hxxps://gofile[.]io/d/5bgoSRqU

Analysis

user interaction
yes
max time kernel
367s
max time network
386s
platform
windows11-21h2_x64
resource
win11-20260911-en
resource tags

arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
03/10/2026, 14:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://gofile.io/d/5bgoSRqU
Sample261003-rvmvjsstdw

Score

8^/10

defense_evasion discovery persistence ransomware

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2322150968-3922673059-3248713381-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
43	656	msedge.exe

Executes dropped EXE 2 IoCs

pid	Process
4316	Built.exe
3648	Built.exe

Loads dropped DLL 15 IoCs

pid	Process
3648	Built.exe
3648	Built.exe
3648	Built.exe
3648	Built.exe
3648	Built.exe
3648	Built.exe
3648	Built.exe
3648	Built.exe
3648	Built.exe
3648	Built.exe
3648	Built.exe
3648	Built.exe
3648	Built.exe
3648	Built.exe
3648	Built.exe

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
27	api.gofile.io
24	api.gofile.io
25	api.gofile.io

Enumerates connected drives 3 TTPs 4 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\D:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe
	\??\D:\	explorer.exe
	\??\F:\	explorer.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Built.exe:Zone.Identifier	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Built.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Built.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
656	msedge.exe

Checks SCSI registry key(s) 3 TTPs 58 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities	explorer.exe

Enumerates system info in registry 2 TTPs 5 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	SearchHost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	SearchHost.exe

Modifies registry class 43 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2322150968-3922673059-3248713381-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2322150968-3922673059-3248713381-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2322150968-3922673059-3248713381-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\PersistedTitleBarData\Microsoft.MicrosoftStickyNotes_8wekyb3d	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2322150968-3922673059-3248713381-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2322150968-3922673059-3248713381-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\bing.com	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2322150968-3922673059-3248713381-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify\UserStartTime = "134336231246632169"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2322150968-3922673059-3248713381-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify\PastIconsStream = 1400000005000000010001000300000014000000494c200603000400540010001000ffffffff2110ffffffffffffffff424d36000000000000003600000028000000100000004000000001002000000000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000b8b8b8efc4c4c4ffc4c4c4ffc4c4c4ffc4c4c4ffc4c4c4ff6c6c6c864d4d4d637c7c7cd6838383fd838383fd7c7c7cd64c4c4c636464647f0000000000000000c4c4c4ffc4c4c4ffc4c4c4ffc4c4c4ffc4c4c4ff8f8f8fb64d4d4d64818181fa8f8f8ffe828282ff828282ff909090fe818181fa4e4e4e650000000000000000a2a2a2ffa2a2a2ffa2a2a2ffa2a2a2ffa2a2a2ff4646465a7c7c7cd5939393fdffffffff9b9b9bffb3b3b3ffffffffff858585ff7c7c7cd5aaaaaaefb5b5b5ffb5b5b5ffb5b5b5ffb5b5b5ffb5b5b5ffb5b5b5ff3636363a818181fc828282ffa9a9a9ffffffffffffffffff949494ff828282ff818181fcb5b5b5ffb5b5b5ffb5b5b5ffb5b5b5ffb5b5b5ffb5b5b5ffb5b5b5ff36363639818181fc828282ffa9a9a9ffffffffffffffffff949494ff828282ff818181fcb5b5b5ffb5b5b5ffc3c3c3fff6f6f6fffffffffffffffffff6f6f6ff4d4d4d5a7c7c7cd5939393fdffffffff9b9b9bffb3b3b3ffffffffff858585ff7c7c7cd5b5b5b5ffb5b5b5fff6f6f6fffafafaffccccccffccccccfffafafaffa9a9a9b74b4b4b60828282f98f8f8ffd828282ff828282ff909090fd828282f94d4d4d62b5b5b5ffb5b5b5ffffffffffdadadaffb5b5b5ffb5b5b5ffdadadaffffffffff656565864b4b4b607a7a7ad4818181fc818181fc7a7a7ad44c4c4c6266666686b5b5b5ffb5b5b5ffffffffffdadadaffb5b5b5ffb5b5b5ffdadadaffffffffffb6b6b6ff858585b64444445936363638363636384d4d4d5a8b8b8bb78a8a8adfb5b5b5ffb5b5b5ffecececfffafafaffccccccffc7c7c7fff6f6f6fff6f6f6ffb5b5b5ffb5b5b5ffa9a9a9ffd3d3d3ffd3d3d3ffd3d3d3ffd3d3d3ff00000000b5b5b5ffb5b5b5ffc3c3c3fff1f1f1fffffffffffffffffff6f6f6ffc3c3c3ffb5b5b5ffb5b5b5ffa9a9a9ffd3d3d3ffd3d3d3ffd3d3d3ffd3d3d3ff00000000b5b5b5ffb5b5b5ffb5b5b5ffb5b5b5ffb9b9b9ffbebebeffb5b5b5ffb5b5b5ffb5b5b5ffb5b5b5ffacacacffd3d3d3ffd3d3d3ffd3d3d3ffd3d3d3ff00000000aaaaaaefb5b5b5ffb5b5b5ffb5b5b5ffb5b5b5ffb5b5b5ffb5b5b5ffb5b5b5ffb5b5b5ffb7b7b7ffd3d3d3ffd3d3d3ffd3d3d3ffd3d3d3ffd3d3d3ff00000000000000000000000000000000c4c4c4ffc4c4c4ffc4c4c4ffc4c4c4ffc4c4c4ffc4c4c4ffd3d3d3ffd3d3d3ffd3d3d3ffd3d3d3ffd3d3d3ffd3d3d3ff00000000000000000000000000000000c4c4c4ffc4c4c4ffc4c4c4ffc4c4c4ffc4c4c4ffc4c4c4ffd3d3d3ffd3d3d3ffd3d3d3ffd3d3d3ffd3d3d3ffd3d3d3ff00000000000000000000000000000000a9a9a9efb4b4b4ffb4b4b4ffb4b4b4ffb4b4b4ffb4b4b4ffb8b8b8ffb8b8b8ffb8b8b8ffb8b8b8ffb8b8b8ffacacacef000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005000000420000002a000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000004c000000ae0000004200000000000000000000001000000075000000c3000000cb000000cb000000cb000000cb000000cb000000cb000000cb000000cb000000cb0000006a0000001e0000000000000005010101a5232323f28b8b8bf9c9c9c9fee3e3e3fee3e3e3fee3e3e3fee3e3e3fee0e0e0fea1a1a1fe080808f4131315624f4f5aad060609d9000000180000007a1f1f1ff5989898f3dbdbdbfce3e3e3fee3e3e3fee3e3e3fee3e3e3fedfdfdffe9c9c9cfe1b1b1bda1c1c1c66969696a8d6d6d6fa535353f2000000b9000000ec5b5b5bf6999999f7adadadfcb3b3b3edd9d9d9fee3e3e3fee3e3e3fe9f9f9ffe1d1d1dd8292929749f9f9fb7cdcdcdf9b7b7b7f6848484f6000000f7000000ff7b7b7bfe979797fe979797fe979797fa9d9d9df9adadadf09a9a9afb0f0f0feb2121216b989898bab0b0b0ecb1b1b1fcb0b0b0fd888888fe000000fe000000f86c6c6cfb979797fe979797fe979797fe949494fe6a6a6afe090909eb10101065858585b0aeaeaef6b0b0b0feafafaffea6a6a6fd3f3f3fee000000bb0000009c2f2f2ff28a8a8afc979797fe959595fe696969fe131313d81212126c565656ab898989f5959595f9a1a1a1fe767676f53d3d3df8040404c6000000250000001a060606be303030f46b6b6bfa656565fe121212da17171774585858ba7e7e7efe7e7e7efe7e7e7efe797979fe0e0e0ee6000000840000002b00000000000000000000001e00000099050505f4050505f410101066585858b77d7d7dfc7e7e7efe7e7e7efe7e7e7efe1f1f1fed000000b90000000c0000000000000000000000000000000300000049000000cb0000004e191919a15b5b5bfc686868f8686868f85f5f5ffb222222ee000000ca0000001e000000000000000000000000000000000000000900000067000000490000000500000072010101ae0e0e0ecd0e0e0ece020202b6000000830000001e000000000000000000000000000000000000000000000000000000090000000300000000000000040000001900000030000000310000001f000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005000000420000002a000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000004c000000ae0000004200000000000000000000001000000075000000c3000000cb000000cb000000cb000000cb000000cb000000cb000000cb000000cb000000cb0000006a0000001e0000000000000005010101a5232323f28b8b8bf9c9c9c9fee3e3e3fee3e3e3fee3e3e3fee3e3e3fee0e0e0fea1a1a1fe080808f4131315624f4f5aad060609d9000000180000007a1f1f1ff5989898f3dbdbdbfce3e3e3fee3e3e3fee3e3e3fee3e3e3fedfdfdffe9c9c9cfe1b1b1bda1c1c1c66969696a8d6d6d6fa535353f2000000b9000000ec5b5b5bf6999999f7adadadfcb3b3b3edd9d9d9fee3e3e3fee3e3e3fe9f9f9ffe1d1d1dd8292929749f9f9fb7cdcdcdf9b7b7b7f6848484f6000000f7000000ff7b7b7bfe979797fe979797fe979797fa9d9d9df9adadadf09a9a9afb0f0f0feb2121216b989898bab0b0b0ecb1b1b1fcb0b0b0fd888888fe000000fe000000f86c6c6cfb979797fe979797fe979797fe949494fe6a6a6afe090909eb10101065858585b0aeaeaef6b0b0b0feafafaffea6a6a6fd3f3f3fee000000bb0000009c2f2f2ff28a8a8afc979797fe959595fe696969fe131313d81212126c565656ab898989f5959595f9a1a1a1fe767676f53d3d3df8040404c6000000250000001a060606be303030f46b6b6bfa656565fe121212da17171774585858ba7e7e7efe7e7e7efe7e7e7efe797979fe0e0e0ee6000000840000002b00000000000000000000001e00000099050505f4050505f410101066585858b77d7d7dfc7e7e7efe7e7e7efe7e7e7efe1f1f1fed000000b90000000c0000000000000000000000000000000300000049000000cb0000004e191919a15b5b5bfc686868f8686868f85f5f5ffb222222ee000000ca0000001e000000000000000000000000000000000000000900000067000000490000000500000072010101ae0e0e0ecd0e0e0ece020202b6000000830000001e000000000000000000000000000000000000000000000000000000090000000300000000000000040000001900000030000000310000001f00000006000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000424d3e000000000000003e0000002800000010000000400000000100010000000000000100000000000000000000000000000000000000000000ffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000c0000000c0000000c000000000000000000000000000000000000000000000000000000000010000000100000001000000010000e0010000e0010000e0010000ffff0000fff90000fff10000c001000080000000000000000000000000000000000000000000000080010000c0030000c0070000c80f0000ffff0000ffff0000ffff0000fff90000fff10000c001000080000000000000000000000000000000000000000000000080010000c0030000c0070000c80f0000ffff0000ffff000000000000000000000000000000000000000000000000010000000800000003000000040000002c000000010000000000000001000000000000000100000000000000	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2322150968-3922673059-3248713381-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2322150968-3922673059-3248713381-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2322150968-3922673059-3248713381-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2322150968-3922673059-3248713381-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "5435"	SearchHost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2322150968-3922673059-3248713381-1000\{1AD7F190-A3E7-4D07-83B2-BA2B961EF6ED}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2322150968-3922673059-3248713381-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2322150968-3922673059-3248713381-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2322150968-3922673059-3248713381-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2322150968-3922673059-3248713381-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2322150968-3922673059-3248713381-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2322150968-3922673059-3248713381-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "23"	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2322150968-3922673059-3248713381-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2322150968-3922673059-3248713381-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\PersistedTitleBarData	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2322150968-3922673059-3248713381-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2322150968-3922673059-3248713381-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2322150968-3922673059-3248713381-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2322150968-3922673059-3248713381-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2322150968-3922673059-3248713381-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\PersistedTitleBarData\Microsoft.MicrosoftStickyNotes_8wekyb3d = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2322150968-3922673059-3248713381-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2322150968-3922673059-3248713381-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "8530"	SearchHost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2322150968-3922673059-3248713381-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2322150968-3922673059-3248713381-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\ApplicationFrame\Microsoft.Windows.PeopleExperienceHo = 6801000088020000	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2322150968-3922673059-3248713381-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2322150968-3922673059-3248713381-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2322150968-3922673059-3248713381-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "23"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2322150968-3922673059-3248713381-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "5435"	SearchHost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2322150968-3922673059-3248713381-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify\IconStreams = 14000000070000000100010006000000140000007b00360051003800300039003300370037002d0036004e00530030002d003400340034004f002d0038003900350037002d004e00330037003700330053003000320032003000300052007d005c005a007600700065006200660062007300670020004200730073007600700072005c0065006200620067005c00420073007300760070007200310036005c0042004800470059004200420058002e0052004b00520000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000393000000000000000000000ea0709004200680067007900620062007800200076006600200070007900620066007600610074000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000200000000000000000000000000000000000000000000000000000000000000e105f2871942dd0181d2cc391a42dd01000000005a0076007000650062006600620073006700200042006800670079006200620078000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000200000050003a005c00480066007200650066005c004e0071007a00760061005c004e006300630051006e0067006e005c005900620070006e0079005c005a00760070006500620066006200730067005c00420061007200510065007600690072005c00420061007200510065007600690072002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f50100000000000000000000ea070900420061007200510065007600690072000a00410062006700200066007600740061007200710020007600610000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000000000000000000000000000000000000000000000000000000000082f3ce971742dd0100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000ea070900000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff75ae2078e323294282c1e41cb67d5b9c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000ea070900000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff81ae2078e323294282c1e41cb67d5b9c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000ea070900000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff82ae2078e323294282c1e41cb67d5b9c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000ea070900000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff83ae2078e323294282c1e41cb67d5b9c00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2322150968-3922673059-3248713381-1000_Classes\Local Settings\MuiCache	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2322150968-3922673059-3248713381-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2322150968-3922673059-3248713381-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2322150968-3922673059-3248713381-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2322150968-3922673059-3248713381-1000\{C3B48AE7-5611-4273-B1D6-EBAE8747E94B}	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2322150968-3922673059-3248713381-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2322150968-3922673059-3248713381-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\www.bing.com	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2322150968-3922673059-3248713381-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "3118"	SearchHost.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Built.exe:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4344	msedge.exe
4344	msedge.exe
2716	explorer.exe
2716	explorer.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe

Suspicious use of AdjustPrivilegeToken 44 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2716	explorer.exe
Token: SeCreatePagefilePrivilege	2716	explorer.exe
Token: SeShutdownPrivilege	2716	explorer.exe
Token: SeCreatePagefilePrivilege	2716	explorer.exe
Token: SeShutdownPrivilege	2716	explorer.exe
Token: SeCreatePagefilePrivilege	2716	explorer.exe
Token: SeShutdownPrivilege	2716	explorer.exe
Token: SeCreatePagefilePrivilege	2716	explorer.exe
Token: SeShutdownPrivilege	2716	explorer.exe
Token: SeCreatePagefilePrivilege	2716	explorer.exe
Token: SeShutdownPrivilege	2716	explorer.exe
Token: SeCreatePagefilePrivilege	2716	explorer.exe
Token: SeShutdownPrivilege	2716	explorer.exe
Token: SeCreatePagefilePrivilege	2716	explorer.exe
Token: SeShutdownPrivilege	2716	explorer.exe
Token: SeCreatePagefilePrivilege	2716	explorer.exe
Token: SeShutdownPrivilege	2716	explorer.exe
Token: SeCreatePagefilePrivilege	2716	explorer.exe
Token: SeShutdownPrivilege	2716	explorer.exe
Token: SeCreatePagefilePrivilege	2716	explorer.exe
Token: SeShutdownPrivilege	2716	explorer.exe
Token: SeCreatePagefilePrivilege	2716	explorer.exe
Token: SeShutdownPrivilege	2716	explorer.exe
Token: SeCreatePagefilePrivilege	2716	explorer.exe
Token: SeShutdownPrivilege	2716	explorer.exe
Token: SeCreatePagefilePrivilege	2716	explorer.exe
Token: SeShutdownPrivilege	2716	explorer.exe
Token: SeCreatePagefilePrivilege	2716	explorer.exe
Token: SeShutdownPrivilege	2716	explorer.exe
Token: SeCreatePagefilePrivilege	2716	explorer.exe
Token: SeShutdownPrivilege	2716	explorer.exe
Token: SeCreatePagefilePrivilege	2716	explorer.exe
Token: SeShutdownPrivilege	2716	explorer.exe
Token: SeCreatePagefilePrivilege	2716	explorer.exe
Token: SeShutdownPrivilege	2716	explorer.exe
Token: SeCreatePagefilePrivilege	2716	explorer.exe
Token: SeShutdownPrivilege	2716	explorer.exe
Token: SeCreatePagefilePrivilege	2716	explorer.exe
Token: SeShutdownPrivilege	2716	explorer.exe
Token: SeCreatePagefilePrivilege	2716	explorer.exe
Token: SeShutdownPrivilege	2716	explorer.exe
Token: SeCreatePagefilePrivilege	2716	explorer.exe
Token: SeShutdownPrivilege	2716	explorer.exe
Token: SeCreatePagefilePrivilege	2716	explorer.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
1404	sihost.exe
2716	explorer.exe
2716	explorer.exe
2716	explorer.exe
2716	explorer.exe
2716	explorer.exe
2716	explorer.exe
2716	explorer.exe
2716	explorer.exe
2716	explorer.exe
2716	explorer.exe
2716	explorer.exe
2716	explorer.exe
2716	explorer.exe
2716	explorer.exe
2716	explorer.exe
2716	explorer.exe
2716	explorer.exe
2716	explorer.exe
2716	explorer.exe
2716	explorer.exe
2716	explorer.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
2716	explorer.exe
2716	explorer.exe
2716	explorer.exe
2716	explorer.exe
2716	explorer.exe
2716	explorer.exe
2716	explorer.exe
2716	explorer.exe
2716	explorer.exe
2716	explorer.exe
2716	explorer.exe
2716	explorer.exe
2716	explorer.exe
2716	explorer.exe
2716	explorer.exe
2716	explorer.exe
2716	explorer.exe
2716	explorer.exe
2716	explorer.exe
2716	explorer.exe
2716	explorer.exe
2716	explorer.exe
2716	explorer.exe
2716	explorer.exe
2716	explorer.exe
2716	explorer.exe
2716	explorer.exe
2716	explorer.exe
2716	explorer.exe
2716	explorer.exe
2716	explorer.exe
2716	explorer.exe
2716	explorer.exe
2716	explorer.exe
2716	explorer.exe
2716	explorer.exe
2716	explorer.exe
2716	explorer.exe
2716	explorer.exe
2716	explorer.exe
2716	explorer.exe
2716	explorer.exe
2716	explorer.exe
2716	explorer.exe
2716	explorer.exe
2716	explorer.exe
2716	explorer.exe
2716	explorer.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2716	explorer.exe
332	SearchHost.exe
1668	StartMenuExperienceHost.exe
2716	explorer.exe

Suspicious use of WriteProcessMemory 57 IoCs

description	pid	Process	procid_target
PID 4140 wrote to memory of 3692	4140	msedge.exe	83
PID 4140 wrote to memory of 4812	4140	msedge.exe	84
PID 4140 wrote to memory of 656	4140	msedge.exe	85
PID 4140 wrote to memory of 4812	4140	msedge.exe	84
PID 4140 wrote to memory of 4812	4140	msedge.exe	84
PID 4140 wrote to memory of 568	4140	msedge.exe	87
PID 4140 wrote to memory of 568	4140	msedge.exe	87
PID 4140 wrote to memory of 332	4140	msedge.exe	88
PID 4140 wrote to memory of 332	4140	msedge.exe	88
PID 4140 wrote to memory of 332	4140	msedge.exe	88
PID 4140 wrote to memory of 228	4140	msedge.exe	89
PID 4140 wrote to memory of 228	4140	msedge.exe	89
PID 4140 wrote to memory of 228	4140	msedge.exe	89
PID 4140 wrote to memory of 1396	4140	msedge.exe	96
PID 4140 wrote to memory of 1396	4140	msedge.exe	96
PID 4140 wrote to memory of 1396	4140	msedge.exe	96
PID 4140 wrote to memory of 2888	4140	msedge.exe	92
PID 4140 wrote to memory of 2740	4140	msedge.exe	93
PID 4140 wrote to memory of 2888	4140	msedge.exe	92
PID 4140 wrote to memory of 2888	4140	msedge.exe	92
PID 4140 wrote to memory of 2740	4140	msedge.exe	93
PID 4140 wrote to memory of 2740	4140	msedge.exe	93
PID 4140 wrote to memory of 5080	4140	msedge.exe	94
PID 4140 wrote to memory of 5080	4140	msedge.exe	94
PID 4140 wrote to memory of 5080	4140	msedge.exe	94
PID 4140 wrote to memory of 1396	4140	msedge.exe	96
PID 4140 wrote to memory of 3200	4140	msedge.exe	97
PID 4140 wrote to memory of 1396	4140	msedge.exe	96
PID 4140 wrote to memory of 3200	4140	msedge.exe	97
PID 4140 wrote to memory of 3416	4140	msedge.exe	99
PID 4140 wrote to memory of 2648	4140	msedge.exe	100
PID 2648 wrote to memory of 3344	2648	msedge.exe	101
PID 4140 wrote to memory of 4076	4140	msedge.exe	102
PID 4140 wrote to memory of 4076	4140	msedge.exe	102
PID 4140 wrote to memory of 2492	4140	msedge.exe	103
PID 4140 wrote to memory of 2492	4140	msedge.exe	103
PID 4140 wrote to memory of 2492	4140	msedge.exe	103
PID 4140 wrote to memory of 4544	4140	msedge.exe	104
PID 4140 wrote to memory of 5012	4140	msedge.exe	105
PID 4140 wrote to memory of 4496	4140	msedge.exe	106
PID 4140 wrote to memory of 3272	4140	msedge.exe	107
PID 4140 wrote to memory of 4316	4140	msedge.exe	108
PID 4316 wrote to memory of 3648	4316	Built.exe	109
PID 4140 wrote to memory of 4600	4140	msedge.exe	110
PID 4140 wrote to memory of 4600	4140	msedge.exe	110
PID 4140 wrote to memory of 4344	4140	msedge.exe	112
PID 4140 wrote to memory of 4260	4140	msedge.exe	113
PID 4140 wrote to memory of 4260	4140	msedge.exe	113
PID 4140 wrote to memory of 1300	4140	msedge.exe	114
PID 4140 wrote to memory of 1300	4140	msedge.exe	114
PID 4140 wrote to memory of 4540	4140	msedge.exe	115
PID 4140 wrote to memory of 4540	4140	msedge.exe	115
PID 4140 wrote to memory of 1792	4140	msedge.exe	116
PID 4140 wrote to memory of 1792	4140	msedge.exe	116
PID 4140 wrote to memory of 1332	4140	msedge.exe	117
PID 4140 wrote to memory of 1332	4140	msedge.exe	117
PID 1404 wrote to memory of 2716	1404	sihost.exe	123

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://gofile.io/d/5bgoSRqU
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x258,0x7ff8035fc188,0x7ff8035fc194,0x7ff8035fc1a0
  2⤵
  PID:3692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1604,i,7771769423124390796,6861434269374427421,262144 --field-trial-handle=2176,i,15082706444178237071,7304860218901163340,262144 --variations-seed-version --mojo-platform-channel-handle=2172 /prefetch:2
  2⤵
  PID:4812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1804,i,9898695342782396142,12599326568253784221,524288 --field-trial-handle=2176,i,15082706444178237071,7304860218901163340,262144 --variations-seed-version --mojo-platform-channel-handle=2212 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1876,i,1977040322754394144,15678651927275941287,524288 --field-trial-handle=2176,i,15082706444178237071,7304860218901163340,262144 --variations-seed-version --mojo-platform-channel-handle=3068 /prefetch:13
  2⤵
  PID:568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3452,i,15585380499899894748,14808432676391320117,2097152 --field-trial-handle=2176,i,15082706444178237071,7304860218901163340,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3460,i,5518927042273327990,4125031223565706820,2097152 --field-trial-handle=2176,i,15082706444178237071,7304860218901163340,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4128,i,8512416131078375329,13253066045885704873,2097152 --field-trial-handle=2176,i,15082706444178237071,7304860218901163340,262144 --variations-seed-version --mojo-platform-channel-handle=4144 /prefetch:1
  2⤵
  PID:1396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4152,i,16688261252103392375,6000027562697909199,2097152 --field-trial-handle=2176,i,15082706444178237071,7304860218901163340,262144 --variations-seed-version --mojo-platform-channel-handle=4196 /prefetch:9
  2⤵
  PID:2888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4216,i,15684402088876353951,503752104702257141,2097152 --field-trial-handle=2176,i,15082706444178237071,7304860218901163340,262144 --variations-seed-version --mojo-platform-channel-handle=4456 /prefetch:1
  2⤵
  PID:2740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4244,i,5512553297023922778,12368766153964152578,2097152 --field-trial-handle=2176,i,15082706444178237071,7304860218901163340,262144 --variations-seed-version --mojo-platform-channel-handle=4448 /prefetch:9
  2⤵
  PID:5080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4276,i,15850501441297616473,4905976740792136787,524288 --field-trial-handle=2176,i,15082706444178237071,7304860218901163340,262144 --variations-seed-version --mojo-platform-channel-handle=3824 /prefetch:14
  2⤵
  PID:1396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4132,i,9586078331607805607,8324799265399542520,524288 --field-trial-handle=2176,i,15082706444178237071,7304860218901163340,262144 --variations-seed-version --mojo-platform-channel-handle=3844 /prefetch:14
  2⤵
  PID:3200
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6148,i,16881286390385179043,5579918790065647379,524288 --field-trial-handle=2176,i,15082706444178237071,7304860218901163340,262144 --variations-seed-version --mojo-platform-channel-handle=6164 /prefetch:14
  2⤵
  PID:4700
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6148,i,16881286390385179043,5579918790065647379,524288 --field-trial-handle=2176,i,15082706444178237071,7304860218901163340,262144 --variations-seed-version --mojo-platform-channel-handle=6164 /prefetch:14
  2⤵
  PID:3416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6252,i,13807675397924882503,6045750667472026734,524288 --field-trial-handle=2176,i,15082706444178237071,7304860218901163340,262144 --variations-seed-version --mojo-platform-channel-handle=6256 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2648
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1144
    3⤵
    PID:3344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6728,i,3040692056605068926,8540450151174890459,524288 --field-trial-handle=2176,i,15082706444178237071,7304860218901163340,262144 --variations-seed-version --mojo-platform-channel-handle=6724 /prefetch:14
  2⤵
  PID:4076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6688,i,12810976948670405012,11656259754148564812,2097152 --field-trial-handle=2176,i,15082706444178237071,7304860218901163340,262144 --variations-seed-version --mojo-platform-channel-handle=6580 /prefetch:1
  2⤵
  PID:2492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6172,i,14479737451411838718,297414642725062166,524288 --field-trial-handle=2176,i,15082706444178237071,7304860218901163340,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:14
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:4544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5056,i,15830180732950672134,14365798406821359514,524288 --field-trial-handle=2176,i,15082706444178237071,7304860218901163340,262144 --variations-seed-version --mojo-platform-channel-handle=5052 /prefetch:14
  2⤵
  PID:5012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5044,i,4797601552373225206,4989935141847381274,524288 --field-trial-handle=2176,i,15082706444178237071,7304860218901163340,262144 --variations-seed-version --mojo-platform-channel-handle=5048 /prefetch:14
  2⤵
  PID:4496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5032,i,16316570422410550252,10467144156985067614,524288 --field-trial-handle=2176,i,15082706444178237071,7304860218901163340,262144 --variations-seed-version --mojo-platform-channel-handle=5100 /prefetch:14
  2⤵
  PID:3272
- C:\Users\Admin\Downloads\Built.exe
  "C:\Users\Admin\Downloads\Built.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4316
- - C:\Users\Admin\Downloads\Built.exe
    "C:\Users\Admin\Downloads\Built.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Reads the TCP/IP host and domain name from the registry
    PID:3648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6576,i,17740947281961122979,3115156585728373324,524288 --field-trial-handle=2176,i,15082706444178237071,7304860218901163340,262144 --variations-seed-version --mojo-platform-channel-handle=4228 /prefetch:14
  2⤵
  PID:4600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4244,i,17158728392020482427,16140187558604193685,262144 --field-trial-handle=2176,i,15082706444178237071,7304860218901163340,262144 --variations-seed-version --mojo-platform-channel-handle=6524 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5404,i,16890244912464353409,2786643130319066423,524288 --field-trial-handle=2176,i,15082706444178237071,7304860218901163340,262144 --variations-seed-version --mojo-platform-channel-handle=6044 /prefetch:14
  2⤵
  PID:4260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6024,i,8295424701046125663,9300319420032808483,524288 --field-trial-handle=2176,i,15082706444178237071,7304860218901163340,262144 --variations-seed-version --mojo-platform-channel-handle=3392 /prefetch:14
  2⤵
  PID:1300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7540,i,3183759139177869688,7030344283392484312,524288 --field-trial-handle=2176,i,15082706444178237071,7304860218901163340,262144 --variations-seed-version --mojo-platform-channel-handle=7544 /prefetch:14
  2⤵
  PID:4540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5524,i,13607529316946535966,15680802220938365332,524288 --field-trial-handle=2176,i,15082706444178237071,7304860218901163340,262144 --variations-seed-version --mojo-platform-channel-handle=7520 /prefetch:14
  2⤵
  PID:1792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7748,i,16619526685956633558,12955138886150247850,524288 --field-trial-handle=2176,i,15082706444178237071,7304860218901163340,262144 --variations-seed-version --mojo-platform-channel-handle=7768 /prefetch:14
  2⤵
  PID:1332

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4408

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1404
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Enumerates connected drives
  - Checks SCSI registry key(s)
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:2716

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:332

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1668

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

13bfe7b6-c604-4ba4-994a-faae2386825b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\13bfe7b6-c604-4ba4-994a-faae2386825b.tmp
Size 8KB
SHA256 1d8c3b6e7f1b889a5aaf9b74eae1d3a5255329ad2740ba4995e90de25c2146cb
MD5 72828a8f1613add10d3395ff02ffd08e
SHA1 e132819bc41e0e796f04a6e8c890d9b334c20134
SHA512 c91f13485b27e2d2d5d5cccf17cba58828a80eaf9a5fbf9f3b7cc66dbb7bb5cd25e6d473413470b6c4f55aec1ec0d05c5a213733113c12c9936c92bbd515ef59
SSDEEP 192:9GNg6UbKQmiUysilWW9XPa4h/HEYe8wGPKIqEU6:9GNg6IGzoWkS4xsRqU6
TLSH
T1341209326874AC7F5DE2ED25B48735139E74812BDBC96F84D5ED2A1C05EB99C130B822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0714e6f61cb4ee87df081093ea45647348bd6b088c2ac1e6188d495c78e99d7e
MD5 2fe08827a42341294e10b9edd0b51268
SHA1 9825b24ae78e2cde9480297e7e4013d6c0959b16
SHA512 7a0465cafbdfbb547a5cef98322581d1e80a528dd4189337fb6b5b13ed414e2f42b21bf71aa7a23f7a751b405de9800d7ecb96c64b25f954ebb7a1f0780507ac
TLSH
T19CD0112AFA222E02E000E232802ABA82020080828C8208088A800222A8C2802882B22A
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a4da83f7c2db56b3b267d8673cd329c9ebe11518ed1355fee48e02e2eb7dc667
MD5 da5bf6bf079a2d0b72f1ba828bb869c4
SHA1 c5b477ca5fa0737bc5ec1d3971d7c5864a969233
SHA512 4bb0cdef8b5998fe4d7dca2c5da777f9d5541df6ec2a269e22d862e25cb11ad1dd6794d959246e60431138d67653ebeed6d6a8ad98885459f62f51a91e4f6048
TLSH
T17CD0222EFB232E02F800E332803CFB830200C0C3CC830A088E800222E8C38028C2B32F
MD5 SHA1 SHA512 TLSH

Submit Download

4d8904e9-3b4c-45d7-8ae4-42d10a46a7da.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4d8904e9-3b4c-45d7-8ae4-42d10a46a7da.tmp
Size 10KB
SHA256 6794752128692983d1a80f70d2c1ec5a5e4e7f2c5963af60ac27ca9fb72126b7
MD5 274478dac832b7c91b9789e532ef8688
SHA1 3e1d01463fdb0215384a26f8dfd2d2d66872dae2
SHA512 df5ead1027ccc74fec82965f2bb5881682c6efa4fa3c4e1955ffb1f209e8f21a9ddbe9e2678c0379e0479bf10fe13ec26f86e1045b633e2f2b8a5372f3cf7ffe
SSDEEP 192:sxZERNOS/fnsxY+OLIdpKlO/W6+WNe0VXY0CKTskIg5IJ:sxZEOS/fnsxY+Z5/b7X5PDm
TLSH
T18522D7116E24A57B8CC7E21DFA15BF53E5F95036A5911E4CEAFC861C08E7ADE220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6e289a05-accc-4772-b8f5-a3763a02eb28.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6e289a05-accc-4772-b8f5-a3763a02eb28.tmp
Size 24KB
SHA256 f5b7ba76caa541c4b7eb8223dcdb1ab80092768d077c70c0df3b0d7add81ea2e
MD5 f5964ba3488f4ce58a4f829571247a98
SHA1 c0b150d916442754bbcdcb5538a6c9690ff0e9cc
SHA512 057e11018447d31b455e24ed85143994381746e73d0c416d260cc9d4aed326d9c88c238308f3d2130290500becce2695196e54cf4bfa38bd04b08fa29b4a9fec
SSDEEP 384:sxZEOS/fnsxi66s8qMpRiYnazAW8pZS15posJWeT+4+ZL/b7X5bmk:sMOS/fEi4Mnc7WeT+4i/bL5bD
TLSH
T115B20705A924C87B9EC3AD18643C7E33D9EC506226C5DEDE1AECCA1C01AD1FDAB4B453
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

83dde01d-3b7e-4ee0-a684-7a44e2140225.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\83dde01d-3b7e-4ee0-a684-7a44e2140225.tmp
Size 9KB
SHA256 41ac064ae6e07f3157e0fb8358886590969634ec6750f01c883fdd726ebe899b
MD5 52e746e7572b07cc35f5ec35a4a2fd28
SHA1 a4dede797e04c7fe481dbc090542f76ff107cbba
SHA512 705d270dc9edef55756091588cc773875afb24d42ac5ea8ae885ca0ad7aaddb3f4f9b208899d7bdb2184399857e20385341bc1d64599102f86a5c90add8dab5f
SSDEEP 192:sxZERNbS/fnsZY+OLIdpKlO/W6+WNevo/Y0CjTskIgrJ:sxZEbS/fnsZY+Z5/bf/5ED9
TLSH
T13622D8516E24A57B8CC7E21DBB15BF13E5F95036A5D11E4CEAFC861C04E7ADE220B80B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9cb687a2-fe2b-4ca5-8774-4ab735abd6af.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9cb687a2-fe2b-4ca5-8774-4ab735abd6af.tmp
Size 10KB
SHA256 025c459f37d046a6fa7e33713e3ef445fe6765051e5f7d15892c09e23dbcd32e
MD5 e44e68800a71ab1f1299b30d149dd8c7
SHA1 ff9dc67d52661fee001f2d6e3a52956d7bcbab82
SHA512 beb4a92e87f0112022a2178c4026dc8de81cb5f198d42711d03895080d7da79acadb53bcb942e52a2a2e70c7b135357be11843244a1100ddd9ca68459f4521da
SSDEEP 192:sxZERNOS/fnsxE+OLIdpolO/W6+WNe0VXY0CiTskIg5qJ:sxZEOS/fnsxE+ZL/b7X5bDk
TLSH
T1AD22E9126E24A97B8CC7E21DFA15BF53E1F95032A5911E4CAAFCC61C05F7ADE220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG
Size 334B
SHA256 3a43596020a5aae507eabf2d792a1d79b57398ab23169315d4a621821a61268b
MD5 c79a110c3ac96d3e7349a4c6bf5b8a27
SHA1 00367bc52f6a71d16798387c723035fc24c6b577
SHA512 ff3c255e0f8e453fab2dca4ee0e45b03f6ad4ba40a885cc5feff93dd9fac38eacb968bf30bdc8e38c13839753e133d15489002ac4737cd760d2759f5cc4b626c
TLSH
T141E026ED2CCAC23EA26AE447017C638C83E13B2AEBC0BD0E1B00C5C97405050A2C3AE0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG
Size 331B
SHA256 c9d12a9a79327fd2694941a529ed75b858eb80b261cbebfaaa380b07cd38a760
MD5 cd8f50c9e388abff68f49633020e6a80
SHA1 031c529ce60f4f77e8109cb821e685c1c62cc0cb
SHA512 a187a0e383dd2ca8b55f92347c63bb7389b796019b2acb13091da4cf64c7a3ab623bf73714b3e289a9e01e7ff3f1c0bf814fac80b15362a43e8531e4adf713d2
TLSH
T1B9E026E82DCCC22FB3686647016C674C83F03A6EA3C4ED9E170CC6847489040B2C27A1
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 08a44c782d31aaf12f7db0c6b1debd19d659654e7cb30975b479e1af0fa0d61f
MD5 6bdae7effc7c0a9a471cb009df2ae306
SHA1 4e920f88f17c704b1715392bd262500f2b395e26
SHA512 4b03baaad49e79b5786103561844338341c9964648a883366b7d4126855d3e23ea079b8027037ea0f82222a02bb638906e4900308ad54a71c215ddd1173af2b3
TLSH
T11C81C380DB92E8E0E7694234A9C311963B30218478B7FF4FB3B8C5B9BF32749151E0A0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 60afbf1f578ac6da6d471d3507bcd604362bb995d3d7bff4118d99f1bfe911ff
MD5 3b06fb2d3ddb9c5423d3451d312e2f55
SHA1 9d0cb31b45f7a76aeffb9c98913d1b950c63f591
SHA512 a289554020a86ac73e77382b2be1b08591c6b7352cc9fc5109b1bc5fcb8a25453202ec52aca06fe1b2ba17b48ec3d543461153c0a55c561e295c45a905e5b968
TLSH
T139510B80CB93ECE5EB7D4778AEC011833630A19979871F43A3A8C5B8AB3675D655F074
MD5 SHA1 SHA512 TLSH

Submit Download

ec31778f-213f-42cc-a72e-c6233cedcc02.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\ec31778f-213f-42cc-a72e-c6233cedcc02.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

1dec90a8-4eff-4c2a-a337-71033f9754bb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\1dec90a8-4eff-4c2a-a337-71033f9754bb.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

46973797-9eac-4267-b2aa-77e71580f17a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\46973797-9eac-4267-b2aa-77e71580f17a.tmp
Size 1KB
SHA256 d6083819290b5a8bfcf39e2f9116f932dddb77f5b1c67ed0d73c0ccfb4560ed1
MD5 0451c49250e89eb9fc66c5cc2cb51b40
SHA1 4155ac21751c9e3a260c30dd79ca04962ab5f8f5
SHA512 8a1157868a81539fad41e0e77f3e152de26d902c72d177318184eaa3eea345a49565b44ff86224854f17669342d0ef3fb252b1d484d548ea34df75bbfc962eae
TLSH
T19121CCF383E5816EC92556F09A14AE2BDE1C0101832C3D2989D0AE2793E3471E00165F
MD5 SHA1 SHA512 TLSH

Submit Download

ba432f1e-9d47-493a-9fe1-a6e777c04b50.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\ba432f1e-9d47-493a-9fe1-a6e777c04b50.tmp
Size 1KB
SHA256 88b05646a17b31e01142704f1bff7856576fd594bb298281923c0caf7bb0f4e3
MD5 ff6d2a3d831b2220c5befe235d542906
SHA1 0e4a263cfc3b0dff2e0e8e0b55c5dbb17122bd4a
SHA512 74ce22054d61b3a00cf3fe90f650ad5505af17e467a58cb0bb0bef738fbf4088fe61b107889f703c23987c2f3f189e7a7c6e66c0ed0b3ac20237d123d0a02d01
TLSH
T18C31BBF383A595AEC92556F0AA14AE2BCE5C0015832C3D298AD0AE17A3E3431E141B5B
MD5 SHA1 SHA512 TLSH

Submit Download

cfc2801e-c640-4e64-9271-837325c035ab.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\cfc2801e-c640-4e64-9271-837325c035ab.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4864215f-0b24-4cbd-a3ff-92d7f219b3af\index-dir\temp-index
Size 552B
SHA256 dfd7db75b7070a91b199f004fc409316bc6b9e7a618fba56e6bab80fbebae116
MD5 8dcd806f7a344ae19a200c8f55df6053
SHA1 5e5d7d91c083a2aa99ddaf281453b2a172b47b22
SHA512 3db8842a2531377fceea9a266f5f1dc4c19beb550ea3ae5cb3ff3e6e2589717cf266826fafb787179a3beaba022b7dfe550f24060f5ee0674c38a9bc069b74ca
TLSH
T141F0ABDB2D238646EC080130203C68A256BA12DC2360BC0BB0FC80278C46748AD82AA0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4864215f-0b24-4cbd-a3ff-92d7f219b3af\index-dir\the-real-index
Size 552B
SHA256 b9cfcb5ed4b1247e6bf3226a3c0b463223b2251c7d36dafb7a25f5f89bf06dee
MD5 66381cfe5e47f7c2fc70e9396a143974
SHA1 2bc6f5df1e1f339cb06201f9af45c591c8b8a03d
SHA512 9d0243bac5ab84e3d7db4276cafcef0cc4e0d430972bdf5e79fec4c38a819b703e128cf56a497bc6760ae8ae6a00765244291a48382c39b1f963794e65046d2f
TLSH
T10EF0F19551138746F8080131B97D715561A51008B3503A4FF1E54025CC42B849D42BF1
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt.tmp
Size 371B
SHA256 11d7e41a545bc345ef0cbc75ab772b9e72e6cd4fd76b26ee1fa70eab1cd95c5e
MD5 902b5f02823dfa15d7ea8c28714cd82d
SHA1 c330a6236bd401d0160957c9e5f885ac429043da
SHA512 985b35ba093b1bd690c45ec16ac97993ead912e933f0de0f34a1073f51d4b99250828b2553fa11e7b98a3d8ab3bbbab1887b549c7dbce288e1d2e5b639516ab5
TLSH
T192E0C0F73E9B2C40FCAFC3CB10B1A472014178588104BC8E605952E351F2345346AC72
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 025a805f14a40ea57193185b7b46f074256ba75cd9a2a9e6887bdf03b0cc2e67
MD5 f09d874fb34f71b543837f98874d0393
SHA1 6b2e23e2e6f8703791bde9154672cbf52c457c36
SHA512 41e8c646f84c8f08f7f94011e5cea37fda7d6241189cb3bdbb3e9d0cbd153eaa101a378008e9256ad3e175b243d123949dfa59f5b92486051bf57c77d393ff25
SSDEEP 96:KMoAK9KyMVIR1DLL+1bOlzV+KrLzf+39VGPlfmBOKaIF:yXMVIR1DLLSbOFVVLzf+9VGPlf1E
TLSH
T1549120A1346A024539BD290C83AA871B52413173B55DF7EA3F7D00929A7BE085EFDDC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b003764f-e956-4256-bf89-d3554c88b0f0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b003764f-e956-4256-bf89-d3554c88b0f0.tmp
Size 28KB
SHA256 0f0634763c169484ecadf7fd278ca17f0ed9f011951b56eef794e5b9dfddfcf6
MD5 f6ca864ccf23ad32ee481ce09e3a42c9
SHA1 4b3bf9e824f352c483129315f86d183e84db243c
SHA512 e757aabe250acc754dd83194754a07438ac96b7b3c3f0db839eece55a47819fe01884fb95785c62c55bba890a59acc59bfc2ac16f13634ffecd07c7b9be7f8b9
SSDEEP 768:UYlTj8Gr2ymWRm+KQEC8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3MxLl/C80fL7roRj:UYlTj8Gr2ymWRm+KQECu1jaKMxLpCNf0
TLSH
T191D21B3F240CCB7E4FC01A9DDD566F976E9802C7A6688D4047FE994C02D77EA512A4CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b16f25ca-f842-48d2-abd2-dd00ce09b509.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b16f25ca-f842-48d2-abd2-dd00ce09b509.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c8a27990-cbbc-45d5-81c2-a882b9815cf7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c8a27990-cbbc-45d5-81c2-a882b9815cf7.tmp
Size 10KB
SHA256 50b8c9ad552dc933622c82b08090064eec8af7c5e8b9b0815e4efe09e45da215
MD5 b1704c20070b4b27d7c0f0260e26f8b5
SHA1 4626a391b9dbce8870a90fad42f690df546d29b4
SHA512 e9981e3b86e920403e089755880038deac293b678e195170b4909aa8323e5b4f65a2e3555a27853112330751078d4e342df0e1d28e52f543a443bfa8ce16870b
SSDEEP 192:sxZERNOS/fnsxE+OLIdpKlO/W6+WNe0VXY0CRTskIg5qJ:sxZEOS/fnsxE+Z5/b7X5WDk
TLSH
T11722C7516E24A97B8CC7E20DBB15BF53E5F95036A5911E4CAAFC861C04F7ACE220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e0fd5f5f-dbbe-456b-a587-03c43d155801.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e0fd5f5f-dbbe-456b-a587-03c43d155801.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

04a9aa48-f2ef-4e4c-9847-d7a273a4f00a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\04a9aa48-f2ef-4e4c-9847-d7a273a4f00a.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 eb24502a7ab815eafd6f3e2342654abfcb50ab897162dee3b7015d44384102cd
MD5 9ac8d7531f5aa05b04a4fac6dd84ef30
SHA1 99374d4e282e0e1151a66768bea97b5d765b7dc1
SHA512 77662d6636c0843f0fe5b66c38672e5d5c19b1cf43a6b641f5c16d2e86895dc495f87ad51394ff51bf18fad56f9adbc33c83bf4655ab34bf9b39d926d4b66fc9
SSDEEP 192:9GNU6UbxQmiUyYJpl+W9XPa4h/Yr53mLU6:9GNU6IPLJP+kS4O2LU6
TLSH
T18A02D73568687C7B9EF3AE15B58776139FB5112FDA952F84CAE81B1C00E768C1307932
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a86bddc5-179a-4224-bcb9-8ada569cadfe.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\a86bddc5-179a-4224-bcb9-8ada569cadfe.tmp
Size 26KB
SHA256 fd31dc8792da6e57ba050f74f59bd679df417d10c3ff7d4a432ae31de6792544
MD5 3a67a98a8a65763e0e68e14b25a61848
SHA1 9a07b0cc60719880ddeb5a25c4bcc991056f0241
SHA512 707b87e77093e0a347f593c5f044fccf16ab9c60967df7fcb7e7bd291f9dd2f888c9dc3a1969cc2fedfb1eacda7f3be5ee27cb3aa014ad56c6667ff0065d25bf
SSDEEP 384:++iFtZcIN8NX8TUNTUlIloq/+6X+TCK5S4xsHqtgOIwZOygLKoZ:+VF1N2wgbL6KqXsLGi
TLSH
T166C22AF248E7887ADCAE9B07A77D2D028E7CC067B5849A54B7D9561CCC961BFC30B811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b01313cb-c102-4f45-87b6-bb705810a506.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\b01313cb-c102-4f45-87b6-bb705810a506.tmp
Size 18KB
SHA256 df156f1d1d3ecf41821279c9de824db19d8a5969f2bd2bc2286f806d6a10b7a5
MD5 eceec56ee66e85436cb292cc2079fb2e
SHA1 df126298e64159292e5200823213cacdc48c2dec
SHA512 5f81fa66f0cdb1e863b2b573481648f65879ea24c4bd23dcf6915abd0681ad0c03263cd543b57b6946626f938f670c919f86be89ef4a7daa5992ea1e975ac1ee
SSDEEP 384:lMZcIh8NN3q/+6XdbTwK5S4xsDqtgOIwZOygLKoZ:laht26sqXsLGi
TLSH
T182828D325C789CBB5CF7D915B44672038F78812F9BC85F48D8EE671D04EA9D8031B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

da52f305-446d-49fc-820e-2756f3326a74.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\da52f305-446d-49fc-820e-2756f3326a74.tmp
Size 18KB
SHA256 691df40859b2741dd5ed64eb1813d8a59d41da7fedf7968f6925962012b49eb5
MD5 e140cc840d7110e12bce0e90964de6c8
SHA1 3b083cff615eec6f0267f1719d5bd9893555f705
SHA512 4d5cde72f7f7453d4aa78ba500e3b8b51a376bf07a4e5679ad1a33db8e160b0c4b28b38366aacf2466d35e028203e3e2c643f5518b6facd9166fdbacb565ae2b
SSDEEP 384:mMZcIh8NNUq/+6XdbTwK5S4xsDqtgOIwZOygLKoZ:mahM26sqXsLGi
TLSH
T17D828D325C789CBB9CF7E915B54672038F78812F9BC85F48D8EE671D04EA9D9030B922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

192c6249-312d-4f5f-b06f-5934d40395a5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\192c6249-312d-4f5f-b06f-5934d40395a5.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000010dc2\VCRUNTIME140.dll
Size 174KB
SHA256 d1f4225df2cd877dbf130d5668a021dce3f94118455ff5ec952061c30afc9ce7
MD5 07bc2f9c4c1b07e1cc013ca0079b31ac
SHA1 1098f2a834146995df7a91c78f72f210d8d2d12d
SHA512 8fd063d61d1c57bfae5ef105b1796c141ef2752dbad17ae79f974c417542c075bc8b4ac12163629a74e43004fd9cf170a76de9d11841b6e5c236f5b47fbbb09b
SSDEEP 3072:aoq3aLPst/GrhA4gBSnSQ37QwZyeBB0ecbavp7D:aofLPsmBnSQ3VyeBB0ecbaV
TLSH
T1C6048D51B2CC00B2E92B9674CCD69553D6B1B0057B30AADF47A846782F33FF2A63DA15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000010dc2\VCRUNTIME140_1.dll
Size 48KB
SHA256 a7146c08f89fe5b04541ab507cdb59ff7b44534d4ba3c668a426c6450a03434e
MD5 bbfa92d8173376c972fd58dcf5ca6aaa
SHA1 b7b4b6e7045caccc0f790e3395e1f514d01f6b2f
SHA512 f5856e7cb7bc8f40efc276f8e7024db9176052ebd47cd02e799aacde650293992a84a6a4856dd974077e94e688bb4ed67f18c1dfd8357afa8698dd0dfead68d3
SSDEEP 768:bmiyc1PGhsryS/TAiblJce9z4Snqdlfe9z1Y:2cF8srygDlSaz4Ez1Y
TLSH
T1DA235E8193BC8086E8B798B480EBDF13BD3DB661976192CF1BA1E15C1D537C0D73926A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_asyncio.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000010dc2\_asyncio.pyd
Size 75KB
SHA256 e96e9c3ed48739ed34cc0a9e42b5a362018962fd21f4bea5f875e48b93af5a7a
MD5 81dfa7854a9dc84b4dd4f59cd262e1ae
SHA1 7adb4ba112c53f04ab8ea8ed762548b9ea1a2904
SHA512 0f1cf66c5bf14819a6ec0d5cc7b07fbfd9eee71f2189e02eeb130e42724fe0ae6a6085c599ae1372a958f5df747734de1d7e4a50ae8cb680a41011185f8a48e3
SSDEEP 1536:bw1LeCsFOgOpesvYqc27DrFVkI4DnFFyXbS95fILlR6p:6efIdNV7DrFVkI4DnaE
TLSH
T1A3735D82A2A44182EA679178C9975F83FFB0F5516F0093DF5198C19F2F533E18BBA325
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000010dc2\_bz2.pyd
Size 84KB
SHA256 c8d0e5b1b394597396e3eb04dc73cb26679bbfb9762e7b64332bbd63af385801
MD5 6503bb32a1d8e98e97a66e45b5b817ac
SHA1 62a53be92577c03fd85648112ec676055f1a0753
SHA512 a89a34962770f8346dd35fb96792f848940b1dda7167d901e2655b9bec572e52eb87c1b0aaf62d77f6289411c2b63549ecec82821961ccd8ea1feca248533f16
SSDEEP 1536:ZcbftYDFaySBxHhcB9SLm6+p8FMci2s0cI43V0yXbS9hfIkd:qtGFayS7GB4m6+m6ci2s0cI43Vt
TLSH
T193835B92A77416BAF22B917956B04393F730BB62172053EFF2C481552F13FD1AA307A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000010dc2\_ctypes.pyd
Size 139KB
SHA256 bd3da14d4b851afa4057f664073e98f546b2a22fd05a0a257504df3adc3d9a6e
MD5 175dbc7bc5c0594eec2299af43baaeb4
SHA1 9f899da81563ba8e752b30e81619e253327534f0
SHA512 8031c0f65b1ec99921a593c86a16f48d104e2eabdf7c9c59b939321a35b8348e74530cc3ae2007cc80d0b03d09e42bd9a5deb9a4e02932830a7f5cbeb559d0d7
SSDEEP 3072:k+oHacqjRXPAuvs2FisZiY70m6FrpOEOC57zo3zxOE8pN3H3xYZjcgI4GPrTj:nnY6i6Qrek7zMgT3Ajc5j
TLSH
T1E7E35C4B739840A6DB638178C5B39A47EBB1F4516B2053CF0164C99A2F633E2AE3F714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_decimal.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000010dc2\_decimal.pyd
Size 319KB
SHA256 23a6c6fc500721d5f87334edb802617ecc0ab923430fd72bbcfa8d7873368f80
MD5 968982e59db58b0c093a73b2113d0e35
SHA1 b5b995d63fee9d9016a15168fdf4002a1179f565
SHA512 ad0147dbb410cf224b385975d4e37bf2b850f43ac5698574fbc9bef3891117650860d431478297025a8954c46d0728254505ba9e711f869a8007c6f76876c192
SSDEEP 6144:wBDlNX/mz4UkNucer+7n05cUFaGFUWoxHkALK8l49GVbS:wplNX/k46e0G5NeAS
TLSH
T15D645B87934909A0E6778079C99B5A5BFBF2B8509320C6CF43A549973F933E3673A344
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000010dc2\_hashlib.pyd
Size 71KB
SHA256 65f921fdee1a34ef18a5635cd9cfea25f8e6650883be79a1a520d3721383eb3a
MD5 b13f7789ac34287cd9cfc735322a45ea
SHA1 2ca2514092cafe711ca84e55b4eb6d2a583e84e4
SHA512 f686251279e260ed4eefdadbe298b09a76182667e0bcb7ad1d11129b7274d2abd1d82eca19569953f194b478921655a8ee21a32d1fed05c39f35471a3bb2f243
SSDEEP 1536:DYa6mLMlYAiWkR303dFtFt1ABILoSkI4DIYyXbS9EfIkI:NMWAKeFtFt1AqLoSkI4DIO
TLSH
T1DD636C56964840A1E9A381B4C9E30F47F935F6622B1097DF63A8C1CD2F237DBA37A354
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000010dc2\_lzma.pyd
Size 167KB
SHA256 717e15be558846375b5c7b93e9275c35147da744786514b3e7e56b7ef7d69b3f
MD5 6f2761fc7e38696ac818ce81979dc825
SHA1 4f938af380d0060a72b5fa08194384e07ffabac1
SHA512 559da601b6de210f613dea2d0eb53d45951921795f7470074ca9b02ef887982a6a988003f7e69c2c9b3083dc0c633a92f2c7f860e2a4266f341db446fa3b97fd
SSDEEP 3072:BsRr+8GAgJ6wLtOGq8YQpsrLEznf19mNoP5x5PwxmPmcI4I13Y:BsRr+MgJ6wB67Q0atYOBvw4ua
TLSH
T15EF33991A258F0D6F3328C34C9934F63E6F97815432092DB018D977D6A2FBE59A7A313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_multiprocessing.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000010dc2\_multiprocessing.pyd
Size 37KB
SHA256 9aed3b5cfa92dda53f4670d3f86e0b5cd049326bd6d95965be8f506147a41445
MD5 34c20c56a233a03792cc950b64978929
SHA1 3c26c9f7d591a5ddcfc4254b05f2471f7ead29d6
SHA512 575c457637d8fc8043ab7962209033a4e61398566c98ac9348fd7ef22ea7fa47c1b3d53ad1f1c0b8b918d3f3b361c910a64757a8876b93882d2430098ece38c3
SSDEEP 768:g6RLiOD5KTjuv1FFN0Iv/62CXmpI47ttNyXmX/5egc2Ip4cVTxf1mlRaXO65:HRL/KTYFNRv/62C2pI47ttNyXbS9yfID
TLSH
T1E3035D86566C4053F922867584E3DE46FA35F3931B2146DF31A5C2CE0E677C2A33A349
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_overlapped.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000010dc2\_overlapped.pyd
Size 56KB
SHA256 8b91dac101597c2c6fab9f4c5ac92caf1d180bb9e32e6acad572135f43d7cb22
MD5 c7db399510b7ef93016d733e162b1033
SHA1 fe66e41e85d4f6736d3513def3f511fda7b7a97f
SHA512 db51883911677c3fb64640e9a55a6c89ef00b96c74828126acbc53bb9a25e757252649199dfa21887a875fe9cabad8b330ee1043d8040f2cc7ccd93d8fbc071b
SSDEEP 1536:BqLOtEEJWmMQrTH0OZ6DVoI4Ct4yXbS9mDfIYiKu:8mr0OZ6DVoI4Ct4i
TLSH
T1E1435B465B5401D6ED63C1BDD1A38E03FA78B293171197DF61A8C24A2F737D2A73E288
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_queue.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000010dc2\_queue.pyd
Size 35KB
SHA256 b1bc451e4de122385a062f3248fcc8773e332073bc1a76018ba83b43963fe004
MD5 f0215e6c67cdaeb21037c777e0349d2e
SHA1 3b93b446d31863746269f22b20e835e76a9c3c09
SHA512 6ff207b32c36da52347f2f787b277cbcaaaf45c1ed0d57dd20660ac2c0c32d80cc2cda4e0f8793561695ec7be88bebf63682029896835663397bc37b0b324466
SSDEEP 768:5HWYKYCLPyt6i5IongI4RUHuyXmX/5egc2Ip4jTxf1ml6Z+7EZNgBi:52YCL46i5NgI4RUHuyXbS9hfILKn
TLSH
T120F27DC6976C41A7F6638670C5E6CF92F934F7935B1183D720A8C24A1E237C2977A268
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000010dc2\_socket.pyd
Size 86KB
SHA256 2ee21e2b37d78458454e81bf529128cb0c98f92254635f5265222647aa850787
MD5 33044d415e1ea10867620b62f13914ce
SHA1 a7612dc69227328ff473d6e8a23871d22d40c462
SHA512 23692aca30fe25e8369c3979bfeb8d77788a99785ce36250758daf4c9b3305d0bf7145b0ff0a1e00199058979193a4c8221c778498bc3e3ac4c8ce64f333eef6
SSDEEP 1536:qrFMxL96MDsyiuK7Oc4M0ypYGiXA+6XwwzLkrf4PcIVgI4GwYmyXbS9mfIYh:EelsGK6c4HypYGiXAzXwwzYD4EIVgI4r
TLSH
T1F7836A41A6A041F6EB729175C2638E53FF74B4C1139497DF1066C69A1F333C2AF3AA86
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_sqlite3.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000010dc2\_sqlite3.pyd
Size 127KB
SHA256 196db98e296e7aa0e8566d9e42959510971cd9e6b07aa1d360fdf23a05c82a5f
MD5 a67325fe5dbe772a22f287f28e5a14d3
SHA1 2cc37d3d9b914460acf6739f9822c3b13a8253ac
SHA512 9b1fbb0ecdcff635cc1b1a179e062b2c842aee8e8bf6bf25db4f3042a713315be75ca7dcc659391b5cd43a9e1bf35f7b73fdae6416eb256df1bdbdd2b69c378f
SSDEEP 3072:WN23RAal2iShsGUCkJ11o9117/8skq11uQ56q11n1VoJTZaL3bpgFBkI4DQ4:WI+aksGeI5hpgj
TLSH
T10BD3496B631801AAFAB34178C5A35A43FB30F561273197CF5190C64A1F377D2AF3A668
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000010dc2\_ssl.pyd
Size 192KB
SHA256 581bc1e1ce0522d2ddcdd6e4865fe47f1de9f7f52474e3950ddfc0c8dd966c5b
MD5 9d3786d67c4d583a3473a8f6ad57c80f
SHA1 4731af4e9e615d1d3abe856cd2693b24cb8707f1
SHA512 8927850f1836aee6429db7a666223399212156da3d0a8d667eafb150733dbaeb86bd8d020382317f00caaceda036cc92df7aba4140758e2067db8ebcaeeae1a8
SSDEEP 3072:2gci4V8O3dTrGPMLf0h7if4jjK6pGs5kL2L+1kTPzXClity1Q5MFe82Iu5tyFjUa:ui4VNt3AC0h7if4jjsFp68yeN
TLSH
T196145A47B1545AB7D912E4F9C6234543FBB4F014332297DF48C6D9A20E03787AE7AAA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_wmi.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000010dc2\_wmi.pyd
Size 38KB
SHA256 73d029da93e92b6846e24c2c067ec1abe4351c86536abac746725344b05bbdb0
MD5 88bcdcc94319deb10d9667cf5ed069b1
SHA1 1d34aa8ed4344ca975e6dccb6e4b7b0d8c877d80
SHA512 0580c1281721dda59b74e2f7b0e2fd52910552e0966365702164da33942b8c33878323ead878d8734dc0094613e4d0871ac09028362becc442303bb0e62ce4b4
SSDEEP 768:qJ51CA8l+hsV/C8EuSd++Q2dVrscI43i7yXmX/5egc2Ip407Txf1mlIJ4l:qJ51X8lzz5Sd62dVAcI43i7yXbS905fu
TLSH
T17D037DD793684056EA23DA79C1E6CE57F934B3936B1183CF3255828A0F233D1D73A268
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_zstd.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000010dc2\_zstd.pyd
Size 494KB
SHA256 49eda8c6a95c5b8e0373f880373fc52fab557c1b42e0336f374131cd999565b1
MD5 ee4b45c8aff23f25aa32c73c43e30230
SHA1 36156cac2e92beab680ed07c46f7fbf3dad2f99e
SHA512 a63020c1a5dc2c942d404753dac34e4ac6c021f60b2fbd614a65ab76a421bd3f78b7a5061e3ca79d25e76e4c2e46c4f6e0ea4b580ef301a564aa4a44e3090261
SSDEEP 12288:38c6M6EDdQw0MiO+sDwUZRkB22RvWYHDEg5BCl9VwLX:38DMn0tWRkBFuYHDdX
TLSH
T18DB49E43F25943ECD437C4B4CA5A9613FBB6B84A1214525793A6DFA83F03B31DB2A319
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI000010dc2\base_library.zip
Size 1.4MB
SHA256 95c011ba003fd4d8aa8e0845f94f2a61b425df125b04b55f0fbefa202ea18bf7
MD5 1b2d091690d587a80dd73d02669c7e3d
SHA1 d0bcada88341199484e1fb0b2dadf83a91da42b4
SHA512 86b5a5d1a6917fc61a287f9503bc54d0bc3bc49f930e87e14b9080a6068e4e913f360980fba22d8c576aa6892cf82ac7cedf5532a145d2a0e5784b9758af2f8d
SSDEEP 24576:p7QgsUFwuxeGXP2m25aiyV27Ze9zn2ZQl6cokn:WgsUFrcZyViZe9znL
TLSH
T147653AE6749239D7FF48F37F4037AE0C2BA95111EE04E6477C9949B82FAE6901F58188
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blank.aes

Path C:\Users\Admin\AppData\Local\Temp\_MEI000010dc2\blank.aes
Size 93KB
SHA256 98a75e464e377ff31e56fb752ddfa47608ff2ce4f97a581c9fbdb9e6d7dea9a4
MD5 e10d8d321a591e10b062806b848fe02b
SHA1 8b3078de40d33447ef0c59819ed7887328ec7a49
SHA512 071c3a3998b7bfe675f3938b41703d03acc4207ffa3c1b7b950ebec31e5b433e2511a8628185ab24aef24b6b396d0632e457008d03b30f6878d3b2b6d3b8baa9
SSDEEP 1536:mjAoEtCJk8PhiwP1+rtEcbU87RJubBhF9UyFv/pqDU88zNhx6c3nyhki5JO0aHTF:mjzru8gwwRExuRsBzv/pU893nqk6o
TLSH
T1E4931254DE8BB5668B32E4F12436F25644A05337C239CF0527F952AEF313B8A422F897
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000010dc2\libcrypto-3.dll
Size 5.7MB
SHA256 75495fe0e079ab00d49be740d3c710a0b94e3f74f9648cb7cc9f768fc7f52319
MD5 b306c000f2b892736f0e66d265c61876
SHA1 f5c438c111e261bed3af886683a8ebbda9a4784f
SHA512 9cdc7fe337af7db5b171896d075486ea34ed139cf5c9c7a94903bce61b022e6ce671259675291805123fc739d727b23d4417fb7396d05f78b69321024a9fda58
SSDEEP 98304:GdBL82n7Vh6CLpf7u50n+Q1CPwDvt3uFA0Cv:GfL82n7Vh6CLpf7CuV1CPwDvt3uFA0Cv
TLSH
T1D3567B6AB6A41089E8BAD13CC6534B1BD6B1B854177197CF05A097BD2F33FDA0A3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000010dc2\libffi-8.dll
Size 38KB
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
TLSH
T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000010dc2\libssl-3.dll
Size 1.2MB
SHA256 8957182a9c385bfd9f3f790921de2ddc614cf91f99edbed4e9e5446a46504e32
MD5 5aaafa642930cc5ca5e7b6aa7a07f0a6
SHA1 3500c90b532ac1eb39b421a03bab59ad8149e809
SHA512 07cc0de051cbc1ec13d5648e708be08d12a79dbc0f2df48eeadc82a26cde638d86e2bbb6f71897de0217e29d5e69711632da9076f509eb935e170d35192cdef5
SSDEEP 24576:PKPVy3rUry/1n0EahtEf0O29YlFqW9Rg5aYsG:PKty3rZ1npkdeRg5aYsG
TLSH
T1D0556B6AB7B811ADD5B7D17CC6938B17E2B2B0002360A7EF066087791F23BD6167E354
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pyexpat.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000010dc2\pyexpat.pyd
Size 230KB
SHA256 6b177f496bfea0f94f1d69fe03a108110a8f36c3dd63f0f165ec1f768020f6cc
MD5 45c56c892d5bb473fd8a898f27efc34e
SHA1 af608343967be1e86021ac8ae0ca8047e09c767a
SHA512 4a0069be092fec122c6d010e2da090773707ff4a175de00495e4197cf727ba6c8ae4753b81fb529e5566f331104a6d813267d049a94a7f84b1a3e1e502861b38
SSDEEP 6144:xompl3PDJMgKR9BClWWYZnQwG2GUQlTlFFC95gA:tJKR9BCc5lQwwUyo
TLSH
T160347C66B2A5C5E5EC538038C9938A03EB72FD651312A6CF27808A7E9F277D71739350
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python315.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000010dc2\python315.dll
Size 7.5MB
SHA256 a302b823d1ca773c534c5692a8a7c6215b4ac93cfcda9fc7e1d3a10e3cdd0eef
MD5 2c0e259e79bda9609a1dfed6b9d422d8
SHA1 93400f7b220808b39a5208973d4c33450ad7f5ba
SHA512 ac1dd44276acbb9a1240096e1c568555cff775a4117ac15a235234da1ea3f5ad380a7e1df6220b3fd599fa318b779607333e9215781d171e3c8967246a5a7635
SSDEEP 98304:mfsCbh9AC6iU843OFl9an6rTbitPTEOApDvPHDMiEJ30DY:mfThfxj43OFl9an6rytPY+idY
TLSH
T18C867C7A63A501A4D87B8136C5434607EBB2BC107B20D2CB52547ADA2F337E35BFA725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rar.exe

Path C:\Users\Admin\AppData\Local\Temp\_MEI000010dc2\rar.exe
Size 816KB
SHA256 f561764bc3e9ed208744321a89a819b562edeaf06e203c02a06976121fda1991
MD5 c7b8d0c2b6a3851291fd446113cbfc5d
SHA1 43a0a27f2b078001d972874b0363fbb7458597a0
SHA512 452839fea04305cc2883c0b7c651918ceb8d4117aaf7ee317774ca8f57dce7625f66b1db1cbb17c06ef088a8283baef683c06351794ad766ca459adecfa29a36
SSDEEP 12288:xxH9uySClf47ZhSelxO9mafDSvYblwkr6YFON0bGLiZ32Pjr45:xxduUB+Ielg9px2JN0TKr45
TLSH
T1B0058E1A9BE801FCE0F7D674CE915917E7B7780A57B1968F03D4499A5F232608E39323
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rarreg.key

Path C:\Users\Admin\AppData\Local\Temp\_MEI000010dc2\rarreg.key
Size 456B
SHA256 58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211
MD5 4531984cad7dacf24c086830068c4abe
SHA1 fa7c8c46677af01a83cf652ef30ba39b2aae14c3
SHA512 00056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122
TLSH
T175F0232C312E70417BC5DE8A1ED04A63C0E28014C99B50D09DF456DF01980A67B72596
MD5 SHA1 SHA512 TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000010dc2\select.pyd
Size 32KB
SHA256 bcec7c662876364122be2d03b326d121a79dbc679210248a3e035de52a392631
MD5 cb61a69dafc141b2688e3d091fa5577f
SHA1 26d14c48e39708f71b14760c93f71fa32db2e1d0
SHA512 eb9c335f57e50225a574f8ca13804ec125984e1142d3f78bfaf0524f2a70a4c2aac2a94702e589fe860130c65079369580f78a665be227cf480e5f88c16f2974
SSDEEP 768:eYOLuWIUtqE+gZJuAFypNgI4RGxyXmX/5egc2Ip4pTxf1ml6Z+7EN7Ng/:bOLuTUFR3hFyjgI4RGxyXbS9bfILWw
TLSH
T177E26CC65B688093EA63857195E2CF43F934F3A35B2087DB30E982591E677C1E73A214
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqlite3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000010dc2\sqlite3.dll
Size 1.6MB
SHA256 b6eb79e14ebc233b14e1c452654888c4f1e0993bad8f00faed97fe8efc37e38a
MD5 42cc1c39e63ee80fdf0df43518e0ba12
SHA1 c180f0f1b0ba428fed55e5bfdd266329c8ae7ccc
SHA512 c4ad026a47308097bb3486a03dd287716b230d18c9c053f69fd28603a539ef91dad2d5d9237de439a34b684c4467077c1951305b1039f5a1b9e27d7c74dfb754
SSDEEP 49152:Z40rvoSafLOI2S+PCmYAMEMkim+es1Sw+2OtplbzwnaRumTiu:Z3m6qSCmYBvkTjskbz4u
TLSH
T16F759D0BB2B801ADD067C0BAC51B5617EBB1B4091B34ABDB51D0C9A52F53FE317BA324
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000010dc2\unicodedata.pyd
Size 735KB
SHA256 c5cfd858bdaa87e89ce1652739ced36addc62b73f97983dff9e50fc456a7c9e8
MD5 c8be157a4be9bd9aa7e174fa4b19ec8f
SHA1 78d5044830957f1c764dba17a3619925c4510298
SHA512 cbc18f5fd67a1500fba3ada76873e8c39b05e5f2e0031586ec056b13c06f97ce75ef448d113612dc0c9ec9010026651a8ff37c94fe84551718061d5301b608b0
SSDEEP 12288:CzYdoZcdJhcHnMAURE6+fvhI4DWBDEZqMxt5bW:CzYd/dsHXjvhADEZl5bW
TLSH
T1B6F4E45FB4840A03D62DCAB833A37575D06FF77EDE0A662B36D44010A4072E9B9EF619
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

438b4a3c-80e4-46d2-9fcf-7e6a89a18603.tmp

Path C:\Users\Admin\Downloads\438b4a3c-80e4-46d2-9fcf-7e6a89a18603.tmp
Size 15KB
SHA256 82b454d6e77bc6da51d1a52985a8ede5fefe2ac3d9dce9f3d9fb618f9f2e60b9
MD5 63a31b99a8c01620e6260791e73db792
SHA1 88593632d9d5fdea4b3fefa576d6a8eca50a507c
SHA512 cb9ea838ddb0eed28d01d2b5b743aa93b3c53eae5131e18d521b337575e573d45e6a83ca2e318ff7233cbec53981dd80cd5769ff0a83112f715a1ee4f178dda0
SSDEEP 384:T5qDQuPlkKhusHiL6FMyBl/zL/eoiaXbQ9rGhUE4HlVVjOqEUhv9SunJ:lqDHhJ9MUBV8rGbkjOqEUhVSuJ
TLSH
T1D762B515ABA559E4F203F23EC68B941FF2D0F05BA3E5E5E7472287551BB36E62034B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Built.exe

Path C:\Users\Admin\Downloads\Built.exe
Size 13.4MB
SHA256 ac2262ae03d850c945bb301db9a5ea5d369b4739576f73abec548298bda46334
MD5 14dbd8b13c561ad67bf3de484162b15a
SHA1 b7652a5afd2014bbec9821801f72a204db7946a2
SHA512 2dae86f4fe3273b52834aa41ee4728bb4e5867259dde93de06c064a4cdd795dc1e06baecd651bdde6e09cb41daeb31bf4ac884ef30d92d389d248ee6aece4fdb
SSDEEP 196608:xdqJvcwtyjp7qejDFE3XIJau2vHrnnHagO9d1B40BPSI3kDMUIEXOJ8t66Vcbl:OJv/yjPZE34JaBrnnHa774Ed3GOJdQc5
TLSH
T1D4E63394F39042E2F8F7C03CC1628256EAB27C6593A0C5D71ED409633E57AC58A79BF6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Built.exe:Zone.Identifier

Path C:\Users\Admin\Downloads\Built.exe:Zone.Identifier
Size 58B
SHA256 fe25e31061b432c3a3fdd8f797c6dadad253e83dfb305ee997a7302cd70b618d
MD5 f328e184c322cba91dc3c014fe2ef3e9
SHA1 2aab1f0a70009051dcc87350e0f3b079da02fbb2
SHA512 e59501b550ea64155d134ae832812004ec298a44519eb03183542599174b7691be3225f6fa5064d45ed7ec81f0a93721eb8f401d7e2a49c4b91a70ded006c97e
TLSH
T18DA00297484485550114369415BD95ACB04F65548DB90A48E84040DBA88587889E5966
MD5 SHA1 SHA512 TLSH

Submit Download

Built.exe:Zone.Identifier

Path C:\Users\Admin\Downloads\Built.exe:Zone.Identifier
Size 160B
SHA256 54e53fe1a12621be64b50e8ef4def8456fd0505479dd5d0bc5ca5d12311a3cc4
MD5 1cce057230ae7feb5f9f14226feb37dc
SHA1 231ed3ccc4944ae1b27938f206e93bd87478cf88
SHA512 961f8e27da41ba44200960f62d1955375c67f3ce65470e4d96cb27080e595adac8473052dca85605918136ad7205745df5be8a2f788a386b230f2d92a0af6ea7
TLSH
T140C08CA3880080AB0A0436C15E6D906CBA0F95048CAE8A94FC04D89FF86A82982E007F
MD5 SHA1 SHA512 TLSH

Submit Download

memory/332-500-0x0000024FAED00000-0x0000024FAEE00000-memory.dmp

Download

memory/332-558-0x00000257D1ED0000-0x00000257D1EF0000-memory.dmp

Download

memory/332-586-0x00000258E4410000-0x00000258E4510000-memory.dmp

Download

memory/332-555-0x00000257D1000000-0x00000257D1100000-memory.dmp

Download

memory/332-557-0x00000257D1EF0000-0x00000257D1F10000-memory.dmp

Download

memory/332-517-0x00000257D1000000-0x00000257D1100000-memory.dmp

Download