d65c3404d742df73fd4c608eabafabc926c944e99fe8b6454d9c5fce9a9897bd

Resubmissions

07/05/2026, 07:01

260507-htem4scx3r8

07/05/2026, 06:01

07/05/2026, 04:34

07/05/2026, 04:34

07/05/2026, 03:58

07/05/2026, 03:23

07/05/2026, 03:09

07/05/2026, 02:46

Analysis

user interaction
yes
max time kernel
861s
max time network
857s
platform
windows11-21h2_x64
resource
win11-20250610-en
resource tags

arch:x64arch:x86image:win11-20250610-enlocale:en-usos:windows11-21h2-x64system
submitted
07/05/2026, 04:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
rain.gif
Size 6.6MB
Sample260507-e7hedaa13n
SHA256 d65c3404d742df73fd4c608eabafabc926c944e99fe8b6454d9c5fce9a9897bd
MD5 9fa23f31f1b96217f6414bada362b7a5
SHA1 92a8f9e721ecd7956d9d908fd3e6b82dc57cb536
SHA512 66042b8c301018a779056ccec2db108b6913d06b96335b0f5f7316ac6b39a8693081aa02ea20a81fcf2dcc59ef8f8eb667c191903911977891819257a806c6da
SSDEEP 98304:EKpe4w3aSQottZE0XlQ1bIdjf5nsjibtE9SXpG5zEUZQvizpg8vT:RppwqSQozZYIdrZ2ytGSXpG5zHza8r
TLSH
T1416633ED955E033B3FBAED854E2564C5994B489A8AB04139FBCC4244B01F1F4B3B9E2D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

adware defense_evasion discovery installer spyware upx

Malware Config

Signatures

Downloads MZ/PE file 7 IoCs

flow	pid	Process
88	4684	chrome.exe
88	4684	chrome.exe
88	4684	chrome.exe
88	4684	chrome.exe
88	4684	chrome.exe
88	4684	chrome.exe
88	4684	chrome.exe

Executes dropped EXE 27 IoCs

pid	Process
4680	XScreenSaverWin-0.78-Setup.exe
5056	XScreenSaverWin-0.78-Setup.tmp
4800	fireflies-scr-2.06.exe
2984	SimAQUARIUM-2024-V3.10.1.exe
5700	SimAQUARIUM-2024-V3.10.1.tmp
6816	SimAquarium3.scr
6944	Midnight-Beach-v2.exe
7040	Midnight.scr
7120	fantasticfish.exe
5676	DreamAquariumXP.exe
6804	ErrorsAndUpdates.exe
5668	DreamAquarium2_win.exe
2332	Dream_Aquarium_Updater.exe
6532	fireflies.scr
1268	random.scr
4488	pinion.scr
5640	voronoi.scr
3480	unknownpleasures.scr
6976	unknownpleasures.scr
1648	Midnight.scr
5200	SimAquarium3.scr
4876	DreamAquarium2.scr
1004	Dream_Aquarium2.scr
7036	Dream_Aquarium2.scr
7044	SimAquarium3.scr
6976	FanFish25.scr
6120	Dream_Aquarium.scr

Loads dropped DLL 64 IoCs

pid	Process
5700	SimAQUARIUM-2024-V3.10.1.tmp
5700	SimAQUARIUM-2024-V3.10.1.tmp
6816	SimAquarium3.scr
5676	DreamAquariumXP.exe
5668	DreamAquarium2_win.exe
5668	DreamAquarium2_win.exe
5668	DreamAquarium2_win.exe
1648	Midnight.scr
1648	Midnight.scr
1648	Midnight.scr
1648	Midnight.scr
1648	Midnight.scr
1648	Midnight.scr
1648	Midnight.scr
1648	Midnight.scr
1648	Midnight.scr
1648	Midnight.scr
5200	SimAquarium3.scr
1004	Dream_Aquarium2.scr
1004	Dream_Aquarium2.scr
1004	Dream_Aquarium2.scr
1004	Dream_Aquarium2.scr
1004	Dream_Aquarium2.scr
1004	Dream_Aquarium2.scr
1004	Dream_Aquarium2.scr
1004	Dream_Aquarium2.scr
1004	Dream_Aquarium2.scr
1004	Dream_Aquarium2.scr
1004	Dream_Aquarium2.scr
1004	Dream_Aquarium2.scr
1004	Dream_Aquarium2.scr
1004	Dream_Aquarium2.scr
1004	Dream_Aquarium2.scr
1004	Dream_Aquarium2.scr
1004	Dream_Aquarium2.scr
1004	Dream_Aquarium2.scr
1004	Dream_Aquarium2.scr
1004	Dream_Aquarium2.scr
1004	Dream_Aquarium2.scr
1004	Dream_Aquarium2.scr
1004	Dream_Aquarium2.scr
1004	Dream_Aquarium2.scr
1004	Dream_Aquarium2.scr
1004	Dream_Aquarium2.scr
1004	Dream_Aquarium2.scr
1004	Dream_Aquarium2.scr
1004	Dream_Aquarium2.scr
1004	Dream_Aquarium2.scr
1004	Dream_Aquarium2.scr
1004	Dream_Aquarium2.scr
1004	Dream_Aquarium2.scr
1004	Dream_Aquarium2.scr
1004	Dream_Aquarium2.scr
1004	Dream_Aquarium2.scr
1004	Dream_Aquarium2.scr
1004	Dream_Aquarium2.scr
1004	Dream_Aquarium2.scr
1004	Dream_Aquarium2.scr
1004	Dream_Aquarium2.scr
1004	Dream_Aquarium2.scr
1004	Dream_Aquarium2.scr
1004	Dream_Aquarium2.scr
1004	Dream_Aquarium2.scr
1004	Dream_Aquarium2.scr

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\DreamAquarium2.scr	DreamAquarium2_win.exe

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000700000002ad29-1046.dat	upx
behavioral1/memory/6944-2746-0x0000000000400000-0x00000000005A8000-memory.dmp	upx
behavioral1/memory/6944-2752-0x0000000000400000-0x00000000005A8000-memory.dmp	upx
behavioral1/memory/7040-2753-0x0000000000400000-0x0000000000875000-memory.dmp	upx
behavioral1/memory/7040-2756-0x0000000000400000-0x0000000000875000-memory.dmp	upx
behavioral1/memory/7120-2766-0x0000000000400000-0x000000000048F000-memory.dmp	upx
behavioral1/memory/7120-2769-0x0000000000400000-0x000000000048F000-memory.dmp	upx
behavioral1/memory/1648-4518-0x0000000000400000-0x0000000000875000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\XScreenSaver for Windows\braid_scr\is-CO71L.tmp	XScreenSaverWin-0.78-Setup.tmp
File created	C:\Program Files (x86)\Dream Aquarium\tanks\moss_angeles\background\background.ageo	DreamAquariumXP.exe
File created	C:\Program Files (x86)\Dream Aquarium 2\species\gui_panel\languages\nl.txt	DreamAquarium2_win.exe
File created	C:\Program Files (x86)\Dream Aquarium 2\tanks\moss_angeles_v2\flowers_mid_v2\arrays\flowers_mid_c.fti	DreamAquarium2_win.exe
File created	C:\Program Files (x86)\Dream Aquarium 2\tanks\wabi_sabi\backdrops\sbd_pinkArch\materials\backdrop.mat	DreamAquarium2_win.exe
File created	C:\Program Files (x86)\Dream Aquarium 2\tanks\wabi_sabi\grass_area_1\grass_area_1.spec	DreamAquarium2_win.exe
File created	C:\Program Files (x86)\Dream Aquarium 2\tanks\jirawong\scenery\arrays\ground.fti	DreamAquarium2_win.exe
File created	C:\Program Files (x86)\Dream Aquarium 2\species\gui_panel\languages\fr.txt	DreamAquarium2_win.exe
File created	C:\Program Files (x86)\Dream Aquarium\species\zebra_danio\arrays\spec.alpha	DreamAquariumXP.exe
File created	C:\Program Files (x86)\Dream Aquarium\species\labidochromis\labidochromis.spec	DreamAquariumXP.exe
File created	C:\Program Files (x86)\Dream Aquarium\species\fiddler_crab\fiddler_crab_skeleton.ageo	DreamAquariumXP.exe
File created	C:\Program Files (x86)\XScreenSaver for Windows\hopalong_scr\is-UNHER.tmp	XScreenSaverWin-0.78-Setup.tmp
File created	C:\Program Files (x86)\Dream Aquarium 2\species\gui_panel\languages\de_RN.txt	DreamAquarium2_win.exe
File created	C:\Program Files (x86)\Dream Aquarium 2\global\arrays\noise_siny_1_chan.chan	DreamAquarium2_win.exe
File created	C:\Program Files (x86)\Dream Aquarium 2\tanks\jirawong\scenery\arrays\ground_left.fti	DreamAquarium2_win.exe
File created	C:\Program Files (x86)\Dream Aquarium 2\tanks\marine1\scenery\arrays\left_midground.alpha	DreamAquarium2_win.exe
File created	C:\Program Files (x86)\XScreenSaver for Windows\xjack_scr\is-NBQ7G.tmp	XScreenSaverWin-0.78-Setup.tmp
File created	C:\Program Files (x86)\Dream Aquarium 2\species\gui_panel\languages\fr_S2.txt	DreamAquarium2_win.exe
File created	C:\Program Files (x86)\Dream Aquarium 2\species\discus_custom\arrays\displace.rgb	DreamAquarium2_win.exe
File created	C:\Program Files (x86)\Dream Aquarium 2\global\wireframe_color_blending.mat	DreamAquarium2_win.exe
File created	C:\Program Files (x86)\Dream Aquarium 2\tanks\moss_angeles_v2\moss_angeles_v2.tank	DreamAquarium2_win.exe
File created	C:\Program Files (x86)\XScreenSaver for Windows\flame_scr\is-DONKL.tmp	XScreenSaverWin-0.78-Setup.tmp
File created	C:\Program Files (x86)\Dream Aquarium\species\angelfish_marble\arrays\thumbnail.fti	DreamAquariumXP.exe
File created	C:\Program Files (x86)\Dream Aquarium 2\tanks\wabi_sabi\background\arrays\wingrock_key_soft.fti	DreamAquarium2_win.exe
File created	C:\Program Files (x86)\Dream Aquarium 2\species\gui_panel\languages\pt_WN.txt	DreamAquarium2_win.exe
File created	C:\Program Files (x86)\Dream Aquarium\species\target\target.ageo	DreamAquariumXP.exe
File created	C:\Program Files (x86)\Dream Aquarium 2\species\labidochromis\allgeos.ageo	DreamAquarium2_win.exe
File created	C:\Program Files (x86)\Dream Aquarium 2\tanks\moss_angeles_v2\arrays\peck_area.image	DreamAquarium2_win.exe
File created	C:\Program Files (x86)\Dream Aquarium\tanks\wabi_sabi\ludwiga\ludwiga_skeleton.ageo	DreamAquariumXP.exe
File created	C:\Program Files (x86)\Dream Aquarium\tanks\moss_angeles_gravel\background\background.ageo	DreamAquariumXP.exe
File created	C:\Program Files (x86)\Dream Aquarium 2\species\gui_panel\languages\nl_DM.txt	DreamAquarium2_win.exe
File created	C:\Program Files (x86)\XScreenSaver for Windows\random_scr\is-5K47P.tmp	XScreenSaverWin-0.78-Setup.tmp
File created	C:\Program Files (x86)\Dream Aquarium\species\gui_panel\materials\generate06.mat	DreamAquariumXP.exe
File created	C:\Program Files (x86)\Dream Aquarium 2\species\gui_panel\languages\fr_MN.txt	DreamAquarium2_win.exe
File created	C:\Program Files (x86)\Dream Aquarium 2\tanks\wabi_sabi\ludwiga\ludwiga_skeleton.ageo	DreamAquarium2_win.exe
File created	C:\Program Files (x86)\Dream Aquarium\tanks\moss_angeles\background\materials\background_tut_add.mat	DreamAquariumXP.exe
File created	C:\Program Files (x86)\Dream Aquarium\species\gui_panel\materials\generate09.mat	DreamAquariumXP.exe
File created	C:\Program Files (x86)\Dream Aquarium 2\species\gui_panel\gui_panel_skeleton.ageo	DreamAquarium2_win.exe
File created	C:\Program Files (x86)\Dream Aquarium 2\species\gui_panel\materials\slider_ticks.mat	DreamAquarium2_win.exe
File created	C:\Program Files (x86)\Dream Aquarium 2\species\ramirezi\arrays\body.fti	DreamAquarium2_win.exe
File created	C:\Program Files (x86)\Dream Aquarium 2\tanks\wabi_sabi\backdrops\ground_glosso\thumbnail.jpg	DreamAquarium2_win.exe
File created	C:\Program Files (x86)\Dream Aquarium 2\tanks\marine1\backdrops\sbd_dark_glow\materials\backdropRays.mat	DreamAquarium2_win.exe
File created	C:\Program Files (x86)\Dream Aquarium 2\tanks\jirawong\backdrop_and_surface\backdrop_and_surface.spec	DreamAquarium2_win.exe
File created	C:\Program Files (x86)\XScreenSaver for Windows\hypercube_scr\is-16G83.tmp	XScreenSaverWin-0.78-Setup.tmp
File created	C:\Program Files (x86)\Dream Aquarium\tanks\wabi_sabi\grass_bg\materials\grad.mat	DreamAquariumXP.exe
File created	C:\Program Files (x86)\Dream Aquarium\species\zebra_danio\arrays\thumbnail.fti	DreamAquariumXP.exe
File created	C:\Program Files (x86)\Dream Aquarium 2\species\gui_panel\arrays\image_failed.alpha	DreamAquarium2_win.exe
File created	C:\Program Files (x86)\Dream Aquarium\species\demasoni\arrays\fish_planes.image	DreamAquariumXP.exe
File created	C:\Program Files (x86)\Dream Aquarium\species\ramirezi\arrays\thumbnail.alpha	DreamAquariumXP.exe
File created	C:\Program Files (x86)\Dream Aquarium 2\zip.exe	DreamAquarium2_win.exe
File created	C:\Program Files (x86)\Dream Aquarium 2\species\gui_panel\arrays\bell.rgb	DreamAquarium2_win.exe
File created	C:\Program Files (x86)\Dream Aquarium 2\adn_support\GUPPY01_picker.fti	DreamAquarium2_win.exe
File created	C:\Program Files (x86)\Dream Aquarium 2\species\std_fish\arrays\swimCycleC.image	DreamAquarium2_win.exe
File created	C:\Program Files (x86)\Dream Aquarium 2\species\gui_panel\languages\fr_RN.txt	DreamAquarium2_win.exe
File created	C:\Program Files (x86)\Sim Aquarium 3\is-ISG0E.tmp	SimAQUARIUM-2024-V3.10.1.tmp
File created	C:\Program Files (x86)\Dream Aquarium\tanks\wabi_sabi\grass_bg\materials\grass_tall.mat	DreamAquariumXP.exe
File created	C:\Program Files (x86)\Dream Aquarium\species\tiger_barb\arrays\thumbnail.alpha	DreamAquariumXP.exe
File created	C:\Program Files (x86)\Dream Aquarium 2\tanks\moss_angeles_v2\scenery\arrays\ground_upper_transp.fti	DreamAquarium2_win.exe
File created	C:\Program Files (x86)\Dream Aquarium 2\tanks\moss_angeles_v2\scenery\arrays\log_back_branch.fti	DreamAquarium2_win.exe
File created	C:\Program Files (x86)\Dream Aquarium 2\tanks\wabi_sabi\background\arrays\frontrock_fill_gravel.alpha	DreamAquarium2_win.exe
File created	C:\Program Files (x86)\Dream Aquarium\tanks\wabi_sabi\grass_bg\arrays\grass_tall.fti	DreamAquariumXP.exe
File created	C:\Program Files (x86)\Dream Aquarium\tanks\moss_angeles\background\arrays\branchZeroAlpha.comp	DreamAquariumXP.exe
File created	C:\Program Files (x86)\Dream Aquarium 2\species\gui_panel\interface_extras.gui	DreamAquarium2_win.exe
File created	C:\Program Files (x86)\Dream Aquarium\species\pearl_gourami\arrays\thumbnail.alpha	DreamAquariumXP.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3076_884996151\Sigma\Content	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1172_1878321854\edge_driver.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1172_1878321854\json\i18n-tokenized-card\ja\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1172_1369263214\auto_open_controller.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1172_1878321854\json\i18n-shared-components\it\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1172_1878321854\wallet-webui-992.268aa821c3090dce03cb.chunk.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1172_1878321854\webui-setup.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3076_1758206261\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3076_1758206261\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1172_1878321854\json\i18n-notification\fr-CA\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3076_1758206261\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1172_2122667833\hyph-or.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1172_1766195762\Part-FR	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1172_1878321854\json\i18n-mobile-hub\ru\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3076_1758206261\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3076_884996151\Sigma\Social	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1172_2122667833\hyph-hy.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1172_1369263214\edge_tracking_page_validator.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1172_1878321854\json\wallet\wallet-notification-config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3076_1758206261\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3076_113418701\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1172_1878321854\Notification\notification_fast.bundle.js.LICENSE.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1172_1878321854\json\i18n-tokenized-card\sv\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1172_1878321854\Mini-Wallet\miniwallet.bundle.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3076_1758206261\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3076_212168825\model.markov	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1172_2122667833\hyph-hr.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1172_1878321854\json\i18n-hub\zh-Hans\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1172_1878321854\json\i18n-hub\zh-Hant\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1172_1878321854\json\i18n-shared-components\en-GB\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1172_1878321854\load-hub-i18n.bundle.js	msedge.exe
File created	C:\Windows\DreamAquarium.scr	DreamAquariumXP.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3076_212168825\english_wikipedia.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1172_2122667833\hyph-sq.hyb	msedge.exe
File opened for modification	C:\Windows\fireflies.scr	fireflies-scr-2.06.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3076_212168825\surnames.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1172_2122667833\hyph-de-1996.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1172_2122667833\hyph-nb.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1172_2122667833\hyph-te.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1172_1644360722\VideoSuperResolution-E-FP32.onnx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1172_2122667833\hyph-it.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3076_694791031\v1FieldTypes.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3076_884996151\Mu\Entities	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1172_1369263214\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1172_1878321854\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3076_113418701\typosquatting_list.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3076_1758206261\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3076_1514693581\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1172_2122667833\hyph-cy.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3076_1758206261\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3076_1758206261\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1172_2122667833\hyph-es.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1172_1878321854\json\i18n-ec\pt-PT\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1172_1878321854\json\i18n-mobile-hub\ja\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1172_1878321854\json\i18n-notification-shared\it\strings.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3076_884996151\Mu\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1172_1878321854\json\i18n-mobile-hub\sv\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1172_1878321854\json\i18n-shared-components\es\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1172_1644360722\onnxruntime.dll	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3076_1758206261\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3076_884996151\Mu\Social	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1172_1369263214\shopping_iframe_driver.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1172_1878321854\Wallet-Checkout\load-ec-deps.bundle.js	msedge.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 7 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Midnight-Beach-v2.exe:Zone.Identifier	chrome.exe
File opened for modification	C:\Users\Admin\Downloads\SimAQUARIUM-2024-V3.10.1.exe:Zone.Identifier	chrome.exe
File opened for modification	C:\Users\Admin\Downloads\fireflies-scr-2.06.exe:Zone.Identifier	chrome.exe
File opened for modification	C:\Users\Admin\Downloads\XScreenSaverWin-0.78-Setup.exe:Zone.Identifier	chrome.exe
File opened for modification	C:\Users\Admin\Downloads\DreamAquarium2_win.exe:Zone.Identifier	chrome.exe
File opened for modification	C:\Users\Admin\Downloads\DreamAquariumXP.exe:Zone.Identifier	chrome.exe
File opened for modification	C:\Users\Admin\Downloads\fantasticfish.exe:Zone.Identifier	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 35 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	XScreenSaverWin-0.78-Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Midnight-Beach-v2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	voronoi.scr
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dream_Aquarium2.scr
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsLogo.scr
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fantasticfish.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SimAquarium3.scr
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsLogo.scr
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DreamAquariumXP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	random.scr
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DreamAquarium2.scr
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dream_Aquarium.scr
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SimAQUARIUM-2024-V3.10.1.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ErrorsAndUpdates.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	unknownpleasures.scr
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fireflies-scr-2.06.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SimAQUARIUM-2024-V3.10.1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	scrnsave.scr
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SimAquarium3.scr
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Midnight.scr
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dream_Aquarium_Updater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	scrnsave.scr
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	XScreenSaverWin-0.78-Setup.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DreamAquarium2_win.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fireflies.scr
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pinion.scr
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	unknownpleasures.scr
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Midnight.scr
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsLogo.scr
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	scrnsave.scr
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dream_Aquarium2.scr
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SimAquarium3.scr
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FanFish25.scr

Inno Setup is an open-source installation builder for Windows applications. 6 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral1/memory/4680-1504-0x0000000000400000-0x0000000000414000-memory.dmp	innosetup
behavioral1/memory/4680-1968-0x0000000000400000-0x0000000000414000-memory.dmp	innosetup
behavioral1/memory/4680-1973-0x0000000000400000-0x0000000000414000-memory.dmp	innosetup
behavioral1/memory/2984-1976-0x0000000000400000-0x00000000004D8000-memory.dmp	innosetup
behavioral1/memory/2984-2031-0x0000000000400000-0x00000000004D8000-memory.dmp	innosetup
behavioral1/memory/2984-2035-0x0000000000400000-0x00000000004D8000-memory.dmp	innosetup

NSIS installer 2 IoCs

installer

resource	yara_rule
behavioral1/files/0x000500000002acc0-899.dat	nsis_installer_1
behavioral1/files/0x000500000002acc0-899.dat	nsis_installer_2

Enumerates system info in registry 2 TTPs 12 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies Control Panel 7 IoCs

defense_evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2345208746-1589029588-866946394-1000\Control Panel\Desktop	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2345208746-1589029588-866946394-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\SIMAQU~1.SCR"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2345208746-1589029588-866946394-1000\Control Panel\Desktop\ScreenSaveActive = "1"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2345208746-1589029588-866946394-1000\Control Panel\Desktop\ScreenSaveTimeOut = "900"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2345208746-1589029588-866946394-1000\Control Panel\Desktop	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2345208746-1589029588-866946394-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\Midnight.scr"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2345208746-1589029588-866946394-1000\Control Panel\Desktop\ScreenSaveActive = "1"	rundll32.exe

Modifies Internet Explorer settings 1 TTPs 29 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2345208746-1589029588-866946394-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateLowDateTime = "1004345119"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2345208746-1589029588-866946394-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2345208746-1589029588-866946394-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPMigrationVer = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2345208746-1589029588-866946394-1000\Software\Microsoft\Internet Explorer\BrowserEmulation	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2345208746-1589029588-866946394-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2345208746-1589029588-866946394-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "268435456"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2345208746-1589029588-866946394-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionLow = "395196024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2345208746-1589029588-866946394-1000\Software\Microsoft\Internet Explorer\GPU\DeviceId = "140"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2345208746-1589029588-866946394-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateHighDateTime = "31252013"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2345208746-1589029588-866946394-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2345208746-1589029588-866946394-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2345208746-1589029588-866946394-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2345208746-1589029588-866946394-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "395196024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2345208746-1589029588-866946394-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2345208746-1589029588-866946394-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "8"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2345208746-1589029588-866946394-1000\Software\Microsoft\Internet Explorer\GPU\VendorId = "5140"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2345208746-1589029588-866946394-1000\Software\Microsoft\Internet Explorer\GPU\Revision = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2345208746-1589029588-866946394-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2345208746-1589029588-866946394-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "9"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2345208746-1589029588-866946394-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2345208746-1589029588-866946394-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2345208746-1589029588-866946394-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionHigh = "268435456"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2345208746-1589029588-866946394-1000\Software\Microsoft\Internet Explorer\GPU\SubSysId = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2345208746-1589029588-866946394-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListDomainAttributeSet = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2345208746-1589029588-866946394-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2345208746-1589029588-866946394-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "13"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2345208746-1589029588-866946394-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2345208746-1589029588-866946394-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\HomepagesUpgradeVersion = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2345208746-1589029588-866946394-1000\Software\Microsoft\Internet Explorer\GPU\SoftwareFallback = "0"	iexplore.exe

Modifies data under HKEY_USERS 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134226021007039864"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2345208746-1589029588-866946394-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2345208746-1589029588-866946394-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2345208746-1589029588-866946394-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SA3Reef\DefaultIcon\ = "C:\\Program Files (x86)\\Sim Aquarium 3\\Sim AQUARIUM 3.exe,0"	SimAQUARIUM-2024-V3.10.1.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Spiralmonkey.DreamAquarium.1	DreamAquariumXP.exe
Key created	\REGISTRY\USER\S-1-5-21-2345208746-1589029588-866946394-1000_Classes\Local Settings	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2345208746-1589029588-866946394-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2345208746-1589029588-866946394-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a000000a000000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Spiralmonkey.DreamAquarium.1\DefaultIcon	DreamAquarium2_win.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2345208746-1589029588-866946394-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\3 = 3a001f44471a0359723fa74489c55595fe6b30ee260001002600efbe1000000006c9c5b79edadb012668b10babdadb01f1513fccdcdddc0114000000	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SA3Reef\shell	SimAQUARIUM-2024-V3.10.1.tmp
Key created	\REGISTRY\USER\S-1-5-21-2345208746-1589029588-866946394-1000_Classes\Local Settings	Midnight-Beach-v2.exe
Key created	\REGISTRY\USER\S-1-5-21-2345208746-1589029588-866946394-1000_Classes\Local Settings	fantasticfish.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.dai\ = "Spiralmonkey.DreamAquarium.1"	DreamAquariumXP.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Spiralmonkey.DreamAquarium.1\shell\Open\command	DreamAquarium2_win.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2345208746-1589029588-866946394-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\3\MRUListEx = ffffffff	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2345208746-1589029588-866946394-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0100000000000000ffffffff	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2345208746-1589029588-866946394-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SA3Reef\shell\open\command\ = "\"C:\\Program Files (x86)\\Sim Aquarium 3\\Sim AQUARIUM 3.exe\" -i %1"	SimAQUARIUM-2024-V3.10.1.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Spiralmonkey.DreamAquarium.1\shell	DreamAquariumXP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2345208746-1589029588-866946394-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1"	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.sa3reef\ = "SA3Reef"	SimAQUARIUM-2024-V3.10.1.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SA3Reef\shell\open	SimAQUARIUM-2024-V3.10.1.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Spiralmonkey.DreamAquarium.1\ = "Dream Aquarium Update"	DreamAquariumXP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.dai\ = "Spiralmonkey.DreamAquarium.1"	DreamAquarium2_win.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2345208746-1589029588-866946394-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 000000000200000001000000ffffffff	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SA3Reef	SimAQUARIUM-2024-V3.10.1.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SA3Reef\ = "SA3 Reef"	SimAQUARIUM-2024-V3.10.1.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Spiralmonkey.DreamAquarium.1\shell\Open	DreamAquariumXP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Spiralmonkey.DreamAquarium.1\DefaultIcon\ = "\"C:\\Program Files (x86)\\Dream Aquarium 2\\Dream_Aquarium_Updater.exe\",0"	DreamAquarium2_win.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2345208746-1589029588-866946394-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202020202	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Spiralmonkey.DreamAquarium.1\ = "Dream Aquarium 2 Update"	DreamAquarium2_win.exe
Key created	\REGISTRY\USER\S-1-5-21-2345208746-1589029588-866946394-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Spiralmonkey.DreamAquarium.1\shell\Open\command	DreamAquariumXP.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2345208746-1589029588-866946394-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\3\NodeSlot = "7"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2345208746-1589029588-866946394-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2345208746-1589029588-866946394-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\LogicalViewMode = "3"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2345208746-1589029588-866946394-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupView = "0"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2345208746-1589029588-866946394-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:PID = "0"	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.sa3reef\Content Type = "application/sa3reef"	SimAQUARIUM-2024-V3.10.1.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SA3Reef\DefaultIcon	SimAQUARIUM-2024-V3.10.1.tmp
Key created	\REGISTRY\USER\S-1-5-21-2345208746-1589029588-866946394-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2345208746-1589029588-866946394-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	chrome.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2345208746-1589029588-866946394-1000\{7526FB72-4CFD-4D5E-A7F8-81F989EA7D84}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2345208746-1589029588-866946394-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.sa3reef	SimAQUARIUM-2024-V3.10.1.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.dai	DreamAquariumXP.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Spiralmonkey.DreamAquarium.1	DreamAquarium2_win.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Spiralmonkey.DreamAquarium.1\shell\Open\command\ = "\"C:\\Program Files (x86)\\Dream Aquarium 2\\Dream_Aquarium_Updater.exe\" \"%1\""	DreamAquarium2_win.exe
Key created	\REGISTRY\USER\S-1-5-21-2345208746-1589029588-866946394-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2345208746-1589029588-866946394-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 03000000000000000200000001000000ffffffff	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2345208746-1589029588-866946394-1000_Classes\Local Settings	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Spiralmonkey.DreamAquarium.1\DefaultIcon\ = "\"C:\\Program Files (x86)\\Dream Aquarium\\ErrorsAndUpdates.exe\",0"	DreamAquariumXP.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.dai	DreamAquarium2_win.exe
Key created	\REGISTRY\USER\S-1-5-21-2345208746-1589029588-866946394-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2345208746-1589029588-866946394-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2345208746-1589029588-866946394-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202020202	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2345208746-1589029588-866946394-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByDirection = "1"	chrome.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2345208746-1589029588-866946394-1000\{C6300F2A-D5C4-4A72-A80A-25143A16CA42}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2345208746-1589029588-866946394-1000_Classes\Local Settings	SimAQUARIUM-2024-V3.10.1.tmp

NTFS ADS 8 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Midnight-Beach-v2.exe:Zone.Identifier	chrome.exe
File opened for modification	C:\Users\Admin\Downloads\XScreenSaverWin-0.78-Setup.exe:Zone.Identifier	chrome.exe
File opened for modification	C:\Users\Admin\Downloads\WindowsLogo.zip:Zone.Identifier	chrome.exe
File opened for modification	C:\Users\Admin\Downloads\DreamAquarium2_win.exe:Zone.Identifier	chrome.exe
File opened for modification	C:\Users\Admin\Downloads\DreamAquariumXP.exe:Zone.Identifier	chrome.exe
File opened for modification	C:\Users\Admin\Downloads\fantasticfish.exe:Zone.Identifier	chrome.exe
File opened for modification	C:\Users\Admin\Downloads\SimAQUARIUM-2024-V3.10.1.exe:Zone.Identifier	chrome.exe
File opened for modification	C:\Users\Admin\Downloads\fireflies-scr-2.06.exe:Zone.Identifier	chrome.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
72	chrome.exe
72	chrome.exe
3076	msedge.exe
3076	msedge.exe
72	chrome.exe
72	chrome.exe
5068	msedge.exe
5068	msedge.exe
1536	chrome.exe
1536	chrome.exe
5700	SimAQUARIUM-2024-V3.10.1.tmp
5700	SimAQUARIUM-2024-V3.10.1.tmp
1172	msedge.exe
1172	msedge.exe
5128	msedge.exe
5128	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 21 IoCs

pid	Process
3328	msedge.exe
3328	msedge.exe
72	chrome.exe
72	chrome.exe
72	chrome.exe
72	chrome.exe
72	chrome.exe
72	chrome.exe
72	chrome.exe
72	chrome.exe
72	chrome.exe
72	chrome.exe
72	chrome.exe
72	chrome.exe
72	chrome.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
72	chrome.exe
72	chrome.exe
72	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	72	chrome.exe
Token: SeCreatePagefilePrivilege	72	chrome.exe
Token: SeShutdownPrivilege	72	chrome.exe
Token: SeCreatePagefilePrivilege	72	chrome.exe
Token: SeShutdownPrivilege	72	chrome.exe
Token: SeCreatePagefilePrivilege	72	chrome.exe
Token: SeShutdownPrivilege	72	chrome.exe
Token: SeCreatePagefilePrivilege	72	chrome.exe
Token: SeShutdownPrivilege	72	chrome.exe
Token: SeCreatePagefilePrivilege	72	chrome.exe
Token: SeShutdownPrivilege	72	chrome.exe
Token: SeCreatePagefilePrivilege	72	chrome.exe
Token: SeShutdownPrivilege	72	chrome.exe
Token: SeCreatePagefilePrivilege	72	chrome.exe
Token: SeShutdownPrivilege	72	chrome.exe
Token: SeCreatePagefilePrivilege	72	chrome.exe
Token: SeShutdownPrivilege	72	chrome.exe
Token: SeCreatePagefilePrivilege	72	chrome.exe
Token: SeShutdownPrivilege	72	chrome.exe
Token: SeCreatePagefilePrivilege	72	chrome.exe
Token: SeShutdownPrivilege	72	chrome.exe
Token: SeCreatePagefilePrivilege	72	chrome.exe
Token: SeShutdownPrivilege	72	chrome.exe
Token: SeCreatePagefilePrivilege	72	chrome.exe
Token: SeShutdownPrivilege	72	chrome.exe
Token: SeCreatePagefilePrivilege	72	chrome.exe
Token: SeShutdownPrivilege	72	chrome.exe
Token: SeCreatePagefilePrivilege	72	chrome.exe
Token: SeShutdownPrivilege	72	chrome.exe
Token: SeCreatePagefilePrivilege	72	chrome.exe
Token: SeShutdownPrivilege	72	chrome.exe
Token: SeCreatePagefilePrivilege	72	chrome.exe
Token: SeShutdownPrivilege	72	chrome.exe
Token: SeCreatePagefilePrivilege	72	chrome.exe
Token: SeShutdownPrivilege	72	chrome.exe
Token: SeCreatePagefilePrivilege	72	chrome.exe
Token: SeShutdownPrivilege	72	chrome.exe
Token: SeCreatePagefilePrivilege	72	chrome.exe
Token: SeShutdownPrivilege	72	chrome.exe
Token: SeCreatePagefilePrivilege	72	chrome.exe
Token: SeShutdownPrivilege	72	chrome.exe
Token: SeCreatePagefilePrivilege	72	chrome.exe
Token: SeShutdownPrivilege	72	chrome.exe
Token: SeCreatePagefilePrivilege	72	chrome.exe
Token: SeShutdownPrivilege	72	chrome.exe
Token: SeCreatePagefilePrivilege	72	chrome.exe
Token: SeShutdownPrivilege	72	chrome.exe
Token: SeCreatePagefilePrivilege	72	chrome.exe
Token: SeShutdownPrivilege	72	chrome.exe
Token: SeCreatePagefilePrivilege	72	chrome.exe
Token: SeShutdownPrivilege	72	chrome.exe
Token: SeCreatePagefilePrivilege	72	chrome.exe
Token: SeShutdownPrivilege	72	chrome.exe
Token: SeCreatePagefilePrivilege	72	chrome.exe
Token: SeShutdownPrivilege	72	chrome.exe
Token: SeCreatePagefilePrivilege	72	chrome.exe
Token: SeShutdownPrivilege	72	chrome.exe
Token: SeCreatePagefilePrivilege	72	chrome.exe
Token: SeShutdownPrivilege	72	chrome.exe
Token: SeCreatePagefilePrivilege	72	chrome.exe
Token: SeShutdownPrivilege	72	chrome.exe
Token: SeCreatePagefilePrivilege	72	chrome.exe
Token: SeShutdownPrivilege	72	chrome.exe
Token: SeCreatePagefilePrivilege	72	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3328	msedge.exe
3328	msedge.exe
72	chrome.exe
72	chrome.exe
72	chrome.exe
72	chrome.exe
72	chrome.exe
72	chrome.exe
72	chrome.exe
72	chrome.exe
72	chrome.exe
72	chrome.exe
72	chrome.exe
72	chrome.exe
72	chrome.exe
72	chrome.exe
72	chrome.exe
72	chrome.exe
72	chrome.exe
72	chrome.exe
72	chrome.exe
72	chrome.exe
72	chrome.exe
72	chrome.exe
72	chrome.exe
72	chrome.exe
72	chrome.exe
72	chrome.exe
72	chrome.exe
72	chrome.exe
72	chrome.exe
72	chrome.exe
72	chrome.exe
72	chrome.exe
72	chrome.exe
72	chrome.exe
72	chrome.exe
72	chrome.exe
72	chrome.exe
72	chrome.exe
72	chrome.exe
72	chrome.exe
72	chrome.exe
72	chrome.exe
72	chrome.exe
72	chrome.exe
72	chrome.exe
72	chrome.exe
72	chrome.exe
72	chrome.exe
72	chrome.exe
72	chrome.exe
72	chrome.exe
72	chrome.exe
72	chrome.exe
72	chrome.exe
72	chrome.exe
72	chrome.exe
72	chrome.exe
72	chrome.exe
72	chrome.exe
72	chrome.exe
72	chrome.exe
72	chrome.exe

Suspicious use of SendNotifyMessage 22 IoCs

pid	Process
72	chrome.exe
72	chrome.exe
72	chrome.exe
72	chrome.exe
72	chrome.exe
72	chrome.exe
72	chrome.exe
72	chrome.exe
72	chrome.exe
72	chrome.exe
72	chrome.exe
72	chrome.exe
72	chrome.exe
72	chrome.exe
72	chrome.exe
72	chrome.exe
72	chrome.exe
72	chrome.exe
72	chrome.exe
72	chrome.exe
72	chrome.exe
72	chrome.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
7040	Midnight.scr
7040	Midnight.scr
6804	ErrorsAndUpdates.exe
2332	Dream_Aquarium_Updater.exe
1648	Midnight.scr
1648	Midnight.scr
1648	Midnight.scr
2808	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2628 wrote to memory of 3328	2628	iexplore.exe	78
PID 3328 wrote to memory of 5460	3328	msedge.exe	79
PID 3328 wrote to memory of 4312	3328	msedge.exe	80
PID 3328 wrote to memory of 3520	3328	msedge.exe	81
PID 3328 wrote to memory of 5944	3328	msedge.exe	82
PID 3328 wrote to memory of 3520	3328	msedge.exe	81
PID 3328 wrote to memory of 3520	3328	msedge.exe	81
PID 3328 wrote to memory of 5944	3328	msedge.exe	82
PID 3328 wrote to memory of 4820	3328	msedge.exe	84
PID 3328 wrote to memory of 4820	3328	msedge.exe	84
PID 3328 wrote to memory of 4820	3328	msedge.exe	84
PID 3328 wrote to memory of 4836	3328	msedge.exe	85
PID 3328 wrote to memory of 4836	3328	msedge.exe	85
PID 3328 wrote to memory of 4836	3328	msedge.exe	85
PID 3328 wrote to memory of 3244	3328	msedge.exe	88
PID 3328 wrote to memory of 1044	3328	msedge.exe	87
PID 3328 wrote to memory of 3244	3328	msedge.exe	88
PID 3328 wrote to memory of 1044	3328	msedge.exe	87
PID 3328 wrote to memory of 2912	3328	msedge.exe	89
PID 3328 wrote to memory of 4640	3328	msedge.exe	91
PID 2912 wrote to memory of 1228	2912	msedge.exe	92
PID 3328 wrote to memory of 3076	3328	msedge.exe	93
PID 3076 wrote to memory of 6104	3076	msedge.exe	94
PID 3076 wrote to memory of 3540	3076	msedge.exe	95
PID 3076 wrote to memory of 4636	3076	msedge.exe	96
PID 3076 wrote to memory of 4636	3076	msedge.exe	96
PID 3076 wrote to memory of 4636	3076	msedge.exe	96
PID 3076 wrote to memory of 4120	3076	msedge.exe	97
PID 3076 wrote to memory of 4120	3076	msedge.exe	97
PID 3076 wrote to memory of 4616	3076	msedge.exe	101
PID 3076 wrote to memory of 4616	3076	msedge.exe	101
PID 3076 wrote to memory of 1408	3076	msedge.exe	103
PID 3076 wrote to memory of 6028	3076	msedge.exe	104
PID 3076 wrote to memory of 6028	3076	msedge.exe	104
PID 3076 wrote to memory of 3176	3076	msedge.exe	105
PID 3076 wrote to memory of 3176	3076	msedge.exe	105
PID 72 wrote to memory of 3628	72	chrome.exe	107
PID 72 wrote to memory of 4796	72	chrome.exe	108
PID 72 wrote to memory of 4796	72	chrome.exe	108
PID 72 wrote to memory of 4684	72	chrome.exe	109
PID 72 wrote to memory of 2584	72	chrome.exe	110
PID 72 wrote to memory of 2584	72	chrome.exe	110
PID 72 wrote to memory of 1200	72	chrome.exe	112
PID 72 wrote to memory of 3896	72	chrome.exe	111
PID 72 wrote to memory of 1200	72	chrome.exe	112
PID 72 wrote to memory of 3896	72	chrome.exe	111
PID 72 wrote to memory of 3420	72	chrome.exe	113
PID 72 wrote to memory of 3420	72	chrome.exe	113
PID 72 wrote to memory of 5436	72	chrome.exe	116
PID 72 wrote to memory of 5436	72	chrome.exe	116
PID 72 wrote to memory of 2432	72	chrome.exe	117
PID 72 wrote to memory of 2432	72	chrome.exe	117
PID 72 wrote to memory of 2284	72	chrome.exe	118
PID 72 wrote to memory of 1088	72	chrome.exe	120
PID 72 wrote to memory of 1088	72	chrome.exe	120
PID 72 wrote to memory of 3188	72	chrome.exe	121
PID 72 wrote to memory of 3188	72	chrome.exe	121
PID 72 wrote to memory of 1380	72	chrome.exe	122
PID 72 wrote to memory of 1380	72	chrome.exe	122
PID 72 wrote to memory of 1376	72	chrome.exe	123
PID 72 wrote to memory of 1376	72	chrome.exe	123
PID 72 wrote to memory of 3240	72	chrome.exe	124
PID 72 wrote to memory of 3240	72	chrome.exe	124
PID 72 wrote to memory of 3248	72	chrome.exe	125

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\rain.gif
1⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:2628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "file:///C:/Users/Admin/AppData/Local/Temp/rain.gif"
  2⤵
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3328
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x2e4,0x2e8,0x2ec,0x2e0,0x304,0x7ffebfabf208,0x7ffebfabf214,0x7ffebfabf220
    3⤵
    PID:5460
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1736,i,14914042483410397456,16390929371030836262,262144 --variations-seed-version --mojo-platform-channel-handle=2712 /prefetch:11
    3⤵
    PID:4312
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2684,i,14914042483410397456,16390929371030836262,262144 --variations-seed-version --mojo-platform-channel-handle=2680 /prefetch:2
    3⤵
    PID:3520
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=1892,i,14914042483410397456,16390929371030836262,262144 --variations-seed-version --mojo-platform-channel-handle=2720 /prefetch:13
    3⤵
    PID:5944
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3360,i,14914042483410397456,16390929371030836262,262144 --variations-seed-version --mojo-platform-channel-handle=3352 /prefetch:1
    3⤵
    PID:4820
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3312,i,14914042483410397456,16390929371030836262,262144 --variations-seed-version --mojo-platform-channel-handle=3372 /prefetch:1
    3⤵
    PID:4836
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --string-annotations --always-read-main-dll --field-trial-handle=4808,i,14914042483410397456,16390929371030836262,262144 --variations-seed-version --mojo-platform-channel-handle=4900 /prefetch:14
    3⤵
    PID:1044
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --string-annotations --always-read-main-dll --field-trial-handle=4820,i,14914042483410397456,16390929371030836262,262144 --variations-seed-version --mojo-platform-channel-handle=4920 /prefetch:14
    3⤵
    PID:3244
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=5636,i,14914042483410397456,16390929371030836262,262144 --variations-seed-version --mojo-platform-channel-handle=5644 /prefetch:14
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2912
  - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\cookie_exporter.exe
      cookie_exporter.exe --cookie-json=1132
      4⤵
      PID:1228
- - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=5648,i,14914042483410397456,16390929371030836262,262144 --variations-seed-version --mojo-platform-channel-handle=5672 /prefetch:14
    3⤵
    PID:2072
- - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=5648,i,14914042483410397456,16390929371030836262,262144 --variations-seed-version --mojo-platform-channel-handle=5672 /prefetch:14
    3⤵
    PID:4640
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:3076
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x240,0x244,0x248,0x23c,0x2f4,0x7ffebfabf208,0x7ffebfabf214,0x7ffebfabf220
      4⤵
      PID:6104
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1792,i,9308880875634932675,4556880648955838254,262144 --variations-seed-version --mojo-platform-channel-handle=2012 /prefetch:11
      4⤵
      PID:3540
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1984,i,9308880875634932675,4556880648955838254,262144 --variations-seed-version --mojo-platform-channel-handle=1980 /prefetch:2
      4⤵
      PID:4636
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=1852,i,9308880875634932675,4556880648955838254,262144 --variations-seed-version --mojo-platform-channel-handle=2492 /prefetch:13
      4⤵
      PID:4120
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=4300,i,9308880875634932675,4556880648955838254,262144 --variations-seed-version --mojo-platform-channel-handle=4320 /prefetch:14
      4⤵
      PID:4616
  - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=4332,i,9308880875634932675,4556880648955838254,262144 --variations-seed-version --mojo-platform-channel-handle=4508 /prefetch:14
      4⤵
      PID:4688
  - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=4332,i,9308880875634932675,4556880648955838254,262144 --variations-seed-version --mojo-platform-channel-handle=4508 /prefetch:14
      4⤵
      PID:1408
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=4732,i,9308880875634932675,4556880648955838254,262144 --variations-seed-version --mojo-platform-channel-handle=4372 /prefetch:14
      4⤵
      PID:6028
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=4448,i,9308880875634932675,4556880648955838254,262144 --variations-seed-version --mojo-platform-channel-handle=4604 /prefetch:14
      4⤵
      PID:3176
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --string-annotations --always-read-main-dll --field-trial-handle=4388,i,9308880875634932675,4556880648955838254,262144 --variations-seed-version --mojo-platform-channel-handle=4504 /prefetch:14
      4⤵
      PID:4880
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --string-annotations --always-read-main-dll --field-trial-handle=4480,i,9308880875634932675,4556880648955838254,262144 --variations-seed-version --mojo-platform-channel-handle=4492 /prefetch:14
      4⤵
      PID:3960
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --string-annotations --always-read-main-dll --field-trial-handle=4380,i,9308880875634932675,4556880648955838254,262144 --variations-seed-version --mojo-platform-channel-handle=4320 /prefetch:14
      4⤵
      PID:5216
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=4184,i,9308880875634932675,4556880648955838254,262144 --variations-seed-version --mojo-platform-channel-handle=4728 /prefetch:14
      4⤵
      PID:4480
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=4424,i,9308880875634932675,4556880648955838254,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:14
      4⤵
      PID:5556
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=4924,i,9308880875634932675,4556880648955838254,262144 --variations-seed-version --mojo-platform-channel-handle=4932 /prefetch:14
      4⤵
      PID:4524
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2752,i,9308880875634932675,4556880648955838254,262144 --variations-seed-version --mojo-platform-channel-handle=4476 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5068
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=4108,i,9308880875634932675,4556880648955838254,262144 --variations-seed-version --mojo-platform-channel-handle=3144 /prefetch:14
      4⤵
      PID:3108
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=4008,i,9308880875634932675,4556880648955838254,262144 --variations-seed-version --mojo-platform-channel-handle=4436 /prefetch:14
      4⤵
      PID:6116
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --string-annotations --always-read-main-dll --field-trial-handle=5172,i,9308880875634932675,4556880648955838254,262144 --variations-seed-version --mojo-platform-channel-handle=5288 /prefetch:14
      4⤵
      PID:3500
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=4972,i,9308880875634932675,4556880648955838254,262144 --variations-seed-version --mojo-platform-channel-handle=5316 /prefetch:14
      4⤵
      PID:3112
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=5268,i,9308880875634932675,4556880648955838254,262144 --variations-seed-version --mojo-platform-channel-handle=748 /prefetch:14
      4⤵
      PID:3220
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2624,i,9308880875634932675,4556880648955838254,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:14
      4⤵
      PID:6836
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --string-annotations --always-read-main-dll --field-trial-handle=5276,i,9308880875634932675,4556880648955838254,262144 --variations-seed-version --mojo-platform-channel-handle=3776 /prefetch:14
      4⤵
      PID:2252
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=5372,i,9308880875634932675,4556880648955838254,262144 --variations-seed-version --mojo-platform-channel-handle=4644 /prefetch:14
      4⤵
      PID:5252
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=5332,i,9308880875634932675,4556880648955838254,262144 --variations-seed-version --mojo-platform-channel-handle=5256 /prefetch:14
      4⤵
      PID:6628
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=5296,i,9308880875634932675,4556880648955838254,262144 --variations-seed-version --mojo-platform-channel-handle=4228 /prefetch:14
      4⤵
      PID:7104
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=5412,i,9308880875634932675,4556880648955838254,262144 --variations-seed-version --mojo-platform-channel-handle=3148 /prefetch:14
      4⤵
      PID:5088
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --field-trial-handle=5424,i,9308880875634932675,4556880648955838254,262144 --variations-seed-version --mojo-platform-channel-handle=5328 /prefetch:1
      4⤵
      PID:3028
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --field-trial-handle=5376,i,9308880875634932675,4556880648955838254,262144 --variations-seed-version --mojo-platform-channel-handle=3968 /prefetch:1
      4⤵
      PID:3360
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --string-annotations --always-read-main-dll --field-trial-handle=5344,i,9308880875634932675,4556880648955838254,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:14
      4⤵
      PID:5224
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --string-annotations --always-read-main-dll --field-trial-handle=5536,i,9308880875634932675,4556880648955838254,262144 --variations-seed-version --mojo-platform-channel-handle=4768 /prefetch:14
      4⤵
      PID:1484
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --field-trial-handle=5936,i,9308880875634932675,4556880648955838254,262144 --variations-seed-version --mojo-platform-channel-handle=5968 /prefetch:1
      4⤵
      PID:1104
  - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=5884,i,9308880875634932675,4556880648955838254,262144 --variations-seed-version --mojo-platform-channel-handle=6168 /prefetch:14
      4⤵
      PID:4956
  - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=5884,i,9308880875634932675,4556880648955838254,262144 --variations-seed-version --mojo-platform-channel-handle=6168 /prefetch:14
      4⤵
      PID:6736
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
      4⤵
      Drops file in Windows directory
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      PID:1172
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x240,0x244,0x248,0x23c,0x264,0x7ffebfabf208,0x7ffebfabf214,0x7ffebfabf220
        5⤵
        
        PID:1492
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2120,i,17902703865657721555,17950795603057487182,262144 --variations-seed-version --mojo-platform-channel-handle=2116 /prefetch:2
        5⤵
        
        PID:4272
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1864,i,17902703865657721555,17950795603057487182,262144 --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:11
        5⤵
        
        PID:2864
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2332,i,17902703865657721555,17950795603057487182,262144 --variations-seed-version --mojo-platform-channel-handle=2660 /prefetch:13
        5⤵
        
        PID:868
    - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=4332,i,17902703865657721555,17950795603057487182,262144 --variations-seed-version --mojo-platform-channel-handle=4356 /prefetch:14
        5⤵
        
        PID:4756
    - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=4332,i,17902703865657721555,17950795603057487182,262144 --variations-seed-version --mojo-platform-channel-handle=4356 /prefetch:14
        5⤵
        
        PID:2080
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=4580,i,17902703865657721555,17950795603057487182,262144 --variations-seed-version --mojo-platform-channel-handle=4620 /prefetch:14
        5⤵
        
        PID:416
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --string-annotations --always-read-main-dll --field-trial-handle=568,i,17902703865657721555,17950795603057487182,262144 --variations-seed-version --mojo-platform-channel-handle=4416 /prefetch:14
        5⤵
        
        PID:6716
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --string-annotations --always-read-main-dll --field-trial-handle=4720,i,17902703865657721555,17950795603057487182,262144 --variations-seed-version --mojo-platform-channel-handle=4412 /prefetch:14
        5⤵
        
        PID:5788
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --string-annotations --always-read-main-dll --field-trial-handle=4696,i,17902703865657721555,17950795603057487182,262144 --variations-seed-version --mojo-platform-channel-handle=4420 /prefetch:14
        5⤵
        
        PID:6708
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=4944,i,17902703865657721555,17950795603057487182,262144 --variations-seed-version --mojo-platform-channel-handle=5032 /prefetch:14
        5⤵
        
        PID:7120
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=4804,i,17902703865657721555,17950795603057487182,262144 --variations-seed-version --mojo-platform-channel-handle=5016 /prefetch:14
        5⤵
        
        PID:724
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=5168,i,17902703865657721555,17950795603057487182,262144 --variations-seed-version --mojo-platform-channel-handle=1924 /prefetch:10
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:5128
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=5188,i,17902703865657721555,17950795603057487182,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:14
        5⤵
        
        PID:6756
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=5220,i,17902703865657721555,17950795603057487182,262144 --variations-seed-version --mojo-platform-channel-handle=5212 /prefetch:14
        5⤵
        
        PID:7036
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --string-annotations --always-read-main-dll --field-trial-handle=5068,i,17902703865657721555,17950795603057487182,262144 --variations-seed-version --mojo-platform-channel-handle=5228 /prefetch:14
        5⤵
        
        PID:7076
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=4932,i,17902703865657721555,17950795603057487182,262144 --variations-seed-version --mojo-platform-channel-handle=4384 /prefetch:14
        5⤵
        
        PID:3172
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=5232,i,17902703865657721555,17950795603057487182,262144 --variations-seed-version --mojo-platform-channel-handle=4844 /prefetch:14
        5⤵
        
        PID:4312
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --string-annotations --always-read-main-dll --field-trial-handle=3992,i,17902703865657721555,17950795603057487182,262144 --variations-seed-version --mojo-platform-channel-handle=4740 /prefetch:14
        5⤵
        
        PID:6764

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:2636

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:784

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5064

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:72
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffec2bedcf8,0x7ffec2bedd04,0x7ffec2bedd10
  2⤵
  PID:3628
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1908,i,6048849838830928815,10895080689496129739,262144 --variations-seed-version=20250610-180047.803000 --mojo-platform-channel-handle=1904 /prefetch:2
  2⤵
  PID:4796
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=1440,i,6048849838830928815,10895080689496129739,262144 --variations-seed-version=20250610-180047.803000 --mojo-platform-channel-handle=2240 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  PID:4684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=2356,i,6048849838830928815,10895080689496129739,262144 --variations-seed-version=20250610-180047.803000 --mojo-platform-channel-handle=2376 /prefetch:13
  2⤵
  PID:2584
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3160,i,6048849838830928815,10895080689496129739,262144 --variations-seed-version=20250610-180047.803000 --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:3896
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3168,i,6048849838830928815,10895080689496129739,262144 --variations-seed-version=20250610-180047.803000 --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:1200
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4144,i,6048849838830928815,10895080689496129739,262144 --variations-seed-version=20250610-180047.803000 --mojo-platform-channel-handle=4160 /prefetch:9
  2⤵
  PID:3420
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4496,i,6048849838830928815,10895080689496129739,262144 --variations-seed-version=20250610-180047.803000 --mojo-platform-channel-handle=4624 /prefetch:1
  2⤵
  PID:5436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=5212,i,6048849838830928815,10895080689496129739,262144 --variations-seed-version=20250610-180047.803000 --mojo-platform-channel-handle=5228 /prefetch:14
  2⤵
  PID:2432
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=5304,i,6048849838830928815,10895080689496129739,262144 --variations-seed-version=20250610-180047.803000 --mojo-platform-channel-handle=5276 /prefetch:14
  2⤵
  PID:2284
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=5476,i,6048849838830928815,10895080689496129739,262144 --variations-seed-version=20250610-180047.803000 --mojo-platform-channel-handle=5308 /prefetch:14
  2⤵
  PID:1088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=5432,i,6048849838830928815,10895080689496129739,262144 --variations-seed-version=20250610-180047.803000 --mojo-platform-channel-handle=5624 /prefetch:14
  2⤵
  PID:3188
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=5276,i,6048849838830928815,10895080689496129739,262144 --variations-seed-version=20250610-180047.803000 --mojo-platform-channel-handle=5320 /prefetch:14
  2⤵
  PID:1380
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=5648,i,6048849838830928815,10895080689496129739,262144 --variations-seed-version=20250610-180047.803000 --mojo-platform-channel-handle=5644 /prefetch:14
  2⤵
  PID:1376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=5416,i,6048849838830928815,10895080689496129739,262144 --variations-seed-version=20250610-180047.803000 --mojo-platform-channel-handle=5720 /prefetch:1
  2⤵
  PID:3240
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=5820,i,6048849838830928815,10895080689496129739,262144 --variations-seed-version=20250610-180047.803000 --mojo-platform-channel-handle=4676 /prefetch:14
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:3248
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --string-annotations --field-trial-handle=5912,i,6048849838830928815,10895080689496129739,262144 --variations-seed-version=20250610-180047.803000 --mojo-platform-channel-handle=4704 /prefetch:14
  2⤵
  PID:4228
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --string-annotations --field-trial-handle=4708,i,6048849838830928815,10895080689496129739,262144 --variations-seed-version=20250610-180047.803000 --mojo-platform-channel-handle=4660 /prefetch:14
  2⤵
  PID:2976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --string-annotations --field-trial-handle=4700,i,6048849838830928815,10895080689496129739,262144 --variations-seed-version=20250610-180047.803000 --mojo-platform-channel-handle=5928 /prefetch:14
  2⤵
  PID:2372
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --field-trial-handle=4772,i,6048849838830928815,10895080689496129739,262144 --variations-seed-version=20250610-180047.803000 --mojo-platform-channel-handle=4548 /prefetch:1
  2⤵
  PID:3452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --field-trial-handle=4272,i,6048849838830928815,10895080689496129739,262144 --variations-seed-version=20250610-180047.803000 --mojo-platform-channel-handle=5620 /prefetch:9
  2⤵
  PID:5852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=4664,i,6048849838830928815,10895080689496129739,262144 --variations-seed-version=20250610-180047.803000 --mojo-platform-channel-handle=4260 /prefetch:14
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:6060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --field-trial-handle=4692,i,6048849838830928815,10895080689496129739,262144 --variations-seed-version=20250610-180047.803000 --mojo-platform-channel-handle=6076 /prefetch:1
  2⤵
  PID:4500
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=5944,i,6048849838830928815,10895080689496129739,262144 --variations-seed-version=20250610-180047.803000 --mojo-platform-channel-handle=5756 /prefetch:14
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:3392
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --field-trial-handle=4684,i,6048849838830928815,10895080689496129739,262144 --variations-seed-version=20250610-180047.803000 --mojo-platform-channel-handle=5564 /prefetch:1
  2⤵
  PID:5504
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=5668,i,6048849838830928815,10895080689496129739,262144 --variations-seed-version=20250610-180047.803000 --mojo-platform-channel-handle=5696 /prefetch:14
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:5688
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --field-trial-handle=6116,i,6048849838830928815,10895080689496129739,262144 --variations-seed-version=20250610-180047.803000 --mojo-platform-channel-handle=6068 /prefetch:1
  2⤵
  PID:1788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=4240,i,6048849838830928815,10895080689496129739,262144 --variations-seed-version=20250610-180047.803000 --mojo-platform-channel-handle=4164 /prefetch:14
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:2988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=4164,i,6048849838830928815,10895080689496129739,262144 --variations-seed-version=20250610-180047.803000 --mojo-platform-channel-handle=5620 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1536
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --field-trial-handle=4228,i,6048849838830928815,10895080689496129739,262144 --variations-seed-version=20250610-180047.803000 --mojo-platform-channel-handle=5396 /prefetch:1
  2⤵
  PID:4448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=5896,i,6048849838830928815,10895080689496129739,262144 --variations-seed-version=20250610-180047.803000 --mojo-platform-channel-handle=5388 /prefetch:14
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:1088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --field-trial-handle=5740,i,6048849838830928815,10895080689496129739,262144 --variations-seed-version=20250610-180047.803000 --mojo-platform-channel-handle=5552 /prefetch:1
  2⤵
  PID:4100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=5936,i,6048849838830928815,10895080689496129739,262144 --variations-seed-version=20250610-180047.803000 --mojo-platform-channel-handle=4252 /prefetch:14
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:1492
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --string-annotations --field-trial-handle=1504,i,6048849838830928815,10895080689496129739,262144 --variations-seed-version=20250610-180047.803000 --mojo-platform-channel-handle=5624 /prefetch:14
  2⤵
  PID:2064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --field-trial-handle=5560,i,6048849838830928815,10895080689496129739,262144 --variations-seed-version=20250610-180047.803000 --mojo-platform-channel-handle=5924 /prefetch:1
  2⤵
  PID:2472
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=5136,i,6048849838830928815,10895080689496129739,262144 --variations-seed-version=20250610-180047.803000 --mojo-platform-channel-handle=4132 /prefetch:14
  2⤵
  - NTFS ADS
  PID:3480
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --field-trial-handle=6332,i,6048849838830928815,10895080689496129739,262144 --variations-seed-version=20250610-180047.803000 --mojo-platform-channel-handle=6296 /prefetch:1
  2⤵
  PID:5728
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --field-trial-handle=6348,i,6048849838830928815,10895080689496129739,262144 --variations-seed-version=20250610-180047.803000 --mojo-platform-channel-handle=6376 /prefetch:1
  2⤵
  PID:5852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --string-annotations --field-trial-handle=4736,i,6048849838830928815,10895080689496129739,262144 --variations-seed-version=20250610-180047.803000 --mojo-platform-channel-handle=3252 /prefetch:14
  2⤵
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:2808
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --field-trial-handle=4764,i,6048849838830928815,10895080689496129739,262144 --variations-seed-version=20250610-180047.803000 --mojo-platform-channel-handle=5612 /prefetch:1
  2⤵
  PID:5820

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:6076

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:868

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2088

C:\Users\Admin\Downloads\WindowsLogo.scr
"C:\Users\Admin\Downloads\WindowsLogo.scr" /S
1⤵
- System Location Discovery: System Language Discovery
PID:2040

C:\Users\Admin\Downloads\WindowsLogo.scr
"C:\Users\Admin\Downloads\WindowsLogo.scr" /S
1⤵
- System Location Discovery: System Language Discovery
PID:5500

C:\Users\Admin\Downloads\XScreenSaverWin-0.78-Setup.exe
"C:\Users\Admin\Downloads\XScreenSaverWin-0.78-Setup.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4680
- C:\Users\Admin\AppData\Local\Temp\is-O5FV1.tmp\XScreenSaverWin-0.78-Setup.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-O5FV1.tmp\XScreenSaverWin-0.78-Setup.tmp" /SL5="$D025E,4552641,54272,C:\Users\Admin\Downloads\XScreenSaverWin-0.78-Setup.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:5056

C:\Users\Admin\Downloads\fireflies-scr-2.06.exe
"C:\Users\Admin\Downloads\fireflies-scr-2.06.exe"
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4800

C:\Users\Admin\Downloads\SimAQUARIUM-2024-V3.10.1.exe
"C:\Users\Admin\Downloads\SimAQUARIUM-2024-V3.10.1.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2984
- C:\Users\Admin\AppData\Local\Temp\is-AGE5B.tmp\SimAQUARIUM-2024-V3.10.1.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-AGE5B.tmp\SimAQUARIUM-2024-V3.10.1.tmp" /SL5="$E021E,53053948,832512,C:\Users\Admin\Downloads\SimAQUARIUM-2024-V3.10.1.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:5700
- - C:\Windows\SysWOW64\rundll32.exe
    "rundll32.exe" desk.cpl,InstallScreenSaver C:\Windows\SimAquarium3.scr
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Control Panel
    PID:1792
  - - C:\Windows\SimAquarium3.scr
      C:\Windows\SimAquarium3.scr /p 1376372
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:6816

C:\Users\Admin\Downloads\Midnight-Beach-v2.exe
"C:\Users\Admin\Downloads\Midnight-Beach-v2.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:6944
- C:\Windows\SysWOW64\rundll32.exe
  "rundll32.exe" desk.cpl,InstallScreenSaver C:\Windows\Midnight.scr
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Control Panel
  PID:6996
- - C:\Windows\Midnight.scr
    C:\Windows\Midnight.scr /p 393596
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:7040

C:\Users\Admin\Downloads\fantasticfish.exe
"C:\Users\Admin\Downloads\fantasticfish.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:7120

C:\Users\Admin\Downloads\DreamAquariumXP.exe
"C:\Users\Admin\Downloads\DreamAquariumXP.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:5676
- C:\Program Files (x86)\Dream Aquarium\ErrorsAndUpdates.exe
  "C:\Program Files (x86)\Dream Aquarium\ErrorsAndUpdates.exe" -i
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:6804

C:\Users\Admin\Downloads\DreamAquarium2_win.exe
"C:\Users\Admin\Downloads\DreamAquarium2_win.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:5668
- C:\Program Files (x86)\Dream Aquarium 2\Dream_Aquarium_Updater.exe
  "C:\Program Files (x86)\Dream Aquarium 2\Dream_Aquarium_Updater.exe" -i
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2332

C:\Windows\fireflies.scr
"C:\Windows\fireflies.scr" /S
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6532

C:\Program Files (x86)\XScreenSaver for Windows\random_scr\random.scr
"C:\Program Files (x86)\XScreenSaver for Windows\random_scr\random.scr" /S
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1268
- C:\Program Files (x86)\XScreenSaver for Windows\pinion_scr\pinion.scr
  "C:\Program Files (x86)\XScreenSaver for Windows\pinion_scr\pinion.scr" /S
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4488

C:\Program Files (x86)\XScreenSaver for Windows\voronoi_scr\voronoi.scr
"C:\Program Files (x86)\XScreenSaver for Windows\voronoi_scr\voronoi.scr" /S
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5640

C:\Program Files (x86)\XScreenSaver for Windows\unknownpleasures_scr\unknownpleasures.scr
"C:\Program Files (x86)\XScreenSaver for Windows\unknownpleasures_scr\unknownpleasures.scr" /S
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3480

C:\Program Files (x86)\XScreenSaver for Windows\unknownpleasures_scr\unknownpleasures.scr
"C:\Program Files (x86)\XScreenSaver for Windows\unknownpleasures_scr\unknownpleasures.scr" /S
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6976

C:\Windows\WinSxS\amd64_microsoft-windows-scrnsave_31bf3856ad364e35_10.0.22000.1_none_37833ea9df2deb57\scrnsave.scr
"C:\Windows\WinSxS\amd64_microsoft-windows-scrnsave_31bf3856ad364e35_10.0.22000.1_none_37833ea9df2deb57\scrnsave.scr" /S
1⤵
PID:6032

C:\Windows\WinSxS\amd64_microsoft-windows-scrnsave_31bf3856ad364e35_10.0.22000.1_none_37833ea9df2deb57\scrnsave.scr
"C:\Windows\WinSxS\amd64_microsoft-windows-scrnsave_31bf3856ad364e35_10.0.22000.1_none_37833ea9df2deb57\scrnsave.scr" /S
1⤵
PID:5364

C:\Windows\System32\scrnsave.scr
"C:\Windows\System32\scrnsave.scr" /S
1⤵
PID:5216

C:\Windows\WinSxS\wow64_microsoft-windows-scrnsave_31bf3856ad364e35_10.0.22000.1_none_41d7e8fc138ead52\scrnsave.scr
"C:\Windows\WinSxS\wow64_microsoft-windows-scrnsave_31bf3856ad364e35_10.0.22000.1_none_41d7e8fc138ead52\scrnsave.scr" /S
1⤵
- System Location Discovery: System Language Discovery
PID:2432

C:\Windows\WinSxS\wow64_microsoft-windows-scrnsave_31bf3856ad364e35_10.0.22000.1_none_41d7e8fc138ead52\scrnsave.scr
"C:\Windows\WinSxS\wow64_microsoft-windows-scrnsave_31bf3856ad364e35_10.0.22000.1_none_41d7e8fc138ead52\scrnsave.scr" /S
1⤵
- System Location Discovery: System Language Discovery
PID:1012

C:\Windows\SysWOW64\scrnsave.scr
"C:\Windows\SysWOW64\scrnsave.scr" /S
1⤵
- System Location Discovery: System Language Discovery
PID:5000

C:\Windows\System32\scrnsave.scr
"C:\Windows\System32\scrnsave.scr" /S
1⤵
PID:2788

C:\Windows\Midnight.scr
"C:\Windows\Midnight.scr" /S
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1648

C:\Users\Admin\Downloads\WindowsLogo.scr
"C:\Users\Admin\Downloads\WindowsLogo.scr" /S
1⤵
- System Location Discovery: System Language Discovery
PID:5212

C:\Windows\SimAquarium3.scr
"C:\Windows\SimAquarium3.scr" /S
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:5200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://simaquarium.com/buy-now/
  2⤵
  PID:4900

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004C4 0x00000000000004E0
1⤵
PID:1108

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:904

C:\Windows\SysWOW64\DreamAquarium2.scr
"C:\Windows\SysWOW64\DreamAquarium2.scr" /S
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4876
- C:\Program Files (x86)\Dream Aquarium 2\Dream_Aquarium2.scr
  Dream_Aquarium2.scr /S
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1004

C:\Program Files (x86)\Dream Aquarium 2\Dream_Aquarium2.scr
"C:\Program Files (x86)\Dream Aquarium 2\Dream_Aquarium2.scr" /S
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:7036

C:\Windows\SimAquarium3.scr
"C:\Windows\SimAquarium3.scr" /S
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:7044

C:\Windows\FanFish25.scr
"C:\Windows\FanFish25.scr" /S
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6976

C:\Program Files (x86)\Dream Aquarium\Dream_Aquarium.scr
"C:\Program Files (x86)\Dream Aquarium\Dream_Aquarium.scr" /S
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6120

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" a -i#7zMap8484:16388:7zEvent28388 -ad -saa -- "C:\Users\Admin\Downloads\Downloads"
1⤵
PID:5600

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Dream_Aquarium_Updater.exe

Path C:\Program Files (x86)\Dream Aquarium 2\Dream_Aquarium_Updater.exe
Size 564KB
SHA256 395e4f091fbd9924cefd7a9241b8ea48dc3e0965a8a69809b2e6364ca21e25d3
MD5 ba57ef326f60b4fefc5bdad43ee3b772
SHA1 6be8ea1d2199bc81d8b9128d87ac834ec85cf5d6
SHA512 43ea06a37e1e1aae48174b92a4b4fd4abf2a772325d81d6064d86e442b7c45be8216f042b4bb7295fa81d48824d27ec8266d5ef626aabb8314e48050d71f1ede
SSDEEP 12288:ohyn4S4K0gn6aKYQbswKV+bsCOxd5KGFG:oh24S6gn6aKYQCV+bsCOcGFG
TLSH
T15DC41B1B3273F831D0B928B84993967C62F46E1077696A5363F47B297B34BE1960CF09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DSPK002_picker.alpha

Path C:\Program Files (x86)\Dream Aquarium 2\adn_support\DSPK002_picker.alpha
Size 8KB
SHA256 7ed9409873d337bd72505a74e431ffba91079e57beb7837505d3655fde174784
MD5 fe9fe7db49ca3f3912d49414939e665d
SHA1 d84198b20a6db8a1737686986283fd75602618be
SHA512 f09c6adfd670d0723184777d7251fbf43c5bfae3f5848c2898767eb05678a4a51107debb167139ab758b56888910c90eac4fc1daccb7442c34b651ed4c78e988
SSDEEP 24:JG20N2VCK2E0kUMk6C2ltnt+9Smn1C+dyq+1aS+scM8N+V6yofb0:JG1N6CK2HHt6CKFHHHuA
TLSH
T15F02039FB7405A69C0BD1831EFC61C5EEA8B0E465F790E5BED28871A7B45108C347DCA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MRPK001_picker.alpha

Path C:\Program Files (x86)\Dream Aquarium 2\adn_support\MRPK001_picker.alpha
Size 10KB
SHA256 7963ef20e0c9d5eeb59aa9d7672cfbb315a992de51415bb19288809d79f420e5
MD5 388b2a7a1e230e0f08ce503e1cf125a0
SHA1 aa9eb073b288daf56dd31c9f1395c7e71ad20973
SHA512 57610373f42e4fbdd37b6eb61ea5cefaa1aabef7a9ca76d7222c8bfa9b3cc5e76173b8706fc406b8aa4de37b3822ae4d6e4ba1f08af47a8f2703ecd85c432947
SSDEEP 192:vdnAL9zgQlNlsssssssssssssssssssssssssssssssssssssssssssssssssssA:viL9zJFssssssssssssssssssssssssn
TLSH
T123229D9BEE009A2CCCBD2832E6A18C424588DDC6CDF84D5AFE1D4C5877D7D0802CBE89
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

generate04.mat

Path C:\Program Files (x86)\Dream Aquarium 2\species\gui_boxes\materials\generate04.mat
Size 534B
SHA256 4a2ec224306e803b4aa0488396b58b2e677e7df10e30a5522bba3be022e039ec
MD5 b775d2af78f3847cc71a14dc130a554a
SHA1 3732aa6a04ca1d48310822a0bc2d61ab38dd7592
SHA512 13eb0473cedd5e24c2a278db2a36a2545f8bf4498e1a264129ba4cb5fe4bec2bb7fee429b39c7f13c2de9184faed3222b14f7d7893f7427cb88d8fd6f2ca187f
TLSH
T164F0209408C2744AF687FEA163A22A2B20E58F2F2214398739AE0782A9669D13A10016
MD5 SHA1 SHA512 TLSH

Submit Download

next_heart.alpha

Path C:\Program Files (x86)\Dream Aquarium 2\species\gui_panel\arrays\next_heart.alpha
Size 7KB
SHA256 b0ca49befdf77548e47260d4576dc0d50c9f71431d346be44595e54182fbb0a3
MD5 6d2141744aa9d475a9ff9ed8cdd4e915
SHA1 aea6abb243e4f83007d3864c4aa16d17c4efc44f
SHA512 2313f365d440c184db4bc990b671ba780101758692fe90a936d22e8f0e8c4af36ffd10313c82d49df1e6bed48dc359d4a17263ec65bf998d6d50fdce7b8defcf
SSDEEP 192:jSs/n3uNTloJxQPs4mJxuxqe0yxzOfg37:jSs/n7JxQPs4gxuxqe0yxzzr
TLSH
T158F1F6BA20FAD536C547C276FB56CC683315AB48C242ABCD738F9B6DF35B66B0205840
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

backdrop_skeleton.ageo

Path C:\Program Files (x86)\Dream Aquarium 2\tanks\moss_angeles_v2\backdrops\sbd_plantwall\backdrop_skeleton.ageo
Size 172B
SHA256 5841ea33d674014970fe190ded08dcd001be3030bb43cf0bdd09108a88ffd919
MD5 769f2607889a5594a27203f0ae6800f2
SHA1 e816e8be50cb5baeaa7e0bad533a5c8f74de5921
SHA512 3ce90e7b826c7c7c97bc30cc2cb3f2066277e2c0a4c9db7f71ca5eac35692c7c1a37d8f1f96b66550df17567d223f20364f453f462e5fec260480a84a26a9893
TLSH
T1F8C08C8030B40956D99EF1FE52684187302E10FDA0A28E1E0B4E80CB0A5B2C076B0B3F
MD5 SHA1 SHA512 TLSH

Submit Download

swatch.spec

Path C:\Program Files (x86)\Dream Aquarium 2\tanks\swatch\swatch.spec
Size 1B
SHA256 bbf3f11cb5b43e700273a78d12de55e4a7eab741ed2abf13787a4d2dc832b8ec
MD5 0bcef9c45bd8a48eda1b26eb0c61c869
SHA1 4345cb1fa27885a8fbfe7c0c830a592cc76a552b
SHA512 91972aa34055bca20ddb643b9f817a547e5d4ad49b7ff16a7f828a8d72c4cb4a5679cff4da00f9fb6b2833de7eb3480b3b4a7c7c7b85a39028de55acaf2d8812
MD5 SHA1 SHA512

Submit Download

frontrock_key_glosso.alpha

Path C:\Program Files (x86)\Dream Aquarium 2\tanks\wabi_sabi\background\arrays\frontrock_key_glosso.alpha
Size 2KB
SHA256 37643bf67d810f6e4ace534aca6a99d04e129930e7117ffffbbeaec3df187479
MD5 dd8e48f67949e510a0298786be68fb5a
SHA1 5aa211d5e4885514c42819d816c79c70c6550e18
SHA512 ec5288dd60dd2b2a5dc28a43564a09f1fa6a6b8991e84cbcd6c4cfb560007a485e847c6e416486431bf21feac33551ef7d7ff28a76b43559c1e769a3f2184579
TLSH
T1A251FFD096740A49D03F553402CAF029EAF839DA1C221F40F86C730277D4271B3828FE
MD5 SHA1 SHA512 TLSH

Submit Download

ErrorsAndUpdates.exe

Path C:\Program Files (x86)\Dream Aquarium\ErrorsAndUpdates.exe
Size 408KB
SHA256 0edbc7a65fa6ab062c4d64cf45c712d3c28e9765b3674f91622e197f82d173cd
MD5 bd8968c56a7bcd2aa56e589d8cf3b8e1
SHA1 b1a27937cfde3bba2900769ea096aff6a541c0e5
SHA512 917dde9038235c883163034d02cd617e70007a220bcc25b2c717a77ad32808a40c68a205442253e5159bc56cdf9166f608f0447c2ae3ab00ed7b33bc8c06e24d
SSDEEP 6144:atHPBWlH2CSKyBPNmYR7SrN7LHQk2oi0uoGSqLB99/8chJhfy:+HPaOBP4Z7LHQk2oirpLBXxJU
TLSH
T11D945A21BB90C076D27335718E66D7B46AB9B8729935870777E02F3D6F345C28A3930A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thumbnail.alpha

Path C:\Program Files (x86)\Dream Aquarium\species\angelfish_marble\arrays\thumbnail.alpha
Size 2KB
SHA256 05a9a6548896adf0e6e7a7f221b3df25ef1f2d0674927c7895447eb3f69cd064
MD5 2622a1def2a59f2ceb5c0b5cb85b7ea5
SHA1 aa96f2358122d6e24e8b760d97f5af73fd03cab4
SHA512 933d8c06bab86c2a1fb7dc6f347f1bcb1d367e79e4e50b251c940a075513d0f8172103276212bed96dc1de4de99156137d84708a214930b883670b18bd95d64e
TLSH
T135518E9F77640949D03C5534CFCA9C2DEA272D5A1F321E43AC6C63027714261E383CE9
MD5 SHA1 SHA512 TLSH

Submit Download

generate17.mat

Path C:\Program Files (x86)\Dream Aquarium\species\gui_panel\materials\generate17.mat
Size 771B
SHA256 128ab3efcf885d8f40e8f0d1ec28616ccb9ffcfcc8e7a35a905983576bce7932
MD5 916263ee4dc2a0e7a3e1798a598833d2
SHA1 75e680a67e3ec243bf06be2d6ba68f4b0750c862
SHA512 7ccbcc9aac72d41001a83267b6731fa31e0d7e69453eb1cda4a97f8239c01b487a9ec2cd03459296ffed4ac0d45ebc65c14ecc1c593efc791e77e45bffb5f131
TLSH
T165017580BA3A2EE9074C8B0687318A4C8A45768609F72D86ACCA85E3982E47554E803D
MD5 SHA1 SHA512 TLSH

Submit Download

D3DX9_43.dll

Path C:\Program Files (x86)\Sim Aquarium 3\D3DX9_43.dll
Size 1.9MB
SHA256 0b28546be22c71834501f7d7185ede5d79742457331c7ee09efc14490dd64f5f
MD5 86e39e9161c3d930d93822f1563c280d
SHA1 f5944df4142983714a6d9955e6e393d9876c1e11
SHA512 0a3e311c4fd5c2194a8807469e47156af35502e10aeb8a3f64a01ff802cd8669c7e668cc87b593b182fd830a126d002b5d5d7b6c77991158bffdb0b5b997f6b3
SSDEEP 24576:8UtU6OIyl2Wy9M3bJ45fPS0zFZghQ6aOiFaKOE31GrvFXl74YZ29X1MDd6olmrBs:8566l2u45BiNYFrz31Cv3D29kd6kWa
TLSH
T14895AF51C5191075FDE69030110D32B2219C9B316391ABCF665E2ED9FFB8BE1EAB8387
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Sim Aquarium 3.exe

Path C:\Program Files (x86)\Sim Aquarium 3\Sim Aquarium 3.exe
Size 2.3MB
SHA256 5d40ca1f2a04701c758d0f9130bf326b1a829b3f2ae22ef6f5bc8a70dd384241
MD5 00f0341e5bddd71c4580cc3677f3f340
SHA1 bb07523bc379d572442ad5bb2e7c084b59a4b061
SHA512 2826ea5ceff1f503509c37a67a1148c25a1bc19d74e0d4a4bc631de084e8350b89bd18f28a59f104e5eb127ac09f67ea21989044cc175074706c85eb31405796
SSDEEP 49152:eL8IEKKDSye+Tk2ncdy63JQ2gl8VTzPTSAr+hNL4Xc1RL4Xc1:0h+Q2nyy63JQ2KMTzGAr+vL4Xc1RL4X
TLSH
T18FB58D415496A064C761CE70901AFE6B8A3E9E79336318DF6BE17CD83AB15703DE7322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unins000.exe

Path C:\Program Files (x86)\Sim Aquarium 3\unins000.exe
Size 3.1MB
SHA256 2dce6b4d952c58ab7f29d453a3c6e9dc9a988786d0d41f339b5368648f0c790e
MD5 8ab148bcc17c145f266fa9f75a877daa
SHA1 46bdfb05180570d70b71c7efb287e85644a1d8c5
SHA512 81fe44e9deaa4d1d6bce51633ae5099151240bc5d4347e59a900ec27728fc45f78febf534780b95e9a44b6bef55dd5a0b11ac261a14cee9d94ac5d6fec031b39
SSDEEP 49152:pWGtLBcXqFpBR6SVb8kq4pgquLMMji4NYxtJpkxhGjIHTbQ333TYf:7tLutqgwh4NYxtJpkxhGj333T4
TLSH
T1A1E53A17F28C713ED06B3A364A3385909837FA6179168C279BFC794C8F365942A3E647
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

starwars.txt

Path C:\Program Files (x86)\XScreenSaver for Windows\starwars_scr\starwars.txt
Size 3KB
SHA256 69950159f9b537be44d4e56c0abc94af29e0e8aa9056938f6cbf9cb64a632b3e
MD5 6a025dfa0f423a228b637bbe2681296f
SHA1 d2c6727dd5baf5495a6b7a27633a72bd75782898
SHA512 93576e5396974a2db4009e41fd9ea675d3596e33e4a8e801d2d8f8fd72a42f6a320e7a33999e40187a73d0a5bad322b88422bb185e659948b10f3cc36d33427c
TLSH
T1D361D631F798233789125BF2E01E78C3AF35A138E77712C5681E51283549832C2FB9EA
MD5 SHA1 SHA512 TLSH

Submit Download

26c3e6e0-cb90-40b0-9f0a-ca507ac99752.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\26c3e6e0-cb90-40b0-9f0a-ca507ac99752.tmp
Size 82KB
SHA256 efce1abae89ad0493f71a52e093559df31b9255e208042f37662c0fdeb3f28ec
MD5 e0b3580bc76faf6a698d86e1662e8be6
SHA1 16cfc10ddf15054ce1d23975e4a9da4109b67b1a
SHA512 168c0d1e9166e3ad892cdd51e4dc7b6685df53f33ddf084d984a5575d1ba27c394ce65fe23146880735df0aa33d22aa6b5c0d71ff8aa1538d4db2ebcef5e71e9
SSDEEP 1536:IUUOxbytlt+0eqgYswraFwWVS0zo2OYjjPbYtfBqeMc9:b/WXtHelYDamOeYjnrc9
TLSH
T1888302B1BB5C47772AB1120ED8546D5BDCFD298F9402ED469EEC1B0F21E1ACE211E21E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 f3f17863b8b3ef3dbe3b43d98e1c51d51d0050396fca00c5179b68a8606e614a
MD5 427dd6e0120c5d13cfc9bf571599e4e7
SHA1 9d929e1e5c01057bef22a4c4f7febc9d5c7f7940
SHA512 4034f32dadc7f9a55c7c0f8bf962e938e6b25ff9121bef1889fc518a522b3cbf8d9657821c43ae437b4cb1348f1e5b52a77800c11ddc2ed972064cde841a29f9
TLSH
T190E02B96C861AC3708FD171D7060434AE791131B2A919A4F3A3C910DDFB1B3A4696C9C
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.104.1_0\_locales\en\messages.json
Size 851B
SHA256 6895648577286002f1dc9c3366f558484eb7020d52bbf64a296406e61d09599c
MD5 07ffbe5f24ca348723ff8c6c488abfb8
SHA1 6dc2851e39b2ee38f88cf5c35a90171dbea5b690
SHA512 7ed2c8db851a84f614d5daf1d5fe633bd70301fd7ff8a6723430f05f642ceb3b1ad0a40de65b224661c782ffcec69d996ebe3e5bb6b2f478181e9a07d8cd41f6
TLSH
T175012506E2516A2B03B2A12775613641F57045EA1200DCBB7A7CD41C9FB6DAB918BBD8
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.104.1_0\_locales\en_US\messages.json
Size 1KB
SHA256 102b586b197ea7d6edfeb874b97f95b05d229ea6a92780ea8544c4ff1e6bc5b1
MD5 578215fbb8c12cb7e6cd73fbd16ec994
SHA1 9471d71fa6d82ce1863b74e24237ad4fd9477187
SHA512 e698b1a6a6ed6963182f7d25ac12c6de06c45d14499ddc91e81bdb35474e7ec9071cfebd869b7d129cb2cd127bc1442c75e408e21eb8e5e6906a607a3982b212
TLSH
T161210707DA04AB37827A6136BC656685F33007EE2201E86F7DBCD50C5F229A791A7798
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 454fb13d5214954f3980bc408dea28b175719c128301b73066670ec075738654
MD5 80c46a4522e5ea7435166d12937ca385
SHA1 34a0b0639f2cbed8446050036cd48f0248a9f0f1
SHA512 141ec97dfd114389b13d9135f3a0e8751a8934ff5f0d0238669b19b1c384409092a298f5a2199a45948a9eef7551a77c7ca963df127bd636bab5a73273e7731f
TLSH
T1EF519CF3C2E486AE855157E86B257E1FCE7E0954132C3D66C8D8AF4B53F1872D21128E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 b087805a9af3da7ad4912d8c4ab27b2c0b065b6f40540ef95ee983817c419fbe
MD5 b9260df79a7bc51f35d3a3283ccbdfdf
SHA1 f7968e8a72bcc0a933ca8a0ff7ae625d86fd8ede
SHA512 cb7a0a2f2f736ca5908dd628b3d4ad4b76d2e1a7ced6796ae4916cf95c42c8924d2517085a172ed6790da2f1a7d87a292b275420772d6cd8c16c3a6a477fb42c
TLSH
T16E518CF783E446AE854196E86B25AE1FCE7D0914132C3DA6C8C4AF4B43F1972E21138E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 06d2355c6fa8e32c456b5104895828e51b200d8ef6d09c90945c49380852941f
MD5 93123cbdc218a1c82199cdb454dea6f6
SHA1 943decc8eb77ddd500a40f8fdbb080f86ebae537
SHA512 92c05dedee4cc37c4747fa62778cd4964800b5d2029d2fd3b40c3751a8c8dabb8c44833cc9468a4bf3f74bbeaf98e5094658833a79ab281b21718e72773648d1
TLSH
T108517CF793E446AE855156F86B25AE1FCE7D0924032C3DA6C8C4AF4B93F1872E21135E
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 690B
SHA256 5f8f08cca441ce4ec3a56c44a3ba0e451618336b8fd0d851068f0f475682ab13
MD5 de8a7bf06276dd6e50a8612a41b2e166
SHA1 e646944782f4bdc24305b2320a4c141bb3cbdd0b
SHA512 14ccb5a8e2dea995f1c0ce2b122d8ee76c416fe995622921b33309cd83940f948aca08d96db62c244f36d03e81e52a62da31aaa9dfa03159aa4ea1dc48b82775
TLSH
T1DC017BBBE27E746B50B88EAB6D04BC0A6776B436168138F4DE7A816CF0415F30B26413
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Platform Notifications\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Platform Notifications\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 0bc5a91d8d7c81702de5bb578bccb9620737a5b5f63ff2fe097268bfdfebb973
MD5 c0f0ed454163123ce220367134ca3693
SHA1 19c971badefbf90c8d9ab32f5c1826ad39680584
SHA512 d12c09c0de43c96b96415ace4928edabcf6e89d6cb56897a13dc68ef850ca90b6fe200a51ecabb299e56dc530700770691a739f60016104a010892ffe3e849e1
SSDEEP 192:YYRWXDe9AkAZ8PRpPcZKHS+WN4jY4x+AzykwUQhypQyIsnA/g2:YYUXD+AqXMecz4w3hsZ2
TLSH
T13432E72E9D14997B8CC7D62DFE563B52D7F5202221842E88EAFCCA1C15E76EC612701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 7bbbf924ddcc6179c37624be75e3e7c3b8a9f473046953fd050a0adcb6b568b3
MD5 51ab680b571249695cae641bfae55504
SHA1 79afc5dd9bf9786b66683db6c3a0848ef3f399a3
SHA512 27aa1f92f32ec91f8eb65856f1d1f4a1ec986a5a34d1ce5ed42646fd8bca88c9aa801409fc5458c3818134d1725020fa26bcc18b03332a764b21cb2a6d8e2829
SSDEEP 192:YYRWXDe9AkWZ8PRpPcZKHS+WN4ZeoT+AzykwUQhypQyIsnA/g2:YYUXD+AcXMecnoC3hsZ2
TLSH
T16D32E72E5D14997B8CC7D72DFE563B56D7F5202221842E88EAFCCA0C15E76EC612701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 7daf46b410b12701157990e74462bb0c14b20fd974896e36e168859da1b72a9e
MD5 f0c9ccc257988317a549619bd224711f
SHA1 0aa67946252f7a06fc717cadd187b601e9e86200
SHA512 9bf1e85c0c43785c23d31f9b5d276e8ac51584503f50d924346797514860f8c316e235ee86dd2dec444d35f4cf946acadf6539bd0ec2af79f9e1886d9aebd15c
SSDEEP 192:YYRWXDe9AkcZ8PRpPcZKHS+WN4fUDF+AzykwUQhypQyIsnA/g2:YYUXD+A2XMecLDs3hsZ2
TLSH
T15532E82E9D14997B8CC7D72DFE563B52D7F5202221842E88EAFCCA0C15E76EC612705B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 7dc79e101619aa3632e473e960f2ffededcb05abd0587915a8bb54271603c440
MD5 1d24313539a4b577064c51776df6a516
SHA1 f05808c467cabd60df973094c159cbfec66726dd
SHA512 e3ea51c461e31fb324486a7740ea62695976bff44643cf2718184c078d6076df5aed9b4888aff084308f0982d60ccc41933f7f4eb54af34fcd6a713bfb58e64d
SSDEEP 192:YYRWXOe9AklZ8PRpPcZKHS+WN4dH3e+AzykwUQhypQyIsnA/g2:YYUXO+A9XMec+3Z3hsZ2
TLSH
T18F32F82E9D14997B8CC7D62DFE563B52D7F5202221842E88EAFCCA0C15E76EC612705B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 d9a45be37086d9b83f5901c5c4fad4f2519a3111a35b645fee8b04afec5c3c1e
MD5 245acc3917440a926d84f3ab526456db
SHA1 6a250be951725c5c2d63fe2acc4602be46de99d7
SHA512 30c75fb0311a5a561f04369056e02093a8b65e38eb2ac98c8b0a58877880f728ce677b70bc7c3dbf13d8c9fdaf47a1bb2e5dcc6188fcdea1193577a5bb1d8cee
SSDEEP 192:YYRWXNe9AkPZ8PRpPcZKHS+WN4E18at+AzykwUQhypQyIsnA/g2:YYUXN+AXXMec98aU3hsZ2
TLSH
T16632F72E9D14997B8CC7D62DFE163B56D7F5202221843E88EAFCCA1C15E76EC612701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 82e7ede5e7bf87c9ddb754ea4176213c2ac31d5e182aeba61a2a2e8689d42c51
MD5 ef15b5d988d2c190b05f58a9f5efabdd
SHA1 b873012b570f5268205161d4121446271066ad25
SHA512 544c5c367033c9703872ae0aa433dc9a83c65faf194479594fbb6878cea6ed18e8504e6489b13627b2ba831bf2834c8838683424ba9b46a68988c8327237bb69
SSDEEP 192:YYRWXne9Ak9Z8PRpPcZKHS+WN4C2z++AzykwiQhypQyIsnA/g2:YYUXn+AFXMecMz53nsZ2
TLSH
T17832E82E9D14993B8CC7D72DFE163B56D7F5202221842E88EAFCCA1C15E76DC612705B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 e25ada7193c6dfe68cdea524606e849bd068133ab71c00af01532f954511b91e
MD5 d379c03ba0503301cb5fdb28e1e526a7
SHA1 0776d62864508bc86ed4b51e2011b3f9122e9ad0
SHA512 590e32f7539932817f045118c4a56efea496366c1925bcb8a092cf44c6228ba77484872d756050ea12c6946f546ab0b764b15adf1a94a137552ef4a867cded7d
SSDEEP 192:YYRWXDe9AkmZ8PRpPcRVKHS+WN4fU03k+V+AzykwUQhypQyIsnA/g2:YYUXD+AEXaecLP+c3hsZ2
TLSH
T1A932F82E9D14993B8CC7D62EFE153B56D7F6202221942E88EBFCCA0C15E76EC611705B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 bb39a03b73df4e76a86a9a176d437b4188cac37cdd1e60145489514b4ad02d1b
MD5 7de5b6ddb444bc1e7a320b1a2726f13b
SHA1 f20037d19b1b1eb7edc82f69daddb1ebd8969de8
SHA512 2fd5534e9f8b0837f2f66f90a171542831a2a9359e540031d4de9ee7f7089ec5721e65e82ef3d7fee3b0f8934eabe895560997c617265ce18fbc592e6398a8cd
SSDEEP 192:YYRWXDe9AkxZ8PRpPcZKHS+WN4fUDF+AzykwUQhypQyIsnA/g2:YYUXD+ApXMecLDs3hsZ2
TLSH
T1C332E82E9D14993B8CC7D72DFE563B52D7F5202221842E88EAFCCA0C15E76EC612705B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 2b953a215050132b6a9a50de4d83e8dfa820e65c36e06d22de42f1001b325260
MD5 ebbf0b5843d2e25b666c855e24f460ba
SHA1 c22a55ab0031d1bb4629503ec49201c2ff7569a7
SHA512 52e82d18032fd5f3a8eb79b060eb741b9a81eac30cdb6e66e25ee5811ede411e8ee5079c8e50e325da95639fb39ad75ed7cded403aef21edd7b759eee639e1f7
SSDEEP 192:YYRWXke9Ak5Z8PRpPcZKHS+WN4MNxSt+AzykwUQhypQyIsnA/g2:YYUXk+AlXMecFxSU3hsZ2
TLSH
T14C32E82E5D14993B8CD7D62DFE553B52D7F5202221843E88EAFCCA0C15E76EC612705B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 b8e2cddcd778e1844f9c99bf83a7e61f57b40e8a83129b6b5fc366cc7637c65e
MD5 31aa07ccc88ac14083afdb37b6feca4c
SHA1 876f4f5ac8d5498cffa1c133a7a035a6d9d0c678
SHA512 581bb0ed072465e622a77afcf0bc62e88f9874d5687d3bf30a24c418ca97bba3a11c783325fbc7bd57cdab835426996ba3d59e54c378f24f68931ed015d29e8d
SSDEEP 192:YYRW8De9AkcZ8PRpPcZKHS+WN4fUDF+AzykwUQhypQyIsnA/g2:YYU8D+A2XMecLDs3hsZ2
TLSH
T14932E82E9D14997B8CC7D72DFE563B52D7F5202221842E88EAFCCA0C15E76EC612705B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 10KB
SHA256 12e5cf3a132a07d842bb07b2c37caa1f18403190c63f7c9dc0feab3c3b13f18c
MD5 cdb3a803a7a0ba3d49245ee185aa36e7
SHA1 489f8e0a276aabfb7229da3abb6dd7a69215bd0b
SHA512 32666af917ca751ae9d2b6305b849281f2f8bb7a1ab102d1cb0d2791a98129a2ef43637f4a1f877f4438f36acdafaec1e0cd11e575b043e909fbd5e8e108ee3d
SSDEEP 192:YYRWXYe9AkhZ8PRpPcZKHS+WN41io1+AzykwAQhypQyIsnA/g4:YYUXY+ABXMecLo831sZ4
TLSH
T10532E81E9D14993B8CC7D62EFE553B56D7F5202221843E88EAFCCA4C15E76EC612701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 18KB
SHA256 a35b1f59f5611ad9a1890995009bc4ecacb5f8fae807e14602ec9f53d0c38705
MD5 e50fe2a3628ecb6c7054978b726b5628
SHA1 7206e12a0605ea4dd2628e5059ae4e9580b4ade2
SHA512 a00caa350eba7cf6cd69a37dd0e381227ff077c8e8a65a1a395a8d10af50b83d063e54c2282c143bef06ab9680ca833161008bbf6879c097ce688809cb5e0023
SSDEEP 384:cw7b7pLuLcjVv7pLuLcghExXazPkXqKf/pUZNCgVLH2Hf1AxrUfhvHG4nA:cSb7pLuLkVv7pLuLpmVazPkXqKf/pUZV
TLSH
T14182E7A77C088D774F90CAC8D92A7A4FADB5124B55DEC4A583FA982703D0EDE11052FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 15KB
SHA256 3e19c895834b21b6365d1246090263b2d54f0dfa0c5cde4d72fc71cf8bde18f5
MD5 60a70bfc4d2355551a1b1d2efc0bf23a
SHA1 532684b3ed53835935b29e57a34206b23a50fd51
SHA512 e140c11811a1ba7b058637e04564b2092548367b5224270b6e498a2d88506a14464234bb168632a275acb8187b12ad367c8346ecf2c9458ede3b12562f2a1502
SSDEEP 384:cwBPv7pLuLcSjExXazPkXqKf/pUZNCgVLH2Hf1AxrUfhvHG1nn:cYPv7pLuL/oVazPkXqKf/pUZNCgVLH2I
TLSH
T1D4720A677C0C9A7B4F94C9CCD82A7F4FACB5025B55ED889493FA982603D4ADA01052FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 6f0ac51b914474df30885103a8e05cabdab0544fd89ad0b86695e6cad8adc3c2
MD5 b8e87bfc904f70811c2b641a7cb58f51
SHA1 01c7708c6196ba90f1d6fc6ce78efb29b4dc5650
SHA512 1e7942bbd9a35987e35b4fdc72ae496d2ee8a14f4f497b01794e8b6e6fd365f2c00d23d83136dfddafd3d32f93c68a580963dcdc6361e8db6a0ae432ca243c6c
TLSH
T118A002FC01D92203C8000770304A218763605C353285178179D1989DACB114092DB10A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 d4de47a0fd4a23f1f364929909864fb57e25a8e76fecf2cf9292d21fd9bfeb0c
MD5 d62f287f8e0e56ff10a396090e31c1c7
SHA1 3fbbcd042563c60e4c69c4abb6942d40cdcf1e92
SHA512 7b285dd1d26d0d2dcff6d28288e22a8c1f458a14189b68068875f07f7041f73a4013b2b2a08cc08abf7d9083b6baa790e317cf4eeba25a0ae9479667b14fb87b
TLSH
T17AA0022112650491C9140BB09E4302E423754C128136275653A4A8B6AC54150CA1E055
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe580644.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe580644.TMP
Size 48B
SHA256 d47e7185ca94f455bf144b03ad40d5865c80a68c37bcfece0b87f7078baaf6dd
MD5 5f3f0bfe65ff0039720a550ebd33a434
SHA1 223ed897b0bdf36366cb32d1cfec2fca3ce6a480
SHA512 30d52a011f65a9e9eef170df26dd4426e37324d242b74f5ecf7a3b6cf9757880670b68bb0839997893eb6325a2efe3f9fced994a55fb587c17282e8a581e2faf
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 203KB
SHA256 bafc8cd661b43170745c9b0446c27fcc0e53ef5076eae9c6afbcfdcb4f3c1f51
MD5 b7e6fb444d0f657e4728505b24bc5bde
SHA1 411f978d3ae5950723d5f31d7dc0417e7f22d445
SHA512 82ddfaa4aab2036fda89197482f5d55a1e09c159c5ec23af3f51ab346139399aae0472589090bc6e73a805690687ee8b255ea565d111f2f093cb5fe6440a2857
SSDEEP 6144:PKqL+BH7K3gRDdG5XbOblX8Wh0G1WdHXDavpjrc4:PvibK3SdSXbYM7GAVXDavtrT
TLSH
T168141333A936256709F8950F98A87B3F5DD5BEEBC405C88EB8E8178E71D7249291F01C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 203KB
SHA256 ff5fc7ea27a4ad41b47e76c92cab466a2d71d1628c74e11b10c2f9a76b0a3cf9
MD5 aa09803dc3fae706041e7862944a7c3f
SHA1 177ee0600f642ba13a38847ce8986b88931cf027
SHA512 049946240ee719b4e8bd1bdc14d6ccd645d1b3feedbb4cb972ff7fe618875774043631cab5726adde6a2901526526cff5f93d217e388835844852aea8be1f0b3
SSDEEP 6144:6qL+BH7K3gRDdG5XbOblX8Wh0G1WdHXDavpjrc4:6qibK3SdSXbYM7GAVXDavtrT
TLSH
T1A1142333A975656705F8910FA8E87B7F6DD97DEB8405C88BA8E8078F71E3249251F02C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 202KB
SHA256 f1abd3ca2a911b26595b0fdd57e6e5838c8bbee63f6a1c0bb2da81c5e79d0040
MD5 b17e4f29fe7d2e148e3083be69120f0a
SHA1 a7b0a1f59275362d11836696d89f430bb934280f
SHA512 872c685572f3665cecc231f1f735d2cdf394a9a203352e231e93ece37386b48168fb9165d9180c60a4d2494eedad12e98b87997f966297b87110e36fd301f661
SSDEEP 6144:9qL+BH7K3gRDdG5XbOblX8Wh0G1WdHXDavpjrc4:9qibK3SdSXbYM7GAVXDavtrT
TLSH
T112142333A975656705F8910FA8E87B7F6DD97DEB8405C88BA8E8078F71E3249251F02C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

protocols.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.10\protocols.json
Size 3KB
SHA256 4fd800e7b1a5fb24b13fac2e31946d205012b7c28d8c61580b0669b2fa3517cc
MD5 1de85fec2dfcc28011a7c2aaab95eb5f
SHA1 80e8c954bfbe8f7ee5a2335c8d969ae033935dc3
SHA512 9c7dd37eb0c094b6aa05201e7c71a8f33b9db81284223bcfa595a44a6ac95d5a6820ab6f07b7aa8d26bf207454e94277bf35332e9c009ee63f083752b6b51750
TLSH
T1D1611DB79A3048090E3412B86B19B35DF63E029F1AD598EB76BE568F1F710F7245C54C
MD5 SHA1 SHA512 TLSH

Submit Download

autofill_bypass_cache_forms.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.32\autofill_bypass_cache_forms.json
Size 161B
SHA256 f7510e38f81f8a84027304070205dd55127e3233fdf011411465ede67b5b5d92
MD5 4b1a79b1996f03fb926a97912835c881
SHA1 ca43e23f7bbb4ff3839751f722df3c38ef7bd8a7
SHA512 c2e07a1b311ab71d94c7b874d645fe1114fdccfe4468875d6b23318fbe327481a60b2782af105b7546b3c1e6c3a7ec67261b21a0587f914cc7bf77c55f1f568e
TLSH
T1E5C08C07ABB804230B414E0B590DEFC9990476F6D5C146FEAB75A5A98A3C6B0005B74A
MD5 SHA1 SHA512 TLSH

Submit Download

edge_autofill_global_block_list.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.32\edge_autofill_global_block_list.json
Size 6KB
SHA256 7d3c45c8207ba69066516e51e10a2137bc4f1fce070a692e0c65225f9856e04c
MD5 5d4464dabc1289c3a010e14c05b92c57
SHA1 d2d185faca1cd13a6d42dea68803a9941074707d
SHA512 f93f4b58efc0127946ffa1b2950a1cf71da6f77a6ab4cf98ad8ada6a751d6261be4818ff8c64fe1f1d45467aa070e0823d15be36c8259c1044fb2d1289df9994
SSDEEP 192:C73stL7O9FnLk25+tF4B8K5b+QiGoztWuDpR6lFuftdHAa4/i:nwJ2r
TLSH
T133D16A2BA91C54B32A044839128E5BE47DDD73B6DD6008D6D650C0B9AEDFCB8203FDA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v1FieldTypes.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.32\v1FieldTypes.json
Size 509KB
SHA256 611e7995ab7599a0c89f98d6c6152a42aaedf7449748109a465bb5b0badd0af2
MD5 b1c140ef49f01eea089d3957da1a529f
SHA1 de64781f20aac98b4d2bbc497e3defa83b25aa8f
SHA512 02ddfcbaf9eaff793f251bd983394cf473b1340182ac1f3217cb7258ddfbd2de066ab08af16b47a378644bcc1871ad6ed8c641f6a053802c90e77f648e4f4be8
SSDEEP 1536:jlKS/dYt+dtxX9U2/W++dGcUooTHR6rF1azQmkEMUmxralqDAtyttVJAC5c8KrVx:B
TLSH
T148B48E2BF9F25C634D822A32053E18996A30615F5CEC6CD4BB3E211F4F2C1791E797A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 1024KB
SHA256 624eaf606d0845d9ef3f81652f29a5b8489b6543deb1e4fd4903c415238ee9d9
MD5 38623c06e100113cf825efa6a44b2386
SHA1 479d8e0c6d7d10c05203a37707a6249d2537a9ed
SHA512 452d7012b949688cabc6afbf4badfe9d02c090f30c06557f7f87b606cd716cda97771136964935eaa4d1668303889011f75ff599a79a6837c285ef84ebc2c8e7
SSDEEP 12:sUXhV0xosfxCe+JKlkQuMRxCb8ZXfgYJ0IJpP0KLsyW1L7Fx6:fRqxosfxWMk8xVZ4YWI30otWn
TLSH
T1CD257885B34494FFC8C35A7189BE27902774F6DE5F02836B6A377A0E2E271D44B48220
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 26202a47cfd53d310307b5a87fd92f7f41e6e535bff8095cd9304c71b9cc6897
MD5 83ca9ddf43636d9043dbcf81c7ac315a
SHA1 2e7cfe438d4b9bbac5d0abd0f0967bcf60de90b7
SHA512 38bfe1aa6e22cb3695993b86bf04cc6c32b3ee51b4b20d90e4d02f9cf0a41fac0f692f0f13982539607958b61ebce6d13ceeed5de1ad0ca25005919427d52419
TLSH
T185D023C3BB0CC742F689CD342B5AC1C82348C20020003E6824D3C52C984DBC40EC708C
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 d6a91dfccc6fd8d162a20682c05eec215fcddb446c626569f907c683c75287f1
MD5 720d2dc35ddc9224be269a27ac1bb4e9
SHA1 67e566ef1df032aa341f84b28e1107f6a9c2c69d
SHA512 b0520b3db85933f4a107f0421ca2f1ff8ae107de694875005e95e37c738b160f5e407073bd48f7a1d6dc0908e3a97fb99a8132e631ccc844a20a49557bb7f013
TLSH
T1FAD02333320CE281F7DB00F1ED40C2C02342D6623006A209E7D2041D1D481C13FCB08F
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9c6523fc4a32fd3ff3341b8481c398ec7ca35eb88bba222ae8bf5bd0d1fe97a3
MD5 aa410aff418d4b8ea4c1ee7554d8ab2d
SHA1 b3a703ae2b0597f84e30dd6c159075a4ae1545b3
SHA512 fe75081f351228e8740c383029633f1ff1d1d1c956865dd7f81b002221a9bc58d7eb7f308ab4da7403bdf8e9e2f28264c492910182ba64a7fab8b888ca64ff1b
TLSH
T139D0A7763564DA82E6D6C5F1DBC0C1C067639586701A914B9672801E65540E0AFC64CF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 526d4e6c513d2d2115daa8b4efa3134d8ca00602e985929eb53f8fe484b252a3
MD5 e5da27b98cb9bf167824d0ef64efe262
SHA1 320dcc412a30fae44796998e595d9f5f48596eef
SHA512 9be63e34d658ea688cac09b80a264d1fe778057738ab09f153747ec77068bd25a9b681381193376e4e6038709b68a1849bf4397422801b4c154af79041a0801b
TLSH
T175D023133F0CD341E34249709A41C3C03305C2103051E70870D2042D79056C03FCF08D
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 bde19d7af882bb68abd3a462c4e3aaf90fb373015e787a151b25f541b16c0555
MD5 c5503fbcb1d4ddf29a7616ead0e24fa2
SHA1 95a0bdd462a51c25130669604bb18ac8f42868b1
SHA512 7baa7e8656e1460090da91e64121ab5bda5ba8995bd7258740c667349da4feead0e7bec0614900d77551bd9993ce75888523716168f20bfcfbc9f9c655e9d656
TLSH
T10EE026D408C8C22EE39075874268830CE2C0770EABC8FA8A1B08C4CA30458D5EBC79E1
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 357B
SHA256 27ef9c28bd60433fe3e46acfa4088fd3b310b133e9d656f690b49dbb3f5f53b1
MD5 fc4cf6bfde6cd5a9535a5ab4a328b34f
SHA1 ce0f292cf9dda05b32dfb38703d962be12f0e123
SHA512 ac7da0e9727a01fae0230620f8565180132922c794de51d274ed6d04553400144f3756c564e499a0cebec0ba2e4eb1c737d9b2c8958fede1a4cd37e4a6a66860
TLSH
T19CE092480B80A190424FB98B824C831580CC7217E5584BE96708EA4CBC428238FCACE9
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 99d53da1924ae55c4bc96750cd719da50cfbbe57333a57e710e36f77cf97a411
MD5 61070798eb49294ef22360fbf4f2d8c5
SHA1 51a5f5526cab5bd245c8cc6cc5e91118b71972eb
SHA512 53b0c9e0a73a4d5cbb07f2574975a24849d097dbb3b45de4f4ea4ecbaccea8dd2aa3919da814cc4079dabe31697efe53e66eef28a5f6ccdbc0231bc906bde67a
SSDEEP 384:znGLI3IFUdbnZjMKoJqDj2aDBkDvk3X6GR7AXW/SJljFx7l:zAI3ImbhMKoY2aDWkH6GRs0IB
TLSH
T1F1137DFE7A8C8F42D2E64D3E81EB7A366331D524E4C85A67C374764157217B3680E0AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 14999b886e9d799835aafb544fd68f765cc64d38ee65a32eaf12d650cf8135cb
MD5 b37bd4ecdf8c106699b199d0b7b0822e
SHA1 696208041fdc9c55ef14037784a08bf1f72fe5f4
SHA512 136bbe77adcd9278b1701dfa62c1efb081da5d0e4ec499861c6d5bdd64fa5b3e5d0f7cb8bd261bce9efe6278b088ea3db848777b2b6488a216600dc16f56cdc1
SSDEEP 1536:7LkWr+3cJM5ZHCBuhujd0Gx6APS5NvU0ek2rn3L2oWFGKz55zv:7bM2BbHp3qo/455z
TLSH
T1014460F70951A01BCBA812F5E2433A3DC277015D2DE1F9EAD67C0C852826B32B6BDB55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_2
Size 1.0MB
SHA256 c56a5dd01d6ad5aa83e406eba28dfb5c107f220b714a9970ff89a6538f35b409
MD5 1dab4b8686f8bc4316ce3f34f4f214eb
SHA1 9e7549282132746fca597bf2861e8c0d5362141e
SHA512 39fdc3cf4b58aaa0a30e26f9910a4a2f01441fcd5f1539f289576e55e28092788e891a470f456414a826d2134923cca38f9975b56a887b8c095de3a4babb2973
SSDEEP 3072:K5mGC+H67u2n/6Qr85lXRslBdHIO4Dk9cr2hoKHjqQeWeurmp:K5fCNKaJ8XXRUTHyQ+iOQepamp
TLSH
T19C259DEEDB346D82DE2A4A70B8E0FC22BCB811937555F1D30C18CA9087567C5639B6DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3
Size 8.0MB
SHA256 ecec2199c52c70a474cfc986cf4854ddc39a5f20a1b51b775bad5845a3a3c435
MD5 87ff622e31bff37ed3f2e6ebfea7ea2d
SHA1 b56fdfefce2f6b4d3493ce49480cd45d67dda7ab
SHA512 1032ea35fce8ec9c45faee2846a5c9e9dfdde2e9010dd056eee6b5e473859ef0e4999f753508c52a4f429c77efb7e4dbde3f26db9a95b92106727dcd7a942381
SSDEEP 24576:LUIsSE18kCGCeXmCg2/INSKszNbFW6CR0b5Af+gBkoVLw0LaW9iQNY:LUdB9mQINSKszNbM6CR0b5YdBDS0LaL
TLSH
T138868DEE8B741C82DE668D70F1D0FC063DB11183B64AD1D7996CC5889B8A3C17AED1AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 ca588de16e2bce321e9571fd441d9b20b26d1959e10a43cfbdae2387e9ca0d47
MD5 d812bdb6acebe55618afdd2ee274fc2b
SHA1 72f42a288ed8279e016cb1436b7e76579741dd38
SHA512 8c10ad4a40bc5edab678cee4e79ad561ae16a538acc99d9365e9b4532e9432972f054b255ceb020a52ca50a6aa5e87c619d467314a87861745addbadc46a08a6
TLSH
T1727149608649EB6DE3395C33E1D93E33F1329681D9F76E698DF85931490FB034215D02
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 2e5b25b28eb32a799473ff0114e4fc1585527b40a20571a1eb43e341398a6d7f
MD5 6b03cd1fd65080c9fec2e7fe808aeab5
SHA1 086528538d1cf8f478149760a33b71960d84df4a
SHA512 062c8f0fcde09d1071fcb23781f14e47eaf051ef5e429163250da82e02e6548b785bc4928fe25c0e55a7d431ed8d62c40d0a63435e5e5cd8f1f99cdfb53042cb
TLSH
T18E712840864ADB6DE3295C33E1D93E73F272AA81EAF76E668DF85530490FB038215D01
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG
Size 343B
SHA256 66ed6483b9a1b508b7a82c0a8f2c55c8910d5f17aa82ebc4afb1889193298829
MD5 3a2e7e71e65dd118fdecee0176e270aa
SHA1 66ba8bea8d8431c7074cfeb4f0dc543ac13672ae
SHA512 c510a3510d901821b6be36fb7954fdc608df13a1f7c5b0ba2c6c89bc69676505ade7ab9ac9c4d564ecbf7048752870247a83a364a5a178da8d045d739c662d59
TLSH
T117E0929459C6C15D5E7034C29239DB4E83C43642D689AE875705CCC8B602423FA859D6
MD5 SHA1 SHA512 TLSH

Submit Download

EdgeHubAppUsageSQLite.db

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db
Size 32KB
SHA256 3db086b99499089b88efa80f35fea69e0baa23fe1979a3219b544c1c253b216b
MD5 c925d58059924453cad3346a649f83b5
SHA1 4571c5ec4c78e716e746dd8c972da73760920a85
SHA512 60a6920dda336c1bfa8f08b8cb70ab8ffcf38ec5c8694c403f7d9074e22a07ee97f95748fcba3b0dd2bd486413e8ce8934d98585f02d3f81222d7a92e0c1c0ca
SSDEEP 48:TuUL+lfwD4jJ/B7H9WxA+DWxrQVMjm+yOZt+0ppCc:owD4jJ/lH9j+D0GMjm+yC+0ppt
TLSH
T16CE21C4D3A12F922C8ED737D60C1C6E09AAC683C9A597030953CAE768C234A5F4CE24F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 322B
SHA256 70967b4dd3e77342f401a7f8a4ab9d643b5d10339b235d75b1971502d7c360b4
MD5 8179f6708321eee645d4c6c4d8592284
SHA1 b93ea92fc347cc49d18e80074de074570b49455b
SHA512 096ba6fb51f7b101ff92d389004d7690fc9c466e32aebb8e29769a8e2c405ed00c48f0ffa1b613e2749cb90ab776d97370fe29f5c47639e6b45b6cdee535338f
TLSH
T196E026080DCCC12A953478D3837D930EC2D03612A3CC3E465B1ADC846101E42F7EA6D4
MD5 SHA1 SHA512 TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 192KB
SHA256 5371947ae438c18a63bdd28b892ff278d44d9a1800676b4dfd86186e7592f261
MD5 1bb3ce8f0507b1b5501593c102189915
SHA1 afccb0645d3055e431e9bd4fae66950aa18f2422
SHA512 4100643521548637bc63ac30b21864288c626e16384cdb23b2a05143689a94cb8e49ea5835ce44676f7a405955d3e57f83c692804f1ccd3aa9d938b85da7c88d
SSDEEP 96:LetU+bGzVQLBE3up+UeV9ytRVjNtDLXjBHYUE2/A80jbgI8SKO:Lea+GOBE3upbeLy3VjfXdHPf/A8jT
TLSH
T10A14ED1E5F743712CDBD913628E645A3597DF03F8B236AC66C6114B0CEE2652B02C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 12e9cd1d77c6efaa13c23e5fba437bfb447a002c849ff7bd0b2278f158dd41c2
MD5 d31861c7f12db4387e73cb965ff789f9
SHA1 092387751595ab7bc278d4a93d3ea59045220335
SHA512 e08837effc86fe52fce16a1fbbd0f18d8c5501e9205079c3f364d007e7868bc9dce5ff1170d8e1f87fa62eec06a3f63a1917d54b79eef38e9550433c79fb069d
SSDEEP 1536:IfEEvnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BkHSRhPjU1
TLSH
T1FAB35327D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F6C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 334B
SHA256 310227a3bc55d757657f4064f9ab22e5268f2945b40c53defa7a62a3985489c6
MD5 1f190fa4123b306b4421c7275e3af97c
SHA1 bc9fa7b3470ed0795418a61c1d83b30c4f35acb8
SHA512 9d2fd250a4432c0f553ade00757056a482fad42332e11adddea3b0f3f71dbb44af5bfc64f474463e04850a894625f28b9a3071267ce2c0657e007fd60eaa73e0
TLSH
T130E0D86158CEC11A662860C7432DA70EC3E1372AD7CC6F459F09D8C4B001408EFC65D5
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 0b5ac2066c3edfab54bc669192fdb6c884c68d8f5c311bf4851fc1f2ac1937a8
MD5 03ae02622d5d8d925440c30692685498
SHA1 91c2907e2e334abeaa24bc8608237d7b29cb490b
SHA512 912409fa65d2fae7659d90c854ce2be4989b228c374637c9327602e4f12412cc20a3595f5e0bb4ba8cfd1912ea5be48a03ffe5f77f7fa09169041442d9e6435e
TLSH
T13031CBF783F4457E8A0095F47A28AF1FCE2D0511432C7E9A85D0AF5BA3E2471E141A9F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 5435947d7522c8420f3ac16abd93da8385b03902165369bd539051c2887dc512
MD5 1e716386aabb76028393ae83c3519698
SHA1 bd592bf15c7f6494bc1b820474962084bcc1e3cd
SHA512 f29e7d6a1a677023886102492da56a4befd82eee7b74a0ff5d5d129ae922ae15eda7e5251270abb3f210399fbe06b77ccce3331642a2cce905907a1f49e3ccc8
TLSH
T19431CCF783B4456E8A4095F46A28AF1FCE2D0521432C7E9A85D0AF17A3E2470E141A9F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 d83d9a40059aeb4a1a4ce3e1854b1528cb25349b18d3d01b6a3cc7b2f7dfe7bc
MD5 d2367704398d7de0a659fb25489bb10e
SHA1 037ea40cebe287899a037650a79ae0cdbc0c6071
SHA512 8748bc003ce6fa1e8ced385259d14b82423e91fb860b284fe3ca99388c5d77d11dacf1ffe76952a540dd1771b9c0cf174bb35316f99756d51117b6245bc1c9aa
TLSH
T19971AAF383E8826ECA1195F47B24BE1BCE2D0914436C3D5AC4D4AF97A3E2471D241A9F
MD5 SHA1 SHA512 TLSH

Submit Download

Reporting and NEL

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL
Size 36KB
SHA256 16bd6e6801173514009f6c0424767fc1c5400f9fb83d417cb8756a4c8f3cb4f6
MD5 b2ae6dd00e0b2dfab5343ba8642f9d98
SHA1 955e6cdc63675f3727b9e0652a99a82c544957ee
SHA512 5b65fb79babb8e7f60eb683093086f66f8db85bd2c56b0cf5f784d5dc59d2030606723ee19956679be81542c54d8a5e18f41297ba4831a015c44041f932a8cf7
SSDEEP 96:uIEumQv8m1ccnvSjKZrmlRATVftTM0k40:uIEumQv8m1ccnvSsE
TLSH
T13DF21EFA07336606D98444B0A404AFDFAF1A404B43B6A6FD76D043E2F3615E2B7B9785
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 188B
SHA256 cc44782ecf202cc572eff12a14d1319e6377300195e6e0dd3a56a582942211ee
MD5 74fb05e5af829ddadf37f7d96604bcca
SHA1 29d9a2c9649ef7df10eca623171baa872eb9a52b
SHA512 2b56940fb41302cfe51c876bb7bad0a9b747851c4b780eca3fb80b323a9e40a3801731860fbfa3cef9e3c4d7b2355100324aadf9e3a30a47fdcc808c2d007c02
TLSH
T116C0126284F9E8F3207D4D7A6E84B8817A7EE434509550E1D9A5923DB0900B76B16329
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 e2d0e317671eeb2b71a65ed008e7d9f6b9444da9d869234bbce83f2656987141
MD5 a2fdb047a569319802fff7c7b2eea93d
SHA1 06dd9de9276903b1c38e0866ab2d630a20425553
SHA512 70781c06bfc38b942a4bc3acddf5743e33ba90f5a835146e6531f3af5de5a5ad52e9ddf2e337b8482263503e05c1e45d35183ab6891188bd012fbb397044a459
SSDEEP 384:sVdTEnpids1iWcMbJyZX9/SwwBtUOQHYA2:s/qOzMbeN/SlBeOQHu
TLSH
T15472E80A6624497F8CDBD619FA927B63D6FD152391409E44A9FC8F0C10E7AED320382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 7bf51edcd4fae613535cd84abedca22f67403bc43d8fd1f6412c75eced9e61d1
MD5 2f8e8615ded24cc47687aed39016b41f
SHA1 261701dbf84a50f96a7918577f00d515bf872220
SHA512 08f1dd61accd7212c1b445b9a62c48cb86e991436f0a3ccd30166aaa46d9afde6c7dc5d10e2180409ab44eda7c7e1abc25d1b4bff8e4da33b51a0a7eeeac0149
SSDEEP 384:sVJTLnpidsYWcMWNHh3yZPW/Sr5tuOQHGAo:sn5izM8HhEO/Sr5sOQH6
TLSH
T15172E8096A28897B8CDAD219FA467F53D6FD1533A5509E44A9FC8F1C04E7AED220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 37KB
SHA256 6534a4b5748c4acebe6f841b051f6a3007d0e9392a1d5a066e476ea95e61b86e
MD5 3deac5ead07789f79473acd3786dd910
SHA1 c0114a08d3e327dfc76a5d5e57cc3f0cdb2ab4e8
SHA512 c40a99189c5f1f455df7fba79f266ccda4d3a5f12bb79b8802fb999895a79d7037a0b3f629eecbf6e06def910b5da772daa9ae9aadfc3c4961e3a5cc44df1d9d
SSDEEP 768:PAiO89M83Q2tk0i+v7pLuLNx/WRWXpQTV8F1+UoAYDCx9Tuqh0VfUC9xbog/OV32:IF89M83Q2RPpENx/WRWXpQTVu1jaKDxA
TLSH
T133030C3B2C0CCB7E4F844E9DEC26AE9A5DE8028F5698895447FE484C03C66DF521A5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 37KB
SHA256 9858277327ce828a62dd3dfd40e142108ced2509161c6fb81342e582d0f34fb3
MD5 e433131b96cd65a942211d4a74541bd6
SHA1 41b119622f7116ab405bc29658285b8e36e35731
SHA512 ca97572c02aa88c36a8e8f9fb29d6076dd3d8cec96441bec3a70d5060c30a418764d2cc315440fa55766d0d19e64f31f3149d0d3c8e45f52059f541ed5729354
SSDEEP 768:PAiX89M83Q2s0R7pL/LnY/WRWXpQTV8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3Kzi/:Is89M83Q2rHDnY/WRWXpQTVu1jaKqxGh
TLSH
T179030C3B280CCB7E4F844E9DEC266E9E5DE8028F5698895447FE884C03C66DF521A5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 338B
SHA256 3913435eb462c0c9f75b102509a1dc1d464e52b1acf0493e44a007ab0a7bdc35
MD5 9bf65ac9ff67d8840176d263f6c0e7d6
SHA1 69b28b0d051db3042815717ebca463a9766f5260
SHA512 52aca07eb80f6b5f682c1f94d3794f2f4e1349e8eff21fe46e5f99992280b715cf7342249fdc7a8cde848afcac5655e72225d109ba1ccd34a19fd02b76884d1c
TLSH
T19AE0DF9009C8D179623660A3022EC30CC3E9B707D3CC3A86AF01C88C6283925BAD6590
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 350B
SHA256 360ea26791e208c526e2b0bc8d9228fe37ea2295a073b457bf9bd65198f99bb9
MD5 06cd39f0602cab8bf2c00f9706331f3b
SHA1 23c735092b98a8c3f2bfed412ea71dfa0485af23
SHA512 334db92f0035529162ac809d185b6a317dded9e1fcb52d376e47976ceee5ef347cc252cf9c9f47e1b04274e21b659bc573d953fe311a875c26dd8268bcd5ba62
TLSH
T1F1E0D8601AC9C23AA3A730D7432FE30CC2E27606D7DD6A55AB0DD4C87347540B7CB9A0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 323B
SHA256 6cfbd57562a77efac488c2ed7148dfb96fa50aa1422b8f02946c3e158b7976cb
MD5 bc4d26e20c09f42f30011188948a4898
SHA1 c115523eaa283110b3f29828d1a7a4dfeef82638
SHA512 7d6e850256641597410af59ac4f56d1b2a50c749f4ccaf84a86757ad53787d6c71dbcee3641fee0b997963b7e12ff94e9e03cf8b3f9efc367f04b2f93fcb5d09
TLSH
T110E0D8B04AC5C339552060D6D37CD709C3E0BE0AD38C3E46EB19C8C47143522B7A96D1
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 24KB
SHA256 10789c61c7379ad3d73adac4f8ea5d2190a88b7d322883d69330e5f04e2124fe
MD5 675fdf6803f0c9e05af024c973f65475
SHA1 1e1ac8f21e88e54049bc681a76a2095798f87d56
SHA512 c66a12312121ef35e79471ee797598da4a5aa953ed11fad402c26bb0497f7e0cfafebb75ce9e16d8ed128fd24c648ce4ba243d681f2aba961199137ff05a0149
SSDEEP 192:T/QjfZBx+BSffv99/KtK/nEJfaTig2fqWg441IJm22EU2xEBGfEAKb5g:T/QjfZBx+BSffv99/KtK/Csq
TLSH
T169B266A1703F7251283E2518A6B5922F864220A37010F5BB3EBD51E58E67E352DFEDCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 22KB
SHA256 9a9c57bc614e3c9414458df4f92e4471551aa77921f5c3bb9a220c6a1a1f0772
MD5 c7824b6a3d1c1c746fede17cf36e1bde
SHA1 8a5af12716f5e7fc18c7274fc3aaa80d9bc225ac
SHA512 1e826d6ebdcc92b30da06abea71fcd938e83c5569250771779b7059adea4e1b61fe4f87c84038571f3ca951952379e1316489b5f10e840c7ba8eb6253140fb56
SSDEEP 192:T/QjfZBx+BSffv99/KtK/nEJfaTig2fqWg441IJm22EU2xEBGfEt:T/QjfZBx+BSffv99/KtK/r
TLSH
T1F5A248A0703F7250383E2558A5B5922F824220A37011B5BB3EBD65E58E67E346DFEDCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Visited Links

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Visited Links
Size 128KB
SHA256 d7a7957aeef05bfd68be98473b242128c5b56f020baa546615b379e9434a0d58
MD5 e435f6f65c6fa5102092533ef776775f
SHA1 89a1ea82c801b938be0b4303b0d7dac887ac812b
SHA512 5097bed55b99de40b9b896d48b4b312c8d624e602626ba55adbc8f53be703b72521ab84b6e6d89a336acd9c64e2db237dbcad1303a9305d4845efbdcc4262321
SSDEEP 3:ImtVCTCSs/Cllzt/crHlllllqbo/Xh9vCjAIjt/THEHQtsrDw/g841pPlpultst:IiVC8mlxUb1qbo33etYHQmw4H7jZ
TLSH
T123D3C04743981608CD80083001442BD5C0FE4440F4D54A8701704D47F3E51010B9E935
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 228KB
SHA256 712ffcfead7be7534a234d313fb757b6cbb1cb7a348b1e2c4dbb9468a4009dcb
MD5 5d327fb1f0e57909705cb4bfed65da55
SHA1 356d2fc18fa9c6b4449b5d7242f16ec58e5794c1
SHA512 a1c507362e096926d5d8aa293515d3c76aa0f491188c1290ea717794de53913201ab36789369d873c3ba99445423cfe60036f2d03d9f88140bd5d2630af7e057
SSDEEP 192:zCNGfT8aRJQnGqqrgenLfUK3NDivIz6DoNCPaWaVIdssXVydue2g2C0:uMfQuJQnPqrgWLfUK3hivmY4Cvp68C
TLSH
T1AA34650A7B786101DCD7E9721CB080771A3C726DCF22A6916DB254694DF6853A33D8EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a1822d4c-6e70-4077-a35a-924e404582b1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a1822d4c-6e70-4077-a35a-924e404582b1.tmp
Size 17KB
SHA256 60741bff8205f4d04ddb070cfee20556bda441dc8f12d9d5a1ce012cc918c77a
MD5 efc70961781261d168fcd0a0c9e63ced
SHA1 a4640fe190832ea6259527dcb117ce7d8186451f
SHA512 c275bf64ec6c5095ab5435124d6276737b1420be27c8525edce65e584a302e6f866be089f8f81b7170d551f1d7ea2688f5c886322a459e669bd59b925c125d38
SSDEEP 384:sVdTEXpids1iWcMbJyZT9/S4nwBQCOQHxA2:s/+OzMbex/S4wBrOQH/
TLSH
T1AD82E90A6634497B8CDBC619FA927B63D7FD152391808E44A9FC8E0C10E7AED320381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default_cloud_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\default_cloud_config.json
Size 13KB
SHA256 f9e4da319fe1f5a7d497c452421f4648a24ec7588f309ebea0f0cd61a6251eef
MD5 256c40bace492c4e28451ce149d2f9ac
SHA1 b48b0eaf986b9efc91d5c8dd394dccb6d82e2adc
SHA512 33b38d1ced015798722180fc8c8ce6daedb18cd5d0e4b3db27d6176c13cf3ccb1bd79f2e68ca390d6eb43ac508c29067e8f1a3ee9f0167cabe37ebbddf6b0ec0
SSDEEP 384:l7BJeojewj9mg1IZyvASoIL5QJwTcoEnE0YU/VwTcoEnE0GU58:l7BJeojewjcg1IZyvASos5FEnE0YREnA
TLSH
T12452007AD2211C7719B8636858BC4692F524137F8281C81F78BC656C8F7FA79A089FDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

favorites_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\favorites_diagnostic.log
Size 1KB
SHA256 54e669f4ed5da9dc7a7346a4c5f82f13297c01c92a00778dab235f56f4c39ce1
MD5 52b7a1334196322deec2b9dfda34cbc0
SHA1 1bcf58a85b41ceac54e397e631f9e3647ac14622
SHA512 d18b52488dd97ee4020d1ba24a0a6d2f52d3c1f43bb6467c5ee26315d4d1f1c0f953796c458a8833230e3b85476438c11a0ee36c09c5235f0c3ab25ebff99294
TLSH
T1F631A7D073AEB455BF8DA881D2296103E4951E67120E6CF1663F15F88B44C3D5A3FE3A
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 322B
SHA256 ce8128c374a3fc5f0f98f9e2589f9aec78c954f57e7c7411551926d832988a28
MD5 8d529cb1b07036591292c10830aace6d
SHA1 c7513b9db92dfa28ea46be3d339bdfcfd0c8324d
SHA512 154b6fa3f973641b2941eecbe9f90c00c74f174ce10429cdea76ee94afad86d44167608de0992277f2a1517a2ceda5339779c30b25030469cb73c785a22d5d43
TLSH
T1D3E02614ACECC16FA53424C7023E830EC2C43B03EBCC2E8A5F11C888A041601FBEB5D1
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 61a9da1dfc0160b384b1d7218b4948c1cabea947b4b3437087a0207b36aee9ce
MD5 ba374e097e0bb23aec69b9a9ac74a384
SHA1 59ace0658824d92fe7b29f24e408f9a32014d2e2
SHA512 3cdeab0221b96f54cc815f43f2d52bb69967f589fc90a3a2edd6802dc3ad5459b4889c10a3a48bf87b4b4b8c17a219dfc6539e5d7328ee8e153871c2da25a63e
TLSH
T14B215E15F320D048E18E967D946AAB355368D852CFFCED0F5079242A2E75B051E8B6F0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 340B
SHA256 1e0423f1d0af17982c4f2fe972afc9d89cc96708320ec5614a035f5edec5ffdc
MD5 c5c1fa6d5fcee4f929899c11813fe2d6
SHA1 f70ed68d1beb9f2db04933b5dbf40a5d062b8558
SHA512 7f297df0aa1e8381b241b33a2c96354043d5094509c2ffaea30883c440a204eb935ef6ca74b19fa53bd882a749ac5a0d96654034c18b9e20f065d379bd157af6
TLSH
T103E0DF24ACC8C1AF997020C3027DD34EE2D53A03EBCC2F4A5F11CC88A901582FBAA591
MD5 SHA1 SHA512 TLSH

Submit Download

data.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\EADPData Component\4.0.4.6\data.txt
Size 145KB
SHA256 44dda6faa8220666a11a09301932b82c5d89ba5cf60227ae3b5c3a0a7518bbac
MD5 370210ebc9e63f6f39a4185846435533
SHA1 17b63f65390d236465b6952953a7df4cbc6fce1e
SHA512 e594ebf58d19f6d9e7024f98107c738142c6cc2504a0ba89e13f8f771c6a600427e75951ccbfe105983c21b735dcde6e6e173f4da37745c4de51bb9f5e86b989
SSDEEP 3072:7PAgDcCHaLHl65aynyosxb3+B1xh0OrlwYEI/tLZjUd6mG:LX1aI5aZoKzMJ07NI/leBG
TLSH
T105E3F1108EC41FACDFA8291C70BE0B1D63E1C79D84676585E773FE0AAFAB90462275C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CloudConfigLog

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog
Size 458B
SHA256 2d45ebb6de792d3f5a6f86f0df8826b92260faee8cd77d900dfebb5ed3b945d4
MD5 b76dc5e28db90b0ddc6b9bc5a1cfc000
SHA1 8cf03d25111247c4d63ca1917441f4b5d7169811
SHA512 a89803246090852a6bf02fdba894875b988e7bb8bebd656e336210760daebfe2b21bc4771c13e3f021798aa50eba292f50d194838825bbcfffced7eae8aff572
TLSH
T1D7F02B92C90A3DBB09722365596216F0FE65134F4949908E7ABC104C5F7A83A05DFAA6
MD5 SHA1 SHA512 TLSH

Submit Download

CloudConfigLog

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog
Size 460B
SHA256 6f54c0dee9b29f9276ecd2bfd05bf74783a6cd9acdf2dd828d6e841c7159eb28
MD5 5266401b8b12a6dc5679ee27d70f7335
SHA1 a6cca502ada53eebcda8d1d113dd43c960398730
SHA512 1decfb30bd1f08156d47fe9caf7fcd5096bb062ba38df06e1cc3336b3d514ab0469e5a92ea7a5d39e52b4644b9f13c45437f6845ef549ec0fdbf9c8493e20e26
TLSH
T1ABF0AB96C41E7DAB08762624052216E0FE26131F4185A08E7ABC018C2F7A83904CBA65
MD5 SHA1 SHA512 TLSH

Submit Download

wallet-checkout-eligible-sites.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18367.18366.1\json\wallet\wallet-checkout-eligible-sites.json
Size 23KB
SHA256 2abefae3d72e7c4f5cdc94eb0ee552612d843a26faf4a7bd061c73839e19d7eb
MD5 ed22bc3ded6df0109b9e594867473559
SHA1 ee39eb80dc23f7fd764199cbe4a153c4edc2e768
SHA512 fb337c0a0107dc37a3067bcd6f60ffb8f63ee892a0ff729dcdf67c7a21fec95a742a274853e8947489108d7543c13b9479e02574f490bc217e8a182f08543aa3
SSDEEP 384:rQR5dkrKzmQWgFlhpyZv8CTi8I6kxAvh0mD:reKrMP8d5JIVAvhV
TLSH
T18CB21064C9210DE11FE4412B6878224B1A3C951B8F90FAFE3B6D928C1F5E06F61B95FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wallet-notification-config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18367.18366.1\json\wallet\wallet-notification-config.json
Size 804B
SHA256 bb26ce6fe9416918e9f92fcc4a6fe8a641eceea54985356637991cf6d768f9fd
MD5 4cdefd9eb040c2755db20aa8ea5ee8f7
SHA1 f649fcd1c12c26fb90906c4c2ec0a9127af275f4
SHA512 7e23b91eab88c472eec664f7254c5513fc5de78e2e0151b0bcc86c3cd0bf2cb5d8bb0345d27afdd9f8fcb10be96feaa753f09e301fa92b8d76f4300600577209
TLSH
T1AB0189EEC8800EB216C24A3A163985C31A3756576C953D147FC9741C2F5D62F22FB98D
MD5 SHA1 SHA512 TLSH

Submit Download

wallet-stable.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18367.18366.1\json\wallet\wallet-stable.json
Size 81KB
SHA256 c1611bb1872456d5ba656cacea801b833ea43126a6ad7e43e143d52cba9d9597
MD5 46ca0b1726448d9c7ed48735c246336f
SHA1 8e26f1f1c6f909f2f3d34c17e042e579f3b2b449
SHA512 c9ec0465c2c0eb0bc0316163f9a2dab9332c372dfc4ebedb0ef4139fe1195efdd8aa34367155c29e659d97d5a27e2395ce2f6012c115ef5791bad270de26bb28
SSDEEP 768:r7PEXSl9cv2tlNnqSBBoCJkQgXzwb7XARjMLVF2CYgYHFkJ/Eqajvapznp+9l:08W27jLgX2ZLSgYHFkJ/EqajvWnAf
TLSH
T1F283DB29C9120DB11FA4001A28BA290B297C960B4F55FAFD7B6C938D1F0E45F61F59FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wallet-tokenization-config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18367.18366.1\json\wallet\wallet-tokenization-config.json
Size 34KB
SHA256 0088d5ebd8360ad66bd7bcc80b9754939775d4118cb7605fc1f514c707f0e20d
MD5 ae3bd0f89f8a8cdeb1ea6eea1636cbdd
SHA1 1801bc211e260ba8f8099727ea820ecf636c684a
SHA512 69aff97091813d9d400bb332426c36e6b133a4b571b521e8fb6ad1a2b8124a3c5da8f3a9c52b8840152cf7adbd2ac653102aa2210632aa64b129cf7704d5b4fa
SSDEEP 192:0NOKnK+QXzpTYaDEqIyVZ5mxzrIAfrXKoNKExGI+MmsMR6Q9GMKPrZnfB4FXZ8N:SOKK+QXzpTYaDEq/e5EAfrRoRI+B9wC0
TLSH
T1A3F2FCB1D9009C932F58850A20BA9505376C52237F86F9FA736D424E9F9F58F2530EEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1
Size 264KB
SHA256 1d9cb4379e5cfd1e44b71de70862d9228df07f856fcedebfd1f2c2f8d6b5ea7e
MD5 646994a0445afe7c5ae23d62ec0aaf20
SHA1 bce6a28a6231c269537114f048a8e7ca6a72b021
SHA512 c9e97581016a0108957f749eb2787f1a903076038b88cec38493fc289686e0eadac48f4bbabaf5331b1d980868a400e0f5174f58b7f543b4a4c0d9b644102d09
SSDEEP 3:MsEllllkEthXllkl2zEflgzU/X:/M/xT02zBQv
TLSH
T1A44404047FC01415C50115704151F3503370D410071157C33CF104335CDF5400C00000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Browser

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Browser
Size 120B
SHA256 9c70f766d3b84fc2bb298efa37cc9191f28bec336329cc11468cfadbc3b137f4
MD5 a397e5983d4a1619e36143b4d804b870
SHA1 aa135a8cc2469cfd1ef2d7955f027d95be5dfbd4
SHA512 4159ea654152d2810c95648694dd71957c84ea825fcca87b36f7e3282a72b30ef741805c610c5fa847ca186e34bde9c289aaa7b6931c5b257f1d11255cd2a816
TLSH
T1E0B012203BF9062CF3F74D00AA73AA3428BFF4080A14811D505102080C33E19C478FA3
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 13B
SHA256 01a3e5d854762d8fdd01b235ce536fde31bf9a6be0596c295e3cea9aaf40f3dd
MD5 3e45022839c8def44fd96e24f29a9f4b
SHA1 c798352b5a0860f8edfd5c1589cf6e5842c5c226
SHA512 2888982860091421f89f3d7444cacccb1938ef70fc084d3028d8a29021e6e1d83eaef62108eace2f0d590ed41ece0e443d8b564e9c9a860fc48d766edb1dc3d9
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 45KB
SHA256 ad907f4919782391082a67385554e6114e63b19d35f46fbe3a7607f9e65be3d9
MD5 de442c346f6c0edb06eaf9b615e215e3
SHA1 2a5554ce67b8acd4d7afb556de240bbcad8b79a0
SHA512 60e9cbc28a0275332a167e62a3106aad744a2fbda34cd97f43f3d9e0d6efc291c8023b0a6785a4359c517bf6616584a708c8d692f866823ea2ffe247651b856a
SSDEEP 768:FtFrE6esE8lDldUGI/CghG2gPxSjRTjQBeDU3pCK42fy7R59iHejzlvcp1GZdQ4d:deB85dgFGZC1Y3UjYy7XUHeWp1W
TLSH
T15E237DB5CA548DA36B9A4EE893373657EFF01157C5484BC4FECA4C8A1C4A09E63878A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 938a451f95476b20a019b023e63c10f61d8a45a74fbf9e0f519394704c2d7c58
MD5 bc205f9d9e17a25fcbbdfd312446ad48
SHA1 e6678ef7eb0376080d0b27ea8ace22c61ace77a6
SHA512 db7a6f8d30f46da194fb7f92afd1aad3c0b24286f63622c33dabd412cb66941b1552468b229361da8c27c8950eaf8b0d513f006abf66918711f98bcb3538fc4b
SSDEEP 768:FjF4TRMUVai1SKqvC/CghNWg5xSjRTjQBwn9RG/ecpp1sa8R59iHejzlvCiyb:IT3oSvqvCFNTC/GG4p1CXUHeu
TLSH
T18B139EB68914CD932EEE8DE5D3277607EEF04187CA881BC4EDCD2D4E0D891AE634B851
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 45KB
SHA256 8edb14d5afce9909080defa57024bfc2a78c4fc50b3173f381fd27c87d6c808f
MD5 ccada7685475f44c045479171de80a4b
SHA1 6f9e0219ed72f332cfc56db454db7e85d20c9be9
SHA512 04f0eb18952ea39ba0d968157c2cfe30a0feb60dbe285ff5779f7a519a7284caf56ccf562ef5c7124eaf18fbfcbaf0cdb6943b771b8717d17838943caec2e844
SSDEEP 768:FtFrE6esE8lDldUGI/CghG2g2xSjRTjQBeDU3pCK42fy7R59iHejzlvcp1GZdQ4d:deB85dgFGkC1Y3UjYy7XUHeWp1W
TLSH
T134237DB5CA548DA36B9A4EE893373657EFF01157C5484BC4FECA4CCA1C4A09E63878A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 51KB
SHA256 300087e527d317711f053ec5864dae96b3e0392338680eae9970d370db095373
MD5 52a0100cf50d88a20f1d1a3a5183c96e
SHA1 e59469f332841743435eebfcb9dc82bc4fbbfa2b
SHA512 89bb2f9ade69fe31c356b22d4c3c99a2e254387d018d63804d9eb2dac7d684b6c74f17a1b03c93136939b951054c93a633d45c579058e748586c449c422a59b2
SSDEEP 768:FCF4TRMUVai1SKqvUX4CgNNWgOtMpsvWvO6WPrqKJfFEIz9RyyXecia8R59iHej0:PT3oSvqvUXANdtva1JVyyOTXUHew
TLSH
T1B6336BF599D389B3DA9D0BA7933E6D028EBCC147B5840A84BBC91D4DCD891BFD30A801
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 620465815a1968be5d4c49733e9de44eba731386e33c252a8d731fa42a1b9be7
MD5 12fa522c92586bf06e5b3d5ba5041cdc
SHA1 83f6fdfd1b0bfaa5f9bfa9a9ad9d98048f1ba2ba
SHA512 adbea1d4bf71edd2b284c738393ec497a474dff5738e622ae7282f137c178b763d691d175808e5e8db9b72679a9d7cbcf7d3817e151f9af07bde5d26c0d1bb44
SSDEEP 768:zgtFiE6esE8lDldUGz3UCg7gQUSjRTjQBeDec7R59iHejzlvcp18dQ4sS:beB85d73dC1ic7XUHeWp1w
TLSH
T1B903AE3AC884C9E35CDA8E95E319379BAEF051A7D54C4BC0D5CC6D0E109A0BEB34BDA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 f43f223fe0fa729be31a782f04b5139fe67412cfa2cdd3ccb91d37c615ea4dd2
MD5 c1d603a5ff8ec97e8d0bdd114eb738ae
SHA1 ec9eaaaec9eda3c1a3665f93b92f28a9df3eeb95
SHA512 0de82c8304bdffccc3755c23c0f61d54abdd24c9699ba8e934121225c3db8accd38aad549118b1274f01fadef10b1966a5860256461f4f2d36cae1c36c329178
SSDEEP 768:zYtFiE6esE8lDldUGz3UCg7gYpPSjRTjQBR8eIV8+GR59iHejzlvcp18dQ4sS:reB85d73olC0lIV8+GXUHeWp1w
TLSH
T12A038C7D8C44CCBB58DEAB48931E3667ADE011B7C8684BC0D7C95F0E50A60AEF70B965
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 3b1818ced20487ac3bb5766214a45106436fd670add8f4df2ad4cb823f105600
MD5 036a0d8f3f94530c1d0e357523b7cca6
SHA1 91cf3b5db76e1d2e21875d8038351c919dece5a4
SHA512 e5ddd5f41b9b935b8e99daf0fa4b8da60584a9f19841b070ae85c54fc683d694e2f68e1ff2d0a2b2d6d7d5ee134b7f3c6de1fa17b036cd47c6f8408a07539ccf
SSDEEP 768:FtF4TRMUVai1SKqvC/CghNWg5xSjRTjQBenj6ecpp1sa8R59iHejzlvCiyb:KT3oSvqvCFNTC1jh4p1CXUHeu
TLSH
T1D2139E759854CED768EE8E9AE3267647EEF04197C6CC0BC8D9C86E0F05861EE230BC55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

crs.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\PKIMetadata\46.0.0.0\crs.pb
Size 233KB
SHA256 c132e2ba94619caf6143b3bbdd9c32944e80cbf3bff87364175c42801afe2584
MD5 8bbfaa2cd5cdd9a5019da146cf4deed5
SHA1 17ed2fb07543c5d4bc196a1989dd16a9dbcaacc1
SHA512 cfeee2916f19648ed408b4287e234b4140cf82254cd4b83d918c0a4c3bac2b0467d921915aec290823355be4a0cc82017557be588f65134b466b7192f795f6c2
SSDEEP 6144:KKiD4F7BVps9YpVW+J2i/P66k8GyST+uUP:KB69Vps9C2GAQb
TLSH
T14A34AE9A0F3C3A11BFD2DEA466C8D9377D79B3E06A6928172111C4F169927E07D8C12F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ct_config.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\PKIMetadata\46.0.0.0\ct_config.pb
Size 16KB
SHA256 aaeeb46cd91a4a392223cf2885f449bf532f0878c087d50bb0cb3fc7fa873a60
MD5 ca6e253c3fc7718b4455493460053be3
SHA1 4085dcccd29a931b8ea9b74f008e26409edf78ad
SHA512 0004e83a845bdab07f01df32094c202c9f3b8767a6dadd707abc19796f917221f869791673315e9d2c5a6a1fc50b922cceb622db98601055df5949818dd6ea58
SSDEEP 384:7tomWvvtJvzm9myvg+FN2VOhikm5hV5+QiyA94pDmiDyDS1c8CazaUhszz:7l5Zhk5hV5+Qis2DS1cbe7Kzz
TLSH
T13A72C9BFA1169F000383D558D6E157AAA12363DACCF3763DB1E1C005F5423E6B1A567B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kp_pinslist.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\PKIMetadata\46.0.0.0\kp_pinslist.pb
Size 10KB
SHA256 b5b2a45a5b25becb901916b13752e3477d4126a42d088f29863bd8672320ecf6
MD5 8061c7027f406f3e20ea5d26969f00bd
SHA1 635d6260e16d1ac595f760df9c5bdda8279629a4
SHA512 7be0be7d59ed46b7ce6adbc1ddc42119426b3223491a03ff068dae66d13a261cc954640916ff4379a6040e021689f070b33dc82b45c010b728ee59abd42f3610
SSDEEP 96:Bxk+yBjecaikDBwrBnnoxGwMAy5z5tBT6c5MacFwn2Xh6g/gw:I1IDCrBnYQ5jlMacFwn2c9w
TLSH
T1362204B37904F99350E7E0BE1041F59AE93343A540ADF98A528C4A7635F1F0719BB4EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 9fa5ec4af71b56ce040748e91f66f8e1569b671ff4199bb1c1b7f2f2bfd30593
MD5 5ca192cd0591eef93e883ad29c817f4c
SHA1 50aed7b6f73807275e98a3cb5692906905a741d9
SHA512 796eddaa740668a04b3ff47443d7f54e9d474e89adadbe0c912ba61554fdb270e303816210507b41022b867d8592f65c891b696c5f51978ca1feb4a916ee112f
SSDEEP 3:MsEllllkEthXllkl2zEflA3zoX:/M/xT02zhDo
TLSH
T1894404047FC50415C5001C704051D3541370D4100511D7433CF104335CCF5401C00000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Filtering Rules

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Subresource Filter\Unindexed Rules\10.34.0.84\Filtering Rules
Size 2.1MB
SHA256 5e301c48e6d7290990971e9f0bcb2263c8adba06ed0a2c6db5086949825d999b
MD5 43f62d9f35fa6597cec4e2ad5643e282
SHA1 8dba6404724ffd6a2e89901e8dc6e5e55fed3374
SHA512 91891d23464f89e6769d9ec7a28867e28f77925e6e3b3b75fb628d8672157ba239676c07699c931ac307a21ccc4dae95dd707d410f988ff82be4015103d4d6a3
SSDEEP 49152:ua2qP9SKIrivd04TxN/7Uw+zJEhs6dl61n4Kmq9SL6bbBT0HjTsQc8cxjw:u8d
TLSH
T1BAA55D237518BDF45BB31F3EA44B6D48823962A483E3EDC5EA2BD10ED5E014F79601B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Subresource Filter\Unindexed Rules\10.34.0.84\LICENSE
Size 24KB
SHA256 ed0f972d56566a96fb2f128a7b58091dfbf32dc365b975bc9318c9701677f44d
MD5 aad9405766b20014ab3beb08b99536de
SHA1 486a379bdfeecdc99ed3f4617f35ae65babe9d47
SHA512 bd9bf257306fdaff3f1e3e1fccb1f0d6a3181d436035124bd4953679d1af2cd5b4cc053b0e2ef17745ae44ae919cd8fd9663fbc0cd9ed36607e9b2472c206852
SSDEEP 384:mva5sf5dXrCN7tnBxpxkepTqzazijFgZk231Py9zD6WApYbm9:mvagXreRnTqzazWgj0v6XqK
TLSH
T140B2526EB64903731AF30116AA4B64DBF31ED03F362A4564346CC1481FB6E7443FA6EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Advertising

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.34\Mu\Advertising
Size 19KB
SHA256 5989ccf9a58e4ffd47c2422bd8dfcb3ea4e1d412fbdec2291385a9955af9eace
MD5 3495430eefd1e96e8bd95b67ccab0f91
SHA1 54129d2d72e062ad36a66922331818e81bd34df3
SHA512 9197537719b70837ce997cd2b168c6bf6fe877811f81459a0c0f1363b7179960594761df147c85034c628b8e9a3463084ac26fb8bcc3fbc765089adfeea56f6b
SSDEEP 384:/jA5024xyUE2oAklQth8rYWepdFhgX/0lRwjTV2qh8NmrbijF4E5C65aNbC:q0WCoAklQcrJepdFeP0lmjTV2qSV9C6P
TLSH
T162925151887035622F2F50CEE0583F8E1199767540AEE6DE9FE48666F28C0F37494EFA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analytics

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.34\Mu\Analytics
Size 4KB
SHA256 163a5318312b814104d244a4b37b676a02f827068820aa60fc069e6346cb2b75
MD5 db9a3dbc4820c8d84a0a569be1234dc0
SHA1 78fe9b49b800627cd2eb458cbe0251591a2a693a
SHA512 a6735713a801d28e644b31f34335e29d55a46d4b263e923cbec9b57fd18f8b0cecf9b78fab578065207080faa5e81156d04c8fbedb436b718893b6d17123742c
SSDEEP 96:2eHeEcb6eD0Hl1LJEmjwsi4RjBzGPeKkF7y5W4jNU/oyw:2/EcWeQ0d4OZkVkW4jNoo1
TLSH
T105817615A4A024423F2E5668E03C76F911E8253880F6F7D5EFB19975B30C0D778E497E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CompatExceptions

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.34\Mu\CompatExceptions
Size 689B
SHA256 5b462316a51c918d0bae95959bf827cb9c72bbd84ffb0e43b750aa91fbf3ba53
MD5 108de320dc5348d3b6af1f06a4374407
SHA1 90aa226d3c9d50cf4435ecdd2b8b0086d8edeb8b
SHA512 70f30c45e20b7cddd0cba6476af9338975cec8e40b8b19603af5fa859a34c6eb2138957daaa263633fe65213e2186402d05d9d29ad53e8f311335555116314c2
TLSH
T1E101E6F18EBD58313C74967C876C0E8FB9A5636F2898F2E96502CC87E3C054761A6C78
MD5 SHA1 SHA512 TLSH

Submit Download

Content

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.34\Mu\Content
Size 4KB
SHA256 7869993fcb93b302598643be96c6ab94c4f3be47c9fc344959773c754291376e
MD5 26c006f350f70dbc8c18098b773c3d4c
SHA1 eb015f7010dd74c874675d0599e634027363b7b4
SHA512 0f56d119a5f89689d0e45a6163133048aa95255447c4156d4fb2565f45c32dbb95adc39666a833d2127ce57f3f4198ce45d2a174955ec088bcdd2f74f59b3f6b
SSDEEP 96:lApOOxO7bthcySBm1yJJzyEsQBCETe+yH:+xqT6mcJJz4QBXTeBH
TLSH
T13F91B8037E4409276E95D005C0ED209E2DB5ABB0C85DDDC99B964B7FBBC8C8BA4961FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Cryptomining

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.34\Mu\Cryptomining
Size 668B
SHA256 1e92781e88ee786bf6d1d5cb71d467a92fe7f281f2d1e548524bf119d7ddc700
MD5 95aa820d67ec466eb3444a9458eb7e56
SHA1 f93e178ff40310e071e4d596f0aff0514666f787
SHA512 15281c334f013f0200ca2d6faaaec81dc5602058cf3522b805e21ca5f031cb4ca68606d353e6745bfb86f07fdd6ccc892942aee5ad7cf0f9f0798a4d7f497a47
TLSH
T1FE01D3D7D86197676FE25AD1D02E73C9F04456F26050F7C10F55315857A8A432794CE8
MD5 SHA1 SHA512 TLSH

Submit Download

Entities

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.34\Mu\Entities
Size 68KB
SHA256 f6e93c83d9e3cfdff064535647cee76fc85aa1c86fd22a93dcf3d2c377346d94
MD5 478a605d5578236f2d1ddc93c2f22456
SHA1 917f05453d497b3e3de684a905e141972c34a267
SHA512 26d75309976fac0bd03ffe7596209c50ead7518584dd9f27d12a86d80ecec0889bb58da1b8dc8cdb38fc6bfdca7928a54c5a15903c4b8d293633d4d58ec147b5
SSDEEP 1536:Wz20p1W8VMVLwecMFUh+oP9jt1PNEOjy+in:W2W1WUMzUT1jpw
TLSH
T152630877BC500D3384FB804BB09D2D6C21249FE5D8ABFED89BB1516612839C4B5D86FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Fingerprinting

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.34\Mu\Fingerprinting
Size 1KB
SHA256 c7d2b05ff6e790af78b0f1f341219fdb554dc5e14fbf3e3981819fccdd1ddfed
MD5 3d90e5235a4bee8f1dccfc2aecf7c585
SHA1 5beb333084b3af33e7fbd8c83326e18650a87f85
SHA512 c81af723cadaa57f638b9dbc60aca5d2600cebb8282d78a7b86edc6b473bd3a1768c8fde1b11d50b6b967b2866495655de09577973778038434bf4b513ba74a7
TLSH
T180214F8685D038316E6E148CD55C3B9C12EA3A7040E6F6DCCEF486A0B50489F7280CA7
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.34\Mu\LICENSE
Size 34KB
SHA256 8ceb4b9ee5adedde47b31e975c1d90c73ad27b6b165a1dcd80c7c545eb65b903
MD5 d32239bcb673463ab874e80d47fae504
SHA1 8624bcdae55baeef00cd11d5dfcfa60f68710a02
SHA512 7633623b66b5e686bb94dd96a7cdb5a7e5ee00e87004fab416a5610d59c62badaf512a2e26e34e2455b7ed6b76690d2cd47464836d7d85d78b51d50f7e933d5c
SSDEEP 768:Mo1acy3LTB2VsrHG/OfvMmnBCtLmJ9A7D:Mhcycsrfrnoue
TLSH
T1B6F2735FB74413B2018206A26A9F68DEE319D07A73664095785DC15C27B3E3483BFBED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Other

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.34\Mu\Other
Size 34B
SHA256 2b4a47b82cbe70e34407c7df126a24007aff8b45d5716db384d27cc1f3b30707
MD5 cd0395742b85e2b669eaec1d5f15b65b
SHA1 43c81d1c62fc7ff94f9364639c9a46a0747d122e
SHA512 4df2ce734e2f7bc5f02bb7845ea801b57dcf649565dd94b1b71f578b453ba0a17c61ccee73e7cff8f23cdd6aa37e55be5cb15f4767ff88a9a06de3623604fbf0
MD5 SHA1 SHA512

Submit Download

Social

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.34\Mu\Social
Size 754B
SHA256 4955c3e7f56641a4ae0ce9c79b4ceee4b21733b0f6dedc980bf8d822a792eba2
MD5 1d06d58fe9131c14ba5ba5ff740b020f
SHA1 e6ed812e23e201b20170e928686a5d612165df85
SHA512 2854c73c6ef4d271d0e992113732ad65e406d6310711551952b4d451e2c577a2c3dcb06052e3ab30003b01619a39e87e5dd28d54f459f94efe879d1a79039b8f
TLSH
T14E0126DB1A1450027FAAC495E4458B6948B00630445DFDE582B8D27BA08EC97F39F7B9
MD5 SHA1 SHA512 TLSH

Submit Download

TransparentAdvertisers

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.34\Mu\TransparentAdvertisers
Size 105B
SHA256 d2cd0bef5f45daf490c53e705d6f67dfe12390c72a00efa6f5117432bd8edb8c
MD5 57d5a3548911886de2f3bd3172e808ed
SHA1 ca932af3b25f245ce931fbc6cf10299e5fbe35a7
SHA512 933194509d305b2a60b38c149ba1d74e142ef15647242b287844d263006d33ffa38b6ea263c89cb821a9277d41f0cfda95a0eda830f3a5ef8df5ba80d3bbc818
TLSH
T1FEB00170D480008ADF4062C1D032DD98E08D5377A138C4CAAAF80C66F2433CAD1A38F9
MD5 SHA1 SHA512 TLSH

Submit Download

Advertising

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.34\Sigma\Advertising
Size 20KB
SHA256 868f3ed3f86f1e82a5041f0a7b382bdd720e411531df2dc680da34eb60580b75
MD5 6959a6835772c67f4e72105e4be259a2
SHA1 72d1fe9070a5c0eed55d989cbd961dbc5442796c
SHA512 98085236a15e810642602e5dd475aa5a9532bb38917aef784e977bb398b3f9e39f7966370d39c1b554cf3e39858713e8b45bc27fbdb8a701b2a903e453a67591
SSDEEP 384:5z8Qpkm9jXUmEtMANAgFYNX8htrCoEeZCNyn9CbRqKi8iyZd0KE:1lb9TU/t9NAgFYNMhte1eZ0yn9is38iT
TLSH
T10292C261986035523EAF019DF1993FCD69A4633080E9FAE9CFA0C636B35D4D335948FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analytics

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.34\Sigma\Analytics
Size 3KB
SHA256 33d2b069ea874c12ec96242ca7eb539c1086d38ac6c2e4858c0efcd74fc632e5
MD5 e018dfa2df54c80ffbfd02c6d2ff5430
SHA1 de3f876b05355c6024d76f1bc24a552e532e2a2a
SHA512 b6d7886b4094837b271d1aa1f72b8c521970527552186604bcb83e17f85fa4a22e658628f79eca7d164ace781555abaa07c423a380fe87006aaed77f53e37838
TLSH
T16C61D918252024211F1B526AE55D3E8E69F4233904F8F7E08FF04EB5B10A4E738E5B77
MD5 SHA1 SHA512 TLSH

Submit Download

Content

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.34\Sigma\Content
Size 5KB
SHA256 d99df5936c57a50aebb7f0a3ca65fcc682f523ace93641fbcfb9b09cfb71c739
MD5 dee2a727844dd3cea088941e82722406
SHA1 24ebec9b92eeb6af83841ab02e858f415580f719
SHA512 e48edf5f6dcbbd615f42f1b3181b2998bd700508094466009a6a48193a48c3e30e6c4d71cc43aae81d18a88ad9fd7e28eb50a0a52ca6889a270001fecdb64dfb
SSDEEP 96:PwYuGYJywH2R7pBBYy+wf0yhZ7RBJ1ja8nBwGhQmxpFD1Lcg:Pnf03H2/KwfNL7vNTBR
TLSH
T152B154B2855079922F7D01D2F9D6225088E482715CBEEBC747A1C61CCD1EDE735A835B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Cryptomining

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.34\Sigma\Cryptomining
Size 32B
SHA256 696e930706b5d391eb8778f73b0627ffc2be7f6c9a3e7659170d9d37fc4a97b5
MD5 4ec1eda0e8a06238ff5bf88569964d59
SHA1 a2e78944fcac34d89385487ccbbfa4d8f078d612
SHA512 c9b1ed7b61f26d94d7f5eded2d42d40f3e4300eee2319fe28e04b25cdb6dd92daf67828bff453bf5fc8d7b6ceb58cab319fc0daac9b0050e27a89efe74d2734e
MD5 SHA1 SHA512

Submit Download

Entities

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.34\Sigma\Entities
Size 106KB
SHA256 0f305323c627cf0c790831c7e0bc38455b7a99983c4ab5bd9d2d9567766c3499
MD5 751e7cc660220e7464935a9b90643274
SHA1 05a725af45c74a9e129839b2fa7acca5d83066d8
SHA512 bc879a9bed224b6abdaed2581f948fcad53361b17dc76d5b5df10607ac893db2f39bc5ce5fbbe86e6392ae66f29fc93ac1079fd2d029b9338697b004325c4b36
SSDEEP 1536:PYNbfqJF3b6wgb6hh2Dgf+x8GC2kMYdSKySPxVMRjAxUR9Wv:Gbi3M6hjf+W2kMk26VMRjaUX4
TLSH
T131B3E73C9F70C4295EE7000B6C28B95846142BD59E87DDC4EEBF7A090272AF536A85F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Fingerprinting

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.34\Sigma\Fingerprinting
Size 2KB
SHA256 ec0fcbf71d58e707aaf6ba8d3c0719972f26727febe03f8efbf570b9635faddf
MD5 5330ccc991b45c6f2777d23c7d8afe8d
SHA1 d11187c035458fe1201608a91062962903de2e53
SHA512 2db42b7a6b7f2170f6cad2a26a606ff6357cb8c707ba9947baab14dd7f566df04a274e46e36cee72c43ee87ebf4d455b4af3f6da973f29bdbefeb0304f1d6f93
TLSH
T1A3414422581030617E7D49DCF59A3F0D29D9613A84C9F6D6DFE08936722E8E734A4896
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.34\Sigma\LICENSE
Size 66B
SHA256 44071e0fcffb9a9a32e8fa7010bb18dbc41afd0b176f81bf700b15b638a88a51
MD5 5b7baf861a48c045d997992424b5877b
SHA1 2b2bd9a13afe49748abf39faf9eb29ed658f066e
SHA512 4820b41aa5ff4d934a583e1f0b93b1512631102bb2dfdb74792a2f0dcf9907da7680c02a5ddd2492a1e6d58cdada3453d9e38bb8deab6ce831ff36a7f8de016c
TLSH
T1A8A0025216021A6312E295EA5E589B4FA50A1AD5255C0341164904D898B01D995E87AE
MD5 SHA1 SHA512 TLSH

Submit Download

Other

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.34\Sigma\Other
Size 198B
SHA256 c9ab8dbc87043c71dd649fc06bb006e7f62e81c973c37b125afb88e654e436f8
MD5 7bb2f4076e4f47781b77d811b21ef1ff
SHA1 fc0feddf6f52841bbd780d21b8e0ddff74fd70ac
SHA512 28356614bc38576ecb37218f9f6f631bd9e55573206c3aa854b91956a33fc828c71f42c7dc7dc6aa86540dab8e345b8f88bf9c6eb56e49824f492854c193b27b
TLSH
T1B4D01250151A5B0D6FEA41D1DA8055241DA19DF474CFF8CC5555B032E68895729C0DD3
MD5 SHA1 SHA512 TLSH

Submit Download

Social

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.34\Sigma\Social
Size 3KB
SHA256 e520603e6fb543cd078b2a7dbd8ccfc175e9aecf71654fc19785927a014d3435
MD5 fbfc314bba2160b09a3376521c762772
SHA1 3566357486c5d466958334e813c90c0a97bfc985
SHA512 e4383491ce5170d0daf4abee61484c62611dfc604549b537d0080f24bfb8cf379ec3efbfb6caf10e7c066ec06457fb077832d5f780d226f0a957f624e0ba9383
TLSH
T17161DD36C590A9932E5D0C41EEC55E700DD8157ECCA6F4D287B082F8F0AD8977D94BAB
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.fingerprint

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.34\manifest.fingerprint
Size 66B
SHA256 f96cf59ef5cdf10cdebb367e16c6736d188af934062a8721eb9d60539556a2a9
MD5 0f487a41f1bb9a49dfc5814815dc8b1e
SHA1 39e5af8034fab47bdfbaa2a66455c74185756f0a
SHA512 bbbd1619eead82c70cdc0f72867db2ffdd4a45cb908c81e852eec8c1293bcafb90c554bc3d51afab7fd7e478efc15aa9ad90fe1b56a01d0012ecee493184d36a
TLSH
T1B0A0024A47C1F51A80D137495D771D41C91755E1BEDF91481A929F2266379C0586C454
MD5 SHA1 SHA512 TLSH

Submit Download

keys.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\TrustTokenKeyCommitments\2026.3.23.1\keys.json
Size 8KB
SHA256 ae6e69a145f84c0a261b4e82888779fbf137f193881d687588e1af71609ae947
MD5 d3ebc1cb4b692c6e2d29a4625420fe73
SHA1 4ce74c1e9af6fd34d6379ec0fec6afb24082a7c1
SHA512 e34b855615e6a3bf770f27d85aa29ca57a324c08bd8f8d9c0130e2a142c0e4a5f17bffd0861b725acc8a2316f73b7fe50406b0af26264a5c2d8f37599b260860
SSDEEP 192:uNtGbR+mFGfvPNyR9Pm4lOvMwkoR9PuGMXcy:ORmqwKjA
TLSH
T18402A57F14A41181CE7FC1698F0B78B78FA038065BCA3A83539BFA49494296D173B5B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

typosquatting_list.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2026.4.17.1\typosquatting_list.pb
Size 1.6MB
SHA256 805d8d74e6a3b6b2fe689e200868d7fa4781089d5f6fc830487ed1b5a9017049
MD5 acc4a11e2e7ba213daa0f5e73300f694
SHA1 979463888ec0a9931499a9b1bf6cdedd9bee0872
SHA512 cd81ae9130a4df9ff95932ab57a6f8410aaf6fc0df0979f0d54c2d8332f0c15dc860d0e59d3d6b32e2b14c47a89179c79f935f75498634fe7cb904f3374db907
SSDEEP 12288:1Po6kw86Bm53N/m9hb0dleifKXYXHX0Wi5QIQ6E7JOPo1oQSc9paunY:1PZq9+9hbHifKXYXHX0WwQIw7VSj
TLSH
T1C985B5F9DFC00194DAB8112D20BE71D8081412A540E5EFEAFE7C855F2BC6AC977E49E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 2741df9ee9e9d9883397078f94480e9bc1d9c76996eec5cfe4e77929337cbe93
MD5 f732dbed9289177d15e236d0f8f2ddd3
SHA1 53f822af51b014bc3d4b575865d9c3ef0e4debde
SHA512 b64e5021f32e26c752fcba15a139815894309b25644e74ceca46a9aa97070bca3b77ded569a9bfd694193d035ba75b61a8d6262c8e6d5c4d76b452b38f5150a4
TLSH
T168A012078473800AE4184092C45C024114A480460119D0015070931314950CA03A5435
MD5 SHA1 SHA512 TLSH

Submit Download

ghbmnnjooekpmoecnnnilnnbdlolhkhi_1.3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\ghbmnnjooekpmoecnnnilnnbdlolhkhi_1.3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
Size 147KB
SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
MD5 9c670f04d98ab7404f16423f6ee6cdfa
SHA1 8d01079b2d065731df8a7ef52f447cd4b7add353
SHA512 102cee76d9dfcfe91e044f529672fbec042b50c5db55a3cc137197b2013dd7f81e47f50dbb0db96cb621c5732610e1eb553c4146837c11075c7c4dbd67546a3b
SSDEEP 3072:F7R0M+jCozOtDTsjMcT0JnFjkbxnEbm/+OdGmlVVklFHEpCm+:F7WxxzyDTM0JnRkb5bJdGmJkvkpx+
TLSH
T12DE3E16D3DE6DE1FC41B58F53E64708BC80E8F0B820A644FB64988345A60B5D1BD6AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Custom.theme

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Themes\Custom.theme
Size 1KB
SHA256 0afcfadf1cb48734037274810f5193e985e117b742fb1baf3210175bd4bb6331
MD5 9ad0113c0ac521968f87938649f65a2e
SHA1 eb97a1a092a60ceaacbb17c9fcaace23a3e4c49e
SHA512 7831e7f1e2ccc8531541c33c7229fb2c83767ef0914b7a6e5d89647773afecb436da0d6575d47f1d361a099aee13513c539f43cbd0bc3305c0503df8f8a987d0
TLSH
T1C741E970F308CE43AED235AF70C4D80FB26C75178984F6451CC0A06AF19711A83B89B9
MD5 SHA1 SHA512 TLSH

Submit Download

e551f526-30c6-49b9-84d7-cf0b1aa34cbf.tmp

Path C:\Users\Admin\AppData\Local\Temp\e551f526-30c6-49b9-84d7-cf0b1aa34cbf.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

AdvSplash.dll

Path C:\Users\Admin\AppData\Local\Temp\nsx26A.tmp\AdvSplash.dll
Size 6KB
SHA256 eb1ca2b3a6e564c32677d0cdc388e26b74ef686e071d7dbca44d0bfa10488feb
MD5 13cc92f90a299f5b2b2f795d0d2e47dc
SHA1 aa69ead8520876d232c6ed96021a4825e79f542f
SHA512 ff4e6e6e7104568fc85ef3a3f0494a5c7822a4ceaf65c584ad534f08f9a472a8d86f0a62f1f86343c61e2540b2254714b7ea43e4b312ff13d8271ff069386fa3
SSDEEP 96:6hNSXIcmYjkvTS6MnBNZ1BMjDfhkkEkkXstWpPwoS:JXIpzTSd1BSk/kJtWpP
TLSH
T137C1B837B7C216F7C35600F12916375387E9943263A1946909B3EBCAA6A185BDD34703
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir72_1869434921\CRX_INSTALL\_locales\en_CA\messages.json
Size 711B
SHA256 2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b
MD5 558659936250e03cc14b60ebf648aa09
SHA1 32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825
SHA512 1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727
TLSH
T1460197136240AF18470BF05BB9023442A0B44AC62384E0B775EC982C6656DAFB20B3B0
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir72_1869434921\CRX_INSTALL\_locales\en_US\messages.json
Size 1KB
SHA256 4f70eca8e28541855a11ec7a4e6b3bc6dd16c672ff9b596ecfb7715bb3b5898c
MD5 64eaeb92cb15bf128429c2354ef22977
SHA1 45ec549acaa1fda7c664d3906835ced6295ee752
SHA512 f63ee02159812146eee84c4eb2034edfc2858a287119cc34a8b38c309c1b98953e14ca1ca6304d6b32b715754b15ba1b3aa4b46976631b5944d50581b2f49def
TLSH
T153213806EA14BB37825F6036BC657585A3300ADB2600FC3D7EDC941C1B059AA91BB3D4
MD5 SHA1 SHA512 TLSH

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir72_1869434921\CRX_INSTALL\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir72_1869434921\CRX_INSTALL\manifest.json
Size 1KB
SHA256 609995e8dbdba5ba968a6c604750e725059902b4e8c1f693851c738d3938317e
MD5 8afea622647be84467127ef5cb12745d
SHA1 dbbecddc500f406b199dabaa7cd38b1bd3d34557
SHA512 51e562c06c99d5a7bdc56df7b61d8b420a42e18e46d9d7ba182c07ac6fd671f68b9c65c0a2356d4ab17e7c6b4f22920d94f57514ac831a46d0fd60450a98034a
TLSH
T1744169F7BC00AD634BA49898AA1E710EFB29B24D55CFD4DB8298107342CCDAE1D601E5
MD5 SHA1 SHA512 TLSH

Submit Download

DreamAquariumXP.exe.crdownload

Path C:\Users\Admin\Downloads\DreamAquariumXP.exe.crdownload
Size 8.3MB
SHA256 6b25587b499327f1cba1a2b592a378ebb93079e5e65b3202a9a0453a8c436a36
MD5 dff323fefe075cc604085711a7985d2d
SHA1 ac95161c1e675a8eb6102f339fcae52e02f5659b
SHA512 ac71e9546517a8e1f8b822103b1f825683ba2335f658987bf6acfa0ee59c0cac91f97a493717628e88bdc485f70a843c11c5ec0ac426babb728724c1ceffc56c
SSDEEP 196608:Azt0nBgPaGKNqorJEg2JdQPRwcwHxYDMRhlCPLAC:AKnBuy09JOPRxVM5q5
TLSH
T13296334BA7F7A257CE712B307C62DD1442265CE40E862B93BFBBD45907D66FD00839A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsLogo.zip

Path C:\Users\Admin\Downloads\WindowsLogo.zip
Size 794KB
SHA256 937cc4f55a56a67a540f3e82ad396dfb2e68eec08fc099bc46681d411f63c0d5
MD5 61a29059e0444163a5283f45e72be05e
SHA1 6c1cb44482c9539e80e3e2eb7b597e29dcf0e3d6
SHA512 43566795ecea5043f52eaf0e1b9a8a4de3b2a4eb5487ade8012a1741c23a18b89be64b01b3d6fb298eea06c15e05d9b87a2569a2b9329ecbc9ce5d5f187e241d
SSDEEP 24576:uTvegV6/99E9VuKjVtADu0nlmuEev9ttWu:mveP9EnjjO3LEev9ttWu
TLSH
T1E40523CE00DFA71AD7CB8D72612EDA5E62215DE391B9352CDD1836331CE4AF4291293B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XScreenSaverWin-0.78-Setup.exe:Zone.Identifier

Path C:\Users\Admin\Downloads\XScreenSaverWin-0.78-Setup.exe:Zone.Identifier
Size 26B
SHA256 eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913
MD5 fbccf14d504b7b2dbcb5a5bda75bd93b
SHA1 d59fc84cdd5217c6cf74785703655f78da6b582b
SHA512 aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98
MD5 SHA1 SHA512

Submit Download

fantasticfish.exe.crdownload

Path C:\Users\Admin\Downloads\fantasticfish.exe.crdownload
Size 1.1MB
SHA256 00dbcc21630308e1430ad5fbfefac113177ec1897f85003058c17bdf6a942a47
MD5 0eabefa85d5b5ab2dee1757b6f21ce9b
SHA1 bab78d82135c50a1cb0a6b4a5fee62aa9fa6df03
SHA512 a62bc7301f72c9678bfb56edae52a2cc3859163a145a62981bf2c9feb05b1f6c35ffb493ec43c40671ef6383471467bae2c194b8b264b6fc1da3491a536e2e91
SSDEEP 24576:zTb4W+z2t1y/vreg+pG6kw8w9uuTLfVTVwEoa/UZlGOZLYTRaWCbV7EuMPdq:zff6/vrXCkw19uiLfVTKNOSGoLyRshM8
TLSH
T13B35336DDB9958EED47E097EC73B8FFD50A98C3037B8456F520D3A1874342CAA09A436
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

edge_checkout_page_validator.js

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1172_1369263214\edge_checkout_page_validator.js
Size 1009KB
SHA256 9960614ae3d67b2a2b2b1bb1fdd6a427f4d103835e50e45f2e2cf3b1c540fa44
MD5 f4cf71ceaf44655238e8f6e445479361
SHA1 4d184496decd453261423d11a681bb925d1c466f
SHA512 c6af515da4c1eaa6689c829be6a99602f148090989c7f8b5aa5cd0620ca73d8b217ba266b188aa72bd219f863c86fb00d6e48758278346f5959f2c5169c1e382
SSDEEP 24576:cs4ymRAbsvvG3kJ6ARjiQixwaErn9VUfWEo0EQ1Xp8C9T0dK/vzHEiJsfaG81E9/:cs4ymRAgvvG3kJ6ARjiQixwaErn9VUfq
TLSH
T15F252B84E1E2253466D74CB960B7D2C4B5DC04583399F1E8FA6C68CADA0FD4723F663A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1172_1369263214\manifest.json
Size 146B
SHA256 1d4f529025d274699f815657573b828ae880ae0d44ee0b0ce66a6a273f2bddff
MD5 94e3a47681712a13578f122b3158c015
SHA1 376442061baa7018ee9e784d991798fc9f302b31
SHA512 6974139805e18959c2ad2a71727705f1c5268ee598b8864833732e042beffe2416db033180b8d01bf8bb3b2b901d4ccbb090dd677ecded939aa3d07797ba05b2
TLSH
T12FC09B73C931AC71157507D449F59745EB74574BF511B1563730018D4B3D57550606D1
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1172_1644360722\manifest.json
Size 83B
SHA256 2fa4f8b4c565b313d2e3758273b432782d14bef430a6c532c695553b84d4d7b6
MD5 f599dd119151ad0cfecb0076d05fd931
SHA1 0a478d2a0f252871d047a2b2b7ce90242db01cc0
SHA512 241b7c439760dcba4f88099b2950a5ab2ee1d34665c56a62446a4f392df8e8ed772dc948fac94b7b0fb5dea9ef32d741966d12738e87839c1b6a8311c35c1229
TLSH
T11AA012132DF1506321801B65113042C4933480046128090820041AA091409750500205
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1172_1695558616\manifest.json
Size 1001B
SHA256 25ac9b79df29fa869b4c9f4ca3bdbc3a85f6122f5a8efab5a1216d577099becc
MD5 580786a5ec9eb650dde3e0e75db8588a
SHA1 8c0835d1a6bf82e753b624440e9674d649696ead
SHA512 c8d41e16b291157e2afbf978469eae4c017d1ce3b941b93ae710e2bbaaf4c3e601db45e579d22b957b7a1ec48cba788015725a2fa23cf02f2d66010ef4fdd0a0
TLSH
T100115B10DD388D9326E4BAA21CC6580957661DAF4CC23F98379E161D8F1C8AFA37366C
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1172_1766195762\manifest.json
Size 116B
SHA256 181a1631374b5ac1fff89559f7e23498ad9ee4796885d7b956d5e7d5f9c3f8c7
MD5 daf93729356a67ea1f849554827fdab1
SHA1 17dad0cbc82d5e04fb068896a5832f983e124c01
SHA512 473d9d608f2f3324d5db6eddeb4554a7271df4a6b62377820d935c001a8a2376479aa4d3e3b80ffbfdd3ba80f56fe72f1bc9dd020bcb396182b753353b883a30
TLSH
T1FBB09262A8084633249523F4A2639363CBA86D4A91346606091B9480659E73B22A5219
MD5 SHA1 SHA512 TLSH

Submit Download

notification_fast.bundle.js.LICENSE.txt

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1172_1878321854\Notification\notification_fast.bundle.js.LICENSE.txt
Size 551B
SHA256 38ed54eb53300fdb6e997c39c9fc83a224a1fd9fa06a0b6d200aa12ea278c179
MD5 7bf61e84e614585030a26b0b148f4d79
SHA1 c4ffbc5c6aa599e578d3f5524a59a99228eea400
SHA512 ca5f2d3a4f200371927c265b9fb91b8bcd0fbad711559f796f77b695b9038638f763a040024ed185e67be3a7b58fab22a6f8114e73fdbd1cccdda6ef94ff88f3
TLSH
T108F08B5A31E12673416285A1270B52DE7F0C10BDB0AF39779444C3386C348EE82D0EE1
MD5 SHA1 SHA512 TLSH

Submit Download

tokenized-card.bundle.js.LICENSE.txt

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1172_1878321854\Tokenized-Card\tokenized-card.bundle.js.LICENSE.txt
Size 1KB
SHA256 363f376ab7893c808866a830fafbcd96ae6be93ec7a85fabf52246273cf56831
MD5 8595bdd96ab7d24cc60eb749ce1b8b82
SHA1 3b612cc3d05e372c5ac91124f3756bbf099b378d
SHA512 555c0c384b6fcfc2311b47c0b07f8e34243de528cf1891e74546b6f4cda338d75c2e2392827372dc39e668ed4c2fd1a02112d8136d2364f9cab9ee4fa1bd87f5
TLSH
T1A2313A5B32F53673416245A1670B52DEBF0C24AEB56F38B79495C3387C388ED82D1DA1
MD5 SHA1 SHA512 TLSH

Submit Download

strings.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1172_1878321854\json\i18n-tokenized-card\fr-CA\strings.json
Size 2KB
SHA256 c67b555372582b07df86a6ce3329a854e349ba9525d7be0672517bab0ac14db5
MD5 cd247582beb274ca64f720aa588ffbc0
SHA1 4aaeef0905e67b490d4a9508ed5d4a406263ed9c
SHA512 bf8fa4bd7c84038fae9eddb483ae4a31d847d5d47b408b3ea84d46d564f15dfc2bae6256eac4a852dd1c4ad8e58bc542e3df30396be05f30ed07e489ebe52895
TLSH
T17251EE3D88F4489B60C7921B6B1142D7C9704E36D704F3848A63828A035BDEFB0BF69D
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1172_1878321854\manifest.json
Size 121B
SHA256 cd25cc1afcc03514d978f0a90692454e810c3cc81763074e0ea5ac504255335a
MD5 8083caaf7f5bc5f01ede464e68db1c7e
SHA1 ed6cf18f79c4ee2968adfffe7bf1bce163ef3873
SHA512 60924bd5617ac5f994805f9a871999764ba93c6adda79c501a0b692dce51b9db6f6531a5e25129bc424ae7c4de868ba6e5a976d6bcfbac2bb8bd192c5513c7ee
TLSH
T10CB0922289429D300469079809B486A6E230674BE406F0397B7041CC8B785B8A4A2A94
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-af.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1172_2122667833\hyph-af.hyb
Size 70KB
SHA256 5487ee44a4cd706d0086522e90c59c76cdf2ac68ce506fd3eae6054b9220c0cf
MD5 ffa9db945f0f0c15b8bba75a6e064880
SHA1 49217a9d5bb7a868464403b4e3c82e80df53456c
SHA512 cc67b2dfbbb009dd3fdb999fe86410425455613c12dac755a3cded435cd25ca4363782d70f3b7bb7c0fdd63e2eb649ae6a4053d929f463b646b43d7dbfda79c0
SSDEEP 1536:dH4Yzf/r1T2bhKC+wQ/MJ4tpBMfWDMxFaye3yrGZ3vGV9YODhX3yKfhGt:dxLr1qFKpNpufWIqye3KgGVnDxe
TLSH
T1D56329C3C62BDF90CC6419F4594D0AA811D816C6E7C039BE9B6C54797A27CB82BC13EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hyph-as.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1172_2122667833\hyph-as.hyb
Size 703B
SHA256 c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
MD5 8961fdd3db036dd43002659a4e4a7365
SHA1 7b2fa321d50d5417e6c8d48145e86d15b7ff8321
SHA512 531ecec11d296a1ab3faeb2c7ac619da9d80c1054a2ccee8a5a0cd996346fea2a2fee159ac5a8d79b46a764a2aa8e542d6a79d86b3d7dda461e41b19c9bebe92
TLSH
T13001E1B0B7014F4BC635EDB0117A4A6D9664C43553BE051D84B1F9634F19714E70A8A8
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-hi.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1172_2122667833\hyph-hi.hyb
Size 687B
SHA256 f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
MD5 0807cf29fc4c5d7d87c1689eb2e0baaa
SHA1 d0914fb069469d47a36d339ca70164253fccf022
SHA512 5324fd47c94f5804bfa1aa6df952949915896a3fc77dccaed0eeffeafe995ce087faef035aecea6b4c864a16ad32de00055f55260af974f2c41afff14dce00f3
TLSH
T14801E178BE13888BC6784DB1054115AA0320F90EF296021B4262B13ACB18FD61C95484
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-nb.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1172_2122667833\hyph-nb.hyb
Size 141KB
SHA256 c2771fbb1bfff7db5e267dc7a4505a9675c6b98cfe7a8f7ae5686d7a5a2b3dd0
MD5 677edd1a17d50f0bd11783f58725d0e7
SHA1 98fedc5862c78f3b03daed1ff9efbe5e31c205ee
SHA512 c368f6687fa8a2ef110fcb2b65df13f6a67feac7106014bd9ea9315f16e4d7f5cbc8b4a67ba2169c6909d49642d88ae2a0a9cd3f1eb889af326f29b379cfd3ff
SSDEEP 3072:pPTHXHEm69FrOP8d4hRLiinKL4Qshbv2fuOQXCxj+60EoM8WC5zgk:p73HEUP8dsiinTThjy90VKk
TLSH
T1CCE319F3A3394AC29420A8A4DF593B7E4044FA944D80E197B5EC2038E667CBC76D579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1172_2122667833\manifest.json
Size 82B
SHA256 d571ef33b0e707571f10bb37b99a607d6f43afe33f53d15b4395b16ef3fda665
MD5 2617c38bed67a4190fc499142b6f2867
SHA1 a37f0251cd6be0a6983d9a04193b773f86d31da1
SHA512 b08053050692765f172142bad7afbcd038235275c923f3cd089d556251482b1081e53c4ad7367a1fb11ca927f2ad183dc63d31ccfbf85b0160cf76a31343a6d0
TLSH
T137A022A0BC0880333E8803A8023E83E3C3BE3E0A20003C0002A33C8022EC33B3038E2C
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3076_1047227492\LICENSE
Size 1KB
SHA256 3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b
MD5 ee002cb9e51bb8dfa89640a406a1090a
SHA1 49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2
SHA512 d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c
TLSH
T17D31535723840B9306DA2B4566AEBDC4B0DDC02D7F27AE05186EF394537B52ED8B3443
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3076_1047227492\manifest.json
Size 79B
SHA256 7ea98f2308a9c51d17a1ac71b64afbe2a41ff0a083a166a0e4cc428bf44f0715
MD5 817fea104100763cd1bf4f15a51bfe94
SHA1 589717cf98cf7e2d55fc0d6025a4b8e215ed13d6
SHA512 da7b959d93113c5a6be360f90d9c721989c5e7acad7fa592081b582c4c3a0c4a9066a71473fd8492ce7fe7b0fbfd6870d939428a67fbd508fcf6b2c6dc1a41ea
TLSH
T15EA0122058019233108407600360478243551C022015244809461041258813A12A3128
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3076_1120674779\manifest.json
Size 177B
SHA256 096e772e0f2e8c15e6dec9087ee0a1fb8b0c56b25061626aedc9e7e705adfc2e
MD5 2714a51ed8c2a891ad73b7488ab655b9
SHA1 9a8cc479aec8de1b4eb678e5d68b23b16a39dc99
SHA512 4811522c06ad6946626a9f4d12eb62a1d623825d18a1cd0ad7b628f4c059f37d299b5857abffd959e4ea53239412490539f5705b4aa6c6951d13c68e6d5b72ad
TLSH
T1E6C012EFDC509DB215EB4323156D43C4E733CF4B1546490935FB66082A25981C193500
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3076_113418701\manifest.json
Size 118B
SHA256 69e4e1c13d13f15e8066d6d7e984a96a08d3b2a2ae33fbb218b1e0de5b8d1aed
MD5 4687681b420a5c580fe40870ed6af32c
SHA1 1aa40f91b2ed8c5ea38cb30b81c87a9ac7e21e6f
SHA512 5ced299552785894df9aa86f0cb5d9c057cf73753f81112ef91a8b8dbc6147913e39c27b6327613bc41c447ed230fbbc74881db79853d38e365685132e618762
TLSH
T170B092B00C1AA43B22C09320ECA0668683F84218E8421B1A098036481F882B880362B2
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3076_1374121817\manifest.json
Size 52B
SHA256 38bee4120e8eb37975dd2f6a2a3b23f9cea6e6c4f0335ad80270dc22b9990fc9
MD5 50ba36034cb8b97ce52eb941d76e9103
SHA1 a8757a3700f2af777ce5efc382010d2619f51491
SHA512 001110c3e45514a09cf6f60ca14855524e83ac15cf56776cf3005e016464dc6584b107c63842328a7c1738cc7f2154d8689f84d913b9b8199367699c3f9085aa
TLSH
T1FC900260082491171AC10E506570F8859391661A95851D1D0445154802A646CE050298
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.fingerprint

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3076_1514693581\manifest.fingerprint
Size 66B
SHA256 c236a2ac7741d48e1c56980652331cb3f1f12baf937baf0b280600fbafb143e3
MD5 c28ffa45708f10e3a35143ed2708782f
SHA1 84a03f2615333c9311dbf79d6f58f56b5c009163
SHA512 beac0eacff45a152eb2a50f4d72db2933b8f8ba97e6f0a9f6811abe866fef5c7c83068151915dbdffaccaee5d0cd335d182671f44dbab6da2222266ff8a28ff0
TLSH
T169A022F3F000F02030022F8A80203C00C8A23BA80C8020808000BEE0200322A3A0C820
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3076_1514693581\manifest.json
Size 135B
SHA256 ba5c9096d20a482aaa1aa9e5f98ad6127d3e97c2f21de84f7c78d9b8073c8e26
MD5 fbebd68ecaa98928909421f66909c054
SHA1 99d787d90f7ed2e5ad924f9c5668eb988b5a6c07
SHA512 749a3b2be47fe28399dc763888654a3e8d397e06e8d3c3af3965bb45846a1336e6ab4ca82c82c3df846b34a2afafa2156f2690e9bf347ab175408dc0171c61cc
TLSH
T158C04C668D51DEAB00A747A56B295315E23B4B4B5044800A7AF5429C1A288964171944
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3076_1748474123\manifest.json
Size 102B
SHA256 932322ae700a7d7606efb182239db5fd9550dd6cb5860e0a17bfb6fe3bcb5f35
MD5 19322c8a94f1ac01a70f8c58cdbbc720
SHA1 7c90dac178c47dac9087dfce738f24a4a627f022
SHA512 f54a9cab8dbe96333862a67912e88c4f26cc3e25a7dc93e8f06d1fb5b0b8e91d53cc0f5619c192380573a2846034ee583276d7eda73dc9fc93bb0d9168f4e099
TLSH
T156B01221EC10B4B32004036C086CC3C063272F032C4079280DE19F84E90D9DBE471528
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3076_212168825\manifest.json
Size 69B
SHA256 c0622dadf4ec10ce5f4a64e3f24956b750345dcc194d0bd3ff73cfce1bf6081e
MD5 fb0d9796a86299d3689982f7a949dc6e
SHA1 6179cd612ac0dcc44d0659c7c99d1e0aecbf206e
SHA512 e3e1a18be661da9d450a30a37d24dc08dc8de628a104ce0f4197214ce6f27a2bf9de3eca1c1697fcfa3c601787ca7a6b5e30a5fe3d6ae3b2c10f1ab34af22fd0
TLSH
T141A022200C2088FFF200E3CC0020E380CF28A300A2088C0A022220002280CB80200320
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3076_271554800\manifest.json
Size 76B
SHA256 0d664bc422a696452111b9a48e7da9043c03786c8d5401282cff9d77bcc34b11
MD5 ba25fcf816a017558d3434583e9746b8
SHA1 be05c87f7adf6b21273a4e94b3592618b6a4a624
SHA512 3763bd77675221e323faa5502023dc677c08911a673db038e4108a2d4d71b1a6c0727a65128898bb5dfab275e399f4b7ed19ca2194a8a286e8f9171b3536546f
TLSH
T170A022833A0EC03B008283B0202383C08BBCAA28380E080E082338C0CAC2BB80000B28
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3076_694791031\manifest.json
Size 119B
SHA256 7169d86e87f904218238cd293e043e20b7828afad9acd1ff2e5d64188530b9d7
MD5 7382260298fc06c135b7c7399e9acff9
SHA1 6a829f795a3b8be25200675e00abfa1908fdefdf
SHA512 f0ce77f9f72fb6721bcfa9b03f77b0771e8217988183787c00dba4f9d9f19cdba252ddd656422336035f81939cb97c8b5dcb4f036a39280198c17cd04faaaed4
TLSH
T191B09273A800E83830E9EB91093A8243F320AB4BA585640A3625485C0B2B9F990606C4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3076_705169011\manifest.json
Size 85B
SHA256 2d905d7b28b1afd313753d14f6a916a2e56ec4c1316bfa43046b09214ceb6090
MD5 8ce95626b39ebc2401eee0b34c24fc7c
SHA1 f97a2fefe756f7a03e388e1333573b884730c2b0
SHA512 f04e4f695977918adf6e0603386b6f9c75a4a2202b0fe7215b642f3db491a1db398039cc28633b8e2541749403581622d28c1400f3f8fc66a3daab200e27266d
TLSH
T106A0121018015DE318880320213143D2D3A51C05247437001106108019B8636027A22E
MD5 SHA1 SHA512 TLSH

Submit Download

Staging

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3076_884996151\Sigma\Staging
Size 36B
SHA256 411a706def2e70f96a507208bf80bceb93e950c4c2d671cd1ddb4134ce54b2a9
MD5 0163de1b14421d4eee3757ff76fd81e4
SHA1 96c75c4fe1e3f33a367f45293bd1bd8bff1c06f4
SHA512 80114d59db8f3654dd6821589e5ad03daa923a35610a372756a8865b3e769621e32ef2aed92c2494de2b9fc06d9796b12f1e3bb75873ed794e8c9ae8a0d5e965
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3076_884996151\manifest.json
Size 132B
SHA256 68683970ce6d7de9a2043c34129106ae68af21a3b0a3c53cb59695640a7c1cbc
MD5 a4d9ab812da8b2906ff9d46f9ffc07c3
SHA1 48b428dc760bc008058e6df47a9f05f2f86b4abb
SHA512 5a2ba950ed85ee55bc1402d57d09ca8d54c0c2df5b43a402bb8bf3668920a40d584fa18d270376b046e23be00698bd1399ef6a0b695ee6c0b99fb454616b1cb6
TLSH
T1E8C09B115801797654DD77F00D29D7526672CB1D1494250546F5C218EC2DCDFB5B330B
MD5 SHA1 SHA512 TLSH

Submit Download

fire-un.exe

Path C:\Windows\fire-un.exe
Size 32KB
SHA256 d27d4334c80cc5baedff1ff3a326ee55a9d335d39ae5dde06ecd3d5fac4c6602
MD5 d92691593ecf5e9c199ba13fc3b54a53
SHA1 bfa7f36e309ffe334c3c84e8b6954baff1cf822a
SHA512 98d3aef0f3e55440967cf6259aef94132bd3b2dd43cc687b3b77ed1f1be6b2f391294f4fce6a97e3633faaf3d933d6b5a2044d148004073873ddd1770c8357b2
SSDEEP 768:bE+BmrtvkC3kCERF57oTBQsuE2Ol3E3VLhg0rJAJRnG:bZBCOCsoGXcERrJl
TLSH
T117E29E3676D188F3DAE280314D776B39FF7AB323122509C753588F6E5D322429A1A3D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1004-4962-0x0000000014A30000-0x0000000014A94000-memory.dmp

Download

memory/1004-4908-0x00000000093B0000-0x00000000093C0000-memory.dmp

Download

memory/1004-4938-0x0000000000F10000-0x0000000000FD1000-memory.dmp

Download

memory/1004-4982-0x0000000000F10000-0x0000000000FD1000-memory.dmp

Download

memory/1004-4911-0x00000000093B0000-0x00000000093C0000-memory.dmp

Download

memory/1004-4983-0x0000000014A30000-0x0000000014A94000-memory.dmp

Download

memory/1004-4910-0x00000000093B0000-0x00000000093C0000-memory.dmp

Download

memory/1004-4909-0x00000000093B0000-0x00000000093C0000-memory.dmp

Download

memory/1004-4912-0x00000000093B0000-0x00000000093C0000-memory.dmp

Download

memory/1004-4961-0x0000000000F10000-0x0000000000FD1000-memory.dmp

Download

memory/1012-4490-0x0000000002A10000-0x0000000002AD1000-memory.dmp

Download

memory/1408-567-0x0000028E03280000-0x0000028E0339E000-memory.dmp

Download

memory/1648-4513-0x00000000076B0000-0x0000000007921000-memory.dmp

Download

memory/1648-4518-0x0000000000400000-0x0000000000875000-memory.dmp

Download

memory/1648-4511-0x00000000076B0000-0x0000000007921000-memory.dmp

Download

memory/1792-2731-0x0000000002DD0000-0x0000000002E91000-memory.dmp

Download

memory/2040-1367-0x0000000002670000-0x0000000002731000-memory.dmp

Download

memory/2080-4931-0x00000247D0800000-0x00000247D091E000-memory.dmp

Download

memory/2088-1348-0x0000011A5AB20000-0x0000011A5AC3E000-memory.dmp

Download

memory/2332-4360-0x00000000008C0000-0x0000000000981000-memory.dmp

Download

memory/2432-4489-0x00000000015B0000-0x0000000001671000-memory.dmp

Download

memory/2788-4491-0x0000021AB7FE0000-0x0000021AB80FE000-memory.dmp

Download

memory/2984-1976-0x0000000000400000-0x00000000004D8000-memory.dmp

Download

memory/2984-2031-0x0000000000400000-0x00000000004D8000-memory.dmp

Download

memory/2984-2035-0x0000000000400000-0x00000000004D8000-memory.dmp

Download

memory/4640-170-0x0000021B83200000-0x0000021B8331E000-memory.dmp

Download

memory/4680-1973-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/4680-1968-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/4680-1504-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/4876-4986-0x0000000002220000-0x00000000022E1000-memory.dmp

Download

memory/4876-4937-0x0000000002220000-0x00000000022E1000-memory.dmp

Download

memory/5056-1972-0x0000000000B70000-0x0000000000C31000-memory.dmp

Download

memory/5056-1971-0x0000000000400000-0x00000000004BA000-memory.dmp

Download

memory/5056-1969-0x0000000000400000-0x00000000004BA000-memory.dmp

Download

memory/5056-1970-0x0000000000B70000-0x0000000000C31000-memory.dmp

Download

memory/5200-4569-0x00000000011F0000-0x00000000012B1000-memory.dmp

Download

memory/5200-4525-0x00000000011F0000-0x00000000012B1000-memory.dmp

Download

memory/5212-4519-0x0000000002E10000-0x0000000002ED1000-memory.dmp

Download

memory/5216-4480-0x000002AE988A0000-0x000002AE989BE000-memory.dmp

Download

memory/5364-4479-0x0000016520D40000-0x0000016520E5E000-memory.dmp

Download

memory/5500-1503-0x0000000002E70000-0x0000000002F31000-memory.dmp

Download

memory/5668-4392-0x00000000021E0000-0x00000000022A1000-memory.dmp

Download

memory/5668-4386-0x00000000021E0000-0x00000000022A1000-memory.dmp

Download

memory/5676-3278-0x00000000021B0000-0x0000000002271000-memory.dmp

Download

memory/5676-3282-0x00000000021B0000-0x0000000002271000-memory.dmp

Download

memory/5700-2034-0x0000000000400000-0x000000000071C000-memory.dmp

Download

memory/5700-2032-0x0000000000400000-0x000000000071C000-memory.dmp

Download

memory/6032-4478-0x000001F03C320000-0x000001F03C43E000-memory.dmp

Download

memory/6532-4401-0x0000000000400000-0x0000000000448000-memory.dmp

Download

memory/6736-4697-0x000001B01AA00000-0x000001B01AB1E000-memory.dmp

Download

memory/6804-3277-0x0000000000A10000-0x0000000000AD1000-memory.dmp

Download

memory/6816-2730-0x0000000001060000-0x0000000001121000-memory.dmp

Download

memory/6944-2751-0x0000000003E90000-0x0000000003F51000-memory.dmp

Download

memory/6944-2752-0x0000000000400000-0x00000000005A8000-memory.dmp

Download

memory/6944-2746-0x0000000000400000-0x00000000005A8000-memory.dmp

Download

memory/6996-2757-0x0000000002560000-0x0000000002621000-memory.dmp

Download

memory/7036-4988-0x0000000007D30000-0x0000000007D40000-memory.dmp

Download

memory/7036-5015-0x0000000000990000-0x0000000000A51000-memory.dmp

Download

memory/7036-5008-0x0000000000990000-0x0000000000A51000-memory.dmp

Download

memory/7036-4991-0x0000000007D30000-0x0000000007D40000-memory.dmp

Download

memory/7036-4989-0x0000000007D30000-0x0000000007D40000-memory.dmp

Download

memory/7036-4990-0x0000000007D30000-0x0000000007D40000-memory.dmp

Download

memory/7036-4987-0x0000000007D30000-0x0000000007D40000-memory.dmp

Download

memory/7040-2753-0x0000000000400000-0x0000000000875000-memory.dmp

Download

memory/7040-2756-0x0000000000400000-0x0000000000875000-memory.dmp

Download

memory/7044-5031-0x0000000000F20000-0x0000000000FE1000-memory.dmp

Download

memory/7120-2769-0x0000000000400000-0x000000000048F000-memory.dmp

Download

memory/7120-2766-0x0000000000400000-0x000000000048F000-memory.dmp

Download