hxxps://cdn[.]discordapp[.]com/attachments/1560686877172961282/1560745930683056251/nitrogen[.]exe?ex=6ad47e2b&is=6ad32cab&hm=9dbb5acd2f663129d0abd2e6673c76a206098f2fcf6ecc8e2c50cb9b1f2c839b&

Analysis

user interaction
yes
max time kernel
1202s
max time network
1208s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/10/2026, 19:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://cdn.discordapp.com/attachments/1560686877172961282/1560745930683056251/nitrogen.exe?ex=6ad47e2b&is=6ad32cab&hm=9dbb5acd2f663129d0abd2e6673c76a206098f2fcf6ecc8e2c50cb9b1f2c839b&
Sample261017-x475qscv21

Score

8^/10

credential_access defense_evasion discovery execution persistence privilege_escalation ransomware spyware stealer

Malware Config

Signatures

Disables Task Manager via registry modification
defense_evasion

Disables one or more Microsoft Defender components 1 TTPs 1 IoCs

Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

defense_evasion

Disable or Modify Tools

T1562.001

pid	Process
6244	powershell.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
17	4332	msedge.exe

Modifies Windows Firewall 2 TTPs 1 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
1548	netsh.exe

Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
credential_access stealer

Windows Credential Manager
T1555.004

Executes dropped EXE 2 IoCs

pid	Process
5112	botConnect.exe
4396	botConnect.exe

Loads dropped DLL 62 IoCs

pid	Process
1672	nitrogen.exe
1672	nitrogen.exe
1672	nitrogen.exe
1672	nitrogen.exe
1672	nitrogen.exe
1672	nitrogen.exe
1672	nitrogen.exe
1672	nitrogen.exe
1672	nitrogen.exe
1672	nitrogen.exe
1672	nitrogen.exe
1672	nitrogen.exe
1672	nitrogen.exe
1672	nitrogen.exe
4396	botConnect.exe
4396	botConnect.exe
4396	botConnect.exe
4396	botConnect.exe
4396	botConnect.exe
4396	botConnect.exe
4396	botConnect.exe
4396	botConnect.exe
4396	botConnect.exe
4396	botConnect.exe
4396	botConnect.exe
4396	botConnect.exe
4396	botConnect.exe
4396	botConnect.exe
4396	botConnect.exe
4396	botConnect.exe
4396	botConnect.exe
4396	botConnect.exe
4396	botConnect.exe
4396	botConnect.exe
4396	botConnect.exe
4396	botConnect.exe
4396	botConnect.exe
4396	botConnect.exe
4396	botConnect.exe
4396	botConnect.exe
4396	botConnect.exe
4396	botConnect.exe
4396	botConnect.exe
4396	botConnect.exe
4396	botConnect.exe
4396	botConnect.exe
4396	botConnect.exe
4396	botConnect.exe
4396	botConnect.exe
4396	botConnect.exe
4396	botConnect.exe
4396	botConnect.exe
4396	botConnect.exe
4396	botConnect.exe
4396	botConnect.exe
4396	botConnect.exe
4396	botConnect.exe
4396	botConnect.exe
4396	botConnect.exe
4396	botConnect.exe
3748	msedge.exe
3748	msedge.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3164	powershell.exe
6244	powershell.exe

Contacts third-party web service commonly abused for C2 1 TTPs 22 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
142	discord.com
143	discord.com
20	discord.com
90	discord.com
107	discord.com
127	discord.com
66	discord.com
81	discord.com
97	discord.com
108	discord.com
132	discord.com
147	discord.com
154	discord.com
98	discord.com
113	discord.com
128	discord.com
133	discord.com
137	discord.com
94	discord.com
112	discord.com
118	discord.com
138	discord.com

Looks up external IP address via web service 1 TTPs 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
20	api.ipify.org
20	ip-api.com
68	api.ipify.org

Discovers running processes 1 TTPs 2 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
2492	tasklist.exe
1424	tasklist.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\LogFiles\WMI\FaceTelManually.etl	svchost.exe
File opened for modification	C:\WINDOWS\SYSTEM32\WINBIODATABASE\51F39552-1075-4199-B513-0C10EA185DB0.DAT	svchost.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\server\classes.jsa	cmd.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\classes.jsa	cmd.exe

Drops file in Windows directory 42 IoCs

description	ioc	Process
File created	C:\Windows\Microsoft.NET\Framework64\screenshot.png	botConnect.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3748_1866706865\deny_full_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3748_1520114717\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3748_189696111\well_known_domains.dll	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3748_2090353421\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3748_641211744\sets.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3748_166716116\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3748_166716116\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3748_641211744\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3748_97977132\extraction.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3748_1387864066\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3748_1520114717\autofill_bypass_cache_forms.json	msedge.exe
File opened for modification	C:\Windows\Globalization\ICU\icudtl.dat	cmd.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3748_2090353421\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3748_166716116\keys.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3748_641211744\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3748_641211744\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3748_97977132\classification.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3748_1866706865\deny_etld1_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3748_1769448293\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3748_1387864066\arbitration_metadata.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3748_1187031025\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3748_2090353421\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3748_97977132\automation.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3748_1866706865\deny_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3748_1520114717\edge_autofill_global_block_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3748_232867519\domain_actions.dll	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3748_166845718\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3748_1866706865\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3748_1769448293\crl-set	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3748_1520114717\v1FieldTypes.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3748_2090353421\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3748_166716116\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3748_97977132\travel-facilitated-booking-bing.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3748_97977132\travel-facilitated-booking-kayak.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3748_189696111\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3748_1187031025\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3748_145338557\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3748_145338557\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3748_97977132\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3748_1520114717\regex_patterns.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3748_232867519\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 17 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
6596	cmd.exe
2584	cmd.exe
2104	cmd.exe
5408	cmd.exe
5660	cmd.exe
7008	cmd.exe
6616	cmd.exe
6580	cmd.exe
3456	cmd.exe
3516	cmd.exe
6160	cmd.exe
2372	cmd.exe
5108	cmd.exe
1040	cmd.exe
5032	cmd.exe
2336	cmd.exe
3384	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	botConnect.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	botConnect.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4332	msedge.exe
5384	msedge.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	vds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	vds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	vds.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Kills process with taskkill 3 IoCs

defense_evasion

pid	Process
6908	taskkill.exe
4876	taskkill.exe
1312	taskkill.exe

Modifies data under HKEY_USERS 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe

Modifies registry class 11 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-696679853-3915825385-3233721679-1000\{00B45DB7-1B0E-4927-A39F-A4C6DA57BABB}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-696679853-3915825385-3233721679-1000\{9D415CE4-628B-4B77-ABDB-E5D753722697}	msedge.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
6608	reg.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3748	msedge.exe
3748	msedge.exe
1948	msedge.exe
1948	msedge.exe
6244	powershell.exe
6244	powershell.exe
6244	powershell.exe
3164	powershell.exe
3164	powershell.exe
3164	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe

Suspicious use of AdjustPrivilegeToken 33 IoCs

description	pid	Process
Token: SeDebugPrivilege	4396	botConnect.exe
Token: SeDebugPrivilege	3228	whoami.exe
Token: SeDebugPrivilege	6244	powershell.exe
Token: SeIncreaseQuotaPrivilege	6244	powershell.exe
Token: SeSecurityPrivilege	6244	powershell.exe
Token: SeTakeOwnershipPrivilege	6244	powershell.exe
Token: SeLoadDriverPrivilege	6244	powershell.exe
Token: SeSystemProfilePrivilege	6244	powershell.exe
Token: SeSystemtimePrivilege	6244	powershell.exe
Token: SeProfSingleProcessPrivilege	6244	powershell.exe
Token: SeIncBasePriorityPrivilege	6244	powershell.exe
Token: SeCreatePagefilePrivilege	6244	powershell.exe
Token: SeBackupPrivilege	6244	powershell.exe
Token: SeRestorePrivilege	6244	powershell.exe
Token: SeShutdownPrivilege	6244	powershell.exe
Token: SeDebugPrivilege	6244	powershell.exe
Token: SeSystemEnvironmentPrivilege	6244	powershell.exe
Token: SeRemoteShutdownPrivilege	6244	powershell.exe
Token: SeUndockPrivilege	6244	powershell.exe
Token: SeManageVolumePrivilege	6244	powershell.exe
Token: 33	6244	powershell.exe
Token: 34	6244	powershell.exe
Token: 35	6244	powershell.exe
Token: 36	6244	powershell.exe
Token: SeDebugPrivilege	3164	powershell.exe
Token: SeShutdownPrivilege	3132	svchost.exe
Token: SeDebugPrivilege	1424	tasklist.exe
Token: SeDebugPrivilege	2492	tasklist.exe
Token: SeDebugPrivilege	4040	whoami.exe
Token: SeDebugPrivilege	6908	taskkill.exe
Token: SeDebugPrivilege	4876	taskkill.exe
Token: SeDebugPrivilege	3288	whoami.exe
Token: SeDebugPrivilege	1312	taskkill.exe

Suspicious use of FindShellTrayWindow 47 IoCs

pid	Process
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe

Suspicious use of SendNotifyMessage 20 IoCs

pid	Process
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1672	nitrogen.exe
6212	SecHealthUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4796 wrote to memory of 5084	4796	msedge.exe	89
PID 4796 wrote to memory of 1140	4796	msedge.exe	90
PID 4796 wrote to memory of 4332	4796	msedge.exe	91
PID 4796 wrote to memory of 1140	4796	msedge.exe	90
PID 4796 wrote to memory of 1140	4796	msedge.exe	90
PID 4796 wrote to memory of 4948	4796	msedge.exe	92
PID 4796 wrote to memory of 4948	4796	msedge.exe	92
PID 4796 wrote to memory of 5880	4796	msedge.exe	93
PID 4796 wrote to memory of 5880	4796	msedge.exe	93
PID 4796 wrote to memory of 720	4796	msedge.exe	94
PID 4796 wrote to memory of 5880	4796	msedge.exe	93
PID 4796 wrote to memory of 720	4796	msedge.exe	94
PID 4796 wrote to memory of 720	4796	msedge.exe	94
PID 4796 wrote to memory of 3976	4796	msedge.exe	96
PID 4796 wrote to memory of 5136	4796	msedge.exe	97
PID 4796 wrote to memory of 3976	4796	msedge.exe	96
PID 4796 wrote to memory of 3976	4796	msedge.exe	96
PID 4796 wrote to memory of 5136	4796	msedge.exe	97
PID 4796 wrote to memory of 5136	4796	msedge.exe	97
PID 4796 wrote to memory of 2480	4796	msedge.exe	98
PID 4796 wrote to memory of 1072	4796	msedge.exe	99
PID 4796 wrote to memory of 2480	4796	msedge.exe	98
PID 4796 wrote to memory of 1072	4796	msedge.exe	99
PID 4796 wrote to memory of 4596	4796	msedge.exe	100
PID 4796 wrote to memory of 4596	4796	msedge.exe	100
PID 4796 wrote to memory of 4396	4796	msedge.exe	101
PID 4796 wrote to memory of 4396	4796	msedge.exe	101
PID 4796 wrote to memory of 4396	4796	msedge.exe	101
PID 4796 wrote to memory of 3368	4796	msedge.exe	103
PID 4796 wrote to memory of 3856	4796	msedge.exe	104
PID 4796 wrote to memory of 3856	4796	msedge.exe	104
PID 4796 wrote to memory of 4740	4796	msedge.exe	105
PID 4796 wrote to memory of 4740	4796	msedge.exe	105
PID 4796 wrote to memory of 4740	4796	msedge.exe	105
PID 4796 wrote to memory of 2424	4796	msedge.exe	107
PID 4796 wrote to memory of 3748	4796	msedge.exe	110
PID 3748 wrote to memory of 4888	3748	msedge.exe	111
PID 3748 wrote to memory of 5368	3748	msedge.exe	112
PID 3748 wrote to memory of 5384	3748	msedge.exe	113
PID 3748 wrote to memory of 5368	3748	msedge.exe	112
PID 3748 wrote to memory of 5368	3748	msedge.exe	112
PID 3748 wrote to memory of 1104	3748	msedge.exe	114
PID 3748 wrote to memory of 1104	3748	msedge.exe	114
PID 3748 wrote to memory of 1492	3748	msedge.exe	116
PID 3748 wrote to memory of 1492	3748	msedge.exe	116
PID 3748 wrote to memory of 1520	3748	msedge.exe	118
PID 3748 wrote to memory of 2376	3748	msedge.exe	119
PID 3748 wrote to memory of 2376	3748	msedge.exe	119
PID 3748 wrote to memory of 4332	3748	msedge.exe	120
PID 3748 wrote to memory of 4332	3748	msedge.exe	120
PID 3748 wrote to memory of 3904	3748	msedge.exe	121
PID 3748 wrote to memory of 3904	3748	msedge.exe	121
PID 3748 wrote to memory of 2008	3748	msedge.exe	122
PID 3748 wrote to memory of 2008	3748	msedge.exe	122
PID 3748 wrote to memory of 1948	3748	msedge.exe	123
PID 3748 wrote to memory of 1948	3748	msedge.exe	123
PID 3196 wrote to memory of 1672	3196	nitrogen.exe	125
PID 3748 wrote to memory of 6236	3748	msedge.exe	126
PID 3748 wrote to memory of 6236	3748	msedge.exe	126
PID 1672 wrote to memory of 5112	1672	nitrogen.exe	128
PID 5112 wrote to memory of 4396	5112	botConnect.exe	129
PID 4396 wrote to memory of 6596	4396	botConnect.exe	130
PID 3748 wrote to memory of 6192	3748	msedge.exe	132
PID 3748 wrote to memory of 6756	3748	msedge.exe	133

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://cdn.discordapp.com/attachments/1560686877172961282/1560745930683056251/nitrogen.exe?ex=6ad47e2b&is=6ad32cab&hm=9dbb5acd2f663129d0abd2e6673c76a206098f2fcf6ecc8e2c50cb9b1f2c839b&
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2c0,0x7ffecf62c188,0x7ffecf62c194,0x7ffecf62c1a0
  2⤵
  PID:5084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1512,i,5030140641094211483,2072301431829498000,262144 --field-trial-handle=2520,i,8953139820857796403,14746639976591725026,262144 --variations-seed-version --mojo-platform-channel-handle=2512 /prefetch:2
  2⤵
  PID:1140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1768,i,8685708605625273694,3823528942615463269,524288 --field-trial-handle=2520,i,8953139820857796403,14746639976591725026,262144 --variations-seed-version --mojo-platform-channel-handle=2764 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:4332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2212,i,14719787464389598616,2054028619172655180,524288 --field-trial-handle=2520,i,8953139820857796403,14746639976591725026,262144 --variations-seed-version --mojo-platform-channel-handle=3140 /prefetch:13
  2⤵
  PID:4948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3472,i,13443056128176737662,17898216060479593401,2097152 --field-trial-handle=2520,i,8953139820857796403,14746639976591725026,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:1
  2⤵
  PID:5880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3492,i,2562524004464349420,12047216866875286193,2097152 --field-trial-handle=2520,i,8953139820857796403,14746639976591725026,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:1
  2⤵
  PID:720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4244,i,9923903380994783068,6333144360575493049,2097152 --field-trial-handle=2520,i,8953139820857796403,14746639976591725026,262144 --variations-seed-version --mojo-platform-channel-handle=4808 /prefetch:1
  2⤵
  PID:3976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4296,i,12794937986225494734,3018249436061505150,2097152 --field-trial-handle=2520,i,8953139820857796403,14746639976591725026,262144 --variations-seed-version --mojo-platform-channel-handle=4812 /prefetch:9
  2⤵
  PID:5136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5336,i,11923555584955195963,13530828479866754623,524288 --field-trial-handle=2520,i,8953139820857796403,14746639976591725026,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:14
  2⤵
  PID:2480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5348,i,1395934180162670034,15485741555574264938,524288 --field-trial-handle=2520,i,8953139820857796403,14746639976591725026,262144 --variations-seed-version --mojo-platform-channel-handle=5424 /prefetch:14
  2⤵
  PID:1072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5748,i,874784196077443098,281387197761088450,524288 --field-trial-handle=2520,i,8953139820857796403,14746639976591725026,262144 --variations-seed-version --mojo-platform-channel-handle=6068 /prefetch:14
  2⤵
  PID:4596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6004,i,15616851836035590162,7954985345866128198,2097152 --field-trial-handle=2520,i,8953139820857796403,14746639976591725026,262144 --variations-seed-version --mojo-platform-channel-handle=6084 /prefetch:1
  2⤵
  PID:4396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6348,i,2695002017615412922,13906956549734653144,524288 --field-trial-handle=2520,i,8953139820857796403,14746639976591725026,262144 --variations-seed-version --mojo-platform-channel-handle=5328 /prefetch:14
  2⤵
  PID:3368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6556,i,16650391243910857676,6402225031059419771,524288 --field-trial-handle=2520,i,8953139820857796403,14746639976591725026,262144 --variations-seed-version --mojo-platform-channel-handle=6552 /prefetch:14
  2⤵
  PID:3856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=4232,i,9245807641110367955,12899589086592784907,2097152 --field-trial-handle=2520,i,8953139820857796403,14746639976591725026,262144 --variations-seed-version --mojo-platform-channel-handle=6052 /prefetch:1
  2⤵
  PID:4740
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7112,i,17627348178668384735,6721911618842075482,524288 --field-trial-handle=2520,i,8953139820857796403,14746639976591725026,262144 --variations-seed-version --mojo-platform-channel-handle=7128 /prefetch:14
  2⤵
  PID:2628
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7112,i,17627348178668384735,6721911618842075482,524288 --field-trial-handle=2520,i,8953139820857796403,14746639976591725026,262144 --variations-seed-version --mojo-platform-channel-handle=7128 /prefetch:14
  2⤵
  PID:2424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3748
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x270,0x7ffecf62c188,0x7ffecf62c194,0x7ffecf62c1a0
    3⤵
    PID:4888
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1676,i,10436120656448090855,2439004668963164775,262144 --field-trial-handle=2288,i,10084059237505837385,17159802647493363147,262144 --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:2
    3⤵
    PID:5368
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1892,i,13931085001144030376,9954475419932741658,524288 --field-trial-handle=2288,i,10084059237505837385,17159802647493363147,262144 --variations-seed-version --mojo-platform-channel-handle=2364 /prefetch:11
    3⤵
    - System Time Discovery
    PID:5384
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2472,i,18356919034268043337,7543758620805341067,524288 --field-trial-handle=2288,i,10084059237505837385,17159802647493363147,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:13
    3⤵
    PID:1104
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4416,i,6894079565778446548,1569367129907518590,524288 --field-trial-handle=2288,i,10084059237505837385,17159802647493363147,262144 --variations-seed-version --mojo-platform-channel-handle=4408 /prefetch:14
    3⤵
    PID:1492
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4388,i,1950947099449151117,12037731484528179476,524288 --field-trial-handle=2288,i,10084059237505837385,17159802647493363147,262144 --variations-seed-version --mojo-platform-channel-handle=4404 /prefetch:14
    3⤵
    PID:1724
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4388,i,1950947099449151117,12037731484528179476,524288 --field-trial-handle=2288,i,10084059237505837385,17159802647493363147,262144 --variations-seed-version --mojo-platform-channel-handle=4404 /prefetch:14
    3⤵
    PID:1520
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4720,i,2856430974262526815,1296531946950946254,524288 --field-trial-handle=2288,i,10084059237505837385,17159802647493363147,262144 --variations-seed-version --mojo-platform-channel-handle=4736 /prefetch:14
    3⤵
    PID:2376
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4792,i,13075744450719137906,8668841107682039899,524288 --field-trial-handle=2288,i,10084059237505837385,17159802647493363147,262144 --variations-seed-version --mojo-platform-channel-handle=4804 /prefetch:14
    3⤵
    PID:4332
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5080,i,14713884805619672622,9172462765309872079,524288 --field-trial-handle=2288,i,10084059237505837385,17159802647493363147,262144 --variations-seed-version --mojo-platform-channel-handle=5072 /prefetch:14
    3⤵
    PID:3904
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5200,i,534324691785522265,6584682570200165803,524288 --field-trial-handle=2288,i,10084059237505837385,17159802647493363147,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:14
    3⤵
    PID:2008
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5368,i,5126519064045516835,15035944754196649941,524288 --field-trial-handle=2288,i,10084059237505837385,17159802647493363147,262144 --variations-seed-version --mojo-platform-channel-handle=5372 /prefetch:14
    3⤵
    PID:1948
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5092,i,13661913408941292400,3384270000944245323,524288 --field-trial-handle=2288,i,10084059237505837385,17159802647493363147,262144 --variations-seed-version --mojo-platform-channel-handle=5080 /prefetch:14
    3⤵
    PID:6236
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4800,i,14077725214313046191,8205932045031545552,524288 --field-trial-handle=2288,i,10084059237505837385,17159802647493363147,262144 --variations-seed-version --mojo-platform-channel-handle=5108 /prefetch:14
    3⤵
    PID:6192
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5560,i,15388820417727216517,11237342476031119466,524288 --field-trial-handle=2288,i,10084059237505837385,17159802647493363147,262144 --variations-seed-version --mojo-platform-channel-handle=5100 /prefetch:14
    3⤵
    PID:6756
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5548,i,5154053783314345398,11002719884117430372,524288 --field-trial-handle=2288,i,10084059237505837385,17159802647493363147,262144 --variations-seed-version --mojo-platform-channel-handle=4868 /prefetch:14
    3⤵
    PID:6196
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5164,i,10609306816100798077,2380838678770753367,524288 --field-trial-handle=2288,i,10084059237505837385,17159802647493363147,262144 --variations-seed-version --mojo-platform-channel-handle=4756 /prefetch:14
    3⤵
    PID:5540
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5184,i,656892329774769044,7762680949618301908,524288 --field-trial-handle=2288,i,10084059237505837385,17159802647493363147,262144 --variations-seed-version --mojo-platform-channel-handle=812 /prefetch:14
    3⤵
    PID:2104
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=812,i,11122235694700776795,8730293950125564164,262144 --field-trial-handle=2288,i,10084059237505837385,17159802647493363147,262144 --variations-seed-version --mojo-platform-channel-handle=5472 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1948
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5224,i,12410922671172289310,12689958344133359694,524288 --field-trial-handle=2288,i,10084059237505837385,17159802647493363147,262144 --variations-seed-version --mojo-platform-channel-handle=5096 /prefetch:14
    3⤵
    PID:4152
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3808,i,12623907949159573490,15523194882386120285,524288 --field-trial-handle=2288,i,10084059237505837385,17159802647493363147,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:14
    3⤵
    PID:6340
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3880,i,3708867186341101883,16276890333560023796,524288 --field-trial-handle=2288,i,10084059237505837385,17159802647493363147,262144 --variations-seed-version --mojo-platform-channel-handle=4196 /prefetch:14
    3⤵
    PID:6264
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3876,i,13370761325897635694,16144222051667358999,524288 --field-trial-handle=2288,i,10084059237505837385,17159802647493363147,262144 --variations-seed-version --mojo-platform-channel-handle=4180 /prefetch:14
    3⤵
    PID:6252
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5368,i,13657144003033660196,5588436080648661903,524288 --field-trial-handle=2288,i,10084059237505837385,17159802647493363147,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:14
    3⤵
    PID:6220
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5144,i,14693410592766593935,11804572502580850333,524288 --field-trial-handle=2288,i,10084059237505837385,17159802647493363147,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:14
    3⤵
    PID:6884
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3496,i,14114019087408051573,15263821534741172951,524288 --field-trial-handle=2288,i,10084059237505837385,17159802647493363147,262144 --variations-seed-version --mojo-platform-channel-handle=3876 /prefetch:14
    3⤵
    PID:7020
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4460,i,1736007785778914901,1893188425202626520,524288 --field-trial-handle=2288,i,10084059237505837385,17159802647493363147,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:14
    3⤵
    PID:5464
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3792,i,7243111020722232867,18222625749045118050,524288 --field-trial-handle=2288,i,10084059237505837385,17159802647493363147,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:14
    3⤵
    PID:5792
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4420,i,5487106722139866902,15147932340330487666,524288 --field-trial-handle=2288,i,10084059237505837385,17159802647493363147,262144 --variations-seed-version --mojo-platform-channel-handle=5008 /prefetch:14
    3⤵
    PID:5876
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4416,i,1830750955488938976,3392595621412365838,524288 --field-trial-handle=2288,i,10084059237505837385,17159802647493363147,262144 --variations-seed-version --mojo-platform-channel-handle=2500 /prefetch:14
    3⤵
    PID:3208
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4984,i,872876235255908611,2934152142670557429,524288 --field-trial-handle=2288,i,10084059237505837385,17159802647493363147,262144 --variations-seed-version --mojo-platform-channel-handle=5072 /prefetch:14
    3⤵
    PID:6724
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5444,i,17391105077158712556,18215945766995084108,524288 --field-trial-handle=2288,i,10084059237505837385,17159802647493363147,262144 --variations-seed-version --mojo-platform-channel-handle=4500 /prefetch:14
    3⤵
    PID:2768
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5032,i,16150249095253810060,12601055266982060660,524288 --field-trial-handle=2288,i,10084059237505837385,17159802647493363147,262144 --variations-seed-version --mojo-platform-channel-handle=4984 /prefetch:14
    3⤵
    PID:956
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4300,i,12222780339698698761,14454097041594688953,524288 --field-trial-handle=2288,i,10084059237505837385,17159802647493363147,262144 --variations-seed-version --mojo-platform-channel-handle=3792 /prefetch:14
    3⤵
    PID:5100
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4180,i,15510670313069333283,1888707521559410148,524288 --field-trial-handle=2288,i,10084059237505837385,17159802647493363147,262144 --variations-seed-version --mojo-platform-channel-handle=2160 /prefetch:14
    3⤵
    PID:1140
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5596,i,5516437216087340924,11197339866711248387,524288 --field-trial-handle=2288,i,10084059237505837385,17159802647493363147,262144 --variations-seed-version --mojo-platform-channel-handle=3792 /prefetch:14
    3⤵
    PID:1264
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5012,i,8835146445678006072,7868825065314941582,524288 --field-trial-handle=2288,i,10084059237505837385,17159802647493363147,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:14
    3⤵
    PID:6760
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5432,i,13296602333394404751,10882262391141502189,524288 --field-trial-handle=2288,i,10084059237505837385,17159802647493363147,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:14
    3⤵
    PID:2684
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=812,i,16185052544693109639,10605260063854342111,524288 --field-trial-handle=2288,i,10084059237505837385,17159802647493363147,262144 --variations-seed-version --mojo-platform-channel-handle=5448 /prefetch:14
    3⤵
    PID:124
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3220,i,18001707585387279680,10017739337320925809,524288 --field-trial-handle=2288,i,10084059237505837385,17159802647493363147,262144 --variations-seed-version --mojo-platform-channel-handle=3804 /prefetch:14
    3⤵
    PID:4768
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1084,i,5432194867898554697,495463115188800908,524288 --field-trial-handle=2288,i,10084059237505837385,17159802647493363147,262144 --variations-seed-version --mojo-platform-channel-handle=5484 /prefetch:14
    3⤵
    PID:6404
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4996,i,8812197373958538759,5159295830508351838,524288 --field-trial-handle=2288,i,10084059237505837385,17159802647493363147,262144 --variations-seed-version --mojo-platform-channel-handle=4768 /prefetch:14
    3⤵
    PID:3428

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4304

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3116

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5424

C:\Users\Admin\Desktop\nitrogen.exe
"C:\Users\Admin\Desktop\nitrogen.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3196
- C:\Users\Admin\Desktop\nitrogen.exe
  "C:\Users\Admin\Desktop\nitrogen.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1672
- - C:\Users\Admin\Downloads\botConnect.exe
    C:\Users\Admin\Downloads\botConnect.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:5112
  - - C:\Users\Admin\Downloads\botConnect.exe
      C:\Users\Admin\Downloads\botConnect.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in Windows directory
      Reads the TCP/IP host and domain name from the registry
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4396
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        Executes a command shell one-liner
        
        PID:6596
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "whoami"
        5⤵
        Executes a command shell one-liner
        
        PID:7008
      - C:\Windows\system32\whoami.exe
        
        whoami
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3228
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" "
        5⤵
        Executes a command shell one-liner
        
        PID:5408
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
        6⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:6244
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskmgr /t REG_DWORD /d 1 /f"
        5⤵
        Executes a command shell one-liner
        
        PID:6616
      - C:\Windows\system32\reg.exe
        
        REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskmgr /t REG_DWORD /d 1 /f
        6⤵
        Modifies registry key
        
        PID:6608
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell -Command "netsh advfirewall set allprofiles state off" "
        5⤵
        Executes a command shell one-liner
        
        PID:6580
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "netsh advfirewall set allprofiles state off"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3164
        
        C:\Windows\system32\netsh.exe
        
        "C:\Windows\system32\netsh.exe" advfirewall set allprofiles state off
        7⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:1548
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "where /r "%LOCALAPPDATA%\Google\Chrome\User Data" Cookies"
        5⤵
        Executes a command shell one-liner
        
        PID:1040
      - C:\Windows\system32\where.exe
        
        where /r "C:\Users\Admin\AppData\Local\Google\Chrome\User Data" Cookies
        6⤵
        
        PID:6400
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "del /q /f /s C:\*"
        5⤵
        Drops file in Program Files directory
        Drops file in Windows directory
        Executes a command shell one-liner
        
        PID:3456
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "b"
        5⤵
        Executes a command shell one-liner
        
        PID:5660
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tasklist"
        5⤵
        Executes a command shell one-liner
        
        PID:3516
      - C:\Windows\system32\tasklist.exe
        
        tasklist
        6⤵
        Discovers running processes
        Suspicious use of AdjustPrivilegeToken
        
        PID:1424
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tasklist /svc"
        5⤵
        Executes a command shell one-liner
        
        PID:2584
      - C:\Windows\system32\tasklist.exe
        
        tasklist /svc
        6⤵
        Discovers running processes
        Suspicious use of AdjustPrivilegeToken
        
        PID:2492
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "whoami"
        5⤵
        Executes a command shell one-liner
        
        PID:6160
      - C:\Windows\system32\whoami.exe
        
        whoami
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4040
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /IM services.exe /F"
        5⤵
        Executes a command shell one-liner
        
        PID:5032
      - C:\Windows\system32\taskkill.exe
        
        taskkill /IM services.exe /F
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:6908
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /IM cmd.exe /F"
        5⤵
        Executes a command shell one-liner
        
        PID:2372
      - C:\Windows\system32\taskkill.exe
        
        taskkill /IM cmd.exe /F
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4876
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "whoami"
        5⤵
        Executes a command shell one-liner
        
        PID:2104
      - C:\Windows\system32\whoami.exe
        
        whoami
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3288
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "diskpart"
        5⤵
        Executes a command shell one-liner
        
        PID:5108
      - C:\Windows\system32\diskpart.exe
        
        diskpart
        6⤵
        
        PID:6388
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "list disk"
        5⤵
        Executes a command shell one-liner
        
        PID:2336
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /IM svchost.exe /F"
        5⤵
        Executes a command shell one-liner
        
        PID:3384
      - C:\Windows\system32\taskkill.exe
        
        taskkill /IM svchost.exe /F
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1312

C:\Program Files\WindowsApps\Microsoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe\SecHealthUI.exe
"C:\Program Files\WindowsApps\Microsoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe\SecHealthUI.exe" -ServerName:SecHealthUI.AppX8tam42xc7v2czs3s1nt0nkxvfjtepzp9.mca
1⤵
- Suspicious use of SetWindowsHookEx
PID:6212

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:5880

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {E041C90B-68BA-42C9-991E-477B73A75C90} -Embedding
1⤵
PID:3504

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k WbioSvcGroup -s WbioSrvc
1⤵
- Drops file in System32 directory
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3132

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2480

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:1296

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /7
1⤵
PID:3236

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5076

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:1568

C:\Windows\System32\vdsldr.exe
C:\Windows\System32\vdsldr.exe -Embedding
1⤵
PID:684

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Checks SCSI registry key(s)
PID:6676

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Windows Credential Manager

T1555.004

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

034ed0c7-75f9-4591-8f10-28c8e9d28bc4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\034ed0c7-75f9-4591-8f10-28c8e9d28bc4.tmp
Size 34KB
SHA256 4d9df688b25bdb6215c8ca256b09e79a88a1357e4820231b9b9bcc93a43981f8
MD5 bb10386320490d3656f936120ca3931a
SHA1 c45b4dd0b6e517c66b3be7453d333fc507842f1d
SHA512 0978f208eaecd810ef2c20c0de5f7d2da41a99f9aeca90177e6276fc4188180a928b5392f4b7b618e721aba0a12d0c4e1e8d33f6d8008e4a14d1399932177b24
SSDEEP 768:BH3L9JBNcZ0rfZWaYo5S0YoYlBw4Ot5AEl94BHYj09ixTtLu:BH3L9DalBVa5AEncHYjoifi
TLSH
T1F4F2AF38ECA59D238CE79389B71B36866FF05563E9C01F94E9D96A1D068324F234B807
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0c3d0c67-451c-4c37-81ce-bc31925c0910.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\0c3d0c67-451c-4c37-81ce-bc31925c0910.tmp
Size 38KB
SHA256 e5b2382b33f86a9d5a6432afb5b93ab93c09e7ec3924270eb027df37db839067
MD5 d8e0c1b8c9041577179ec174bcc41dde
SHA1 c2f89a43b52f356587647e38c8300da0145c5d1a
SHA512 24d66ffd24e3dffe965ede3967890b473cb7fd4f5f46657f2bc8b0a7527358ca373a535995018bd3db60836150b5b98887243a4cf2639c30f531f61c5d475be5
SSDEEP 768:z/UxvxjgC+b30IcZ0rfZWaYo5SXBw4Ot5AEl94BHYj/JAFTN/:GZj3+b3EBVa5AEncHYjRAFB/
TLSH
T12903BF3DECA59927CCF79785770B3397AEF18463A5C12ED489EC2D1E0A8725D530B80A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4e061648-0b79-44aa-a426-f1f6b58bab2b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\4e061648-0b79-44aa-a426-f1f6b58bab2b.tmp
Size 38KB
SHA256 08c4eb82e07010bf62e6bede12956431ec400eadad3f8fbe98fac1abe1623fe4
MD5 d76417b8aa48a56ac282dc007bedf09f
SHA1 7c4b23b4e5391ac34279395f90c243ac4db6f130
SHA512 e74f1ce1417aa1a6cddc8f81ddecb86a5b997b7e096dbc445b6383849fc4c3e8bd1b831183abfbbc1adbabef42c5f01cd94b7e3b6c2ec99cfd9d7da93e26e1e8
SSDEEP 768:k/UxvxjgC+b30kBfcZ0rfZWaYo5S0YoYGBw4Ot5AEl94BHYjevAFTN/:RZj3+b3jMGBVa5AEncHYjEAFB/
TLSH
T15203BF39ECA599238CF696C5771B33479EF185A3E5C16ED09DEC2D1E0A8729E130B806
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4f8749cd-ce8b-41fe-b8de-41ee1db4157e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\4f8749cd-ce8b-41fe-b8de-41ee1db4157e.tmp
Size 36KB
SHA256 44a8356783982c3cf439ef77a971d8c1167f23788ef2b138375e2d38d7547973
MD5 23de7f174b97726d2c7ad8cf3ef1b514
SHA1 feeb86165603ab5dafff03616aa3949c64f53b35
SHA512 9934a705a0989ac5d65c14269cd152436f77700326ddd1e72b89b16c3a3f3ab4ed63709ba65d51d006361ad04ca7a7e5f2bd005b6740be24913f6ddede4a04eb
SSDEEP 768:6H3L9JBNcZ0rfZWaYo5SNBw4Ot5AEl94BHYj0OsE/cwdyTtLu:6H3L9DGBVa5AEncHYjtpcAIi
TLSH
T166F2AE3CDCA54D3B8CEBB785B60E36466EF09233E9941E94DBCC6B1D459324EA347806
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

65165427-c38e-4121-aa4d-97751c44d0d0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\65165427-c38e-4121-aa4d-97751c44d0d0.tmp
Size 38KB
SHA256 dbbb86fc24903ac3339206fb3f9d87caca6162991fc7df51ce105f3a7d75d8c3
MD5 ee891f442c867ece47a92d24b73db8d2
SHA1 930d4fc4f1c86eba1844b1bcea04a1f3eee70b21
SHA512 82f526ac36d37b6b00dc641e5a10b861e5db56f8c6e3c528871d1053def3cdd53442f7889daac4ea6cc74a258cffb34847d972c0aaf7f589f32e2041dd81476a
SSDEEP 768:SH3ZD91BNcZ0rfZWaYo5S0YoYwBw4Ot5AEl94BHYjHk7Kb9wddxTILn:SH3Z9XawBVa5AEncHYjE7Kb9Adij
TLSH
T1E6037C3CDCA5993F48EEB788760E36565EB04233E5B01A94D7C92B1D86B724EF347806
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8c9f7747-2981-4abb-a428-d16a5ddd4923.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\8c9f7747-2981-4abb-a428-d16a5ddd4923.tmp
Size 55KB
SHA256 f69f2191c9632c8c8a049d9bbbc2d4bda1330dbc8d7ad90ff02610756837213b
MD5 e7ef004be973dcb605bacdee3437b03e
SHA1 b1e5bd55374ba92ac14f456afc8605b7b947e0e6
SHA512 9fb0c14c8fc347efd98e08aa041a8443249351443a63c4b498f0b1620f12524fb4d6ccf2c848fdaf910fda35141c8a03f84e739c9945d39cb40e1ee50246e18c
SSDEEP 1536:6H3t9DbBVa5AEncHYjLocgmtCu2aDSipcAli:Qt/EnTjFtR2lipZ0
TLSH
T18443BF39DCA4CE7F88F76785B74E3A0AADF15223D6E869D4E6C85E1C019758E6303C09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9effa242-5662-42d5-a5c2-f6070c3bc0f4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\9effa242-5662-42d5-a5c2-f6070c3bc0f4.tmp
Size 34KB
SHA256 3f76b7685ae4595fa09db848b9c14ffc752c2e18f83fa7bc670710587b6900cf
MD5 ed774fc80c4e3e8b1a2e69ef8f223b1e
SHA1 a10dae34a09a0714ad5a4fd718a0bb1bf94a1238
SHA512 00077e77c80d36498290b8f6488fe51a481c3aee249f98b25cf0db99ea283595d035201e8dad31249f070d1e3c1a3b266806c03189715d22c043ce706d7090e1
SSDEEP 768:mH3I9JBNcZ0rfZWaYo5S0YoYlBw4Ot5AEl94BHYj09ixTtLu:mH3I9DalBVa5AEncHYjoifi
TLSH
T1C0F2AF38ECA59D638CF79389B71B36866FF05563E9C01F94E9D96A1D068324F234B807
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 3f461bb307501118465fa355b5c41e2a705f236a6f0a9d6da2f7ec220831c703
MD5 b128b9eab72c965083b92d5147aa016b
SHA1 50e10f3f576f2ffa690298c3261891f992813335
SHA512 c7356be074c8c4dac39c2b53fc3c679e844ec686a16cf50df2caffd578fd4ff9775661084c859882e8c383687ff10fc72b9c4d7784ae1707436f3dee76196979
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7r:fwUQC5VwBIiElEd2K57P7r
TLSH
T193B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 59619e39464102fa53912dd9a15237954c5125d546c48a72b8bdb58ad9eb9753
MD5 f80a0057aa895d42a15b594d07d09f76
SHA1 2478a67794a5362ccf809b7a2c8f64a03c72fa32
SHA512 4a9ec8459a11d9e573883d5eacfd5386cf838bad2bd0b33ff1b37017f5f2cf6bfcef877344a87892e3c49ce624e0cae52791ded1593b8233138de87fd2e5e634
TLSH
T1C6D02B75F668E9D2C140043C00410920706035066F6801C206030038040324B55022C7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 bd3d58347f0a51de8ef13df44fe22f9f8278d43ed21023353851cf85ce97fa85
MD5 ff0249660c5879ba1298be8581359f58
SHA1 3965ad1cdbb8bbba6bdd826fdc168f69fc1f601b
SHA512 404436b600286b3599ebfc12f50562a871786f2b7abf8a844e17784b5d26550b863f08e7c13e23d41a152856ec4c2b1ba96cb795324a047caa4d667cdecd47f1
TLSH
T1D2D0801575267EEDC35D143801545D4065549F635B75054746030C3809665432C91EEF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 be479f4b2c74f102d86dca39bec27a414d97b7118bce8f11f9ec9a394d59f745
MD5 c9f87ffbe56375928ce0c7df3cfb0ea7
SHA1 b4484ca6cbad95d74098d59bc0a41183763d834d
SHA512 4e51fb4234f95a26493648527725924caa19dcd4836e042cac2274565c1bae45280ccb009f7a6d6fab34a0abc1d608a04c3ee356ab9eb4cf42ea66d7995fad9f
TLSH
T1B0D08095F617395CC74A5874034E5F506110E927653604764907053C1006F4538D17FE
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2f95af5a1b90fb9d524e4a5fc2acdf5ca6f1dfdc67d891ac98e9ee01bed2cfd7
MD5 2279f5e9e869bf2b37a2673549548f80
SHA1 eefbfc9ed1c792862a7283b94af7b0190d242b2c
SHA512 831f5b95abb0155374a3b47681dedbf5d5ff2442f4b23fa3030a772a138f2378262530c319c792466af46f53fbc6a1c35d555ec523fcf7e9683ddc639d94cb9d
TLSH
T112D08095F617385CC74A5874034E5F506100E927153604764907053C1006F4539D07EE
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 91a032a4ffcdd10503afdeb5220904a7e7cea899c3a55606bb3e90180ed9472e
MD5 f04321ebc7aa4a8f91bb5362a6c4c79b
SHA1 c98d3283204e4a0453e416a04c3ae56e4c3feed8
SHA512 c2faa7fae738d85299e6f63b9eaf33c25db5a255ea3f5f6a8551842b7e0cec73c7e8b5e86a9cfb9714287d2b382b57b7249bc70671dbfde2815d5937243570af
TLSH
T1DED02B71F678E8D2C140043C00420920705035061F6801C207034038040324B55012C3
MD5 SHA1 SHA512 TLSH

Submit Download

1d439e7a-d554-4a65-911e-4e625e9e3ecf.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1d439e7a-d554-4a65-911e-4e625e9e3ecf.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

9b67646c-4d68-4d10-8b5a-10687dba6049.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9b67646c-4d68-4d10-8b5a-10687dba6049.tmp
Size 12KB
SHA256 6fc16d0e7a926a95c1c8793dd911616ca43149a35ea430a184da637403912224
MD5 80c4fa3bc6210db63b7e7b33a9d95d29
SHA1 d3892c9efbad15d84a44defd839946129e8486eb
SHA512 99aa9fa3421cac91f67c929ec2f9737de124426fbc3d98daf56311205927a4afe1841229461464b494cfa5737c324f696b22371a580015ed0a04e287283fd63d
SSDEEP 192:sxRrRPZs1/fjsqTWpVnyGCJ5VzoA8pi/g6+WNIYiOTT1MGwIgPJ:sxRr3s1/fjsgWvny7P4i/5I9R
TLSH
T11E42B715AD28B93B9CC7E25DBB657F53D6F9103360955E08A6FC8A2C00FB6DD120790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9d3c4fd3-20a2-4576-b736-6c9d27778a87.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9d3c4fd3-20a2-4576-b736-6c9d27778a87.tmp
Size 12KB
SHA256 a188813900ce7a0557fadb02ca6465438192dea8aabccf7919e9a773ee920e8b
MD5 5f582288d3dbdf330b3493ce9f762cce
SHA1 be0539025408ce2dee17daa7fd48afde52248f5b
SHA512 065e7d1ac02455534e404643c5917553b789bfcce2db60395df1adb4ec5aebe9dfdb3395c59892988b312951e81cc9d8573dbaa7f3ef0dd1a99a46a85b6e6542
SSDEEP 192:sxRrRPZs1/fjsqTWpVGyGCJ5VzoA8pi/g6+WNIYihJT1MGwIgtJ:sxRr3s1/fjsgWvGy7P4i/5IU3
TLSH
T17B42B615AD28B93B8CCBD21DFB657F53D6F91032A0955E48A6FC8A2C04EB6DD120790F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9f582fc4-7c62-40cb-9f00-2a361c2df080.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9f582fc4-7c62-40cb-9f00-2a361c2df080.tmp
Size 11KB
SHA256 97bd51f3496b07b86d393baa938a8ff8ca9e02182a9750a179c8313c1708b241
MD5 f0975135d19687bdc42fd20f28f2bbf5
SHA1 0d30a80c24b7f5cd18c3f095f3bb8b0aa8d14eec
SHA512 4493d05fab4937648c75892fa3fcc11e9c4f7a900f6277f9e70f0cfd480b4e3d7c8bcab1064ec4165cefe8db51915eea588c96cb2dc284a00f28e49a2f0f8fdd
SSDEEP 192:sxRwRPZs1/fjsBFWpVGy6VzoA8pi/g6+WNIYihJT1agwIgIJ:sxRw3s1/fjsbWvGy64i/5IAs
TLSH
T1EC32B615AD28B93B8CCBD21DFB657F53D2F9103261965E48E6FC8A2C04EB6DD120790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG
Size 334B
SHA256 b6dbe7ceb63d510f44ac2d71980360ccb93fbd68b2572e3e57d35c6f00f52802
MD5 82fc86eb7589bb379dc2591d5f8c0096
SHA1 f808fddb3f7da94b87725660d693e5c06a37fe50
SHA512 fcb10cd7365a462b0e8169a3cb16498f43d25989f90c6af1b3a51859279217adf4928ea9edb836e522098f06fd9569ce0ed9cd9496a0c40fbfc039269db59556
TLSH
T156E026C445CBC32FE708E78702B8C34C93A1265EDAC0ED4E5B40CDC8B206640A7C2AB0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG
Size 334B
SHA256 fa537db8d476bbd52bf5414f0a482e753bae3e5cb9bd597f222ff097ffc67c45
MD5 49443d7a3cd6c3314d0f72f157f66861
SHA1 83f30f1344780b64848657bf155552b831e282a4
SHA512 a71e3dd8893ff08c9061b3920f744ec50d1afde6e33c39b2aeb01f520dd4783e8409ab680f1a9105ce1380ae95c9c77c704e508e19a175855d39cefc66b5193f
TLSH
T15AE026C404CBC32FEB09E6474268430CCBA2265ED3C179CE6B00CDC9B005240A3A7AB0
MD5 SHA1 SHA512 TLSH

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 73e02ada82e0f2b4c6e6801dc8dabd6c53bbedaab57c37d1a0b9a82d2dbfdce9
MD5 44e3b6d52741f0c0acc757392c125ad4
SHA1 653d47c01ce8ab986882105401c2e1fb08e71b6b
SHA512 0c0d8738e12e1560e7ce7cba5dbf1940c1b27e79c93260c1fa83264df31f541977183147d848b498fd7afe3ec60c84c180b922b11d3ea18eb1bf83aa89783837
TLSH
T1D8E0ABD9CC21BC3324FC1B6890504A46E65103572A42C80F3A3C81088FB062B4191C4C
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 028c34bac7abf72c609db3069d5f9cd84ef9b06f094b8c03dcfada105dfd8e25
MD5 38b12e11f16a989befd337cf0dadc81a
SHA1 8d529b1b9b608cf5cd06afff6d713a4ff0475835
SHA512 346530531a01f4af732f8e801506f49514bb060eb22f16e88d64feff1b4f2d607d7c0de883e9284a27566cd2dcf4b38e4f42639c14610f98f68391589010d342
SSDEEP 192:2yNivRxedfPLJBQIeSO4hiC2q9IAmZIuh8/WG5c:2yAvRxeNZfht2qipZVyv
TLSH
T1B913B53F3A065C47F6D29DBD89D38BF613B580AAD0E142235532F255D23F7BA091E188
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 c883cc892f4010d29e94aacba711713e4c1128fb06b2a04e56a35e75c7d4fc57
MD5 2a958502de7baf1a268fa358fc450b0f
SHA1 f34bb304079a0c56172c02cc613eca25ada951d5
SHA512 6ea1bf7376a2739b60ce64c5a3dea96bd63a07590578d3cfd75f52208a66bf4061b8772cdc96a1e5c9dfdf6258123e212c8b725c99b4ae0063b3f4d9758dfbbd
SSDEEP 768:KtkQNRZAK1L/cRXL/dU2Dnt5uHno7bVOT+IxFnLah3Q4/uxKieFMcB6VF8TX:KtAK1L/cRL/dUyoh+IxFnLETdc
TLSH
T1FF4440F71951A05BDBA852F5D2033E3DD277411E7CE1E8E9E17C8C852826F31B2B9A48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_2
Size 1.0MB
SHA256 cfda51ccff26bff1e7e4054d3179bcb41e542476fbf43abb00aa846720368854
MD5 f3cbbfab0630e02ebd94b681e187b196
SHA1 34e1e109104061fceb5017c19607654d5540cf84
SHA512 9a9e148ccca97116e5a497bb533772f3daec75acd8ab695ba1a6f3c8b3f93e4ecee200567029e02731c67841b1583fa3bfdd720195024403d34cc9cfc156ae40
SSDEEP 3072:Lv9G+0W2IXZoLp4sXHva3mx5m6MDvY4xSnOjmeFdpCBbehFQ9rSQGfouoP9YHtp:LQDlM6p/Ug+tp
TLSH
T1442539EEC7682C82DE6B8770B0E0D90B7E712182B69DD0D39944C5D897D6B8175F82BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 a49b4abd9c859302f1f59ef46aa089623a756a830ff409bfe5d9243f1ab7ff70
MD5 1ebdf128ce06d015e3eecfa194106881
SHA1 866a78e2f27c9c9a170ddcfa9a6d7138096f4bfc
SHA512 2274b4164b7f2df957c9c6ba2a3bd858a61e83d6e5ec69b99984ad299738b08e08890a56742febf77ce409f83f9a1333c355903ea776d5755a8bb7c3523d2043
SSDEEP 12288:EYDYDAL/a2dAko5Smcnxo0NrtvdgqKNrbCR2BO16XMwDT3nNjZj/TwZvvxdO75Fu:VJWq+Z55GCwgxiK9Y+ZK
TLSH
T12A166CEDCA7858C3DD639A30B4F0E9477C7413C3F965C1D6889CC184026BBC5BBAA669
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 2KB
SHA256 9bfb211e009065160831997c34ad0bf4429d4344cf84181b33474bf779c5edea
MD5 517eb529dd200259e496ece4e7580d6c
SHA1 abfcbfa0050b8a0ea7227c40df3a1d9bb579cc6a
SHA512 f864e591ef444f36732b0be4658b3bbb135c950676092a5f3f391fbd7249ff54814cf898393aa8afaa772765d40f3ba97662c198ffe521947f8808a7103850cb
TLSH
T1DC516E0B75904183FF982CB541D99DE3B63C878536A33FF2219AD678E83FB3450A8062
MD5 SHA1 SHA512 TLSH

Submit Download

ace24126-0b9d-4b3c-9205-f54726964412.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\ace24126-0b9d-4b3c-9205-f54726964412.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG
Size 343B
SHA256 c9030e0e4ae9572474f64e88eeb30514e5874d04b2d93e7087ba156daf6ee9f0
MD5 2dba6821e9248041dd842d673238ffe7
SHA1 4ea826f043be02e279e137d7969cd2ebc9edfd85
SHA512 00f1a055f774d91e0431e8f63642ef3b8a271a5dc88700a56a8061d7d162b6d9af08e43e4003542a68e79e0dcb616794dcdb452fb1f89e5d0153ca0966785d07
TLSH
T1E4E0D89565C7C21E5A14348602346F4893A13596DAC17D876701CCC0B607305F35BE77
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log
Size 342B
SHA256 39dfdec86949f152a1471442545245ac5f3372b56428a6f61dffac0a3ec159e7
MD5 829a3c6987490c82e6ba954662c1d61b
SHA1 3799630075c4e24b21e810bb5896dd5ecb96c9b5
SHA512 0fe38650c2f79854b11bb4f6564fa45639e74cf8e644f7913c55cc92ee0ebe58c20307360aa83432e6521c046c39ccf2d2e1098695cae563817d0f4af593e30a
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 319B
SHA256 7317e86dbe8215437751f071173e3510a6b2c49d52318e9dd710f7405d733162
MD5 e748d83e27037f573f288ecd03f2879a
SHA1 8319e9002098f16a0e12db91be69585adda8388e
SHA512 03d7e155c11f8e593a65d8a0f690b850741cd117b9c6979d39e87b6a8fdcd0fc481a8be48e2e6dd6f6ab203d9302c73b1721c1df6e4e058e7a6207ea138002df
TLSH
T122E086580CCBD32E96186997437C534C87E2349AF7843D86274ACD80E105745F39F6B5
MD5 SHA1 SHA512 TLSH

Submit Download

ExtensionActivityEdge

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ExtensionActivityEdge
Size 32KB
SHA256 475f12864892aa7b74be2630191c6d8f0223c403e99ba88c526ed36a19ab91bd
MD5 eec0746e532e1aa3315a9bcbaaec4a2e
SHA1 b3092a8c10c8f3ae716f6e3bc8beec6eccc0e4d4
SHA512 dbb680492930aaf08078604ab14d0d1e63853a735d0a896644c8eb4d4ed380aa94f0cc9f573a04a7abc1c06fa1ad335a082b07b9242e5b463f1c06605f0a2bbf
SSDEEP 24:TLlWK3iOvwxwwweePKmJIOAdQBVA/kjo/TJZwJ9OV3WOT/uReQQ:TWm+/9ZW943WOT/
TLSH
T156E24B2A5E7C7121CD667136AC2194665CB910DA977336F23EE000796F8228BC535CEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 224KB
SHA256 d302976ba1c1c03e3ec1306e4f3f8f78bf8bf5d39f94496413fcce253a6b5e7a
MD5 9b11a03229a6db09749e63c521e87632
SHA1 b6898c1e9225bac086342f32050f9d86a2190403
SHA512 409fc7187b61d1b176de5882ae9a5261cff8de348ab0dffc1f5c841046df63c8f1aea5af33ecd5879847c03aaf81b3c3a1ef53316580f6a2d325ab97d2f7c464
SSDEEP 96:rdrDF9SmT9VtejzH+bF+UIYysX0fxQp97oEHt/DfLjLqL/9bbEOVpZf24JkMfXSq:rvMewH+bF+UI3iWGVoWN3qL/9VVV63
TLSH
T1BB24234E5F243722CDBD813668E744A35D7DF03FCB1366CA686114B0CEE2652A02C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 331B
SHA256 07c655db574ba1a4464d40f0dd5015477997284b3373d8c0dc8f1845a51cc062
MD5 56df98c05b7cdbb9cae8528439ebd337
SHA1 45c7d88b479d8a3e6fefc824fbd3200a28202046
SHA512 e63ac75ed9b684a5c0aac299b7dc06e7bdec6806a4c0b57f6d747fd160a2d57fa8f1bcceac6659ddebd7fa954c6913e55d1becbb1acecf76053ef42a52789f76
TLSH
T165E0DF6049CFC22E6708314B033DA70CD7B2245BE6C42ACA2B06D980F04A748A3D7AF2
MD5 SHA1 SHA512 TLSH

Submit Download

6a983248-c272-4ede-9de4-837975a5c89a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\6a983248-c272-4ede-9de4-837975a5c89a.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Size 24KB
SHA256 215bc4e482b6d39e98e5dfac8cb44f6f2383e6dbb38a6163285fc69a36f4095c
MD5 e7ea2e006cec63e631967c2e5faf2307
SHA1 50f83e5527f37477c98eb66867f018e7910db453
SHA512 89b64dbd46a193a4ec7e815a8ffffd95fe845e37ba29df4d47f657e429b3d6d0d254b6c59cfb04919949b04896d8196afa0a214e468874273640e8f4e2d55fa7
SSDEEP 48:Txk/LopFMaty423w/a9NUuT1PwIoHqw9E6VonwvBCIm:qDeMatha9TFwutx5
TLSH
T1B5B2714D2F346612C2F4867AECE184923FBC000DC3637A869A1460F3DDA369FB5060AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Reporting and NEL

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL
Size 36KB
SHA256 6b619609ce83de4d2fcf9c9135a8716a75b22feef76ab440e65eb89706dd09dd
MD5 68e8bb310dba8ddda6786dc96b16c5b9
SHA1 da10505dbe6727152fc901657f7f4e415001f922
SHA512 aad7144db62889d9c9d471bc9ed9ffff403fa5f425794f135fcab2703f4030c6e7e93c6c4f5539cc637b36aea8eacce7cda2ce0235c8e8032a7a847bcd0b0cff
SSDEEP 96:i/IEumQv8m1ccnvS6UHD33DYQtfzYZznFBa8VK4g:i/IEumQv8m1ccnvS6UYvZPJw
TLSH
T17DF2DDFB07276206C98445B095009A8EAF16004B47B6B6ED76C447E3F7931E3B1B9B5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 188B
SHA256 5cca27ef84d97456640c850d388eb6b0cf8600537df460ff571b045b9a12dc2a
MD5 809c9c10e168ea89882af36426f85a62
SHA1 ba1034d798abe7cdd12acc508dd621d376c043d0
SHA512 d365c36373a3ab8c6863ff93a823fda715c4dbbfdd4f7ff37d953487b98e963172e967b38fd5ddeeab3acc90d8a3ad0a63b920df5c1fbd2223984d1763cd9bd6
TLSH
T10DC0222384FAF073003989391D99B8C66A38D03B005050E8D996C3BC70800BB5F1502D
MD5 SHA1 SHA512 TLSH

Submit Download

d90f6bff-b426-4774-920e-f5d23e711fbb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\d90f6bff-b426-4774-920e-f5d23e711fbb.tmp
Size 2KB
SHA256 690f10cb7da7f49d067e07f66ed8ede94fe8e9115cc681e4c5a325567d209281
MD5 64d55ecf8d1a14695d077886c873078d
SHA1 d416e3d6330b42e76a309cacadc2a03c1255ff6f
SHA512 3c7be890e2d9c5bda90eb2935f5cc7405f94cf9149d09fce63612186136822d310ddb04f8f28c5458b54f723df8396bf3dd042dc32144942662c55b04f3a9543
TLSH
T1E141BCF387F4866EC9055AF0AA14AE1FCE2D0515431C7C6A89E4EF2BD3E3462E041A5F
MD5 SHA1 SHA512 TLSH

Submit Download

f66b1e75-9978-4c54-9359-2c23e76746c5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\f66b1e75-9978-4c54-9359-2c23e76746c5.tmp
Size 2KB
SHA256 650cab9bbdbed9b0aea668415f000b3795aea05e743a284abdf5910f8e1d5540
MD5 11ffe93c08bdf8fb121089c437799c5e
SHA1 f9ab23444ca05479905ee12798ef72825ef31198
SHA512 a9ae48c95c5071e4edd5389f7f0ea97ccdc945632a5647ade1107701f7d417b153c1138881f2b3875d73efed75d02bedfa4dbf2bb873b4c09de0d55762796e0b
TLSH
T1E65189F3C6E8866EC9055AF4AB146E2BCE2D0954432C3D5AC8E4EF5B93E3472E14194F
MD5 SHA1 SHA512 TLSH

Submit Download

fc56ac92-a26f-47dd-b6a0-9933b15eaf6b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\fc56ac92-a26f-47dd-b6a0-9933b15eaf6b.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 338B
SHA256 2f575b58cc64d276e01f586895a050879ed075b7d6cf1baff8edc996ffd1aee5
MD5 0b13c13f0b922056bc62cbd97b1d431c
SHA1 508e4ab67f2717e790ebc3af86e5b02804df9870
SHA512 772514202b33cfcf1a70a99f6461e691c342fda8fec1ab3f2be97ff79953307389c69e94379000aba4b9f2d39e39c27a4f3f27ba5d3111d6b7848a41d12e8799
TLSH
T1B5E0486015C6C33E755B658B01648B0C97B6B45FD6C43AC52F45CDC0D186758736B572
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 350B
SHA256 4da7c95dfdad2c071143ecad72f30f16f03b719f2209577ba3fa62d66cb4374e
MD5 57a633447e42ebc400cac60c7450ef14
SHA1 39837f16d9072b8c5047d6a8a705847c826f50ca
SHA512 6960462662587dff86ba868caa4c175ee2c004520b3eaf87542cdb3a235cdc4d24cddf515991533e43d9f27bb666f9595923eb50c24aad70a6d78fbbcce15339
TLSH
T161E0D83025CBC32F625D248B0335E30C83B37856D6C42D953B09E9C0E24A7407347571
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync App Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\000003.log
Size 175B
SHA256 80d1388b9a7150eb0291175fe693dd7b6bce910c3e4fff51e94841d31d771dbe
MD5 cb63c64828a27af7253afb7c7d986654
SHA1 8a54aeb86f79cc69e6f11278d874cebd328ae466
SHA512 e0dbdd6931c9272e0b52bb2ef7895121f6324379f584899343342a057737a9837cc476842ea781a1de5c17a20c06e0a7d24c0ed6ea41fdd95bb99296e8810f9a
TLSH
T135C09BD55F903023FDCA5D3D0DAB53041720C4752F74CF57D28430901C0A285FF61145
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 326B
SHA256 fac164e1164503acaa1ca3d9ad4951ca6ebd522269f68b4d0fd43e320da658b2
MD5 54903746945d8a94d1086b183efa59ae
SHA1 03b63c3e9cb880a24749cc7554b1dad6051a4e67
SHA512 07424e5085915f85a6f28ccf76de87e712f3fcd7c1004f3e0ea940d00462686afbc2826c6f6b3ed08189f4b03dfd804c91ca37652a6a4110e9d1f200715730f8
TLSH
T1D2E048B045C6C33E6585A4DB02759B0897B2AC6FD78479C967089CC0E145354736B5B6
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 5b01669301b5392a9c83d33e24f40f4306fa66bc2be3afba0001c24af101de9e
MD5 0db45f685ab7a203602e36e3b37ad9c4
SHA1 386c3db0633be73616e81b2a6d5f0137a87cd0b0
SHA512 c47e72661f3e734e5d50c93d51f91907c2d309481b10cf73cf7d40f21c9d5b9b16b1b7948c01fe17c919ecbb31cd16a5a6d128cc2f2e5484d79130a8d886f254
SSDEEP 96:KUowK1+K6MgKF2+uFaKGWS7GKYcqW/6KkI4:qjLfd4tVB
TLSH
T1E6E16450303B46413ABE2B0854D4DA6B435271B37029E9AF7BDA50958A2FF045EFE8DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 21d8360b95dfb8e9e0488a31a9df83456bd1903cea27ee38e461e9286be9c764
MD5 fad20030ae362377d19d0717637dce73
SHA1 ff1f28fa7c7b5841760e429ad45c98efcdf18273
SHA512 afbc4850dabebd2a5bc6b3b438e5be18346132e798bc9432a7b0015984b6644588d3e08662fff533b201e7b4336b555430c645870f1c09f35eaf2d96bdfce214
SSDEEP 48:KUoIvK1+cTyZMIXKF2cHy60/gEGKWgqSxzIlMgKE1MHvQT/z8hW:KUowK1+K6MgKF2+uFaKGWm
TLSH
T1BB91F920303B5A4139BE3518A4E497AA534171A33429EA6F7FDE10568F1FE084DFD8DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 256KB
SHA256 beec659d0e3c9ceecf5b84ce5f5112360ebd5034ae7c8a449f7c4cd7f034997d
MD5 36c221510a41d4e93447b02f9cd0a7ba
SHA1 f29000f7310e61bdebdfd0100841333c8bae095b
SHA512 d1ec5587b5aaf1d783ce29640b06ef845bce3c5785fc95908f49adebc19e7a3ba2551eff2a3a49e12e3d75e2f2ff9ad471151565024f8e284b98a98fc4fd2762
SSDEEP 384:DNrRZyCSDnxTICX2MEhIKyll7svbFKfk7:xFZJSDniiyI1l7svbF9
TLSH
T17444840A7B747001EDE6D9725CB080771E3CB16D8F22E6916DA254698DB3853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

abff376e-0597-4034-993d-fe9251a23238.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\abff376e-0597-4034-993d-fe9251a23238.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cb954435-9a11-4db2-b048-827b6e349db0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\cb954435-9a11-4db2-b048-827b6e349db0.tmp
Size 12KB
SHA256 a0d6c4d03ff9d40c96d07bf601678e1ecce1d150e5a464a2732f9d17767774e1
MD5 978deb7cc43c030e68be66029e908341
SHA1 126ef459f1644e5237626ed2659f90fd235c60a7
SHA512 4674dbc0a2c9cab6e787fff494b6c3eb16935d97c22cd68032cc75325e208c46a052f38d01516572993c44e89fb2f5f397b757ae5b603885c79c5d17108bb460
SSDEEP 192:sxRwRPZs1/fjsxTWpVGyGCJ5VzoA8pi/g6+WNIYihJT1MGwIgtJ:sxRw3s1/fjsRWvGy7P4i/5IU3
TLSH
T1AF42B715AD28B93B8CC7D21DFB657F53D6F9103260955E48A6FC8A2C04EB6DD120790F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cd434a87-9b4f-49a3-90b2-65a161623e11.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\cd434a87-9b4f-49a3-90b2-65a161623e11.tmp
Size 23KB
SHA256 9d4dafa8410b918ddc8259ae6fa5874b7bbf7483ceb4215f2bbff89e6045deef
MD5 f7d0b7380b95c7f9431e22ca8073c343
SHA1 1d630cb1b66963be89043fac51644c9f5d73dcee
SHA512 61c23dec7623947eed79a7c1810b2e276bc8442d47e3d5eda99cf6e981cdc7aa0dae1bd886b8446e0243d7343907b7b1d01efa29beaa2ff4c683fee56527e93f
SSDEEP 384:XLMDmVifCtgvdFfnvKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVC69lLRRTrohZL:XIDmVoWgvHfnv8F1+UoAYDCx9Tuqh0Vx
TLSH
T1A8B2DA2B640DCB7F4F800A9DAC296FD77D9801CB9A588D4047FE994C02D77EA921A4DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

deb74a45-c62f-4a9e-b1ed-8df5c9a4e9fe.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\deb74a45-c62f-4a9e-b1ed-8df5c9a4e9fe.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

favorites_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\favorites_diagnostic.log
Size 488B
SHA256 303387d9983e0b66d5fad3271312e57d0b100ec6b9b15d816e9a13d8847cefa3
MD5 35445d63a64d8ed0f665c04fffdbc0fb
SHA1 9196f91b26c1a6a72b48e881c59436d6fa60f39c
SHA512 cf3e5d9ad339204b1085eea0988cf96490ed6c505d35e316e168502eb2076dd2f96a97be9150a062f894e3b3e2f20d87b406122b11a76bda0d2e3fafd8319ec4
TLSH
T1D0F054D16227E8C66BCCAB408148690361952E7B150E98F9375E96984B4CC1C5B2FE76
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 16KB
SHA256 0fbc898b25f86467b9c90a2c4c1ac2aca82c406dcffad36eee24b473b4db3a6e
MD5 b14b56fd534ac1607f6a397b084979ac
SHA1 8eb3e38299e5e46ce0b34f1a1ff82874eb62ddbd
SHA512 92fc845f962b5c1c34ef05a17a4ae48f397e84b91ba0404261ca3eda10a460ed3cd29d631bc8050657ee32852d5bfe5529df667e6cd7cf05304685a5d1e7d4cd
SSDEEP 384:FQrIII6b6MIMiBepdsVF2sLUTstTDJTzmJTzZT:FQruVVATqTFTzUTzd
TLSH
T1BC72B46A66062B77C69F4E7B037687425BE49C814027631D7192385F9CF2EA7C2C46F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 319B
SHA256 870359de981393f447105a605bdaccdc973ac76f068fc3e9109a9dc29a9403c8
MD5 9266579a83888d937c068c764e03392b
SHA1 f00735ec1f8ae845c68ae8a345b38aff14bb5167
SHA512 8f15103da183f6225932c8b2758705b021006437614021f8e79c352def6b2d8b9307cca061faf2fd98d9224a3f38d6e63dfba94593dd90ec693b6b835c8bee3c
TLSH
T139E08651BDCBC62FA928208711755348D7A22D9BEA842DDA3F07CAC8E105344B39F5B2
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 e67accc56b4dceeff49545f4573b549ae1410ebc9b8fd26eee1fdd13b0968d82
MD5 2bdfa54b7b3a0a671909a1bead3c8e0d
SHA1 c367e61c296ce89ab829a6e9cad0249e22ef0be1
SHA512 c06975306b7f5a833f53202b31c2fa600be7f641f548f5c82ef4b5199e00dc5289df205d7ec31c04bc54d1351f434baff367bbc4bee03a7be6d200d2dfd06a69
TLSH
T1EC21D655F330C108E14A867D507B5B250739E8169FBCEC0F857A20747E76F080E4B6E5
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 337B
SHA256 56c7691d9db62deb536fbf8e6c55ed9330f5423aac14c04af92fc103fc12a2ef
MD5 cffd217fc0adfec4ad50b4b9a34b9805
SHA1 5917fe20dbc237cbd5b0801cdb117c04d72aaf65
SHA512 b075cf2db27dc5017695b793477cdbbbd447de34b14f5bc28df0ae02c473eb7cebb1332e7650f877a222afc757ac7be876ba878f02f404139fd20d492cf19c87
TLSH
T121E0D81078C6C21F5124208311B59348C3A23C97EA802E853F02CF88E505345734F572
MD5 SHA1 SHA512 TLSH

Submit Download

41cf4725-833c-485e-9c1f-3cf8e07d5cb5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\41cf4725-833c-485e-9c1f-3cf8e07d5cb5.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_1
Size 264KB
SHA256 1b73b310c31b13697912e7fd8ba966b9456c4bc2aa946b35290cdc4e0007541c
MD5 657aeb611b8703ed21fc718c74403bab
SHA1 0c2879fa6ecd53e6f712c1b4ff6987411764541f
SHA512 44c443f0d5c6f1955b898e240da9fd0d54ee43731900f85cc16722c4279a06431b9acc718a293fd5b51055c90987f4eb82f50c7092541ea4ee133483ecf92bcd
SSDEEP 3:MsEllllkEthXllkl2zEfl2:/M/xT02z
TLSH
T1FA4404047FD40405C70110314051C35013F0F45415515FC374D144735CCFFC00C00004
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1
Size 264KB
SHA256 e27c795db58bb5c60157e444ba9709bfdd8c286c9e4f718043567fe95ab6a97a
MD5 32a93b01db8abf9423f2627906fa9c6d
SHA1 bdb82968d4bd8cb9596bb834b5122575443d12fd
SHA512 8d927dfe656a54588f82164a3805c67c32a38d91ee27f391e7ef1339a411ed5d92137c47faa25c99d15b7dad3ada1b15ef952f241bddb9f0debeadae75e4ce3b
SSDEEP 3:MsEllllkEthXllkl2zEfl/Sx7/:/M/xT02z3x7
TLSH
T1804404047FD00455C50010304051C3501370DC1055115FC374F144335CD7F401C0000C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Browser

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Browser
Size 120B
SHA256 9c70f766d3b84fc2bb298efa37cc9191f28bec336329cc11468cfadbc3b137f4
MD5 a397e5983d4a1619e36143b4d804b870
SHA1 aa135a8cc2469cfd1ef2d7955f027d95be5dfbd4
SHA512 4159ea654152d2810c95648694dd71957c84ea825fcca87b36f7e3282a72b30ef741805c610c5fa847ca186e34bde9c289aaa7b6931c5b257f1d11255cd2a816
TLSH
T1E0B012203BF9062CF3F74D00AA73AA3428BFF4080A14811D505102080C33E19C478FA3
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 37f851b7be2c6859324f191293f20ebe60c96f1245309cf157bfa44bba5733b2
MD5 d1640c70d98c20c6286a3c563451bd76
SHA1 367126587f0aa3ef857446f37264ecb3426ba7a2
SHA512 1bebe3f4af1e0de1dbf3ce1c0cca10b87e9ea885375cf3207dd44d6f53e1ee92f7624f2c1a1b2c702515cca37ada3c46cd0b925974e0517c348c4c575926aef3
SSDEEP 3:MsEllllkEthXllkl2zEflChl:/M/xT02z
TLSH
T1004402046F940805C6402034545283501370D51465129B87649144326CC6A401C01844
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

06c82b9f-8f1a-4e4b-ac52-0ec9aa111905.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\06c82b9f-8f1a-4e4b-ac52-0ec9aa111905.tmp
Size 1KB
SHA256 1510c23644ba71aef6fac2773e2360c324bab93f34a9e4bb1024386375c911b1
MD5 221bfbf3efd0f3ea1c1d7cb24f5157d7
SHA1 d47cd5795ff06911ef1137aae2fa0553e99cdfe6
SHA512 7c916166b6e9a9efce385eca09f96f379de1a7d9b48255dc35f8deb69f55fa3e3895bc40cd20ce3f439351b2c705326669b2e4677b744688eb16eb0eaec65b3a
TLSH
T1B121FEA05C3A0AD6C17E0EAFE4872EEC50D89216F0D434792898FC98553E52E205187F
MD5 SHA1 SHA512 TLSH

Submit Download

18d18ee2-ba5c-4527-b544-b94d5d64e462.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\18d18ee2-ba5c-4527-b544-b94d5d64e462.tmp
Size 1KB
SHA256 ffca90ac3d83157d1e54b94db7a9ebb39fd45f63bee4c825b6b4f29144bdb88e
MD5 9ccba6657c769acfc140a46cbd1afca5
SHA1 5504abb583c9fc5f9428f0b5ae9ad1a0a26c7d1a
SHA512 aa3916eaa7cb35cc0a67829e88bc2b34b005c581b0c477ac7b1e5c54549ecbe66c95c249f92cf10edf4b5f010f56b664eebd1c4275d98ea0d96003a069793409
TLSH
T1184124E05C381AD2D0BD0DBEB05B39FC84DC8221F4A434792898ED985A3B61D750483F
MD5 SHA1 SHA512 TLSH

Submit Download

2110b7e0-cb39-4582-90d2-3e55e063bf99.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\2110b7e0-cb39-4582-90d2-3e55e063bf99.tmp
Size 1KB
SHA256 67353875e88fe69a56887f38465348f4ffb849037520bc4470807cb408f04bfe
MD5 77d44b73bab0d4e0f139a3a8126fbcce
SHA1 bd5d737f8dd622eb3ece8ce71aff3431b29a9a46
SHA512 9c2c245e6ed16542c6ece29f296d6cf9deb1399ce3b8b9e83e5d3173c9eca5cc185cbf5ca5344a2108bb8570eddb80bcbfe2b373de29b3de02c85768c1dd01f2
TLSH
T10E21F0A05C391AC6D17E0DAFF09B2AEC50D89212F4D4347928A8FC98953E62E315087F
MD5 SHA1 SHA512 TLSH

Submit Download

2150b327-61eb-4fb1-b413-a2ea030f446a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\2150b327-61eb-4fb1-b413-a2ea030f446a.tmp
Size 1KB
SHA256 70d0a71aab99d3f5f398573920b8412d130e56b0232d880414661dd12939f93b
MD5 d94dd5812583a94b1ef6ef413ba003d2
SHA1 c2dd170147af27f1deee54f5252036550087afce
SHA512 9e32891f0e37e03833fe46eb21890d34e0346e6600ec61ac6ba5737f7bfc45ac63f7534f3601d6ebb28d0e079b9b5a66cdfb6d8ab431ff65c154dfaf3ecbe920
TLSH
T1A63102E05C3D1AD1D17D0EBEA05B2AEC40DCC222F4A4347A2899ED99563B61E715087F
MD5 SHA1 SHA512 TLSH

Submit Download

22f01017-43ba-4ce4-a30c-3dacc23996ec.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\22f01017-43ba-4ce4-a30c-3dacc23996ec.tmp
Size 492B
SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
MD5 c1bec3bc77db46888e279f8b3eeb18fc
SHA1 c2d14f387c796193ddc6378267768745c10dae14
SHA512 8d41fbab8134eec1a95a53d4d56d1d2edb1edced5b2f4987278e5b8f6ac9b169c9928a0c52ebe7a66393caddfa5a29e001890386b54105a8e69958661b40ec35
TLSH
T134F09E808C3E1AC5D6B90F6FE40716FC40D8591670D9287844CEE4A8A47B05B311586D
MD5 SHA1 SHA512 TLSH

Submit Download

322936ac-e66e-4939-acb1-990f55c920f0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\322936ac-e66e-4939-acb1-990f55c920f0.tmp
Size 612B
SHA256 aefe41ba49514b111597c7f1d7c4be25749a5c72259d4deeeba6393a98942c23
MD5 4979eccaf0b564a0be3a74243ff501d5
SHA1 f2eb355e1da53299417438cdbd859a325e9513c8
SHA512 84a1e794b4ba4e190cfc8fff8859eefe20120a2e923c9efcb28351a42dbe0210ffd8d1317c8de1f31ad0cce028e1348ce14ea878921aea32f7d4de5e7834b7b6
TLSH
T1E7F00C808C391DC5C6B90F9FA4032AFC40C84A26B0C8387814CEE89CA43A05F3111CBD
MD5 SHA1 SHA512 TLSH

Submit Download

3d0d9d38-c921-4759-a742-eeb2ecb8a1c4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\3d0d9d38-c921-4759-a742-eeb2ecb8a1c4.tmp
Size 1KB
SHA256 a29b3c908c3fb876d3f23731003991c6d9a0a90ab7102637c3d077baaf72082f
MD5 e7a757b3cabfe52fbab7f16f92f9a172
SHA1 eee923d2f278551ad08a4313cc1afcad1ccaade8
SHA512 4dc97c05634f35fd0414325cd06315aaa54d70686f2376e30405e74cd27d4f1553bc361c2a5f8ffd21f93cc194f58b5108024c3ac4106ed41fd4ca6ba60b3d61
TLSH
T1FE1112D15C390AC6C17E0E6EE4873EED40D89212F0D8347918D8FC98513A51E305187F
MD5 SHA1 SHA512 TLSH

Submit Download

49e39999-aff7-4121-91c7-b99d93c1ffe2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\49e39999-aff7-4121-91c7-b99d93c1ffe2.tmp
Size 2KB
SHA256 b95f9ce43ee836e28848fdfbc65bbe6774540e2f7e8b4d21aca2600824f468da
MD5 85122ff6b2b1aba8656de11e6b926a08
SHA1 a9e42cb487700659dc8dce495cd44cc29e962ad6
SHA512 8bae5467d297bf69d3492558f730da5be4be9fd65d8e0b6ab51130f8e5d0e06c28d995412dfd901db2dbe0520cdc7948b63160361bba8cb6798d78f8415d9815
TLSH
T1914123E05C381AD1D0BD0DBEB09B39FC84DC8222B4E4347D2898ED98467E61D754483F
MD5 SHA1 SHA512 TLSH

Submit Download

6be991b7-10ae-4bd3-beb0-032fa926a3dc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\6be991b7-10ae-4bd3-beb0-032fa926a3dc.tmp
Size 1KB
SHA256 0276aa00e88c0c5ad8c54e4409c7cd1099fad50f7da5d420999d7b95b25e54cd
MD5 1ac5a03a4e89bfbe93e3bc893650d8c2
SHA1 ca119fc764218d276f571eb60802bc2673af7c7b
SHA512 db83b75fe386280c55322ff38d0537dc963164f7f0f574f419b496de098fe57808d04e4dc6bcabf59ac3ccfb0f1017a238b9ce159f5b581f89cb20234c11fe5f
TLSH
T18E3123E05C3C1AD2D07E0DBEB0572AFC80DCC222F5A434792899ECA8593B61E755087F
MD5 SHA1 SHA512 TLSH

Submit Download

85247855-1f90-4872-8402-3a6b1b837ce6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\85247855-1f90-4872-8402-3a6b1b837ce6.tmp
Size 852B
SHA256 8bc825a30631771ae614094fd07267a0f3350af6ac0fee62fe078d20f34e8420
MD5 5dc1393ff7ce1bc4029176ab75d81692
SHA1 74afc05ab3b0318ec85767b6e96042f2fecb0582
SHA512 c047607ebd16df9d0f2d5635943cbf0280763b2e6ee891670a636e2713dca6a933f965d3d89fb4be3ddb26abd506fbb255450e622275a71716abfe429342b1db
TLSH
T17E011ED04C391EC6C6BD0EAFA0472BEC40C89522F0D8387928DCF8A8957A41E345183E
MD5 SHA1 SHA512 TLSH

Submit Download

89517039-4d8d-4124-b9ae-d4bd65f81291.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\89517039-4d8d-4124-b9ae-d4bd65f81291.tmp
Size 2KB
SHA256 9fed54fc3948a356e320cd8a0e67f52a7d22071925ce54f3bbad5017b368b86a
MD5 8219de32816fe98506b0ad425f37b6fa
SHA1 56bb45dfddc937a35d15785321df3cfcc1fc66a8
SHA512 a753499490d45bc86b543822d59e567e685b9ceca8eeaf60a1fc512a8a064fcbd3f73f320498108c8318f41b88691adaa6516464d704eac32b48ec18e659343c
TLSH
T1194124E09D381AD1D0BD0DBFB49B39FC80DC9222F4A4347D2898EDA84A7A61D754483F
MD5 SHA1 SHA512 TLSH

Submit Download

8abba2f9-93e5-414f-929e-8cb808f1441a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\8abba2f9-93e5-414f-929e-8cb808f1441a.tmp
Size 972B
SHA256 a5c9b43b44afa81381ce617a0d2752a5597a3e079393b550369188093e5db410
MD5 b4b926e5aba0fe5c9647091e37ae1229
SHA1 253d300d1b2c691de5e0a5048f25c1c9ad9af6ed
SHA512 4d743381df677cf8dc49a9724575580030bbf4e0ba61bdc50e7fce7a75b6222173cb05fb784aeb1143b80c56fa20c19f753faf8db92a312e4f88e4ca662f3f85
TLSH
T16F1110D05C3A1AC7D67E0EAEA08B2AEC40C89623F0D8347918ECFC98403A52E345583E
MD5 SHA1 SHA512 TLSH

Submit Download

9e104abb-256e-4c22-bce9-a92a27474116.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\9e104abb-256e-4c22-bce9-a92a27474116.tmp
Size 2KB
SHA256 e716a3c56177f5ec325b6bed9ac6854bc8802b0ce5ef0a2dea3b2873073517ee
MD5 804a0e8c4dba85254f230ab599b5fad2
SHA1 79b554a3304d6bb849255c7b0051bffca60fef9c
SHA512 8e14571cee316544cba29a403af5e2f38f9b9361897388a40c0537bdc9f6638d635033810e81e1ec3b2ec8291ce427e0c894ee492a68d98b9765b96a4aa65879
TLSH
T1A74131D04C385AD2D0BD0E7EB59B29FC80DC8621F4A0347E28A8ED984A7A61D744483F
MD5 SHA1 SHA512 TLSH

Submit Download

c03f7650-8d7f-4824-9134-dede1512760d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\c03f7650-8d7f-4824-9134-dede1512760d.tmp
Size 2KB
SHA256 6d0324bd835c5d23ae91d117df84df5889085e470c06c9942d5fae39ba31ac40
MD5 910522ead3034bb9fd15c8ec140f5719
SHA1 659d380e6f86dc243553d165e22a89fda97612c0
SHA512 7f05594d7d61f0ad390c91500148e855d357060f815fe2629d3f10d81412a37d94c0ad94fc80324acddd02c0e690bba24aa06bfa58f818acbbf0aea8d7dd12db
TLSH
T12B4123D09C395AD1D0BD0E6EB59B39FC80DC9222F4A4347D289CED984A7A61D754483F
MD5 SHA1 SHA512 TLSH

Submit Download

ca7eda5e-fec1-40ba-9b85-3226af27ae3c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\ca7eda5e-fec1-40ba-9b85-3226af27ae3c.tmp
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

e1263df8-647d-4215-afb9-de9aebce9267.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\e1263df8-647d-4215-afb9-de9aebce9267.tmp
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

e4b779ad-a90c-4c54-b3b5-9864af31b8aa.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\e4b779ad-a90c-4c54-b3b5-9864af31b8aa.tmp
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

ee0f839d-1857-4909-ae4f-b0b03b944a0f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\ee0f839d-1857-4909-ae4f-b0b03b944a0f.tmp
Size 1KB
SHA256 97f6e93df5d8fcefe496ab73299ce2cd5427f9ba8cf9c504e6492beb9e878ed8
MD5 6004a7c4484b94de96161b97170dfa5f
SHA1 5f097af927d304da74944931e3b7ac7362ccc3f3
SHA512 63e515b32b8c2648f25b8cb6f5eeb094b99b9e3980f14f98164e9d738889f07ca18b1ba68cff87b86b2f7a5d922879f3d7a9b1f26a95be5c60f6fb9a0b174e9f
TLSH
T15E3102A05C3D1AC2D17E0DAFA09B2AEC50DC9212F4D4347928DCFCA8553E61D755087F
MD5 SHA1 SHA512 TLSH

Submit Download

f20a1c1e-1ac2-4cce-97b2-465388805218.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\f20a1c1e-1ac2-4cce-97b2-465388805218.tmp
Size 732B
SHA256 556feddcbd9b9cd3e28eadee8e310af21c5251e941f1ce8a66aeb0ce40bbe84d
MD5 3f903c66e8e6af5685738ec2bd996c6a
SHA1 ff1cc1c9d1ea1d1c6bc1afa3cc7e93a3d3c84776
SHA512 bad6cc215b7f65249116b67aa9c8b794a725c09e981cd348feac503825fcb42024848e61ea17c152337a3f12a2872061c94c448fe65855e79090db07f53f8986
TLSH
T1B5011BD08C3A29C7C6BE0EAEA4072AEC90C84627B0C83878149DED98907A01E315187E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 37790bf1a0fb12ce34cc8754cbec55243757d80362f198a4df59a7625c6ba9d0
MD5 78b52b864512a9d98f05f3ae46b15352
SHA1 c1b0b11be353411b002939df015ffee7e5670a35
SHA512 ce461e583a4e098c82e850c7cae1db8cd0db2b6e069da59d292c4ccd64e27f9a0d57897073adc5d24ec31da539c2c83445b4e63db05c295a09f11d166671e725
TLSH
T1E2311FE05C3D1AD2D17D0EAEA09B2AEC40DC8222F0A434792898E8E8553A61D705087F
MD5 SHA1 SHA512 TLSH

Submit Download

76775cc8-7279-4b4b-baef-55331be52b47.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\76775cc8-7279-4b4b-baef-55331be52b47.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

f360dc75-7dee-4ddc-ac83-9fe9094eca71.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\f360dc75-7dee-4ddc-ac83-9fe9094eca71.tmp
Size 34KB
SHA256 4dd15b25585ca1ac488630d7f8ca1b19717403a0e504531811080339b40d7c67
MD5 4701b5030ac6469c642463cd4c98de97
SHA1 5cd5351f76dc712647403129f0519f23f0bc9a77
SHA512 09403c37a6449fe5ce1d89c55306b733b1a33c30e041370c0fdb95482f91b178b293d6ce59eb53e85114e41e23fc4474864f0079fc74210754d23da6966ac693
SSDEEP 768:/U3ZD91BNcZ0rfZWaYo5S0YoYwBw4Ot5AEl94BHYjHvxTILn:/U3Z9XawBVa5AEncHYjPij
TLSH
T174F2BE38ECA49D638CF393C9B61B36466EF08553E9C01ED4E9CC6A1D068729F234B807
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

first_party_sets.db

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\first_party_sets.db
Size 48KB
SHA256 f35a4f569a8d6e9a53c7abbb2fdca981cdaaf4108e2934925648d90000b72a42
MD5 29f0806ef1eab44a9cac51d6178104b2
SHA1 da9a041647bf896631ff9a3a1470aec96da1eeb0
SHA512 02d7f20c525765b0a77f7738b19fedba3472edd6c259dff60db5beb1f82ebbef1c72f48fa68ede5aaf452b953f8d1b959494e48c37cde60ada7cef9e322eec56
SSDEEP 24:TLL4/arHRH34kQrq+i7ZYZY5J+Qnj3k0rJXAeL3mkAD6W6Ivrr6Uw/sufL:To/IHRH34kWqB1kQnjhHmr6ITmUuL
TLSH
T14C23896EDA2CB9A1FEE40B3DD7D1D4127B36AA0EC2E4D9F1099B406746C540405EB63F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

first_party_sets.db-journal

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\first_party_sets.db-journal
Size 12KB
SHA256 d492821811bb72f9f29b83fda59d01bfb17e6f168a58d23540611ddea5c51865
MD5 45d500214af5be2cb32a6429a05b05fa
SHA1 bc850a542cf3aebd047290db0b5bb78f0eba11af
SHA512 8ef8e2bd0887041a0c5da7e1cd481c3567ba1d57cad9579f682ddcda6553c923a3f9ea74ead8e52585985b8a743eece1efecfa3682da64ca72567b7c8a2fb95b
SSDEEP 48:6e7bnqo/IHRH34kWqB1kQnjhHmr6ITmU/:/nIHRHIbKkQndHmLJ
TLSH
T13942876EDA2CAAA2FEE00B3ED7D5E4127B36A60EC2E4D9F2095B505747C440405DB63F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1151292f-55ff-4477-9577-49d0d00a6aa0.tmp

Path C:\Users\Admin\AppData\Local\Temp\1151292f-55ff-4477-9577-49d0d00a6aa0.tmp
Size 158KB
SHA256 3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
MD5 9c18c4721b560ec55f0d5de055144d5c
SHA1 6af37a3bda916cac276ad5879c9f61262d9ae523
SHA512 51466928eb8d3cf7b917919c98bd8168453583d2c3dc5836036d87ffd0d2c732ab8450212a880fc6de199ea569a96993ba0d250a5012160d2d72211880695f92
SSDEEP 3072:5ZwEurOxn8zXnHc2qHNYEU/rUHCVJWGdi0Ha5HnXk9TFzBsuht7yGik:5ZwPOx8D85UIHEI0HaZ09JzKStjik
TLSH
T1CFF3E13E7EDE891AD80B10BB7F16B18BD80D8E0B460AB44B769D80155B3668D1BD1CFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gb2312.enc

Path C:\Users\Admin\AppData\Local\Temp\_MEI000013f82\_tcl_data\encoding\gb2312.enc
Size 84KB
SHA256 1700af47dc012a48cec89cf1dfae6d1d0d2f40ed731eff6ca55296a055a11c00
MD5 c5aa0d11439e0f7682dae39445f5dab4
SHA1 73a6d55b894e89a7d4cb1cd3ccff82665c303d5c
SHA512 eee6058bd214c59bcc11e6de7265da2721c119cc9261cfd755a98e270ff74d2d73e3e711aa01a0e3414c46d82e291ef0df2ad6c65ca477c888426d5a1d2a3bc5
SSDEEP 768:UHivP+bFFScXEBFhHeUrUFESCeYjN7GC0nYX:I7FFX2nHeUr8ESCDlX
TLSH
T1F383286043498EC0D70811DBE0EB7B923AFEBC7297C4D4A052F6CB859A3745D684F6D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_dmpruodi.bsp.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_dmpruodi.bsp.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

cv_debug.log

Path C:\Users\Admin\AppData\Local\Temp\cv_debug.log
Size 1KB
SHA256 d548e38140f51d8a7920994233e1eb79d23511904ca599193a13854a7f1ec558
MD5 281ed70615773c3886ea4b00eca31386
SHA1 5f5b75568402740701874f56ef7b3f79226e2c2d
SHA512 d8fe3b86d672944120a402de6823b46202d8b48ef7181b5ce15b0ae196f55b0de53c21846843592d5a59f993b4c5c118a5dfb5ee0d20beaedc11adfb68676d68
TLSH
T13521B6953122773F17821BD990624C982AA0B584033F6A8CDA1A5474ED9CEE3676E3CD
MD5 SHA1 SHA512 TLSH

Submit Download

ff72e63d-195f-42ce-9b72-b8274bed3c2d.tmp

Path C:\Users\Admin\AppData\Local\Temp\ff72e63d-195f-42ce-9b72-b8274bed3c2d.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3748_191657570\CRX_INSTALL\_locales\en_CA\messages.json
Size 711B
SHA256 2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b
MD5 558659936250e03cc14b60ebf648aa09
SHA1 32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825
SHA512 1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727
TLSH
T1460197136240AF18470BF05BB9023442A0B44AC62384E0B775EC982C6656DAFB20B3B0
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3748_191657570\CRX_INSTALL\_locales\en_CA\messages.json
Size 851B
SHA256 6895648577286002f1dc9c3366f558484eb7020d52bbf64a296406e61d09599c
MD5 07ffbe5f24ca348723ff8c6c488abfb8
SHA1 6dc2851e39b2ee38f88cf5c35a90171dbea5b690
SHA512 7ed2c8db851a84f614d5daf1d5fe633bd70301fd7ff8a6723430f05f642ceb3b1ad0a40de65b224661c782ffcec69d996ebe3e5bb6b2f478181e9a07d8cd41f6
TLSH
T175012506E2516A2B03B2A12775613641F57045EA1200DCBB7A7CD41C9FB6DAB918BBD8
MD5 SHA1 SHA512 TLSH

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3748_191657570\CRX_INSTALL\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

service_worker_bin_prod.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3748_191657570\CRX_INSTALL\service_worker_bin_prod.js
Size 137KB
SHA256 63b3d006783e106d3aacb9cda3224d48a218dd45d50db663d38b45d2d9b2bff0
MD5 97b43ffd3c415ea9887f0113d43f5a2d
SHA1 1afcebee8c88dcc9c3ff7d43ffdc3b00a329f9c0
SHA512 279521e204cebf954dbf991ba66b9d4a30534d77650c898ce2f052034263d9dfd9a1ea122a548f51a061ebee9859fd2e88860ebece906b23b9d6dffdc7d85c97
SSDEEP 3072:cFMbB96nK7qtBnZ8CDPDHbSVh6lGE4C0S1wmF9cWMzK:cFMqMGvSVh6lGE4CymFiWMzK
TLSH
T147D3D9CCF6A5B0124363A5F5402F000BB239B8B9E44C85A8F288D9E97D7556D8277F7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3748_559929520\CRX_INSTALL\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e3d9b344-7ded-4871-adf7-e4f6790d5e6b.tmp

Path C:\Users\Admin\Downloads\e3d9b344-7ded-4871-adf7-e4f6790d5e6b.tmp
Size 7KB
SHA256 b8f6deef024f37781f74a171262758a1364c9520af37751807513164edda2756
MD5 5edd106e5c3f4b7f23d36067bbcd1522
SHA1 4ad79b3be7b5b79624020ff6e116c30583bcb03f
SHA512 4b7d78ff9329f52796efd65b88805252cc7a955d2c0c3905c22d354bba08048a29baf43dd23a121a5ccbbcdb316a0033a888d2c584f9360fae7692eab9f95af7
SSDEEP 192:kQ5qDS/uPlbrNVUKhumYaK+ijycHaFMYxqalmSzL/eoijOb:h5qDQuPlkKhusHiL6FMyBl/zL/eoiab
TLSH
T1BEF15204AB654DE0F207B13FD298285FF2C0F053D3D8F0AB571297566AE26AB2574F40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

help_commands.txt

Path C:\Users\Admin\Downloads\help_commands.txt
Size 3KB
SHA256 070a6fd7d94bdfa095f07bd9d6f1e4776521ae4dd868909270745dfe74cf8948
MD5 94cfcebea2551e111cff5ec55c5cb5d3
SHA1 6fb12c011789d5574c60e655ac9651e27a5b2822
SHA512 dbb72c0330084de9763438f9f891a8936d526f8746c493ad56e04e7f41c6a6f2f7cae6c7431adce337f94ba80eda8a59f79300e43c85d88de1e113ba6da02bac
TLSH
T1D5712069C8D9FB5B3AF34704E5C9E2172CCD920133A8F470AD3982566788BD8C6B2175
MD5 SHA1 SHA512 TLSH

Submit Download

screenshot.png

Path C:\Users\Admin\Downloads\screenshot.png
Size 398KB
SHA256 94bd0a8fd17b7e3cb0939ec1211cbfc60d6229a9e0150cdcade22209e3f192c6
MD5 bffd5cc87d6e401339679afa897ed084
SHA1 7fab02335147538d59dcd99f19bf7282cd6f4eaa
SHA512 a52402596a586dfb222e6c881ebd79872472535ef7a8bf4b4a799ed0ccadefc2d766654b438eb57baa94554445cc8cc7eba3bb7e670e9f18c2f6d5fc7f33652a
SSDEEP 12288:oeVkgS0hca+1s8Txn0b9+lZB6cOEQM4iVme:o2kgAa+1s8Txn0M/B6caO/
TLSH
T17D94120485AEC945F784817B5BD1E180AF70A123B2320AAA5DF4B27B169443F7CDDDEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3748_1187031025\manifest.json
Size 135B
SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
MD5 616eb6b585f16811dc5db5063e088cd7
SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
TLSH
T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3748_1387864066\manifest.json
Size 238B
SHA256 1bdda4a8fc3e2b965fbb52c9b23a9a34871bc345abfb332a87ea878f4472efbd
MD5 15b69964f6f79654cbf54953aad0513f
SHA1 013fb9737790b034195cdeddaa620049484c53a7
SHA512 7eeee58e06bba59b1ef874436035202416079617b7953593abf6d9af42a55088ab37f45fdee394166344f0186c0cb7092f55ed201c213737bb5d5318e9f47908
TLSH
T178D0A727EC008DB611B207580AF5A742E3B1630F7C012509377308CC0F3D1744081285
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3748_145338557\manifest.json
Size 160B
SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
MD5 c3911ceb35539db42e5654bdd60ac956
SHA1 71be0751e5fc583b119730dbceb2c723f2389f6c
SHA512 d8b2c7c5b7105a6f0c4bc9c79c05b1202bc8deb90e60a037fec59429c04fc688a745ee1a0d06a8311466b4d14e2921dfb4476104432178c01df1e99deb48b331
TLSH
T1F1C08C73CC08AE7911B14B371B214642E3B8030B600039093A32084C0BA47B00262328
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3748_1520114717\manifest.json
Size 119B
SHA256 7169d86e87f904218238cd293e043e20b7828afad9acd1ff2e5d64188530b9d7
MD5 7382260298fc06c135b7c7399e9acff9
SHA1 6a829f795a3b8be25200675e00abfa1908fdefdf
SHA512 f0ce77f9f72fb6721bcfa9b03f77b0771e8217988183787c00dba4f9d9f19cdba252ddd656422336035f81939cb97c8b5dcb4f036a39280198c17cd04faaaed4
TLSH
T191B09273A800E83830E9EB91093A8243F320AB4BA585640A3625485C0B2B9F990606C4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3748_166716116\manifest.json
Size 80B
SHA256 abe933f0db95b1a75786da21de82feb5270ffa7ae072270923da2437710d93ba
MD5 3790d9257ba14f8be2ba08acf259a57f
SHA1 c54ab2e79d0ac9dc27425c7450e01ad593f02d60
SHA512 9568fef732369f06aafd8270638a38531a26f6f40a1c7c65fb7254eed36807789756e1c6efabaec86017b3decead2773de9ef5814650dbb334e6000ebd44a467
TLSH
T1A8A012605811E13310C403700260438243E01C112015240405461140218823713A3129
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3748_166845718\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3748_1769448293\manifest.json
Size 113B
SHA256 98821f71a1973ac61b45967ce0c121eb598ac6e95abaa23c912d2f33e4237d8c
MD5 7ef3c71464d0fef472bc1d81fd363c62
SHA1 230e8ec0f849bf34d444c55ef548ba0c9c94d39b
SHA512 f74b96ec3b9569e360a02bfdd4fe237efad8ee2a5deaf46db891bcadd39dba22fd6d59a4e9aafe5511152625ce9f468519dadd53fc0c9b6c8826dc58cbe6cd7c
TLSH
T1C8B09262DC80D872693A93AC0E2246C4F228234B2558AA493630048C0A3A3F082A2321
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3748_1866706865\manifest.json
Size 177B
SHA256 77a882c1ca9977c89f8e67a15ec1854a8eb84e1e79bf7009808ae9eaf5193b65
MD5 b9662cf1a01e6a1e875d12cf69862abf
SHA1 8644cbd5900e21cf6422e12dcd8b12c203f32504
SHA512 840e37081ac9b9974a0c9c151d17c04544be2b70810a0a2d5baf30f0decfa927596df9282a8b9728f9588a6da051962b45b3198328c1df05bec31c2a7b9b0858
TLSH
T109C012EFDC509DB115EB4323156D43C4E733CF0B1546450935FB66082E25981C193500
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3748_189696111\manifest.json
Size 141B
SHA256 fe8c5046a79693a9b7f32bfc3ed7c8fdf84c5d186f5326a527ac508345a44009
MD5 3a5a48cc06d7f5cf2ec6e467e34915dd
SHA1 b6c3679e8961f0af7b5a56704992d5561ebaf6c1
SHA512 ae2de2b1827831eaeae6c9d00d081aa7be570fb050368eabc6b549469b14d7409b55e3726d4ac8ceb6cf75e48b3a88604345cb56a53f0686dd84cf8cb262125a
TLSH
T130C04C5585005D71509D87781D6C97054B12CF5618946509DDC68309EC1DCCB64B234F
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3748_2090353421\manifest.json
Size 165B
SHA256 fc5dd0f6692cb24ec676b53527dabff28114c905dd08f72c97ac54a22c1bffae
MD5 1bfafb8c67c4ae6cf99faf6f1fcbe9e3
SHA1 77fc3483a895f1f429e6c6bb0f294a8fdc69dd08
SHA512 7237c88400ae032f4e745d8f0e5a869c29a76f0151b61ad2aed2ae1be7fd0b759d81c5e6b47535586533c0ab25291a25822174173f1bf6dbaab0298366aaea73
TLSH
T115C012229844793A12A183840A31CA82B2A0020B34E129023A79408C4F350749101619
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3748_232867519\manifest.json
Size 165B
SHA256 880b2b81f96f7ec0799e2939e82955327f65a8e4edadfdd89cfebb70d8fb6f2e
MD5 3ef32f0bc4059ed77b8df1ddc1bd32d6
SHA1 180f08a503c8145e50e715a1dbe202b491de0011
SHA512 036d08f722ca62b9f5a21d79d9d6d0585f7255ff736ce717f72aff31ef0e194adb3481da6c690be7306818947efcdf1e6745d0d14de0c32bd088a5f93415805b
TLSH
T1EEC080029400197419CE47150D5CF388A722D7152D80B0165BD7C218DC3DC8B68F3B4D
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3748_641211744\LICENSE
Size 1KB
SHA256 3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b
MD5 ee002cb9e51bb8dfa89640a406a1090a
SHA1 49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2
SHA512 d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c
TLSH
T17D31535723840B9306DA2B4566AEBDC4B0DDC02D7F27AE05186EF394537B52ED8B3443
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3748_641211744\manifest.json
Size 85B
SHA256 2d905d7b28b1afd313753d14f6a916a2e56ec4c1316bfa43046b09214ceb6090
MD5 8ce95626b39ebc2401eee0b34c24fc7c
SHA1 f97a2fefe756f7a03e388e1333573b884730c2b0
SHA512 f04e4f695977918adf6e0603386b6f9c75a4a2202b0fe7215b642f3db491a1db398039cc28633b8e2541749403581622d28c1400f3f8fc66a3daab200e27266d
TLSH
T106A0121018015DE318880320213143D2D3A51C05247437001106108019B8636027A22E
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3748_97977132\manifest.json
Size 135B
SHA256 cb929ae2d466e597ecc4f588ba22faf68f7cfc204b3986819c85ac608d6f82b5
MD5 4055ba4ebd5546fb6306d6a3151a236a
SHA1 609a989f14f8ee9ed9bffbd6ddba3214fd0d0109
SHA512 58d39f7ae0dafd067c6dba34c686506c1718112ad5af8a255eb9a7d6ec0edca318b557565f5914c5140eb9d1b6e2ffbb08c9d596f43e7a79fdb4ef95457bf29a
TLSH
T1CEC09223CC019CB119743B642AB2AB82F7B41B0B6869705A3AB3148C1F7E1B48082680
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4396-2861-0x00007FFEC7270000-0x00007FFEC85F1000-memory.dmp

Download

memory/6244-3032-0x000001F75A1E0000-0x000001F75A292000-memory.dmp

Download

memory/6244-3031-0x000001F757DC0000-0x000001F757DDE000-memory.dmp

Download

memory/6244-3033-0x000001F757D20000-0x000001F757D2A000-memory.dmp

Download

memory/6244-3028-0x000001F757D40000-0x000001F757D62000-memory.dmp

Download