1ba5b7689c14fc780b878dd8128a34a41f5ccd8b59ded4967abbb6d573dcf6ef

Analysis

user interaction
yes
max time kernel
89s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/11/2026, 12:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Pumpkhn_UnhwidBan/Unhwidban/hwid/FIles/AppleCleaner (1).exe
Size 3.4MB
Sample261102-p77pdatwht
SHA256 1ba5b7689c14fc780b878dd8128a34a41f5ccd8b59ded4967abbb6d573dcf6ef
MD5 a8a46c5977802536571716a50921e7e6
SHA1 47944c2d69929022835de23b85cb123440a794a8
SHA512 c9240a435eb3778641cfd951a3f781d69d0229d410cf3c5d70e6f8b6ea3bc783c5212ad4f249fd703798255a7d122c202168bc98ea6c96f906c948fe5ebb1a7b
SSDEEP 98304:kpuRTwBWKSRQPg/2DkG4+uumEHIX+xjqk9:kARTw4V2pDkGtXmEHIOx+k9
TLSH
T181F533670626DF47FD6C1E32C2AB616AF7B38133F36A52A4C84E15B9861850C4FFD5A0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery execution persistence privilege_escalation themida trojan

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	AppleCleaner (1).exe

Modifies Windows Firewall 2 TTPs 1 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
1244	netsh.exe

Checks BIOS information in registry 2 TTPs 3 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	AppleCleaner (1).exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	AppleCleaner (1).exe
Set value (data)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion = 30004f00310048005300200020002d002000650000000000	AppleCleaner (1).exe

Themida packer 7 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral1/memory/4816-0-0x00007FF79CD90000-0x00007FF79D6C4000-memory.dmp	themida
behavioral1/memory/4816-2-0x00007FF79CD90000-0x00007FF79D6C4000-memory.dmp	themida
behavioral1/memory/4816-3-0x00007FF79CD90000-0x00007FF79D6C4000-memory.dmp	themida
behavioral1/memory/4816-1-0x00007FF79CD90000-0x00007FF79D6C4000-memory.dmp	themida
behavioral1/memory/4816-4-0x00007FF79CD90000-0x00007FF79D6C4000-memory.dmp	themida
behavioral1/memory/4816-5-0x00007FF79CD90000-0x00007FF79D6C4000-memory.dmp	themida
behavioral1/memory/4816-238-0x00007FF79CD90000-0x00007FF79D6C4000-memory.dmp	themida

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	AppleCleaner (1).exe

Network Service Discovery 1 TTPs 2 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

pid	Process
3524	ARP.EXE
888	cmd.exe

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	AppleCleaner (1).exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer = "f70e"	AppleCleaner (1).exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 1 IoCs

defense_evasion

Debugger Evasion

T1622

pid	Process
4816	AppleCleaner (1).exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1364_990345989\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 21 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 20 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2196	cmd.exe
1444	cmd.exe
4400	cmd.exe
2000	cmd.exe
5408	cmd.exe
5400	cmd.exe
3608	cmd.exe
5020	cmd.exe
3496	cmd.exe
2648	cmd.exe
2592	cmd.exe
5268	cmd.exe
5484	cmd.exe
220	cmd.exe
4736	cmd.exe
2444	cmd.exe
5340	cmd.exe
4952	cmd.exe
4176	cmd.exe
5828	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 5 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname = "KevinulJ"	AppleCleaner (1).exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\NV Hostname	AppleCleaner (1).exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\NV Hostname = "KevinulK"	AppleCleaner (1).exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	AppleCleaner (1).exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname = "KevinulC"	AppleCleaner (1).exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3496	cmd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4664	msedge.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 30 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral	AppleCleaner (1).exe
Set value (str)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral\0\Identifier = "f095cdde-47ff8c42-f"	AppleCleaner (1).exe
Set value (str)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardVersion	AppleCleaner (1).exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardProduct	AppleCleaner (1).exe
Set value (str)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	AppleCleaner (1).exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral	AppleCleaner (1).exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer	AppleCleaner (1).exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	AppleCleaner (1).exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemBiosVersion	AppleCleaner (1).exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSVersion	AppleCleaner (1).exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	AppleCleaner (1).exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	AppleCleaner (1).exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Set value (str)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral\0\Identifier = "9298b24d-12d7453a-1"	AppleCleaner (1).exe
Set value (str)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardProduct	AppleCleaner (1).exe
Set value (str)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	AppleCleaner (1).exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral\0	AppleCleaner (1).exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	AppleCleaner (1).exe
Set value (str)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion = "EB-C82-K.8"	AppleCleaner (1).exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral\0\Identifier	AppleCleaner (1).exe
Set value (str)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer	AppleCleaner (1).exe
Set value (str)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer = "OGMO"	AppleCleaner (1).exe
Set value (str)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSVersion = "KCJ-9.G7.O-7-C31OQQQLK-N4GO1MFO.Q7N7.85A"	AppleCleaner (1).exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral	AppleCleaner (1).exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	AppleCleaner (1).exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	AppleCleaner (1).exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardVersion	AppleCleaner (1).exe
Set value (str)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName = "0381 F4CFE 7L74P4CN QP"	AppleCleaner (1).exe

Gathers network information 2 TTPs 3 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3772	ipconfig.exe
3460	ipconfig.exe
3280	ipconfig.exe

Kills process with taskkill 3 IoCs

defense_evasion

pid	Process
2128	taskkill.exe
4924	taskkill.exe
3168	taskkill.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-747854149-4118156852-591593384-1000\{C80761BA-373D-4D08-94A2-8C37A79167AB}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4816	AppleCleaner (1).exe
4816	AppleCleaner (1).exe

Suspicious behavior: LoadsDriver 3 IoCs

pid	Process
656	Process not Found
656	Process not Found
656	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs

pid	Process
1364	msedge.exe
1364	msedge.exe
1364	msedge.exe
1364	msedge.exe
1364	msedge.exe
1364	msedge.exe
1364	msedge.exe
1364	msedge.exe
1364	msedge.exe
1364	msedge.exe
1364	msedge.exe
1364	msedge.exe
1364	msedge.exe
1364	msedge.exe
1364	msedge.exe
1364	msedge.exe
1364	msedge.exe

Suspicious use of AdjustPrivilegeToken 24 IoCs

description	pid	Process
Token: SeDebugPrivilege	4924	taskkill.exe
Token: SeDebugPrivilege	3168	taskkill.exe
Token: SeDebugPrivilege	2128	taskkill.exe
Token: SeIncreaseQuotaPrivilege	1652	WMIC.exe
Token: SeSecurityPrivilege	1652	WMIC.exe
Token: SeTakeOwnershipPrivilege	1652	WMIC.exe
Token: SeLoadDriverPrivilege	1652	WMIC.exe
Token: SeSystemProfilePrivilege	1652	WMIC.exe
Token: SeSystemtimePrivilege	1652	WMIC.exe
Token: SeProfSingleProcessPrivilege	1652	WMIC.exe
Token: SeIncBasePriorityPrivilege	1652	WMIC.exe
Token: SeCreatePagefilePrivilege	1652	WMIC.exe
Token: SeBackupPrivilege	1652	WMIC.exe
Token: SeRestorePrivilege	1652	WMIC.exe
Token: SeShutdownPrivilege	1652	WMIC.exe
Token: SeDebugPrivilege	1652	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1652	WMIC.exe
Token: SeRemoteShutdownPrivilege	1652	WMIC.exe
Token: SeUndockPrivilege	1652	WMIC.exe
Token: SeManageVolumePrivilege	1652	WMIC.exe
Token: 33	1652	WMIC.exe
Token: 34	1652	WMIC.exe
Token: 35	1652	WMIC.exe
Token: 36	1652	WMIC.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1364	msedge.exe
1364	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4816 wrote to memory of 1444	4816	AppleCleaner (1).exe	85
PID 1444 wrote to memory of 4924	1444	cmd.exe	86
PID 4816 wrote to memory of 3496	4816	AppleCleaner (1).exe	89
PID 3496 wrote to memory of 3168	3496	cmd.exe	90
PID 4816 wrote to memory of 4400	4816	AppleCleaner (1).exe	91
PID 4400 wrote to memory of 2128	4400	cmd.exe	92
PID 4816 wrote to memory of 2000	4816	AppleCleaner (1).exe	93
PID 2000 wrote to memory of 4444	2000	cmd.exe	94
PID 4444 wrote to memory of 1364	4444	msedge.exe	96
PID 1364 wrote to memory of 2512	1364	msedge.exe	97
PID 1364 wrote to memory of 3440	1364	msedge.exe	98
PID 1364 wrote to memory of 4664	1364	msedge.exe	99
PID 1364 wrote to memory of 3440	1364	msedge.exe	98
PID 1364 wrote to memory of 3440	1364	msedge.exe	98
PID 1364 wrote to memory of 1896	1364	msedge.exe	101
PID 1364 wrote to memory of 1896	1364	msedge.exe	101
PID 1364 wrote to memory of 3380	1364	msedge.exe	102
PID 1364 wrote to memory of 3516	1364	msedge.exe	103
PID 1364 wrote to memory of 3380	1364	msedge.exe	102
PID 1364 wrote to memory of 3380	1364	msedge.exe	102
PID 1364 wrote to memory of 3516	1364	msedge.exe	103
PID 1364 wrote to memory of 3516	1364	msedge.exe	103
PID 1364 wrote to memory of 2648	1364	msedge.exe	104
PID 1364 wrote to memory of 4532	1364	msedge.exe	105
PID 1364 wrote to memory of 2240	1364	msedge.exe	106
PID 1364 wrote to memory of 3376	1364	msedge.exe	107
PID 1364 wrote to memory of 3008	1364	msedge.exe	130
PID 1364 wrote to memory of 1352	1364	msedge.exe	109
PID 1364 wrote to memory of 3836	1364	msedge.exe	110
PID 1364 wrote to memory of 2648	1364	msedge.exe	104
PID 1364 wrote to memory of 2648	1364	msedge.exe	104
PID 1364 wrote to memory of 1700	1364	msedge.exe	111
PID 1364 wrote to memory of 4532	1364	msedge.exe	105
PID 1364 wrote to memory of 4532	1364	msedge.exe	105
PID 1364 wrote to memory of 3944	1364	msedge.exe	112
PID 1364 wrote to memory of 2240	1364	msedge.exe	106
PID 1364 wrote to memory of 2240	1364	msedge.exe	106
PID 1364 wrote to memory of 3376	1364	msedge.exe	107
PID 1364 wrote to memory of 3376	1364	msedge.exe	107
PID 1364 wrote to memory of 3008	1364	msedge.exe	130
PID 1364 wrote to memory of 3008	1364	msedge.exe	130
PID 1364 wrote to memory of 1352	1364	msedge.exe	109
PID 1364 wrote to memory of 1352	1364	msedge.exe	109
PID 1364 wrote to memory of 3836	1364	msedge.exe	110
PID 1364 wrote to memory of 3836	1364	msedge.exe	110
PID 1364 wrote to memory of 1280	1364	msedge.exe	113
PID 1364 wrote to memory of 1700	1364	msedge.exe	111
PID 1364 wrote to memory of 1700	1364	msedge.exe	111
PID 1364 wrote to memory of 3944	1364	msedge.exe	112
PID 1364 wrote to memory of 3944	1364	msedge.exe	112
PID 1364 wrote to memory of 1280	1364	msedge.exe	113
PID 1364 wrote to memory of 1280	1364	msedge.exe	113
PID 1364 wrote to memory of 4496	1364	msedge.exe	116
PID 1364 wrote to memory of 4496	1364	msedge.exe	116
PID 4816 wrote to memory of 2444	4816	AppleCleaner (1).exe	117
PID 1364 wrote to memory of 2192	1364	msedge.exe	119
PID 1364 wrote to memory of 2192	1364	msedge.exe	119
PID 1364 wrote to memory of 2192	1364	msedge.exe	119
PID 1364 wrote to memory of 744	1364	msedge.exe	120
PID 1364 wrote to memory of 744	1364	msedge.exe	120
PID 1364 wrote to memory of 4120	1364	msedge.exe	121
PID 1364 wrote to memory of 4300	1364	msedge.exe	122
PID 1364 wrote to memory of 4120	1364	msedge.exe	121
PID 1364 wrote to memory of 4300	1364	msedge.exe	122

C:\Users\Admin\AppData\Local\Temp\Pumpkhn_UnhwidBan\Unhwidban\hwid\FIles\AppleCleaner (1).exe
"C:\Users\Admin\AppData\Local\Temp\Pumpkhn_UnhwidBan\Unhwidban\hwid\FIles\AppleCleaner (1).exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Checks system information in the registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Reads the TCP/IP host and domain name from the registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4816
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im EpicGamesLauncher.exe >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1444
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im EpicGamesLauncher.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4924
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im FortniteClient-Win64-Shipping.exe >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:3496
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im FortniteClient-Win64-Shipping.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3168
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im Battle.net.exe >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4400
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im Battle.net.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2128
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start https://applecheats.cc
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2000
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://applecheats.cc/
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4444
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://applecheats.cc/
      4⤵
      Drops file in Program Files directory
      Checks SCSI registry key(s)
      Checks processor information in registry
      Enumerates system info in registry
      Modifies registry class
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:1364
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x25c,0x7ff931f1c188,0x7ff931f1c194,0x7ff931f1c1a0
        5⤵
        
        PID:2512
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1700,i,7280866161863454800,2145468801400380079,262144 --field-trial-handle=2284,i,15980373508054531935,17603139610193213785,262144 --variations-seed-version --mojo-platform-channel-handle=2280 /prefetch:2
        5⤵
        
        PID:3440
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1940,i,9639050925484130284,118045224544945645,524288 --field-trial-handle=2284,i,15980373508054531935,17603139610193213785,262144 --variations-seed-version --mojo-platform-channel-handle=2344 /prefetch:3
        5⤵
        System Time Discovery
        
        PID:4664
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2580,i,17699112590299062794,15238737038395063152,524288 --field-trial-handle=2284,i,15980373508054531935,17603139610193213785,262144 --variations-seed-version --mojo-platform-channel-handle=2584 /prefetch:8
        5⤵
        
        PID:1896
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3452,i,3938292517787542825,848543945135442848,2097152 --field-trial-handle=2284,i,15980373508054531935,17603139610193213785,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
        5⤵
        
        PID:3380
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3456,i,17489933814820497661,9367975124908117038,2097152 --field-trial-handle=2284,i,15980373508054531935,17603139610193213785,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
        5⤵
        
        PID:3516
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4276,i,5313095606243607334,2391091968081613035,2097152 --field-trial-handle=2284,i,15980373508054531935,17603139610193213785,262144 --variations-seed-version --mojo-platform-channel-handle=4524 /prefetch:1
        5⤵
        
        PID:2648
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4300,i,7474111152153196405,12127579208409146629,2097152 --field-trial-handle=2284,i,15980373508054531935,17603139610193213785,262144 --variations-seed-version --mojo-platform-channel-handle=4656 /prefetch:1
        5⤵
        
        PID:4532
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4288,i,5964623602545476247,2300529188205445742,2097152 --field-trial-handle=2284,i,15980373508054531935,17603139610193213785,262144 --variations-seed-version --mojo-platform-channel-handle=4548 /prefetch:2
        5⤵
        
        PID:2240
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4324,i,9102873531755676206,11983085884590379470,2097152 --field-trial-handle=2284,i,15980373508054531935,17603139610193213785,262144 --variations-seed-version --mojo-platform-channel-handle=4660 /prefetch:2
        5⤵
        
        PID:3376
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=4268,i,7196092831735017457,7181847577035013803,2097152 --field-trial-handle=2284,i,15980373508054531935,17603139610193213785,262144 --variations-seed-version --mojo-platform-channel-handle=4692 /prefetch:1
        5⤵
        
        PID:3008
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=4340,i,13009137902213798087,66977622143727442,2097152 --field-trial-handle=2284,i,15980373508054531935,17603139610193213785,262144 --variations-seed-version --mojo-platform-channel-handle=4672 /prefetch:1
        5⤵
        
        PID:1352
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=4352,i,10343072125060720249,3805927630941886598,2097152 --field-trial-handle=2284,i,15980373508054531935,17603139610193213785,262144 --variations-seed-version --mojo-platform-channel-handle=4676 /prefetch:2
        5⤵
        
        PID:3836
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=4372,i,12760798767113280315,15034968811720632647,2097152 --field-trial-handle=2284,i,15980373508054531935,17603139610193213785,262144 --variations-seed-version --mojo-platform-channel-handle=4732 /prefetch:2
        5⤵
        
        PID:1700
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=4388,i,12854314292136933399,9028478832461475193,2097152 --field-trial-handle=2284,i,15980373508054531935,17603139610193213785,262144 --variations-seed-version --mojo-platform-channel-handle=4896 /prefetch:1
        5⤵
        
        PID:3944
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=4404,i,12063036886350062167,7421108493956572631,2097152 --field-trial-handle=2284,i,15980373508054531935,17603139610193213785,262144 --variations-seed-version --mojo-platform-channel-handle=4900 /prefetch:2
        5⤵
        
        PID:1280
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6420,i,1128686913736888546,12702072999408803306,524288 --field-trial-handle=2284,i,15980373508054531935,17603139610193213785,262144 --variations-seed-version --mojo-platform-channel-handle=5396 /prefetch:8
        5⤵
        
        PID:4496
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6536,i,3313683761426111316,8904192155708251344,2097152 --field-trial-handle=2284,i,15980373508054531935,17603139610193213785,262144 --variations-seed-version --mojo-platform-channel-handle=4528 /prefetch:1
        5⤵
        
        PID:2192
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4672,i,12913402469176403448,15790744413212271857,524288 --field-trial-handle=2284,i,15980373508054531935,17603139610193213785,262144 --variations-seed-version --mojo-platform-channel-handle=4456 /prefetch:8
        5⤵
        
        PID:744
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5392,i,11920272419972041543,1408668069656398604,524288 --field-trial-handle=2284,i,15980373508054531935,17603139610193213785,262144 --variations-seed-version --mojo-platform-channel-handle=6832 /prefetch:8
        5⤵
        
        PID:4120
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5396,i,15627043630148912179,13233326098884832819,524288 --field-trial-handle=2284,i,15980373508054531935,17603139610193213785,262144 --variations-seed-version --mojo-platform-channel-handle=6824 /prefetch:8
        5⤵
        
        PID:4300
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=5364,i,17976801155497609050,2685225803430727906,2097152 --field-trial-handle=2284,i,15980373508054531935,17603139610193213785,262144 --variations-seed-version --mojo-platform-channel-handle=6752 /prefetch:1
        5⤵
        
        PID:2244
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=6420,i,11894953185147091930,7143418263869887752,2097152 --field-trial-handle=2284,i,15980373508054531935,17603139610193213785,262144 --variations-seed-version --mojo-platform-channel-handle=5032 /prefetch:1
        5⤵
        
        PID:4512
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6528,i,6632617665552199079,12104075012404546597,524288 --field-trial-handle=2284,i,15980373508054531935,17603139610193213785,262144 --variations-seed-version --mojo-platform-channel-handle=7184 /prefetch:8
        5⤵
        
        PID:4760
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6528,i,6632617665552199079,12104075012404546597,524288 --field-trial-handle=2284,i,15980373508054531935,17603139610193213785,262144 --variations-seed-version --mojo-platform-channel-handle=7184 /prefetch:8
        5⤵
        
        PID:4264
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7432,i,8538503829924945776,17542442409258685906,524288 --field-trial-handle=2284,i,15980373508054531935,17603139610193213785,262144 --variations-seed-version --mojo-platform-channel-handle=7436 /prefetch:8
        5⤵
        
        PID:2680
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7596,i,16748481062905104845,98455960170921873,524288 --field-trial-handle=2284,i,15980373508054531935,17603139610193213785,262144 --variations-seed-version --mojo-platform-channel-handle=7600 /prefetch:8
        5⤵
        
        PID:3008
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7444,i,14480906811709265007,924993644082610853,524288 --field-trial-handle=2284,i,15980373508054531935,17603139610193213785,262144 --variations-seed-version --mojo-platform-channel-handle=3696 /prefetch:8
        5⤵
        
        PID:5260
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8072,i,1360792803373061384,6821921330185172867,524288 --field-trial-handle=2284,i,15980373508054531935,17603139610193213785,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:8
        5⤵
        
        PID:5292
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6616,i,9983831237694210215,4738028224324029851,524288 --field-trial-handle=2284,i,15980373508054531935,17603139610193213785,262144 --variations-seed-version --mojo-platform-channel-handle=6632 /prefetch:8
        5⤵
        
        PID:5844
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4788,i,12235122902573746914,16706628595558323436,524288 --field-trial-handle=2284,i,15980373508054531935,17603139610193213785,262144 --variations-seed-version --mojo-platform-channel-handle=4832 /prefetch:8
        5⤵
        
        PID:5320
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4372,i,7292388004699758957,15644343416452626907,524288 --field-trial-handle=2284,i,15980373508054531935,17603139610193213785,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:8
        5⤵
        
        PID:5332
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5636,i,18079463251388417259,5058743629551815048,524288 --field-trial-handle=2284,i,15980373508054531935,17603139610193213785,262144 --variations-seed-version --mojo-platform-channel-handle=5576 /prefetch:8
        5⤵
        
        PID:5336
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=6680,i,1731060427678390654,16654129673460559806,2097152 --field-trial-handle=2284,i,15980373508054531935,17603139610193213785,262144 --variations-seed-version --mojo-platform-channel-handle=6468 /prefetch:1
        5⤵
        
        PID:5608
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7028,i,12059429682401945735,12208850207637661861,524288 --field-trial-handle=2284,i,15980373508054531935,17603139610193213785,262144 --variations-seed-version --mojo-platform-channel-handle=5328 /prefetch:8
        5⤵
        
        PID:5960
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7384,i,5126524329078712727,3256461119796454799,524288 --field-trial-handle=2284,i,15980373508054531935,17603139610193213785,262144 --variations-seed-version --mojo-platform-channel-handle=5056 /prefetch:8
        5⤵
        
        PID:1076
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c pause
  2⤵
  - Executes a command shell one-liner
  PID:2444
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:5408
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c NETSH WINSOCK RESET >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5340
- - C:\Windows\system32\netsh.exe
    NETSH WINSOCK RESET
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:5328
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c NETSH INT IP RESET >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5400
- - C:\Windows\system32\netsh.exe
    NETSH INT IP RESET
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:5440
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall reset >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:3608
- - C:\Windows\system32\netsh.exe
    netsh advfirewall reset
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:1244
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c NETSH INTERFACE IPV4 RESET >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:4952
- - C:\Windows\system32\netsh.exe
    NETSH INTERFACE IPV4 RESET
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:4728
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c NETSH INTERFACE IPV6 RESET >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5484
- - C:\Windows\system32\netsh.exe
    NETSH INTERFACE IPV6 RESET
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:5848
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c NETSH INTERFACE TCP RESET >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:2648
- - C:\Windows\system32\netsh.exe
    NETSH INTERFACE TCP RESET
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:5472
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c NETSH INT RESET ALL >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:4176
- - C:\Windows\system32\netsh.exe
    NETSH INT RESET ALL
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:3000
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c IPCONFIG /RELEASE >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:2592
- - C:\Windows\system32\ipconfig.exe
    IPCONFIG /RELEASE
    3⤵
    - Gathers network information
    PID:3772
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c IPCONFIG /RELEASE >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:220
- - C:\Windows\system32\ipconfig.exe
    IPCONFIG /RELEASE
    3⤵
    - Gathers network information
    PID:3460
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c IPCONFIG /FLUSHDNS >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:4736
- - C:\Windows\system32\ipconfig.exe
    IPCONFIG /FLUSHDNS
    3⤵
    - Gathers network information
    PID:3280
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c NBTSTAT -R >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5268
- - C:\Windows\system32\nbtstat.exe
    NBTSTAT -R
    3⤵
    PID:5788
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c NBTSTAT -RR >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5828
- - C:\Windows\system32\nbtstat.exe
    NBTSTAT -RR
    3⤵
    PID:4632
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c arp -a >nul 2>&1
  2⤵
  - Network Service Discovery
  PID:888
- - C:\Windows\system32\ARP.EXE
    arp -a
    3⤵
    - Network Service Discovery
    PID:3524
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c arp -d >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:2196
- - C:\Windows\system32\ARP.EXE
    arp -d
    3⤵
    PID:2576
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c WMIC PATH WIN32_NETWORKADAPTER WHERE PHYSICALADAPTER=TRUE CALL DISABLE >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5020
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC PATH WIN32_NETWORKADAPTER WHERE PHYSICALADAPTER=TRUE CALL DISABLE
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1652

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3260

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Debugger Evasion

T1622

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Browser Information Discovery

T1217

Debugger Evasion

T1622

Network Service Discovery

T1046

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1d0ead52-7480-4111-9468-354b623dc9bf.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\1d0ead52-7480-4111-9468-354b623dc9bf.tmp
Size 8KB
SHA256 99ab45b4e70137e48deb6386bd05bb7e1ddb58ccdcd885acad4ae010035d5ca8
MD5 774bd5d3079e97a5cf1c9a22c01eb93a
SHA1 72bdc3c02d66207593c43f92fdd122c1f88d73e5
SHA512 78c1d9cc608b926a71af98636c4f703185bc624a8041dc0c342be7de873db35deb0d4e5e5c0e81b6786cca144218558331d447e8b09267590263031535c92e44
SSDEEP 192:LJONc6DphmqQmiUybCbZq8wGYX59ezVCNY+Yjkk7/r/U6:lONc619XRwGYX5E0S+YbTU6
TLSH
T10502E935E8787C7B9DE36E45B58B2A239FD8112BAA942F84D6E81F1C01D768C1307837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

509327cb-d773-4bea-a705-3c7e3f0e6079.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\509327cb-d773-4bea-a705-3c7e3f0e6079.tmp
Size 28KB
SHA256 71a4228ca81254d1842ea629dbee6287d9180e46af44f13dbeb8348852f164fa
MD5 3647efede2c7d0bfecf3018c3d3f39d1
SHA1 7072a9c4ad91da5b31596f3ea73317148d2d93c8
SHA512 da06c4c969ac4ac500de6d5c64161c0dd060d5b21d847e938c2e9a4bf6dc9236eb82daa222e757ad23c3af3c8e8aad58e19c71d11cff2e16d9d8485795bb8453
SSDEEP 384:n2iFQQkUSvpgsN38TUNTUlIld53RTE5jK2BtDfhmYX5E0S+YpDovH7vBEoOIIl2:dF4yewg93RQYwTmYu0SVpEvH75E/L4
TLSH
T19CD293F198E7993BD9AE4743A37E2D429ABCC117B5885984F7885D0CCC861BFD30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5182ee97-e227-41e6-84aa-69e20e811820.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\5182ee97-e227-41e6-84aa-69e20e811820.tmp
Size 8KB
SHA256 bd5fd1b1383be4d08a09316abc3ee582dd7976759363c97bd18cb92445a45f42
MD5 664948661aac20622779008bd56c25fc
SHA1 a45d8e49003a459d0465bc83ebc2951c52833376
SHA512 2eb8085345693f5e9dac4f5e539fe63e31a1914033d8a65860f067ad95f1e1329dcd563b1155897a0747dbe2777d7e09a69cf2802df83c27bc2bef02787e8748
SSDEEP 192:HONo6DphQqQmiUybebZiwGYX59ezVCNY+YpDyeykII8q5jU6:HONo61/diwGYX5E0S+YpDxvU6
TLSH
T1D1121A32D878AC7B5DD3A951B48B39139FA4522BEB887F94D5EC1A1C01DF69C130A827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5346ce08-e386-489d-a431-72297735d654.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\5346ce08-e386-489d-a431-72297735d654.tmp
Size 28KB
SHA256 ba99a3141d9e4e967596b421953eb93aa9e2ff04b5022a1026ed201edd826c1c
MD5 cd9b1f00bd54a67e8fc0065d421d2bf4
SHA1 eff0cf9943ec9f5b0cc7a2424ba34855b738cafa
SHA512 0d5bb34d992547f70bd47b09e2b60d502744a075671f28a31de37343913280b5565838aed4ea2bb3385648783d10eb7838389be41a29b01cd4fc7c1ff9a175ca
SSDEEP 384:n2iFzQkUSvpzsN38TUNTUlIlZ53RTE5jK2BtDf4mYX5E0S+YpDwvH7vBEoOIIl2:dFdJewgN3RQYwymYu0SVpsvH75E/L4
TLSH
T197D293F198E7993BD9AE4783A37E3D429EBCC117B5885984B7885D0CCC861BFD30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8c92450f-ee3f-460b-8aee-5f49b6e06a8c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\8c92450f-ee3f-460b-8aee-5f49b6e06a8c.tmp
Size 18KB
SHA256 eb0af14078c80899834ea33b12b54843be8db51f6fade76bd2be733b94e65479
MD5 63af2f9c476c55158089d559bd4de901
SHA1 7eb878f15af5d070dfae2bf765a0cec6db45f173
SHA512 ebc2de979bb0722531bd86e456f47c7a998b5e92ca85667a217e0573f41ce67b45c4d821c0f2becaab2fb409c99326e0e77ca7dfb1081eb028cae5adaa84253f
SSDEEP 384:nRQkUSv0sNtZ53RTE5jW2BGYX5E0S+YpDevH7vBEoOIIl2:D0I3RQowGYu0SVpCvH75E/L4
TLSH
T1A7825C329879AC7B0DE3A611F18B3E139FB8961BD6D42B94D5ED5B1D00CF28C234B916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 d1cc89f8f1c9f75d127814445edc4d6d9314209d3b11e5a2b4cc826747683f30
MD5 3bc9cc32c2de3150dc7916bb61984962
SHA1 d75ba9bc7ad74cb95dcb4ec6de6e6b18f5813a04
SHA512 fd090e624e91a98337689ed57390fc5813fab21acd3af426c9de6566ea4d92a7875c4f92a1b64d547eaf9ce40cad3d8a85472a30cf521aea6198cf74b69805ac
TLSH
T12ED02232ABF00E82C80B0032082082880F08C03C0800B323A23C20AE2A82CEC2E23000
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a62a1faeaaa56a5f5375b4d4921e6b263c0bc10a5ecc1f991894c66c32a88aef
MD5 64fcd85513a139bcf5844ab49aea8206
SHA1 3c834eccb77da48c4abac17c440971305fd9b653
SHA512 cd1b39ff43d56158fbb01c5408a5bf247d5bd82279b205a914ab4cdccfece77a5399e430bb26db6f7d10e70dc3503c3bf37c5de59e23cb8f62d6337066c4114f
TLSH
T15DD02232EBF00E82C00B0032082282880F08C03C08003222A23C20AE3A80CEC2E23000
MD5 SHA1 SHA512 TLSH

Submit Download

2e278802-c7a9-49f1-bec7-ee4781b8f20a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2e278802-c7a9-49f1-bec7-ee4781b8f20a.tmp
Size 11KB
SHA256 c7d583b39ac3db75e043381af4a9b60015b00da004d8067c7ef095d2d5e39161
MD5 6992cd48039bc127b0b6205097e8e44c
SHA1 c996f37d455b79443ee815f77a917be673ae5cfc
SHA512 408437ea717efe7a20d7625cd839694404867647a0239a5241604f7a56ca27acbfd874ef032b554fffe76d26756a5a89a627604cbc22d8cc5f0e40d43f6d5603
SSDEEP 192:sxZNRXsP/f8svTntfXrIdpXqDXHW6+WNs3MZzOgy3G1Ig5kJ:sxZNWP/f8svT5X0MHbvZBi
TLSH
T13832D756AD28697B8CC7E21DBB55BF13E6F9503251801E88EAFCC61C04E7ADD224780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

62932b10-f7ba-4366-9102-2e7cf842eee2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\62932b10-f7ba-4366-9102-2e7cf842eee2.tmp
Size 10KB
SHA256 8186a967de97e228a24783b95a2f5e460fe0696ffa745391da027ca8b6f5f1e4
MD5 7c1a7583763894b78e598a61ff2b462f
SHA1 5637ba753b76424137e20c67e91dcd5390ec400a
SHA512 4f527aad1e0bd8c0e3a2e104b3eabaa5f3318cea7efd886eae7a31c28d6c1a230389131f1b637973fdbe3aa4fe226f9af5e41a0cf2abbc155b040dee3642086d
SSDEEP 192:sxZNRXsP/f8s7pntfXqIdpRqEHW6+WNs/E/zOg2MG1Ig4J:sxZNWP/f8s7p5XjRHbH/Cc
TLSH
T14722D751AE28697B8CC7E21DBA55BF13E6F9543291C11D88EAFCC61C04E7ADD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9ed1ad46-358f-4de7-85c2-b1e58b9f1e6e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9ed1ad46-358f-4de7-85c2-b1e58b9f1e6e.tmp
Size 10KB
SHA256 d598fb9170f44c1f42d1cc2aa92c53ba4d9f0ff35df89e59370a8711c472dd77
MD5 7204b990901a1d24ed6132e764318aed
SHA1 a8d5cda3e2f3a3b0ebeebaae792f32b825b0db5d
SHA512 b501cbd67b78321d992912cde8c2a8944a4f039976421868a873c4ccc6a52433b7a9b48e798153fce7968e77b0689e0eb311ad8d199221124ccfd223eeab647a
SSDEEP 192:sxZNRXsP/f8svpntfXqIdpRqEHW6+WNs/E/zOg2MG1Ig5yJ:sxZNWP/f8svp5XjRHbH/CU
TLSH
T14E32D755AE28697B8CC7E21DBB55BF13D6F9543291C01E88EAFC861C04E7ADD224780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 190faf01e19665b3a91492572744ac7097eeea95e6916ee0207bcb63576ebf69
MD5 08d5f110177131af4f3eaf4c7ba7d393
SHA1 4e70db633cc021f6c58d1efcc80d5febabc94daf
SHA512 fb9c911cde1e2f74fc3ce2586cdf33705e4cc2a0752bb6a2b40fbdcdfa9c7e88825f8dc2bf980b0a776b74526a946b4e32abfbc689a1dda4c762b21171b60303
TLSH
T168719579A9A0E2B8FF65447AE49A18CF78324D94A643BFD30E74F47ADCB734491B8100
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 111ac45e2e2937f6c69168a9042607632bd5ed04ff5d976dd3ff7b89e553852a
MD5 50a774dc4a3b2aa80bd5367660abf1dc
SHA1 d6a1603bbcc2a6531f78cab35eb01f7d8a540ec5
SHA512 1136e51224b42c20031c3b75cb78cf113873a3ab3c8c2dc2b2813c155dc535beb2be775aea1c676456ff84f46ce785bf455ba0a04bcb203f5caf29109554e787
TLSH
T11A617479AA60E2B9FFA8447AD5DA14CF39325D95B447BED30EB4E87BCC7630491B8100
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 e112bbf6b5e6c98f38d3c26a42b558b4d587fcab436dc894def90a8834eebc6d
MD5 fd94776610a1db3fee4633dd1cfe74b0
SHA1 b943036e841b9c991b8a25f7a8429a0072dfee4a
SHA512 80eeda03e9ad71bad26599a50e772ae86bf31faa51514cb950f6bb5b6b02d22a6d700ac1cf1ee84a8f9df7e40c0ca516d2ed54a72b7206a3ecf2009ef8fcfcd2
TLSH
T1EA81C9B8A9A0D2A8FF55047BE48A5CCF39324D906957AFD30EB8E43BDD7338550B8000
MD5 SHA1 SHA512 TLSH

Submit Download

efd37b74-c1f9-41db-b6fa-b47145010f04.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\efd37b74-c1f9-41db-b6fa-b47145010f04.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.111.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

378d1a58-5694-406f-87b3-0a5cfbe6396e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\378d1a58-5694-406f-87b3-0a5cfbe6396e.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

ce0ed154-e875-4d25-81be-d5c12b41fa14.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\ce0ed154-e875-4d25-81be-d5c12b41fa14.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

ea46b3fa-88cc-4d55-b86f-144ac292ca1b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\ea46b3fa-88cc-4d55-b86f-144ac292ca1b.tmp
Size 4KB
SHA256 e625b3b1a5fedd60d62a27a295094d06ecf760935808629273146ecaf2760e85
MD5 b4bdd5f863f0de57045a3c9fe36475d5
SHA1 05512be4ecbc8129eea04319bb5c8498957623da
SHA512 9fb8be8f93e2b0b6cf45b5b43c064d3c29379e34b68c945ad1284dc7ba1921116f8c7f4ca520999e1b1ab7265b46da6c7a3327eb975adb2683149de550786e10
SSDEEP 48:YALlNeOq+qqWqtzxgy9PqgsARskzEsPfoKsfqsKCKs+gmgwEs7jsF7zsPb9BCIsy:DsOYholTprzrwUZiwfMeb9BvIu
TLSH
T1BA9191E3D2E88B6D881256F46B14AE2FCE1D051842283C1B89E5DF9F93E24B1D15178F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\js\index-dir\temp-index
Size 72B
SHA256 deda62e0e1580a727a2b102f048115e5161ec82b014baa6ebbfcce30f842d698
MD5 7fe4f08d17cd54a4412e223e0ccb6ee2
SHA1 7b9c14b7910e0d003d90d6f3153e4a701e4ec5bb
SHA512 d454ad2261895f461a2c1679621e3672cfd595e0c1ac3e92e6a492381bc59fa5b38604f847450541a245729cde3777e137934dd565363b3f67b7c7f7fb4ab1af
TLSH
T16EA002611ACB4496DD05027262D60D98321188148307470751D1A0BCF9631F05205400
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 ce15ca755fbbc2a6ee944951163b6c9d25d724178388ad388527865aef2050c4
MD5 96218df061d370b75f8d41a7b55b5950
SHA1 9ca069ec4b9f87ca80c3811fde343c8b0d277725
SHA512 24c0a4c16da7db9ea09738fdd6c9d9c8f0f5159f6ce2b3578359deb84e8dd65cfa21e4fc8d3cffb9c51374b85d2577547f03e96eaae619ae744a8ef7dc38c46a
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

099cbf7d-944f-4efb-a631-c89130cfa93c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\099cbf7d-944f-4efb-a631-c89130cfa93c.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 b3735455b49e31e34f0da62f9144a5a73f5a232e437e0756953a0fdf9827e457
MD5 92da481e1c95e24c4b955a0d87e10057
SHA1 7f329436f8c9497e7ca16ca1e13d274cb0ce0c61
SHA512 acbb7696ae1c64fea058abe39c0eeaf739e43a9537c225c3e9b009b3f34ee01693fe1b34a9ddecc17f81fa03305a8bbed1a9684258006a8e649d97b300237a0d
SSDEEP 48:K0GDGmGHGjGN8rKWkmKzb6ZCISOzK9q1IzxsjYhyKQyRaI/K7aYfyFbIJKkwUx9:K3idmC3TeK8ouia0K7aiGbGKkw8
TLSH
T1D4913341327E53813A7D254D4079855B568231F370A8EE7FBBA8C4A64E6BE280CFD4CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c8fc3453-c599-4e0e-9895-251cd32f8bc0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c8fc3453-c599-4e0e-9895-251cd32f8bc0.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d1e41696-2c6d-4da8-b969-ab20520ea77a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d1e41696-2c6d-4da8-b969-ab20520ea77a.tmp
Size 11KB
SHA256 9c5bc971f6b0258f4594314df4ccedf9793a1e0499e34e4fcd2c784560ebe819
MD5 dca65d6de4958ee1e89f65f65b1d1638
SHA1 e73b595681e0b90aed643d70a4b77dc5e62d7412
SHA512 9bb749e451961e5bcc0f30a8a4b74f5e3462557eb3daa7197d8642962c28ded0877f1349aa6bae31d14c9bd741846ac4e2eac4d62c69e3fa34819d6f6ec22cca
SSDEEP 192:sxZNRXZP/f8svTntfXrIdpXqDXHW6+WNs3MZzOgy1G1Ig5kJ:sxZN3P/f8svT5X0MHbvZ7i
TLSH
T1DB32D756AD28697B8CC7E21DBA55BF53E6F9103251901E88EBFCC61C04E7ADD224380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d9ddd529-5243-4e38-9344-56528986f139.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d9ddd529-5243-4e38-9344-56528986f139.tmp
Size 29KB
SHA256 85434aff302a9b7d562167a92c79dd26cb945a9a74509f6bad054a438b2af931
MD5 52c7a716576c7f62d483ba2ce83a5e5d
SHA1 370b17a020b5a4270fcabc649048a903c99025b5
SHA512 707e0fd3b59a0daec38f6af9822dba70b3b466af587e94414cb692307105c860295f1be9bb7ee548cac0d782eb2202c39d861c67d22d8b62a74319b6fd73763a
SSDEEP 768:cNipu37pLuLjocWD8kf148F1+UoAYDCx9Tuqh0VfUC9xbog/OVNvF8oNTrocp+U:cNipuxEjocWD8kf14u1jaivFjNgxU
TLSH
T1D8D2F97B640CCB7E4FC04ADDD85A7E8EAEAC028B9698DD4047F9845C03C67EB511A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fdadc3d2-76ed-4fd0-984b-842af4bdcd03.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\fdadc3d2-76ed-4fd0-984b-842af4bdcd03.tmp
Size 11KB
SHA256 65e6b4f0df9b61bef68af92ee9aef544c0b8e78f2f022a3aa6a77d6e77cb0a3d
MD5 6b869054b40337c9d408438894adb0a6
SHA1 6102893d7d24243234e1d121f9b99a10d2b801fa
SHA512 bf0acc374fb75d7a342ffe1751bf1b15f91688a7a1490048be0bdf201a2e89fdfc866e2108e5492d229d47f262daf2abd16daec132702420af23a2d9e7526a44
SSDEEP 192:sxZNRXsP/f8svTntfXqIdpRqEHW6+WNs/E/zOgGoG1Ig5kJ:sxZNWP/f8svT5XjRHbH/ci
TLSH
T1CD32C8556E28697B8CC7E21CBB55BF13E6F9543250811E88EAFCC61C05E7ADD224780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

445c2b8f-9ce2-429e-abf8-38bfaedccf7c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\445c2b8f-9ce2-429e-abf8-38bfaedccf7c.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\OriginTrials\0.0.1.7\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

bbaeb759-1b98-46e6-90d1-b1c40556227c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\bbaeb759-1b98-46e6-90d1-b1c40556227c.tmp
Size 18KB
SHA256 77663b945971b788cf65c97e9df659c1482fa8fafd3518a6a789f201578689c2
MD5 15ea693db944339cb376d07cf7a06ba0
SHA1 d343f75171599fe3debad769103e47c0d0c06d08
SHA512 3b6b7e9d76788d301905cf4d69af81e6976064db77e8b67074e7a616f65a5d705ffba62a0f711fd7ec7487fabebc9e86f9b0b7c0d3233b88c138f7ef7af112ee
SSDEEP 384:ndQkUSv0sNtM53RTE5jW2BGYX5E0S+YpDevH7vBEoOIIl2:H0f3RQowGYu0SVpCvH75E/L4
TLSH
T12D826D329879AC7B0DE3A611F18B3E139FB8961BDAD42B94D5DD5B1C01CF28C234B916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0b8b8b41-7446-4ce2-bb8a-ee19618b8e9c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\0b8b8b41-7446-4ce2-bb8a-ee19618b8e9c.tmp
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

ee20d335-62c3-43ea-9869-4640c16407b3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\ee20d335-62c3-43ea-9869-4640c16407b3.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 ef4ab3fdca7abb3ed967e4ea01681b4f8ffd1cf49abb08a9b3b3170f21247318
MD5 e016b0ce459da36f051d470c0d04f1b9
SHA1 cfc5d4ecbce6e7cced7625d5f0106886dabe00b6
SHA512 7855745f8488364dffc18eb987e792d49e0307d4457449343f5da37873463c4e065f1d5188a10a38701974ffdad773cb278d7bf03d438e19332dcdac322312de
TLSH
T1B241275CA6F90148B3B76F0A9BF6A8AD587FBC772E06D09D00110E4F0A22A40C971737
MD5 SHA1 SHA512 TLSH

Submit Download

a127fbb1-0979-4a31-b410-b8d299e4f0dc.tmp

Path C:\Users\Admin\AppData\Local\Temp\a127fbb1-0979-4a31-b410-b8d299e4f0dc.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

e7f7365a-1752-4f5a-8197-cd182f0ac9a6.tmp

Path C:\Users\Admin\AppData\Local\Temp\e7f7365a-1752-4f5a-8197-cd182f0ac9a6.tmp
Size 158KB
SHA256 3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
MD5 9c18c4721b560ec55f0d5de055144d5c
SHA1 6af37a3bda916cac276ad5879c9f61262d9ae523
SHA512 51466928eb8d3cf7b917919c98bd8168453583d2c3dc5836036d87ffd0d2c732ab8450212a880fc6de199ea569a96993ba0d250a5012160d2d72211880695f92
SSDEEP 3072:5ZwEurOxn8zXnHc2qHNYEU/rUHCVJWGdi0Ha5HnXk9TFzBsuht7yGik:5ZwPOx8D85UIHEI0HaZ09JzKStjik
TLSH
T1CFF3E13E7EDE891AD80B10BB7F16B18BD80D8E0B460AB44B769D80155B3668D1BD1CFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

34264a1d-4d17-4dad-8e19-90054e9373a5.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1364_1441798631\34264a1d-4d17-4dad-8e19-90054e9373a5.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1364_1441798631\CRX_INSTALL\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1364_1702125816\CRX_INSTALL\_locales\en_CA\messages.json
Size 711B
SHA256 2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b
MD5 558659936250e03cc14b60ebf648aa09
SHA1 32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825
SHA512 1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727
TLSH
T1460197136240AF18470BF05BB9023442A0B44AC62384E0B775EC982C6656DAFB20B3B0
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4264-563-0x0000024549BC0000-0x0000024549D09000-memory.dmp

Download

memory/4264-564-0x0000024549BC0000-0x0000024549D09000-memory.dmp

Download

memory/4816-0-0x00007FF79CD90000-0x00007FF79D6C4000-memory.dmp

Download

memory/4816-5-0x00007FF79CD90000-0x00007FF79D6C4000-memory.dmp

Download

memory/4816-4-0x00007FF79CD90000-0x00007FF79D6C4000-memory.dmp

Download

memory/4816-1-0x00007FF79CD90000-0x00007FF79D6C4000-memory.dmp

Download

memory/4816-3-0x00007FF79CD90000-0x00007FF79D6C4000-memory.dmp

Download

memory/4816-2-0x00007FF79CD90000-0x00007FF79D6C4000-memory.dmp

Download

memory/4816-238-0x00007FF79CD90000-0x00007FF79D6C4000-memory.dmp

Download