hxxp://GPT[.]AIULTRONX[.]COM

Analysis

user interaction
yes
max time kernel
225s
max time network
228s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
23/04/2026, 01:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://GPT.AIULTRONX.COM
Sample260423-bk9cssft8w

Score

8^/10

defense_evasion discovery persistence

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
64	1696	msedge.exe

Executes dropped EXE 6 IoCs

pid	Process
4580	AitronLink_v1.0.21.exe
1488	AiMouse.exe
1848	AiMouse.exe
1516	AiMouse.exe
1708	AiMouse.exe
4504	AiMouse.exe

Loads dropped DLL 59 IoCs

pid	Process
4580	AitronLink_v1.0.21.exe
4580	AitronLink_v1.0.21.exe
4580	AitronLink_v1.0.21.exe
4580	AitronLink_v1.0.21.exe
4580	AitronLink_v1.0.21.exe
1488	AiMouse.exe
1488	AiMouse.exe
1488	AiMouse.exe
1488	AiMouse.exe
1488	AiMouse.exe
1488	AiMouse.exe
1488	AiMouse.exe
1488	AiMouse.exe
1488	AiMouse.exe
1488	AiMouse.exe
1488	AiMouse.exe
1848	AiMouse.exe
1848	AiMouse.exe
1848	AiMouse.exe
1848	AiMouse.exe
1848	AiMouse.exe
1848	AiMouse.exe
1848	AiMouse.exe
1848	AiMouse.exe
1848	AiMouse.exe
1848	AiMouse.exe
1848	AiMouse.exe
1848	AiMouse.exe
1848	AiMouse.exe
1516	AiMouse.exe
1516	AiMouse.exe
1516	AiMouse.exe
1516	AiMouse.exe
1516	AiMouse.exe
1516	AiMouse.exe
1516	AiMouse.exe
1516	AiMouse.exe
1516	AiMouse.exe
1516	AiMouse.exe
1708	AiMouse.exe
1708	AiMouse.exe
1708	AiMouse.exe
1708	AiMouse.exe
1708	AiMouse.exe
1708	AiMouse.exe
1708	AiMouse.exe
1708	AiMouse.exe
1708	AiMouse.exe
1708	AiMouse.exe
4504	AiMouse.exe
4504	AiMouse.exe
4504	AiMouse.exe
4504	AiMouse.exe
4504	AiMouse.exe
4504	AiMouse.exe
4504	AiMouse.exe
4504	AiMouse.exe
4504	AiMouse.exe
4504	AiMouse.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000\Software\Microsoft\Windows\CurrentVersion\Run\AitronLink = "C:\\AitronLink\\AiMouse.exe -auto"	AiMouse.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000\Software\Microsoft\Windows\CurrentVersion\Run\AitronLink = "C:\\AitronLink\\AiMouse.exe -auto"	AiMouse.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Windows directory 19 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4268_1263636334\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4268_1263636334\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4268_1372169280\travel-facilitated-booking-bing.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4268_1266019989\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4268_1266019989\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4268_212247072\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4268_580394066\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4268_1372169280\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4268_1578109887\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4268_580394066\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4268_1372169280\extraction.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4268_1372169280\travel-facilitated-booking-kayak.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4268_212247072\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4268_212247072\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4268_580394066\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4268_580394066\sets.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4268_1372169280\automation.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4268_1372169280\classification.js	msedge.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\AitronLink_v1.0.21.exe:Zone.Identifier	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AitronLink_v1.0.21.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AiMouse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AiMouse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AiMouse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AiMouse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AiMouse.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1696	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134213804188209622"	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1383858298-2057492509-1726743289-1000\{B0EC07B9-2272-492F-BEBF-088FDFF0604C}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\AitronLink_v1.0.21.exe:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4580	AitronLink_v1.0.21.exe
4580	AitronLink_v1.0.21.exe
4580	AitronLink_v1.0.21.exe
4580	AitronLink_v1.0.21.exe
1848	AiMouse.exe
1848	AiMouse.exe
1516	AiMouse.exe
1516	AiMouse.exe
4984	msedge.exe
4984	msedge.exe
4504	AiMouse.exe
4504	AiMouse.exe
4504	AiMouse.exe
4504	AiMouse.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe

Suspicious use of FindShellTrayWindow 62 IoCs

pid	Process
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
1488	AiMouse.exe

Suspicious use of SendNotifyMessage 17 IoCs

pid	Process
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
1488	AiMouse.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4268 wrote to memory of 452	4268	msedge.exe	80
PID 4268 wrote to memory of 1696	4268	msedge.exe	81
PID 4268 wrote to memory of 1704	4268	msedge.exe	83
PID 4268 wrote to memory of 1704	4268	msedge.exe	83
PID 4268 wrote to memory of 2640	4268	msedge.exe	82
PID 4268 wrote to memory of 2640	4268	msedge.exe	82
PID 4268 wrote to memory of 2640	4268	msedge.exe	82
PID 4268 wrote to memory of 3528	4268	msedge.exe	84
PID 4268 wrote to memory of 3528	4268	msedge.exe	84
PID 4268 wrote to memory of 3528	4268	msedge.exe	84
PID 4268 wrote to memory of 1268	4268	msedge.exe	85
PID 4268 wrote to memory of 1268	4268	msedge.exe	85
PID 4268 wrote to memory of 1268	4268	msedge.exe	85
PID 4268 wrote to memory of 3312	4268	msedge.exe	87
PID 4268 wrote to memory of 3312	4268	msedge.exe	87
PID 4268 wrote to memory of 3312	4268	msedge.exe	87
PID 4268 wrote to memory of 2420	4268	msedge.exe	88
PID 4268 wrote to memory of 3048	4268	msedge.exe	89
PID 4268 wrote to memory of 2420	4268	msedge.exe	88
PID 4268 wrote to memory of 2420	4268	msedge.exe	88
PID 4268 wrote to memory of 3048	4268	msedge.exe	89
PID 4268 wrote to memory of 3048	4268	msedge.exe	89
PID 4268 wrote to memory of 2624	4268	msedge.exe	90
PID 4268 wrote to memory of 2624	4268	msedge.exe	90
PID 4268 wrote to memory of 2624	4268	msedge.exe	90
PID 4268 wrote to memory of 672	4268	msedge.exe	92
PID 4268 wrote to memory of 672	4268	msedge.exe	92
PID 4268 wrote to memory of 1232	4268	msedge.exe	94
PID 4268 wrote to memory of 1232	4268	msedge.exe	94
PID 4268 wrote to memory of 1364	4268	msedge.exe	95
PID 4268 wrote to memory of 1364	4268	msedge.exe	95
PID 4268 wrote to memory of 1364	4268	msedge.exe	95
PID 4268 wrote to memory of 2464	4268	msedge.exe	96
PID 4268 wrote to memory of 2164	4268	msedge.exe	97
PID 4268 wrote to memory of 2464	4268	msedge.exe	96
PID 4268 wrote to memory of 2164	4268	msedge.exe	97
PID 4268 wrote to memory of 5100	4268	msedge.exe	98
PID 4268 wrote to memory of 1196	4268	msedge.exe	100
PID 5100 wrote to memory of 3668	5100	msedge.exe	101
PID 4268 wrote to memory of 1052	4268	msedge.exe	102
PID 4268 wrote to memory of 1052	4268	msedge.exe	102
PID 4268 wrote to memory of 3916	4268	msedge.exe	103
PID 4268 wrote to memory of 3916	4268	msedge.exe	103
PID 4268 wrote to memory of 2620	4268	msedge.exe	104
PID 4268 wrote to memory of 2620	4268	msedge.exe	104
PID 4268 wrote to memory of 2192	4268	msedge.exe	105
PID 4268 wrote to memory of 2192	4268	msedge.exe	105
PID 4268 wrote to memory of 2676	4268	msedge.exe	106
PID 4268 wrote to memory of 2676	4268	msedge.exe	106
PID 4268 wrote to memory of 1620	4268	msedge.exe	107
PID 4268 wrote to memory of 1620	4268	msedge.exe	107
PID 4268 wrote to memory of 1620	4268	msedge.exe	107
PID 4268 wrote to memory of 1644	4268	msedge.exe	108
PID 4268 wrote to memory of 4392	4268	msedge.exe	109
PID 4268 wrote to memory of 1644	4268	msedge.exe	108
PID 4268 wrote to memory of 4392	4268	msedge.exe	109
PID 4268 wrote to memory of 4392	4268	msedge.exe	109
PID 4268 wrote to memory of 4688	4268	msedge.exe	110
PID 4268 wrote to memory of 5108	4268	msedge.exe	111
PID 4268 wrote to memory of 840	4268	msedge.exe	112
PID 4268 wrote to memory of 1060	4268	msedge.exe	113
PID 4268 wrote to memory of 4580	4268	msedge.exe	114
PID 4580 wrote to memory of 1488	4580	AitronLink_v1.0.21.exe	117
PID 1488 wrote to memory of 1848	1488	AiMouse.exe	119

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://GPT.AIULTRONX.COM
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2e8,0x7ff8512dc188,0x7ff8512dc194,0x7ff8512dc1a0
  2⤵
  PID:452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1812,i,12455521782339276527,7901173213636871987,524288 --field-trial-handle=2256,i,7951225944572317726,5754898132572895895,262144 --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:1696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1604,i,9270378332306767427,6655204024180840187,262144 --field-trial-handle=2256,i,7951225944572317726,5754898132572895895,262144 --variations-seed-version --mojo-platform-channel-handle=2252 /prefetch:2
  2⤵
  PID:2640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2128,i,12800110539153147723,9779564304181793469,524288 --field-trial-handle=2256,i,7951225944572317726,5754898132572895895,262144 --variations-seed-version --mojo-platform-channel-handle=2988 /prefetch:13
  2⤵
  PID:1704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3536,i,17704190172084078263,17459263750428262245,2097152 --field-trial-handle=2256,i,7951225944572317726,5754898132572895895,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:1
  2⤵
  PID:3528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3556,i,9767679813715286136,10715135595644993707,2097152 --field-trial-handle=2256,i,7951225944572317726,5754898132572895895,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:1
  2⤵
  PID:1268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4084,i,11631063837410885264,16831666819339714935,2097152 --field-trial-handle=2256,i,7951225944572317726,5754898132572895895,262144 --variations-seed-version --mojo-platform-channel-handle=4112 /prefetch:1
  2⤵
  PID:3312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4128,i,3369841845689302441,3112407303050781851,2097152 --field-trial-handle=2256,i,7951225944572317726,5754898132572895895,262144 --variations-seed-version --mojo-platform-channel-handle=4176 /prefetch:9
  2⤵
  PID:2420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4184,i,13911489675974884259,14158015434127325355,2097152 --field-trial-handle=2256,i,7951225944572317726,5754898132572895895,262144 --variations-seed-version --mojo-platform-channel-handle=4332 /prefetch:1
  2⤵
  PID:3048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4196,i,8369644548766437993,8713622583500708507,2097152 --field-trial-handle=2256,i,7951225944572317726,5754898132572895895,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:9
  2⤵
  PID:2624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3700,i,13564282218145098431,2055036116034527030,524288 --field-trial-handle=2256,i,7951225944572317726,5754898132572895895,262144 --variations-seed-version --mojo-platform-channel-handle=3712 /prefetch:14
  2⤵
  PID:672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3760,i,10362022448418232347,1896026820326942120,524288 --field-trial-handle=2256,i,7951225944572317726,5754898132572895895,262144 --variations-seed-version --mojo-platform-channel-handle=3704 /prefetch:14
  2⤵
  PID:1232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=5292,i,6886776806191702652,15644671980367571882,2097152 --field-trial-handle=2256,i,7951225944572317726,5754898132572895895,262144 --variations-seed-version --mojo-platform-channel-handle=5284 /prefetch:1
  2⤵
  PID:1364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3632,i,8304474243570704793,1744385972138340039,524288 --field-trial-handle=2256,i,7951225944572317726,5754898132572895895,262144 --variations-seed-version --mojo-platform-channel-handle=3788 /prefetch:14
  2⤵
  PID:2464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4328,i,13632670695338350284,668339358347346493,524288 --field-trial-handle=2256,i,7951225944572317726,5754898132572895895,262144 --variations-seed-version --mojo-platform-channel-handle=3664 /prefetch:14
  2⤵
  PID:2164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6076,i,789414569359363935,14675410714584438773,524288 --field-trial-handle=2256,i,7951225944572317726,5754898132572895895,262144 --variations-seed-version --mojo-platform-channel-handle=5876 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5100
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1136
    3⤵
    PID:3668
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6124,i,15453312983132687854,14980018798645873670,524288 --field-trial-handle=2256,i,7951225944572317726,5754898132572895895,262144 --variations-seed-version --mojo-platform-channel-handle=6180 /prefetch:14
  2⤵
  PID:1700
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6124,i,15453312983132687854,14980018798645873670,524288 --field-trial-handle=2256,i,7951225944572317726,5754898132572895895,262144 --variations-seed-version --mojo-platform-channel-handle=6180 /prefetch:14
  2⤵
  PID:1196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5876,i,4767067149876112334,9452883717441585067,524288 --field-trial-handle=2256,i,7951225944572317726,5754898132572895895,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:14
  2⤵
  PID:1052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6404,i,6468724018248700862,11077388822569014436,524288 --field-trial-handle=2256,i,7951225944572317726,5754898132572895895,262144 --variations-seed-version --mojo-platform-channel-handle=6440 /prefetch:14
  2⤵
  PID:3916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6716,i,12576858453618832685,5439802228486231094,524288 --field-trial-handle=2256,i,7951225944572317726,5754898132572895895,262144 --variations-seed-version --mojo-platform-channel-handle=6696 /prefetch:14
  2⤵
  PID:2620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6720,i,4429750521401849848,16036824868524125481,524288 --field-trial-handle=2256,i,7951225944572317726,5754898132572895895,262144 --variations-seed-version --mojo-platform-channel-handle=6724 /prefetch:14
  2⤵
  PID:2192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6456,i,1173548325882177393,10473310028565376279,524288 --field-trial-handle=2256,i,7951225944572317726,5754898132572895895,262144 --variations-seed-version --mojo-platform-channel-handle=6736 /prefetch:14
  2⤵
  PID:2676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=6756,i,11960623061328809883,11417070418488366429,2097152 --field-trial-handle=2256,i,7951225944572317726,5754898132572895895,262144 --variations-seed-version --mojo-platform-channel-handle=6768 /prefetch:1
  2⤵
  PID:1620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5428,i,607637151586713665,13526634848696696189,524288 --field-trial-handle=2256,i,7951225944572317726,5754898132572895895,262144 --variations-seed-version --mojo-platform-channel-handle=6964 /prefetch:14
  2⤵
  PID:1644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=3716,i,11558822019404660938,6428025776011601499,2097152 --field-trial-handle=2256,i,7951225944572317726,5754898132572895895,262144 --variations-seed-version --mojo-platform-channel-handle=7012 /prefetch:1
  2⤵
  PID:4392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5292,i,973149174435258287,6782213406851182771,524288 --field-trial-handle=2256,i,7951225944572317726,5754898132572895895,262144 --variations-seed-version --mojo-platform-channel-handle=4804 /prefetch:14
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:4688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7476,i,14728392780225421699,1501704302336764452,524288 --field-trial-handle=2256,i,7951225944572317726,5754898132572895895,262144 --variations-seed-version --mojo-platform-channel-handle=7628 /prefetch:14
  2⤵
  PID:5108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7272,i,6441784683002637015,7074507266310091464,524288 --field-trial-handle=2256,i,7951225944572317726,5754898132572895895,262144 --variations-seed-version --mojo-platform-channel-handle=7680 /prefetch:14
  2⤵
  PID:840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7296,i,2585951218431884953,9937307290700349673,524288 --field-trial-handle=2256,i,7951225944572317726,5754898132572895895,262144 --variations-seed-version --mojo-platform-channel-handle=7596 /prefetch:14
  2⤵
  PID:1060
- C:\Users\Admin\Downloads\AitronLink_v1.0.21.exe
  "C:\Users\Admin\Downloads\AitronLink_v1.0.21.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4580
- - C:\AitronLink\AiMouse.exe
    "C:\AitronLink\AiMouse.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:1488
  - - C:\AitronLink\AiMouse.exe
      "C:\AitronLink\AiMouse.exe" --type=gpu-process --field-trial-handle=1724,8002743499783381716,10299978854957059163,131072 --disable-features=CalculateNativeWinOcclusion --no-sandbox --log-file="C:\AitronLink\debug.log" --lang=zh-CN --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --log-file="C:\AitronLink\debug.log" --mojo-platform-channel-handle=1848 /prefetch:2
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:1848
  - - C:\AitronLink\AiMouse.exe
      "C:\AitronLink\AiMouse.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1724,8002743499783381716,10299978854957059163,131072 --disable-features=CalculateNativeWinOcclusion --lang=zh-CN --service-sandbox-type=none --no-sandbox --log-file="C:\AitronLink\debug.log" --lang=zh-CN --log-file="C:\AitronLink\debug.log" --mojo-platform-channel-handle=2260 /prefetch:8
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:1516
  - - C:\AitronLink\AiMouse.exe
      "C:\AitronLink\AiMouse.exe" --type=gpu-process --field-trial-handle=1724,8002743499783381716,10299978854957059163,131072 --disable-features=CalculateNativeWinOcclusion --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --no-sandbox --log-file="C:\AitronLink\debug.log" --lang=zh-CN --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --log-file="C:\AitronLink\debug.log" --mojo-platform-channel-handle=3028 /prefetch:2
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:4504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3708,i,13024706796091582056,15181084419623417346,524288 --field-trial-handle=2256,i,7951225944572317726,5754898132572895895,262144 --variations-seed-version --mojo-platform-channel-handle=5588 /prefetch:14
  2⤵
  PID:5052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=6876,i,8644595492029033846,16475997718543831249,2097152 --field-trial-handle=2256,i,7951225944572317726,5754898132572895895,262144 --variations-seed-version --mojo-platform-channel-handle=6900 /prefetch:1
  2⤵
  PID:4988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6480,i,6941382188135200788,12820387819216775915,524288 --field-trial-handle=2256,i,7951225944572317726,5754898132572895895,262144 --variations-seed-version --mojo-platform-channel-handle=7616 /prefetch:14
  2⤵
  PID:2036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7372,i,11542108957559540333,16031529047221824474,524288 --field-trial-handle=2256,i,7951225944572317726,5754898132572895895,262144 --variations-seed-version --mojo-platform-channel-handle=7012 /prefetch:14
  2⤵
  PID:2912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7412,i,4517978733958888144,11956751309256843173,524288 --field-trial-handle=2256,i,7951225944572317726,5754898132572895895,262144 --variations-seed-version --mojo-platform-channel-handle=2020 /prefetch:14
  2⤵
  PID:2584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7312,i,8156207983293869158,14315955824639438213,262144 --field-trial-handle=2256,i,7951225944572317726,5754898132572895895,262144 --variations-seed-version --mojo-platform-channel-handle=3688 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6224,i,4034590723513315045,1343935117693032884,524288 --field-trial-handle=2256,i,7951225944572317726,5754898132572895895,262144 --variations-seed-version --mojo-platform-channel-handle=7484 /prefetch:14
  2⤵
  PID:4996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7448,i,11907510643103868755,107210126315778754,524288 --field-trial-handle=2256,i,7951225944572317726,5754898132572895895,262144 --variations-seed-version --mojo-platform-channel-handle=4024 /prefetch:14
  2⤵
  PID:3452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7444,i,5666806133070405289,18355265244299356702,524288 --field-trial-handle=2256,i,7951225944572317726,5754898132572895895,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:14
  2⤵
  PID:4092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5364,i,240687409589524206,346119555496860036,524288 --field-trial-handle=2256,i,7951225944572317726,5754898132572895895,262144 --variations-seed-version --mojo-platform-channel-handle=6256 /prefetch:14
  2⤵
  PID:3436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3688,i,992315587728197257,6773507567970353339,524288 --field-trial-handle=2256,i,7951225944572317726,5754898132572895895,262144 --variations-seed-version --mojo-platform-channel-handle=2204 /prefetch:14
  2⤵
  PID:3804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6896,i,16917958439356208339,6426970529025644036,524288 --field-trial-handle=2256,i,7951225944572317726,5754898132572895895,262144 --variations-seed-version --mojo-platform-channel-handle=2012 /prefetch:14
  2⤵
  PID:868

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4024

C:\AitronLink\AiMouse.exe
"C:\AitronLink\AiMouse.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:1708

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AiMouse.exe

Path C:\AitronLink\AiMouse.exe
Size 17.7MB
SHA256 8d4d5c99977784445fef250f70d7a531511eb91d90471ad9497f260795902f80
MD5 631c5cb7facdd6638bd5f161238baae9
SHA1 0d8a25027e821c76fd79c1c4ef89a1a7ad82a9a1
SHA512 e5a6c36e0c2890ff4b7ea85a11c3ce2297ec7b16aa71ce100b997512b0e1f57bdd6e14b141e3f5f26d8d20f0b15da79ca4cfb7358fd21a03d569f91c4de56731
SSDEEP 393216:IG6LNOqjNkUjhZerSBjdsqeJEQWtHqNJ1KHM7TBmkDh5+jbS9ggYAn+jZ2CjsjGo:IG6LcqjNj1wwNiZAGm9hMe6SkR8dD4HH
TLSH
T18F17F120A702D62FF9A301B5986DA69E105CAB31171454CBF3CC1E9E5EF85E37E32A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DuiLib.dll

Path C:\AitronLink\DuiLib.dll
Size 1003KB
SHA256 3dc85eb574a655cb0c871c9215791e9a1a3f5a8abb81832c7a6bf34e4de956ca
MD5 c79b085e51773e2148a80c7835bafbc3
SHA1 1947ac0534eab0c9ff4982eada7ee9c557b5d765
SHA512 218537604cceed3b46fc537866b8ad6130ae5cfd4b8b13342b3fe25992e4d436f6a9b7fd3a0eab9eb8a5e34a1108f98ef03e5be2cf44842d40bb799e6340ace2
SSDEEP 12288:g74iLpYqaF9vWRPKGeHxNVHZTAhWusnruYLBTxsUNLif:g74Kp/O9v4wZHRYknyYLBTFNO
TLSH
T1D9259DC12DE280B1DA63C3724B3DAA3868FD75615534C35B73DC8E1A5CA6AE2C5067B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSVCR110.dll

Path C:\AitronLink\MSVCR110.dll
Size 854KB
SHA256 b30160e759115e24425b9bcdf606ef6ebce4657487525ede7f1ac40b90ff7e49
MD5 4ba25d2cbe1587a841dcfb8c8c4a6ea6
SHA1 52693d4b5e0b55a929099b680348c3932f2c3c62
SHA512 82e86ec67a5c6cddf2230872f66560f4b0c3e4c1bb672507bbb8446a8d6f62512cbd0475fe23b619db3a67bb870f4f742761cf1f87d50db7f14076f54006f6c6
SSDEEP 12288:TmCyHcMpK7QdgD+9Tr8r3FmJciMgLFWkA8qTWu+FVlofpJCjNdr12iqwZeq:TmCyHNIQdTryVmCipIkqTWu+Fr
TLSH
T19A15BE12B6D2C0B2C57200701628E772597FBA72547999BBAFD98E0E1DB06C0F71B772
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_100_percent.pak

Path C:\AitronLink\cef_4430\chrome_100_percent.pak
Size 762KB
SHA256 6505a53a81319d3cf52ddae57a5bf0ec83139b612e35148044e3f545355fd6e0
MD5 5b3d7aaeb81aa3502a57af94866f247d
SHA1 4421dc23ee7442f96caf69f2a4f6d21fc8438b6e
SHA512 593b31082fe4580b754e90b28c55b0e314adafb055c552dacb3f5e8bbfe2f386956b225110a10d44145348dd22f1201829c1ac456473a9b57faf0aca2b8c4f1e
SSDEEP 12288:HN8I3HWOnJGgsz5B0GDJQrnKs8SNP+QSsBilMxjPvQj+0tigONwW9aJyIACoORei:p3h0zEEmPLBnxj3G+0oRdIZoORes
TLSH
T1D3F412C7B770AC3EDF6353B7603650B5FC3305296F92418E128AE8756A62758A8DD383
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_200_percent.pak

Path C:\AitronLink\cef_4430\chrome_200_percent.pak
Size 1.3MB
SHA256 21e872ff8001e1d6f153b103de3b1038be773513312adbc51c37bf31d243fb8d
MD5 f8890823d5b487261efba17bd63ae903
SHA1 46933e5d6451229bda7d00306018cd79be4ff4a9
SHA512 c3e9d10d8d62a483becb1809ac9879e730b4622e778c78356a0ee0529355f74c645ad2b5d6d0f83b56b669827d1fc7e458377089c2a4ce03133160920a148b91
SSDEEP 24576:r3DjW3zkmmibkFR8+mZe/BK6eQQ4U3qCZ699wV/Qtoebafw6ebioL4:r3DS3YmNbkFRJmXQdUaC1/Q0wjba
TLSH
T15C5512C7D370CC7DCBA30737A07B11B1FC77142A1EA6818E06979C366951698AC9AA93
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_elf.dll

Path C:\AitronLink\cef_4430\chrome_elf.dll
Size 909KB
SHA256 94b0cf00e73a8f4aec0d00021e332b152e2015362db8c419e95ea8dc75f0aeff
MD5 6b914ff6abeaa3fe2230c326e2670059
SHA1 8684d51e90b366bb7e017007a93d40f670a88b83
SHA512 436c4c10c2224819c9641437c7b2fd3cec271e047bc553c0d4a995958b8c01e843bec186604298b9fad152d76ecfa67f8279e9c6b7a9c16c8b1315a498ab68f3
SSDEEP 24576:EMGJx3rvnWauymKtRlZt4+YTPe0udUahohHZscNkePClb:EMK3rvnWauymKtRlZt4+MPe0uuHkePCB
TLSH
T10815AE12B9909071D4033131912CE73DAB3DE6254F208EDBD3D49DE9AFB15D1A63A2AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icudtl.dat

Path C:\AitronLink\cef_4430\icudtl.dat
Size 9.9MB
SHA256 6e0b6b0d9e14c905f2278dbf25b7bb58cc0622b7680e3b6ff617a1d42348736b
MD5 80a7528515595d8b0bf99a477a7eff0d
SHA1 fde9a195fc5a6a23ec82b8594f958cfcf3159437
SHA512 c8df47a00f7b2472d272a26b3600b7e82be7ca22526d6453901ff06370b3abb66328655868db9d4e0a11dcba02e3788cc4883261fd9a7d3e521577dde1b88459
SSDEEP 196608:+UGwSv9AAQnt6liXUxR0rHa93WhlU6tcCLhl:+oKlQnAliXUxR0rHa93WhlU6t3Ln
TLSH
T1F7A63947A2FB4DC2F9FBAF30D8F452679467BD496E32805A11042F3B5C373A096617A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zh-CN.pak

Path C:\AitronLink\cef_4430\locales\zh-CN.pak
Size 259KB
SHA256 f0307e11c2573728d2db593df4ac050f4fe846175d4019ec6aa4cbe069c8f199
MD5 2ffbccab500c49a760a23814e5bd366a
SHA1 37d95652670f3411f7bd5910a4ff0540834abf6c
SHA512 1e5571a3b3730754324bd6cf9d31e57c87a4927954d6d2769140abc4a5139ac89e080a074f715fd6fdcee49dc4d854785663aa09dbcdbed1994e2724f1b38653
SSDEEP 6144:UQ6Heo7jd588SdxmvE8Uw5SN446+q5FRxIdTOlL:Ux+o7Mdx2E8UwYeWq5FRmZ8
TLSH
T14D447EE811E8BDEC004694D03725613D7940720BF257AFB6AED284DD1BA7FAE0757A0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

resources.pak

Path C:\AitronLink\cef_4430\resources.pak
Size 6.9MB
SHA256 e44c44fc11f9f86db93c0e446b42c89eefedfea41503869bca0aa3f28aa345a6
MD5 b6252587a16744802844fa4e1e5752a1
SHA1 e844484a418e2282dcb57be77d98aec2bdc862df
SHA512 03640e3dd811e67d9805df799c957a4e47912f9753579eee469ed77def701fd17e2b219e99b4b3dd3c7a3683563bbefd81ade578c712a3dd0fa6b8559eca73a5
SSDEEP 196608:KECH1/gLnBW3QD6zwvatOiXXepNygFhU8skrVRXSRlpKNgjEVa:KEg/kZD6zoiXXeT1gLkrVRcKNgjT
TLSH
T15C761202D9B03D3BC2CE213774AA7152B6A448C341683E7EB6DF418C8F9DD5511FAB9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v8_context_snapshot.bin

Path C:\AitronLink\cef_4430\v8_context_snapshot.bin
Size 161KB
SHA256 19c78d5167599de6b1f6a75d120ccbb24a3190e7246ee70f9bfb599de5a9bb93
MD5 25d6e4ebd31fd91650ddcfdd148c9f7e
SHA1 fcd44f81d9b7da2d6385f1f93b602dfb44355722
SHA512 547c10de6dcc80155daaf2be3ec6fe0c4d79481fd3a9d5b4a6f7325af3acc287779e0bfd2d241fd2babcf00611616bf73ee9278372065e0f3310ae16b6875bef
SSDEEP 3072:OaZxRiwPILugV4+ejF8XLDbny3zZ1VfcAoDo/ScM5MKJVrc5:BZ3ihLXV4+eRebyDa7o/3MacS5
TLSH
T118F312E8B957671E7E7BA4324FD2E8B35049E84F1007F6197144980FE09983BF68EA07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

custom.ini

Path C:\AitronLink\custom.ini
Size 3KB
SHA256 e0b1c1ac175d43c1510c6d4a00521add6beab4dc93b56d8d3c362f470c3b85ec
MD5 d8f94ac46fa611aeb3a0459bd1710792
SHA1 77f71eccacadf66db079ee749b67c9656a9c3e9a
SHA512 2322152e95a985349850f78fead08c59b0f6d47e727739eff85205b80e56e5ae5cc1fbd78af90e2cc945783efe375cae497dfdf9581c023e6c9ebd22273c8a77
TLSH
T12761261727E4552CFEF30B50E8B898726F26FDDA281EE01D65C5010C49F1A809E636F7
MD5 SHA1 SHA512 TLSH

Submit Download

custom.ini

Path C:\AitronLink\custom.ini
Size 3KB
SHA256 b86cbbd3350f985f092ceb272870d23e4d286ce811f7d14a3ae16bb990095e8a
MD5 24881ce3a3e06d194a2ffa871361b704
SHA1 52befa9b1fbe9d4e728bb3aaa4f155cefb60079b
SHA512 610921a6db8be61c43025b2dab73542536679e6284562048f590063460e354bf04b48a771754f092056a606444a801b99ffbbbf892394223398709c58a69d5ce
TLSH
T14A61261727E4552CFEF30B54E8B898726F26FDDA281EE01D65C5010C45F1A809E63AF7
MD5 SHA1 SHA512 TLSH

Submit Download

libcrypto-1_1.dll

Path C:\AitronLink\libcrypto-1_1.dll
Size 2.0MB
SHA256 0a000c302e77f5db2bc61291cd2e4c61fd2338b6f20d8de2cd0c1ae3a66b337e
MD5 244537a7fafeb634a9dba27cf60d51ff
SHA1 400928ccdde48905124eb8d390ec1ee104a58be7
SHA512 e832584d2d9c910173198074e1ecb5906abf3b50547a86a9afdf491ac146a98a01e952f60bff80c343a9501491aac0b196f83e0dac8a1898a19a526efddfc8f9
SSDEEP 49152:2v6fmDGkivQ/qpyr0ktxOTC7VJORc7i6TvGOtv71CPwDv3uFgsD/g8d:3fmakivQ/qpyr0kCTUVJV2DOtT1CPwDc
TLSH
T175A5BF02FF961651EADF463D62EA573F8E365608C338DAD38E622895DC325D1273E381
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcurl.dll

Path C:\AitronLink\libcurl.dll
Size 370KB
SHA256 86e544a3dd50f7d31a65485e97a3c9ac647a2fba664e31675007437b2e0941ca
MD5 67f5649f88276f069aa13826447f6010
SHA1 55c4189d9a9502bd8c406c3f7fca4d8388e6f7d3
SHA512 c18aab3f6673262f459eb1622226c7f1bcf2be877b6493f0d5f69b1899fc953f720b7f05741bb1ac3ebbbe895e1cafb941934bb92d2e7753b7cfff7b20081197
SSDEEP 6144:Z1HjU4BWAyxIsNDcKRZtQucOold2ahrkGKX9rNJtC6vJBerXcoDQDIQqx8XrCl+Q:Z1Hj58AyxIstcKRZtQucO2d2ahrkGKXx
TLSH
T175846B81FF8241F1F6C603BCB2A62B7B0D3556896710E5E3DB905864D9213E2A73E78D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-1_1.dll

Path C:\AitronLink\libssl-1_1.dll
Size 367KB
SHA256 1b95ec157b6f3f935775980a435247249d2e9ffa1ab858f24d914497327a225f
MD5 67890fb18d9d5d0a98b0adba2c5df00f
SHA1 5cccafa5a5405a001c364a939d4c079d61aa1e32
SHA512 8796fd830a1e9f7ae29c8ef5ddf4b0fed2f2f5656d7cbddc74f4fa3c1b61ed326650b2bfc504ab542edce9169c1b0ec9c2608999cfb82f96b6adf14cb36e34b4
SSDEEP 6144:tHteOWxDHxp88nmqjcRr7VBqmsJMh2v1CAVBuWsy4bK+5jiVXP6T65il+YcAd4SE:h0lHxi8nmgcRr7VBqmsJMh2v1CAVAWss
TLSH
T134846B41FB8359F6D48686BD71AF17BA2A7DA7002328E8D39F611D208D363D166393CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msc.dll

Path C:\AitronLink\msc.dll
Size 6.2MB
SHA256 edf2ae2c34f8bdddac8b01c3bf97cab4df0d56addc6e786d25a8a2180847bf10
MD5 5640717ca69a29c9547eb8925bd1b13f
SHA1 740a1a52b849ff7d2524c0600580bc01961e0553
SHA512 59f6e5e4b989c9421ab0f6089fb06d874392856b24a5c2f148556fb1349bb8b45e275385d4b1dbe8fe92b577e7ddc33547afa44faae15c4f13b50fb4dac494fa
SSDEEP 98304:uSLEnEYMlK+EG9JgCmMsgzYiM3gIuOoDM06f062o502qPcW:uKEnEHfgCBNYIioOH2WRuP
TLSH
T13956BE42B5784CB2F5EA1375E16A17AB892CDF3293B052C35FD03496192CAF3A63C647
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcr100.dll

Path C:\AitronLink\msvcr100.dll
Size 755KB
SHA256 60c06e0fa4449314da3a0a87c1a9d9577df99226f943637e06f61188e5862efa
MD5 bf38660a9125935658cfa3e53fdc7d65
SHA1 0b51fb415ec89848f339f8989d323bea722bfd70
SHA512 25f521ffe25a950d0f1a4de63b04cb62e2a3b0e72e7405799586913208bf8f8fa52aa34e96a9cc6ee47afcd41870f3aa0cd8289c53461d1b6e792d19b750c9a1
SSDEEP 12288:yMmCy3nAgPAxN9ueqix/HEmxsvGrif8ZSy+rdQw2QRAtd74/vmYK6H3BV0eAI:dmCy3KxW3ixPEmxsvGrm8Z6r+JQPzV4I
TLSH
T1B2F49D11B692C073C1B221300629D7B25D7BB8711035946BBBD59F3E1FB47C2EA277AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcr120.dll

Path C:\AitronLink\msvcr120.dll
Size 948KB
SHA256 86e39b5995af0e042fcdaa85fe2aefd7c9ddc7ad65e6327bd5e7058bc3ab615f
MD5 034ccadc1c073e4216e9466b720f9849
SHA1 f19e9d8317161edc7d3e963cc0fc46bd5e4a55a1
SHA512 5f11ef92d936669ee834a5cef5c7d0e7703bf05d03dc4f09b9dcfe048d7d5adfaab6a9c7f42e8080a5e9aad44a35f39f3940d5cca20623d9cafe373c635570f7
SSDEEP 12288:LBmFyjLAOQaYkxGXPfY7eiWWcpOKnpTVOIxhK765qlRRb6x4pI23IbJQV:dmFyjLF847eiWWcoGZVOIxh/WxIAIbGV
TLSH
T10F25BE12B982C0B2C57202B1152DE772197FBA71443598B7BBD98F0E1DB46C0FB67A63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uninst.exe

Path C:\AitronLink\uninst.exe
Size 53KB
SHA256 9dc0ecb408a22362836e3f299fe2dca4d7d91a368fda1c7e41c9982c085a8e9a
MD5 dd7c6a215d8705947e4db8b3670378ea
SHA1 6c0550b77455eb30d368312dca918a570c3e8fb2
SHA512 2c8a951e0ef2641f5cab0495835d016e92410f6d983e6fb3b0b8fe1d5b0cc6c767e1fcfc5077109f1d80b0ebc08d520068d2b1feefff07f2820a99e2b0a0cc8a
SSDEEP 1536:6ty/C+MS3YtrIutTbFwl1EmwrmuHdyznH:fDgrTbFaT0daH
TLSH
T148438D57EFC485F2FE9305B006767B1BE7B1F60940249B4FD798EE0FA822281AD5D281
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 538c1a0bded49157881b1c0e111a58732912def07977f599efb60ebb986ecbbb
MD5 2e5f50c6e7cd1b1d6049d9d3e57a9866
SHA1 28319f3d040fd1e80776d82fef3baa00dc34dec2
SHA512 1a56a7d8e7dc2aa514d9d57d40d74133033bdabf84bd35a3b65f0b62eeda07a00060dd4058de9c4703a2c70d201c867647a11b5cbacf4bb2c1ee4acd92d13058
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7u:fwUQC5VwBIiElEd2K57P7u
TLSH
T1F7B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

protocols.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.10\protocols.json
Size 3KB
SHA256 4fd800e7b1a5fb24b13fac2e31946d205012b7c28d8c61580b0669b2fa3517cc
MD5 1de85fec2dfcc28011a7c2aaab95eb5f
SHA1 80e8c954bfbe8f7ee5a2335c8d969ae033935dc3
SHA512 9c7dd37eb0c094b6aa05201e7c71a8f33b9db81284223bcfa595a44a6ac95d5a6820ab6f07b7aa8d26bf207454e94277bf35332e9c009ee63f083752b6b51750
TLSH
T1D1611DB79A3048090E3412B86B19B35DF63E029F1AD598EB76BE568F1F710F7245C54C
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 92b3fe3c1f53c120f20ea643b0dc7ed8623f9d208eb1c4d7232edcc97f0b69b6
MD5 7c01ab9b4147641f5e78fe413048da53
SHA1 8e1e36c184f8a953d84d6bcf9a23a2aeccf11785
SHA512 f42cfb7a46a1c4450f02942035de8f5b217382c91026f29ea332e7a448ba0045eb1f7a5acb7c8eddde74daa258d80f1a8ba7fcf32be1c93b64cbb997ca2c55ef
TLSH
T1E7D0805C33715C74C8968E71140DBF063699C4B2545553333C332C691C471411ED5297
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 bf89531d0e3eaeb6193d0eb94b0bec959bbc3dbf51f4b1135a0c78cf16adaa46
MD5 38938711ef0446937338851ec79a0894
SHA1 179778fce333dbfd0c0e890d77eef83f40e68189
SHA512 f43a9b63b4232462afb2de768f45ce89cf129900c80bd1d32946f956e184aba1b903c62f63f5ff2ed8fb9fb615cb1ac6ddffb909f174000b4a41a45f7daef6fc
TLSH
T104D0805C33B15C74CC968E71140DBF063699C4B2545553333C332C691C471811ED5297
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 7KB
SHA256 1299102294ae8f4edcfb5e1fd838fc0bb39b439b8b5f41b2948ab64826da1269
MD5 407842bdc4535394052d47227a744a13
SHA1 ba11dbd264f4e795e43ebab63ee8dcfa60aed862
SHA512 1046250c7d2e21e1a405b06a8eb910c78bd73c43ac4c624c2568067b4eb1b23f1d8008bbc0a9447595f1c542b414cb9f386ff1040b4866c9b591eb93e330f156
SSDEEP 192:qjVz0z0NWWQhaaTqxxxUUjjmo8oYTJ1WKRf4AyLO:qjVz0z0NWWQhaaTqxxxUUjjmo8oYTJ15
TLSH
T1A8E1565783D5C3DA8F4A109E4EA4635C51B13B0EFBECD90817CC8ADD304E8DAB6E1A94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 04cd4243bc688bcf8772dbbc821902f6799361e187c36d212f59df285b4a92b6
MD5 e74d18b58362c4f79e18c4f564041d33
SHA1 54f35f1aa49de86d47955b0b205610dd6a30df1b
SHA512 40dc4441041bf46dbee187140d9bd7d27c24a8f913478a4ed687dc297975cdfe83de908b7be955b85d11235203dac157aea43b2a1e70482139d553d0b6deb1ed
TLSH
T19F715E5E807594D9EFE472BC26E8A015F2305A18C54F1F1A93C5B27FCE2EB6A405B0F8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 bb6eb24a228db95360700e05231bd44353d841611cb375304f3eaf9dd97946a4
MD5 16e6a966e4bab46879978016ee99dbaf
SHA1 4744bd762693ac29a8cac5c07e979f0b51e17ef6
SHA512 577336c78ba0e93dac59b3956f1f1fc29d364db45926ce52ff37747419850bf22972d8409030c49239e384e8e1d89b29925b3ae05946d1e7e90a920e9ba00c59
TLSH
T19C71705E807594D9EFE472BC26E86015F2308A18C04F1F1A93C5B27FCE2EB6A505B1F8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe587dc6.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe587dc6.TMP
Size 3KB
SHA256 df7aa7dc09f18ec3a65c7a9cb1f395782ee356e66a63a13f6416f8dec8bb602f
MD5 eb5cdce02853054bac95346529db3606
SHA1 a8ff8002929c36ce9adb41404224d13cc39a035f
SHA512 8ef629b18e45288e0098f623c417d2095bbf2dcf02c3318bab47bd40cc5686d453ad642b8cbdedbd2fd46e31f27b7cf5f3c876a4ee2f5d60db9239c9f54cb534
TLSH
T1A3615F5E807554D9EFE472BC66E95015F2308A18C45F1F1693C5B27FCE2EB6A405B0F8
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 449281bdb0ceb4e5d89c6f341266e032dca87fa5b0fbec574b3544e795f49a96
MD5 12c526eeca46a9961b9427a3267d7fec
SHA1 531bd5c077f39e0ee689f733c6db94543b4cdc61
SHA512 5a70cc40ed0426b3e0b0d17f8d8c4aed503a917a8089739723b1325672156f2e162a08d62e410b72c230060d2429f6e300069475bc4cb004e884eb92b399a78e
TLSH
T14241ACF7C3E4866E8A0196F0AA187F1BCE2D0914432C7D5AC9E4AF5B93E3871E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 b542ea60c1a51858e9eee30f4399872a2f692b4a0fa2d7f314057f8467039c6e
MD5 104c129767a840c973302cf24c32a82c
SHA1 ec0c108a5c36ea32052fc0459cec189ecec41e9b
SHA512 ff63ed1f1ac90bd55fab0172afed019101700afc87c619f0621d41f4bb17c0b932ab31b0d230b9b4ab278892f44d8c463491605790accad192f49cdfb359b375
TLSH
T173518CF7C3E4866E891156F0AA187F1BCE1D0914432C3D5AC9E4EF5B93E3471E141A5E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 feec413f49a1b95f762bc58d3d122f9316ea0ff5501552dbf32f8e5cb63dbb59
MD5 49fd91e2109bf48cdd5dc028b41dc0d0
SHA1 36092fc32ca3685ea92f887d5c1ccfc6277c8aa7
SHA512 41410379e7cec22015e9cc1928ac424e1a28e50d165575b898f901b1732423789de1023b1e7982c03c8f4f3212dba3927fdc8b95ba0f8676ffc1047939716dc1
SSDEEP 192:sxZTRPyM//K1Ml8MF1/fxsIdBuIdpPi/W6+WN4LA/Y0xknvQ+bIg4J:sxZTJd1/fxsIdhq/bD/5Dgc
TLSH
T1C552F7166A3499778DDBD309FA45BF53D6F9056292900E44AEFCCA1C00E6BED2213C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 fd4053a5af320b41d0c4f599b4f6dc4f39c5ca6bbcca09fccd400401404f3f96
MD5 0bb09b178b9ce9863d59b617011763cd
SHA1 fd04d3be074b877576b37a4b0408391e457fb5fa
SHA512 250064f3296ab075aebb7a395fbf984819df72dc489b72a90320885ac532583c9e5deb8ef6bbbfc7b2d91d704849f9d491d32896a265020f119dd6a633b27d49
SSDEEP 192:sxZTRPyM//K1Ml8MH1/fxs8vBvIdptR/W6+WN44RfY0xkqBf+bIg5zJ:sxZTJ/1/fxs8veb/bdf51gz
TLSH
T12262D616AA345A778DDBD209FA45BF53E6F5046292501E44AEFCCB1C01E6BED2213C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 508265525cc7ca0d99c743b9a2d92ee580ff18887666156c21fe1906f4074d3c
MD5 aef148b55baf830d7fd24463cbf8802f
SHA1 f492a7deaa7092672dc221a49e14a677231189b4
SHA512 5b4772e771dcdd2c80c17d475fa1b2844bf636db9510a2656c790568b7aa5c8b38a7630f6c8779d621dab263fa0f96f5f45ef3368c40da8f5929455880605380
SSDEEP 192:sxZTRPyM//K1Ml8UQtH1/fxs8vBvIdptR/W6+WN44RfY0xkqBf+bIg5zJ:sxZTJqx1/fxs8veb/bdf51gz
TLSH
T1F662C616AA345A778DDBD209FA45BB53E6F5046292501E44AAFCCB1C01E6BED2213C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 d54ecd3539af4a0d66655199c579cec3f8b4c4831365b412ba17008035299664
MD5 077055e91e749a5d701c9ee036f408ca
SHA1 425471cac7d5ecf5fd09957348c1018816dd6cce
SHA512 b800fe10385bc070679c8b0c291c38822ba9e4bfafcf8dc99d0d6be3c8a4521f1443458869f3ed9d96d9f3f5f576ce8fd0b63461c4a10d69f38f2438dde2abf7
SSDEEP 192:sxZTRPyM//K1Ml8Mo1/fxs8dBuIdpPi/W6+WN4LA/Y0xknLQ+bIg5FJ:sxZTJQ1/fxs8dhq/bD/51gh
TLSH
T18F52D716AA345A778DDBD309FA45BB53D6F5046292900E449EFC8B1C05E6BED2213C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 8a95e2602f3c5a7031e625aabd8a7fe0110b6698b1176b3dae6b449737b158d3
MD5 804922e41c5f94158b4b932e6c9998e6
SHA1 0c6bf4a212037f5eab56767ff4d69075cca5025b
SHA512 48af13cef98365c7a1fa6bc0129fcd2c4e4e87c42bca7bc8c93f1207d4df25b04d5c22b956727474723856cd6cd097e39dc1a209a6b14a1e70778cae5d19ed77
SSDEEP 768:ouK2G8g+2Ty7pLuLndJWRmdnQaP8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3/ac8Lli:ouK2G8g+2TKEndJWRmdnQaPu1jaK/acB
TLSH
T1EE031D3F280CCB7E4F844E9CEC267E9A6DE8018B9698C95447F9844C03C66EF56175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 ec99f3c1413350bdfc62fcb36ebbb2746e3f39daa07666061b58b063bf6c0b51
MD5 87d7a712bf237051af91bdc3842fa690
SHA1 7510102e524a8e1f3681b266f24f9092aa1bc59e
SHA512 8e662b98c88d1f5447de9180f7f13d3e3bb87964e7c5c6c585cab2a2fa3435749615de295f1bcd1bb1354a2387ec58e14a6bf65ba4459b44a7da42fb41e2a520
SSDEEP 96:KAhyKisSiOQK/Kq3c1IsaO6o2Wz7skoK0tsSogEEDSiD6FxDV1xcRMsiJxKK4ijv:olfPF7D6FxDV1ORMFJv4ij07zEJ1SrO
TLSH
T1E2E11752F03A03812A7D299A91E1B47E42C230A33464A93F77BE01660F67E24DEFD5DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe590296.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe590296.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

office_endpoints_list.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Data Protection Lists\2.0.0.0\office_endpoints_list.json
Size 3KB
SHA256 8480f3d58faa017896ba8239f3395e3551325d7a6466497a9a69bf182647b25e
MD5 94406cdd51b55c0f006cfea05745effb
SHA1 a15dc50ca0fd54d6f54fbc6e0788f6dcfc876cc9
SHA512 d4e621f57454fea7049cffc9cc3adfb0d8016360912e6a580f6fe16677e7dd7aa2ee0671cb3c5092a9435708a817f497c3b2cc7aba237d32dbdaae82f10591c3
TLSH
T1F681BE27C5B58E2796F060119750E654F53D43AFA600C6AFB5FC825C2F373ECE88A4A8
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 29KB
SHA256 23b3caea1f5f879c3da1dc8b6b1010731fb8dd0c3b51d1513b14d1cb2788b254
MD5 f10a0e173c02cd50dfa3be00b5392f6e
SHA1 b43c3ed629d0fd9c9a4f1b0e90aed50a639ec2b6
SHA512 739927c6990c02d4a905cf24b573856a447ca169c20503171d1064c7eb65d1c008a8614c0f29f572e9d92e111587875b7721a1567d3436bbdcd129437209e2ab
SSDEEP 384:nJiFijccCs+Bt0S3a8NW8TUNTUlIlf6+weYo1Vxfp4vAw4I8+Hl3XTyMkKlns1Zz:gFMccQ6Fwgp5v4P40lHTyMBlnmL
TLSH
T133D294F698E79976E9AE4B87A33D6E125EBCC05375845594FB880E0CCC872BFC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 d1eec0d8f389fe9eeb1b4987a4987fa836da2cf9e7b007b48640820f9b9a7672
MD5 2e8f00b769fa0d6203f9f97a641b16fa
SHA1 752160dc6943ad033bab538a812ee79011873f38
SHA512 77945a6387bed1a30e8b254a8afa0a14574d10cd0b4abc07327a67d7c4770688d6ae8b0f5f171b0ca2cd9928cbc40bc5fc9f07361b7992968df165d106d8e025
SSDEEP 384:nmjccCs+Bt0S3H8NsUM6+weV71QvAw4I8+Hl3XTyMkKlns1Zf3L:gccQnZDuP40lHTyMBlnmL
TLSH
T160825C3269746CAB9AF39A49F4467B236FF4406BA6842F58DDEC4B1C01CF39C1306926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 5f1da893e5c06f61ecf5318ad9ec5ebd60ffb2115d4d5a611a4167b1eee4a82f
MD5 dca15cced60d28a9f07fc3462a4668b7
SHA1 28dde391556effeb02b4f24115b8d272b8f30ca2
SHA512 becb633956f24ef7cd1e95cc73dd149636d4e23492ba31ede1e91cc137d296ae93535ad0f4cdfef56081c6fff1a4b666312407f79c886e634e2cf506b1d33f8d
SSDEEP 384:nJiFejccCs+Bt0S3p8Nt8TUNTUlIlf6+weP71VDfY4vAw4I8+Hl3XTmMkKlns1Zz:gFIccQJMwgppU4P40lHTmMBlnmL
TLSH
T1BEB22936E8B4DD6BAEF39BC5F6067657AFF0016796885AD4DDD84E0C008B2DD030AC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 83609400a7970aa469c4e5621af6e24704c2745366ef968cf238dac44a7e2ad3
MD5 d4aa5a9cea3d8fdcd526242b75a09483
SHA1 779c09e2a08c024ba424fa3610da0bbe44c68d32
SHA512 19a7c718f229c518d6e6710263c7155f94c519573348428d0fd5fc492076178679e03e6190653c721ed327ee286e57244bace7e8003b3dd4c95afe1d89a82226
SSDEEP 384:nojccCs+Bt0S358NsUf6+web71QvAw4I8+Hl3XTgMkKlns1Zf3L:WccQZkhuP40lHTgMBlnmL
TLSH
T147825C3669746CAB9AF3AA49F44677237FF4406BA6842F58DDEC4B1C01CF39C1306926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 0861a35c8b0c62a61edaf629ec8c59bf14a690c5da0d476d8e9e75913d1f6a1f
MD5 fb7b4c1ca71b62da4103ab10cf9558e3
SHA1 6796e4c0a1e086ad53d8d089968d122fc0af9f2f
SHA512 d4f1958f29c1ff65cab8a6b7dc94b3ca4d7a89b007ab8d6d34745a6a223c3aaf53be5d0e01137f1e45218aaf53e58987b1a2c0bb2107015d37e65632101e4741
SSDEEP 384:n0jccCs+Bt0S358NsUf6+web71QvAw4I8+Hl3XTgMkKlns1Zf3L:CccQZkhuP40lHTgMBlnmL
TLSH
T1D6825C3669746CAB9AF3AA49F44677237FF4406BA6842F54D9EC4F1C01CF39C1306926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 270bc75e66bd1287df335d289328cc25afbc0748581d310ff9e8a97f9c492acf
MD5 c72420383a5b442df01a610e0340a47c
SHA1 edd230681c922f2f9eec7958bb1cd60b2db2ca21
SHA512 c87941347858ead7d9960556361a25d80e4af17738298c73e7c409fc8452f982cfeca48901aff9ff5a6f89776b240ea34ccb2166b9c653c81f746b6398ae2ba9
SSDEEP 192:VGN76EajeQmiUyJw/NnRvAw4Ajzorq9Mq6M+DgU6:VGN76ENmwlnRvAw4I8+EMLU6
TLSH
T12102EA35B9787CAB9EF3AE45B08737176FE4112BE5942B44DAE81B1C00DB35C1306926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 71e2d05a20b7243213ab8806b2d988737a77df60d8947e0134d99b79d1b94a8a
MD5 9fd30ae2d7fbeee932a6115ae3a69752
SHA1 139b80aa49f36824818ae4a55df35a297f2e5f38
SHA512 7d7b14e2557b8a22160d725a340552899f98c4e632e90e9e612af96deb470659735e2d9db7754a1f5c3add2b6035c3ee225f3e08712193322680b327189eb6af
SSDEEP 384:nRjccCs+Bt0S3H8NsUg6+weO71QvAw4I8+Hl3XTw7MkKlns1Zf3L:hccQn9kuP40lHTw7MBlnmL
TLSH
T1BB825C3269746CAB9AF39A49F4467B137FF4406BA6842B54DDEC4B1C01DF39C1306926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 55b8027bf7456df37797714580773f35aff448184ce564db23254e043a7b451f
MD5 d2cb24901cc9fe067f29cb86333d4523
SHA1 90c77c88e996ab32ddb24e2a598c25f49c8088a8
SHA512 2ce9b5a3df19143dcaffa4444f99ee50ed0f2d18c6ee561f21c8183beae90c000e2b698a5b454c38275db501877073b29883479a86c13c1aa2ac57a4ef2a6c7c
SSDEEP 192:nGNG6Eaj2QmiUyVNHRvAw4Ajzorq9Hl3XQERkupM1qlKU6:nGNG6EBKHRvAw4I8+Hl3XTBMkKU6
TLSH
T14F12FB32B9787CAB5FF2AE46B04637176FF5112BE5842B54DEE81B1C00DB35C134A926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nav_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\WorkspacesNavigationComponent\1.0.0.5\nav_config.json
Size 2KB
SHA256 98252dc9f9e81167e893f2c32f08ee60e9a6c43fadb454400ed3bff3a68fbf0d
MD5 499d9e568b96e759959dc69635470211
SHA1 2462a315342e0c09fd6c5fbd7f1e7ff6914c17e6
SHA512 3a5922697b5356fd29ccf8dcc2e5e0e8c1fd955046a5bacf11b8ac5b7c147625d31ade6ff17be86e79c2c613104b2d2aebb11557399084d422e304f287d8b905
TLSH
T16B51DB73D5988C4B9BF4A29CE919A309F11107CF75D48C0B76BE010C1F7757AB5C6588
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 612B
SHA256 ce7879978d6dc1ebc353b93e509ab0dcd980bc78615af00080f3db1cb23e79d4
MD5 a15cd0a1e68c6b9c3945d3192091dc4a
SHA1 5162188f19a245162594501e5febb31a7626aeb4
SHA512 a7ec103cf7c6fa801e1850205c4c06cadf96c21b1fd56db058a2980c472b1ff2f25c69a73f943de8dff815d69217995ad880e85ca7b8ced8cfa1c506315f7368
TLSH
T18DF0ACD29D7E35C2D5AA0F2ED44B25EC54D89606F49CB57A484CEAD4913940F248287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 30e8b5d48a130d6bf81847b89c208c7a087525e9b7d9a0a97bcf21598332b63b
MD5 bf165c172af1f75083dd4c7e8915ad0e
SHA1 2eb27e18672fd0a1816ab00d00078a570eb62711
SHA512 a58ad7ee2e18750242b9c5d53224218bef54ecd50e067170da12510559c455979fb0523044d4c23d5d5a523562165e471f95d939376df623bfdea9228ca25256
TLSH
T181F09ED29D7E36C0D6E50F6ED44B64FC40D89506F05CB579484CEAD8913950B254287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 732B
SHA256 0c1b4dc8f72139abc5b2e25e5d0097c1d3529ae18001b1a64ff535e345378b32
MD5 0ad641099b286eebf58a290b5bde86c0
SHA1 922d3e17ccc238f1bf276051af3ad5cdffb20397
SHA512 8661612608382058967a1f2ef25c7fbee41a3c2c748838346c044a48058ba081e84750e4a0de424903813499876fa7f69beba345d8ebc396340d830f1a7c81e0
TLSH
T1220110D29D7E26C2C1AA0F6ED08B26EC40C8D106F19CB07A0C8CF9D4823880E188283F
MD5 SHA1 SHA512 TLSH

Submit Download

5bb61865-936c-4731-b409-abac24bdd4c0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\5bb61865-936c-4731-b409-abac24bdd4c0.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

b675842b-4e4f-4ac9-8e09-44c43bc7d80c.tmp

Path C:\Users\Admin\AppData\Local\Temp\b675842b-4e4f-4ac9-8e09-44c43bc7d80c.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

c3d2cb31-351f-419e-bf1c-5eeef03a932d.tmp

Path C:\Users\Admin\AppData\Local\Temp\c3d2cb31-351f-419e-bf1c-5eeef03a932d.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InstallOptions.dll

Path C:\Users\Admin\AppData\Local\Temp\nsq9EBD.tmp\InstallOptions.dll
Size 15KB
SHA256 359f31fb5142dd294ab92454a23b9a4e36b0d1fd890947f72c1fd1bcdc59a6c2
MD5 aa96e7b116036b44620a5efb4f77936b
SHA1 06aefcad46c0d70526c90874d72eaa73c747d536
SHA512 263497a5e4af84a65f6b1b50b702156985a537993646b80151467110801227690894e0fc9f9fdd9fc0f1d2c554ec896f522644ce726c789cd7c7aae9034b1052
SSDEEP 384:J3zD9kETtmK0cNaajReCCiXqo54XBNALmCVul:J1kCtmK0cAaNeCCiX+XHNQ
TLSH
T1066229567AC631F2DF97727836A77B325FB27001E4D6880B87B37E8758226016E39361
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsq9EBD.tmp\System.dll
Size 11KB
SHA256 5b7f308ac3a621457ac948cc2f29ede99789c249856bcac33fc6a8db54600e69
MD5 b86b5e4be239777a76bcb98f92e2aa80
SHA1 4f67624f2562fd7dda40325bc4026b1125c2df4d
SHA512 82b4f0cf6795b1864660318fa0750fb9790371385fd9abe8b761edcf44d5135ff71a50444d052ca60fd2e70bfe26849100be5ca02070bf95ebf6bbd669cb7aa9
SSDEEP 192:YuHDngvKux4W9OI/cFaqr2UHRJ8mqs0e0X6iM:N4J9WF32UrP+vX6i
TLSH
T153326D426BA259F1F615023A08B57F165738DC5002E4DFABCFD39549EAA029324397D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nsq9EBD.tmp\ioSpecial.ini
Size 1KB
SHA256 9c36c4cae68e23c930c4b28439292a67a473ff709565a9865c5ff8d73f07637a
MD5 eb929f5ba0e7a3ea3af3753cff4d5cf1
SHA1 4c9f401308322f1213484103f0b1727a9843f156
SHA512 fe2478569cb50d71ec369056f6dddacaaa960c0ac570082955554c9ee31b7d48c57c95e5dae1cbe787f49bac54461c154a32d5b44ec8eee3ab50de938faa7fc3
TLSH
T1183191077AFD1604F2BABB14FFB541799B3A7855A838D64D41C00A0E09F6E408923BAB
MD5 SHA1 SHA512 TLSH

Submit Download

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nsq9EBD.tmp\ioSpecial.ini
Size 1KB
SHA256 078b642e752da457e50e4e70130f277a7c8afd403b8927faa7e342eed152e4ab
MD5 9e6e07c6a22426d9dca75df83799655a
SHA1 742ab65702bd1cf98e7472ecf7d8b877cff63fd0
SHA512 645977734d9ca6de59ee5a58a08bd0e5ec2cee51a38a39840ba4a0b3d8f2ec2f508051137a46a30814a04506f0003819135e763f9b396ce631734e1fafd07ebd
TLSH
T1D721AF073EF94514E2EAFB08FBF5843697397855982CD54E90C10B0E45E6A818827BEF
MD5 SHA1 SHA512 TLSH

Submit Download

nsProcessW.dll

Path C:\Users\Admin\AppData\Local\Temp\nsq9EBD.tmp\nsProcessW.dll
Size 4KB
SHA256 30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11
MD5 f0438a894f3a7e01a4aae8d1b5dd0289
SHA1 b058e3fcfb7b550041da16bf10d8837024c38bf6
SHA512 f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7
SSDEEP 48:Sz4joMeH+Iwdf8Rom/L+rOnnk5/OCnXeAdbdOAa4GPI+CJ87eILzlq7gthwIsEQW:64c/eFdfS/SSnkxNa4G+ueqPuCtGsj
TLSH
T11191D87597D804B1C197093276620A672FBD843603A7651FE7836E962ED0EFBE874321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4268_79981078\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7f4f3300-a8b8-4930-909f-8b91c94abdb6.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4268_845413331\7f4f3300-a8b8-4930-909f-8b91c94abdb6.tmp
Size 147KB
SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
MD5 9c670f04d98ab7404f16423f6ee6cdfa
SHA1 8d01079b2d065731df8a7ef52f447cd4b7add353
SHA512 102cee76d9dfcfe91e044f529672fbec042b50c5db55a3cc137197b2013dd7f81e47f50dbb0db96cb621c5732610e1eb553c4146837c11075c7c4dbd67546a3b
SSDEEP 3072:F7R0M+jCozOtDTsjMcT0JnFjkbxnEbm/+OdGmlVVklFHEpCm+:F7WxxzyDTM0JnRkb5bJdGmJkvkpx+
TLSH
T12DE3E16D3DE6DE1FC41B58F53E64708BC80E8F0B820A644FB64988345A60B5D1BD6AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AitronLink_v1.0.21.exe:Zone.Identifier

Path C:\Users\Admin\Downloads\AitronLink_v1.0.21.exe:Zone.Identifier
Size 174B
SHA256 89a803ce757d330e771d06b6a9ad1016f9fc47a713fb4db8875019cdbee45e12
MD5 aee1f5f3a78f3f395f425319df294a60
SHA1 6c6a564eb0619c71ca665936057eb22fa4ea62eb
SHA512 48943bc88d27904376b8abf00d0459d0460a6d2de34f010042c85d474131c76433469c8c62b42113b36da30575d23139af581da6c76fc62727e3c0e935183524
TLSH
T159C08CC3E50881341E0526D236DE6A0DB44BBA688CA456C0E8828087AAC14A3E0BA952
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4268_1263636334\manifest.json
Size 160B
SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
MD5 c3911ceb35539db42e5654bdd60ac956
SHA1 71be0751e5fc583b119730dbceb2c723f2389f6c
SHA512 d8b2c7c5b7105a6f0c4bc9c79c05b1202bc8deb90e60a037fec59429c04fc688a745ee1a0d06a8311466b4d14e2921dfb4476104432178c01df1e99deb48b331
TLSH
T1F1C08C73CC08AE7911B14B371B214642E3B8030B600039093A32084C0BA47B00262328
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4268_1266019989\manifest.json
Size 135B
SHA256 ba5c9096d20a482aaa1aa9e5f98ad6127d3e97c2f21de84f7c78d9b8073c8e26
MD5 fbebd68ecaa98928909421f66909c054
SHA1 99d787d90f7ed2e5ad924f9c5668eb988b5a6c07
SHA512 749a3b2be47fe28399dc763888654a3e8d397e06e8d3c3af3965bb45846a1336e6ab4ca82c82c3df846b34a2afafa2156f2690e9bf347ab175408dc0171c61cc
TLSH
T158C04C668D51DEAB00A747A56B295315E23B4B4B5044800A7AF5429C1A288964171944
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4268_1372169280\manifest.json
Size 135B
SHA256 cb929ae2d466e597ecc4f588ba22faf68f7cfc204b3986819c85ac608d6f82b5
MD5 4055ba4ebd5546fb6306d6a3151a236a
SHA1 609a989f14f8ee9ed9bffbd6ddba3214fd0d0109
SHA512 58d39f7ae0dafd067c6dba34c686506c1718112ad5af8a255eb9a7d6ec0edca318b557565f5914c5140eb9d1b6e2ffbb08c9d596f43e7a79fdb4ef95457bf29a
TLSH
T1CEC09223CC019CB119743B642AB2AB82F7B41B0B6869705A3AB3148C1F7E1B48082680
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4268_1578109887\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4268_212247072\manifest.json
Size 160B
SHA256 2a7fe18a087d8e8be847d9569420b6e8907917ff6ca0fa42be15d4e3653c8747
MD5 a24a1941bbb8d90784f5ef76712002f5
SHA1 5c2b6323c7ed8913b5d0d65a4d21062c96df24eb
SHA512 fd7dfec3d46b2af0bddb5aaeae79467507e0c29bab814007a39ea61231e76123659f18a453ed3feb25f16652a0c63c33545e2a0d419fafea89f563fca6a07ce2
TLSH
T133C04C23ED18BABA12F587D40971DB43F7F0031B34E169463B39948C5F761B8925175A
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4268_580394066\manifest.json
Size 85B
SHA256 2d905d7b28b1afd313753d14f6a916a2e56ec4c1316bfa43046b09214ceb6090
MD5 8ce95626b39ebc2401eee0b34c24fc7c
SHA1 f97a2fefe756f7a03e388e1333573b884730c2b0
SHA512 f04e4f695977918adf6e0603386b6f9c75a4a2202b0fe7215b642f3db491a1db398039cc28633b8e2541749403581622d28c1400f3f8fc66a3daab200e27266d
TLSH
T106A0121018015DE318880320213143D2D3A51C05247437001106108019B8636027A22E
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1488-970-0x0000000003D10000-0x0000000003D74000-memory.dmp

Download

memory/1488-969-0x0000000002440000-0x0000000002502000-memory.dmp

Download

memory/1488-1295-0x0000000002440000-0x0000000002502000-memory.dmp

Download

memory/1488-1248-0x0000000002440000-0x0000000002502000-memory.dmp

Download

memory/1488-1062-0x0000000002440000-0x0000000002502000-memory.dmp

Download

memory/1488-1218-0x0000000002440000-0x0000000002502000-memory.dmp

Download

memory/1516-1222-0x0000000002310000-0x00000000023D2000-memory.dmp

Download

memory/1516-1299-0x0000000002310000-0x00000000023D2000-memory.dmp

Download

memory/1516-975-0x0000000002310000-0x00000000023D2000-memory.dmp

Download

memory/1516-1066-0x0000000002310000-0x00000000023D2000-memory.dmp

Download

memory/1516-1158-0x0000000002310000-0x00000000023D2000-memory.dmp

Download

memory/1516-976-0x0000000003D30000-0x0000000003D94000-memory.dmp

Download

memory/1708-1133-0x00000000020C0000-0x0000000002182000-memory.dmp

Download

memory/1708-1134-0x0000000003CC0000-0x0000000003D24000-memory.dmp

Download

memory/1848-1297-0x00000000020C0000-0x0000000002182000-memory.dmp

Download

memory/1848-1031-0x00000000020C0000-0x0000000002182000-memory.dmp

Download

memory/1848-972-0x0000000002410000-0x0000000002474000-memory.dmp

Download

memory/1848-971-0x00000000020C0000-0x0000000002182000-memory.dmp

Download

memory/1848-1064-0x00000000020C0000-0x0000000002182000-memory.dmp

Download

memory/4504-1267-0x0000000003D10000-0x0000000003D74000-memory.dmp

Download

memory/4504-1266-0x00000000022D0000-0x0000000002392000-memory.dmp

Download

memory/4580-670-0x0000000002300000-0x000000000273B000-memory.dmp

Download

memory/4580-895-0x0000000002300000-0x000000000273B000-memory.dmp

Download