legion | a635117713d2803b77763a576b579c26ea79503704d3efad8e59eb42859bee67

Analysis

max time kernel
144s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
24/04/2025, 14:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Free_Apps_v3.4.7z
Size 25.5MB
Sample250424-r9rr2stycw
SHA256 6bf1e861222fc2305b934336d45416503c33eab6552fdf73ed96b49d1641bb44
MD5 42e673f1e9c73c1648e06d2c3acccb4c
SHA1 70dac399c6998a8a76acca0937c5d556e7f0eff0
SHA512 3d56b81234c677337bd0a0eb01479d492980021051874acc6c86ba9a1f61455f8ec5a9d510d5f78419950e14426681c7e0bed6029789acd3297490d1ecd83e8d
SSDEEP 786432:yxv/wjJb2NCG2g/tXBRjytNDiv6y4/ImX:o/4JyJ2KtRRuzDm6LgmX
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

legion discovery downloader loader stealer

Malware Config

Extracted

Family

legion

Attributes

url_paths
front.php

back.php
user_agent
Mozilla/5.0 (Windows NT 6.3; Trident/7.0; Touch; rv:11.0) like Gecko

Signatures

Legion family
legion
Legion, RobotDropper, Satacom
Legion aka 'RobotDropper' or 'Satacom' is a malware downloader written in C++ and Legion stealer is written C#.
downloader stealer legion

Executes dropped EXE 3 IoCs

pid	Process
4736	7z.exe
4640	crashpad_handler.exe
4668	PwTech.exe

Loads dropped DLL 25 IoCs

pid	Process
4428	MsiExec.exe
4428	MsiExec.exe
4428	MsiExec.exe
4428	MsiExec.exe
4428	MsiExec.exe
4428	MsiExec.exe
4428	MsiExec.exe
4736	7z.exe
4640	crashpad_handler.exe
4640	crashpad_handler.exe
4640	crashpad_handler.exe
4640	crashpad_handler.exe
4640	crashpad_handler.exe
1212	MsiExec.exe
1212	MsiExec.exe
1212	MsiExec.exe
1212	MsiExec.exe
1212	MsiExec.exe
1212	MsiExec.exe
3744	MsiExec.exe
3744	MsiExec.exe
3744	MsiExec.exe
3744	MsiExec.exe
3744	MsiExec.exe
3744	MsiExec.exe

Blocklisted process makes network request 2 IoCs

flow	pid	Process
24	4428	MsiExec.exe
25	4428	MsiExec.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4640 set thread context of 5256	4640	crashpad_handler.exe	106

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1780_298761545\_locales\uk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1780_298761545\_locales\et\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1780_298761545\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1000_729607052\_locales\fa\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1000_729607052\_locales\en_CA\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1000_729607052\_locales\nl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1000_729607052\offscreendocument_main.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1780_298761545\_locales\ka\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1780_298761545\_locales\el\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1780_298761545\_locales\sw\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1780_298761545\_locales\sl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1000_729607052\_locales\eu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1780_298761545\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1000_729607052\_locales\af\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1000_729607052\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1000_729607052\_locales\fil\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1000_729607052\_locales\th\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1000_729607052\_locales\it\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1780_298761545\_locales\lo\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1780_298761545\_locales\my\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1000_729607052\_locales\te\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1000_729607052\_locales\iw\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1000_729607052\_locales\es\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1780_298761545\_locales\mr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1000_729607052\_locales\lv\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1000_729607052\_locales\gu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1780_298761545\_locales\ca\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1780_298761545\_locales\sv\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1780_298761545\_locales\ta\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1780_298761545\_locales\ms\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1780_95733997\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1780_298761545\_locales\de\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1000_729607052\_locales\lo\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1000_729607052\_locales\kk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1000_729607052\_locales\lt\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1000_729607052\_locales\sv\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1000_729607052\_locales\ta\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1780_298761545\_locales\hu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1780_298761545\service_worker_bin_prod.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1000_729607052\_locales\mr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1000_729607052\_locales\be\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1780_298761545\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1780_298761545\_locales\am\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1780_298761545\_locales\ar\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1000_729607052\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1780_298761545\_locales\es_419\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1780_298761545\_locales\bg\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1780_298761545\_locales\hr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1780_298761545\_locales\zu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1780_298761545\128.png	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1780_298761545\offscreendocument_main.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1000_729607052\_locales\ne\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1000_729607052\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1000_729607052\_locales\ru\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1000_729607052\128.png	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1780_298761545\_locales\th\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1780_95733997\LICENSE	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1000_729607052\_locales\am\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1000_729607052\_locales\el\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1000_729607052\_locales\sr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1780_298761545\_locales\en\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1780_298761545\manifest.fingerprint	msedge.exe
File created	C:\Program Files\msedge_url_fetcher_1000_465633039\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_91_1_0.crx	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1000_729607052\_locales\hr\messages.json	msedge.exe

Drops file in Windows directory 29 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSI8D1D.tmp	msiexec.exe
File created	C:\Windows\Installer\e57c0a0.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC287.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI432A.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI53A7.tmp	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC2B7.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI527D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI434A.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7F5E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4319.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7F6E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7F3D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e57c0a0.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICFC8.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID354.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\e57c0a4.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7F7F.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC354.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID4AC.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI42E8.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4308.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC218.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7F5D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8BF4.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC12D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\SourceHash{69D5489F-0C0E-4620-89DE-AACADB817D59}	msiexec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PwTech.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133899800971564720"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3975168204-1612096350-4002976354-1000\{27CA3C88-BC8D-4498-A808-3F25B55005E3}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000_Classes\Local Settings	7zFM.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3975168204-1612096350-4002976354-1000\{C68CFE03-1399-4606-9C47-4946A2CE03F3}	msedge.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4780	msiexec.exe
4780	msiexec.exe
4164	7zFM.exe
4164	7zFM.exe
4780	msiexec.exe
4780	msiexec.exe
4164	7zFM.exe
4164	7zFM.exe
4780	msiexec.exe
4780	msiexec.exe
4164	7zFM.exe
4164	7zFM.exe
1780	msedge.exe
1780	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4164	7zFM.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
1000	msedge.exe
1000	msedge.exe
1000	msedge.exe
1000	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeRestorePrivilege	4164	7zFM.exe
Token: 35	4164	7zFM.exe
Token: SeSecurityPrivilege	4164	7zFM.exe
Token: SeShutdownPrivilege	5384	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5384	msiexec.exe
Token: SeSecurityPrivilege	4780	msiexec.exe
Token: SeCreateTokenPrivilege	5384	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	5384	msiexec.exe
Token: SeLockMemoryPrivilege	5384	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5384	msiexec.exe
Token: SeMachineAccountPrivilege	5384	msiexec.exe
Token: SeTcbPrivilege	5384	msiexec.exe
Token: SeSecurityPrivilege	5384	msiexec.exe
Token: SeTakeOwnershipPrivilege	5384	msiexec.exe
Token: SeLoadDriverPrivilege	5384	msiexec.exe
Token: SeSystemProfilePrivilege	5384	msiexec.exe
Token: SeSystemtimePrivilege	5384	msiexec.exe
Token: SeProfSingleProcessPrivilege	5384	msiexec.exe
Token: SeIncBasePriorityPrivilege	5384	msiexec.exe
Token: SeCreatePagefilePrivilege	5384	msiexec.exe
Token: SeCreatePermanentPrivilege	5384	msiexec.exe
Token: SeBackupPrivilege	5384	msiexec.exe
Token: SeRestorePrivilege	5384	msiexec.exe
Token: SeShutdownPrivilege	5384	msiexec.exe
Token: SeDebugPrivilege	5384	msiexec.exe
Token: SeAuditPrivilege	5384	msiexec.exe
Token: SeSystemEnvironmentPrivilege	5384	msiexec.exe
Token: SeChangeNotifyPrivilege	5384	msiexec.exe
Token: SeRemoteShutdownPrivilege	5384	msiexec.exe
Token: SeUndockPrivilege	5384	msiexec.exe
Token: SeSyncAgentPrivilege	5384	msiexec.exe
Token: SeEnableDelegationPrivilege	5384	msiexec.exe
Token: SeManageVolumePrivilege	5384	msiexec.exe
Token: SeImpersonatePrivilege	5384	msiexec.exe
Token: SeCreateGlobalPrivilege	5384	msiexec.exe
Token: SeRestorePrivilege	4780	msiexec.exe
Token: SeTakeOwnershipPrivilege	4780	msiexec.exe
Token: SeRestorePrivilege	4780	msiexec.exe
Token: SeTakeOwnershipPrivilege	4780	msiexec.exe
Token: SeRestorePrivilege	4780	msiexec.exe
Token: SeTakeOwnershipPrivilege	4780	msiexec.exe
Token: SeRestorePrivilege	4780	msiexec.exe
Token: SeTakeOwnershipPrivilege	4780	msiexec.exe
Token: SeRestorePrivilege	4780	msiexec.exe
Token: SeTakeOwnershipPrivilege	4780	msiexec.exe
Token: SeRestorePrivilege	4780	msiexec.exe
Token: SeTakeOwnershipPrivilege	4780	msiexec.exe
Token: SeRestorePrivilege	4780	msiexec.exe
Token: SeTakeOwnershipPrivilege	4780	msiexec.exe
Token: SeRestorePrivilege	4780	msiexec.exe
Token: SeTakeOwnershipPrivilege	4780	msiexec.exe
Token: SeRestorePrivilege	4780	msiexec.exe
Token: SeTakeOwnershipPrivilege	4780	msiexec.exe
Token: SeRestorePrivilege	4780	msiexec.exe
Token: SeTakeOwnershipPrivilege	4780	msiexec.exe
Token: SeRestorePrivilege	4780	msiexec.exe
Token: SeTakeOwnershipPrivilege	4780	msiexec.exe
Token: SeRestorePrivilege	4780	msiexec.exe
Token: SeTakeOwnershipPrivilege	4780	msiexec.exe
Token: SeRestorePrivilege	4780	msiexec.exe
Token: SeTakeOwnershipPrivilege	4780	msiexec.exe
Token: SeRestorePrivilege	4780	msiexec.exe
Token: SeTakeOwnershipPrivilege	4780	msiexec.exe
Token: SeRestorePrivilege	4780	msiexec.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4164	7zFM.exe
4164	7zFM.exe
5384	msiexec.exe
4428	MsiExec.exe
4428	MsiExec.exe
5384	msiexec.exe
4668	PwTech.exe
4668	PwTech.exe
1000	msedge.exe
1000	msedge.exe
4668	PwTech.exe
4668	PwTech.exe
4668	PwTech.exe
4668	PwTech.exe
4668	PwTech.exe
4668	PwTech.exe
4668	PwTech.exe
4668	PwTech.exe
4668	PwTech.exe
4668	PwTech.exe
4668	PwTech.exe
4668	PwTech.exe
4668	PwTech.exe
4668	PwTech.exe
4668	PwTech.exe
4668	PwTech.exe
4668	PwTech.exe
4668	PwTech.exe
4668	PwTech.exe
4668	PwTech.exe
4668	PwTech.exe
4668	PwTech.exe
4668	PwTech.exe
4668	PwTech.exe
4668	PwTech.exe
4668	PwTech.exe
4668	PwTech.exe
4668	PwTech.exe
4668	PwTech.exe
4668	PwTech.exe
4668	PwTech.exe
4668	PwTech.exe
4668	PwTech.exe
4668	PwTech.exe
4668	PwTech.exe
4668	PwTech.exe
4668	PwTech.exe
4668	PwTech.exe
4668	PwTech.exe
4668	PwTech.exe
4668	PwTech.exe
4668	PwTech.exe
4668	PwTech.exe
4668	PwTech.exe
4668	PwTech.exe
4668	PwTech.exe
4668	PwTech.exe
4668	PwTech.exe
4668	PwTech.exe
4668	PwTech.exe
4668	PwTech.exe
4668	PwTech.exe
4668	PwTech.exe
4668	PwTech.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
4668	PwTech.exe
4668	PwTech.exe
4668	PwTech.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4668	PwTech.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4164 wrote to memory of 5384	4164	7zFM.exe	97
PID 4164 wrote to memory of 5384	4164	7zFM.exe	97
PID 4780 wrote to memory of 4428	4780	msiexec.exe	100
PID 4780 wrote to memory of 4428	4780	msiexec.exe	100
PID 4780 wrote to memory of 4428	4780	msiexec.exe	100
PID 4780 wrote to memory of 5784	4780	msiexec.exe	101
PID 4780 wrote to memory of 5784	4780	msiexec.exe	101
PID 5784 wrote to memory of 4736	5784	cmd.exe	103
PID 5784 wrote to memory of 4736	5784	cmd.exe	103
PID 4780 wrote to memory of 4640	4780	msiexec.exe	104
PID 4780 wrote to memory of 4640	4780	msiexec.exe	104
PID 4640 wrote to memory of 5256	4640	crashpad_handler.exe	106
PID 4640 wrote to memory of 5256	4640	crashpad_handler.exe	106
PID 4640 wrote to memory of 5256	4640	crashpad_handler.exe	106
PID 4780 wrote to memory of 4668	4780	msiexec.exe	105
PID 4780 wrote to memory of 4668	4780	msiexec.exe	105
PID 4780 wrote to memory of 4668	4780	msiexec.exe	105
PID 4640 wrote to memory of 5256	4640	crashpad_handler.exe	106
PID 4668 wrote to memory of 1000	4668	PwTech.exe	108
PID 4668 wrote to memory of 1000	4668	PwTech.exe	108
PID 1000 wrote to memory of 1512	1000	msedge.exe	109
PID 1000 wrote to memory of 1512	1000	msedge.exe	109
PID 1000 wrote to memory of 5232	1000	msedge.exe	110
PID 1000 wrote to memory of 5232	1000	msedge.exe	110
PID 1000 wrote to memory of 244	1000	msedge.exe	111
PID 1000 wrote to memory of 244	1000	msedge.exe	111
PID 1000 wrote to memory of 244	1000	msedge.exe	111
PID 1000 wrote to memory of 244	1000	msedge.exe	111
PID 1000 wrote to memory of 244	1000	msedge.exe	111
PID 1000 wrote to memory of 244	1000	msedge.exe	111
PID 1000 wrote to memory of 244	1000	msedge.exe	111
PID 1000 wrote to memory of 244	1000	msedge.exe	111
PID 1000 wrote to memory of 244	1000	msedge.exe	111
PID 1000 wrote to memory of 244	1000	msedge.exe	111
PID 1000 wrote to memory of 244	1000	msedge.exe	111
PID 1000 wrote to memory of 244	1000	msedge.exe	111
PID 1000 wrote to memory of 244	1000	msedge.exe	111
PID 1000 wrote to memory of 244	1000	msedge.exe	111
PID 1000 wrote to memory of 244	1000	msedge.exe	111
PID 1000 wrote to memory of 244	1000	msedge.exe	111
PID 1000 wrote to memory of 244	1000	msedge.exe	111
PID 1000 wrote to memory of 244	1000	msedge.exe	111
PID 1000 wrote to memory of 244	1000	msedge.exe	111
PID 1000 wrote to memory of 244	1000	msedge.exe	111
PID 1000 wrote to memory of 244	1000	msedge.exe	111
PID 1000 wrote to memory of 244	1000	msedge.exe	111
PID 1000 wrote to memory of 244	1000	msedge.exe	111
PID 1000 wrote to memory of 244	1000	msedge.exe	111
PID 1000 wrote to memory of 244	1000	msedge.exe	111
PID 1000 wrote to memory of 244	1000	msedge.exe	111
PID 1000 wrote to memory of 244	1000	msedge.exe	111
PID 1000 wrote to memory of 244	1000	msedge.exe	111
PID 1000 wrote to memory of 244	1000	msedge.exe	111
PID 1000 wrote to memory of 244	1000	msedge.exe	111
PID 1000 wrote to memory of 244	1000	msedge.exe	111
PID 1000 wrote to memory of 244	1000	msedge.exe	111
PID 1000 wrote to memory of 244	1000	msedge.exe	111
PID 1000 wrote to memory of 244	1000	msedge.exe	111
PID 1000 wrote to memory of 244	1000	msedge.exe	111
PID 1000 wrote to memory of 244	1000	msedge.exe	111
PID 1000 wrote to memory of 244	1000	msedge.exe	111
PID 1000 wrote to memory of 244	1000	msedge.exe	111
PID 1000 wrote to memory of 244	1000	msedge.exe	111
PID 1000 wrote to memory of 244	1000	msedge.exe	111

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Free_Apps_v3.4.7z"
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4164
- C:\Windows\System32\msiexec.exe
  "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7zO44043DF7\SETUP.msi"
  2⤵
  - Enumerates connected drives
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:5384
- C:\Windows\System32\msiexec.exe
  "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7zO440D8008\SETUP.msi"
  2⤵
  - Enumerates connected drives
  PID:6020
- C:\Windows\System32\msiexec.exe
  "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7zO4409ED38\SETUP.msi"
  2⤵
  - Enumerates connected drives
  PID:4536

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4780
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding B1E00E1403A7D4E8C8E0C2CC20D1BAE9
  2⤵
  - Loads dropped DLL
  - Blocklisted process makes network request
  - System Location Discovery: System Language Discovery
  - Suspicious use of FindShellTrayWindow
  PID:4428
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Tasjoc Tools Quato\tune.bat" "C:\Users\Admin\AppData\Roaming\Tasjoc Tools Quato\" dd16d195c7aeef7b5cadda432a798841"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5784
- - C:\Users\Admin\AppData\Roaming\Tasjoc Tools Quato\7z.exe
    "C:\Users\Admin\AppData\Roaming\Tasjoc Tools Quato\\7z.exe" x "C:\Users\Admin\AppData\Roaming\Tasjoc Tools Quato\\saved.dat" -o"C:\Users\Admin\AppData\Roaming\Tasjoc Tools Quato\" -y -pdd16d195c7aeef7b5cadda432a798841
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:4736
- C:\Users\Admin\AppData\Roaming\Tasjoc Tools Quato\crashpad_handler.exe
  "C:\Users\Admin\AppData\Roaming\Tasjoc Tools Quato\crashpad_handler.exe" dd16d195c7aeef7b5cadda432a798841
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:4640
- - C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe explorer.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5256
- C:\Users\Admin\AppData\Roaming\Tasjoc Tools Quato\PwTech.exe
  "C:\Users\Admin\AppData\Roaming\Tasjoc Tools Quato\PwTech.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4668
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://sourceforge.net/projects/pwgen-win/files/Password%20Tech/3.5.6/
    3⤵
    - Drops file in Program Files directory
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1000
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x2c8,0x2cc,0x2d0,0x2c4,0x2d8,0x7ffc4618f208,0x7ffc4618f214,0x7ffc4618f220
      4⤵
      PID:1512
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1960,i,9036402376014480722,3976985282613963951,262144 --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:3
      4⤵
      PID:5232
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2128,i,9036402376014480722,3976985282613963951,262144 --variations-seed-version --mojo-platform-channel-handle=2124 /prefetch:2
      4⤵
      PID:244
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2552,i,9036402376014480722,3976985282613963951,262144 --variations-seed-version --mojo-platform-channel-handle=2720 /prefetch:8
      4⤵
      PID:3276
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3512,i,9036402376014480722,3976985282613963951,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:1
      4⤵
      PID:2380
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3532,i,9036402376014480722,3976985282613963951,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:1
      4⤵
      PID:3544
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=4944,i,9036402376014480722,3976985282613963951,262144 --variations-seed-version --mojo-platform-channel-handle=5028 /prefetch:1
      4⤵
      PID:3264
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=5140,i,9036402376014480722,3976985282613963951,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:1
      4⤵
      PID:880
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5164,i,9036402376014480722,3976985282613963951,262144 --variations-seed-version --mojo-platform-channel-handle=5308 /prefetch:8
      4⤵
      PID:448
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4844,i,9036402376014480722,3976985282613963951,262144 --variations-seed-version --mojo-platform-channel-handle=4916 /prefetch:8
      4⤵
      PID:4732
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5688,i,9036402376014480722,3976985282613963951,262144 --variations-seed-version --mojo-platform-channel-handle=5660 /prefetch:8
      4⤵
      PID:4328
  - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5660,i,9036402376014480722,3976985282613963951,262144 --variations-seed-version --mojo-platform-channel-handle=5800 /prefetch:8
      4⤵
      PID:5196
  - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5660,i,9036402376014480722,3976985282613963951,262144 --variations-seed-version --mojo-platform-channel-handle=5800 /prefetch:8
      4⤵
      PID:5460
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6064,i,9036402376014480722,3976985282613963951,262144 --variations-seed-version --mojo-platform-channel-handle=6284 /prefetch:8
      4⤵
      PID:1664
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
      4⤵
      Drops file in Program Files directory
      Checks processor information in registry
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      PID:1780
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x23c,0x240,0x244,0x238,0x2f8,0x7ffc4618f208,0x7ffc4618f214,0x7ffc4618f220
        5⤵
        
        PID:1872
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1956,i,8476217003286299382,15631940567396813729,262144 --variations-seed-version --mojo-platform-channel-handle=2232 /prefetch:3
        5⤵
        
        PID:4424
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2204,i,8476217003286299382,15631940567396813729,262144 --variations-seed-version --mojo-platform-channel-handle=2200 /prefetch:2
        5⤵
        
        PID:4556
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2532,i,8476217003286299382,15631940567396813729,262144 --variations-seed-version --mojo-platform-channel-handle=2596 /prefetch:8
        5⤵
        
        PID:3148
    - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=2444,i,8476217003286299382,15631940567396813729,262144 --variations-seed-version --mojo-platform-channel-handle=4352 /prefetch:8
        5⤵
        
        PID:2028
    - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=2444,i,8476217003286299382,15631940567396813729,262144 --variations-seed-version --mojo-platform-channel-handle=4352 /prefetch:8
        5⤵
        
        PID:692
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4384,i,8476217003286299382,15631940567396813729,262144 --variations-seed-version --mojo-platform-channel-handle=4400 /prefetch:8
        5⤵
        
        PID:5640
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4688,i,8476217003286299382,15631940567396813729,262144 --variations-seed-version --mojo-platform-channel-handle=4708 /prefetch:8
        5⤵
        
        PID:5552
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4724,i,8476217003286299382,15631940567396813729,262144 --variations-seed-version --mojo-platform-channel-handle=4756 /prefetch:8
        5⤵
        
        PID:4208
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=564,i,8476217003286299382,15631940567396813729,262144 --variations-seed-version --mojo-platform-channel-handle=4376 /prefetch:8
        5⤵
        
        PID:552
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4540,i,8476217003286299382,15631940567396813729,262144 --variations-seed-version --mojo-platform-channel-handle=4728 /prefetch:8
        5⤵
        
        PID:4048
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4336,i,8476217003286299382,15631940567396813729,262144 --variations-seed-version --mojo-platform-channel-handle=4756 /prefetch:8
        5⤵
        
        PID:2272
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4120,i,8476217003286299382,15631940567396813729,262144 --variations-seed-version --mojo-platform-channel-handle=4920 /prefetch:8
        5⤵
        
        PID:3752
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4936,i,8476217003286299382,15631940567396813729,262144 --variations-seed-version --mojo-platform-channel-handle=4948 /prefetch:8
        5⤵
        
        PID:5164
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4824,i,8476217003286299382,15631940567396813729,262144 --variations-seed-version --mojo-platform-channel-handle=4188 /prefetch:8
        5⤵
        
        PID:3820
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding AC918C028BDE5DFEDB94C5FBA1596A5C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1212
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 132BE16C6CE63E44CC4017156FCA1B41
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:3744

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:2132

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
  2⤵
  PID:2844

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:4596

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e57c0a3.rbs

Path C:\Config.Msi\e57c0a3.rbs
Size 53KB
SHA256 ff83f034b3204133a861de91be1d110fb6f3fd1dd119f97eaafe6864d5b6f6b7
MD5 879de86927ab89a681e229c3e9bb7f85
SHA1 01b6ab6977836944e0a24a2a9cfa9988d1704472
SHA512 4c4c372bc6954a3dd8c172d47da9a4b1a45a64d33dbf02b758b78acbb6fbd40ce06993c194e75ba0080e9cf84aa30900c97d2b3d3efbdd71d2d132c47347a63c
SSDEEP 1536:5nIctP6j7eVO9FYJY8pYh2ePqq5L2OjXKhM5TIvNGv83o77saG5VDgF2847ItVO+:Px/qgzH6hXlh9VlA6
MD5 SHA1 SHA512 SSDEEP

Submit Download

e57c0a7.rbs

Path C:\Config.Msi\e57c0a7.rbs
Size 3KB
SHA256 5dae7d233e6841e09b869bb8ec099c906647a4797e9cf034f4027bfec747f4db
MD5 d77dd296b81031d8ebcc50a23bd84f8f
SHA1 2f145b311d9484f599139bcb87c7f6805581b049
SHA512 64b20eab80220a13a1ac25d545f2fc0fbde91fa19f1d9c15bdff2c0882a9e7406df5e337d37acb3dfb21b555bda470e4ea3346346449bd1e834e13b4403c1984
MD5 SHA1 SHA512

Submit Download

e57c0aa.rbs

Path C:\Config.Msi\e57c0aa.rbs
Size 3KB
SHA256 5c592b7eca62ef7c978bada48800137483e02238921a57dac16bb78e7d487420
MD5 ca1505863e0ab84cbd23949a9744a0c8
SHA1 b82c75715cb47e9000969e836499bedb828b7f76
SHA512 1c42b9db944a22eaa305caf85a1b93fdaedd5283da543003f918f2e05b3766f9537b60cffefc90cad56a7de3073be2daf4fc12c7c7ce4ba91210f14fcba48638
MD5 SHA1 SHA512

Submit Download

manifest.fingerprint

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1780_1002825664\manifest.fingerprint
Size 66B
SHA256 df55a9464ee22a0f860c0f3b4a75ec62471d37b4d8cb7a0e460eef98cb83ebe7
MD5 496b05677135db1c74d82f948538c21c
SHA1 e736e675ca5195b5fc16e59fb7de582437fb9f9a
SHA512 8bd1b683e24a8c8c03b0bc041288296448f799a6f431bacbd62cb33e621672991141c7151d9424ad60ab65a7a6a30298243b8b71d281f9e99b8abb79fe16bd3c
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1780_1002825664\manifest.json
Size 134B
SHA256 c36944790c4a1fa2f2acec5f7809a4d6689ecb7fb3b2f19c831c9adb4e17fc54
MD5 049c307f30407da557545d34db8ced16
SHA1 f10b86ebfe8d30d0dc36210939ca7fa7a819d494
SHA512 14f04e768956bdd9634f6a172104f2b630e2eeada2f73b9a249be2ec707f4a47ff60f2f700005ca95addd838db9438ad560e5136a10ed32df1d304d65f445780
MD5 SHA1 SHA512

Submit Download

LICENSE

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1780_154019103\LICENSE
Size 1KB
SHA256 3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b
MD5 ee002cb9e51bb8dfa89640a406a1090a
SHA1 49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2
SHA512 d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1780_154019103\manifest.json
Size 79B
SHA256 530882d7f535ae57a4906ca735b119c9e36480cbb780c7e8ad37c9c8fdf3d9b1
MD5 7f4b594a35d631af0e37fea02df71e72
SHA1 f7bc71621ea0c176ca1ab0a3c9fe52dbca116f57
SHA512 bf3f92f5023f0fbad88526d919252a98db6d167e9ca3e15b94f7d71ded38a2cfb0409f57ef24708284ddd965bda2d3207cd99c008b1c9c8c93705fd66ac86360
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1780_95733997\manifest.json
Size 85B
SHA256 db9a702209807ba039871e542e8356219f342a8d9c9ca34bcd9a86727f4a3a0f
MD5 c3419069a1c30140b77045aba38f12cf
SHA1 11920f0c1e55cadc7d2893d1eebb268b3459762a
SHA512 c5e95a4e9f5919cb14f4127539c4353a55c5f68062bf6f95e1843b6690cebed3c93170badb2412b7fb9f109a620385b0ae74783227d6813f26ff8c29074758a1
MD5 SHA1 SHA512

Submit Download

protocols.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.9\protocols.json
Size 3KB
SHA256 5f21978e992a53ebd9c138cb5391c481def7769e3525c586a8a94f276b3cd8d6
MD5 f9fd82b572ef4ce41a3d1075acc52d22
SHA1 fdded5eef95391be440cc15f84ded0480c0141e3
SHA512 17084cc74462310a608355fbeafa8b51f295fb5fd067dfc641e752e69b1ee4ffba0e9eafa263aab67daab780b9b6be370dd3b54dd4ba8426ab499e50ff5c7339
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 d0494fac3d011f9b232abd07f0f24904408079748d04787f5ee888dc0583c3fc
MD5 5d208dbeeb317236f91ff80704097dbb
SHA1 9179e2c435c9968ce6a6cb16a695058cdaf474fe
SHA512 2061bad8074399a8de17128ab9ac24219400de2d9ad274d91d90e86f0e8d825442e08fca387ae237b3a847df5fb8e6d0be7fee884c2d49dfc508a94f2bbf2e0f
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a1e0b448218678b30356cbbe4092ea091435e7450822a9748361b6e8b198962d
MD5 65044109d1beb8ed8d59560642cbc519
SHA1 0084485b0aa26069232fab51ee603682e8edfd17
SHA512 96dcc68fe92f98c4329a8335cfffdb0849a52562431045ccc42076bda0abf3842491303fb669246bfd04e64113688d3f90000a09571dd76ff84b52e34e45f9b6
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3728927053d89307cc89f21d7a6329ac4810f854254faf60af96a79c4f24d5f2
MD5 0408247b48e154f1c85cfae5f6a0060c
SHA1 80248ac5439f5fcd9f4765f871500775fa5dc744
SHA512 b55886f1b0631da029ea2847c26a37f0a4342c9c1ca42ba7584ad1f2d4b954c8b2841ce0d03b9a07bcfc953d2042f61769e55e75f0f8492c2dc6c03c4973cf58
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 e0527f7a626fab414e79e8ea6ee8d9b9afbcc296b0994eaa17f9f166ee547645
MD5 2cdf852f3c200c14fad27e5f8ba18f64
SHA1 c5f10dc2582581173d4a62a6e17309d00e0bb988
SHA512 1bef852f180850e0645544be5970f6acc109cd13cedace71ff85551ccc9a92d2688151495b3b254f394240c8b3628efd094df0e31269f4fdb14feef36bc1bf1b
MD5 SHA1 SHA512

Submit Download

the-real-index~RFe581037.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe581037.TMP
Size 3KB
SHA256 2f70b8986fbdbde49639e3ac0d85c38678025e4522a58fe4361abab03ed0294b
MD5 ecc97804ad3ae2176b9372bfe7685733
SHA1 8b30cb104c90f77bddbdc34d88ae68ca515c65e0
SHA512 60a03e51791ddd8e14c635dbb336c2887d9adeecad262ddff40c39648eaf2dbf61d2dda60b64e9e082222ed077dd48db9049a7e361afe2fd48c2cbcb8ef79ec0
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.91.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 108KB
SHA256 088bb586f79dd99c5311d14e1560bbe0bb56225a1b4432727d2183341c762bcd
MD5 06d55006c2dec078a94558b85ae01aef
SHA1 6a9b33e794b38153f67d433b30ac2a7cf66761e6
SHA512 ec190652af9c213ccbb823e69c21d769c64e3b9bae27bea97503c352163bf70f93c67cebbf327bfc73bfd632c9a3ae57283b6e4019af04750fe18a2410a68e60
SSDEEP 1536:I6LPH74eshBGZqW3iPPDuVvpBI/S8tZsA62UYPq:RPHjdRiPjU1
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 f7b61ca2d1d422ca75a7d2381a5b0b91f719324a6ff6e2c41dbb1d4280ca4fb2
MD5 5f7cd02af6b6b6a73557a8c24c331787
SHA1 02bf4ad884eda35db2d0fe62700dc689b349da3d
SHA512 2ee5997c3967ba375d43010d8a83c5ebac8cf49b5c664c3399f13dedcc1d65f7d944e98393ce1f6e17aae7cbdae68dd529da5a638d8b4a3acedcd6e893b81630
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 a31f71dade5d0b7e9e96ed90804f774daba06f8c9aee50c0267cf7438e41cbc4
MD5 1b211b456ab182c94c04a057fb453758
SHA1 9e80d53bf254be7d761785a1efb93a40c5b3ef7d
SHA512 c6e78805e0fdb4c4fa6f5b38221e2586c1a8929822b10d7322304fe08d30b2b6055fdfc9e59f29419daa242e90b7d4c78b3879bcd63e89fb7ca457a1ab3533c8
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 fe4c0261fa877b847492797ce7555f650080dfb8d44fb48672b43802f903106e
MD5 b0dda9079072a44f1b0bac384c790cd9
SHA1 2432b7979e09021f99b7a3c3706224d51627d7a5
SHA512 9d7c6a5d8f7a3be3cd2ffd2da3315aae36375bd774acf429191bf18e69fa18ed18294fd51499779ee8f1c031caa05790cf523861dff03437970d65765b019935
SSDEEP 192:sVjR9yMqv/Ky0Ml83gLsEWcjcwDwI/pJ9Ov1ZMbizoZ8pvHY+WNXMwoKlI7AhcI0:sVjsLxLsEWcIIZ/pJa1ZMbgvHS8wNAh
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 916e940722060a524d68c37ed91d7b457dc00229d55e3ed9b4e9cf10e75874d3
MD5 7720764bf878d85ba8521914ad055ff0
SHA1 e787745ff349c3bd4ec524afa9db4cfc51a207fe
SHA512 d01eb5be4ab8c26581d34c943242d29e8095572eceaf75cdea6a05ba85c099296757ead33f27fdaf85e0dc0739b3e75a031cb259a17197c967a109d056a421d7
SSDEEP 768:9gVYCUU7pLuLxFjWFzNLJ8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjYDU6LlUWD+yr7:9gVYCUYExFjWFzNLJu1jaUWU6LWk+pE
MD5 SHA1 SHA512 SSDEEP

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 9774161d11bc2beab3673822dc3ed365be16951ba65eb560378207c0924c494e
MD5 0be94db40cee8de84361b834ba3dc903
SHA1 1b74df1f73ccf3bed7bacca267fff266808cf868
SHA512 f2047fc79777757bc37b05689f8be1966f402d3e16448163324a901d4f97f4190a80ff9573dbd84b81dcf888d4a77955e52de534c2f9a7239d50926587144aa6
SSDEEP 96:tnKn24KwrKfuWKF67WKAkQgEsBWSgKKkYSx4VatumKyyKBGAKcSKRyRKNIKxWWK2:Gyz1hVdSemg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CloudConfigLog

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog
Size 24KB
SHA256 7bf42d3d8c0fbfbfd5c1d9dc22a3bad9f50addddf24967d7d5e1abcf8ca44d62
MD5 0da3864ff3878687b90d53016598670a
SHA1 052e6c4bba29bb61e95d875d4f6326026dc357b0
SHA512 65ca36ac1cdccd18b823ab3807eabd1512190f019f755a7529b272fb1fb56b8cfa6bbfd8f1844b0c392b13d68d7bdd8bdecc66d7336345745e172deecd825cb8
SSDEEP 768:OJOk/FY7/2lagbCtCkQ7wDlH/h+umbA6BQpGMgSVlkium1z4tfLTvq/uIvqpgRvk:OJOk/iSlagbCtCkQ8DlH/jmbA6BQpGMo
MD5 SHA1 SHA512 SSDEEP

Submit Download

CloudConfigLog

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog
Size 469B
SHA256 acd6773d8833c3314762e817b7d930c68d2620758b5fd577ef8555b4dbe7c4e8
MD5 32ebfcd76be3c2a61acc30d646fc7f5a
SHA1 14ae0b8e0203854de893e62fd79b86c5e76d9cea
SHA512 b8c63e2b172ec23dcfcc0f7bb29f52ed97d0f1f6122f499a5c023c3e79f6813ac48125d8b33b007d9709cce0b2484f2ffc95e1412958eadf014ee9c029439d04
MD5 SHA1 SHA512

Submit Download

CloudConfigLog

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog
Size 904B
SHA256 c9c72019716bff5a993a57814a435cb0841fdd1a15a74ec517388c7f6099c980
MD5 97ebeefe0baa0518565dcee4d3a701c2
SHA1 d1c55bac061ea86c9b50111690f9b322e75626be
SHA512 a188adbc943d16e068ff71da044fbdf364e445fee4efbc04cf8829cd5e512984e1cf59c46ed3eaccc65ec504fc3fd8cbb05a639b0b571b2a0cdf9967c321ebbd
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 19KB
SHA256 16cee17a989167242dd7ee2755721e357dd23bcfcb61f5789cc19deafe7ca502
MD5 41c1930548d8b99ff1dbb64ba7fecb3d
SHA1 d8acfeaf7c74e2b289be37687f886f50c01d4f2f
SHA512 a684d61324c71ac15f3a907788ab2150f61e7e2b2bf13ca08c14e9822b22336d0d45d9ff2a2a145aa7321d28d6b71408f9515131f8a1bd9f4927b105e6471b75
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+eW6PQpGMgSVlkFIum1z4tfLTvq/uIvqV:WJOk/FY7/2lagbCtCkQ7wDlH/h+eW6PH
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 54KB
SHA256 1c813c0c206e74b936b3f83ea66b26d82e130e8f28f1faaa2276663d2230eebe
MD5 735f9e698ce73ea165f34e97adaf2809
SHA1 9d1ee69e27f87bc5dc83b59dc4a712f51b57e380
SHA512 18bdd79d7c30a5be17649c5f627581281cecf0984c4d1a34aa36e63e56ef36cadec1664bd22ebef0ae469469255ab585a9c7ccee70f83f281a67e5b5b10cd7fe
SSDEEP 768:HQJE6esE8lDldUGJuwgSvhyW1Ejj6VZzn8lqjORIB+Ul2E26SQL2e976JofXt:YeB85dh7p5jnYqj06+w26SuT95d
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 e75fb103a59bfa5668890039fbd005c20360d826dac72f3faf88802dad6d79ab
MD5 9037f7c250786f1f80b6456e07e4fc99
SHA1 2e28dbc4547bfb44039cfb0e9ef5c3fe91705279
SHA512 8f3db1e4933c6ea4c33785590c1dbf12dc76dadd8ab877f04186a0b8200a3a0818938cf759c7007d7890be693a0d1baa5d9d42509ecf8cbedbd5f810703ec6e9
SSDEEP 768:eliE6esE8lDldUGA3ubgWFhyW1Ejj63qWi3L2e976JofNrp6P5t:jeB85dI3kP5DqZbT95Bp6xt
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 55KB
SHA256 ed1bfe8fe251f65ade0fcf7b4a253a7d711c0767ed9317d0c993b1c6a7b8fa4d
MD5 965ef189c77b2b7ee230c03f39a1a675
SHA1 117e8223b6f78f56faa105150e097e2f24889629
SHA512 7ce71980940d737758863340a004d59afe57c485bdc918be2e78c3b9dae2eb86b7cfc46a240e2426fd98e998bc33a604241c99cdf8de2cb5107aac28458608dc
SSDEEP 768:elJE6esE8lDldUGJubgWkhyW1Ejj63q1Sd961/jORIB+Ulmrp63QL2e976JofXm:IeB85dhkk5DqQf61/j06+zp63uT95W
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 32eba75d5191fbaa8fd68ba6c74a80b4dc7bb4fe08b432e921597ea58d7193b7
MD5 0daed82f7ffe78f91552afa21608643f
SHA1 0c1ae4d3f45e01b255a8fa6bcec2204a330966b0
SHA512 d040ad047dd64b7110acad54191f8520c696c9f49f23b725a5547d805cc3a11b3ce8d672ee57c498d35eea0e32ca11c5b1eef824196c7658d106c53a1075aff0
SSDEEP 768:GliE6esE8lDldUGz3rbgnyyW1Ejj6GN3NK4KJ49+hL2e976JofNrp6qt:LeB85d73z5aG4KX1T95Bp6qt
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 11b01e9f129440f3b24d16d6021b6d6f1cc69f85b923d7b65d1aa7eb03c18698
MD5 62e8cd576272d4b8382e6f9693fed8f9
SHA1 cc8847c882b99ac984806d2ae0197ce1bbaa67a2
SHA512 f21421a0070efcd7c3f89d5596ad755ae648ed8a7c0086dc0ddc2e38eb89dd727f597c016cd6854039bbe57bb5072a86fb23b15e1591fc6be7d5329a84d50796
SSDEEP 768:GliE6esE8lDldUGz3rbg3MyW1Ejj63qWi3L2e976JofNrp6qt:LeB85d73R5DqZbT95Bp6qt
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 49KB
SHA256 b0e18ce7756a96c86509496709f256999738b989f20d1254d740ccad1fb272f9
MD5 0eeb0522ad5c96150f0f998241b558b9
SHA1 cbff5ff96f9342913a58d1b2355385a88fdb1848
SHA512 c9b26be971ca255018f6456019084394137e76f2fc2101110c35306c14de6d84ae4a0d5e95c0bb5b23312431508b9e21c9a1aa59ee43417ffa32a0981a86a8dc
SSDEEP 768:WlJE6esE8lDldUGJubgWdhyW1Ejj63Zzn8lqjORIB+Ul2E26SQL2e976JofXt:AeB85dhkH59nYqj06+w26SuT95d
MD5 SHA1 SHA512 SSDEEP

Submit Download

keys.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\TrustTokenKeyCommitments\2025.1.17.1\keys.json
Size 6KB
SHA256 fd1847df25032c4eef34e045ba0333f9bd3cb38c14344f1c01b48f61f0cfd5c5
MD5 bef4f9f856321c6dccb47a61f605e823
SHA1 8e60af5b17ed70db0505d7e1647a8bc9f7612939
SHA512 bdec3e243a6f39bfea4130c85b162ea00a4974c6057cd06a05348ac54517201bbf595fcc7c22a4ab2c16212c6009f58df7445c40c82722ab4fa1c8d49d39755c
SSDEEP 96:UXq6pG2GE+Vy2+m0plhYvPuW+wkpTm+ozdswsDm4+uTagSfC3AQj+y:uNtGbVKm4lOvMwkoR9PuGs3gy
MD5 SHA1 SHA512 SSDEEP

Submit Download

ghbmnnjooekpmoecnnnilnnbdlolhkhi_1.dff2c9d9755f96713c08f4932a9091080808ec34c0823feac2206fa526f91e60

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\ghbmnnjooekpmoecnnnilnnbdlolhkhi_1.dff2c9d9755f96713c08f4932a9091080808ec34c0823feac2206fa526f91e60
Size 153KB
SHA256 dff2c9d9755f96713c08f4932a9091080808ec34c0823feac2206fa526f91e60
MD5 b0917d8e6c5b6be358bff67f84eb8336
SHA1 a6e221edcb19a1cc81575b4ddd927fd9a6fbdd6d
SHA512 cd5822bbf91e8f7f5ab2b471a4bf8b464bde95465e2fccc6a57e5a287ca55d5062bdd6d4b3cd76f8529ee7a9081b6a7aad7dc2a7581c344ce4fd2d3256bdf451
SSDEEP 3072:o+B2OnDMFi9mby+1ddHCqaPAitXxLXX3Gu5A08mqKzHoIdk2FNA8GzzUp:oe2oDMVysdHKrXxzHsxhKsIdnTA8GHUp
MD5 SHA1 SHA512 SSDEEP

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 062504477d5e5a25ab6ebd708104454737988104829cdeefa463f595de092b8b
MD5 b2922b078dcdb502bf01d2ea4fb8440f
SHA1 12da0bd0cbfa532cccef946f9debbb2f43882ec0
SHA512 a9bce39f0eb75621fa68a28b05c6f03a416b9b9771f764f79bac8e8d4ede0f80f31f90c7e6e366aa438852b360fab06faa5034836a06c26a9fcf19e5053979f5
MD5 SHA1 SHA512

Submit Download

3b1ed792-57c2-46a0-99f9-af5f265c770a.tmp

Path C:\Users\Admin\AppData\Local\Temp\3b1ed792-57c2-46a0-99f9-af5f265c770a.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1780_973494233\CRX_INSTALL\_locales\en\messages.json
Size 711B
SHA256 2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b
MD5 558659936250e03cc14b60ebf648aa09
SHA1 32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825
SHA512 1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727
MD5 SHA1 SHA512

Submit Download

7z.dll

Path C:\Users\Admin\AppData\Roaming\Tasjoc Tools Quato\7z.dll
Size 1.8MB
SHA256 882063948d675ee41b5ae68db3e84879350ec81cf88d15b9babf2fa08e332863
MD5 c4aabd70dc28c9516809b775a30fdd3f
SHA1 43804fa264bf00ece1ee23468c309bc1be7c66de
SHA512 5a88ec6714c4f78b061aed2f2f9c23e7b69596c1185fcb4b21b4c20c84b262667225cc3f380d6e31a47f54a16dc06e4d6ad82cfca7f499450287164c187cec51
SSDEEP 24576:tL9NgP+4hcdTDeM1EF7Jx2meoI4Tzp7iyeNgzd6Nv7:x9NgPjM1E7JPx+ye5
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.exe

Path C:\Users\Admin\AppData\Roaming\Tasjoc Tools Quato\7z.exe
Size 551KB
SHA256 e2ca3ec168ae9c0b4115cd4fe220145ea9b2dc4b6fc79d765e91f415b34d00de
MD5 b6d5860f368b28caa9dd14a51666a5cd
SHA1 db96d4b476005a684f4a10480c722b3d89dde8a5
SHA512 d2bb1d4f194091fc9f3a2dd27d56105e72c46db19af24b91af84e223ffcc7fec44b064bf94b63876ee7c20d40c45730b61aa6b1e327947d6fb1633f482daa529
SSDEEP 12288:jrx//c1kmegKVcvbYAgZ+ml1PUEynhwNblha:5s1DetKMT7yV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Arabic.lng

Path C:\Users\Admin\AppData\Roaming\Tasjoc Tools Quato\Arabic.lng
Size 30KB
SHA256 7df452d2b82638c1722b4ce6da902b6a9e7322ed67a08c0125e990a806f92635
MD5 5872984a32739b5606cd4802cb269e64
SHA1 946ce5691f052a626feab296cd963d2adcb372d3
SHA512 9e8e21a895cf79aa2d08062ba06d3b2d481c7e219889ed55b461f2264adfe66839f93720d4d39e96b3ebe5833129806e4e61786713d3e6f2310dc8a0758b75ad
SSDEEP 768:ISAFqFOeIGTlA3lFICeFstRqTVPGkrAOG:IS/FO5GTlAVFIjmclGk0OG
MD5 SHA1 SHA512 SSDEEP

Submit Download

Catalan.lng

Path C:\Users\Admin\AppData\Roaming\Tasjoc Tools Quato\Catalan.lng
Size 26KB
SHA256 d9788a0901d40d9cdf5056afade7a7cc777f294901bbdec84863800eb9b4c340
MD5 41b42337ad2f8a5d4abfaab9dbc1c80f
SHA1 9b2de6ac9e609c327599e55e12c8c18739d177dd
SHA512 3ee933cfd1ced73c4dd87c31ebca46924c78d6ac863425c90006a3e2cbadf9f4118a5ca53ffc1c80dd092b99d42c8d3da64e9eb292b2ba7e71de6266a532113f
SSDEEP 768:fSX6wI1SvSGbvyiqb+iw/2yQ1qEoi6ivmP8:fSKwvSUPc1qEoMD
MD5 SHA1 SHA512 SSDEEP

Submit Download

Chinese-Simplified.lng

Path C:\Users\Admin\AppData\Roaming\Tasjoc Tools Quato\Chinese-Simplified.lng
Size 35KB
SHA256 487519227c706e31a603695822c83c220fc9d6ac01a0947a4e584b605a583104
MD5 38bc7ef200d17f9c5d3d16bc41bd2ac5
SHA1 637ae94b141ac4c979a9976e22708a90da192c36
SHA512 3bfa9373c60f8d46ec3b11adb2f02eed6bf1ed204b0cc6f556bb682f1f55d58ef38085a43ddb46c6923ed3d06627c4bf2ae7ae0dd6f8d51c0a8dd3c5618a1254
SSDEEP 768:FwOfCOEZIw6S/+TeRQBr4iIwL+F/hqD1CARny:FN659+qmBr4JwCL
MD5 SHA1 SHA512 SSDEEP

Submit Download

Chinese-Traditional.po

Path C:\Users\Admin\AppData\Roaming\Tasjoc Tools Quato\Chinese-Traditional.po
Size 83KB
SHA256 31caf003f72ea7f901a0e10ca2005df8f8edbb82731228e69297d9356e6172af
MD5 90805c124c58d8db788300fca4168ea9
SHA1 833caf20408f060a63185a0fe9798d3ea29b0623
SHA512 37e388819a12129bfac19ae96718d00cf05d1f4961a2f6c03d72970929886781bd5df3fad279c73c267ddea2ece9a8d8ab419ae39263d4b0152b56b70c561449
SSDEEP 768:YxGjokgeyNAsMxo5DMQkH2GgwZGsz17bxc9YgIceU0asLK6YmnUxvhRcnpaF3Gy4:BCRmlhDqY8Ofw+iKj43vA
MD5 SHA1 SHA512 SSDEEP

Submit Download

Dutch.lng

Path C:\Users\Admin\AppData\Roaming\Tasjoc Tools Quato\Dutch.lng
Size 24KB
SHA256 4373a5fe80a57e0101798f66c9a992c6ab24862bcd5656ffe2c5f54294e1b623
MD5 28eee73fb3e30a05268c44397a3f519c
SHA1 52070591f09568110787d3275f2a24c336c885d9
SHA512 4b6e5bfc33a149a17717751bb78b31bb6174542d2710f207796ec08da43ed078f5a9617746ccd5616b317d968d03b063f44f49af49c46619f5a4c67d6b391af8
SSDEEP 384:D9UDZ876SQ66QjTxkgguMEnxbTvvNi6jU3N7cXKk9YfDkPUao2pa:Zjnl6QmEx3vfw3NIXlkD2ha
MD5 SHA1 SHA512 SSDEEP

Submit Download

French.po

Path C:\Users\Admin\AppData\Roaming\Tasjoc Tools Quato\French.po
Size 92KB
SHA256 49a2721a81b0ae31a248605ce909ffbd99d48d98500b68bb0c52240c26ec911e
MD5 28d9282fe4750a53d4f75b49fafbfef5
SHA1 6ab2c6be892bdc818fba421fcd2005dd28ba02fe
SHA512 7a4a8aa7747a156e815c073c12da6bbfcf9169ccf5e1631c45338e908a6996a44516f37a24d7afe88e243a8138eaa4e146c40d3f850f928610abff3aee0cf381
SSDEEP 1536:50HBtLSV6YA/9kz3bLSNJ46/81EqgM4clO1sTCBgP2Dr59r9g9S1/LAo8PM:s3soKj2bp0M
MD5 SHA1 SHA512 SSDEEP

Submit Download

German.po

Path C:\Users\Admin\AppData\Roaming\Tasjoc Tools Quato\German.po
Size 88KB
SHA256 3909734d84cefc3d6a211fa13f6cfa5091b8b5b5dc2fab4ff3751b350647f7fc
MD5 f2d7331a36a0e8a694df8c7e0d872d7f
SHA1 d0a1c1a3950a0589009750711dda3c29e52edca1
SHA512 48c599dde8b205f51f236acab02a1933ef2295c959b544292c5715464c3423c3111b14564bd243df5446a3d659ab9ca4cc3a048872aa91c063f1e8c4f1d226b8
SSDEEP 1536:b9sew6O2jdNnKzkyT1J9zGVoSqljyZumW:b9WMozkOJ9zGVoSqljyZumW
MD5 SHA1 SHA512 SSDEEP

Submit Download

Greek.lng

Path C:\Users\Admin\AppData\Roaming\Tasjoc Tools Quato\Greek.lng
Size 55KB
SHA256 3bce77b4d6deeaf4cce2f501f102bd099414d3dc5b1451da766fec2c96e0418b
MD5 30b740006bd35caa17859d475fafc614
SHA1 889f64487b51e4e086ffa4d7fbef9e018eae68a0
SHA512 85887f9bbe0dbf87096841a2722ce778c32a545c136517e28d74184d92b07ee6480f667c6838039b1563c2e1bb3bd864e821b89b581e6bb0a48fcbce5e3b849e
SSDEEP 1536:gSFusfppEfDecO8r08nZvMUyXS8ejoomcT4kq7A0BoHHSzYlNNcbY6vVJz9VZ:gUfkfycH0S8eVmcT4hA0BoHYYcT
MD5 SHA1 SHA512 SSDEEP

Submit Download

Hungarian.lng

Path C:\Users\Admin\AppData\Roaming\Tasjoc Tools Quato\Hungarian.lng
Size 23KB
SHA256 50e1440f5588b59c2f97e9a502a2bbfaaec6aecabe00dfaa97666cad6a49baa0
MD5 577cbd0c6d8b9caef19a5360230a8e32
SHA1 9c0d8dd10e7dd636f2e0978e93a778cf24bc1bce
SHA512 33439c7b88abbbeea31e808e245590cf2968042285f3b1002688bf9d803e31dd18463f06981ceb7768c9de11a05a45fe028336f98f3814b2adfb7173ca8edcbd
SSDEEP 384:jr5MxCB6QuLuGCHnDlBGyd4bilUHsVI1HcYmBeK0TL9Q5tog6n:n5yK6QqCHR5I1Hcop4a3
MD5 SHA1 SHA512 SSDEEP

Submit Download

Italian.lng

Path C:\Users\Admin\AppData\Roaming\Tasjoc Tools Quato\Italian.lng
Size 21KB
SHA256 cc6a29127820d973ff7ac2dc1ec33db0103c2cee2e56b288c4481b780003cdff
MD5 8f0f8ab780f3f2f529974497491ddd15
SHA1 c9f2ea013043c30fc1bd019f9d08fc55e6e331a6
SHA512 ed69cd50c268a91c1afd162f669282b0b2f275b8326c5aa1fbec6582a7a570ad16ef7da091f09a7c28b6fdf64598efffd523f243fe0524b4f0be6c6fb52c93ae
SSDEEP 384:rE5UBTxbI0u2gHqiDi38J1eleO5QoabPtGRkI1x050KIdrr7vsha:reQRjhgHqiDi3/evo8P/I1B5tDJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Korean.lng

Path C:\Users\Admin\AppData\Roaming\Tasjoc Tools Quato\Korean.lng
Size 27KB
SHA256 cccd11a07c0ff2720a6311d8f19721a405a4fd888055ab195f6755198bd6c75e
MD5 68d8db1181c4ec64944dbe9e6ccb7a23
SHA1 7da7e19dc44f3200469a5b94fc612886a008a478
SHA512 2dfc68f781ad4834f24795c3a129bbef162916d6450163bb61c4df25fc6808d7a3eb12492f09aca4894ade40ddae0e397d89cf06ae15f47417ccd7dd9d6a1856
SSDEEP 384:xBSjszms/HEka+YRyXjKlFiGtsI3+VMd2w2X8UA/KS+/3/fI:nSYS6HEka+YRujBS3CMd2wpUiFL
MD5 SHA1 SHA512 SSDEEP

Submit Download

MSVCP140.dll

Path C:\Users\Admin\AppData\Roaming\Tasjoc Tools Quato\MSVCP140.dll
Size 554KB
SHA256 75872c426555ac8af55b5a7f6d4aea8831af74353b22612850a2bfc40e3b67e1
MD5 0ca4a10be84402ce3123ebed2e2c6abb
SHA1 9e6d9bcb827ee3a108d0b91a99490ee37a4fa1cc
SHA512 899a4635cf6ed642a2bcd2a4415dd02dbcecfe0a0cf789d1eb4c9781bf86fcc7a44bbf41f20d3d5073f6a3935ed165e6ad3afd38824b7a7af33c7e95855eac1b
SSDEEP 12288:d7dqZ1EqSGQEwkcz6sm7UtgZ/29z7mnuMG7NaekWdgJMKZ+h7rUh0svaQEKZm+j8:dZNg+h7rKiQEKZm+jWodEERG5
MD5 SHA1 SHA512 SSDEEP

Submit Download

MSVCP140.dll

Path C:\Users\Admin\AppData\Roaming\Tasjoc Tools Quato\MSVCP140.dll
Size 564KB
SHA256 74892d9b4028c05debaf0b9b5d9dc6d22f7956fa7d7eee00c681318c26792823
MD5 1ba6d1cf0508775096f9e121a24e5863
SHA1 df552810d779476610da3c8b956cc921ed6c91ae
SHA512 9887d9f5838aa1555ea87968e014edfe2f7747f138f1b551d1f609bc1d5d8214a5fdab0d76fcac98864c1da5eb81405ca373b2a30cb12203c011d89ea6d069af
SSDEEP 12288:RBSNvy11qsslnxU/1ceqHiNHlOp/2M+UHHZpDLO+r2VhQEKZm+jWodEEVAdm:RBSDOFQEKZm+jWodEE2dm
MD5 SHA1 SHA512 SSDEEP

Submit Download

Polish.lng

Path C:\Users\Admin\AppData\Roaming\Tasjoc Tools Quato\Polish.lng
Size 39KB
SHA256 090f8088e80d99cc86bf4af54b6391da7d92d051c64e5071ddc4dca400d1ada1
MD5 214cd81571ac325ed2c748e59250139c
SHA1 70844ad9c081ca3205e188d6f80d421918f45702
SHA512 263f0274bce4027f1ee50648e666f30e52186ad4855736961874014e5566494596dee8d2207cc4897cb224bbab3ff5d785acc508fd0d8417c84c16ce33163ec0
SSDEEP 384:kAT5SUmq2sTA3CpnC3cOm/oB+PsyhI2/A8JdWleO6qduWpQqAMsQyljU2+K5Vr2+:nS3AA3qOmhs2F/A8ylTduU6QeyrDT55W
MD5 SHA1 SHA512 SSDEEP

Submit Download

Portuguese-Brazilian.lng

Path C:\Users\Admin\AppData\Roaming\Tasjoc Tools Quato\Portuguese-Brazilian.lng
Size 27KB
SHA256 c8cfa83b613d28c99195ed75e7437a8963bd4c3e32738fab07e1b39dafee7281
MD5 7447352f37485241b2ea83b1933530e9
SHA1 b94e9b9f54146c1ec19c4e8128496f4bfd3cbe51
SHA512 8c101ab378582504d4568923f1e6c0380dbf84cd7a0923a2ecc410ffdbf4cc9975d259dd167cbe51c65bd72cc3218182a2cbed1db3897e3c4642ab745e8661a9
SSDEEP 384:ifDrpsOqXm4xnKPkvR/vE12z6M+ExTRtJAuAUl/K+mzVmQKLPhJgYF:iLrqmDu3Y6TRtJvAW/ZmzV/APF
MD5 SHA1 SHA512 SSDEEP

Submit Download

PwTech.exe

Path C:\Users\Admin\AppData\Roaming\Tasjoc Tools Quato\PwTech.exe
Size 9.9MB
SHA256 6127bed4caa40b660a8545caaf5bddf09a0c64bfb4008bba5181cd02b093b60b
MD5 a35468d4359b986a87bed8d6efa00fcf
SHA1 7cd66999bc1cb7a16629e36c7f56e4a160f951b4
SHA512 de57c86773fc40ec39df8b526157d59d7920b2ee2564936e9f617bd1feacac91824604ba5c3406d34a1a6727e1349deaa42c638b80720808a23db2255a3a8621
SSDEEP 98304:62gfttMaaR1OiVy/61iEaPy0rHFZlb5ot52wL+NzAZtVmbXdrls1CaeqdV4DSKRD:Ho/6t5h4DS1oxMVFQkOwu5XrEY/
MD5 SHA1 SHA512 SSDEEP

Submit Download

PwTech.ini

Path C:\Users\Admin\AppData\Roaming\Tasjoc Tools Quato\PwTech.ini
Size 3KB
SHA256 1f5dbcbdfc3d071ab81637149c66724d7becc60f82bf98959fd8f40b8ea947fd
MD5 c5cda2c25d783b06e885a62f871dd4c9
SHA1 173b6286310714cb486ec6a08a5684bfd6c3d728
SHA512 01e6d6edab1c77da647508e8796c37a52f0182e26806cd5f5c3d52794fe01fefc133edefcd08c4ab3a6007ac635c090689b5c704d5328762c95c20488163feb5
MD5 SHA1 SHA512

Submit Download

Russian.po

Path C:\Users\Admin\AppData\Roaming\Tasjoc Tools Quato\Russian.po
Size 99KB
SHA256 42407d51b41bd3592f409bb9d92646531b34480a75abf2d5a331b9c313661a92
MD5 62670123e8117e164cc8ad07ca1979c6
SHA1 6ea117c3d3a6e573792feb76eb7d1b9b8f1d02a7
SHA512 297e6af263c94b7f009dfa168b241efb8145ef07ce4811c547ba9412e7c50547e8569dbf85775856077edb1af3034338cb285d77a37cbded3bcf374b427990f8
SSDEEP 768:PUciBMKaTuvKjb8OfNVY3ax1L7W9QJOFTyGInUObQajReYByt6e0pjj6fd2OSPn4:c3LLuw3aXPAi1lOk5c+KnSW
MD5 SHA1 SHA512 SSDEEP

Submit Download

Spanish-International.lng

Path C:\Users\Admin\AppData\Roaming\Tasjoc Tools Quato\Spanish-International.lng
Size 9KB
SHA256 092ee27be230735bb633d1b1b7ab529a69bc7a20bf42a254633ce5f29d9e7c59
MD5 13c12049a43ce1dd19d626a38fbba7dc
SHA1 ab82fad731f9cd3e36b08232c1a24f5ad867b8cf
SHA512 85034010b05cffce58adf32d549eac05530dbe49f93995208f956e97549b4da8cad4dc1728e49ce09e3bb979e83303fdd7ebea41d73b2faaf2a697bd37977760
SSDEEP 192:KkxBZS3YCHwa53hFTEculYMg1DCs2Yc8/a+:KkBSoCHNhFTEVYNgs2REa+
MD5 SHA1 SHA512 SSDEEP

Submit Download

Spanish.lng

Path C:\Users\Admin\AppData\Roaming\Tasjoc Tools Quato\Spanish.lng
Size 24KB
SHA256 32268218df225dad7afbd578d97d5e950e87296bd38b1795fdb106f3da03b7f5
MD5 ffb28eb526fc1e1b5dc9c72f90602695
SHA1 64c3c378f8dbaa4a42bb6c27445a762181f0aab7
SHA512 eedb5a02f54c0a0a4de1b27e4ac9ff23db151648c36f298443da3d823ec93bc65434f3b8ffe16b7ecf2c30260243735b1b6ea7919e4ef11b330b21827467bb91
SSDEEP 384:nrqdbZkpHWZU5/Id7R2o1YvG6lBSNmsEwDkKRN3eZu:nOdNkEZUadUo1J2wmpwQ4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Swedish.lng

Path C:\Users\Admin\AppData\Roaming\Tasjoc Tools Quato\Swedish.lng
Size 24KB
SHA256 5e68a29aaebd3a59e5ee70c00cb570296c9e67e64f9db6b2aba1f8aaf4d3c2da
MD5 bcc8b96dbbdffd866da42ed76185cf80
SHA1 26fc050bf65faa9f0ec18a5d7c68e5f45e1830c8
SHA512 36240e6314c7ff6652682b7086ccd812fa975bcd7cfa98d88b4e0ce65afc6e513462f8d751de665792ea8dd0cd54844357f3a930f959caedb3577e3c37374b1c
SSDEEP 768:ahRwm7FxrOjKzOAvfwKExhM/6cf+voDxR:Swm7SEQKEk/P+kxR
MD5 SHA1 SHA512 SSDEEP

Submit Download

Turkish.lng

Path C:\Users\Admin\AppData\Roaming\Tasjoc Tools Quato\Turkish.lng
Size 18KB
SHA256 226545bd8ff23105438fadd7a37d9d0101822b10fb2e13fad7aacbf3c9bf9996
MD5 c633b51960c775161fca69bec319bd2b
SHA1 66936ffeff23aee848344e0e6dfc0df9e6ba62d0
SHA512 b962513eb84690dd29de007cb4083ee70ae0b0fa2d9177ae8dc27dfcfe041ae155aa15a37c5bf73425c538b823e907046a30bcdbbbcd895b2ae271e8aa04ccaa
SSDEEP 384:O7NHnFIBHJZItWCN+g64Cf07tjASVm3k5KMSB6Rm95:6BnoZoWm+Mk07tjASY665
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ukrainian.lng

Path C:\Users\Admin\AppData\Roaming\Tasjoc Tools Quato\Ukrainian.lng
Size 10KB
SHA256 6fe144a7e09bcd12778032cbd8f63ca9155794c4bdb9fd7f57ff5d8ecbe95518
MD5 d3f10d95f30eeb8313c20f6f38da6f8a
SHA1 a216ea223928562dcd60e604bebb65541f79f4bf
SHA512 ef8b62ad85bafc6b33c73abd4cc1424390721890c64ba97e9c946d0dbabbffd9791e295701670de2c8066e594d6a55bcd65e47e863c70aa309188d5abce944fb
SSDEEP 192:Ozfq64C8k7uJBaukwJ1q/sLUKWkh/hLF53Hulvdqwg/WYRl7z2wCG7m:Hs8zGOJgULBF53KvdqwFYLG9
MD5 SHA1 SHA512 SSDEEP

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Roaming\Tasjoc Tools Quato\VCRUNTIME140.dll
Size 106KB
SHA256 69320f278d90efaaeb67e2a1b55e5b0543883125834c812c8d9c39676e0494fc
MD5 49c96cecda5c6c660a107d378fdfc3d4
SHA1 00149b7a66723e3f0310f139489fe172f818ca8e
SHA512 e09e072f3095379b0c921d41d6e64f4f1cd78400594a2317cfb5e5dca03dedb5a8239ed89905c9e967d1acb376b0585a35addf6648422c7ddb472ce38b1ba60d
SSDEEP 1536:BcghDMWyjXZZIzpdbJhKm6Kuzu8fsecbq8uOFQr+zMtY+zA:BVHyQNdbJAKuzRsecbq8uOFvyU
MD5 SHA1 SHA512 SSDEEP

Submit Download

VCRUNTIME140_1.dll

Path C:\Users\Admin\AppData\Roaming\Tasjoc Tools Quato\VCRUNTIME140_1.dll
Size 48KB
SHA256 6fd366a691ed68430bcd0a3de3d8d19a0cb2102952bfc140bbef4354ed082c47
MD5 cf0a1c4776ffe23ada5e570fc36e39fe
SHA1 2050fadecc11550ad9bde0b542bcf87e19d37f1a
SHA512 d95cd98d22ca048d0fc5bca551c9db13d6fa705f6af120bbbb621cf2b30284bfdc7320d0a819bb26dab1e0a46253cc311a370bed4ef72ecb60c69791ed720168
SSDEEP 768:a0Q4HUcGJZekJSam1BbuBSYcCZbiLzlSHji9z4GwZHji9znwT:afnDex5izbiLzlE+z4Gwl+zwT
MD5 SHA1 SHA512 SSDEEP

Submit Download

common_passwords.txt

Path C:\Users\Admin\AppData\Roaming\Tasjoc Tools Quato\common_passwords.txt
Size 81KB
SHA256 af55295852bcb0bc63e76cd22e342d9f7778b1802e76f0c502c73a35f652fd7a
MD5 01400a300abe0f193e3e4650cc5c1e56
SHA1 3b43dea40d28da9c0844f872e4566a020fb964d2
SHA512 462da2aa7accf3f4219b3139237099a016a51dc941014673d75fcc5c29ff361a07e6d575b800f5f270d042e7fbf4fdfb9f90d1981f355aabab37de7ebfc406fc
SSDEEP 1536:iR+IFwVFbYufJrJpBdyWJ+29ljtJDVsoYgvLnCkz+eYcm/QLS7quAm/7s:swVNHJrJEg1ljt3soYgvTCkz95nDuNI
MD5 SHA1 SHA512 SSDEEP

Submit Download

crashpad_handler.exe

Path C:\Users\Admin\AppData\Roaming\Tasjoc Tools Quato\crashpad_handler.exe
Size 483KB
SHA256 b2cfa5938d4f4cdcd7858b323da1c418391cf84c68fc699655c9b6d14b54593c
MD5 86b619cd0e562e2458e284672378bbdb
SHA1 f1b4f5b77f1bae421333b09d61bf2d15af8a5f7e
SHA512 5715d4643e30b9a4b639f404533700157598e452a221dc3c0d4d6eb191dc2abc4b4c101434ca36e20761c93f7d32156bf3e3d5c64ececd25d193be5ebabf61b5
SSDEEP 12288:wYAVIZjr27Q4i2gO5Qxpuq72dVaCp85O3O4nuho:wdVIZPOQ4i2gO5Qxpuq72dVaCp85O3O6
MD5 SHA1 SHA512 SSDEEP

Submit Download

randseed.dat

Path C:\Users\Admin\AppData\Roaming\Tasjoc Tools Quato\randseed.dat
Size 64B
SHA256 70950b976daa32cd5bb30fe6ed2b9c9de95023ea7821c06f3f651246f42fccba
MD5 b662a76399d1f70de3ca57a0cc784c37
SHA1 6aa8975272068eccaaea2559c51f2321dcb66ff3
SHA512 adb12703d42c21232ab2b7d47894d8fd3bb506a20432075a275086033a091a463255e1eb7e0554a38d1a437051913213be6cc755afbff46230fa2d8785069c31
MD5 SHA1 SHA512

Submit Download

saved.dat

Path C:\Users\Admin\AppData\Roaming\Tasjoc Tools Quato\saved.dat
Size 614KB
SHA256 e253ac7f274216228a3233dffc6476bebf28b1943d560247d8dab892ca58baab
MD5 702d47baefa275cde52a6f0b072a64bf
SHA1 73a9ff83f0c811be366a43ccc5c8519a469edcc2
SHA512 8465bf7c79608bf7c2c505473d9b231eecb75028bf489b92e51124566e13d56a582bd0e6eeb08f882bc75be588f860e29f5a0c38dba4a994acdc43517e720a1d
SSDEEP 12288:MM7pqC+/lJ7bzxouky3VC4LKkZZH2DIcP43f0rSSozk8dRQW8e5uuBDyA:Z7kplJby5yc4z3HELPQcrJozk8d6W8lC
MD5 SHA1 SHA512 SSDEEP

Submit Download

tune.bat

Path C:\Users\Admin\AppData\Roaming\Tasjoc Tools Quato\tune.bat
Size 88B
SHA256 120ab8272bee169d2c4ece25e6eca8a2194b474d2441b5b033a06db45c1a48e8
MD5 34446423927458485d5820faac77fd28
SHA1 26b223514ff7043320534141818e3d388398a8db
SHA512 a993aea56bc0f0dd5e466615656b7bb2ce2a5b8e23385a4961fafba3abc96cce5d4a74cda94d09fee4c2b37068e28a80adbbf131e6db3f21ee600956c34a1493
MD5 SHA1 SHA512

Submit Download

zlib1.dll

Path C:\Users\Admin\AppData\Roaming\Tasjoc Tools Quato\zlib1.dll
Size 1.0MB
SHA256 929caec229e7920bd69c16a82770494bda27cbed6cf65e5fa4ad47e41af564bb
MD5 5e2ca5bddbb5c48c650c26c2bfed0497
SHA1 84ab6a17ecf2131742f842c6e614150883cdf246
SHA512 cbbc1f2024dc54af47b7c09fb87f8b948188a89cd150023e15c428364f9a3c54e82f58e788cf05b05d5bab578a7e0dcd71d1be0f60d13c5247f3f6ded1c02c3d
SSDEEP 24576:rxS2TAFv19z/ZDWhGi/p+GNc780zpN+eXuM0:I2TcTgE5Q
MD5 SHA1 SHA512 SSDEEP

Submit Download

MSIC12D.tmp

Path C:\Windows\Installer\MSIC12D.tmp
Size 1.0MB
SHA256 c54f8a0cc280a9a0c934b8b23bbd530ba739e79ad686121cc8b659882ceb60fd
MD5 379f76e2fa6eef4c2116c2a3ae6896be
SHA1 1752ce4a944162f989505a3a826315ac7614d25f
SHA512 0b4f2fe85c76255db4b853f852b3e9d0f20736a2090d4c40b8ee332a9f0dfdd27bbb3944ccc61200d759f064d0f5f7431fa257c9f2298e1f80f7e74c466a6fee
SSDEEP 24576:ksHYYj0abjxKYLFfR4QOh0lhSMXlmGG3moCZwPKJF:kwYYIabTFZ4QbWGG3moCZwPKJF
MD5 SHA1 SHA512 SSDEEP

Submit Download

MSICFC8.tmp

Path C:\Windows\Installer\MSICFC8.tmp
Size 382KB
SHA256 802730190e1cd8b0ef380992c3c6664c142caeffade56a7e2157f9ede596a77b
MD5 481fba768d3692cb566f14697e436689
SHA1 9d3d801c5c5189a872ee33055f3b5cc345d07ebc
SHA512 32a48c05662edf3d35eb30b918e284b8af7b1b698e9fe27aa2e5c3d5b6fd11da900860c4161ec97891c94d8ae55c2634680a17e2bf2f4574efa6f2d8cbf17145
SSDEEP 6144:10r1GHZCl+eJk6VfKZfB5+J28RGG08enOCMdOajdLwLFeABzDykb:1u1GHLwKZfB5+JqG5CqO2ShDR
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4668-1342-0x00000000000A0000-0x0000000000ABA000-memory.dmp

Download

memory/4668-1339-0x00000000000A0000-0x0000000000ABA000-memory.dmp

Download

memory/4668-649-0x00000000000A0000-0x0000000000ABA000-memory.dmp

Download

memory/4668-509-0x00000000000A0000-0x0000000000ABA000-memory.dmp

Download

memory/5256-502-0x00000000001C0000-0x00000000001FA000-memory.dmp

Download

memory/5256-507-0x00000000001C0000-0x00000000001FA000-memory.dmp

Download

memory/5256-506-0x00000000001C0000-0x00000000001FA000-memory.dmp

Download

memory/5256-505-0x00000000001C0000-0x00000000001FA000-memory.dmp

Download

memory/5256-513-0x00000000001C0000-0x00000000001FA000-memory.dmp

Download

memory/5256-514-0x00000000001C0000-0x00000000001FA000-memory.dmp

Download

memory/5256-504-0x00000000001C0000-0x00000000001FA000-memory.dmp

Download

memory/5256-503-0x00000000001C0000-0x00000000001FA000-memory.dmp

Download

memory/5256-501-0x00000000001C0000-0x00000000001FA000-memory.dmp

Download