hijackloader | hxxps://soft[.]addictionandart[.]org/avental/

Analysis

user interaction
yes
max time kernel
125s
max time network
126s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
22/05/2026, 14:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://soft.addictionandart.org/avental/
Sample260522-scdplag16v

Score

10^/10

backdoor discovery hijackloader snappyclient loader spyware stealer

Malware Config

Extracted

Family

hijackloader

Attributes

directory
%APPDATA%\ORCLHeap
inject_dll
%windir%\SysWOW64\input.dll

xor.hex

Extracted

Family

snappyclient

Attributes

additional_fields
false
buildID
main
cache_directory
naijaco
default_directory
%ALLUSERSPROFILE%\Mayanex
directory
Nata
events_db
Jifexabo
keylogger_file
Kapuq
shared_memory
true
software_db
Mitonico
tag
new

Signatures

Family: HijackLoader, IDAT loader, Ghostulse,
HijackLoader is a multi-stage loader, first seen in 2023.
loader hijackloader
Family: SnappyClient
SnappyClient is a C2 framework with information stealing capabilities, written in C++.
backdoor stealer snappyclient

Detects HijackLoader (aka IDAT Loader) 1 IoCs

resource	yara_rule
behavioral1/files/0x000f00000002bb72-612.dat	family_hijackloader

Suspicious use of NtCreateProcessExOtherParentProcess 6 IoCs

description	pid	Process	procid_target
PID 3724 created 944	3724	NaRouter86.exe	196
PID 3724 created 944	3724	NaRouter86.exe	196
PID 3724 created 944	3724	NaRouter86.exe	196
PID 3724 created 3024	3724	NaRouter86.exe	80
PID 3724 created 3024	3724	NaRouter86.exe	80
PID 3724 created 3024	3724	NaRouter86.exe	80

Executes dropped EXE 1 IoCs

pid	Process
4376	P_Lattic.exe

Loads dropped DLL 8 IoCs

pid	Process
4376	P_Lattic.exe
4376	P_Lattic.exe
4376	P_Lattic.exe
4376	P_Lattic.exe
2004	MeProfiler32.exe
3724	NaRouter86.exe
2416	Crisp.exe
3900	Crisp.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Contacts third-party web service commonly abused for C2 1 TTPs 5 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
173	camo.githubusercontent.com
169	camo.githubusercontent.com
170	camo.githubusercontent.com
171	camo.githubusercontent.com
172	camo.githubusercontent.com

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
3724	NaRouter86.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 4376 set thread context of 2004	4376	P_Lattic.exe	191
PID 2016 set thread context of 3724	2016	𝗦𝗘𝗧𝗨𝗣.exe	192
PID 4376 set thread context of 2416	4376	P_Lattic.exe	194
PID 2016 set thread context of 3900	2016	𝗦𝗘𝗧𝗨𝗣.exe	195

Drops file in Windows directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3024_1611457961\manifest.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3024_1134994811\manifest.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3024_1821522555\manifest.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3024_1611457961\nav_config.json	msedge.exe
File created	C:\Windows\Tasks\data_messenger_i386_dev.job	Crisp.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3024_1821522555\protocols.json	msedge.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4576	sc.exe
1980	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Crisp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	𝗦𝗘𝗧𝗨𝗣.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	P_Lattic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MeProfiler32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Crisp.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 4 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2672	cmd.exe
1284	PING.EXE
4112	cmd.exe
1680	PING.EXE

System Time Discovery 1 TTPs 4 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3428	msedge.exe
5344	chrome.exe
5200	chrome.exe
6056	msedge.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	NaRouter86.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	NaRouter86.exe

Enumerates system info in registry 2 TTPs 12 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134239355262949813"	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2824035265-2271499813-2042964211-1000\{E352C77A-83A4-4B87-B219-97DA86F05B9C}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings	msedge.exe

Modifies registry key 1 TTPs 7 IoCs

Modify Registry

T1112

pid	Process
232	reg.exe
4756	reg.exe
4608	reg.exe
2416	reg.exe
4608	reg.exe
6512	reg.exe
492	reg.exe

NTFS ADS 11 IoCs

description	ioc	Process
File created	C:\ProgramData\WNQT_net35_dbg\driver-reg.so\:Zone.Identifier:$DATA	𝗦𝗘𝗧𝗨𝗣.exe
File created	C:\ProgramData\WNQT_net35_dbg\madDisAsm_.bpl\:Zone.Identifier:$DATA	𝗦𝗘𝗧𝗨𝗣.exe
File created	C:\ProgramData\WNQT_net35_dbg\msvcp_win.dll\:Zone.Identifier:$DATA	𝗦𝗘𝗧𝗨𝗣.exe
File created	C:\ProgramData\WNQT_net35_dbg\rtl120.bpl\:Zone.Identifier:$DATA	𝗦𝗘𝗧𝗨𝗣.exe
File created	C:\ProgramData\WNQT_net35_dbg\ucrtbase.dll\:Zone.Identifier:$DATA	𝗦𝗘𝗧𝗨𝗣.exe
File opened for modification	C:\Users\Admin\Downloads\Installer_L_X64_x86_2024.zip:Zone.Identifier	msedge.exe
File created	C:\ProgramData\WNQT_net35_dbg\madBasic_.bpl\:Zone.Identifier:$DATA	𝗦𝗘𝗧𝗨𝗣.exe
File created	C:\ProgramData\WNQT_net35_dbg\madExcept_.bpl\:Zone.Identifier:$DATA	𝗦𝗘𝗧𝗨𝗣.exe
File created	C:\ProgramData\WNQT_net35_dbg\vcl120.bpl\:Zone.Identifier:$DATA	𝗦𝗘𝗧𝗨𝗣.exe
File created	C:\ProgramData\WNQT_net35_dbg\Zip.dll\:Zone.Identifier:$DATA	𝗦𝗘𝗧𝗨𝗣.exe
File created	C:\ProgramData\WNQT_net35_dbg\parserlib.dump\:Zone.Identifier:$DATA	𝗦𝗘𝗧𝗨𝗣.exe

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
1284	PING.EXE
1680	PING.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2004	MeProfiler32.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2016	𝗦𝗘𝗧𝗨𝗣.exe
2016	𝗦𝗘𝗧𝗨𝗣.exe
2016	𝗦𝗘𝗧𝗨𝗣.exe
4376	P_Lattic.exe
4376	P_Lattic.exe
4376	P_Lattic.exe
2316	powershell.exe
2316	powershell.exe
2316	powershell.exe
2016	𝗦𝗘𝗧𝗨𝗣.exe
2016	𝗦𝗘𝗧𝗨𝗣.exe
2016	𝗦𝗘𝗧𝗨𝗣.exe
4756	powershell.exe
4756	powershell.exe
4756	powershell.exe
4376	P_Lattic.exe
4376	P_Lattic.exe
4376	P_Lattic.exe
2004	MeProfiler32.exe
2004	MeProfiler32.exe
2004	MeProfiler32.exe
2004	MeProfiler32.exe
2004	MeProfiler32.exe
2004	MeProfiler32.exe
2004	MeProfiler32.exe
2004	MeProfiler32.exe
3724	NaRouter86.exe
3724	NaRouter86.exe
3724	NaRouter86.exe
3724	NaRouter86.exe
3724	NaRouter86.exe
3724	NaRouter86.exe
2416	Crisp.exe
2416	Crisp.exe
2416	Crisp.exe
3900	Crisp.exe
3900	Crisp.exe
3900	Crisp.exe
3724	NaRouter86.exe
3724	NaRouter86.exe
3724	NaRouter86.exe
3724	NaRouter86.exe
3724	NaRouter86.exe
944	chrome.exe
944	chrome.exe
3724	NaRouter86.exe
3724	NaRouter86.exe
3724	NaRouter86.exe
3724	NaRouter86.exe
3724	NaRouter86.exe
3724	NaRouter86.exe
3724	NaRouter86.exe
3724	NaRouter86.exe
3724	NaRouter86.exe
3724	NaRouter86.exe
3724	NaRouter86.exe
3724	NaRouter86.exe
3724	NaRouter86.exe
3724	NaRouter86.exe
3724	NaRouter86.exe
3724	NaRouter86.exe
3724	NaRouter86.exe
3724	NaRouter86.exe
3724	NaRouter86.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2004	MeProfiler32.exe

Suspicious behavior: MapViewOfSection 4 IoCs

pid	Process
4376	P_Lattic.exe
2016	𝗦𝗘𝗧𝗨𝗣.exe
4376	P_Lattic.exe
2016	𝗦𝗘𝗧𝗨𝗣.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 32 IoCs

pid	Process
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
944	chrome.exe
944	chrome.exe
944	chrome.exe
4448	msedge.exe
4448	msedge.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4288	chrome.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeDebugPrivilege	2316	powershell.exe
Token: SeDebugPrivilege	4756	powershell.exe
Token: SeDebugPrivilege	3724	NaRouter86.exe
Token: SeShutdownPrivilege	944	chrome.exe
Token: SeCreatePagefilePrivilege	944	chrome.exe
Token: SeShutdownPrivilege	944	chrome.exe
Token: SeCreatePagefilePrivilege	944	chrome.exe
Token: SeShutdownPrivilege	4288	chrome.exe
Token: SeCreatePagefilePrivilege	4288	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
944	chrome.exe
944	chrome.exe
944	chrome.exe
944	chrome.exe
944	chrome.exe
944	chrome.exe
944	chrome.exe
944	chrome.exe
944	chrome.exe
944	chrome.exe
944	chrome.exe
944	chrome.exe
944	chrome.exe
944	chrome.exe
944	chrome.exe
944	chrome.exe
944	chrome.exe
944	chrome.exe
944	chrome.exe
944	chrome.exe
944	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3024 wrote to memory of 3340	3024	msedge.exe	81
PID 3024 wrote to memory of 3428	3024	msedge.exe	82
PID 3024 wrote to memory of 4772	3024	msedge.exe	84
PID 3024 wrote to memory of 4772	3024	msedge.exe	84
PID 3024 wrote to memory of 3472	3024	msedge.exe	83
PID 3024 wrote to memory of 3472	3024	msedge.exe	83
PID 3024 wrote to memory of 3472	3024	msedge.exe	83
PID 3024 wrote to memory of 4676	3024	msedge.exe	86
PID 3024 wrote to memory of 5040	3024	msedge.exe	87
PID 3024 wrote to memory of 4676	3024	msedge.exe	86
PID 3024 wrote to memory of 4676	3024	msedge.exe	86
PID 3024 wrote to memory of 5040	3024	msedge.exe	87
PID 3024 wrote to memory of 5040	3024	msedge.exe	87
PID 3024 wrote to memory of 2672	3024	msedge.exe	89
PID 3024 wrote to memory of 1892	3024	msedge.exe	90
PID 3024 wrote to memory of 2672	3024	msedge.exe	89
PID 3024 wrote to memory of 2672	3024	msedge.exe	89
PID 3024 wrote to memory of 2108	3024	msedge.exe	91
PID 3024 wrote to memory of 4608	3024	msedge.exe	92
PID 3024 wrote to memory of 1892	3024	msedge.exe	90
PID 3024 wrote to memory of 1892	3024	msedge.exe	90
PID 3024 wrote to memory of 2108	3024	msedge.exe	91
PID 3024 wrote to memory of 2108	3024	msedge.exe	91
PID 3024 wrote to memory of 4608	3024	msedge.exe	92
PID 3024 wrote to memory of 4608	3024	msedge.exe	92
PID 3024 wrote to memory of 2088	3024	msedge.exe	93
PID 3024 wrote to memory of 2088	3024	msedge.exe	93
PID 3024 wrote to memory of 2396	3024	msedge.exe	95
PID 3024 wrote to memory of 2396	3024	msedge.exe	95
PID 3024 wrote to memory of 4136	3024	msedge.exe	96
PID 3024 wrote to memory of 4136	3024	msedge.exe	96
PID 3024 wrote to memory of 1752	3024	msedge.exe	97
PID 3024 wrote to memory of 1752	3024	msedge.exe	97
PID 3024 wrote to memory of 4416	3024	msedge.exe	99
PID 3024 wrote to memory of 816	3024	msedge.exe	100
PID 816 wrote to memory of 3736	816	msedge.exe	101
PID 3024 wrote to memory of 5092	3024	msedge.exe	102
PID 3024 wrote to memory of 5092	3024	msedge.exe	102
PID 3024 wrote to memory of 1284	3024	msedge.exe	103
PID 3024 wrote to memory of 1284	3024	msedge.exe	103
PID 3024 wrote to memory of 5100	3024	msedge.exe	107
PID 3024 wrote to memory of 1096	3024	msedge.exe	106
PID 3024 wrote to memory of 5100	3024	msedge.exe	107
PID 3024 wrote to memory of 1096	3024	msedge.exe	106
PID 3024 wrote to memory of 4688	3024	msedge.exe	108
PID 3024 wrote to memory of 4688	3024	msedge.exe	108
PID 3024 wrote to memory of 5096	3024	msedge.exe	109
PID 3024 wrote to memory of 5096	3024	msedge.exe	109
PID 3024 wrote to memory of 5096	3024	msedge.exe	109
PID 3024 wrote to memory of 3300	3024	msedge.exe	110
PID 3024 wrote to memory of 3300	3024	msedge.exe	110
PID 3024 wrote to memory of 1288	3024	msedge.exe	111
PID 3024 wrote to memory of 1288	3024	msedge.exe	111
PID 3024 wrote to memory of 1288	3024	msedge.exe	111
PID 3024 wrote to memory of 768	3024	msedge.exe	112
PID 3024 wrote to memory of 3064	3024	msedge.exe	114
PID 3024 wrote to memory of 4112	3024	msedge.exe	115
PID 3024 wrote to memory of 5016	3024	msedge.exe	116
PID 2016 wrote to memory of 4376	2016	𝗦𝗘𝗧𝗨𝗣.exe	119
PID 4376 wrote to memory of 1320	4376	P_Lattic.exe	120
PID 1320 wrote to memory of 4372	1320	cmd.exe	122
PID 4372 wrote to memory of 1460	4372	cmd.exe	124
PID 1460 wrote to memory of 4576	1460	cmd.exe	126
PID 1460 wrote to memory of 1912	1460	cmd.exe	127

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://soft.addictionandart.org/avental/
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x260,0x7ffad901c188,0x7ffad901c194,0x7ffad901c1a0
  2⤵
  PID:3340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1828,i,7962895965609135720,8753891973814083075,524288 --field-trial-handle=2400,i,15652754510953875196,15951861803588457028,262144 --variations-seed-version --mojo-platform-channel-handle=2452 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1632,i,17104474148678836556,2412621598644216658,262144 --field-trial-handle=2400,i,15652754510953875196,15951861803588457028,262144 --variations-seed-version --mojo-platform-channel-handle=2396 /prefetch:2
  2⤵
  PID:3472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2424,i,90378882810792540,11303895063583249083,524288 --field-trial-handle=2400,i,15652754510953875196,15951861803588457028,262144 --variations-seed-version --mojo-platform-channel-handle=3124 /prefetch:13
  2⤵
  PID:4772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3532,i,8410216742552623090,2518763431086008204,2097152 --field-trial-handle=2400,i,15652754510953875196,15951861803588457028,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:1
  2⤵
  PID:4676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3548,i,6534522572269539036,1952560429057989040,2097152 --field-trial-handle=2400,i,15652754510953875196,15951861803588457028,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:1
  2⤵
  PID:5040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4200,i,17830287770769368710,13084148307961498577,2097152 --field-trial-handle=2400,i,15652754510953875196,15951861803588457028,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:1
  2⤵
  PID:2672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4212,i,8049430952487260221,3044978995823948614,2097152 --field-trial-handle=2400,i,15652754510953875196,15951861803588457028,262144 --variations-seed-version --mojo-platform-channel-handle=4248 /prefetch:9
  2⤵
  PID:1892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4272,i,13043408588262399720,13871933726992447030,2097152 --field-trial-handle=2400,i,15652754510953875196,15951861803588457028,262144 --variations-seed-version --mojo-platform-channel-handle=4360 /prefetch:1
  2⤵
  PID:2108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4264,i,2980536128572859470,9052157072773777404,2097152 --field-trial-handle=2400,i,15652754510953875196,15951861803588457028,262144 --variations-seed-version --mojo-platform-channel-handle=4380 /prefetch:9
  2⤵
  PID:4608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4456,i,2895901572846851457,15076301238570636581,524288 --field-trial-handle=2400,i,15652754510953875196,15951861803588457028,262144 --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:14
  2⤵
  PID:2088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5552,i,9222355189262753154,15322757977611602555,524288 --field-trial-handle=2400,i,15652754510953875196,15951861803588457028,262144 --variations-seed-version --mojo-platform-channel-handle=5540 /prefetch:14
  2⤵
  PID:2396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5348,i,18206164008073178009,1598467037453753088,524288 --field-trial-handle=2400,i,15652754510953875196,15951861803588457028,262144 --variations-seed-version --mojo-platform-channel-handle=5492 /prefetch:14
  2⤵
  PID:4136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5476,i,4568679566780014884,7661359219837649006,524288 --field-trial-handle=2400,i,15652754510953875196,15951861803588457028,262144 --variations-seed-version --mojo-platform-channel-handle=4472 /prefetch:14
  2⤵
  PID:1752
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6096,i,12256276262917300342,5315569954553966477,524288 --field-trial-handle=2400,i,15652754510953875196,15951861803588457028,262144 --variations-seed-version --mojo-platform-channel-handle=6184 /prefetch:14
  2⤵
  PID:1680
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6096,i,12256276262917300342,5315569954553966477,524288 --field-trial-handle=2400,i,15652754510953875196,15951861803588457028,262144 --variations-seed-version --mojo-platform-channel-handle=6184 /prefetch:14
  2⤵
  PID:4416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6352,i,5375586320292762223,7008519425185220096,524288 --field-trial-handle=2400,i,15652754510953875196,15951861803588457028,262144 --variations-seed-version --mojo-platform-channel-handle=6360 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:816
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1132
    3⤵
    PID:3736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6444,i,6998624689489378276,2955082372485036263,524288 --field-trial-handle=2400,i,15652754510953875196,15951861803588457028,262144 --variations-seed-version --mojo-platform-channel-handle=6492 /prefetch:14
  2⤵
  PID:5092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6696,i,5146754601514140170,2163064032361138730,524288 --field-trial-handle=2400,i,15652754510953875196,15951861803588457028,262144 --variations-seed-version --mojo-platform-channel-handle=6700 /prefetch:14
  2⤵
  PID:1284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6864,i,9513103590750631477,16180399163595561409,524288 --field-trial-handle=2400,i,15652754510953875196,15951861803588457028,262144 --variations-seed-version --mojo-platform-channel-handle=6868 /prefetch:14
  2⤵
  PID:1096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6844,i,12178279929622711607,2048092068681941877,524288 --field-trial-handle=2400,i,15652754510953875196,15951861803588457028,262144 --variations-seed-version --mojo-platform-channel-handle=6444 /prefetch:14
  2⤵
  PID:5100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6856,i,15658310808741774821,4363821754903125892,524288 --field-trial-handle=2400,i,15652754510953875196,15951861803588457028,262144 --variations-seed-version --mojo-platform-channel-handle=7024 /prefetch:14
  2⤵
  PID:4688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=6944,i,6578640753054212258,16743779331663070169,2097152 --field-trial-handle=2400,i,15652754510953875196,15951861803588457028,262144 --variations-seed-version --mojo-platform-channel-handle=6972 /prefetch:1
  2⤵
  PID:5096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6800,i,11947850919366367656,15590545131662372129,524288 --field-trial-handle=2400,i,15652754510953875196,15951861803588457028,262144 --variations-seed-version --mojo-platform-channel-handle=6848 /prefetch:14
  2⤵
  PID:3300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=4372,i,14290040288524749048,6307766086931598112,2097152 --field-trial-handle=2400,i,15652754510953875196,15951861803588457028,262144 --variations-seed-version --mojo-platform-channel-handle=6992 /prefetch:1
  2⤵
  PID:1288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7220,i,13726391085582807378,1437181490552964796,524288 --field-trial-handle=2400,i,15652754510953875196,15951861803588457028,262144 --variations-seed-version --mojo-platform-channel-handle=7308 /prefetch:14
  2⤵
  - NTFS ADS
  PID:768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6196,i,37827235182908327,232628016925844244,524288 --field-trial-handle=2400,i,15652754510953875196,15951861803588457028,262144 --variations-seed-version --mojo-platform-channel-handle=6240 /prefetch:14
  2⤵
  PID:3064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4268,i,16538750894112562302,8512782082072124743,524288 --field-trial-handle=2400,i,15652754510953875196,15951861803588457028,262144 --variations-seed-version --mojo-platform-channel-handle=6232 /prefetch:14
  2⤵
  PID:4112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4328,i,677605168133270510,10358992133354269028,524288 --field-trial-handle=2400,i,15652754510953875196,15951861803588457028,262144 --variations-seed-version --mojo-platform-channel-handle=4496 /prefetch:14
  2⤵
  PID:5016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4416,i,6687270901752581474,2509454279561505027,524288 --field-trial-handle=2400,i,15652754510953875196,15951861803588457028,262144 --variations-seed-version --mojo-platform-channel-handle=6792 /prefetch:14
  2⤵
  PID:2316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6348,i,17990070339551470705,6964062908342542785,524288 --field-trial-handle=2400,i,15652754510953875196,15951861803588457028,262144 --variations-seed-version --mojo-platform-channel-handle=1904 /prefetch:14
  2⤵
  PID:2628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5688,i,6852536417192899022,8237814933322648011,524288 --field-trial-handle=2400,i,15652754510953875196,15951861803588457028,262144 --variations-seed-version --mojo-platform-channel-handle=2784 /prefetch:14
  2⤵
  PID:5988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=756,i,3819707140794967564,8955285201617443837,2097152 --field-trial-handle=2400,i,15652754510953875196,15951861803588457028,262144 --variations-seed-version --mojo-platform-channel-handle=760 /prefetch:1
  2⤵
  PID:6396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=4980,i,17975569012196717042,10436731005098247558,2097152 --field-trial-handle=2400,i,15652754510953875196,15951861803588457028,262144 --variations-seed-version --mojo-platform-channel-handle=5412 /prefetch:1
  2⤵
  PID:6676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=5568,i,12863449721293400708,16763122609132305916,2097152 --field-trial-handle=2400,i,15652754510953875196,15951861803588457028,262144 --variations-seed-version --mojo-platform-channel-handle=5912 /prefetch:1
  2⤵
  PID:5648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6712,i,1510029562783435513,17016875731700442117,524288 --field-trial-handle=2400,i,15652754510953875196,15951861803588457028,262144 --variations-seed-version --mojo-platform-channel-handle=4968 /prefetch:14
  2⤵
  PID:6160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5584,i,9212103525211110024,874303438655815506,262144 --field-trial-handle=2400,i,15652754510953875196,15951861803588457028,262144 --variations-seed-version --mojo-platform-channel-handle=7208 /prefetch:10
  2⤵
  PID:6656

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1252

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5016

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:72

C:\Users\Admin\Downloads\Installer_L_X64_x86_2024\#Pa$$w0rD__2024--0peɴ_Set-Up!\𝗦𝗘𝗧𝗨𝗣.exe
"C:\Users\Admin\Downloads\Installer_L_X64_x86_2024\#Pa$$w0rD__2024--0peɴ_Set-Up!\𝗦𝗘𝗧𝗨𝗣.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2016
- C:\Users\Admin\AppData\Roaming\WNQT_net35_dbg\QMITTTECRITKKNKY\P_Lattic.exe
  C:\Users\Admin\AppData\Roaming\WNQT_net35_dbg\QMITTTECRITKKNKY\P_Lattic.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:4376
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c start /min "" "C:\Users\Admin\AppData\Roaming\ORCLHeap\NZMEQTLUQSR\123.cmd"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1320
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Roaming\ORCLHeap\NZMEQTLUQSR\123.cmd"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4372
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\Sysnative\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\ORCLHeap\NZMEQTLUQSR\123.cmd" re1"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1460
      - C:\Windows\System32\sc.exe
        
        sc query Null
        6⤵
        Launches sc.exe
        
        PID:4576
      - C:\Windows\System32\find.exe
        
        find /i "RUNNING"
        6⤵
        
        PID:1912
      - C:\Windows\System32\findstr.exe
        
        findstr /v "$" "123.cmd"
        6⤵
        
        PID:4048
      - C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c ver
        6⤵
        
        PID:2892
      - C:\Windows\System32\reg.exe
        
        reg query "HKCU\Console" /v ForceV2
        6⤵
        
        PID:4788
      - C:\Windows\System32\find.exe
        
        find /i "0x0"
        6⤵
        
        PID:2996
      - C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /S /D /c" echo "AMD64 " "
        6⤵
        
        PID:1556
      - C:\Windows\System32\find.exe
        
        find /i "ARM64"
        6⤵
        
        PID:3796
      - C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c echo prompt $E | cmd
        6⤵
        
        PID:4640
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /S /D /c" echo prompt $E "
        7⤵
        
        PID:5020
        
        C:\Windows\System32\cmd.exe
        
        cmd
        7⤵
        
        PID:2004
      - C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /S /D /c" echo "C:\Users\Admin\AppData\Roaming\ORCLHeap\NZMEQTLUQSR\123.cmd" "
        6⤵
        
        PID:3180
      - C:\Windows\System32\find.exe
        
        find /i "C:\Users\Admin\AppData\Local\Temp"
        6⤵
        
        PID:3188
      - C:\Windows\System32\fltMC.exe
        
        fltmc
        6⤵
        
        PID:1680
      - C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "if ($PSVersionTable.PSEdition -ne 'Core') {$f=[System.IO.File]::ReadAllText('C:\Users\Admin\AppData\Roaming\ORCLHeap\NZMEQTLUQSR\123.cmd') -split ':pstst';. ([scriptblock]::Create($f[1]))}" 2>nul
        6⤵
        
        PID:3836
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "if ($PSVersionTable.PSEdition -ne 'Core') {$f=[System.IO.File]::ReadAllText('C:\Users\Admin\AppData\Roaming\ORCLHeap\NZMEQTLUQSR\123.cmd') -split ':pstst';. ([scriptblock]::Create($f[1]))}"
        7⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2316
      - C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c mode con
        6⤵
        
        PID:3624
        
        C:\Windows\System32\mode.com
        
        mode con
        7⤵
        
        PID:3112
      - C:\Windows\System32\reg.exe
        
        reg query HKCU\Console /v QuickEdit
        6⤵
        Modifies registry key
        
        PID:232
      - C:\Windows\System32\find.exe
        
        find /i "0x0"
        6⤵
        
        PID:1892
      - C:\Windows\System32\reg.exe
        
        reg add HKCU\Console /v QuickEdit /t REG_DWORD /d 0 /f
        6⤵
        Modifies registry key
        
        PID:4756
      - C:\Windows\System32\cmd.exe
        
        cmd.exe /c ""C:\Users\Admin\AppData\Roaming\ORCLHeap\NZMEQTLUQSR\123.cmd" -qedit"
        6⤵
        
        PID:556
        
        C:\Windows\System32\sc.exe
        
        sc query Null
        7⤵
        Launches sc.exe
        
        PID:1980
        
        C:\Windows\System32\find.exe
        
        find /i "RUNNING"
        7⤵
        
        PID:4660
        
        C:\Windows\System32\findstr.exe
        
        findstr /v "$" "123.cmd"
        7⤵
        
        PID:2672
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /S /D /c" echo "-qedit" "
        7⤵
        
        PID:3180
        
        C:\Windows\System32\find.exe
        
        find /i "/"
        7⤵
        
        PID:4112
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c ver
        7⤵
        
        PID:1680
        
        C:\Windows\System32\reg.exe
        
        reg query "HKCU\Console" /v ForceV2
        7⤵
        
        PID:1572
        
        C:\Windows\System32\find.exe
        
        find /i "0x0"
        7⤵
        
        PID:3596
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /S /D /c" echo "AMD64 " "
        7⤵
        
        PID:2364
        
        C:\Windows\System32\find.exe
        
        find /i "ARM64"
        7⤵
        
        PID:1856
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c echo prompt $E | cmd
        7⤵
        
        PID:2992
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /S /D /c" echo prompt $E "
        8⤵
        
        PID:1752
        
        C:\Windows\System32\cmd.exe
        
        cmd
        8⤵
        
        PID:4224
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /S /D /c" echo "C:\Users\Admin\AppData\Roaming\ORCLHeap\NZMEQTLUQSR\123.cmd" "
        7⤵
        
        PID:824
        
        C:\Windows\System32\find.exe
        
        find /i "C:\Users\Admin\AppData\Local\Temp"
        7⤵
        
        PID:1064
        
        C:\Windows\System32\fltMC.exe
        
        fltmc
        7⤵
        
        PID:3300
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "if ($PSVersionTable.PSEdition -ne 'Core') {$f=[System.IO.File]::ReadAllText('C:\Users\Admin\AppData\Roaming\ORCLHeap\NZMEQTLUQSR\123.cmd') -split ':pstst';. ([scriptblock]::Create($f[1]))}" 2>nul
        7⤵
        
        PID:1892
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "if ($PSVersionTable.PSEdition -ne 'Core') {$f=[System.IO.File]::ReadAllText('C:\Users\Admin\AppData\Roaming\ORCLHeap\NZMEQTLUQSR\123.cmd') -split ':pstst';. ([scriptblock]::Create($f[1]))}"
        8⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4756
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c mode con
        7⤵
        
        PID:5020
        
        C:\Windows\System32\mode.com
        
        mode con
        8⤵
        
        PID:4660
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c ping -n 1 activated.win
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:2672
        
        C:\Windows\System32\PING.EXE
        
        ping -n 1 activated.win
        8⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1284
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c ping -n 1 updatecheck310.activated.win
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:4112
        
        C:\Windows\System32\PING.EXE
        
        ping -n 1 updatecheck310.activated.win
        8⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1680
        
        C:\Windows\System32\choice.exe
        
        choice /C:10 /N
        7⤵
        
        PID:2104
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /S /D /c" echo "-qedit" "
        7⤵
        
        PID:668
        
        C:\Windows\System32\find.exe
        
        find /i "/S"
        7⤵
        
        PID:3732
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /S /D /c" echo "-qedit" "
        7⤵
        
        PID:5104
        
        C:\Windows\System32\find.exe
        
        find /i "/"
        7⤵
        
        PID:1068
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v Desktop
        7⤵
        
        PID:4760
        
        C:\Windows\System32\reg.exe
        
        reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v Desktop
        8⤵
        
        PID:1856
        
        C:\Windows\System32\mode.com
        
        mode 76, 34
        7⤵
        
        PID:2252
        
        C:\Windows\System32\reg.exe
        
        reg query HKLM\SOFTWARE\Microsoft\Office\ClickToRun\Configuration /v ProductReleaseIds
        7⤵
        Modifies registry key
        
        PID:2416
        
        C:\Windows\System32\find.exe
        
        find /i "O365"
        7⤵
        
        PID:5088
        
        C:\Windows\System32\reg.exe
        
        reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Office\ClickToRun\Configuration /v ProductReleaseIds
        7⤵
        Modifies registry key
        
        PID:4608
        
        C:\Windows\System32\find.exe
        
        find /i "O365"
        7⤵
        
        PID:4188
        
        C:\Windows\System32\choice.exe
        
        choice /C:12345678EH0 /N
        7⤵
        
        PID:1572
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://git.activated.win/Microsoft-Activation-Scripts
        7⤵
        
        PID:6268
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/massgravel/Microsoft-Activation-Scripts
        7⤵
        
        PID:6280
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://massgrave.dev/troubleshoot
        7⤵
        
        PID:6428
        
        C:\Windows\System32\mode.com
        
        mode 76, 34
        7⤵
        
        PID:5520
        
        C:\Windows\System32\reg.exe
        
        reg query HKLM\SOFTWARE\Microsoft\Office\ClickToRun\Configuration /v ProductReleaseIds
        7⤵
        Modifies registry key
        
        PID:6512
        
        C:\Windows\System32\find.exe
        
        find /i "O365"
        7⤵
        
        PID:5584
        
        C:\Windows\System32\reg.exe
        
        reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Office\ClickToRun\Configuration /v ProductReleaseIds
        7⤵
        Modifies registry key
        
        PID:492
        
        C:\Windows\System32\find.exe
        
        find /i "O365"
        7⤵
        
        PID:6404
        
        C:\Windows\System32\choice.exe
        
        choice /C:12345678EH0 /N
        7⤵
        
        PID:6476
      - C:\Windows\System32\reg.exe
        
        reg add HKCU\Console /v QuickEdit /t REG_DWORD /d 1 /f
        6⤵
        Modifies registry key
        
        PID:4608
- - C:\Users\Admin\AppData\Local\Temp\MeProfiler32.exe
    C:\Users\Admin\AppData\Local\Temp\MeProfiler32.exe
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: AddClipboardFormatListener
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    PID:2004
- - C:\Users\Admin\AppData\Roaming\ORCLHeap\Crisp.exe
    C:\Users\Admin\AppData\Roaming\ORCLHeap\Crisp.exe
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:2416
- C:\ProgramData\NaRouter86.exe
  C:\ProgramData\NaRouter86.exe
  2⤵
  - Suspicious use of NtCreateProcessExOtherParentProcess
  - Loads dropped DLL
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3724
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --disable-gpu about:blank
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    PID:944
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffad5dac728,0x7ffad5dac734,0x7ffad5dac740
      4⤵
      PID:3012
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1704,i,15107401514225713180,12915137646411888006,262144 --field-trial-handle=1972,i,3754963156438421118,9819688925826574882,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1968 /prefetch:2
      4⤵
      PID:5320
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2140,i,8583360061878440006,9219264035835631305,524288 --field-trial-handle=1972,i,3754963156438421118,9819688925826574882,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2144 /prefetch:11
      4⤵
      System Time Discovery
      PID:5344
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2272,i,8205379367038986538,14262230617306762624,524288 --field-trial-handle=1972,i,3754963156438421118,9819688925826574882,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2236 /prefetch:13
      4⤵
      PID:5408
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3104,i,870957111388347818,16334675785424157239,2097152 --field-trial-handle=1972,i,3754963156438421118,9819688925826574882,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3144 /prefetch:1
      4⤵
      PID:5476
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3096,i,5291096075931047663,16106994799225668842,2097152 --field-trial-handle=1972,i,3754963156438421118,9819688925826574882,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3108 /prefetch:1
      4⤵
      PID:5488
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4204,i,7076982611561393113,5783687856753319205,2097152 --field-trial-handle=1972,i,3754963156438421118,9819688925826574882,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4228 /prefetch:9
      4⤵
      PID:5592
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" --no-first-run --disable-extensions --headless --disable-logging --log-level=3 --user-data-dir="C:\Users\Admin\AppData\Local\noeUpate\b7c3b351" about:blank
    3⤵
    PID:5008
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" --no-first-run --disable-extensions --headless --disable-logging --log-level=3 --user-data-dir=C:\Users\Admin\AppData\Local\noeUpate\b7c3b351 about:blank
      4⤵
      Checks processor information in registry
      PID:636
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2344 -prefsLen 27097 -prefMapHandle 2348 -prefMapSize 270315 -ipcHandle 2420 -initialChannelId {a285fbc2-44c5-4f5d-ad1d-cfbd2ff8fd2d} -parentPid 636 -crashReporter "\\.\pipe\gecko-crash-server-pipe.636" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 socket
        5⤵
        
        PID:2972
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-first-run --disable-extensions --headless --disable-logging --log-level=3 --user-data-dir="C:\Users\Admin\AppData\Local\noeUpate\fac3a6f1" about:blank
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    PID:4448
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\noeUpate\fac3a6f1 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\noeUpate\fac3a6f1\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2ec,0x7ffad901c188,0x7ffad901c194,0x7ffad901c1a0
      4⤵
      PID:5132
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\noeUpate\fac3a6f1" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2232,i,16079717286252412964,18134068096748153325,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=2260 /prefetch:11
      4⤵
      System Time Discovery
      PID:6056
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --headless --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\noeUpate\fac3a6f1" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --field-trial-handle=2232,i,16079717286252412964,18134068096748153325,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=2216 /prefetch:2
      4⤵
      PID:6076
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\noeUpate\fac3a6f1" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2232,i,16079717286252412964,18134068096748153325,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=2664 /prefetch:13
      4⤵
      PID:5924
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\noeUpate\fac3a6f1" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=2232,i,16079717286252412964,18134068096748153325,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=3348 /prefetch:1
      4⤵
      PID:1900
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\noeUpate\fac3a6f1" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=2232,i,16079717286252412964,18134068096748153325,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=3352 /prefetch:1
      4⤵
      PID:4552
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\noeUpate\fac3a6f1" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=2232,i,16079717286252412964,18134068096748153325,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=3744 /prefetch:1
      4⤵
      PID:6264
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\noeUpate\fac3a6f1" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=2232,i,16079717286252412964,18134068096748153325,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=3784 /prefetch:9
      4⤵
      PID:6272
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\noeUpate\fac3a6f1" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --field-trial-handle=2232,i,16079717286252412964,18134068096748153325,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=3836 /prefetch:1
      4⤵
      PID:6280
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\noeUpate\fac3a6f1" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --field-trial-handle=2232,i,16079717286252412964,18134068096748153325,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=3840 /prefetch:9
      4⤵
      PID:6288
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\noeUpate\fac3a6f1" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --field-trial-handle=2232,i,16079717286252412964,18134068096748153325,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=3956 /prefetch:9
      4⤵
      PID:6296
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\noeUpate\fac3a6f1" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --field-trial-handle=2232,i,16079717286252412964,18134068096748153325,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=3904 /prefetch:1
      4⤵
      PID:6304
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\noeUpate\fac3a6f1" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --field-trial-handle=2232,i,16079717286252412964,18134068096748153325,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=3972 /prefetch:1
      4⤵
      PID:6312
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\noeUpate\fac3a6f1" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --field-trial-handle=2232,i,16079717286252412964,18134068096748153325,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=3900 /prefetch:9
      4⤵
      PID:6320
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\noeUpate\fac3a6f1" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --field-trial-handle=2232,i,16079717286252412964,18134068096748153325,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=4064 /prefetch:1
      4⤵
      PID:6336
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\noeUpate\fac3a6f1" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --field-trial-handle=2232,i,16079717286252412964,18134068096748153325,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=4044 /prefetch:9
      4⤵
      PID:6328
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --disable-extensions --headless --disable-logging --log-level=3 --user-data-dir="C:\Users\Admin\AppData\Local\noeUpate\b31b3051" about:blank
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of AdjustPrivilegeToken
    PID:4288
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\noeUpate\b31b3051 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\noeUpate\b31b3051\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\noeUpate\b31b3051 --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x104,0x108,0x10c,0x100,0x110,0x7ffad5d1c728,0x7ffad5d1c734,0x7ffad5d1c740
      4⤵
      PID:5404
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --headless --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\noeUpate\b31b3051" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2192,i,13189719963809759129,12081718496829085926,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=2188 /prefetch:2
      4⤵
      PID:5360
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\noeUpate\b31b3051" --no-pre-read-main-dll --force-high-res-timeticks=disabled --field-trial-handle=2192,i,13189719963809759129,12081718496829085926,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=2228 /prefetch:11
      4⤵
      System Time Discovery
      PID:5200
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\noeUpate\b31b3051" --no-pre-read-main-dll --force-high-res-timeticks=disabled --field-trial-handle=2192,i,13189719963809759129,12081718496829085926,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=2272 /prefetch:13
      4⤵
      PID:5612
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\noeUpate\b31b3051" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=2192,i,13189719963809759129,12081718496829085926,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=3168 /prefetch:1
      4⤵
      PID:5792
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\noeUpate\b31b3051" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=2192,i,13189719963809759129,12081718496829085926,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=3188 /prefetch:1
      4⤵
      PID:5172
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\noeUpate\b31b3051" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=2192,i,13189719963809759129,12081718496829085926,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=3448 /prefetch:1
      4⤵
      PID:6216
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\noeUpate\b31b3051" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=2192,i,13189719963809759129,12081718496829085926,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=3468 /prefetch:9
      4⤵
      PID:6224
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\noeUpate\b31b3051" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=2192,i,13189719963809759129,12081718496829085926,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=4496 /prefetch:9
      4⤵
      PID:6492
- C:\Users\Admin\AppData\Roaming\WNQT_net35_dbg\Crisp.exe
  C:\Users\Admin\AppData\Roaming\WNQT_net35_dbg\Crisp.exe
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:3900

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5544

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

NaRouter86.exe

Path C:\ProgramData\NaRouter86.exe
Size 72KB
SHA256 30e29e655b10f50fcb55a14970bfdb7da56655023ea89df752e14abcce8d2740
MD5 a72bbfeebe485506e930d35f95463319
SHA1 e7c4c7c417874611d7cbf5146f8e8808a10afa44
SHA512 4e39d6c2195f7b8853ddbdf28bc7395c12202e0917a19a262dfaa82bb8ec8fbf7b1a0107f3ccd235590d59d51b018e59aa4949c11b466d434fa5a87741ac7a65
SSDEEP 1536:3ZT7olo3MlJYsQhmrqJaXBZ48tqsWN5RRGTdJNGU:3ZT0lo3MTYsZrqJadETCJP
TLSH
T1F5735B4563E104F8E073C63888F18955EB77F85206B58F4E4AA8429B5FA77D18E38F36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp_win.dll:Zone.Identifier

Path C:\ProgramData\WNQT_net35_dbg\msvcp_win.dll:Zone.Identifier
Size 123B
SHA256 cb40744ddb47f1250d1080ec7a1f4d499c02587b8cef9d7a141ed43f69c44998
MD5 92ed92680454959b95a8e4cef5580455
SHA1 9d970883589d285f6b8f52ee7a550844e93f6c26
SHA512 0c6fe4d6ff900e9be8443a3fc2679c75b220856e6b0bc092f684098216c0132ba350cb489e5d6549cad7e8605ed64d6c1b04feda0d05bc5e15de07eb1abcd3e1
TLSH
T18DB09B955585491910B03317137F6A9C509E64D11E5155C0EBD448A7F540D2CC955D4F
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 92483d02043f21aeeee8f49112d3132f2d07458cd1d5ad8656ab5eed85f60a56
MD5 231844ac35300c3c36f5d2f39f5b23c8
SHA1 bb4862ab38b019df92c69cd42a4bc5beed545f79
SHA512 72bba61586acd50dec74408c3b71b50540c75add3e829f52e4fc29675f2a997a2192a90cddb4d1762e98c648743bfbdc030fc228b7bcf871c90e1ef9318a8c0e
SSDEEP 3072:/zWs4B7zxAQ0xVOnXTZpY3g9DzcU0/DlblAIToV:LWDfxA3OnjrYQ9EU0/hEV
TLSH
T1C8C302A11C36BD660DF8EE99B44D3A60BFF4AD9A91835DC361ED2F0C24FA5C81139970
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 85b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c
MD5 627073ee3ca9676911bee35548eff2b8
SHA1 4c4b68c65e2cab9864b51167d710aa29ebdcff2e
SHA512 3c5f6c03e253b83c57e8d6f0334187dbdcdf4fa549eecd36cbc1322dca6d3ca891dc6a019c49ec2eafb88f82d0434299c31e4dfaab123acb42e0546218f311fb
TLSH
T19651CE323375B1D889163F47192C5AC463BF8355FA94AF4CB698620ED92741B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 b9b2e787bff8ef07aaf8dc41b35307c7c27a735e7d7ceb08a7a415a3e0bf278d
MD5 6b1b71135b132fc9820aba7909379913
SHA1 203a3bbcdcbfad5b9fcc3b862338d849bc46335c
SHA512 ee8ea33ab55fc59728e89ee58318e93e1e10697a037488e782e474fdd2fcdbd8c32e1d9bb596e518f23ae71ef00bc569552d7a2f5359f8d6ad520cdac9122bde
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7Q:fwUQC5VwBIiElEd2K57P7Q
TLSH
T170B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

protocols.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.10\protocols.json
Size 3KB
SHA256 4fd800e7b1a5fb24b13fac2e31946d205012b7c28d8c61580b0669b2fa3517cc
MD5 1de85fec2dfcc28011a7c2aaab95eb5f
SHA1 80e8c954bfbe8f7ee5a2335c8d969ae033935dc3
SHA512 9c7dd37eb0c094b6aa05201e7c71a8f33b9db81284223bcfa595a44a6ac95d5a6820ab6f07b7aa8d26bf207454e94277bf35332e9c009ee63f083752b6b51750
TLSH
T1D1611DB79A3048090E3412B86B19B35DF63E029F1AD598EB76BE568F1F710F7245C54C
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a4b35a6422c1c682176591bd42ebef96b0cb78607f98b3c5ee2c0e2d44e526da
MD5 63b4ddb137c55bd42461aacc1eb4cf83
SHA1 e41f99c448526208c80f1acecf1939a8e3f06728
SHA512 88b7f5970c19ff8d8362281bde3b29f3c7b018ff88c03d8ce082f66572704c79543ea528e6962172f18f1cdde2d1aaad0aca218b732ba8a673b844844d3ae585
TLSH
T125D080B23D4DB010D75B51F1F903D741121A857528536B33E694C54C5DB5CD813C71D3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2e4c78c9d4b6915833ca44ba5f9b735c9d9e0bf49d6aa045c47aaaa63f1f9359
MD5 f7389aaad82eb86ca1896ff3c7af7a86
SHA1 a7833bad037b8c94d375310ccb5bf39c3f9df83c
SHA512 cdfd274480229d612566789a9d9cdf47643a9543e303957436e5121c790936878b1b7eb452100170489121bede724239183c48208033a8c70d6070e93b3f1226
TLSH
T1E5D080B23D4DB010D75B51F1F903D741121A85752853AB33E694C54C5DB5CD813C71D3
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 8bc86ceb0b275bb8e62dcd01413647f3d1b318d465e7effb79f47477da474384
MD5 f43b18227289fb0625e494122cbbb335
SHA1 c2666b52a88af6cbb27f11c82725bf456b652b8a
SHA512 2548992bfc859a43258c9174fae032d843b89d6939fb3cd0f0b760f08366ec9fa9768925517bfa581b23dca341fa1f667919600ad6b6fdfa8138ff4e6a2a8952
TLSH
T1CA61B29D07336F85F75325F3B1DC0D84F1B284785AB30EA612C158B6690EFA35D96238
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58a062.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58a062.TMP
Size 3KB
SHA256 5a2105c6053200e1c3f8c4c347ca26bfd70d4c6157347b4bdf0cb1cd0f28d7b3
MD5 59e04b32cd5652e544072184b6710283
SHA1 19b299e3b58d543ef419fe21ec34e8b9fcd644b3
SHA512 0a2fb59dd15c441141c83a1cd43496801714be58e2734693ac2c87f4a5ac4a0c25eb10c4f14de1b6f9c8b747ebf1e244fe250d0572cd746bfe2358f4e97004c6
TLSH
T15E617FAD03336F85F35325F3B1DC0D84F57284791AB70DA612C208B5690EFA35D96238
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\000\t\Paths\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 204KB
SHA256 a37f77cb52fadfa427b801d592e7b3f413acf4a2d38c20144f2ff6e49c34ef6e
MD5 a8d7e8d6ff5d32e394cf7e915b519fcb
SHA1 33e85c0c532703e39d9e090073aa4ba77c38e4ae
SHA512 6dade2dc6817418234b02c0e75e03e3c97eadd498f8ad10f3efda27cb16bdfbf89c9fafddfa2205a3a923e8401c91d6ad876d8f439eaf55de1f773412ca6729e
SSDEEP 192:x5nP1Yd1b0+G83uxXBBK31GkSJJn/5+EJH7DNspUe:xFPK1ba83uFBBQ1GkS3/R7DNspUe
TLSH
T14114745F5F302212CE6C403669F784A75DBDF43F8B52668A78601471CEE3652E46C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 cae7e8f3a6fad75c34fc3de016ef58e7b02a52da4eba584185579de3a3d2471b
MD5 be96623990ac01df7577f4b4d0f95803
SHA1 abc7f92ec32dcf6460852cd5b141a99298658095
SHA512 fe58e83c5547f8bf57bde3bd56a1f50f68cfd42846d6b64e4e173915603937633f398a9c0c30002b5d2383f25d71c805cdeb63c7fb0c293e6916b249579ec5e0
TLSH
T1C581BAF3C2E8862DCD1252F4AA146E2BCF1D0925436C3D5EC8D4AF4B97EA871E24554F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 1ae67bbb6ba05ce54b3960fb78098000493c4263218fd6f15e4fdef6d409c218
MD5 fc4196921fab9fe6584bf2384bd41a1b
SHA1 6f304c50c771b6e8a8f79daef1873717ad4d074e
SHA512 61ce57bb2c28833f3cac5f1ca95580b33ac426e4cb44716c9a697a28e3494fc516792566ec007aa862d20b3e9afd1add2ac053a4f2db39a665247507a3eec791
SSDEEP 192:sxZlVRzyM/jK1Ml8Mox/f5s4Hxp1BIdpzE/W6+WNdXIu//Yn05c4bZIg4J:sxZlV1Qx/f5s4HzUI/bB/Vvc
TLSH
T19E52E8026A34597BCCCBD219F951BB63D6F9557292900E44AEFCCA0C00E6AED2217C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 991ef442ffb0ddac6b11b2dc1320d67ccac3cbffc93013ec45d8c71cee06ca1c
MD5 abbb91d7829bf1ada1dc763fa6924e31
SHA1 86aee78b1fe6737151156807e1fe3e7c1b500b60
SHA512 860f48c6350c17c0d6de9b8950c614412daedadd1754d7eeb2b3ff040369d5d75d5c9b1565aef987bb8d4580e35c3ba5144cc2d80c0229e192fa79cdc71754dc
SSDEEP 192:sxZlVRzyM/jK1Ml8UQxox/f5szJxp12IdpmsZ2//W6+WN7NzvdBJRV7XYXIu//YP:sxZlV1qqx/f5szJz9k/bRVrm/Vbw
TLSH
T1FB62E852AA344A778CCBD119F951BB67D3F555B296900E44AEFCCA0C00E6BDD6207C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 5eb6d9c2df1fb03ea34a2c603642da877f87b7f100807c993cdac4ca0a211b54
MD5 497b432e150241ed0db854c5f71b0f1f
SHA1 d24bbdbf6713872bf9b710705505dcf92bf27b0c
SHA512 c32a237bba7d256a4367947bd12db47050480497cd834174be7715b0a745ee5c2ae72949dac0ac2412e391c58bcc9f70b5e250e297e5879ab15779f333c59b19
SSDEEP 768:IvzXl8pZ2sn7pLuLXJ1WRmsYQL08F1+UoAYDCx9Tuqh0VfUC9xbog/OV3Gq1/Ll/:IvzXl8pZ2shEXJ1WRmsYQL0u1jaKGq1l
TLSH
T1D2032C7F284CCB7E4F844E9CEC267F9A6EE8018B56D8895447FA480C03C66DB111B5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 1c5a6b1342e503e6d972344765bd9aeb67304370e1f905188128bab044e63435
MD5 37c3cd2707e614fc7675447174cbcacb
SHA1 f564ef5f66d4fc30abc04645ed635ef6548bfc99
SHA512 fc6cf24ab87bf4a152dd29884db4dee4dd3ed138bbba25d339d9d4ab0ab1de1913f95a071c9f7ec38e47c279421be32af9b1b29f81fa4c44a0f49fc164eeb6a2
SSDEEP 24:KdXRfXcXHXuaXLdXzXfXn4X3Xb+xf8nOardT/H4X7+eIjbHKiQhalH1ExXSmpMcT:KUGOIfKXK43yhgI3KlWc9zIlKosQfyD
TLSH
T18A91371675BA07417DBD38088275DA170E8271E73068F93B3BB850B22D66E152EFD9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 224KB
SHA256 c00836ab6cabc62f529e067dbbd32141e6e1a4bba7b24bfec8f409a4e6a6c0cd
MD5 643df09d68d581f55b537ec182eb9180
SHA1 3bb320017ae5095563fa95c74feabb76990482e9
SHA512 4622c1c60b1baa5913d68661d18b9904bff8435eafbf47fd67c090a4e1215d888f3dcdee57436a2288b5789302fb6539dc879cb3a18bdcf6dbe659f29cd8b890
SSDEEP 192:FvoWSDfT8wRJQnGL11HLfzNSivuvTNN+u/egddCeyv/hVRdbsCEV:aJfQ0JQn6lLfzAivuvBN+wtP2s
TLSH
T11724640A7B747001DDE7E9725CB080771A3CB16ECF22A6915DA254698DB2853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe593455.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe593455.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 9ca70a15a6ba06ab7ec0ba20f6c5be0fb9cbe67f9349b6294872267733e23b53
MD5 65709d4553ff81c219f842563f972d52
SHA1 8edeb78c4f6a9cd56c62840e35df66afffda5fa5
SHA512 cf096763385bd2d071581e074ae1f2177e4e5589fcfdee72d09cadf9ed501f153287f58568a5a80ee5a1429436747f22937c471b28b022ab1ce19ae16e35aefa
SSDEEP 384:n6tNnNnb9X8NvBEuEO9hzdK/JDf4h2CtT6B2LnOYPpcaVq5:6jZbZgzY/xfRCtT68yo9q5
TLSH
T101927D7168B96D7BCAA7A916F00776172F7461FB55D02E80CEDC2F1D00DB28C230A82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 a33f325fbf8704fa8da5bc1d802d5c5edba42c03fd273611e84fe4a738d93da9
MD5 f1fc66c99250a9f9045901ea31c284d6
SHA1 b9766cf3667d06712371267b05e111b839e712e3
SHA512 058ed75434b33b9071a4a1335c5f9330bc95fc7cb2a117c2918c8d976bfc307db6d3b226274acdb0c89a8028ae96d34e9374e540f5d7989607a3eefcba0338ea
SSDEEP 384:nhiFatNnNnb9d8Ne8TUNTUlIlBEuEYm+Afzxjxftc/JDf4h2feT6B2LnOYPpcaVY:IFajZbjZwgs+6z9c/xfRfeT68yo9q5
TLSH
T1AEE2A4F198E79A37D9AE5B83A33E7D565EBCD19775841880BBC81D0CCC861BFC20A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 4dd6548afb6415f68744e7ec019a625d48d6308804eeb4349a7db2ea9a50507a
MD5 b59cb23bc18aaeb8919051e7783e8154
SHA1 6ab4b26db0308289c602f4cd2ab691cbd4d7a1b3
SHA512 fd19f145b73c565e0d118a6442d8819d79e1f21bb86000a86c3824c25a71afbfb4fb82738cace3e4e218b9a145169e30d11113b4093092e54bc3ac460408ba1f
SSDEEP 384:nhiFKtNnNnb9l8Ne8TUNTUlIlBEuEYm+A2zG2jiftc/JDf4h2feT6B2LnOYPpcaK:IFKjZbLZwgs+jzGBc/xfRfeT68yo9q5
TLSH
T145E2A5F598E79A3BD9AE5783A33E7D465EBCD19775841880BBC81D0CCC861BFC20A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 e24ae5de9f477bdb17d5390abc6fb5f108fb1e2f80cc039b4c59292704c16aa7
MD5 e14ba4ddd5f32f40d92e0c3400239aaa
SHA1 2138e7c8a54b7ee22c24bad7f079a70c06fb70f9
SHA512 9e0bc9754f789670350d767269afa63b459af4e28a3ee1fb738d7015718219bda7e9236d7a628d277624c17b1e86189ac74b5c88a673802bc928d4d7fa217921
SSDEEP 384:nhiFrtNnNnb9l8NR8TUNTUlIlBEuEOm+AhzdjDfcc/JDf4h2PZT6B2LnOYPpcaVY:IFrjZbL0wgK+4zCc/xfRPZT68yo9q5
TLSH
T104D2B5F598E79A3BD9AE5783A33E7D465EBCD1A775841880BBC81D0CCC861BFC206815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 ec5b88de4a8df9d78e7a01f78e354d8c59199906bf93d7bb0540b48aaf5f0752
MD5 25c5b3d7cbc6aca36fefeec878bb39cf
SHA1 8ae98943c8c7a8095ed382bc659ab174518ad5fe
SHA512 601283d821da4868aeb9760fcc413882661fde15959634a555fa0650139d6266948bfcba562ae2f97731ff04dcf63ea9e3e9048c891425aa77a1eeb691dcb6c8
SSDEEP 384:nktNnNnb9X8NvBEuEO9hzdK/JDf4h2CtT6B2LnOYPpcaVq5:kjZbZgzY/xfRCtT68yo9q5
TLSH
T182927D7168B96D7BCAA7A916F10777172F7461FB55D02E80CEDC2F1D00DB68C230A82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 16KB
SHA256 5784a36ca7da7f2983173c7b691f69c830350b7d7e39aa9cfff1ee50e1c158a5
MD5 6c626faa1ea5fd3e4de48e8be9c95c03
SHA1 a301d10dd0631326bf066d1416ab6ea0fbfd3877
SHA512 bafdb399b4cd61cac10fe435fa034b970d3302f76e64bdded8967981874996b78c8e5571b24246b21849bad2ff451deae5ee6d26fd93c3ab99aa29e8c89476cc
SSDEEP 384:nN8NvmEuE69hpdK/JDf4h2CtT6B2LnOYPpcaVq:NnpY/xfRCtT68yo9q
TLSH
T1E9726B75A8B96D7BCAA7A906F50776271FB060FB56D41E54CED82F1C00DB2CC130AD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 5f0abd0076cb6ab626610c6ed259d8fee1f057d2aa07ef81d42db6677ccffd52
MD5 e64f216eb59a7eb598b860e6d7087562
SHA1 6199a5ff3915cee317bddcb9ae9509bbb8236a45
SHA512 3ceb903bae286ecdc40ce026192887ae5431cf0cee519b0ff885470f41eb895841ac0158833bb3883eba85abb9fed93d7f176eee99341278b74c65b2bd1a11b9
SSDEEP 384:nWtNnNnb918Nv1EuET9hzdK/JDf4h2CtT6B2LnOYPpcaVq5:WjZbfhzY/xfRCtT68yo9q5
TLSH
T14E927D7168B96D7BCAA7A916F50776172F7461FB85D02E90CEDC2F1D00DB68C230A826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 ae168bfc07b652e51c363f90906cf9c5888e2b8eb15dceaece23177554d54afa
MD5 990e0b73ca7444fe13f7579a8543c44e
SHA1 443e4670eb0988b6299652683ab4667c86d14edd
SHA512 6495d8fe63b882a6779a20517a85b3f46729999ec53278b923bb6106a04767a2a9fde350b1adec5dbda54524813ed35127ef71570f8f931c4c184326f89ce0ca
SSDEEP 192:7GNd6fNNQmiUypzHpIPL/GPT2AXRQfMV7qlFU6:7GNd61LOzJIPL/JDfMU/U6
TLSH
T1A9020935ACA86C7B8EE2AE59F5473B175FA4206B9A951F44D6E82F0C00D769C2307C36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 73f1a6c7a673a96d5ee965448e68f894e74cea40cf6fad459b5f385e96c6eacd
MD5 df67eb433dc01d8510808944474a7072
SHA1 7f2f6eb21beab733dce63298a66a3e897f3cb64e
SHA512 fd3b3d9fdf3a1046a7607c05a179b41e229914a88a95eda48dea725878d30fd44d7a51de4f325bf59298cea2ec2bb61a57b1015ba0158af6019e09e7ec8cc428
SSDEEP 384:nhiFrtNnNnb9l8Ne8TUNTUlIlBEuEOm+AhzdjDftc/JDf4h24eT6B2LnOYPpcaVY:IFrjZbLZwgK+4zjc/xfR4eT68yo9q5
TLSH
T173E2B5F598E79A37D9AE5783A33E7D465EBCD19775841880BBC81D0CCC861BFC20A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 041bd0ee0b09b372efb7514a321152aaa3a965e274fa44ddbdabaa7c5dd82a90
MD5 4322b245db17df1727505a51530361dd
SHA1 7e3802cbe5300a818fbb59b0a793fe4eeb5ea4d2
SHA512 fe2cfd6f5dda74db3742b7e2c7647cab19d3eeb8cf8224749d96d90fee1eb0f0bd60b26067140c671b3f20513d1f05d650a38de4cc141ffe132d129ca20e340e
SSDEEP 192:7GN66fNEQmiUysSpI/L/GPT2AXRQf4h1EhV3Z2/YU6:7GN661U1yI/L/JDf4h2hLTU6
TLSH
T1D9120934A8B87C7B8ED2AE16F4477617AFA0217B9A951F55DAE42B1C00D769C2307C32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 d8936765e70c281c5657c0f7e07923d7e80efc62a9503986b2fc8081d0ce688a
MD5 83f9b1cc5873fafd042a024898c1e0eb
SHA1 f0d8de021a676f2c44dd242586e630b752bd538f
SHA512 94386a43de925b7b737761d0f4c7a8835cde8409e8f2b9439cd9978f15a7b00be8089e8698524cf3d2947996fe29a9ba5fdc3e984512f1cacf167df1deb6904f
TLSH
T1C2E00206530042ABD1305B7000CB1B203FB28432071306090E30127C5C313003E11540
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe59f5ef.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe59f5ef.TMP
Size 392B
SHA256 c31feff3e97c5dcb55e02a408e9a21410b4e2f966b95881d4dd3a0aac790a61b
MD5 33c70da2970f3e039e7f955eaa2d8d91
SHA1 98f0eeac72db3af02a544bd441dd8fa7c56aafb4
SHA512 883672d7bf98939842e6ad294ae6189e53948c12040693bc951ef26d0c7e0a6a2dcfc887df43eb1e495081436443b446f16c18abaa30d14926a8858b45ae4f49
MD5 SHA1 SHA512

Submit Download

nav_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\WorkspacesNavigationComponent\1.0.0.5\nav_config.json
Size 2KB
SHA256 98252dc9f9e81167e893f2c32f08ee60e9a6c43fadb454400ed3bff3a68fbf0d
MD5 499d9e568b96e759959dc69635470211
SHA1 2462a315342e0c09fd6c5fbd7f1e7ff6914c17e6
SHA512 3a5922697b5356fd29ccf8dcc2e5e0e8c1fd955046a5bacf11b8ac5b7c147625d31ade6ff17be86e79c2c613104b2d2aebb11557399084d422e304f287d8b905
TLSH
T16B51DB73D5988C4B9BF4A29CE919A309F11107CF75D48C0B76BE010C1F7757AB5C6588
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

2e154114-39e5-4deb-bf21-7fc2c2c951ad.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\2e154114-39e5-4deb-bf21-7fc2c2c951ad.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 948B
SHA256 bc38ea6605142cb9ec440231b665a5c5a53c499c7e25a77a94eb6491efdd2a65
MD5 d70b0a49b2727a97cc322ea54d2a66c7
SHA1 57d984bd970307ad80665d97f5369ad644de8776
SHA512 90790e506f7453a63d4915fb50c7694184c3bc5b836979d19c15a240c6145d9bbc33d393007f4b39a782e789f6259974a1824e79e960a64c5f8703e4797fdd0d
TLSH
T1AD116633F78CC034C899057A108CAE01B1B4C3CB009FDD8B7A84C114E57F98AEB941E4
MD5 SHA1 SHA512 TLSH

Submit Download

218B22.tmp

Path C:\Users\Admin\AppData\Local\Temp\218B22.tmp
Size 12.5MB
SHA256 88d0f2d3e14b9a0850399c0ff961c36d5195a22da6fb6e3a784e391cca00c1c0
MD5 8314d525e05bda308e0acb806fdbb52c
SHA1 e0700cd215c1fd0b176ad9a410b036440af6ffab
SHA512 778ce376df1c7fb8a912285375b3cafcec422d644454154cf5efb43a7a74f2828863af2a0d180426142e9fe3169720365396face0d99bc864daf47015b40881c
SSDEEP 393216:rHhc9xE/sGS+sLxASZEGcYzDKilkPxc4+L:rBOxEhsdvZEGNL
TLSH
T14DD633AEBAF2C070CC258CED59035DC376E63EA07957D0D261A6E5D0EC4BA41D98CDB8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

218B22.tmp

Path C:\Users\Admin\AppData\Local\Temp\218B22.tmp
Size 12.5MB
SHA256 c734c5e7eb4ffca8c27af67f1356c4287400cbc8427f1838f9cf966c6028ff6d
MD5 1d43ada304f5e6052ae9d7f6ca518396
SHA1 76fb8dd9a344133977ae12a899bd76e8422e71d4
SHA512 d89b4adfc041611ac0f8133d4f227a295a86e6335d14933a56a1626a539d8ca996c846d099a30f5722545cc9c6eb8a54b222143c2ca027a8dd08d6d8fb59177c
SSDEEP 393216:rHhc9xE/sGS+sLxASZEGcYzDKilkPxc4+L:rBOxEhsdvZEGNL
TLSH
T18ED633AEBAF2C070CC258CED59035DC376E63EA07957D0D261A6E5D0EC4BA41D98CDB8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

35D188F.tmp

Path C:\Users\Admin\AppData\Local\Temp\35D188F.tmp
Size 3.2MB
SHA256 a6fa2c2bd73092d8f28fba13ad9659be449b83a9186b75ae38c4a019ffc4d097
MD5 8f40ae16bb50ef7e061c3f51ada9725d
SHA1 c0109f6ac79e11ce21e655b44d9a14916c8b11e6
SHA512 82ab3395341911ee23a220a3851b9a2de8868d1ce8c1f2861fa9acbf0561f313803b4cbb1663e3e2962bde54211973150be160fc8fff0b4f86ed8908e4d8bfe3
SSDEEP 98304:DhiCE75+UbKwQoWssDJjD/kDbjBqQJqB9stO:DRE75+cKEWr1v/MvYOqBaO
TLSH
T104F53379025ECE0B5299F38DC0D8B437DB8E59F19076A7D8F0806A385068E6FF399635
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

35D188F.tmp

Path C:\Users\Admin\AppData\Local\Temp\35D188F.tmp
Size 3.2MB
SHA256 5aa6bd548b5767dbb534363ae9d8f55a88d8c40113b3528c04496c6ffa0417e0
MD5 61a39f26d7299574661be230b19b3c7c
SHA1 5e1be21fda526412d48bf0b7ab8692f0693c084c
SHA512 20017a7376646fad2a2bb0bc49fe48b36901bfecbfa8dd9411997b122e6b12c079088e6cb87f5ab394500e11ec279937bb1918b84809c3f7d1c60e5147f9f449
SSDEEP 98304:9hiCE75rUbKwQoWssDJjD/kDbjBqQJqB9stO:9RE75rcKEWr1v/MvYOqBaO
TLSH
T189F53379025ECE0B5299F38DC0D8B437DB8E59F19076A7D8F0806A385068E6FF399635
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7BF4677.tmp

Path C:\Users\Admin\AppData\Local\Temp\7BF4677.tmp
Size 40B
SHA256 2a720f12cd543e734ad4b2ce6aa4f250cb7416472b3cdf51d50e706ec4711aab
MD5 5c5125b38ac85be2b9630a67f4db1f7d
SHA1 b95e7fca5dac68d762da8b4bf3f4cc0b2a1613cf
SHA512 220ff67bd0f523de3d2addeb7542982952510a34686c782fb64258c7cf63ef80e87fa865b410a950178a5404e058d84c4a4a418132efdb1ae2094ad1ec3db518
MD5 SHA1 SHA512

Submit Download

81449F2.tmp

Path C:\Users\Admin\AppData\Local\Temp\81449F2.tmp
Size 40B
SHA256 5de04fb5fac4104e147934ed42863b38e9cde73146da0eb584e732fad6cc2650
MD5 a68faa40e8e90c3cb1bdf22b8cd73f27
SHA1 38f1e90c0f7ee18b7b24bb6627455198f4a1c399
SHA512 a059f6ec7869c26205a4d30887c624b773843dcbafc80e567f94a0d9458635a69e0faecc5e6ab593e06e66dd21001058f087fc3a419bada080bfafa3f5183e07
MD5 SHA1 SHA512

Submit Download

MeProfiler32.exe

Path C:\Users\Admin\AppData\Local\Temp\MeProfiler32.exe
Size 258KB
SHA256 3837645e4ccc1e6b60c984d9516030da3168aa8f2a9bf7d52ebab8017c3a9f24
MD5 7793c30e1ca6670a558fc38338cd7b76
SHA1 64fe73b543d62147c4b44db121a1cbb05285684d
SHA512 4969b0430cb97b8caf8d1ea7cad04b7fbffd0382895f93f8951924aa76b0f1d8635dfd8ebb168dc277d6da232e2f235b111e74a24904d25d8c2a40a5ad17e886
SSDEEP 3072:hENRC6vGYOvcY7we7UYuqnDz+1CxDistQNw+:hEycpYs2/hDiH
TLSH
T1D4445ADEA18B84E1D1C1FE34C2A3B303672A6E1F0AFF54562B977509F8BD29E3511606
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_aoncfbm5.iqv.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_aoncfbm5.iqv.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

cd7fd2d3-60cf-43fd-8fbf-e58284677652.tmp

Path C:\Users\Admin\AppData\Local\Temp\cd7fd2d3-60cf-43fd-8fbf-e58284677652.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d2dcf18d-16ce-4b72-895d-3fb78989b3a1.tmp

Path C:\Users\Admin\AppData\Local\Temp\d2dcf18d-16ce-4b72-895d-3fb78989b3a1.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

8829de15-5be8-4d3a-8f64-648b76b94073.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3024_1267655213\8829de15-5be8-4d3a-8f64-648b76b94073.tmp
Size 147KB
SHA256 d766e75ceffe993aa1dadd5619b24043a0ebe9a9689a6796d19d88bf952683d4
MD5 a9f7675ff091bb15c88909424bab4a39
SHA1 90f753d8d7e4397de0f49631fcd9222a7f59148c
SHA512 ff1f89fb04ae9c9a4c6cf6b1475f5a77f1c4f90829acda95cb39889b6b15c3b4f0b3b822a668f8ec8520b002cc90dd397cc26d314ac8fd5f3e2c9826bd458df5
SSDEEP 3072:Ph3iICVe1DvTtr/3tOpPu8LdKBTJyU4AshzWnD7UVDvuZE4tkGL:PgTVWvTZPghwln0AD7UV8Eeky
TLSH
T12BE3E01D29E2846EC82B24F4BA4A718FC71ECF07910BE40F25D984A55C7474E17E2EED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3024_511933113\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\noeUpate\fac3a6f1\Crashpad\settings.dat
Size 280B
SHA256 5c5e640a24f90690ee372b0ab3e57522b6b41279f46720d1d3e3af878a69a49b
MD5 aa51ce780957a9a4d0ada9809b86f265
SHA1 9b60edbf93c78e78f3289ea05bb93a80ddd53bee
SHA512 9bcea864391a080f7023165151db739a22068be3d94e0fd9b53fc1593d2a9f70c697b1ea16ad6314c34dff4ed5d916aeb3aff7b01a44e62a408962154a00cd53
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\noeUpate\fac3a6f1\Crashpad\settings.dat
Size 280B
SHA256 8d1fa98a0ac07f4571beb0701862f82e5355274592101d3fdf5938f329c97b24
MD5 713183f74e03250dae50931e480f6578
SHA1 33bf23c4cfcbf4fa93274a8c96c54897bfdfde65
SHA512 c533a139a8700aa99a3cad9ff5e286671efd8759956c4988142dcb0de79488cc7850c0f2574381e3ff8b25bb10d25349d6dea76543411e54a1ae01c9582251a1
TLSH
T136D022083B300088E38230B8022083003C00CBB8080320C00E302ACA8C03CF328238A0
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\noeUpate\fac3a6f1\Default\DawnGraphiteCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\noeUpate\fac3a6f1\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\noeUpate\fac3a6f1\Default\DawnGraphiteCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\noeUpate\fac3a6f1\Default\DawnGraphiteCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\noeUpate\fac3a6f1\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\wasm\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\noeUpate\fac3a6f1\Default\Sync Data\LevelDB\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\noeUpate\fac3a6f1\Local State
Size 5KB
SHA256 803fcbe9ab40c1609881e71c611254b93b393ad6b9b93a399d7b196daae4944b
MD5 a1e0c3c1379f44f342a4fca801b6f29b
SHA1 031db406c61fcfeffceaac95a2ac42798d335869
SHA512 7dea70449dc5bd43a1fdcd1ac586ea2d03f3b816be21369d63399ef4eeeec76afa8044fb9fdf0b5199b4dbce4eb214232507f075d92b328a9363b6da0d1c81e3
SSDEEP 96:0qGNk7Qsjpf129F558Frh/cInURoDotovbAZUDsBm7vE3t80x4UpPSDS4SYSuSDq:/GNv6fTooDUwzgrt808
TLSH
T1F9B197736874A86B5DE26981B48536079FB4D237EA997FD8DADC170C05EF1A8830AC12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\noeUpate\fac3a6f1\Local State
Size 4KB
SHA256 151df3bc398c805d84c281c09455290534b7e2bba55d2533137fed3fc2cf930f
MD5 d877fffc8e985ea70d40ed0845453a88
SHA1 eb52b276fe1f7fb9bf67e683dfe062aba0e67d54
SHA512 fb82b9dfcfdcc744cbbf5e8389955f6f69e92abf050e67934b36aebec0d282160ba1d41d495cf4e199a4d5a26f41a56f3b3fe7c54e5e89fcf31f4b4cb7356d14
SSDEEP 96:0qGNkosIMf129F51bVEsDjBm7vE3t80x4UpPSDS4SYSuSDSDS1q4a:/GNjHkeP9rt808
TLSH
T1B18196737864ADB79DE21981B44525038F74E263EF59BF94A6DC231C04EF468C30AC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe59c579.TMP

Path C:\Users\Admin\AppData\Local\noeUpate\fac3a6f1\Local State~RFe59c579.TMP
Size 1KB
SHA256 57396ced38777840b8bd296b4597784e10c3f9342560abc8b42ab472af357811
MD5 d94aaaf8af403dcee16ea6a8c19024db
SHA1 0004eee2d77e5193725dcb06247821999329249a
SHA512 4765d7a41337ed2c37735e8ac44780ab8bbec0b89d4416b72ab1cef1966cd63c7fb67f8e6a07c551add47903c8d19bd074fcd0cf43a5668dda51b8ca79336732
TLSH
T1E831B67178A838F7FC721A86F188A75B1F74207455165FCC51DC420904E30AC531EC36
MD5 SHA1 SHA512 TLSH

Submit Download

Crisp.exe

Path C:\Users\Admin\AppData\Roaming\ORCLHeap\Crisp.exe
Size 334KB
SHA256 c2e62475768c9546efe1da92a55f3bb2a55350eed83241139917aabd1ad25f8a
MD5 5f9f88c9a16b62dc38504549e93d3667
SHA1 587d56031b39e34102bc67b5f7d0338ee41b5328
SHA512 edbb7a8cd75e056d2c47b8af6fbee63726cb3d5f000d5f8bc000f4b16366619c8532e628585cc943f474d2509c63802179d0d22a1d32dd690fb25e00d262af83
SSDEEP 6144:7c2XFRJ3DNuzAOS9FuxIRtiiuhKPTqX4Y42:dFvYzU9kutRuhKPTqo32
TLSH
T125749E11B9D1C4B2C4B2053009E8EBB5697DFD714F61863B33D8772E1F742C1A662AA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

123.cmd

Path C:\Users\Admin\AppData\Roaming\ORCLHeap\NZMEQTLUQSR\123.cmd
Size 743KB
SHA256 d6197cf6341fda9f91b44dee7bff9c65ebd2a33ed16b7a77bb7e74684fd7cbbe
MD5 871164e95099050f09a80236ab8dd5d4
SHA1 b28ac8983d17fb9af6a5ac56740c12686209fa1f
SHA512 8448b72c4c345f07baa9082761cdc0430caef22d9505c007582af7acec3ff601baa402f4daa5485b30e1276b609526d8dd19ca373ae5209a35a7dfe7393fcb52
SSDEEP 6144:y3ILf26X5eUBcEvTGmaiE8Tdnc/x4WM0yktBBuS:y3ILDfcEvTGXiE0c5rM0yktBp
TLSH
T17EF419466D0251A601B3F379DE53814EFB2AC2638375526879ADC044BF3A309A2FEF5D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.QualityTools.VideoRecorderEngine.dll

Path C:\Users\Admin\AppData\Roaming\WNQT_net35_dbg\QMITTTECRITKKNKY\Microsoft.VisualStudio.QualityTools.VideoRecorderEngine.dll
Size 184KB
SHA256 353afad602ca52e0ae5e4bd21d30aa9400cb26070e534dc2bc6a35e2ec58da28
MD5 55e072016ee568ab4efd2e38dec8c98e
SHA1 d9be1170ae296f617e60de0d711b7180a0187880
SHA512 d96243d4bcdcde7d6265e864ddb2629f37408938d98d488b98baeb502672db20dc83c49b7107ab61591b0a8f40d9128760465adbd20e428ddca6daebd169de1c
SSDEEP 3072:e3L+vYKVnpM9b7ItsUn0h05ilgCQzeioerIAy57d/WNVL1eCnj9M:FpMxMtF05pgvr87lmekm
TLSH
T1D204491077E58931E6FB1A35B876992A497FB9220FE4E2DF1750166E0E316C0CE34B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

P_Lattic.exe

Path C:\Users\Admin\AppData\Roaming\WNQT_net35_dbg\QMITTTECRITKKNKY\P_Lattic.exe
Size 4.6MB
SHA256 1dfe7f509ab5380d6464b5dd9e0c7e205c7f0dc80edbffac75494cc1ebb0cce9
MD5 1bfae338b2a6140d01a834012db7f359
SHA1 31e54e330de45b31730a3ef5fd6f3d96e9826564
SHA512 38cee4cebc3c48e9611e27d4d99ad002a7940e9bc7259dd739ef681684313778f146fa87c4942c4f55eb957a66fc9e971b5d51d351326b12a2733640afec36d2
SSDEEP 49152:vkF1GOgzLU8s1vUyBpuHcx9TvTWj8j+dIWTgXFLSPJp+U17H83ztOGTLdlUTLdlz:vkF1qsCyBoC5Jj+CTup+UUfTRlUTRl
TLSH
T15526AE82BB479572F982843665397F3B083DAC3443A648E797843E2558732E32B3B757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

beacon_sdk.dll

Path C:\Users\Admin\AppData\Roaming\WNQT_net35_dbg\QMITTTECRITKKNKY\beacon_sdk.dll
Size 1.5MB
SHA256 c8405b2f3666de3f6904ac9619ef650afb825f94f8cbd45a0c22403b2ad57518
MD5 e4d38877ed2150b048210d7cc1afc013
SHA1 26ba12d8630b4be978f848fdcfbc0e7ccc4ad917
SHA512 2587d06a02853e190771b34b8512f371552c295b0c8893d826956e92431e54a270cf6042f740cb5a235ff621a9a88f4956cb2bf1fe4ca343e6d2411663a5b44c
SSDEEP 24576:PMVT8XoIxU8cqhg1MLXjNRy+LD4bBOkDygiBXFxn5P36H/bwzrgOtl52dmMl73TD:AT8XouBPhNNg+PIBOlgOXFx5yfbJWHM5
TLSH
T11C75AF13BA818472F5CD01B5A2BA9BBA4D3D9632072881D3D7D42CA49D705E37B3E35B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory-stub.pdb

Path C:\Users\Admin\AppData\Roaming\WNQT_net35_dbg\QMITTTECRITKKNKY\memory-stub.pdb
Size 2.5MB
SHA256 9b1fdd75cbbcc946efbb4e642e651655729685ff780d8d04124b04354c3d3467
MD5 043485cf9703d7d6345d58c7cbfda4f4
SHA1 dfe07ec8bb4c4b4e01bf93a30eef33a72a990732
SHA512 320cc1ab59d925c523f4fa1b03485ff5212be5f63d48d46aac443e528376590a9692a23a6491efc581379fc275a971a9fbe105a0a0fd3a028c9d989cb7edb275
SSDEEP 49152:qoTS3eidXbgRBioJLD3OJfsmiZqLLg35saU34DP8NgnP4E5q7lbYsAsh:XS6TULLjv4DENgn9ulbYdsh
TLSH
T18CC5333F5486C5AECCCA1AB31847F485BAFDAA37117849EECF818A81EEED1454205F74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140.dll

Path C:\Users\Admin\AppData\Roaming\WNQT_net35_dbg\QMITTTECRITKKNKY\msvcp140.dll
Size 429KB
SHA256 c09b126e7d4c1e6efb3ffcda2358252ce37383572c78e56ca97497a7f7c793e4
MD5 1d8c79f293ca86e8857149fb4efe4452
SHA1 7474e7a5cb9c79c4b99fdf9fb50ef3011bef7e8f
SHA512 83c4d842d4b07ba5cec559b6cd1c22ab8201941a667e7b173c405d2fc8862f7e5d9703e14bd7a1babd75165c30e1a2c95f9d1648f318340ea5e2b145d54919b1
SSDEEP 12288:oAoA7hbarg71r4RzfxjJhUgiW6QR7t5s03Ooc8dHkC2esq0Ju:oAoAN3r0Bm03Ooc8dHkC2eT0Ju
TLSH
T167944922BB820EF2E58E13B531C943225BF9FC254760A3C393DBF1596F556C26633A91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

renderhandler.dll

Path C:\Users\Admin\AppData\Roaming\WNQT_net35_dbg\QMITTTECRITKKNKY\renderhandler.dll
Size 34KB
SHA256 a9b6768cb9d63a95fa8eb16a976f7d228b8572e4d3d5e0cc84d354caa3734ea2
MD5 be5320609a41189b03779e6d74767f6e
SHA1 5a67bb6c3311662bc9c5cfa2238d609346882032
SHA512 ea3d96fbda7046d278f3142c473e29129c1a6d1188b4c42494f1b06afdf6fd07f437a1bf03f925446d32b72e4aa585b318b8c56ecb0346a9c3c551736471af21
SSDEEP 768:zoh1HGJNdgaEFYd3einpwu8ZwfXWt4cQ6mJlg47E5b/Ug0:+1H4Nl3zwu8Z2M4WoggEig0
TLSH
T17EF28DBA9B2B8E56B91AAC39981870D3C345F1FBBF090577F5D9281B70119D8E520EC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140.dll

Path C:\Users\Admin\AppData\Roaming\WNQT_net35_dbg\QMITTTECRITKKNKY\vcruntime140.dll
Size 83KB
SHA256 b7c13f8519340257ba6ae3129afce961f137e394dde3e4e41971b9f912355f5e
MD5 b77eeaeaf5f8493189b89852f3a7a712
SHA1 c40cf51c2eadb070a570b969b0525dc3fb684339
SHA512 a09a1b60c9605969a30f99d3f6215d4bf923759b4057ba0a5375559234f17d47555a84268e340ffc9ad07e03d11f40dd1f3fb5da108d11eb7f7933b7d87f2de3
SSDEEP 1536:BTXU4YQD+JZoxeu8zIrBj3hGzHRb3izsQe1o8jsu0gD/TecbOjc8WsaBmiK:pXUlQDeexZTBozHRb3izsQe1o8E8ecbg
TLSH
T145837D11B4D84072D16A493412AEEA73763CAA608FD54FDF6FAC4C9C1AB93C1773221B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Installer_L_X64_x86_2024.zip:Zone.Identifier

Path C:\Users\Admin\Downloads\Installer_L_X64_x86_2024.zip:Zone.Identifier
Size 137B
SHA256 9cc1a5be6b244767827f97358db44a67f4f40069321b935638230b2f70ee8cb9
MD5 13f6581bf4ec3e09b0f5d5ed4a4adf34
SHA1 92bf9859e53d21b46966a378912f9c0e95904556
SHA512 a8a7ceb907c72fd6b346753b4ce5eeaa17330ce4b25b2b306bfd64fcaf06335d0a2d9f957879af61213a613c38e44fbf61407e44c843a31043df649a12278459
TLSH
T190C09B9789404014275E32D557B7D45CB446F148CDF4D398E98441D3BD41555D5F193F
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3024_1611457961\manifest.json
Size 160B
SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
MD5 c3911ceb35539db42e5654bdd60ac956
SHA1 71be0751e5fc583b119730dbceb2c723f2389f6c
SHA512 d8b2c7c5b7105a6f0c4bc9c79c05b1202bc8deb90e60a037fec59429c04fc688a745ee1a0d06a8311466b4d14e2921dfb4476104432178c01df1e99deb48b331
TLSH
T1F1C08C73CC08AE7911B14B371B214642E3B8030B600039093A32084C0BA47B00262328
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3024_1821522555\manifest.json
Size 135B
SHA256 ba5c9096d20a482aaa1aa9e5f98ad6127d3e97c2f21de84f7c78d9b8073c8e26
MD5 fbebd68ecaa98928909421f66909c054
SHA1 99d787d90f7ed2e5ad924f9c5668eb988b5a6c07
SHA512 749a3b2be47fe28399dc763888654a3e8d397e06e8d3c3af3965bb45846a1336e6ab4ca82c82c3df846b34a2afafa2156f2690e9bf347ab175408dc0171c61cc
TLSH
T158C04C668D51DEAB00A747A56B295315E23B4B4B5044800A7AF5429C1A288964171944
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2004-702-0x0000000000450000-0x0000000000819000-memory.dmp

Download

memory/2004-759-0x0000000000450000-0x0000000000819000-memory.dmp

Download

memory/2004-735-0x0000000000450000-0x0000000000819000-memory.dmp

Download

memory/2004-706-0x00007FFAF8400000-0x00007FFAF8609000-memory.dmp

Download

memory/2004-1416-0x0000000000450000-0x0000000000819000-memory.dmp

Download

memory/2004-673-0x0000000000450000-0x0000000000819000-memory.dmp

Download

memory/2016-640-0x0000000000400000-0x00000000004D1000-memory.dmp

Download

memory/2016-646-0x0000000000AF0000-0x0000000000C2A000-memory.dmp

Download

memory/2016-553-0x0000000000AF0000-0x0000000000C2A000-memory.dmp

Download

memory/2016-554-0x00000000755B0000-0x00000000755FF000-memory.dmp

Download

memory/2016-644-0x0000000050000000-0x0000000050117000-memory.dmp

Download

memory/2016-645-0x0000000050120000-0x000000005030E000-memory.dmp

Download

memory/2016-555-0x00007FFAF8400000-0x00007FFAF8609000-memory.dmp

Download

memory/2016-577-0x00000000755B0000-0x00000000755FF000-memory.dmp

Download

memory/2016-642-0x0000000057000000-0x000000005703F000-memory.dmp

Download

memory/2016-629-0x00000000755B0000-0x00000000755FF000-memory.dmp

Download

memory/2016-643-0x0000000057800000-0x0000000057812000-memory.dmp

Download

memory/2016-641-0x0000000059800000-0x000000005986E000-memory.dmp

Download

memory/2316-620-0x00000250E38B0000-0x00000250E38D2000-memory.dmp

Download

memory/2416-757-0x00007FFAF8400000-0x00007FFAF8609000-memory.dmp

Download

memory/2416-760-0x00000000755B0000-0x00000000755FF000-memory.dmp

Download

memory/3724-712-0x00007FF756E00000-0x00007FF756F1F000-memory.dmp

Download

memory/3724-692-0x00007FF756E00000-0x00007FF756F1F000-memory.dmp

Download

memory/3724-1417-0x00007FF756E00000-0x00007FF756F1F000-memory.dmp

Download

memory/3724-763-0x00007FF756E00000-0x00007FF756F1F000-memory.dmp

Download

memory/3724-816-0x00007FF756E00000-0x00007FF756F1F000-memory.dmp

Download

memory/3900-764-0x00007FFAF8400000-0x00007FFAF8609000-memory.dmp

Download

memory/4376-647-0x00000000755B0000-0x00000000755FF000-memory.dmp

Download

memory/4376-616-0x00000000755B0000-0x00000000755FF000-memory.dmp

Download

memory/4376-614-0x00007FFAF8400000-0x00007FFAF8609000-memory.dmp

Download

memory/4376-613-0x00000000755B0000-0x00000000755FF000-memory.dmp

Download

memory/4376-724-0x0000000000B60000-0x000000000100E000-memory.dmp

Download