njrat | 70485ce33c53aa8d552707b55c43cdd6a02a3d63d84756063e2a5846b4aa4869

Analysis

user interaction
yes
max time kernel
1048s
max time network
425s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
12/10/2026, 10:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Server.exe
Size 93KB
Sample261012-mppdzavves
SHA256 70485ce33c53aa8d552707b55c43cdd6a02a3d63d84756063e2a5846b4aa4869
MD5 f15de45c13db7eab4decff2866eaeb6c
SHA1 01a4cf9a4d1fbea3bd9ca5c60f712c06806d0956
SHA512 29199ebd88319c9fd78627eba6572f3610da1a1d16ba49a058dfe01f350b0c34a636b767433bd27cc7f494d05df0f79d7cb90d09f4472eb79807a37be4252d9e
SSDEEP 768:gY3lVfhWXxyFcxovUKUJuROprXtWN8eYhYbmXxrjEtCdnl2pi1Rz4Rk3VsGdpYgM:9V5WhIUKcuOJhPhBjEwzGi1dDlDYgS
TLSH
T19293E74977E56524E0BF56F79871F2004F74B48B1612E39D48F219AA0A33AC44F89FEB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

hacked by vrmy defense_evasion discovery execution njrat persistence privilege_escalation ransomware trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed By vrmy

hakim32.ddns.net:2000
8.tcp.cpolar.cn:13093

Mutex

9035f860ff1de96a9f7a397f20381535

Attributes

reg_key
9035f860ff1de96a9f7a397f20381535
splitter
|'|'|

Signatures

Family: njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
Disables Task Manager via registry modification
defense_evasion

Modifies Windows Firewall 2 TTPs 3 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
4708	netsh.exe
2204	netsh.exe
380	netsh.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Control Panel\International\Geo\Nation	Server.exe
Key value queried	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Control Panel\International\Geo\Nation	tmp94E.tmp.exe

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Server.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Server.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 1 IoCs

pid	Process
4748	tmp94E.tmp.exe

Modifies system executable filetype association 2 TTPs 47 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\runas\command	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shellex\DropHandler	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runasuser	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\ContextMenuHandlers\PintoStartScreen	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\edit	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shellex\ContextMenuHandlers\Compatibility	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shellex\DropHandler	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\OpenContainingFolderMenu	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\runas	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\DropHandler	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\lnkfile\shellex\ContextMenuHandlers\ FileSyncEx	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\print	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shellex\ContextMenuHandlers	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\lnkfile\shellex\ContextMenuHandlers	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\IconHandler	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\tabsets	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\DefaultIcon	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\runasuser	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shellex\{8895b1c6-b41f-4c1c-a562-0d564250836f}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\DefaultIcon	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shellex	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\DropHandler	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\edit\command	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\DefaultIcon	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\CLSID	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runasuser\command	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\ContextMenuHandlers\Compatibility	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\{00021401-0000-0000-C000-000000000046}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shellex\DropHandler	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shellex\IconHandler	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\runasuser\command	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runas	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\ContextMenuHandlers	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runas\command	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\print\command	reg.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Explower.exe	Server.exe
File opened for modification	C:\Windows\SysWOW64\Explower.exe	Server.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Explower.exe	Server.exe
File opened for modification	C:\Program Files (x86)\Explower.exe	Server.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
624	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Server.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Server.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2064	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{73647561-0000-0010-8000-00AA00389B71}\InprocServer32	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\runas\command	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{129D7E40-C10D-11D0-AFB9-00AA00B67A42}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CF4F55F4-8F87-4D47-80BB-5808164BB3F8}\DataFormats\GetSet\1	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Extensions\ContractId\Windows.BackgroundTasks\PackageId\Microsoft.Windows.ShellExperienceHost_10.0.19041.1023_neutral_neutral_cw5n1h2txyewy\ActivatableClassId\App.AppXgxgm8gs8b9vsjsd9gvhmn	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{17BF8FA3-4C5A-49A3-B2F8-5942E1EA287E}\ProxyStubClsid32	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0006F069-0000-0000-C000-000000000046}\InprocServer32\15.0.0.0	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{62B4D041-4667-40B6-BB50-4BC0A5043A73}	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\.m4v\OpenWithProgids	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\CLSID\{CAFEEFAC-0014-0002-0074-ABCDEFFEDCBB}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000209A4-0000-0000-C000-000000000046}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630FA-0000-0000-C000-000000000046}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{987db579-3ba3-4c95-a762-c931ff53663c}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.w64	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Extensions\ContractId\Windows.BackgroundTasks\PackageId\Microsoft.MicrosoftStickyNotes_3.6.73.0_x64__8wekyb3d8bbwe\ActivatableClassId\App.AppX9faf3c1mkamh8e300g054wegxfnq2aen.mca	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2959618A-A692-48FF-8CEF-7A28A4F50954}\ProxyStubClsid32	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{305106DE-98B5-11CF-BB82-00AA00BDCE0B}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.mpg\shell	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{00020906-0000-0000-C000-000000000046}\MiscStatus	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\CLSID\{CAFEEFAC-0014-0002-0095-ABCDEFFEDCBA}	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\CLSID\{CAFEEFAC-0017-0000-0389-ABCDEFFEDCBB}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{f07f3920-7b8c-11cf-9be8-00aa004b9986}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F8CF7A98-2C45-4c8d-9151-2D716989DDAB}\Version	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{91493483-5A91-11CF-8700-00AA0060263B}\ProxyStubClsid32	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Charset\hz-gb-2312	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6448ddea-c1cd-5143-a422-5fe4f008cc92}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.msstyles	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\CLSID\{CAFEEFAC-0018-0000-0239-ABCDEFFEDCBB}\InprocServer32	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Interface\{2B865677-AC3A-43BD-B9E7-BF6FCD3F0596}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{49E0DBD1-9440-466C-9C97-95C67190C603}\ProxyStubClsid32	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F6F94D21-78C2-11D2-8FFE-00C04FA38314}	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\xboxgames	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\AppX8mg1ky09gvfdexfmk8e77463mz4j1xcp\Shell	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\SVCID.Local\7f7b65b8-769f-4221-a079-d93a05a933df	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Word.Application.8\CLSID	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\WOW6432Node\CLSID\{7AFDFDDB-F914-11E4-8377-6C3BE50D980C}\InprocServer32	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\CLSID\{CAFEEFAC-0015-0000-0076-ABCDEFFEDCBC}	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\CLSID\{CAFEEFAC-0017-0000-0028-ABCDEFFEDCBA}\InprocServer32	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\FDate.Factoid\CurVer	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00020873-0000-0000-C000-000000000046}\TypeLib	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4DC034A8-4BFC-4D43-9250-914163356BB0}\TypeLib	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E4442A83-F623-459C-8E95-8BFB44DCF23A}\ProxyStubClsid32	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Msi.Package\shell\Uninstall	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\AppXe05qdnx2p14g0mw29139zqs9s5n3wcne\Shell\open	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5052A832-2C0F-46c7-B67C-1F1FEC37B280}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1F1289FD-DD10-4579-81F6-1C59AAF2E1A9}\1.0\0\win64	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.a52\shell\Open\command	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.snd\shell\PlayWithVLC	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0006F04F-0000-0000-C000-000000000046}\InprocServer32	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3050F24D-98B5-11CF-BB82-00AA00BDCE0B}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C100BEEE-D33A-4a4b-BF23-BBEF4663D017}	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\CLSID\{CAFEEFAC-0017-0000-0022-ABCDEFFEDCBB}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\DirectShow\MediaObjects\Categories\f3602b3f-0592-48df-a4cd-674721e7ebeb\ef985e71-d5c7-42d4-ba4d-2d073e2e96f4	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000244E4-0000-0000-C000-000000000046}\ProxyStubClsid32	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\OSE.Global	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\PowerPoint.SlideShow.12\shell\New	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\TypeLib\{638805C3-4BA3-4AC8-8AAC-71A0BA2BC284}\1.0\0\win32	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8BF94B48-1E76-4AA3-AB1D-463F49B3E681}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D80C5D22-F56B-477D-80C1-F019C08E6D22}\ProxyStubClsid32	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\CLSID\{CAFEEFAC-0016-0000-0008-ABCDEFFEDCBC}	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\CLSID\{CAFEEFAC-0017-0000-0076-ABCDEFFEDCBB}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{c87ccf7a-4663-4eeb-8230-d5a86fcd074f}\ProxyStubClsid32	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C62A69F0-16DC-11CE-9E98-00AA00574A4F}	reg.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2560	Server.exe
2560	Server.exe
2560	Server.exe
2560	Server.exe
2560	Server.exe
2560	Server.exe
2560	Server.exe
2560	Server.exe
2560	Server.exe
2560	Server.exe
2560	Server.exe
2560	Server.exe
2560	Server.exe
2560	Server.exe
2560	Server.exe
2560	Server.exe
2560	Server.exe
2560	Server.exe
2560	Server.exe
2560	Server.exe
2560	Server.exe
2560	Server.exe
2560	Server.exe
2560	Server.exe
2560	Server.exe
2560	Server.exe
2560	Server.exe
2560	Server.exe
2560	Server.exe
2560	Server.exe
2560	Server.exe
2560	Server.exe
2560	Server.exe
2560	Server.exe
2560	Server.exe
2560	Server.exe
2560	Server.exe
2560	Server.exe
2560	Server.exe
2560	Server.exe
2560	Server.exe
2560	Server.exe
2560	Server.exe
2560	Server.exe
2560	Server.exe
2560	Server.exe
2560	Server.exe
2560	Server.exe
2560	Server.exe
2560	Server.exe
2560	Server.exe
2560	Server.exe
2560	Server.exe
2560	Server.exe
2560	Server.exe
2560	Server.exe
2560	Server.exe
2560	Server.exe
2560	Server.exe
2560	Server.exe
2560	Server.exe
2560	Server.exe
2560	Server.exe
2560	Server.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2560	Server.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs

pid	Process
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2560	Server.exe
Token: 33	2560	Server.exe
Token: SeIncBasePriorityPrivilege	2560	Server.exe
Token: 33	2560	Server.exe
Token: SeIncBasePriorityPrivilege	2560	Server.exe
Token: 33	2560	Server.exe
Token: SeIncBasePriorityPrivilege	2560	Server.exe
Token: 33	2560	Server.exe
Token: SeIncBasePriorityPrivilege	2560	Server.exe
Token: 33	2560	Server.exe
Token: SeIncBasePriorityPrivilege	2560	Server.exe
Token: 33	2560	Server.exe
Token: SeIncBasePriorityPrivilege	2560	Server.exe
Token: 33	2560	Server.exe
Token: SeIncBasePriorityPrivilege	2560	Server.exe
Token: 33	2560	Server.exe
Token: SeIncBasePriorityPrivilege	2560	Server.exe
Token: 33	2560	Server.exe
Token: SeIncBasePriorityPrivilege	2560	Server.exe
Token: 33	2560	Server.exe
Token: SeIncBasePriorityPrivilege	2560	Server.exe
Token: 33	2560	Server.exe
Token: SeIncBasePriorityPrivilege	2560	Server.exe
Token: 33	2560	Server.exe
Token: SeIncBasePriorityPrivilege	2560	Server.exe
Token: 33	2560	Server.exe
Token: SeIncBasePriorityPrivilege	2560	Server.exe
Token: 33	2560	Server.exe
Token: SeIncBasePriorityPrivilege	2560	Server.exe
Token: 33	2560	Server.exe
Token: SeIncBasePriorityPrivilege	2560	Server.exe
Token: 33	2560	Server.exe
Token: SeIncBasePriorityPrivilege	2560	Server.exe
Token: 33	2560	Server.exe
Token: SeIncBasePriorityPrivilege	2560	Server.exe
Token: 33	2560	Server.exe
Token: SeIncBasePriorityPrivilege	2560	Server.exe
Token: 33	2560	Server.exe
Token: SeIncBasePriorityPrivilege	2560	Server.exe
Token: 33	2560	Server.exe
Token: SeIncBasePriorityPrivilege	2560	Server.exe
Token: 33	2560	Server.exe
Token: SeIncBasePriorityPrivilege	2560	Server.exe
Token: 33	2560	Server.exe
Token: SeIncBasePriorityPrivilege	2560	Server.exe
Token: 33	2560	Server.exe
Token: SeIncBasePriorityPrivilege	2560	Server.exe
Token: 33	2560	Server.exe
Token: SeIncBasePriorityPrivilege	2560	Server.exe
Token: 33	2560	Server.exe
Token: SeIncBasePriorityPrivilege	2560	Server.exe
Token: 33	2560	Server.exe
Token: SeIncBasePriorityPrivilege	2560	Server.exe
Token: 33	2560	Server.exe
Token: SeIncBasePriorityPrivilege	2560	Server.exe
Token: 33	2560	Server.exe
Token: SeIncBasePriorityPrivilege	2560	Server.exe
Token: 33	2560	Server.exe
Token: SeIncBasePriorityPrivilege	2560	Server.exe
Token: 33	2560	Server.exe
Token: SeIncBasePriorityPrivilege	2560	Server.exe
Token: 33	2560	Server.exe
Token: SeIncBasePriorityPrivilege	2560	Server.exe
Token: 33	2560	Server.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2560 wrote to memory of 4708	2560	Server.exe	91
PID 2560 wrote to memory of 2204	2560	Server.exe	93
PID 2560 wrote to memory of 380	2560	Server.exe	94
PID 2560 wrote to memory of 4732	2560	Server.exe	104
PID 4732 wrote to memory of 4660	4732	msedge.exe	105
PID 4732 wrote to memory of 2064	4732	msedge.exe	106
PID 4732 wrote to memory of 2060	4732	msedge.exe	107
PID 4732 wrote to memory of 3544	4732	msedge.exe	108
PID 4732 wrote to memory of 2060	4732	msedge.exe	107
PID 4732 wrote to memory of 2060	4732	msedge.exe	107
PID 4732 wrote to memory of 3544	4732	msedge.exe	108
PID 4732 wrote to memory of 1432	4732	msedge.exe	109
PID 4732 wrote to memory of 1432	4732	msedge.exe	109
PID 4732 wrote to memory of 2040	4732	msedge.exe	110
PID 4732 wrote to memory of 1432	4732	msedge.exe	109
PID 4732 wrote to memory of 2040	4732	msedge.exe	110
PID 4732 wrote to memory of 2040	4732	msedge.exe	110
PID 4732 wrote to memory of 4372	4732	msedge.exe	112
PID 4732 wrote to memory of 1544	4732	msedge.exe	113
PID 4732 wrote to memory of 4372	4732	msedge.exe	112
PID 4732 wrote to memory of 4372	4732	msedge.exe	112
PID 4732 wrote to memory of 1544	4732	msedge.exe	113
PID 4732 wrote to memory of 1544	4732	msedge.exe	113
PID 4732 wrote to memory of 4376	4732	msedge.exe	114
PID 4732 wrote to memory of 4376	4732	msedge.exe	114
PID 2560 wrote to memory of 3532	2560	Server.exe	115
PID 4732 wrote to memory of 5100	4732	msedge.exe	117
PID 4732 wrote to memory of 5100	4732	msedge.exe	117
PID 4732 wrote to memory of 5100	4732	msedge.exe	117
PID 4732 wrote to memory of 4020	4732	msedge.exe	118
PID 4732 wrote to memory of 4020	4732	msedge.exe	118
PID 4732 wrote to memory of 4020	4732	msedge.exe	118
PID 4732 wrote to memory of 2428	4732	msedge.exe	119
PID 4732 wrote to memory of 2428	4732	msedge.exe	119
PID 2560 wrote to memory of 1076	2560	Server.exe	120
PID 4732 wrote to memory of 3180	4732	msedge.exe	121
PID 4732 wrote to memory of 3180	4732	msedge.exe	121
PID 4732 wrote to memory of 3180	4732	msedge.exe	121
PID 4732 wrote to memory of 2996	4732	msedge.exe	122
PID 4732 wrote to memory of 2996	4732	msedge.exe	122
PID 4732 wrote to memory of 2996	4732	msedge.exe	122
PID 4732 wrote to memory of 4004	4732	msedge.exe	124
PID 4732 wrote to memory of 4004	4732	msedge.exe	124
PID 4732 wrote to memory of 4004	4732	msedge.exe	124
PID 2560 wrote to memory of 1996	2560	Server.exe	125
PID 4732 wrote to memory of 884	4732	msedge.exe	126
PID 4732 wrote to memory of 884	4732	msedge.exe	126
PID 4732 wrote to memory of 884	4732	msedge.exe	126
PID 2560 wrote to memory of 4292	2560	Server.exe	127
PID 4732 wrote to memory of 2264	4732	msedge.exe	128
PID 4732 wrote to memory of 2264	4732	msedge.exe	128
PID 4732 wrote to memory of 2264	4732	msedge.exe	128
PID 4732 wrote to memory of 2740	4732	msedge.exe	129
PID 4732 wrote to memory of 2740	4732	msedge.exe	129
PID 4732 wrote to memory of 2740	4732	msedge.exe	129
PID 2560 wrote to memory of 2880	2560	Server.exe	130
PID 2560 wrote to memory of 4448	2560	Server.exe	131
PID 4732 wrote to memory of 4688	4732	msedge.exe	132
PID 4732 wrote to memory of 4688	4732	msedge.exe	132
PID 4732 wrote to memory of 4688	4732	msedge.exe	132
PID 4732 wrote to memory of 4380	4732	msedge.exe	133
PID 4732 wrote to memory of 4380	4732	msedge.exe	133
PID 4732 wrote to memory of 4380	4732	msedge.exe	133
PID 4732 wrote to memory of 3168	4732	msedge.exe	134

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\Server.exe
"C:\Users\Admin\AppData\Local\Temp\Server.exe"
1⤵
- Checks computer location settings
- Creates a file in the Startup directory
- Drops file in System32 directory
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2560
- C:\Windows\SysWOW64\netsh.exe
  netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\Server.exe" "Server.exe" ENABLE
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:4708
- C:\Windows\SysWOW64\netsh.exe
  netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\Server.exe"
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:2204
- C:\Windows\SysWOW64\netsh.exe
  netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\Server.exe" "Server.exe" ENABLE
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.facebook.com/
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4732
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x2ec,0x7ff87d08c188,0x7ff87d08c194,0x7ff87d08c1a0
    3⤵
    PID:4660
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1772,i,15958533809975063084,5037603630120542883,524288 --field-trial-handle=2600,i,17602958172434584127,2250643922720907930,262144 --variations-seed-version --mojo-platform-channel-handle=2644 /prefetch:3
    3⤵
    - System Time Discovery
    PID:2064
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1644,i,9761830997139759746,18130370363683904054,262144 --field-trial-handle=2600,i,17602958172434584127,2250643922720907930,262144 --variations-seed-version --mojo-platform-channel-handle=2596 /prefetch:2
    3⤵
    PID:2060
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2320,i,14645388788187718637,4030999562495770374,524288 --field-trial-handle=2600,i,17602958172434584127,2250643922720907930,262144 --variations-seed-version --mojo-platform-channel-handle=2668 /prefetch:8
    3⤵
    PID:3544
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3484,i,10775857396794455131,14649448983156454016,2097152 --field-trial-handle=2600,i,17602958172434584127,2250643922720907930,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
    3⤵
    PID:1432
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3508,i,12259650304019658058,14045556898717630409,2097152 --field-trial-handle=2600,i,17602958172434584127,2250643922720907930,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
    3⤵
    PID:2040
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4112,i,3690142195069854797,7676487701726737061,2097152 --field-trial-handle=2600,i,17602958172434584127,2250643922720907930,262144 --variations-seed-version --mojo-platform-channel-handle=4588 /prefetch:1
    3⤵
    PID:4372
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4124,i,6679147967882857561,6720355634713681015,2097152 --field-trial-handle=2600,i,17602958172434584127,2250643922720907930,262144 --variations-seed-version --mojo-platform-channel-handle=4648 /prefetch:2
    3⤵
    PID:1544
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5064,i,17828872417108923393,15764969277415532999,524288 --field-trial-handle=2600,i,17602958172434584127,2250643922720907930,262144 --variations-seed-version --mojo-platform-channel-handle=4120 /prefetch:8
    3⤵
    PID:4376
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5144,i,5012682999102405215,18190059123481629949,2097152 --field-trial-handle=2600,i,17602958172434584127,2250643922720907930,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:1
    3⤵
    PID:5100
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5320,i,5961331613890877164,11368526573026663861,2097152 --field-trial-handle=2600,i,17602958172434584127,2250643922720907930,262144 --variations-seed-version --mojo-platform-channel-handle=5344 /prefetch:1
    3⤵
    PID:4020
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5492,i,8678526437681920815,11646176298670398395,524288 --field-trial-handle=2600,i,17602958172434584127,2250643922720907930,262144 --variations-seed-version --mojo-platform-channel-handle=5324 /prefetch:8
    3⤵
    PID:2428
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=5636,i,3305493089549208552,425328329641237842,2097152 --field-trial-handle=2600,i,17602958172434584127,2250643922720907930,262144 --variations-seed-version --mojo-platform-channel-handle=5648 /prefetch:1
    3⤵
    PID:3180
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=5820,i,3678562521392384675,3816808697421339532,2097152 --field-trial-handle=2600,i,17602958172434584127,2250643922720907930,262144 --variations-seed-version --mojo-platform-channel-handle=5776 /prefetch:1
    3⤵
    PID:2996
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=5988,i,9076175156051670165,16486791658170255619,2097152 --field-trial-handle=2600,i,17602958172434584127,2250643922720907930,262144 --variations-seed-version --mojo-platform-channel-handle=5972 /prefetch:1
    3⤵
    PID:4004
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6136,i,16733138642110283533,3889173481545162256,2097152 --field-trial-handle=2600,i,17602958172434584127,2250643922720907930,262144 --variations-seed-version --mojo-platform-channel-handle=6164 /prefetch:1
    3⤵
    PID:884
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6292,i,3802287184484753566,11899132336126094251,2097152 --field-trial-handle=2600,i,17602958172434584127,2250643922720907930,262144 --variations-seed-version --mojo-platform-channel-handle=6316 /prefetch:1
    3⤵
    PID:2264
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6172,i,11037314415148227626,17110664498177593365,2097152 --field-trial-handle=2600,i,17602958172434584127,2250643922720907930,262144 --variations-seed-version --mojo-platform-channel-handle=6488 /prefetch:1
    3⤵
    PID:2740
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=4596,i,6294415046050857346,6558145260280351784,2097152 --field-trial-handle=2600,i,17602958172434584127,2250643922720907930,262144 --variations-seed-version --mojo-platform-channel-handle=6648 /prefetch:1
    3⤵
    PID:4688
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6664,i,2165879693113887952,17445563974121981083,2097152 --field-trial-handle=2600,i,17602958172434584127,2250643922720907930,262144 --variations-seed-version --mojo-platform-channel-handle=4112 /prefetch:1
    3⤵
    PID:4380
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=6696,i,8757516078480731886,18417492032745704526,2097152 --field-trial-handle=2600,i,17602958172434584127,2250643922720907930,262144 --variations-seed-version --mojo-platform-channel-handle=6924 /prefetch:1
    3⤵
    PID:3168
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=7084,i,11722003732505067712,589406645792942925,2097152 --field-trial-handle=2600,i,17602958172434584127,2250643922720907930,262144 --variations-seed-version --mojo-platform-channel-handle=7056 /prefetch:1
    3⤵
    PID:1288
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=7220,i,6222922530514790421,2908346755336716179,2097152 --field-trial-handle=2600,i,17602958172434584127,2250643922720907930,262144 --variations-seed-version --mojo-platform-channel-handle=7236 /prefetch:1
    3⤵
    PID:1300
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7020,i,14222128872062668993,1509841728155966441,524288 --field-trial-handle=2600,i,17602958172434584127,2250643922720907930,262144 --variations-seed-version --mojo-platform-channel-handle=6700 /prefetch:8
    3⤵
    PID:3744
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7104,i,2275984497576791016,12980711865464422634,524288 --field-trial-handle=2600,i,17602958172434584127,2250643922720907930,262144 --variations-seed-version --mojo-platform-channel-handle=6904 /prefetch:8
    3⤵
    PID:732
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6280,i,2376263903726000244,5063375237001216828,524288 --field-trial-handle=2600,i,17602958172434584127,2250643922720907930,262144 --variations-seed-version --mojo-platform-channel-handle=6840 /prefetch:8
    3⤵
    PID:1420
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6012,i,11923363084673532443,3110651635169151794,524288 --field-trial-handle=2600,i,17602958172434584127,2250643922720907930,262144 --variations-seed-version --mojo-platform-channel-handle=6848 /prefetch:8
    3⤵
    PID:5008
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5972,i,9697312410541853789,13607026236856224308,524288 --field-trial-handle=2600,i,17602958172434584127,2250643922720907930,262144 --variations-seed-version --mojo-platform-channel-handle=4116 /prefetch:8
    3⤵
    PID:1548
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6020,i,426715523462026392,7008248649207897952,524288 --field-trial-handle=2600,i,17602958172434584127,2250643922720907930,262144 --variations-seed-version --mojo-platform-channel-handle=4792 /prefetch:8
    3⤵
    PID:2728
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4656,i,15631643825831223601,8654040162477104375,524288 --field-trial-handle=2600,i,17602958172434584127,2250643922720907930,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:8
    3⤵
    PID:4848
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4656,i,15631643825831223601,8654040162477104375,524288 --field-trial-handle=2600,i,17602958172434584127,2250643922720907930,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:8
    3⤵
    PID:5132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.facebook.com/
  2⤵
  PID:3532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.facebook.com/
  2⤵
  PID:1076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.facebook.com/
  2⤵
  PID:1996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.facebook.com/
  2⤵
  PID:4292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.facebook.com/
  2⤵
  PID:2880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.facebook.com/
  2⤵
  PID:4448
- C:\Users\Admin\AppData\Local\Temp\tmp94E.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmp94E.tmp.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:4748
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /k reg delete HKCR /f
    3⤵
    - Executes a command shell one-liner
    PID:624
  - - C:\Windows\system32\reg.exe
      reg delete HKCR /f
      4⤵
      Modifies system executable filetype association
      Modifies registry class
      PID:3488

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1288

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x32c 0x300
1⤵
PID:2864

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Component Object Model Hijacking

T1546.015

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Component Object Model Hijacking

T1546.015

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

52c786b4-6c01-4624-9455-323df68de766.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\52c786b4-6c01-4624-9455-323df68de766.tmp
Size 12KB
SHA256 15eeff7a79d0b402dbe31cd70265baf37dab323aaeee520fb450f026365653d2
MD5 66707ed2a01d50bdd70637d54f20de7b
SHA1 0d8d9f98d423e458f54f13784848eb4972a9ccb2
SHA512 f0f5395da8510894699a8734027d455adf12467e2f266cb1008d36fe0aaeb45310c494ded4154d9346aaf0d5beede40db469184277f4578cfeaab79e991094fe
SSDEEP 384:z/sNuWoj55yzjWZxLBGYX5Ecw78+iXx/RhW3yq:LDj5O67GYuZzaxZhWf
TLSH
T18C422A35A879EC374CA77046F58A3643AFB85037AE846F54D5E95B1D01CA3C8274B82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8e6766c9-6e12-428c-bb7e-ee5d00095d13.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\8e6766c9-6e12-428c-bb7e-ee5d00095d13.tmp
Size 12KB
SHA256 07e165d88419fa9e59763077ade17fb9119f4a3291d8b2a83b424d812c9d1a3c
MD5 230aeabb1d118a91725fa07d007ef2a3
SHA1 9398a8783cca8f84ee54529cea7ae20fb165f44d
SHA512 552b93fb2e38ef8d8353dcde836083cd87c0ea9fa09dc0b8fec9ec6e57c511aad68c5ac7c5cf953925bd7665db4788d76fe83d6564b70525ff25e9d1e552750d
SSDEEP 384:zTsNujoj55yzjssxfBGYX5Ecw78+iXx/NhW3yA:faj5OdvGYuZzax1hWN
TLSH
T15A422A35A87AAC374CA77096F58B37439FB85037AE846F54D5E91B1D01CA3C8274B82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9457a676-af18-4596-a0dc-d550877e85aa.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\9457a676-af18-4596-a0dc-d550877e85aa.tmp
Size 12KB
SHA256 605041392f427f033e82c7f00e532020853e66f73efee4351bd673a9cc61908e
MD5 15c3876b0ff127bae1e8157334a11f7c
SHA1 3061ccf389181e6bbc9d2eba5be56366c4a5f44f
SHA512 c731f9691a6115a0531784f8f4e4b264638bdad2d93b15a9c2931493c1e5c7f3f6c4ffe0000cec6ef9b8b31fb5a6ad4d29b1c070af23b7918660b1cfd20083a3
SSDEEP 384:zTsNuRoj55yzjsTxPBGYX5Ecw78+iXx/NhW3yl:fsj5O6XGYuZzax1hWo
TLSH
T1CD422935A87AAC374CA77096F58B37439FB85037AE846F54D5E91B1D01CA3C8274A82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 d1cc89f8f1c9f75d127814445edc4d6d9314209d3b11e5a2b4cc826747683f30
MD5 3bc9cc32c2de3150dc7916bb61984962
SHA1 d75ba9bc7ad74cb95dcb4ec6de6e6b18f5813a04
SHA512 fd090e624e91a98337689ed57390fc5813fab21acd3af426c9de6566ea4d92a7875c4f92a1b64d547eaf9ce40cad3d8a85472a30cf521aea6198cf74b69805ac
TLSH
T12ED02232ABF00E82C80B0032082082880F08C03C0800B323A23C20AE2A82CEC2E23000
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a62a1faeaaa56a5f5375b4d4921e6b263c0bc10a5ecc1f991894c66c32a88aef
MD5 64fcd85513a139bcf5844ab49aea8206
SHA1 3c834eccb77da48c4abac17c440971305fd9b653
SHA512 cd1b39ff43d56158fbb01c5408a5bf247d5bd82279b205a914ab4cdccfece77a5399e430bb26db6f7d10e70dc3503c3bf37c5de59e23cb8f62d6337066c4114f
TLSH
T15DD02232EBF00E82C00B0032082282880F08C03C08003222A23C20AE3A80CEC2E23000
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ff8821ee7c48738eec423973b59c80822a54ed6bdbb3f3992304b702982d762e
MD5 04ee18b9de0bd5c9568bbac64e65c37c
SHA1 2062d4a2d115a84dd9c364fdb32693ab17edb990
SHA512 552e36cc02219aea863a7cd75e2da7c1c5e15bd08ddc30d53d8ca4ecbe4b5b4267ead60e3898f7afc20edc348bf475f1b2c4090f42e797b9fded02925a4f43f5
TLSH
T1DCD092229AB02FD6E02A103A052241484E8886675B41221AA22E686E6AA48DA2E62981
MD5 SHA1 SHA512 TLSH

Submit Download

0d694444-1aef-4585-905b-c3805ad66da1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\0d694444-1aef-4585-905b-c3805ad66da1.tmp
Size 9KB
SHA256 5c89d20e46d89d6725f4f57f9e8d361420174e6d2edf6578dea94f72cd63cbd7
MD5 9a81707c8d05a051c7f15b08ead5ecc3
SHA1 63b159536c10bfd8cf9dd5abee02ee384e1b21b3
SHA512 a4a054c4078488188f829b18e611090e06669a0ca81ec91cd562314dfa634d40ee13e55a46a477cef0636a2bbd1346e13be5db0a31f97658ff0bc4a61ad59362
SSDEEP 192:sxZARrsY/f1sxeEdp5DcF1/W6+WN0qIJYBOfa9qIgyJ:sxZA+Y/f1sxhCHbeJFO
TLSH
T14422A8566E38A97B8CD7E21DBB65BF13D1F5103261D11E88E6FC862C05EA6DE120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1d4cb127-e3da-404e-8c9c-850a97116f48.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1d4cb127-e3da-404e-8c9c-850a97116f48.tmp
Size 10KB
SHA256 e231c9d64506be82e17ddf3aab9ab1479bb6a9eb3b82e71c291049e2a861cd40
MD5 39a74e9d748c44d1d9a47915bd338b4f
SHA1 a6ec7a5029eecfcfc2cf9d7170b4573b6d061cdb
SHA512 674ede34e88074d58ef29c655057a539d8f3680124b8b66b19d80900ffc6b5b038cde5ba0805c4044e7bd9e994655059ebf31c2d3f979fa49e47ed62f63cbc73
SSDEEP 192:sxZARrsY/f1sUeEdp5DcF1/W6+WN0qIJYBOfa9qIg5oJ:sxZA+Y/f1sUhCHbeJFy
TLSH
T1BE22C8566E386A7B8CD7E21DBB65BF13D1F5103261D11E88E6FC862C05EA6DD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

32dfde41-5b19-4cc8-9ce7-371c042973a4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\32dfde41-5b19-4cc8-9ce7-371c042973a4.tmp
Size 27KB
SHA256 6de4569d685b074237bd29f9e769658527a0fc17f6db9f46db2f756b23f47730
MD5 1f667697ebc1e17f41113e39fdfd3d42
SHA1 1bb07e2e19ce09c96ec9b99274b292776bc81e68
SHA512 6afc1529db185894ad99c9adaebcbfe9883914c3628019cd7a61fcfe1320a42c1db53ba6fe5ba64f5f7d42769d6237f7e8456f2b88cf83efc364c65012a95db1
SSDEEP 768:16ichkPWvPZpl8F1+UoAYDCx9Tuqh0VfUC9xbog/OVo+LlEKXzirolKc:16ichkPWvPZplu1jaX+LKgz5Ic
TLSH
T11CC2F93F644CCB7E4FC01A9DDD1A6F9A7E9802C7A6588D4047FA984C02C77EE91264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

35b005cf-d608-4621-bd6c-15b790e779c2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\35b005cf-d608-4621-bd6c-15b790e779c2.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8fddbfed-5416-48bb-ae69-db5c888eccd5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\8fddbfed-5416-48bb-ae69-db5c888eccd5.tmp
Size 10KB
SHA256 eefbcdb3e51880f4575cec6cfe3fa737146426785e3dde3fcfc606867e4e665f
MD5 51fdae631272202dac3e7dceea0dabf4
SHA1 570f29880a439c66652f6b2313ad13f0aff63fe5
SHA512 3f738e7fde15597bfa38b3435ccde1c438b67bbc7164ced212b95e7b3068d7267b882cb2022c94ffe4072e7b4df9a0e50a7dbe23184c849a4b36d690cd04b005
SSDEEP 192:sxZARrVY/f1szeEdp5DcF1/W6+WN0V/1YBOfO9qIg5oJ:sxZATY/f1szhCHbG1hy
TLSH
T17722C7566E38697B8CD7E21DFA55BF13E2F5103261D11E88E6FC862C05EA6CD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000079

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000079
Size 305KB
SHA256 d6ce86182f09911822853c2e7c15f53c645ab52603b5dfb3fd83f06e126d2774
MD5 e838334816b863b76fb8384d7d7a4fd7
SHA1 187240bcb5f99cee499968d392ca456eafbfa262
SHA512 01034746096e8421cb9db993178bffa965dad4a11b3fa90394ced79a3c69cc9faf7d6dae75b6c0db2f20592a91cb8299dec2e67c3adca4fbccac3418acb3a13a
SSDEEP 6144:lOYt4SY+ewC7VP5E2O3YpFnNclSj5Xn4nJkZqkXrAnyiW7ytuf:h4SY+fSEpacMG6XXUyvCuf
TLSH
T1FB64236454AE0FEDBDE9064B974E67A3FD21A8E4EEB7501D08369E2837171C8F0D052E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00007a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007a
Size 76KB
SHA256 60e0f6f2cce78d6267be0d25740bd58d651e8fd8eef4d83e8a3147944b31e762
MD5 778896c2d5492a4398de258194033132
SHA1 b733b027346a9ece1cf9512133e4243d11a59170
SHA512 1697f1f145a87d9a8b1c5af415a207f52056e68b2532bcbfd1b6a5556a76d947168e7eabbae8cfb3a57afe9ca71e0418796a68dfd6d28f96ff85c03c5a76eec2
SSDEEP 1536:WRLSWig+8bmO54fbZteTrZWIC/UOGHFbTV7zU6oM8oWlZ4bse+jB:iLSowevQibp7zCM8HlOsem
TLSH
T1D87302A2660B8842F3408DE26C7C693657FFF9CB54646C6C6A19CA75202BF29E139270
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00007b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007b
Size 44KB
SHA256 26343bebf42ddd04a30921fbc485b7d9f1c47de25a3de50c5b73a58888b80f6e
MD5 4b48a599a8ca1efe581ee05d9bbbafea
SHA1 ae3c441f96bcc9e087a87cef735d43baf2435b55
SHA512 fedad0034505f773f8165a438686b0a6b04e07e47aa3ea477d187d7d794ab05be737767394c25dd648a1f8e2849c6596635b13dc34162dd5a58d63f2e2f4fd28
SSDEEP 768:QndqXsIIIFh0Mk78yYyq95EZqYL0wAC0R9nn0zoeecPk4D+AdjbAUI2:QndqFFdk7lYyDqYc1n0zovcPk4KARbAq
TLSH
T1CC23E15AFE3AB7B853526A9BD41530F664683ED338FC28A126F61CD660D224366D31F0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00007c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007c
Size 226KB
SHA256 1c4cbf731d91a9864daf7b2c35edce0a4451c9c371103bf48d2d1403bcc682e5
MD5 852e3232b7a3d3d6c537ddef4a8346d5
SHA1 77234c954a7f3918ff5009519ab563e415004507
SHA512 9034c4f006741f2f4062a699bc0aa0152a678f0a3a938736fffbfb81de0ab3c9d319f7d5bf9585b7f8c55d943bc802606cd466f545d0ded0c95d7f3c2675906e
SSDEEP 6144:o6qqKQXj0Q6j4czyBR7TXrprvkSuYGlnL3rfsfb:o4Kgjfczyz7Tdr+3rfsfb
TLSH
T1D3342248E437A8A3399C034788CDA5AACFA35E59944EB446C9FFC84C2E0B36DC991177
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00007d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007d
Size 29KB
SHA256 8cb1fd7e2b3ef91c5db14dfa641ecff60489c05b51a8844a3391737099dabc2a
MD5 8305a958d9a31934f1594324769b5288
SHA1 6389719c3991bcb7e2ff6d43f35aa1424f4f5d91
SHA512 af5652b1ec90f1cdaa2f40ba8bb4b5c27c996da723473e3e47ef661c1223738973108342e37e13c16d9143a871bf30fa3ae4670d134dbc3b22f493a746c9e072
SSDEEP 768:x3ZJnNBMZV69NuUZpHxzr53m5AHtdQUHJpRx1rQH:3CZE9oUZ352iHtFHJpRxJs
TLSH
T1D5D2F1D41FFB94662D6AC13C6DD1B72CDEF24380A527974FCA0A935990FB67038A6C81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00007e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007e
Size 66KB
SHA256 6e5a2154d9b3f08919e49799ec0071b6e6c2abcfd8594f7c7f9b06a2ffa6c380
MD5 7a6ad7d1b1bb5ed6a5049c875722f106
SHA1 2dec6894208c613d4d408cc85ebc863475ca854c
SHA512 3e032a19b0e02fbe5f75eeb27e7ce62f581ce100218c2702767922ba29bd409ce340fa28a86e635a3d185c174d7c0bd4346cdd7aac7f7520b69625e0499ace0e
SSDEEP 1536:YZtBw0xBCZ0OlBwGABqjH23Xpki1NjxbDKj:YDBw0xBzwjH6pxjpDA
TLSH
T1DC63021A71496E40AF7E49A72B6F938C5C51937F1AF6C1287A0387F44E12F4C1AD0BB6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00007f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007f
Size 111KB
SHA256 8b500667495e2a73580b5c85669da15811f876a098414ca83fd2b569d16511bf
MD5 db5d82abea3bb2a3451ae9fefbb3375a
SHA1 389d7010a8ab127bb4503d1e76c4ed54b904638c
SHA512 2194a51378c0f6b1bdcbd99e412ee8296ab4fdc6573672564aa35df40e839e1a67c31e34960a8c41448e3701d177fe7226488200354545d5bc526d35dd4f1799
SSDEEP 3072:juxkSyehg5DwfU4wBNo2AO6He5ElQvkyF9wZw:Wyeh8DwfIo2IHe5Euvp5
TLSH
T10AB312D326D48B300142B5EF9671C367CA0B2EAF1C78A9AD9CDCB9CC7F744511AD2A54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000080

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000080
Size 103KB
SHA256 64e9d82ea401387f8ebf4a5aab43f9227e3711583c446467980b4f811ad3c04e
MD5 6f201a78f2ebadca4782ee33c123d905
SHA1 1a05c8d3cb84c0ef51dd9dfb5e4407de9d8b0f50
SHA512 78a1b3458b34a204bc31af337be78a2065041378386657221eaa79af6d0a856aa28af86cd6775a6aefdc7c2cc24bbf8de6d93d67e61b169baec228d9f90d5e8a
SSDEEP 3072:305alIDMiQ9dseVA5n7PqopJsqatf3eyzeRB/:305aiQ9dVaq9qieyzcB/
TLSH
T1B0A3028A022DBA13BF76DE7349CCA0784806AC3606658401857977F38A73EB055EF6CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000081

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000081
Size 160KB
SHA256 cf1212e90d3a17d348c44c6ccdb14b95ae1932f8628d01e844c4afabd2c1a41f
MD5 1aef89f32d3b1b304c3eae57282686a0
SHA1 1368ee628adee7e0b9b62a3906e25cebd95fd4e7
SHA512 d4801c5582d750e47e04a0a2b7df93743b5cbd0372abee0270ca675a8174323531a240a0e025f2e320bb2eff68965a3b7bf135e4ab4bd90a67c507eabe09111f
SSDEEP 3072:02Tc/dY+qFbFLH/jXZjcgI1+1yXMWtPTlvXVawFZi/+1oiOXoOizB:/02XFbFLfjhfI12mtxvXJZB0XoJB
TLSH
T1B8F31385C5B097D7A6F20F93254E66381D99270962872089B5C7F2F7184D3A0F89629F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000082

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000082
Size 209KB
SHA256 53d21750f42bd3e19a34fc98e7f915775593aae5fdbbfe9c1070b5c04df197bb
MD5 9b71aabd53821bd562b5874d3bb7da46
SHA1 a686bbec057699d384e586c222433750cd7ea285
SHA512 3d9559a1c45ca97aae5b0c5d0bf6f5b62224848f0b7e61593999ce5e7fa25636885f074f4a2eea532f8af24fe299c77e33722cbcd4ab419ca54ea35f9810f741
SSDEEP 6144:LW78PyrDlQ7uhnKlJNWo354OQhSHtIAf5bJJL8DQ:87DguoDEc57tNxgDQ
TLSH
T10D24133C8BBBD226298873D2D145F4E64E4F1B5A7914CB1D8A2E7116EB6427F8D0C12F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000085

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000085
Size 25KB
SHA256 5e4611fdb5c7906e74b744366efc4778029bd654117c564a285dba17d1183e12
MD5 960038e61249b8206edf905c44f06e1f
SHA1 4eade31097df53ddce9bca4f9d3c0829da38f827
SHA512 0d0c83d8ceebda95004bcc078334576462d9ae8f4536f7c882a13fd1770ca8fb6776149c3984bd177c07acf239bc0d5507e2a9a3617c63d972d0f75eab40ac21
SSDEEP 768:U6v1HTpbmOblQZkN4yU5+vwiZdwQUKBw9xGU+X:UAzpbjblQe+2vwkwQTsGvX
TLSH
T101C2E1C07FEA088D4A711A697AAAC9437189676EC8C43D4EF7C20167611F2DCF6C1D64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

03ec7abd975f7d5b_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\03ec7abd975f7d5b_0
Size 270B
SHA256 c92fafed5522591a0b54e40f19f0698221cfb46087189da40ed19b28506e9991
MD5 86df973a347695eaf0fd3214529d650e
SHA1 f8825bea2e20b01419d732e7c7e13c7b53446c2b
SHA512 83f79c2ce9fdec5254685b642c3b87a67707423a0f9d41705de440d4b02e7a5d4610d17cff478d22f106e0325a2210a340bd1a31e17057464900c75a79de753f
TLSH
T1D5D0956F046C7274FF69CCB0C67F9286969744780C6C48D085445DB31200D30B146D9E
MD5 SHA1 SHA512 TLSH

Submit Download

21cfddd83967c71d_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\21cfddd83967c71d_0
Size 283B
SHA256 922d7a79a85a6ec67df87d0e187b679b63236125d5fdd63e538ce186df6011ba
MD5 a62697da3c533758e2ade01dd96f4407
SHA1 8dd0887c2a1c70ae52f4ff065e4b80497dad9608
SHA512 d4f4f357d7337814bd4a7f7950bf964ba49ab2066f64980425f612687d2226e62590bf1d15014d0535cc42c4edfdecaa03df6b9a3c7509ab8a5377db2fabb21e
TLSH
T13DD0EB77300F7028DD886BB8C6023312C23EB106D88C827880056C7130040709B0AC00
MD5 SHA1 SHA512 TLSH

Submit Download

54ff8f6e35ca41c8_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\54ff8f6e35ca41c8_0
Size 283B
SHA256 91403884b2e21bc29526e81b3f58e2688c811645703658682a7e43e59dad9749
MD5 333c338ad545aea2f2e97e7e18f34d53
SHA1 3932afd456254efb602069fa83f7f8e521305178
SHA512 08e6f23a0db4e5f7fc6f7b3b289319c1964b674f548cfb3cadf99930019861132390eccfd4457039199bc04d987db313dd0b20f450426b92c661f8a75b3dfcb6
TLSH
T1DFD02B3B6C28E424E958FDF486577255CE37C06D6C28C5EA84049BB911278B1E449002
MD5 SHA1 SHA512 TLSH

Submit Download

6053b12d761472de_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\6053b12d761472de_0
Size 291KB
SHA256 d6ca710875d7d292af4a858e0d798e38b269479f4c2829d357d73c40380ee51d
MD5 119a5663e34c220fa03280c958532ad8
SHA1 6165bfd4c419b2c0283a7fe42773cb1d661a6c27
SHA512 88c7c74640200dc62d0252a9037e83eecd89d5a255a4cb35bd31b14f6af2b5719f806c46aef431d12a57b5faac20f78e81531535cd8494b7e1e0a0e93a3995b0
SSDEEP 6144:FbjreA3C1JH40/zKKa5HRC5BpLMaCfz4edpV2eQ:FbH0JH48zKt5xC5BpLMaGFdGt
TLSH
T19554C6551B90EE15CE3663F54262C953B73551483FC7A71332E8A33A3C1A2E25F9A88F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

64899beca14a3f67_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\64899beca14a3f67_0
Size 591B
SHA256 9054d5e690f1c9316d1a75ad4feef799f813c48da74d1fcc78a5ef3bb24acfe4
MD5 2ef0577bf78efae466d2b31a6b96e970
SHA1 2d2f87b442459c7730138448f9e48bc1c145da33
SHA512 27a32dd2607cd1cc5eeb7c08a322b8e80086371d65eaf6b0ca6ad52a8fcc992e2520784e1cf4588727860803cc0cae654a46ed36cb9c597de0084c18ae929800
TLSH
T1A2F04143810CB414E0EE27F4CAF89A1AC362D5A50FFD98229120C0A332C38683D481E0
MD5 SHA1 SHA512 TLSH

Submit Download

6e72fbf6fb33a081_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\6e72fbf6fb33a081_0
Size 530KB
SHA256 2bcf907af31ef396dccc1e48e9880927541710418a83ad1294f1195283be6fcc
MD5 4b2e6ed7f361e829a7c96db7ce89c070
SHA1 2727992804f0f500805dfd3eb6dac07543ad4c9e
SHA512 76f45ab158d0bd1f04826138d66983603d37c714a7745c21bcec27ad989825571a692d2f311fea79897adb9a55cdb9c993ef7da5f176b5c80d9da36a3f7883d1
SSDEEP 6144:kBVl29/NonWYANc6Qj600vgAyAsLmctwADh9oC/A/chbR0VE096Fd:oJnWYA+yytYKGCPSbod
TLSH
T1C0C4F9491790EA55CF7623F451A3C963A73541083EC7E723B1E4B73A3C4A2E15E9A88F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7b77adfe9be65a96_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\7b77adfe9be65a96_0
Size 283B
SHA256 a6ed84b8a780d7f7f766adb81fcfde51227a76dd06759b213659c3f00a6ec40c
MD5 065a46e6aa04a42858c39d526036b2d1
SHA1 277cb78d6cfc6ff216a096aca0ecdce322126c92
SHA512 e6751ff9a191fc2f69f9f81e3de387f4e9c4cf5101bcd5d1bf97096f26e79f953b48492579c4c8b7eca75faaccb91af2177b3b05db4245d5fd2c6984e1c60842
TLSH
T1EAD02BEB954DB419DE39BFF0C3D3B341CB32E45D0A7864E9C40510F1275E5705648849
MD5 SHA1 SHA512 TLSH

Submit Download

82eec1640d19d10e_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\82eec1640d19d10e_0
Size 206KB
SHA256 81bdc84a7319738cbb32076f3a7eb023cc797bc536ab60afd57af672a6d7eced
MD5 9a950ce5f8640640ccbc2e1cc9178618
SHA1 28561aa1e48bc3c5f147c9d8a40090e29824a0a5
SHA512 a4d4cceb1e59d052774d3e8a814d292f0ceaf8c88b5aea65d5e3c02d3ea065494d8c87faf415f499d5fd777574f330433457cc57cf58925904dfcf0828485825
SSDEEP 3072:ANeeaau+xGTRp5oR030L59DOIfS1Gc/T1Hp:Rau+GKOkL5HsGc7Bp
TLSH
T1D12429891790DEA6CE7B23F411734957A73040442EC7E72B21E5A7362C893E25EEAC5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9a274a1abd80718d_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\9a274a1abd80718d_0
Size 602B
SHA256 4136b90e88c48a840c5151d44055010bc30b9068a2144f368005174dc2b91d8a
MD5 f3c27136458b5a1d69274e7794e1fea4
SHA1 145e0e7e926304235424e11532642a982bc8c1e3
SHA512 0bc466e828b4c201449392c15c54cf54ad18eb3f8ffd7e716d26a418465187687938bc6e00409805c919f984a5662380a4f1f808528b41a361d7c3c5b1e43e2a
TLSH
T14FF041ABF01E481DEF7ADF38829151150933C25C89899FD9E04C80F62025430F9118C7
MD5 SHA1 SHA512 TLSH

Submit Download

a612051d9c21cbf5_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\a612051d9c21cbf5_0
Size 343KB
SHA256 f4f9ba6b976cee874598f2b4f851170cd4ebbbd845b3f88a856feb4f227dcc8e
MD5 fde194e54ccc5e6afb9584f4d9d19469
SHA1 e5907d3c2f39dd02da6065ec3a10d84cced00e02
SHA512 d52f9d481c4fa362d0f0698f5d2f395ae916b1aa7feec3937dba21fcc827582fb23e5db3e66425a6d7cc233d59edd2b3ac3c983fe605075903910300bd281ec9
SSDEEP 6144:JeVurJB0a2wEgcZYubz02sUl/CsT2TCpSI4nwF3UZw8cCg3m3G:Ourr0aVa2ilq3zG3UpcpmW
TLSH
T1C174B6495790FE99CB7A23F441528953B731848C2EC7E32371E8A73A3C492D55F8A98F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aeab3387b5295f62_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\aeab3387b5295f62_0
Size 516KB
SHA256 c2d989b49c07be49cedd4db7d6678cb1e2b4aaf1d1b0189cb08e8233ed8b8320
MD5 aeef7711fb7bfc04a879c206c6ae4aef
SHA1 81fd06d71ec066bac69d4d0a2a38315db3381c51
SHA512 412b16194fd07d9e718be1597ca51f1d0f22eb59889d7afcad504e4f8b77765b933e69374eb4cb8ebe534d44526ad3e326fdf7821b135eeced8325ef880787a2
SSDEEP 6144:8bAPlao5Cev3UodBZRjDcjqDJRSDzHk/T1cV7oYVo6bsvYct49:qAM+EiDhDcuSDzE/ThOct49
TLSH
T160B4E6051790EA5ACB7623F541A3C953A73580482EC6E72770E8F73A3C4A2F15E5AD8F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b629d1195bb0b3b9_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\b629d1195bb0b3b9_0
Size 264KB
SHA256 7ad851d24a5f398f1ea59960e6679a4494f42638fd50d680db5048600fe4c275
MD5 89dddab13e3b39021b3bf92a2d74e71e
SHA1 6c2e4f912c801bf4d69b50a91a4e8a7510f8dc0d
SHA512 6979185e2484957467887118f68df3566acbb7e8f91135155c1af61d575779b187931a3ecacf7976e37952c9d42fe45c3398448b81cae18d1edb3f3bbc44e9d3
SSDEEP 3072:mO8HUz0uGsDwn87cEe+x1jy59ISsIGCj/SbmMrtS4+:mJuGsDwn87fcISswGbfr7+
TLSH
T10844182197A0E5B5DF3237F91107569AA3345A441EC6EB2372A0A3642DC53F00EEBE5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

be222414bd6d104b_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\be222414bd6d104b_0
Size 24KB
SHA256 60aa475af75732e695ee09278e48c6eb0e8c4dbfa3ab278d65909896375bc988
MD5 e367a36f85e802905e9f00230eed7fb8
SHA1 887c1d3ff86666eec91691c362fae9487dcf8941
SHA512 0e470bfaa05aeebf8a5932fda9f590e9e18aae24d031d15404648bae34fc9235bc6a2aee5a288b190a278615f8c56619f54bd01dc294f5351805195232c0cc24
SSDEEP 384:/2jD4rbqy7FYa4youDJZcnJhsFLE2EG95wJbcLMhqRjUW7YfSCKD+Z691LIMHO+F:AKxxoxTsFNEKyR2M4U3bKDDxJ
TLSH
T111B20A15175459A9CD2E23F900638A57BB3184046ECAEB1F60D2E7346C8C2F36E9FDE6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c0fa5042240c7433_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\c0fa5042240c7433_0
Size 426B
SHA256 a8725e6a9e94bd746b26816a41a802dc7b73d0629acf2937bf857fe47c50cee0
MD5 a57d50a1827a4aa74c328adea7f746e1
SHA1 315c92ca9155edf99ddf179dbe00ba3e82aeff20
SHA512 b9234a032af5b16284bb8c635834cfee7f9f4d52a9beb2bdf108f5d6109ba76c070fee1cf8247fe4abe3782a032a45db3e1e28a5238819c5021fddcdf5a66ea7
TLSH
T1DFE0F1FB0B2CA870CF7B9DF18A64B28E5F37D65040ECD8EAC1451EF3E210874960846A
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 4KB
SHA256 aa1e29c65048c68a00e8055439b1e73e2ac0f381b4c6de9c77881ba71f9dd34f
MD5 dee0563eadac951e27e97083dfbc8ed1
SHA1 6e40ceb76a34b02805e0b2a9bf0a0d8ddf18a4cc
SHA512 a22cc756f7576338df6b385f16c6261595d9c9c1e1aa81cdb454ea7ac5abac2fd741671a6220dd8f5a04bd5a3eda21a887ec610035231e72e5edfe6c34e84d02
SSDEEP 96:mjCmYI5EZ/qnLK9f2jyL8PjFf7X1P2fZTpwvXPa6:G5EZ/qnLKJ61D1PQTpwvXy6
TLSH
T1B191C55BD4A07065EF384D7055C0374A29FE6FB1588B2F22C7DAF82A0BB2BB340460A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 8514722f26f9091c48420e7239920c10e54980226d1d69b65fb6bc8815e763db
MD5 55ccbbf6cae2f89aa47c768df54fa185
SHA1 ef00407144d4f71b281ccea753231d88a25f7162
SHA512 33087094b03ca3f84c1c5d3cfc84a8f4fe1cf340ab8d06c5fc1290d33785dc1facc496756b452471ac4f98b1c2888fb7d6bd18ae3160d6c804381633b1335009
TLSH
T1EA615E4B94814065DFB84C708AD4338F35FE5BB0498B3E12D7E6F87A5BB27B3514A0A8
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 81279f862f6a550473a08147e11e397b4b666603837548e926a30a51e4a3821c
MD5 ff07b88bdb973f8b975be5b67bd9fbfd
SHA1 219bb598d2af0cded787bd7b154f9e91f6c6091c
SHA512 84a87b85a609082c62a8d71d6334739aa478451b2ccc09443134f61d114df6e30eed067ef16a00be9134df24abb8baeac980850cdbd0e102e2e19c5cff0c8a95
SSDEEP 3:MsEllllkEthXllkl2zEkl91Eb+l/l:/M/xT02znXg+lt
TLSH
T178440404FFC0140DC50051304051C3500770DC100735574374515C137CCD54C4C01000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

073caef6-1d8b-4df0-b24e-074dff8dd5d7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\073caef6-1d8b-4df0-b24e-074dff8dd5d7.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

37ce3dc0-fd82-4aa4-bdfc-bd490a28b5d8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\37ce3dc0-fd82-4aa4-bdfc-bd490a28b5d8.tmp
Size 3KB
SHA256 645bfd84708bfa9e03b510b781d2a220210c69b35bd79fbc7a12f73fb4a1e8de
MD5 d5765d12a99eea9b3a8d5ff7bab94dc2
SHA1 08ee1b63e157a33f278d30a764fa70da5f681203
SHA512 573c21f07b39f63ac57af3d8296ab6186999e246c3ceba07fcb3cb1d1374c250519ccc6b36efac771d4919ddcf03c4294d9b5bd210f2c407a53848d75750cd2f
TLSH
T19D61A9B7C3E4862DEC1156F0AA156E2ACF2D0914631C3D5AC8D9AF6BA3E2470E101A5F
MD5 SHA1 SHA512 TLSH

Submit Download

9a10d576-6d52-4735-9772-40bc688d061a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\9a10d576-6d52-4735-9772-40bc688d061a.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

b42139bb-2080-4785-ac63-bc15d8dbfb2e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\b42139bb-2080-4785-ac63-bc15d8dbfb2e.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 3KB
SHA256 d43efad6b3e714931878573914acb217b029387473ca4150279d72b2803a2d87
MD5 e3cf88b8785df6b046d044ba24196f55
SHA1 506494c496f44b269cd56c2fac0b651567c1f796
SHA512 3b4a83e16db909694cc9b163f88b4429cd653e949250aed66ee76d53e85434afff50997497806000e2d6349b1b86b95244de5a9ca86c4a07b31dfbff4d923d6c
TLSH
T146812B05747B421038FE3A4852B5CE6A66423177351AF92B7BBD54B24E2EE081DFF8C9
MD5 SHA1 SHA512 TLSH

Submit Download

e03b90ee-af4c-4892-abb4-358dd4ffcd47.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e03b90ee-af4c-4892-abb4-358dd4ffcd47.tmp
Size 11KB
SHA256 eb80c9a866d51492a67eb864eb6a4b5c400f7c93f4a6a21f7806e7da7c1f6991
MD5 37dfb7cb4ed453e5f4e2804e86e52144
SHA1 5ab05e2b4c31ea391bbc2f6a985f0780794b579c
SHA512 dda6f1c689986a738c777fc4779c2ac8f86ab74baac6bac8192145620484c86b89e6bdc8f21b6f3d8ae102115ef51152a808b39a6ab978bab3bee6a64d0df638
SSDEEP 192:sxZARcVY/f1s+WpV/8Edp5DcF1/W6+WNZYV/1YBOfUdW8IgboJ:sxZA+Y/f1s+Wv/jCHbQ1I3Y
TLSH
T1A732C7566D38A97F8CD7E21DFB55BF13D2F9102261D11E84A6FC862C01EA6DD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e8a1d534-c734-4026-94a6-21ffdc31fbf0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e8a1d534-c734-4026-94a6-21ffdc31fbf0.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

bd732a7c-dab4-4901-bf7c-6d74298ac116.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\bd732a7c-dab4-4901-bf7c-6d74298ac116.tmp
Size 8KB
SHA256 8924b215670f4b21e9cacac54ebd6bb527f88089c6c5a7d4bbd1c35ba8294706
MD5 a29594de6a118c836beacf78876faa15
SHA1 03d8e361ccbfc21310856e3838d3a4a73d103d7a
SHA512 3aeed1482e989d9c08da41914fcc5167e34f2732e9c14ccb7b22b2f0d9d3b3b9218aa4ff9a49b89062cbd4dd67929c1eebb136e4c9eada092bf1f779d35bad42
SSDEEP 192:LJONJ6DphmqQmiUyMPq8wGYX59ezgHNCLjzorx1m7kk7RTU6:lONJ619HRwGYX5Ecw78U1U6
TLSH
T18E02EA35A8787C7B4DF3AE45B48B27139FE8112BEA946F44D6E81B2C01C768C2306937
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cbc0df40-f1f3-4233-9f03-75407cff4b9e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\cbc0df40-f1f3-4233-9f03-75407cff4b9e.tmp
Size 16KB
SHA256 26d1cf74c06359010300f6ffeb825554facdae95b858dfca097ff4c2033d065e
MD5 9d40ad738278c55390f7708720616d03
SHA1 797410d4e8591b9629024c372a8dd6bdbad7a51d
SHA512 703d141cd47c4af14b3f6c54a381e0ddf346e1f7028f7d3975bc8ff1187c2a51c8d2bac5d36675c2e43de8c394797a7a2501e2fa968275432d6d142941fb1e65
SSDEEP 384:nTsNuWoj55yzjFmx6BGYX5Ecw78+iXx/TteAStVXdssMKwIr+93yq:TDj5OYiGYuZzax7PSeRKwIr+9f
TLSH
T101720975D8B56CF748A2E8C5A546F603AFA85037D6881F1CD6F97A3D308F2F81352826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dc98eab5-76a4-430f-9817-7daaa8f34a97.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\dc98eab5-76a4-430f-9817-7daaa8f34a97.tmp
Size 12KB
SHA256 24beae243d33db42fe29504c7d2e79eb3e6a036f48fd9ef6cf4a476b2791c8e8
MD5 53faeef6d4e59d6520967dfcdc49d686
SHA1 d6063e8d1766f19e5243fe4e0302748e851641d5
SHA512 c5fa7013f807c0fcf0b056e83d7e97bb897f2f1ea9ffa5f0fa1baa7ea0b217f692c4a4ed0cc4407701c107477da2bd6cdb976f5a2f02062957845dcf66529d7d
SSDEEP 384:zTsNuRoj55yzjWZxLBGYX5Ecw78+iXx/RhW3yq:fUj5O67GYuZzaxZhWf
TLSH
T1F2422935A879AC374CE77086F58A3743AFB85037AE846F54D5E95B1D01CA3C8274B82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b3f19ec7-ba75-49f6-89de-d28ca62bf01a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\b3f19ec7-ba75-49f6-89de-d28ca62bf01a.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

f3dbf3d8-7c17-49b0-a10a-c97b29596d24.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\f3dbf3d8-7c17-49b0-a10a-c97b29596d24.tmp
Size 8KB
SHA256 3025259bba9c18934efa22f27c941ed791a76293f45a617fd902cd2e1f82a8c5
MD5 b91f07eb1e5ad68e60c48149113d287c
SHA1 ae73f6018f60085b5f96e870d38d1c02cb818343
SHA512 ea2733c14443de10a8506fcc97c6da24631c5f1642c4abf951ce5fc4596179d8306640afb3833d819fcf32c7051fbd1b45fc26531486363eeac51322a3fa3f26
SSDEEP 192:kONP6DphYqQmiUyQLPcwGYX59ezgHNCLjzorx1mBiXx/HkII2q5+YWU6:kONP61vrDcwGYX5Ecw78+iXx/whWU6
TLSH
T1CD120975A8B9FC2B1CD37455B08B36539FA42037EE84AF54D6E81B1C01CB7C8274A92B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 841c04f1ca34aded4a1b745475af5fad5ffd60b72a6036978dbef0bdc54b2517
MD5 a134c8ecb791f87f4475e9f2b03f4c8a
SHA1 1759647b09290145687261d33edbd56d7bc1d62e
SHA512 e086531ff8edc1ee2fb354b4c13d62064f5d1ef1ddca2bea31786e675000a57df6c7aa79d8adecd8640f818610907e2597a593c9f86bb9cb945afa80f5ff874d
TLSH
T148412458B6EE1148B3B76F5A9BF6686D447E79332F06D09E10110E8E0623A41C872B33
MD5 SHA1 SHA512 TLSH

Submit Download

8b0d4544beb97a69dbb9583fca5575a9aba6e37d.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\8b0d4544beb97a69dbb9583fca5575a9aba6e37d.tbres
Size 2KB
SHA256 130a649ea8c5a0c15a783f6ba902959c739f330aad4256cf0a8db94badb79ed1
MD5 dc8977bd80326402b3293a83048088fe
SHA1 a960477e73e3214f813a2fc170e2ccb5ea23d89c
SHA512 d9448ec626a4851f25d0942604cce813b49e284c3e6805202b0d2514cdedff8a04f19dd79a5b4845f211e70942edcaf26a781b7d7695787635f5452babb0ddc2
TLSH
T12A510D5866F91048B3737F5A9BF6B85E497F79332B07D45D10110E8E0667A04D8A173B
MD5 SHA1 SHA512 TLSH

Submit Download

Explower.exe

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Explower.exe
Size 93KB
SHA256 70485ce33c53aa8d552707b55c43cdd6a02a3d63d84756063e2a5846b4aa4869
MD5 f15de45c13db7eab4decff2866eaeb6c
SHA1 01a4cf9a4d1fbea3bd9ca5c60f712c06806d0956
SHA512 29199ebd88319c9fd78627eba6572f3610da1a1d16ba49a058dfe01f350b0c34a636b767433bd27cc7f494d05df0f79d7cb90d09f4472eb79807a37be4252d9e
SSDEEP 768:gY3lVfhWXxyFcxovUKUJuROprXtWN8eYhYbmXxrjEtCdnl2pi1Rz4Rk3VsGdpYgM:9V5WhIUKcuOJhPhBjEwzGi1dDlDYgS
TLSH
T19293E74977E56524E0BF56F79871F2004F74B48B1612E39D48F219AA0A33AC44F89FEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmp94E.tmp.exe

Path C:\Users\Admin\AppData\Local\Temp\tmp94E.tmp.exe
Size 11KB
SHA256 850f58eefa0854fe22e69f229764cb53fa2e1de6f3c98d243221db8c544880d5
MD5 69c135b4d050de2036eb5cbcff46c50a
SHA1 80b16cffeb4b1ac6a51ba25b121d2d0eccc20866
SHA512 98bdabfbb5abd673cb9433faca50b702c8c802d883046faedb3461b56848df2bd6fab67a06ef2ef2b2142bb9a74b0446704e636c28a9130301c3ac90d2fea080
SSDEEP 192:bwuCj484R7U9h8p2JHYkyjkaH8onqhfRLN5Fd4Ioqr9oza3JEp9H9O:bf64RdP0pYfnqdBfFCIoQ9oza3JEp9HE
TLSH
T19A322905EFC98430CEEC0BB824B746A6A574E40E8F279F4F2DDD45A66E79B400F852D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2560-20-0x00000000012F0000-0x0000000001300000-memory.dmp

Download

memory/2560-1-0x0000000075332000-0x0000000075334000-memory.dmp

Download

memory/2560-0-0x00000000012F0000-0x0000000001300000-memory.dmp

Download

memory/2560-21-0x0000000075332000-0x0000000075334000-memory.dmp

Download

memory/4748-527-0x0000000000380000-0x000000000038A000-memory.dmp

Download