hijackloader | 4d95e661c6160b85f4320c21d44da333b97ba485f2969015c93cba9e81cdfc82

Analysis

max time kernel
149s
max time network
135s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/01/2026, 02:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 5.9MB
Sample260130-ddkrzaew4e
SHA256 4d95e661c6160b85f4320c21d44da333b97ba485f2969015c93cba9e81cdfc82
MD5 4af5af6fed218c5cc4e2c8ddbdd4432e
SHA1 dcf896658bea041c32dcac68c11095f2f44f051a
SHA512 5bdf6c157505a67035e853279f054ef28664e4647108df7902d93d79810570796d3ed1e8c38a39415da5d3ae0f0e81fa887e3c545cf722401c8113fa031f45ff
SSDEEP 98304:db5bc59tLCXk3M+goM5BU5bIvCbdCA3aWqsf99O+RB7FW6pzQdbl3Z+lqLxjX:dNwLCOKo5QY9q3+Rf9Gdb0qLxj
TLSH
T1FC563343B7C74476E8BD7E32C838C020CC2569782BE6B42B3DF9D69D46326D95972392
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

credential_access discovery hijackloader installer loader spyware stealer

Malware Config

Extracted

Family

hijackloader

Attributes

directory
%APPDATA%\WriterManager
inject_dll
%windir%\SysWOW64\input.dll

xor.hex

Signatures

Detects HijackLoader (aka IDAT Loader) 1 IoCs

resource	yara_rule
behavioral1/files/0x000700000002449f-37.dat	family_hijackloader

HijackLoader, IDAT loader, Ghostulse,
HijackLoader is a multi-stage loader, first seen in 2023.
loader hijackloader
Hijackloader family
hijackloader

Executes dropped EXE 2 IoCs

pid	Process
1540	file.tmp
4748	NavGrid.exe

Loads dropped DLL 3 IoCs

pid	Process
4748	NavGrid.exe
2764	VectorShar.exe
4808	Crisp.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious use of SetThreadContext 6 IoCs

description	pid	Process	procid_target
PID 4748 set thread context of 4808	4748	NavGrid.exe	97
PID 2764 set thread context of 4116	2764	VectorShar.exe	99
PID 2764 set thread context of 4604	2764	VectorShar.exe	120
PID 2764 set thread context of 4116	2764	VectorShar.exe	99
PID 2764 set thread context of 5028	2764	VectorShar.exe	126
PID 2764 set thread context of 4244	2764	VectorShar.exe	139

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSIPC\ThirdPartyNotices.txt	VectorShar.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\README.txt	VectorShar.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ext.txt	VectorShar.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uk.txt	VectorShar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\README.txt	VectorShar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\README.txt	VectorShar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\SkypeForBusinessBasic2019_eula.txt	VectorShar.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\COPYING.txt	VectorShar.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kaa.txt	VectorShar.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uz-cyrl.txt	VectorShar.exe
File opened for modification	C:\Program Files\7-Zip\Lang\zh-tw.txt	VectorShar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientOSub_eula.txt	VectorShar.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tr.txt	VectorShar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\WacLangPackEula.txt	VectorShar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Configuration\ssn_high_group_info.txt	VectorShar.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\en-US\about_Pester.help.txt	VectorShar.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mk.txt	VectorShar.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fur.txt	VectorShar.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ar.txt	VectorShar.exe
File opened for modification	C:\Program Files\7-Zip\Lang\id.txt	VectorShar.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lt.txt	VectorShar.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nn.txt	VectorShar.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ta.txt	VectorShar.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tg.txt	VectorShar.exe
File opened for modification	C:\Program Files\7-Zip\Lang\bn.txt	VectorShar.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fi.txt	VectorShar.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fr.txt	VectorShar.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ne.txt	VectorShar.exe
File opened for modification	C:\Program Files\7-Zip\readme.txt	VectorShar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\jvm.hprof.txt	VectorShar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt	VectorShar.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tt.txt	VectorShar.exe
File opened for modification	C:\Program Files\7-Zip\Lang\et.txt	VectorShar.exe
File opened for modification	C:\Program Files\7-Zip\Lang\si.txt	VectorShar.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\en-US\about_Mocking.help.txt	VectorShar.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ku.txt	VectorShar.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pl.txt	VectorShar.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sv.txt	VectorShar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\THIRDPARTYLICENSEREADME-JAVAFX.txt	VectorShar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\WacLangPack2019Eula.txt	VectorShar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\TPN.txt	VectorShar.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fy.txt	VectorShar.exe
File opened for modification	C:\Program Files\7-Zip\History.txt	VectorShar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientLangPack2019_eula.txt	VectorShar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Configuration\card_expiration_terms_dict.txt	VectorShar.exe
File opened for modification	C:\Program Files\7-Zip\Lang\co.txt	VectorShar.exe
File opened for modification	C:\Program Files\7-Zip\Lang\eo.txt	VectorShar.exe
File opened for modification	C:\Program Files\7-Zip\Lang\it.txt	VectorShar.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pt-br.txt	VectorShar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.18.0_x64__8wekyb3d8bbwe\_Resources\index.txt	VectorShar.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ko.txt	VectorShar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt	VectorShar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientOSub2019_eula.txt	VectorShar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jvisualvm.txt	VectorShar.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ku-ckb.txt	VectorShar.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ky.txt	VectorShar.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sw.txt	VectorShar.exe
File opened for modification	C:\Program Files\7-Zip\Lang\th.txt	VectorShar.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uz.txt	VectorShar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientARMRefer_eula.txt	VectorShar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub_M365_eula.txt	VectorShar.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ca.txt	VectorShar.exe
File opened for modification	C:\Program Files\7-Zip\Lang\cy.txt	VectorShar.exe
File opened for modification	C:\Program Files\7-Zip\Lang\el.txt	VectorShar.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\coreapi_lts.job	Crisp.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Crisp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	file.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	file.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NavGrid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VectorShar.exe

System Time Discovery 1 TTPs 3 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1212	chrome.exe
4636	msedge.exe
4768	chrome.exe

Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral1/memory/4556-0-0x0000000000400000-0x0000000000428000-memory.dmp	innosetup
behavioral1/memory/4556-49-0x0000000000400000-0x0000000000428000-memory.dmp	innosetup
behavioral1/memory/4556-121-0x0000000000400000-0x0000000000428000-memory.dmp	innosetup

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-914486190-3969805341-592249730-1000\{5A746758-2F3C-4A8F-A063-7691A83EFA5B}	msedge.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2764	VectorShar.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4748	NavGrid.exe
4748	NavGrid.exe
4748	NavGrid.exe
4748	NavGrid.exe
2764	VectorShar.exe
2764	VectorShar.exe
2764	VectorShar.exe
2764	VectorShar.exe
2764	VectorShar.exe
2764	VectorShar.exe
2764	VectorShar.exe
2764	VectorShar.exe
2764	VectorShar.exe
2764	VectorShar.exe
2764	VectorShar.exe
2764	VectorShar.exe
2764	VectorShar.exe
2764	VectorShar.exe
2764	VectorShar.exe
2764	VectorShar.exe
4116	chrome.exe
4116	chrome.exe
2764	VectorShar.exe
2764	VectorShar.exe
2764	VectorShar.exe
2764	VectorShar.exe
2764	VectorShar.exe
2764	VectorShar.exe
2764	VectorShar.exe
2764	VectorShar.exe
2764	VectorShar.exe
2764	VectorShar.exe
4808	Crisp.exe
4808	Crisp.exe
4808	Crisp.exe
2764	VectorShar.exe
2764	VectorShar.exe
2764	VectorShar.exe
2764	VectorShar.exe
2764	VectorShar.exe
2764	VectorShar.exe
2764	VectorShar.exe
2764	VectorShar.exe
2764	VectorShar.exe
2764	VectorShar.exe
2764	VectorShar.exe
2764	VectorShar.exe
2764	VectorShar.exe
2764	VectorShar.exe
2764	VectorShar.exe
2764	VectorShar.exe
2764	VectorShar.exe
2764	VectorShar.exe
2764	VectorShar.exe
2764	VectorShar.exe
2764	VectorShar.exe
2764	VectorShar.exe
2764	VectorShar.exe
2764	VectorShar.exe
2764	VectorShar.exe
2764	VectorShar.exe
2764	VectorShar.exe
2764	VectorShar.exe
2764	VectorShar.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2764	VectorShar.exe

Suspicious behavior: MapViewOfSection 7 IoCs

pid	Process
4748	NavGrid.exe
4748	NavGrid.exe
2764	VectorShar.exe
2764	VectorShar.exe
2764	VectorShar.exe
2764	VectorShar.exe
2764	VectorShar.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
1836	msedge.exe
1836	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2764	VectorShar.exe
Token: SeShutdownPrivilege	4116	chrome.exe
Token: SeCreatePagefilePrivilege	4116	chrome.exe
Token: SeShutdownPrivilege	4116	chrome.exe
Token: SeCreatePagefilePrivilege	4116	chrome.exe
Token: SeShutdownPrivilege	4116	chrome.exe
Token: SeCreatePagefilePrivilege	4116	chrome.exe
Token: SeShutdownPrivilege	4116	chrome.exe
Token: SeCreatePagefilePrivilege	4116	chrome.exe
Token: SeShutdownPrivilege	4116	chrome.exe
Token: SeCreatePagefilePrivilege	4116	chrome.exe
Token: SeShutdownPrivilege	4116	chrome.exe
Token: SeCreatePagefilePrivilege	4116	chrome.exe
Token: SeShutdownPrivilege	4116	chrome.exe
Token: SeCreatePagefilePrivilege	4116	chrome.exe
Token: SeShutdownPrivilege	4116	chrome.exe
Token: SeCreatePagefilePrivilege	4116	chrome.exe
Token: SeShutdownPrivilege	4116	chrome.exe
Token: SeCreatePagefilePrivilege	4116	chrome.exe
Token: SeShutdownPrivilege	4116	chrome.exe
Token: SeCreatePagefilePrivilege	4116	chrome.exe
Token: SeShutdownPrivilege	4116	chrome.exe
Token: SeCreatePagefilePrivilege	4116	chrome.exe
Token: SeShutdownPrivilege	4116	chrome.exe
Token: SeCreatePagefilePrivilege	4116	chrome.exe
Token: SeShutdownPrivilege	4116	chrome.exe
Token: SeCreatePagefilePrivilege	4116	chrome.exe
Token: SeShutdownPrivilege	4116	chrome.exe
Token: SeCreatePagefilePrivilege	4116	chrome.exe
Token: SeShutdownPrivilege	4116	chrome.exe
Token: SeCreatePagefilePrivilege	4116	chrome.exe
Token: SeShutdownPrivilege	4116	chrome.exe
Token: SeCreatePagefilePrivilege	4116	chrome.exe
Token: SeShutdownPrivilege	4116	chrome.exe
Token: SeCreatePagefilePrivilege	4116	chrome.exe
Token: SeShutdownPrivilege	4116	chrome.exe
Token: SeCreatePagefilePrivilege	4116	chrome.exe
Token: SeShutdownPrivilege	4116	chrome.exe
Token: SeCreatePagefilePrivilege	4116	chrome.exe
Token: SeShutdownPrivilege	4116	chrome.exe
Token: SeCreatePagefilePrivilege	4116	chrome.exe
Token: SeShutdownPrivilege	4116	chrome.exe
Token: SeCreatePagefilePrivilege	4116	chrome.exe
Token: SeShutdownPrivilege	4116	chrome.exe
Token: SeCreatePagefilePrivilege	4116	chrome.exe
Token: SeShutdownPrivilege	4116	chrome.exe
Token: SeCreatePagefilePrivilege	4116	chrome.exe
Token: SeShutdownPrivilege	4116	chrome.exe
Token: SeCreatePagefilePrivilege	4116	chrome.exe
Token: SeShutdownPrivilege	4116	chrome.exe
Token: SeCreatePagefilePrivilege	4116	chrome.exe
Token: SeDebugPrivilege	2764	VectorShar.exe
Token: SeDebugPrivilege	2764	VectorShar.exe
Token: SeShutdownPrivilege	4116	chrome.exe
Token: SeCreatePagefilePrivilege	4116	chrome.exe
Token: SeShutdownPrivilege	4116	chrome.exe
Token: SeCreatePagefilePrivilege	4116	chrome.exe
Token: SeShutdownPrivilege	4116	chrome.exe
Token: SeCreatePagefilePrivilege	4116	chrome.exe
Token: SeShutdownPrivilege	4116	chrome.exe
Token: SeCreatePagefilePrivilege	4116	chrome.exe
Token: SeShutdownPrivilege	4116	chrome.exe
Token: SeCreatePagefilePrivilege	4116	chrome.exe
Token: SeShutdownPrivilege	4116	chrome.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
1836	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe

Suspicious use of WriteProcessMemory 51 IoCs

description	pid	Process	procid_target
PID 4556 wrote to memory of 1540	4556	file.exe	85
PID 1540 wrote to memory of 4748	1540	file.tmp	87
PID 4748 wrote to memory of 2764	4748	NavGrid.exe	92
PID 4748 wrote to memory of 2764	4748	NavGrid.exe	92
PID 4748 wrote to memory of 2764	4748	NavGrid.exe	92
PID 4748 wrote to memory of 4808	4748	NavGrid.exe	97
PID 4116 wrote to memory of 3860	4116	chrome.exe	101
PID 4116 wrote to memory of 5792	4116	chrome.exe	102
PID 4116 wrote to memory of 5792	4116	chrome.exe	102
PID 4116 wrote to memory of 1212	4116	chrome.exe	103
PID 4116 wrote to memory of 1604	4116	chrome.exe	104
PID 4116 wrote to memory of 1604	4116	chrome.exe	104
PID 4116 wrote to memory of 728	4116	chrome.exe	105
PID 4116 wrote to memory of 988	4116	chrome.exe	106
PID 4116 wrote to memory of 728	4116	chrome.exe	105
PID 4116 wrote to memory of 988	4116	chrome.exe	106
PID 4116 wrote to memory of 2924	4116	chrome.exe	108
PID 4116 wrote to memory of 2924	4116	chrome.exe	108
PID 4116 wrote to memory of 3152	4116	chrome.exe	109
PID 4116 wrote to memory of 3152	4116	chrome.exe	109
PID 4748 wrote to memory of 4808	4748	NavGrid.exe	97
PID 4116 wrote to memory of 3780	4116	chrome.exe	111
PID 2764 wrote to memory of 4604	2764	VectorShar.exe	120
PID 4116 wrote to memory of 1912	4116	chrome.exe	123
PID 4116 wrote to memory of 1200	4116	chrome.exe	124
PID 4116 wrote to memory of 6092	4116	chrome.exe	125
PID 2764 wrote to memory of 5028	2764	VectorShar.exe	126
PID 1716 wrote to memory of 1836	1716	msedge.exe	129
PID 1836 wrote to memory of 1132	1836	msedge.exe	130
PID 1836 wrote to memory of 4228	1836	msedge.exe	132
PID 1836 wrote to memory of 4636	1836	msedge.exe	133
PID 1836 wrote to memory of 4228	1836	msedge.exe	132
PID 1836 wrote to memory of 4228	1836	msedge.exe	132
PID 1836 wrote to memory of 5460	1836	msedge.exe	134
PID 1836 wrote to memory of 5460	1836	msedge.exe	134
PID 1836 wrote to memory of 5716	1836	msedge.exe	135
PID 1836 wrote to memory of 732	1836	msedge.exe	136
PID 1836 wrote to memory of 5716	1836	msedge.exe	135
PID 1836 wrote to memory of 5716	1836	msedge.exe	135
PID 1836 wrote to memory of 732	1836	msedge.exe	136
PID 1836 wrote to memory of 732	1836	msedge.exe	136
PID 2764 wrote to memory of 4244	2764	VectorShar.exe	139
PID 1836 wrote to memory of 4596	1836	msedge.exe	141
PID 1836 wrote to memory of 4596	1836	msedge.exe	141
PID 1836 wrote to memory of 684	1836	msedge.exe	142
PID 1836 wrote to memory of 684	1836	msedge.exe	142
PID 1836 wrote to memory of 4756	1836	msedge.exe	146
PID 1836 wrote to memory of 4612	1836	msedge.exe	150
PID 1836 wrote to memory of 4532	1836	msedge.exe	151
PID 1836 wrote to memory of 3616	1836	msedge.exe	152
PID 4116 wrote to memory of 4768	4116	chrome.exe	153

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4556
- C:\Users\Admin\AppData\Local\Temp\is-TU0UG.tmp\file.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-TU0UG.tmp\file.tmp" /SL5="$6025A,5829781,121344,C:\Users\Admin\AppData\Local\Temp\file.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1540
- - C:\Users\Admin\AppData\Local\Temp\is-868KA.tmp\NavGrid.exe
    "C:\Users\Admin\AppData\Local\Temp\is-868KA.tmp\NavGrid.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:4748
  - - C:\ProgramData\VectorShar.exe
      C:\ProgramData\VectorShar.exe
      4⤵
      Loads dropped DLL
      Suspicious use of SetThreadContext
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: AddClipboardFormatListener
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious behavior: MapViewOfSection
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2764
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        5⤵
        
        PID:4604
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        5⤵
        
        PID:5028
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        5⤵
        
        PID:4244
  - - C:\Users\Admin\AppData\Roaming\WriterManager\Crisp.exe
      C:\Users\Admin\AppData\Roaming\WriterManager\Crisp.exe
      4⤵
      Loads dropped DLL
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:4808

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {c08afd90-f2a1-11d1-8455-00a0c91f3880} -Embedding
1⤵
PID:2728

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1756

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x11c,0x120,0x124,0x118,0x128,0x7ffb0d6fc728,0x7ffb0d6fc734,0x7ffb0d6fc740
  2⤵
  PID:3860
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1700,i,17586849711546973366,7343894096040556012,262144 --field-trial-handle=1996,i,17420628503012292352,13859883563912721130,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=1980 /prefetch:2
  2⤵
  PID:5792
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1596,i,8667729345229332473,11499363035684407600,524288 --field-trial-handle=1996,i,17420628503012292352,13859883563912721130,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2296 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1212
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2432,i,8952790867707956589,11673604296962297266,524288 --field-trial-handle=1996,i,17420628503012292352,13859883563912721130,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2612 /prefetch:8
  2⤵
  PID:1604
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3280,i,7363681097384508597,16418488130894764950,2097152 --field-trial-handle=1996,i,17420628503012292352,13859883563912721130,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:728
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3244,i,8458763733667410783,11590758704107150409,2097152 --field-trial-handle=1996,i,17420628503012292352,13859883563912721130,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4300,i,4152553842386853906,9244852017384159901,2097152 --field-trial-handle=1996,i,17420628503012292352,13859883563912721130,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4340 /prefetch:2
  2⤵
  PID:2924
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4728,i,8322953638134937822,11715323011298111465,2097152 --field-trial-handle=1996,i,17420628503012292352,13859883563912721130,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4744 /prefetch:1
  2⤵
  PID:3152
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5412,i,10151958957960118165,5324724707339444763,524288 --field-trial-handle=1996,i,17420628503012292352,13859883563912721130,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5428 /prefetch:8
  2⤵
  PID:3780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5800,i,8289744750574583926,8958301029502492308,524288 --field-trial-handle=1996,i,17420628503012292352,13859883563912721130,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5812 /prefetch:8
  2⤵
  PID:1912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5804,i,6645257503828451739,6704020654392592306,524288 --field-trial-handle=1996,i,17420628503012292352,13859883563912721130,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5860 /prefetch:8
  2⤵
  PID:1200
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5808,i,14619430665408219918,4184167866213217573,524288 --field-trial-handle=1996,i,17420628503012292352,13859883563912721130,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5796 /prefetch:8
  2⤵
  PID:6092
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2292,i,12835502910766328500,15855318711252490619,524288 --field-trial-handle=1996,i,17420628503012292352,13859883563912721130,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=1596 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4768

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:6084

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4928

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4576

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4060

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5048

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5180

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1836
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x244,0x7ffaf92ac188,0x7ffaf92ac194,0x7ffaf92ac1a0
    3⤵
    PID:1132
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1752,i,5121278328432093873,11943636344276005285,262144 --field-trial-handle=2268,i,929693139216576987,7738572498771159949,262144 --variations-seed-version --mojo-platform-channel-handle=2252 /prefetch:2
    3⤵
    PID:4228
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2020,i,4124042026950896833,1955729535037116775,524288 --field-trial-handle=2268,i,929693139216576987,7738572498771159949,262144 --variations-seed-version --mojo-platform-channel-handle=2436 /prefetch:3
    3⤵
    - System Time Discovery
    PID:4636
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2616,i,13769192360451990972,1028208260401791761,524288 --field-trial-handle=2268,i,929693139216576987,7738572498771159949,262144 --variations-seed-version --mojo-platform-channel-handle=2780 /prefetch:8
    3⤵
    PID:5460
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3456,i,16080132018275708294,234004738945613243,2097152 --field-trial-handle=2268,i,929693139216576987,7738572498771159949,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
    3⤵
    PID:5716
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3460,i,17793254750029606640,4886609363170383069,2097152 --field-trial-handle=2268,i,929693139216576987,7738572498771159949,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
    3⤵
    PID:732
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5748,i,12375484051629837332,11350473458819257203,524288 --field-trial-handle=2268,i,929693139216576987,7738572498771159949,262144 --variations-seed-version --mojo-platform-channel-handle=5764 /prefetch:8
    3⤵
    PID:4596
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5752,i,11328938632855239692,2309725521671881799,524288 --field-trial-handle=2268,i,929693139216576987,7738572498771159949,262144 --variations-seed-version --mojo-platform-channel-handle=5816 /prefetch:8
    3⤵
    PID:684
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6544,i,4648447769009118865,105155378015610556,524288 --field-trial-handle=2268,i,929693139216576987,7738572498771159949,262144 --variations-seed-version --mojo-platform-channel-handle=6612 /prefetch:8
    3⤵
    PID:5224
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6544,i,4648447769009118865,105155378015610556,524288 --field-trial-handle=2268,i,929693139216576987,7738572498771159949,262144 --variations-seed-version --mojo-platform-channel-handle=6612 /prefetch:8
    3⤵
    PID:4756
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6708,i,11485635358028058407,8843575860732345561,524288 --field-trial-handle=2268,i,929693139216576987,7738572498771159949,262144 --variations-seed-version --mojo-platform-channel-handle=5620 /prefetch:8
    3⤵
    PID:4612
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6700,i,9498680377646031577,5744942902406783562,524288 --field-trial-handle=2268,i,929693139216576987,7738572498771159949,262144 --variations-seed-version --mojo-platform-channel-handle=5696 /prefetch:8
    3⤵
    PID:4532
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6660,i,12871282110330972516,13614481725086391462,524288 --field-trial-handle=2268,i,929693139216576987,7738572498771159949,262144 --variations-seed-version --mojo-platform-channel-handle=6680 /prefetch:8
    3⤵
    PID:3616

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5760

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1004

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:536

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

VectorShar.exe

Path C:\ProgramData\VectorShar.exe
Size 1.7MB
SHA256 1dade02f4d36d483a918a455fad19dcf2f6ba993ad33bf8cac75184d5713ceda
MD5 f791b56733b56b97132351f7deda4297
SHA1 5528a47c2214a827e0f68ee564b789759eba81a1
SHA512 fffc7b5cfb863c425403f8d2711bc27f4fce31d274837464b9b7a3047df25e2daaf453359b6efd118614faa926fdddd4800d5c932ff61d7c443f3ca4a5119cc8
SSDEEP 24576:yL3450FtfMqXPGezr5n0cnrYKMHnM+s/qzUBUO2FdAEY7VN+:CZtUqfHB0cn8hBsuUBdUAC
TLSH
T186854D01A642D23AF9F315F7CAFE966D9638A660171950C393C81C7E9F21AF27D3124B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 8c408c3ff6a3554715046b95770c54a1bb47f68954022d057c4058bb6e7b4f89
MD5 900e28e95c56d69d2088865615f54085
SHA1 efdced1e3f48c116af00209b7eba8d9f5fe72a03
SHA512 eb0277148c902d397989b09dc5d4e96de693a73203b61fd6a736bfaf7a2fcdcadaf1dabfb08ffc98b21e634a6b20d64b2468f74ba577712249774f069cbc77af
TLSH
T16EE022AAC966EC6B08FD1B185014070AEF00131B6B41690F7A3D8A0D8FF963B898691C
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 356fe735704f8178336e24cabe81251e5451767b5f08da81df808dd2d97f3352
MD5 516264ea80b9aa843acb7c5cab1fd8f7
SHA1 356e4e93214208ff77fcfbf90e459a6e3f9debf1
SHA512 e379ca6f401e2bbabed4fb21259199cd48e4b8e726b1df5ecf7aff0e9cb413a9754cfdcb052347e5b98a0f93e28e81c4d273100a9a4131cb3aa880cab560f4eb
TLSH
T142518BB3C3E89A6D891156E4AB257E1FCD690A14621C3C5AC8D4AF0F53F19B6D21068E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 a5cf935694e9b1457f3043032563f6563521ac8467ef4ccaafd48902fb8faf5a
MD5 0fc4edf8736288d5293f2d4f3d9e6868
SHA1 211210e7ab3e83df232c98217c42a9ce1ae65ee5
SHA512 82cbe85aec40e84a7294d43ee14816bea5fc88e3f518101985a628079d5502aa1b2bb84f6562ee4811e1f8931ba5c5556c404b6c32962342635e142382cb4b0b
SSDEEP 192:6RTp+dkTf2Lusv7japAPRp2w9mHsb+WNnfkUxV/+VyIsnAUgtaJ:6RTpKgfL4aUXbIw8UX/28
TLSH
T1B332C62DA914B53F5CCBD22AFA667B57DBF5103164942E84EAFC8A3C00DB6CD621701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 56a1e8c00cba78461b814b7af7b99a3de58a4329a7a44475b23e4150677716ca
MD5 6932e737f9fb5bb798f741f34796b7e1
SHA1 58bd5e6597f4a5801de9e176eca39fb244cddab8
SHA512 6e0d027f757f85c0e73419b5d0cc63c8778e317595fc91efbb163ddebee9c4ad7ab8467ebddc43b66b02293c61347fd81b0b3e241e6794b5bc99b05d775c9885
SSDEEP 384:y4jGR7KxkXqKf/pUZNCgVLH2Hfgslyi7pLuLcifIpXODGJ+ErU3DcHG8akl78fPY:yMGR7KxkXqKf/pUZNCgVLH2Hfgswi7pz
TLSH
T1FC720AA76C4C997B0F94CACCC8177F4FADB5015B65E9886493FB582603D8BCB11091EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 b24f7988ce92ac405c6227cb797cdc9ebb41c4c8eb9dc6d93b640c40042f4b68
MD5 399334576dc62000c628328d6d08ec81
SHA1 2b2df2b0443f131287dfb236458d1dad396f3924
SHA512 255b47c669fc31b5c3682e93d6d633e4663ee49a719288682897bed786b5998a83d903605740bf427b180167b0d67677723afd3fdc8010f38c827ebd571f3851
TLSH
T143B01251C0019511C42302F416860488B124DF109B49230253E079759C265904015150
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59287d.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59287d.TMP
Size 96B
SHA256 3aabbceec438de6fcd50e023ac1d1761b11669129c7c87f4986fb97e78d76320
MD5 b916f099eea30b0554e5b5cfab86e8b7
SHA1 f99bc936b5cd947a7e8ac754de9e96a87242394f
SHA512 25e68ef38b6d547b9782133e1c635656495e1ab203b32411b415ef48b27c21d4ba7051d69b41c917636430fef6d6037b8de0afc715c05a19807e5ae98e7a9e6e
TLSH
T170B02238C2023322C00203B02EC0C0C8B0A0CF32C3030203C2E20B22EC20E200028020
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 177KB
SHA256 3c37f9d1203fc85132a37619ec59fa49d863f78f9d6181226235eb1130e8f263
MD5 978ad61c10694b723372a436653af11f
SHA1 21edb7ed0c22da235429d3994cd5334b7883c4b0
SHA512 08517c91f2f5f2b1d3dc42551eedde7a2d9fe58af616f1f6e7699eceefc6ad547a9892eb8a2f6a40fc07ddd6e26ee0cc798663648120a5edbf0de42e9d7b8e74
SSDEEP 3072:0HWP61eq4iiXSwQC+gvH42S0LUgy1Jw3Qw/xLANk0mUW5GmRntSFCjEENe:0HWPX79StC+gvHJLUJJwrOk0HOGm/SF3
TLSH
T17404127D1D270EBB297D8988F05E75088C31671E629FA5CC709867CEB08718A1F66E53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 89KB
SHA256 f3e44feb03e66905d76a39610c10a6dfb9d46fd389067252d855045c2b4c8bef
MD5 af3c1e0aa1304e76247aa5c27f8488e1
SHA1 424a1c85a86f848197768af6c498e94bf3324bf7
SHA512 de969274b206e4e3f7afdde3a73cee7cd782a3ad328b02270d4c167dd19757798fe90b69232e1b057ef783f3d1def4ed00fde7f33e13fc9fd163980ce6f30745
SSDEEP 1536:0lC8cYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9Yj:0j3Qw/xLANk0mUW5GmRntSFCjEENW
TLSH
T1F89302BA9E264AEB957E468176AE780CCE13130D709FA9CC715C639C21D41C92B73E73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 176KB
SHA256 a4f88aaf6dd43e4a1bf1181cb263d9d19a32e03ca19a52d9753250edeea90bae
MD5 097eb4e06a5d7e40afdc2495117daac2
SHA1 f5c6c206da16837ff1ca088ba177ca79b91d0690
SHA512 294cd415e45714e0487ff2087241d9fb47ab390233acc1e037cf68776ebd9e9b9a668769679e4fa737a3995d1fd0c077087fc8004aeeb7d42990cffda499b1c3
SSDEEP 3072:0+P61eq4iiXSwQC+gvH42S0LUgy1Jw3Qw/xLANk0mUW5GmRntSFCjEENe:0+PX79StC+gvHJLUJJwrOk0HOGm/SFyi
TLSH
T11E04126E5D270AFB297DC688F09E6908CC32571D719F75DC6098A7CFB08218B1766E23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 176KB
SHA256 58306634e92299ba3fce9f09a457310f9f3f82a6ed91666de2263078067664ee
MD5 bc87edb0356e2234ada348bd0aad2564
SHA1 86cf809f41761cadbd854873f6ecf8e918ebcb21
SHA512 845577138a074b4273d4a137a56d624e15217eb2df3f02e048a13d191c4d4c76e1351ac64c117a8b929b94aee8bb97f6662eda917908ea8d1bdb57e899bb3f27
SSDEEP 3072:0vP61eq4iiXSwQC+gvH42S0LUgy1Jw3Qw/xLANk0mUW5GmRntSFCjEENe:0vPX79StC+gvHJLUJJwrOk0HOGm/SFyi
TLSH
T15604126E5D270AFB397DC688F09E6908CC325719719F75DC6098A7CFB08218B1766E23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8b1e4ba6890ec60cfe9f6942acc1937ba6fdde042b45c0a2e0b7e13ade701cfd
MD5 642961cbd4f67f82b3038bc1275d24c3
SHA1 f1df4ba11ac13409c392147b2a9da411bc9cd6eb
SHA512 4f7f98f2ebf15c98a7f379a7975f6dff1c7086a1e3cf81d3daec8c9be6212ba05fb4eefc5fa2c0486a277860dc8b2aecdded5e174409117a0736b1cd3b8443d0
TLSH
T1CCD0805C52B3BC75D4C7997045C53B47373ED493659187317C6274B90C534504D961C7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 d68b8059d1fdfd8541892ccb136bddd7ec7601b55110e2cdd4c0e5ace97d9da8
MD5 531be76c0b4d3ce6131509c7d95980da
SHA1 8d06c8ade4d281ea8e43a1dd0a469db76987e5cf
SHA512 3f61844b74b97a902b9307c088590e72b7ad0e95c0f14948ae3780aa3e04b871d8e5c5cb6ca5f5fdf524ad8258178623c85c528a35deec8559c2d1d114436d1f
TLSH
T125D0C05C12B3BC35D4CB987004C13B03323ED893659187307C2234B80C0304048960C3
MD5 SHA1 SHA512 TLSH

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 b2874dcff50bdcd9e0fab08a0b93f9a1c342681a6c4f53d1af1064e79c754412
MD5 f17f4e65d0c8080dfc1563a7b69a3088
SHA1 28ce3998adf9374432436c6abc99d202a46a5004
SHA512 5fb5782dc0ca928704761c50e763846701a7615a468383c3da9e62449e2e93f64f827bb9f2266aa15e4cf18c29e21f5108783282599fc76ee3f7b2f669b4ee42
TLSH
T16AE02BEEC825EC2B1CFD075960604646E74413972A80590F3A3CC109CFF0A3B458685C
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 51f3d72ea52c206797cb6ed0421230c9d9c378ca6ed9d8a748bdcc16d6702c11
MD5 4d25ecc492cc5cc9b401186147581907
SHA1 04bee6f0c47c516181888d3a2d99ea0e0518fb09
SHA512 068c9f203be35bb76630be04b9a90af62f0ce5fd9fa780f17e5e8e9a52b6920004a5301ebd713d03b7a58c9fc63dd8464036b28fbd04bdcf6e7e40cd7eb366ee
TLSH
T1616183ACBFD0ACD4FFE089F56E6EED5EA21042B5C0C30B2B2421842C44836AD6547F69
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59e797.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59e797.TMP
Size 3KB
SHA256 9c6a90d540c319c778d530a326576aff7b6d739009108875536a01ab82ceacc7
MD5 01e767bd9ada9afe8c98fada4b3665bb
SHA1 5d00a52fdd7254ca6164fa2379fba7047e712363
SHA512 0935b9ef3ffe918a5405a1b1d49498ccbc33c0706be31eee17400efc912f1aeae968f52938d19796cdba673ef1f67e2cf7265d16790af429deafd7a243c41c0d
TLSH
T17461E88C6391ECE4FBF441B4A2FEDA2EB230427540871E3A25F4453C4542B1DA847F75
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 108KB
SHA256 84ab2d00a9c76d63c3edf4fd0139236f6b94e49bd7889e4f5f63f19941bc1ed1
MD5 902622d177776fafc9f85d74f2ab73b8
SHA1 deb767db94129ecffdcd2ff94970687033409107
SHA512 d219535bf4fd4b1561c34b2e0c9f3938de8a86a85aba4d19f31b413483d01cb6afe611077620907839f4340475f1468c2097318751aeef4a61c64a75751aea2e
SSDEEP 1536:IdcH74ohBGZqW3iPPDuVvpBI/S8tZsA62UYPq:vHSRiPjU1
TLSH
T196B35227D6A54C6B01F16264EC794382F325436F9282A82F3A7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 44b621956901610795d577d738c85d9871346f01448b255207fdf97414c9c555
MD5 81674d4432a6f98fd6260e39ea41ec14
SHA1 44617a5c344d977500b7890ca3df0815649cbbd8
SHA512 46687ee838c366af70c30471345fe9a599bb246f8dd84fddf79222026a96e416678f4539a1c237e843e9df12e81e1f16d587ef22d0b4e2cc0c8c8e9006140f6b
TLSH
T1B531CCF3C3E8953D8A0196F0B6183F2BCE690951931C3C5BC4E4EE0BA3E28B5E14185B
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 15d180821ed87ec5c578dabc9740a96cb8a45543b9ae9ae9f4c88d9f86f30a70
MD5 6ffb7415e17e1b9918a53e2fa8777f99
SHA1 d891d23d1aad1dc11904ee26df5c6f6b1365d796
SHA512 ab45bdaa9de7c1bfa36924c60423baa0c34775aa0ca5a62ce7bab0e09919cfd7a8e89fd5a0445542cf0be84d7ecb79dbd92c9bb381fab3bf8cc4bba6fe243c27
SSDEEP 192:sxZLQUnhRTyMqZ/K1Ml8M3d/fGs9fjZBrfzkDqNodp4NHW6+WNBOlaf/Yx58heIT:sxZfnhE/d/fGs9j3rfz+8Hbs0f/A7BjY
TLSH
T1B2821915A538593B9DDBD218FA467F93D7F81563D1804E489AFCCA0C04E6BED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 eeb32ed58e23a2be0885e9bdfb1bc7043b337c99a55edf1c2d189e9bdda0a26c
MD5 598352fdc9c298b9872ec9ed1e83530c
SHA1 8a7ceef4b9821a22d750589836a2113741ed6a0d
SHA512 38959a01b4da9ddd3d8ec1e04d2fe66b01212a4e913cccd1e1fd0ea9416d9430bf8baa75aedd49c11113ff0812f0785ea3889c4434eacaf7872939c97b4e22e8
SSDEEP 768:Jic+tx27pLuL/VRWvV/qH8F1+UoAYDCx9Tuqh0VfUC9xbog/OV/DFkLlMeNtFro4:Jic+txWE/VRWvV/qHu1jaiDFkLO6t+Ba
TLSH
T14EF20B3B2C0CCB7E4F840E9CEC2A7E5E6EE801CB96988D5447F9885C02C66EB55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\91d73940-0d21-4161-b459-1da74c6e5c7d\index-dir\the-real-index
Size 72B
SHA256 ae3f0d19dea306485206703d8b9fcaed9c379752318ebf14ebc4e5c99f81fe44
MD5 9f9446e7cafae2ebfa4626b72ccbfd4d
SHA1 5e8c91b523706a38ef94ce62968236b9bbb391e4
SHA512 1a46d4a2858fa9f1650717c1bdb1885a4699e24221b7f4378527c721d5965158204eac245f48b776e21f888ffef8db8151ce50f38edf6d2f014817e1ae7d5506
TLSH
T1A3A002E04BA61C07E05611F9595213891216C9601132920643A11044CC51C506E4250C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\91d73940-0d21-4161-b459-1da74c6e5c7d\index-dir\the-real-index
Size 72B
SHA256 a24fed99ca46e8c73a870a7200d3969eab94bca6bb3916cd2f8bb6a07db8e354
MD5 8a07d56f33246e8e626aa32366ae167b
SHA1 4fde59143a576bac22cab4323be7c0d85dce4a3c
SHA512 36850daec1ccfb59be25268c56e0773c4831119c018e972247da56bff658e15ba53598057576797c4e938d6609025e4a48209622e628f259ba165937f7e9a26b
TLSH
T149A002E012EA1C01E0935AF0269301467211D8150E63A60643E10144C893D40668100D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9ee838dd-a441-435f-b78f-4a16a5581428\index-dir\the-real-index
Size 2KB
SHA256 8261517fbae7868748ff37a38770fd624862a536eff3ce3337856b022d206039
MD5 e4f238f56d9c3eb1975e66f2e6a8b319
SHA1 815c1799d49593b4ceb08f57a963ba68e44afb67
SHA512 3d55afc080e3c0e44bd734487bfff9e0e8688aae5e8454fb533be7aab10b3cbe98e4430fd1273607fcfcae5c9089c1b725a7346d04fe295f188dfaa66e4a226b
TLSH
T19E51EA4D5C4B5E23C97C52B159FB0479337418FE1B98070778FC96386C8BA6129E7319
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9ee838dd-a441-435f-b78f-4a16a5581428\index-dir\the-real-index
Size 2KB
SHA256 d7592a170846f38de2224e940ebb88ea7495d3c5ffba56dfdd8fde7962c05913
MD5 270bb1afc6ec2db22dd1fca4e1f725fa
SHA1 e8e5ea1c644cf425ea9d5566ab2555ab97b5a428
SHA512 45e09b331209c1e0729a0a334868d7998280e064e448059fa2317054e873f8d97a8b02cf52e0600038f18f8fdc39c1c8f2df621b38cd7628ff5e67dad68d1eaa
TLSH
T1E851E94D5C4A9E13CA6D42F099F71028333458FE2A98070778FD953C9C8BA922ED731D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe599011.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9ee838dd-a441-435f-b78f-4a16a5581428\index-dir\the-real-index~RFe599011.TMP
Size 2KB
SHA256 5f21a6274633c474777d422204361d80f04d24bb32a45c77d7cf43c278b12419
MD5 82287ad52a07cf29b4fb47f97a391890
SHA1 1493c90ce771e352cb9223819d79aa31f9a3ef1e
SHA512 d9f07a4e60e0f7e79656abcaf150253ae00cc40ad8f328cf3558a726447c808b61640fc56d6b9ccb85e104b3d0409bce01b63183012dfb09d518b93b526c03a5
TLSH
T1DE51A85E9C824A22CD6081B359CA6469333E68954944AF0B34FCCA33ECC76AD3D57355
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 916534a59d1f5349b77911c3e3f7681c736ce81e1c20312732a2f6ad7ce96363
MD5 de85807b0b600c8999206386f4651608
SHA1 9a105445e7f3fbf130479a1312de4e418e5788b8
SHA512 f48c17ca6a7defd8a95bd709da6301a731d4a65ded3a6b5c26c6303ab5bad1e65de028e7218c4edf12281e7af3398ac002646996a6abe656645dd96318c7dfb0
TLSH
T196E0DFBA3DF71C10AEAE87D6687294A00955B4488E54AC8E642696D768A2311288EC7B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 f6342b368add360ca64a1ead87d170e9bee515f81eba7dc6c06a610117f950fc
MD5 ce38af1de7d00d29e4cd95ec51bba668
SHA1 3f971d593773f3fc8c7c8a93327bcda6bef77f46
SHA512 f98dd830c48da68b9406d27a8f2121a92d66a32d4174d28e7712a0a10e5dc14efc036dca71ff5129d0aece65c03be168138051c7d564e15b133b206229d8c6d8
TLSH
T1D2A0026585791481C0180AF894410284237089582745761256E404ECBC543459992817
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59e296.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59e296.TMP
Size 48B
SHA256 37e92dca0268f288e16d9ae843924ca986d94759d6408ec6a5dec718f74710c8
MD5 0311b2ae4a4b25b00b2c7fad6c06971d
SHA1 d4664f1ca5acef4373dd5dc97508410d7d50dbca
SHA512 dca23048e91637700e2eda8fb80137e916458575f65a86f808346c2deb4c56cbd757a0529c3778946a535d95837a63b0084c1c047537cc082ee9d4b225b75336
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 b7c17d8c03e30c3c830d8ed11f941c3349b346c45bc144eca7e14bcbc2e6b953
MD5 d3171b9ee8d54f18e47f5ec996af9dc3
SHA1 55f955cb3116d770f8278be6ba40f1c7806b46cc
SHA512 82e351ac5b092dc0d63923dabe4cb36179dc8d27d1423b8f9760f2cb637197ef609edf48fe00abce7f99b7f786a091da4a62449cc2dd83a3bf4f46c802b5c5c5
SSDEEP 384:SXEpUTaFkzG/T1ddEtgjzzLlRQbz4BD30LK4xfmOGwBsgr:SXEpUTaFkzG/T1ddEtgjzzLlRQbz4BDE
TLSH
T161B23910317B06803A7E699E95A5B86F62C270633058A83B7BFC00A64F6BE14DDFD5DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 24528cf9ae115dde06b654a473fe89e1533a21c11b7c77af2467828bfe31a4f0
MD5 b99f340678103c6e3a9b41062abcfbc6
SHA1 0d61f397fd2696b10f13c17faaefd08f1b8fcf58
SHA512 078272299e0bbb09ac67c1c5804c7e04a3e6813080e79d18916b624e54e0e879c405bf1867a830c4070604e4ada333be9deb6f6ebf22a04ba6fdc45ada6bd8cd
SSDEEP 384:n0ziFavqMg3sNd8TUNTUlImx9JC9v3vfEPEABRx0b7dnS4mtmLP9rNlk+5vI+R:zFayv3qwgDcPrh0b7dS4smzJ9
TLSH
T1AFC23C75EC58DAABEDE78FC9A7497A07EEE001A7D98C4AC8DAC81D0D00971DE1307C12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 0ae40acdb75d7f8c769bc90cb68dcbfd71774ddc3a63a3fa4c47ae507bd32a4e
MD5 541d5f4dfb8b3f348fffde5f04983fb5
SHA1 489dc6f734d0ac0e39165ed1f076d3de0d747366
SHA512 d4cfb116200dcbd0ed8c21805c0a3809f4cd77f286b4aed529d03f4abf4a248d90a4b64fe7f18086369026384f14f8a34ee69114e6928bf979bd77b714847231
SSDEEP 384:nFziFavqMz3sN18TUNTUlI4vTQ8JFCe3vfEPEABRx0yuow5t9LICN8tOVT6KrNle:0Fay032wg3jFPrh0yCJLbyOVThe
TLSH
T1B9D24A72E898DAABEDE78BD9B7097607DEE041A3C5CC4AD8D9DC5D0D009B09E130BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 74311735ca62580b62500aa7b6578a21433fe42562d600a3bd5022be45629c5e
MD5 6535bd1b1ad453e646b78bbc09fc5a56
SHA1 4f370bdf0029bfe221d2a0f93556bd138fc24edb
SHA512 567400c26616dc7f70ac3c868295f07ba9d9b5d80bae69765f4e50c04f27587bc5ab5f8ad7340315bef015db7a945519ae302372befe561c7e28f0871ea5dedd
SSDEEP 384:n0ziFavqMg3sNB8TUNTUlImx9JCev3vfEPEABRx0yuow5tZLdnS4mtmLP9rNlk+v:zFayv3GwgEcPrh0yCtLdS4smzJ9
TLSH
T12EC23B72E858CAABADE78FD9A7497A07EEE04597D98C4AD4D5DC2D0D00DB0DE130BC12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 a02b9527ac7f9c971b296596c35c7b8bb84ae51ecbfe708ab37e142cddfcffc9
MD5 48a181619bb46b7017baa9baffb5ae16
SHA1 90bb542b49700e51125cf5d49605bb75a8bc3eb7
SHA512 d1132ab658ee2eaa4f3fd9c15083e32492da445184f2005342f653bcb49e148de459ff7bc54a5449d6d77df92cb247271d8bae1261077ddf1cb3c95891c0b246
TLSH
T1BE41E558AAF91108B3B36F1AAFF7A8AE447E78672F06D15D10150D4F0B22F40C9A1B37
MD5 SHA1 SHA512 TLSH

Submit Download

20A4447.tmp

Path C:\Users\Admin\AppData\Local\Temp\20A4447.tmp
Size 6.2MB
SHA256 8ac28afe0aa73609f2b61fb72a3f711c4f25f29b79c719469c36ce2d557828d0
MD5 0f6c746ccdf3f8501eade0e36a1f79f2
SHA1 aec93827149157a02cb97a062a22dd2c636ba202
SHA512 70c07ad213b3eb9341e0d3c109dd7712fc6a418ae66cebe1faf3261773c08fec1ebc6ad0042c5789c8f797af361842bf61dcb75974a8c45c7bbe28c881532740
SSDEEP 196608:5njx3dB/x4po6MXkt4hf/fp759wRmSpOIcRnnq3:Vjpd9h68lNhkRmtY
TLSH
T1635633041022A69384F4F7922F23C761D9ACB9D0B4DCE659EB786E54F5D3CC66A0DCA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

20A4447.tmp

Path C:\Users\Admin\AppData\Local\Temp\20A4447.tmp
Size 6.2MB
SHA256 1761cecddf8f170830d7a25a62667e5631379a153a1b300770dce2c8f99f1451
MD5 c3a0469eda1177008e8fd2662dfd6c45
SHA1 257e400924af70af9f3e885c48242ece03695496
SHA512 9eb436f8419251558fda7323c3a0c0148ed130ede9ff12261ba42195688bc9b2c595d27a56a82068661a23e673eae4ae011f4b1636f110e7b94a48fa330a6f36
SSDEEP 196608:lgjx3dB/x4po6MXkt4hf/fp759wRmSpOIcRnnq3:ejpd9h68lNhkRmtY
TLSH
T1955633041022A69384F4F7922F23C761D9ACB9D0B4D8E659EB786E54F5D3CC66A0DCA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8vrd8w.7z

Path C:\Users\Admin\AppData\Local\Temp\8vrd8w.7z
Size 7KB
SHA256 ae4f3d922b9c1da50c9a5efbdc28bc167e5df0bc6a09600f84fe2b4eed43c374
MD5 f62df23b945c6cd7a20620d80145674b
SHA1 1e31409c5ee7a9a2e79bc245ae0e8b9dd645161c
SHA512 f96b0c5750b58be0639228106fa707188954e7534c79d80d37146f1972413398c10557ebb5e488596e815167925ee8d830cc6262d638f8a60321a027bdb9f81d
SSDEEP 192:QORgGLjLpIXaXLNQjiK/nYWs9UrL1D/XDm7sCV0X7OeLbeEy:QEgGvuXaXqdfYWs9YpDmQ/r5beEy
TLSH
T1B4E1A0408AA3ECE653F0A61016E6F8B7D0FBDAD6130D267617CCC1379557C4794AD8E2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ExceptionHandler.dll

Path C:\Users\Admin\AppData\Local\Temp\is-868KA.tmp\ExceptionHandler.dll
Size 128KB
SHA256 3b0f1581ea7f69d17460e3e698ba05876617437352dc8fdc8d633c42892c1553
MD5 05ea79d834f6f0924ae573a1276f0e86
SHA1 78c8b8066124ede98b61e5d3fc78e472ade7bb2d
SHA512 c7c0f300b0975eefacaba08a4e9f8f6c85c595993e6540e9a7243b2300a1a65e53e89bc2a761c4ecc680f5df64c1702437b5785fa67c5c08a2792f849f452e4e
SSDEEP 1536:xeLbWzby5i5ZqygSH9JFXHSFUNNRcZZh6mCcTSkb0EYsKK93BFZ2nQ+5e+b7:cv+iNRSH9JFCsInjWK9RFZB+5e+b7
TLSH
T1D7D38D21B250C0B2C4CF663D4466C7655B7FB5358B658ACBB7580B7ABE203D09B3A347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NavGrid.exe

Path C:\Users\Admin\AppData\Local\Temp\is-868KA.tmp\NavGrid.exe
Size 119KB
SHA256 daef1f11e3ef895923191a21bb1d9e4652a0568aa2651c97033ab9d3be9ddb10
MD5 bca13825411049cf5b942ba2decb9192
SHA1 ddd26f1754ae44b8f194ecf963abf8e5436d83f3
SHA512 c00dc2a4b242912da40a052e7ee0b45bfc5fdb62d712201a39dfc623b187f4c5a93cfde21ee7b85a54c5bdb56fc0021ef3110197ad1ba193e5ded1533876ea87
SSDEEP 1536:IBnZOvLKSCNIoaT4AhbcfkdOpLbdTqBiLDnlxZksXoEU8+scVvoa76Kw87ZsP:EOvLU63RSLbRjlgEU8+sqvoaR9y
TLSH
T1AEC39D11B890C873C417593558A4E7A69E3DF6224BB089C7F35C4B7E9F203C19B7A2DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Thongshootplieg.zh

Path C:\Users\Admin\AppData\Local\Temp\is-868KA.tmp\Thongshootplieg.zh
Size 9KB
SHA256 c9e70912a5b73ea44b13a3b00ac81696bf4f0398ecca0fbf27ed9b12626302cd
MD5 9d26d235264bb21f84c15e71a1097f06
SHA1 0a7fda9909ba806e9ac61a6d308ba69fa1cd2023
SHA512 55fc0ce4415b346f9fe0559987fdd8ccb32ee5062a0c245433b6b482fa7722fe93e86056e151d999b5f81b347e8b061b29c4ed4c861663eb1ce0a1be7964858b
SSDEEP 192:52IDgBc4JOxPMhVroMBb+PN5WdeKpvjH89OfKmpkF1SQZMg:kID2T/Vr95+PyewzTpQ1pMg
TLSH
T10512395D5DAE57182CCAA4FDB6F0DBAFA1F47A3E2B9410C115A964152973A0CC203C9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Wailhaingshaeck.ia

Path C:\Users\Admin\AppData\Local\Temp\is-868KA.tmp\Wailhaingshaeck.ia
Size 5.2MB
SHA256 fe094ebb875f1b2b180f2cde1b672b4f4467e6820ceffaee534c5352713faa83
MD5 7c4589bd58ebaf6ea0c530dad9c9e89a
SHA1 b6bf893cde087c4e1e33b0c84861d918239e54ff
SHA512 da4d7bc71cd6233665cc4972f8ecee78860bce0299e7f89fca96501204723e9d6e5b0830028be720e4d1f82ce638c7073625d832c626e4a0080ee1e079484f58
SSDEEP 98304:r/ipDv0OUm/xjXq/kiWPPVlbg8zLho0Og0En+HNUQIaWAXet4ccjNrbav:ruDvasxjXqBelkAhoYFsNUQ1E7kNvav
TLSH
T1954633A6E68EC433CB57DD7A5BBE25DD3A8C94C01BA300A032C5A1EEC8FE540555673B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

file.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-TU0UG.tmp\file.tmp
Size 1.1MB
SHA256 821bd11693bf4b4b2b9f3c196036e1f4902abd95fb26873ea6c43e123b8c9431
MD5 90fc739c83cd19766acb562c66a7d0e2
SHA1 451f385a53d5fed15e7649e7891e05f231ef549a
SHA512 4cb11ad48b7585ef1b70fac9e3c25610b2f64a16358cd51e32adcb0b17a6ab1c934aeb10adaa8e9ddf69b2e2f1d18fe2e87b49b39f89b05ea13aa3205e41296c
SSDEEP 24576:RtdAm9DUi/CR3wCkCiRgoG7hBaHkbEXXeG/jFt5lTxyt:PqTytRFk6ek1L
TLSH
T198453A22A3D24437D5732F759C6BC2946C367E202EA4E54A7EF99E0C0E39B41BD35392
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lpACibdo

Path C:\Users\Admin\AppData\Local\Temp\lpACibdo
Size 32B
SHA256 0a987bd9c0979749601d3effa2c4b874f53b8c3becec6e013add3017a4223d49
MD5 cad238516d1e4e01c367d4363ce42e13
SHA1 dd9f13db3be84a59ffe541064a7923ce7d700e14
SHA512 20f00815b98271ea2bc451eb51873cdf9d5e8d0b59ca349978fddb9913d4745550d671f64ccc316cd0fe0ce26e4f9d0e9d6436696015180d43618ee40bd91834
MD5 SHA1 SHA512

Submit Download

Crisp.exe

Path C:\Users\Admin\AppData\Roaming\WriterManager\Crisp.exe
Size 334KB
SHA256 c2e62475768c9546efe1da92a55f3bb2a55350eed83241139917aabd1ad25f8a
MD5 5f9f88c9a16b62dc38504549e93d3667
SHA1 587d56031b39e34102bc67b5f7d0338ee41b5328
SHA512 edbb7a8cd75e056d2c47b8af6fbee63726cb3d5f000d5f8bc000f4b16366619c8532e628585cc943f474d2509c63802179d0d22a1d32dd690fb25e00d262af83
SSDEEP 6144:7c2XFRJ3DNuzAOS9FuxIRtiiuhKPTqX4Y42:dFvYzU9kutRuhKPTqo32
TLSH
T125749E11B9D1C4B2C4B2053009E8EBB5697DFD714F61863B33D8772E1F742C1A662AA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1540-120-0x0000000000400000-0x000000000052D000-memory.dmp

Download

memory/1540-119-0x0000000000400000-0x000000000052D000-memory.dmp

Download

memory/1540-50-0x0000000000400000-0x000000000052D000-memory.dmp

Download

memory/1540-43-0x00000000021A0000-0x00000000021A1000-memory.dmp

Download

memory/1540-5-0x00000000021A0000-0x00000000021A1000-memory.dmp

Download

memory/2764-122-0x0000000002E80000-0x0000000002E81000-memory.dmp

Download

memory/2764-61-0x00007FFB2A6D0000-0x00007FFB2A8C5000-memory.dmp

Download

memory/2764-72-0x0000000002E80000-0x0000000002E81000-memory.dmp

Download

memory/2764-68-0x0000000073E60000-0x0000000074782000-memory.dmp

Download

memory/4556-49-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/4556-0-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/4556-121-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/4748-55-0x00000000747D7000-0x00000000747D8000-memory.dmp

Download

memory/4748-64-0x0000000000EF0000-0x0000000000F0D000-memory.dmp

Download

memory/4748-54-0x00000000747C0000-0x000000007480F000-memory.dmp

Download

memory/4748-52-0x00000000747C0000-0x000000007480F000-memory.dmp

Download

memory/4748-44-0x00000000747D7000-0x00000000747D8000-memory.dmp

Download

memory/4748-47-0x00000000747C0000-0x000000007480F000-memory.dmp

Download

memory/4748-46-0x00000000747C0000-0x000000007480F000-memory.dmp

Download

memory/4748-39-0x00007FFB2A6D0000-0x00007FFB2A8C5000-memory.dmp

Download

memory/4748-38-0x00000000747C0000-0x000000007480F000-memory.dmp

Download

memory/4808-150-0x00000000747C0000-0x000000007480F000-memory.dmp

Download

memory/4808-128-0x00007FFB2A6D0000-0x00007FFB2A8C5000-memory.dmp

Download