977133a0a8dde6b5f0329bec11f9a7707fd3b989256f2e007edf6b043f5ee350

Analysis

user interaction
yes
max time kernel
296s
max time network
279s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/10/2026, 13:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Mafia II Definitive Edition Arabic.exe
Size 7.3MB
Sample261024-qtel4svsfy
SHA256 977133a0a8dde6b5f0329bec11f9a7707fd3b989256f2e007edf6b043f5ee350
MD5 5d699097a26a81f53a052d36dd8f0a84
SHA1 0ca62a59a064190fdde032069385b400a44c7a98
SHA512 cb2572a55b5083965f99412b8c3a7b86d0b0a2878db52d180a9369604a2369f22efc6b9f0f853bca624034bb2fb2ca2e3df14c0d86781b7b723b487abc805b10
SSDEEP 196608:2mY+up2JUWcrX6akwp6nZ35iAWfOPakCVkIP8:itXj6Z38AiCakiE
TLSH
T16276E00BDD5C5BE2F39EE97D4225A17841236ACC8F918CDF11B2EF4ADD3816B1863285
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4868	autorun.exe

Loads dropped DLL 1 IoCs

pid	Process
4868	autorun.exe

Contacts third-party web service commonly abused for C2 1 TTPs 8 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
69	discord.com
72	discord.com
73	discord.com
79	discord.com
84	discord.com
11	raw.githubusercontent.com
12	raw.githubusercontent.com
68	discord.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	autorun.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	autorun.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mafia II Definitive Edition Arabic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	autorun.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4144	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2101206053-1414382737-268919432-1000\{36C4ED31-B6BB-430F-88C0-3EE987612FA6}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2101206053-1414382737-268919432-1000\{FE8EF664-CF7B-4558-9748-8BCC4ECBA03E}	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4868	autorun.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2580	Mafia II Definitive Edition Arabic.exe
4868	autorun.exe
4868	autorun.exe

Suspicious use of WriteProcessMemory 50 IoCs

description	pid	Process	procid_target
PID 2580 wrote to memory of 4868	2580	Mafia II Definitive Edition Arabic.exe	83
PID 4868 wrote to memory of 1220	4868	autorun.exe	99
PID 1220 wrote to memory of 2640	1220	msedge.exe	100
PID 2640 wrote to memory of 4584	2640	msedge.exe	101
PID 2640 wrote to memory of 4144	2640	msedge.exe	102
PID 2640 wrote to memory of 2792	2640	msedge.exe	103
PID 2640 wrote to memory of 2792	2640	msedge.exe	103
PID 2640 wrote to memory of 2792	2640	msedge.exe	103
PID 2640 wrote to memory of 1612	2640	msedge.exe	104
PID 2640 wrote to memory of 1612	2640	msedge.exe	104
PID 2640 wrote to memory of 4544	2640	msedge.exe	106
PID 2640 wrote to memory of 4544	2640	msedge.exe	106
PID 2640 wrote to memory of 4544	2640	msedge.exe	106
PID 2640 wrote to memory of 3948	2640	msedge.exe	107
PID 2640 wrote to memory of 3948	2640	msedge.exe	107
PID 2640 wrote to memory of 3948	2640	msedge.exe	107
PID 2640 wrote to memory of 4368	2640	msedge.exe	108
PID 2640 wrote to memory of 4432	2640	msedge.exe	109
PID 2640 wrote to memory of 4368	2640	msedge.exe	108
PID 2640 wrote to memory of 4368	2640	msedge.exe	108
PID 2640 wrote to memory of 4432	2640	msedge.exe	109
PID 2640 wrote to memory of 4432	2640	msedge.exe	109
PID 2640 wrote to memory of 1464	2640	msedge.exe	111
PID 2640 wrote to memory of 1464	2640	msedge.exe	111
PID 2640 wrote to memory of 4236	2640	msedge.exe	113
PID 2640 wrote to memory of 4236	2640	msedge.exe	113
PID 2640 wrote to memory of 4932	2640	msedge.exe	114
PID 2640 wrote to memory of 4932	2640	msedge.exe	114
PID 2640 wrote to memory of 4932	2640	msedge.exe	114
PID 2640 wrote to memory of 940	2640	msedge.exe	116
PID 2640 wrote to memory of 4620	2640	msedge.exe	117
PID 2640 wrote to memory of 940	2640	msedge.exe	116
PID 2640 wrote to memory of 4620	2640	msedge.exe	117
PID 2640 wrote to memory of 3240	2640	msedge.exe	119
PID 2640 wrote to memory of 2768	2640	msedge.exe	118
PID 2640 wrote to memory of 2768	2640	msedge.exe	118
PID 2640 wrote to memory of 1616	2640	msedge.exe	121
PID 2640 wrote to memory of 1640	2640	msedge.exe	122
PID 2640 wrote to memory of 1640	2640	msedge.exe	122
PID 2640 wrote to memory of 908	2640	msedge.exe	123
PID 2640 wrote to memory of 908	2640	msedge.exe	123
PID 2640 wrote to memory of 604	2640	msedge.exe	124
PID 2640 wrote to memory of 4332	2640	msedge.exe	125
PID 2640 wrote to memory of 4332	2640	msedge.exe	125
PID 2640 wrote to memory of 604	2640	msedge.exe	124
PID 2640 wrote to memory of 4148	2640	msedge.exe	126
PID 2640 wrote to memory of 4148	2640	msedge.exe	126
PID 2640 wrote to memory of 5528	2640	msedge.exe	128
PID 2640 wrote to memory of 5536	2640	msedge.exe	129
PID 2640 wrote to memory of 5544	2640	msedge.exe	130

C:\Users\Admin\AppData\Local\Temp\Mafia II Definitive Edition Arabic.exe
"C:\Users\Admin\AppData\Local\Temp\Mafia II Definitive Edition Arabic.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2580
- C:\Users\Admin\AppData\Local\Temp\ir_ext_temp_0\autorun.exe
  "C:\Users\Admin\AppData\Local\Temp\ir_ext_temp_0\autorun.exe" "SFXSOURCE:C:\Users\Admin\AppData\Local\Temp\Mafia II Definitive Edition Arabic.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4868
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.gg/etdKdEH7XS
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1220
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://discord.gg/etdKdEH7XS
      4⤵
      Checks processor information in registry
      Enumerates system info in registry
      Modifies registry class
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:2640
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x278,0x7ff973d2c188,0x7ff973d2c194,0x7ff973d2c1a0
        5⤵
        
        PID:4584
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1968,i,14035434297667978953,12609831979172942743,524288 --field-trial-handle=2280,i,16845646693529453780,8896582426321266804,262144 --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:3
        5⤵
        System Time Discovery
        
        PID:4144
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1756,i,3374266165703087435,10538878769728108394,262144 --field-trial-handle=2280,i,16845646693529453780,8896582426321266804,262144 --variations-seed-version --mojo-platform-channel-handle=2276 /prefetch:2
        5⤵
        
        PID:2792
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2016,i,15390947039394091795,13387642255090321464,524288 --field-trial-handle=2280,i,16845646693529453780,8896582426321266804,262144 --variations-seed-version --mojo-platform-channel-handle=2672 /prefetch:8
        5⤵
        
        PID:1612
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3520,i,1899028147881765082,11543940822782896361,2097152 --field-trial-handle=2280,i,16845646693529453780,8896582426321266804,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:1
        5⤵
        
        PID:4544
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3524,i,4260466271483524235,16686316096602886974,2097152 --field-trial-handle=2280,i,16845646693529453780,8896582426321266804,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:1
        5⤵
        
        PID:3948
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4248,i,17067405091817686251,8300104342433462732,2097152 --field-trial-handle=2280,i,16845646693529453780,8896582426321266804,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:1
        5⤵
        
        PID:4368
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4268,i,11078648696223051992,1044941225829015818,2097152 --field-trial-handle=2280,i,16845646693529453780,8896582426321266804,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:2
        5⤵
        
        PID:4432
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3724,i,4680253172772333206,1555441327227883413,524288 --field-trial-handle=2280,i,16845646693529453780,8896582426321266804,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:8
        5⤵
        
        PID:1464
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3724,i,17936951807259473484,2983179765030961390,524288 --field-trial-handle=2280,i,16845646693529453780,8896582426321266804,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:8
        5⤵
        
        PID:4236
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5152,i,3651001655433286485,14609511416455310160,2097152 --field-trial-handle=2280,i,16845646693529453780,8896582426321266804,262144 --variations-seed-version --mojo-platform-channel-handle=5360 /prefetch:1
        5⤵
        
        PID:4932
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5824,i,1471513199435977108,13129383307806104136,524288 --field-trial-handle=2280,i,16845646693529453780,8896582426321266804,262144 --variations-seed-version --mojo-platform-channel-handle=5840 /prefetch:8
        5⤵
        
        PID:940
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5828,i,3604216479374964856,7074051123362575641,524288 --field-trial-handle=2280,i,16845646693529453780,8896582426321266804,262144 --variations-seed-version --mojo-platform-channel-handle=5864 /prefetch:8
        5⤵
        
        PID:4620
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6064,i,3737759522495137012,7148805809073983903,524288 --field-trial-handle=2280,i,16845646693529453780,8896582426321266804,262144 --variations-seed-version --mojo-platform-channel-handle=5264 /prefetch:8
        5⤵
        
        PID:2768
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6068,i,7812678208224262424,2434432421068248830,524288 --field-trial-handle=2280,i,16845646693529453780,8896582426321266804,262144 --variations-seed-version --mojo-platform-channel-handle=5808 /prefetch:8
        5⤵
        Modifies registry class
        
        PID:3240
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5616,i,13163938225620635554,326070430535699955,524288 --field-trial-handle=2280,i,16845646693529453780,8896582426321266804,262144 --variations-seed-version --mojo-platform-channel-handle=5688 /prefetch:8
        5⤵
        
        PID:416
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5616,i,13163938225620635554,326070430535699955,524288 --field-trial-handle=2280,i,16845646693529453780,8896582426321266804,262144 --variations-seed-version --mojo-platform-channel-handle=5688 /prefetch:8
        5⤵
        
        PID:1616
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3784,i,16597993409533174083,12592594722219369193,524288 --field-trial-handle=2280,i,16845646693529453780,8896582426321266804,262144 --variations-seed-version --mojo-platform-channel-handle=3768 /prefetch:8
        5⤵
        
        PID:1640
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3780,i,18230709672748758677,12719802378200128545,524288 --field-trial-handle=2280,i,16845646693529453780,8896582426321266804,262144 --variations-seed-version --mojo-platform-channel-handle=3796 /prefetch:8
        5⤵
        
        PID:908
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6708,i,15351346265015028257,6104591775168745068,524288 --field-trial-handle=2280,i,16845646693529453780,8896582426321266804,262144 --variations-seed-version --mojo-platform-channel-handle=3764 /prefetch:8
        5⤵
        
        PID:604
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6612,i,13440123551945319809,13161296786199523886,524288 --field-trial-handle=2280,i,16845646693529453780,8896582426321266804,262144 --variations-seed-version --mojo-platform-channel-handle=6516 /prefetch:8
        5⤵
        
        PID:4332
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6612,i,10981819070039421853,16691721939982079982,524288 --field-trial-handle=2280,i,16845646693529453780,8896582426321266804,262144 --variations-seed-version --mojo-platform-channel-handle=6812 /prefetch:8
        5⤵
        
        PID:4148
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4352,i,4845766207678907356,7247670518048826494,524288 --field-trial-handle=2280,i,16845646693529453780,8896582426321266804,262144 --variations-seed-version --mojo-platform-channel-handle=6496 /prefetch:8
        5⤵
        
        PID:5528
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6396,i,15540546710232298314,16653701140183223371,524288 --field-trial-handle=2280,i,16845646693529453780,8896582426321266804,262144 --variations-seed-version --mojo-platform-channel-handle=6460 /prefetch:8
        5⤵
        
        PID:5536
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3776,i,18264781450262162571,9474996259044265321,524288 --field-trial-handle=2280,i,16845646693529453780,8896582426321266804,262144 --variations-seed-version --mojo-platform-channel-handle=3708 /prefetch:8
        5⤵
        
        PID:5544

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4cc 0x3f8
1⤵
PID:1500

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4152

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1860e7d9-b9d2-4647-b824-1a2b04fb9487.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\1860e7d9-b9d2-4647-b824-1a2b04fb9487.tmp
Size 18KB
SHA256 c5f5fc3f7155ba2a1b21a9d36e86de0677deb88e118aeb93390f7ec85cf3d810
MD5 21afb6e430f3024bc21e24fb797bf887
SHA1 fa25017dca2c0f30885fe701e25fd1c9b4e6e4fa
SHA512 6707c661405e769e415bda9e724506c1143b6c0f959ab0f822f80af25799661c547eb1c63a6898aed82977e1941501502245f4f2012bead50351b94d1d15869b
SSDEEP 384:nkQkUSv0sNnG4TFTj3Zp5u8igAAZYo2z2IeufIIlA:U0K1kjEez5eufLG
TLSH
T156827D3668B8BC379DA29521F64B36038E74815BD7C86F90D9DD6B2C05DF2D8230BA07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

39e9ce82-9790-4ce2-9400-8658d274a8e5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\39e9ce82-9790-4ce2-9400-8658d274a8e5.tmp
Size 8KB
SHA256 6e1d3347fd299b1e8854912831454e947f805cd3129f92c22271a34979c77c48
MD5 480591819900ccc2063517e889c30ccd
SHA1 689bca66a6224613804259cbb69081bd53089e37
SHA512 fc8014d0a1480a532c91923a3714e93a068cec7a00122c303bd15670fa1f5347dd3496e84a923def5b75358bf7278283cb4fa719dd7e9758a19eea7407297963
SSDEEP 192:SONh6iDCQmiUyCYHq5u88PEvIBBSqSBROU6:SONh6/kHq5u8igA3uOU6
TLSH
T1B9020A396C787C7B9DE2AE15B5877B179FA4113FE6942F84DAE8172C01E768C1303822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

81f2f93e-7d55-4547-ad5c-f90ea94276f9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\81f2f93e-7d55-4547-ad5c-f90ea94276f9.tmp
Size 8KB
SHA256 62a3e353366e1bf9a2ede231674c8116e23348e270395dd37322f84c5d1f6a86
MD5 84312882d5ba7987d66d03f7ce1f5c88
SHA1 df7f539ef07b5de39fb5b6ac14d45f902462c6c2
SHA512 9356b9981b56b4e80f97ebf28ddbcb6ad7c3b22a27a4dc40e48a2c1ab86fcfe3112c633b2e04eeeaba43d0f95fde2814380de82e17b2765ae45528108cdd0b28
SSDEEP 192:nJONq6iDXQmiUyVYbq5u88PEvIBAB3PwoeuZ/q5OU6:JONq6stbq5u8igAAZYoBzU6
TLSH
T1DE122B367878BC2B6CD2A865F58772039EA4426BDB887F80D9EC271C01EF59C530B917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

931c5fd7-70b6-4ef8-ba37-876cf7641263.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\931c5fd7-70b6-4ef8-ba37-876cf7641263.tmp
Size 23KB
SHA256 2a0dfc254777a2a734a4cfbc2c68c4eeae2b2a2c06754761f7f5e377201a30df
MD5 690fde3be05f2572e0e4825bfc2f0ab6
SHA1 12fc1cfe7be04082d6f32a6622b8ce1c366d9f5b
SHA512 ab8480c994410920e854e11d579039f4a290aeeac2ae897977e32923d6109937722b3eee0b8c31f5ce225d18f56062fe93159d0f9355c0e4771a2e93ac0a559e
SSDEEP 384:nQQkUSv0sNxr4TFTjfZp5u8igAAZYo2p0AStYdtOqMKWb5/L2IeufIIlA:4071kjEe5Sh7KWb5/L5eufLG
TLSH
T1B5B26BB198E5ACE748A5E4D4B646F203ADA8417BC6885F4CD5F9BA3C30CF1F82717606
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f6c603c48bad8cf6fc5bfa1901589a53022a5c1315888da77b07a5c7516687a5
MD5 4fabfb1f7d070458e2895ffec233ff43
SHA1 98393503bad4d9db97f3ddfbb3e45d91868d9978
SHA512 8d103d2ec672aaef277a945b102deb58448c812a35ac148aeabfd0c6f3a0f02507510d1c81989a1842eaf658c9190a9493eb0148dbc239fa99fadbb1108ebe40
TLSH
T13ED0805474663DFCD16E71355415CD405744DF53E1021755160B4C15D5501C61CF1EDD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 61a97be736e0441d45644d31b38bd9bef6c1bd260fa1ecbb5d099fa493fee6b4
MD5 99bbd8400adc948f85ebd87cb24b3fcb
SHA1 c8fb9564ede7ecb06cef446bdb527025127a796e
SHA512 75b3ee70eca487cbbfb3d5b4b25bae158ff99188ab36d55f391e9f80c51ce9fa433897d79a0ae37ad64698bc3eb5aa9a10a49116fb8f7f35ed0a6e98aa8321b7
TLSH
T109D022C8F2A0300CE00C3233A02BCE022B88CEA8F0032BCA000E8C80E8800C80CF2C8E
MD5 SHA1 SHA512 TLSH

Submit Download

0249f66f-4da4-4425-b44b-b192facdd0de.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\0249f66f-4da4-4425-b44b-b192facdd0de.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

09b71d12-8944-43dc-a723-9874b4661835.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\09b71d12-8944-43dc-a723-9874b4661835.tmp
Size 10KB
SHA256 f4a991e7f09beeb426d7b4451c5adf3e6b40c5406ceea234e9b7a1bda428b771
MD5 3e742e537dfecd73b72c88af7d7192b2
SHA1 27bbb0dd2f9e66782a8c2865f35940d34b9861cd
SHA512 24a3b5c44eee6528a652fc38e85d8fde8bb1bf58c5af214b82ae784bfe71ded0e0d50314f4c91e7be164920bfcae764af6232207a1aebbfb8fa6047b7e4bc8ee
SSDEEP 192:sxZyRAst/fJXsSKFAz0IdpEkHW6+WNztR/eBDaA4kkIg4J:sxZybt/fZsNgttHbr/eGc
TLSH
T10422D9526E38B97B4CC7D219BF15BF13D6F9103295D11E48AAFC861C05E6ADE220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

449063d5-7c22-47ec-a36b-fe361a0e42ac.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\449063d5-7c22-47ec-a36b-fe361a0e42ac.tmp
Size 10KB
SHA256 14228fa73b3dc6358953add4f470e6591a62eeb2458875639583ad7ab05d0ba7
MD5 3366afa2f44bbdf3a9f9eb542cdf9d65
SHA1 59eaa18ed57d3e155f7a53e0b6fc96c99905147b
SHA512 51c9f41d15e9316b2f7a86601defc1f3a1b2f19064a09433395ef94c78bf95a6e272013904b8892557cb2f70e2203c0fb942241dff3b249d7d4effa2b363ba7a
SSDEEP 192:sxZyRA/t/fJXsIKFAz0IdpEkHW6+WNztR/eBDaA4kkIg5qJ:sxZyCt/fZsngttHbr/eGk
TLSH
T1BE32D9166E38A97B4CC7D219FE55BF13D6F9103295D51E48AAFC861C04E6ADE220B80F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

846e2a99-f238-49a0-8d79-fa2d8dba06e3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\846e2a99-f238-49a0-8d79-fa2d8dba06e3.tmp
Size 32KB
SHA256 a383f956474ffb9f95b6e5f4734e13d304176b4f900f87fe41dd87ed18d21d30
MD5 3765f4605e972e074e209811483b52b3
SHA1 242fe8003c8ce41b049ab14bd7a1c74f2a69d980
SHA512 778848a518cabbe3a6ec2d33f8a06ba6d2c77a0f716dfca5d57c9e883dfe69bcf5bd47a42efc5bdf0b7419a7b2045c4913501aee8ed3fd87c536c1b3d0caf5c8
SSDEEP 768:5eyQR3+7pLuLjTrWvvlRZ8F1+UoAYDCx9Tuqh0VfUC9xbog/OVz9XKLlRXH3irod:5eyQR3+EjTrWvvlRZu1jaa9XKLf335w2
TLSH
T128E2EA7B780CCE7E4FC00E9DDC2A7E9A6DA802CB5698C94447FA945C02C7BEE51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 9KB
SHA256 e2d08b1578fb5e70e595b3ad3c1e4846ca1a78811b17d1b2573e0d3eb5edc58d
MD5 abee64c8ab2210cdfaea7e374c6ec6cf
SHA1 ea1abb9f6f90b9be754d5c7d9366b15481d598cc
SHA512 db4e719fe8886deae481c747ecb34f93632529f85cb365be097736855fe930070b5c9670c07709975c590d7210dc8cb1e1985124ac71c6c96f9d27350795d3e0
SSDEEP 192:ve6T3sPs6qT/t6+dFhRZJRW//4PKfGQ2b/Jiu+3Cpd:veo9p0+jhRZ+//4MGQ2b/Gyv
TLSH
T1B4225FA8A44026DBF79CB4BE11DCB96671381703B5B3DEE1C066E6FC34A9F819B36004
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 8eb20a3f6b5bcb23ac62d218a20539894cbab46a3d1c630c4699ef89adfaf4c1
MD5 344a12bf1c956b2725f12b79456908d6
SHA1 555984d539342a24e1b0e4e5f3871de8c2932b7b
SHA512 510310811b77e6f5f26200b7e5dc81bc6341f62940b2ab38ecf73056c6c9a0465b7bdc7976e54d5ad867eb01af5e0be7ae30fa9cdb4560ef1ba05eb29f015e7f
SSDEEP 3:MsEllllkEthXllkl2zEklaWKt:/M/xT02znbKt
TLSH
T1654404047FC0040FC50030345015C3500370F4110531F747347704335DCD5400D10011
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

244ade49-4820-446f-80b0-1926d675dd38.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\244ade49-4820-446f-80b0-1926d675dd38.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.111.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

0c2099e1-911c-498f-8d16-cada4cb133bf.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\0c2099e1-911c-498f-8d16-cada4cb133bf.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

2bcd3551-91e1-48ac-acd9-96f73bb87c92.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\2bcd3551-91e1-48ac-acd9-96f73bb87c92.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

98c99d1c-2939-429b-9d6d-166400515288.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\98c99d1c-2939-429b-9d6d-166400515288.tmp
Size 2KB
SHA256 42560e036f3854f21e72b98934ae09e41ccdd456b1fcf563e157ca8da318c0bd
MD5 c4e70d1eeae9c1957905ea13f7f1ac99
SHA1 29fbb7a0b573cec9ea05e66c84518924cf4dd39e
SHA512 5e9054edb2c38e02bdcea489ae730abc83f3527b7c01409f975d6ac13e5fe3406b5cdecbf58d7b8ef24d279fa5cd6ed3a2d2bc99efe4a97f729ea4c90a5d098a
TLSH
T11051BAF3C7E8866DC91156F4AB147E1BCE2E0958432C3D2AC4E8AE5B93E2571E18094F
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 138B
SHA256 3e4c95646cc43a229b099cb803a09694405244645d39d71deaa87c6e89e3a84e
MD5 4f731a0518511b76b6d139f43c1db508
SHA1 79350ec38ed4c045d4b934fa105f07051549db94
SHA512 bc30b6e8140569b2609d8eb4e0af5f41ef4872ff568d7ac2a3c0ca2cc4d11cffea0e7dbb4995bb18fe425344ae3c87a56a1a8b2136b18e1d00a701d7cc6cfbd8
TLSH
T10DC09BB7E2440A95DB2907511233515D97152CDD5DC788DE71137874107DE377202EE1
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt.tmp
Size 233B
SHA256 25d5864214ca6ab67fe2984d3d0fdb74800705093f72aa0acfaacb9ae0f458f6
MD5 71834d75615fbd6aa1bdf327c741f181
SHA1 356b5988d942bac4845f7b30a09d34be9c86e88a
SHA512 3ca682c50dc18f4ca2be801da0c5b776aa47004a1452f4e32007dd92d602013bb79342fcfe0543f3f119272d7ff35698664acbc3ac3e9216eb5b6af659f951fd
TLSH
T1E7D0A7A7D55508F0FB7A47626572145D83612C8818DB48CDE402343934B9E53E321EB6
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt.tmp
Size 226B
SHA256 6cf9258b64a44d216e0592aea4d1d00dc588b1254a382a0aab94bd0434abbcc9
MD5 ed4d8bc2cd66843516b53665da6ef315
SHA1 39c00027ccd6217be59edf0a807f490e0b13a9eb
SHA512 c7a7df54b6ac6750bed94db5c2584624cba1366ec1ebef05bdcd9e589fcec95d723144d7747087e3152e08d9a0bb551775682c03c2d1f2a86b0ff6248c784f6b
TLSH
T115D0A7A7D15849F0FABE4B622572106D43502C8928DB48CDB40104356499E63A312EB2
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 bc0b3337b73f94fcc98a8c99f6ddfef455bb65b3116e9adff9720b4b86f67eef
MD5 b2002925c6e4ded8ed1e9d297e17dae4
SHA1 649790b56898252c091c5db805f897d922eb2727
SHA512 e7293a0a8808a540b18078680e9141005aaee45230119d08db8f36fdc059a641d23abb83e0139b6798a99a52c59dcb067b5e6635d11f911709d0d9d44b466189
SSDEEP 48:K0nDnmnHnjnNnln1n2bnlnon9ISnjn2K9nT1nBn2xnLnmYnwnRnDnnyLRAthrvzy:KE4gK1eySOEKXq8feKMEqR
TLSH
T18A9132553177030079BE294880B89B2B42B131F2714CEA7BBF6D81B68E2EE145CFE5D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a8df3fcc-969a-4627-a69f-acf2edf92160.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a8df3fcc-969a-4627-a69f-acf2edf92160.tmp
Size 12KB
SHA256 cd6cb25f46558c608ed1d17a3eee38784fc7e17e30999bdf487a6a093551e9a8
MD5 77c316f917c2b3bd320e9097f72f6d3c
SHA1 d0a095e2cd56f304ca89fa02339933dfa2cdcfd8
SHA512 9c60c95cb2eea3d48cac6476ac7bc0e55d4245a9ddc6e59df883192910633cfad7e63e4979fc94c4acf224b599600d39d6182541d4738e94eb2b3847f3601c16
SSDEEP 192:sxZyRU/tt/fJXsIpWpVzFAz0IdpEkHW6+WNQkOtR/eBDe9frDOIgbMJ:sxZyAt/fZsEWvzgttHbe/ejs
TLSH
T19542C816AD24A97B8CD7D219FA55BF13D2F9203655D11E44AAFC8A1C01E6ADE230780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dd0fa2db-5012-494c-bc4d-ee3004fb977e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\dd0fa2db-5012-494c-bc4d-ee3004fb977e.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fcc55a90-5969-4f52-b0a4-a7bb445222fd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\fcc55a90-5969-4f52-b0a4-a7bb445222fd.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 6d985a9bf98422be8cf5347ac4ebe3d22328d3b18a19a86a61e97aac3da14916
MD5 118a35484ea8105fd252a6cc1db92422
SHA1 1e349385c9dbe2de242780f6a86f1721a764e0eb
SHA512 718960685a448738a95297966e40f24227f8cde8cc6b46b77fd78bb30a706c9deb98e856f5c79cd2abf93e7e9b19b425bd5143785c621057dc64654c6acc0b71
TLSH
T14541185CB6E91108B3B36E569BF7A86D487FBD732E06985E00110E4F4A63A40C8B1B37
MD5 SHA1 SHA512 TLSH

Submit Download

809431ba-64ee-4aac-95e8-b7b9e3f4d7f5.tmp

Path C:\Users\Admin\AppData\Local\Temp\809431ba-64ee-4aac-95e8-b7b9e3f4d7f5.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

df55fcfb-f679-43bd-9e7f-0dbf7216e164.tmp

Path C:\Users\Admin\AppData\Local\Temp\df55fcfb-f679-43bd-9e7f-0dbf7216e164.tmp
Size 158KB
SHA256 3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
MD5 9c18c4721b560ec55f0d5de055144d5c
SHA1 6af37a3bda916cac276ad5879c9f61262d9ae523
SHA512 51466928eb8d3cf7b917919c98bd8168453583d2c3dc5836036d87ffd0d2c732ab8450212a880fc6de199ea569a96993ba0d250a5012160d2d72211880695f92
SSDEEP 3072:5ZwEurOxn8zXnHc2qHNYEU/rUHCVJWGdi0Ha5HnXk9TFzBsuht7yGik:5ZwPOx8D85UIHEI0HaZ09JzKStjik
TLSH
T1CFF3E13E7EDE891AD80B10BB7F16B18BD80D8E0B460AB44B769D80155B3668D1BD1CFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Discord.btn

Path C:\Users\Admin\AppData\Local\Temp\ir_ext_temp_0\AutoPlay\Buttons\Discord.btn
Size 20KB
SHA256 d5d20708b3db048bf1e90b166b0a42f6e05a8b3978e3b062e9af8b240a95cf8d
MD5 290e2c1ae520efebcff62445b6f68d24
SHA1 d7c1c1b5b6bb566cc76b7770b44484b0e9c9f0b6
SHA512 88ee2a7c4d4b923e8ff79390aa08917d3e52da021649d3150d94f016776de6057c930f25733735a680031020020188ccae24345263f62e28cb941bded3258ef4
SSDEEP 384:92DV6e43XxXOH+L53F5ndS8cOUEq8fRwOs4Wa20jp0SX7m:aV67OH+t3F5IOqm9pjpHm
TLSH
T1F4A2E10373737425FACCDF6CCF9299AE51419520EEB724691432EDADF148860E1ADBC6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Exit.btn

Path C:\Users\Admin\AppData\Local\Temp\ir_ext_temp_0\AutoPlay\Buttons\Exit.btn
Size 5KB
SHA256 6da1f1b370f07b71ca1155dbbf48d4547c970189ab27b899e06abb7e72b932dd
MD5 aaeb6f13f130396dc404d3bf4ad81f89
SHA1 f29108dfffe089fc8437e33960ac5e9deedebabb
SHA512 20fb0004d2cb4f7180ed6ac700ce29cbe1d1056d6f23f004d57ed264dcf5bfa888632c4916a155923689c23380175e7d6fe1677b0c78943f20f9673424929030
SSDEEP 96:oeiiRYEO1SINo20yte6KJ744uh71mcmRWRooZ9GaIyK10:oenWSGR0y/4VpoqaIyh
TLSH
T165C17DB997E23A7DF96C0B30364A2A7A4539575648B2E00470681FFD61BFBFCC940714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Exit_1.btn

Path C:\Users\Admin\AppData\Local\Temp\ir_ext_temp_0\AutoPlay\Buttons\Exit_1.btn
Size 5KB
SHA256 f249120b09c51d1ca9677a8db72df8d9ed943e03d8ba154341cb4d96c9337a36
MD5 3cb0779e82e95cc4d4e6b3834db43d6c
SHA1 f757e2671776de6d40b81b559a745d1a622c46b2
SHA512 3f87edf1974104697d16dfb7034e0617ea94c0a0a56f5f62ed7c56887000d535f65b376488ca0587308afdf2e7f3107af533167d1098eb74ba6191f4a05f515d
SSDEEP 96:QfbTAYHpe1SINo20yte6KJ744uo6U1mcmRWRooZ9GaIyK1IW:AfAYGSGR0y/4OpoqaIyvW
TLSH
T18CC18E7957A33DBCFA3C0730394A376645395B4714B1A005B5A81EED60BFBF89640710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Patreon.btn

Path C:\Users\Admin\AppData\Local\Temp\ir_ext_temp_0\AutoPlay\Buttons\Patreon.btn
Size 21KB
SHA256 cc381c1fe05c6c95bffecae62c33f4d0c9fc21486e6ac374d9727ab5769602b6
MD5 42f9c56f7a52f4d3445f90c9b9a25d24
SHA1 861ac091e3bb67d1d745ff6c201d31b13f539a96
SHA512 607628080b0bdd9332e04436e1aae74b1c365fe31e3019120aad6b9805e7fedeebcff75a82af666cb9c5521745e9e1310acd2a6fbcaf303dff2dd2e5e465adfe
SSDEEP 384:z2S8jaIpVBviYyZiCaap5tkeEJxOeuHzQCJ21OiX714F4s6TeF+86:SNj3XxiYWiZGCeEJPZ711sMk+n
TLSH
T114A2D0AA15464335DE27C171F1BA3183CA45338A7A2DDB148B2E1228AEFC1C3CD59F47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PayPal.btn

Path C:\Users\Admin\AppData\Local\Temp\ir_ext_temp_0\AutoPlay\Buttons\PayPal.btn
Size 27KB
SHA256 94d30c667279359683e5b9dcf2a20c7bd4f0f9a5c88f3b03cb4356d3e42172c0
MD5 8cebf6a3b52102d7598387b1f885cbe1
SHA1 1a288a30fb28d3ccc2c717f96a6bfc73b0866f93
SHA512 a50894519b9e01dd9d292f21ff80b466c72663e2a12d22040cf02b9e203ead3cf75921ca26e3f404c501bb64ae6ca2abc21d0b401f949da7dbd2d0819daec85d
SSDEEP 768:3zWQuk27sjf5UgpJmvVPtH2lv5Fac8KxxMVkuaTvl+UZnL:3dnW0JcV6FaDEMKvvl++
TLSH
T1A7C2E15F7843DCA5CE55763630400764840BAF8DB99DA741CCE8EBD9A0DA4F611CAB4A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Youtube.btn

Path C:\Users\Admin\AppData\Local\Temp\ir_ext_temp_0\AutoPlay\Buttons\Youtube.btn
Size 30KB
SHA256 c542cee8a24d5dd112b5fe3e6d37ccb8f795c3d504574330fee8dd4acf1d415f
MD5 5c5fb9ec861063f6e64e1eab7b3dd467
SHA1 94938e7754a31d4ceeb576794f4f2ce8a9c38b51
SHA512 c4fcfda00ac46e61e5081da73d554068ca5801222f14624528e8da591eb9d6643b73f06832d993607f47517a7608ba023587b5341ef5a9ed90cd957f1f265503
SSDEEP 768:/IAfw0vGkDA8GIFV39yhpGN2RJDeTpnBPct22FVrfMINu5P:NfwWb2wTyTGUJD8npyLMd
TLSH
T1DBD2F1565D7A4E1CEA35317BB21E99C0C9666BCD21DEF82C22F0EDCDA6E88D19042147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

button.btn

Path C:\Users\Admin\AppData\Local\Temp\ir_ext_temp_0\AutoPlay\Buttons\button.btn
Size 3KB
SHA256 de16e0369e6ebe52d0bce306d216a61a90bd1e02ac6e51ac1a610a2677ca1d55
MD5 0de75b15ceea331012eece176c3a8c7c
SHA1 fc2a88c627c53c280879dd5e85d0aed26f587026
SHA512 3225c9f5abee7f42e65352bbc7020f0807a1e9b47b4d2e844e539b6ed6840090169181be80db7080da4d4977e04bd3120dc5b9933f62966a3d50acedda24f5c8
TLSH
T177612CFC38EB1C00DCAB2BF520CD80D75110A7694D0C338F5AB9108594E65D69E8DE0D
MD5 SHA1 SHA512 TLSH

Submit Download

button_1.btn

Path C:\Users\Admin\AppData\Local\Temp\ir_ext_temp_0\AutoPlay\Buttons\button_1.btn
Size 3KB
SHA256 128dbf94b895cefb60ee7f3609e93ffffef0a5c9decd4a63be99e369989dcc9c
MD5 57d5cd2cfb2ee9c65bbb73d056e85355
SHA1 c9659a619b5db4e433788c6f67d489dcab421eaf
SHA512 ecf4f5e65edb2687b40f0299bf93d7faa9a88f3de4ffc487d12589bf338790ef8d863839a8e12febfb1d426843050912351eb93503106e5c0189f4faa6c3ced8
TLSH
T1B0613A245AFA0B9CFE5350B4569E5CBBE45C0149ECF886AF4A882826E0D17DDD31DD48
MD5 SHA1 SHA512 TLSH

Submit Download

minimize.btn

Path C:\Users\Admin\AppData\Local\Temp\ir_ext_temp_0\AutoPlay\Buttons\minimize.btn
Size 6KB
SHA256 2c1fa95bbb0cc8b3ff13b2fcf1c432530325e2d065f84e200da42f2ed853f1f2
MD5 0817cc7fecfa8c77729ae5c1f5cdf6ca
SHA1 0e62d6aef9b67140b47b1ecfb52b2f5e9039e1c6
SHA512 7451e57e809d22e1fdb328d244ab58ab601c74323a434bfe57862f601d0d7edf6ca1a49dd5cc473a0a31f9c5be2267e66fda6e486b99c9998d80718a4203488a
SSDEEP 192:JKJLIRyKVyk2VAIBDyP6xtKuYJR8xUFV93W:YJLILL2xDZ+bR8xUFVhW
TLSH
T1DBD19E683F91A2F7C35F9D3D033AA271BA383126042BC4059511FD727F4A6B53428E6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Input_1.png

Path C:\Users\Admin\AppData\Local\Temp\ir_ext_temp_0\AutoPlay\Images\Input_1.png
Size 2KB
SHA256 aa6a603b893aa5280849c7586052c8ad7815471d19c55e30488c95c43f74525e
MD5 ffad5426f53d8fd6680016d5bfc650dc
SHA1 1ad572f05a9e78d631cbdcdb7556306e8c2dd521
SHA512 4e31b0c4b713fa63d8698971cb822975e9f5d8ef14d9643c4f1ce3edfc31b9019dc8447c8c9d466cefcba409d8a5a28bf5a1fdf63e0e39c8ca045be6811bf809
TLSH
T1EE418309F9209910CAADFD545DEDA2DB16238BD0EF509459ACEACA271D300BCCF9D1D3
MD5 SHA1 SHA512 TLSH

Submit Download

bg.jpg

Path C:\Users\Admin\AppData\Local\Temp\ir_ext_temp_0\AutoPlay\Images\bg.jpg
Size 45KB
SHA256 9a4f10a1010db2add89aaadeb271d4cc6064fb1d09b4f549e9b905b44fa86a6c
MD5 08fc0d0901c5d6615ed80a17c4d873ca
SHA1 7a54e902cceccc608a988b412502289699d563ee
SHA512 e35ade6c249a5984dc1ad4338c80a643a7142ca88ecdccb0d71e17fdee5a3f356f7e2ec9da0348ffd807cb9a927eff1e356675ee7dce88b322340df1e5549d2e
SSDEEP 768:rNn7gfRN5GYF/GjU2XkFSbeNnQIPTfIaomjRw6otR:J0fxF/qU2JbcrMmjRfa
TLSH
T105239D1837115C01ECD56D72D8B2E886A533AF4AEF47B2947C8DB11DBB74781AE0D622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

border.png

Path C:\Users\Admin\AppData\Local\Temp\ir_ext_temp_0\AutoPlay\Images\border.png
Size 4KB
SHA256 acb84ecf9508b26721172836be142db14c3c24603cca2ed9f193c1d964303d24
MD5 06819e7f323f45ac9face3e371c66208
SHA1 84bad47d3683e321ca2801dcf0e604c8a5e37eb9
SHA512 8b39fea27ebc2f6cfe0637aadf22be0a7498a68ef237e4900de033f20d72321ae1db81e652df680c19dab10e0101be6548fd91b772a7610e54fa38bc18771df1
SSDEEP 48:Lk/6IBVknA9WpcvRniBgMwKY3EqjHA6y30jHANtF+jojEkUkUkUkUkUkUkUkUkUD:QSOknmWp8RniOysjHbXjHoH+8a1
TLSH
T179A113325344A665823E6A059CEB2A49C33DE770C8526CE02D42C5C6FF2705E7E8FDE6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

logo.jpg

Path C:\Users\Admin\AppData\Local\Temp\ir_ext_temp_0\AutoPlay\Images\logo.jpg
Size 41KB
SHA256 30f83e1afd8044003ca677ef46bbd920a4b42fde0e20a43534cfd4653634a0af
MD5 82a8e3073a438e3435efc92e08f2a96f
SHA1 d708d52f557f0f0b8963bb1fbd354854f43c10bf
SHA512 8d5f657b0575231afcd089ca1b220c26683c80e0a039548d60734eda1d2cf62da17388d421c2295588c2d5c71b50609be64a5cd396e38b77c58ad4d3694132cd
SSDEEP 768:MJ78KpSsufbcggiZ77VeHWi0+34detjfFq/g:MGKp+bd8T0Jgpv
TLSH
T1CA13C016BBAA9DB1FDC1533D04A4D78B4230AEC45FA36393749EB2417F363828D48642
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sound on.png

Path C:\Users\Admin\AppData\Local\Temp\ir_ext_temp_0\AutoPlay\Images\sound on.png
Size 8KB
SHA256 8976050cd9ce6c08d8def55f3523d4a66d5a180358f63d6b261daf13c3b35622
MD5 2fa8e89bdf7c0cdeb1bcf2914fe8f0e1
SHA1 5ade04087d66d1bc61edd5823009b3002b709a50
SHA512 51f5a522b167f3743d6f8d6d97d3dd181db1db68f13b7fd3fdf701226a8e991e17bc598638418cd9e56fb053d0962258d114d7c5844a7bcead75ca200f42c2c8
SSDEEP 192:ISrknsZMqF7tF0D6BtdQ02+n/Lhyi1izuvdZqvEIHMdOypSSHWQydC:PAnwH0DiqiNyiCv5HMcGxfydC
TLSH
T11212AF0EB66561A01D6C8FD52AE4109909771FC0AF40A434ECCACD457DC47BD8B7ACD6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

autorun.cdd

Path C:\Users\Admin\AppData\Local\Temp\ir_ext_temp_0\AutoPlay\autorun.cdd
Size 2.1MB
SHA256 0430523d2397fa92ca7ebe280b8c94e46c37111a760df20d9ac0232d343c0a39
MD5 5f9c8a6d10ddef806b5c03c022fe7cb9
SHA1 d1706315901e170cbccee1ef2a35875d70dd6252
SHA512 7ca12e194f72cda8b21e17767c3260ec5a9da7d2ce67b31bd61a06bd38b2c46c1d5bb34c704826bfd94d8fc7260686fee9bd60fb6fb00e61b9a8c978e488e86c
SSDEEP 49152:xmFDmu1E12a/k0EIkci2mAJYj0gmHHc8tgH2ynKMdK:xm4u1isWkxsp8fH2cdK
TLSH
T185A5331E23D1CDCA600C4D5ADE3E8C9D01D98945676A34B14CDCFEABA4BAA4ED974C3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Mafia2.ico

Path C:\Users\Admin\AppData\Local\Temp\ir_ext_temp_0\Mafia2.ico
Size 363KB
SHA256 a44c986dba66aa757e85a4f361c75f7ea7597cc6b6c25cde03f5e274f3fc3825
MD5 bd9fc49bfaf8a94eac4384b808246511
SHA1 b638582577b409a1b8e626ea595569be86dc87a6
SHA512 16bb7c3bc13c3c2e42efb8326189f19be022261ba86f7f6c0aa48bcd52fd4001d63c32304a81c4ed73819a213356ab9c32176bfb306e7ec618dd26747ff4f2c4
SSDEEP 1536:0ATFVui2wO45JHyp418oXOaJdRTU3moXcoyCsqh:Vjsbmdw
TLSH
T17784D44BDC1D5BE2F39EE97C4225A1A841232ACD9F918CDF51B2EF46ED3916F1883181
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

autorun.exe

Path C:\Users\Admin\AppData\Local\Temp\ir_ext_temp_0\autorun.exe
Size 6.4MB
SHA256 17a83c9e78fe30bc898de92008a863a23b850e9b7902e32148a824729fdefda3
MD5 5fa00850c711ff24006a18fff2f497f1
SHA1 7c13df7a17a30bad68e9b9ffdae4c46b9ef684d6
SHA512 e2a886be587d5f60d15ba39af6c0ddf9972548263e3f7619dd6ec0a0edb8c839ac249d9a3c013b6707c173ccd11ec2305e25a97362f7494c38756430c1697ad2
SSDEEP 196608:CckXI2J+DclPbLeCQOn9zIYojD390brV3:CY2p7n9zQDq
TLSH
T17966AE23FECC41F6E29AA1354566A23C90B79DE45F208DC75261BF36FD306D3183A299
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lua5.1.dll

Path C:\Users\Admin\AppData\Local\Temp\ir_ext_temp_0\lua5.1.dll
Size 322KB
SHA256 f26f4f66022acc96d0319c09814ebeda60f4ab96b63b6262045dc786dc7c5866
MD5 c3256800dce47c14acc83ccca4c3e2ac
SHA1 9d126818c66991dbc3813a65eddb88bbcf77f30a
SHA512 6865a98ad8a6bd02d1ba35a28b36b6306af393f5e9ad767cd6da027bb021f7399d629423f510c44436ac3e4603b6c606493edf8b14d21fabf3eab16d37bd0d25
SSDEEP 6144:7kn2LG5bwf92+0HiDhAqUS0aMkhwfDRAOj+JzOg7Fa:Q2x2cdUhZcIDR8xha
TLSH
T10F64AE03B283C472D5A500B90569D7BA4E7A797157B6C4F7EBD01AAD8E203E0A73734E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Mafia II Definitive Edition.txt

Path C:\Users\Admin\AppData\Local\Temp\ir_ext_temp_0\update\Mafia II Definitive Edition.txt
Size 167B
SHA256 c70de70a79fe04a3ef5ed6a62f2e099587a5e4bc725ff6cf47bc1369e56a3dfa
MD5 aa27539aa40447730bd45aa6c783b2aa
SHA1 e14ef76032a1d53a7a467683954500e92c8d510a
SHA512 220ea59d83ab3a55da2f24c87969039261bc574b2d55517b9c94cbb37f63f32b0722b6c2b8a8f280ce41119fd35739059af6560d78e250dce1297e6f81044576
TLSH
T1E2C08C53EB6AE56F04D260FFB17F24AC6406D556C90C40C6561090009D305E403ECB04
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2640_1152729466\CRX_INSTALL\_locales\en_CA\messages.json
Size 711B
SHA256 2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b
MD5 558659936250e03cc14b60ebf648aa09
SHA1 32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825
SHA512 1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727
TLSH
T1460197136240AF18470BF05BB9023442A0B44AC62384E0B775EC982C6656DAFB20B3B0
MD5 SHA1 SHA512 TLSH

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2640_655949048\CRX_INSTALL\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b33cea34-edf5-4c59-a9bf-7ed86a5beea8.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2640_655949048\b33cea34-edf5-4c59-a9bf-7ed86a5beea8.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads