan_AG3ma-5.tmp
3324	Sad Satan_AG3ma-5.tmp
3324	Sad Satan_AG3ma-5.tmp
3324	Sad Satan_AG3ma-5.tmp
3324	Sad Satan_AG3ma-5.tmp
2720	msedge.exe
2720	msedge.exe
516	Sad Satan_AG3ma-5.tmp
516	Sad Satan_AG3ma-5.tmp
516	Sad Satan_AG3ma-5.tmp
516	Sad Satan_AG3ma-5.tmp
516	Sad Satan_AG3ma-5.tmp
516	Sad Satan_AG3ma-5.tmp
516	Sad Satan_AG3ma-5.tmp
516	Sad Satan_AG3ma-5.tmp
516	Sad Satan_AG3ma-5.tmp
516	Sad Satan_AG3ma-5.tmp
516	Sad Satan_AG3ma-5.tmp
516	Sad Satan_AG3ma-5.tmp
516	Sad Satan_AG3ma-5.tmp
516	Sad Satan_AG3ma-5.tmp

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3936	qbittorrent.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe

Suspicious use of FindShellTrayWindow 62 IoCs

pid	Process
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
3324	Sad Satan_AG3ma-5.tmp
3936	qbittorrent.exe
3936	qbittorrent.exe
3936	qbittorrent.exe
3936	qbittorrent.exe
3936	qbittorrent.exe
3936	qbittorrent.exe
3936	qbittorrent.exe
3936	qbittorrent.exe
516	Sad Satan_AG3ma-5.tmp

Suspicious use of SendNotifyMessage 39 IoCs

pid	Process
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
3936	qbittorrent.exe
3936	qbittorrent.exe
3936	qbittorrent.exe
3936	qbittorrent.exe
3936	qbittorrent.exe
3936	qbittorrent.exe
3936	qbittorrent.exe

Suspicious use of WriteProcessMemory 46 IoCs

description	pid	Process	procid_target
PID 4568 wrote to memory of 4404	4568	msedge.exe	84
PID 4568 wrote to memory of 3684	4568	msedge.exe	86
PID 4568 wrote to memory of 5224	4568	msedge.exe	87
PID 4568 wrote to memory of 5224	4568	msedge.exe	87
PID 4568 wrote to memory of 5224	4568	msedge.exe	87
PID 4568 wrote to memory of 4048	4568	msedge.exe	88
PID 4568 wrote to memory of 4048	4568	msedge.exe	88
PID 4568 wrote to memory of 3784	4568	msedge.exe	89
PID 4568 wrote to memory of 3784	4568	msedge.exe	89
PID 4568 wrote to memory of 3784	4568	msedge.exe	89
PID 4568 wrote to memory of 5860	4568	msedge.exe	90
PID 4568 wrote to memory of 5860	4568	msedge.exe	90
PID 4568 wrote to memory of 5860	4568	msedge.exe	90
PID 4568 wrote to memory of 5160	4568	msedge.exe	93
PID 4568 wrote to memory of 1648	4568	msedge.exe	94
PID 4568 wrote to memory of 5160	4568	msedge.exe	93
PID 4568 wrote to memory of 1648	4568	msedge.exe	94
PID 4568 wrote to memory of 4880	4568	msedge.exe	95
PID 4568 wrote to memory of 4880	4568	msedge.exe	95
PID 4568 wrote to memory of 2284	4568	msedge.exe	96
PID 4568 wrote to memory of 2284	4568	msedge.exe	96
PID 4568 wrote to memory of 2284	4568	msedge.exe	96
PID 4568 wrote to memory of 2592	4568	msedge.exe	99
PID 4568 wrote to memory of 2564	4568	msedge.exe	101
PID 4568 wrote to memory of 780	4568	msedge.exe	102
PID 4568 wrote to memory of 780	4568	msedge.exe	102
PID 4568 wrote to memory of 5268	4568	msedge.exe	108
PID 4568 wrote to memory of 4692	4568	msedge.exe	109
PID 4568 wrote to memory of 1644	4568	msedge.exe	110
PID 4568 wrote to memory of 3080	4568	msedge.exe	113
PID 4568 wrote to memory of 3080	4568	msedge.exe	113
PID 4568 wrote to memory of 3080	4568	msedge.exe	113
PID 4568 wrote to memory of 1156	4568	msedge.exe	114
PID 936 wrote to memory of 3324	936	Sad Satan_AG3ma-5.exe	119
PID 4568 wrote to memory of 2220	4568	msedge.exe	120
PID 4568 wrote to memory of 2220	4568	msedge.exe	120
PID 4568 wrote to memory of 2180	4568	msedge.exe	121
PID 4568 wrote to memory of 2180	4568	msedge.exe	121
PID 3324 wrote to memory of 4680	3324	Sad Satan_AG3ma-5.tmp	127
PID 3324 wrote to memory of 3936	3324	Sad Satan_AG3ma-5.tmp	129
PID 4568 wrote to memory of 2720	4568	msedge.exe	135
PID 4716 wrote to memory of 516	4716	Sad Satan_AG3ma-5.exe	140
PID 4568 wrote to memory of 5608	4568	msedge.exe	145
PID 4568 wrote to memory of 5608	4568	msedge.exe	145
PID 516 wrote to memory of 5016	516	Sad Satan_AG3ma-5.tmp	146
PID 516 wrote to memory of 3292	516	Sad Satan_AG3ma-5.tmp	148

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://d1ubcao5pljbpg.cloudfront.net/4owIMKToN.exe
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x25c,0x7ffdef7ac188,0x7ffdef7ac194,0x7ffdef7ac1a0
  2⤵
  PID:4404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1808,i,6787952254882907064,10641784249763140243,524288 --field-trial-handle=2328,i,1785202217396181371,2827668200650346665,262144 --variations-seed-version --mojo-platform-channel-handle=2440 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:3684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1652,i,9935538684662593038,9897636057245896062,262144 --field-trial-handle=2328,i,1785202217396181371,2827668200650346665,262144 --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:2
  2⤵
  PID:5224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2596,i,17653621276250843409,7185630556507219011,524288 --field-trial-handle=2328,i,1785202217396181371,2827668200650346665,262144 --variations-seed-version --mojo-platform-channel-handle=2688 /prefetch:8
  2⤵
  PID:4048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3444,i,2456267636633924853,12753337331327081010,2097152 --field-trial-handle=2328,i,1785202217396181371,2827668200650346665,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:3784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3464,i,10158682199351859967,13386491633987372576,2097152 --field-trial-handle=2328,i,1785202217396181371,2827668200650346665,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:5860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4956,i,48382219685664121,10126581557362618192,524288 --field-trial-handle=2328,i,1785202217396181371,2827668200650346665,262144 --variations-seed-version --mojo-platform-channel-handle=4980 /prefetch:8
  2⤵
  PID:5160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4960,i,598011890046161832,1208280692871932508,524288 --field-trial-handle=2328,i,1785202217396181371,2827668200650346665,262144 --variations-seed-version --mojo-platform-channel-handle=5012 /prefetch:8
  2⤵
  PID:1648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5600,i,11463784479127933562,11059252942578168705,524288 --field-trial-handle=2328,i,1785202217396181371,2827668200650346665,262144 --variations-seed-version --mojo-platform-channel-handle=5624 /prefetch:8
  2⤵
  PID:4880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5612,i,17915744767455969524,12908092242687981374,2097152 --field-trial-handle=2328,i,1785202217396181371,2827668200650346665,262144 --variations-seed-version --mojo-platform-channel-handle=5724 /prefetch:1
  2⤵
  PID:2284
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6208,i,15398929207269257729,6908375441996443251,524288 --field-trial-handle=2328,i,1785202217396181371,2827668200650346665,262144 --variations-seed-version --mojo-platform-channel-handle=6224 /prefetch:8
  2⤵
  PID:5156
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6208,i,15398929207269257729,6908375441996443251,524288 --field-trial-handle=2328,i,1785202217396181371,2827668200650346665,262144 --variations-seed-version --mojo-platform-channel-handle=6224 /prefetch:8
  2⤵
  PID:2592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6376,i,16653456404335560889,6958822100636826015,524288 --field-trial-handle=2328,i,1785202217396181371,2827668200650346665,262144 --variations-seed-version --mojo-platform-channel-handle=6184 /prefetch:8
  2⤵
  PID:2564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6192,i,16268607693201859978,4364556737327004520,524288 --field-trial-handle=2328,i,1785202217396181371,2827668200650346665,262144 --variations-seed-version --mojo-platform-channel-handle=6496 /prefetch:8
  2⤵
  PID:780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6280,i,16339134948448504377,13850172794907155677,524288 --field-trial-handle=2328,i,1785202217396181371,2827668200650346665,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:8
  2⤵
  PID:5268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=560,i,11206309056682680345,12962146708254171286,524288 --field-trial-handle=2328,i,1785202217396181371,2827668200650346665,262144 --variations-seed-version --mojo-platform-channel-handle=6252 /prefetch:8
  2⤵
  PID:4692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6276,i,18419876244443843260,10678069759826910968,524288 --field-trial-handle=2328,i,1785202217396181371,2827668200650346665,262144 --variations-seed-version --mojo-platform-channel-handle=6636 /prefetch:8
  2⤵
  PID:1644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6636,i,4351884088598073276,11724913619358537841,2097152 --field-trial-handle=2328,i,1785202217396181371,2827668200650346665,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:1
  2⤵
  PID:3080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6716,i,14164990491898508432,11363955779109711870,524288 --field-trial-handle=2328,i,1785202217396181371,2827668200650346665,262144 --variations-seed-version --mojo-platform-channel-handle=6704 /prefetch:8
  2⤵
  PID:1156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2148,i,2062457639457376982,2753964220686954465,524288 --field-trial-handle=2328,i,1785202217396181371,2827668200650346665,262144 --variations-seed-version --mojo-platform-channel-handle=6840 /prefetch:8
  2⤵
  PID:2220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7060,i,6942493274808109401,12905990500981856629,524288 --field-trial-handle=2328,i,1785202217396181371,2827668200650346665,262144 --variations-seed-version --mojo-platform-channel-handle=7064 /prefetch:8
  2⤵
  PID:2180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4524,i,12985987911061575483,12885404603760021502,262144 --field-trial-handle=2328,i,1785202217396181371,2827668200650346665,262144 --variations-seed-version --mojo-platform-channel-handle=5824 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5724,i,15771968338561129490,8879417817759067636,524288 --field-trial-handle=2328,i,1785202217396181371,2827668200650346665,262144 --variations-seed-version --mojo-platform-channel-handle=4024 /prefetch:8
  2⤵
  PID:5608

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3788

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:912

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4804

C:\Users\Admin\Downloads\Sad Satan_AG3ma-5.exe
"C:\Users\Admin\Downloads\Sad Satan_AG3ma-5.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:936
- C:\Users\Admin\AppData\Local\Temp\is-P807D0YC9M.tmp\Sad Satan_AG3ma-5.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-P807D0YC9M.tmp\Sad Satan_AG3ma-5.tmp" /SL5="$A02C8,14880881,843264,C:\Users\Admin\Downloads\Sad Satan_AG3ma-5.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks for any installed AV software in registry
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3324
- - C:\Windows\SysWOW64\netsh.exe
    "netsh" firewall add allowedprogramC:\Users\Admin\AppData\Local\Temp\is-L8QM94YD6N.tmp\qbittorrent.exe "qBittorrent" ENABLE
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:4680
- - C:\Users\Admin\AppData\Local\Temp\is-L8QM94YD6N.tmp\qbittorrent.exe
    "C:\Users\Admin\AppData\Local\Temp\is-L8QM94YD6N.tmp\qbittorrent.exe" magnet:?xt=urn:btih:B9B0594FA7605EA672E9A5FC0B14F99DE306965D
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious behavior: AddClipboardFormatListener
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:3936

C:\Users\Admin\Downloads\Sad Satan_AG3ma-5.exe
"C:\Users\Admin\Downloads\Sad Satan_AG3ma-5.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4716
- C:\Users\Admin\AppData\Local\Temp\is-7AOVU92BE0.tmp\Sad Satan_AG3ma-5.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-7AOVU92BE0.tmp\Sad Satan_AG3ma-5.tmp" /SL5="$B00D6,14880881,843264,C:\Users\Admin\Downloads\Sad Satan_AG3ma-5.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks for any installed AV software in registry
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:516
- - C:\Windows\SysWOW64\netsh.exe
    "netsh" firewall add allowedprogramC:\Users\Admin\AppData\Local\Temp\is-QT0AQEDJV9.tmp\qbittorrent.exe "qBittorrent" ENABLE
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:5016
- - C:\Users\Admin\AppData\Local\Temp\is-QT0AQEDJV9.tmp\qbittorrent.exe
    "C:\Users\Admin\AppData\Local\Temp\is-QT0AQEDJV9.tmp\qbittorrent.exe" magnet:?xt=urn:btih:B9B0594FA7605EA672E9A5FC0B14F99DE306965D
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: AddClipboardFormatListener
    PID:3292

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

Software Discovery

T1518

Security Software Discovery

T1518.001

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3c1c88a1dc8e5439a1a520e9db930955bf4755654f664147c54e6cba8b43ed4c
MD5 22184503a294aa98846d9a4c3975971b
SHA1 44809070563819cceeff10eeef861544783faf98
SHA512 5d29c381872b72159a2d05366e0578c0ad56eb5ef51240db505660b787e0b3b88212c74bad2c16783f95846d95fdad86172cdc01a84d34426cca804e937a679d
TLSH
T1F4D02B24B2AC7654E01A343C0114428C30CE5970140BB400805413940FC261201C4069
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2f67a665126f0d437497b394b50cc87ce72773b6abd85385bb78adf0ad326302
MD5 a98f4348736e1c7c5e70799864c15774
SHA1 fa2e3725e970aab935f77d155b649177f50be7d6
SHA512 c1dd68c743d45af6f713c7d8fade4a675abe4d224e86b956c5aaf959ccda0a92b9824b0e784a0ee9992843bfc2a7a73f85267479d6e5ffa0aa5827760492419d
TLSH
T19ED02B20B6A87654E006343C0114428C31CE5570140BB400809413A40FC261201C4069
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 0280bd1414ae5a9a0479f7096bf0e4f7b30c8ef098deee02db8d10f967834d66
MD5 9ba2b444399062aeb2c3334f160f302a
SHA1 da461226dde63b4c6050cc0b7652ac802ff02e88
SHA512 9b8cc7365c22a8cf83abca66cf726f0f6ab0305f1d534675b094b8b9fc0af3282685c4787a1f8bb0787d9cbe8074bef081f9c335bed5f2f60502890f979d2c33
TLSH
T14DE0DF8608CECA2EA74074CB51789F8DC2C1370FA3C8EB0A3740A884F201A80B6A2690
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 2b27e1cddaabfc7960ad62182c9290fbf1102f29dea3089e6766135c93e8b100
MD5 30c5dfe91b563eeef443da7cae9e7496
SHA1 6b2877685e6199aea371dfbe5ea75fda25d25f1c
SHA512 2057dfe19d994b7491c75c4ac739b3c8c2c748762425c012d8792488c77604cd73d247b09d9d758daf7f772a36e3fd7175403932e24b3ed4589e56dde5bed88f
TLSH
T127E02B6AC911EC3F08FD0B7954940745FB10236B2A419C4B3B3E81188FF55364599C6C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 c1031d7a700a564d29f479d438b204f487ad6fb4fbfdc50b7d35d480b65228c9
MD5 c34747b25fbafe10fd498877df221053
SHA1 320f675569134431ab6533fb34a3d866af04886e
SHA512 0ffb094595e732d89839c4195c984183d670b628c3e37ea602fef9d5389a155ad6dcefff521201d33750263e6a47c18a3c03ad971678ada86c647a54b19f53ca
TLSH
T10441CFF7C3E4856E890156F0A614AE1FDE2D0A14432C3D5AC9D4EF2BD3E3471E10165B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 aec8522d1d363119bc1522bf0acc1a2d0408aa0d3c60181d5ef39add4013fbb6
MD5 172e4734fc8fe79792954899e706bb9d
SHA1 fe3fc5c69198bb4c3967d93719388fd63134d3af
SHA512 9b992fd54f2bdde18a819bda68182c1983108a637969de1c8c9a4ce0734b95b21ba580f78d346ce975bac2e9803bb4d2a31f703aee0952c7d540218e4cf043ae
SSDEEP 192:sxZERI9Q/fYsbQZLX8OzodpLHW6+WNGYop2Sr0Ig5ZtoJ:sxZEoQ/fYsbOgVLHbGySMrtM
TLSH
T15132D8556E28A93B8CC7D219FB56BF53E7F91032A0D10E44AAFC8A1C15EB6DD120741F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 05302d4ee4e619722b0134dd90b00e1fbc750fe078cdc416db0f7729fbce0108
MD5 2946b4c0901450d23901e676f8181688
SHA1 f4cde4682491491a9644680fda9a6ed7aa34eff2
SHA512 8eddc140a710bbf667bb55cad38cca2a71c8ae55b340d4b4163752a2da49c75da366d615fff2dd9b844672d49efebed84be778348195af0a5470c0129f233953
SSDEEP 192:sxZERI9Q/fYs4aQZLX8OzodpLHW6+WNGYoo2Sr0Ig5ZtoJ:sxZEoQ/fYsxOgVLHbGzSMrtM
TLSH
T15132D8556E28A93B8CC7D219FB56BF53E7F9103290D10E44AAFC8A2C15EB6CD120741F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 308c102193ea6042c90a8bafcb19fd5a3ee5796b40f1a99b22a85cb3e879e3e3
MD5 345904bc0f8991d289aa802850545918
SHA1 475a88130750b126a91f49d16ec3986091d0b894
SHA512 f473dae7b4d6b7bcbad488ff7a744cbb075e11701259e5d2f2661039891bdfd8282ad64c5e96807475ba01cced1839d006370b875c409a9d1e83943a39f0c0da
SSDEEP 192:sxZERIjQ/fYsbQZLX8OzodpLHW6+WNGYoM82Sr0Ig5ZtoJ:sxZEeQ/fYsbOgVLHbGgSMrtM
TLSH
T1FC42C8556E28A93B8CC7D219FB567F53E7F91032A0D10E44AAFC8A1C15EB6DD120741F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 aab10f060a2a0519bd610b5732a95499161fe49e1d4d374e0445e82bbabd31ae
MD5 973ec20cb8dd12d8b1c445555e3a7135
SHA1 e9236f27211a39d4d583352580a3a12ab9ced71e
SHA512 4ff16f96225846daa9da2706ef480a731858cd7a0099ca6a93a0349039164554f7cd8ae59ceb0e1e2d1efa58706f9e0c99e140a420adb81177ed7caf39579b47
SSDEEP 192:sxZERI9Q/fYsHaQZLX8OzodpLHW6+WNGYoo2Sr0IgjtoJ:sxZEoQ/fYs6OgVLHbGzSMjtM
TLSH
T10332D8556E28A93B8CC7D219FB56BF53E7F9503290D10E48AAFC8A2C15EB6CD120741F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 24KB
SHA256 7f0269cda2282ba48b3233e913befd6368f1fc819a185dcf0e20ddf809a25f8b
MD5 3a92654a057dcf749516eb51943a5019
SHA1 f6322f1e90bae028e86d61dc4aa1d68e38a7aa75
SHA512 000b52d66b91d587709aaad763738dc0ad82f3cdeb68bdf22c4eddedcd771434ddd9358771fccfc913e2f9407135e1698d0fe08f74961fe73b1b15274694e996
SSDEEP 192:ST/2dXOJhJlpfnpp3tNXVrN3w+Z6eME0DE/eeuT04vG+no+nFLBg:SL29ObJffppdNlrtqfLC
TLSH
T1BDB2345571BB021039FE391892B6976E068231733119E62B7FBD00B68E6BF085DFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

fbc3a28c-626a-4f0d-99b5-79eb8ea10047.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\fbc3a28c-626a-4f0d-99b5-79eb8ea10047.tmp
Size 27KB
SHA256 b889e5382c9e415bcf4e5e68d2959c49597a0b5dcecea8a5067e3c14924f16f9
MD5 355b4edfda2a0287b0e92e6bb13bfc45
SHA1 654be442ee8176e74f3cbcc353b26ad58f0793b3
SHA512 d5ac6b4b1c43a1693926a1f4b0344b0e9c9c7b4f201b20fbb4e5c9a919e780eab5d79897f6e3aca7afe239b52cbfa08377837a95a157097e70915d91fefeb0cb
SSDEEP 768:Px6r8j+WviyUK8F1+UoAYDCx9Tuqh0VfUC9xbog/OVXpLlvVajYroorbgnov:Px6r8j+WviyUKu1jaqpLd4jjovgK
TLSH
T1D4C2E93B640CCB7E4FC41E9DDC1A6F972D9802C796588D408BFA954C02C77EA912A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 919cd6228099ce61ce878d445f22122d9b92ce230d733ea6291bb4290f67f073
MD5 ee84976c383b0b8fc55b0a043f0bb46f
SHA1 a488b463a125d5e5006af34adadfc881df5a31cf
SHA512 6cb01f379372126c9157ecc9837fbb05e5bc2a422cef31ab8d270c83d96336598be80fe9a5bec9dc98f971ccca752c365d0e0fd51e08df5cf84c9eec00e543a1
SSDEEP 384:nGiFoZcI60sN68TUNTUlI4kaKMngww2fiBCauGlAbupm+7O6R2FeoGTgL/7IzKoV:tFWdLwgA6PBCaXWIm+7TRKK
TLSH
T1F6C25B72EC98D9ABEDE78AC5B74A3603EEF04153998C9AC4D9DC1D1D009B5DD030BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 68a1b77a3fe8d26f6ca8feba938fcdbec11841ecdeae8d2b2e35a03127188978
MD5 66fb1fa438eae54cc55c68c02483d318
SHA1 86e2718dd2d704a23cd07c89605ff16aa5ac59b6
SHA512 66e5b45c82376d76146ba54bbe3834a3e00553f9a2a2727860a4caa0abba5f6a3e41747fae705486958adb6b1ae5e0ec1ddd98f0a811b8c96eb7b406f3fc7c3b
SSDEEP 384:nwiFiZcID3sN68TUNTUlI4qaKMLKww2fiBCauGlAbu7i+sa+VYYrgL/7IzKoC:LFQD3Lwg6MPBCaXW4i+hgYJ
TLSH
T169C23972EC98D9ABEDE78BD5A74A7603EEF04163958C9AD4D9D81D1C009B1ED030BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 66f43136ff83790b79159d9d4926feef126c7360642e4dc75a5bbc0faa4bca2e
MD5 76d94ec647d3929eea624c06b4a6a4ca
SHA1 a5941348cd34c5bd6094151aa239059cd2f0b60f
SHA512 2b8658bc94259e1b23fe18605dfc25f64b8f9c6cc273eeb0cbebc1f884f9925cc92643a1160747fda5928f2b86a94a6b2cca51a53a185d14dd9f99c464f566db
SSDEEP 384:nGiFCZcI6wsNic8TUNTUlI44aKMXgww2fiBCauGlAbuQm+7O6R2FeoGTgL/7IzJK:tFwJTcwgOuPBCaXWFm+7TRJK
TLSH
T131C26B72EC98D9ABEDE78AC5B74A3A03EEF04153998C9AC4D9DC1D1D009B5DD030BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 1c9ac4cf8b0bc514effec2cdfa3cf27b813eb1e0a495694481ef57b9fa601489
MD5 2115b4d9f6de748c8cfc87a75e930f19
SHA1 3cef8b89760728672daa8d7b6551d91b25bae2fe
SHA512 c2ccd06cbc3b79e636f024504d8e8644cf765e9e74d6d36c90af5a5f4f3227f18e90c43e49c66b79395d11c0323ed3c9b4d79a875ea860c6fea433f95d331b0b
SSDEEP 384:n7iFiZcI63sNq8TUNTUlImZaKMiK4w2fiBCauGlAiFHsa+VYYrgL/7IzdoC:WFQ63Dwg/xnBCaXHFHhgPJ
TLSH
T1B1C24B36EC98D9ABE9FB8FDAAB4A7603EEF00153959C95D4D9D81C1D00971DD0307C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 0b98cabffdb8adc566d699ff25da4b3a26ee861e796e4f7d3c058c571ce149bd
MD5 fdb003876296320a74429319fc4fcaca
SHA1 5683d8635998f3e8cb957480c82ba6c935e89e61
SHA512 f99bcb02d3592b9423b0741eb8601d7ad397417b1587d35dbbbe6899dd3d19e22b85dcfb7d1aa18ddd8cb62089faf1cd1b8d601477d27a1b13f3785e7f4aaae1
TLSH
T16C410B68B6F91108B3B76E5A9BF7A86D487EB9772E07C45D00110E4F0B66A40C8A2737
MD5 SHA1 SHA512 TLSH

Submit Download

Avast_One.png

Path C:\Users\Admin\AppData\Local\Temp\is-L8QM94YD6N.tmp\Avast_One.png
Size 42KB
SHA256 2ddd50ca3bb30387c309b0a627cc14f2820352679caa1d59f0dd35aed9540453
MD5 faff96fb8080a98bd1def3c4f9cce9c1
SHA1 466c66dfaed49d93dd7d8a1e42919a4f03613efa
SHA512 ad87ccc0bcb0115d5e7255935c5bd2b5eeb85b75f46206987d85f0f5e04afce054b0b3cee3d7577039db6ddbff1f0fdfdca657b7877376e4f97c80c5ed7514b7
SSDEEP 768:53E5YnNz2SLHvDYgWfGHV8L77Yy/oksC+x8+RfWpzrdYnsi2anUpMQb3HGJ2:536Ynl2SLrYHAWHDgEqCSskn0nqA
TLSH
T11613F1B8B8DE416DDDDED6B8FCE66FF564816437CC84D1EA800CB028518E784366636B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperaGX.png

Path C:\Users\Admin\AppData\Local\Temp\is-L8QM94YD6N.tmp\OperaGX.png
Size 152KB
SHA256 2f116cdef55e05549d6f06913afe39a91b715b188e110188c7fbf7f5eb69b318
MD5 4e2421d76f1b0c5627f732d4e945a023
SHA1 89e3de5bcbfe50c18f17b5ee731dd24213f1812d
SHA512 13c97b5ec52344b605d1b9658dbe15ca05841fdb786f2e06ab52a4f80ca6398adfa7c0dda304ec343ab733df85d9a9da29012ac21d96e680a19ecbbfeb0b9001
SSDEEP 3072:zkL8PqE1l4NJoxLiog7R+1tNx+ZEaLbplAfkFO/lb95N:zFowWo7tv8bpyp9j
TLSH
T138E3121A702324BAB44EF4D6F1DB65C2EC22AAFD214D10A7D79A5C7428C0B66FC5D2C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WebAdvisor.png

Path C:\Users\Admin\AppData\Local\Temp\is-L8QM94YD6N.tmp\WebAdvisor.png
Size 33KB
SHA256 494169cdd9c79eb4668378f770bfa55d4b140f23a682ff424441427dfab0ced2
MD5 db6c259cd7b58f2f7a3cca0c38834d0e
SHA1 046fd119fe163298324ddcd47df62fa8abcae169
SHA512 a5e8bb6dc4cae51d4ebbe5454d1b11bc511c69031db64eff089fb2f8f68665f4004f0f215b503f7630a56c995bbe9cf72e8744177e92447901773cc7e2d9fdbb
SSDEEP 768:ZH5cQCJvj3+2/C0clMzHBtHlRX6DVL8dT1DKSd:ZZPCJvj3rVcyzHBdls987DBd
TLSH
T1EDE2E056637B73B94E401FADAEF75A8FA9644282147F20B7EFA2D4027018E4CDF49807
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

finish.png

Path C:\Users\Admin\AppData\Local\Temp\is-L8QM94YD6N.tmp\finish.png
Size 2KB
SHA256 d573198f50546dc82c772ebae668e0ea98f32716ddb0e1c993cde183df04ecbd
MD5 36ce28c4d51d200fb4a94446a72fc299
SHA1 4a1b9613ba510ba7b097171cd151ba918bec330b
SHA512 c0b1f1a93319129134b6693dd2a3f8e5a8bd86dd3d2fea839aa4546dfc2a3156911f894940b2e6309c1078262cea0cc9ec6ab27e7778f2de631b0a3c80309603
TLSH
T100513CE10DC1EE84A2245AF54C2BEAA7A45B4DADCC0629CBB5DB50617C0CDD07D06B5A
MD5 SHA1 SHA512 TLSH

Submit Download

qbittorrent.exe

Path C:\Users\Admin\AppData\Local\Temp\is-L8QM94YD6N.tmp\qbittorrent.exe
Size 30.4MB
SHA256 aa61eb930b40f90ae5afda838d4b0c441160ca1e18a032dc5c2597abb980d2e5
MD5 00382da16223e19de5d3e6f6e9d8db19
SHA1 fe20004b008583d94fc8673fce99be6a28349f06
SHA512 250011cda64fccd54bcd0dde75e9672240cfec7e87f090eb67ddb6882d44458d7a16bcb2a58b96cfb5438e7dc8f2935bda1078783d56ba868807013a03807a64
SSDEEP 786432:OhgfXLovSpkj+UO5E7YJRASqdEg36yCu:OhULA+UO5E7YbASq/36y9
TLSH
T169678E85B2E001A0E176D1748D2B916FF6B27A9607B0ABDF339497590F27FE05E3A305
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zbShieldUtils.dll

Path C:\Users\Admin\AppData\Local\Temp\is-L8QM94YD6N.tmp\zbShieldUtils.dll
Size 2.0MB
SHA256 5e6530cd6b60470f7ef70a2a645d18d629875285b597c23e04da622cb96973ed
MD5 8e1406b88bcac4bd2691e6526aff021b
SHA1 af060e6903798f4cbc213ecf84bb38b15f2c3d56
SHA512 ad7f7d24f24679c80f0aaeff197d485e52a8ca2bfdf30b2946e8188f142b28e8b34aca0495fdb52ca9ea91643c30209965810f68b85e8c2326b1cf765f4da44e
SSDEEP 49152:7PIy3/h44bleO/ZR/JVIj6RASMCQWoYrQ6/yAZFotEA:7D/G0sO/bJVIj2jMCQWoCQ6/y2E
TLSH
T107958F137650402FE21B1E355A3BB328FABDA57007F545C33ED4AA192D314839E6F6AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Sad Satan_AG3ma-5.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-P807D0YC9M.tmp\Sad Satan_AG3ma-5.tmp
Size 4.1MB
SHA256 dc8c86bf2ce73f88cf48d7e94f73940906b08cabaed05b6789616411d3ecf0f3
MD5 593f58b165919a81a92ffe18b3d70850
SHA1 42ec87a667bc98d6fc0b795c152206d0dcab30a4
SHA512 52397d4d731e1a49702cddc0b6e106304851b2d5af5c713698b9da1836707d58ced614921accabf5b7bb7f8d227bdfeed216f57d1dd92acf05cf6e47b462a141
SSDEEP 98304:DYU5hnuOajWwMPdCpepI3GrwrA+Jr333c:dxuHjWfZIzk
TLSH
T19B168F03B388753EE4671A3A583FA284983F7A213A26CD4F6BF40D5C8F395416D2A757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qbittorrent.log

Path C:\Users\Admin\AppData\Local\qBittorrent\logs\qbittorrent.log
Size 2KB
SHA256 5f8d3e17ca5b94d7664188a7af4dd84556ec8b91fa2620318d7addeee4f3c41d
MD5 7973a23284c952ebb78a0e6d14e73626
SHA1 9839620ca66bad00d72267820a6176d1c388fa72
SHA512 51dc07037b74cf117030056f8134cf5d5b6f2985c0804e9cf27f693a37f90268390f54641f5c637802716ab5f0a327097dd7f5a5d25a979857ba3d41727d0dc8
TLSH
T1834129392D3B52883AD549C2EC111B9F6761F113B286BE187BCD17D47502629FFF2098
MD5 SHA1 SHA512 TLSH

Submit Download

qBittorrent.ini

Path C:\Users\Admin\AppData\Roaming\qBittorrent\qBittorrent.ini
Size 1KB
SHA256 d4232c2ec9e1ead513cf3a7f9a9596a70e9c9514b451dcca9d8187aed8e347e7
MD5 2be96828f64bffbee5004bd2f8d10a77
SHA1 c1d069ec6ba4ab902f0227540c65360d5b91a044
SHA512 b50b8c529d01999aada4a852dd204d2c2775d50de9bd48790fcd421a80e8cb8769942b6e5c8cde8df912afbf81c616b0ef99ee53a2093afc5517adc10dc7767b
TLSH
T125413022D3087269C4DCC3140FF8CB6BA277890DE454F0079E447656EE4CBE816ACCD6
MD5 SHA1 SHA512 TLSH

Submit Download

watched_folders.json

Path C:\Users\Admin\AppData\Roaming\qBittorrent\watched_folders.json
Size 4B
SHA256 d914176fd50bd7f565700006a31aa97b79d3ad17cee20c8e5ff2061d5cb74817
MD5 5b76b0eef9af8a2300673e0553f609f9
SHA1 0b56d40c0630a74abec5398e01c6cd83263feddc
SHA512 cf06a50de1bf63b7052c19ad53766fa0d99a4d88db76a7cbc672e33276e3d423e4c5f5cb4a8ae188c5c0e17d93bb740eaab6f25753f0d26501c5f84aeded075d
MD5 SHA1 SHA512

Submit Download

Sad Satan_AG3ma-5 (1).exe.crdownload

Path C:\Users\Admin\Downloads\Sad Satan_AG3ma-5 (1).exe.crdownload
Size 15.4MB
SHA256 a885897d753cda6f3bbeb4f953e58a4d8f6184953fc1d17bedb6ba3e44d57612
MD5 3dc1449c1cd40e994d9ae71b4e5c427e
SHA1 62555629d0a7f0c1d5d95ace3df253e7f3c38761
SHA512 c3778b9ae17423c2786ab887a5f274e8524130b4fad2f57ab318ef78759a6f2ed21b338ce87b662af0c782a3015618aea91ffb85b9072a24bbb7cb58f581ebb7
SSDEEP 393216:/nPWVMwFVkQYS9Hq011WbqjOw29Wjyv0D0jSs:3IMwFtf9K011WdLSs
TLSH
T1A3F6333FF28B653DE06A6A3AB9B2D201593BB65075524C52D6E4C49CCF260B01E3F787
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Sad Satan_AG3ma-5.exe.crdownload

Path C:\Users\Admin\Downloads\Sad Satan_AG3ma-5.exe.crdownload
Size 15.4MB
SHA256 1163ff48a24baf9624f28990ce32ff2bc3701446254c179b654688fee7824639
MD5 e4bd5306007e6c908c32af771c98ea87
SHA1 a514cd7e1e073f61262bad49fb9efdef7a14de30
SHA512 e4cd38cf0e1eecc869fb34b1e59b53aa7e82431df30e3bee862448c429a5b251cccd5c081daef1558d8a8c39205324c08a956d1832cd494f7b183b22aef9c4c4
SSDEEP 393216:OJPWVMwFVkQYS9Hq011WbqjOw29Wjyv0D0DSF:sIMwFtf9K011WdrSF
TLSH
T1AEF6333FF28B653DE16A6A3AB9B2D201593BB65075524C42D6E4C49CCF260B01E3F787
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/516-460-0x0000000002D20000-0x0000000002E60000-memory.dmp

Download

memory/516-483-0x00000000000D0000-0x0000000000507000-memory.dmp

Download

memory/516-442-0x0000000002D20000-0x0000000002E60000-memory.dmp

Download

memory/516-430-0x0000000002D20000-0x0000000002E60000-memory.dmp

Download

memory/516-437-0x00000000000D0000-0x0000000000507000-memory.dmp

Download

memory/516-435-0x0000000002D20000-0x0000000002E60000-memory.dmp

Download

memory/936-281-0x0000000000CA0000-0x0000000000D7C000-memory.dmp

Download

memory/936-348-0x0000000000CA0000-0x0000000000D7C000-memory.dmp

Download

memory/936-262-0x0000000000CA0000-0x0000000000D7C000-memory.dmp

Download

memory/2592-200-0x000001EF309B0000-0x000001EF319B0000-memory.dmp

Download

memory/3324-345-0x0000000000F70000-0x00000000013A7000-memory.dmp

Download

memory/3324-347-0x0000000000F70000-0x00000000013A7000-memory.dmp

Download

memory/3324-339-0x0000000002DD0000-0x0000000002F10000-memory.dmp

Download

memory/3324-328-0x0000000002DD0000-0x0000000002F10000-memory.dmp

Download

memory/3324-323-0x0000000000F70000-0x00000000013A7000-memory.dmp

Download

memory/3324-322-0x0000000002DD0000-0x0000000002F10000-memory.dmp

Download

memory/3324-308-0x0000000002DD0000-0x0000000002F10000-memory.dmp

Download

memory/3324-282-0x0000000000F70000-0x00000000013A7000-memory.dmp

Download

memory/4716-406-0x0000000000CA0000-0x0000000000D7C000-memory.dmp

Download

memory/4716-436-0x0000000000CA0000-0x0000000000D7C000-memory.dmp

Download

memory/4716-484-0x0000000000CA0000-0x0000000000D7C000-memory.dmp

Download