discordrat | 1083e87b86fb03ea2b8a8e0fd52c2c04460db954398490bdd970e29f48c7358d

Analysis

user interaction
yes
max time kernel
32s
max time network
41s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
31/10/2026, 15:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
AlexSpoofer.exe
Size 2.0MB
Sample261031-swwdract41
SHA256 1083e87b86fb03ea2b8a8e0fd52c2c04460db954398490bdd970e29f48c7358d
MD5 b7fbbc4db7969018ba299cde31216d12
SHA1 9865631a27184c2fc557d80eaeac5db2fbca56f0
SHA512 1a2aa03dcaa4c7a0ed3e321a816475f95b5cdcfab62cd98b0a5a24dbb5544374a84d453c5cfe379218c708c41c7eeaf8be44a1ffcb45c2bde0b032a1878984b4
SSDEEP 49152:z7Az1j1kOVv7eadh7ySCtxcGY87lJjz9DRMuRjOx:mtZheaddyLxySldzRFj
TLSH
T1C7A5331EBD8548D0E12F16F3993FCEB974152E1AFA4971E35DF4A3247C292C49A3C8A4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTQ1NjUxMTAxMTQ4NDk5MTUxMg.GkjdPC.1uebVAtTW4aFPpnL8MOpb5thn273RkunAg7aP4
server_id
1453910283012669594

Signatures

Family: Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Checks computer location settings 2 TTPs 5 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Control Panel\International\Geo\Nation	AlexSpoofer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Control Panel\International\Geo\Nation	WScript.exe

Executes dropped EXE 3 IoCs

pid	Process
64	AlexSpoofer.exe
3264	Launcher_2.exe
1692	Client-built.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 6 IoCs

execution

Visual Basic

T1059.005

pid	Process
2128	WScript.exe
2264	WScript.exe
1884	WScript.exe
4796	WScript.exe
3908	WScript.exe
1776	WScript.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3160	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Client-built.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Client-built.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	AlexSpoofer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	AlexSpoofer.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3660	msedge.exe
4840	msedge.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AlexSpoofer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	AlexSpoofer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Launcher_2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Launcher_2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-681733028-2344970462-962213935-1000\{BA52863E-A079-42FE-89B6-9C66EE01E52C}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings	AlexSpoofer.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings	cmd.exe

Modifies registry key 1 TTPs 64 IoCs

Modify Registry

T1112

pid	Process
3032	reg.exe
1708	reg.exe
5480	reg.exe
5760	reg.exe
5692	reg.exe
5068	reg.exe
2380	reg.exe
5832	reg.exe
4652	reg.exe
4904	reg.exe
5716	reg.exe
212	reg.exe
5028	reg.exe
5248	reg.exe
2856	reg.exe
552	reg.exe
5132	reg.exe
5600	reg.exe
2332	reg.exe
2160	reg.exe
2436	reg.exe
5532	reg.exe
4424	reg.exe
3508	reg.exe
2624	reg.exe
2624	reg.exe
5300	reg.exe
1064	reg.exe
4944	reg.exe
3024	reg.exe
1924	reg.exe
6108	reg.exe
6132	reg.exe
3228	reg.exe
2432	reg.exe
4412	reg.exe
5172	reg.exe
3532	reg.exe
3340	reg.exe
5396	reg.exe
2084	reg.exe
1680	reg.exe
680	reg.exe
4000	reg.exe
4100	reg.exe
3372	reg.exe
472	reg.exe
4428	reg.exe
3412	reg.exe
5696	reg.exe
4904	reg.exe
2192	reg.exe
2672	reg.exe
2700	reg.exe
5292	reg.exe
316	reg.exe
1372	reg.exe
2360	reg.exe
4428	reg.exe
2832	reg.exe
1112	reg.exe
5724	reg.exe
4992	reg.exe
4620	reg.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
64	AlexSpoofer.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
1092	msedge.exe
1092	msedge.exe
1092	msedge.exe
1092	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1692	Client-built.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1092	msedge.exe
1092	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
64	AlexSpoofer.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5956 wrote to memory of 64	5956	AlexSpoofer.exe	84
PID 5956 wrote to memory of 3264	5956	AlexSpoofer.exe	85
PID 5956 wrote to memory of 1692	5956	AlexSpoofer.exe	86
PID 64 wrote to memory of 1092	64	AlexSpoofer.exe	90
PID 1092 wrote to memory of 5868	1092	msedge.exe	91
PID 1092 wrote to memory of 3660	1092	msedge.exe	92
PID 1092 wrote to memory of 2328	1092	msedge.exe	93
PID 1092 wrote to memory of 2328	1092	msedge.exe	93
PID 1092 wrote to memory of 2328	1092	msedge.exe	93
PID 1092 wrote to memory of 2700	1092	msedge.exe	94
PID 1092 wrote to memory of 2700	1092	msedge.exe	94
PID 1092 wrote to memory of 472	1092	msedge.exe	96
PID 1092 wrote to memory of 2660	1092	msedge.exe	97
PID 1092 wrote to memory of 472	1092	msedge.exe	96
PID 1092 wrote to memory of 472	1092	msedge.exe	96
PID 1092 wrote to memory of 2660	1092	msedge.exe	97
PID 1092 wrote to memory of 2660	1092	msedge.exe	97
PID 1092 wrote to memory of 4100	1092	msedge.exe	100
PID 1092 wrote to memory of 4100	1092	msedge.exe	100
PID 1092 wrote to memory of 4100	1092	msedge.exe	100
PID 1092 wrote to memory of 3724	1092	msedge.exe	101
PID 1092 wrote to memory of 3724	1092	msedge.exe	101
PID 1092 wrote to memory of 3724	1092	msedge.exe	101
PID 1092 wrote to memory of 3456	1092	msedge.exe	102
PID 1092 wrote to memory of 3456	1092	msedge.exe	102
PID 1092 wrote to memory of 1152	1092	msedge.exe	103
PID 1152 wrote to memory of 1932	1152	msedge.exe	105
PID 1152 wrote to memory of 4840	1152	msedge.exe	106
PID 1152 wrote to memory of 4052	1152	msedge.exe	107
PID 1152 wrote to memory of 4560	1152	msedge.exe	108
PID 1152 wrote to memory of 4052	1152	msedge.exe	107
PID 1152 wrote to memory of 4052	1152	msedge.exe	107
PID 1152 wrote to memory of 4560	1152	msedge.exe	108
PID 1152 wrote to memory of 1868	1152	msedge.exe	114
PID 64 wrote to memory of 3160	64	AlexSpoofer.exe	121
PID 3160 wrote to memory of 2240	3160	cmd.exe	123
PID 3160 wrote to memory of 2300	3160	cmd.exe	124
PID 3160 wrote to memory of 2128	3160	cmd.exe	125
PID 2128 wrote to memory of 4292	2128	WScript.exe	126
PID 2128 wrote to memory of 1332	2128	WScript.exe	128
PID 2128 wrote to memory of 3264	2128	WScript.exe	130
PID 2128 wrote to memory of 3024	2128	WScript.exe	132
PID 2128 wrote to memory of 2004	2128	WScript.exe	192
PID 2128 wrote to memory of 5228	2128	WScript.exe	193
PID 2128 wrote to memory of 2084	2128	WScript.exe	138
PID 2128 wrote to memory of 1112	2128	WScript.exe	197
PID 2128 wrote to memory of 4372	2128	WScript.exe	142
PID 2128 wrote to memory of 2380	2128	WScript.exe	144
PID 2128 wrote to memory of 2624	2128	WScript.exe	146
PID 2128 wrote to memory of 3532	2128	WScript.exe	148
PID 2128 wrote to memory of 4428	2128	WScript.exe	150
PID 2128 wrote to memory of 5300	2128	WScript.exe	152
PID 2128 wrote to memory of 4100	2128	WScript.exe	154
PID 2128 wrote to memory of 544	2128	WScript.exe	156
PID 2128 wrote to memory of 4456	2128	WScript.exe	158
PID 2128 wrote to memory of 6108	2128	WScript.exe	160
PID 2128 wrote to memory of 5600	2128	WScript.exe	162
PID 2128 wrote to memory of 5292	2128	WScript.exe	164
PID 2128 wrote to memory of 2332	2128	WScript.exe	166
PID 2128 wrote to memory of 5068	2128	WScript.exe	168
PID 2128 wrote to memory of 3032	2128	WScript.exe	170
PID 2128 wrote to memory of 2160	2128	WScript.exe	227
PID 3160 wrote to memory of 2264	3160	cmd.exe	174
PID 2264 wrote to memory of 4608	2264	WScript.exe	175

C:\Users\Admin\AppData\Local\Temp\AlexSpoofer.exe
"C:\Users\Admin\AppData\Local\Temp\AlexSpoofer.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5956
- C:\Users\Admin\AppData\Local\Temp\4F620E7B\AlexSpoofer.exe
  "C:\Users\Admin\AppData\Local\Temp\4F620E7B\AlexSpoofer.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:64
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://guns.lol/manlikealex91
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1092
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x35c,0x7ffdb4e2c188,0x7ffdb4e2c194,0x7ffdb4e2c1a0
      4⤵
      PID:5868
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1956,i,13160784069662046295,12659599332735264826,524288 --field-trial-handle=2876,i,2147276922048933502,11708643026639060651,262144 --variations-seed-version --mojo-platform-channel-handle=2960 /prefetch:3
      4⤵
      System Time Discovery
      PID:3660
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1688,i,7922388487332640209,7903883650872306019,262144 --field-trial-handle=2876,i,2147276922048933502,11708643026639060651,262144 --variations-seed-version --mojo-platform-channel-handle=2872 /prefetch:2
      4⤵
      PID:2328
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2316,i,13448120570259650516,7476780686025997418,524288 --field-trial-handle=2876,i,2147276922048933502,11708643026639060651,262144 --variations-seed-version --mojo-platform-channel-handle=2972 /prefetch:8
      4⤵
      PID:2700
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3452,i,14873605548323161566,2584666590355856120,2097152 --field-trial-handle=2876,i,2147276922048933502,11708643026639060651,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
      4⤵
      PID:472
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3460,i,4286426331755842390,13179293973860919594,2097152 --field-trial-handle=2876,i,2147276922048933502,11708643026639060651,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:1
      4⤵
      PID:2660
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4956,i,8802891894941440121,11115965651953738919,2097152 --field-trial-handle=2876,i,2147276922048933502,11708643026639060651,262144 --variations-seed-version --mojo-platform-channel-handle=4976 /prefetch:1
      4⤵
      PID:4100
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=5652,i,9544693725666660264,5204509986130939372,2097152 --field-trial-handle=2876,i,2147276922048933502,11708643026639060651,262144 --variations-seed-version --mojo-platform-channel-handle=5640 /prefetch:1
      4⤵
      PID:3724
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5468,i,15813635601033657472,8515948694837541359,524288 --field-trial-handle=2876,i,2147276922048933502,11708643026639060651,262144 --variations-seed-version --mojo-platform-channel-handle=5452 /prefetch:8
      4⤵
      PID:3456
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
      4⤵
      Checks processor information in registry
      Enumerates system info in registry
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:1152
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2b4,0x7ffdb4e2c188,0x7ffdb4e2c194,0x7ffdb4e2c1a0
        5⤵
        
        PID:1932
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1892,i,9940724899449621324,4241169963693009453,524288 --field-trial-handle=2592,i,14125364053737416645,5304139442772443766,262144 --variations-seed-version --mojo-platform-channel-handle=2624 /prefetch:3
        5⤵
        System Time Discovery
        
        PID:4840
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1688,i,18073324702447481327,17794921280051792075,262144 --field-trial-handle=2592,i,14125364053737416645,5304139442772443766,262144 --variations-seed-version --mojo-platform-channel-handle=2580 /prefetch:2
        5⤵
        
        PID:4052
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2172,i,17360372820070836853,10635285514287673771,524288 --field-trial-handle=2592,i,14125364053737416645,5304139442772443766,262144 --variations-seed-version --mojo-platform-channel-handle=2668 /prefetch:8
        5⤵
        
        PID:4560
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4360,i,10247842523141617535,2743398691576369635,524288 --field-trial-handle=2592,i,14125364053737416645,5304139442772443766,262144 --variations-seed-version --mojo-platform-channel-handle=4376 /prefetch:8
        5⤵
        
        PID:552
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4360,i,10247842523141617535,2743398691576369635,524288 --field-trial-handle=2592,i,14125364053737416645,5304139442772443766,262144 --variations-seed-version --mojo-platform-channel-handle=4376 /prefetch:8
        5⤵
        
        PID:1868
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4768,i,15132294478901517947,15166071382278180061,524288 --field-trial-handle=2592,i,14125364053737416645,5304139442772443766,262144 --variations-seed-version --mojo-platform-channel-handle=4812 /prefetch:8
        5⤵
        
        PID:5440
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4804,i,10495092596204817296,460779971859676249,524288 --field-trial-handle=2592,i,14125364053737416645,5304139442772443766,262144 --variations-seed-version --mojo-platform-channel-handle=4856 /prefetch:8
        5⤵
        
        PID:5576
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4808,i,5940067243755294196,16856836335210465944,524288 --field-trial-handle=2592,i,14125364053737416645,5304139442772443766,262144 --variations-seed-version --mojo-platform-channel-handle=4156 /prefetch:8
        5⤵
        
        PID:5912
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3716,i,15703618474521825410,17023769885503734600,524288 --field-trial-handle=2592,i,14125364053737416645,5304139442772443766,262144 --variations-seed-version --mojo-platform-channel-handle=2420 /prefetch:8
        5⤵
        
        PID:4364
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3716,i,6677948222799194329,14103553047629433950,524288 --field-trial-handle=2592,i,14125364053737416645,5304139442772443766,262144 --variations-seed-version --mojo-platform-channel-handle=2840 /prefetch:8
        5⤵
        
        PID:4548
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ManLikeAlex91_64\start.bat"
    3⤵
    - Checks computer location settings
    - Executes a command shell one-liner
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:3160
  - - C:\Windows\system32\mode.com
      mode con: cols=80 lines=25
      4⤵
      PID:2240
  - - C:\Windows\system32\openfiles.exe
      openfiles
      4⤵
      PID:2300
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ManLikeAlex91_64\reg.vbs" delete "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TPM\WMI" /v "WindowsAIKHash" /f
      4⤵
      Checks computer location settings
      Executes a VBScript file via the Windows Script Host.
      Suspicious use of WriteProcessMemory
      PID:2128
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography" /v MachineGuid /t REG_SZ /d 89518-82061-62237-97806-81100 /f >nul 2>&1
        5⤵
        
        PID:4292
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v BuildGUID /t REG_SZ /d 42687-66720-84621-54820-54223 /f >nul 2>&1
        5⤵
        
        PID:1332
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e967-e325-11ce-bfc1-08002be10318}\Configuration\Variables\BusDeviceDesc" /v PropertyGuid /t REG_SZ /d {65500-41831-88936-37622-59368} /f >nul 2>&1
        5⤵
        
        PID:3264
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\Configuration\Variables\DeviceDesc" /v PropertyGuid /t REG_SZ /d {33652-91565-31730-97333-14426} /f >nul 2>&1
        5⤵
        
        PID:3024
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\Configuration\Variables\Driver" /v PropertyGuid /t REG_SZ /d {13849-83297-78854-68280-10003} /f >nul 2>&1
        5⤵
        
        PID:2004
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SystemInformation" /v ComputerHardwareId /t REG_SZ /d {55573-94987-42843-85374-95584} /f >nul 2>&1
        5⤵
        
        PID:5228
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD "HKLM\Software\Microsoft\Windows NT\CurrentVersion" /v InstallDate /t REG_SZ /d 32243 /f
        5⤵
        
        PID:2084
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD "HKLM\Software\Microsoft\Windows NT\CurrentVersion" /v ProductId /t REG_SZ /d 97562 /f
        5⤵
        
        PID:1112
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SOFTWARE\Microsoft\Cryptography /v GUID /t REG_SZ /d 46748-72339-19467-21987-38329 /f
        5⤵
        
        PID:4372
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid /t REG_SZ /d 90897-81881-42831-69981-12432 /f
        5⤵
        Modifies registry key
        
        PID:2380
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SOFTWARE\Microsoft\Windows" "NT\CurrentVersion /v BuildGUID /t REG_SZ /d 81188-24470 /f
        5⤵
        Modifies registry key
        
        PID:2624
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SOFTWARE\Microsoft\Windows" "NT\CurrentVersion /v InstallDate /t REG_SZ /d 59228 /f
        5⤵
        Modifies registry key
        
        PID:3532
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SOFTWARE\Microsoft\Windows" "NT\CurrentVersion /v ProductId /t REG_SZ /d 86095-50890-66505 /f
        5⤵
        Modifies registry key
        
        PID:4428
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SOFTWARE\Microsoft\Windows" "NT\CurrentVersion /v RegisteredOrganization /t REG_SZ /d FS22070 /f
        5⤵
        Modifies registry key
        
        PID:5300
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SOFTWARE\Microsoft\Windows" "NT\CurrentVersion /v RegisteredOwner /t REG_SZ /d FS58710 /f
        5⤵
        Modifies registry key
        
        PID:4100
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SYSTEM\CurrentControlSet\Control\ComputerName\ActiveComputerName /v ComputerName /t REG_SZ /d 95404 /f
        5⤵
        
        PID:544
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName /v ComputerName /t REG_SZ /d 18444 /f
        5⤵
        
        PID:4456
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SYSTEM\CurrentControlSet\Control\IDConfigDB\Hardware" "Profiles\0001 /v GUID /t REG_SZ /d {51443-63940-26449-48923-47598} /f
        5⤵
        Modifies registry key
        
        PID:6108
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SYSTEM\CurrentControlSet\Control\SystemInformation /v ComputerHardwareId /t REG_SZ /d {37799-44164-48970-34551-77810} /f
        5⤵
        Modifies registry key
        
        PID:5600
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SYSTEM\HardwareConfig /v LastConfig /t REG_SZ /d {64606} /f
        5⤵
        Modifies registry key
        
        PID:5292
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\Software\Microsoft\Windows NT\CurrentVersion /v InstallDate /t REG_SZ /d 91005 /f
        5⤵
        Modifies registry key
        
        PID:2332
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\System\CurrentControlSet\Control\SystemInformation /v ComputerHardwareId /t REG_SZ /d 23967 /f
        5⤵
        Modifies registry key
        
        PID:5068
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\System\CurrentControlSet\Control\WMI\Security /v 671a8285-4edb-4cae-99fe-69a15c48c0bc /t REG_SZ /d 43348 /f
        5⤵
        Modifies registry key
        
        PID:3032
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion" "WindowsUpdate /v SusClientId /t REG_SZ /d {86423-31991-81383-89307-23340} /f
        5⤵
        Modifies registry key
        
        PID:2160
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ManLikeAlex91_64\reg.vbs" delete "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TPM\WMI" /v "TaskManufacturerId" /f
      4⤵
      Checks computer location settings
      Executes a VBScript file via the Windows Script Host.
      Suspicious use of WriteProcessMemory
      PID:2264
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography" /v MachineGuid /t REG_SZ /d 92682-85225-65401-10970-84264 /f >nul 2>&1
        5⤵
        
        PID:4608
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v BuildGUID /t REG_SZ /d 51460-75493-93394-63593-62995 /f >nul 2>&1
        5⤵
        
        PID:5440
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e967-e325-11ce-bfc1-08002be10318}\Configuration\Variables\BusDeviceDesc" /v PropertyGuid /t REG_SZ /d {85490-61821-18925-57611-79358} /f >nul 2>&1
        5⤵
        
        PID:5208
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\Configuration\Variables\DeviceDesc" /v PropertyGuid /t REG_SZ /d {53642-21554-51719-27322-34416} /f >nul 2>&1
        5⤵
        
        PID:2300
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\Configuration\Variables\Driver" /v PropertyGuid /t REG_SZ /d {17013-86461-82018-71444-13167} /f >nul 2>&1
        5⤵
        
        PID:5240
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SystemInformation" /v ComputerHardwareId /t REG_SZ /d {36039-75453-23309-65840-76051} /f >nul 2>&1
        5⤵
        
        PID:4808
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD "HKLM\Software\Microsoft\Windows NT\CurrentVersion" /v InstallDate /t REG_SZ /d 13236 /f
        5⤵
        
        PID:3212
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD "HKLM\Software\Microsoft\Windows NT\CurrentVersion" /v ProductId /t REG_SZ /d 78028 /f
        5⤵
        
        PID:4032
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SOFTWARE\Microsoft\Cryptography /v GUID /t REG_SZ /d 27478-53069-90197-92717-19059 /f
        5⤵
        Modifies registry key
        
        PID:5248
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:2004
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid /t REG_SZ /d 82844-73828-34778-61928-94379 /f
        5⤵
        
        PID:5228
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SOFTWARE\Microsoft\Windows" "NT\CurrentVersion /v BuildGUID /t REG_SZ /d 73135-16417 /f
        5⤵
        Modifies registry key
        
        PID:2832
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SOFTWARE\Microsoft\Windows" "NT\CurrentVersion /v InstallDate /t REG_SZ /d 34613 /f
        5⤵
        Modifies registry key
        
        PID:1112
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SOFTWARE\Microsoft\Windows" "NT\CurrentVersion /v ProductId /t REG_SZ /d 60953-25748-41362 /f
        5⤵
        Modifies registry key
        
        PID:5028
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SOFTWARE\Microsoft\Windows" "NT\CurrentVersion /v RegisteredOrganization /t REG_SZ /d FS81847 /f
        5⤵
        Modifies registry key
        
        PID:5724
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SOFTWARE\Microsoft\Windows" "NT\CurrentVersion /v RegisteredOwner /t REG_SZ /d FS39176 /f
        5⤵
        Modifies registry key
        
        PID:316
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SYSTEM\CurrentControlSet\Control\ComputerName\ActiveComputerName /v ComputerName /t REG_SZ /d 87351 /f
        5⤵
        Modifies registry key
        
        PID:1064
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName /v ComputerName /t REG_SZ /d 16000 /f
        5⤵
        Modifies registry key
        
        PID:6132
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SYSTEM\CurrentControlSet\Control\IDConfigDB\Hardware" "Profiles\0001 /v GUID /t REG_SZ /d {43390-55887-18396-40870-39545} /f
        5⤵
        Modifies registry key
        
        PID:3340
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SYSTEM\CurrentControlSet\Control\SystemInformation /v ComputerHardwareId /t REG_SZ /d {18529-24894-29700-15281-58540} /f
        5⤵
        
        PID:4892
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SYSTEM\HardwareConfig /v LastConfig /t REG_SZ /d {34383} /f
        5⤵
        Modifies registry key
        
        PID:4944
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\Software\Microsoft\Windows NT\CurrentVersion /v InstallDate /t REG_SZ /d 54909 /f
        5⤵
        Modifies registry key
        
        PID:2856
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\System\CurrentControlSet\Control\SystemInformation /v ComputerHardwareId /t REG_SZ /d 66655 /f
        5⤵
        
        PID:2616
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\System\CurrentControlSet\Control\WMI\Security /v 671a8285-4edb-4cae-99fe-69a15c48c0bc /t REG_SZ /d 69210 /f
        5⤵
        Modifies registry key
        
        PID:5396
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion" "WindowsUpdate /v SusClientId /t REG_SZ /d {22284-57853-17245-25168-49201} /f
        5⤵
        Modifies registry key
        
        PID:1708
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ManLikeAlex91_64\reg.vbs" delete "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TPM\WMI" /v "TaskInformationFlags" /f
      4⤵
      Checks computer location settings
      Executes a VBScript file via the Windows Script Host.
      PID:1884
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography" /v MachineGuid /t REG_SZ /d 94001-86543-66720-12288-85582 /f >nul 2>&1
        5⤵
        
        PID:3964
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:2160
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v BuildGUID /t REG_SZ /d 41561-65594-83495-53694-53097 /f >nul 2>&1
        5⤵
        
        PID:3524
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e967-e325-11ce-bfc1-08002be10318}\Configuration\Variables\BusDeviceDesc" /v PropertyGuid /t REG_SZ /d {77700-54031-11136-49822-71568} /f >nul 2>&1
        5⤵
        
        PID:3940
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\Configuration\Variables\DeviceDesc" /v PropertyGuid /t REG_SZ /d {51461-19374-49539-25142-32235} /f >nul 2>&1
        5⤵
        
        PID:5912
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\Configuration\Variables\Driver" /v PropertyGuid /t REG_SZ /d {37266-16714-12272-91697-33421} /f >nul 2>&1
        5⤵
        
        PID:636
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SystemInformation" /v ComputerHardwareId /t REG_SZ /d {78990-28404-66260-18791-29002} /f >nul 2>&1
        5⤵
        
        PID:4564
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD "HKLM\Software\Microsoft\Windows NT\CurrentVersion" /v InstallDate /t REG_SZ /d 72485 /f
        5⤵
        
        PID:1332
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD "HKLM\Software\Microsoft\Windows NT\CurrentVersion" /v ProductId /t REG_SZ /d 64367 /f
        5⤵
        
        PID:4196
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SOFTWARE\Microsoft\Cryptography /v GUID /t REG_SZ /d 25033-50625-87752-90272-16615 /f
        5⤵
        Modifies registry key
        
        PID:2436
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid /t REG_SZ /d 80399-71383-32333-59483-91935 /f
        5⤵
        Modifies registry key
        
        PID:3228
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SOFTWARE\Microsoft\Windows" "NT\CurrentVersion /v BuildGUID /t REG_SZ /d 76299-19581 /f
        5⤵
        Modifies registry key
        
        PID:552
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SOFTWARE\Microsoft\Windows" "NT\CurrentVersion /v InstallDate /t REG_SZ /d 54339 /f
        5⤵
        
        PID:2340
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SOFTWARE\Microsoft\Windows" "NT\CurrentVersion /v ProductId /t REG_SZ /d 81206-46001-61616 /f
        5⤵
        Modifies registry key
        
        PID:2084
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SOFTWARE\Microsoft\Windows" "NT\CurrentVersion /v RegisteredOrganization /t REG_SZ /d FS11573 /f
        5⤵
        Modifies registry key
        
        PID:5480
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SOFTWARE\Microsoft\Windows" "NT\CurrentVersion /v RegisteredOwner /t REG_SZ /d FS59429 /f
        5⤵
        Modifies registry key
        
        PID:5832
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SYSTEM\CurrentControlSet\Control\ComputerName\ActiveComputerName /v ComputerName /t REG_SZ /d 33903 /f
        5⤵
        
        PID:116
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName /v ComputerName /t REG_SZ /d 58687 /f
        5⤵
        Modifies registry key
        
        PID:3372
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SYSTEM\CurrentControlSet\Control\IDConfigDB\Hardware" "Profiles\0001 /v GUID /t REG_SZ /d {76393-88890-51399-73873-72548} /f
        5⤵
        Modifies registry key
        
        PID:1372
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SYSTEM\CurrentControlSet\Control\SystemInformation /v ComputerHardwareId /t REG_SZ /d {44341-50706-55513-41093-84352} /f
        5⤵
        Modifies registry key
        
        PID:5760
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SYSTEM\HardwareConfig /v LastConfig /t REG_SZ /d {65277} /f
        5⤵
        Modifies registry key
        
        PID:472
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\Software\Microsoft\Windows NT\CurrentVersion /v InstallDate /t REG_SZ /d 91939 /f
        5⤵
        
        PID:6044
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\System\CurrentControlSet\Control\SystemInformation /v ComputerHardwareId /t REG_SZ /d 92467 /f
        5⤵
        Modifies registry key
        
        PID:2432
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\System\CurrentControlSet\Control\WMI\Security /v 671a8285-4edb-4cae-99fe-69a15c48c0bc /t REG_SZ /d 15712 /f
        5⤵
        Modifies registry key
        
        PID:4992
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:4944
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion" "WindowsUpdate /v SusClientId /t REG_SZ /d {70531-16100-65491-73415-97448} /f
        5⤵
        Modifies registry key
        
        PID:5696
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ManLikeAlex91_64\reg.vbs" delete "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TPM\WMI\TaskStates" /f
      4⤵
      Executes a VBScript file via the Windows Script Host.
      PID:4796
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography" /v MachineGuid /t REG_SZ /d 57856-50398-30575-66143-49437 /f >nul 2>&1
        5⤵
        
        PID:2332
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v BuildGUID /t REG_SZ /d 91389-25422-43323-13523-12925 /f >nul 2>&1
        5⤵
        
        PID:5952
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e967-e325-11ce-bfc1-08002be10318}\Configuration\Variables\BusDeviceDesc" /v PropertyGuid /t REG_SZ /d {30338-96669-53774-92460-24206} /f >nul 2>&1
        5⤵
        
        PID:5400
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\Configuration\Variables\DeviceDesc" /v PropertyGuid /t REG_SZ /d {87963-55876-86041-61644-68737} /f >nul 2>&1
        5⤵
        
        PID:1032
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\Configuration\Variables\Driver" /v PropertyGuid /t REG_SZ /d {68687-48135-43692-33118-64842} /f >nul 2>&1
        5⤵
        
        PID:3784
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SystemInformation" /v ComputerHardwareId /t REG_SZ /d {25492-64906-12762-55293-65504} /f >nul 2>&1
        5⤵
        
        PID:3524
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD "HKLM\Software\Microsoft\Windows NT\CurrentVersion" /v InstallDate /t REG_SZ /d 13906 /f
        5⤵
        
        PID:5440
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD "HKLM\Software\Microsoft\Windows NT\CurrentVersion" /v ProductId /t REG_SZ /d 90179 /f
        5⤵
        
        PID:1348
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SOFTWARE\Microsoft\Cryptography /v GUID /t REG_SZ /d 80470-16062-53189-55709-72052 /f
        5⤵
        Modifies registry key
        
        PID:5532
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid /t REG_SZ /d 33037-24021-74971-12121-44573 /f
        5⤵
        Modifies registry key
        
        PID:4424
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SOFTWARE\Microsoft\Windows" "NT\CurrentVersion /v BuildGUID /t REG_SZ /d 34018-67300 /f
        5⤵
        Modifies registry key
        
        PID:4652
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SOFTWARE\Microsoft\Windows" "NT\CurrentVersion /v InstallDate /t REG_SZ /d 96977 /f
        5⤵
        Modifies registry key
        
        PID:3024
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SOFTWARE\Microsoft\Windows" "NT\CurrentVersion /v ProductId /t REG_SZ /d 33317-88112-13726 /f
        5⤵
        Modifies registry key
        
        PID:4904
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:3228
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SOFTWARE\Microsoft\Windows" "NT\CurrentVersion /v RegisteredOrganization /t REG_SZ /d FS54211 /f
        5⤵
        Modifies registry key
        
        PID:2192
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SOFTWARE\Microsoft\Windows" "NT\CurrentVersion /v RegisteredOwner /t REG_SZ /d FS95931 /f
        5⤵
        Modifies registry key
        
        PID:5692
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SYSTEM\CurrentControlSet\Control\ComputerName\ActiveComputerName /v ComputerName /t REG_SZ /d 59715 /f
        5⤵
        
        PID:5612
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:2084
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName /v ComputerName /t REG_SZ /d 80473 /f
        5⤵
        Modifies registry key
        
        PID:3508
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SYSTEM\CurrentControlSet\Control\IDConfigDB\Hardware" "Profiles\0001 /v GUID /t REG_SZ /d {23472-35969-88478-20952-19627} /f
        5⤵
        Modifies registry key
        
        PID:1680
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SYSTEM\CurrentControlSet\Control\SystemInformation /v ComputerHardwareId /t REG_SZ /d {97718-14083-18890-94470-47729} /f
        5⤵
        
        PID:5724
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SYSTEM\HardwareConfig /v LastConfig /t REG_SZ /d {23572} /f
        5⤵
        
        PID:888
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\Software\Microsoft\Windows NT\CurrentVersion /v InstallDate /t REG_SZ /d 49707 /f
        5⤵
        Modifies registry key
        
        PID:4428
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\System\CurrentControlSet\Control\SystemInformation /v ComputerHardwareId /t REG_SZ /d 67325 /f
        5⤵
        Modifies registry key
        
        PID:680
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\System\CurrentControlSet\Control\WMI\Security /v 671a8285-4edb-4cae-99fe-69a15c48c0bc /t REG_SZ /d 86178 /f
        5⤵
        Modifies registry key
        
        PID:2672
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion" "WindowsUpdate /v SusClientId /t REG_SZ /d {45389-80957-40349-48273-72306} /f
        5⤵
        
        PID:5220
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ManLikeAlex91_64\reg.vbs" delete "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TPM\WMI\PlatformQuoteKeys" /f
      4⤵
      Executes a VBScript file via the Windows Script Host.
      PID:3908
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography" /v MachineGuid /t REG_SZ /d 40431-32974-13150-48719-32013 /f >nul 2>&1
        5⤵
        
        PID:5276
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v BuildGUID /t REG_SZ /d 77464-11497-29398-89597-89000 /f >nul 2>&1
        5⤵
        
        PID:5600
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e967-e325-11ce-bfc1-08002be10318}\Configuration\Variables\BusDeviceDesc" /v PropertyGuid /t REG_SZ /d {27630-93961-51066-89752-21498} /f >nul 2>&1
        5⤵
        
        PID:1928
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\Configuration\Variables\DeviceDesc" /v PropertyGuid /t REG_SZ /d {85255-53168-83333-58936-66029} /f >nul 2>&1
        5⤵
        
        PID:4004
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\Configuration\Variables\Driver" /v PropertyGuid /t REG_SZ /d {65979-45427-40984-30410-62133} /f >nul 2>&1
        5⤵
        
        PID:392
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SystemInformation" /v ComputerHardwareId /t REG_SZ /d {17176-56590-94445-46977-57187} /f >nul 2>&1
        5⤵
        
        PID:2516
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD "HKLM\Software\Microsoft\Windows NT\CurrentVersion" /v InstallDate /t REG_SZ /d 95590 /f
        5⤵
        
        PID:3964
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD "HKLM\Software\Microsoft\Windows NT\CurrentVersion" /v ProductId /t REG_SZ /d 66883 /f
        5⤵
        
        PID:4608
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SOFTWARE\Microsoft\Cryptography /v GUID /t REG_SZ /d 21941-47532-84660-87180-13522 /f
        5⤵
        Modifies registry key
        
        PID:4620
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:3524
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid /t REG_SZ /d 75197-66181-27131-54281-86733 /f
        5⤵
        Modifies registry key
        
        PID:4412
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SOFTWARE\Microsoft\Windows" "NT\CurrentVersion /v BuildGUID /t REG_SZ /d 99140-42422 /f
        5⤵
        Modifies registry key
        
        PID:2700
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SOFTWARE\Microsoft\Windows" "NT\CurrentVersion /v InstallDate /t REG_SZ /d 71571 /f
        5⤵
        Modifies registry key
        
        PID:3412
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SOFTWARE\Microsoft\Windows" "NT\CurrentVersion /v ProductId /t REG_SZ /d 92830-57625-73239 /f
        5⤵
        Modifies registry key
        
        PID:4000
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:2436
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SOFTWARE\Microsoft\Windows" "NT\CurrentVersion /v RegisteredOrganization /t REG_SZ /d FS28805 /f
        5⤵
        Modifies registry key
        
        PID:4904
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SOFTWARE\Microsoft\Windows" "NT\CurrentVersion /v RegisteredOwner /t REG_SZ /d FS65444 /f
        5⤵
        Modifies registry key
        
        PID:5716
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SYSTEM\CurrentControlSet\Control\ComputerName\ActiveComputerName /v ComputerName /t REG_SZ /d 36419 /f
        5⤵
        
        PID:3020
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName /v ComputerName /t REG_SZ /d 44378 /f
        5⤵
        
        PID:1888
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SYSTEM\CurrentControlSet\Control\IDConfigDB\Hardware" "Profiles\0001 /v GUID /t REG_SZ /d {65632-78129-40638-63112-61787} /f
        5⤵
        Modifies registry key
        
        PID:212
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SYSTEM\CurrentControlSet\Control\SystemInformation /v ComputerHardwareId /t REG_SZ /d {44797-51162-55969-41549-84808} /f
        5⤵
        Modifies registry key
        
        PID:2624
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SYSTEM\HardwareConfig /v LastConfig /t REG_SZ /d {84026} /f
        5⤵
        Modifies registry key
        
        PID:5132
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\Software\Microsoft\Windows NT\CurrentVersion /v InstallDate /t REG_SZ /d 14816 /f
        5⤵
        Modifies registry key
        
        PID:1924
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:3372
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\System\CurrentControlSet\Control\SystemInformation /v ComputerHardwareId /t REG_SZ /d 61944 /f
        5⤵
        Modifies registry key
        
        PID:2360
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\System\CurrentControlSet\Control\WMI\Security /v 671a8285-4edb-4cae-99fe-69a15c48c0bc /t REG_SZ /d 45679 /f
        5⤵
        Modifies registry key
        
        PID:5172
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion" "WindowsUpdate /v SusClientId /t REG_SZ /d {63083-98652-58044-65967-90000} /f
        5⤵
        
        PID:4524
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ManLikeAlex91_64\reg.vbs" delete "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TPM\WMI\Endorsement\EKCertStoreECC\Certificates" /f
      4⤵
      Executes a VBScript file via the Windows Script Host.
      PID:1776
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography" /v MachineGuid /t REG_SZ /d 96744-89287-69463-15032-88326 /f >nul 2>&1
        5⤵
        
        PID:5624
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v BuildGUID /t REG_SZ /d 19875-43908-61809-32008-31411 /f >nul 2>&1
        5⤵
        
        PID:5996
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e967-e325-11ce-bfc1-08002be10318}\Configuration\Variables\BusDeviceDesc" /v PropertyGuid /t REG_SZ /d {72726-49057-96162-44848-66594} /f >nul 2>&1
        5⤵
        
        PID:5144
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\Configuration\Variables\DeviceDesc" /v PropertyGuid /t REG_SZ /d {27666-85579-25744-91347-98440} /f >nul 2>&1
        5⤵
        
        PID:3304
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\Configuration\Variables\Driver" /v PropertyGuid /t REG_SZ /d {43509-22957-18515-97940-39664} /f >nul 2>&1
        5⤵
        
        PID:3020
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SystemInformation" /v ComputerHardwareId /t REG_SZ /d {64332-13746-51601-94133-14343} /f >nul 2>&1
        5⤵
        
        PID:556
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:116
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD "HKLM\Software\Microsoft\Windows NT\CurrentVersion" /v InstallDate /t REG_SZ /d 34188 /f
        5⤵
        
        PID:4284
    - - C:\Windows\System32\reg.exe
        
        "C:\Windows\System32\reg.exe" ADD "HKLM\Software\Microsoft\Windows NT\CurrentVersion" /v ProductId /t REG_SZ /d 82419 /f
        5⤵
        
        PID:4916
- C:\Users\Admin\AppData\Local\Temp\4F620E7B\Launcher_2.exe
  "C:\Users\Admin\AppData\Local\Temp\4F620E7B\Launcher_2.exe"
  2⤵
  - Executes dropped EXE
  - Checks processor information in registry
  PID:3264
- C:\Users\Admin\AppData\Local\Temp\4F620E7B\Client-built.exe
  "C:\Users\Admin\AppData\Local\Temp\4F620E7B\Client-built.exe"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious use of AdjustPrivilegeToken
  PID:1692

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4108

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2192

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1112

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

10360f27-8cf5-4feb-a7c5-9c132823d1a6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\10360f27-8cf5-4feb-a7c5-9c132823d1a6.tmp
Size 26KB
SHA256 59d4a1be0866a0a198f958d2f6a7283ba24892a07ae317cc5a35273efe66c666
MD5 fed4645769bc64f08dad8165466e6550
SHA1 4f0c2ee504c8ea717784eb48dafbaa934efb4b04
SHA512 29e7eb23a9b6f947f073f7a801c11f5605aa204343ec6b3173c8b85ca972a3e364c5f958fb597684f0eb390a9cd4a42991c7d66a9f80e36f4a0e84a720423e3b
SSDEEP 384:n+iFiZcI63sN78TUNTUlIm25mgjhBKzfMBaLXJIhom7O6R2FeoCrgL/7IzNo2:VFQ63qwgSSZBERm7TRn5R
TLSH
T140C26C32E899CEBBECEB8B95A74A7A47DDF0516385CC8AC0E5D84D1C008759D170BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1bcb5b09-6a9e-4f18-b86d-6e96711ea773.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\1bcb5b09-6a9e-4f18-b86d-6e96711ea773.tmp
Size 29KB
SHA256 46b19d7378531ada2208ef9b334981846cbce64485bec36fb3852b32df4360f4
MD5 82e2287d3022b4fdc5c705d7a6f8a91d
SHA1 4c76e90941e9268e1d27afbe05bf15d1fab9fe86
SHA512 e84035c58e6e3272cab0e645f9b7a647d4ba62af96ee7a9961573bd4be98e767dc66a5b2ea18601af5b6eca4d2bd8f2266147672045c02ceb1ddd1066e83158e
SSDEEP 384:nIiFNZcI/sN/8TUNTUlI4K5mgnp0KzfMBaLXJIhoYzASTLowkOr+dDJgL/7Izs8i:TFV/awg+AEBE35SIwkOr+dbi
TLSH
T1AED20875D894DDEBA8E6DED59646FA02EEE44133819C498CD5F8AD3C209F4BC0307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

910a4ce4-faa6-464f-b553-d2378ac9a52b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\910a4ce4-faa6-464f-b553-d2378ac9a52b.tmp
Size 24KB
SHA256 bc28661f0e6d81da9dc5efaa77c0f7df7ada2f18ccaf7b6d079bab79fc7959ae
MD5 99935143683e99b5f9e657e20646d6e4
SHA1 12a2ef15fa4cd370eadc3aba18e48d20cbab552f
SHA512 b4480e225d18fa27e9f04a9a71a54d27ab424f7e1e1cfa93aca73e1659198bb6e0e056292c1379729260db148a2f988f5b58561b955d9a9e2ddd7b8717d04743
SSDEEP 384:nIiFuQkUSvKsNE8TUNTUlI485mgnP0KzfMBaLXJIh0wyKDJ/Izs/all:TFeKRwgS6EBElwyKJall
TLSH
T115B24A76E899CE7BACEB8F95A64A7643DEE0516389CC8ED4EAC94D1C00C71CD170BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b7c7b629cf980554ba201945f9dbcd1c64e77cc796fc6d8aedbe4749bf0d2698
MD5 844568391c8d79f46705230953f1d7f9
SHA1 a9cd387c1c5dddc3c8fa77739776f3408ec661d4
SHA512 85a2814e7f88919b1be438203c2053dccaf55dcefa377da5cfa8fa7daf780315b818c6b4ce3d02d6cc49b8673ba077bf7b9fd475c54c978185fc230f70cd9b53
TLSH
T13CD02B449DC43A64E942243A22185281B14489550A07244041E303940C813B200840D1
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 db759c3c3934bf56069e934969b7b09f586fed452182c151bd01633b9b27bf87
MD5 ab67867c211ab688848725ec145740f0
SHA1 c091eed57aaf62fb4b4c293d73ad6ac09823e67a
SHA512 36ec910e186d3dbb24e30337fbca8d6f6bcd7a8f248a4d5f5379e227776ea65d887c40363ac37f303049490eb20265c1934114c84ce3526c2d0868d9793068a6
TLSH
T177D02B4899C83A64E956243A22185281B0448D550A07244041A303840C413B200840D1
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 452ef3ee03770726fe2287056b673e2f8aae5a7c9f2464b08b02d114c3d817bc
MD5 81fb3d9abdc2c3416d295ce2a659d7c8
SHA1 de60b73bf29e7ef44e3ff43927fa0018138edde3
SHA512 e9ab5876653c0cf848e042bdc9a2c87bdb688c6b8993320ee113d8dbb741d14e2d216089b0a2813a870c5d3e3ffacef21a90806c3d854b2d6545f36c484f1714
TLSH
T1F5D0805855D53A69FA69257E32195241B288CD551E175151C16307464F463B201D50D1
MD5 SHA1 SHA512 TLSH

Submit Download

36096ece-0de8-4a91-9fd7-05db728419df.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\36096ece-0de8-4a91-9fd7-05db728419df.tmp
Size 13KB
SHA256 00c25a1b57cf3dfb82e12dc735fa12300b5a4792646b1fa1313dfdeeca12f2f1
MD5 de55d7400b9a5ab677514087fe6c076b
SHA1 081dc81127b015fe93b915c3f7778ae18542c20c
SHA512 78f853af95054b8253636bcdc5a35bf565f7c8fc51dee078b67b304d3e330c9796c56d9a27d91b3aea3ac50696547e22dfb3022486a87e381d217bb4cff1a3c5
SSDEEP 384:sxZBvG/frssWvzOZNCipHb8fCW/kmY7Zz:sJvG/fDYzbQHb8fCMkmY
TLSH
T1F952E815AD28997B9CC7D21DFB557F52E3F9502390D51E48AAFC8A2C14EB6DC220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

55de01da-ba08-4edc-84ab-1d0519bf2ca1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\55de01da-ba08-4edc-84ab-1d0519bf2ca1.tmp
Size 13KB
SHA256 2b89ee16d9b682ff3fce38df2a25475497359354a80583e7ce47569e7f458669
MD5 2c4404549858d90445a187b4b6b6ab13
SHA1 f06f9525f678b99b25e6fd2e1262cac9a6f8f06c
SHA512 4618552c692172e8c382ef9886c18cf32c93b6bf9df34e93c3de5768594e053f1ef34762fdfc3a70146a8dec8768dc4ea1b00c35c414eb5865d563e55f42c29d
SSDEEP 384:sxZBvG/frstWvzOZNCipHb8fCW/kKYCZz:sJvG/feYzbQHb8fCMkKh
TLSH
T1C352F915AD28697B9CC7D21DFA557F52E3F9113390C15E48AAFC8A2C10EB6CC220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

93c2e864-0b4d-4ce0-9f10-50f79f797e6c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\93c2e864-0b4d-4ce0-9f10-50f79f797e6c.tmp
Size 414B
SHA256 a5f235f931a6fe072bcbf39545790212c6565d4311fd6a8a21411da9872dd00d
MD5 175f67cdb048b1a3b458761dd9308951
SHA1 14b2ae3bc7770e05b2138505c777930f39701b96
SHA512 a0516213521b0576e58d7d941746c0730057c104fbcb57ce83fd53c8b14f55ca9e9db3140b5e35dee6a87bf2a6b51610121062522900bd7165d54630b89574ed
TLSH
T1B8E02BF9C91AAC3719FC472850541785EA5153472A80944F373C810D8FF1A36458ACAC
MD5 SHA1 SHA512 TLSH

Submit Download

9a63966c-aed8-4080-8ce5-29c1dd9592a4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9a63966c-aed8-4080-8ce5-29c1dd9592a4.tmp
Size 32KB
SHA256 64f2af6ccff6f1dbc571deccdb60f91476033110071b7b479f758a717f18790d
MD5 cdd2de35afb38c730106d7cb3baa8595
SHA1 413bd9ece60f5dfd8d65dab8c91a7b6d99aea0c8
SHA512 3caae7fa1f1ed20ac18b376804368ae5181d9fbbb9a534b80d3f75c0bc84df9057749840e17c7891dd754fb4d5cb577ac308fa66a3bcd5fb4ceb2bba36cabd46
SSDEEP 768:0RyktjU7pLuLbvnWvDBtt8F1+UoAYDCx9Tuqh0VfUC9xbog/OVvwLWLlMC7fnrok:0RyktjYEbvnWvDBttu1jaywLWLywf0Lo
TLSH
T1A2E2EB3F780CCA7E4FC04E9DDD6A7E8B6DA802CB9698894047FA945C02C67EA51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 e7b0f3fe4ba9883063cf65410f9a675115a0373d751ece6e036847e3ddbeaca1
MD5 f27955c852386147109de87711769685
SHA1 49b1af6321b11887f28625b40bc881345d309214
SHA512 28f6cfd5b2fee8b3c329986cf9bde99bd6546aaa3b811cf0f99eebaae8d3abea3f83792c83781a47fc22565c80dddccd7b8edafc3d3156e6c7d5539b229e45df
SSDEEP 384:QUCjC5MlAhL+EMT7V64tt2/S3WbcbilGG+IIGu:QcOYq3ZvAkWSd
TLSH
T110132A7E76411E65EADECA3C468F2A3027B4E8F6D8C214138B35F5B31331346AD6E056
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 9e760d56a532aea021596e4bb2badc8a2f22579ad6e6e4cacb042ac9132e31e9
MD5 0dd099353c2f76537208bfa3059ab9ba
SHA1 55c34620ab4b73bf1b95a7938b726a917022620a
SHA512 85228212debbcd1dce2fd1090445fb9e3752d274a15f7a274738431d2ace18cfe1efc8eb4724bfc8e989813b0a9bf025523cf547afa9c3f297f084a25c8963b2
SSDEEP 1536:JaaHBTL/+bL/moAODw21szNCnRO2aL/CL/KL/Qdk7L5ygwzfvgE:J7xL/IL/NtcTL/CL/KL/h0RN
TLSH
T13B4450F31911A40BCBA842F5E6033E3DC277446D6CE1E8A9E6789CD12935B71B6FCA44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_2
Size 1.0MB
SHA256 534465add880e165d5a9a62f2743cfb10f695d72857395131ad4d702739748cc
MD5 3f5c147a674610d3fc6bd7ae4c9b6ea1
SHA1 3e5cac0bdb3ad8d91eb186b0fb516a841ebf254a
SHA512 c8d815da844c9c661b020d031e884e3c0b1f4b64bc84783a96ac637bff987a95abcdd3434e2e98ac6a7193481dc5a5365fec322e2c41bba7c1bdc8fd68e7ccee
SSDEEP 3072:SW3nbev51+LxHeXKfouoyya0yQibV9jnL5Mmwg2BOwbQItyr+4KP85:rev51IMo5yY95Mmw1BOwbQItyK
TLSH
T128254CDECB282C83CFA7CBB5B4D0D8163E7021C2B599D0D39441C5E966D2BC47AE926D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 eaa6d90a582ad16c9aad05500d4569b77687fbf0fbe430c34a7b9655e4ba37b0
MD5 2f96999f3f57328d9a1f44730042a9f3
SHA1 b3d1dad45b00ba1cdbf1862cb7a74b5a65e743fb
SHA512 cf188cefcdc775a26671720430390384cf4b2721422d10d69e826a97e757303375e87739fce56aa7ead660ea4e0cb86e92e9c44c3f6316947cb3bfce86dffd45
SSDEEP 24576:cswvzD60mIyG/WwtqNEDFyKro0U/wYqTzCDG9+LI/KpivOG:NwvlmZot7Jyao0UETL90I/Ui
TLSH
T143167CEDCA7858C3DD63AA30B4F0E9477C7413C3F565C1D68898C184026BBC5BBAA769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000072

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000072
Size 128KB
SHA256 1e8f938956d53877a3ab66cb9858e1c0b56608d4b151aa62f2a5d9d54bae2d91
MD5 1671ef24a92f81e7ada62209d7be32b2
SHA1 2caf0c70302ff59e16c88223dd8f3fa531dd9922
SHA512 2da1a0dcbdc294accd24410171ee07fe39b13c8ea8cd521de665567bb6aef6b26fdc81ae881cab75ac936564eccd81422204dc7c368f96e2dc733e4e0bc615aa
SSDEEP 3072:FTi3WYxiRqWknyf0sn0SXiGKd6Z5WUtB2Rv:QWYQRqWkXfR+j32Rv
TLSH
T1BCD3588DFBD49403CEB22334ACE253653634D5F8078787DF854C972DADA23A85E861E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 edc008d40489f398853800458bf5496354280bb1ae938d2bbefd9bcc022f4480
MD5 0f1ea46d2ba4401687a4340a348497ac
SHA1 e54c492356636aef95777947ff2cb9cf945ee4c6
SHA512 dedbed741af44b116657cf7540994602f151f57078213930ad900c00eb67a6bde18732ecfaaf9706e8fa672fbfa54d99008f0337ba30f0c60b520b3b56446a57
TLSH
T1BC81B68E186F7054DFBECB3082D9597EF9B80AF0AA835E52B3D3C4BA973B7541024084
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 693312f573123162ff7c5475ef5df451f0e7a810b8c6f529a8f711e2ba4666c1
MD5 6896bcd58fe890660cc37766564bc1b9
SHA1 cb05e201873f0856bf34f8161414bce9ab4cffc0
SHA512 d568a2ea5d793b0a0ce81b38acbcef0c5c54bf6e077e6b8ef845715d126ac7b032ae89bb3cc2a9682b6741f44055bb50b6c82d88ce6f9639457aa86f8aefac64
TLSH
T1EE61B68D186FB0A4DBAFCE3086D9A95FF9780BF0A6835E23B3D6C4B8572B7141010054
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

bbbd21eb-c7bd-43a5-b417-7a89922fa617.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\bbbd21eb-c7bd-43a5-b417-7a89922fa617.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG
Size 346B
SHA256 c7a8d77eea8e546619dd2309c6467349c964264b915b1adf667cdcff9e2fd1f1
MD5 78f88622353ef3fb16a07f1bac026973
SHA1 9569e03866f36d2c49c9f75a518a6117d4f74401
SHA512 e37597a0b22112ee63b26e83e165a654fa88be630fbffbd81e299596059217c524acd322183bd7660a7f2c58cd63224b6a3d1d206a93ae26594e65dadb1fdf57
TLSH
T1ECE020D4D5C6C27F751434D701386F0E87C53873D6916D47A700CCC476C6001B65956B
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 322B
SHA256 8a59c5ed98932d8cf8ef114af664eb9b01682e9d62066f285e183f03e9e58ec4
MD5 ab0c2b0d5f5e219de01f4ca5f6b120e9
SHA1 cfb1bd6ad6504677b4d1349bf56b6dbfe1cbbe9a
SHA512 43d01b1e9030fda807d75d4e8e5b15c0a513ab1ea12ec3be5d8678f0a0b5f21259e7ebb8bccb9907e8dcc6ea223939ead960201327220648de64c1c79fad62d7
TLSH
T151E0268805C8C36DA91868E306BE63088FE03413E3A039672B08E8C87201A41B3AF690
MD5 SHA1 SHA512 TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 204KB
SHA256 fe4314bf379f7867c7a578aa4068d04fd22c1756ad9726e0b3b8d6233bdf65a6
MD5 4f0595b6aad5a1236ad917e33c9c526c
SHA1 e882d4884b48f91ba93113802a21b77694a4027a
SHA512 b1f4a7292ce48c2acbe4e86478ede41c6fec275dc2c51038e7318c05da5aa0700c141ae6517a6e91e373b7a474285915b9b8de3d6eb9967a70c6d4822fbd0d5e
SSDEEP 96:nunqQIU+bGz83uy3+u4tgp4DLjGQLBze9z3nftjBHMsDEuspU0wbtqrOQpPfR4JQ:nunrf+G83uy3Ct7XBBKrH7DXspU3iD
TLSH
T1F014210E5F343721CDBD917669E744B35D6CF03F8B1366CA686104B4CEE2A52A02C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log
Size 226B
SHA256 3b3c26df18ba087f79160ad1bc4f37708f82a410bcdb64c24cd242aafa749e1c
MD5 ecd2213d4e3b6b11d8368c21d8d0ceb9
SHA1 2520e7ff23e9b281e4dd4250dd61f962e4905cd0
SHA512 d8c2bdfa36b945f88dfb5cd9b9f29d71272e559265dce9ae5537ac512c7c5eae5e830ac3aebc5abadcfee4a5b4a371d80a265d22f44591c2f06ef9e743210da1
TLSH
T1F8D04CB7690A3843E7430CB03A533BE4F71BF0196ED49384C843E4081F210F411EB512
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 331B
SHA256 9f622845c817d12237dc331a039d33efd4a4f60a1e679eea675675e002a3a418
MD5 005b56c0c42d3ad3f26998d981f007d8
SHA1 0f12bf3f10a1c4295ee6f85ea292c81bb8c44caf
SHA512 7e6cc026db9ef27a4ad3b4a642539dad9ac66bfa76c74b33e3abc471800daca1987d8e40595e832a189c3a65c545675a0c50a35a7c276c4d2bce77f49490c316
TLSH
T176E0D8F145CDE22D6608609702297708CBA12827E695AA462B05E9C5B445108E29D5D1
MD5 SHA1 SHA512 TLSH

Submit Download

224a502c-8b28-4a82-9d36-ca58045b33ed.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\224a502c-8b28-4a82-9d36-ca58045b33ed.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

6ed9044c-c5e1-449d-af04-c54002d943c5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\6ed9044c-c5e1-449d-af04-c54002d943c5.tmp
Size 2KB
SHA256 744b3f632c2e169b71a7a05b9cbfe9bb9a5a108cd029071c32a9bb84e0c3f06a
MD5 80773846087e6f79596e8cabc5627867
SHA1 a17165e45472dab9bb9f940f386271d62f9fb5e0
SHA512 321a47247e669d6221015a24b0435f2e4c060050c69119af799dd9d242defb29c97369444a0980718e1947b5c3fb8847d9dc82a98f0c53ba816db2d901cbab33
TLSH
T169517CF3C3E986AEE91152F5EA152E2BCE1C0515436C7C06C5D49E1BABF28B1E140E5F
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Size 20KB
SHA256 97e1837dcd64a5366f5ab34a5a2fc7c7f3663d2ead30389098ce5889c4672f5e
MD5 0e58274d9e558178fd770264b76a22d8
SHA1 461611f482bf794c976de8386980f8f5ed334e04
SHA512 f93f856d5c441511eb22d7e2be5ae37bf5bcdf70f1a5be614fa4419369c3b906e61882983faf84eed6fb48d642d5446252ab31ac8093307c70854c6b66d6d4c9
SSDEEP 48:T2SLopFMatSaw/auUOt8M4tXZAUzdnTSP+HNPyV5LGoQwOxLYdFHGtDihojYK0qV:iSeMatUaAGp/dnTuiy/wfLbuFK0qoiB
TLSH
T14E92E65E2F202501C0E5A776ECD284172EBC241DEB772A1FAD4060F24CA22F3B56326B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Reporting and NEL

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL
Size 36KB
SHA256 bbd9d0c4b73c2eff1825aa51a429ab4df7fc9cbc4c79958881ae31ded675001b
MD5 b7fe7747efd412f186197892dc925e43
SHA1 e985e81587d2352e8105e76a7f751265ec4f6ac4
SHA512 6629c05ef2db679c98da055ab7d57264d77a254532efc1c79a9fabdafb29b412cb667e94f71b10dfad6b1604f529c1c28d47b9edee8075fb457e8e731b8d663c
SSDEEP 96:i/IEumQv8m1ccnvS6JIofZh1iO2wv3f6DRvwnFcEqNoay4g:i/IEumQv8m1ccnvS6BY/FKd
TLSH
T1E1F2F4F71637654AE98045B0E0046F9F9F06000B43F6B6ECA6C456E3F7A24F2B1B9B59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 523B
SHA256 028d533888bd2e7dc5ff9084bd7e09d18dfaec23b802fb1ef74ce6dece0af191
MD5 772e76e12dc4bf0a14a3663e6eb19133
SHA1 f23f6b0981c348da285d1121d679d1fff2530386
SHA512 136ec7780686af47f3d3e73127850fcf60e565abdde78eee788791ec4a8f21435ce834807a0cccdea284edbe6ddf9805ef7a53dcab6cb6fbfc6289c80fb83133
TLSH
T194F059E681BEF47B10AE8E771D4438427A3AB439090168F4E9A3837CB0D15E79A16432
MD5 SHA1 SHA512 TLSH

Submit Download

d0c67132-3eec-4be9-aa85-8fba2b3cf507.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\d0c67132-3eec-4be9-aa85-8fba2b3cf507.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

f1e9e54b-ffb3-4405-980c-1b0566e3e457.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\f1e9e54b-ffb3-4405-980c-1b0566e3e457.tmp
Size 2KB
SHA256 e3c7e20c3f691e9e1e09dcfefc612b62176077bbcb835057575d7cce4899c3b0
MD5 f99f102cead078ef6814ef1cef1ea724
SHA1 1811f74230e9a25db57c624d3c0f58ade5fcf76f
SHA512 a922296cc488af9565b5d18c22dc1ebc917df11af6b341579b83dbf1707054bc39f5f07d1da6bed93518c2a2718acc69ae7347c9d2f11416a01577df39e3c1b9
TLSH
T154516CF3C3E986AEE91152F5EA142E2BCE1C0515436C7C06C5E49E1BABF28B1E140E5F
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 335B
SHA256 5f0c3d79e1306c42d2784252cb83e18a292ce67eb34ee36791398c7175cec191
MD5 627d8fe4c0b28edb0e94e49dd54760dc
SHA1 88d0ae0653958e10b5fd3b03218ec55401f585e7
SHA512 0bf4e19410b713229f3ff60f69f5ec535ffdc03dec8762124883837836fde2b0211a0d1d08e7923c9dab24a75933afd0210d3658d1973df49c5f1cb354f18470
TLSH
T10EE026981AC8F27D701920D3063AA309CBE8B427D2C43D477F01DAC07187605B1AE590
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 347B
SHA256 4576b6a788eacebc64753acd771bd28c35326a7f9b07756f4516a5d71ecb711f
MD5 2302f4c5642b51f8a10de30a105df7ca
SHA1 9a49f6eb1b6c298241e49017f8b237a7587997fe
SHA512 a34ff86c9bb44189d9b8dbda7518b606cd2999f027642458ffebf0e6b06f4cfd7b8e3a137518da93e7b98fd6370e8029879812cdb4f44f4288d864a3c726db4d
TLSH
T1E7E0D8A016CAC32E714920E70239F30987A2B812D7D429673B09E994724F240725B650
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 323B
SHA256 ebb241d37520466a99818aa20bf5f68abc3eaee44ae1cddd4b618d10256cb9b8
MD5 ca06214ee85e60497b52c89f080ac93d
SHA1 269fbe4160b5ed0a867abacdb926cd30004364c0
SHA512 d53d1094c605ee5ab98fd96767ab4f646efa23904ac72aea5c09e6d55529c75a07498335742d5496160a0810733e873763fabc6b9d135d1f7910b8c309c76ccf
TLSH
T13EE086F44EC9D33D600860D3467AF70E8BF4A816D7D43A9B670898D5B145245B3BF990
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 bd04608635c455d7c0d9db46e6a1d4540485a005d88f89159487e7508275056f
MD5 dd3aeee29ffc30ffeeac54fe503e8005
SHA1 be174f7c9ae01687c2f4e29889d34be573137aad
SHA512 aa64ab6528250e2e55b9c67a82e17a1177b8c932032db5e55e87dfbd7b23da920115b08b4f2199b5c916dbe9e692d604adcdcc4a88832ff15287651a68ace143
SSDEEP 192:Ojhff4AZWCAmGdiXW6M4hg/YwP6X5vo7FPD1rhP4DFhvXwPjb:OtfFvpopPxrB4Rhfwrb
TLSH
T107B2451471BA021138FE290C81B5971F464232B37259EB2B7FBD14A69E6BF085DFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 224KB
SHA256 d2dd6fe4fcf8ee60d1d314d5c3e7a8c10f875a8a409f820a4bc63a7a9548c931
MD5 942eeaabfec4555c3862e112d99259b3
SHA1 8ee32a742ffb767ea9088ac1b1778ec109ec546a
SHA512 61345c035eef4f36ba1f9e7d3b24b80149cdc50bf72d729b648db0664e07debf1db5dd94148ae928a6b555a92192bbd3cd1d78f71c4d320e809a7bf85c70006b
SSDEEP 192:P+xWeZPfT8w0QQnG2IMW1hPJubRd6vPtcdCewdbsc7V1VJ:mxbPfQ9QQn7IMW1hPJuVd6vPkxW
TLSH
T19624630A7B747001EDE6D9725CB080771E3CB16ECF22A6915DB254698DB2853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b6c80b57-a7f2-4ff9-85a3-f2876e83f884.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b6c80b57-a7f2-4ff9-85a3-f2876e83f884.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

default_cloud_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\default_cloud_config.json
Size 13KB
SHA256 f9e4da319fe1f5a7d497c452421f4648a24ec7588f309ebea0f0cd61a6251eef
MD5 256c40bace492c4e28451ce149d2f9ac
SHA1 b48b0eaf986b9efc91d5c8dd394dccb6d82e2adc
SHA512 33b38d1ced015798722180fc8c8ce6daedb18cd5d0e4b3db27d6176c13cf3ccb1bd79f2e68ca390d6eb43ac508c29067e8f1a3ee9f0167cabe37ebbddf6b0ec0
SSDEEP 384:l7BJeojewj9mg1IZyvASoIL5QJwTcoEnE0YU/VwTcoEnE0GU58:l7BJeojewjcg1IZyvASos5FEnE0YREnA
TLSH
T12452007AD2211C7719B8636858BC4692F524137F8281C81F78BC656C8F7FA79A089FDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f91cf793-30d1-47e4-91d9-ae3765d67245.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f91cf793-30d1-47e4-91d9-ae3765d67245.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

fb05d622-7c35-4ac8-8df2-bb34ee6b9647.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\fb05d622-7c35-4ac8-8df2-bb34ee6b9647.tmp
Size 13KB
SHA256 23b8216d8c6b5cba56c80f1728ffd6de1142404540e9567aee03b33f70d4afb4
MD5 e65a6e0eabdfb10698fadec23bf1c3e1
SHA1 d0f5a0413dcadd465d9712fc63066f673c489386
SHA512 6d4ba3257328f638aecb604ea9db04e1366b8acef5eecc616e2d3a4d8118325add33a0e15e59e7cb7195872b747b4b4723b1f783f9421d4fe0f5cceddbfa6fc7
SSDEEP 384:sxZBvG/frs7WvzOZNCipHb8fCW/kKYCZz:sJvG/fIYzbQHb8fCMkKh
TLSH
T1A752E815AD28697B9CC7D21DFA557F52E3F9513390C12E48AAFC8A1C10EB6CC220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 10KB
SHA256 4c94728725466af7a7ab5345d840e1bae68c0898c0f977d8230fd79e406571fd
MD5 c4cfb5e1545bee225c2265112e57b2d1
SHA1 09ed76b1bedab04b30c5d90d90d129479372c0b6
SHA512 816ef579949ee195a0375d69acd2e03715e65afb5a07926bd5ed230d56a4c32c05a53fe9e566c41afae2ffd0bb9e1f5159f649a6ab0261fdcfabcdd3a5306ccd
SSDEEP 96:w89+vvgxZJZQgOXjZeDWXWY1lDHseCcAWV7lrNUQHWWVsOKpSkHapSpIpS0fp35N:42ODTAs7lrNUQ2s5WPIBD
TLSH
T198220E782E491B33C50D5DB31A7A4F6413D6C04243F727AEB2A5045D1DDA76787C82F5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 322B
SHA256 f3398e93ef576a75e669fd5bf9662ed1ecfd3d989d9fa1f8af17fdc55c97cbd5
MD5 05b37dcbb8d62dc949a4f0f3759c27f9
SHA1 fa958ad198fd18645b718cf642b2dfe126f6f899
SHA512 9a887158f19dc8f5856d03a7d3ef60fa2493f0bb55eb9bc0c0ad2713f1973ccdff2eeb4814450b56b89819f15a9ee4c77279a6862ac3749bd0872ce701c186ec
TLSH
T12CE02690EAC8C2AEB81C20D7013D5308DBA42817EEA029AB2F04C4C8B205500B6AF1D1
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 f72998b4c56cb1b826bae1a1466eb6799467f4628fbdeda6d9e90c1d9b0ad32b
MD5 be046f504fc12544d021a294a0d93114
SHA1 6c2dcb4588da523a548a263f757da4a975c7ce75
SHA512 5d368fe3995fa3f69a5842aa56738d797b9dd83462934e99d0a70270505f2c5c60c58b1f1ff3d5670da81b8a729107057ea983e03eb8c5da7e71b4db4868091d
TLSH
T16C215A12F720C149E54E867EA06BAB351378E9528FFCEC0F45B960352E72B001E9F6E1
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 340B
SHA256 96c3accfc8f9e0acc1d6313cad67e15b181572e2e5a32e9db6da9f494495607d
MD5 b5bc7f9390db2206c7e7c731cd36b5d5
SHA1 1b6a13c7a50a89ac18504e252a37966dca114272
SHA512 2e7f805a1b5faffc8ed120492ffb0d80ca96abc5bca6a85db145c60c36fa28a5650587ed669a773fec4a2569d6d415eda6aa047a1f1dffbbdf53d7474a7e67e7
TLSH
T141E02090E5C8C39F701C20D3017D9348C7953857EAA12E972F00CDD47205541B65F1D1
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1
Size 264KB
SHA256 814aad402144022868bcb220a196ab98620f5d10fdc92d83b72e383fc368ee08
MD5 f2d3af22d1f28dd3e6128ce2f7026d64
SHA1 8a9fffba969196d2fb65b7e38fe1762814e47a47
SHA512 62935e96524b4954dffab98caf9b12d03b8b0c24cf61ec515da043c853ef845b763a73baeb1c85a0a9acd588e1c2342e1f6140d86d0627bd67e191389f3fbd75
SSDEEP 3:MsEllllkEthXllkl2zEflG:/M/xT02zh
TLSH
T1164404047FC0040DFD0010305053C3D01370D4104511574334D1C4735DC75400C11000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 29KB
SHA256 0f9afdfbec15f3b181facf9da0c1693a7f9184c540ae319a62a4e2dc84382be8
MD5 153859873015e62db9d62e8b5bfc9790
SHA1 a967511d674840dff79c7d594dc2fb195b2b0ba1
SHA512 b094e50b166c0bff61c9db0be80cc430500beb274a3f7034917553bf051cab0b96ac9f36fa7dbb9be77979e947416830fadd701f41b762c1c695fbafacda1069
SSDEEP 384:nIiFNZcI/sN/8TUNTUlI4K5mgn00KzfMBaLXJIhoYzASTLowkOr+dDJgL/7Izs8i:TFV/awg+lEBE35SIwkOr+dbi
TLSH
T189D20875D894DDEBA8E6DED59646FA02EEE44133819C498CD5F8AD3C209B4BC0307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 e0de35dd2b7ad590bfa57e9e50989c9792bb869f54c6d98fd01f0f3b0d496230
MD5 1dbb49a1851b0b3696418439ec8ca5d4
SHA1 f53b30055fa86cb24a4fb73808742c0aaffb030e
SHA512 892f9a3bd0b09a7a619cc52029f600117704ed05eff46f81f8334a1c2f0cdf153faef0c625177923ebe371860bee1d927c2de118099114e2a9a07b310bbf9215
SSDEEP 3:MsEllllkEthXllkl2zEflWc:/M/xT02zu
TLSH
T1BD4404057FC0050DD501103040D1C3501370D4104711574334D347737DCF7401C00000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

c5d64d53-c547-4589-bcdb-96478ee7daa5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\c5d64d53-c547-4589-bcdb-96478ee7daa5.tmp
Size 25KB
SHA256 ff9f94109005e3436ee062c6289398073403d34799ec5ba7df6984774e38240b
MD5 8b3979d27470658168495447420df796
SHA1 54e2c577fd72ea4cef1f880d2078b03f378f82de
SHA512 88c48fc4bf3afce61d97a65ba19d0771f53654d2f3257abf4e60c5e279a7749b7e2541432345a77072dd6e06c9065824c9d58696208758e4ffcfbc3a42205b21
SSDEEP 384:nGiFiZcI63sNp8TUNTUlIm25mg5YnKzfMBaLXJmC7O6R2FeoCrgL/7IzNo2:tFQ634wgSDvBEwC7TRn5R
TLSH
T11BC24B36EC98CABBECFB8F99A74A7A07DEE0416385DC4AC0DAD85D1D008759D1307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
Size 158KB
SHA256 3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
MD5 9c18c4721b560ec55f0d5de055144d5c
SHA1 6af37a3bda916cac276ad5879c9f61262d9ae523
SHA512 51466928eb8d3cf7b917919c98bd8168453583d2c3dc5836036d87ffd0d2c732ab8450212a880fc6de199ea569a96993ba0d250a5012160d2d72211880695f92
SSDEEP 3072:5ZwEurOxn8zXnHc2qHNYEU/rUHCVJWGdi0Ha5HnXk9TFzBsuht7yGik:5ZwPOx8D85UIHEI0HaZ09JzKStjik
TLSH
T1CFF3E13E7EDE891AD80B10BB7F16B18BD80D8E0B460AB44B769D80155B3668D1BD1CFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 83ffd8e1a149375a43e257ac81da64add56a772f43e80c4cb5342a3cab9bccfb
MD5 1fcbd3538eda5d34b7bf916548b8a54b
SHA1 254d8719e7878d8abd6b575c8ef356e457a6e8b4
SHA512 5e4b99802239df4adf6bc9ec7520cbbc296a67b23073db28ccfe3e9b628e4472951c1b38314b2b3bf8d248fa76d8114579339490871cc5acf17d955a0414a5c5
TLSH
T176411858A6F91118B3B76E5AABF7A86E447AB9372F0BD05E10110D4F0A62B40CD61737
MD5 SHA1 SHA512 TLSH

Submit Download

8b0d4544beb97a69dbb9583fca5575a9aba6e37d.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\8b0d4544beb97a69dbb9583fca5575a9aba6e37d.tbres
Size 2KB
SHA256 cea2bb6c07e75e9f7776d5a6bf1591963c6834f34ad12f0b2b40030ea24205ff
MD5 8f24ed6baea2e4c503013f1d432ced83
SHA1 9ff6d47e60658497210ac5f0f77364a411f9fa78
SHA512 e1e02c8c40350acfd4d480d1a48053b33ff78df3159f8722710416bb6810fecd35145befa2467e7786ab41ca95865ca18195458e27d8d9c8116b34cd1c4deb3c
TLSH
T133515C58A7EA1118B3776F5AABF6786E887AB9733B06C45E00110E4F0A63F40C861737
MD5 SHA1 SHA512 TLSH

Submit Download

AlexSpoofer.exe

Path C:\Users\Admin\AppData\Local\Temp\4F620E7B\AlexSpoofer.exe
Size 2.6MB
SHA256 bfe8d6dc490fb0d56cc08330b6201720d562d2a421bf12452108ab850b7b8e4c
MD5 886cfe56417b5960feec00bc99564724
SHA1 0eaad362b32cdb45cb2aadfad2a68aa575e23ae7
SHA512 9e57859179c871906259a6a124f8c5d4daad66d73c2c265a5b2ebd69dd7346d9cb6b93f3c9715a5c6fc7c9d5ad3bd54b3bc0c2db9d14df45ef9ea38ccfef4a45
SSDEEP 49152:A9eo0UhK4lBN0C/VsoQbdfcVd0tzSNfAdc0eg9aADcN0L5rwWc40D9a1CGiicJ9R:CxlBNLV4bFqfAuifcN0NvcuN
TLSH
T198D5D043FBE245ECC753A13886129717D6B5B82117204BDB26E0AB92EF73AD09F75321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Client-built.exe

Path C:\Users\Admin\AppData\Local\Temp\4F620E7B\Client-built.exe
Size 78KB
SHA256 4c184231868c6b7970890c7948d6b19792bb7dd204dad293b9dbabe68417928d
MD5 b43123ebc3df59c34dd757e1d9c576d2
SHA1 98018805def1343f11f0aac116064537b9e73a50
SHA512 a360927099ff9128d62c9ce3983e79bbc79d7ef45aef6f5c03719ffdf7af0536cb5d68e1e908187d2a05f9d8d9d5384cf45e24552747a8ea5f11ba16d93ae4ea
SSDEEP 1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+sPIC:5Zv5PDwbjNrmAE+AIC
TLSH
T1DB73B8C877AD8903FBBF5EBD147141524B72BB17E935F68D088C54E611B2B828C42B9B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Launcher_2.exe

Path C:\Users\Admin\AppData\Local\Temp\4F620E7B\Launcher_2.exe
Size 1.1MB
SHA256 6372ab7419765ecc6ad8e70fe173c998ed6f3f3b98294b952bb9812fcae8412f
MD5 deeb55a8e70cfeab4ce0112604039ee5
SHA1 aa54f24d695ec27a8d4fdb26f95421e80b47f8a3
SHA512 2c7db56c9eeb76d0196f1560d573f01c88f01f632bd3fbeaf4b457ad02e83aa52ae0f2c8c6523db2feb083c7c960a11ccac948c23ba851e3e67a36a9470e2eeb
SSDEEP 12288:6bs/m0E54jwaFXGc8lEBBBHGBKq2IZwDO4vfqItNqdg:6bOVE5ifGPRZwLvf3fd
TLSH
T119357C83E7A385D8C116C9B5534BF137F9627C8E4B157197ABC41E633A67BA4E22CB00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

reg.vbs

Path C:\Users\Admin\AppData\Local\Temp\ManLikeAlex91_64\reg.vbs
Size 4KB
SHA256 92b39db2079deaf20cd53e6be399700dc81554ad5a401d67ba4764e5635c48a2
MD5 0a73d9445b0e66ad7ba02737482c9b1c
SHA1 6fc758884077682fb4c8050fc052ff6b54feb1d5
SHA512 82b1016168e5262ebdb68f00e63aa6d7cda331ebfe10d94efd166a4ac31154d783fd65158462ec9120750695cf4c4c8e8466150d213db99a0c26c057304f1b4f
SSDEEP 48:/IcOIWZITZwUZd+ZdnZ1vXTCF02nujIjiD2qOdR:7WaTv2/zvXTCF02nujIjO2qOdR
TLSH
T1A4A10411FEE7A2239394AD581F064E9CD2FB33E10089761275C8E479D89378EB461BDB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

start.bat

Path C:\Users\Admin\AppData\Local\Temp\ManLikeAlex91_64\start.bat
Size 6KB
SHA256 f47a82a23f768884b8d8a8039966eabfdf05f1d24fc183d5bbb0caacf335a4d3
MD5 0a9633e201fe3da16c8dcba00d644804
SHA1 bb212cbcad953ffb4302f1f6d43c813e75722a52
SHA512 827692b1368b3b1f784a64dacd80c1e93c8dc3980910f9d4112f6338e39ba0e3904baadec5cad062dbeddca33801ce4d14708e290d74e34222d0596225c37e72
SSDEEP 192:/I3YkkPyhHbxyQr1HaoBoAlZ+TapPbj77zX07WUC9aaatfIL2aLYLyfi:/I3YkkPyhHbxyQr1HtZ+TaPbn7A7WUC+
TLSH
T134D156202F760D96998350118F63821062B5F10B4365EA93B6FD3845FF91F9B83BE9ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1152_134796944\CRX_INSTALL\_locales\en_CA\messages.json
Size 711B
SHA256 2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b
MD5 558659936250e03cc14b60ebf648aa09
SHA1 32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825
SHA512 1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727
TLSH
T1460197136240AF18470BF05BB9023442A0B44AC62384E0B775EC982C6656DAFB20B3B0
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1692-411-0x0000026CCD8C0000-0x0000026CCD8D0000-memory.dmp

Download

memory/1692-14-0x0000026CCD8C0000-0x0000026CCD8D0000-memory.dmp

Download

memory/1692-43-0x0000026CCE6B0000-0x0000026CCEBD8000-memory.dmp

Download

memory/1692-13-0x0000026CCD500000-0x0000026CCD6C2000-memory.dmp

Download

memory/1692-12-0x0000026CB2EC0000-0x0000026CB2ED8000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads