22db3354cd270ee96e9b88c6b1fea6e94aa6ea9c5fa8b78f354efec1ff1d35ed

Analysis

user interaction
yes
max time kernel
272s
max time network
274s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
29/04/2026, 14:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Akagi64.exe
Size 448KB
Sample260429-rvrthagy2q
SHA256 22db3354cd270ee96e9b88c6b1fea6e94aa6ea9c5fa8b78f354efec1ff1d35ed
MD5 91ade9687e334adaf2d35fd410f7c59f
SHA1 70c3d88bd11d8b9eda3f7f32a68ffe040acb46e1
SHA512 555d49fdbc60d6a9adc039b2a28fb4935c11af616fed7301293430b231664631352bf34939aae720b9fe1b82d098a32e9b7dc8c50e32d24651aa4b2a3ce72f67
SSDEEP 3072:Nc8tQrq1/GC0RhkFKL6FhNBp7pYl7npYl7zpYl7FEpYl7HIGc07ZG93rO8Ba5NV9:mrq1/n0cp7pOnpOzpOCpOH00cbOX0a
TLSH
T134A4F86972AC02A1D2A4C0758807C677EE61781D132A66FB55C984F7EE303E85F3CE6D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery persistence ransomware

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
73	2844	chrome.exe

Executes dropped EXE 12 IoCs

pid	Process
5032	VC_redist.x86.exe
1076	VC_redist.x86.exe
5060	VC_redist.x86.exe
844	VC_redist.x86.exe
484	VC_redist.x86.exe
492	VC_redist.x86.exe
960	VC_redist.x64.exe
5592	VC_redist.x64.exe
5892	VC_redist.x64.exe
6124	VC_redist.x64.exe
5940	VC_redist.x64.exe
3528	VC_redist.x64.exe

Loads dropped DLL 7 IoCs

pid	Process
1076	VC_redist.x86.exe
6000	VC_redist.x86.exe
492	VC_redist.x86.exe
5592	VC_redist.x64.exe
5676	VC_redist.x64.exe
4932	msedge.exe
6060	msedge.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{0e4ccf1b-d073-4cfe-8a24-e86185719b56} = "\"C:\\ProgramData\\Package Cache\\{0e4ccf1b-d073-4cfe-8a24-e86185719b56}\\VC_redist.x86.exe\" /burn.runonce"	VC_redist.x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{91ee571b-0e8a-4c65-9eaf-2e2f5fc60c00} = "\"C:\\ProgramData\\Package Cache\\{91ee571b-0e8a-4c65-9eaf-2e2f5fc60c00}\\VC_redist.x64.exe\" /burn.runonce"	VC_redist.x64.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\vcruntime140_1.dll	msiexec.exe
File created	C:\Windows\system32\concrt140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfcm140.dll	msiexec.exe
File created	C:\Windows\SysWOW64\vcruntime140_threads.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140u.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfcm140.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfcm140u.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140_codecvt_ids.dll	msiexec.exe
File created	C:\Windows\system32\mfc140chs.dll	msiexec.exe
File created	C:\Windows\system32\mfc140esn.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\msvcp140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\msvcp140_atomic_wait.dll	msiexec.exe
File created	C:\Windows\SysWOW64\vcamp140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140chs.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140_1.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140_1.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140_atomic_wait.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140deu.dll	msiexec.exe
File created	C:\Windows\SysWOW64\msvcp140_2.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\concrt140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfcm140u.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140deu.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140esn.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140rus.dll	msiexec.exe
File created	C:\Windows\system32\mfc140enu.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140cht.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcamp140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcomp140.dll	msiexec.exe
File created	C:\Windows\system32\vcamp140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140jpn.dll	msiexec.exe
File created	C:\Windows\system32\mfc140deu.dll	msiexec.exe
File created	C:\Windows\system32\mfc140fra.dll	msiexec.exe
File created	C:\Windows\system32\mfc140kor.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\msvcp140_1.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140enu.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140chs.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140cht.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140_codecvt_ids.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vccorlib140.dll	msiexec.exe
File created	C:\Windows\system32\vcomp140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\msvcp140_2.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140ita.dll	msiexec.exe
File created	C:\Windows\system32\mfc140.dll	msiexec.exe
File created	C:\Windows\system32\mfc140rus.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140fra.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140.dll	msiexec.exe
File created	C:\Windows\system32\vcruntime140_1.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140enu.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140kor.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140jpn.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140_2.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140_2.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140.dll	msiexec.exe
File created	C:\Windows\system32\mfc140cht.dll	msiexec.exe
File created	C:\Windows\system32\mfc140ita.dll	msiexec.exe
File created	C:\Windows\system32\mfcm140u.dll	msiexec.exe
File created	C:\Windows\SysWOW64\concrt140.dll	msiexec.exe
File created	C:\Windows\SysWOW64\msvcp140_atomic_wait.dll	msiexec.exe
File created	C:\Windows\SysWOW64\vcomp140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140rus.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140rus.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140fra.dll	msiexec.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File created	C:\Windows\SystemTemp\~DFAD5720234497E63A.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBA02.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_1140769371\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_1140769371\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_1140769371\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_1140769371\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\~DFF502A8836A8AFCDF.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_1140769371\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_1140769371\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_1140769371\_locales\uk\messages.json	msedge.exe
File opened for modification	C:\Windows\Installer\MSIDCDB.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_1140769371\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_1140769371\_locales\zh_CN\messages.json	msedge.exe
File opened for modification	C:\Windows\Installer\e59b2a5.msi	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_1140769371\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_1140769371\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_1140769371\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_1140769371\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_1140769371\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_1140769371\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_1140769371\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\~DF82BAC70E0B34760A.TMP	msiexec.exe
File created	C:\Windows\Installer\e59b2b7.msi	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_1140769371\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_1140769371\_locales\mk\messages.json	msedge.exe
File created	C:\Windows\Installer\SourceHash{61B44572-8722-4DAF-8ACF-8E742D30BCC5}	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_1140769371\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_1140769371\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_1140769371\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\~DFC1248CC846A80C7B.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_1140769371\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_1140769371\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_1140769371\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_1140769371\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\~DF06D26EE39D1718EA.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_1140769371\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_1140769371\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_1140769371\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_1140769371\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_1140769371\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_1140769371\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_1140769371\_locales\kn\messages.json	msedge.exe
File opened for modification	C:\Windows\Installer\MSID817.tmp	msiexec.exe
File created	C:\Windows\Installer\e59b2b8.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFB96A02474A47CE48.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_1140769371\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_1140769371\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_1140769371\offscreendocument_main.js	msedge.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_1140769371\_locales\th\messages.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_1140769371\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_1140769371\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_1140769371\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_1140769371\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_1140769371\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\Installer\e59b2cd.msi	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_1140769371\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_1140769371\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_1140769371\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\~DFA264EEE21A4B7761.TMP	msiexec.exe
File created	C:\Windows\Installer\e59b28f.msi	msiexec.exe
File created	C:\Windows\Installer\e59b2a4.msi	msiexec.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\VC_redist.x86.exe:Zone.Identifier	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 18 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe

System Time Discovery 1 TTPs 3 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2844	chrome.exe
2964	msedge.exe
2488	msedge.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000611ecaf51c3c1a840000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000611ecaf50000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900611ecaf5000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1a611ecaf5000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d611ecaf5000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe

Checks processor information in registry 2 TTPs 22 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 21 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2B\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2D	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2f	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2d	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2E	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134219467228465047"	chrome.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2A	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2c	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2C	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2e	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\29	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D05DA3776EAA1AB4DA105B3A88478C04\AuthorizedLUAApp = "0"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\27544B162278FAD4A8FCE847D203CB5C\Clients = 3a0000000000	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8A567BD6FA501A947AD1F646E53EEC14	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D05DA3776EAA1AB4DA105B3A88478C04\SourceList	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8800A266DCF6DD54E97A86760485EA5D\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\27544B162278FAD4A8FCE847D203CB5C\VC_Runtime_Minimum	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\27544B162278FAD4A8FCE847D203CB5C\SourceList\PackageName = "vc_runtimeMinimum_x64.msi"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8A567BD6FA501A947AD1F646E53EEC14\SourceList\Net	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\88AAB0B9F51EF1A3CA0C2B609EDD7FC1	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0DE4DCEAB3A89E14291DB6EE3047CCFA\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{AECD4ED0-8A3B-41E9-92D1-6BEE0374CCAF}v14.50.35719\\packages\\vcRuntimeAdditional_amd64\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\55AFD0A51583CB54B80259AEB45F18D2\Provider	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\D05DA3776EAA1AB4DA105B3A88478C04\VC_Runtime_Additional	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x86,x86,14.30,bundle\Dependents	VC_redist.x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v14\Version = "14.50.35719"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\88AAB0B9F51EF1A3CA0C2B609EDD7FC1\0DE4DCEAB3A89E14291DB6EE3047CCFA	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_x86,v14\ = "{5A0DFA55-3851-45BC-8B20-95EA4BF5812D}"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\679E80FBE29B63345BF612177149674C\SourceList\Media	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\15E8B87C56C0E773581D82F286F95E50	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D05DA3776EAA1AB4DA105B3A88478C04	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\55AFD0A51583CB54B80259AEB45F18D2	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\55AFD0A51583CB54B80259AEB45F18D2\Language = "1033"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\55AFD0A51583CB54B80259AEB45F18D2\SourceList\Media\1 = ";"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\679E80FBE29B63345BF612177149674C	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\09A86F63C932FD435BC8463B1035EC53\27544B162278FAD4A8FCE847D203CB5C	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0DE4DCEAB3A89E14291DB6EE3047CCFA\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\55AFD0A51583CB54B80259AEB45F18D2	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\D05DA3776EAA1AB4DA105B3A88478C04\Provider	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_x86,v14\Dependents\{0e4ccf1b-d073-4cfe-8a24-e86185719b56}	VC_redist.x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\27544B162278FAD4A8FCE847D203CB5C\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{61B44572-8722-4DAF-8ACF-8E742D30BCC5}v14.50.35719\\packages\\vcRuntimeMinimum_amd64\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\88AAB0B9F51EF1A3CA0C2B609EDD7FC1	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.30,bundle	VC_redist.x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\55AFD0A51583CB54B80259AEB45F18D2\PackageCode = "08EDA59D439BD774893A94B286A53626"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\55AFD0A51583CB54B80259AEB45F18D2\SourceList\PackageName = "vc_runtimeMinimum_x86.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\55AFD0A51583CB54B80259AEB45F18D2\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{5A0DFA55-3851-45BC-8B20-95EA4BF5812D}v14.50.35719\\packages\\vcRuntimeMinimum_x86\\"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\INSTALLER\DEPENDENCIES\VC,REDIST.X86,X86,14.30,BUNDLE\DEPENDENTS\{4D8DCF8C-A72A-43E1-9833-C12724DB736E}	VC_redist.x86.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\INSTALLER\DEPENDENCIES\MICROSOFT.VS.VC_RUNTIMEADDITIONALVSU_X86,V14\DEPENDENTS\{4D8DCF8C-A72A-43E1-9833-C12724DB736E}	VC_redist.x86.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v14	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0DE4DCEAB3A89E14291DB6EE3047CCFA\InstanceType = "0"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\09A86F63C932FD435BC8463B1035EC53	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\27544B162278FAD4A8FCE847D203CB5C\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v14	VC_redist.x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v14\ = "{AECD4ED0-8A3B-41E9-92D1-6BEE0374CCAF}"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0DE4DCEAB3A89E14291DB6EE3047CCFA\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0DE4DCEAB3A89E14291DB6EE3047CCFA\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v14\Dependents\{91ee571b-0e8a-4c65-9eaf-2e2f5fc60c00}	VC_redist.x64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\INSTALLER\DEPENDENCIES\MICROSOFT.VS.VC_RUNTIMEADDITIONALVSU_AMD64,V14\DEPENDENTS\{57A73DF6-4BA9-4C1D-BBBB-517289FF6C13}	VC_redist.x64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\60DB5E5629367203C8625813703DFCA1	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_x86,v14\ = "{773AD50D-AAE6-4BA1-AD01-B5A38874C840}"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\27544B162278FAD4A8FCE847D203CB5C\Version = "238193543"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\60DB5E5629367203C8625813703DFCA1\55AFD0A51583CB54B80259AEB45F18D2	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\679E80FBE29B63345BF612177149674C\SourceList	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D05DA3776EAA1AB4DA105B3A88478C04\Version = "238193543"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\27544B162278FAD4A8FCE847D203CB5C	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8A567BD6FA501A947AD1F646E53EEC14\SourceList	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\INSTALLER\DEPENDENCIES\MICROSOFT.VS.VC_RUNTIMEMINIMUMVSU_AMD64,V14\DEPENDENTS\{57A73DF6-4BA9-4C1D-BBBB-517289FF6C13}	VC_redist.x64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5040806F8AF9AAC49928419ED5A1D3CA	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_x86,v14\Version = "14.50.35719"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\55AFD0A51583CB54B80259AEB45F18D2\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D05DA3776EAA1AB4DA105B3A88478C04\SourceList\Net	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\27544B162278FAD4A8FCE847D203CB5C\Language = "1033"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\15E8B87C56C0E773581D82F286F95E50\D05DA3776EAA1AB4DA105B3A88478C04	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\0DE4DCEAB3A89E14291DB6EE3047CCFA\Servicing_Key	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0DE4DCEAB3A89E14291DB6EE3047CCFA	msiexec.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\VC_redist.x86.exe:Zone.Identifier	chrome.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
5136	chrome.exe
5136	chrome.exe
4304	msiexec.exe
4304	msiexec.exe
4304	msiexec.exe
4304	msiexec.exe
4304	msiexec.exe
4304	msiexec.exe
4304	msiexec.exe
4304	msiexec.exe
5136	chrome.exe
5136	chrome.exe
4304	msiexec.exe
4304	msiexec.exe
4304	msiexec.exe
4304	msiexec.exe
4304	msiexec.exe
4304	msiexec.exe
4304	msiexec.exe
4304	msiexec.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

pid	Process
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
4932	msedge.exe
4932	msedge.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5136	chrome.exe
Token: SeCreatePagefilePrivilege	5136	chrome.exe
Token: SeDebugPrivilege	6064	firefox.exe
Token: SeDebugPrivilege	6064	firefox.exe
Token: SeShutdownPrivilege	5136	chrome.exe
Token: SeCreatePagefilePrivilege	5136	chrome.exe
Token: SeShutdownPrivilege	5136	chrome.exe
Token: SeCreatePagefilePrivilege	5136	chrome.exe
Token: SeShutdownPrivilege	5136	chrome.exe
Token: SeCreatePagefilePrivilege	5136	chrome.exe
Token: SeShutdownPrivilege	5136	chrome.exe
Token: SeCreatePagefilePrivilege	5136	chrome.exe
Token: SeShutdownPrivilege	5136	chrome.exe
Token: SeCreatePagefilePrivilege	5136	chrome.exe
Token: SeShutdownPrivilege	5136	chrome.exe
Token: SeCreatePagefilePrivilege	5136	chrome.exe
Token: SeShutdownPrivilege	5136	chrome.exe
Token: SeCreatePagefilePrivilege	5136	chrome.exe
Token: SeShutdownPrivilege	5136	chrome.exe
Token: SeCreatePagefilePrivilege	5136	chrome.exe
Token: SeShutdownPrivilege	5136	chrome.exe
Token: SeCreatePagefilePrivilege	5136	chrome.exe
Token: SeShutdownPrivilege	5136	chrome.exe
Token: SeCreatePagefilePrivilege	5136	chrome.exe
Token: SeShutdownPrivilege	5136	chrome.exe
Token: SeCreatePagefilePrivilege	5136	chrome.exe
Token: SeShutdownPrivilege	5136	chrome.exe
Token: SeCreatePagefilePrivilege	5136	chrome.exe
Token: SeShutdownPrivilege	5136	chrome.exe
Token: SeCreatePagefilePrivilege	5136	chrome.exe
Token: SeShutdownPrivilege	5136	chrome.exe
Token: SeCreatePagefilePrivilege	5136	chrome.exe
Token: SeShutdownPrivilege	5136	chrome.exe
Token: SeCreatePagefilePrivilege	5136	chrome.exe
Token: SeShutdownPrivilege	5136	chrome.exe
Token: SeCreatePagefilePrivilege	5136	chrome.exe
Token: SeShutdownPrivilege	5136	chrome.exe
Token: SeCreatePagefilePrivilege	5136	chrome.exe
Token: SeShutdownPrivilege	5136	chrome.exe
Token: SeCreatePagefilePrivilege	5136	chrome.exe
Token: SeShutdownPrivilege	5136	chrome.exe
Token: SeCreatePagefilePrivilege	5136	chrome.exe
Token: SeShutdownPrivilege	5136	chrome.exe
Token: SeCreatePagefilePrivilege	5136	chrome.exe
Token: SeShutdownPrivilege	5136	chrome.exe
Token: SeCreatePagefilePrivilege	5136	chrome.exe
Token: SeShutdownPrivilege	5136	chrome.exe
Token: SeCreatePagefilePrivilege	5136	chrome.exe
Token: SeShutdownPrivilege	5136	chrome.exe
Token: SeCreatePagefilePrivilege	5136	chrome.exe
Token: SeShutdownPrivilege	5136	chrome.exe
Token: SeCreatePagefilePrivilege	5136	chrome.exe
Token: SeShutdownPrivilege	5136	chrome.exe
Token: SeCreatePagefilePrivilege	5136	chrome.exe
Token: SeShutdownPrivilege	5136	chrome.exe
Token: SeCreatePagefilePrivilege	5136	chrome.exe
Token: SeShutdownPrivilege	5136	chrome.exe
Token: SeCreatePagefilePrivilege	5136	chrome.exe
Token: SeShutdownPrivilege	5136	chrome.exe
Token: SeCreatePagefilePrivilege	5136	chrome.exe
Token: SeShutdownPrivilege	5136	chrome.exe
Token: SeCreatePagefilePrivilege	5136	chrome.exe
Token: SeShutdownPrivilege	5136	chrome.exe
Token: SeCreatePagefilePrivilege	5136	chrome.exe

Suspicious use of FindShellTrayWindow 63 IoCs

pid	Process
6064	firefox.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
6064	firefox.exe
6064	firefox.exe
6064	firefox.exe
5136	chrome.exe
6064	firefox.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
1076	VC_redist.x86.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5592	VC_redist.x64.exe
4932	msedge.exe
4932	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe
5136	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
6064	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1580 wrote to memory of 1520	1580	cmd.exe	84
PID 5304 wrote to memory of 6064	5304	firefox.exe	86
PID 5304 wrote to memory of 6064	5304	firefox.exe	86
PID 6064 wrote to memory of 4120	6064	firefox.exe	87
PID 6064 wrote to memory of 4120	6064	firefox.exe	87
PID 6064 wrote to memory of 4120	6064	firefox.exe	87
PID 6064 wrote to memory of 2864	6064	firefox.exe	88
PID 6064 wrote to memory of 2864	6064	firefox.exe	88
PID 6064 wrote to memory of 2864	6064	firefox.exe	88
PID 6064 wrote to memory of 2864	6064	firefox.exe	88
PID 5136 wrote to memory of 5648	5136	chrome.exe	90
PID 5136 wrote to memory of 5152	5136	chrome.exe	91
PID 5136 wrote to memory of 2844	5136	chrome.exe	92
PID 5136 wrote to memory of 5152	5136	chrome.exe	91
PID 5136 wrote to memory of 660	5136	chrome.exe	93
PID 5136 wrote to memory of 660	5136	chrome.exe	93
PID 5136 wrote to memory of 4656	5136	chrome.exe	95
PID 5136 wrote to memory of 4656	5136	chrome.exe	95
PID 5136 wrote to memory of 3380	5136	chrome.exe	96
PID 5136 wrote to memory of 3380	5136	chrome.exe	96
PID 5136 wrote to memory of 6000	5136	chrome.exe	97
PID 5136 wrote to memory of 6000	5136	chrome.exe	97
PID 6064 wrote to memory of 5264	6064	firefox.exe	99
PID 6064 wrote to memory of 5264	6064	firefox.exe	99
PID 6064 wrote to memory of 5264	6064	firefox.exe	99
PID 6064 wrote to memory of 5264	6064	firefox.exe	99
PID 6064 wrote to memory of 5680	6064	firefox.exe	100
PID 6064 wrote to memory of 5680	6064	firefox.exe	100
PID 6064 wrote to memory of 5680	6064	firefox.exe	100
PID 5136 wrote to memory of 5036	5136	chrome.exe	101
PID 5136 wrote to memory of 5036	5136	chrome.exe	101
PID 6064 wrote to memory of 4620	6064	firefox.exe	102
PID 6064 wrote to memory of 4620	6064	firefox.exe	102
PID 6064 wrote to memory of 4620	6064	firefox.exe	102
PID 6064 wrote to memory of 4620	6064	firefox.exe	102
PID 6064 wrote to memory of 3864	6064	firefox.exe	103
PID 6064 wrote to memory of 3864	6064	firefox.exe	103
PID 6064 wrote to memory of 3864	6064	firefox.exe	103
PID 6064 wrote to memory of 3864	6064	firefox.exe	103
PID 6064 wrote to memory of 4720	6064	firefox.exe	104
PID 6064 wrote to memory of 4720	6064	firefox.exe	104
PID 6064 wrote to memory of 4720	6064	firefox.exe	104
PID 6064 wrote to memory of 4720	6064	firefox.exe	104
PID 6064 wrote to memory of 272	6064	firefox.exe	105
PID 6064 wrote to memory of 272	6064	firefox.exe	105
PID 6064 wrote to memory of 272	6064	firefox.exe	105
PID 6064 wrote to memory of 272	6064	firefox.exe	105
PID 6064 wrote to memory of 1924	6064	firefox.exe	106
PID 6064 wrote to memory of 1924	6064	firefox.exe	106
PID 6064 wrote to memory of 1924	6064	firefox.exe	106
PID 6064 wrote to memory of 1924	6064	firefox.exe	106
PID 5136 wrote to memory of 3296	5136	chrome.exe	107
PID 5136 wrote to memory of 5436	5136	chrome.exe	109
PID 5136 wrote to memory of 5436	5136	chrome.exe	109
PID 5136 wrote to memory of 2868	5136	chrome.exe	110
PID 5136 wrote to memory of 2868	5136	chrome.exe	110
PID 5136 wrote to memory of 3836	5136	chrome.exe	111
PID 5136 wrote to memory of 3836	5136	chrome.exe	111
PID 5136 wrote to memory of 6044	5136	chrome.exe	112
PID 5136 wrote to memory of 5716	5136	chrome.exe	113
PID 5136 wrote to memory of 2004	5136	chrome.exe	114
PID 5136 wrote to memory of 5128	5136	chrome.exe	115
PID 5136 wrote to memory of 5128	5136	chrome.exe	115
PID 5136 wrote to memory of 5436	5136	chrome.exe	116

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\Akagi64.exe
"C:\Users\Admin\AppData\Local\Temp\Akagi64.exe"
1⤵
PID:3452

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:848

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1580
- C:\Users\Admin\AppData\Local\Temp\Akagi64.exe
  Akagi64.exe 41
  2⤵
  PID:1520
- C:\Users\Admin\AppData\Local\Temp\Akagi64.exe
  akagi64.exe 41
  2⤵
  PID:4284

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5304
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:6064
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1972 -prefsLen 27097 -prefMapHandle 1976 -prefMapSize 270279 -ipcHandle 2064 -initialChannelId {63603058-db6f-4b12-988e-469e8e3b8b08} -parentPid 6064 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6064" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:4120
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2428 -prefsLen 27133 -prefMapHandle 2432 -prefMapSize 270279 -ipcHandle 2440 -initialChannelId {fb233bbb-2d67-4757-a40e-9949222af0c6} -parentPid 6064 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6064" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    - Checks processor information in registry
    PID:2864
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3500 -prefsLen 27323 -prefMapHandle 3504 -prefMapSize 270279 -jsInitHandle 3508 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3516 -initialChannelId {92df16ee-43f7-4b8a-8761-085975098132} -parentPid 6064 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6064" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:5264
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3824 -prefsLen 27323 -prefMapHandle 3828 -prefMapSize 270279 -ipcHandle 3948 -initialChannelId {253cc8d9-2302-465a-af78-b6b5c768a08c} -parentPid 6064 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6064" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:5680
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4488 -prefsLen 34822 -prefMapHandle 4492 -prefMapSize 270279 -jsInitHandle 4496 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4460 -initialChannelId {55b2d243-4c29-4878-9e2d-9eb192b148e2} -parentPid 6064 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6064" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:4620
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5056 -prefsLen 35010 -prefMapHandle 5052 -prefMapSize 270279 -ipcHandle 5044 -initialChannelId {c1077f76-9e57-4366-8077-a9d2ecef9259} -parentPid 6064 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6064" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:3864
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3240 -prefsLen 32952 -prefMapHandle 3244 -prefMapSize 270279 -jsInitHandle 1372 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5200 -initialChannelId {cc38d6cb-8d82-4675-89fd-67ca77bc931e} -parentPid 6064 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6064" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:4720
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 1660 -prefsLen 32952 -prefMapHandle 1668 -prefMapSize 270279 -jsInitHandle 2940 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5388 -initialChannelId {7678ebdd-9bc7-410e-8c3e-bca6654ed63e} -parentPid 6064 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6064" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:272
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5536 -prefsLen 32952 -prefMapHandle 5540 -prefMapSize 270279 -jsInitHandle 5544 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5340 -initialChannelId {1ce67c4a-34f0-496e-9cf2-348031ba6d0f} -parentPid 6064 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6064" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:1924

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5136
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbd00cc728,0x7ffbd00cc734,0x7ffbd00cc740
  2⤵
  PID:5648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1640,i,11990123825537794131,7713756145728239634,262144 --field-trial-handle=2140,i,12110271922775895405,9788048768893705179,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2124 /prefetch:2
  2⤵
  PID:5152
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1460,i,1534570765560118808,1039681568509726460,524288 --field-trial-handle=2140,i,12110271922775895405,9788048768893705179,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2168 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:2844
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2372,i,13223091176382781718,16398121324920970080,524288 --field-trial-handle=2140,i,12110271922775895405,9788048768893705179,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2384 /prefetch:13
  2⤵
  PID:660
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3236,i,6094122282967777413,14069277245513322631,2097152 --field-trial-handle=2140,i,12110271922775895405,9788048768893705179,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:4656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3268,i,3564636961524267435,4362112986571403298,2097152 --field-trial-handle=2140,i,12110271922775895405,9788048768893705179,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:3380
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4212,i,583685044841493419,9230838523079330556,2097152 --field-trial-handle=2140,i,12110271922775895405,9788048768893705179,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4228 /prefetch:9
  2⤵
  PID:6000
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4568,i,1696017029694569226,9630025624874936799,2097152 --field-trial-handle=2140,i,12110271922775895405,9788048768893705179,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4536 /prefetch:1
  2⤵
  PID:5036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5440,i,832931796461252692,4268396244987387753,524288 --field-trial-handle=2140,i,12110271922775895405,9788048768893705179,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5412 /prefetch:14
  2⤵
  PID:3296
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5440,i,8000278731577053036,1539211457190194968,2097152 --field-trial-handle=2140,i,12110271922775895405,9788048768893705179,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5480 /prefetch:1
  2⤵
  PID:5436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=3388,i,17852396746821563746,6183913968855199597,2097152 --field-trial-handle=2140,i,12110271922775895405,9788048768893705179,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5800 /prefetch:1
  2⤵
  PID:2868
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5796,i,1654245724622408144,3181298421210327147,2097152 --field-trial-handle=2140,i,12110271922775895405,9788048768893705179,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3384 /prefetch:1
  2⤵
  PID:3836
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5760,i,734397064356648245,10653977641603916597,524288 --field-trial-handle=2140,i,12110271922775895405,9788048768893705179,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5688 /prefetch:14
  2⤵
  PID:6044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5496,i,7640315679015966956,18051376318831768730,524288 --field-trial-handle=2140,i,12110271922775895405,9788048768893705179,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3312 /prefetch:14
  2⤵
  PID:5716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=212,i,5399606023494384579,3616180531806226278,524288 --field-trial-handle=2140,i,12110271922775895405,9788048768893705179,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3528 /prefetch:14
  2⤵
  PID:2004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5856,i,12448790688082473250,4481222793577982160,2097152 --field-trial-handle=2140,i,12110271922775895405,9788048768893705179,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=212 /prefetch:1
  2⤵
  PID:5128
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=4232,i,7351118895733299406,2294082908142154052,2097152 --field-trial-handle=2140,i,12110271922775895405,9788048768893705179,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4200 /prefetch:1
  2⤵
  PID:5436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5976,i,11432838555605117606,3693697477989632797,524288 --field-trial-handle=2140,i,12110271922775895405,9788048768893705179,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5984 /prefetch:14
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:4716
- C:\Users\Admin\Downloads\VC_redist.x86.exe
  "C:\Users\Admin\Downloads\VC_redist.x86.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5032
- - C:\Windows\Temp\{3C09283D-D70B-45D6-A1B3-44E01E2BA7AC}\.cr\VC_redist.x86.exe
    "C:\Windows\Temp\{3C09283D-D70B-45D6-A1B3-44E01E2BA7AC}\.cr\VC_redist.x86.exe" -burn.clean.room="C:\Users\Admin\Downloads\VC_redist.x86.exe" -burn.filehandle.attached=732 -burn.filehandle.self=692
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    PID:1076
  - - C:\Windows\Temp\{7BE6F1E8-9155-4D0E-8FD0-3C84B6C7AFBA}\.be\VC_redist.x86.exe
      "C:\Windows\Temp\{7BE6F1E8-9155-4D0E-8FD0-3C84B6C7AFBA}\.be\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{728690B0-7E9B-4D55-9969-747B3323EFE9} {B72777C2-79E0-4D2B-BC54-4099E05B2F55} 1076
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Modifies registry class
      PID:5060
    - - C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
        
        "C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={0e4ccf1b-d073-4cfe-8a24-e86185719b56} -burn.filehandle.self=1108 -burn.embedded BurnPipe.{CE57F7AD-9862-45C6-8CCF-7811A4F64A0D} {9C4F1B4A-C1BB-4C83-84AE-6B3BF6EFA4C7} 5060
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4412
      - C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
        
        "C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -burn.clean.room="C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -burn.filehandle.attached=548 -burn.filehandle.self=564 -uninstall -quiet -burn.related.upgrade -burn.ancestors={0e4ccf1b-d073-4cfe-8a24-e86185719b56} -burn.filehandle.self=1108 -burn.embedded BurnPipe.{CE57F7AD-9862-45C6-8CCF-7811A4F64A0D} {9C4F1B4A-C1BB-4C83-84AE-6B3BF6EFA4C7} 5060
        6⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:6000
        
        C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
        
        "C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{FF461BE9-3FB1-43E7-9957-E30A138133FD} {80CF1570-32FD-49CF-883F-649EC72C7694} 6000
        7⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6724,i,3763185848261428922,4055484190866317743,2097152 --field-trial-handle=2140,i,12110271922775895405,9788048768893705179,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6788 /prefetch:1
  2⤵
  PID:3372
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6888,i,18340108589295756922,2851343893423651351,524288 --field-trial-handle=2140,i,12110271922775895405,9788048768893705179,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4236 /prefetch:14
  2⤵
  PID:5904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6656,i,9426929513599192574,6118046368351629668,262144 --field-trial-handle=2140,i,12110271922775895405,9788048768893705179,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6660 /prefetch:10
  2⤵
  PID:132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=4616,i,12542519828274432068,8132753324247765874,524288 --field-trial-handle=2140,i,12110271922775895405,9788048768893705179,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5636 /prefetch:14
  2⤵
  PID:2936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=4300,i,7583789852497811252,2498864195309071743,2097152 --field-trial-handle=2140,i,12110271922775895405,9788048768893705179,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4208 /prefetch:1
  2⤵
  PID:5176
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=7048,i,4794906176743439400,15795801382497283862,2097152 --field-trial-handle=2140,i,12110271922775895405,9788048768893705179,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=7068 /prefetch:1
  2⤵
  PID:1916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=6768,i,16416079751089877854,6474878985753211410,2097152 --field-trial-handle=2140,i,12110271922775895405,9788048768893705179,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4344 /prefetch:1
  2⤵
  PID:3216
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=6864,i,751327133221525819,10942419592425118284,2097152 --field-trial-handle=2140,i,12110271922775895405,9788048768893705179,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4264 /prefetch:1
  2⤵
  PID:3196

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5712

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5016

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:1520

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
1⤵
PID:2352

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4304

C:\ProgramData\Package Cache\{0e4ccf1b-d073-4cfe-8a24-e86185719b56}\VC_redist.x86.exe
"C:\ProgramData\Package Cache\{0e4ccf1b-d073-4cfe-8a24-e86185719b56}\VC_redist.x86.exe" /burn.runonce
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:844
- C:\ProgramData\Package Cache\{0e4ccf1b-d073-4cfe-8a24-e86185719b56}\VC_redist.x86.exe
  "C:\ProgramData\Package Cache\{0e4ccf1b-d073-4cfe-8a24-e86185719b56}\VC_redist.x86.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260429153238.log"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:484
- - C:\ProgramData\Package Cache\{0e4ccf1b-d073-4cfe-8a24-e86185719b56}\VC_redist.x86.exe
    "C:\ProgramData\Package Cache\{0e4ccf1b-d073-4cfe-8a24-e86185719b56}\VC_redist.x86.exe" -burn.clean.room="C:\ProgramData\Package Cache\{0e4ccf1b-d073-4cfe-8a24-e86185719b56}\VC_redist.x86.exe" -burn.filehandle.attached=548 -burn.filehandle.self=564 /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260429153238.log"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:492

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe"
1⤵
PID:2528
- C:\Users\Admin\AppData\Local\Temp\Akagi64.exe
  Akagi64.exe 41
  2⤵
  PID:5800

C:\Users\Admin\Downloads\VC_redist.x64.exe
"C:\Users\Admin\Downloads\VC_redist.x64.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:960
- C:\Windows\Temp\{2A8D73B6-EA44-4AA6-937F-DAF1DD40A03D}\.cr\VC_redist.x64.exe
  "C:\Windows\Temp\{2A8D73B6-EA44-4AA6-937F-DAF1DD40A03D}\.cr\VC_redist.x64.exe" -burn.clean.room="C:\Users\Admin\Downloads\VC_redist.x64.exe" -burn.filehandle.attached=724 -burn.filehandle.self=728
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of FindShellTrayWindow
  PID:5592
- - C:\Windows\Temp\{9C10DD64-8741-47A9-B5F2-A8842047795A}\.be\VC_redist.x64.exe
    "C:\Windows\Temp\{9C10DD64-8741-47A9-B5F2-A8842047795A}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{519E9768-D7A2-4AF3-A30F-8FF0C33CCD36} {5188EF63-B1A5-411A-BA06-322431E90C3E} 5592
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:5892
  - - C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
      "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={91ee571b-0e8a-4c65-9eaf-2e2f5fc60c00} -burn.filehandle.self=972 -burn.embedded BurnPipe.{1D619388-7C5C-47E8-A465-0D6E8F9DA941} {3D31D37C-CB43-42B8-B3E9-8A1FF6694C6D} 5892
      4⤵
      System Location Discovery: System Language Discovery
      PID:1264
    - - C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
        
        "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.filehandle.attached=544 -burn.filehandle.self=560 -uninstall -quiet -burn.related.upgrade -burn.ancestors={91ee571b-0e8a-4c65-9eaf-2e2f5fc60c00} -burn.filehandle.self=972 -burn.embedded BurnPipe.{1D619388-7C5C-47E8-A465-0D6E8F9DA941} {3D31D37C-CB43-42B8-B3E9-8A1FF6694C6D} 5892
        5⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:5676
      - C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
        
        "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{5D925DD0-CE3A-4B4A-8EA3-526308E40F8F} {A629BC94-EFA0-4661-853D-A5C15B05B125} 5676
        6⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5340

C:\ProgramData\Package Cache\{91ee571b-0e8a-4c65-9eaf-2e2f5fc60c00}\VC_redist.x64.exe
"C:\ProgramData\Package Cache\{91ee571b-0e8a-4c65-9eaf-2e2f5fc60c00}\VC_redist.x64.exe" /burn.runonce
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6124
- C:\ProgramData\Package Cache\{91ee571b-0e8a-4c65-9eaf-2e2f5fc60c00}\VC_redist.x64.exe
  "C:\ProgramData\Package Cache\{91ee571b-0e8a-4c65-9eaf-2e2f5fc60c00}\VC_redist.x64.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260429153401.log"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5940
- - C:\ProgramData\Package Cache\{91ee571b-0e8a-4c65-9eaf-2e2f5fc60c00}\VC_redist.x64.exe
    "C:\ProgramData\Package Cache\{91ee571b-0e8a-4c65-9eaf-2e2f5fc60c00}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{91ee571b-0e8a-4c65-9eaf-2e2f5fc60c00}\VC_redist.x64.exe" -burn.filehandle.attached=548 -burn.filehandle.self=564 /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260429153401.log"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3528

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://cnd/
1⤵
- Loads dropped DLL
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
PID:4932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x368,0x7ffbdf96c188,0x7ffbdf96c194,0x7ffbdf96c1a0
  2⤵
  PID:616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1576,i,12879772215371847829,3366303191185414511,262144 --field-trial-handle=1980,i,937453315921176751,1816182317897294580,262144 --variations-seed-version --mojo-platform-channel-handle=1988 /prefetch:2
  2⤵
  PID:5300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2272,i,15921039619027943290,1359865039755739029,524288 --field-trial-handle=1980,i,937453315921176751,1816182317897294580,262144 --variations-seed-version --mojo-platform-channel-handle=2356 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2576,i,8153591611300103195,6402033063365281741,524288 --field-trial-handle=1980,i,937453315921176751,1816182317897294580,262144 --variations-seed-version --mojo-platform-channel-handle=2516 /prefetch:13
  2⤵
  PID:568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3416,i,10239223955800671094,16645842443647684950,2097152 --field-trial-handle=1980,i,937453315921176751,1816182317897294580,262144 --variations-seed-version --mojo-platform-channel-handle=3444 /prefetch:1
  2⤵
  PID:1820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3436,i,657636293987456248,15311709600667330850,2097152 --field-trial-handle=1980,i,937453315921176751,1816182317897294580,262144 --variations-seed-version --mojo-platform-channel-handle=3456 /prefetch:1
  2⤵
  PID:2284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  PID:6060
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x264,0x7ffbdf96c188,0x7ffbdf96c194,0x7ffbdf96c1a0
    3⤵
    PID:3676
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1728,i,17482320177949265982,4834555757393786435,524288 --field-trial-handle=2140,i,18190635730876633905,17759797559478774194,262144 --variations-seed-version --mojo-platform-channel-handle=2168 /prefetch:11
    3⤵
    - System Time Discovery
    PID:2488
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1532,i,8828806240186344211,8552522808401427453,262144 --field-trial-handle=2140,i,18190635730876633905,17759797559478774194,262144 --variations-seed-version --mojo-platform-channel-handle=2136 /prefetch:2
    3⤵
    PID:852
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2472,i,10546909679074233283,10308203847970502363,524288 --field-trial-handle=2140,i,18190635730876633905,17759797559478774194,262144 --variations-seed-version --mojo-platform-channel-handle=2468 /prefetch:13
    3⤵
    PID:5852
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4468,i,12026074336372294332,8086874379171069141,524288 --field-trial-handle=2140,i,18190635730876633905,17759797559478774194,262144 --variations-seed-version --mojo-platform-channel-handle=4484 /prefetch:14
    3⤵
    PID:3236
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4468,i,12026074336372294332,8086874379171069141,524288 --field-trial-handle=2140,i,18190635730876633905,17759797559478774194,262144 --variations-seed-version --mojo-platform-channel-handle=4484 /prefetch:14
    3⤵
    PID:836
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4832,i,13527104058412524990,17298351845045563824,524288 --field-trial-handle=2140,i,18190635730876633905,17759797559478774194,262144 --variations-seed-version --mojo-platform-channel-handle=4468 /prefetch:14
    3⤵
    PID:1820
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4836,i,3993986638563567429,2521748807844797592,524288 --field-trial-handle=2140,i,18190635730876633905,17759797559478774194,262144 --variations-seed-version --mojo-platform-channel-handle=4420 /prefetch:14
    3⤵
    PID:1472
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4840,i,3260973219676394385,16079271674745814043,524288 --field-trial-handle=2140,i,18190635730876633905,17759797559478774194,262144 --variations-seed-version --mojo-platform-channel-handle=4868 /prefetch:14
    3⤵
    PID:1328
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3452,i,5556705669008106852,4065236214073263575,524288 --field-trial-handle=2140,i,18190635730876633905,17759797559478774194,262144 --variations-seed-version --mojo-platform-channel-handle=2420 /prefetch:14
    3⤵
    PID:5192
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3428,i,5226597867603052939,569329416255595635,524288 --field-trial-handle=2140,i,18190635730876633905,17759797559478774194,262144 --variations-seed-version --mojo-platform-channel-handle=4920 /prefetch:14
    3⤵
    PID:1156

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3368

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3652

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:436

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe"
1⤵
PID:4520
- C:\Users\Admin\AppData\Local\Temp\Akagi64.exe
  akagi64.exe 41
  2⤵
  PID:2668

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e59b282.rbs

Path C:\Config.Msi\e59b282.rbs
Size 16KB
SHA256 dabb252f68cfa01e29eb13e99f2492d24f0aa29a448168a3e1f8b318c981d346
MD5 dbc8cdc6e21415ab1a519a47b3e13a3a
SHA1 f7f99fd487c50062ff2bb27a1e5fea36dba6800f
SHA512 2da9a33fa46d46a12d881b43e999461df404bc8e08d6072d13e44b654e7abec04496dc8f6459b2899718a28c1b9f876818926d68e6bb2fde91716a44c991915b
SSDEEP 96:XeRp55Rp/NNWT8RIeDd11xQo8R6eDd11Cjtknz0yWcW/Rp0Q2RpVdzRp9OXw3Tju:XIRX1GRp1Hn4Xyin5f7e+nh18XThhty
TLSH
T18772FE42A94096C3E8662B70DD571B7037B7D7E5A344839B40DC92349F877D22F9E28E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59b287.rbs

Path C:\Config.Msi\e59b287.rbs
Size 18KB
SHA256 f39dcc4112abed056bfa0c0c100c6914f8bcbe1e919ca147e1f1438cad887cf1
MD5 e7c1f68de08e936829c069beb37b6b52
SHA1 8e28d0c8a905f6c816f05978070b3277dc06b224
SHA512 3f9775cbe448b69d4aed3e918175f6ddaf43c132c644cf05a2246fa2956f03391e96391db74f819516023eccf7f5696ba1bbdaecc7d0b223b771756b652cb862
SSDEEP 96:XPRp0LWRp2JJNBdwNNNNNNNNNNjroPb41nHV5zTRpP8Nkg9pRE4a+eeRpsCLAadh:XOYvv1dCn2ZUIaZUSOrjnyEmqUxOpO
TLSH
T11592FB436A00C9E3E8A76B71CE5B0B163B72D3E6C354634B44DCD1304F93BC92E9969A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59b294.rbs

Path C:\Config.Msi\e59b294.rbs
Size 20KB
SHA256 dec5f6a7c21f4a43bec40ad454c843d706850738377724611fbe4786b513942d
MD5 c9c8762cd0857aebe94ba18ba12091d3
SHA1 59edeeae35e1da5f8908c1b2525fc9c26c9e509d
SHA512 765aea6c6fbd003602cb0bd1efa617e2020cb1f9066736486cebfee30454d37097d1ff3755755e1d955b1ec0849c52c4e62b6b6ce202b1a19a65cef046b265f3
SSDEEP 384:cWREglRcgFfXMawmn28I1S9HXVZFbLQPOqUO32ghSin2N6FHft:cWEgcifXMawmn28IA9HXVZFbkPOqUe2k
TLSH
T17FA2FE03B64499D3D9B62B70DD671BA47B32CBE59361434B40DC94388F933C22EDA68E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59b2a3.rbs

Path C:\Config.Msi\e59b2a3.rbs
Size 19KB
SHA256 28e3f61a39a084df5dce33c94f7b6a15cdbdcb35d1ef9d1578f53fd3e45bf4ef
MD5 2c0047b236ca6c63e58b097482fd5cc7
SHA1 6acdee8c2b4acb56a2dcc061efd8f49c106acaa8
SHA512 d6633db67a6999e83c3115394d6308ea96dfc6c767f072acc176e8f3c27e4fc7a7c16dd05a9d063ed30c657c1e3263c4000618213b991642b9ef2cc256a4bd2c
SSDEEP 192:chmBtwUk0Ve2SD4QsUh+HRrMfCEA26UI/6U5uD1LW5LsUErLrS7aOpsv:chSVk0Ve2SD4QsUh+xOv6/6hRKQfS7O
TLSH
T15092CB427A00DA92D8A62B70DD971B253772D3DAD751538B02DCC1744F833C6AF9EA8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59b2aa.rbs

Path C:\Config.Msi\e59b2aa.rbs
Size 19KB
SHA256 49b36fb4cc5aafff42da4e1013d017a863cafbdc5e736fb59232a80808c79822
MD5 667929f0f3fce3bfde0c77d890d5a0ea
SHA1 cdb3ea0498df6c2d14af1ae682189e1d05de9bde
SHA512 a5049b7fbee1413a9bcebd1fe48853bf18fee1ebc35029abbe725635a08ac6ad80a3d1a48003122af856cfc861a56853246a3ec555e7e70744b503c4d59ac80e
SSDEEP 192:HKRm1kRf15dXcFUADIc1f+W+y4+ogfhP7:HKRm6RfTeC81f/cqP7
TLSH
T1EB92FB127680C9E2D8766B31CD671B653B76DBD5A390438B40DC94308F93BCA2F9D68D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59b2b6.rbs

Path C:\Config.Msi\e59b2b6.rbs
Size 19KB
SHA256 f06a774022a4540f47cf2ee6cf10056e8a47de875a1209f623fa507637a91530
MD5 faf06615d0c5ae5bab7d0dd575e70e23
SHA1 476a40dfef4ccc0ab4e2cdce73dedb3c93b18da6
SHA512 d998363614179caa1b260e2ae286636b6156599ea55c0d5b89b70070fe41d94ce7b4495ad040b83656bc22bd3025d1c6d74b0053e37815ce2f17ab40f5cccafd
SSDEEP 192:H9DAoBHRq+M3NinQv7ClstgCOCd2jdUI/jdUgY3ETLNfHOpM:HxAoBHRqF3NinQv7Wnjd/jd/5
TLSH
T1CF92ED416A40C2A3DDA63B70DD571B193BB6D3D9E791434B42CC80748E837CA6FDE68A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59b2bd.rbs

Path C:\Config.Msi\e59b2bd.rbs
Size 21KB
SHA256 1a68986fd969a297df02c8d911a1f2ee462ef2b19207a05acaa4c8918912c272
MD5 ecc6c9c5075d241fbb51346775a0dd36
SHA1 2418feaf7b46fe697c7f0ec93dbcfd6ba7fc51af
SHA512 7003b2c8d99349a285f0b2ece108480a659ff06b222e67066c9fed0efa4b79f609b0fd0e60e6bcbafdde8aea14f5a11408f9fa1966d43da38e5dc4b86359aae4
SSDEEP 384:2YRVGRGnAKxNAUhUC7xJjrMNYPzIbSfmaJqJ9ck7YtWdjkP:28MSAKhkmVq2
TLSH
T1D9A20E03768099E3D86227B1DD672BA53B73D7D99350434B10ECD2348F633C72E5AA9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59b2cc.rbs

Path C:\Config.Msi\e59b2cc.rbs
Size 21KB
SHA256 fe5c4e31c55d609ef94601fe8f35529a52954e2338b96eae911739d5e2dc130a
MD5 8d2d51b114f419fe44b7abe9645b6192
SHA1 552efa08b957a0dc50e9a3f2b34e62667bfcfebc
SHA512 ea600ab6628637669f4311dae5485f39648dd6ce48e8185f1c06501eaa3838a0cba3b4518a8e484061cf9d67a75f2122c1ecee66d1a1271407f0e6b372db3c2f
SSDEEP 384:2T6tFYQxkA+pAv9jH4ryInsalckU72eC64ZjR/a/+KY2sLV:2T6tFYQxkA+pAv9jayIRZFy2KYXLV
TLSH
T1E1A2EC017A00D292E4AB2B30CD971B2477B6C2D99361D78B81CDD1748F837D66FAD68A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

state.rsm

Path C:\ProgramData\Package Cache\{0e4ccf1b-d073-4cfe-8a24-e86185719b56}\state.rsm
Size 872B
SHA256 643ddfeb3ac1c92c5406a34351f6143da29ccec29d0883486ae8645b9042610e
MD5 73e09d736e9213ffd3674090f4d53f70
SHA1 91cef7b1e3312cdde629c3dfb48a4264ff868b95
SHA512 e0617ba46f602230a1e73e4290cfc8315bfc42e2a509d2ee11d6cff7e0586b7407fdac48d10b194a06f7b2cd0be3b97174c9eabe8b111e4087d34415da4b6108
TLSH
T1C911BEA08FF64029F3F76A7078B90B55287BB8125E32801C0181308B8F32B90C874BA6
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 456B
SHA256 d0e624ae6fb12f06ffcb336771115cd4a317285ad7e9d14cda9bae478a01697e
MD5 e488ccee32bb194319bb481413a66ccc
SHA1 6fef94897d83e53ba152351371ba2881cda3138a
SHA512 0c7937b73247754433980b400b50586c3bd30ca44f978132579e55a902e0b5ab01ee7fa01a9dfc9afd39c9567e5a78e537d3d6e9e068d76f6dfb795219071207
TLSH
T18DF0D80939E5E1E5CBDD59B3B0C10A15E20C084151501797CD38E448BDF3DA15288458
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 357a2718b31742e7a237caf8f5583f8bd95c9bdc7c150f59b493ddbd4183dac6
MD5 27c0bb5100ef7e9b0b11e9cba75fd2d3
SHA1 4b40f8c5fa98bdf8a696907c73f72270474fb056
SHA512 7e6d97c7761a01d8d2a33a3c54792390fbb26a411c2cc2342d3b697a368c28e8c317b158bfe848b437fd56bf4c304a583563df532491456380cf213ed9613eb5
SSDEEP 96:DLpAgVI+SaIarYGfYzrmD6XuilNbPp5d0HAOw:DLpAgVIvaIarYGfYzrmD6XuilNbx5GHS
TLSH
T1D8C16AF7C3E4852DC95596F4AB156E1ECE2D0A24432C3C66C8D8AF5B93E2472E21139E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 e776c1828a35a2fe4bf250c3c3c6eb83bdaf45ab0c9f7dc286e684fa45a44448
MD5 8afa62aa3f21d8c442214ade1830adbf
SHA1 ded70614f35acc63374e48bc67a1e24631cd4fb8
SHA512 abcf72dbbc69554ba35b999fc4315cf7ba3df80fa6a8dc0b7af8637cd0216da015808f017db19257a12c21a56fbc222a0d5fc6d06e467e579c66d01ae0095bff
SSDEEP 192:mRGcBzc7xxYZMnHv7+FpAPRp2kN0f9hHsb+WNZnGL1Ds2l2+TM2yT2/ewCauaVyr:mRGmzcYaP6FUXebwK2rP2k2+ade
TLSH
T1FD52D7AFF934293B5CD6D21AF951B71AE7F6002161841D88FAFCCA1C15E7ACD221B41B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 d7bea64d2dd9e571f97425f2704c71d65206513db7b9cb5afaa3fd024c7d6a89
MD5 16d35543911bf5a10bab1c08b0ac6e87
SHA1 e1ac68706c11c75c86ffbb2c47bd91ad0c486f04
SHA512 fb6fbab7da175fa1b3b7d4fe0fe2f30dd06abdd49cfbba552f0506006fd0e91cdf1d41aa85ee4a3e38db3681752a9c1f670c3c870f48f58d289f8dd93f3e9528
SSDEEP 192:mRGcBzQ7xxYZMnHv7+FpAPRp2kN0f9hHsb+WNZ/Ds4TM2VT2/ewCau4VyIsnAUg8:mRGmzQYaP6FUXebw+Z2J2+aP8
TLSH
T15E52D66EF934293B5CD6D21AFA51B717E7F6002161841D88FAFC8A1C15E7ACD221B41B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 a4d4a382e490a3dbad79799362da9231ed54f3ba5552fa19c0b99e50efde08e5
MD5 537e7ad047b97632ed3945d36b7b73ea
SHA1 890f1ba2acff45861bcf633f05f826ef0d832aae
SHA512 b9451ec06786d4f6b2c72288bc2efe86c9c892582202b45da51da4366692bf557c51db9ef9622a76673aae2b5b64c345d36cf1003f227849161bbe6492f507a2
SSDEEP 192:7RGcBzB7xxYZMtHv7+Fp7PRprkn0f9hHsb+WNZntSACDs2l2+TM28T2/ewCausVK:7RGmzBYQP6FJXPbwiALrP2G2+aRe
TLSH
T1FF62F8AFF834293B5CD6D21AF951BB1AE7F2002121841D88FAFCCA1C15E7ACD221B457
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 5bfc39344c150e1b7053fc2cf307cd86dcf0fb93a4014f507de43489dc556d27
MD5 b84a3c9ec9440dc530529c35259ed002
SHA1 e044273686923fad3c8f37bc1aa1ae3432db5c75
SHA512 44b67ebf4c3078ea1ff975b2c0d6bbaa6a7f74ba5bce6763e138ac8c5d06d83238171277117ffcc4890923e7539e5fd8ed800a4a95524e34729b709048d704f1
SSDEEP 192:mRGcBzB7xxYZMnHv7+FpAPRp2kN0f9hHsb+WNZnGL1Ds2l2+TM2yT2/ewCauaVyr:mRGmzBYaP6FUXebwK2rP2k2+ade
TLSH
T1E852D7AFF934293B5CD6D21AF951B71AE7F6002161841D88FAFCCA1C15E7ACD221B41B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 82f19bdaa200c3a3056c6486f8d9171c832143077338572b10c4c0ee03580c4b
MD5 80e775e497e26256725722f158c1a7e7
SHA1 24ed3e37ba5a437a46beacb73c33c43eae3aec98
SHA512 09ac01744410777e518bc948ab2c8649e18de947108d5d4afd77f70e32dbc68ce133ca9306edde725939c3c02ac6e14f160c2e4f358579e678e152b19c349bfd
SSDEEP 384:oSj0X7KxkXqKf/pUZNCgVLH2HfgslrL7pLuLcifyTXOD0b+ErU3wRHGU/QT:oy0X7KxkXqKf/pUZNCgVLH2Hfgs1L7pY
TLSH
T1E77219676C4C9E3B0FA4CACCDC16BE4FADB5024B65D9886843FA582903D5ACF11061FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 6d6110a1bc1fe4bef9c403ef2fdcce3dc341121eaa662960eeb870f11179f6b4
MD5 ed0626eee9c1224471596dfb9d7f990f
SHA1 f87d2b45d95413dbd5d3109b556f4af74a779091
SHA512 18f9eec28b2d17de90eda0c7ebbb3e7716932cddf230d627f79c5f48098616ac7e46bdea45d296fc713d14c31411ad77a41cf218c0a86ea3738a68ac12255b90
TLSH
T18EB0121080015541C08302B111825888B2145F108709130193E46971D8265F14024151
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe594685.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe594685.TMP
Size 96B
SHA256 968393b46051c4d8a8a7e66b8771848137023f99b103983e67c30f82a809518e
MD5 db2cc7abf5f1edf7d66ad3b7ad6a6453
SHA1 7f0aacd2b1ec5b5bd30218e2e1397d19fd8db8ea
SHA512 d7c511893b472bc250264e3a87f884c59cd41a7b5ca71e61fcb119edacde08c69decefd48c18ec33dd8eed6d9bd9a39b26725bdbdf96588f7ab7f98fdc5f50b0
TLSH
T192B022C8E2023282C0C303B02880A0C8B020FF30C3030203E2E02EEAEC22A330030020
MD5 SHA1 SHA512 TLSH

Submit Download

d8f0aa4a-952d-41a3-b23b-69f53477f295.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\d8f0aa4a-952d-41a3-b23b-69f53477f295.tmp
Size 414B
SHA256 ae27cc4db2a7ebb70dcedf3cf098f86a71fd5995ed2fcf06626bfab67ab20576
MD5 d49a889156686225e38f80187b01838a
SHA1 711d16edd3717f8ba8c335e0802d2177c519e8cc
SHA512 0539db5a021a9e56aa0b879a3a03aace97e927b7a7b8dc13084abb221f96df882bd4502e920aae9c1787342ff518de167441b036e7335dd8a47e200401e88b8b
TLSH
T1A1E0E5AAC836E8270CFE071850904746E64413572B804D1F7A3D820D9F7063F4685C1C
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 197KB
SHA256 13a0e99f744800255d580f5fece6dc8a1ab7642bad4109a05b70eb68e2775562
MD5 844bba8dbb37be282497327ba1722b02
SHA1 fa90d5a75a9d4f4885ddbf53dc67b51b28873256
SHA512 663938eaa71de5d942baaeb40d685191977cd1a6297c86d5d8e2dd54cc2d4b9023d7197bf0f89da0b9640c57a7a0fe283193b610a339a879eea87bf93c73bb77
SSDEEP 6144:5dyW0YRSVP7ExboymtdkL++JjcMW2VcVLw:5wHP7UPmjoOMWu
TLSH
T1291412E1A906F9BA137AA3738017DD288CF2CCCD201468BE50E66B1E25F935147DFE61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 198KB
SHA256 1a432938fd09d05d4dc8a89f0824c7e10747b61c3b61d7faffddf387204146d1
MD5 502a89664fc34aafaa195ecaafd85761
SHA1 8e96aa1e133cc792434c6507d6e7fa9cb8cb0f40
SHA512 8d313705fd39662a297d0d9d1adfb9e9497af86c9faf37e094bfb61fc248b2a570d33baeb495af6135e32ac2b91623d997ff911e022f9ffe6d1ef77f7680f470
SSDEEP 6144:5+aW0YRSVP7ExboymtdkL++JjcMW2VcVLw:5HHP7UPmjoOMWu
TLSH
T1511412F2AD06B9BA137AA3A68007ED198CF2CCCF241478BE50967B0E15E935147DFD61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 90KB
SHA256 68e8ecfeef913c1f87ef6c332639cba052ed246f6a34553efb08207702a78065
MD5 255f945c4c028136d6c12ab88a5957d5
SHA1 b1291fc3fc87bd8472d1d98b1cf14435c5598813
SHA512 0f7813605f48d8c89a82513c5cd6f818a3b3189dae223971a90e503b5920d815f41bce5a6a2ea5d4792a857cf7953c1c863d8d786a3bd37f4bd5356305976bc9
SSDEEP 1536:eGp0oP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNM:au++J3qUQm08KMWF0bFTcVHr6zD
TLSH
T10A9302B9991E7D75636AC6D690079CAC88E3DCCE1514117C30C7AB1E24BE393A31B8E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 198KB
SHA256 498ada3252c9d16361a7ecef336edb42795f2c7e8aba95863a4cdb1fe713a85c
MD5 5a15b76502fc6b9fc603a03bf315ee8e
SHA1 b69d15a11f06372fb90016c716da65cbedaa8c1e
SHA512 7e95a89ceefbd14099c3a5f4f10d8fbee0ae4db1e75cc4bfcdc9d2a74734944bea381a86481cd595d2c7e9d4d1464a2445f9c9dbb4f7e45146e79466aaff5467
SSDEEP 6144:4+aW0YRSVP7ExboymtdkL++JjcMW2VcVLw:4HHP7UPmjoOMWu
TLSH
T14E1412F2AD06B9BA137AA3A68007ED198CF2CCCF241478BE50967B0E15E935147DFD61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 197KB
SHA256 f936b924d18d8dc1b2dd3be2887893d0006f28fe9d27fde01e6f524511c1e7d1
MD5 933b3f3f08ddf9719ac33aa19078a1e5
SHA1 5cd936c749958a6034137bcfe216fc16f3dfe4ba
SHA512 81e14593e1773f6ad75f78e045aebe748af11a3af9ff62a79aefba50d7a71e530079de7e2c82ea2e65908afcc5c675258f951888178b5085f339f72e5ad9f785
SSDEEP 6144:QBiW0YRSVP7ExboymtdkL++JjcMW2VcVLw:QYHP7UPmjoOMWu
TLSH
T1E01412E1E906F9BA137AA3739017DD298CF2CCCE201068BE50D66B1E25E935147DFE61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 197KB
SHA256 7e9ea5157e586f01f4597966ad9066739924477caacaf9958abda19d598ae3e9
MD5 7cc6e2095201073c9e25ce571be546b4
SHA1 8acfdfc9637293a967e267ad7c8c085e55cecfe7
SHA512 7cbbe36b4e11bce350527b631975b5a810ee54a8abe53ecdba7c0dea89dc6465d64e5ae80b42670290a989de7ad504d695f45c5de5be18f1ea40890ca86104e5
SSDEEP 6144:SBiW0YRSVP7ExboymtdkL++JjcMW2VcVLw:SYHP7UPmjoOMWu
TLSH
T1C11412E1E906F9BA137AA3739017DD298CF2CCCE201068BE50D66B1E25E935147DFE61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1eac715bceeccb15cc45a13a9b914a80ac00eeb9f178f8c94511c17b32720b1a
MD5 b42dc01f081a5fcaa564011a4fcbf9f9
SHA1 8bcee7db87d1cadc63412a4981a1a46bc8ac9a01
SHA512 70a6ffe00e23a197554908a478c6e06671c1c239e2134c7e2eb172c03b4237bd91a7d62847a63e20268dbfb9c9b77ec1b8df3b9c0e528df0aaa3f9289c5d6452
TLSH
T101D0803D1572ACB4C485DA714456372B7F1DC8E24DC65F116462357D4DD700186D72D3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2172811336537a33607e0aadb9c5ba8cadf28b2a4fcb84d32213c685b1c34544
MD5 c6c88b3fb919f1f75228e4aff327fe5c
SHA1 70428f4ae69437730ef237674398113e1a3f3017
SHA512 1cda50c8b022751e3d3a7c73ffc9350fe02786e3000fa887544b774366bd092e165982f8e834c7eb67dc7a078a4dd76c0d5370912b7c3c7b95fc731b504ce5e8
TLSH
T19FD0803D1572BCB4C499DA714456372B6E1DCCE24DC65F116462356D4D9700186D72D3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ddeb419210ce4199db863146447f6cd46ace6bede2983be20027867088d00a20
MD5 0bcc8744c7d45c98094be42414b04535
SHA1 d1f718e5857f4cacc569fb26c1eaec301ab26152
SHA512 22610ccf9ee91e5809424a69309d3d096fd06c1e16a1c55abfc19f0498b78d1f90a5d213ab40bee36363584e6e4ac126766fceb1e8b589b6e46e9c87dc3b0440
TLSH
T12BD097342676B8A0C0050031882123332F0E88C12CC74B11F004909C8E6E00083D12C3
MD5 SHA1 SHA512 TLSH

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 e53d8b3b442756dd8fcc7daefcb4ae88a05bc5ae87dbbf5375251280cafe706b
MD5 3f3237ba4350645a7f203b8479a59477
SHA1 d727cfb3dbd29a0a3a3841be2be0610188d10c76
SHA512 81f2370832fd8bcd1ad4d5708738959867685a68aef59291121e6c7ac88cf3c7a5dc13e3cca5cce33180464e080c893b049c7e9183eff4ed5638ad6d895d581d
TLSH
T19AE02BFEC86199670CFD0B2950604A46EA1013571B50894B3F3D820C8FF0B3B0685C6C
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

ecafcec1-cf8e-4f22-9389-78c1f985db8b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\ecafcec1-cf8e-4f22-9389-78c1f985db8b.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 0150516e89972531a65b1a29f3c6cd979841cc179199ba7cac12977398153335
MD5 c3982cbe506842c00e655f79c3843eff
SHA1 a00e753146bf3354e835220f5878f06fdd6eed8a
SHA512 8f47bcfa013ec3d9e1df47749470d6081511631b5df62a55f52e0415deeb35f6f837e159024b6422a193dd2100b6ff63111684f6bc951107e53fea922c07d839
TLSH
T12021ACF743B455AE9B11D1F0EA187E2F8E6D0011435C7DEA85F06E1793E3461E041A5B
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 28018d57d768691a7c79a5b90cf63dab34cba2fa7dc5925cc70a8b9e9f030610
MD5 a00e78779b68e55dfc6ea1f4a02caca6
SHA1 49f7d25340aeb6c8bd53497d29c4900c79d59bdb
SHA512 e4344b6133dc1832bf40b582ffed462588b229f0f9c75277b4787fbbfe37beaf6487372f520f03e4819c6b8e595f0bb604aa7eb11d785e30c97b71d1b9328ea2
SSDEEP 192:sxZrROyMqZ/K1Ml8Ycn/fLsbRWpVc3Gi2IIDPpezodpW/W6+WNGY0ETFnHevIgZH:sxZrxGn/fLsbRWvc3X2tL/W/bG5wEZH
TLSH
T13B72F80A6A38997B9CDBD209FA457F53D7F9153391904E449AFCDA0C00E7AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 3e95ee95f547497d4bebee558741758e3ec464143ede6590387506c6f698a5a0
MD5 26c4fbfcea95a40a0864edd7521d92b9
SHA1 2a8866af9c2091b53b7f2454e56e199658f31ce7
SHA512 c5af48d5ea740ce7fb282ce76ffe741bafd6c028c71e624b72b2d2f8667ebf786baee6a9df3aa11eeb6358495341625e73b319bb0f56884a0ade58e09648dc9a
SSDEEP 192:sxZrRLyMqZ/K1Ml8Ycn/fLsAWpVc8Gi2IIDPpezodpW/W6+WNGY0ETFn05tIgZ9J:sxZrwGn/fLsAWvc8X2tL/W/bG5wQZH
TLSH
T1A872F80A6A38997B8CD7D209FA457F53D7F9152391904E449AFCDB0C00E7AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 37KB
SHA256 8ab26e90b12eaccb690711660f15cf77f9504eb95e7020f37728ecfef3811d9d
MD5 d8717fe813f513ce92b3ebf97d63bfea
SHA1 5d1837cc41fd95b89905416e261cb0779dc17339
SHA512 9428210b609e379d3837e858614f48186edef1753abe2d16d318ceb1bedc615b304b1a4e8453a24a38d7ed76e0355959df8b2d440f34ea229f0cfa22da91edc6
SSDEEP 768:UgjXV8Zp2+m7pLuL/AAWRmAoQ7k8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3BDwvLlC:UgjXV8Zp2+GE/AAWRmAoQ7ku1jaKBDw4
TLSH
T1F603FB3B280CCB7E4F844E9CEC26BE9E6DE8018B9698895447EA444C03C76EF551B5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 def8f00f4b891e0e617d81729489aec03a0dad09d943e5c3d49536ac4a9f5414
MD5 f906bf92d06d6e74bc89e81f249be47b
SHA1 281d72d97bc33f963ae32f8b8c3e7acea49a5596
SHA512 b6f8bbe2673e69b7a72c87ed06b51bed7e31e2d396f11ac1fad0c4c05170fabfa9f764ab208369494350f2a6b62001420fe5b0cf2ec11ee06b92dba67184948b
SSDEEP 96:KUQAK926Wh+KiQRYAKJq+2xWKqgZ8gKRuiqsQKJyy1aKGg/qQYKxqqvOKMMaa20/:ardVTNBbfw8nM9fgzNJ9dvz9r5tf
TLSH
T1A0B24B51353B07C13ABE259A81A1B5AF56C230633118E42B3BF850EA4F67E24DDFE5C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 d1f7f68ccc17eedca857263abd5b0c78a902a2bbfddc710700f6cf8fd5802f06
MD5 9cda8f6d361ca10567c9bd079aae213b
SHA1 e2b67cf8639dfe640cdc697ecef27a0f3f2eb7d0
SHA512 7c0482eb2170cc4c3f07b3cc70e3b2505db02dde05e5ba663217b874bb0fa944a379a239db002fba1b66080337f43b4ba4d868c3dc8721c12e05bf619c85ca59
SSDEEP 384:nMiFavqMg38Nr8TUNTUlIxBvHTWwGBrfRK7ge+v27XVdnS4mtmEerNlk+5vI+P:3Fayv38wgCw+K0efXVdS4smE2j
TLSH
T135C24B75E898DAA7EDE78FC9A7097B16EEE00197D98C4AC4DAC81D1E00D719E130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 75bc20933867b724d1da596754d957a2d77f627c3e27938db1ded9bc51a52bed
MD5 63c57ad731a94e4e626c747c8a700e9c
SHA1 398549e08c01bcdb009077f4b6990daa1ae07337
SHA512 e88be0f43492fd2e8d93536795986d4ef870348985089a5245580813f5006642e67c4b804d832df13346b1dc9b81d5369996dfad8477bc10cefdf78d4df0a31b
SSDEEP 384:nliFavqMg38Nc8TUNTUlIxBvHHL8BrfRK7ge+v27SzRU+jf+QdnS4mtmEerNlk+x:sFayv3Dwgj8K0efStUMfFdS4smE2j
TLSH
T1A6C25B75D898CE67EDE78EC9A7497A56EEF001A3D98C4AC4D6C81D0E00D719E274FC12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 ad6ef4f42c5765cc3671f65bfb41c7c5e697418ff88d58eafc195f668041ec76
MD5 5dacb0c9087319b6f0a1c6b6cb981f53
SHA1 5cb253c3a32616165bfd5981c39ef23dda0018a3
SHA512 aaff8f5ff9c15100f73ea7e6f21c52017741b7522596686dd63d01a12aac13b5547573a4586a424213c7a792611990fd6e8d763a1cb802b93ceb8327c2e0ff73
SSDEEP 384:nciFsvqMd8NY8TUNTUlIRN8vH1ufBrfRK7ge+v27SzRU+jpIZWjJZVKQN/Yypsar:HFsy8zwgvN/K0efStUMpI6JKQNAya6f
TLSH
T106E2197DDC55897F98EEBF89A70E2A169DE00177C9A84998D7D50F0D80B708EF30B852
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 655846d1bbe9f7904c32165bc91281930b2d8fc9b5072538bda753bc605799f3
MD5 6fe2cfd0a88f43d78562759e2efe0fa3
SHA1 ef6d4c12e5f2c39e06249c306e3cee7e633ef84d
SHA512 d89da213144841db826bc547d2a4d3252d7545f2263288c314303f0c6eb937b007bd45e914ea7658cf1b211d86dcd7daa2596b0d4d8558ba4a5ca5f3e0606095
SSDEEP 384:nciFlcXqnE8NU8TUNTUlIRlvH1zfBrfRK7ge+v27SzRU+jGBrpsaF7Ig8:HFZEPwg1/K0efStUMG9al
TLSH
T1CEB2187AD899CD67ECEB4EC9A24A7643DEE011A3998C9EC4EAC85D0C00D71DD170FC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 90bd0cbe8f7d0b40b27b5a880589196a0945ae34a43c6f4314a0321d1c07c8e9
MD5 0371745964d773917d203aef0af99758
SHA1 29e33f9b6c2d58f08c80d901848758e117485ce1
SHA512 94abca8d985944f0ab18d03f543d3dd6a878d87190b80fb78a71e216db6c8b30a83b6c0d9cee52ffbec2e8ce1d1d4612f3b0acd1fc7e6de94a0abaf7ff720982
SSDEEP 384:niHiFlcXqnE8NU8TUNTUlIRlvH1zfBrfRK7ge+v27SzRU+jGBrpsaF7Ig8:nFZEPwg1/K0efStUMG9al
TLSH
T164B2187AD899CD67ECEB4EC9A24A7643DEE011A3998C9EC4EAD85D0C00D72DD170BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
Size 147KB
SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
MD5 9c670f04d98ab7404f16423f6ee6cdfa
SHA1 8d01079b2d065731df8a7ef52f447cd4b7add353
SHA512 102cee76d9dfcfe91e044f529672fbec042b50c5db55a3cc137197b2013dd7f81e47f50dbb0db96cb621c5732610e1eb553c4146837c11075c7c4dbd67546a3b
SSDEEP 3072:F7R0M+jCozOtDTsjMcT0JnFjkbxnEbm/+OdGmlVVklFHEpCm+:F7WxxzyDTM0JnRkb5bJdGmJkvkpx+
TLSH
T12DE3E16D3DE6DE1FC41B58F53E64708BC80E8F0B820A644FB64988345A60B5D1BD6AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 54f761e00d363bd15db7bae3cc55144c80148a5fa1db7c3c2049e0e406a9142c
MD5 b1ac780361002049b0a10a7fd30fd809
SHA1 0ee0a7dc27fd175ab7abd6e5649890be3e2795b5
SHA512 1bd8b1d2dc30bc62728d3d08085a446e8c037b02499687affa9a0bb18c6bdfee19104eabdcd8a52c2d0b542046abf26b7fdf81815037d4923e31231b0dfb7d60
TLSH
T156C02B5538F9488C2FA5257ED238092E12E4C912310022B0002ED804103465C13A0C2F
MD5 SHA1 SHA512 TLSH

Submit Download

65783bb7-ee21-4025-a6e7-c4e50f96ec0b.tmp

Path C:\Users\Admin\AppData\Local\Temp\65783bb7-ee21-4025-a6e7-c4e50f96ec0b.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

dd_vcredist_amd64_20260429153401_000_vcRuntimeMinimum_x64.log

Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260429153401_000_vcRuntimeMinimum_x64.log
Size 2KB
SHA256 3ea3827c4ba7f3b6ce9a96f48dd6a176794248e0d2644d15beafcb63300ce28d
MD5 02cb9623b91358dee6632b7145d383d2
SHA1 1718e643ebbec058fe07bfe8e2b9da2ff04fee6f
SHA512 28afc2cacc5c9d176b515817bc160597fd0d8e58524094756cd851990ad4d2f3199fa2de319ace450d1cc71b1f810688b252f3ab69674f67755139a3e3ef39d1
TLSH
T19741D4601BD90D0BF2F35A479EF3C4928A77FCC258359B4D224A835A466BD045CACB6E
MD5 SHA1 SHA512 TLSH

Submit Download

dd_vcredist_amd64_20260429153401_001_vcRuntimeAdditional_x64.log

Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260429153401_001_vcRuntimeAdditional_x64.log
Size 2KB
SHA256 da8d06d5b97d8349c5bf4b5410f2417b908dda164a3333e4aeb1563bd0b46780
MD5 b22d094f15d4354968ef12408b86bfd9
SHA1 dc9f69501ede23a763a3960b0c74fac8bcb0ea11
SHA512 55a42a225313fcf9f1040e878534ee1d2fc9a407c0b576b0c383bbf5a642997c661586b5f65681ca5c2f8cc0062dbb97c30972862e747626c713c9997afc44cd
TLSH
T154411C752AE90C0AF2B36A475EF3C0536A77FCC27934CB0C6244431D06A7D0059BC76A
MD5 SHA1 SHA512 TLSH

Submit Download

dd_vcredist_x86_20260429153238_000_vcRuntimeMinimum_x86.log

Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260429153238_000_vcRuntimeMinimum_x86.log
Size 2KB
SHA256 cef71ad01ca76aa2cd7a770cd7f0f4483a9eb1675b26da3f382ee158698e6153
MD5 300b5269c8ebecf71d2dc91dbe9ada90
SHA1 a234ac28fc62f41d7f79a3c6c0bb34b283b452b1
SHA512 94e9ea8c840afc8597be4d1689d12f547060dba393cbfc4913ede0e4e47d8a42eb80d1497f365cbad061197de5783c64811b1d5bac7bd4b5ed3702c620afd8dd
TLSH
T10F41F7552AE90C46F2B6978B9EF3C0529F33FCE298358B4C62864259066FD016C7C77E
MD5 SHA1 SHA512 TLSH

Submit Download

dd_vcredist_x86_20260429153238_001_vcRuntimeAdditional_x86.log

Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260429153238_001_vcRuntimeAdditional_x86.log
Size 2KB
SHA256 651c9abb17723a6c8f905840e79df980679bfda961af629627df0f03a50f96f9
MD5 0f0d57e499bc0a68722c4fba20b0f242
SHA1 d8d04e72c4da8ffea43e0580e0d4c38dc09807cb
SHA512 563a76344d482e10ec51cd9531dc03bebac3663547b25ef493f50f2d9952de2b256b69762311d9146ef7000559014cf207e5a1fd031a2916461db4cbc0889326
TLSH
T14041E6601BE90809B2F29757DEB3C0669E33FCE66935CB4C22464159066BD026CBC77E
MD5 SHA1 SHA512 TLSH

Submit Download

compatibility.ini

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\compatibility.ini
Size 198B
SHA256 252b7fff962848c61092e82a3d87adca163849767713a93ab533bb397f1f53bb
MD5 ce9ef13caa8a74c25157b184aa038475
SHA1 db03a9935d8bb3ce6b120aca98feade536805160
SHA512 0f6f5053e78167ef5cc5fa70ed3a87dd116df0671a590299277a197341bed983e3d77e37ad2c33cd4afe880fab9ed1c7f7502210040617a01f97a81c1e1d4f29
TLSH
T1C1D022818BC7848C9D4AA8E4537C38086BF2EE0E0604492A32827F0B4164F09023C3F9
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 9d4eeb825b349094563ce8822d46a7260e25c47d27c741359e4c0b4985f4a402
MD5 f928337e3c3f889c4d1acccad898f6ba
SHA1 49108049d2b7167354d25bf5c2edc08f041de4b9
SHA512 cf8543644606e795b69455288b1e4c405db8f748bba981c07c575f430b400557285807f0f013707f15045aa58f192f3c8af0a79fe3b367edb876af5bac262bbb
SSDEEP 192:K7Ov5zboHOZ3hyjHZ51d66Joz0dzgCl6mc0dz:PbouZ3hyjld66JozQzgC1jd
TLSH
T1E4E10EA4F6288A3BD405027BCDB61F410F39384A988E3F1936DC645C2D562DE3B8E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 df9e272ac5530505bf24f7bf86bac49345edb1052d9ac44fea72ef65361dd437
MD5 2124862f6e80215af4198996ea311d2d
SHA1 fa2d69dccb1aae5ac701ee13c05c90f003347a23
SHA512 feb3abd181a399faa6143fe7b2623a1211b163a92046bda472fcd94a28c09ecdcf4d821803064103c1f2fca8de6a66578bf7426360942c59d023cadd20cfeddc
SSDEEP 96:iFN2FiFArFq/dd66Joz0dzgClKtmc0d/UU37SdF95/7bkW6QXjrcE3hyUR6JgWZ:01d66Joz0dzgCl6mc0dt7Ov5zboob3hU
TLSH
T193C1C964F6294A3BD449023BCCB61F500F35784AA88E3F1932EC644D2D562DE7A8D17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\datareporting\glean\db\data.safe.tmp
Size 3KB
SHA256 b40d18f5dacb703ba985097df43b3923001adff884dc3ff9d95c15f7ffd0cf4a
MD5 26d5d7dae336c7a1d65367cba63911ca
SHA1 2c5eb4d485e7e03ee7a34c88e0da03fc64138937
SHA512 7b3b97487e791c47c16984864422ea7219a0a93bf731aa30c430d96995ea0fd62c17c0746616a0b6d71cdd35b607f258707dc30f6dfbcaa9bfea88d72e73c2d5
TLSH
T16961DC58F6288A3FE444413ADC965B405F347416A4AF7F1A36ACA04D1E5B3DD7ACD03E
MD5 SHA1 SHA512 TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\datareporting\glean\events\events
Size 1KB
SHA256 c060e16fba5e0048cae37adc33b564fd691b4682512df1f1cc75a3c66b72bf9c
MD5 a4145f01e1455ba7fcb62cafbd13e53a
SHA1 1c58050ddbe3c5dc57e73d82b06a6522d348e159
SHA512 b444aa69f3458d26aa942356d2067ac68e725fe9a651adaf2be669b09722f92352302dbdb45258513850de3b4261f30af1a164e091a03586a0299b8671921c06
TLSH
T15F21794C39B88D2AE8D7F29C7955028E63688E0604972C430D03DFCDCDD6ADD326A4BD
MD5 SHA1 SHA512 TLSH

Submit Download

00686ece-2473-4f8f-9e41-749f96cf189f

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\datareporting\glean\pending_pings\00686ece-2473-4f8f-9e41-749f96cf189f
Size 883B
SHA256 05fbd4c719781942a0ac7b88046734da4b0ff61b3130e85898cdb091d64be06e
MD5 742caf87b35153686a5166bc92e90ec9
SHA1 ba9855cb47cbd06673b4553fa8914f3ccd815fa2
SHA512 c5595e3d14fae3c2d29f56953e2a6845f2af3766f78a2c2f9308087f53b0556cdf33e8c1288bc1b47c7fbf65181e609bca099eaaef129a305e89a8b5a39a6a18
TLSH
T18611DC81A23079E29C68A28BC8A53B0297A47923C0CA44143FB15D080E7A52EE75A657
MD5 SHA1 SHA512 TLSH

Submit Download

02652ded-3a1b-4e85-9dd4-6d5399538cfd

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\datareporting\glean\pending_pings\02652ded-3a1b-4e85-9dd4-6d5399538cfd
Size 235B
SHA256 0b6f6a89453f7ec6f8bd021d8cb25775f956436979a7c7a8611007b2963fa9b2
MD5 097486b44d0fdce45855710fce77fe03
SHA1 a0809c933d5970e0e9bfd0867390de8bf45ac5a0
SHA512 fad52f7173dce4b59c9675885c1bb9ce135c3a3e01e1f998eed53270f5bdd89a4644ed70a64790f4564b652e3c53b00ab72d162d885c0d6b0ba32cb12669c046
TLSH
T1E6D097D12488BB6C18140F06F0A028D234448C3310F49820DEA246749AFDDC4411281A
MD5 SHA1 SHA512 TLSH

Submit Download

7c666031-a45a-42f1-bd24-d0372fce6751

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\datareporting\glean\pending_pings\7c666031-a45a-42f1-bd24-d0372fce6751
Size 235B
SHA256 d5679aa24bb61030bce0693733fb909ea0f28c90f4f2e4b1321754c5ea8cb5da
MD5 834aa4182415ddf7d0ed2f2220a17620
SHA1 be36083376aaece64d98cda7097049d0142bb597
SHA512 d9b86955179568e3032fcf1a076360cab5bea97312de3b5d2bb30836d72631c33c14f1869752faa1b3b8390ff7436080aee4d0021c988c925ac3ec4764a06495
TLSH
T119D0978024A863AE88100F03F0B0BAD3315A8C3B29746810C652053CD9F9EC48121C47
MD5 SHA1 SHA512 TLSH

Submit Download

90641cc9-5fb4-420e-b2d8-3231c0f03d7f

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\datareporting\glean\pending_pings\90641cc9-5fb4-420e-b2d8-3231c0f03d7f
Size 886B
SHA256 4519f1285a669106469d8bbad9ba6c959dbc81f10ade84f0f25e8ff2afd4379d
MD5 318a6bb8ccc04dec3078377f6d239994
SHA1 45f640dcd06059b24d8228a0f5288732c9726947
SHA512 5ed0ccbb3735895929fd57a51530c9aaceb9ad4ef7e7dcf98253da52ec1b93c66b2aef5f38b88a3465768c7d49b3ed085880239c76285e04048de3b5fd63e32e
TLSH
T1AD110080A6647CF29C78E38B85A17B4287E47423C1C60D043F949E180EBA12FA76A717
MD5 SHA1 SHA512 TLSH

Submit Download

c55f9774-1445-4711-a1f1-727618b30192

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\datareporting\glean\pending_pings\c55f9774-1445-4711-a1f1-727618b30192
Size 16KB
SHA256 b882d1b36da168ab0a8587862e7519f35bd4f777d1607d70238d0e33111dd56c
MD5 8e8d4e47590af11fc6593fa65525cac8
SHA1 fa0b27e7f830de88ebe74816b7c9e95466f1ad8e
SHA512 b04fa8edb32835925192672a3126943ba3197c75f1fae87147f84f15f6101d864ef9a579682a3bfcf1957ac65cbce265035e0dbacb5b36b53afcbef81aba6bcf
SSDEEP 192:UyOj9GjrQHM+vfLOWhVfBLLdPc7dzVOUrBpgB1Y4bn0/uHb2zdDirK4pxu/JIq8l:UhhGjrQHnQ3aTPHb2BDirKrl8L1n
TLSH
T1B872C816186049BA9251E36894FCBFC3E6F538CF4C418FC99BE4BD4869EE06E512784F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c5c5bf57-518f-4627-bbb2-c4e64d50766b

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\datareporting\glean\pending_pings\c5c5bf57-518f-4627-bbb2-c4e64d50766b
Size 2KB
SHA256 f3016ec9ed315e8059c00336979944df2e7738d7ed5c83c75a129ed24e06054c
MD5 601f9f9d856234841cd3e749729f9656
SHA1 5b46bdd907ad23d2bd5e7feafeae42a0d8323629
SHA512 e088dbcd738fb54ed4694c235b8adeefab0cd04a72f85e8bcc69eedffb11a3b97a993b4f86dd14870b40438637be1358d7c5bcd16d0f1b9efae2d9540445912b
TLSH
T15241205C35784C7B9CDAF69D9496338E93A0890200C61D932E95DF0C8D9B6DA336B52B
MD5 SHA1 SHA512 TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\prefs-1.js
Size 6KB
SHA256 98d748d4295b763de498abe58b696dcd00df546168dce020805f8864a7a78760
MD5 39f2fa9ebbe2ead0167737db6157c64e
SHA1 a94eeac49d56bcdf22e5735f8d11e2cff143f3d9
SHA512 b1690dd520351e43790c9d946915897fd2951bcca405c32c6cc1e5ffd167b010332a1109d17e4bf45451462c506a280681a5e3dedfa2eb5ffd401de5264d341c
SSDEEP 96:xHiUTUAPqGqcUfCz1ObzS+SSlrdv9jOnHHCriDYzMgBw8OH8L4cnHVWZ:UwCRvfCz10SS4CaYzMgBw8Oqs
TLSH
T18BE11D7895088B7F74B6776CAC2888716AB2413BB7BF28C710B954C4055CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\prefs-1.js
Size 6KB
SHA256 37121f489bb49cd6a6915e1bd7fdf5298425b1a05827c499df327e085f31e489
MD5 f3d2f327e9c9cfe69baa45df2e28702b
SHA1 05d9653a41bcd59a9c36bee80138ecc14fecf663
SHA512 d9233d2737dd9e4601cca9362eeec8146e0371a0915539b11fbdba115f1cad263f5049f324bd24e2435cf331b41b2c9313ac1d5b27d8510c41aa7c94adee4a8c
SSDEEP 96:xHiUTUAPqGqcUfCz11zS+SSlrdv9jOnHHCriDYzMgBw88H8L4cnHVjZ:UwCRvfCz1XSS4CaYzMgBw88qL
TLSH
T1FBE12D3894088B7F74B6776CAC6888716AB2413BB7BF28C710B954C4054CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\prefs.js
Size 6KB
SHA256 d151a629bd28b7deef0528d341f1f988f8675196ab02e731cdabfe646f2fde78
MD5 71b3a272e5fde020bcb9e0b802984ebb
SHA1 2d4c52ed5a80911658c54f6ed163c83e79730415
SHA512 c1ea9cb774ac1b5ba83a5111b9e68d3a6482767f9fb350d228b3d5419eeed5cbaaccdbb572a978722b9cd034460fdf1b3adb8ae515d49f04a436b781b14bf813
SSDEEP 96:xHiUTUAPqGqcUfCKjKnjs1zStvSSlrdv9jwnHHCriDYzMgBw88H8L4cnHVjZ:UwCRvfCNg4vSSuCaYzMgBw88qL
TLSH
T1B7E12E3890088F7F74B6776C6C6888316AB2013BB7BF68C610B954C4055CF3842F96E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sessionCheckpoints.json.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\sessionCheckpoints.json.tmp
Size 288B
SHA256 b779351c8c6b04cf1d260c5e76fb4ecf4b74454cc6215a43ea15a223bf5bdd7e
MD5 362985746d24dbb2b166089f30cd1bb7
SHA1 6520fc33381879a120165ede6a0f8aadf9013d3b
SHA512 0e85cd132c895b3bffce653aeac0b5645e9d1200eb21e23f4e574b079821a44514c1d4b036d29a7d2ea500065c7131aef81cfc38ff1750dbb0e8e0c57fdc2a61
TLSH
T10CD08C83C10950BACE826A58B398BB509E3E00F271140142B6AC888C183F023418B803
MD5 SHA1 SHA512 TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 3.2MB
SHA256 1082f94253af22963d26726336fe3fa06c1b2cfc9d929991a242866e8187afd1
MD5 ff0f6c708de8f58a12573b885bdaee17
SHA1 d70cfa7cafcb37fdde6f660625bedb28a37d6520
SHA512 1bb512ee669bce0994c4640e28f1b03d7463e0cc53fc8091490b2d4dcd26103e6d6759988741f18556b90948c42fe5214e73b473b202947f456fee28e56ba3e4
SSDEEP 24576:gCWk+tIYI0Lgr363BDcYrVQpa9dfH9IQ8lQyZH:gjv7Lu6pcYrVEa9d/9IQ+QyZ
TLSH
T10DF52AF820D2B357F3414033A64593EB21AFD00CA467DE044BA956E995B8CEF9E05B7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unconfirmed 283168.crdownload

Path C:\Users\Admin\Downloads\Unconfirmed 283168.crdownload
Size 17.7MB
SHA256 8995548dfffcde7c49987029c764355612ba6850ee09a7b6f0fddc85bdc5c280
MD5 23985a8a66ae306aedf0a9feb1a3d14b
SHA1 7ee9442ceaeef605ea66849f042b8410433c988d
SHA512 b618f601a1989a696c8efa0208efd977a3bfe9a8df8ace8fae9eef20262240e7eefcb67ce466fe166bdc606d80d594d2de80b3b4e530749aab8e99f5cecd86d4
SSDEEP 393216:Sr3bJsxx3E2DiCLwmQQp5MTFarWznCY1LHRqLJ:S3mx3D585AI+WDCYZHRw
TLSH
T1D717333160A0413BFBF51077B928A2202E7CE73C2B5598BAD7D8AD1D7D6A84147FB163
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unconfirmed 911683.crdownload

Path C:\Users\Admin\Downloads\Unconfirmed 911683.crdownload
Size 6.6MB
SHA256 e7267c1bdf9237c0b4a28cf027c382b97aa909934f84f1c92d3fb9f04173b33e
MD5 84855eb74e9d7fd646f42137c7b93069
SHA1 ed3708cabffb4c52314eff81f452b7ae70e99d3a
SHA512 a6687ef328597c90093a4278a12a0059496711801d84a40dc730511badde3d94199368d57fdc0926d8a3e19d2d2aeec8fe58337b91cc69aeb4dfa251833ca5a6
SSDEEP 196608:ILZfOXtuDj+lkIbrhibcDrlC0OqatbB5bMebjA:MMgKeBbcBeFLnjA
TLSH
T1AD66233294644133FBF61173B938D0307D3CB72827549CAEE7D8BD5939A9886A3B7216
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VC_redist.x86.exe:Zone.Identifier

Path C:\Users\Admin\Downloads\VC_redist.x86.exe:Zone.Identifier
Size 68B
SHA256 10b5e0c965f5f3a06c919adddcb0a93458b0140de324b0ee96873d8590a98e9a
MD5 95382976d1d1faa42a3d1561498e4ea6
SHA1 a73de3ad4be0e5beadd5fe5ec4ef9e5bf41da233
SHA512 59f643930138c9f9064e469ed880eec1577086319906269ed9673f3424cc1ed6a8e606a249133ce03c48fec006aa48cac0bcdd970ac4f91849dc1baaf91653a2
TLSH
T130A022AB8C0003000A20328822ACC20CB00FA2230C2080CCEC8080C3AE803ECE2A280A
MD5 SHA1 SHA512 TLSH

Submit Download

vcruntime140.dll

Path C:\Windows\System32\vcruntime140.dll
Size 120KB
SHA256 184146852727a9db4eea06178716bec3cdbb1015c911f6b0f915b184ad7775b2
MD5 0d35c5e99871b4f02c490b9fd9dace34
SHA1 c2280e6285147cd8010becc0cd3a120fca0088e0
SHA512 114bc156655e0d3249b6f94af1da80528b6695630f548ab596dfb406f6ffcc65276c9f900b637ba9c244ba5a4331aa15d2de0672f6dcbd38cb49a206c100698b
SSDEEP 1536:a9pCUgtBAVcxStMXcfG8VwfmpcGLOI5Sv+vecbeQ6N7l9gEeza/yLzt:qyA+3EOfmpcGSdOecbeQ6Nx9Mqsp
TLSH
T1B9C37B4272B802FBC16BD274C292AE27FBB6B50687605BDF07AA86650F537D06D3C341
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VC_redist.x64.exe

Path C:\Windows\Temp\{2A8D73B6-EA44-4AA6-937F-DAF1DD40A03D}\.cr\VC_redist.x64.exe
Size 615KB
SHA256 806e6252db45be78bfc064eb9a774dd1320d8f9aa70dd746996a1d9ddf9b8fd4
MD5 e5237fba0388d7d5ac22e823da709438
SHA1 d772562f32eec346f0ba6260877a3caffc0d8dac
SHA512 af99bc56c4c1f1ed0fb4302a301a7a1a6a85baf8343e3abbfa38533085ffa3cc5fe5d004efeadb22daddc8f7800fb27b040eacbaece4a234b8fcf49e3a1e183a
SSDEEP 12288:P3mgqnIZuYfCYqFet4CovkM7wVYnEvIhqFxVKLxYGHLNJk:P3WnIZuMCxezot76gTqFxVKLxVk
TLSH
T11CD48D32A5614033F7F105B3B928A6303E7CE728275189A9D7D4BD1D7EA84C2A7F7216
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VC_redist.x86.exe

Path C:\Windows\Temp\{3C09283D-D70B-45D6-A1B3-44E01E2BA7AC}\.cr\VC_redist.x86.exe
Size 614KB
SHA256 3d37aa9541cbdab5361c4776304ded5a497a45b486277db14bbfd26cd436f997
MD5 b8e7d895c331e7cf60adf1663c16d211
SHA1 5561a123a862dfa434b2950ff2ea28fda7ac8aaf
SHA512 7af74f826cbefa2798ee13194c316f9811d93753c5876136b0cfdca8065e40faee03cbaa1042a03d9df6072ea2d4d0b875ec4a9e058b7c1facbf7482ca38ff70
SSDEEP 12288:B3mgqnIZuYfCYqFet4CovkM7cBYnERq8SoQ:B3WnIZuMCxezot7agPTZ
TLSH
T1FBD48D32A5614033FBF10573B928A6303E7CE7282B5188A9D7D4BD1D7EA48D1A7F7216
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wixstdba.dll

Path C:\Windows\Temp\{7B2934B3-1D08-425F-8504-F9A65BDBFB18}\.ba\wixstdba.dll
Size 191KB
SHA256 a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041
MD5 eab9caf4277829abdf6223ec1efa0edd
SHA1 74862ecf349a9bedd32699f2a7a4e00b4727543d
SHA512 45b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2
SSDEEP 3072:OXoiFK6b0k77I+QfaIl191rSJHvlalB+8BHkY6v53EfcUzN0m6I+WxBlnKzeZuqt:OXoQNb++gDrSJdr8BHkPh3wIgnK/IU1a
TLSH
T103149E11B5D0907AE7FB1A385938B5216D7FBA201B60C99E17589D6F2DF02C0AF35B23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

logo.png

Path C:\Windows\Temp\{7BE6F1E8-9155-4D0E-8FD0-3C84B6C7AFBA}\.ba\logo.png
Size 1KB
SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
MD5 d6bd210f227442b3362493d046cea233
SHA1 ff286ac8370fc655aea0ef35e9cf0bfcb6d698de
SHA512 464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b
TLSH
T1CF312CF34748B7A7D30581351471819AD242FFD8F9CE291E35CD5307664018115C75CF
MD5 SHA1 SHA512 TLSH

Submit Download

wixstdba.dll

Path C:\Windows\Temp\{7BE6F1E8-9155-4D0E-8FD0-3C84B6C7AFBA}\.ba\wixstdba.dll
Size 215KB
SHA256 e921f69b9fb4b5ad4691809d06896c5f1d655ab75e0ce94a372319c243c56d4e
MD5 f68f43f809840328f4e993a54b0d5e62
SHA1 01da48ce6c81df4835b4c2eca7e1d447be893d39
SHA512 a7a799ecf1784fb5e8cd7191bf78b510ff5b07db07363388d7b32ed21f4fddc09e34d1160113395f728c0f4e57d13768a0350dbdb207d9224337d2153dc791e1
SSDEEP 6144:K6EZdi6e93SuDeTKZxQfsRy26BqbUHYJe:K62i6eNSYeuZ2sRDK
TLSH
T15E24AF12B5D0907AEBFB19305939E5216DBDBA210FA0C9CE5348AD2B2E705C1DB36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cab54A5CABBE7274D8A22EB58060AAB7623

Path C:\Windows\Temp\{7BE6F1E8-9155-4D0E-8FD0-3C84B6C7AFBA}\cab54A5CABBE7274D8A22EB58060AAB7623
Size 840KB
SHA256 8b177ce7ea07fcf055dee844c567d3feeee40abc15cc5aa21acbf9e97a9dbfae
MD5 63ce93ae9e0008c3e913d742fce336d1
SHA1 cb683bf1e3a86ee865be0033d95e32b6b43515d9
SHA512 b71e948c3fa6bf224e24aaba21357d519ca2f4c5bfa92496d3ed386cf8722a67a832da23c20fb0bd98dab75ede5e9205ecc09b059ede662e9be9abf9bc8bcf43
SSDEEP 24576:NMGOKehVppofbOVioh2DAWHjwnJSA9OB3Mwt8qI7e5:MKY/OFbDlDw0AcxMwt8Ta
TLSH
T1210533CCC83FB706DA430D14E154ECD21837A698B818676F7E2B644A29F9345C758EEA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cabB3E1576D1FEFBB979E13B1A5379E0B16

Path C:\Windows\Temp\{7BE6F1E8-9155-4D0E-8FD0-3C84B6C7AFBA}\cabB3E1576D1FEFBB979E13B1A5379E0B16
Size 4.9MB
SHA256 951657e869eb42149ccaa66d4c3f4465ebd29c490285f24c51c8492993861c25
MD5 8d61eda1e9a0deb5d309098bf45f2f2d
SHA1 e4c171460fb2df06df53ffcd62a2aa1fee6c8d24
SHA512 565fc9ee145b96e12c0fd056009174ef135d560457ba0a33f65ec96f686250ea89ad68afb3a3e686b7cca7bf24e47f7fdf997c70cfa9122b210bb3dee8373e3a
SSDEEP 98304:E5QnIVB09bp2QtU51QYECjGMyLa7rr/BMDfaPr615b9dVABB8kv6JaQrm:E56IVBwv251ZECjGPuroE8b9dVABLvCq
TLSH
T17A36337BCC0D561A9DEE72579561C05CFE26F8D674889C2BBD1B9AA0017A00FF272C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcRuntimeAdditional_x86

Path C:\Windows\Temp\{7BE6F1E8-9155-4D0E-8FD0-3C84B6C7AFBA}\vcRuntimeAdditional_x86
Size 200KB
SHA256 21e993652e0cab41bbbc8c8a6df9baa1a25e9147a50700cf956e24e6b15f63d6
MD5 b03c4ab93231dda79101329f32100780
SHA1 f50c9558311a95287a882adeffc97ee5b998de10
SHA512 a2e706c8dbcead1fd994ea4f0cd21bfa8b61401dd812fbca2be426f1cbae96089c3d450c99bf06531732b20781922d8794ffd02c7cd2092483b05710c57cec19
SSDEEP 3072:E9laht5Xel69YGnfxC2WB/bEPcefrKROjibDPxriTMB:ilaZeKFxCnBheIdlu4
TLSH
T13D14AE12B5808032DAFE19351178DB715F3DBE608F54499B2364B6AD1E717C08F3AABB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcRuntimeMinimum_x86

Path C:\Windows\Temp\{7BE6F1E8-9155-4D0E-8FD0-3C84B6C7AFBA}\vcRuntimeMinimum_x86
Size 200KB
SHA256 15aa329341a7df570ca75769e44bb820a301e58ff566a00e1db29db7fe8dcedd
MD5 1905ab2a4d72e1a360308fe7aea2fa06
SHA1 fa28ad85acf7b997a34e63948c688c3fa0b1c65f
SHA512 0106605696b3b49210b4f345bd929fe31f2cec6bd28a657b8b3a3320faeee26e0c4c12d375850084bf4496b5aa3c004d7eb22cd7974bf1b38ff72facca7f9301
SSDEEP 3072:7t9laht5Xel69YGnfxC2WB/bEPcefrKROjibDPxriT+a:DlaZeKFxCnBheIdlua
TLSH
T17514AE12B5808032DAFE19351178DB615F3D7E608F5449AB6364B6AC1E717C0CF3AAB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Windows\Temp\{9C10DD64-8741-47A9-B5F2-A8842047795A}\.ba\thm.wxl
Size 3KB
SHA256 21a76eb702fe727ca06de6632be2294ed1caa9e1d3798d01ed1428e0f40e19ea
MD5 8d7baa10be22463697654d8aca5d2a1f
SHA1 67a757111562a216f8b7da791a0151bb1b0fb3e4
SHA512 9935a5da93d229ea879f1b1dba01ba42655517e68797bb65fcb0ad9c07f1bb92c2ddfbca702c256afd7cae81cac8d048e5f26db7bd9a5988b7098dab0f9dfddc
TLSH
T133519AA77CCF639028735125EAD2596A6920C19C923F2DF1FC4A914B838D532A373F57
MD5 SHA1 SHA512 TLSH

Submit Download

thm.xml

Path C:\Windows\Temp\{9C10DD64-8741-47A9-B5F2-A8842047795A}\.ba\thm.xml
Size 8KB
SHA256 8d67851408a62b0f04dbaaddc588cd98499cf3630ec5df9f7c0699f0d367f79c
MD5 c29a69f34ff31ff63c3ec6b2d4f903e5
SHA1 44e58eb62821c8d023bc91b51975162841647abd
SHA512 b46d13206c1a6064fe4857dc3de96769a773711fbdf5f8cc979216bd6b8e62703f1bdc3d3b86ed07405249613eb22697f0cdd039963f741bf2b13a4e3addd199
SSDEEP 96:8L2HdQG+3UzHfz96zYFGaPSWXdHRAmImlqFQKFBiUxn7ye5tM82rkO/pWL3nswP:ZH9z//S
TLSH
T126026AB546DDB801D232FB1166E231D27F126971C0C46E99F90C3AFB5FE1140A8B72AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cab2C04DDC374BD96EB5C8EB8208F2C7C92

Path C:\Windows\Temp\{9C10DD64-8741-47A9-B5F2-A8842047795A}\cab2C04DDC374BD96EB5C8EB8208F2C7C92
Size 5.4MB
SHA256 62a859b0db8bca416c7b6ad2ad5d2c84a4890a39e5d45cbec75f90a2fd328749
MD5 504150d63e81e949371003f6639fb1f9
SHA1 f1a665c19dcdc2d88b985935108c7a660a004339
SHA512 87fd95adb97a26dbf168523f838eb07ed9720a62c1f4c266bb33cbff66ef0993678f5f09c92cd85dde6bc4d39d1c781ea3879fcaa166ebc3a5da257f24e45a07
SSDEEP 98304:E7ja9ivJoWIR34H7Xk2aXpdoearQ3KmTT0oVGdrK8qqjlYxtO2mqvwiIBXcQ4qj:QGTebX8XpOea03WhLjn2m4cb
TLSH
T19B463334908E8339396AFE68251F7BCF0B319EAE2D315537B4D784158EAD9432534A2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cab5046A8AB272BF37297BB7928664C9503

Path C:\Windows\Temp\{9C10DD64-8741-47A9-B5F2-A8842047795A}\cab5046A8AB272BF37297BB7928664C9503
Size 967KB
SHA256 c346d91193246b18301cce532f2ae784fb377cb068d77bd22edec238e5746aa7
MD5 b1e651d0456b9fc783e96122e835f7dd
SHA1 8e8a4e9fc1a1e6ef34855b036c6737dad81af95f
SHA512 7fbdfe78c047dc6f73afda097a90da007a06bfcc490f25ddbc3958691ada652f2269ceeb7cec6f35d577ae4a8af41d30c407238eba65b7ee874e625dde4593db
SSDEEP 24576:zE3+9Eaeu1l82zQGjLhQPV7dr/UY/UEWYDxy24EBgbog4wi:zefeSoQGXSd5/UEWYDxnNnFH
TLSH
T1F5253379685DBAC058FF4E1A44C1F5FC08F7489F869CEF160E2C9F6A3E8AA741345099
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcRuntimeAdditional_x64

Path C:\Windows\Temp\{9C10DD64-8741-47A9-B5F2-A8842047795A}\vcRuntimeAdditional_x64
Size 208KB
SHA256 275d770dc4332bf6f3eae9ebc544ed07e3b169de791ba3d20ad50f04d9d222df
MD5 e4e29cb648ac2ea9451639e95395b9b0
SHA1 d32a6cd7705b5eba5544175d4a8f9f4da1abb29e
SHA512 bbf76d5008d263adb3fb38e67e6d703774a268d454b98ebb90b39766cb78ef7cf65d77750182ef5e24d13dc1792a23c425dd955f468a39204f68943e9838f547
SSDEEP 3072:u9laht5Xel69YGnfxC2WB/bEPcefrKROjibDPxriTqn:AlaZeKFxCnBheIdlum
TLSH
T12924AF12B5808033DAFE1A311178DB615F3DBE608F544A9B6364B6AD1E717C08F369BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcRuntimeMinimum_x64

Path C:\Windows\Temp\{9C10DD64-8741-47A9-B5F2-A8842047795A}\vcRuntimeMinimum_x64
Size 208KB
SHA256 57d65221ca418dabfcc6320215b2c05eec907690aa4f93384f2007eb9e1394b0
MD5 d44663b4fd6516e849efc5b7532c8d08
SHA1 57e9da2129e87a5433cdf585de8d23c0ca926365
SHA512 5a4f077f6f86b2a277641e36b37b77d11fdb7bf05fdcb7915b7b386d525b1e7a50985c3f1a826586064b2c70285519f9f2655e681820990fc062af15c7499394
SSDEEP 3072:I9laht5Xel69YGnfxC2WB/bEPcefrKROjibDPxriTLFI:elaZeKFxCnBheIdlu/2
TLSH
T1C624AE12B5808033DAFE1A311178DB615F3D7E608F54899B6364B6AD1E717C08F3AAB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1264-1053-0x0000000000F80000-0x0000000000FF7000-memory.dmp

Download

memory/1520-1-0x00007FF7FEA90000-0x00007FF7FEB1B000-memory.dmp

Download

memory/1520-2-0x00007FF7FEA90000-0x00007FF7FEB1B000-memory.dmp

Download

memory/1840-782-0x00000000006D0000-0x0000000000747000-memory.dmp

Download

memory/2668-1354-0x00007FF7FEA90000-0x00007FF7FEB1B000-memory.dmp

Download

memory/3452-0-0x00007FF7FEA90000-0x00007FF7FEB1B000-memory.dmp

Download

memory/4284-811-0x00007FF7FEA90000-0x00007FF7FEB1B000-memory.dmp

Download

memory/4304-810-0x0000017BCA2E0000-0x0000017BCA2EC000-memory.dmp

Download

memory/4412-785-0x00000000006D0000-0x0000000000747000-memory.dmp

Download

memory/5340-1050-0x0000000000F80000-0x0000000000FF7000-memory.dmp

Download

memory/5676-1052-0x0000000000F80000-0x0000000000FF7000-memory.dmp

Download

memory/5800-856-0x00007FF7FEA90000-0x00007FF7FEB1B000-memory.dmp

Download

memory/6000-784-0x00000000006D0000-0x0000000000747000-memory.dmp

Download