hxxp://google[.]com

Analysis

user interaction
yes
max time kernel
150s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260911-en
resource tags

arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
07/11/2026, 17:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://google.com
Sample261107-vj4kpsfd78

Score

7^/10

discovery ransomware

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1704	WinDirStat.exe
1092	WinDirStat.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files\WinDirStat\WinDirStat.exe	msiexec.exe
File opened for modification	C:\Program Files\WinDirStat\WinDirStat.ini	WinDirStat.exe
File opened for modification	C:\Program Files\WinDirStat\WinDirStat.ini	WinDirStat.exe

Drops file in Windows directory 14 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSI28AC.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{30CA2173-D51B-4B78-B89C-7F384EBDB728}\WinDirStat.ico	msiexec.exe
File created	C:\Windows\Installer\e5926d9.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF692DF1057BF1CB26.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\e5926d7.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{30CA2173-D51B-4B78-B89C-7F384EBDB728}	msiexec.exe
File created	C:\Windows\SystemTemp\~DFD9042C70D7DD4E76.TMP	msiexec.exe
File created	C:\Windows\Installer\{30CA2173-D51B-4B78-B89C-7F384EBDB728}\WinDirStat.ico	msiexec.exe
File created	C:\Windows\SystemTemp\~DFB65A27A9E8C39984.TMP	msiexec.exe
File created	C:\Windows\Installer\e5926d7.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\SystemTemp\~DFD89BE2677C72AD4B.TMP	msiexec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5284	msedge.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000303acd984d2017e10000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000303acd980000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900303acd98000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1a303acd98000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d303acd98000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe

Modifies registry class 36 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3712AC03B15D87B48BC9F783E4DB7B82\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3712AC03B15D87B48BC9F783E4DB7B82\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3712AC03B15D87B48BC9F783E4DB7B82\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1570888168-524493533-3242721904-1000\{9C24D8CC-0AF0-45B4-A130-2FD828807095}	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shell\WinDirStat\Icon = "C:\\Program Files\\WinDirStat\\WinDirStat.exe"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Drive\shell\WinDirStat	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\9C601F64C0900D3488510DB39AAF559A\3712AC03B15D87B48BC9F783E4DB7B82	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3712AC03B15D87B48BC9F783E4DB7B82\SourceList\PackageName = "WinDirStat-2.9.3-x64.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3712AC03B15D87B48BC9F783E4DB7B82	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3712AC03B15D87B48BC9F783E4DB7B82\PackageCode = "86363D15D513D91498339EA6F1D80E95"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3712AC03B15D87B48BC9F783E4DB7B82\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3712AC03B15D87B48BC9F783E4DB7B82\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\Downloads\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shell\WinDirStat\command\ = "\"C:\\Program Files\\WinDirStat\\WinDirStat.exe\" \"%1\""	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shell\WinDirStat\ = "WinDirStat"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3712AC03B15D87B48BC9F783E4DB7B82\Version = "34144259"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3712AC03B15D87B48BC9F783E4DB7B82\ProductIcon = "C:\\Windows\\Installer\\{30CA2173-D51B-4B78-B89C-7F384EBDB728}\\WinDirStat.ico"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3712AC03B15D87B48BC9F783E4DB7B82\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3712AC03B15D87B48BC9F783E4DB7B82\ProductName = "WinDirStat 2.9.3"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3712AC03B15D87B48BC9F783E4DB7B82\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1570888168-524493533-3242721904-1000_Classes\Local Settings\MuiCache	MiniSearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3712AC03B15D87B48BC9F783E4DB7B82	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1570888168-524493533-3242721904-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Directory\shell\WinDirStat	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3712AC03B15D87B48BC9F783E4DB7B82\SourceList\Net\1 = "C:\\Users\\Admin\\Downloads\\"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3712AC03B15D87B48BC9F783E4DB7B82\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3712AC03B15D87B48BC9F783E4DB7B82\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\9C601F64C0900D3488510DB39AAF559A	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3712AC03B15D87B48BC9F783E4DB7B82\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Directory\shell\WinDirStat\command	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3712AC03B15D87B48BC9F783E4DB7B82\SourceList	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3712AC03B15D87B48BC9F783E4DB7B82\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shell\WinDirStat\ = "WinDirStat"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shell\WinDirStat\Icon = "C:\\Program Files\\WinDirStat\\WinDirStat.exe"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Drive\shell\WinDirStat\command	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shell\WinDirStat\command\ = "\"C:\\Program Files\\WinDirStat\\WinDirStat.exe\" %1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3712AC03B15D87B48BC9F783E4DB7B82\FT_Core	msiexec.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\WinDirStat-2.9.3-x64.msi:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
6004	msiexec.exe
6004	msiexec.exe
1704	WinDirStat.exe
1704	WinDirStat.exe
5868	msedge.exe
5868	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1092	WinDirStat.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5136	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5136	msiexec.exe
Token: SeSecurityPrivilege	6004	msiexec.exe
Token: SeCreateTokenPrivilege	5136	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	5136	msiexec.exe
Token: SeLockMemoryPrivilege	5136	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5136	msiexec.exe
Token: SeMachineAccountPrivilege	5136	msiexec.exe
Token: SeTcbPrivilege	5136	msiexec.exe
Token: SeSecurityPrivilege	5136	msiexec.exe
Token: SeTakeOwnershipPrivilege	5136	msiexec.exe
Token: SeLoadDriverPrivilege	5136	msiexec.exe
Token: SeSystemProfilePrivilege	5136	msiexec.exe
Token: SeSystemtimePrivilege	5136	msiexec.exe
Token: SeProfSingleProcessPrivilege	5136	msiexec.exe
Token: SeIncBasePriorityPrivilege	5136	msiexec.exe
Token: SeCreatePagefilePrivilege	5136	msiexec.exe
Token: SeCreatePermanentPrivilege	5136	msiexec.exe
Token: SeBackupPrivilege	5136	msiexec.exe
Token: SeRestorePrivilege	5136	msiexec.exe
Token: SeShutdownPrivilege	5136	msiexec.exe
Token: SeDebugPrivilege	5136	msiexec.exe
Token: SeAuditPrivilege	5136	msiexec.exe
Token: SeSystemEnvironmentPrivilege	5136	msiexec.exe
Token: SeChangeNotifyPrivilege	5136	msiexec.exe
Token: SeRemoteShutdownPrivilege	5136	msiexec.exe
Token: SeUndockPrivilege	5136	msiexec.exe
Token: SeSyncAgentPrivilege	5136	msiexec.exe
Token: SeEnableDelegationPrivilege	5136	msiexec.exe
Token: SeManageVolumePrivilege	5136	msiexec.exe
Token: SeImpersonatePrivilege	5136	msiexec.exe
Token: SeCreateGlobalPrivilege	5136	msiexec.exe
Token: SeBackupPrivilege	4452	vssvc.exe
Token: SeRestorePrivilege	4452	vssvc.exe
Token: SeAuditPrivilege	4452	vssvc.exe
Token: SeBackupPrivilege	6004	msiexec.exe
Token: SeRestorePrivilege	6004	msiexec.exe
Token: SeRestorePrivilege	6004	msiexec.exe
Token: SeTakeOwnershipPrivilege	6004	msiexec.exe
Token: SeRestorePrivilege	6004	msiexec.exe
Token: SeTakeOwnershipPrivilege	6004	msiexec.exe
Token: SeRestorePrivilege	6004	msiexec.exe
Token: SeTakeOwnershipPrivilege	6004	msiexec.exe
Token: SeRestorePrivilege	6004	msiexec.exe
Token: SeTakeOwnershipPrivilege	6004	msiexec.exe
Token: SeRestorePrivilege	6004	msiexec.exe
Token: SeTakeOwnershipPrivilege	6004	msiexec.exe
Token: SeRestorePrivilege	6004	msiexec.exe
Token: SeTakeOwnershipPrivilege	6004	msiexec.exe
Token: SeRestorePrivilege	6004	msiexec.exe
Token: SeTakeOwnershipPrivilege	6004	msiexec.exe
Token: SeRestorePrivilege	6004	msiexec.exe
Token: SeTakeOwnershipPrivilege	6004	msiexec.exe
Token: SeRestorePrivilege	6004	msiexec.exe
Token: SeTakeOwnershipPrivilege	6004	msiexec.exe
Token: SeRestorePrivilege	6004	msiexec.exe
Token: SeTakeOwnershipPrivilege	6004	msiexec.exe
Token: SeRestorePrivilege	6004	msiexec.exe
Token: SeTakeOwnershipPrivilege	6004	msiexec.exe
Token: SeRestorePrivilege	6004	msiexec.exe
Token: SeTakeOwnershipPrivilege	6004	msiexec.exe
Token: SeRestorePrivilege	6004	msiexec.exe
Token: SeTakeOwnershipPrivilege	6004	msiexec.exe
Token: SeRestorePrivilege	6004	msiexec.exe

Suspicious use of FindShellTrayWindow 44 IoCs

pid	Process
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
5136	msiexec.exe
5136	msiexec.exe
1092	WinDirStat.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
2776	MiniSearchHost.exe
1092	WinDirStat.exe
1092	WinDirStat.exe
1092	WinDirStat.exe
1092	WinDirStat.exe
1092	WinDirStat.exe
1092	WinDirStat.exe
1092	WinDirStat.exe

Suspicious use of WriteProcessMemory 55 IoCs

description	pid	Process	procid_target
PID 4936 wrote to memory of 4980	4936	msedge.exe	81
PID 4936 wrote to memory of 5284	4936	msedge.exe	82
PID 4936 wrote to memory of 880	4936	msedge.exe	83
PID 4936 wrote to memory of 5980	4936	msedge.exe	84
PID 4936 wrote to memory of 880	4936	msedge.exe	83
PID 4936 wrote to memory of 880	4936	msedge.exe	83
PID 4936 wrote to memory of 5980	4936	msedge.exe	84
PID 4936 wrote to memory of 5148	4936	msedge.exe	86
PID 4936 wrote to memory of 5148	4936	msedge.exe	86
PID 4936 wrote to memory of 5148	4936	msedge.exe	86
PID 4936 wrote to memory of 5760	4936	msedge.exe	87
PID 4936 wrote to memory of 5760	4936	msedge.exe	87
PID 4936 wrote to memory of 5760	4936	msedge.exe	87
PID 4936 wrote to memory of 912	4936	msedge.exe	89
PID 4936 wrote to memory of 912	4936	msedge.exe	89
PID 4936 wrote to memory of 912	4936	msedge.exe	89
PID 4936 wrote to memory of 1008	4936	msedge.exe	90
PID 4936 wrote to memory of 1008	4936	msedge.exe	90
PID 4936 wrote to memory of 5600	4936	msedge.exe	91
PID 4936 wrote to memory of 3760	4936	msedge.exe	92
PID 4936 wrote to memory of 5600	4936	msedge.exe	91
PID 4936 wrote to memory of 3760	4936	msedge.exe	92
PID 4936 wrote to memory of 1136	4936	msedge.exe	94
PID 4936 wrote to memory of 2956	4936	msedge.exe	95
PID 1136 wrote to memory of 5172	1136	msedge.exe	96
PID 4936 wrote to memory of 3260	4936	msedge.exe	99
PID 4936 wrote to memory of 3260	4936	msedge.exe	99
PID 4936 wrote to memory of 3260	4936	msedge.exe	99
PID 4936 wrote to memory of 2064	4936	msedge.exe	100
PID 4936 wrote to memory of 2064	4936	msedge.exe	100
PID 4936 wrote to memory of 2064	4936	msedge.exe	100
PID 4936 wrote to memory of 5816	4936	msedge.exe	101
PID 4936 wrote to memory of 5816	4936	msedge.exe	101
PID 4936 wrote to memory of 5816	4936	msedge.exe	101
PID 4936 wrote to memory of 3788	4936	msedge.exe	103
PID 4936 wrote to memory of 3788	4936	msedge.exe	103
PID 4936 wrote to memory of 3788	4936	msedge.exe	103
PID 4936 wrote to memory of 960	4936	msedge.exe	104
PID 4936 wrote to memory of 960	4936	msedge.exe	104
PID 4936 wrote to memory of 960	4936	msedge.exe	104
PID 4936 wrote to memory of 2044	4936	msedge.exe	105
PID 4936 wrote to memory of 2044	4936	msedge.exe	105
PID 4936 wrote to memory of 5612	4936	msedge.exe	106
PID 4936 wrote to memory of 5612	4936	msedge.exe	106
PID 4936 wrote to memory of 5612	4936	msedge.exe	106
PID 4936 wrote to memory of 5620	4936	msedge.exe	107
PID 4936 wrote to memory of 5136	4936	msedge.exe	108
PID 4936 wrote to memory of 668	4936	msedge.exe	112
PID 4936 wrote to memory of 5800	4936	msedge.exe	113
PID 4936 wrote to memory of 5776	4936	msedge.exe	114
PID 6004 wrote to memory of 4628	6004	msiexec.exe	117
PID 6004 wrote to memory of 1704	6004	msiexec.exe	119
PID 4936 wrote to memory of 2328	4936	msedge.exe	121
PID 4936 wrote to memory of 2328	4936	msedge.exe	121
PID 4936 wrote to memory of 5868	4936	msedge.exe	125

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://google.com
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x250,0x7ff9d654c188,0x7ff9d654c194,0x7ff9d654c1a0
  2⤵
  PID:4980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1716,i,12904759581139571151,1518784205184441842,524288 --field-trial-handle=2856,i,5664377525173000250,2372478195411877140,262144 --variations-seed-version --mojo-platform-channel-handle=2924 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1592,i,12153302390034806558,11685798006502728464,262144 --field-trial-handle=2856,i,5664377525173000250,2372478195411877140,262144 --variations-seed-version --mojo-platform-channel-handle=2852 /prefetch:2
  2⤵
  PID:880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2252,i,4256587188803688075,6660334601580903862,524288 --field-trial-handle=2856,i,5664377525173000250,2372478195411877140,262144 --variations-seed-version --mojo-platform-channel-handle=2944 /prefetch:13
  2⤵
  PID:5980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3476,i,8215082175350589653,3498092189272496965,2097152 --field-trial-handle=2856,i,5664377525173000250,2372478195411877140,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:5148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3500,i,5374320256737601484,874143646018925840,2097152 --field-trial-handle=2856,i,5664377525173000250,2372478195411877140,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:5760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4912,i,18424783719722791156,1127310779733819971,2097152 --field-trial-handle=2856,i,5664377525173000250,2372478195411877140,262144 --variations-seed-version --mojo-platform-channel-handle=4940 /prefetch:1
  2⤵
  PID:912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3564,i,6157258670506234997,11294912094650411921,524288 --field-trial-handle=2856,i,5664377525173000250,2372478195411877140,262144 --variations-seed-version --mojo-platform-channel-handle=5116 /prefetch:14
  2⤵
  PID:1008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5200,i,15197221515419832119,14585250582560937330,524288 --field-trial-handle=2856,i,5664377525173000250,2372478195411877140,262144 --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:14
  2⤵
  PID:5600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5204,i,14652530105095978533,12405839264650130828,524288 --field-trial-handle=2856,i,5664377525173000250,2372478195411877140,262144 --variations-seed-version --mojo-platform-channel-handle=5132 /prefetch:14
  2⤵
  PID:3760
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5928,i,1173994923337540145,2062975464617233487,524288 --field-trial-handle=2856,i,5664377525173000250,2372478195411877140,262144 --variations-seed-version --mojo-platform-channel-handle=5940 /prefetch:14
  2⤵
  PID:576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5988,i,5452238229682030130,3411870308414257530,524288 --field-trial-handle=2856,i,5664377525173000250,2372478195411877140,262144 --variations-seed-version --mojo-platform-channel-handle=5992 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1136
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1128
    3⤵
    PID:5172
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5928,i,1173994923337540145,2062975464617233487,524288 --field-trial-handle=2856,i,5664377525173000250,2372478195411877140,262144 --variations-seed-version --mojo-platform-channel-handle=5940 /prefetch:14
  2⤵
  PID:2956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6392,i,16364853747486006492,7321413103201259248,2097152 --field-trial-handle=2856,i,5664377525173000250,2372478195411877140,262144 --variations-seed-version --mojo-platform-channel-handle=6476 /prefetch:1
  2⤵
  PID:3260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6736,i,17228735568777277254,14531787975503643937,2097152 --field-trial-handle=2856,i,5664377525173000250,2372478195411877140,262144 --variations-seed-version --mojo-platform-channel-handle=6728 /prefetch:1
  2⤵
  PID:2064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6880,i,1062465615357948148,13481539722334663730,2097152 --field-trial-handle=2856,i,5664377525173000250,2372478195411877140,262144 --variations-seed-version --mojo-platform-channel-handle=6892 /prefetch:1
  2⤵
  PID:5816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6868,i,2723112767452702669,17753128563010202358,2097152 --field-trial-handle=2856,i,5664377525173000250,2372478195411877140,262144 --variations-seed-version --mojo-platform-channel-handle=7048 /prefetch:1
  2⤵
  PID:3788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=5952,i,7546722180347586103,17671064561261733380,2097152 --field-trial-handle=2856,i,5664377525173000250,2372478195411877140,262144 --variations-seed-version --mojo-platform-channel-handle=6880 /prefetch:1
  2⤵
  PID:960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7184,i,13222355717417039935,14385700848541068642,524288 --field-trial-handle=2856,i,5664377525173000250,2372478195411877140,262144 --variations-seed-version --mojo-platform-channel-handle=7128 /prefetch:14
  2⤵
  PID:2044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=7180,i,15413018837967676487,2418557377384941310,2097152 --field-trial-handle=2856,i,5664377525173000250,2372478195411877140,262144 --variations-seed-version --mojo-platform-channel-handle=7088 /prefetch:1
  2⤵
  PID:5612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7520,i,4848022237881728937,10392025607817533134,524288 --field-trial-handle=2856,i,5664377525173000250,2372478195411877140,262144 --variations-seed-version --mojo-platform-channel-handle=7248 /prefetch:14
  2⤵
  - NTFS ADS
  PID:5620
- C:\Windows\System32\msiexec.exe
  "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\Downloads\WinDirStat-2.9.3-x64.msi"
  2⤵
  - Enumerates connected drives
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:5136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8500,i,4979549546296539811,11790904621043550428,524288 --field-trial-handle=2856,i,5664377525173000250,2372478195411877140,262144 --variations-seed-version --mojo-platform-channel-handle=7592 /prefetch:14
  2⤵
  PID:668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8492,i,12562646337101330539,9876632087774818533,524288 --field-trial-handle=2856,i,5664377525173000250,2372478195411877140,262144 --variations-seed-version --mojo-platform-channel-handle=8244 /prefetch:14
  2⤵
  PID:5800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8400,i,14668886207790459697,13547306890118874989,524288 --field-trial-handle=2856,i,5664377525173000250,2372478195411877140,262144 --variations-seed-version --mojo-platform-channel-handle=776 /prefetch:14
  2⤵
  PID:5776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5204,i,1391522147514135630,5848401079199015261,524288 --field-trial-handle=2856,i,5664377525173000250,2372478195411877140,262144 --variations-seed-version --mojo-platform-channel-handle=7144 /prefetch:14
  2⤵
  PID:2328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=8360,i,4343953427540952758,7283669384358285856,262144 --field-trial-handle=2856,i,5664377525173000250,2372478195411877140,262144 --variations-seed-version --mojo-platform-channel-handle=8308 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5868

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4044

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3024

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6004
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:4628
- C:\Program Files\WinDirStat\WinDirStat.exe
  "C:\Program Files\WinDirStat\WinDirStat.exe" /LegacyUninstall
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  PID:1704

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4452

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2776

C:\Program Files\WinDirStat\WinDirStat.exe
"C:\Program Files\WinDirStat\WinDirStat.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:1092

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e5926d8.rbs

Path C:\Config.Msi\e5926d8.rbs
Size 8KB
SHA256 b6a02f07ee9cf40a544e9efde8590fbb1bfe8b66c4aeb8e7bf5b9c9c2de2714d
MD5 b0102343517ac0eede3386f8d850829f
SHA1 7778df334c70d3f6020a123e452f9427bce3054e
SHA512 dff92fa9fafa7d1e063aad25b2bf43199e3eeff41531a6906c364549437a4a1af7975e746e969b8db32c4d25954d23df62faa199a22127727094650bc2c8cad0
SSDEEP 192:+3EtRq4RqFRqSRq9o7C1wa16pIyRka16pCywBjpMvpFs:+wqSqfqMqKv3fk3oND
TLSH
T1D50224412A0089D3FC920F3DC2C71A623772DAF9BB54624F9E9C85209F027E95F556AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WinDirStat.exe

Path C:\Program Files\WinDirStat\WinDirStat.exe
Size 2.8MB
SHA256 c6925752fe688aa72115723f23dbb95a7e1c55f094a7d7f30acb5f509a38045b
MD5 31fc1a6ad7ac224b6eb472c84f8eed6b
SHA1 7563684b998fce25f7dc0c56d98d65fcbb726652
SHA512 e30322090df7be2ce77f13e26f0322a8938acf0a980596450cede3b70882965edf7633ce2d24a3aca3f05c2bdda726576e479744d940cc1b75dee4bd81907d23
SSDEEP 49152:wDEA75/vIwAWZRwVLjLWoUozm3T3rFfiOaVcu9MvsLojQFVsO:G1ojCTgV4sF2
TLSH
T170D58D13A5E401ECD137C1F8CB669E02E772744A033466DB439099672FB7AE94E7E722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WinDirStat.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinDirStat.lnk
Size 1007B
SHA256 819b2fb1d2d852c42800a21bb9b8f29bb2de7c8297a182e452e43c6dcab63b35
MD5 9d2f51b73c9ee2006e8f844c14bef5cf
SHA1 9dfc96b57b7c6eb7a98b0dba9003eb29e863e2b4
SHA512 65c5af109d0547879fe7dcf877c3ecb602a8ee7ac670b0402ad8418ff536da201882f830a9dd4f2731ea8c02b3be795c10109b905efe3f1743fb1e7c15c053a8
TLSH
T1E811C2510F9A0B1EF5F7873D5B2333129632FC04EE6887155185614D0C756109D5CFBA
MD5 SHA1 SHA512 TLSH

Submit Download

~inDirStat.tmp

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\~inDirStat.tmp
Size 1KB
SHA256 6a179d0f0559f39d9ccca9164f234fc87347b6b4ba53d47761e7ae086262f5b7
MD5 931282355419a021e768222baa35bee1
SHA1 07fe662fd00a7235ccf69f0e7bbc7dbfa8e55b08
SHA512 1d680834385c341d18208be097dc630d27f3ce21adb6b84d7153b92000c058603dc07cad43518b6087783cf777c494bdcb733a6de01075705d7633e258842f9b
TLSH
T1D5115C510F9A071AF5F7463D5B6233135632FC04EE68C7255185614D0C7A6109D5CFAA
MD5 SHA1 SHA512 TLSH

Submit Download

30069012ED3CF5DB92F9F4FC78D55E2D_87238437CEFCADF00F1385E31A888EF4

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\30069012ED3CF5DB92F9F4FC78D55E2D_87238437CEFCADF00F1385E31A888EF4
Size 1KB
SHA256 f7662c9699657f6f20ed941410c78cef8edd0d9f009064099f3c686eec305b79
MD5 bf7c120eee7b8a7bec2ad6ec1a887273
SHA1 415caf0654e24dbd0ae7d76afd72f69ac87b4af2
SHA512 a6b69709e5d05dddb4f786a2a245e770189c91c174158a7f7645058453152b3e32d1e448b9d65a99f82122e8bc48a2d8f95d8cd960dab70ca2f1b7416872a167
TLSH
T11931F726CE5D98012B400F208DF4D2381DFAABF8458C11D62534C9D29D2ABBF6F1681F
MD5 SHA1 SHA512 TLSH

Submit Download

4E4160FB650E5091C535216313A4ECD3_232E37A8C44AA22C559A9A98F0210595

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\4E4160FB650E5091C535216313A4ECD3_232E37A8C44AA22C559A9A98F0210595
Size 2KB
SHA256 cfea6ecb8fa484fa5a6248970f8a3a295730507fd021ce7e8c07ceeb1d82eb03
MD5 7d8f204db7c07244421b1592c6b84ccf
SHA1 58c674d8b3c35b19220e37ec0350aeab41ca3a9f
SHA512 d61bfb029e7d6be914bea05f126c33c62584467624cb9b8dec15eb0f3427f9c9573e9d3835607222eed86dcc8aec2cb90fd9578ab8eb616d6db27e3b168c4f74
TLSH
T107411B068B91796CF553EE91CC8C88322EB587F528003687265DC5CF56A6F376F7502E
MD5 SHA1 SHA512 TLSH

Submit Download

68FAF71AF355126BCA00CE2E73CC7374_E5F521CA60C5ED8C2B4E2BF399FE2061

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\68FAF71AF355126BCA00CE2E73CC7374_E5F521CA60C5ED8C2B4E2BF399FE2061
Size 1KB
SHA256 3062c99c50e9f4cfd96608f838b075cf7791be48b5c044b3d1e8f64b09fab89f
MD5 00e037b179230a9a3a8d6269729332cb
SHA1 15d8049c7f23a87a1f32826bfd6b343764c43723
SHA512 402b26a821f5f171a78fc9e8bdd9175200b1d247ea519f6c97aaccbd9f145fe3a2dcaaec787af7ec8241ac7aaa733eb33610500b67a8f6b681ccc7ff8bcc8d7d
TLSH
T11E3195612B622C952EA30C805F8AFB3EA97452D208301496347DD3C69E97B7B766581D
MD5 SHA1 SHA512 TLSH

Submit Download

30069012ED3CF5DB92F9F4FC78D55E2D_87238437CEFCADF00F1385E31A888EF4

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\30069012ED3CF5DB92F9F4FC78D55E2D_87238437CEFCADF00F1385E31A888EF4
Size 412B
SHA256 4e0575751987eb6963e26bba394cb99290bb8db0dd54291f19daece99349c150
MD5 8da6599d25c3c461a079988bb784ae38
SHA1 7760d756a7b168e6cf5d1fd577d54dcada6b7da1
SHA512 8f4091fea0f2f66bfd2114c4158b4a00d1b96cba40dc1c0ef81febfc1cce5841b2acf6302fe4d81a385bdb9aca17407af5c779f7212f4d9982b7c9dd3f653632
TLSH
T158E0680831FF6104F2798C7D03D961306E38B1A32045A6BA0A5152187349C00CCF2BA5
MD5 SHA1 SHA512 TLSH

Submit Download

4E4160FB650E5091C535216313A4ECD3_232E37A8C44AA22C559A9A98F0210595

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\4E4160FB650E5091C535216313A4ECD3_232E37A8C44AA22C559A9A98F0210595
Size 420B
SHA256 5ae27c61ba58c214ebb9a4d1b6bc6e1af2ee795735567fcf1b0ff04cad0838f9
MD5 4538b3b5183d98b965a35c82c26c2928
SHA1 8c9bbc518809a3a028b58fe5dac7acafd736f39b
SHA512 5d8959911d540440ed3d1524bd83ae28c562ccd83769b221bc9333d194416162d4d7b52de8f63ef77b665c1fe563f69ac1b71ead2a7a279a563fd1f54597c97a
TLSH
T1E6E0681C32F9804EE632E43447D9B1264E5EF2AB84941BAA2E4062065F01F004D33E28
MD5 SHA1 SHA512 TLSH

Submit Download

68FAF71AF355126BCA00CE2E73CC7374_E5F521CA60C5ED8C2B4E2BF399FE2061

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\68FAF71AF355126BCA00CE2E73CC7374_E5F521CA60C5ED8C2B4E2BF399FE2061
Size 412B
SHA256 aa49c558ce4bbf8b298042ada59e9e545494b0dc68b64248266df745f3d60efc
MD5 4f9b4b075bedc2f07948feeb2e421ac4
SHA1 a6c8f4688fc63bd39a4f65541b2801f74363542d
SHA512 4247e2f2bfcb6b3bfff095eea16ee086e72e90878ad9b9ddc17e7b1764781eb95c4d017e796d18e436622a4414b5ace67205debe2c9a3d005e2fee700c5ca382
TLSH
T1C5E0682833FB40B9FA34E63D01CE27A00E3BB637050D1AB42AE003147A10B404D55870
MD5 SHA1 SHA512 TLSH

Submit Download

22603f74-2963-411b-9b73-6d934fd26072.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\22603f74-2963-411b-9b73-6d934fd26072.tmp
Size 32KB
SHA256 71ee7155f5fa701195247bf1ad11d64481025dad0ebe7b73bbb7574d5dd5399c
MD5 5e2f4f7495329cee7005dd15b91a382a
SHA1 33969578f9706666c2d35e3c62fb1c71c0d94532
SHA512 7f7995fa70a1e052a6e33b027caac37fbfeb5880df8f6cc4def1e9671f9ff627c6c17dcc74d3f2056d47c6eff3ca2dc63865aed4c81678f09765e1dbfdbecc8f
SSDEEP 384:nAiFAQkUSvz38N88TUNTUlIRwwqJpm2b2f19KNLLYm761dH7vBEnVJgL/7IzJIIj:bFoz3zwgTcmn9Qop1dH75EVbLj
TLSH
T1C6E2B1F198E79977D9EE4B93A37D2D0699BCC113B5884A84B7D81C1CCC861BFD30A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5d0d78ac-eaa8-46c9-ab8f-7d5f487334e2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\5d0d78ac-eaa8-46c9-ab8f-7d5f487334e2.tmp
Size 27KB
SHA256 c8009a55a6c6bc41356e6571c1ad0352841ea0c586d9294bbf699e520e3fc466
MD5 68db725a40bc251ce5b3c2d99567d019
SHA1 ebc468dbc7b5209c57399b6e4f6222f44eda8d31
SHA512 8c12d5ccc00109539c07e0b98f377820c7730c8c4624ebedd7a53ccea046b1aed27e78825759eef25ba7599b342a1e6fe84d46a8edbc286244beef692fef83fa
SSDEEP 384:nbiFAQkUSvz38N88TUNTUlIRwwqJem2b2f19KNLLYm7xdH7vBEnVJgL/7IzJIIlp:2Foz3zwgTNmn9QoMdH75EVbLj
TLSH
T1D2C25A32EC64DA7BADEB8E95E34E3A07EEE0515389DC4AD4E9D85D1C00872DE130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

83faa48d-f32b-4ef3-ab7f-76ecd40e6b26.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\83faa48d-f32b-4ef3-ab7f-76ecd40e6b26.tmp
Size 27KB
SHA256 2762ed77ad24e31303a583471b19445deda0c3308cc41788d370f118e0f8f2b9
MD5 cf2d6e7b238e059ced2be23dbc7a2f1c
SHA1 19b1a3b4fcf081fb5463b27d02cdc1537ba3e72b
SHA512 c3b7f2b7cf3cead4028f744a8024e715aa5d00b4ff03d1e5e27a86dfbba026b97e5ca799949d126dc7aff2d9905673ca064594c9e6369b8fc0ed35ee5cb1e6e8
SSDEEP 384:nRiFgQkUSvz38N88TUNTUlIRwwqJem2b2f19KNLLYm7xdH7vBEnVJgL/7IzJIIlp:4FIz3zwgTNmn9QoMdH75EVbLj
TLSH
T177C25B32EC64DA7BADEB8E95E34E3A07EEE0515389DC4AD4E9D85D1C00872DE130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

89004dda-6d65-41cd-b395-608b55634ab3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\89004dda-6d65-41cd-b395-608b55634ab3.tmp
Size 26KB
SHA256 ee8f2d1a710e535dd374dbf2f398a8b6db96cfe7cd87b4d0d8493ff2015d38d7
MD5 06b35a632a0372fac59fa0012a82a654
SHA1 29a5287b1b92d16baacc01460e9784d53c08b094
SHA512 f2c2f5ca9784bd20cbbbe6ab1866b3494639de9dde43f52474b3650ed996553719e670bad13f36b603b878eadeb73cf01c43b942d27f2fc463fc3de3743852ad
SSDEEP 384:nRiFzQkUSvh38N88TUNTUlIRMwq/V9b2f19KNLLYm7LdH7vBEnVJgL/7IzJIIlp:4Fdh3zwgT+A9Qo6dH75EVbLj
TLSH
T110C24A32EC64DA7BEDEB8E95A34E3A07EEE0515389DC5AD4E9D85D1C00872DE130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c9a92cbd849eecadff108aa705c8bffeefa88b48debb99ebb0a61da60d1ea55d
MD5 3eab7477df5ca8aedeabf1695c6ec99e
SHA1 47e45efb75000cd4d9e036210864e45f420f2323
SHA512 0465738c688cb93e5238241731fb0a05395e81c567aa2fffc33a9f478454ed7814c50cbc62e962000f8c572df3a8f4d2780caaf1956dec8d990b4097d0125ee8
TLSH
T11ED02B1FBAAD12A0E12331390637420030C4E540480310188450032228C268100E44F0
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 cb58490731045c4d4ef8ae90fd5b5394608566e0de59eb2fcf0ecafd0e27c1e4
MD5 a1449147626cc89b1f49004bd7e5d7ce
SHA1 e848ee4aaefc37442c33cbecb41170227e80799f
SHA512 09a97d82a24abaaf732d89be9ab3b4434bd39ecb04c04633d236c4752119bff4b381aa75666a5cca804d38dfd7487cee9fe3800fd60f91ad3cfffc59a6e0ec34
TLSH
T1B5D02B1BBEAD02A0E11331390637420031C4E140480310188490033228C268104E44F0
MD5 SHA1 SHA512 TLSH

Submit Download

809aae73-13d0-4c28-a3d0-2be2a616c517.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\809aae73-13d0-4c28-a3d0-2be2a616c517.tmp
Size 14KB
SHA256 02eaede1a7a412424fd019546b3b6d3bc40e577eff3361da35d86016b20db5f2
MD5 2942b8fe47bdc23670f55d414b4b9707
SHA1 1fac18a51280d226e8ed213a577122839ba165ee
SHA512 ac9fc57acfb9a017a8e29b9ba2b551ea0df1282797bdcc27fe5da5946297f81759d45f5ba1c7b3bf582d86357e549ff90a34d7b1472025ece34cea7a2600b3fd
SSDEEP 192:sxZNRR5cBWo/fFsVqDodpO4haK//W6+WNfxlZ+YW/Y0YmedZ8kIg5Ka5GJTlH6:sxZNxmWo/fFsVRt/bxI/5XI/QWGK
TLSH
T13462FB526D34E9778CC7D609BA35BF26D3F5503299921E4CAAFCC92C04DB6ED220781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

94937ab7-d497-4a0f-922e-48108fda020c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\94937ab7-d497-4a0f-922e-48108fda020c.tmp
Size 15KB
SHA256 25877ab3f28934487317d4741e7a8a086b161726b1c336ae9fe1d5490b0b236d
MD5 41e5ffd6280dba99d2faafe341124a2d
SHA1 f306f67c2ab9bd3c3f23df8789a0a2734e444539
SHA512 b6a02b58b643e4bd1f5c2413bb5193bf47488591d29a7ba8076b0ed21e478af0ab6005e7584ee5483f26c3b37f640ef799a8c6a7dd6e4fbed7eed0c44b0564f9
SSDEEP 192:sxZNRROcBWo/fFsZqDodpO4haK//W6+WNf5xJHlZ+YW/Y0Y+VZO8kIg5Ka5GJTla:sxZNWmWo/fFsZRt/b5TI/5Hy/QWGK
TLSH
T17B62EB52AD34A9779CC6D609BA35BF26D3F5503299811E4CAAFCC92C04DB6ED320781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9e273090-c387-4c2c-bc0c-72c4a29c6aee.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9e273090-c387-4c2c-bc0c-72c4a29c6aee.tmp
Size 28KB
SHA256 7e5c0efbe62817fc26e7111fa924548ed0c54e74db7ffb89f5210c999d5de653
MD5 741caa4e5283e663de2f3e3453954f46
SHA1 3b6324cfed1d6ce1c5d6ac02126b58c0901742fd
SHA512 ac00c1db14fb285d5f4f4c3e11378b36cdcc5d34b4526b93e60f071dd1fe86400d4d6051a59d9c5674b0ee3bc06730c08c986f9e67854a3eed2a96cde8ecc0ca
SSDEEP 768:SPcas8Tw23fWRmLJQt18F1+UoAYDCx9Tuqh0VfUC9xbog/OV3VOLl/hf0+7Yroq/:SPcas8Tw23fWRmLJQt1u1jaKVOLph8+s
TLSH
T107D2093F640CCB7E4FC01A99DC16AF976EA802C7A6688D4447FE994C02C77EB51264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000073

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000073
Size 60KB
SHA256 a221cbf72963df1c02c8bc202b159379f26e3d0d06225a5933209e745040e35b
MD5 b90c0e06b88c09158b13db21c7fc9ef7
SHA1 a4b968f5abcd2addd2d8f2d3e6fc01f4127c95a3
SHA512 430aadb5315738f414c2d4ca0d9e2be42f5242a3b28765993602aed4b34e334d854a88a051e6519877b7ffd8a5bf4ee7276885d6daec541826dba878f8c07f2e
SSDEEP 1536:iw916VqIkIFHzR32SF2Sjm+KW3IS7uchJEsZP8:nngaGzR32ceS7uchJ1ZP8
TLSH
T18C530227CA3085D2572D05004B9EF35A1A6079FDEA09CD7E920157F772ACAACFE20E21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000074

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000074
Size 68KB
SHA256 2033d4c0dcdab8b765e78c9c1845742d2589b0f1c56a06b701e91f536035f85c
MD5 047bb9fd0930eca58ce326cdca8634c0
SHA1 b9fa0a8cc2fe5e274bb20d28ba8581139949cec1
SHA512 c4e022dcfd4e98313189200eba4b545a65163a7365107d082085b4c49a2f57402fc1480c95984acbfbaef179dbdcc11895dc7fea875d3783a7c5d2a99743b07d
SSDEEP 1536:7WiFK/+t3/ZhLVxdengIiVyWT2tiuwqVMfNidV/yd2db:7MMZhLVxQnqVyWTVfNid5pdb
TLSH
T1C8630262AF4CAB7E25CC41839FD2A335D0E8DD19481B407C36549BCFBA549712B39E63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000075

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000075
Size 19KB
SHA256 af18b3681e8e2a1e8dc34c2aa60530dc8d8a9258c4d562cbe20c898d5de98725
MD5 1bd4ae71ef8e69ad4b5ffd8dc7d2dcb5
SHA1 6dd8803e59949c985d6a9df2f26c833041a5178c
SHA512 b3ff083b669aca75549396250e05344ba2f1c021468589f2bd6f1b977b7f11df00f958bbbd22f07708b5d30d0260f39d8de57e75382b3ab8e78a2c41ef428863
SSDEEP 384:/Und3PKicut4yiFkC9RWzlJpa2/CKYOyDJmCZyXJTW4PO821GyLjSoBwNeS:0UizQDYlJpaQCKYOyDJpI5Kx821DS3Nz
TLSH
T13692E1670BCE314E422EE25FA316A51733E41BE1EFE49640D6AA70D81C38DA243179D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000076

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000076
Size 65KB
SHA256 f12de7e272171cda36389813df4ba68eb2b8b23c58e515391614284e7b03c4d4
MD5 56d57bc655526551f217536f19195495
SHA1 28b430886d1220855a805d78dc5d6414aeee6995
SHA512 7814c60dc377e400bbbcc2000e48b617e577a21045a0f5c79af163faa0087c6203d9f667e531bbb049c9bd8fb296678e6a5cdcad149498d7f22ffa11236b51cb
SSDEEP 1536:654NcGosP0w+UcGoanS2RR/QwNdIvEsgXn:6iRsw+UkC5QdEfXn
TLSH
T1055302E4123CA75C49FC43EA5434D635BA4B31ADABD4102FB69BC4258F6EA824447CFB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000077

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000077
Size 45KB
SHA256 44c44c5e9cca81e4e3a8b88e6c45ef531d9ec84d198955739a4e3ca82e76f0f3
MD5 afc7d5b0c3d21def3418a9fc43858f83
SHA1 bf9c629cc33dd8475f36005870ea625624acc7b0
SHA512 04cd55b52af530e7c411b4cddb385a34304cdcaeb84b8b2e9e912f7089a125c61cb52b7966707d9fe74c986034fa6f53b1626eb0caf1f163d6ec9044462fb3f2
SSDEEP 768:zAr5A78yAtyYOzjMPHwIVoveCDn4mSE1NNJi8AlLaTmPXrnr/WPY165c3KfHJqma:8FAZAjOzjMoOy5T13Ji8EaSPjrcMgfW
TLSH
T16123E1975618B5E2D5A97B351AC3718F5F9BC0D884EB22CA258B604BE0D0CF791860EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 5KB
SHA256 4720df6f7c0b33fb15df9cd0f0743e1b3852d52081c74f2fc8068b9e463a2657
MD5 835b8b74dac637531f7394b3a9a8c173
SHA1 9e30d536b84b4a773e542e9d6038e1b53655ec8c
SHA512 aebea32063b84b79c5221a0169fb0d87e699aa693d8c54687f271e05a1fe759a3692d6168b69b062b449c1562776c9925ab017a4d1e5134138b401bb1d0a09b2
SSDEEP 96:Qf24kP+jIamfskldUWwsPUyLAHKs6sKblTtBIYmOBA4wdOmWYmiHSjSwpeswDD59:Qf24kP+jIamkkl93PUyLAH56rHB3BA4S
TLSH
T17BB11A40004D0145CBAF5830C2DE3A8278F3FF5231E7AFCAD8D2E9B55646BE35B84A28
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 4826fe4a561c20b95bee075ee4466a291cdf25d82e4f673856c6bef0021d4aa2
MD5 ae4d3e096ae2e16573bab5685a1bcf39
SHA1 4d8cc86e4c6987eea393a74f61d5bde1f75a6f9f
SHA512 53d66062bda3a2d6dc119ffe49d209b3f0939a866cdf86756ecda885c7980f30565eaa5971b46750703318f181b276a21041a2069179910a9f930932690ec69a
TLSH
T12F61F88115505295D7EF4831D6E223873CF4DD9231532DDD1C9BF8B9560AB775C80F68
MD5 SHA1 SHA512 TLSH

Submit Download

9a2cebc7-1edd-4b8d-b7b2-9e9af21833e8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\9a2cebc7-1edd-4b8d-b7b2-9e9af21833e8.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

51bf6414-68be-47a2-96c9-21ecca344b4d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\51bf6414-68be-47a2-96c9-21ecca344b4d.tmp
Size 210B
SHA256 7e24c3cde79933b3175224bceac771811737a2fae10defbd8ce978f608180d91
MD5 cbd6e5e424b168ce3d1861b6bbfd121e
SHA1 8243fbcaddf7c82ad5102ea2f3d9319c167ebf0e
SHA512 99151cdcea6c085d4e65e454e3eb1b18c325277a1985aafbfd7860f5d69a490ba8eb4ada278f9907394eef5308cbabf96338ae426f62a35ae97def53b035102c
TLSH
T104D022332200B2718A6C29AC1129AD4EC77300690C12E5E824F1A48A2AB5D2E0A0B0CE
MD5 SHA1 SHA512 TLSH

Submit Download

a9b7416e-6adf-41a5-a283-a83db4c8369b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\a9b7416e-6adf-41a5-a283-a83db4c8369b.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

e6e5e832-7381-4146-8244-08aaa43cf671.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\e6e5e832-7381-4146-8244-08aaa43cf671.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

e968f5af-11f9-4136-8b4c-165c0797703a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\e968f5af-11f9-4136-8b4c-165c0797703a.tmp
Size 6KB
SHA256 a0ce06cb542c379fdb66aabce3acfeae2dcb75839587ada87e0f6ae96cc486ca
MD5 cef9e1f7698e46c61e294ec8f3ac9b5a
SHA1 9af045481c4531e6f341e342dd2f7c4484ba1f04
SHA512 b773148047c798e3a1f4fa63f2c09fc73c2d5ef6501b1d3d04333bd592c1c8e1a7ecbb19feb82e11d6aa8cf8cfc0a11638ef974f6fd0f2f159721a4d9e6a55e0
SSDEEP 192:D1tRWmLsygt8qlaaKie/uBf3JBa155ighvCMPGT:D1tRWmLsygt8qlaaKie/uBf3JBa155i9
TLSH
T1C1E1ACF7C7E8862DC91156F09B146F1ECE1E0928832C3C5AC4E8AE5BD3E2871E25575E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 dcefb38b3a7885f1a5af06bf74fc415edcfb4fd1bbde5c3dceabe22a25d22d02
MD5 b16bb3e7c1052414e0547d42e64f518f
SHA1 095c7aa5d0f7f49bd770779e71982c67f8b03185
SHA512 7721c0aaadda2fcce0a31cde593fd0edc67fbd7a0ecbba574b4e3a9d6696df310fa4086943e8b568d12d816b18c6cd77c674bf659f60f9aa5980a4b46c625e7b
SSDEEP 192:sxZNRRFo/fFscqAzodpHQi/W6+WNrYW/Y0YzedZ8kIgjaJ:sxZNNo/fFscQ//bR/5OI/jW
TLSH
T1A142D856AD38A93B9CC7D209FA15BF57D3F9503291911E48E6FC8A2C05E76DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

abb39031e58561f3_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\abb39031e58561f3_0
Size 207KB
SHA256 7d93b9986583465d06854d9889d9f7fbffccfbabe89e7f888d4cc20532ce1c58
MD5 3803bc2afa64c9e5b9388ba4797028cd
SHA1 74be73f7ba26e28fbe4232d235d761daeefdd4ec
SHA512 18f8964427ffce79591d7c6f756af9366abde9914cc49c5607a2b657ea3991500e75b32aac0318e5dd5e054c56ee969674148ffcdb0b4bf88a0a7f233b29d61d
SSDEEP 3072:1QOgp7hzBCKMJVIO/i99BLbKcIdvXnjv/L+KJZ6:OO89zB6zIO/itL2cI5r1JZ
TLSH
T1DE246C726300F87FB5239EA1627F7F4D3C35A127DD0686BCE1A4E9309AD6DF20116A58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\index-dir\temp-index
Size 72B
SHA256 42d2f8fb64cd3fc9f9578100e0729a9236abb2d8f7b443c470955a0bb4921c81
MD5 09e1168947e516c89044d1d2257f12cd
SHA1 bb097e04483b1fc3618f06cfb4e75a9b9c32ff04
SHA512 366ff22d759bb698464b3c0338da904209f9b0eb5bd2315d7677ca52782c9cbc07a8f512b9a5b2516d6f54c53acb131ffd4b38bc275a7fadbd58e9838df3284e
TLSH
T10AA0023145D298E5CE0186712192334A63634D206162DB0782B001588A575934215124
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync App Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 24KB
SHA256 e4f452302df1dce9811e3c6d6719bc8b2d18c4848d268ca592a59bc97f7857da
MD5 f1430657eafa364331abf2048f98ef97
SHA1 b9ba6b1c130bf2ac7e45a0f00ece1df758aed094
SHA512 bab3fffab034e6f885de07d521e917904057b70df11444330f59ede9ce47dbad2fb2f977eeb215cc3e3bbf44a0944475b58d4c5fab9d485cc34b6c52f251315d
SSDEEP 96:K8cAKF62iU4K5CeWgKXqfCusKjKUUgK9a+2vOKY4nwAKtSWGVCKGQ9XKKwcO21WV:ir/+SvIrlfrljh9DdgslV9rnAnBRk
TLSH
T131B2771531BA12453CBE290881B5972F128235B33159EA3B7FFD44A68E6BE085DFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

bdea6a35-e045-450c-9340-966ed6f68337.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\bdea6a35-e045-450c-9340-966ed6f68337.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

cb3ffa57-dcce-42c3-ab60-d662030bc7eb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\cb3ffa57-dcce-42c3-ab60-d662030bc7eb.tmp
Size 414B
SHA256 74dec2bb315ed88ccd9586517885cc20329c030bdeaa5d36edb3e7eda3bfd89a
MD5 77b1c255fcd0204a679239c2dc519d5a
SHA1 844d397fdb5e5257d7a32929fd009dbad0debaf6
SHA512 68331f84040d454fe5c584d1729964ab0968f93949a4c7cc9dd200e55b0c7b00b1844571474f84e8c77af0e93866f6b271edec410b9f83aea3ac1f849f1d7f82
TLSH
T1DFE02BAAC861ED271EFC0B68A0544785E751536B2B41490F3A3C920D8FB162A52DEC1C
MD5 SHA1 SHA512 TLSH

Submit Download

fb6d86af-9fbc-4a74-a66a-6842336418e4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\fb6d86af-9fbc-4a74-a66a-6842336418e4.tmp
Size 14KB
SHA256 eff6a6b907d015fa8bb8492b71f9d565ac6b207f5dc752c89222c565b3cde1a4
MD5 b631220ed64e89e16a706756f67d95d7
SHA1 18f01ab4b4be16d48673cf486deaae42fc2dc1fd
SHA512 cc8d861d9ea6b481d13c5a23e518f8d86b23f6020148cb73ec457a2ce7bee9b5395b4e1ba7a597e369f74bce5afdd2671b8b3c77832cb8710c8cfea2add01d22
SSDEEP 192:sxZNRR5cBWo/fFsZqDodpO4haK//W6+WNfxlZ+YW/Y0YmVYZ8kIg5Ka5GJTlH6:sxZNxmWo/fFsZRt/bxI/5XO/QWGK
TLSH
T15E62FB52AD34E97B9CC7D609BA35BF26D3F5503299811E4CA6FCC92C04DB6ED220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 1541eb47482e9b2310bd962dbe4f7e5099b9976719ab9dc76a71e762f3984de7
MD5 dcdaf147704fe81c721f98bb79ad6476
SHA1 b79c9d70190d73e820e14b4c7682d003bb81dbcc
SHA512 c0d43327de81ff07d36687a9ba95b88f6bbc189583483cfeca89c0b534074118524bf4f4c0b47d43225299e90d1c8298b149abb3d81dcaf2ab7fabefd49c0ae5
SSDEEP 384:nciFiZcI638Ng8TUNTUlIxBwqsnub2f19KNLLYm7wdsa+VYVUgL/7Izyof:HFQ63DwgwBv9QoPdhgWU
TLSH
T136C24A32DC54D9ABECEB8FE5AB8A7607DDF0525385DC9AC4D9D86D1C009B19D030BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d6247a44-f089-42a6-a750-6c977afb3e15.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\d6247a44-f089-42a6-a750-6c977afb3e15.tmp
Size 25KB
SHA256 8e2928853a664162927e348140bb056e85fe040e59f689d0b5abbeed289a5ed1
MD5 2cc8b7beef7fc5af7b008efa9c5b77df
SHA1 d56ebf22bab58b77a3e199a381ba1396b6b3e0d1
SHA512 e641a9bfe2db88a4fbd84552d682acf52f74295826639f183a12654165a7e372ce9f113fa38518a998f117b4fa69f38af0722330c24d6a44f3405630e3d9c55a
SSDEEP 384:nhiFiZcI638No8TUNTUlIxBwqB2+gb2f19KNLLYL2sa+VYVUgL/7Izyof:IFQ63XwgwJ+59QoL2hgWU
TLSH
T136C23935EC58D9BBECEB8FD5AB8A7607EEF0116384AC59C8D9D45D1C008729D1307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e9e1200f-2576-4b71-bd48-02648d2efe21.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\e9e1200f-2576-4b71-bd48-02648d2efe21.tmp
Size 32KB
SHA256 d4920719fa98279afef0c25c0f725d70e67102e55716de454a1aeab20e3f789f
MD5 27e22589ee1fddf1b1c63a1192eeac67
SHA1 4ca77b107750b6f638e9943d0569f52afdbf289a
SHA512 e95b405f654a26b58260034bd6609225b7514ac62b2a7997fb02808295a9550c96b24ef60bd00d0fb36ac54697a6fcb9752af10ac9c0ce1c8ea97a1146689215
SSDEEP 384:nAiF+QkUSv+38NLP8TUNTUlIRwwqCpm2b2f19KNLLYm76OdH7vBEnVJgL/7IzJIk:bFu+3QPwgTDmn9QopOdH75EVbLj
TLSH
T134E2B1F198E79976D9AE4B93A37D2D0699BCC113B5884A84B7D81C1CCC861BFD30A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

~earchHoverUnifiedTileModelCache.tmp

Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\~earchHoverUnifiedTileModelCache.tmp
Size 21KB
SHA256 bc7a15226809654152b9901ef74d46d0671dc846d5304f4bc24982ed230e37ad
MD5 d91ef0b4da2ddfeaf0c4166289beaf1b
SHA1 dee5c3f9b560db72160148feb0e5e1a8ef4e0a04
SHA512 476b5cdff2ba0264cf6b35f0a9fd8c7bd14092c0bee81423b0268662b4af659603ae74431e797c823c7d0e88515c206cbc9837da3d2e32b5db220ab36fa0e234
SSDEEP 384:ZJWJYVca12krtuVm+RbfQOVjeQ8RJojYghnjUocYW65Pom5s+GDa50R7HcT3MYXX:X+YVcWr+l8RJoYg9jUocY/ds+GDa50RA
TLSH
T1DCA25A743AF41755F3F29F759AF1A95A643AB866AC00DB4D0122028D0937D92CDB0F3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WinDirStat-2.9.3-x64.msi.crdownload

Path C:\Users\Admin\Downloads\WinDirStat-2.9.3-x64.msi.crdownload
Size 2.4MB
SHA256 96c4c4beb63c7c5ad6b1a206f96560d7a9a2b6063f3cd175a82f392977a9af5d
MD5 629bf5c2c87be2b477259dce501edf8a
SHA1 99ddc1daff07e4f53d64eefc9cd7db870a29965f
SHA512 484b11c57f686773e68426df96ec36ef432b6d45c404c550f57246a1fbe8ea6220946a1d03579fef3292c85959f0b39bcbd30df839f96a5fb646f967e15169fe
SSDEEP 24576:tcYKbx6c9X8C5k5bDeYYGW2g5W4Zcs08anD93rAQuM/neO4LEN:OYob9P54eYYb2gDyGe3rATuneDL
TLSH
T117B5F11DF584E325E957133E85C2DFB31720AC249322221662C9BF5F3EB6860E3667D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WinDirStat-2.9.3-x64.msi:Zone.Identifier

Path C:\Users\Admin\Downloads\WinDirStat-2.9.3-x64.msi:Zone.Identifier
Size 1KB
SHA256 e81854c591adb7fea994d38ee7594855f444f704ba0920e57b4f5ae4445637d1
MD5 c675670537b89f31bfdd7a416e6722b1
SHA1 10b307b694cd08e6695d52ffc0436bcbc64aa8fd
SHA512 28b1165bf388f0ea46a9597464a735bf4aef36189d29643cdc5e0ea917e7dbfeedea4d3d5e7dde229f313f10b55ec87dec6e710cf6dd3376ca681b9e788afc4c
TLSH
T1EC1165FBD40986ABAF07A5C36D9D6DAE6027B4A7CE4B104CD35AC189D0C0574B0D352B
MD5 SHA1 SHA512 TLSH

Submit Download

d8cbf012-8bea-4132-848b-f60339e510f0.tmp

Path C:\Users\Admin\Downloads\d8cbf012-8bea-4132-848b-f60339e510f0.tmp
Size 15KB
SHA256 dc474bdc2436f46007776b60cba396f894e2dce5ef4b648b577f365061fd71ce
MD5 0b49751bc922ed0003948f0b5e5bfed3
SHA1 5bb188ce0809e79232fcf13cb23145ebf13afae5
SHA512 48746a6e9d59d9b6c2e3e86a1f8647cd33f56a2b0c4592dea6cf5e965168dc0c6185f313c89b5e527b6284d097b0e7f8022f6ebb0278dd542a8a06aea805a952
SSDEEP 96:2vec36tY89PNaU88y0Ccy4GcmgzpbCwuQdcb8:2vktr9PNa8y0CTcrpuwuQdcb8
TLSH
T1A0720C02B92AE32FD5A6AF365C9AC0ED5312FC07CF16204735DAB32F76B42824C52755
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.6MB
SHA256 e6634b2f4d03a0fdaf2185a5a3ca920e8c1904dc280fb906815965d5b72579ff
MD5 dbd4933af02555e08b1b309f4a159136
SHA1 307eba97775ce744e840ebbcb76068365cd85e86
SHA512 215a69a7493303e778fda2f11a7250a08755532e67c43566a9df42adf0951d7f214ea2a060d50c95d33e4a9def841b569ebe6e8390f346d42c4d5b67466bc77b
SSDEEP 24576:k2gmSp1UdoO/vvTL6WROBk3afqp6A4lL22iN3JEh4q6YkNlU4ag2rsLWx:N
TLSH
T10647BF2436E92110E7F79E3CA8F0AA27493A7D5B8C19DE8D05415F4E0921FB1E873F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{4609d9d4-7131-47ab-bb64-4d49cdb0d6c3}_OnDiskSnapshotProp

Path \??\Volume{98cd3a30-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{4609d9d4-7131-47ab-bb64-4d49cdb0d6c3}_OnDiskSnapshotProp
Size 6KB
SHA256 a174a109c0f6e8059ed525464b6c3b18a9991d486a42d962a57622319611b79d
MD5 e40dd0bbd2ede62dc5dcb98bd44e166c
SHA1 47457a8576040284cc5e51a01cd2e195f7194c09
SHA512 029c37c637f0fb0de136fc68ff1fe153f318fac3cf2dce5e3183427188a36d75085f092dad9933af0048d6b6258b16bcc68a8f09c407c8dad66d6b4721311ed8
SSDEEP 96:FdxI8MJkWyvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpuN:lpb++ZVmN
TLSH
T146D189085AF54311E2B3AB7229F14557A877B912EF33CB8E0198638E2670914F936F5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/6004-578-0x000001E18EE50000-0x000001E18F912000-memory.dmp

Download