f3e0baecbf63c940c2dc926ff25093a4ddf4f3ab5c62314f1a71676dff4bc27c

Resubmissions

04/08/2026, 15:13

260804-slz9ys1scx8

08/07/2026, 21:30

10/05/2026, 14:48

10/05/2026, 14:43

09/05/2026, 10:00

09/05/2026, 09:52

Analysis

user interaction
yes
max time kernel
347s
max time network
350s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
09/05/2026, 10:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Potassium.exe
Size 74.9MB
Sample260509-l14glaev8x
SHA256 f3e0baecbf63c940c2dc926ff25093a4ddf4f3ab5c62314f1a71676dff4bc27c
MD5 db0f4570ebd5dcfbd3b97ff02bfe5707
SHA1 f3e9db1b2de22c7cdc2cd060bc54a410314090b1
SHA512 7eeb08732cbb91d8ad25c2215fe106cf433963ac5a15b06927ec683f2c60d92ecc528a4cef286293454cd750ce0ff66420af2b661be58165420224a5ffa3d5c0
SSDEEP 196608:p9dnSC5zSxrIHs2XTWMrdMmz89dnSC5ZudFcc+/m4hvm5:p9dnSC5zSxcHs2aMZg9dnSC5Zg+/TRu
TLSH
T1700818F9936023BCDC4957BFB96138B4B60F747A37E5CD94C22E4E92581789ECA09843
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery persistence ransomware trojan

Malware Config

Signatures

Downloads MZ/PE file 2 IoCs

flow	pid	Process
86	892	msedge.exe
125	1384	msedge.exe

Executes dropped EXE 13 IoCs

pid	Process
3412	aspnetcore-runtime-8.0.26-win-x64.exe
916	aspnetcore-runtime-8.0.26-win-x64.exe
4848	AspNetCoreSharedFrameworkBundle-x64.exe
912	AspNetCoreSharedFrameworkBundle-x64.exe
4776	AspNetCoreSharedFrameworkBundle-x64.exe
4624	AspNetCoreSharedFrameworkBundle-x64.exe
2744	windowsdesktop-runtime-8.0.26-win-x64.exe
2760	windowsdesktop-runtime-8.0.26-win-x64.exe
2840	windowsdesktop-runtime-8.0.26-win-x64.exe
2364	windowsdesktop-runtime-8.0.26-win-x64.exe
4416	windowsdesktop-runtime-8.0.26-win-x64.exe
4424	windowsdesktop-runtime-8.0.26-win-x64.exe
836	windowsdesktop-runtime-8.0.26-win-x64.exe

Loads dropped DLL 64 IoCs

pid	Process
916	aspnetcore-runtime-8.0.26-win-x64.exe
4592	MsiExec.exe
4624	AspNetCoreSharedFrameworkBundle-x64.exe
2760	windowsdesktop-runtime-8.0.26-win-x64.exe
2924	MsiExec.exe
2924	MsiExec.exe
1304	MsiExec.exe
1304	MsiExec.exe
2648	MsiExec.exe
2648	MsiExec.exe
2648	MsiExec.exe
2648	MsiExec.exe
3004	MsiExec.exe
4424	windowsdesktop-runtime-8.0.26-win-x64.exe
3004	MsiExec.exe
2540	windowsdesktop-runtime-8.0.15-win-x64.exe
4060	MsiExec.exe
4060	MsiExec.exe
1992	windowsdesktop-runtime-8.0.15-win-x64.exe
5144	MsiExec.exe
5144	MsiExec.exe
5644	MsiExec.exe
5644	MsiExec.exe
5760	MsiExec.exe
5760	MsiExec.exe
5584	Potassium.exe
5584	Potassium.exe
5584	Potassium.exe
5584	Potassium.exe
5584	Potassium.exe
5584	Potassium.exe
5584	Potassium.exe
5584	Potassium.exe
5584	Potassium.exe
5584	Potassium.exe
5584	Potassium.exe
5584	Potassium.exe
5584	Potassium.exe
5584	Potassium.exe
5584	Potassium.exe
5584	Potassium.exe
5584	Potassium.exe
5584	Potassium.exe
5584	Potassium.exe
5584	Potassium.exe
5584	Potassium.exe
5584	Potassium.exe
5584	Potassium.exe
5584	Potassium.exe
5584	Potassium.exe
5584	Potassium.exe
5584	Potassium.exe
5584	Potassium.exe
5584	Potassium.exe
5584	Potassium.exe
5584	Potassium.exe
5584	Potassium.exe
5584	Potassium.exe
5584	Potassium.exe
5584	Potassium.exe
5584	Potassium.exe
5584	Potassium.exe
5584	Potassium.exe
5584	Potassium.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{f600cee9-4c2d-456b-b0d0-46283c87fbc5} = "\"C:\\ProgramData\\Package Cache\\{f600cee9-4c2d-456b-b0d0-46283c87fbc5}\\AspNetCoreSharedFrameworkBundle-x64.exe\" /burn.runonce"	AspNetCoreSharedFrameworkBundle-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{ccb8cf0e-e9c7-4fea-add7-d5cdde656e5b} = "\"C:\\ProgramData\\Package Cache\\{ccb8cf0e-e9c7-4fea-add7-d5cdde656e5b}\\windowsdesktop-runtime-8.0.26-win-x64.exe\" /burn.runonce"	windowsdesktop-runtime-8.0.26-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{ccb8cf0e-e9c7-4fea-add7-d5cdde656e5b} = "\"C:\\ProgramData\\Package Cache\\{ccb8cf0e-e9c7-4fea-add7-d5cdde656e5b}\\windowsdesktop-runtime-8.0.26-win-x64.exe\" /burn.runonce"	windowsdesktop-runtime-8.0.26-win-x64.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 2 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Potassium.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Potassium.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App\8.0.26\Microsoft.Extensions.Configuration.Ini.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.26\System.Reflection.DispatchProxy.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.26\System.Security.Permissions.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\pt-BR\PresentationUI.resources.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\pt-BR\System.Windows.Input.Manipulations.resources.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Diagnostics.Tracing.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.26\mscorrc.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.26\zh-Hant\PresentationUI.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.26\System.Runtime.Serialization.Json.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.26\de\System.Windows.Controls.Ribbon.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.26\tr\UIAutomationClientSideProviders.resources.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.IO.FileSystem.AccessControl.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.26\System.Runtime.InteropServices.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.26\System.Runtime.InteropServices.JavaScript.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.26\PresentationFramework-SystemDrawing.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\System.CodeDom.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\de\PresentationUI.resources.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\it\ReachFramework.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.26\createdump.exe	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.26\System.Buffers.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.26\zh-Hans\System.Xaml.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.26\UIAutomationTypes.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Text.Encodings.Web.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App\8.0.26\Microsoft.AspNetCore.Components.Server.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App\8.0.26\Microsoft.AspNetCore.Authentication.OAuth.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.26\mscordaccore.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.26\System.Net.Requests.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.26\System.IO.FileSystem.AccessControl.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.26\zh-Hans\System.Windows.Controls.Ribbon.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.26\de\UIAutomationClientSideProviders.resources.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ko\PresentationCore.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App\8.0.26\Microsoft.AspNetCore.Http.Abstractions.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.26\System.Collections.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.26\ru\System.Windows.Forms.Design.resources.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\PresentationFramework.Aero2.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\fr\UIAutomationProvider.resources.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ko\UIAutomationClientSideProviders.resources.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Private.CoreLib.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Security.Cryptography.X509Certificates.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App\8.0.26\Microsoft.AspNetCore.Mvc.ApiExplorer.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App\8.0.26\Microsoft.AspNetCore.Mvc.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\cs\ReachFramework.resources.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\es\WindowsBase.resources.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Security.Cryptography.Cng.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App\8.0.26\Microsoft.Extensions.Diagnostics.HealthChecks.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.26\ru\ReachFramework.resources.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\it\System.Windows.Forms.Primitives.resources.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Threading.Tasks.Extensions.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App\8.0.26\Microsoft.AspNetCore.Mvc.TagHelpers.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.26\cs\System.Windows.Forms.Primitives.resources.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\cs\System.Windows.Forms.Design.resources.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Linq.Queryable.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ja\System.Windows.Forms.Design.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App\8.0.26\Microsoft.AspNetCore.Antiforgery.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.26\pt-BR\WindowsFormsIntegration.resources.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\cs\UIAutomationTypes.resources.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ru\PresentationFramework.resources.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\zh-Hant\ReachFramework.resources.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Net.Security.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Security.SecureString.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.26\PresentationNative_cor3.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.26\it\Microsoft.VisualBasic.Forms.resources.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\System.Windows.Extensions.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\pt-BR\WindowsBase.resources.dll	msiexec.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5136_557429190\classification.js	msedge.exe
File opened for modification	C:\Windows\Installer\e588aa1.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE3E3.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF08CD2CBA8C133785.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF696.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6B.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{C971FC9E-5291-4C07-8E2F-96BDCBF217E2}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICCC9.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e588a9c.msi	msiexec.exe
File created	C:\Windows\Installer\e588aa1.msi	msiexec.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5136_643046025\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5136_339699168\sets.json	msedge.exe
File created	C:\Windows\SystemTemp\~DFE0568F5A45BD65AB.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF402.tmp	msiexec.exe
File created	C:\Windows\Installer\e588aa0.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF4A16B59161A21BF3.TMP	msiexec.exe
File created	C:\Windows\Installer\e588aa5.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICBED.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC7E0.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE1C0.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DFD1B61D4CDF0F160E.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\91F309C43C4BC0D4C89C4D445C11FAC1\64.60.31149	msiexec.exe
File created	C:\Windows\Installer\e588aab.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF5FB47C6876C0CCBC.TMP	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\91F309C43C4BC0D4C89C4D445C11FAC1\64.60.31149\fileCoreHostExe	msiexec.exe
File created	C:\Windows\SystemTemp\~DFB14EEF32CAAA8655.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF87D453C1604D8AD0.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5136_557429190\automation.js	msedge.exe
File created	C:\Windows\SystemTemp\~DF95281AD702B7BB77.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5136_557429190\extraction.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5136_557429190\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\~DFACC7775E0DD75304.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF21CAC85A51E03910.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF8CD031DAA0BB3BE4.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8D48.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC6E5.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{CDF2084D-21BE-3505-B0FB-7866136E1ADD}	msiexec.exe
File created	C:\Windows\Installer\SourceHash{BC979F77-77D3-4599-ADFF-12D432BFF8C5}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF55C.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5136_156929188\manifest.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5136_643046025\smart_switch_list.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File created	C:\Windows\SystemTemp\~DF6D7D20BB96076C82.TMP	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBF42.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE0C5.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5136_557429190\travel-facilitated-booking-bing.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5136_557429190\travel-facilitated-booking-kayak.js	msedge.exe
File created	C:\Windows\Installer\e588a97.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e588aa6.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF00B03734AEE66869.TMP	msiexec.exe
File created	C:\Windows\Installer\SourceHash{2D690786-1257-44F3-AB75-7F55B62B42E9}	msiexec.exe
File created	C:\Windows\SystemTemp\~DF6A123CD50D0181F1.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5136_156929188\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\~DF3E739A9C1888F4BD.TMP	msiexec.exe
File created	C:\Windows\Installer\e588ab1.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF5DDCB72BCBE2D7D4.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIDC1E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIDEEE.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF13237412C49C9469.TMP	msiexec.exe
File created	C:\Windows\Installer\e588a9b.msi	msiexec.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 2 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\aspnetcore-runtime-8.0.26-win-x64.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\windowsdesktop-runtime-8.0.26-win-x64.exe:Zone.Identifier	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 28 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AspNetCoreSharedFrameworkBundle-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-8.0.26-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-8.0.15-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-8.0.15-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-8.0.15-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aspnetcore-runtime-8.0.26-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AspNetCoreSharedFrameworkBundle-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AspNetCoreSharedFrameworkBundle-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-8.0.26-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-8.0.26-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-8.0.26-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-8.0.26-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AspNetCoreSharedFrameworkBundle-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-8.0.26-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-8.0.15-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-8.0.15-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aspnetcore-runtime-8.0.26-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-8.0.26-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-8.0.15-win-x64.exe

System Time Discovery 1 TTPs 6 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
892	msedge.exe
3412	aspnetcore-runtime-8.0.26-win-x64.exe
916	aspnetcore-runtime-8.0.26-win-x64.exe
1384	msedge.exe
5496	msedge.exe
5560	chrome.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000d3137aa3aa466ad60000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000d3137aa30000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900d3137aa3000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1ad3137aa3000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1dd3137aa3000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Enumerates system info in registry 2 TTPs 18 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 26 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2F	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\31	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134227945329874360"	msedge.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\29	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2c	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2D	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2d	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2e	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\30	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\30	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2B	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2C	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2A	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2f	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_64.104.50421_x64\Dependents	windowsdesktop-runtime-8.0.26-win-x64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\687096D275213F44BA57F7556BB2249E\Version = "1080607989"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\687096D275213F44BA57F7556BB2249E\SourceList\Media\1 = ";"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_64.60.31149_x64	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D4802FDCEB1250530BBF876631E6A1DD\SourceList\PackageName = "aspnetcore-runtime-8.0.26-servicing.26169.11-win-x64.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E7BE303DDFAB56A45A02AA83F80AFBA9\SourceList\PackageName = "dotnet-runtime-8.0.26-win-x64.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D4802FDCEB1250530BBF876631E6A1DD\Version = "134217754"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_64.104.50433_x64\ = "{BC979F77-77D3-4599-ADFF-12D432BFF8C5}"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\INSTALLER\DEPENDENCIES\WINDOWSDESKTOP_RUNTIME_64.60.31203_X64\DEPENDENTS\{5625BB48-295C-4113-BC92-D6A69B19B04C}	windowsdesktop-runtime-8.0.15-win-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_64.104.50433_x64\Dependents\{ccb8cf0e-e9c7-4fea-add7-d5cdde656e5b}	windowsdesktop-runtime-8.0.26-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{f600cee9-4c2d-456b-b0d0-46283c87fbc5}\Version = "8.0.26.26169"	AspNetCoreSharedFrameworkBundle-x64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6F9CCC11AA771244E9CAABCE639D8671	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\687096D275213F44BA57F7556BB2249E\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{2D690786-1257-44F3-AB75-7F55B62B42E9}v64.104.50421\\"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\91F309C43C4BC0D4C89C4D445C11FAC1\SourceList\Net	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\6F9CCC11AA771244E9CAABCE639D8671	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\572D255F9F75C6C7779EEDE404287670	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\91F309C43C4BC0D4C89C4D445C11FAC1\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\77F979CB3D779954DAFF214D23FB8F5C\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{BC979F77-77D3-4599-ADFF-12D432BFF8C5}v64.104.50433\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D4802FDCEB1250530BBF876631E6A1DD\ProductName = "Microsoft ASP.NET Core 8.0.26 Shared Framework (x64)"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\77F979CB3D779954DAFF214D23FB8F5C\SourceList\Media\1 = ";"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0287A4E04ADF05247BCA7E2A7F4BB346\SourceList\Net	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E9CF179C192570C4E8F269DBBC2F712E\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.AspNetCore.SharedFramework_x64_en_US.UTF-8,v8.0.26-servicing.26169.11	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D4802FDCEB1250530BBF876631E6A1DD	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D4802FDCEB1250530BBF876631E6A1DD\Language = "1033"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{ccb8cf0e-e9c7-4fea-add7-d5cdde656e5b}\Version = "8.0.26.35920"	windowsdesktop-runtime-8.0.26-win-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\BC85C81D418550B72495B28DBE4578FF	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\windowsdesktop_runtime_64.104.50433_x64	windowsdesktop-runtime-8.0.26-win-x64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6F9CCC11AA771244E9CAABCE639D8671\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E7BE303DDFAB56A45A02AA83F80AFBA9	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E7BE303DDFAB56A45A02AA83F80AFBA9\AuthorizedLUAApp = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E9CF179C192570C4E8F269DBBC2F712E\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E9CF179C192570C4E8F269DBBC2F712E\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\687096D275213F44BA57F7556BB2249E\Provider	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\D881F2EC0135A4B72CA89D27FD72F577\687096D275213F44BA57F7556BB2249E	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\687096D275213F44BA57F7556BB2249E\Clients = 3a0000000000	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\91F309C43C4BC0D4C89C4D445C11FAC1\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\E7BE303DDFAB56A45A02AA83F80AFBA9\MainFeature	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_64.104.50421_x64\Dependents\{ccb8cf0e-e9c7-4fea-add7-d5cdde656e5b}	windowsdesktop-runtime-8.0.26-win-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_64.104.50421_x64\Dependents\{ccb8cf0e-e9c7-4fea-add7-d5cdde656e5b}	windowsdesktop-runtime-8.0.26-win-x64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_64.60.31149_x64	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E7BE303DDFAB56A45A02AA83F80AFBA9\Language = "1033"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_64.104.50421_x64	windowsdesktop-runtime-8.0.26-win-x64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\91F309C43C4BC0D4C89C4D445C11FAC1	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\INSTALLER\DEPENDENCIES\{5625BB48-295C-4113-BC92-D6A69B19B04C}\DEPENDENTS\{5625BB48-295C-4113-BC92-D6A69B19B04C}	windowsdesktop-runtime-8.0.15-win-x64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_64.60.31149_x64\Dependents	windowsdesktop-runtime-8.0.15-win-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.AspNetCore.SharedFramework_x64_en_US.UTF-8,v8.0.26-servicing.26169.11\ = "{CDF2084D-21BE-3505-B0FB-7866136E1ADD}"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E7BE303DDFAB56A45A02AA83F80AFBA9\Assignment = "1"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E7BE303DDFAB56A45A02AA83F80AFBA9\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_64.104.50421_x64\Version = "64.104.50421"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\687096D275213F44BA57F7556BB2249E\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\77F979CB3D779954DAFF214D23FB8F5C\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{ccb8cf0e-e9c7-4fea-add7-d5cdde656e5b}\ = "{ccb8cf0e-e9c7-4fea-add7-d5cdde656e5b}"	windowsdesktop-runtime-8.0.26-win-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\E7BE303DDFAB56A45A02AA83F80AFBA9	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_8.0_x64\Version = "64.104.50421"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_64.104.50433_x64\DisplayName = "Microsoft Windows Desktop Runtime - 8.0.26 (x64)"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_8.0_x64\Dependents\{ccb8cf0e-e9c7-4fea-add7-d5cdde656e5b}	windowsdesktop-runtime-8.0.26-win-x64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0287A4E04ADF05247BCA7E2A7F4BB346\SourceList\Media	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\INSTALLER\DEPENDENCIES\DOTNET_RUNTIME_64.60.31149_X64\DEPENDENTS\{5625BB48-295C-4113-BC92-D6A69B19B04C}	windowsdesktop-runtime-8.0.15-win-x64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3119821332-640943685-2562343641-1000\{2B5C0C91-E2D9-4A1B-96B9-7AB8F1145186}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{f600cee9-4c2d-456b-b0d0-46283c87fbc5}\Dependents\{f600cee9-4c2d-456b-b0d0-46283c87fbc5}	AspNetCoreSharedFrameworkBundle-x64.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\aspnetcore-runtime-8.0.26-win-x64.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\windowsdesktop-runtime-8.0.26-win-x64.exe:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 32 IoCs

pid	Process
2024	msiexec.exe
2024	msiexec.exe
2024	msiexec.exe
2024	msiexec.exe
2024	msiexec.exe
2024	msiexec.exe
2024	msiexec.exe
2024	msiexec.exe
2024	msiexec.exe
2024	msiexec.exe
2024	msiexec.exe
2024	msiexec.exe
2024	msiexec.exe
2024	msiexec.exe
2024	msiexec.exe
2024	msiexec.exe
2024	msiexec.exe
2024	msiexec.exe
2024	msiexec.exe
2024	msiexec.exe
5136	msedge.exe
5136	msedge.exe
5584	Potassium.exe
5584	Potassium.exe
5772	msedge.exe
5772	msedge.exe
4712	Potassium.exe
4712	Potassium.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 19 IoCs

pid	Process
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
6092	msedgewebview2.exe
3448	msedgewebview2.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeBackupPrivilege	4028	vssvc.exe
Token: SeRestorePrivilege	4028	vssvc.exe
Token: SeAuditPrivilege	4028	vssvc.exe
Token: SeShutdownPrivilege	4848	AspNetCoreSharedFrameworkBundle-x64.exe
Token: SeIncreaseQuotaPrivilege	4848	AspNetCoreSharedFrameworkBundle-x64.exe
Token: SeSecurityPrivilege	2024	msiexec.exe
Token: SeCreateTokenPrivilege	4848	AspNetCoreSharedFrameworkBundle-x64.exe
Token: SeAssignPrimaryTokenPrivilege	4848	AspNetCoreSharedFrameworkBundle-x64.exe
Token: SeLockMemoryPrivilege	4848	AspNetCoreSharedFrameworkBundle-x64.exe
Token: SeIncreaseQuotaPrivilege	4848	AspNetCoreSharedFrameworkBundle-x64.exe
Token: SeMachineAccountPrivilege	4848	AspNetCoreSharedFrameworkBundle-x64.exe
Token: SeTcbPrivilege	4848	AspNetCoreSharedFrameworkBundle-x64.exe
Token: SeSecurityPrivilege	4848	AspNetCoreSharedFrameworkBundle-x64.exe
Token: SeTakeOwnershipPrivilege	4848	AspNetCoreSharedFrameworkBundle-x64.exe
Token: SeLoadDriverPrivilege	4848	AspNetCoreSharedFrameworkBundle-x64.exe
Token: SeSystemProfilePrivilege	4848	AspNetCoreSharedFrameworkBundle-x64.exe
Token: SeSystemtimePrivilege	4848	AspNetCoreSharedFrameworkBundle-x64.exe
Token: SeProfSingleProcessPrivilege	4848	AspNetCoreSharedFrameworkBundle-x64.exe
Token: SeIncBasePriorityPrivilege	4848	AspNetCoreSharedFrameworkBundle-x64.exe
Token: SeCreatePagefilePrivilege	4848	AspNetCoreSharedFrameworkBundle-x64.exe
Token: SeCreatePermanentPrivilege	4848	AspNetCoreSharedFrameworkBundle-x64.exe
Token: SeBackupPrivilege	4848	AspNetCoreSharedFrameworkBundle-x64.exe
Token: SeRestorePrivilege	4848	AspNetCoreSharedFrameworkBundle-x64.exe
Token: SeShutdownPrivilege	4848	AspNetCoreSharedFrameworkBundle-x64.exe
Token: SeDebugPrivilege	4848	AspNetCoreSharedFrameworkBundle-x64.exe
Token: SeAuditPrivilege	4848	AspNetCoreSharedFrameworkBundle-x64.exe
Token: SeSystemEnvironmentPrivilege	4848	AspNetCoreSharedFrameworkBundle-x64.exe
Token: SeChangeNotifyPrivilege	4848	AspNetCoreSharedFrameworkBundle-x64.exe
Token: SeRemoteShutdownPrivilege	4848	AspNetCoreSharedFrameworkBundle-x64.exe
Token: SeUndockPrivilege	4848	AspNetCoreSharedFrameworkBundle-x64.exe
Token: SeSyncAgentPrivilege	4848	AspNetCoreSharedFrameworkBundle-x64.exe
Token: SeEnableDelegationPrivilege	4848	AspNetCoreSharedFrameworkBundle-x64.exe
Token: SeManageVolumePrivilege	4848	AspNetCoreSharedFrameworkBundle-x64.exe
Token: SeImpersonatePrivilege	4848	AspNetCoreSharedFrameworkBundle-x64.exe
Token: SeCreateGlobalPrivilege	4848	AspNetCoreSharedFrameworkBundle-x64.exe
Token: SeRestorePrivilege	2024	msiexec.exe
Token: SeTakeOwnershipPrivilege	2024	msiexec.exe
Token: SeBackupPrivilege	1696	srtasks.exe
Token: SeRestorePrivilege	1696	srtasks.exe
Token: SeSecurityPrivilege	1696	srtasks.exe
Token: SeTakeOwnershipPrivilege	1696	srtasks.exe
Token: SeRestorePrivilege	2024	msiexec.exe
Token: SeTakeOwnershipPrivilege	2024	msiexec.exe
Token: SeRestorePrivilege	2024	msiexec.exe
Token: SeTakeOwnershipPrivilege	2024	msiexec.exe
Token: SeBackupPrivilege	1696	srtasks.exe
Token: SeRestorePrivilege	1696	srtasks.exe
Token: SeSecurityPrivilege	1696	srtasks.exe
Token: SeTakeOwnershipPrivilege	1696	srtasks.exe
Token: SeRestorePrivilege	2024	msiexec.exe
Token: SeTakeOwnershipPrivilege	2024	msiexec.exe
Token: SeRestorePrivilege	2024	msiexec.exe
Token: SeTakeOwnershipPrivilege	2024	msiexec.exe
Token: SeRestorePrivilege	2024	msiexec.exe
Token: SeTakeOwnershipPrivilege	2024	msiexec.exe
Token: SeRestorePrivilege	2024	msiexec.exe
Token: SeTakeOwnershipPrivilege	2024	msiexec.exe
Token: SeRestorePrivilege	2024	msiexec.exe
Token: SeTakeOwnershipPrivilege	2024	msiexec.exe
Token: SeRestorePrivilege	2024	msiexec.exe
Token: SeTakeOwnershipPrivilege	2024	msiexec.exe
Token: SeRestorePrivilege	2024	msiexec.exe
Token: SeTakeOwnershipPrivilege	2024	msiexec.exe
Token: SeRestorePrivilege	2024	msiexec.exe

Suspicious use of FindShellTrayWindow 61 IoCs

pid	Process
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
916	aspnetcore-runtime-8.0.26-win-x64.exe
1924	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2760	windowsdesktop-runtime-8.0.26-win-x64.exe
4424	windowsdesktop-runtime-8.0.26-win-x64.exe
2500	msedge.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe
4312	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3920 wrote to memory of 1924	3920	Potassium.exe	80
PID 1924 wrote to memory of 5008	1924	msedge.exe	81
PID 1924 wrote to memory of 892	1924	msedge.exe	82
PID 1924 wrote to memory of 4196	1924	msedge.exe	83
PID 1924 wrote to memory of 4196	1924	msedge.exe	83
PID 1924 wrote to memory of 4196	1924	msedge.exe	83
PID 1924 wrote to memory of 4844	1924	msedge.exe	84
PID 1924 wrote to memory of 4844	1924	msedge.exe	84
PID 1924 wrote to memory of 656	1924	msedge.exe	86
PID 1924 wrote to memory of 656	1924	msedge.exe	86
PID 1924 wrote to memory of 656	1924	msedge.exe	86
PID 1924 wrote to memory of 3372	1924	msedge.exe	87
PID 1924 wrote to memory of 3372	1924	msedge.exe	87
PID 1924 wrote to memory of 3372	1924	msedge.exe	87
PID 1924 wrote to memory of 3976	1924	msedge.exe	88
PID 1924 wrote to memory of 3888	1924	msedge.exe	89
PID 1924 wrote to memory of 3976	1924	msedge.exe	88
PID 1924 wrote to memory of 3976	1924	msedge.exe	88
PID 1924 wrote to memory of 896	1924	msedge.exe	90
PID 1924 wrote to memory of 4876	1924	msedge.exe	91
PID 1924 wrote to memory of 3888	1924	msedge.exe	89
PID 1924 wrote to memory of 3888	1924	msedge.exe	89
PID 1924 wrote to memory of 896	1924	msedge.exe	90
PID 1924 wrote to memory of 896	1924	msedge.exe	90
PID 1924 wrote to memory of 4876	1924	msedge.exe	91
PID 1924 wrote to memory of 4876	1924	msedge.exe	91
PID 1924 wrote to memory of 1664	1924	msedge.exe	93
PID 1924 wrote to memory of 1664	1924	msedge.exe	93
PID 1924 wrote to memory of 1516	1924	msedge.exe	94
PID 1924 wrote to memory of 1516	1924	msedge.exe	94
PID 1924 wrote to memory of 4496	1924	msedge.exe	95
PID 1924 wrote to memory of 4496	1924	msedge.exe	95
PID 1924 wrote to memory of 4496	1924	msedge.exe	95
PID 1924 wrote to memory of 484	1924	msedge.exe	97
PID 1924 wrote to memory of 484	1924	msedge.exe	97
PID 1924 wrote to memory of 4156	1924	msedge.exe	98
PID 1924 wrote to memory of 4156	1924	msedge.exe	98
PID 1924 wrote to memory of 3356	1924	msedge.exe	100
PID 1924 wrote to memory of 2428	1924	msedge.exe	101
PID 2428 wrote to memory of 2480	2428	msedge.exe	102
PID 1924 wrote to memory of 1672	1924	msedge.exe	103
PID 1924 wrote to memory of 1672	1924	msedge.exe	103
PID 1924 wrote to memory of 2476	1924	msedge.exe	104
PID 1924 wrote to memory of 2476	1924	msedge.exe	104
PID 1924 wrote to memory of 4860	1924	msedge.exe	105
PID 1924 wrote to memory of 4312	1924	msedge.exe	106
PID 1924 wrote to memory of 4860	1924	msedge.exe	105
PID 1924 wrote to memory of 4312	1924	msedge.exe	106
PID 1924 wrote to memory of 4520	1924	msedge.exe	107
PID 1924 wrote to memory of 4520	1924	msedge.exe	107
PID 1924 wrote to memory of 1116	1924	msedge.exe	108
PID 1924 wrote to memory of 1116	1924	msedge.exe	108
PID 1924 wrote to memory of 2624	1924	msedge.exe	109
PID 1924 wrote to memory of 2624	1924	msedge.exe	109
PID 1924 wrote to memory of 2624	1924	msedge.exe	109
PID 1924 wrote to memory of 3664	1924	msedge.exe	110
PID 1924 wrote to memory of 3412	1924	msedge.exe	111
PID 3412 wrote to memory of 916	3412	aspnetcore-runtime-8.0.26-win-x64.exe	112
PID 916 wrote to memory of 4848	916	aspnetcore-runtime-8.0.26-win-x64.exe	113
PID 912 wrote to memory of 4776	912	AspNetCoreSharedFrameworkBundle-x64.exe	123
PID 4776 wrote to memory of 4624	4776	AspNetCoreSharedFrameworkBundle-x64.exe	124
PID 2024 wrote to memory of 4592	2024	msiexec.exe	125
PID 3884 wrote to memory of 2500	3884	Potassium.exe	129
PID 2500 wrote to memory of 2396	2500	msedge.exe	130

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\Potassium.exe
"C:\Users\Admin\AppData\Local\Temp\Potassium.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://aka.ms/dotnet-core-applaunch?framework=Microsoft.AspNetCore.App&framework_version=8.0.0&arch=x64&rid=win-x64&os=win10&gui=true
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1924
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e8,0x2ec,0x2f0,0x2e4,0x2f8,0x7ff8ec45c188,0x7ff8ec45c194,0x7ff8ec45c1a0
    3⤵
    PID:5008
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1828,i,5376424743474888279,3216255819890833277,524288 --field-trial-handle=2080,i,10031011803211046601,7373066902125565413,262144 --variations-seed-version --mojo-platform-channel-handle=2124 /prefetch:11
    3⤵
    - Downloads MZ/PE file
    - System Time Discovery
    PID:892
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1580,i,13603923962152813540,15781825333378813743,262144 --field-trial-handle=2080,i,10031011803211046601,7373066902125565413,262144 --variations-seed-version --mojo-platform-channel-handle=2076 /prefetch:2
    3⤵
    PID:4196
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2504,i,5964173454802343023,9281813937436625421,524288 --field-trial-handle=2080,i,10031011803211046601,7373066902125565413,262144 --variations-seed-version --mojo-platform-channel-handle=1760 /prefetch:13
    3⤵
    PID:4844
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3444,i,17175606730241952423,16206907901166310011,2097152 --field-trial-handle=2080,i,10031011803211046601,7373066902125565413,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
    3⤵
    PID:656
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3448,i,10509163755683667460,11835662253974777023,2097152 --field-trial-handle=2080,i,10031011803211046601,7373066902125565413,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
    3⤵
    PID:3372
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4084,i,3711891192478407050,13144548275361241729,2097152 --field-trial-handle=2080,i,10031011803211046601,7373066902125565413,262144 --variations-seed-version --mojo-platform-channel-handle=4140 /prefetch:1
    3⤵
    PID:3976
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4172,i,1879563975262314813,14339948854628984770,2097152 --field-trial-handle=2080,i,10031011803211046601,7373066902125565413,262144 --variations-seed-version --mojo-platform-channel-handle=3428 /prefetch:9
    3⤵
    PID:3888
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4216,i,2514941414583934879,15488068521288975316,2097152 --field-trial-handle=2080,i,10031011803211046601,7373066902125565413,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:1
    3⤵
    PID:896
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4264,i,3657394344909273802,16335076501105794164,2097152 --field-trial-handle=2080,i,10031011803211046601,7373066902125565413,262144 --variations-seed-version --mojo-platform-channel-handle=4448 /prefetch:9
    3⤵
    PID:4876
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3608,i,14846476713797052121,6386251639001249258,524288 --field-trial-handle=2080,i,10031011803211046601,7373066902125565413,262144 --variations-seed-version --mojo-platform-channel-handle=4408 /prefetch:14
    3⤵
    PID:1664
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5204,i,16115418413618199732,7997907264843692680,524288 --field-trial-handle=2080,i,10031011803211046601,7373066902125565413,262144 --variations-seed-version --mojo-platform-channel-handle=5332 /prefetch:14
    3⤵
    PID:1516
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=5492,i,9210374226658878709,11550228768670413477,2097152 --field-trial-handle=2080,i,10031011803211046601,7373066902125565413,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:1
    3⤵
    PID:4496
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3516,i,5477920442916858690,5310352466243255551,524288 --field-trial-handle=2080,i,10031011803211046601,7373066902125565413,262144 --variations-seed-version --mojo-platform-channel-handle=3712 /prefetch:14
    3⤵
    PID:484
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3576,i,18044125810329831640,2069453371263447005,524288 --field-trial-handle=2080,i,10031011803211046601,7373066902125565413,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:14
    3⤵
    PID:4156
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6036,i,7629004370761200971,15505644297179260004,524288 --field-trial-handle=2080,i,10031011803211046601,7373066902125565413,262144 --variations-seed-version --mojo-platform-channel-handle=6052 /prefetch:14
    3⤵
    PID:2788
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6036,i,7629004370761200971,15505644297179260004,524288 --field-trial-handle=2080,i,10031011803211046601,7373066902125565413,262144 --variations-seed-version --mojo-platform-channel-handle=6052 /prefetch:14
    3⤵
    PID:3356
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6188,i,16145397306297098635,12301945244889076794,524288 --field-trial-handle=2080,i,10031011803211046601,7373066902125565413,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:14
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2428
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
      cookie_exporter.exe --cookie-json=1144
      4⤵
      PID:2480
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6368,i,8158311203982661979,3163448212833965002,524288 --field-trial-handle=2080,i,10031011803211046601,7373066902125565413,262144 --variations-seed-version --mojo-platform-channel-handle=6400 /prefetch:14
    3⤵
    PID:1672
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6224,i,13987495242383687598,17209395704014924231,524288 --field-trial-handle=2080,i,10031011803211046601,7373066902125565413,262144 --variations-seed-version --mojo-platform-channel-handle=6536 /prefetch:14
    3⤵
    PID:2476
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6588,i,171133942205915370,645763280944432022,524288 --field-trial-handle=2080,i,10031011803211046601,7373066902125565413,262144 --variations-seed-version --mojo-platform-channel-handle=6520 /prefetch:14
    3⤵
    PID:4860
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6676,i,1659779348058713329,16609055042330394123,524288 --field-trial-handle=2080,i,10031011803211046601,7373066902125565413,262144 --variations-seed-version --mojo-platform-channel-handle=6440 /prefetch:14
    3⤵
    PID:4312
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6652,i,13190949371429492540,9813126949231612592,524288 --field-trial-handle=2080,i,10031011803211046601,7373066902125565413,262144 --variations-seed-version --mojo-platform-channel-handle=6512 /prefetch:14
    3⤵
    PID:4520
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7084,i,741703867062234720,17217028286341225243,524288 --field-trial-handle=2080,i,10031011803211046601,7373066902125565413,262144 --variations-seed-version --mojo-platform-channel-handle=7096 /prefetch:14
    3⤵
    PID:1116
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=7024,i,5512832187700625957,5503984164056369480,2097152 --field-trial-handle=2080,i,10031011803211046601,7373066902125565413,262144 --variations-seed-version --mojo-platform-channel-handle=7116 /prefetch:1
    3⤵
    PID:2624
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7176,i,14122402781228469106,882385865247191187,524288 --field-trial-handle=2080,i,10031011803211046601,7373066902125565413,262144 --variations-seed-version --mojo-platform-channel-handle=6760 /prefetch:14
    3⤵
    - Subvert Trust Controls: Mark-of-the-Web Bypass
    - NTFS ADS
    PID:3664
- - C:\Users\Admin\Downloads\aspnetcore-runtime-8.0.26-win-x64.exe
    "C:\Users\Admin\Downloads\aspnetcore-runtime-8.0.26-win-x64.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - System Time Discovery
    - Suspicious use of WriteProcessMemory
    PID:3412
  - - C:\Windows\Temp\{FF66EE6C-8C3E-4253-99ED-A4DD21E85EB9}\.cr\aspnetcore-runtime-8.0.26-win-x64.exe
      "C:\Windows\Temp\{FF66EE6C-8C3E-4253-99ED-A4DD21E85EB9}\.cr\aspnetcore-runtime-8.0.26-win-x64.exe" -burn.clean.room="C:\Users\Admin\Downloads\aspnetcore-runtime-8.0.26-win-x64.exe" -burn.filehandle.attached=724 -burn.filehandle.self=728
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      System Time Discovery
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:916
    - - C:\Windows\Temp\{12896CB5-4BA0-4954-9667-4574B17EA72A}\.be\AspNetCoreSharedFrameworkBundle-x64.exe
        
        "C:\Windows\Temp\{12896CB5-4BA0-4954-9667-4574B17EA72A}\.be\AspNetCoreSharedFrameworkBundle-x64.exe" -q -burn.elevated BurnPipe.{A62676F0-1411-4842-89E0-6024B4156D4E} {DD831734-8315-4D29-85E2-81B4EDCA1C59} 916
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:4848

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2316

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4028

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1696

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2024
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 73F9903E28E2B0B8E1566A76FA6D741E
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4592
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding E71BF913DA8E77C254F956C907330BC4
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2924
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 6D2C35F8E29A661A87D9F3EC3FFDA95D
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1304
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 659AD36FBBB156A8AE4156311DEE89EF
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2648
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding DB9E6E033D311ECBF4C628DE41B822EE
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:3004
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 8FCDE516259E0BE6E166D56A15F46388
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4060
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 97F310840E2832FE9AC10A3E60C31132
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:5144
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding A7A124B0E8E6B21DBFD3E2EA5F8BF580
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:5644
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 8C7932CA878931448D4A80D5FC2D38A1
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:5760

C:\ProgramData\Package Cache\{f600cee9-4c2d-456b-b0d0-46283c87fbc5}\AspNetCoreSharedFrameworkBundle-x64.exe
"C:\ProgramData\Package Cache\{f600cee9-4c2d-456b-b0d0-46283c87fbc5}\AspNetCoreSharedFrameworkBundle-x64.exe" /burn.runonce
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:912
- C:\ProgramData\Package Cache\{f600cee9-4c2d-456b-b0d0-46283c87fbc5}\AspNetCoreSharedFrameworkBundle-x64.exe
  "C:\ProgramData\Package Cache\{f600cee9-4c2d-456b-b0d0-46283c87fbc5}\AspNetCoreSharedFrameworkBundle-x64.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_dd_AspNetCoreSharedFramework___20260509110225.log"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4776
- - C:\ProgramData\Package Cache\{f600cee9-4c2d-456b-b0d0-46283c87fbc5}\AspNetCoreSharedFrameworkBundle-x64.exe
    "C:\ProgramData\Package Cache\{f600cee9-4c2d-456b-b0d0-46283c87fbc5}\AspNetCoreSharedFrameworkBundle-x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{f600cee9-4c2d-456b-b0d0-46283c87fbc5}\AspNetCoreSharedFrameworkBundle-x64.exe" -burn.filehandle.attached=552 -burn.filehandle.self=568 /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_dd_AspNetCoreSharedFramework___20260509110225.log"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:4624

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3372

C:\Users\Admin\AppData\Local\Temp\Potassium.exe
"C:\Users\Admin\AppData\Local\Temp\Potassium.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://aka.ms/dotnet-core-applaunch?framework=Microsoft.NETCore.App&framework_version=8.0.26&arch=x64&rid=win-x64&os=win10&gui=true
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2500
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e8,0x2ec,0x2f0,0x2e4,0x2dc,0x7ff8ec45c188,0x7ff8ec45c194,0x7ff8ec45c1a0
    3⤵
    PID:2396
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1816,i,3968795442664251110,4781667397057969624,524288 --field-trial-handle=2180,i,10783762499896100284,5863214964173463915,262144 --variations-seed-version --mojo-platform-channel-handle=2232 /prefetch:11
    3⤵
    - Downloads MZ/PE file
    - System Time Discovery
    PID:1384
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1612,i,9948272446745589611,8507419470831265481,262144 --field-trial-handle=2180,i,10783762499896100284,5863214964173463915,262144 --variations-seed-version --mojo-platform-channel-handle=2176 /prefetch:2
    3⤵
    PID:3380
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2480,i,7506156102898595825,16614963385992417654,524288 --field-trial-handle=2180,i,10783762499896100284,5863214964173463915,262144 --variations-seed-version --mojo-platform-channel-handle=2576 /prefetch:13
    3⤵
    PID:3228
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3480,i,4461000091170646278,9418319795452019485,2097152 --field-trial-handle=2180,i,10783762499896100284,5863214964173463915,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
    3⤵
    PID:4768
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3516,i,12786242545886566797,12047705044880175871,2097152 --field-trial-handle=2180,i,10783762499896100284,5863214964173463915,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
    3⤵
    PID:4456
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4860,i,18058621561470232420,3948512762722762503,2097152 --field-trial-handle=2180,i,10783762499896100284,5863214964173463915,262144 --variations-seed-version --mojo-platform-channel-handle=4864 /prefetch:1
    3⤵
    PID:416
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3732,i,14534812953473566110,12631269978502224304,524288 --field-trial-handle=2180,i,10783762499896100284,5863214964173463915,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:14
    3⤵
    PID:3532
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4536,i,8231861193549371958,15565949780869712798,2097152 --field-trial-handle=2180,i,10783762499896100284,5863214964173463915,262144 --variations-seed-version --mojo-platform-channel-handle=5072 /prefetch:1
    3⤵
    PID:4292
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5372,i,11790636000253610023,6979159050049094812,524288 --field-trial-handle=2180,i,10783762499896100284,5863214964173463915,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:14
    3⤵
    PID:2568
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5412,i,8766924357056834170,16394021112205165137,524288 --field-trial-handle=2180,i,10783762499896100284,5863214964173463915,262144 --variations-seed-version --mojo-platform-channel-handle=5480 /prefetch:14
    3⤵
    PID:2164
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6260,i,8050786219822700327,5853914310289778901,524288 --field-trial-handle=2180,i,10783762499896100284,5863214964173463915,262144 --variations-seed-version --mojo-platform-channel-handle=6376 /prefetch:14
    3⤵
    PID:3972
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6240,i,2464949920152131596,10315987437366316929,524288 --field-trial-handle=2180,i,10783762499896100284,5863214964173463915,262144 --variations-seed-version --mojo-platform-channel-handle=6600 /prefetch:14
    3⤵
    PID:576
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3760,i,1210281201739590327,7186198978152173193,524288 --field-trial-handle=2180,i,10783762499896100284,5863214964173463915,262144 --variations-seed-version --mojo-platform-channel-handle=6632 /prefetch:14
    3⤵
    - Subvert Trust Controls: Mark-of-the-Web Bypass
    - NTFS ADS
    PID:4964
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6240,i,2464949920152131596,10315987437366316929,524288 --field-trial-handle=2180,i,10783762499896100284,5863214964173463915,262144 --variations-seed-version --mojo-platform-channel-handle=6600 /prefetch:14
    3⤵
    PID:3084
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6780,i,13539880784350662853,4847268769580112138,2097152 --field-trial-handle=2180,i,10783762499896100284,5863214964173463915,262144 --variations-seed-version --mojo-platform-channel-handle=4932 /prefetch:1
    3⤵
    PID:980
- - C:\Users\Admin\Downloads\windowsdesktop-runtime-8.0.26-win-x64.exe
    "C:\Users\Admin\Downloads\windowsdesktop-runtime-8.0.26-win-x64.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2744
  - - C:\Windows\Temp\{CA77E463-80E5-4436-9F6F-36FC4C8EE064}\.cr\windowsdesktop-runtime-8.0.26-win-x64.exe
      "C:\Windows\Temp\{CA77E463-80E5-4436-9F6F-36FC4C8EE064}\.cr\windowsdesktop-runtime-8.0.26-win-x64.exe" -burn.clean.room="C:\Users\Admin\Downloads\windowsdesktop-runtime-8.0.26-win-x64.exe" -burn.filehandle.attached=724 -burn.filehandle.self=728
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of FindShellTrayWindow
      PID:2760
    - - C:\Windows\Temp\{8D6C2C87-9DAF-4161-91D0-1A9AC4B5CA25}\.be\windowsdesktop-runtime-8.0.26-win-x64.exe
        
        "C:\Windows\Temp\{8D6C2C87-9DAF-4161-91D0-1A9AC4B5CA25}\.be\windowsdesktop-runtime-8.0.26-win-x64.exe" -q -burn.elevated BurnPipe.{47EA6DDA-2344-4229-99A8-62BADFD94E0D} {88B2EE65-0A68-4DF0-9984-CA2675913E73} 2760
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2840
      - C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
        
        "C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={ccb8cf0e-e9c7-4fea-add7-d5cdde656e5b} -burn.filehandle.self=908 -burn.embedded BurnPipe.{A6E958E7-2432-4C47-AAA3-1FBE7FB3F573} {D7ED21CF-4B13-4319-B621-D63F3E8DFF0A} 2840
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2648
        
        C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
        
        "C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe" -burn.filehandle.attached=548 -burn.filehandle.self=564 -uninstall -quiet -burn.related.upgrade -burn.ancestors={ccb8cf0e-e9c7-4fea-add7-d5cdde656e5b} -burn.filehandle.self=908 -burn.embedded BurnPipe.{A6E958E7-2432-4C47-AAA3-1FBE7FB3F573} {D7ED21CF-4B13-4319-B621-D63F3E8DFF0A} 2840
        7⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:2540
        
        C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
        
        "C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe" -q -burn.elevated BurnPipe.{49042D8E-E257-4682-B7EA-D6FE7465BA05} {06A0F40C-5DD2-422B-9BFF-6E37F4C67E87} 2540
        8⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3692
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6692,i,12367048431552802319,12889437539802282553,524288 --field-trial-handle=2180,i,10783762499896100284,5863214964173463915,262144 --variations-seed-version --mojo-platform-channel-handle=6684 /prefetch:14
    3⤵
    PID:5436
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6464,i,16355669333179016261,8360300620176842658,524288 --field-trial-handle=2180,i,10783762499896100284,5863214964173463915,262144 --variations-seed-version --mojo-platform-channel-handle=6468 /prefetch:14
    3⤵
    PID:5444
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6700,i,6136978072165339856,7884897872820714271,524288 --field-trial-handle=2180,i,10783762499896100284,5863214964173463915,262144 --variations-seed-version --mojo-platform-channel-handle=7344 /prefetch:14
    3⤵
    PID:5452
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    PID:5136
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x214,0x260,0x7ff8ec45c188,0x7ff8ec45c194,0x7ff8ec45c1a0
      4⤵
      PID:5200
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1732,i,8857456539791588860,3719072726478939432,524288 --field-trial-handle=2528,i,10540149735701386116,15267262437150706083,262144 --variations-seed-version --mojo-platform-channel-handle=2564 /prefetch:11
      4⤵
      System Time Discovery
      PID:5496
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2104,i,11854459142546425372,12794322900476520007,524288 --field-trial-handle=2528,i,10540149735701386116,15267262437150706083,262144 --variations-seed-version --mojo-platform-channel-handle=2596 /prefetch:13
      4⤵
      PID:5568
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1552,i,6433215870530754638,5823959838391439154,262144 --field-trial-handle=2528,i,10540149735701386116,15267262437150706083,262144 --variations-seed-version --mojo-platform-channel-handle=2520 /prefetch:2
      4⤵
      PID:5488
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4484,i,9030183125677743282,16504566090543311213,524288 --field-trial-handle=2528,i,10540149735701386116,15267262437150706083,262144 --variations-seed-version --mojo-platform-channel-handle=4500 /prefetch:14
      4⤵
      PID:6008
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4484,i,9030183125677743282,16504566090543311213,524288 --field-trial-handle=2528,i,10540149735701386116,15267262437150706083,262144 --variations-seed-version --mojo-platform-channel-handle=4500 /prefetch:14
      4⤵
      PID:6000
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4496,i,1195335069289336326,2714914573040405729,524288 --field-trial-handle=2528,i,10540149735701386116,15267262437150706083,262144 --variations-seed-version --mojo-platform-channel-handle=4552 /prefetch:14
      4⤵
      PID:9036
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4512,i,3033205439855653015,13914754066301006322,524288 --field-trial-handle=2528,i,10540149735701386116,15267262437150706083,262144 --variations-seed-version --mojo-platform-channel-handle=4544 /prefetch:14
      4⤵
      PID:9048
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4484,i,5958121195847848172,7269920890679157800,524288 --field-trial-handle=2528,i,10540149735701386116,15267262437150706083,262144 --variations-seed-version --mojo-platform-channel-handle=4548 /prefetch:14
      4⤵
      PID:9056
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4576,i,3497731092196945783,4885212715254083125,524288 --field-trial-handle=2528,i,10540149735701386116,15267262437150706083,262144 --variations-seed-version --mojo-platform-channel-handle=4868 /prefetch:14
      4⤵
      PID:4644
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4336,i,1230130807170827568,16560409520187500874,524288 --field-trial-handle=2528,i,10540149735701386116,15267262437150706083,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:14
      4⤵
      PID:1440
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5088,i,9800997250002200156,17556160658377177364,524288 --field-trial-handle=2528,i,10540149735701386116,15267262437150706083,262144 --variations-seed-version --mojo-platform-channel-handle=756 /prefetch:14
      4⤵
      PID:6648
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5108,i,7629650109097328879,490908002200946807,262144 --field-trial-handle=2528,i,10540149735701386116,15267262437150706083,262144 --variations-seed-version --mojo-platform-channel-handle=5092 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5772
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5076,i,1621169877212203053,1899924683438564088,524288 --field-trial-handle=2528,i,10540149735701386116,15267262437150706083,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:14
      4⤵
      PID:8572
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3872,i,3686623642523290748,8122022765209829362,524288 --field-trial-handle=2528,i,10540149735701386116,15267262437150706083,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:14
      4⤵
      PID:2792
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3876,i,8716124307534458024,4568389577222045624,524288 --field-trial-handle=2528,i,10540149735701386116,15267262437150706083,262144 --variations-seed-version --mojo-platform-channel-handle=4136 /prefetch:14
      4⤵
      PID:6508
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5080,i,13961415123435638487,14888208187590731295,524288 --field-trial-handle=2528,i,10540149735701386116,15267262437150706083,262144 --variations-seed-version --mojo-platform-channel-handle=3696 /prefetch:14
      4⤵
      PID:7012
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5372,i,466392919446100309,14320648895148012253,524288 --field-trial-handle=2528,i,10540149735701386116,15267262437150706083,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:14
      4⤵
      PID:7560
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5040,i,3736573091303547225,12766407835825383775,524288 --field-trial-handle=2528,i,10540149735701386116,15267262437150706083,262144 --variations-seed-version --mojo-platform-channel-handle=5500 /prefetch:14
      4⤵
      PID:6224

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1084

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4520

C:\ProgramData\Package Cache\{ccb8cf0e-e9c7-4fea-add7-d5cdde656e5b}\windowsdesktop-runtime-8.0.26-win-x64.exe
"C:\ProgramData\Package Cache\{ccb8cf0e-e9c7-4fea-add7-d5cdde656e5b}\windowsdesktop-runtime-8.0.26-win-x64.exe" /burn.runonce
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2364
- C:\ProgramData\Package Cache\{ccb8cf0e-e9c7-4fea-add7-d5cdde656e5b}\windowsdesktop-runtime-8.0.26-win-x64.exe
  "C:\ProgramData\Package Cache\{ccb8cf0e-e9c7-4fea-add7-d5cdde656e5b}\windowsdesktop-runtime-8.0.26-win-x64.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_8.0.26_(x64)_20260509110352.log"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4416
- - C:\ProgramData\Package Cache\{ccb8cf0e-e9c7-4fea-add7-d5cdde656e5b}\windowsdesktop-runtime-8.0.26-win-x64.exe
    "C:\ProgramData\Package Cache\{ccb8cf0e-e9c7-4fea-add7-d5cdde656e5b}\windowsdesktop-runtime-8.0.26-win-x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{ccb8cf0e-e9c7-4fea-add7-d5cdde656e5b}\windowsdesktop-runtime-8.0.26-win-x64.exe" -burn.filehandle.attached=548 -burn.filehandle.self=564 /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_8.0.26_(x64)_20260509110352.log"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    PID:4424
  - - C:\ProgramData\Package Cache\{ccb8cf0e-e9c7-4fea-add7-d5cdde656e5b}\windowsdesktop-runtime-8.0.26-win-x64.exe
      "C:\ProgramData\Package Cache\{ccb8cf0e-e9c7-4fea-add7-d5cdde656e5b}\windowsdesktop-runtime-8.0.26-win-x64.exe" -q -burn.elevated BurnPipe.{D92A18BB-EF8C-4239-8E5A-2498E81DD9AC} {11635ADA-716D-450E-AB65-5EFCFEED685C} 4424
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Modifies registry class
      PID:836
    - - C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
        
        "C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={ccb8cf0e-e9c7-4fea-add7-d5cdde656e5b} -burn.filehandle.self=876 -burn.embedded BurnPipe.{370A3ED6-72DA-44D2-9DEE-8DE20D9EE22E} {7D193DB7-75E3-4E76-8EAF-75C7551828F0} 836
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:424
      - C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
        
        "C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe" -burn.filehandle.attached=548 -burn.filehandle.self=564 -uninstall -quiet -burn.related.upgrade -burn.ancestors={ccb8cf0e-e9c7-4fea-add7-d5cdde656e5b} -burn.filehandle.self=876 -burn.embedded BurnPipe.{370A3ED6-72DA-44D2-9DEE-8DE20D9EE22E} {7D193DB7-75E3-4E76-8EAF-75C7551828F0} 836
        6⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:1992
        
        C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
        
        "C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe" -q -burn.elevated BurnPipe.{30545383-E3BB-4C52-BE02-E98064871288} {51130986-D937-49C7-845C-9A9A1EC7FF1E} 1992
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5356

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2484

C:\Users\Admin\AppData\Local\Temp\Potassium.exe
"C:\Users\Admin\AppData\Local\Temp\Potassium.exe"
1⤵
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
PID:5584
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Potassium.exe --webview-exe-version=1.0.0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Potassium.exe.WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=1 --mojo-named-platform-channel-pipe=5584.6076.2040370705242626668
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  PID:6092
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\Potassium.exe.WebView2\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\Potassium.exe.WebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x164,0x168,0x16c,0x160,0x170,0x7ff8e035b078,0x7ff8e035b084,0x7ff8e035b090
    3⤵
    PID:4196
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Potassium.exe.WebView2\EBWebView" --webview-exe-name=Potassium.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1684,i,397923080399929332,9380014307111401744,262144 --variations-seed-version --mojo-platform-channel-handle=1680 /prefetch:2
    3⤵
    PID:6160
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Potassium.exe.WebView2\EBWebView" --webview-exe-name=Potassium.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=1992,i,397923080399929332,9380014307111401744,262144 --variations-seed-version --mojo-platform-channel-handle=2004 /prefetch:11
    3⤵
    PID:6236
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Potassium.exe.WebView2\EBWebView" --webview-exe-name=Potassium.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=1696,i,397923080399929332,9380014307111401744,262144 --variations-seed-version --mojo-platform-channel-handle=2288 /prefetch:13
    3⤵
    PID:6472
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Potassium.exe.WebView2\EBWebView" --webview-exe-name=Potassium.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3612,i,397923080399929332,9380014307111401744,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:1
    3⤵
    PID:7532

C:\Users\Admin\AppData\Local\Temp\Potassium.exe
"C:\Users\Admin\AppData\Local\Temp\Potassium.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
PID:4712
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Potassium.exe --webview-exe-version=1.0.0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Potassium.exe.WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=1 --mojo-named-platform-channel-pipe=4712.2412.847514803030477223
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  PID:3448
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\Potassium.exe.WebView2\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\Potassium.exe.WebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x164,0x168,0x16c,0x140,0x174,0x7ff8e035b078,0x7ff8e035b084,0x7ff8e035b090
    3⤵
    PID:1508
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Potassium.exe.WebView2\EBWebView" --webview-exe-name=Potassium.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1696,i,3766427536897112617,7548574963645133308,262144 --variations-seed-version --mojo-platform-channel-handle=1688 /prefetch:2
    3⤵
    PID:5900
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Potassium.exe.WebView2\EBWebView" --webview-exe-name=Potassium.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=1360,i,3766427536897112617,7548574963645133308,262144 --variations-seed-version --mojo-platform-channel-handle=2012 /prefetch:11
    3⤵
    PID:6300
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Potassium.exe.WebView2\EBWebView" --webview-exe-name=Potassium.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=2268,i,3766427536897112617,7548574963645133308,262144 --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:13
    3⤵
    PID:2924
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Potassium.exe.WebView2\EBWebView" --webview-exe-name=Potassium.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3480,i,3766427536897112617,7548574963645133308,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
    3⤵
    PID:7524

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4312
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8ec94c728,0x7ff8ec94c734,0x7ff8ec94c740
  2⤵
  PID:9052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1840,i,7419728188610666967,15619068785756137825,262144 --field-trial-handle=1916,i,6014151660802472388,10588295480512632221,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=1900 /prefetch:2
  2⤵
  PID:5544
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1516,i,12463786481514583054,11496121144805874918,524288 --field-trial-handle=1916,i,6014151660802472388,10588295480512632221,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2268 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5560
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2372,i,8643736904882835217,3310367828971389295,524288 --field-trial-handle=1916,i,6014151660802472388,10588295480512632221,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2408 /prefetch:13
  2⤵
  PID:6644
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3292,i,9433179032135177444,16096424010145242209,2097152 --field-trial-handle=1916,i,6014151660802472388,10588295480512632221,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:7376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3580,i,899841914555698415,8403690092904112458,2097152 --field-trial-handle=1916,i,6014151660802472388,10588295480512632221,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3592 /prefetch:1
  2⤵
  PID:4588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4484,i,16462406438574932735,17034617387520227671,2097152 --field-trial-handle=1916,i,6014151660802472388,10588295480512632221,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4488 /prefetch:9
  2⤵
  PID:7564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4680,i,15197860090940947409,11786665486105938729,2097152 --field-trial-handle=1916,i,6014151660802472388,10588295480512632221,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3980 /prefetch:1
  2⤵
  PID:8420
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5352,i,15292415379307848741,10014181795703545936,524288 --field-trial-handle=1916,i,6014151660802472388,10588295480512632221,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5400 /prefetch:14
  2⤵
  PID:8628
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5732,i,13973127127123294001,11534191525366559663,524288 --field-trial-handle=1916,i,6014151660802472388,10588295480512632221,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5748 /prefetch:14
  2⤵
  PID:8280
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5736,i,7928005087338985275,9863284387110773179,524288 --field-trial-handle=1916,i,6014151660802472388,10588295480512632221,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5728 /prefetch:14
  2⤵
  PID:8324
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5744,i,15531394461116571807,9837410368276991072,524288 --field-trial-handle=1916,i,6014151660802472388,10588295480512632221,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5696 /prefetch:14
  2⤵
  PID:8348

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1384

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:6468

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:4296

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e588a9a.rbs

Path C:\Config.Msi\e588a9a.rbs
Size 41KB
SHA256 995d832e40bf1a09a2f64948ecdc8e8e1aa8d49dea8df7ed5a474df4c665352b
MD5 6ab7d001fc531030214f33fb1cd4ba12
SHA1 3edf322b7fa2f513690826bcb22fdcf2506e83d9
SHA512 d4dc2efa76efc458f2e3c1e637ed5ffafadef179329153f78f0d053707c3232a7a8fddb961a7ed7e5813c7253a8eb37fd20e9d1e8afcb603458fbe88a972adab
SSDEEP 768:vxt29kz0qpOHMB3jwKfeW5N7xGTQOhWMUNqUoZuxZ1VDsMBxh3pyN0KuE5GE8Yey:Jt29kz0qpOHMB3jwKfeW5N7xGTQOhWMf
TLSH
T1301340C1F647C2C6F223FD93AF507F1AB619AB435606E80A05CDD2688456E98DBBC4D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e588a9f.rbs

Path C:\Config.Msi\e588a9f.rbs
Size 48KB
SHA256 534fa35fc6f6a91f69a248b4822cb81acb5c2999764a55ca9ed24369aaab6742
MD5 93f25a2562d1182ab8fa2cab759ffa5d
SHA1 efef36a2825682ddbe74d072060576d18431e3ad
SHA512 5ba7d70b7e8dca9213f8409036fa7a49a275802302870aa8442ab7d4d300fe0337ee03e14188f0bda1c64083f93525a1cb0051adacad98e3029a2dcd485f93b2
SSDEEP 1536:ofEGshoERTXvudNvAEnWzzWG1GN9yUBkzwjTKCj8tia/X7/sPsQhTqagSbLsTGrI:F3dHx
TLSH
T1FE23ED219B14C1DBE57339A03351EE043318CE9ABA05CD6A65CA436CD996FCC9FBC6B1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e588aa4.rbs

Path C:\Config.Msi\e588aa4.rbs
Size 9KB
SHA256 f998961b8ee0045f65730ea5f379d9382ce43d635347593eae2eb71dee0abf59
MD5 1c985953bbd07cf549b725d46464e5ee
SHA1 e7a38256f1a03ba9a51f918e62ca8cee6a1eb3d3
SHA512 b578f9886b01be0a1523893a35b5b329d1205c215d93a0eecd3389b27dfb540ffad9b6bea9cedb191b6c85bff545b70debe51cde35df58214d32e0864a1d9dc6
SSDEEP 96:8mdeH8cgstNLXcd6fCHPM4UseD2oCCsTlyUseD2oCC6jWd/YGTldY6SZE5U7N//o:Zdfqt1sKC0XjBIjjBHqZEcNXKo2Rph
TLSH
T1D9120181AA1085D3EDA62738C3071B763BF7A3D99604524B498DC160DF573CC2FD9A9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e588aa9.rbs

Path C:\Config.Msi\e588aa9.rbs
Size 11KB
SHA256 aecf327be115e32996f414a0feaadcc833b61edb773f1e9b02cb001b05771b29
MD5 8d22353743c5d30034cb193e3a6ffd5a
SHA1 24461559517f0da69fef74bcb6116bba9ff58fa7
SHA512 d18ad9e1e8b9adcfe201ff0b95b8485788b9703d653dce749f712c43e0ed94229e17cace04d9515a2ebe981e89dcedddce4c5376a3dcf6c7ecb1aab546ea5ba6
SSDEEP 192:qHydsB+BKv7BHBoI5HKArld9CvXhtAEBIeehtAEBLbeNhEAulsZq7RpOILM:qjqM9hp5H3m5w55Jy
TLSH
T1AE323F42AA00C5E3ED621B34CB871B7237B7D3EAA315475B11CE93395E037852FE919A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e588aae.rbs

Path C:\Config.Msi\e588aae.rbs
Size 8KB
SHA256 69bd2ac23f7ce7d79b6b84174b2288dc41d2547b7f0f44cbdc6aecfaa2016b52
MD5 7fab3bd17633e356c785d1683b1e0443
SHA1 ec8c39047b80ad5a02bb5ad41a5f2beb73aaabd5
SHA512 95cfbf5042efdf3aa82d989bfaef11a66506921ebcf39907ee2efa2e20aa8acb599fdff6fcfa2f7017c830aa0a269e10266b2ecf4a50db94f67b1e52a6487e56
SSDEEP 192:q8qSxRXxER3xP/nlkhVSczdrCFgTD8e0W1co0RVo0Z32w/ii6s:q8qSxRX+R35/nlkhVSczQFAD8ezczXzl
TLSH
T135123007B60081F3EA512735E72327B17BABD79E8304435F10ECB0695B46BC61EE95EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e588aaf.rbf

Path C:\Config.Msi\e588aaf.rbf
Size 143KB
SHA256 7ae20d0542a544b54730a5520a2c7b56dc9235be1a4dc1331763786a16fabed9
MD5 7d4ea76b6e0659fdd36b34499f964aea
SHA1 6b7700ed5632d176fc0efbc5611192644bc391d4
SHA512 41ecf5f0a70828d114056bacd8fde364e2685e3c2f58a785540af7056e3698b027cd3bcce64ab840814ad3d2c5a0eac0a3528cdd88b737eb02671e816eff27cf
SSDEEP 1536:8vJ9psmemUoXVpuoM+/7BUNs9OFVJqp+uIBQepE4XKF3QcOzm:8vJ9psmeIBcV8pQFq4XKF3QP6
TLSH
T1FBE3C31AD29802E8C06E6179C7568A41B7337C6687E1D3CB53D0F53E1F766909EEAB03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e588ab0.rbf

Path C:\Config.Msi\e588ab0.rbf
Size 3B
SHA256 13bf7b3039c63bf5a50491fa3cfd8eb4e699d1ba1436315aef9cbe5711530354
MD5 21438ef4b9ad4fc266b6129a2f60de29
SHA1 5eb8e2242eeb4f5432beeec8b873f1ab0a6b71fd
SHA512 37436ced85e5cd638973e716d6713257d692f9dd2e1975d5511ae3856a7b3b9f0d9e497315a058b516ab31d652ea9950938c77c1ad435ea8d4b49d73427d1237
MD5 SHA1 SHA512

Submit Download

e588ab4.rbs

Path C:\Config.Msi\e588ab4.rbs
Size 87KB
SHA256 2c2de4785e2221c7388f263c76bc01ccf362614b35c99f736bbf8a4bf7138186
MD5 806a13965a21b9fa4365584cbb3775e6
SHA1 d49d7f85e6e8ecd6456e7f26a1a3aa864d0a5c05
SHA512 8df943110773b99d004dac770f405b354a7b21cdafc038d4184172883ce98b9c8aaa08581dae849346c08abeab87d2aca9774cfe21b777b07e859fb1f53ee63b
SSDEEP 1536:ZoU1ecC4ItIEdpD7isW2FyqvTv1NNMEr2aO4Pugv6hyfpsbIjemi7Ilw6aDMQuBc:0tftAKZMHbgIEkxlCnQrd
TLSH
T1449332555724C3E2B8337E484BABE64EAE194DEF5345C92911C2017FDCA2A8BDB7C0E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e588ab8.rbs

Path C:\Config.Msi\e588ab8.rbs
Size 3KB
SHA256 575667bd388df9a8ce40f33278482b848a8e093503ac6ecce2932f3b9fa1f79d
MD5 64f68384c52da0f1d084f5ad46dd7057
SHA1 63f758b70e27715294125f92d8406842209697ae
SHA512 cd53a06d7c4c14bce557ee920a2315c6232f29d790f27b9f375409a32fed2c70cf73fc3afb876dced44d7d04abfa06fd57e2c92079edcefaa06010c18548410c
TLSH
T1F281AF039B10D6D3FCA22B30C9470B1637B7DADA8315434B44CC91754E8B7899FD968A
MD5 SHA1 SHA512 TLSH

Submit Download

e588abb.rbs

Path C:\Config.Msi\e588abb.rbs
Size 132KB
SHA256 fc78eb3d7108f43425d5c2fb45549c561dbe50627ddd4e3149b8721b30a1fb5a
MD5 d1dadc4e0d3cba5a87b6a098cc7400b2
SHA1 e653d3ebe46003a0ca2cdb56bb0569138f8d84eb
SHA512 d085f1ee97608edd10ceae9c3deb9b0889462b32fb3ff0f3adb546aa73bb5cd8fe85bc6541eeb6c3cdfe990c5d6b4f1f9966c3991a817a7f9807efdd3505795c
SSDEEP 3072:3MrS6moQnqroUOVa377XMc81JsqES/e8IDPsdDY:4K0P
TLSH
T175D3EE9F2354D0E2C43236349B3BAB4CAD174E765311805B9AE9962EDE777C32FA48C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e588bd8.rbs

Path C:\Config.Msi\e588bd8.rbs
Size 8KB
SHA256 20bf4e99197a09970cc58886e275fb1f3e09aed2dc86241502a28dd96a54cd4a
MD5 44416cd1aa3a3e35a6c0998a925b5ff7
SHA1 0010af58af66a1109ea65c5365de8c4f315810e9
SHA512 6d15ff0b83305b3a51839ebd866b546708af1a8153d2d1891e11a63e4596bdff607836b9d421aa2a042885757de24e65acee4c59bcc2316097ddbcf36e6fd8a9
SSDEEP 192:xzCHRax+RqxqkHHhYPR6a2OrI9mT2kcOgiHK+L8K+RXKo6mi:xQRasRq8BfP
TLSH
T12F020F26B649C2E3FA662A31D7032B70BFB7D2D98314438B10DD75609F17788AA583DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e588bdc.rbs

Path C:\Config.Msi\e588bdc.rbs
Size 86KB
SHA256 5859c240225db437f8a15ccc3ffccc57d3f624481a947bec0e6f60983d05a7cb
MD5 e124a531b3d71c41cba7d9230aa73a30
SHA1 f839036d628084b4a6e434f2cd902a8c0dbb74cc
SHA512 f73067685da7d34a55285d761a0dc5e34e82fd4d0b02a3d51c7772b93938f086df8bcd03f5e12b8809d6b0540b1846a0f8fe4431bca12ffb8632aefaabc750b6
SSDEEP 384:ArMR0vRvIOJif+YIp4eafmC/0QAXjB8tbIURpcAhdO/qAlFIHafTC9v7ahhFEDu+:AMANEz1tmyOFc6d/72j
TLSH
T11B83BF677F88D0F3D231B97067335B4C7F128E664710C09A56E9824FCA3B7E96E98486
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.AspNetCore.App.runtimeconfig.json

Path C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App\8.0.26\Microsoft.AspNetCore.App.runtimeconfig.json
Size 289B
SHA256 13d6b39073018e2634688547903cd4b503eacb0da4eb31bd01fd5d40f579e7ce
MD5 5a2317cef7301a0a1d20ef12260a9878
SHA1 2e7d1aeb633fb390cfdb7fbe30cd7cc9f5103772
SHA512 cd07d2867713529b473bc646971afed0d866aa96ec1a6fa3851464672fb20ab84f2e6dffb73e40143fde784cb524c30b8e3f006cf89865915bdea0d857be9dec
TLSH
T180D0C776EE116E6712F12B69D0B1C683FA21A36B0014089174FE6E0C1F36AB64006BA9
MD5 SHA1 SHA512 TLSH

Submit Download

state.rsm

Path C:\ProgramData\Package Cache\{f600cee9-4c2d-456b-b0d0-46283c87fbc5}\state.rsm
Size 916B
SHA256 16443f8d15f473248409c240fdf782148f0f20f9bb5eff33812c709f13478cda
MD5 edeca387ef8314b1c284416ca6387d74
SHA1 b9630645824ecb4bc1cdd171b18fca72edab9d6c
SHA512 4d243fcb32c95d1cbb7944cd9a0dbee4727a23fb87b453f55ab02a75e3e5e341ce546d0840a7526cc23f5f4c86e2950ff72758f1bcb67b6c883f3a449142e0b9
TLSH
T131119A504FFA4628F3FAAB7069B59659243AB8212E32C62C044131868F32B91C974F73
MD5 SHA1 SHA512 TLSH

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 b8ed3ee57f71438fb0d0587dc17b77cc3a0b6ae82eb67428a26af422904421ac
MD5 80a178811b0a4deb57ae1bd37d71a034
SHA1 9a203618c9502cf914de75019a959648714b4aa6
SHA512 3e38dec33522b905c9c75111923fef73fecf3d80954e975629ebf797cc2c7d56599fbdfeecd001c8de0350ac38e3aa0a6188022c742e0ee965f098afd4b0fa94
TLSH
T134E02BEED961E86719FD476860644B46F72013972B41884F3B3D810C4FB152B0586C7C
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 d93b320613b4fe50fc2b79bd37c232967b94fadee98927472065c3f6aef1e8cf
MD5 394bd13511ff36c0d030b0ba13e5ca3a
SHA1 44cbb64b4133b32bb8618a86386c97f7554b9de0
SHA512 182214be2529cfc25c753c96b06ee9491ffe405c24d70b1045e0e366d812be76a2056405a4c5241ca500516ed56ddcbe9b347a277ac083f70ce9eacf289613af
SSDEEP 192:mROXrhjTIQv7ApAPRp2w9qHsb+WNnb4tEQeSi24a4VyIsnAUgraJ:mROXCMsUXz4wstCLace
TLSH
T12A42E92EA918793B5CD6C219FD66B753E3F6103161942E84E7FC8A1C15E7ACC621B02B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 101a0ca0c6a7e3b6ebd0ff23aaddffc59fe289c592c0732528c9a135267ea44a
MD5 a660c0997cedc79b92064d901311217d
SHA1 ff384b12d94c50fc657d9fe398075768bb536391
SHA512 81f64229593076d85625cc77d56fab1d9b5b444e0b3ad86f559e30265e87e791b8b22c4eaddfb25f0d2afe99d757d6548490d9bc7d128f0e02a00cbcbe80d850
SSDEEP 192:mROXrhjTIbv7ApAPRp2w9qHsb+WNnVS0XQeSi24aaVyIsnAUgtaJ:mROXCjsUXz4w807Laa8
TLSH
T1E542E92EA918793B5CD6C319FD66B753E7F6103121942E84E7FC8A1C15E76CC621B02B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 02fa3748cc960b0ed806669146286ae61d8f8c37c72e1c20fff625c9b568d7c5
MD5 e1d791f76039330e35fa0e1827d639ea
SHA1 a37e7b6749565fdef84e626eb8e8ab5cfd1eaf09
SHA512 4cd2d4ec371de591ed8fc49a3c9c69bf2d80c0d8879044f55af268ee4a35e216538e529304db502c0dc2822c3e20cfadd9949c623d30489800bbc0cdffa3ddcc
SSDEEP 384:2Mjqt7KxkXqKf/pUZNCgVLH2Hfgslo67pLuLcifklXODqt+ErU3sjHG9TDWxSal2:2Aqt7KxkXqKf/pUZNCgVLH2Hfgsq67pU
TLSH
T1B672E8676C0C9D7B0F94C58CD8267E4FADB9024B65ED886483FA582A03D5BDF110A1F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 88cfdf713938e946b2e354206347ca16e118eeb1f261b87e775304ce44d213c6
MD5 90642bc219beb279fe7f82ab04abc2a6
SHA1 9b71b51df53725f2fde5f0d0ba4b9ec51484e2d3
SHA512 6c678df37d5869964e65791caed14bd49a40716ea4fd172fac862890f630a9d9736f9ef30df74b90df18497a6709793cfd94c7659108451bad4db17e6c46838f
TLSH
T120B01250C0019511C04303F41582048876149F14D70A170193E4697298261A08014250
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5cbb49.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5cbb49.TMP
Size 96B
SHA256 7a2bac2a93e9eff0775f236584d5407fa175deb86036d3e23325bf4745f9d096
MD5 393238f7034a5e56c10c4f93e07916cc
SHA1 191afd751e58bf9e574311d374f6feb4acb78274
SHA512 2080c15f495684ddf8be81e2755bf83024e264602b3d38abf55ec794397fd40eea358d1d387b56368ccb530bd2093c4407821aa5d66766339462030f4d300964
TLSH
T10FB02200C2822202C0C283F0288880CC3020CF28C203030B82EC0A3ECC22230082A82C
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 201KB
SHA256 f313b59b18ca40fed00eddc885ec19a6eb45131f04d50f289a447c1cbfb737e8
MD5 43dcfab46be1175a97b0c131a9783b83
SHA1 c1a1c4eb1249ebb88dd9bfb7a9cd811614bc882c
SHA512 e93b2e049e796fbccf5fbb706a0d95bdf94921191d41026f845dc0bbc9b5007a3108aa651edf081160f38ece209d5033df83e1801ddfb705ac9a36646611d1a4
SSDEEP 3072:w8Scf3e1lcXCSJdh2mXkoD866zAtmRfdK1FEJt5mH++J3qUQm08KMWF0bFTcVHrO:wI/+SCpoA6aAcGE35E++JjcMW2VcVLO
TLSH
T169141278BA27BE31A3CFEA93E02B5D7D4CD2DC8D9244527D63A2178D02EA7C1124F654
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 201KB
SHA256 91297830acb51345af67913fcb7bed5ba6b1ca415167bd498f6a56d137f24aff
MD5 864f0d264cf3d6e148164be62129b0ad
SHA1 60b271a7f5740de9ad29303333c39f6a55e965ef
SHA512 cda30fc7289a9b39826411dd3fc2cbddb0ca30c271fb9439d84f54e50363287b5a7f5f43aa26eb232f1b0e43f472dd901d3b4c107863b4d36c0c05d45b0cbbd0
SSDEEP 3072:78Scf3e1lcXCSJdh2mXkoD866zAtmRfdK1FEJt5mH++J3qUQm08KMWF0bFTcVHrO:7I/+SCpoA6aAcGE35E++JjcMW2VcVLO
TLSH
T147141278BA27BE31A3CFEA93E02B5D7D4CD2DC8D9244527D63A2178D02EA7C1124F654
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 90KB
SHA256 9db0b1a4789a54c693d0407e206cfaa383c503d7c6fba097ca86d963686cde4b
MD5 7f99f123c4c8b1a33146fd3c75a942ff
SHA1 8c4786312e93a3a4ada7c25c2ed0cd1af36e330b
SHA512 c402db2422a46e2c34718fcb9fe47c4090a7306217295a0c2f6c643692c96fcb2d5ae58ee2067d88b3efea8c85d3b2de7e5e111eeec02cc9a9bf309556ab3498
SSDEEP 1536:hZ8P++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNs:q++J3qUQm08KMWF0bFTcVHr6zT
TLSH
T1B49302BA591E7D39536AC3969007DCAC8CD3DCCE1514557C30C7AB1E14BA393A31B8E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 44e9a43c63982734361d58f6dbb1502c3d740628b05ab5bec57406bde04add60
MD5 723a748e44caadd71195ffe4e217722d
SHA1 7c7f1c75f1efbe6ba044a556d11f863c98b2acda
SHA512 44b8b021f13d2c8587120e726b58a313a8c6936ade23d6930d74e692ecbb5ad90bf9aaefec94e7110419575515c29551e0ec9551d3e4937f1f999d88b062c3f8
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7L:fwUQC5VwBIiElEd2K57P7L
TLSH
T16BB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 801b37962d35e959858c08faa0350c31a0ad9207c26da2d7a3bf16260b463adf
MD5 fabfc494f05b60e6b1b50c8c863605d9
SHA1 22bca3eaa2e735da0ce26f062320574457164a7b
SHA512 db9629b172ca6b01f928cf8b26757539851e44b27b573edc228844b5e38928b7a699a6235b10a15ce3d5a709ef5f26cf5957157d70823a377a92ac56b2fff1ee
TLSH
T1E0D0973A25466400F10741B0B002C7072B32412030261F00B264CC0C47542EB62CB0C3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 22bf0a1a770811caa575bf0b732600fc745c05d7d3aec7f1e780e5abd7c66086
MD5 034c3af3545b211ee4df68b423b87c0d
SHA1 5f3c9d7a5f13d5038a648cb9c37fdacc9cb956f5
SHA512 a88c6b98d33b6fd9ae3f7caabbe373c8c4c245385ed61f00ec55564f34e1fac8175d1af13338d3d1ceb50e626f9ee0726ab03ab0c2dcab3ada1bf2fe3e7540d8
TLSH
T167D0973A2946A400F10741B0B402C7073B32416430261F00B268CC0C47542EB62CB0C3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 72b205beb453f50e17a365601deeef9544c1fb0a6c7471fff4fe6b93111db2cf
MD5 4545a4b7e84bcd1f6c7395a6930d3c6b
SHA1 26e12977a65c318160cfc591f3cc6ac9c106ebef
SHA512 789954b86c2f406bc6b7f62fd9619c8e956d66ddac2ac5afb6d58654154278baf2404cd620e207faa1dc05510f158069b79ca441afa4f99edcf4da9fa519cfd6
TLSH
T10DD0C02C00B15C25C0C489702841FB063F34D023140B5F3028F32C6C0D41342445B0D7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 717eb4940c7fbe87ab8f0b600d1104c8a67cd4b09b0beada521544a45bbe175d
MD5 e9e994edd7a4b5a78b7b4a8f74bbf493
SHA1 df0475a3ce64d76335fb0863982edfd1a11e70b3
SHA512 d35a1536d171822e132b7f0c00b30e123c9a419e2c6192fd28ef0dd75cdabb6e20eeb4fa7c6c6085b4ad1cdf846fedf1ff5eb9437a48a09c77a49de91da73af5
TLSH
T10CD0C02C00F15C25C4C489702840FB063F34D023140B9F3128F32C6C0D42382445B0D7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7c3db8275183be415347b5fba5275cc4fadd5c828eee8b34824e1dd34e34f8e5
MD5 32d666bb4bbbcb2d60aa37935f8a9b24
SHA1 cc425cfb9051ffde5ee6c434d00eacf3d787f78f
SHA512 dcb88ff06963c5d1e8714cb513c66188ec3a3267dc10dc6e86955280ba306ad7c98cf72d9634c06e74636b539ffd27596e03647fb8ddfab923d806079131708d
TLSH
T1DCD0A7362545A40AE5294171B513C7052B755111344B5F50F355C88C96A83DA57D60C2
MD5 SHA1 SHA512 TLSH

Submit Download

2a93225a-8589-4463-b9fa-0518be3ed9d2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2a93225a-8589-4463-b9fa-0518be3ed9d2.tmp
Size 414B
SHA256 6f0998103d9620985b98a286e7f551f442efb54a0df8ca8b2d75a27af66cc214
MD5 0b6fbc775c0dd120ec43dbca1999c771
SHA1 1a169cf90f1e329706ca6fc20b1ed29f94b41f8a
SHA512 e3a6dfb5abbcfddc4e25ff86f3c5ba6f13843079ce54d9affeca23b6b4e7fcd8b94c5f1cef42aa84685c015fd772dc3fda417a2522256cb243060281baeeb173
TLSH
T1BEE02BA6CD25FC2B18FE0B6925508B49E790138B2B40864F373C830C8FF063A559982C
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 cea8f60805293ed27cde1a060405f8839f6c4bd2c116249b3949ba70bdc44be2
MD5 084c0804d7c6d716e54f171b0a8b6ca4
SHA1 f4eae0cd806d7e70238651ce776678d38f031878
SHA512 2b97a5825e9a25d7b2744cac4474cc5a8c741ea97458ad584d93876b3f094f4e111b291147eceea7ba7f9126b8a5f4de10f7bcd6d9e2a9ea949478eb8bfabfd2
TLSH
T12A7119009CD2EAA9EBE444747A9F1440FAE0765DCD370E2B0DDF943D5A8BBA181BCD50
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 236555177929b67fdf3d0e831db9e5c75b0e2f8717ac9ae09d06a0c4654c063a
MD5 ce07b3ded38e5c42a566e947921d3745
SHA1 d6d235c3183e58de54b7500aa9835e873124a22f
SHA512 34454fc8194c66b517d75792e6b06b94d7b436096e7f9e9b5af6a7184aeade4cfba12e1cadf599f29a13992365d99b37e4d54aac7b7c15b31a0c731be71cdb6d
TLSH
T14D812A048CC2EAA9EBE044B87A8F1441FAF07218CD370E2B0DDF443D568BBA181BCD20
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58969e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58969e.TMP
Size 3KB
SHA256 f6c07c5ec29993bed9d7f11b2687db54da95e5342d87898f26b221da70a5bc2f
MD5 85e37c932c8a7855075be30334532d76
SHA1 822e3da4f0f437826b4e31953343bfcf777fce2e
SHA512 08d93daac9de93d5696688d5d021be5d3d01128d5af4a551d17f88eb95870d89e49a5ac731e32f321c31a2cb0773962ce78c22ee380e9ade3544db854b87c907
TLSH
T1D871F6409DD2E7A9EBE044787A8F1040F9E0B658CD370E2B1DEF443D5A8BBA281BCD50
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

computed_hashes.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_2\_metadata\computed_hashes.json
Size 429B
SHA256 b829b0df7e3f2391bfba70090eb4ce2ba6a978ccd665eebf1073849bdd4b8fb9
MD5 5d1d9020ccefd76ca661902e0c229087
SHA1 dcf2aa4a1c626ec7ffd9abd284d29b269d78fcb6
SHA512 5f6e72720e64a7ac19f191f0179992745d5136d41dcdc13c5c3c2e35a71eb227570bd47c7b376658ef670b75929abeebd8ef470d1e24b595a11d320ec1479e3c
TLSH
T10AE055170A1A50B79BB8DB90EE525CA2E8A0A6B1C50438D63E608234B68A11F738347D
MD5 SHA1 SHA512 TLSH

Submit Download

verified_contents.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_2\_metadata\verified_contents.json
Size 1KB
SHA256 d23b2ba94ba22bbb681e6362ae5870acd8a3280fa9e7241b86a9e12982968947
MD5 738e757b92939b24cdbbd0efc2601315
SHA1 77058cbafa625aafbea867052136c11ad3332143
SHA512 dca3e12dd5a9f1802db6d11b009fce2b787e79b9f730094367c9f26d1d87af1ea072ff5b10888648fb1231dd83475cf45594bb0c9915b655ee363a3127a5ffc2
TLSH
T12B317466C8683D56267A63348E2D0602EB57C2BB0050640EB5AC558D4F7115FE242FAF
MD5 SHA1 SHA512 TLSH

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons
Size 20KB
SHA256 1112ca63894895a5ad29c23df3d9284909b6f914b90b34381445f6dac88c13b2
MD5 ef7c516492c9aa843b4cb9514595fc9b
SHA1 d18b0e822dea7e5d50df72f88f75c9b82fec0197
SHA512 64ec06d31f5b91f5021b96feac5026829353c6617f7e55ae2b2cf6b8982e97c1bdb65c7ed503805f85fc449cc302580d4982853175a2aa11b44b6934db858281
SSDEEP 96:6BCxAvUjoUIO8OXqoIngF848OXq6quXl87A307BiT+QHJvUjoTIO8OXq/Ing+E4S:wa364WXj7A307BUxHe3tbJ
TLSH
T1B8924003EE707403DF102A77231E5439D63B911A6F97EEC57C254060D9B32D6A0662BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 204KB
SHA256 f03218aa73fdc200bde18fdc8a8b78ac585191e8b13a4b1c68ea155523c72a83
MD5 036cebfdd4d54e318f564a16063576e6
SHA1 c58488f27d81c8d46ac30e08001f6059c57dfd2a
SHA512 91ee8df32b97b332c2069a79924d4f297dfd4b7e0ce15f4ef5537351876872c00f1bf052b76a61ad22e6e5cd9a736bfae3b6460ada77abb64a89703a0c476f6f
SSDEEP 384:KRUYvMM/cKF9ta83uFBBQ1GkSymxo3R8J7DNspUO:m5UFBBlCRfUO
TLSH
T18D14454F9F306212CD7991375AEA54A39D6EF02B8B53B7DA6C610470CEF3642B01C5AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 baca0308317e72e807cfe12d4c6c6a396ae20e6674dd29c6753dea916d9864e5
MD5 276a51cc0dfe0feeb8dc0f762d8f0758
SHA1 c076b0e155aaf63a11f3ae9fa0ab8e9f863608d2
SHA512 9d375d9022296c2ae7be480bfdcdae79fe07969cb5cf225953d7b02b735e32a164c2d19b0a416f913cf6e047052a9e6da2f5b03085273817a7675bdff30d48aa
TLSH
T1E151BEF783E4856E8A1196F0AA18EE2FDF2D0615435C3C6A89E4EE17D3E3471E00265F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 2bd9f707a36bd51b7102dac88200c56d1c44f981a65f2c55d11abc23086f7009
MD5 cb27ef4728151451a92b0c9f9bdd5f7b
SHA1 d6ad768a4d4981a992d34ec94b93b4531c5506d1
SHA512 07b3e6973c8d12c3888ac236d6d1971fc51ec56bd9d44b9552853652793212ce263703568cbfc3ca8ab83a865247e15c7c0da65427ad3a78c5ed5fcf29c4f028
TLSH
T16D61BEF783E4856ECA1196F0AA18EE2FDE2D0615435C3C6989E4EE17D3E3471E10265B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 3b40bdb4c44ab13bf599dfaca2d104ba447682fcdf0a782a4949b2b151272aae
MD5 83c5234ca431ba60d6228057ba02b1dc
SHA1 4cae977dcbd8eae082a1d9976689b0f69bff77f6
SHA512 7ad155bb1b477c2f2d8eac58e7647d84c19af140f14eb04b00d2eb403ef542f344e83f2a66664215ca18ed6b64ca5dc3448d0673c0756589c0dab66193ad15d3
TLSH
T12C61DDF783E4856ECA1196F0AA18EE2FDE2D0615431C3C6989E4EE17D3E3472E10265F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 858B
SHA256 0f30cad1e5a1a91259f3756bd49454cb49e6c72f44120a556c000f75baa0c1dd
MD5 7569ee15bfe8fcb8603f914479ea3b06
SHA1 1b9f8a89c9ebd6205060f1c23df7986bcb273188
SHA512 dac388d63b3bc1038325696af5cad3bdaca31e74cf87bbc976e05f1de1d8a368bc7bd01652a490239dd16e6af3970074e578531d8965691291392db71388f456
TLSH
T1CF116B5BC27FBCAB253C447F5E887C893DB6E8310152A8F9D9AAD22D70455F71711029
MD5 SHA1 SHA512 TLSH

Submit Download

ca64f5f6-0694-485d-a5cf-087e2e048ddf.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\ca64f5f6-0694-485d-a5cf-087e2e048ddf.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 96aad6e6e1447463a15950761256a2c71da08b728c9847a00dff3c14fe4e79ce
MD5 53c2245b5288e14c88ae099f49780ad2
SHA1 4e380dd9c647f504130940b160a06ed8c8e11271
SHA512 5fa83509c579853b68e67d2c0e3688e876eac2a865affcae7fab9002e426a6ae70a1b0d52e87c1dc688ccf3c975a05b836f39af00924ab0218060b8e2a22fb2c
SSDEEP 192:sxZERgyM//K1Ml8MNZ/f1s04rvM3sIdpft/W6+WNr/GtfAaf/1FePNPxvTGIg4J:sxZE+1Z/f1s04U1F/bEf7kBT+c
TLSH
T1B152EA12AA34B977CCCBD209F955BB53D6F9156392900E48DAFCCA0C04E6BED621781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 858dce352cdc587a1e9bd4f3fa0401cf3ab49583be54804dfae07b0f91fa3f49
MD5 3e8030656eb608966c79f9e5a53f2cd0
SHA1 86edde7ad0d5b7dc603916b6125f800f2301b8fe
SHA512 06601a4158833bda3609eb63bd3e9f9907180ab4db7b41a6267c14e6733e0bc45868c86614b373c47766dff9ce1c1a1f8e1ce54480308ff84f6771219feb47a5
SSDEEP 384:sxZEP+Z/f1sYWvyWmciKHg1u9/btZ5pIT+HH:sMGZ/f9YyWmwAw/bj5B
TLSH
T1F672E812A578A977CCDBD208FA15BF53D7F9156392900E44A9FC8E0C01E6BED620382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 b2705ca14bd6106bc9bb3059d2b64a5cab3f1ee32d565bfe748230a68d7a2ab7
MD5 ccf40e74b471cf2894f6653b74f99b37
SHA1 e80a54a3e77ce110ebc3668b2a989480d0fd2f94
SHA512 cbebf69bab8f12624d28af8aba534d4e58779a136f3d27c4f52377be337201bd2b1ada2d90c474ad60ebefdd398d5ddd4fca46de08110286a8dc276ea6b469c8
SSDEEP 384:sxZEP/Z/f1sYWvyWWUiKHg1N9/bQZ5L/T+I:sM3Z/f9YyWWoAd/bI53
TLSH
T10672F912A6786977CCDBD219FA15BB53D7F9196392904E44A9FC8E0C00E77ED620382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 248a4006b1ca2521b2fb3bca816f5e1370a5fd11c805c277e182fbe36e34791f
MD5 7958240a57d1a12870549ce5fdc7c5d4
SHA1 6b2930db0e336d867f0c55c0c444e3b4111efdc6
SHA512 615d0623db3efbc24af092cdf5ee4884de33928b2bf806b7f8bcd3374bc2a54501c6a5ee8b8e363489350cf2435e6a8cc46ec36065f88022e84baa51783bd0c1
SSDEEP 192:sxZERgyM//K1Ml8MlZ/f1s34rvM3sIdpft/W6+WNr/GtfAaf/1FePKPxvTGIg5wJ:sxZE+tZ/f1s34U1F/bEf7tBT+e
TLSH
T10162E912EA346977CCDBD209F955BB53D6F9156392900E48EAFCCA0C04E6BED621381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 52d6f9de919761aca91e75328677e5fd275d5a85f01c79bf3bb6696e923c1973
MD5 176aeb6a0e90e5f4c88303a116a1cb89
SHA1 532f4899df6468c0b58e87e8d41193ce5dae1f40
SHA512 2327cbb4aa6f96e0972ed9a2ebe6d530f2a859293759d5cd6b6a387de93a1270bda87d1f487b96406a395f8beaea9655d47b6cdbd50b140762a05c2f497b5e9d
SSDEEP 192:sxZERgyM//K1Ml8ClZ/f1s4WpVB4rvM3lIdpft/W6+WNH2/GtfAaf/1pCPKPXFT/:sxZE+FZ/f1s4WvB4UWF/bVf7F1T+I
TLSH
T12762F912A6746977CCDBD208FA55BF53D6F8186392900E44AAFCCA0C00F67ED620381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 c2e1c0a25d21f1e1bfc1a3bedaee7f8d520eb7167220ff380fa608f7b8647adb
MD5 9373a06b735f5e6e308d6794211d3882
SHA1 f5beb69e821bde89cce8af928ca5ddf209729edf
SHA512 ff54747957a05a1ce96e498a0b9dabe2e648e0dd832e4908c064334bbdd65fa9d18b18f4c75d75187aa3a025d414f7192df610dd06c5a4e00796bcf659cf3b1a
SSDEEP 768:sOZSPHx8/128E7pLuLnu0WRmoMQTA8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3EXAzS:sOZSPHx8/128IEnu0WRmoMQTAu1jaKEd
TLSH
T142F20B3B784CCB7E4F804D9CDC26AE9B6DE4028B96A8C95447FA484C03C67EF551A1DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 b445873fccd56f308eecfe390fda6260ab2d7f03ae9de205ffaade00981f5344
MD5 98b31e3d38e0c7f0e261837678431fd1
SHA1 5056a68544a5f0457f7b365647909813d8273bc3
SHA512 9981718645c3e4229b1fbf003fe213efc383f130eb94ad70fbdcfb232fa39eabc11a1fcd37055aef24772994ac5bf3f20def58cac309d5ea3ff5f621929717d0
SSDEEP 768:sOZoP7x8t12SE7pLuLno0WRmoMQ3A8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3EXizD:sOZoP7x8t12SIEno0WRmoMQ3Au1jaKE6
TLSH
T1D7031C3B3C0CCB7A4F844E9CDC26BE9A6DE801CB56A8895447FA484C03C66EF551B5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 338B
SHA256 a33784385c919b6e9dded69074461843a8d10534f156ad611be8d66ae9083364
MD5 660272f550acb059ee4d65035a97d697
SHA1 b5d117fbc94dc5ce01facd073e7a72a0775ca8b0
SHA512 a6456ac85e1b899ba842b3aa315da0500ef1a61dc465adeeff84fc08685d25dd57718a403ede111beaf4456a302f2ae9702ed752972783b56766ca2b3e146f40
TLSH
T1A5E0DF1846C8C1B96119349342B49B0EC2EA742FE3C83A822F88CCA66342D04B99B2B0
MD5 SHA1 SHA512 TLSH

Submit Download

Tabs_13422794559584506

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Tabs_13422794559584506
Size 1KB
SHA256 735d6877d29857fd0f1b178ea53a2167f074c1cdb2f7517e68d5d96ee25a7f19
MD5 e47a6903ab64baa0d4e23d80e6d458ad
SHA1 1bcb3b02a271f5196fb3bdc23901378ff2933869
SHA512 9238f28b5af3c234ba31d1a24ca5272a12de2fbb3e4f3997c710801c48a7a7902da786d98435978c8ed1a3aba7186692c666283089ae3d432ff67d1b6c3ef1df
TLSH
T18041DC46DBF1016EE6BE4635A4BE11B65B32BC02A9E2DB4F05D040084933A11CFB0FA7
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log
Size 112B
SHA256 4104c22b9f9f9868606629015e87824f0d6be2f1272eb2122b4bde1fc3fc76c8
MD5 a6ea017e61d144a7a9f7cfe60ebe2735
SHA1 76ef5cf17a4f3505a9792d19139aa605cf9bf954
SHA512 72e134eaf8e1cb1a0414170339f246f1a6cd6c3df7c268151094405147217d868e563a7d3513b153fbe24dfe5416fe0ec1be452221a16da36f9f78eaba3ca18d
TLSH
T19CB01286BB509356CCCA4C730D804B40A710E063250045838855DF108C2D7A4EE068C8
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 347B
SHA256 a5d9df8375f9bb20b25a3a5c04397eebb5f5806ec127866d2abb88024d1fb04a
MD5 242f82d415e607a66fc0049d07e21e6b
SHA1 ebf1d7e0ed7a2085f4a13f9ec6e3f03ab434b455
SHA512 f6da8bab75f456a9aa6de0c7f9dc294be5ffdc4f3ad8bb3a30a1e0d534cb92886d21948d26967070d3a888e2d9cffd2552f62961d5053b60b20743981ee0e0d5
TLSH
T194E0D82C95C9C62AA15534D78378E70DC1E3741BE7C86BB13F0CD8447306580728B670
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\000003.log
Size 175B
SHA256 80d1388b9a7150eb0291175fe693dd7b6bce910c3e4fff51e94841d31d771dbe
MD5 cb63c64828a27af7253afb7c7d986654
SHA1 8a54aeb86f79cc69e6f11278d874cebd328ae466
SHA512 e0dbdd6931c9272e0b52bb2ef7895121f6324379f584899343342a057737a9837cc476842ea781a1de5c17a20c06e0a7d24c0ed6ea41fdd95bb99296e8810f9a
TLSH
T135C09BD55F903023FDCA5D3D0DAB53041720C4752F74CF57D28430901C0A285FF61145
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 323B
SHA256 0e09b39cfa09cda9ae945411f79b6f5233bf23529747c376522eb79e7d8b00f0
MD5 c5c2a853aba837da89a0212ace81ea9d
SHA1 7805fe9143da3ef1319dddabe072d591b4261e8a
SHA512 d3758c0f46726c2a7d059e6801e219e1368407b9e60686a9a9a853a84e09949ae7d0127dd95e0769bdccc90831f3c962d649935cf5b4b133bafe6ea3076f19c9
TLSH
T14EE0D87885C4C6799000F4E783B4AF0EC2E2B85EA3853A816F0C8855A301500B2AE2F0
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 7c03d1a9ff8e77d5022d99277c01e8776ed1e749acce4f0466cee8e81e6cb52d
MD5 58932fa16a84e1637a88ab43b83b5522
SHA1 05923e7ed6f846d32d772ed6c97fe1f29b6b8618
SHA512 704f7978fd122ea436f728c7ae3236c1640f21e75eae496c2d04e91c1a0ba86ca793451eb0819dfefe4b17e29957eb04ca0416f6d4ac06ba8a80da9491e7723e
SSDEEP 96:K84YKhq+iAAKdOym3mKwozZCKy4SS4AKNON:y7LjlV5DO
TLSH
T180E1E051B07A03912A7E256A80D4B47E928235A73118F53B3BB801760F67F54DDFECE9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5aeea7.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5aeea7.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 ee07d966b236cca73cb64ec39b6071802b267467f8082b7cf80f99e7e475d00e
MD5 c7c5855bbdf20a69f29d348af35a93e7
SHA1 30fe1dc6a44916fd3e613e26be28a65d3be8ab3c
SHA512 0d0fa377609eec0f5b14c1a3bb6ae438a748258a47c1f3229702abb0ad17a35d2ccc23b092f28dadb43ccb65b8cfdb6516c355cf5888777de48a94573eea30a7
SSDEEP 384:n1iFTCcmyWCM38Nw8TUNTUlIlIebf5WRQ2rW3qDfQP/Fpv5PBck39Mq4KV8p0Cuo:8FmcpM3fwgOeTgY5P/FB5PSi9ME8p08
TLSH
T111C2393AEC58997F9CE7A784B30A76039EE04177C6E899D8DBD81F0D50A319DA30BC15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 a698eb2a7f2a1837c4cc5ec3229be2efeeb0d61c6c98ee98aaf397ec5ca440aa
MD5 536d58c4f780b06164269ee21f9746bf
SHA1 bb8f65709abe1a28f364104d951985438bd68352
SHA512 3334a785acd1e0c32d956ce0de53bb4b5fff72de1f947f385037cd3b477d89ed47aedd63417ed4fe718a6979dc296e021fe691df7f2864a0e2fddb23e2a0bd7e
SSDEEP 384:nfCcmyWCX8N8Cebf5WRQkA3Y/FpveHTkwe4KV8p0CDgk:acpXueTgII/FBgkwI8p08
TLSH
T112828C316C7D6C7789D39118F44B36439EB068BB8AC05F69EAE95F0D00D7298230F91B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 ee33d6aee1bc534dd8f9d7b9a6fdadf4030014e2061e48101eea0ac6e12f7095
MD5 9277a2dd34689153f3408bbccc7565fe
SHA1 10d1b81f6b2b43e7f17e2d67ce81a912d9277cd5
SHA512 a23dbfcc09125ab929e129a510b7b815e108dcdf19a9522d8588ad308d724a0dbb40a9fb91ae686c0f18d87eba398e07847f70c834d72786c3c3030c0c762ff5
SSDEEP 384:nBCcmyWCK8N8Oebf5WRQkA3Y/FpveHTkwe4KV8p0CDgk:IcpKqeTgmI/FBgkwI8p08
TLSH
T1EE827C316C7D6C7788D79158F45736439EB068BB8AC05F69EAE95F0D00D7298230F91B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 bc432cc032863cfb952009939ba86695a493d6d0d0edd08580696f4c98ebe487
MD5 fcd5278cf051f8169eeea0da1dc85ff8
SHA1 07b5ba4a6e0a901b2a9a728bc7b76e86eace8553
SHA512 3420b121fd686d6899c94826c51001147a2cbb98e9fad3857155ecb92d7ca4e47f18355c982695c1f0610bbe06e51278cada40424d46fdc778a3a7e6bafa7466
SSDEEP 384:noCcmyWCM38NfIebf5WRQ2OW3Y/FpveHWm/iDIpKOmS/e4KV8p0Cuty/7Ig1gC:LcpM35eTg3I/FB1/spKOmS/I8p08
TLSH
T183C25C7DAC685C7F489FB30CB60E29235DA4523BC6F48969E7E80B0EE0B2558F70B515
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 0f8d37974296ccc2353a75ba578407690c3bf59a83da31f3126d4e3d09b99dc0
MD5 1dc8dd8bb94ea5c564b1df01f1c1a4f2
SHA1 2896af9934e3bf9516940190845528b8eb3036a9
SHA512 a6a550a03245cb1b559b47acc6e6eca6ec72475d8eefc41217e44022e6fa1360cab4ec3e084b6ca20d80408e024d55704cca67dbfded4a46102859051b51995d
SSDEEP 192:ZGN/6Pt3QmiUymceqB/Fl8YmbRcv7ras5U6:ZGN/6FZ1NqB/FpvPt5U6
TLSH
T1B202F839B8BC6C7B9EE3AD45B487B7135FA4106BDAA45F94DAE81F0D00C765C2307426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 e82186a4368e7c006fff4c72cc2e170a66c081c0e08176e57300ed6f22ced6af
MD5 06a16d67be6858712d35845324f47b57
SHA1 3fab7bd4314ffa74a2631f2cf0146bebc98845e9
SHA512 a7e9e67e4a21e82674730925c3a156cd78973610003178a507c243e3a25cebc2295b729bb4959c8ac76e1866f7b0403ba30e408bb19d11bcb33ffb048e61263b
SSDEEP 384:nHCcmyWCK8NZOebf5WRQdo3Y/FpveHqr/8t6AC9SkVEYe4KV8p0CDgk:icpKPeTgdI/FB5Qtm9xEYI8p08
TLSH
T15BB2593C9C685C3F849FB70CB14E2A274D68163BD6F1896DE7E80B0DD0B6598F706926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 75f73d8c42bce07d14520c706d785034974df18810dcb580905f703f87db8533
MD5 29376a9da60595e9ab88c9f1e47a3719
SHA1 7075d132cdda4bbc1fb09f9967fea3bf39b12c97
SHA512 81ad71121a7100d6c423688de0b90e8026e7c7192ba004038c0edc230b66e39fbea09624fed8ae609fc64e2546ac1d301bf340c06930e902faaa93a42367f909
SSDEEP 384:nHCcmyWCK8NZOebf5WRQdh3Y/FpveHqr/8t6AC9SkVEYe4KV8p0CDgk:icpKPeTg0I/FB5Qtm9xEYI8p08
TLSH
T168B2493C9C685C3F849FB70CB14E29274D68163BD6F1896DE7E80B0DD0B6598F706926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 89dd05985b4b6fe7fd00dbaad326c259a60022e1deba9bae762e92836c0b334a
MD5 68d297d9bb87e7a3ed366e2252eb2180
SHA1 6e1c2835dd8efa94f75d68ab25312395a006f7df
SHA512 943f08397699fbfb9a6e1faf866a929e29a5cdd54b29e0ecbbc9585f2aff9f14fe14a7dbfd336200c4732b2a89547202eb8c49fbfade1cc2641db9eb1cec713b
SSDEEP 384:npCcmyWCa8Nf7ebf5WRQDG3Y/FpveHFiue4KV8p0Cuty/7Ig1gC:wcpaAeTgHI/FBO9I8p08
TLSH
T16D927C356C7C2CB79DD3D959F52B6A03AFF0646B82D01EA5D9E91F0E10C7298230B927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 99a90ecd2a14631c6f6538cc03743978f9dcb031f234bdb25c98ee2b413da50c
MD5 2760d802128eb98ffe2b906ff5acb99b
SHA1 7f5a1f129e580a3c62db6143f77ca95e34e9106e
SHA512 41399c1efb370f1333c3ae3c82365e8f408437110d9706f461e5b1b5a0d2559367ee16c5f1188dedc48de886c14187ce60bc9fd2d37ff6bb941ed4eee35ef150
SSDEEP 384:niCcmyWC38Nf7ebf5WRQuG3Y/FpveHFiue4KV8p0Cuty/7Ig1gC:Zcp3AeTgMI/FBO9I8p08
TLSH
T1CB927C356C7C2CB78DD3D95DF52B6A03AFF0646B82D01EA5D9E91F0E10C7298230B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 452359a8226df438fead7de3245b005796f3e131edafe2d9e29d458bbc17a138
MD5 94966bc0a45c546a5a10115eca751ae7
SHA1 8714c429218ebddbd26838f468a7a90f1f5e166c
SHA512 c90e107d1bdd8edbde6c87d12383f4ea07ad6868fdb29069f1698292cacc5238fea0fe9b70477d03abe11d96a4ba4ad60340180c72a18c8c9f6b5e683e325fd4
SSDEEP 192:8GNV6PtbQmiUyRneFB/Fl8YmbRceH6YGPn4FqrhwU6:8GNV6FNGeFB/FpveHtkwU6
TLSH
T150120834A8BCAC3B5EE3A855B48777535EA014B7DEC5AF95E5E51F0D00D728C230B416
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

campaign_history

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history
Size 20KB
SHA256 36105b7998a2b707eaacaad6b37d9eaeed8d505fa0614343be59e3ac6188fe18
MD5 a3aed3cd13494674abddcb4e98ed7ac0
SHA1 ecd9cf1bdb1eb294a3c52583f117484a3b9cd2b3
SHA512 1ac7fb6c214b96bb7597753767fdd790660c7597d0fdd6400ca7910e7cb9bbd504086e97ab54f28adcbb1720ec28e50358b59caf88c5e5ffd9c0340027c63dc3
SSDEEP 12:TLpOPFUxOUDaaWZXiDiIF8izX4fhhdWeci2oesJa/Si3isHYzcQAIdVfhmQQtudB:TL85UOl0afDdWec9sJmZM2DB5fc
TLSH
T17792ED23AC312033ECEA4A36BC5385D10EBC165FC5A7F814DAD049621CB1BD2E2881F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 e30cd38e2f4ab7dde23a45aca38cc909838e8ebad22cbef5adac9a4817e84234
MD5 bb0e83d5188c8080ec874da0f8710839
SHA1 7a0baf92dde79491f247a951dd45bc663e289860
SHA512 09b535928ff3866b6d174ff8c91cf8d19c7c31c4c7d763a6db2e20dc1138ea6c5339aaed6f24eaff4b78941e5d213995091c4468cb3cf8f38e8b4dd16050d71a
SSDEEP 3:MsEllllkEthXllkl2zEkl71:/M/xT02zn5
TLSH
T1254404057FC05407C50010F34115C3D0037DFC141711D743345134135CC5D400C00040
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

nav_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\WorkspacesNavigationComponent\1.0.0.5\nav_config.json
Size 2KB
SHA256 98252dc9f9e81167e893f2c32f08ee60e9a6c43fadb454400ed3bff3a68fbf0d
MD5 499d9e568b96e759959dc69635470211
SHA1 2462a315342e0c09fd6c5fbd7f1e7ff6914c17e6
SHA512 3a5922697b5356fd29ccf8dcc2e5e0e8c1fd955046a5bacf11b8ac5b7c147625d31ade6ff17be86e79c2c613104b2d2aebb11557399084d422e304f287d8b905
TLSH
T16B51DB73D5988C4B9BF4A29CE919A309F11107CF75D48C0B76BE010C1F7757AB5C6588
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 30e8b5d48a130d6bf81847b89c208c7a087525e9b7d9a0a97bcf21598332b63b
MD5 bf165c172af1f75083dd4c7e8915ad0e
SHA1 2eb27e18672fd0a1816ab00d00078a570eb62711
SHA512 a58ad7ee2e18750242b9c5d53224218bef54ecd50e067170da12510559c455979fb0523044d4c23d5d5a523562165e471f95d939376df623bfdea9228ca25256
TLSH
T181F09ED29D7E36C0D6E50F6ED44B64FC40D89506F05CB579484CEAD8913950B254287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 612B
SHA256 ce7879978d6dc1ebc353b93e509ab0dcd980bc78615af00080f3db1cb23e79d4
MD5 a15cd0a1e68c6b9c3945d3192091dc4a
SHA1 5162188f19a245162594501e5febb31a7626aeb4
SHA512 a7ec103cf7c6fa801e1850205c4c06cadf96c21b1fd56db058a2980c472b1ff2f25c69a73f943de8dff815d69217995ad880e85ca7b8ced8cfa1c506315f7368
TLSH
T18DF0ACD29D7E35C2D5AA0F2ED44B25EC54D89606F49CB57A484CEAD4913940F248287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 732B
SHA256 0c1b4dc8f72139abc5b2e25e5d0097c1d3529ae18001b1a64ff535e345378b32
MD5 0ad641099b286eebf58a290b5bde86c0
SHA1 922d3e17ccc238f1bf276051af3ad5cdffb20397
SHA512 8661612608382058967a1f2ef25c7fbee41a3c2c748838346c044a48058ba081e84750e4a0de424903813499876fa7f69beba345d8ebc396340d830f1a7c81e0
TLSH
T1220110D29D7E26C2C1AA0F6ED08B26EC40C8D106F19CB07A0C8CF9D4823880E188283F
MD5 SHA1 SHA512 TLSH

Submit Download

983dfcd3-edb9-45ba-a031-7726629a83cf.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\983dfcd3-edb9-45ba-a031-7726629a83cf.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

029da488-3337-4396-8e76-681ca8c32349.tmp

Path C:\Users\Admin\AppData\Local\Temp\029da488-3337-4396-8e76-681ca8c32349.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

6e9f1085-11d5-4b42-ac6b-05a2d2534d1d.tmp

Path C:\Users\Admin\AppData\Local\Temp\6e9f1085-11d5-4b42-ac6b-05a2d2534d1d.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\Potassium.exe.WebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 4f11f10da8aa518fb7dd40bf74dbdfb3ff6fbe6518192f0d385ca5d3932a91ee
MD5 f9fe457b66cf3653c60d4e488ce29770
SHA1 9e68fb60c4f2b243ab9c30fcf3f8fbe0074a9db7
SHA512 ccc5456af0d5b2d1513de4ab2722c3632b96a69cb9e51c95974de71d6a5b97b6be2b220b51e5ac7cd367f578698c719983dd9e80e16ab36b9c28229f6dea703b
TLSH
T19AD0121277510134C01020B3100666480500DD0BC10BC2045839D92D5B048901A02481
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\Potassium.exe.WebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 1d4c942761f23e99cf57198875472690decc77086b05ae776e69ab62eb51edec
MD5 573356ac7a6ff462293fd6b16a01139a
SHA1 a3c85205f9359713af53b7a5e46954e4fc3fc7c6
SHA512 7638ae313c266f71319bfee6bbf0f7f63729380b4883501ada58d04a119367782cf69fcd4fbbf75b978cf229cd6e34cd69cbea15b8285e474ace9d5495c36ce5
TLSH
T168D012127B510134C01021B2100566480600DC0BC20BC3045839C93D5F048905A02481
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\Potassium.exe.WebView2\EBWebView\Default\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\Potassium.exe.WebView2\EBWebView\Default\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\Potassium.exe.WebView2\EBWebView\Default\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Temp\Potassium.exe.WebView2\EBWebView\Default\Preferences
Size 6KB
SHA256 05d49862b77cbcd8f73994f5ee35b45e92f99d58c7da0b91051ca6a767b474cd
MD5 e7f6719c3abb6f595f0686b881e5e90c
SHA1 fa8298626ac4f3930767f40b67c53a74873dc10a
SHA512 9112a38b2c418c021ad4fd535bffb9ca52f0a0a018c0d2fb85ab70a53e993435bb8a359762aec593b8d533f02d3ab7763b27ab8ee5d91f53d429b6477d93114f
SSDEEP 96:rQ5vsJY0CbDcVEdZ8i0vhEQwklm/7qx+WVHMSm+uecadQjK+gRgxKEB:rQqi+MZ8paQi/S+Wi8dn3gxK8
TLSH
T149D197125E68A97B4CC7E61DBA36BB43D3FA102276E54E48EAFC461C08D65DC120790F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\Potassium.exe.WebView2\EBWebView\Local State
Size 1KB
SHA256 61515f3a0e36d6f43d8a48e7913c505ecf1d54cf505309a01d06a19eb73056d5
MD5 d775eafc307865f8a176fa600183c9d5
SHA1 dbdb9962cb197cefee051b932eedec963827d9c0
SHA512 450998c86d8e693c794b95248299f7198a20f4a542c959fd7d823efe4aef76053129da4e0c7ac88e3e41afd3937773bb1600df420485dae7f1ef84442c19892a
TLSH
T1493162B3A0D92FA258D6D54576127B436F3000BA82204E84F1ED470C05EA6DEA637C3A
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\Potassium.exe.WebView2\EBWebView\Local State
Size 4KB
SHA256 5e051a80496e414a54dac00813ab995b3543e39f4224d973f76366b5509802b8
MD5 04b3fcaf34573e138c70f49942743cb8
SHA1 fef8748d76e1d5dc373b4291a2893e4518a5fc87
SHA512 dea55a615c825b3c47afa97f169ed6480ebaf5e858837095d629b0b793d71ba051fea688005c0ce1aa3c7718783109c3b6255b11b3834b3b0246d9ddb00dd866
SSDEEP 96:zugbNkCE8bkfjN3qag458Frh/cInURoDotoTMlDPBqZh6OQZj5T66ia:zBbNbLbGN3qVDooDU4w5qZQFb
TLSH
T15C817332A4A9AE674DF2D944B9463B0377605077D6A53FD9D9EC0F0C01EB2D92352C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\Potassium.exe.WebView2\EBWebView\Local State
Size 4KB
SHA256 d4d2ea70018af400a693b9066bf0351ff54bc4e49c4acc41d58436bf9cff6183
MD5 6f5091a8201cf1b15dc5868b6b424820
SHA1 920e381838e04c77af0322a1cde5f0481cca7407
SHA512 18317142ae236cceae6cf550834f1e5bae79e800258bce7d83a2959f755eb3fb8f512fbf3257fcf24534620fbd9b7f4aa706528b19a9fafa358cb778a51fae89
SSDEEP 96:zugbNkCE8bkfjN3qag458Frh/cInURoDotoTMlDPBqZh6OQZj5Tb6ia:zBbNbLbGN3qVDooDU4w5qZQFe
TLSH
T129817232A4A9AE674DF2D945B9863B0377605077D6A13FD9D9EC0F0C01EB2D92352C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\Potassium.exe.WebView2\EBWebView\Local State
Size 4KB
SHA256 910018717231e4679289e9f508fbb4f5a97077bd6d7f48cb24982ec83e4900fe
MD5 068b011b70c3d3992d35a711409faa73
SHA1 5707019b8ffcb7989e313ea1ac96702a3e19e32a
SHA512 c83e07c8ae0c19fe7b0a4892d41b0cce1a1df98a7de32ff3aa9baa229c08133512dd6db603b3a997d943ffc42eef9a616261a1ceaf3ff92abaec51180d70ffab
SSDEEP 96:zugbNkCE8bkfjN3qag458Frh/cInURLl8DotoTMYDPBqZh6OQZj5ib6ia:zBbNbLbGN3qVDoiDU4T5qZQke
TLSH
T13691943264A9AE274DE2D944B9463B0377A04077D1A13FD9D9EC0F0C01DB2E91352C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\Potassium.exe.WebView2\EBWebView\Local State
Size 3KB
SHA256 a6cb73afad0ec4be405123ba5d14eff7a4b7c7c2f9fa056fa1a06fdd720f45c6
MD5 89ddcadfb737bc539099f4a474c4eedd
SHA1 2ad1c3fc7b2e465fa52b6df3b479328ea99dcacb
SHA512 40972ee1af06aa86bbf650908a0db83b0f945b409ff933d6a2d72a91165ae7533aa318fe0fe401c61a3074ff384b7e09be915fbbb087538971b091800c8253ab
TLSH
T13A717273A8A9AE674DE2D904B9862B03B7615177D6A13F95D9EC0F0C01DB2982352C2B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\Potassium.exe.WebView2\EBWebView\Local State
Size 4KB
SHA256 b88883f2076f05fd8d309e8191c8f4ad3bf54bd2192e4f2ef5b5429b9c2bdf9a
MD5 70684843170e5ca1ff76990e861da23b
SHA1 400b9ddbb8c13444fe9b65ea6e1788a1b6fb214a
SHA512 b03716c4adc990b790d70d8a2e14dd8e086aecc65aa9d49aa9e0f52c28e3b95b74d6dde19dc981445aeb6b79e004cc4be6d91e307455d330cf98a5e3cffc2c13
SSDEEP 96:zugbNkCE8bkfjN3qag458Frh/cInURLl8DotoTM0DfBqZh6OQZj5iHlia:zBbNbLbGN3qVDoiDU4fpqZQkD
TLSH
T1AE91743664A9AE274DF2D945BA863B0377A05077D1A53FD9D9EC0F0C01DB2E91352C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\Potassium.exe.WebView2\EBWebView\Local State
Size 2KB
SHA256 b282b43d31d51ae5071e2bcef280499e14e4148395ce90a4e19eac1bf3bfb12c
MD5 d0a566f0f845dc961d1daf2424651b2f
SHA1 25d087d378fda5a322913abf144b3e2c6698ea85
SHA512 5adb674207c5e4c51ab4523c1085a91b80ed8da120284e8ad9bec40340b44903fcf2e75abb0d3dedcd9787617ea7edbec716f63ca1d50b9afdceb316fe71d8a5
TLSH
T1BD51B673A858AF7749E2C9047E563B13AB3151F596712F91A5EC070C00DA6AD2313C3B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe5afa6f.TMP

Path C:\Users\Admin\AppData\Local\Temp\Potassium.exe.WebView2\EBWebView\Local State~RFe5afa6f.TMP
Size 1KB
SHA256 a09ee20a166629703e12930a96c5d57e1cb47fa136b7d97f8be10ec632707448
MD5 ddbe846fc1431b18becebbfafe791308
SHA1 3330239cc4f1e97fcc326d2937e492d272d38ae5
SHA512 bfaf02cd9088f249349abc1f3f789c2a4097f48ec7eae61af4b25785538da9c268cd4d2109e0497f94eb9a79efa7d2df3aba6eee481ef884c5bcb8280f4cbfc4
TLSH
T1F22142B3D0D96FA669D5D44579227B473F2040BA82205E85F1ED030C05EB5DEA677C3B
MD5 SHA1 SHA512 TLSH

Submit Download

dd_dd_AspNetCoreSharedFramework___20260509110225.log

Path C:\Users\Admin\AppData\Local\Temp\dd_dd_AspNetCoreSharedFramework___20260509110225.log
Size 10KB
SHA256 eca851c7cc44fa4839d4ba3a9452b1401234ebd484f419a910800b836d32f49d
MD5 c91b9fc900e4aeb216bbd11f26709413
SHA1 52d25db6975d66761b33ce2bf177c535d0187b30
SHA512 bfbd7b9ec92bd8a474d89adeb6c322bafe5e839d0ffcfe1e147dd38a59a75b709c2e1b865cbdf36831f1e70f31826993667bad9fb651a31017e8f0e44094ba36
SSDEEP 96:FJ9sFJh5i1dNlKD29U8LM5mAqrv1diOv1diMmMWuqCkj4/mCYQ2oO7HdTvWXmrd+:585ixAqDBTaF7tBlLQj+PuSC9
TLSH
T19522536E71E73B133438D8B9E638A9BD6E7033192600567476EA876C0253C745F89377
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dd_dd_AspNetCoreSharedFramework___20260509110225_000_AspNetCoreSharedFramework_x64.log

Path C:\Users\Admin\AppData\Local\Temp\dd_dd_AspNetCoreSharedFramework___20260509110225_000_AspNetCoreSharedFramework_x64.log
Size 2KB
SHA256 36ce9cb7c3f0c79287e381021511242f47915b0e75f17d8218080928c819691a
MD5 245840fef65d349583aae1f945b5a630
SHA1 d777ce9cfb53f3361cc0e9efe3924971541bcf99
SHA512 a42d6ecc2a20e7dca391592f286f191a937476113d6ddc2583d85dc3659e038a9b806f29cddc51ffcafd12dc90a617184d11afdd714d2436d3f00d0aaeacd432
TLSH
T1CC411C591BE50D06B2B657479AF7C4636A33FCE27834CF4C2285831A066BD056C6877F
MD5 SHA1 SHA512 TLSH

Submit Download

dbf27539-0935-431b-a3a1-f979207b4190.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1924_1961330041\dbf27539-0935-431b-a3a1-f979207b4190.tmp
Size 147KB
SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
MD5 9c670f04d98ab7404f16423f6ee6cdfa
SHA1 8d01079b2d065731df8a7ef52f447cd4b7add353
SHA512 102cee76d9dfcfe91e044f529672fbec042b50c5db55a3cc137197b2013dd7f81e47f50dbb0db96cb621c5732610e1eb553c4146837c11075c7c4dbd67546a3b
SSDEEP 3072:F7R0M+jCozOtDTsjMcT0JnFjkbxnEbm/+OdGmlVVklFHEpCm+:F7WxxzyDTM0JnRkb5bJdGmJkvkpx+
TLSH
T12DE3E16D3DE6DE1FC41B58F53E64708BC80E8F0B820A644FB64988345A60B5D1BD6AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1924_680106840\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aspnetcore-runtime-8.0.26-win-x64.exe

Path C:\Users\Admin\Downloads\aspnetcore-runtime-8.0.26-win-x64.exe
Size 10.0MB
SHA256 2819e0c6731c1ae34944778499e3d3e1ca81ac3ca05cb1cb7d252350b8e7ac65
MD5 603620067fb08340ce7bad9395512a9a
SHA1 aec0dda330a4f30c84911130ea89b2b8796bb969
SHA512 0a72cefaf82d475e50630e5a994367b3aeebefe3ea1d20a586c0dd215c559860691219080f3f49f7816210d4dd55eb19e09e3cbcf29fffef0bf9473a5826e744
SSDEEP 196608:KgZ2q0xUxwiAj/XCndOt+vhS7jLRxs9r/uG1vE4Bb2odqFY/p0Xi+Jp:z2qEUe3SnmL73ArbTp2rYy73
TLSH
T14AB63331A6650022E7F50677AD18E5313E3CA2382B1499A6E7C8EC1D3F790D16BF7297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aspnetcore-runtime-8.0.26-win-x64.exe:Zone.Identifier

Path C:\Users\Admin\Downloads\aspnetcore-runtime-8.0.26-win-x64.exe:Zone.Identifier
Size 185B
SHA256 39962b125b4ccef222c1a08374679f8f5dedfedc8047ec6157bd0d5f37090772
MD5 78e38adbcebfffa27076a51fd865cef1
SHA1 06887cedca05cc8b379a3d13948b5d07bcf09a50
SHA512 577bd0390276385bdee3b577f21f04c56b3e6d75848694492fdd854967b2d9811310e8fb831ccb57dcbf3ae612f44769f9712430a8737561776d291bf28b2aa8
TLSH
T129C02293C80086034E1033830728F22DE20F22920580E3C88C8080E1D2430D5C1C5031
MD5 SHA1 SHA512 TLSH

Submit Download

MSI8C3D.tmp

Path C:\Windows\Installer\MSI8C3D.tmp
Size 219KB
SHA256 2bf33a9b9980e44d21d48f04cc6ac4eed4c68f207bd5990b7d3254a310b944ae
MD5 928f4b0fc68501395f93ad524a36148c
SHA1 084590b18957ca45b4a0d4576d1cc72966c3ea10
SHA512 7f2163f651693f9b73a67e90b5c820af060a23502667a5c32c3beb2d6b043f5459f22d61072a744089d622c05502d80f7485e0f86eb6d565ff711d5680512372
SSDEEP 3072:FVzl3qiEZybztEwiUx6D02cWVsV1v2vZR3X6j7zo6k2FkngTLrOrORT9flQnS6lg:FVIMEgXmEAR3oHon2VaFuG0eEp
TLSH
T1AF248D217494947EEAFA0832A57EDA71BF3DF2241760C8AEC3409D1E6D604C167B7B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e588aa0.msi

Path C:\Windows\Installer\e588aa0.msi
Size 26.2MB
SHA256 3c01cf2258660e926adaa2e5f223ee31b4644da0674d96c443fdbbe78d768386
MD5 cdbfc80b80cd60c32571eb1684ab6aad
SHA1 5e405716f38eb872f9f6b26add7ea324e8b7c40a
SHA512 e40c48f9825ce6a4f0e3970065eef90b5cb4e47e762451c0c3c589bb621e8aaebde6409d772a0098ac44e32b6322eb3a03db9edebc7a54add5eabf969e1a2f5d
SSDEEP 786432:PC2yKtSd/MlegbTYK5wZU2FwaQTh1UI16o:PC2CcegnBiear1
TLSH
T17C5733137C828A76D87A4E73903EC7722B3E6C104E64D90B8345B41DEDF25D11B7AADA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e588aa1.msi

Path C:\Windows\Installer\e588aa1.msi
Size 776KB
SHA256 3d6486f880876db959ee93f8e64071b1453b231d307e459be2d37589eb78690a
MD5 12990936661c6937403de5bf7e9db0aa
SHA1 c5818fd4fd102ab1321335a45ce1cbabe2701095
SHA512 eb7bfc242901cc38f67f75a38137e014b6ff1c0c1e74df4a92ccf9060abfd6d9aa3ec79df420670c4e6e0dc761b85ac9022dfcb2e7b572d3bf0e09dd9a519113
SSDEEP 12288:uolklSasc3V1EgXmEI3os2Qx7E4D4Rxbp4K+1uiq:uhlSC3Xdc3/7Rin+s
TLSH
T173F4AE237D80803AD9BA1D718579D7B16F3DBE204A64889B6380791DDDF11C0AF36BE6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e588ab5.msi

Path C:\Windows\Installer\e588ab5.msi
Size 29.1MB
SHA256 47639f4810fe717e364824dfbdee1363ad137b38afec6572a4b2889912dae7d4
MD5 74adb479635221a66bdc8fc523bb9684
SHA1 bd3f2296d5cb1b0120b1ab991eb7627dd153ad9b
SHA512 a40485bd9f5fa771c874008a929474eb9923695349ef95d975b588bfc58f50461ff12a256266d42b2407234b1060051566dca004f60290406ae7bc81bfc8bdc1
SSDEEP 786432:ixYxEGGISBU+OCp68m1rwTtJesgtNlf+AXYb6:iGWp1W4tszbLXY
TLSH
T192673313BC92E833D87A0EB1953AD7215E7E9D241B58C8DB6354B00DCDF16C09B78ADA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5136_156929188\manifest.json
Size 160B
SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
MD5 c3911ceb35539db42e5654bdd60ac956
SHA1 71be0751e5fc583b119730dbceb2c723f2389f6c
SHA512 d8b2c7c5b7105a6f0c4bc9c79c05b1202bc8deb90e60a037fec59429c04fc688a745ee1a0d06a8311466b4d14e2921dfb4476104432178c01df1e99deb48b331
TLSH
T1F1C08C73CC08AE7911B14B371B214642E3B8030B600039093A32084C0BA47B00262328
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5136_557429190\manifest.json
Size 135B
SHA256 cb929ae2d466e597ecc4f588ba22faf68f7cfc204b3986819c85ac608d6f82b5
MD5 4055ba4ebd5546fb6306d6a3151a236a
SHA1 609a989f14f8ee9ed9bffbd6ddba3214fd0d0109
SHA512 58d39f7ae0dafd067c6dba34c686506c1718112ad5af8a255eb9a7d6ec0edca318b557565f5914c5140eb9d1b6e2ffbb08c9d596f43e7a79fdb4ef95457bf29a
TLSH
T1CEC09223CC019CB119743B642AB2AB82F7B41B0B6869705A3AB3148C1F7E1B48082680
MD5 SHA1 SHA512 TLSH

Submit Download

logo.png

Path C:\Windows\Temp\{12896CB5-4BA0-4954-9667-4574B17EA72A}\.ba\logo.png
Size 12KB
SHA256 c8e23a42e04fbd73f5f66f3b9f2ba34a777bc4769c413a0f78335a4e757baad5
MD5 84709eb22e4b05688067699ca9b0d322
SHA1 7c3381d8b6a58087cda95577cc2d25e7aa2c21d8
SHA512 04de70b7317ee1cbde73ac0fe84bd70983cf0ff7e769e5f9626c69eaa6e3e9724c95b14ccb7a5478ee639848d3f8c98e4dec599cc5e33ad71de638da589ba319
SSDEEP 192:k4VwCaltyB5RgMq8RymiBg06po6jKeTvw:k4VzalIB5Rgh8YmiBg06W6jKKw
TLSH
T16F42C15EE9EE8248E52D065234DB6E1A997A4CEF2E9D66B2E1B57E340C303E30D47481
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wixstdba.dll

Path C:\Windows\Temp\{12896CB5-4BA0-4954-9667-4574B17EA72A}\.ba\wixstdba.dll
Size 190KB
SHA256 dcea15f3710822ffc262e62ec04cc7bbbf0f33f5d1a853609fbfb65cb6a45640
MD5 f1919c6bd85d7a78a70c228a5b227fbe
SHA1 71647ebf4e7bed3bc1663d520419ac550fe630ff
SHA512 c7ff9b19c9bf320454a240c6abbc382950176a6befce05ea73150eeb0085d0b6ed5b65b2dcb4b04621ef9cca1d5c4e59c6682b9c85d1d5845e5ce3e5eedfd2eb
SSDEEP 3072:sjEoXsLW9OLG8Qp51ySdjDXY33b+Av7O5IkI+/AYkPAEc527uu3k/gLtxavf0ir2:sjEo8LW9553hXWy15I2YrAW7FUVEihs3
TLSH
T1FF14AF1176D0A07AEBFB16307A39A5216E7DBA200FA0C9DF63449D2B1D715C19B36B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AspNetCoreSharedFramework_x64

Path C:\Windows\Temp\{12896CB5-4BA0-4954-9667-4574B17EA72A}\AspNetCoreSharedFramework_x64
Size 9.8MB
SHA256 3b57b7129f88d3566896ff768dc7de0e4040989e7a91cf0edc4655eb9f400ff9
MD5 024c73aa5ff6ef31ec457b9fa24ec310
SHA1 cf5c7b1b478f0fe464ef33bad3c9b5dd895b3879
SHA512 b5ba6cbc2ed46f44d39681651b25902aa971aa10c29cb86115afdd39a7788114f60c416fe8a9892d371a5e4fc5c9be8902ea864e644261fee4252516131c30f6
SSDEEP 196608:bSexkGUfk0jhnFgKt6zPkVnN1+Y+MNkfroHiFCpAZ7i:jx0j3ncPkd+J9fUHOaai
TLSH
T1A3A633277DA2843AD4A90D708A76CB606F3DBC344B50E5974380BA2DEDF11D05B77AE2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Windows\Temp\{8709644B-A6DE-4EB0-9BBA-48F569D85DD5}\.ba\1033\thm.wxl
Size 5KB
SHA256 81a68046b06e09385be8449373e7ceb9e79f7724c3cf11f0b18a4489a8d4926a
MD5 d5070cb3387a0a22b7046ae5ab53f371
SHA1 bc9da146a42bbf9496de059ac576869004702a97
SHA512 8fcf621fb9ce74725c3712e06e5b37b619145078491e828c6069e153359de3bd5486663b1fa6f3bcf1c994d5c556b9964ea1a1355100a634a6c700ef37d381e3
SSDEEP 96:MT0abTxmup/vrCKATQdYQHdYCwgoVOBq9LjP5dbSE7:OQNkdYQHdYCYXt7
TLSH
T1F1C1DBA778CF53C128731255EA925AAA5911C19C537F2DF4FC8B454B838A827A373F23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bg.png

Path C:\Windows\Temp\{8D6C2C87-9DAF-4161-91D0-1A9AC4B5CA25}\.ba\bg.png
Size 4KB
SHA256 9095bf7b6baa0107b40a4a6d727215be077133a190f4ca9bd89a176842141e79
MD5 9eb0320dfbf2bd541e6a55c01ddc9f20
SHA1 eb282a66d29594346531b1ff886d455e1dcd6d99
SHA512 9ada3a1757a493fbb004bd767fab8f77430af69d71479f340b8b8ede904cc94cd733700db593a4a2d2e1184c0081fd0648318d867128e1cb461021314990931d
SSDEEP 48:u+Xg+NXWbdlIr33lx9W5OstaDIy3r5XpPyvZKmXYTDeiByNxcaaaaaaaaaaaaaaE:AaXWPIrHT932JsdpPyjqDeioatEn
TLSH
T19891B4D8FCF95322C6002BF255F4C0735A0215B713ABFEC82F496BD90E6878E25058B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

windowsdesktop-runtime-8.0.26-win-x64.exe

Path C:\Windows\Temp\{8D6C2C87-9DAF-4161-91D0-1A9AC4B5CA25}\.be\windowsdesktop-runtime-8.0.26-win-x64.exe
Size 608KB
SHA256 0466d1a58a3e98e8073b387f2f070734cce7139b84cea18540a2f39871a3176d
MD5 7f3f8d277180f185bfac2a880e6b132d
SHA1 4692da04d56aa7e8d97273c6be4e2dd4b2b3d102
SHA512 932ddc39cfd881aced78e66935df2a2a8313d1984d51823043d3fc5db697fa2b71482f4c73ebd07774efefbf967c912b865e3df14b26265f89b083f5d7e6d09d
SSDEEP 12288:cmEsd9PZfePv3xl7ft7V+6uC+zd5qLlN13wzjauQZrDnmp:cm39PZfePv3r7fm6t+jqp33aQh
TLSH
T16FD47D32A5614032E7F10673B928D6303E3CE328275488AAE7D4AD1D7EB84D667F7257
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.xml

Path C:\Windows\Temp\{B402ADDE-9375-4E41-BC03-33747B5C6DFB}\.ba\thm.xml
Size 11KB
SHA256 83ca096f7ba2c83fc3b3aeb697b8139a788fa35eb8632943e26bb9fff7c78e63
MD5 302563a713b142ee41b59e3eeac53a90
SHA1 1340e90cc3c6c5fc19a7feb61d7779f4a4f0fdb5
SHA512 c9d4dfc20802bb542178300d1044bb94b35593b834ab0b50875a32953f890e48da456199128500e2c1fee26eaaf8c2c4fcaffb308b37914215f900cdd5c4cbc8
SSDEEP 96:eCdhlFGZRd4UyAi0Rz96zYFGiRdl6dXXdT9gUoLNEmRG3QBinRFRK03K8+GGI9ki:eCSfiozEW/A
TLSH
T1A2325BA986DE7C00D232E711ABF271D6AF126862C4C46E58F94C39BB4FE25406C7727D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Windows\Temp\{F0A19C65-0D0F-46CE-9B09-1605368AC58B}\.ba\thm.wxl
Size 4KB
SHA256 65507ddc6f2ab2a93b684684ba1d69fdf0b024296367cdce5dad31d5e49813d0
MD5 d4226d322e0a676476db291ab59c0cd1
SHA1 572f5e80c1b56aadfb15e227d96fb4b6fea47ce9
SHA512 b69e606d117785412744c131e9559c597d5efbb0b38b97f1369b11f39efd5330c7918369d6825a8f2a4a1490cd4a076981f0008621fbc28c08278481e6d74810
SSDEEP 96:JTNREsRDTxmupv9/KATZgoVOBq9Lr878U:zvNDW7R
TLSH
T18C91AA63B8CB27D1287361A4EE9195B95911D09C823B2CF4FC47454B838E927A3B3F67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aspnetcore-runtime-8.0.26-win-x64.exe

Path C:\Windows\Temp\{FF66EE6C-8C3E-4253-99ED-A4DD21E85EB9}\.cr\aspnetcore-runtime-8.0.26-win-x64.exe
Size 589KB
SHA256 4eecc518c865e68838162dba37c7883c3cd8b9cb0d7a17bc649a554535e5d51a
MD5 213cbe07ed3f689b1c8620bc0a9bf49b
SHA1 737b918145da73c77855ba7507995cc80e2ee598
SHA512 d9e8fa928668bcfb2a5a899c84dc27ae647367baf042f894d02f3c8c87cbe1dea5e755d3bab6c14285b2d65d8ffc09a3ea40d325bcba6b6ad5e3d091195edd89
SSDEEP 12288:omEsd9PZfePv3xl7ft7V+6uC+zd5qLliP+woCYJjsXs8Ng2:om39PZfePv3r7fm6t+jqpi+SsU
TLSH
T117D47C32A5614032E7F10673B968D6303E3CE328275488AAE7D4AD1D7EB84D667F7253
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/424-2222-0x0000000000190000-0x0000000000206000-memory.dmp

Download

memory/836-2296-0x0000000003210000-0x0000000003270000-memory.dmp

Download

memory/836-2303-0x0000000003210000-0x0000000003270000-memory.dmp

Download

memory/1696-961-0x00000263B1FF0000-0x00000263B2021000-memory.dmp

Download

memory/1992-2221-0x0000000000190000-0x0000000000206000-memory.dmp

Download

memory/2024-976-0x000001B3EA2B0000-0x000001B3EA2BC000-memory.dmp

Download

memory/2024-977-0x000001B3EA2D0000-0x000001B3EA2D9000-memory.dmp

Download

memory/2480-104-0x0000026795490000-0x0000026795499000-memory.dmp

Download

memory/2480-103-0x0000026793E20000-0x0000026793E51000-memory.dmp

Download

memory/2540-2211-0x0000000000190000-0x0000000000206000-memory.dmp

Download

memory/2648-2212-0x0000000000190000-0x0000000000206000-memory.dmp

Download

memory/3084-1338-0x0000023E37760000-0x0000023E37791000-memory.dmp

Download

memory/3356-570-0x000001F064450000-0x000001F064481000-memory.dmp

Download

memory/3372-980-0x000001ADC4740000-0x000001ADC4771000-memory.dmp

Download

memory/3692-2206-0x0000000000190000-0x0000000000206000-memory.dmp

Download

memory/3884-992-0x00000201A1420000-0x00000201A1451000-memory.dmp

Download

memory/3920-0-0x000002BEE9160000-0x000002BEE9191000-memory.dmp

Download

memory/5356-2219-0x0000000000190000-0x0000000000206000-memory.dmp

Download

memory/5584-2375-0x0000016500CA0000-0x0000016501040000-memory.dmp

Download

memory/5584-2371-0x0000016500CA0000-0x0000016501040000-memory.dmp

Download

memory/5584-2350-0x0000016500CA0000-0x0000016501040000-memory.dmp

Download

memory/5584-2343-0x0000016500CA0000-0x0000016501040000-memory.dmp

Download

memory/5584-2347-0x0000016500CA0000-0x0000016501040000-memory.dmp

Download

memory/5584-2348-0x0000016500CA0000-0x0000016501040000-memory.dmp

Download

memory/5584-2346-0x0000016500CA0000-0x0000016501040000-memory.dmp

Download

memory/5584-2344-0x0000016500CA0000-0x0000016501040000-memory.dmp

Download

memory/5584-2345-0x0000016500CA0000-0x0000016501040000-memory.dmp

Download

memory/5584-2338-0x0000016500CA0000-0x0000016501040000-memory.dmp

Download

memory/5584-2352-0x0000016500CA0000-0x0000016501040000-memory.dmp

Download

memory/5584-2351-0x0000016500CA0000-0x0000016501040000-memory.dmp

Download

memory/5584-2353-0x0000016500CA0000-0x0000016501040000-memory.dmp

Download

memory/5584-2334-0x0000016500CA0000-0x0000016501040000-memory.dmp

Download

memory/5584-2362-0x0000016500CA0000-0x0000016501040000-memory.dmp

Download

memory/5584-2363-0x0000016500CA0000-0x0000016501040000-memory.dmp

Download

memory/5584-2364-0x0000016500CA0000-0x0000016501040000-memory.dmp

Download

memory/5584-2361-0x0000016500CA0000-0x0000016501040000-memory.dmp

Download

memory/5584-2366-0x0000016500CA0000-0x0000016501040000-memory.dmp

Download

memory/5584-2365-0x0000016500CA0000-0x0000016501040000-memory.dmp

Download

memory/5584-2368-0x0000016500CA0000-0x0000016501040000-memory.dmp

Download

memory/5584-2370-0x0000016500CA0000-0x0000016501040000-memory.dmp

Download

memory/5584-2367-0x0000016500CA0000-0x0000016501040000-memory.dmp

Download

memory/5584-2349-0x0000016500CA0000-0x0000016501040000-memory.dmp

Download

memory/5584-2369-0x0000016500CA0000-0x0000016501040000-memory.dmp

Download

memory/5584-2372-0x0000016500CA0000-0x0000016501040000-memory.dmp

Download

memory/5584-2335-0x0000016500CA0000-0x0000016501040000-memory.dmp

Download

memory/5584-2373-0x0000016500CA0000-0x0000016501040000-memory.dmp

Download

memory/5584-2374-0x0000016500CA0000-0x0000016501040000-memory.dmp

Download

memory/5584-2377-0x0000016500CA0000-0x0000016501040000-memory.dmp

Download

memory/5584-2376-0x0000016500CA0000-0x0000016501040000-memory.dmp

Download

memory/5584-2379-0x0000016500CA0000-0x0000016501040000-memory.dmp

Download

memory/5584-2336-0x0000016500CA0000-0x0000016501040000-memory.dmp

Download

memory/5584-2337-0x0000016500CA0000-0x0000016501040000-memory.dmp

Download

memory/5584-2339-0x0000016500CA0000-0x0000016501040000-memory.dmp

Download

memory/5584-2340-0x0000016500CA0000-0x0000016501040000-memory.dmp

Download

memory/5584-2341-0x0000016500CA0000-0x0000016501040000-memory.dmp

Download

memory/5584-2342-0x0000016500CA0000-0x0000016501040000-memory.dmp

Download

memory/5584-2355-0x0000016500CA0000-0x0000016501040000-memory.dmp

Download

memory/5584-2356-0x0000016500CA0000-0x0000016501040000-memory.dmp

Download

memory/5584-2357-0x0000016500CA0000-0x0000016501040000-memory.dmp

Download

memory/5584-2358-0x0000016500CA0000-0x0000016501040000-memory.dmp

Download

memory/5584-2359-0x0000016500CA0000-0x0000016501040000-memory.dmp

Download

memory/5584-2360-0x0000016500CA0000-0x0000016501040000-memory.dmp

Download

memory/5584-2354-0x0000016500CA0000-0x0000016501040000-memory.dmp

Download

memory/5584-2314-0x0000016500CA0000-0x0000016501040000-memory.dmp

Download