Analysis
- max time kernel
149s - max time network
154s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20260513-en - resource tags
arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows - submitted
23/05/2026, 04:20
Behavioral task
behavioral1
Sample
tmph6bxoily.exe
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
30 signatures
150 seconds
Behavioral task
behavioral2
Sample
tmph6bxoily.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
30 signatures
150 seconds
Behavioral task
behavioral3
Sample
tmph6bxoily.exe
Resource
win11-20260513-en
windows11-21h2-x64
29 signatures
150 seconds
General
- Target tmph6bxoily.exe
- Size 4.9MB
- Sample260523-ex4vmacy3r
- SHA256 1b3e955bff68102c66aeaa9a720104199e6e16d236b80e8836c0cc9b437e2824
- MD5 58aaeddecf19b06b95a228e2077e3058
- SHA1 fa640c339af00a50218d0292d3e7f962e2c15e51
- SHA512 f73efbad73176243bc6b22270a794d974307726d5b9eca7850121338460dbce2b3b68349d3e101443a40f8b3cb336b8799e83f7b5c6f3111ad11ae8e4218cd6b
- SSDEEP 98304:C6EHKfGqWMB67HLlXUIeHcVa74D7p6dmo1aUyxHgetoVHFRYLQYLpl4d:C69OqWV7Hi74Dl6dmHLHgzJFWLgd
- TLSH T1C036331373CB0432F0265E71EDB59C447EA3B5B80DF0A4082DF1C58D2ABE5A6A936776
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
hijackloader
Attributes
-
directory
%APPDATA%\utilityhost_v7_arm64_prod%APPDATA%
-
inject_dll
%windir%\SysWOW64\rasapi32.dll
xor.hex
Signatures
- Family: HijackLoader, IDAT loader, Ghostulse,
HijackLoader is a multi-stage loader, first seen in 2023.
- Detects HijackLoader (aka IDAT Loader) 1 IoCs
resource yara_rule behavioral1/files/0x0007000000028600-47.dat family_hijackloader - Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\drivers\gmreadme.txt usr_router_task.exe - Executes dropped EXE 3 IoCs
pid Process 1988 tmph6bxoily.tmp 4412 D-Transmit.exe 1944 D-Transmit.exe - Loads dropped DLL 25 IoCs
pid Process 4412 D-Transmit.exe 4412 D-Transmit.exe 4412 D-Transmit.exe 4412 D-Transmit.exe 4412 D-Transmit.exe 4412 D-Transmit.exe 4412 D-Transmit.exe 4412 D-Transmit.exe 4412 D-Transmit.exe 4412 D-Transmit.exe 4412 D-Transmit.exe 1944 D-Transmit.exe 1944 D-Transmit.exe 1944 D-Transmit.exe 1944 D-Transmit.exe 1944 D-Transmit.exe 1944 D-Transmit.exe 1944 D-Transmit.exe 1944 D-Transmit.exe 1944 D-Transmit.exe 1944 D-Transmit.exe 1944 D-Transmit.exe 1944 D-Transmit.exe 1132 usr_router_task.exe 2780 Crisp.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Drops file in System32 directory 7 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\default.help.txt usr_router_task.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\default.help.txt usr_router_task.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\default.help.txt usr_router_task.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\default.help.txt usr_router_task.exe File opened for modification C:\Windows\SysWOW64\WindowsCodecsRaw.txt usr_router_task.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\default.help.txt usr_router_task.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\default.help.txt usr_router_task.exe - Suspicious use of SetThreadContext 6 IoCs
description pid Process procid_target PID 1944 set thread context of 2780 1944 D-Transmit.exe 90 PID 1132 set thread context of 752 1132 usr_router_task.exe 93 PID 1132 set thread context of 5400 1132 usr_router_task.exe 112 PID 1132 set thread context of 752 1132 usr_router_task.exe 93 PID 1132 set thread context of 232 1132 usr_router_task.exe 120 PID 1132 set thread context of 1404 1132 usr_router_task.exe 123 - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\Lang\he.txt usr_router_task.exe File opened for modification C:\Program Files\7-Zip\Lang\hr.txt usr_router_task.exe File opened for modification C:\Program Files\7-Zip\Lang\mk.txt usr_router_task.exe File opened for modification C:\Program Files\7-Zip\Lang\mng.txt usr_router_task.exe File opened for modification C:\Program Files\7-Zip\Lang\nn.txt usr_router_task.exe File opened for modification C:\Program Files\Java\jdk-1.8\THIRDPARTYLICENSEREADME.txt usr_router_task.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Configuration\card_security_terms_dict.txt usr_router_task.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Mac\CYRILLIC.TXT usr_router_task.exe File opened for modification C:\Program Files\7-Zip\Lang\es.txt usr_router_task.exe File opened for modification C:\Program Files\7-Zip\Lang\is.txt usr_router_task.exe File opened for modification C:\Program Files\7-Zip\Lang\ms.txt usr_router_task.exe File opened for modification C:\Program Files\7-Zip\Lang\sk.txt usr_router_task.exe File opened for modification C:\Program Files\7-Zip\Lang\tg.txt usr_router_task.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\ClientLangPack2019_eula.txt usr_router_task.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\WacLangPack2019Eula.txt usr_router_task.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\win\CP1251.TXT usr_router_task.exe File opened for modification C:\Program Files\7-Zip\Lang\et.txt usr_router_task.exe File opened for modification C:\Program Files\7-Zip\Lang\kaa.txt usr_router_task.exe File opened for modification C:\Program Files\7-Zip\Lang\uk.txt usr_router_task.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Configuration\card_terms_dict.txt usr_router_task.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\en_GB\added.txt usr_router_task.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\ThirdPartyNotices.MSHWLatin.txt usr_router_task.exe File opened for modification C:\Program Files\7-Zip\History.txt usr_router_task.exe File opened for modification C:\Program Files\7-Zip\Lang\an.txt usr_router_task.exe File opened for modification C:\Program Files\7-Zip\Lang\da.txt usr_router_task.exe File opened for modification C:\Program Files\7-Zip\Lang\nb.txt usr_router_task.exe File opened for modification C:\Program Files\7-Zip\License.txt usr_router_task.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\LyncBasic_Eula.txt usr_router_task.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\en-US\about_Mocking.help.txt usr_router_task.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\en_US\Excluded.txt usr_router_task.exe File opened for modification C:\Program Files\7-Zip\Lang\ast.txt usr_router_task.exe File opened for modification C:\Program Files\7-Zip\Lang\ba.txt usr_router_task.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\THIRDPARTYLICENSEREADME.txt usr_router_task.exe File opened for modification C:\Program Files (x86)\Windows NT\TableTextService\TableTextServiceTigrinya.txt usr_router_task.exe File opened for modification C:\Program Files\7-Zip\Lang\cy.txt usr_router_task.exe File opened for modification C:\Program Files\7-Zip\Lang\ga.txt usr_router_task.exe File opened for modification C:\Program Files\7-Zip\Lang\gu.txt usr_router_task.exe File opened for modification C:\Program Files\7-Zip\Lang\tr.txt usr_router_task.exe File opened for modification C:\Program Files\7-Zip\Lang\hy.txt usr_router_task.exe File opened for modification C:\Program Files\7-Zip\Lang\ja.txt usr_router_task.exe File opened for modification C:\Program Files\7-Zip\Lang\pa-in.txt usr_router_task.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ThirdPartyNotices.ja-jp.txt usr_router_task.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\en-US\about_TestDrive.help.txt usr_router_task.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_GB\changelog.txt usr_router_task.exe File opened for modification C:\Program Files\7-Zip\Lang\ku.txt usr_router_task.exe File opened for modification C:\Program Files\7-Zip\Lang\sq.txt usr_router_task.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\server\Xusage.txt usr_router_task.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\ClientARMRefer_eula.txt usr_router_task.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\win\CP1254.TXT usr_router_task.exe File opened for modification C:\Program Files\7-Zip\Lang\eu.txt usr_router_task.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\ClientLangPack_eula.txt usr_router_task.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\ExcelMessageDismissal.txt usr_router_task.exe File opened for modification C:\Program Files\7-Zip\Lang\ar.txt usr_router_task.exe File opened for modification C:\Program Files\7-Zip\Lang\nl.txt usr_router_task.exe File opened for modification C:\Program Files\7-Zip\Lang\pt.txt usr_router_task.exe File opened for modification C:\Program Files\7-Zip\Lang\si.txt usr_router_task.exe File opened for modification C:\Program Files\7-Zip\Lang\th.txt usr_router_task.exe File opened for modification C:\Program Files\7-Zip\Lang\pl.txt usr_router_task.exe File opened for modification C:\Program Files\7-Zip\Lang\tk.txt usr_router_task.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Configuration\ssn_high_group_info.txt usr_router_task.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\AccessMessageDismissal.txt usr_router_task.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Mac\CENTEURO.TXT usr_router_task.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Mac\UKRAINE.TXT usr_router_task.exe File opened for modification C:\Program Files\7-Zip\Lang\de.txt usr_router_task.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\UKRAINE.TXT usr_router_task.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..e.desktop.searchapp_31bf3856ad364e35_10.0.19041.1_none_43fe9f4e368e081f\23.txt usr_router_task.exe File opened for modification C:\Windows\WinSxS\amd64_windows-senseclient-service_31bf3856ad364e35_10.0.19041.4355_none_1cdedcd7446f020d\n\NOTICE.txt usr_router_task.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_10.0.19041.1_es-es_81c367117552d701\default.help.txt usr_router_task.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\CENTEURO.TXT usr_router_task.exe File opened for modification C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\cache\Desktop\8.txt usr_router_task.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..e.desktop.searchapp_31bf3856ad364e35_10.0.19041.1_none_43fe9f4e368e081f\14.txt usr_router_task.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..e.desktop.searchapp_31bf3856ad364e35_10.0.19041.3758_none_029c2ba64c8b77bb\18.txt usr_router_task.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..e.desktop.searchapp_31bf3856ad364e35_10.0.19041.3758_none_029c2ba64c8b77bb\r\14.txt usr_router_task.exe File opened for modification C:\Windows\WinSxS\amd64_multimedia-generalmididata_31bf3856ad364e35_10.0.19041.1_none_3eae594ef5c099df\gmreadme.txt usr_router_task.exe File opened for modification C:\Windows\WinSxS\amd64_windows-shield-provider_31bf3856ad364e35_10.0.19041.4355_none_1aafe29782951faf\ThirdPartyNoticesBySHS.txt usr_router_task.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-windowscodecraw_31bf3856ad364e35_10.0.19041.3636_none_13e1b2c6a171ba1c\WindowsCodecsRaw.txt usr_router_task.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\CP1253.TXT usr_router_task.exe File opened for modification C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\cache\Desktop\13.txt usr_router_task.exe File opened for modification C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\cache\Desktop\16.txt usr_router_task.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..e.desktop.searchapp_31bf3856ad364e35_10.0.19041.3758_none_029c2ba64c8b77bb\f\14.txt usr_router_task.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..e.desktop.searchapp_31bf3856ad364e35_10.0.19041.3758_none_029c2ba64c8b77bb\r\6.txt usr_router_task.exe File opened for modification C:\Windows\WinSxS\amd64_windows-defender-service_31bf3856ad364e35_10.0.19041.746_none_a39f6d9ab59bd8b7\ThirdPartyNotices.txt usr_router_task.exe File opened for modification C:\Windows\WinSxS\amd64_windows-senseclient-service_31bf3856ad364e35_10.0.19041.4355_none_1cdedcd7446f020d\NOTICE.txt usr_router_task.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..e.desktop.searchapp_31bf3856ad364e35_10.0.19041.3758_none_029c2ba64c8b77bb\n\34.txt usr_router_task.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\ICELAND.TXT usr_router_task.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\CP1251.TXT usr_router_task.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\CP1258.TXT usr_router_task.exe File opened for modification C:\Windows\SystemTemp msedge.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..e.desktop.searchapp_31bf3856ad364e35_10.0.19041.3758_none_029c2ba64c8b77bb\f\21.txt usr_router_task.exe File opened for modification C:\Windows\WinSxS\amd64_windows-senseclient-service_31bf3856ad364e35_10.0.19041.4355_none_1cdedcd7446f020d\n\ThirdPartyNotice.txt usr_router_task.exe File opened for modification C:\Windows\WinSxS\amd64_windows-shield-provider_31bf3856ad364e35_10.0.19041.4355_none_1aafe29782951faf\n\ThirdPartyNoticesBySHS.txt usr_router_task.exe File opened for modification C:\Windows\SystemTemp chrome.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\CP1257.TXT usr_router_task.exe File opened for modification C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\cache\Desktop\5.txt usr_router_task.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_10.0.19041.1_it-it_044e29050af610e6\default.help.txt usr_router_task.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..e.desktop.searchapp_31bf3856ad364e35_10.0.19041.3758_none_029c2ba64c8b77bb\12.txt usr_router_task.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-t..-coreinkrecognition_31bf3856ad364e35_10.0.19041.746_none_cb918c7159c1f7d9\ThirdPartyNotices.MSHWLatin.txt usr_router_task.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_10.0.19041.1_it-it_0ea2d3573f56d2e1\default.help.txt usr_router_task.exe File opened for modification C:\Windows\WinSxS\wow64_multimedia-generalmididata_31bf3856ad364e35_10.0.19041.1_none_490303a12a215bda\gmreadme.txt usr_router_task.exe File opened for modification C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\cache\Desktop\12.txt usr_router_task.exe File opened for modification C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\cache\Desktop\3.txt usr_router_task.exe File opened for modification C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\cache\Desktop\36.txt usr_router_task.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..e.desktop.searchapp_31bf3856ad364e35_10.0.19041.3758_none_029c2ba64c8b77bb\35.txt usr_router_task.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft.powershell.pester_31bf3856ad364e35_10.0.19041.1_none_8a237828132e61da\about_TestDrive.help.txt usr_router_task.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft.powershell.pester_31bf3856ad364e35_10.0.19041.1_none_9478227a478f23d5\about_Pester.help.txt usr_router_task.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..e.desktop.searchapp_31bf3856ad364e35_10.0.19041.3758_none_029c2ba64c8b77bb\17.txt usr_router_task.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..e.desktop.searchapp_31bf3856ad364e35_10.0.19041.3758_none_029c2ba64c8b77bb\28.txt usr_router_task.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft.powershell.pester_31bf3856ad364e35_10.0.19041.1_none_9478227a478f23d5\about_TestDrive.help.txt usr_router_task.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..e.desktop.searchapp_31bf3856ad364e35_10.0.19041.3758_none_029c2ba64c8b77bb\f\12.txt usr_router_task.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..e.desktop.searchapp_31bf3856ad364e35_10.0.19041.3758_none_029c2ba64c8b77bb\r\13.txt usr_router_task.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..e.desktop.searchapp_31bf3856ad364e35_10.0.19041.3758_none_029c2ba64c8b77bb\r\9.txt usr_router_task.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-t..nkrecognition.ja-jp_31bf3856ad364e35_10.0.19041.1_none_7c0cc5368758e843\ThirdPartyNotices.ja-jp.txt usr_router_task.exe File opened for modification C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\cache\Desktop\11.txt usr_router_task.exe File opened for modification C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\cache\Desktop\34.txt usr_router_task.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..e.desktop.searchapp_31bf3856ad364e35_10.0.19041.1_none_43fe9f4e368e081f\5.txt usr_router_task.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..e.desktop.searchapp_31bf3856ad364e35_10.0.19041.3758_none_029c2ba64c8b77bb\16.txt usr_router_task.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..e.desktop.searchapp_31bf3856ad364e35_10.0.19041.3758_none_029c2ba64c8b77bb\f\4.txt usr_router_task.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..e.desktop.searchapp_31bf3856ad364e35_10.0.19041.3758_none_029c2ba64c8b77bb\n\32.txt usr_router_task.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..e.desktop.searchapp_31bf3856ad364e35_10.0.19041.3758_none_029c2ba64c8b77bb\r\11.txt usr_router_task.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-t..extservice-tigrinya_31bf3856ad364e35_10.0.19041.1_none_2863d34beb4a07ef\TableTextServiceTigrinya.txt usr_router_task.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\CP1254.TXT usr_router_task.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\CYRILLIC.TXT usr_router_task.exe File opened for modification C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\cache\Desktop\25.txt usr_router_task.exe File opened for modification C:\Windows\WinSxS\amd64_hyperv-vmchipset_31bf3856ad364e35_10.0.19041.4355_none_49f7f1fb41e2907c\VmChipset Third-Party Notices.txt usr_router_task.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..e.desktop.searchapp_31bf3856ad364e35_10.0.19041.3758_none_029c2ba64c8b77bb\f\11.txt usr_router_task.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..e.desktop.searchapp_31bf3856ad364e35_10.0.19041.3758_none_029c2ba64c8b77bb\f\13.txt usr_router_task.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..e.desktop.searchapp_31bf3856ad364e35_10.0.19041.3758_none_029c2ba64c8b77bb\f\15.txt usr_router_task.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_10.0.19041.1_de-de_ceb289e251ed179c\default.help.txt usr_router_task.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tmph6bxoily.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tmph6bxoily.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language usr_router_task.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Crisp.exe - System Time Discovery 1 TTPs 3 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 5868 chrome.exe 5420 msedge.exe 6248 chrome.exe - Inno Setup is an open-source installation builder for Windows applications. 3 IoCs
Inno Setup installer
resource yara_rule behavioral1/memory/6136-0-0x0000000000400000-0x0000000000428000-memory.dmp innosetup behavioral1/memory/6136-43-0x0000000000400000-0x0000000000428000-memory.dmp innosetup behavioral1/memory/6136-66-0x0000000000400000-0x0000000000428000-memory.dmp innosetup - Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier msedge.exe - Enumerates system info in registry 2 TTPs 6 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe - Modifies data under HKEY_USERS 3 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134239836798373009" chrome.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry msedge.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-101591186-421676486-4137282292-1000\{B30394CD-D2D4-43E4-9B86-48720635B0B0} msedge.exe - Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1132 usr_router_task.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4412 D-Transmit.exe 1944 D-Transmit.exe 1944 D-Transmit.exe 1944 D-Transmit.exe 1132 usr_router_task.exe 1132 usr_router_task.exe 1132 usr_router_task.exe 1132 usr_router_task.exe 1132 usr_router_task.exe 1132 usr_router_task.exe 1132 usr_router_task.exe 1132 usr_router_task.exe 1132 usr_router_task.exe 1132 usr_router_task.exe 1132 usr_router_task.exe 1132 usr_router_task.exe 1132 usr_router_task.exe 1132 usr_router_task.exe 1132 usr_router_task.exe 1132 usr_router_task.exe 752 chrome.exe 752 chrome.exe 1132 usr_router_task.exe 1132 usr_router_task.exe 1132 usr_router_task.exe 1132 usr_router_task.exe 1132 usr_router_task.exe 1132 usr_router_task.exe 1132 usr_router_task.exe 1132 usr_router_task.exe 1132 usr_router_task.exe 1132 usr_router_task.exe 2780 Crisp.exe 2780 Crisp.exe 1132 usr_router_task.exe 1132 usr_router_task.exe 1132 usr_router_task.exe 1132 usr_router_task.exe 1132 usr_router_task.exe 1132 usr_router_task.exe 1132 usr_router_task.exe 1132 usr_router_task.exe 1132 usr_router_task.exe 1132 usr_router_task.exe 1132 usr_router_task.exe 1132 usr_router_task.exe 1132 usr_router_task.exe 1132 usr_router_task.exe 1132 usr_router_task.exe 1132 usr_router_task.exe 1132 usr_router_task.exe 1132 usr_router_task.exe 1132 usr_router_task.exe 1132 usr_router_task.exe 1132 usr_router_task.exe 1132 usr_router_task.exe 1132 usr_router_task.exe 1132 usr_router_task.exe 1132 usr_router_task.exe 1132 usr_router_task.exe 1132 usr_router_task.exe 1132 usr_router_task.exe 1132 usr_router_task.exe 1132 usr_router_task.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1132 usr_router_task.exe - Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 1944 D-Transmit.exe 1944 D-Transmit.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 752 chrome.exe 752 chrome.exe 752 chrome.exe 752 chrome.exe 1404 msedge.exe 1404 msedge.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1132 usr_router_task.exe Token: SeShutdownPrivilege 752 chrome.exe Token: SeCreatePagefilePrivilege 752 chrome.exe Token: SeShutdownPrivilege 752 chrome.exe Token: SeCreatePagefilePrivilege 752 chrome.exe Token: SeShutdownPrivilege 752 chrome.exe Token: SeCreatePagefilePrivilege 752 chrome.exe Token: SeShutdownPrivilege 752 chrome.exe Token: SeCreatePagefilePrivilege 752 chrome.exe Token: SeShutdownPrivilege 752 chrome.exe Token: SeCreatePagefilePrivilege 752 chrome.exe Token: SeShutdownPrivilege 752 chrome.exe Token: SeCreatePagefilePrivilege 752 chrome.exe Token: SeShutdownPrivilege 752 chrome.exe Token: SeCreatePagefilePrivilege 752 chrome.exe Token: SeShutdownPrivilege 752 chrome.exe Token: SeCreatePagefilePrivilege 752 chrome.exe Token: SeShutdownPrivilege 752 chrome.exe Token: SeCreatePagefilePrivilege 752 chrome.exe Token: SeShutdownPrivilege 752 chrome.exe Token: SeCreatePagefilePrivilege 752 chrome.exe Token: SeShutdownPrivilege 752 chrome.exe Token: SeCreatePagefilePrivilege 752 chrome.exe Token: SeShutdownPrivilege 752 chrome.exe Token: SeCreatePagefilePrivilege 752 chrome.exe Token: SeShutdownPrivilege 752 chrome.exe Token: SeCreatePagefilePrivilege 752 chrome.exe Token: SeShutdownPrivilege 752 chrome.exe Token: SeCreatePagefilePrivilege 752 chrome.exe Token: SeShutdownPrivilege 752 chrome.exe Token: SeCreatePagefilePrivilege 752 chrome.exe Token: SeShutdownPrivilege 752 chrome.exe Token: SeCreatePagefilePrivilege 752 chrome.exe Token: SeShutdownPrivilege 752 chrome.exe Token: SeCreatePagefilePrivilege 752 chrome.exe Token: SeShutdownPrivilege 752 chrome.exe Token: SeCreatePagefilePrivilege 752 chrome.exe Token: SeShutdownPrivilege 752 chrome.exe Token: SeCreatePagefilePrivilege 752 chrome.exe Token: SeShutdownPrivilege 752 chrome.exe Token: SeCreatePagefilePrivilege 752 chrome.exe Token: SeShutdownPrivilege 752 chrome.exe Token: SeCreatePagefilePrivilege 752 chrome.exe Token: SeShutdownPrivilege 752 chrome.exe Token: SeCreatePagefilePrivilege 752 chrome.exe Token: SeShutdownPrivilege 752 chrome.exe Token: SeCreatePagefilePrivilege 752 chrome.exe Token: SeShutdownPrivilege 752 chrome.exe Token: SeCreatePagefilePrivilege 752 chrome.exe Token: SeShutdownPrivilege 752 chrome.exe Token: SeCreatePagefilePrivilege 752 chrome.exe Token: SeDebugPrivilege 1132 usr_router_task.exe Token: SeDebugPrivilege 1132 usr_router_task.exe Token: SeShutdownPrivilege 752 chrome.exe Token: SeCreatePagefilePrivilege 752 chrome.exe Token: SeShutdownPrivilege 752 chrome.exe Token: SeCreatePagefilePrivilege 752 chrome.exe Token: SeShutdownPrivilege 752 chrome.exe Token: SeCreatePagefilePrivilege 752 chrome.exe Token: SeShutdownPrivilege 752 chrome.exe Token: SeCreatePagefilePrivilege 752 chrome.exe Token: SeShutdownPrivilege 752 chrome.exe Token: SeCreatePagefilePrivilege 752 chrome.exe Token: SeShutdownPrivilege 752 chrome.exe - Suspicious use of FindShellTrayWindow 35 IoCs
pid Process 752 chrome.exe 752 chrome.exe 752 chrome.exe 752 chrome.exe 752 chrome.exe 752 chrome.exe 752 chrome.exe 752 chrome.exe 752 chrome.exe 752 chrome.exe 752 chrome.exe 752 chrome.exe 752 chrome.exe 752 chrome.exe 752 chrome.exe 752 chrome.exe 752 chrome.exe 752 chrome.exe 752 chrome.exe 752 chrome.exe 752 chrome.exe 752 chrome.exe 752 chrome.exe 752 chrome.exe 752 chrome.exe 752 chrome.exe 752 chrome.exe 752 chrome.exe 752 chrome.exe 752 chrome.exe 752 chrome.exe 752 chrome.exe 752 chrome.exe 752 chrome.exe 1404 msedge.exe - Suspicious use of SendNotifyMessage 32 IoCs
pid Process 752 chrome.exe 752 chrome.exe 752 chrome.exe 752 chrome.exe 752 chrome.exe 752 chrome.exe 752 chrome.exe 752 chrome.exe 752 chrome.exe 752 chrome.exe 752 chrome.exe 752 chrome.exe 752 chrome.exe 752 chrome.exe 752 chrome.exe 752 chrome.exe 752 chrome.exe 752 chrome.exe 752 chrome.exe 752 chrome.exe 752 chrome.exe 752 chrome.exe 752 chrome.exe 752 chrome.exe 752 chrome.exe 752 chrome.exe 752 chrome.exe 752 chrome.exe 752 chrome.exe 752 chrome.exe 752 chrome.exe 752 chrome.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 6136 wrote to memory of 1988 6136 tmph6bxoily.exe 83 PID 1988 wrote to memory of 4412 1988 tmph6bxoily.tmp 84 PID 4412 wrote to memory of 1944 4412 D-Transmit.exe 85 PID 1944 wrote to memory of 1132 1944 D-Transmit.exe 88 PID 1944 wrote to memory of 1132 1944 D-Transmit.exe 88 PID 1944 wrote to memory of 1132 1944 D-Transmit.exe 88 PID 1944 wrote to memory of 2780 1944 D-Transmit.exe 90 PID 752 wrote to memory of 3656 752 chrome.exe 95 PID 752 wrote to memory of 5112 752 chrome.exe 96 PID 752 wrote to memory of 5112 752 chrome.exe 96 PID 752 wrote to memory of 5868 752 chrome.exe 97 PID 752 wrote to memory of 2704 752 chrome.exe 98 PID 752 wrote to memory of 2704 752 chrome.exe 98 PID 752 wrote to memory of 2948 752 chrome.exe 99 PID 752 wrote to memory of 1300 752 chrome.exe 100 PID 752 wrote to memory of 2948 752 chrome.exe 99 PID 752 wrote to memory of 1300 752 chrome.exe 100 PID 752 wrote to memory of 2600 752 chrome.exe 102 PID 752 wrote to memory of 2600 752 chrome.exe 102 PID 752 wrote to memory of 5232 752 chrome.exe 103 PID 752 wrote to memory of 5232 752 chrome.exe 103 PID 752 wrote to memory of 5124 752 chrome.exe 104 PID 1944 wrote to memory of 2780 1944 D-Transmit.exe 90 PID 1132 wrote to memory of 752 1132 usr_router_task.exe 93 PID 1132 wrote to memory of 752 1132 usr_router_task.exe 93 PID 1132 wrote to memory of 752 1132 usr_router_task.exe 93 PID 1132 wrote to memory of 752 1132 usr_router_task.exe 93 PID 1132 wrote to memory of 752 1132 usr_router_task.exe 93 PID 1132 wrote to memory of 5400 1132 usr_router_task.exe 112 PID 1132 wrote to memory of 5400 1132 usr_router_task.exe 112 PID 1132 wrote to memory of 5400 1132 usr_router_task.exe 112 PID 1132 wrote to memory of 5400 1132 usr_router_task.exe 112 PID 1132 wrote to memory of 5400 1132 usr_router_task.exe 112 PID 1132 wrote to memory of 5400 1132 usr_router_task.exe 112 PID 1132 wrote to memory of 752 1132 usr_router_task.exe 93 PID 1132 wrote to memory of 752 1132 usr_router_task.exe 93 PID 1132 wrote to memory of 752 1132 usr_router_task.exe 93 PID 1132 wrote to memory of 752 1132 usr_router_task.exe 93 PID 1132 wrote to memory of 752 1132 usr_router_task.exe 93 PID 752 wrote to memory of 4904 752 chrome.exe 117 PID 752 wrote to memory of 4596 752 chrome.exe 118 PID 752 wrote to memory of 3480 752 chrome.exe 119 PID 1132 wrote to memory of 232 1132 usr_router_task.exe 120 PID 1132 wrote to memory of 232 1132 usr_router_task.exe 120 PID 1132 wrote to memory of 232 1132 usr_router_task.exe 120 PID 1132 wrote to memory of 232 1132 usr_router_task.exe 120 PID 1132 wrote to memory of 232 1132 usr_router_task.exe 120 PID 1132 wrote to memory of 232 1132 usr_router_task.exe 120 PID 1612 wrote to memory of 1404 1612 msedge.exe 123 PID 1404 wrote to memory of 564 1404 msedge.exe 124 PID 1404 wrote to memory of 5420 1404 msedge.exe 125 PID 1404 wrote to memory of 3604 1404 msedge.exe 126 PID 1404 wrote to memory of 3604 1404 msedge.exe 126 PID 1404 wrote to memory of 3604 1404 msedge.exe 126 PID 1404 wrote to memory of 3912 1404 msedge.exe 127 PID 1404 wrote to memory of 3912 1404 msedge.exe 127 PID 1404 wrote to memory of 2080 1404 msedge.exe 128 PID 1404 wrote to memory of 2080 1404 msedge.exe 128 PID 1404 wrote to memory of 184 1404 msedge.exe 129 PID 1404 wrote to memory of 2080 1404 msedge.exe 128 PID 1404 wrote to memory of 184 1404 msedge.exe 129 PID 1404 wrote to memory of 184 1404 msedge.exe 129 PID 1132 wrote to memory of 1404 1132 usr_router_task.exe 123 PID 1132 wrote to memory of 1404 1132 usr_router_task.exe 123
Processes
-
C:\Users\Admin\AppData\Local\Temp\tmph6bxoily.exe"C:\Users\Admin\AppData\Local\Temp\tmph6bxoily.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6136 -
C:\Users\Admin\AppData\Local\Temp\is-TAK9L.tmp\tmph6bxoily.tmp"C:\Users\Admin\AppData\Local\Temp\is-TAK9L.tmp\tmph6bxoily.tmp" /SL5="$801B8,4788852,121344,C:\Users\Admin\AppData\Local\Temp\tmph6bxoily.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1988 -
C:\Users\Admin\AppData\Local\Temp\is-6P9KC.tmp\D-Transmit.exe"C:\Users\Admin\AppData\Local\Temp\is-6P9KC.tmp\D-Transmit.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4412 -
C:\ProgramData\utilityhost_v7_arm64_prod%APPDATA%\D-Transmit.exeC:\ProgramData\utilityhost_v7_arm64_prod%APPDATA%\D-Transmit.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1944 -
C:\Users\Admin\AppData\Local\Temp\usr_router_task.exeC:\Users\Admin\AppData\Local\Temp\usr_router_task.exe5⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1132 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"6⤵PID:5400
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"6⤵PID:232
-
-
-
C:\Users\Admin\AppData\Roaming\utilityhost_v7_arm64_prod%APPDATA%\Crisp.exeC:\Users\Admin\AppData\Roaming\utilityhost_v7_arm64_prod%APPDATA%\Crisp.exe5⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2780
-
-
-
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {c08afd90-f2a1-11d1-8455-00a0c91f3880} -Embedding1⤵PID:3192
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:2396
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:752 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x22c,0x230,0x234,0x208,0x238,0x7ffd817dc728,0x7ffd817dc734,0x7ffd817dc7402⤵PID:3656
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1768,i,3393272886610376772,16717464161388197437,262144 --field-trial-handle=1984,i,8159056580863702378,561147417344888892,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=1980 /prefetch:22⤵PID:5112
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1608,i,17155173444880709715,10746709724479255204,524288 --field-trial-handle=1984,i,8159056580863702378,561147417344888892,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=2252 /prefetch:32⤵
- System Time Discovery
PID:5868
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2368,i,8456565266006800717,12306976630116625269,524288 --field-trial-handle=1984,i,8159056580863702378,561147417344888892,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=2540 /prefetch:82⤵PID:2704
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3228,i,11645233990547912977,2640516299755611289,2097152 --field-trial-handle=1984,i,8159056580863702378,561147417344888892,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=3232 /prefetch:12⤵PID:2948
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3252,i,16289770344739228484,12140770042739285254,2097152 --field-trial-handle=1984,i,8159056580863702378,561147417344888892,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=3272 /prefetch:12⤵PID:1300
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4336,i,763475020022031414,17877226004924725357,2097152 --field-trial-handle=1984,i,8159056580863702378,561147417344888892,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=4348 /prefetch:22⤵PID:2600
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4660,i,16514157480790232476,16359373200927519925,2097152 --field-trial-handle=1984,i,8159056580863702378,561147417344888892,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=4628 /prefetch:12⤵PID:5232
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5424,i,7457784815210448023,7097424765438579287,524288 --field-trial-handle=1984,i,8159056580863702378,561147417344888892,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=5432 /prefetch:82⤵PID:5124
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5624,i,446489879893526406,2769921518595633610,524288 --field-trial-handle=1984,i,8159056580863702378,561147417344888892,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=5704 /prefetch:82⤵PID:4904
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5620,i,7969585239791178617,2267298964258647445,524288 --field-trial-handle=1984,i,8159056580863702378,561147417344888892,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=5740 /prefetch:82⤵PID:4596
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5524,i,8362004296183103940,4641562876660719422,524288 --field-trial-handle=1984,i,8159056580863702378,561147417344888892,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=5764 /prefetch:82⤵PID:3480
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1608,i,13429459456326939270,17696918442617029504,524288 --field-trial-handle=1984,i,8159056580863702378,561147417344888892,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=2248 /prefetch:32⤵
- System Time Discovery
PID:6248
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:2096
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:1964
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:2616
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:4800
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:2992
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:1908
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1612 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch2⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1404 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x308,0x7ffd6b18c188,0x7ffd6b18c194,0x7ffd6b18c1a03⤵PID:564
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1840,i,12187839336683508607,11370429546527909205,524288 --field-trial-handle=2336,i,3384108275909393882,16460876480946301810,262144 --variations-seed-version --mojo-platform-channel-handle=2368 /prefetch:33⤵
- System Time Discovery
PID:5420
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1688,i,3090047936311003727,3613295332251657290,262144 --field-trial-handle=2336,i,3384108275909393882,16460876480946301810,262144 --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:23⤵PID:3604
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2344,i,7949640055513840800,16543660310386918451,524288 --field-trial-handle=2336,i,3384108275909393882,16460876480946301810,262144 --variations-seed-version --mojo-platform-channel-handle=2400 /prefetch:83⤵PID:3912
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3428,i,14990227516045684793,2338601158325067725,2097152 --field-trial-handle=2336,i,3384108275909393882,16460876480946301810,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:13⤵PID:2080
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3448,i,9079425941349031589,2302941700171156054,2097152 --field-trial-handle=2336,i,3384108275909393882,16460876480946301810,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:13⤵PID:184
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5248,i,12661233248144220386,887427778203905445,524288 --field-trial-handle=2336,i,3384108275909393882,16460876480946301810,262144 --variations-seed-version --mojo-platform-channel-handle=5292 /prefetch:83⤵PID:3600
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5252,i,5242125595009851488,13537618434131917450,524288 --field-trial-handle=2336,i,3384108275909393882,16460876480946301810,262144 --variations-seed-version --mojo-platform-channel-handle=5296 /prefetch:83⤵PID:5836
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6024,i,13526947326719057170,14163543508146097472,524288 --field-trial-handle=2336,i,3384108275909393882,16460876480946301810,262144 --variations-seed-version --mojo-platform-channel-handle=5856 /prefetch:83⤵PID:5340
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6024,i,13526947326719057170,14163543508146097472,524288 --field-trial-handle=2336,i,3384108275909393882,16460876480946301810,262144 --variations-seed-version --mojo-platform-channel-handle=5856 /prefetch:83⤵PID:1956
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4900,i,335264294297092278,10483878185926437169,524288 --field-trial-handle=2336,i,3384108275909393882,16460876480946301810,262144 --variations-seed-version --mojo-platform-channel-handle=4904 /prefetch:83⤵PID:2032
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5124,i,9987010546082850578,12380995966012854212,524288 --field-trial-handle=2336,i,3384108275909393882,16460876480946301810,262144 --variations-seed-version --mojo-platform-channel-handle=136 /prefetch:83⤵PID:216
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=600,i,14361918217857548984,7643540304474695603,524288 --field-trial-handle=2336,i,3384108275909393882,16460876480946301810,262144 --variations-seed-version --mojo-platform-channel-handle=6140 /prefetch:83⤵PID:5264
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵PID:3700
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵PID:6012
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵PID:5692
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
3Credentials In Files
3Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\CrashpadMetrics-active.pma
- Size 1024KB
- SHA256 67ee11b51cd6f637795e31ab501f135ed595c8459bce885735f08b0418513a17
- MD5 34c29bdb9e41b1f47f2d2786762c12ec
- SHA1 4075131b18c3487e3e848361e112009c897629c7
- SHA512 ca3a978798e77b2ced27b379f38e935ef18beaa7ea23e34270a9af20b37e1b1c5edf9478606311cf1acabd83992766cb3da8444de9394c674d5955bdbc53c0d0
- SSDEEP 12:bHCskaXhVMMBKEKSCemJKlkQfIYVhYJ0X:bi0ROMMBS+MkEPYW
- TLSH T151259286B34455BBC54189B188AA17606274F9E89F82179A3B18E60F1E661DC0F51964
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
- Size 649B
- SHA256 2832ce05f88fbec1110ef201814ab446b3c59efa12fb562b969d8022b0a44cae
- MD5 756315610f74a82bd17f9f89e9485052
- SHA1 3b2b9f1b906bb63a70302438be8991e3b5f24d66
- SHA512 27ae0fae7fcdf2a6fd9dc08bfe91d4521c461c1ecb2c13f8e56638a319473eabcd91e29704a4f650feca6e5c6f5706fd497d1b476ff833299f652f315201742f
- TLSH T11EF02DB9C9219C3718FC1B2D20944B46FB4513672B80885F3A3D420D8FB573B459591C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 3KB
- SHA256 4b6c256cae65674b08b5ac02fe6a277e30960bb132159172512f9a222fef5f5f
- MD5 34556c13c11e1e3399be8273398287b1
- SHA1 4605d317dd7451c3a2c3d5e845bc3942758cfbed
- SHA512 74b1a21d23ccb08ea6b3548610e3beba808b9367d63aa8928cdfc68773f16d8f4f01d6bbd9a217ed73c924ba5a12feb71a166c83cb49ca9b5c6612bb467a8ffc
- TLSH T1A2517CB3C7D8866D881156F4AB256E2FCD2D0A18631D3C66C8D4AF4B53E6872D34138E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 cd48dfaee2cc134335a8f6f84cfaf91404fbcc8b74482f4dab2967a2fdac48d2
- MD5 b8c7610372ed7d6140141db61310669b
- SHA1 1fa18c901f1793d48516accf6e1e894f7d774318
- SHA512 3542cb24588ad9bb675686555885b511ab19b45acf0e314811fa29ff0476fcfeb876d415eec7ac37742177871acd96a2dc87197720d06c4cb9327f44b2004f4e
- SSDEEP 192:8RAfxux8cx+v7dpAPRp2c97Hsb+WNnYW0by2EUkwpVyIsnAUgtaJ:8RAfI65UXDdwl0W2Bv8
- TLSH T1C542A72EAD20793B5CDAD62EFA663753D3F5203171942E84E6FC8A2C14D75CC2227817
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 17KB
- SHA256 6646989bfcb5c97513acdde7bf1e6a934ad9e4a758723746e8ad756689192b52
- MD5 a53b398127eef947fb45f97818cbc504
- SHA1 feb83c16e01a91151075652e72c375abfdb60d64
- SHA512 7d4597211aa3b5d84a9750798703e7119d689c2b5783eba16dc6b3a7fad248d1392de105073b4174c487374230945692a752279764d5846cd7995ff455d202cc
- SSDEEP 384:UOjwL7KxkXqKf/pUZNCgVLH2Hfgsl5T7pLuLcSjGHXODwn+ErU3uZHG29t8OPHu:U+wL7KxkXqKf/pUZNCgVLH2Hfgs3T7pe
- TLSH T16772F8A76C4C9E370FD8C5CCD82A7B4FADB5024B65E9886482FA581903D5BDB11062FB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
- Size 120B
- SHA256 80e7ce7fc66152841b7f1134c674db2feba4f7171f590913c5ea32fd73c130a4
- MD5 de31bc8c7e4844e924f295cfea6e79eb
- SHA1 ad34218c1c65840aa85efdcfbf70e5a2f34a38d6
- SHA512 a3a21c1f075b4e8b8a70f9bc215b119380beb82859aaf8e393d83544cd96af1234d3c479cf611abe4ce30a52fb780b4761ffb972ab6c32c88c277804ed92fd9a
- TLSH T1A1B0124080019901C04707F43153548871245F14970F1F01C3E06A66C8261618018050
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5963b2.TMP
- Size 96B
- SHA256 bf2dc1d89b1a9c2d4ba05c462ddc9a7c8c4f99a84d6335bf97f0ebf71ba94334
- MD5 0853f33162fc1ef94e7a00653a271a63
- SHA1 dd95b918e6334e4e924d73112d977c1ad4a688fb
- SHA512 b51a43fe8e37ef8a70bb8a66df3866ae2bf2d7c3b5335f9f2ab69b37f72f2cc496b1a284b456833025f70a127556ef793af0b9b0bdae6ad07157c96d862ef487
- TLSH T199B02283C2032202C00283F03AA880C83030CF20E2030202A2E02BB2CC222F00038020
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Browser
- Size 106B
- SHA256 3615498fbef408a96bf30e01c318dac2d5451b054998119080e7faac5995f590
- MD5 de9ef0c5bcc012a3a1131988dee272d8
- SHA1 fa9ccbdc969ac9e1474fce773234b28d50951cd8
- SHA512 cea946ebeadfe6be65e33edff6c68953a84ec2e2410884e12f406cac1e6c8a0793180433a7ef7ce097b24ea78a1fdbb4e3b3d9cdf1a827ab6ff5605da3691724
- TLSH T1AAB0112033FC0228F3F38200AE333BA00F3FF8230000022CA008228808B38288880FB3
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version
- Size 13B
- SHA256 e5efa9eb104cd0b25149c2e789bec8d9aa4ba95678831b657eef7780a281c391
- MD5 43ef949d3c6e9956545979ace65d0085
- SHA1 63f2b2de8727854597e49a1216e8e74c68117c07
- SHA512 313a5ab7ac9b5efd955beba4615784bdc2a9058ddaa804d85fb2d0c651dd3de07e382d61a1bb482499520a80e0b64c004ff2af03459cbc1daef47f540f0a6905
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 7KB
- SHA256 1d3d9d08dcea1af4d8c862355a8ddda823461e8e93503c6d2872461eb6f54ca4
- MD5 d8d61c8469f498e61f09d0b866f018da
- SHA1 e63bf959c008df8279b33ec0e961231e2f8769a8
- SHA512 b836a815571e268b1ba4c5cdce2a5c9f6478a565f155504cc6580e38778c6fcf076f197f1f4cdc8f1675a9f7c31424ac5f4e4865878030d22e67f6311f6df2b7
- SSDEEP 192:eNtjRHCw95KiU2iErnaA+8SxM6F4xvkjLJJ/:CtlHCUK2z+8P6F4xMjLJJ/
- TLSH T11EF1A9BAA8195C5649F7588DA1023A034DF4B3ABDA58AD9CB8DC2F0D41CF0EC5B07922
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 5KB
- SHA256 36156598c3d846e0c6aa41bedc713a4f1ae372b241b6616a420ed31b168927fc
- MD5 8220a8fb2b334ad87de9842194ed2ee5
- SHA1 11448dcc1eeb9b0a4097d9a8ee4b7fe833d8267e
- SHA512 daad02e2d3b8de122d66801893da823d68ce5083f41e51f82350f782e0c75db76a652dbdbf84f6be964eb81b46fdab060e324e3ea15002852e2a01ac291b312f
- SSDEEP 96:eNC0d++nHQU0Ttfy95z4CRDotok5v0DgB6PJGyvyL9QN6HBC1Zwh11a:eNC0RHCw955DUDaEo0N9QN6HBC1q1s
- TLSH T177B1FBB6D4698C77157B85C9F5466B06CFB8F0EBE5609E989DDD1F0D01EB0E81302932
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 6KB
- SHA256 ea1ae99f689f085b0310cb39391e30442b433bcfd4e4d4a695e7dfabbf2d608c
- MD5 3da6af48c4ccadda7260008ed5f6b07e
- SHA1 7a9de7b1975da3a1e996f11e9e91bd5138601671
- SHA512 04daefdef8567a025d718eddd22a0cc62ccec90e969506222e395adab32a2c8f76ed29a04de4b85b386b9880d2826308e58ac2802de9f4e3ad3f4f2d195d61f2
- SSDEEP 96:eNbJ6wd++nHQU0Ttfy9524KSl8h4otop5vcDgB6bGyvyL+wV1mm8XSrM6h0j9ICZ:eNtjRHCw95KiU2iErN++8XSrM6hUZzJ/
- TLSH T178E11ABAE8799C6355BBE5DAF4072B07CEB4B0EBE65059A499D95F0D01CB0EC1303932
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Variations
- Size 86B
- SHA256 2741df9ee9e9d9883397078f94480e9bc1d9c76996eec5cfe4e77929337cbe93
- MD5 f732dbed9289177d15e236d0f8f2ddd3
- SHA1 53f822af51b014bc3d4b575865d9c3ef0e4debde
- SHA512 b64e5021f32e26c752fcba15a139815894309b25644e74ceca46a9aa97070bca3b77ded569a9bfd694193d035ba75b61a8d6262c8e6d5c4d76b452b38f5150a4
- TLSH T168A012078473800AE4184092C45C024114A480460119D0015070931314950CA03A5435
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\VariationsSafeSeedV1
- Size 82KB
- SHA256 3b2059d556586e1cffb5a141840a9b32862a0956256dbbb40d0824028902ebd1
- MD5 dbca12af9873dd38d115ae011809721d
- SHA1 01ffafb0bd12220083fe84b2f65e7b10eecf23b5
- SHA512 f499698303c5205babe1e5e48a3792148f75b529797ba791136ede0314ccbeffddce3bd7d00fbc85fe74eb9b5678c38907a9d53946a270f0725a4861ed3d7bb0
- SSDEEP 1536:5BzC3sTcZgFCIs80t11mKKujY8Y7p3XS9fVgk4HPOTYf:5BzqZVIotF1/Y7JC99juPl
- TLSH T19783120A77F40B99B10DAC9B36D1EA191EDB3C02B2DDE3D90E85196C41885C1FD87AB6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\VariationsSeedV1
- Size 85KB
- SHA256 2490020a9dee98889177c80d44c540502b8e5fcfca2b29c23b456af72cc492a9
- MD5 93d83b146f18c59cc13ca6fafa7543c6
- SHA1 5816c99fc398b96790b81ebb206cb8550a83a5b0
- SHA512 39de4b8fb88e1300550b71f6b75e036ecc328d7a9199f2766879af045bc307b7882520fa27b7b28f2aeee337ad2bb3d899fe82798d6ce6280d5bea0cff208ee9
- SSDEEP 1536:xNpHNXEf1p8RsHhSB/+rMyT63rTwgjI3pFETVKK0k0All:3bUtuIhQ2C8gjtUK0k0w
- TLSH T1C18312D5F49261CC942252F52B8A1F8AF4EB2C7A34DD501434EEBD1B97036FA68C3875
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\cb4246eb-a858-49c5-ad84-d50e611e4361.tmp
- Size 6KB
- SHA256 9b2179bdf7b75acf0375e706a603f2407109b320d1321a190bb37556bbd49a53
- MD5 33273266d81e3a201548f2f2667e1511
- SHA1 fd2939367e57e2b087af77397d1f2a87242a3ef3
- SHA512 e1c3b508063e9fe49755c233b3989977953b8da9306f43745f1d88e8d2f81c7f9bc11b867e3558963327a58437c6189dae23563d2eff08de5c94a0396db2b751
- SSDEEP 96:eNC6wd++nHQU0Ttfy9524KSl8h4otop5vcDgB6bGyvyL+wV1mm8XSrM6h0j9ICfh:eNCjRHCw95KiU2iErN++8XSrM6hUZzJ/
- TLSH T113E10ABAE8799C6355B7D5DAF4072B07CEB4A0EBE65059A499D95F0D01CB0EC1303932
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\first_party_sets.db
- Size 48KB
- SHA256 0c2a7d9a05ecc2cc77765a0a5d71529f2237755fe60ac3d742d6c07805f80d14
- MD5 e045e65cd8ef3d083617318874fb79ea
- SHA1 c2fa643f68ddf8df9e99d41cecc7525e5a2c08c3
- SHA512 23c380211a66716c26bb85d47c8d82531cd1ed92636bb91e281a4abb9e2e2123967e8b4761d830c99c8fabdd7d6e7526165d78111e0ffae97194ce7a1195dcb6
- SSDEEP 24:TL74/arHRH34kQrq+i7ZYZY5J+Qnj3k0rJXAeL3mkAD6W6Ivrr6UwgfL:TY/IHRH34kWqB1kQnjhHmr6ITmU9L
- TLSH T1C223886EDA2CB9A1FEE40B3DD7D1D0127735AA0EC2E4D9F1099B406746C540405EB63E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 280B
- SHA256 9e9b606cfbfc7b0fcbfab1ff9a90d94ddcf0c4033903cc47f13cbcd8bcac95cc
- MD5 66bd1dbef8b4df50e7a09a2d2848fb79
- SHA1 69983a576369225e69f3c4e38eef011e7e436249
- SHA512 7f8546014287d3ced2b59766b273c8d8981aee3ef643630332615e594a89f92a95f1ce112c2fa889b0e249a10643792bfc57043bfc523d6ada97b8bc7d6e7d6c
- TLSH T17CD080776B0BF411E35D5131D503C75127BE507179625723F158C41D99B41D697C51C2
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 280B
- SHA256 35cc5409a0e92c7b1f173401d1114c9d5fdc977752a8e45ce9068d8101c9a651
- MD5 4177a98ec95c7b8511089a1be66e9e7b
- SHA1 523d632928047252508b7d45169327ef4523179e
- SHA512 d9e67625f1cfcaf9b90149a3ed0ce8899f43e93e14c729f7cf114adedf8a6a345c93240cebfa58351038924578a437d9d7144c7dcd826b1b8892dc523920e947
- TLSH T17AD08077670FF411E36D5131D503C75117AE547179625723F118C40D99741D693C51C2
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
- Size 649B
- SHA256 ff0f76df8d3ac85bdeb2d2003ab400b82d8396b0b2816ff7046dfac4e112eef5
- MD5 fe8834861a1d6ad3571f47e6df63379b
- SHA1 113ed98906e14ea8889bf0c56d772935fa060e29
- SHA512 5f78bca575e3f96d96dd13f4dfd0b4c70a88e5bf75dc6533256794fa95b371934a6815c916072a4f91fe48db167b5a51fecc58620e24c5edf7aa28e47e4c211a
- TLSH T10AF049AACD21AC3718FC0B2D71584B47E74013272B40955F3B3D520C8FB163B4656C1C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 5KB
- SHA256 6206040e1c0f5c2f23eec24ab4500165b6e1634136ff375f84551dce4d8ae6fa
- MD5 9708e0eee5251c5c64ed665e5e737c0c
- SHA1 af8815777f99049b3a2973a010388e462b0f7de1
- SHA512 901c5491767202f96ccb954023a2416e411f94c679a7049db128e386e2f4ed19abf4563fedcf978bed73197b6f6bae0b77337cc50e833ba0c2637ad8bbb92d06
- SSDEEP 96:l8fs2KheYdij4gcxhxMFI9mngFbwdgRuyLXszx7CCmE:O8heYE4dZmnowaRv8zxuE
- TLSH T145C1A35399B1E0C2DB55C1BCB49FACD526F045B589133F92034422E2BB9F7A406EE01B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a4111.TMP
- Size 3KB
- SHA256 e39fd51ac3dd22051b5630db761cae334770c234e604c67971fb74475c036361
- MD5 5585926eb34fabe1c6a8dfd3b78f3fda
- SHA1 b682dac506c230e9efec8415430c52ef3137a6c5
- SHA512 c2581d81311300a1a907eb038b998162b651e6ce0dc8e05fd3d3697b0e6c6b5b1897c6a0aba6e3ed747142f1024642e1e802d029378e773f1b19e758338fbf52
- TLSH T1AF71A56921B2C4D2E751C1BCA0CADDC57AF886B656032FE200606BF537EEBB115DC01B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
- Size 2B
- SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
- MD5 99914b932bd37a50b983c5e7c90ae93b
- SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
- SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
- Size 106KB
- SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
- MD5 25dca813dd764f2197142ef84bc5ce66
- SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
- SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
- SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
- TLSH T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\CURRENT
- Size 16B
- SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
- MD5 46295cac801e5d4857d09837238a6394
- SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
- SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\MANIFEST-000001
- Size 23B
- SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
- MD5 3fd11ff447c1ee23538dc4d9724427a3
- SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
- SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
- Size 40B
- SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
- MD5 20d4b8fa017a12a108c87f540836e250
- SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
- SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 17KB
- SHA256 95caee086ee88b84b888009848fb0e7cfe75c16aa33382b0c5c6ffc1e807ec1b
- MD5 4cf125d6c691312c93a244f0bf28b980
- SHA1 b28d4547c5d3146b7d8d362773c629b488a4836d
- SHA512 b8a77d4cb505fa85ccf44e5c09f98189800250931bc0d2b137fda9e6de4c6a67f166c142a80105a60e5e235ad9c89dba7f07186ef8947c2dcedf90ca882d0f2d
- SSDEEP 384:sxZtnqd/Z/f6sGs+S1gYFFdZHbC/AZqjjd:sFqtZ/f8s+SqOFnHb4AZqV
- TLSH T1DF82E70A6934497B8DEBD219F9457B53D7F85473A6904E489AFC8E0C04E7ADD2213C2B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
- Size 35KB
- SHA256 c50c10de573c1308d184e42c2640050f7a1b738e1be178655573cff4c7bb9b25
- MD5 2404d2e533be03bc417be8a7421f4d08
- SHA1 a6dc50ba44c94b74b051ab6cbff4b7bfbcee9c35
- SHA512 bc1dda73a6bf7afa8fe02f8ec18db6b1d661533b3fb331a2de2f9063689e8043b1c709d4740126c8aa3c6e8c9ade24af038f988d76a726f9f7dad419920bf2c4
- SSDEEP 768:/Zk4Pfe7pLuLnXDWvXt4h8F1+UoAYDCx9Tuqh0VfUC9xbog/OV2eHiLl42vJ4roD:/Zk4PfeEnXDWvXt4hu1jaPeHiL+QJDWk
- TLSH T182F2FA3B680CCB7E4F844E9CEC2ABE9A6EE8018F5698CD5447FA444C03C76EB51165DB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\25699733-08a4-4b59-92e5-2994418996db\index-dir\the-real-index
- Size 72B
- SHA256 6a230465cfd3fe7ce5109be882b41df51b9d938227b1c6646f613f396476ec12
- MD5 27c0b1957e4e4dd3890a6aeab74a6cc7
- SHA1 9dbeda73b4a54b3d9cd32cac3a5db88b44bbd131
- SHA512 2a1dfe754fe0a97ba7d103af03d10ee56531c6276213164c3e4df867d1ce14a1d77b249694e8fa2ab0f6aebfedd07ef5bbb84ef0adb0d41b138248ebb436c206
- TLSH T1CEA0023509D59381C04516B4619BC67033A59C1D1146830D70E2859A88916D84519056
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\64d35e3d-c11a-4565-9675-8f69df0b3009\index-dir\the-real-index
- Size 72B
- SHA256 d43a57c73d28f80c7136a5d88682a66ad19244edcb3c64eb948216f392e99f58
- MD5 c7ff342d6a1e4edad625af38c6a2aa90
- SHA1 e8ddf26f1ba4893544c379e88e79d52e2425fdc7
- SHA512 0196d7a556ff732e4264cfc2a733b0895b88066d09bc51cd9c98e1114c3f19706d70ad1edf434ff72728d7370181da9ad7e6e7605898dddc13d33ac197c2276f
- TLSH T176A0025506C48201C10716B135A7C161B6A44D101605730DB1D1558ECA505D1826581D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\64d35e3d-c11a-4565-9675-8f69df0b3009\index-dir\the-real-index~RFe5a2675.TMP
- Size 72B
- SHA256 ccaf9dba23712aa70c9d7f370b00b673eff0e26dec3fb1270c1a2ec7dee75120
- MD5 84cd233ef8b459bc461113029ab5744e
- SHA1 55b75d214b9e66c2cf5b2e67755be90f5b7b5169
- SHA512 df535fc2815624e86b2b26c689999c61500f9dadb79c8e4c3fb9902147ce480eb016a92910a2969eb56693b69663e0a02b825c109eadb534b92cfb866984f2e6
- TLSH T104A002548B804455C11211B15A6307D12380C9A01100330740D10044CC54B4CCD4110C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\99755d9e-864c-41e7-ab4d-7cb31e17682c\index-dir\the-real-index
- Size 3KB
- SHA256 3d6a35f055e4bf6936d3babade8434df9e62dbf000d6cf522fc19e9da87eaa2e
- MD5 6e1ae3c475ae4db96e7d70e106b2f662
- SHA1 d23a94292c53cf267b07426944f1a173bb7014ac
- SHA512 1372446eb56baaa3e273480efce151524f0426b50029d0fdadc9b0fdb7dca524341ba8ddacbe4f8a4d66bbf30ab65e5da01259e24cf4b0946894334c6560945a
- TLSH T1B851F88E8D551921EEBC06F318B2045573B989CD2B808E0794EC6178F9C35AE2CE4329
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\99755d9e-864c-41e7-ab4d-7cb31e17682c\index-dir\the-real-index~RFe5a4373.TMP
- Size 2KB
- SHA256 bc29b35e6ed2131ce86f41b11a9368cb8c023321f344b4796c3e2046ffaabe62
- MD5 9183f62cf169982261917717900d9bae
- SHA1 4f8df406b6c6a1fb805a854d6556ac66e9778503
- SHA512 b24a656a35dd6af32c5c31fbaafb8dcfddcb4f85764731564462c2ebbc06fc03b0b9b8f187e255d4d8ec6d174be3a41715fa37eece8eab939b76e2906d2cf238
- TLSH T10C51A68E4E42463AD8D441B309D3A4A4373959009719BF5774FC9636BCD23AE3D5E3C5
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\ce9bc7ee-533b-4299-bae6-fcfa05287703\index-dir\the-real-index
- Size 72B
- SHA256 e1478fe0a93c97c61e89828ad99381fbca5d059b22183465d335b408ffde54cb
- MD5 1c78c744bf5865d5d3cf0858ab8b528f
- SHA1 97557ea02a760f647a54b95170b51c421aec9142
- SHA512 e66391bad8e719b1d97fab44923f5bfef6af772625cc1c08096849220e1c86fd11e4079c3ff51ba649fcc6fa7691fe33a76fd13b8a531366a7490ed9900ec970
- TLSH T1CBA0027443A25109CD23077C309A05627338DD17220AAA5341A510D5B9B1546C709105
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\ce9bc7ee-533b-4299-bae6-fcfa05287703\index-dir\the-real-index~RFe5a2675.TMP
- Size 48B
- SHA256 e74e2b58a9764842d1fc3b7603e7b460ac4a19469bd09af323165b6ac286e412
- MD5 f109f0dd58c2a4bc636e04f6a15dbd17
- SHA1 ebf255cc77626c25365e27edce6c8df09bd2fe8f
- SHA512 f2d29d0cb1b9b7ec38cce77aff4b3e03586d41766f631ed0e4164e2bc9094447337c09bdcfa35df59265cadffb02526dace962797eae65064293319e30f4545d
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
- Size 476B
- SHA256 6ee6c098c3470dac6f5043998e28018bb66f0a543d1fff625c26f0c1ccf00325
- MD5 b1f7dcf600a90c5e330aa34752845ea1
- SHA1 b8277d815fd6eee7cf48e4bb3f114de792aba719
- SHA512 475c216e784aad81e1b260e6ff02f5d4a4789203b3f701f96af1df1f5fdca078acddaae586c4b402d35da874d32560dbd08830557c0d8af391b0a9467964eb49
- TLSH T117F027FB6DE71C05F8AFD3D1347264A10A157C598914DC4F642EA2E7A0F1618185DCA3
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
- Size 481B
- SHA256 db8505cb9c65e0a5bc06445e7fb85c5233335d5edc65af6445d833bd49b53a1d
- MD5 e1dfc9e54460ecf9fe8cb37e0d98e58c
- SHA1 51b1003c4be292f1b8a30a8f6c9cf977540b0a4e
- SHA512 55ca10ef4c55815e71c41a8c173c8851a6f12323f81268fca5cc93f57d4fceab88406d1f8226e440979fe6a55f638063181e8fc2bde1de8d981766cb73888526
- TLSH T1B7F027FB2DE71C04B9AFD3D2347224A109117C598905AD4F642EB2D7E0B56191859CA3
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
- Size 72B
- SHA256 13d154f82c3c3235c17dc0878307edefd62863cd38879bbfb30c02492d8e183d
- MD5 3a94e9b3e94e0ab85f65e2b697b11fac
- SHA1 599b4decc5acb114d39a1032669f58938d1e664d
- SHA512 266b2bb8feb0f7c64360acfdc0c3f56994e7cb2d4ac21bce91de6ddf35a1968600ed6731ce3910ebb5cdb976b2e010c2cbe527756545baf35a27de6fbecde2ae
- TLSH T1CBA002178258105BC00406F4F54702846222DD100F4D2611C5F4E194E891140453A005
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5a3f3d.TMP
- Size 72B
- SHA256 02e93bb14411a8603822245b9c93605fd8146414639b8ad30295f1c93e44820e
- MD5 aff6e64f0f1d39d05d7f7cfa07d866d3
- SHA1 d503b2258bd4500a32fb029e52b8b38cb7bc2488
- SHA512 b817e1f4aad34f9354864ca989e1356f6423f07490c34f3aa2a2d444baf7ff4438623457f7d177f83201899ebe524405cd6d1f133e8d7ed94165510b21fed349
- TLSH T153A00212868A1488C54049B1100B76B01385DC6902001302589090E9ED915D0556251E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
- Size 23KB
- SHA256 fa8a904b640b0e40ae72240cb699cce34c34782fd987c3d68e690ef03d779c89
- MD5 7bf9328583c06a03b513d970e95f5ba1
- SHA1 94fe3176ee31e3cdb61089f614c19a87c7422207
- SHA512 d7c354f1d2aa94a8f441f11dc241f95ac7df88301d823750cdb362d6cf3017075a30b2d6d0eb20dd09e1dac2f2d5f1bfc49c6474c28af8ee11614e0d15fd52f0
- SSDEEP 192:EtjGz7Y1/St59NZp1ZVzDqHgnmz3th9AZkzPr1PVIfPU1orHB:EJGnYNSv9PpHV/qjqbB
- TLSH T15AB22C13317A03423CBE2909A2B686779E4231B33019E67F77A944A64E67E124DFDDCD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 28KB
- SHA256 f3fe926d47e48a6f68663987c813f91005066fabcc85d7068e6626336dc6458f
- MD5 0010b78d72b15a46d763b9a42c97ce1d
- SHA1 971fdd2f288ef605d7e4f715284c3d97ce4398c9
- SHA512 9340429a29d517b6f16f4893e4a6cd9b94dd47659e5aaaf4e593e94fcac16ac16dc8cf063cfe52c649d17540faf3ea907d206818b4095d5c16dc9d977aadbc7e
- SSDEEP 768:bMF1jZb23ewg33uVtiQUUFQ4y9gYt+mUsKz:bY63EPFUFQRq8U7z
- TLSH T14FD24A32D864CEBBADE74A9AB34A7603EFE042A3958C5ED4E9DC5D1D00D719D130BC16
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 24KB
- SHA256 4d1e7e75164f4b8966e3ebea8d682b583d886ec2dd90fb30438e833064495a8f
- MD5 35021ff3d2e2ad46d9da3b467b8d3c9a
- SHA1 0dc017c337987791805b3359fa379288bbf68e06
- SHA512 297054dadb15723b336f53867ee7dd30a266e11b0786ef80437efa8a15751410391b7f7015de4660ef902f9e98226ed983f3f22295f7dec7e49f78f414ac3999
- SSDEEP 768:mMFccps3gwglMlvVtiQUzQ1/QhkoFYS/Pd:mMs3EDFzQyhkoa0d
- TLSH T10AB25B36EC98CABBEDF74F9AAB4A7A03DEE00167C19899C4DAD81D1D00D719D130BC12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 25KB
- SHA256 1b9306edec21b2caa985fb63af96a33e49f683ae6dc73ab7c78b03acff71d0a4
- MD5 f73a4b16b6a508eafee0c2a3a61880e3
- SHA1 110a1783e54a2b60fba2395eea8b201f7f1c8900
- SHA512 c4557231f9b1f0992cd5980c0fd3c900526c40a0054fcb83000c7cbbb8c727f69c07dc68fb0311c374874f92e8eff9f35c92adc94c4deca2e5dfac7f9a938e29
- SSDEEP 384:nbFiF9CcmyWCb3sN98TUNTUlI4kSTIoNm9pkyBfgVtiQUTGaaeeQHyJHy/7Igw:bMFccpb3ewgNBuVtiQUUFQHyN
- TLSH T122B23A32EC64CAB7ADE74B9AB74A7A03DEE04163D68C9AD4DADD1D1C00DB19D130BC16
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
- Size 2KB
- SHA256 892e4b32ecce16b88cc6d601043d5e1b6670634de63cfd7dd754162a61f7f515
- MD5 fab8256645b472e2b9b60d01056e7ad9
- SHA1 cbeb449083e596c20b521f9adcf07e7de269f66b
- SHA512 f8ea0a4409faed4ca5f224a49dbc7e46599fcd648967686bc9fed8db04c793f8592d621792882db931bf747a98a770b81b5c7ed62f7e3dcc5c19e62f24af6e08
- TLSH T139413D5CA6FA0148F3B67F569BF6A86D487BBC772E46D45E00110E4F0A22E40C861733
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\7D383F0.tmp
- Size 2.3MB
- SHA256 63537a95313e8f3a32bf3129d85f89a2d97a9db9ff78f56ee56d1973a9d56bbe
- MD5 54b0c50f9931c2885bc5bf1465f574e7
- SHA1 951010aa8c521d294c0b91b9282783b9d9925ec2
- SHA512 92f4f9db6d216dd54d953a8dc0954f9b2c7ad9a92c778a10788c34367c05250d09e598b4e057cfd01871e42c099f09a6b38f7db136940e3aff687920041fa904
- SSDEEP 49152:cRHQR1N/wkb/Qz7E8Ed+/vR4cip4xhtY93ng+Zp52my0yX79xCjgjPn:cCP/wkYw8ecx/q52dX7Mgjf
- TLSH T176B5332496F9F584DABCB144E126B4DCF761EB76152CEB68B023103EE222E11C7763B1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\7D383F0.tmp
- Size 2.3MB
- SHA256 b5888dfe56504242d1147df443ceb46e082334379649ce0e77085d16ddb1d55c
- MD5 ac814b8ec36eec33d3a36fb478aaaa73
- SHA1 019037af4e3211c36f5757921079b51901292b7e
- SHA512 ad6612502a8e4b7e44c93099e3989bcd42bc48ced3ba62e4c81ef26689e75d155098f27e39896dd736c46cbe9baa1a43978842e96eb10d958ef8e3f00541f443
- SSDEEP 49152:ZRHQR1N/wFb/Qz7E8Ed+/vR4cip4xhtY93ng+Zp52my0yX79xCjgjPn:ZCP/wFYw8ecx/q52dX7Mgjf
- TLSH T1FCB5332496F9F585DABCB144E126B4DCF761EB76052CEB68B063103EE222E11C7763B1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\KTzB.7z
- Size 8KB
- SHA256 27396c61e3d9a5645f5fce42f850914d1694c0747fad1b0d61a8e1772ba62672
- MD5 37a9e8c8fd41e8d57d574209f036f4c4
- SHA1 c17c089b841ac54b8404d5cc74bfd0ee829a4e29
- SHA512 6e19eb56ee01f40c527bb6eaddd99e2f8d07b8f7938c2dd550f9845e8917fd786717506c963ec5d34e68d6e083196b2b2dd69c6bd1ecaed2dc438a2cffd54599
- SSDEEP 192:DRDn7c/bo9TyLTlAcYbwjyL5Lvozd5ytrienpv:DRDY0ZyFHo2sxQgWen5
- TLSH T1F202B07E8664780DB7CE6D784216D6AD3F804016DAF23A80C9534CD0C427A9374E57AF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\is-6P9KC.tmp\D-Transmit.exe
- Size 864KB
- SHA256 b87ebd3fcebd30a113ed0672e7b960feb2bf1918987d93c3f9942276ae9314fa
- MD5 03606c35456430789af96c919c5695ba
- SHA1 6bde4262e365f99d89c07ba66fa33ac0f763a8bb
- SHA512 4c2602552308ee25aa2aedeba046cb5ac0969448de70e7fcca9a985a46d685dc764b7136962039ddf3a248d96f07cbda468b361ce913376b5876175b13bff6b4
- SSDEEP 12288:R3Cig87yiDOkNjU7wDSxnY/duXadvu7wpDJd/zp:Ih873DOeDSxYFuKdvkADn/zp
- TLSH T1BC154D1A66A812F5D0F6D2B8CE974413E673B8565B32CACF02A1455F2F376E08E3B711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\is-6P9KC.tmp\FileSyncEvents.dll
- Size 133KB
- SHA256 4bb4a6bde44f555bbc497bcb207abb8d1b8d2cd5bd001e07effa91c40dee83f8
- MD5 1795b1977fcdf5b00fb32ade97138f4c
- SHA1 9473a9a26b7ca71ba028c32b34866751d61c339b
- SHA512 5ce5af881527380e80d2fd704d69658dc747ed0df1c755112a47cffef43f77b19ea7f684936d56d062c8b49bf44a6525f2613e0c97b6537d9b63f983e74aa422
- SSDEEP 3072:J0ifDUehodGNITnblgW1UZ8u7h1P3P13CmTJXpmK:UIs+WeTl3CewK
- TLSH T14CD34A5B735C008AE519D1BA8AA7C807FB33BCA7072297CF13A5D31A0FA36E45D79614
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\is-6P9KC.tmp\FileSyncFS.dll
- Size 1.0MB
- SHA256 29963d22067d02fd98ea93cb7a8b893e7fa12c3723bf89524d74e96fc2e0661d
- MD5 9774d60174faac68b55a54e4e7c9e59c
- SHA1 4b06b5c1e65ef34e230ea2f5f935f940217eb1fc
- SHA512 f77cf3fbb10e8a6c8576e3a908a6dce295b7a74ee0c938714e967f3147d8facc3073e16460ab9e035cb8ec39391f5739c53c45aaaa1c129e9075def53efdbddc
- SSDEEP 12288:Dvw3bD2C8Q/3xQKxcCoB7UeF0lJ4Vrh4C268goXnsvF1SEpzvDG6+83:DIrZB/hQK87HF0z4Ag6noF1DZG583
- TLSH T1E7357E1B666C416BD4AAE1FDCEA78917E7B2B84A433296CF03A4924D1F277E0453F710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\is-6P9KC.tmp\FileSyncHost.dll
- Size 517KB
- SHA256 cdeecdd37c82dbe21a702c850b51c147ef961bd1ed12acbaf74d145859f79b04
- MD5 1f6530dcaf2e9add93d501e4e593be7e
- SHA1 da42be439e1730b24774e1213f7740c262a53155
- SHA512 5c0a0816de36f01f8170a483372f5ddf2df343a33d4ecdc8253c92f21949f84685df15505a47344e9dea9e36e11ac577e7dba5ae852a84ae0bc49b019448c4db
- SSDEEP 12288:Ewgyb9SSosddQYbScfAwGjUhQ7zNR3GU4z:Ewgw9CY2cFG2QnNY7z
- TLSH T163B44B59A2A803B9D1FAD1B88E638417E673BC19472286CF13E1E56D1F37BD0953B720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\is-6P9KC.tmp\LoggingPlatform.DLL
- Size 693KB
- SHA256 4de36f8ac27f1f97d52b456d48f262202a5854e644561e3ad6a066ef3617d63d
- MD5 a32aebcc07025cee4987bff195b07f72
- SHA1 88a441015f95734952b6d0107b0ccde85bfbcd99
- SHA512 f0c96bad61c691256f5aef7f5a8b0a0d7b2c9607304f85f4893a58461a80dc74d5db0b5f1e8b29ff6f0ba19f428c113fec36da46a006b7315f3d49462bf6146b
- SSDEEP 12288:piDFPh/Fdt4UebGClX2t2lNTx+9E4oFvBJxjCnGcZmJcxcln:piDX/Fdt4jbGF2QE4sBTunGtJcxq
- TLSH T16CE45C1AA6A801A9D0FAD1B98E538427EB73BC054732D7CB0391C65E5F277D48B3B711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\is-6P9KC.tmp\Telemetry.dll
- Size 1.0MB
- SHA256 f31a8953531ffb5c14e2d8347e283e1f8f3c732a5a9a68f611c96f4730e8a7dc
- MD5 b6a201726b44106a7dbe93a480b38420
- SHA1 10dfd71cf61ea3c1621a5b0c08c3b034773fb84b
- SHA512 6904d7c7e6d38ff983d25718d8ac4ed4161da8fac7e49274e135a7892a731eb11f99041eed4789c4d5b3c75ccf57a71bb70317d26e03520a4525018430406b03
- SSDEEP 12288:FPBiUxML1tCIS190GrCsXL2Ux4tMt+P7A+tz1ydyrgtD9KMB8:yUiL7iPBCs72ERt+TA+tzUAmBKMB8
- TLSH T1B235490677A47FB4E29BD0BDE6324403E5F2F4385322A5FF45DA59280E27AC05935BB2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\is-6P9KC.tmp\UpdateRingSettings.dll
- Size 704KB
- SHA256 ffba487d0c0c1930ab99a23969ef010b49b9100c14c194841dc0d3fb27705504
- MD5 d0dbc08305de0948279a793b279cf1a0
- SHA1 a7a3c9b21c180e7eff9919d160dd8fb7bba8d3d7
- SHA512 e82f964edd631e7dffc06ad32b716fcda4a8cb69f21c2df5df9c42578789a162cbe2319a66c8e6a44d1d4b00d333567f80969264b3f21e4853dfc0c45ba7706c
- SSDEEP 12288:BqBEBmcaovtfVSMSmvKh3/WrAfzfJ1x1GgKNDNBus8x:82Bmc3vxUX/WmV1x1YBuTx
- TLSH T131E44B1AAAE802A9D0FBD1B98DE74417E773BC155732D6CF0291866E0F27BD0853B721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\is-6P9KC.tmp\daemonproc.toml
- Size 18KB
- SHA256 165a08fd077f8be029bfaf7ae4f61591fc4088df6dbb94297369dbec1a4690ec
- MD5 b7839332de4b3efb75a3f6673ced50fe
- SHA1 52cfe9ca4b0af5b55578b71a2ad2bd394d205119
- SHA512 589738f9ac0cffb7c9cae441a7fc7a7b3672f14106c03e1e0aef1d70b741b4afd832bd790ccccaa693cd6d13980b7ac4cbe53fe5feabd2fb32f007d922424f09
- SSDEEP 384:ACqV1qTG4AhwiqTFrRYl66bMGaaaUibrLf2/GLDYj7h:ACqVsXQGYl66taUmr72/EDg7h
- TLSH T1FC825AB95A317FBA4D39699ADEA7E0D0C1C0EB1D194F5B73E8DA7466B01C8BC4450C03
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\is-6P9KC.tmp\kernel_dump.lib
- Size 2.2MB
- SHA256 631d485a3c68aa3d028b03bd9c6c203505f9b394f9815c4b5c39766c34853570
- MD5 adc90c6a8a9c114b25411c237021866a
- SHA1 b4940a06b19adc14ac034b9b78afc41af990bdb6
- SHA512 f8b03b923c22e0efbadaa9a768833ade5ff0a5243a2621d9b568f27c0bb4e481ccc70d27c59abe464c9bbcc9147be945eccf02b040e11fefa3b6907e4532ff8a
- SSDEEP 49152:FcBdVnxtwRYTLWAA5l60mmEDUWoAXQHCV7P62A:e7hbyY2A4mVg4XQm7P6T
- TLSH T15BB5332ADF8A0CF7E537D833A6655CDBAFC62A580A25A0117DCCC4E5B96C11F10C1BE9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\is-6P9KC.tmp\msvcp140.dll
- Size 530KB
- SHA256 fbc76265fe94360770149b2ee010a083bd41610092a48d331e4a50ade40b2972
- MD5 ac8c6c8f84a01c45a02cc59075cc8636
- SHA1 314a46d95c284b3ec16d63011a155ef14f8da5a7
- SHA512 a363468558d25c36cee103a4dc60a34a07336752777cb37b2322b2b9c26505619b6dd9aa724b8fcdedb2b0023bb5d37911d6159a6b14649e6dd4ebb375fbea58
- SSDEEP 12288:P0MrE03u1mHWV/I3HVbQEKZm+jWodEEV7Ki:P0p1F/IpQEKZm+jWodEENKi
- TLSH T1F4C41A23F75906A0E195E3B8A1838702D7F1BC598323E3C742EB955E2F577D0A63B690
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\is-6P9KC.tmp\msvcp_win.dll
- Size 626KB
- SHA256 777d112d7e01a6b7d65f01e74bbd76dd4042614b2ba65a03ba12a661fe753481
- MD5 182d64877ec6ac8f0dcca0554f782e08
- SHA1 4c7002a605fcfb6dfe18ffd81a9958daac33c0bf
- SHA512 73e1bb8d43b6dc30846ebaf045abdcdbbf818bc098fd6dc80886c1f69bfbbee121c327ab1063704e7a69f2c543ae0afe09c4ad7179611825619d8adc29c3cd8b
- SSDEEP 12288:w+TTIwt0B5483RXXoTk3iUKQEKZm+jWodEEVUsS80v:58wdKnIk2QEKZm+jWodEEmsSN
- TLSH T1CFD41827BB5906A1D16693BCA5C74306E3F1BC054721A3C742EBE26D2F2B7C8673B650
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\is-6P9KC.tmp\ucrtbase.dll
- Size 1.3MB
- SHA256 491a68206038a66c97e5e98094923cc0e7529504e506c13d6996c2b57cae3d3b
- MD5 4be2b1c8948f2d8e479b859ea027fd86
- SHA1 710b2438fd71e50569e12af4a0bba3e2d38b8dad
- SHA512 d778c2c9826698fa8e7484010b26ef4dd77f1bc20f0599fb95f703fe3f3696135548d924694b0f703b424973f10520ec69673cb7e25fda843067e227ad635fab
- SSDEEP 24576:QM6VUOfZDUVOb+uifkfEee3siuEWBlwmN1v2PI/BoEzJszW75mxvSZX0ypOpTq1:QM622DUVOb+uiMfE+nzTv2ApvzHWpI
- TLSH T1AA55AE6576AD01E9C1BFD139C64B4A06E5B27C1503708ACB03E94E792E3BBE9177B321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\is-6P9KC.tmp\vcruntime140.dll
- Size 110KB
- SHA256 911e0d4a1754b1d9f8f7a577729d2ba74dd405b8027fcf4df5841626f270d19d
- MD5 1756e382708d39ad4c216b468f91db11
- SHA1 762b45db20290a54e83861456d3e40ac6c9601b9
- SHA512 202af6629bf2ded92ebbff28b6dd8df477338bfc2a7f3ccead44fe1f0f2e9514842c8faf136828833fb1614c135bcbc84342921030ac87133b33f2bdd88f4c90
- SSDEEP 1536:59pCUgtBAVcxStMXcfG8VwfmpcGLOI5EvMvecbeQ6N7vCyhz3:dyA+3EOfmpcGSL8ecbeQ6NTCyhz
- TLSH T1F7B36A0272B802FBD16AD278C1929E67E7B6F40587649BDF07EA46660F23BE05D3D341
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\is-6P9KC.tmp\vcruntime140_1.dll
- Size 36KB
- SHA256 6ce58e7b441fb7adc7fffeb14c73502365ea13905eb2dce2520154d45e58f570
- MD5 70dcbda25747dc5a10efb5465de4e9ed
- SHA1 8f80898d75e7c84977bbfde2d4ee5cce284d0ce0
- SHA512 4da86078af85bbd169dde505265c34548d1c04de10b2e8d91eaee527e58856b43e5b002ad90b1303d6d17b601ed16ed8541209128c70e992a93ff0b293963b87
- SSDEEP 768:XezSkbhNfI4fWLZySXdPWD/0bO0UlU+9zZXM:0YZyqPWD/0y016zu
- TLSH T153F25B52A3784096E8ABC5B0C4A79F17FA39F69197A083CF1FA4954C1E577D0A33D322
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\is-TAK9L.tmp\tmph6bxoily.tmp
- Size 1.1MB
- SHA256 8f0beb5863d190b7b2cfe7f506f3b721ab6b9e892337a133364f2ba710931b25
- MD5 be3cc5717f5951662adb399d613f20cc
- SHA1 f776bc4344ad59fbd6950d24d3aa6dddb3df215a
- SHA512 fbe0aab2194e4f09cbdbed770d862a4f9f2672a5c8346ee7e392341973c75cfc0b8c66a132e5a2bb22fb6e265cb40b45dfb05fb076c74914faed35e1e476a2cd
- SSDEEP 24576:wnbbPImgK4brDi4IxgRqzwqNb+Yz71P2EN29cnDdqxyt:GHeKh4nqzF1Px2io
- TLSH T10C453A22A3D28437D5732E759D6BD2946C367E202EB4E44A7EF89E0C0E35B41BD35392
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\usr_router_task.exe
- Size 132KB
- SHA256 f41bfa204e937824bbc509ec0716df5df62e174b73070d1fd80d3fb67a23b669
- MD5 3e963e13c6ab3091e0384dcf4539a03d
- SHA1 ca2c41403d392950eca218c5b3a8829d1f842c70
- SHA512 2b7bfb9dc0890c815042b03e2f202fe38106d0faa850caf9fc0f813e5a60cb5cdeae5868875d803350aa04cebd073f9ecd1563443e7a7db6029dc1812d674a59
- SSDEEP 3072:EkC27/AQ8nV9IL4lTV7O9TQPdnujXBuwcoLNjhpuxnTxkbDFv:EkC27/AQ8nW9sP2uwpRca
- TLSH T13AD39E12BB45C032F9920431A2AADB67193CF5302B6D49D7E3A05A76B8707D26B3D377
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\utilityhost_v7_arm64_prod%APPDATA%\Crisp.exe
- Size 334KB
- SHA256 c2e62475768c9546efe1da92a55f3bb2a55350eed83241139917aabd1ad25f8a
- MD5 5f9f88c9a16b62dc38504549e93d3667
- SHA1 587d56031b39e34102bc67b5f7d0338ee41b5328
- SHA512 edbb7a8cd75e056d2c47b8af6fbee63726cb3d5f000d5f8bc000f4b16366619c8532e628585cc943f474d2509c63802179d0d22a1d32dd690fb25e00d262af83
- SSDEEP 6144:7c2XFRJ3DNuzAOS9FuxIRtiiuhKPTqX4Y42:dFvYzU9kutRuhKPTqo32
- TLSH T125749E11B9D1C4B2C4B2053009E8EBB5697DFD714F61863B33D8772E1F742C1A662AA7
- MD5 SHA1 SHA512 SSDEEP TLSH