Analysis
- user interaction
yes - max time kernel
106s - max time network
147s - platform
windows11-21h2_x64 - resource
win11-20260911-en - resource tags
arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
04/11/2026, 00:57
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://gofile.io/d/Vvbx1vU0
Resource
win10v2004-20260911-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
https://gofile.io/d/Vvbx1vU0
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
11 signatures
150 seconds
Behavioral task
behavioral3
Sample
https://gofile.io/d/Vvbx1vU0
Resource
win11-20260911-en
windows11-21h2-x64
32 signatures
150 seconds
Behavioral task
behavioral4
Sample
https://gofile.io/d/Vvbx1vU0
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
14 signatures
150 seconds
Errors
Reason
Machine shutdown
General
- Target https://gofile.io/d/Vvbx1vU0
- Sample261104-bax7sagy6p
Malware Config
Extracted
Family
-
neptunerat
C2
-
82.22.62.40:666
Attributes
-
filename
MasonUSB.exe
-
group
MasonGroup
-
key
PZySUSuxlU9MhXcx
-
rat_name
MasonRAT
Signatures
- Family: NeptuneRAT, MasonRAT
NeptuneRAT aka MasonRAT is a trojan written in C#.
- Detects NeptuneRAT stealer 2 IoCs
resource yara_rule behavioral3/files/0x000400000002500b-374.dat family_neptunerat behavioral3/memory/1744-382-0x00000000004C0000-0x00000000004D2000-memory.dmp family_neptunerat - Detects Umbral payload 2 IoCs
resource yara_rule behavioral3/files/0x0002000000026018-390.dat family_umbral_obfuscated behavioral3/memory/4368-398-0x0000026DD90B0000-0x0000026DD90F0000-memory.dmp family_umbral_obfuscated - Downloads MZ/PE file 1 IoCs
flow pid Process 47 3292 msedge.exe - Executes dropped EXE 6 IoCs
pid Process 4532 3dSeriesGG1161.0Setup.exe 1088 3dSeriesGG1161.0Setup.exe 1744 KS AMK GDAR.exe 4580 KS AMK GDAR.exe 4368 Grabber.exe 5068 tmp8667.tmp.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-338007942-693956180-937915117-1000\Software\Microsoft\Windows\CurrentVersion\Run\KS AMK GDAR = "C:\\Users\\Admin\\AppData\\Roaming\\KS AMK GDAR.exe" KS AMK GDAR.exe - Contacts third-party web service commonly abused for C2 1 TTPs 6 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
flow ioc 23 api.gofile.io 24 api.gofile.io 26 api.gofile.io 31 api.gofile.io 51 raw.githubusercontent.com 69 raw.githubusercontent.com - Looks up external IP address via web service 1 TTPs 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 51 ip-api.com - Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 tmp8667.tmp.exe - Drops file in System32 directory 18 IoCs
description ioc Process File opened for modification C:\Windows\System32\wininit.exe tmp8667.tmp.exe File opened for modification C:\Windows\System32\dwm.exe tmp8667.tmp.exe File opened for modification C:\Windows\System32\advapi32.dll tmp8667.tmp.exe File opened for modification C:\Windows\System32\shell32.dll tmp8667.tmp.exe File opened for modification C:\Windows\System32\svchost.exe tmp8667.tmp.exe File opened for modification C:\Windows\System32\gdi32.dll tmp8667.tmp.exe File opened for modification C:\Windows\System32\ole32.dll tmp8667.tmp.exe File opened for modification C:\Windows\System32\ntdll.dll tmp8667.tmp.exe File opened for modification C:\Windows\System32\csrss.exe tmp8667.tmp.exe File opened for modification C:\Windows\System32\smss.exe tmp8667.tmp.exe File opened for modification C:\Windows\System32\dllhost.exe tmp8667.tmp.exe File opened for modification C:\Windows\System32\lsass.exe tmp8667.tmp.exe File opened for modification C:\Windows\System32\spoolsv.exe tmp8667.tmp.exe File opened for modification C:\Windows\System32\kernel32.dll tmp8667.tmp.exe File opened for modification C:\Windows\System32\user32.dll tmp8667.tmp.exe File opened for modification C:\Windows\System32\ntoskrnl.exe tmp8667.tmp.exe File opened for modification C:\Windows\System32\winlogon.exe tmp8667.tmp.exe File opened for modification C:\Windows\System32\services.exe tmp8667.tmp.exe - Enumerates video capture drivers 2 TTPs 1 IoCs
Queries the legacy Video for Windows capture drivers. This is commonly abused by RATs to check for available webcams on the system before reporting to their C2.
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32\msvideo9 KS AMK GDAR.exe - Queries system WMI classes for hardware identifiers 2 TTPs 1 IoCs
Uses WMI to read hardware serial numbers or the system UUID, commonly used to fingerprint the victim machine.
pid Process 2700 wmic.exe - Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs
When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.
description ioc Process File opened for modification C:\Users\Admin\Downloads\3dSeriesGG1161.0Setup.exe:Zone.Identifier msedge.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 5 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 1240 cmd.exe 1952 cmd.exe 2252 cmd.exe 4072 cmd.exe 1332 cmd.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain KS AMK GDAR.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain Grabber.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname Grabber.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname wmic.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain wmic.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname KS AMK GDAR.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3dSeriesGG1161.0Setup.exe - System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 3292 msedge.exe - Checks processor information in registry 2 TTPs 28 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key deleted \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6 reg.exe Key deleted \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7 reg.exe Key deleted \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor reg.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2 reg.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5 reg.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7 reg.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7 reg.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor reg.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 reg.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 reg.exe Key deleted \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 reg.exe Key deleted \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2 reg.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3 reg.exe Key deleted \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3 reg.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4 reg.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 reg.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2 reg.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3 reg.exe Key deleted \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4 reg.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5 reg.exe Key deleted \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5 reg.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6 reg.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6 reg.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor reg.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor reg.exe Key deleted \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 reg.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 reg.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4 reg.exe - Enumerates system info in registry 2 TTPs 64 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController reg.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral reg.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\0 reg.exe Key deleted \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\0 reg.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\1 reg.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\1 reg.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0 reg.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController reg.exe Key deleted \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor reg.exe Key deleted \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController reg.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController reg.exe Key deleted \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter reg.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS reg.exe Key deleted \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses\PCIBus\0000 reg.exe Key deleted \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses reg.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0 reg.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral reg.exe Key deleted \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0 reg.exe Key deleted \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses\PCIBus reg.exe Key deleted \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0 reg.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1 reg.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2 reg.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0 reg.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0 reg.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0 reg.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter reg.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController reg.exe Key deleted \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1 reg.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral\0 reg.exe Key deleted \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2 reg.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses\PCIBus\0000 reg.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor reg.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0 reg.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral reg.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0 reg.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses\PCIBus reg.exe Key deleted \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral reg.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0 reg.exe Key deleted \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController reg.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1 reg.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController reg.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor reg.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0 reg.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0 reg.exe Key deleted \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS reg.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses\PCIBus reg.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses\PCIBus reg.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor reg.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral\0 reg.exe Key deleted \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0 reg.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses reg.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses\PCIBus\0000 reg.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key deleted \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral\0 reg.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral reg.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0 reg.exe Key deleted \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral reg.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses reg.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\0 reg.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter reg.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter reg.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS reg.exe - Modifies registry class 57 IoCs
description ioc Process Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\*\shell\UpdateEncryptionSettingsWork\Shell reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.3fr\ShellEx\{e357fccd-a995-4576-b01f-234630154e96} reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.3gp2\OpenWithProgIds reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.3gp2\ShellEx\{BB2E617C-0920-11D1-9A0B-00C04FC2D6C1} reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.3gp\ShellEx\{BB2E617C-0920-11D1-9A0B-00C04FC2D6C1} reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.3gpp\ShellEx\{BB2E617C-0920-11D1-9A0B-00C04FC2D6C1} reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.3mf\shellex\{8895b1c6-b41f-4c1c-a562-0d564250836f} reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\Sharing reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\{a2a9545d-a0c2-42b4-9708-a0b2badd77c8} reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.3fr\ShellEx reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.3g2 reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.3gp\ShellEx reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\PropertySheetHandlers\CryptoSignMenu reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\*\OpenWithList\IExplore.exe reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\*\OpenWithList\Winword.exe reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\{90AA3A4E-1CBA-4233-B8BB-535773D48449} reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.3g2\ShellEx\{e357fccd-a995-4576-b01f-234630154e96} reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.3ga reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.3gpp\OpenWithProgIds reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\*\OpenWithList\Excel.exe reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\*\OpenWithList reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.3gp\ShellEx\{e357fccd-a995-4576-b01f-234630154e96} reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\PropertySheetHandlers\{1f2e5c40-9550-11ce-99d2-00aa006e086c} reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.3fr reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.3mf\shellex\{e357fccd-a995-4576-b01f-234630154e96} reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\*\shell\removeproperties reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.3g2\ShellEx reg.exe Key created \REGISTRY\USER\S-1-5-21-338007942-693956180-937915117-1000_Classes\Local Settings msedge.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\*\shell reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\7-Zip reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\*\shell\UpdateEncryptionSettingsWork\Shell\Decrypt reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.386 reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.3g2\ShellEx\{BB2E617C-0920-11D1-9A0B-00C04FC2D6C1} reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.669 reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\PropertySheetHandlers\{883373C3-BF89-11D1-BE35-080036B11A03} reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.3gpp\ShellEx\{e357fccd-a995-4576-b01f-234630154e96} reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.a\PersistentHandler reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.3gp\OpenWithProgIds reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.3gp2\ShellEx\{e357fccd-a995-4576-b01f-234630154e96} reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.3gp2 reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.3gpp\ShellEx reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.a reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\PropertySheetHandlers\{3EA48300-8CF6-101B-84FB-666CCB9BCD32} reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\*\shell\removeproperties\DropTarget reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\Open With EncryptionMenu reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.3g2\OpenWithProgIds reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.3gp reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\*\shell\UpdateEncryptionSettingsWork reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.386\PersistentHandler reg.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-338007942-693956180-937915117-1000\{64B752D0-2C7F-4C06-A77E-6F0DE08A5B0F} msedge.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\*\shell\UpdateEncryptionSettingsWork\Shell\Decrypt\command reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\Open With reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.7z reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.3gp2\ShellEx reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.3mf reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.3gpp reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.3mf\shellex reg.exe - Modifies registry key 1 TTPs 2 IoCs
pid Process 5148 reg.exe 5180 reg.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\Downloads\3dSeriesGG1161.0Setup.exe:Zone.Identifier msedge.exe - Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 5068 schtasks.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
pid Process 1828 msedge.exe 1828 msedge.exe 1828 msedge.exe 1828 msedge.exe 1828 msedge.exe 1828 msedge.exe 1828 msedge.exe 1828 msedge.exe - Suspicious use of AdjustPrivilegeToken 48 IoCs
description pid Process Token: SeDebugPrivilege 1744 KS AMK GDAR.exe Token: SeDebugPrivilege 4580 KS AMK GDAR.exe Token: SeDebugPrivilege 4368 Grabber.exe Token: SeIncreaseQuotaPrivilege 2700 wmic.exe Token: SeSecurityPrivilege 2700 wmic.exe Token: SeTakeOwnershipPrivilege 2700 wmic.exe Token: SeLoadDriverPrivilege 2700 wmic.exe Token: SeSystemProfilePrivilege 2700 wmic.exe Token: SeSystemtimePrivilege 2700 wmic.exe Token: SeProfSingleProcessPrivilege 2700 wmic.exe Token: SeIncBasePriorityPrivilege 2700 wmic.exe Token: SeCreatePagefilePrivilege 2700 wmic.exe Token: SeBackupPrivilege 2700 wmic.exe Token: SeRestorePrivilege 2700 wmic.exe Token: SeShutdownPrivilege 2700 wmic.exe Token: SeDebugPrivilege 2700 wmic.exe Token: SeSystemEnvironmentPrivilege 2700 wmic.exe Token: SeRemoteShutdownPrivilege 2700 wmic.exe Token: SeUndockPrivilege 2700 wmic.exe Token: SeManageVolumePrivilege 2700 wmic.exe Token: 33 2700 wmic.exe Token: 34 2700 wmic.exe Token: 35 2700 wmic.exe Token: 36 2700 wmic.exe Token: SeIncreaseQuotaPrivilege 2700 wmic.exe Token: SeSecurityPrivilege 2700 wmic.exe Token: SeTakeOwnershipPrivilege 2700 wmic.exe Token: SeLoadDriverPrivilege 2700 wmic.exe Token: SeSystemProfilePrivilege 2700 wmic.exe Token: SeSystemtimePrivilege 2700 wmic.exe Token: SeProfSingleProcessPrivilege 2700 wmic.exe Token: SeIncBasePriorityPrivilege 2700 wmic.exe Token: SeCreatePagefilePrivilege 2700 wmic.exe Token: SeBackupPrivilege 2700 wmic.exe Token: SeRestorePrivilege 2700 wmic.exe Token: SeShutdownPrivilege 2700 wmic.exe Token: SeDebugPrivilege 2700 wmic.exe Token: SeSystemEnvironmentPrivilege 2700 wmic.exe Token: SeRemoteShutdownPrivilege 2700 wmic.exe Token: SeUndockPrivilege 2700 wmic.exe Token: SeManageVolumePrivilege 2700 wmic.exe Token: 33 2700 wmic.exe Token: 34 2700 wmic.exe Token: 35 2700 wmic.exe Token: 36 2700 wmic.exe Token: SeDebugPrivilege 5068 tmp8667.tmp.exe Token: 33 3156 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 3156 AUDIODG.EXE - Suspicious use of FindShellTrayWindow 50 IoCs
pid Process 1828 msedge.exe 1828 msedge.exe 1828 msedge.exe 1828 msedge.exe 1828 msedge.exe 1828 msedge.exe 1828 msedge.exe 1828 msedge.exe 1828 msedge.exe 1828 msedge.exe 1828 msedge.exe 1828 msedge.exe 1828 msedge.exe 1828 msedge.exe 1828 msedge.exe 1828 msedge.exe 1828 msedge.exe 1828 msedge.exe 1828 msedge.exe 1828 msedge.exe 1828 msedge.exe 1828 msedge.exe 1828 msedge.exe 1828 msedge.exe 1828 msedge.exe 1828 msedge.exe 1828 msedge.exe 1828 msedge.exe 1828 msedge.exe 1828 msedge.exe 1828 msedge.exe 1828 msedge.exe 1828 msedge.exe 1828 msedge.exe 1828 msedge.exe 1828 msedge.exe 1828 msedge.exe 1828 msedge.exe 1828 msedge.exe 1828 msedge.exe 1828 msedge.exe 1828 msedge.exe 1828 msedge.exe 1828 msedge.exe 1828 msedge.exe 1828 msedge.exe 1828 msedge.exe 1828 msedge.exe 1828 msedge.exe 1828 msedge.exe - Suspicious use of SendNotifyMessage 16 IoCs
pid Process 1828 msedge.exe 1828 msedge.exe 1828 msedge.exe 1828 msedge.exe 1828 msedge.exe 1828 msedge.exe 1828 msedge.exe 1828 msedge.exe 1828 msedge.exe 1828 msedge.exe 1828 msedge.exe 1828 msedge.exe 1828 msedge.exe 1828 msedge.exe 1828 msedge.exe 1828 msedge.exe - Suspicious use of WriteProcessMemory 57 IoCs
description pid Process procid_target PID 1828 wrote to memory of 3648 1828 msedge.exe 80 PID 1828 wrote to memory of 3292 1828 msedge.exe 81 PID 1828 wrote to memory of 3136 1828 msedge.exe 83 PID 1828 wrote to memory of 3136 1828 msedge.exe 83 PID 1828 wrote to memory of 3260 1828 msedge.exe 82 PID 1828 wrote to memory of 3260 1828 msedge.exe 82 PID 1828 wrote to memory of 3260 1828 msedge.exe 82 PID 1828 wrote to memory of 1056 1828 msedge.exe 85 PID 1828 wrote to memory of 1056 1828 msedge.exe 85 PID 1828 wrote to memory of 1056 1828 msedge.exe 85 PID 1828 wrote to memory of 3744 1828 msedge.exe 86 PID 1828 wrote to memory of 3744 1828 msedge.exe 86 PID 1828 wrote to memory of 3744 1828 msedge.exe 86 PID 1828 wrote to memory of 3916 1828 msedge.exe 87 PID 1828 wrote to memory of 3916 1828 msedge.exe 87 PID 1828 wrote to memory of 3916 1828 msedge.exe 87 PID 1828 wrote to memory of 3456 1828 msedge.exe 88 PID 1828 wrote to memory of 3456 1828 msedge.exe 88 PID 1828 wrote to memory of 3456 1828 msedge.exe 88 PID 1828 wrote to memory of 1524 1828 msedge.exe 89 PID 1828 wrote to memory of 4444 1828 msedge.exe 90 PID 1828 wrote to memory of 1524 1828 msedge.exe 89 PID 1828 wrote to memory of 1524 1828 msedge.exe 89 PID 1828 wrote to memory of 4444 1828 msedge.exe 90 PID 1828 wrote to memory of 4444 1828 msedge.exe 90 PID 1828 wrote to memory of 2552 1828 msedge.exe 93 PID 1828 wrote to memory of 444 1828 msedge.exe 94 PID 1828 wrote to memory of 2552 1828 msedge.exe 93 PID 1828 wrote to memory of 444 1828 msedge.exe 94 PID 1828 wrote to memory of 2528 1828 msedge.exe 95 PID 1828 wrote to memory of 688 1828 msedge.exe 97 PID 2528 wrote to memory of 4588 2528 msedge.exe 98 PID 1828 wrote to memory of 2372 1828 msedge.exe 99 PID 1828 wrote to memory of 408 1828 msedge.exe 100 PID 1828 wrote to memory of 2372 1828 msedge.exe 99 PID 1828 wrote to memory of 408 1828 msedge.exe 100 PID 1828 wrote to memory of 408 1828 msedge.exe 100 PID 1828 wrote to memory of 2008 1828 msedge.exe 101 PID 1828 wrote to memory of 440 1828 msedge.exe 102 PID 1828 wrote to memory of 1884 1828 msedge.exe 103 PID 1828 wrote to memory of 1368 1828 msedge.exe 104 PID 1828 wrote to memory of 2476 1828 msedge.exe 106 PID 1828 wrote to memory of 2476 1828 msedge.exe 106 PID 4532 wrote to memory of 1088 4532 3dSeriesGG1161.0Setup.exe 109 PID 4532 wrote to memory of 1744 4532 3dSeriesGG1161.0Setup.exe 110 PID 1744 wrote to memory of 5068 1744 KS AMK GDAR.exe 111 PID 4532 wrote to memory of 4368 4532 3dSeriesGG1161.0Setup.exe 116 PID 4368 wrote to memory of 2700 4368 Grabber.exe 118 PID 1744 wrote to memory of 5068 1744 KS AMK GDAR.exe 120 PID 5068 wrote to memory of 1240 5068 tmp8667.tmp.exe 122 PID 5068 wrote to memory of 1952 5068 tmp8667.tmp.exe 124 PID 5068 wrote to memory of 2252 5068 tmp8667.tmp.exe 126 PID 5068 wrote to memory of 4072 5068 tmp8667.tmp.exe 128 PID 5068 wrote to memory of 1332 5068 tmp8667.tmp.exe 130 PID 2252 wrote to memory of 5148 2252 cmd.exe 132 PID 1952 wrote to memory of 5180 1952 cmd.exe 133 PID 1240 wrote to memory of 5192 1240 cmd.exe 134 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://gofile.io/d/Vvbx1vU01⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1828 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2f0,0x7ffd8b9fc188,0x7ffd8b9fc194,0x7ffd8b9fc1a02⤵PID:3648
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1820,i,12377448220325353981,1299583312863492585,524288 --field-trial-handle=2496,i,7184695232767707731,11345543480659292716,262144 --variations-seed-version --mojo-platform-channel-handle=2696 /prefetch:112⤵
- Downloads MZ/PE file
- System Time Discovery
PID:3292
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1540,i,6680819951675414919,8904205432446918533,262144 --field-trial-handle=2496,i,7184695232767707731,11345543480659292716,262144 --variations-seed-version --mojo-platform-channel-handle=2492 /prefetch:22⤵PID:3260
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2104,i,9298827364218576784,5187239349829227375,524288 --field-trial-handle=2496,i,7184695232767707731,11345543480659292716,262144 --variations-seed-version --mojo-platform-channel-handle=2868 /prefetch:132⤵PID:3136
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3440,i,13736029810712075673,12801627106342737714,2097152 --field-trial-handle=2496,i,7184695232767707731,11345543480659292716,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:12⤵PID:1056
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3444,i,13530043387124295252,15238427514447320151,2097152 --field-trial-handle=2496,i,7184695232767707731,11345543480659292716,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:12⤵PID:3744
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4120,i,3832738532143239184,6228144870944459929,2097152 --field-trial-handle=2496,i,7184695232767707731,11345543480659292716,262144 --variations-seed-version --mojo-platform-channel-handle=4124 /prefetch:12⤵PID:3916
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4132,i,13527816449187615478,17862483927865922173,2097152 --field-trial-handle=2496,i,7184695232767707731,11345543480659292716,262144 --variations-seed-version --mojo-platform-channel-handle=4152 /prefetch:92⤵PID:3456
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4300,i,4864822892475588877,18133051995754723519,2097152 --field-trial-handle=2496,i,7184695232767707731,11345543480659292716,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:12⤵PID:1524
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4328,i,5387484222258527538,13386872388474025987,2097152 --field-trial-handle=2496,i,7184695232767707731,11345543480659292716,262144 --variations-seed-version --mojo-platform-channel-handle=4440 /prefetch:92⤵PID:4444
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3448,i,5424089357137712242,12015574845347699126,524288 --field-trial-handle=2496,i,7184695232767707731,11345543480659292716,262144 --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:142⤵PID:2552
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3488,i,6712196743456047681,11667788365109471646,524288 --field-trial-handle=2496,i,7184695232767707731,11345543480659292716,262144 --variations-seed-version --mojo-platform-channel-handle=5356 /prefetch:142⤵PID:444
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6112,i,15813587187943142466,4353539868657827953,524288 --field-trial-handle=2496,i,7184695232767707731,11345543480659292716,262144 --variations-seed-version --mojo-platform-channel-handle=6120 /prefetch:142⤵
- Suspicious use of WriteProcessMemory
PID:2528 -
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.execookie_exporter.exe --cookie-json=11323⤵PID:4588
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6132,i,11536440506230471242,11661452843485362905,524288 --field-trial-handle=2496,i,7184695232767707731,11345543480659292716,262144 --variations-seed-version --mojo-platform-channel-handle=6192 /prefetch:142⤵PID:4520
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6132,i,11536440506230471242,11661452843485362905,524288 --field-trial-handle=2496,i,7184695232767707731,11345543480659292716,262144 --variations-seed-version --mojo-platform-channel-handle=6192 /prefetch:142⤵PID:688
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5080,i,14227288974484165870,4007399630121534120,524288 --field-trial-handle=2496,i,7184695232767707731,11345543480659292716,262144 --variations-seed-version --mojo-platform-channel-handle=4704 /prefetch:142⤵PID:2372
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=4140,i,5188413843566013253,17689515325649711130,2097152 --field-trial-handle=2496,i,7184695232767707731,11345543480659292716,262144 --variations-seed-version --mojo-platform-channel-handle=4480 /prefetch:12⤵PID:408
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6820,i,2999857089014376677,9805756794202358458,524288 --field-trial-handle=2496,i,7184695232767707731,11345543480659292716,262144 --variations-seed-version --mojo-platform-channel-handle=6748 /prefetch:142⤵PID:2008
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6832,i,11198494834133684733,5673080170312263769,524288 --field-trial-handle=2496,i,7184695232767707731,11345543480659292716,262144 --variations-seed-version --mojo-platform-channel-handle=6796 /prefetch:142⤵PID:440
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6836,i,6217497907958784949,1733533841972232840,524288 --field-trial-handle=2496,i,7184695232767707731,11345543480659292716,262144 --variations-seed-version --mojo-platform-channel-handle=6840 /prefetch:142⤵PID:1884
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4416,i,1589832508365909435,4469488519945836026,524288 --field-trial-handle=2496,i,7184695232767707731,11345543480659292716,262144 --variations-seed-version --mojo-platform-channel-handle=4760 /prefetch:142⤵
- Subvert Trust Controls: Mark-of-the-Web Bypass
- NTFS ADS
PID:1368
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=748,i,7903372628881879153,5747116398955687130,524288 --field-trial-handle=2496,i,7184695232767707731,11345543480659292716,262144 --variations-seed-version --mojo-platform-channel-handle=2372 /prefetch:142⤵PID:2476
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6556,i,2123206308556150526,4254518721946532696,262144 --field-trial-handle=2496,i,7184695232767707731,11345543480659292716,262144 --variations-seed-version --mojo-platform-channel-handle=5080 /prefetch:102⤵PID:1492
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵PID:4968
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:1400
-
C:\Users\Admin\Downloads\3dSeriesGG1161.0Setup.exe"C:\Users\Admin\Downloads\3dSeriesGG1161.0Setup.exe"1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4532 -
C:\Users\Admin\AppData\Local\Temp\3dSeriesGG1161.0Setup.exe"C:\Users\Admin\AppData\Local\Temp\3dSeriesGG1161.0Setup.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1088
-
-
C:\Users\Admin\AppData\Local\Temp\KS AMK GDAR.exe"C:\Users\Admin\AppData\Local\Temp\KS AMK GDAR.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Enumerates video capture drivers
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1744 -
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /sc minute /mo 1 /tn "KS AMK GDAR" /tr "C:\Users\Admin\AppData\Roaming\KS AMK GDAR.exe"3⤵
- Scheduled Task/Job: Scheduled Task
PID:5068
-
-
C:\Users\Admin\AppData\Local\Temp\tmp8667.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp8667.tmp.exe"3⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5068 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg delete HKCR /f4⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1240 -
C:\Windows\system32\reg.exereg delete HKCR /f5⤵PID:5192
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg delete HKCU /f4⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1952 -
C:\Windows\system32\reg.exereg delete HKCU /f5⤵
- Modifies registry key
PID:5180
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg delete HKLM /f4⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2252 -
C:\Windows\system32\reg.exereg delete HKLM /f5⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Modifies registry key
PID:5148
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg delete HKU /f4⤵
- Executes a command shell one-liner
PID:4072 -
C:\Windows\system32\reg.exereg delete HKU /f5⤵PID:5264
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg delete HKCC /f4⤵
- Executes a command shell one-liner
PID:1332 -
C:\Windows\system32\reg.exereg delete HKCC /f5⤵PID:5280
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Grabber.exe"C:\Users\Admin\AppData\Local\Temp\Grabber.exe"2⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4368 -
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid3⤵
- Queries system WMI classes for hardware identifiers
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:2700
-
-
-
C:\Users\Admin\AppData\Roaming\KS AMK GDAR.exe"C:\Users\Admin\AppData\Roaming\KS AMK GDAR.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4580
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004E4 0x00000000000004D41⤵
- Suspicious use of AdjustPrivilegeToken
PID:3156
-
C:\Users\Admin\AppData\Roaming\KS AMK GDAR.exe"C:\Users\Admin\AppData\Roaming\KS AMK GDAR.exe"1⤵PID:5208
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1Windows Management Instrumentation
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Pre-OS Boot
1Bootkit
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Modify Registry
2Pre-OS Boot
1Bootkit
1Subvert Trust Controls
1SIP and Trust Provider Hijacking
1Discovery
Browser Information Discovery
1Peripheral Device Discovery
1Query Registry
3System Information Discovery
4System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
2Internet Connection Discovery
1System Time Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\KS AMK GDAR.exe.log
- Size 654B
- SHA256 e31b18f21621d9983bfdf1ea3e53884a9d58b8ffd79e0e5790da6f3a81a8b9d3
- MD5 2cbbb74b7da1f720b48ed31085cbd5b8
- SHA1 79caa9a3ea8abe1b9c4326c3633da64a5f724964
- SHA512 ecf02d5240e0c1c005d3ab393aa7eff62bd498c2db5905157e2bf6d29e1b663228a9583950842629d1a4caef404c8941a0c7799b1a3bd1eb890a09fdb7efcff9
- TLSH T119F0A2302371E1C8C9263F422C0D2A4966AF474A7B50FE0C7694635DD825167AF313F3
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\1f3a2576-b8e7-45c4-80ce-184643859510.tmp
- Size 18KB
- SHA256 d0b0dd110ef1356faafaacf8f92ed3acd011098634e243399f47e1af7d20d3b4
- MD5 0208d963176929fcb2904193ce19f7f9
- SHA1 4bb184336cdab9542ced478a18779f5a579851b6
- SHA512 e7d5b0fa00186b061a4d816dbf7cf97122c339e71379461bae615b35b44b5cf1d1042412c86bed3959b6c7997b9a67b0f0af65b53451108aac260c2c38542c5b
- SSDEEP 384:8QkUSvJ8NBOdnrWaE9ckX5mV8Gyxy5Kys4H7vBEERIIll:8JznsA/o7ys4H75E4LP
- TLSH T1FA826B72A8B87C2B5AB3E554F14A3A17AFB4911BDAC41B80D5DD9A1D00CA2DC234BD26
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\a37361d5-f296-47c7-96eb-0ba1a871fc45.tmp
- Size 105KB
- SHA256 98d027a7d5f34317602446091fe5e8214f7e942ff9ef737ba4d84e1e3d5595bf
- MD5 8f3342292c3866482651f7779a119225
- SHA1 4913b3a3b3dbc7ed6a23f06a3e43a7fb771af8a5
- SHA512 5ac909173ab373dd81244ae41107fd57459d8168297be5c68fdfbbe0e0d6bba188b269540254cf5084284313bf648a5ee3587eb3073c307b59f64cfeafed06a7
- SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7J:fwUQC5VwBIiElEd2K57P7J
- TLSH T125B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 280B
- SHA256 2aa0ef8543982e42f2141a859cd78cf0f780a6b139ea99c1c2ad33fd4f56cb7b
- MD5 cf1ef0f6a6585003596ad6b09c83cbc3
- SHA1 80edf8da49bc458828bf3125b8b4aa3036814e22
- SHA512 0c23492cf0d4ab37f4a7f42f865cc6238ff5b3cdabf212ce523b204513d6aa133d66ec3e381caf548455fba3f37294ba5fdf00ad1dbaac1945115047c226530d
- TLSH T198D012A1FB31008CE4801134613A1B281D00810000C301015510009D4C441D2657D024
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 280B
- SHA256 635a17b62bc802a1d6d2ac977e63b5a2027aa2bf3d1b5551e63352afa4362fd9
- MD5 7fe12d00d13e30949f1419fc02757c7e
- SHA1 7fe9042bd95f9f143a17aee8b65dd97f8f4eb44e
- SHA512 c9251c530a2927beaa3f58a69cd075267ab37b951ce23f2f159ff17f194ed9b03a08d41f5cce2d4dd1a091898135db5440df49406cc67c2f8fa1bd50c44edd4e
- TLSH T1B1D011A2FB32008CE0802238A23B2B282E00820000C30000AA2000AEAC882A2AABE028
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\0e6ec704-f0b0-4259-9da4-fcf29665db82.tmp
- Size 10KB
- SHA256 c879d9209ce2b82ac269e8b297a4a93edf1c80d8a3367e200dac063d3ecba721
- MD5 0da7dc9c024e2730eca5e92643aebe5a
- SHA1 19e0eca01a4b95bbf37ca1fb525ea2de4de40432
- SHA512 4ec54263e36ecde60c060d26e0792d5cf920f1b5507cd71e980621b6ca4adb1476ddc7295296b73c3deaa59fe90eda85df1a7d113c5fa0fd5e6150ad1cf945bb
- SSDEEP 192:sxZvRPOcZ/fZsL7Li1qIdpKlU/W6+WNeG1XY0HCbcNsIg5rJ:sxZvwcZ/fZsPUjf/b9X5TGn
- TLSH T15C22B8526E68A97B8CCBD219FA15BF53E7F9103291D11E88A6FCC61C04E76DD224780F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\13c76aed-f2aa-41b2-ba7a-0dc59bb620cb.tmp
- Size 10KB
- SHA256 f987b9616a947888e1326c487ed2b5ec16f1fcdd3f6d53e97bb4db815b75b300
- MD5 83376a33559f04291521c9901c31a768
- SHA1 b9acbfc0ea2e46ed78c573fba26974c784b18376
- SHA512 e701033a90c096279bcc2aa4bdde8a31c6d6c3a313848a0c376d25b0d723a901521bab644f9528d1db29be2ed96c8f44b6f37b920a0d79c7257abd3d6a918645
- SSDEEP 192:sxZvRPbcZ/fZsZ7Li1qIdpKlU/W6+WNe86gF/Y0HtFNcNsIgrJ:sxZv9cZ/fZspUjf/bx/5yG9
- TLSH T18622A7116E78A97B8CC7D219FA15BF53E6F9503291D11E88AAFCC61C04E76DE224780F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\17bb5f14-b6e2-4670-b421-c46c40deb8f4.tmp
- Size 10KB
- SHA256 7cbb8f5347c59fd52b4ec99f8146522add833db0bc1f0cf4cee2c871a3e53b35
- MD5 38ba12eea2170278e7276f434ef22661
- SHA1 a6ca20d86a4b31cb32f6fea0f60b80bdf4a0ba39
- SHA512 b8d1d4bd2809d59c608134274ec8fa38c9d66b2c7ad6b8c89a22885ff308ad7c0b7da2800d61a932c63c7c5da7cb2bae391366a27541d863adaf6f09ab1ae089
- SSDEEP 192:sxZvRPOcZ/fZsLpLi1qIdpKlU/W6+WNeG1XY0HR1cNsIg5JJ:sxZvwcZ/fZsVUjf/b9X5AGZ
- TLSH T19322C8116E68A97B9CCBE209FA15BF53E7F9503291D11E88A6FCCA1C04E76DD224740F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\323d3ba1-42c4-4d3a-b9c3-1d23dc2acb7d.tmp
- Size 10KB
- SHA256 ac7a6c43ca0267db84da4b34b3df2b53cc22b06172f8ea86b83565a820984791
- MD5 8c286f931d89546c78a40e9fdb54b280
- SHA1 ae2a3bb9068b8535dc721fa926f721d2d9dd35d4
- SHA512 c0662e20c698fb8bf57ad9580ad1edcb52c3bd0f80dafcde916a048b58afd249ac999a3fe9e7cb96ca478303f5fa7bddd49256fce201c15f542b934fb167f576
- SSDEEP 192:sxZvRPOcZ/fZsLpLi1qIdpolU/W6+WNeG1XY0H6qEcNsIg5JJ:sxZvwcZ/fZsVUj5/b9X5hGZ
- TLSH T12C32C8126D68A93B9CCBE219FA15BF53E7F9103251D11E88A6FCCA1C04E76DE224740F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4beee6e5-85bb-45ea-8e06-4d2ee48404ee.tmp
- Size 70KB
- SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
- MD5 efe54a870e0f5ff28d7e00036b861065
- SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
- SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
- SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
- TLSH T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6a87634f-dcf7-4111-bbaa-943fcff5a92c.tmp
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7eebcb90-56eb-4de1-b681-1611fea4f85f.tmp
- Size 28KB
- SHA256 4ccf52321fe6093dd49213b6f7f091b1c29ad2c23546666a8403b5d5ee690d2d
- MD5 129c9d04c8fc31d0bc80b3f8a4898d11
- SHA1 02762afd3a9ff51828340faf042fd080e4b96fa4
- SHA512 6941a576915294a8ce2b9395930f64f682c5c197ac7ac3ec8d0d42fae4da43fc8f56977841c5d8ba9e695267e43fd621f2e714b07704fd98bb3ed5d382164beb
- SSDEEP 768:LBWY2I87M23TWRmjdQVx8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3NyLl/cu0yBlBCE:LBWY2I87M23TWRmjdQVxu1jaKNyLpc3k
- TLSH T1B3D2FA3B344CCB7E4FC11AADDC1A6F976E9802C796688D4047FA894C02C77EE51264DB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
- Size 4KB
- SHA256 fa37821b15f230a51279bd511c5d4ee5e6c28050d53bb5cf9f42a65269b1ba97
- MD5 4a5a82045f461c842b88b62d80c1c6b3
- SHA1 813eac5cf0022ec1e227398550a76d947d31a05f
- SHA512 74988b697ce939cf2a693474f82a7413779e34bfff528dc36b642226a1b1cf277cd7846c786374d755fe43f8a31f5c3d2ffcd23202fdc3cf30007f86226560cb
- SSDEEP 48:AEBQHiKaAuUllpOqV5z2OExK0YLEPLmvd4HzIhYCUg0+8nKCrQCVSQFxd5BlA:nGHifAL7Kx646MISU8ndSGdq
- TLSH T16C91A28D58AEE061E7ED5974ACF530963735D9C23087AE522274CA7D8FCBB57600835C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 3KB
- SHA256 37430b0aba98b59078d08433117cd965fbbb26adcc9bac9dab86a58ff9fcf98a
- MD5 4399cd40de8483c125724662c11a11bf
- SHA1 6d496eaa4f5ba581fa633dfe486f7a57472b6318
- SHA512 784e7d1b06b5f3ca13186eaf9ba2e9a916a0501a2d4231588948cbd676e36e9ae1dc7f9310b61b5bcd407b9438b0185ee27ceaf7b1df229c3b7bb3bf7c28d365
- TLSH T14B61C58158AEC0A1F7ED5C78ADF620D73B34ADC33187AE510074CBB68CCBB64600815C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\b6a6dfc8-f0dd-436e-9318-a2ffd392b243.tmp
- Size 2B
- SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
- MD5 99914b932bd37a50b983c5e7c90ae93b
- SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
- SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_0
- Size 8KB
- SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
- MD5 cf89d16bb9107c631daabf0c0ee58efb
- SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
- SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
- SSDEEP 3:MsFl:/F
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_1
- Size 264KB
- SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
- MD5 d0d388f3865d0523e451d6ba0be34cc4
- SHA1 8571c6a52aacc2747c048e3419e5657b74612995
- SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
- SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_2
- Size 8KB
- SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
- MD5 0962291d6d367570bee5454721c17e11
- SHA1 59d10a893ef321a706a9255176761366115bedcb
- SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
- SSDEEP 3:MsHlDll:/H
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_3
- Size 8KB
- SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
- MD5 41876349cb12d6db992f1309f22df3f0
- SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
- SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
- SSDEEP 3:MsGl3ll:/y
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\6cd78413-fad0-45ec-a80b-4e14de5c136a.tmp
- Size 1KB
- SHA256 ea62ac1f92eb5c68bd7e0d56ff2b123e8d95493274a2cf4a0bcb016a1ed7a710
- MD5 4acc3ab4c7ea09ff449d8f12f335162f
- SHA1 4f658b4f744b01c2ad52cc8c9ea369ade55f4604
- SHA512 cde4f09d5469498d5abfe9f9880cf327d5fc804324887fff065ec5c67ee28dfd5afb0581238e85f3d466bc98bb575c521a298e332ed0bc9ed60fd944dff54407
- TLSH T1BF2199F3C3E9956E892556F0AA14AE2BCE1D0516832C7D2989D0EE2793E3471E04165B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\cd03fba4-00aa-45c4-9f19-322100e24cd3.tmp
- Size 111B
- SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
- MD5 285252a2f6327d41eab203dc2f402c67
- SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
- SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
- TLSH T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\904eaa8c-5b5e-4f51-8012-a32578e989eb\index-dir\temp-index
- Size 1KB
- SHA256 586ead364bb634f441427cf80980b337697b36105319ab8fad8f06e4b8c10ea0
- MD5 ef14c418e71d01067a855f35fa4afbaa
- SHA1 b0a59ead2e130a478a15ab58d23c5ce1f8541c0a
- SHA512 3b5c7bc120446acf3eb13997885950efc52bc7513bf6839965df0f0111f635ddf7404175d6545ba7d9822065e098c98194220b0c28ad9cc87596d50956a169d3
- TLSH T1E72168525D525F97FE945274103D1456B33592CC03547E0FE2FDE1359C86700BD85858
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\904eaa8c-5b5e-4f51-8012-a32578e989eb\index-dir\the-real-index
- Size 1KB
- SHA256 1ce1774362c8b546b22d0bf9378c50fd7f0b3ae5fb3a091e697e585de3785d73
- MD5 fdb18714551c289df524633e9a8f53dc
- SHA1 a1781a6f5d550bf2300265c3be576cf54d9880d9
- SHA512 836541e037104eb3532751667342d6457f90255491c267d8743bf1d64da4986cacc6a36c6d1bcf031e2bca80a8faca07f5d1723b0e6ec706281e4204c7ff57c8
- TLSH T19621886211630F67FD402376156D58933335E5085354770F93E7E139DC81B44ADC6DE4
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt.tmp
- Size 371B
- SHA256 ca7e2130410bd4c56d6aa6e75df7de38babd109b85ebfeb4d7b5e92824d2361b
- MD5 44442456f3e28243c755f5aa66806a91
- SHA1 ebddca8369961ba7d8c025ab1e56c586b73c7519
- SHA512 6d42da2dddc0c5c299119237c8b4d40d7691626d3e24d6de4d9c74be49aaf08f10d33044bae923391559a10a7261be6645cfa7e2aace771756eb14e68cdee4ce
- TLSH T1EBE068B32DE32574BAAB83EA307480A00045BC448849EC4E406E63DBD0B6355748AC57
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
- Size 4KB
- SHA256 f6d35f8316861d4481f2ea1c0a7aa0a4f734811b2f66373787177cb9f9daa3cd
- MD5 87aecabd8ca233dc03a87bc2fc77477c
- SHA1 9914d197c52f31e07ce344b7077c852efd8b6ca8
- SHA512 8063a98e87848f369821c693f67527ddb6bd8832d4a7dbcf451ccd380430d2212bfa7f2ec4064d893c7608c3d89d5dcadf0bce3ad2ba10ea8784ab6d823f644c
- SSDEEP 24:KBHkzAvI/K7hu1aSSNjyX2RCtUpInK9h61WSwfnyXLc3EMeI5KEhU1iSh6Ck77:KMsI/K9ucPyZGInKb6ADydRI5KyUMN
- TLSH T17891C81034B9064079BD3909A2788F2B5281B173705DEA7F3FBD65A64E76E054CFC9C9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\787468a9-2eca-4e6d-994e-65d83ce6e0cc.tmp
- Size 22KB
- SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
- MD5 f768bcb451a187c18099961c484eef8b
- SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
- SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
- SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
- TLSH T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
- Size 3KB
- SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
- MD5 904e6e94a1d46374c8630cfd86cc729f
- SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
- SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
- TLSH T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\a6c0e1b5-7374-443e-862d-d1d568bca745.tmp
- Size 26KB
- SHA256 7bad068d6458733ea88840a89c5f5384bcc080236398e97382bfde032ab6366f
- MD5 ca5638ba91240f9c0dc957bbff2be4a2
- SHA1 2e44d859766ff93b9f4a63baf595a60e7d22ddb7
- SHA512 a0307640af7b05be9d70ac6484681a542a472925db3b93af3aa5aaa6a220d9f1c3b3d894f72d11563f6bff8403d31a605864519f62fae38a18e0a4c7dc6711cc
- SSDEEP 384:qiFbQkUSvq8NT8TUNTUlIlOdnrEEE9ckX5mV8Gyxy5Lus4H7vBEERIIll:hFVqGwgEnsA/oEus4H75E4LP
- TLSH T1ABC22AF298D7983AD9AE9B43E73D3D169EBCC017F5805A40B788491CCC861BFE34A811
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\a9253dcd-9eb8-4c85-a0a8-8df803ebdd94.tmp
- Size 18KB
- SHA256 f8a8b43c58f32ead8774e29dcd4f982dabce9cdc726d8da84a585bde3e874486
- MD5 cb5004ceec82562dc0b4ad2035c664e4
- SHA1 7b2d1664432f1d00d1658413e2a476c35e917e54
- SHA512 75401bd9ab2ce42974e8771531785846eb412c06adcce763db156d7dac8fb7bfc873c5ced62ec8b9866ffcb03e9e64776164eb9f6d7222fb3e914400be5b836c
- SSDEEP 384:3QkUSvJ8NB9dnrWaE9ckX5mV8Gyxy5Kys4H7vBEERIIll:JJCnsA/o7ys4H75E4LP
- TLSH T11A826B72ACB87C3B5AB3E554F14A3A17AFB49117DAC41B80D5DD9A1D00CA2DC234BD26
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\dfc9ad28-92f6-4ce2-a4d0-b1989caa5d5a.tmp
- Size 8KB
- SHA256 44eec33682262fc28869f762faffc6aa4b26109eb9f179556d335bcc5cb03cb0
- MD5 9d986c8a280271109b88fe037b15dbf7
- SHA1 6de85c73985cedecef116a9cb1f21e48720a0b90
- SHA512 ca9c13fec6120a66c5ecab664377597f7c01ca104d430f7c8aaf8195212999b46826e82de1785a11f87203ebe901f7c543baa1d5c622dfaaf7c881be4d53cde9
- SSDEEP 192:AGNT6WLkQmiUyzmDLEbnckX5m9r8GyimU4lshcU6:AGNT6a0s6LQckX5mV8GyVs2U6
- TLSH T1CD02D835BC787C7B9EF3AD49B54726179FE4212BE6852F44DAE81E1D00D729C2306827
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\e14f61d0-80f3-4d52-9f6f-a371a11f155d.tmp
- Size 8KB
- SHA256 61bfc1167241962a45a4ca037bd99ee96d524180e6faac0647f63fd2d7be5d95
- MD5 645a6486cd99d658a53c865e4da6fd9c
- SHA1 b8f9850d025891ccc2bcd506064e9e03ffb2805f
- SHA512 90e16bfdb13c7f99fa005f6a24599ece4f24ee35879ff3a3ce5234d17b598cfb2c493dd6468923c468221b00bfad51d474f1b84bfeb03f3ffa82659b29f33869
- SSDEEP 192:vGN06WL4QmiUy3DEEbnckX5m9r8GyimRy5ZY/Meshq5U6:vGN06aYYEQckX5mV8Gyxy5Ws4U6
- TLSH T139120A36A8B8B86B5EE3E454F44736179EA55127D7856F40D5DC1E1C00EF29C230B927
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\34ec00ad-923f-46d2-a04f-27c0773fe465.tmp
- Size 13B
- SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
- MD5 2aa9e263ee3796d9ce358460a2451b4c
- SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
- SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\fb0eef48-60f3-40c2-8113-8cd246dc60a2.tmp
- Size 18KB
- SHA256 13b4633bf048da1c85f52895f559d409548651b63bb54e661c985983afdd8134
- MD5 256227059eeb775261b18d915eaded89
- SHA1 fa329ffd0524c9a578d273d68b50044f601cd71d
- SHA512 92432bc6a8e9e6a2379b0221ac440d548710ecbac56d800ecfd100e26268277e17b82803370e21bfbacbc0a59e0ec52a28461738d591d54d631ceab1c5f951bc
- SSDEEP 384:QQkUSvJ8NBRdnrWaE9ckX5mV8Gyxy5Ps4H7vBEERIIll:4JCnsA/oYs4H75E4LP
- TLSH T172827C72A8B87C2B5AB3E550F54A3A17AFB49117DAC41B80D5DD9B1D00CA2DC334BD26
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\Grabber.exe
- Size 233KB
- SHA256 aa9b0d8f374a57c5d376c589e24bc73fde7223d27f60ca011467b0ef7167af03
- MD5 f506b641367b0b7eedfb02d2ff2569c4
- SHA1 bcc08bdda6b8de222422e6616886d20de7793bdc
- SHA512 ca992593de35ac2890a2e3d5244cebac087f90187eb83a09eaed286f37daccb8d1e9f9fe73a17ed6226a278c3e1b85074ed0975d67ce54b8e19f2adcbc88ee0a
- SSDEEP 6144:6DpjcgHgo3CSGwXDyoDhyiDcNdQGIxFYX+x6IE8e3OpU8:ajcgHSSfX2JbOf
- TLSH T18B347D2523B8CB23F25F9FBE95B0055FCB71A207E90BF78E1C88A5E92416741E809D57
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\KS AMK GDAR.exe
- Size 49KB
- SHA256 d02b5c1f1bdb516df251ea8465aab5bcd32715149ad9367e58a72a0016ac6864
- MD5 965cf971816ca8c2009b151df0052f9f
- SHA1 7040d694ee60dc8be1a88a3e37cd1127764b720f
- SHA512 6015127664f46511a1c451dbd78e235b4c3e584ddb0482f88f55d684329ca4fc39e9d7d06ff64f777ba493e419072e5c446915c74ac8d78255db14918e69b147
- SSDEEP 1536:/AnETpStUhjSUbUIXXUWkA/53XOcMXOczXOcgXOc1XOc6hYlUOeUk+4malmgXOcO:/AnETpStUhjSUbUIXXUPA/53XOcMXOce
- TLSH T13933C68DE7D54121D6BF5EB119B31249C3B066934917C62FBCD805CB3B2AB988281BE7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nso2454.tmp\LangDLL.dll
- Size 5KB
- SHA256 09acfc5ee34a1dfa1af3a9d34f00c3b1327b56641feebd536e13752349c08ac8
- MD5 014a3be4a7c1ccb217916dbf4f222bd1
- SHA1 9b4c41eb0e84886beb5591d8357155e27f9c68ed
- SHA512 0f3d1bf548e29a136150b699665a3f22c6ea2821701737363fa2920b51c391d735f1eae92dea8af655e7d07304bd3d06e4aff3f5a82fa22bcf5d1690013eb922
- SSDEEP 48:S46+/iTKYKxbWsptIpBtWZ0iV8jAWiAJCvxft2O2B8mMofjLl:zsuPbOBtWZBV8jAWiAJCdv2CmfL
- TLSH T143C19470F3C248B9C491413368E737D36612EE746784500F9B6311AA38209E7AD3EBC3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nso2454.tmp\System.dll
- Size 12KB
- SHA256 7a9ddee34562cd3703f1502b5c70e99cd5bba15de2b6845a3555033d7f6cb2a5
- MD5 564bb0373067e1785cba7e4c24aab4bf
- SHA1 7c9416a01d821b10b2eef97b80899d24014d6fc1
- SHA512 22c61a323cb9293d7ec5c7e7e60674d0e2f7b29d55be25eb3c128ea2cd7440a1400cee17c43896b996278007c0d247f331a9b8964e3a40a0eb1404a9596c4472
- SSDEEP 192:nenY0qWTlt70IAj/lQ0sEWc/wtYbBH2aDybC7y+XBDIwL:n8+Qlt70Fj/lQRY/9VjjfL
- TLSH T1F6427D1193B089F2F590593805A67F2A6FBEAC5C27E44963CFE345853D702DFA47A243
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tmp8667.tmp.exe
- Size 11KB
- SHA256 1a7610cd29d915c7f4ad68d5238e4dd3cfc973de57ad81a177ba8ae5cb9a86c5
- MD5 5870c114ead5c7fe9c360e763f315824
- SHA1 86376c63ab2f442c21d1f59fa56e91c77ce9d55b
- SHA512 f6148e2041086d55a280e8540ad5c4ae563e025ca6339c3a2611a863d9a623c7cdfa97e260e7e1a46a1f5f2b9b2771aada8ab0772e0a1b3541eca2766ebb8958
- SSDEEP 192:9YJsjftImptoisXPebmjsTytSiV0zQGE6X:y6pK7ebQsetSiafH
- TLSH T10532E94CB7E84534D2BE4B3608B6D3125770F0038D27CB5E1DEE64EE2D2671569A2F90
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\7H1QP8W5XRYX7Q4DC21Y.temp
- Size 3KB
- SHA256 ef4a2fd7f9c1af7a4ef94265075bb59ddd4299afb25f2c3aa359fd0fda126bbb
- MD5 ffa393e341d5fa8b44e745c45b7cba92
- SHA1 dc714bd31b8c4840311b05a3c9302fd1340f58d1
- SHA512 29c601adcca72fbb443effe9229265d1298200e9ddcaac859153b7fc5bc8d37ed34faf7223d6a0f856c08ecb945acced81b819546f82945f3252af7d9cdf6710
- TLSH T1478103419BD505EEF3F29E7255B3BB156B7FF9098B148B4D408542080C72B05957EBA3
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
- Size 3KB
- SHA256 b388d25baaa1dc5b88a02f1f6de109ba05b978004931ddfa0fe41d172d96d10b
- MD5 ebd6f282087469a88501480a5f831e0c
- SHA1 dca7bb26f1ed68d22386cd12bb5f050aa9be5e4d
- SHA512 ed05f56629cc527b78e6aec914551770829d1d52726211f29431b5a8f33e081b198d3705517640ce1d5d07b3f302f89b951a71ba507365ca26297c19e30e3958
- TLSH T1C88103419BD505EEF3F29E7254B3BB146B7BF9098B188B4D408542080C72B05957EBE3
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\Downloads\3dSeriesGG1161.0Setup.exe:Zone.Identifier
- Size 168B
- SHA256 aba499922e0e62c81d7c05e607e1edb45bc475de2a3a59bea9f788644708d7ce
- MD5 217b1d47ab45c29f3615eb789f309458
- SHA1 43ee80747f6dd7f83bcda573a3a0cf9cd598d3b5
- SHA512 dd2d48d80e97d9e62f2d9500304e6479a61349dd2b8b6ac0713df3316aecc6c9ef151e8b69277b315941c86a8b83e8551fc58f60672302239d960b307ee8263b
- TLSH T1A6C080974808C05D174637C10D7DC55CB94F65505DDA9974E440504F5515C24CFE863F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\Downloads\3dSeriesGG1161.0Setup.exe:Zone.Identifier
- Size 168B
- SHA256 aba499922e0e62c81d7c05e607e1edb45bc475de2a3a59bea9f788644708d7ce
- MD5 217b1d47ab45c29f3615eb789f309458
- SHA1 43ee80747f6dd7f83bcda573a3a0cf9cd598d3b5
- SHA512 dd2d48d80e97d9e62f2d9500304e6479a61349dd2b8b6ac0713df3316aecc6c9ef151e8b69277b315941c86a8b83e8551fc58f60672302239d960b307ee8263b
- TLSH T1A6C080974808C05D174637C10D7DC55CB94F65505DDA9974E440504F5515C24CFE863F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\Downloads\d382dfeb-d070-405c-abe2-a80ad4b594f6.tmp
- Size 7KB
- SHA256 76b82d57effd053419646721345ebdf440bd49de295946e6d2b7822de48ce972
- MD5 883627dd0335b2aa782fee07e8d945f2
- SHA1 12ebe951b64f4c8e879e2713c3bd2244a781b503
- SHA512 cc2f0d07700c85c92d3063a920f939c4c080dd7f6f0dae889dbe9e2bc71be934011f3a73f636bb8e403e5f3ff0e18ff0f2bbd19c83ebbbb3002b044e11c2109b
- SSDEEP 192:40wv6uX126ABpeqh2IoZnJT5FS5amIfXcE7ggY6NGg:SRFtspeqh2Io5JT5F0Ez7rL
- TLSH T100F1F8C88BBCE417D16E09BC1466129B063152728265F7DECCDC69F536C3391294A3CF
- MD5 SHA1 SHA512 SSDEEP TLSH