hxxps://drive[.]google[.]com/drive/folders/1xXxMTUkw5fbZTmcveghjXtVyYqfMt-4K?usp=sharing | Triage™

Analysis

user interaction
yes
max time kernel
149s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/10/2026, 11:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://drive.google.com/drive/folders/1xXxMTUkw5fbZTmcveghjXtVyYqfMt-4K?usp=sharing
Sample261007-ngme3sys5k

Score

8^/10

defense_evasion discovery persistence privilege_escalation

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
108	4576	msedge.exe

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartUp\ST6UNST Uninstaller.LNK	setup.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartUp\ST6UNST Uninstaller.LNK	setup.exe

Executes dropped EXE 5 IoCs

pid	Process
2488	setup.exe
5448	Setup1.exe
5888	st6unst.exe
5404	setup.exe
1904	Setup1.exe

Loads dropped DLL 6 IoCs

pid	Process
2488	setup.exe
5448	Setup1.exe
5448	Setup1.exe
5404	setup.exe
1904	Setup1.exe
1904	Setup1.exe

Writes a Windows system DLL name to a user directory 2 TTPs 2 IoCs

A module named after a system DLL outside System32 can be loaded instead of the real one by a program searching that directory.

defense_evasion

DLL Search Order Hijacking

Match Legitimate Name or Location

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\msftqws.pdw\oleaut32.dll	setup.exe
File created	C:\Users\Admin\AppData\Local\Temp\msftqws.pdw\oleaut32.dll	setup.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Contacts third-party web service commonly abused for C2 1 TTPs 6 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

flow	ioc
3	drive.google.com
4	drive.google.com
12	drive.google.com
19	drive.google.com
26	drive.google.com
48	drive.google.com

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

System Information Discovery

ioc	Process
\??\f:\	Setup1.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\temp.000	setup.exe
File created	C:\Windows\SysWOW64\temp.000	setup.exe
File opened for modification	C:\Windows\SysWOW64\VB6ES.DLL	setup.exe

Drops file in Windows directory 21 IoCs

description	ioc	Process
File opened for modification	C:\WINDOWS\st6unst.exe	setup.exe
File opened for modification	C:\WINDOWS\Setup1.exe	setup.exe
File created	C:\WINDOWS\ST6UNST.000	setup.exe
File opened for modification	C:\WINDOWS\WinDepav.CAB	setup.exe
File created	C:\WINDOWS\Setup1.exe	setup.exe
File created	C:\WINDOWS\SETUP.LST	setup.exe
File created	C:\WINDOWS\temp.000	setup.exe
File created	C:\WINDOWS\Setup1.exe	setup.exe
File opened for modification	C:\WINDOWS\ST6UNST.000	Setup1.exe
File opened for modification	C:\WINDOWS\ST6UNST.000	setup.exe
File created	C:\WINDOWS\WinDepav.CAB	setup.exe
File opened for modification	C:\WINDOWS\st6unst.exe	setup.exe
File created	C:\WINDOWS\temp.000	setup.exe
File opened for modification	C:\WINDOWS\Setup1.exe	setup.exe
File opened for modification	C:\WINDOWS\ST6UNST.000	Setup1.exe
File created	C:\WINDOWS\ST6UNST.000	setup.exe
File opened for modification	C:\WINDOWS\WinDepav.CAB	setup.exe
File created	C:\WINDOWS\SETUP.LST	setup.exe
File opened for modification	C:\WINDOWS\ST6UNST.000	setup.exe
File created	C:\WINDOWS\WinDepav.CAB	setup.exe
File opened for modification	C:\WINDOWS\ST6UNST.EXE	setup.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

System Language Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Setup1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	st6unst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Setup1.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

System Time Discovery

pid	Process
4576	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{41A7D760-6018-11CF-9016-00AA0068841E}\TypeLib	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{14E469E0-BF61-11CF-8385-8F69D8F1350B}\TypeLib	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CBB76011-C508-11D1-A3E3-00A0C90AEA82}\TypeLib\ = "{EA544A21-C82D-11D1-A3E4-00A0C90AEA82}"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FCFB3D2B-A0FA-1068-A738-08002B3371B5}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FCFB3D2B-A0FA-1068-A738-08002B3371B5}\TypeLib\ = "{EA544A21-C82D-11D1-A3E4-00A0C90AEA82}"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EB41E8C5-4442-11D1-8906-00A0C9110049}\ = "_DPersistableDataSourceClass"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EB41E8C5-4442-11D1-8906-00A0C9110049}\ProxyStubClsid32	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E43FD401-8715-11D1-98E7-00A0C9702442}	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A4C46780-499F-101B-BB78-00AA00383CBB}\TypeLib\ = "{000204EF-0000-0000-C000-000000000046}"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{45046D60-08CA-11CF-A90F-00AA0062BB4C}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4495AD01-C993-11D1-A3E4-00A0C90AEA82}\ProxyStubClsid32	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C0324960-2AAA-11CF-AD67-00AA00614F3E}\TypeLib\ = "{EA544A21-C82D-11D1-A3E4-00A0C90AEA82}"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C0324960-2AAA-11CF-AD67-00AA00614F3E}\TypeLib\Version = "6.0"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7500A6BA-EB65-11D1-938D-0000F87557C9}\ProxyStubClsid32	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{888A5A60-B283-11CF-8AD5-00A0C90AEA82}\TypeLib	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{737361EC-467F-11D1-810F-0000F87557AA}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{41A7D760-6018-11CF-9016-00AA0068841E}\ProxyStubClsid32	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BE8F9800-2AAA-11CF-AD67-00AA00614F3E}\TypeLib\ = "{EA544A21-C82D-11D1-A3E4-00A0C90AEA82}"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D4E0F020-720A-11CF-8136-00AA00C14959}\ProxyStubClsid32	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C4D651F1-7697-11D1-A1E9-00A0C90F2731}\ = "EventParameters"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{737361EC-467F-11D1-810F-0000F87557AA}\TypeLib	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D5DE8D20-5BB8-11D1-A1E3-00A0C90F2731}\InProcServer32	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EB41E8C1-4442-11D1-8906-00A0C9110049}\ = "_DDataBoundClass"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EB41E8C2-4442-11D1-8906-00A0C9110049}\ProxyStubClsid32	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{737361EC-467F-11D1-810F-0000F87557AA}\ = "Licenses"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A4C466B8-499F-101B-BB78-00AA00383CBB}\ProxyStubClsid32	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A4C46780-499F-101B-BB78-00AA00383CBB}\TypeLib	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{45046D60-08CA-11CF-A90F-00AA0062BB4C}\TypeLib\ = "{EA544A21-C82D-11D1-A3E4-00A0C90AEA82}"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{41A7D760-6018-11CF-9016-00AA0068841E}\TypeLib\Version = "6.0"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B28FA150-0FF0-11CF-A911-00AA0062BB4C}\ProxyStubClsid32	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B28FA150-0FF0-11CF-A911-00AA0062BB4C}\TypeLib	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2CE46480-1A08-11CF-AD63-00AA00614F3E}\ = "SelectedControls"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7500A6BA-EB65-11D1-938D-0000F87557C9}\TypeLib\ = "{EA544A21-C82D-11D1-A3E4-00A0C90AEA82}"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A4C466B8-499F-101B-BB78-00AA00383CBB}\TypeLib\Version = "6.0"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{41A7D761-6018-11CF-9016-00AA0068841E}\TypeLib\ = "{EA544A21-C82D-11D1-A3E4-00A0C90AEA82}"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2CE46480-1A08-11CF-AD63-00AA00614F3E}\ProxyStubClsid32	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BE8F9800-2AAA-11CF-AD67-00AA00614F3E}	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C4D651F0-7697-11D1-A1E9-00A0C90F2731}\TypeLib	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C4D651F1-7697-11D1-A1E9-00A0C90F2731}\TypeLib	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C4D651F2-7697-11D1-A1E9-00A0C90F2731}\TypeLib\ = "{EA544A21-C82D-11D1-A3E4-00A0C90AEA82}"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{14E469E0-BF61-11CF-8385-8F69D8F1350B}	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D5DE8D20-5BB8-11D1-A1E3-00A0C90F2731}\InProcServer32	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4495AD01-C993-11D1-A3E4-00A0C90AEA82}\ = "_PropertyBag"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2CE46480-1A08-11CF-AD63-00AA00614F3E}\TypeLib\Version = "6.0"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{14E469E0-BF61-11CF-8385-8F69D8F1350B}\ProxyStubClsid32	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FCFB3D2B-A0FA-1068-A738-08002B3371B5}\TypeLib	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EB41E8C1-4442-11D1-8906-00A0C9110049}	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EB41E8C1-4442-11D1-8906-00A0C9110049}\TypeLib\ = "{EA544A21-C82D-11D1-A3E4-00A0C90AEA82}"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A4C466B8-499F-101B-BB78-00AA00383CBB}\TypeLib	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C4D651F1-7697-11D1-A1E9-00A0C90F2731}\TypeLib\ = "{EA544A21-C82D-11D1-A3E4-00A0C90AEA82}"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{888A5A60-B283-11CF-8AD5-00A0C90AEA82}	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CBB76011-C508-11D1-A3E3-00A0C90AEA82}	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EB41E8C3-4442-11D1-8906-00A0C9110049}\TypeLib\ = "{EA544A21-C82D-11D1-A3E4-00A0C90AEA82}"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{EA544A21-C82D-11D1-A3E4-00A0C90AEA82}\6.0\9\win32\ = "C:\\WINDOWS\\SysWow64\\msvbvm60.dll\\3"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4495AD01-C993-11D1-A3E4-00A0C90AEA82}\TypeLib	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4495AD01-C993-11D1-A3E4-00A0C90AEA82}\TypeLib\ = "{EA544A21-C82D-11D1-A3E4-00A0C90AEA82}"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4495AD01-C993-11D1-A3E4-00A0C90AEA82}\TypeLib\Version = "6.0"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{41A7D761-6018-11CF-9016-00AA0068841E}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7500A6BA-EB65-11D1-938D-0000F87557C9}	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{41A7D761-6018-11CF-9016-00AA0068841E}\TypeLib	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{41A7D760-6018-11CF-9016-00AA0068841E}\TypeLib\ = "{EA544A21-C82D-11D1-A3E4-00A0C90AEA82}"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B28FA150-0FF0-11CF-A911-00AA0062BB4C}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D5DE8D20-5BB8-11D1-A1E3-00A0C90F2731}	setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1696934516-3600988056-1840298893-1000\{D55DE27B-A172-49BB-801F-EA0231B731C0}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5172	msedge.exe
5172	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5448	Setup1.exe
1904	Setup1.exe

Suspicious use of WriteProcessMemory 62 IoCs

description	pid	Process	procid_target
PID 460 wrote to memory of 3160	460	msedge.exe	87
PID 460 wrote to memory of 4576	460	msedge.exe	88
PID 460 wrote to memory of 1060	460	msedge.exe	89
PID 460 wrote to memory of 2232	460	msedge.exe	90
PID 460 wrote to memory of 1060	460	msedge.exe	89
PID 460 wrote to memory of 1060	460	msedge.exe	89
PID 460 wrote to memory of 2232	460	msedge.exe	90
PID 460 wrote to memory of 4092	460	msedge.exe	92
PID 460 wrote to memory of 4092	460	msedge.exe	92
PID 460 wrote to memory of 4092	460	msedge.exe	92
PID 460 wrote to memory of 4528	460	msedge.exe	93
PID 460 wrote to memory of 4528	460	msedge.exe	93
PID 460 wrote to memory of 4528	460	msedge.exe	93
PID 460 wrote to memory of 912	460	msedge.exe	94
PID 460 wrote to memory of 612	460	msedge.exe	95
PID 460 wrote to memory of 912	460	msedge.exe	94
PID 460 wrote to memory of 912	460	msedge.exe	94
PID 460 wrote to memory of 612	460	msedge.exe	95
PID 460 wrote to memory of 612	460	msedge.exe	95
PID 460 wrote to memory of 2800	460	msedge.exe	98
PID 460 wrote to memory of 2800	460	msedge.exe	98
PID 460 wrote to memory of 2800	460	msedge.exe	98
PID 460 wrote to memory of 3004	460	msedge.exe	100
PID 460 wrote to memory of 3004	460	msedge.exe	100
PID 460 wrote to memory of 4572	460	msedge.exe	101
PID 460 wrote to memory of 4572	460	msedge.exe	101
PID 460 wrote to memory of 1560	460	msedge.exe	105
PID 460 wrote to memory of 1836	460	msedge.exe	107
PID 460 wrote to memory of 1836	460	msedge.exe	107
PID 460 wrote to memory of 1836	460	msedge.exe	107
PID 460 wrote to memory of 3228	460	msedge.exe	112
PID 460 wrote to memory of 3288	460	msedge.exe	113
PID 460 wrote to memory of 3228	460	msedge.exe	112
PID 460 wrote to memory of 3288	460	msedge.exe	113
PID 460 wrote to memory of 3288	460	msedge.exe	113
PID 460 wrote to memory of 4152	460	msedge.exe	114
PID 460 wrote to memory of 756	460	msedge.exe	115
PID 460 wrote to memory of 756	460	msedge.exe	115
PID 460 wrote to memory of 5764	460	msedge.exe	123
PID 460 wrote to memory of 5764	460	msedge.exe	123
PID 460 wrote to memory of 5764	460	msedge.exe	123
PID 460 wrote to memory of 5776	460	msedge.exe	124
PID 460 wrote to memory of 6084	460	msedge.exe	128
PID 460 wrote to memory of 6084	460	msedge.exe	128
PID 460 wrote to memory of 6084	460	msedge.exe	128
PID 460 wrote to memory of 2748	460	msedge.exe	129
PID 460 wrote to memory of 5196	460	msedge.exe	130
PID 460 wrote to memory of 5196	460	msedge.exe	130
PID 460 wrote to memory of 5196	460	msedge.exe	130
PID 460 wrote to memory of 5204	460	msedge.exe	131
PID 460 wrote to memory of 4780	460	msedge.exe	133
PID 460 wrote to memory of 2556	460	msedge.exe	134
PID 460 wrote to memory of 3332	460	msedge.exe	135
PID 460 wrote to memory of 2488	460	msedge.exe	136
PID 2488 wrote to memory of 5448	2488	setup.exe	138
PID 5448 wrote to memory of 5888	5448	Setup1.exe	141
PID 460 wrote to memory of 5892	460	msedge.exe	142
PID 460 wrote to memory of 5892	460	msedge.exe	142
PID 460 wrote to memory of 5952	460	msedge.exe	146
PID 460 wrote to memory of 5952	460	msedge.exe	146
PID 460 wrote to memory of 5172	460	msedge.exe	149
PID 5404 wrote to memory of 1904	5404	setup.exe	152

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://drive.google.com/drive/folders/1xXxMTUkw5fbZTmcveghjXtVyYqfMt-4K?usp=sharing
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x254,0x7ff9c6f5c188,0x7ff9c6f5c194,0x7ff9c6f5c1a0
  2⤵
  PID:3160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1920,i,669148427633818080,17285139565189933720,524288 --field-trial-handle=2732,i,11324997246484671314,1788156359240177241,262144 --variations-seed-version --mojo-platform-channel-handle=2764 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:4576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1620,i,2340738860118040728,10596433260513525391,262144 --field-trial-handle=2732,i,11324997246484671314,1788156359240177241,262144 --variations-seed-version --mojo-platform-channel-handle=2728 /prefetch:2
  2⤵
  PID:1060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2216,i,9186661133724536736,5298600767669716210,524288 --field-trial-handle=2732,i,11324997246484671314,1788156359240177241,262144 --variations-seed-version --mojo-platform-channel-handle=2780 /prefetch:8
  2⤵
  PID:2232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3492,i,8581517682820561235,13443427783496227348,2097152 --field-trial-handle=2732,i,11324997246484671314,1788156359240177241,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:4092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3452,i,4401167077297112318,373282493208254317,2097152 --field-trial-handle=2732,i,11324997246484671314,1788156359240177241,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:4528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4188,i,13845110329771104608,11658900129908984568,2097152 --field-trial-handle=2732,i,11324997246484671314,1788156359240177241,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:1
  2⤵
  PID:912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4228,i,8139486539034710052,15407282826936628184,2097152 --field-trial-handle=2732,i,11324997246484671314,1788156359240177241,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:2
  2⤵
  PID:612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3760,i,9527848675220283588,13165940525689294236,2097152 --field-trial-handle=2732,i,11324997246484671314,1788156359240177241,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:2800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5252,i,15187886419345558646,3881309220953189212,524288 --field-trial-handle=2732,i,11324997246484671314,1788156359240177241,262144 --variations-seed-version --mojo-platform-channel-handle=5288 /prefetch:8
  2⤵
  PID:3004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5256,i,5016415205687484001,12517576361529522733,524288 --field-trial-handle=2732,i,11324997246484671314,1788156359240177241,262144 --variations-seed-version --mojo-platform-channel-handle=5308 /prefetch:8
  2⤵
  PID:4572
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3536,i,4910890544735944802,10652425325825947925,524288 --field-trial-handle=2732,i,11324997246484671314,1788156359240177241,262144 --variations-seed-version --mojo-platform-channel-handle=5028 /prefetch:8
  2⤵
  PID:5044
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3536,i,4910890544735944802,10652425325825947925,524288 --field-trial-handle=2732,i,11324997246484671314,1788156359240177241,262144 --variations-seed-version --mojo-platform-channel-handle=5028 /prefetch:8
  2⤵
  PID:1560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6212,i,5589630722110873864,14487281257824415360,2097152 --field-trial-handle=2732,i,11324997246484671314,1788156359240177241,262144 --variations-seed-version --mojo-platform-channel-handle=6224 /prefetch:1
  2⤵
  PID:1836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5072,i,10189156114881716925,6918484007659936060,524288 --field-trial-handle=2732,i,11324997246484671314,1788156359240177241,262144 --variations-seed-version --mojo-platform-channel-handle=5124 /prefetch:8
  2⤵
  PID:3228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=5108,i,1407024554236839652,4920095157479218340,2097152 --field-trial-handle=2732,i,11324997246484671314,1788156359240177241,262144 --variations-seed-version --mojo-platform-channel-handle=6396 /prefetch:1
  2⤵
  PID:3288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6664,i,10084871942342307592,1028352035324957843,524288 --field-trial-handle=2732,i,11324997246484671314,1788156359240177241,262144 --variations-seed-version --mojo-platform-channel-handle=6668 /prefetch:8
  2⤵
  PID:4152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6784,i,14962673417687154809,14175900147165736774,524288 --field-trial-handle=2732,i,11324997246484671314,1788156359240177241,262144 --variations-seed-version --mojo-platform-channel-handle=6812 /prefetch:8
  2⤵
  PID:756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=5056,i,14923982099436798253,14398848327436319011,2097152 --field-trial-handle=2732,i,11324997246484671314,1788156359240177241,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:5764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4548,i,5587494385889954946,1188774218111558438,524288 --field-trial-handle=2732,i,11324997246484671314,1788156359240177241,262144 --variations-seed-version --mojo-platform-channel-handle=4520 /prefetch:8
  2⤵
  PID:5776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=4540,i,4370881778787509818,10115893462778617504,2097152 --field-trial-handle=2732,i,11324997246484671314,1788156359240177241,262144 --variations-seed-version --mojo-platform-channel-handle=6256 /prefetch:1
  2⤵
  PID:6084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6892,i,1878788829537395188,12027500126071015246,524288 --field-trial-handle=2732,i,11324997246484671314,1788156359240177241,262144 --variations-seed-version --mojo-platform-channel-handle=6916 /prefetch:8
  2⤵
  PID:2748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6384,i,6344724524315727722,16833547213267116450,2097152 --field-trial-handle=2732,i,11324997246484671314,1788156359240177241,262144 --variations-seed-version --mojo-platform-channel-handle=6440 /prefetch:1
  2⤵
  PID:5196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6820,i,11369306752144738748,13111980723448882934,524288 --field-trial-handle=2732,i,11324997246484671314,1788156359240177241,262144 --variations-seed-version --mojo-platform-channel-handle=7012 /prefetch:8
  2⤵
  PID:5204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6580,i,7200383816339366260,294629658177639259,524288 --field-trial-handle=2732,i,11324997246484671314,1788156359240177241,262144 --variations-seed-version --mojo-platform-channel-handle=7064 /prefetch:8
  2⤵
  PID:4780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4520,i,14773090344875534303,15862618910253227816,524288 --field-trial-handle=2732,i,11324997246484671314,1788156359240177241,262144 --variations-seed-version --mojo-platform-channel-handle=6568 /prefetch:8
  2⤵
  PID:2556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6572,i,12098451453959996133,2823840813716058438,524288 --field-trial-handle=2732,i,11324997246484671314,1788156359240177241,262144 --variations-seed-version --mojo-platform-channel-handle=6512 /prefetch:8
  2⤵
  PID:3332
- C:\Users\Admin\Downloads\setup.exe
  "C:\Users\Admin\Downloads\setup.exe"
  2⤵
  - Creates a file in the Startup directory
  - Executes dropped EXE
  - Loads dropped DLL
  - Writes a Windows system DLL name to a user directory
  - Drops file in System32 directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2488
- - C:\Windows\Setup1.exe
    Setup1.exe "C:\Users\Admin\Downloads\" "C:\WINDOWS\ST6UNST.000" "C:\WINDOWS\st6unst.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:5448
  - - C:\WINDOWS\st6unst.exe
      C:\WINDOWS\st6unst.exe -n "C:\WINDOWS\ST6UNST.000" -e 2 -f -w 5448
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6484,i,11456961694619635157,17871402902221472163,524288 --field-trial-handle=2732,i,11324997246484671314,1788156359240177241,262144 --variations-seed-version --mojo-platform-channel-handle=6604 /prefetch:8
  2⤵
  PID:5892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3996,i,15317139108993233246,15480598513468807172,524288 --field-trial-handle=2732,i,11324997246484671314,1788156359240177241,262144 --variations-seed-version --mojo-platform-channel-handle=6272 /prefetch:8
  2⤵
  PID:5952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=2132,i,13892282761479728878,9775181301878827704,262144 --field-trial-handle=2732,i,11324997246484671314,1788156359240177241,262144 --variations-seed-version --mojo-platform-channel-handle=5332 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5172

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3320

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1624

C:\Users\Admin\Downloads\ejemplo\setup.exe
"C:\Users\Admin\Downloads\ejemplo\setup.exe"
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Loads dropped DLL
- Writes a Windows system DLL name to a user directory
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5404
- C:\Windows\Setup1.exe
  Setup1.exe "C:\Users\Admin\Downloads\ejemplo\" "C:\WINDOWS\ST6UNST.000" "C:\WINDOWS\st6unst.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Enumerates connected drives
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1904

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Hijack Execution Flow

DLL Search Order Hijacking

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Hijack Execution Flow

DLL Search Order Hijacking

Defense Evasion

Hijack Execution Flow

DLL Search Order Hijacking

Masquerading

Match Legitimate Name or Location

Credential Access

Discovery

Browser Information Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

System Time Discovery

Lateral Movement

Collection

Command and Control

Web Service

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0a1214d9-0943-4c1f-a709-07907d4787be.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\0a1214d9-0943-4c1f-a709-07907d4787be.tmp
Size 26KB
SHA256 0a10aceffc41fb564b4c1d3d4f68536a08fe40f8f14a6434b32a2966061e6d79
MD5 02bb39c18a86fb34164fb4a50080e704
SHA1 d7709c687862494db289bff6cb3b391a9ab7e586
SHA512 8f7c8e2e76aff19ef969e964410125cc9bfd9a98ff2e38eedf9ba1fef9603de34e08f7ea8bce8e3d14a32903bda5c0c48268650c97b7a0f6fb3bf0b4dc850460
SSDEEP 384:0iFBZcIUYsN38TUNTUlIlUWfpu148V49iX5F1YBPJAxJ+mChJoh:PFJjGwgnQ8auBPkJ+mCbi
TLSH
T1BEC219F258E7997AD9AE8743E77E2D024EBCC067F6846A54B3D8561CCC861BFC306811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

13ecfa60-dcd1-4497-a0b4-2eeeb6ecfd5d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\13ecfa60-dcd1-4497-a0b4-2eeeb6ecfd5d.tmp
Size 26KB
SHA256 df59dfda241f60a87e47f0a6063e316b22a1c20561d2a683ee0cd7c0bcadba30
MD5 6d3e6f4d2a733abedb8d129040007b98
SHA1 3fb0512e09e02cbbb36193604c1588e460e81f50
SHA512 b94f13459683d4a9a5c7f60a2e7026de88ff5a22df1e9577cbbb505dbf4834c44022ba9ec05915310a6a2f9be8af9b49faf204710e21b92f305fae016728138d
SSDEEP 384:0iFCZcIUmsNw8TUNTUlIlUWfpu1r8V49iX5F1KwBPJAxJ+mChJoh:PFwZfwgnT8aUwBPkJ+mCbi
TLSH
T17FC229F258E7997AD9AD8743E77E2D034EBCC067B6846A54B3D8561CCC861BFC30A811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1deee584-2f33-4dc7-b3fa-3bc628b65304.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\1deee584-2f33-4dc7-b3fa-3bc628b65304.tmp
Size 18KB
SHA256 6c36166686849e325e10a960e04bf73222382e1c70ccbf1e22c5da3166f3efd2
MD5 e7d2e2bd9e6b9e44766681eb179b2f40
SHA1 61f302b80a4c71b4e3196faaffffc76e18c82ece
SHA512 06e6b1a8fab7054933e61cfd17423c1d94aa3b02053dde6d9d16407691407340b34b5b23c4c34cfbdc8f7d4b0b2982db7ba8fdd4dc02e5115040de6fa77fc1f8
SSDEEP 384:dZcIhsNtpWfpu1D8349iX5F13BPJAxJ+mChJoh:Fhh38a9BPkJ+mCbi
TLSH
T185828EB2ACB86D7A59E2D541F84739135FF8C127E7C82F88D5ED672D01CA398031B922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

48c7d31f-4b3c-4eaa-9b19-14e6de816996.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\48c7d31f-4b3c-4eaa-9b19-14e6de816996.tmp
Size 8KB
SHA256 0fbef6269886e1bda3550c40f4d48cb4504124d45192e88cd477218dc4e508b4
MD5 482258b994d44e1c8b9dac1c0e64d2e8
SHA1 893a77477d6937cd572076568f6831213303f37f
SHA512 6650b5d583ed9b2d64366c7c7d4f5db3428ffc927a18805c22de1a2221305755104ebf79e08beed8a15fd63a77c18e5c15ce1b2cb894f18b939a16c585b0a156
SSDEEP 192:LONI6AmwpTQmiUyeNKIsiX5Fqm9G6lRvgqqEU6:LONI6ipFtYIsiX5F1ZBU6
TLSH
T195121A36A8B86C3F5EE2A955F48736139FA98217EB887F84D5DC162C01DF29C530B522
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5d911951-23b4-4ddc-878b-9097db7cf6f4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\5d911951-23b4-4ddc-878b-9097db7cf6f4.tmp
Size 8KB
SHA256 11b7accd1da3a6e9fe289311a5d46507dfc848270f65d7c4e0c2607eff191cc2
MD5 006852bda962cb5059d83379e8d69d00
SHA1 433265f5cdce6945050f33781ba0ed7dae968da2
SHA512 dbc1d801768f38e705c1b27dba656ce282172a3b74d140df87a8b16370da03aa057ed8d3306f22c61cf01bbd56c71f84c54c38ca6ba43e39a74fedfac7e1b344
SSDEEP 96:gqONkdQsjpfuMVwptaL5ih/cIPURHl8h4otop52iCDaBIPuva6zx8X5FxmxQWmNU:LONl6AmwprQmiUyOK6siX5FqmgJimJU6
TLSH
T11A02FA35AC787C7B9EF3AE45B48B77179F99116BEB942F84CAE4162C01D729C1307422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7b70abb0-8e66-474c-bf00-b1a0f24b10e8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\7b70abb0-8e66-474c-bf00-b1a0f24b10e8.tmp
Size 18KB
SHA256 d5db513942b8c98cb1e5e8c63c0e92566a51a5591c1b6ee7ba982c966aa86e86
MD5 f429a14287c3c4efe5987065c6ac3036
SHA1 45c0127b326d958b631c30d8ffe9c1411b8dc59e
SHA512 df078b6ba5eb41779baf12bb06050010edc1925e1708acc3f160165193696ca4b657e04ad2586766264251d8b1cdbb588fd240fd3ddaec997df699aa013eef03
SSDEEP 384:dZcI7sNtpWfpu1Kb8349iX5F13BPJAxJ+mChJoh:F7he8a9BPkJ+mCbi
TLSH
T1EB828EB2ACB86D7A59E6D542F84739135FF8C127E7C82F88D5DD672D01CA398031B922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5421c8b0bf6e5f37422a05b412b233cde63f1db63aa71d65c91c5b31275595c0
MD5 07f616e3db8597d59ea940f94c1abb0b
SHA1 eedf28342bbff8c4cae798c2980ea6953992f1b2
SHA512 30782b7b7d8c6db47a40bc15f968f35fca7939aaa4b83a8a19c8f5a415c745b54c161abc0037d24bad8ebf15d5deb4134f24e357c1b5869f1598fa22619302be
TLSH
T163D0243C7F114D50D40041710530D50435D3CC1740D015050C354C074C101C11305CD0
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 daf8c1243ee20a2e95a6bd65ee87f94e97a213f1bc26473da181514314bf0e5e
MD5 22b29b46992ba3d1fd586e35207b402b
SHA1 03a007676fa49e6e9fbeffbbc2e943124c1b3d3d
SHA512 3634d483353d2e9fb49d846c71c6867053c6a8f1ead10608addea75574d5ce0e36c8de933f71d10bae9682752372e6f7925bbc3c9d982dfe840a9d664f859687
TLSH
T1BDD0243C3F514D50DC0041710530D50435D3CC1740D017070C354C074C101C11305CD0
MD5 SHA1 SHA512 TLSH

Submit Download

00eb1ecf-8cb4-454c-a777-33c59e3c0ec5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\00eb1ecf-8cb4-454c-a777-33c59e3c0ec5.tmp
Size 27KB
SHA256 cb420977c90249ec787b82b59115a589c043822db5824fa1bd98a1f18b0974b6
MD5 dad0fbd214c153668b4e84a3c83dc3c2
SHA1 1a882fbec7e3777a42067e1f9004c933fe16ad82
SHA512 cf7ed03012bcc3625e1dbccdaf57691c9d466429bd31645c4a543f6429f1d6aed40947924fb060ac85836f3f2e855eff861dae46059d2949b483fe7b6ca65749
SSDEEP 768:HJ30AbSWvS2l98F1+UoAYDCx9Tuqh0VfUC9xbog/OVGmLlLJ72grolZMfi:HJ30AbSWvS2l9u1jaLmLZ12rOi
TLSH
T164C2DA3B640CCB7E4FC05A9DDC6AAF9B6E9C02C796548D4047FA984C02C77EA51274DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

04aeab0f-6113-421b-9d71-c1f3a3359f80.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\04aeab0f-6113-421b-9d71-c1f3a3359f80.tmp
Size 10KB
SHA256 d1508bea5f9b02a94b233d4bf91c81a70912f46019924d1d066b00a10a0f8294
MD5 bc56fb5773d8f89a37fc7017680a9a2d
SHA1 28529030dd8bf021349c7e3143e74ab17be784e4
SHA512 20dcef797e6ed51161e7331d99580c0d5f7027cd599acb23f66d9d6315d6489267b919ac16f0e8257db3ff6cf684e5a39f7bfbe403b62bb92541161119d84382
SSDEEP 192:sxZ0RVWX/fNsbXIdp39UHW6+WNyg5/Y3Z2SIgrJ:sxZ0GX/fNsb46Hb//U9
TLSH
T1CF22C8526E34A97B8CCBD219FA55BF53E6FD4032A1D51E48BAFC851C04E66DD130780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2c61f39a-df07-4605-9e73-1946cdac40a3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2c61f39a-df07-4605-9e73-1946cdac40a3.tmp
Size 11KB
SHA256 4834ce7773c0f15dc6a111a76f16a89fbed7d6490e57b524cef3aff10cc01945
MD5 66f5c2ea6eb8c67f0ae085ba119d8604
SHA1 e83ddb0b0583238c79c01f9b58750def7ff84232
SHA512 890299d8adf1b827255b8e691f6d58d4d744e4facdacdbbbcfaa6c093184f6325c3541da7309c0817b6131df61156cda3f31745855213dbb3d51f71049fe1ee2
SSDEEP 192:sxZ+RVnX/fNsSWXIdp3SCUHW6+WNyJfZY3u2SIg5kJ:sxZ+3X/fNsSW4mHbgZfq
TLSH
T1E532B6926D34697B8CCBD219FA557F53E6FD4033A0D51E48AAFC862C04E66DE230780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5644c88d-91a9-4575-8989-d44b45b21345.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\5644c88d-91a9-4575-8989-d44b45b21345.tmp
Size 11KB
SHA256 1aa11fa8352cea29b565a66f3b0805b5d4fb027eb7c0378515baf7a6283b1478
MD5 6c5986a3417ad684df5c708d72680892
SHA1 aba831e97336fb70ce3265c10edc499e456f3811
SHA512 cc72c8613348b6b229d6d9b9df5a0c1ffb0c5af90be4c542c4c749d842594d11879471095d2de94ebd8b92758b2e39b8094d13e88e94b5bfa3d83cd2dccb1cf1
SSDEEP 192:sxZ+RV5X/fNsSWXIdpVSCUHW6+WNyJfZY372SIg5kJ:sxZ+pX/fNsSW4gHbgZOq
TLSH
T11032B6926D34697B8CCBD219FA557F53E6FD1032A0D51E48EAFC852C05E6ADE230740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

58ebcb99-97c8-4b1d-8bcc-9d13276ad39f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\58ebcb99-97c8-4b1d-8bcc-9d13276ad39f.tmp
Size 11KB
SHA256 a8ac51228e7794e7b09cd80fce3524d160b3dbdbae4d9ac9d9fec7f28c783ff1
MD5 203bc44bc58dd926275ad5f75d743522
SHA1 611da6c9e54d59162492f7f583ae2939b9a50477
SHA512 1ce15495608196db3c8557f7e637be16f4b9735d18fb4e211f22715e9b8cc1234bcf914beb6bd1893da01de9f011bb25e06c0de4b84bdd7197341e990ca02e79
SSDEEP 192:sxZ+RVnX/fNsSWXIdpVSCUHW6+WNyJfZY3V2SIg5kJ:sxZ+3X/fNsSW4gHbgZUq
TLSH
T14932B7926D34697B8CCBD219FA557F53E6FD1033A0D51E48AAFC862C05E6ADE230740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 9ed61e410bef19e5261833c61a81d33d6e12e5a19d8d52378770908f013f220a
MD5 3077020f6745269b5895cc7ede858c41
SHA1 77953c7d2f5458c53e20d8d62805a74c7b346861
SHA512 9c4688b36fa0e2f950c0e25e5f6a3485f689d01facc966406ae0e09fef495b64673a284535d507e483023d9a6c6b7bd7eab534da54a1950962bad2822a8a2ff2
TLSH
T100E020D5D8F4CF1F5334A44B0368770C87C2362B96C07B8D2B44C5447646440E6C157C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000074

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000074
Size 346KB
SHA256 51d725adc85e61c53d5ed7037835396b46e9fa3cfb658333861ddfc35fe63e9d
MD5 b28ce7f9dc81957871817c03cfcf9185
SHA1 30d1e930a04d4e493976eb041f8a1e53dcbdf322
SHA512 6f0685f95f8ce5874161b2dc5f02612af743447bf6a4442ae6a5ae78d42e4a9c3f38105ac0324009ee8bf65c620ad2918309174e98f027209595512a86bef2da
SSDEEP 6144:GNBARfr2x38GKGwQb0ln2iq7Pe+i8meINpylX5bfQZWY6BAk4HXH9C6UZoWFbkum:GNBufXs7+2z4/nylpzwRzHNDUaNuwX
TLSH
T1857423DA8608F8EEB240750A7C62FE2FD686191F4077BDD1B62E9AA63503C7054622D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000076

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000076
Size 39KB
SHA256 20b535fa80c8189e3b87d1803038389960203a886d502bc2ef1857affc2f38d2
MD5 9a01b69183a9604ab3a439e388b30501
SHA1 8ed1d59003d0dbe6360481017b44665153665fbe
SHA512 0e6795255b6eea00b5403fd7e3b904d52776d49ac63a31c2778361262883697943aedcb29feee85694ba6f19eaa34dddb9a5bfe7118f4a25b4757e92c331feca
SSDEEP 768:Vce3jkow68wmT4IBX0tXdlSirS61gSjcz0GPwHbP+w2jec56O:VcI/iEEEtXdFJj+0GPwHbP+w5rO
TLSH
T13703023A5E3CCF1A84157A703950F6D9A8481E548E9D143B4F1AC7BF085DDE2209B6D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 4KB
SHA256 7d1faf8d56af9d193c28150cfa304849352ba2e6e693c96953762ba483635c16
MD5 3d58dd1e923b654feb17e18ef25e9707
SHA1 a17e9f59d54d74a06100cc6f7e51beeeed68668e
SHA512 efce027ec0e0d511bc3b0460b4ed905ca10cc31377566ce951630e568b14152831379ddf099299bdb971ccbb1635a2d69d36a831dd0cd99699e46d8e445d04e2
SSDEEP 96:tzPUTXssxRUTQTAzvx678KwkDfuBOwoS5Ml:trU8scQTAz564AuU3ik
TLSH
T18B91846E95306951FB686430C6E634C664303A8B9E026FF301EAE7347DB6F9A1ACD0C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a3644586-bff7-4841-8317-682223f9846d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\a3644586-bff7-4841-8317-682223f9846d.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

105a810d-e1a5-4efb-9aa1-860ee3a40e9d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\105a810d-e1a5-4efb-9aa1-860ee3a40e9d.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

66f06ccc-aaae-4770-b6f9-fc72db784961.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\66f06ccc-aaae-4770-b6f9-fc72db784961.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

92d5fd3f-0082-4242-b15f-33cb04cfd7b0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\92d5fd3f-0082-4242-b15f-33cb04cfd7b0.tmp
Size 7KB
SHA256 be69e1f98f5967d56bc1e9df9c0f44cef850ecd9d563f5f9ab603ffc158f212f
MD5 52f604c5cdd23a35d8971ed7a98a519f
SHA1 895770149560c438dd2572cb0446b1b37f89a124
SHA512 006277c5d17c4b1723f53344b09d7c647e44186cc84ccca2cfbaca18bcac48e549399ffa922c48133ff99eb807c81e86a64cfbd82f5bcc51832a14cf492eb4e8
SSDEEP 192:DY4fTU1MtlgOtG53sgL4WtQNf6nJuNResObD9:DY4fTU1MtlgOtG53sgL4WtQNf2JuNRer
TLSH
T1A4E17BF7C7E9862DC85156F49B15AF1ECF1E0628432C3C2A88D8AF5B93E2431E21575E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 7866222c60c60d477f0d2be1934018f246a41f60b45d080622d6473f4f3847b4
MD5 f071475a357f22a4a588b860658d6c77
SHA1 d75cb9832052f12483644b05c792d26e5c00dda7
SHA512 3eca9958610736ced2b99b626793f4249c219d79102edb78ba554ed6a96b30c14796f75295328cab7b61a77cd18ff4c3fc87a74f642f8c626d3866e527e1619d
SSDEEP 48:K0TW3Td1FGbV4tISTGK9D1xGxbWYgBzXyLQiQtQwQcQiQAQgQxbQ8QLQsISQ0Qxp:KE0AKdGWCsAKp2SEAKtKOio
TLSH
T19D917090B07B5251387E6D4882A4865B128330F2705CE66FBFBD41A28EAFE158DFD4DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a1523a12-ac1e-4f65-88bb-86bf95003d69.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a1523a12-ac1e-4f65-88bb-86bf95003d69.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cf70fca8-3984-4d77-ab96-c28c0e369d95.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\cf70fca8-3984-4d77-ab96-c28c0e369d95.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f0056c91-140c-4ce5-90cd-160d7519c031.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f0056c91-140c-4ce5-90cd-160d7519c031.tmp
Size 10KB
SHA256 de7bc839161960dc2dcfe11547ded415dd754511571c52eb6d87fe348f38ec18
MD5 c27611a5131efbfe0cc69494345070fc
SHA1 ea6d2845f64d05a11fcc4e923a34408884a4a9d8
SHA512 08090fe7ae954c7990fed87def8a1a086d7d35563389677af843d4c3f862bffbf2bd30267502dd02459ed5df8295c5cc6339e83775f263e7aef7f0292a4adff2
SSDEEP 192:sxZ+RVnX/fNsSNXIdp39UHW6+WNyPFXY3c2SIg52J:sxZ+3X/fNsSN46HbcX3I
TLSH
T13932A5926E34697B8CCBD219FA55BB53E6FD0032A1D51E48EAFC952C04E66DD230780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

ddd82056-bca8-48d9-991d-3728491d4bc9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\ddd82056-bca8-48d9-991d-3728491d4bc9.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ac4180d9-c33e-40a1-a291-83075bed60ce.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ac4180d9-c33e-40a1-a291-83075bed60ce.tmp
Size 18KB
SHA256 208beb6e13e7353d4ce42a6770a437accd831a2bf3d21822d69fdc086d2ba6bd
MD5 a32ae9d153f1160568a3e0cc0e1806a4
SHA1 4d4393f79fb38ea3e15541c2761cefb009f55bfc
SHA512 e3a5e836d3d58553e518ff25aaf4fcf933f77d82274c5fa9be84fd3d86340d889e857d0edc9cc5d4cd73344e46752d7aa9be87976234964a3cd7accc8a857d09
SSDEEP 384:9ZcIysNtUWfpu148349iX5F13BPJAxJ+mChJoh:lyU28a9BPkJ+mCbi
TLSH
T123828EB2ACB86D7A59E6D542F84739135FF8C127E7C82F88D5ED572D01CA398031B922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 38a6d47c829def3033fac4a816991540ce445aa02c0e84ad4419fcd643bdec77
MD5 ea3f934731be5192f532a76d7d215a27
SHA1 0fc5d79c28f851c12f3c8bafe0ba316331660553
SHA512 e5330f86377f34faa6f0d7d3d30321c82dfb510a66cbe0e76d7057bea55cf6e869aafc598569eb9e61580f7b69a1a79af8e48975088047a5297c9b39f95fb055
TLSH
T12B41285CA6E91108B3B3AE5A9BF6A47D847B78373E46D56E10100E4F0A73E40C8A1B37
MD5 SHA1 SHA512 TLSH

Submit Download

COMCAT.DLL

Path C:\Users\Admin\AppData\Local\Temp\msftqws.pdw\COMCAT.DLL
Size 21KB
SHA256 96d04cdfaf4f4d7b8722b139a15074975d4c244302f78034b7be65df1a92fd03
MD5 3b180da2b50b954a55fe37afba58d428
SHA1 c2a409311853ad4608418e790621f04155e55000
SHA512 cf94ad749d91169078b8829288a2fc8de86ec2fe83d89dc27d54d03c73c0deca66b5d83abbeaa1ff09d0acac4c4352be6502945b5187ecde952cbb08037d07e8
SSDEEP 384:23Fob3slaN3oF1fHICOoMzMv/QTIBjDVquODJXsUW7ftWs6:Yo7s28JnOxzMv/QsBjRqugXspd
TLSH
T13EA2F992B7BA9013F1D201B5182DF317B3B56B7009ACA15E8324EE5E24F94535B7872B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VB6ES.DLL

Path C:\Users\Admin\AppData\Local\Temp\msftqws.pdw\VB6ES.DLL
Size 116KB
SHA256 b9c2fa6decf3c7027c6ac7d363a1714b732e0b75ad17327f3e31c6b88fa9e92a
MD5 5920f5a17a7bb807ef3f1f7cb5558728
SHA1 f1f19864bfcf4fbf317b1f8a234864f8cd0b3800
SHA512 31740ed25990ca269ef79dc1e191babd9ec53142fbac05bf2438a484195ab44aa2996b2b80d1add591e7439eb307ac2502fbe4f43a428fb32723e7ffee181a43
SSDEEP 1536:68ZRfCW/zG8144gC/B6RanAh5bRETVLxsllKUdB8Q62+V:6vwm44ftmV
TLSH
T176C3335167F96345F2F7BF39AABA1A644E3ABDA6ED39C10D4220015E0DB0F448D64B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VB6STKIT.DLL

Path C:\Users\Admin\AppData\Local\Temp\msftqws.pdw\VB6STKIT.DLL
Size 99KB
SHA256 df6e2f111773adec3b33dcb0b31e2a4d21ef7d51740706335f411e2c999c0e6b
MD5 cff867572b44212b01b711c1fa009537
SHA1 3978c9f7a3d77c0bdff4353949e2143757eebc79
SHA512 1b77ef24b1efb4939e4625deb1f8ebccc3c2edbb49b412dadb8a3c293a265c77ea84d8eb725d3af5bb84d9c040a91debe5890f57ed8750147e91f30c1a0630c4
SSDEEP 3072:c6v5KkE3OEc4dUN5KgzIED1LAOWOa+dSogCh:csKkE+Ec4dU/KXEDunOaC
TLSH
T1C1A36C40BAD1C0F5F0D106BC01E66B7AAF3B69754B9295C3C710EE776C722F1A53A24A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

asycfilt.dll

Path C:\Users\Admin\AppData\Local\Temp\msftqws.pdw\asycfilt.dll
Size 65KB
SHA256 0091bec0ebb00c65fcf198a7871b827d35fa1944214f26220b6856fdf2c839cb
MD5 b68926b03d0a980ec8365d6220aed640
SHA1 da2311f0ec08c99dd445ccbdd3a0a1dc8fc80e3e
SHA512 a5c021fbf8bc13dffd29bef747e7a998497e542a6c5df238f139c17212c9420e981acf49260a317238bfa45dcf75a69e6b88cf84eb25f657ea2eec73fcd50571
SSDEEP 1536:h+r9IO1boo9EpzksAUfdvhoF7QxipFgOuF:k9Iko5J7nhoFkxgv
TLSH
T1A2636B31A9604036C8E222B49A4E7B35596D87B20B6D52D702181BF9FB34BD1EF783C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvbvm60.dll

Path C:\Users\Admin\AppData\Local\Temp\msftqws.pdw\msvbvm60.dll
Size 1.3MB
SHA256 2d8bea00c4393a8289614e3b07adc74eec8c97e4f81ef370e390dfda0e7f7e66
MD5 8d43735c8b4519ccc473d68e25f24c1d
SHA1 366f85361cb0598f196447c100f8f56f6f96e3e0
SHA512 3910e4b2a3b5ee1256d9b6491176c686d1dec9d9b5be2b509f01841bdac6ee8997b94c4a1e8d5b8b8bd70b24199547d795ffc907e1494db55a10eb28b3014b90
SSDEEP 24576:Xc+xgXIiJlHZ1ayX23Q7Rfuf842W2WufnXHs7UoSkmPZxKRo9Dg:XQsA7Rfuf84eWufnXHVoSkkLFm
TLSH
T18555AE1333E49077CAA379380BA66775B3B56D20AD35AA8B1360353F1836741A72F736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

oleaut32.dll

Path C:\Users\Admin\AppData\Local\Temp\msftqws.pdw\oleaut32.dll
Size 551KB
SHA256 8e66d107ff935ff9976e75822253855a2402683ef071413ce4ff8d466fafe99a
MD5 349084b33ae5f6929a2b58ce105390be
SHA1 4e920b81814b6bf58440989c1c3f15ad8b13f796
SHA512 46fb65c2718eda6e885f721bb4baad1e9244e83170d31370c93c2d243c5079c9d25e1d3e738ee60e8a0597347e3350091a8f89468ee12d3efbb533f1135582b9
SSDEEP 12288:/hQsV/9dUUh52IPYGHrQO4owpKkuW9C5TNS18EdNb/RUJCHg:pQA/nU6AIPYGHL4BKkuW9CSvNb/RUl
TLSH
T137C47C2175D390B1C423307086AE72B5E2EDDE39156DBA070A94DB352EB4491DF3AE8F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

olepro32.dll

Path C:\Users\Admin\AppData\Local\Temp\msftqws.pdw\olepro32.dll
Size 87KB
SHA256 70233ff8b36172afb59575e8b16d25ac03ca9b25ac1a47fd7544a1a55a3e41c9
MD5 4e5ac2e22dde7dc39743eb0700f72c1e
SHA1 1f93665b0af184e25388c75c07c81402072ffb31
SHA512 d922def8ab24b37b8802b77b8ad92ce6f9d3a8f874133e6f827752bbd16bbaf53127e583437bdfc62fb0d05a4e6dce5d8b330b419cc9733b998948adb1ce245f
SSDEEP 1536:dfZj6T6xM5FPWhP3+Qj1jY5yfNbGLa5Divz9kIZwMth9E:dhjdmDaXj1jYw1o6Dm9iMo
TLSH
T1CF93F7743641D632C8D225B1095DB6B65EADFF530F2812C336943BEEED742C18E3868A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

stdole2.tlb

Path C:\Users\Admin\AppData\Local\Temp\msftqws.pdw\stdole2.tlb
Size 16KB
SHA256 01de2a877c4cd3d11a47f49f22715ab285a9682f3855aa35d130d4b3438b86eb
MD5 d5213329522f620a50ef2dbdc7f4d0d7
SHA1 7a3fcad96dbf47a6cb5fbd0a3c1bf923bbc1e8d8
SHA512 41ca27383f93a84af613c723ecacf74ccee0f99c178d21460a6af076fd3800c556094c23f07ab18a5fd3302ecb801a41f9cdb0af2d2577324326753c49de3f91
SSDEEP 192:rFn2YJdPWF0Y3wAQgiQJdDg5rDLWQrNBm5C7BTNcJL8Bz8Q0WwT:rFbuFrR+X6QNn1pcJIQWwT
TLSH
T1C8722E1AB781CDB2D42E41314C5FE3D99E71BC41AE11E7273388336F6DB27A87A46A50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6b5904aa-d8f3-4469-9b76-7f89532d09c8.tmp

Path C:\Users\Admin\Downloads\6b5904aa-d8f3-4469-9b76-7f89532d09c8.tmp
Size 3.2MB
SHA256 65c40c983a1451ab8aba2357c2dd934f9e87cf2132d1dbb502618c3f79d3438a
MD5 44d6ead3464698b218ccf0f48acbcf0d
SHA1 a629c37728add1cd0f54892c6ff365f182131383
SHA512 44d8fb54802eb43649af2424fbb037e946a18a2bd803b4150ed6cd054777ce34e3913ce37fdc445a40133548296a23d419b1078468cdfbfad1492169426b31a1
SSDEEP 98304:hVktyVahRQBzDbwtd8r7vpabhsSxY2c+Z8vUSlggM:SXhcXMC7UbhsSw1lu
TLSH
T18FF5337B135CE5E7FA740637F652AA5DC9DE81ED6346243B20AC708278BD8D53BB1820
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SETUP.LST.crdownload

Path C:\Users\Admin\Downloads\SETUP.LST.crdownload
Size 4KB
SHA256 5d8dfd4ef386f6e50deab9542d1702ececfced594ba50d4e61551b76b4bea4e6
MD5 583c52987e0206fd93a7415ce13b169b
SHA1 1d7f6558a7bdab57650ab8e5babdcdf77a034f6b
SHA512 ffee83c74bd3afbcef3e73fc16fc410e011a0439a76465f184227ad5f9d0d2981469d86332e7aa45ae2401db69fba7a276f175e9f8deca54bf58ef9d1312bef0
SSDEEP 48:a4GU3Tax4Zn/u5TZNpjXX/OV1EG+bqMOoIuxoIi9t74:tZTax4ZnG5TN0EGD7oIgojM
TLSH
T1B491C967E8CED1E9B4F0BF5B97BE60236A1F242444813C1CE0BC593C058A4339699DF1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe.crdownload

Path C:\Users\Admin\Downloads\setup.exe.crdownload
Size 139KB
SHA256 d00e85a7d6d8bfbffbade69cf92380b08dbd1ef374f6d7260f256a0bebd68e0d
MD5 d06cee4016aac5e427390655a870b0f4
SHA1 59207ed09c2b2c22dd1c7c8e7f9e74342a96af96
SHA512 23997e9c47b1e41fad9d5b28257d3684803741ddf0b285bcc701328041373adeb3b5954a1807f0d3fe75d3879b22e83cf6528b91a7897685a6920cda15588a40
SSDEEP 3072:TqwmOGqM8OROAO5UTS7vdWcoWxg7YjcZJQgeu:Tq0M8OQAO5WSocVxgGcr
TLSH
T1C9D3281172E5C1B2F5F2277154B59A35AE3ABC315B35D28BC700DE2B1C70AA4AD383A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ST6UNST.000

Path C:\WINDOWS\ST6UNST.000
Size 1KB
SHA256 56ef36122915e2e935e2567d95b0f7b9e912d8e9b7bbd2c140ac8215b5ff3356
MD5 1d00331b0592a8bba9115dfd3aab71fe
SHA1 0db3c3a564881d9035c5db39fc56073a6742e485
SHA512 2b321cfb92cd48155287c177030c447b7a56da7e082d3e8a20e0c26fff3bcd1fa5ef35ba2c4906bea7aff4edd291e2e4d0e2b16cd02710de7a62feaf80f186d9
TLSH
T1FF4103799BEA43E06DD00D1C69DFC6046714F0B0782EDB2681BD2984A468F05DFFB999
MD5 SHA1 SHA512 TLSH

Submit Download

ST6UNST.000

Path C:\WINDOWS\ST6UNST.000
Size 1KB
SHA256 d01b3d58d5afd7a0c9c89e64d209f55532a45c5f9f1453db4df89ceb07093b32
MD5 a59ce1d3dd5a07773f048524fcd6e46b
SHA1 f2ac02e78b540f17f310787bd2537de03b797263
SHA512 61a04864cfe180b86a055077c3a8be9c3b5d984973869e22ee64ab6d9d14b27d5b1cbe565ce10c131acd8576ebb2f65a17ed4891586cc39fe8f5ef3de647880b
TLSH
T19A4112799BEA42D06DD00D1C69EBC6046714F0F0782EDB1581BD2988E05CF05EFFB999
MD5 SHA1 SHA512 TLSH

Submit Download

ST6UNST.000

Path C:\Windows\ST6UNST.000
Size 1014B
SHA256 6e3f5710334ea7b712359b52b82bf9a02d6131a67ded93335ea73f066111b0ba
MD5 ef80f902be4706b9fb6addfd2fe42d89
SHA1 fb7e97e4ec5ffd0a0dc5d19c32f86e78c426b142
SHA512 071612f68ebefe9f5caa71565c0f24bf11ea9a53dd92e32da6013c82ba29148e8c6d81ac6582156751d9fad2034533f54a5b52850719d0f6440801c3281200d9
TLSH
T1E611E17A95E782B0A8400E15799ED700B314F0A4380FE92251BC6644EA59F0AE7F69DD
MD5 SHA1 SHA512 TLSH

Submit Download

ST6UNST.000

Path C:\Windows\ST6UNST.000
Size 3KB
SHA256 6ba657a2643065e74068cc3b4337c74afe8f7604dd6d003fba604b17c4f8998e
MD5 91776969e55944f9a52cec6d14749d73
SHA1 37bed578c500fc2dd76cd874c7973828b5a83e84
SHA512 ad2a7f1d8a333649e3b879823317a55bd24bdf662ab786c5b2dd9e5f0ea5f05b8b96d7879e88e3d52edb8445f396b4bd11e2613e567efa3f502a39afd6a412bd
TLSH
T1DD8158754FDA81A139B10A0CA2DBF740B208E0789C55D76DC17E3D26A44EFC4DAB7B46
MD5 SHA1 SHA512 TLSH

Submit Download

ST6UNST.000

Path C:\Windows\ST6UNST.000
Size 607B
SHA256 cdd7177f76cca7725a7db33abf6c618ef19bf3a6d1abb0a463c23f59d9394a87
MD5 98e894166c29108e0ea1f73f0a546c93
SHA1 301ee626f7734fc29006198b2df9f5c18ca21863
SHA512 47a39f1d45b643d4861a4724d24c4fe026bc40793bc9b580f2ed36c2ad49511d1eb757af06a342c99e03c94ce15b88b1a187a8570a7b38d099c2b9b37ee65ab4
TLSH
T1F2F0E1BB46EB504265850B16BA5BA254E398D1BC740BFA00109C6B84D749F41F3BE19D
MD5 SHA1 SHA512 TLSH

Submit Download

Setup1.exe

Path C:\Windows\Setup1.exe
Size 284KB
SHA256 86fb9d030e11b2997cba0c321a4b649f06293a7971398d016bfa67ad5800277d
MD5 8aa40fd187a56c90d157f6917e093817
SHA1 99bc7ed30ecb23334c9b68abea23994a033b9bad
SHA512 d89e784c4d70553fac861a7a616129c02aea6a8a9177b5c56dbb4f8d4871911527ca65712740d39772384a962975d3beb15163570572c0367fda2b7ac1d8414e
SSDEEP 6144:ouOxemROOMqMA8K3eEGOCUgtLD2J9dh4bYTJ6Q7:7O3OmMQGp2J9X
TLSH
T15E54F92263D47B56F1B68EF05D760694C87EBC3559B0990FD7C11E0A2AB2E83DB21327
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp.000

Path C:\Windows\temp.000
Size 72KB
SHA256 69c66a8e0085e4ebff940b426c84feddf6aab0f97e43658b872f63dd6c6c9761
MD5 7f787d537ae26932e9eaf2442abd6b98
SHA1 e3dc598b5245ca0f6857351b28ad1b97a5072dda
SHA512 2551e88d62f4f94b2d6778c348e3a90dd3324042c32693a6ca1afa82fefcbc56730e467b2565b39a4882027de558d26babd34c27c3e42d7e2f3dea8293989ba5
SSDEEP 1536:RKTg6tZkYVxqdE5NLt3mZCSRCxDka6tg7hexf8e:YsixsE5b3mZCwC1AtgVY8e
TLSH
T135732B41AAE55CB2F6B2373024F567768E3BFD5B5A38C25B8350D9AB1C31640D92832B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download