Analysis
- max time kernel
150s - max time network
152s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
23/05/2026, 04:20
Behavioral task
behavioral1
Sample
tmph6bxoily.exe
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
30 signatures
150 seconds
Behavioral task
behavioral2
Sample
tmph6bxoily.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
30 signatures
150 seconds
Behavioral task
behavioral3
Sample
tmph6bxoily.exe
Resource
win11-20260513-en
windows11-21h2-x64
29 signatures
150 seconds
General
- Target tmph6bxoily.exe
- Size 4.9MB
- Sample260523-ex4vmacy3r
- SHA256 1b3e955bff68102c66aeaa9a720104199e6e16d236b80e8836c0cc9b437e2824
- MD5 58aaeddecf19b06b95a228e2077e3058
- SHA1 fa640c339af00a50218d0292d3e7f962e2c15e51
- SHA512 f73efbad73176243bc6b22270a794d974307726d5b9eca7850121338460dbce2b3b68349d3e101443a40f8b3cb336b8799e83f7b5c6f3111ad11ae8e4218cd6b
- SSDEEP 98304:C6EHKfGqWMB67HLlXUIeHcVa74D7p6dmo1aUyxHgetoVHFRYLQYLpl4d:C69OqWV7Hi74Dl6dmHLHgzJFWLgd
- TLSH T1C036331373CB0432F0265E71EDB59C447EA3B5B80DF0A4082DF1C58D2ABE5A6A936776
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
hijackloader
Attributes
-
directory
%APPDATA%\utilityhost_v7_arm64_prod%APPDATA%
-
inject_dll
%windir%\SysWOW64\rasapi32.dll
xor.hex
Signatures
- Family: HijackLoader, IDAT loader, Ghostulse,
HijackLoader is a multi-stage loader, first seen in 2023.
- Detects HijackLoader (aka IDAT Loader) 1 IoCs
resource yara_rule behavioral3/files/0x001900000002b50f-47.dat family_hijackloader - Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\drivers\gmreadme.txt usr_router_task.exe - Executes dropped EXE 3 IoCs
pid Process 4636 tmph6bxoily.tmp 4556 D-Transmit.exe 1436 D-Transmit.exe - Loads dropped DLL 22 IoCs
pid Process 4556 D-Transmit.exe 4556 D-Transmit.exe 4556 D-Transmit.exe 4556 D-Transmit.exe 4556 D-Transmit.exe 4556 D-Transmit.exe 4556 D-Transmit.exe 4556 D-Transmit.exe 4556 D-Transmit.exe 4556 D-Transmit.exe 4556 D-Transmit.exe 1436 D-Transmit.exe 1436 D-Transmit.exe 1436 D-Transmit.exe 1436 D-Transmit.exe 1436 D-Transmit.exe 1436 D-Transmit.exe 1436 D-Transmit.exe 1436 D-Transmit.exe 1436 D-Transmit.exe 5872 usr_router_task.exe 1508 Crisp.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Drops file in System32 directory 7 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\WindowsCodecsRaw.txt usr_router_task.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\default.help.txt usr_router_task.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\default.help.txt usr_router_task.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\default.help.txt usr_router_task.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\default.help.txt usr_router_task.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\default.help.txt usr_router_task.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\default.help.txt usr_router_task.exe - Suspicious use of SetThreadContext 6 IoCs
description pid Process procid_target PID 5872 set thread context of 3372 5872 usr_router_task.exe 85 PID 1436 set thread context of 1508 1436 D-Transmit.exe 96 PID 5872 set thread context of 4848 5872 usr_router_task.exe 101 PID 5872 set thread context of 3372 5872 usr_router_task.exe 85 PID 5872 set thread context of 2072 5872 usr_router_task.exe 107 PID 5872 set thread context of 4644 5872 usr_router_task.exe 109 - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\AccessRuntime_eula.txt usr_router_task.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\ThirdPartyNotices.MSHWLatin.txt usr_router_task.exe File opened for modification C:\Program Files\7-Zip\Lang\it.txt usr_router_task.exe File opened for modification C:\Program Files\7-Zip\Lang\ko.txt usr_router_task.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\LyncVDI_Eula.txt usr_router_task.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_CA\List.txt usr_router_task.exe File opened for modification C:\Program Files\7-Zip\Lang\el.txt usr_router_task.exe File opened for modification C:\Program Files\7-Zip\Lang\uk.txt usr_router_task.exe File opened for modification C:\Program Files\7-Zip\Lang\uz.txt usr_router_task.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\ExcelMessageDismissal.txt usr_router_task.exe File opened for modification C:\Program Files\VideoLAN\VLC\README.txt usr_router_task.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\en-US\about_Mocking.help.txt usr_router_task.exe File opened for modification C:\Program Files\7-Zip\Lang\ms.txt usr_router_task.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\THIRDPARTYLICENSEREADME.txt usr_router_task.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\win\CP1251.TXT usr_router_task.exe File opened for modification C:\Program Files\7-Zip\Lang\be.txt usr_router_task.exe File opened for modification C:\Program Files\7-Zip\Lang\gu.txt usr_router_task.exe File opened for modification C:\Program Files\7-Zip\Lang\hr.txt usr_router_task.exe File opened for modification C:\Program Files\7-Zip\Lang\nl.txt usr_router_task.exe File opened for modification C:\Program Files\Java\jdk-1.8\THIRDPARTYLICENSEREADME.txt usr_router_task.exe File opened for modification C:\Program Files\7-Zip\Lang\hi.txt usr_router_task.exe File opened for modification C:\Program Files\7-Zip\Lang\ka.txt usr_router_task.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\AugLoop\third-party-notices.txt usr_router_task.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\en-US\about_Mocking.help.txt usr_router_task.exe File opened for modification C:\Program Files\7-Zip\Lang\va.txt usr_router_task.exe File opened for modification C:\Program Files\7-Zip\readme.txt usr_router_task.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Mac\TURKISH.TXT usr_router_task.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\win\CP1253.TXT usr_router_task.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\win\CP1258.TXT usr_router_task.exe File opened for modification C:\Program Files\7-Zip\Lang\ca.txt usr_router_task.exe File opened for modification C:\Program Files\7-Zip\Lang\eu.txt usr_router_task.exe File opened for modification C:\Program Files\7-Zip\Lang\ru.txt usr_router_task.exe File opened for modification C:\Program Files\7-Zip\Lang\yo.txt usr_router_task.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\server\Xusage.txt usr_router_task.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Mac\UKRAINE.TXT usr_router_task.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_US\List.txt usr_router_task.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\en_GB\added.txt usr_router_task.exe File opened for modification C:\Program Files\7-Zip\Lang\br.txt usr_router_task.exe File opened for modification C:\Program Files\7-Zip\Lang\he.txt usr_router_task.exe File opened for modification C:\Program Files\7-Zip\Lang\io.txt usr_router_task.exe File opened for modification C:\Program Files\7-Zip\Lang\ps.txt usr_router_task.exe File opened for modification C:\Program Files\7-Zip\Lang\sk.txt usr_router_task.exe File opened for modification C:\Program Files\7-Zip\Lang\sq.txt usr_router_task.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\jvm.hprof.txt usr_router_task.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_CA\README_en_CA.txt usr_router_task.exe File opened for modification C:\Program Files\7-Zip\Lang\ext.txt usr_router_task.exe File opened for modification C:\Program Files\7-Zip\Lang\ne.txt usr_router_task.exe File opened for modification C:\Program Files\7-Zip\Lang\pa-in.txt usr_router_task.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\jvm.hprof.txt usr_router_task.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\LICENSE.txt usr_router_task.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_GB\affDescription.txt usr_router_task.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_GB\README.txt usr_router_task.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\en_CA\excluded.txt usr_router_task.exe File opened for modification C:\Program Files\7-Zip\Lang\ba.txt usr_router_task.exe File opened for modification C:\Program Files\7-Zip\Lang\fr.txt usr_router_task.exe File opened for modification C:\Program Files\7-Zip\Lang\gl.txt usr_router_task.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\ClientLangPack_eula.txt usr_router_task.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\ClientVolumeLicense_eula.txt usr_router_task.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\TPN.txt usr_router_task.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\en-US\about_Pester.help.txt usr_router_task.exe File opened for modification C:\Program Files\7-Zip\License.txt usr_router_task.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ThirdPartyNotices.MSHWLatin.txt usr_router_task.exe File opened for modification C:\Program Files\7-Zip\Lang\et.txt usr_router_task.exe File opened for modification C:\Program Files\7-Zip\Lang\lij.txt usr_router_task.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..e.desktop.searchapp_31bf3856ad364e35_10.0.22000.1_none_e4512f709bf99514\1.txt usr_router_task.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..e.desktop.searchapp_31bf3856ad364e35_10.0.22000.1_none_e4512f709bf99514\21.txt usr_router_task.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..e.desktop.searchapp_31bf3856ad364e35_10.0.22000.1_none_e4512f709bf99514\26.txt usr_router_task.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_10.0.22000.1_de-de_7959c456ebb9668c\default.help.txt usr_router_task.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\CP1253.TXT usr_router_task.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\GREEK.TXT usr_router_task.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\TURKISH.TXT usr_router_task.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\UKRAINE.TXT usr_router_task.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\CENTEURO.TXT usr_router_task.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft.powershell.pester_31bf3856ad364e35_10.0.22000.1_none_2a76084a7899eecf\about_Pester.help.txt usr_router_task.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_10.0.22000.1_it-it_aef56379a4c25fd6\default.help.txt usr_router_task.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft.powershell.pester_31bf3856ad364e35_10.0.22000.1_none_34cab29cacfab0ca\about_should.help.txt usr_router_task.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\CacheSize.txt usr_router_task.exe File opened for modification C:\Windows\WinSxS\amd64_hyperv-containerlicense_31bf3856ad364e35_10.0.22000.1_none_abefd2487314ab92\License.txt usr_router_task.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-t..-coreinkrecognition_31bf3856ad364e35_10.0.22000.1_none_43dbdf4affbbc684\ThirdPartyNotices.MSHWLatin.txt usr_router_task.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-windowscodecraw_31bf3856ad364e35_10.0.22000.132_none_9051d3373cf05252\WindowsCodecsRaw.txt usr_router_task.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_10.0.22000.1_ja-jp_511ae28697dd71b1\default.help.txt usr_router_task.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..e.desktop.searchapp_31bf3856ad364e35_10.0.22000.1_none_e4512f709bf99514\19.txt usr_router_task.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..e.desktop.searchapp_31bf3856ad364e35_10.0.22000.1_none_e4512f709bf99514\8.txt usr_router_task.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-t..extservice-tigrinya_31bf3856ad364e35_10.0.22000.1_none_c8b6636e50b594e4\TableTextServiceTigrinya.txt usr_router_task.exe File opened for modification C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\wow64_microsoft-windows-windowscodecraw_31bf3856ad364e35_10.0.22000.132_none_9aa67d897151144d\f\WindowsCodecsRaw.txt usr_router_task.exe File opened for modification C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\cache\Desktop\12.txt usr_router_task.exe File opened for modification C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\cache\Desktop\19.txt usr_router_task.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_10.0.22000.1_fr-fr_ba78c2e0992fb85d\default.help.txt usr_router_task.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\CP1254.TXT usr_router_task.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\CROATIAN.TXT usr_router_task.exe File opened for modification C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\cache\Desktop\1.txt usr_router_task.exe File opened for modification C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\cache\Desktop\26.txt usr_router_task.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..e.desktop.searchapp_31bf3856ad364e35_10.0.22000.1_none_e4512f709bf99514\16.txt usr_router_task.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..e.desktop.searchapp_31bf3856ad364e35_10.0.22000.1_none_e4512f709bf99514\5.txt usr_router_task.exe File opened for modification C:\Windows\WinSxS\amd64_multimedia-generalmididata_31bf3856ad364e35_10.0.22000.1_none_df00e9715b2c26d4\gmreadme.txt usr_router_task.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_10.0.22000.1_en-us_224a9a4fda977251\default.help.txt usr_router_task.exe File created C:\Windows\Tasks\adv_handler_v12.job Crisp.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\ICELAND.TXT usr_router_task.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_10.0.22000.1_de-de_6f051a04b758a491\default.help.txt usr_router_task.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..e.desktop.searchapp_31bf3856ad364e35_10.0.22000.1_none_e4512f709bf99514\12.txt usr_router_task.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft.powershell.pester_31bf3856ad364e35_10.0.22000.1_none_2a76084a7899eecf\about_Mocking.help.txt usr_router_task.exe File opened for modification C:\Windows\WinSxS\amd64_windows-shield-provider_31bf3856ad364e35_10.0.22000.100_none_a1709384527830fe\ThirdPartyNoticesBySHS.txt usr_router_task.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_10.0.22000.1_fr-fr_c4cd6d32cd907a58\default.help.txt usr_router_task.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-t..-coreinkrecognition_31bf3856ad364e35_10.0.22000.1_none_4e30899d341c887f\ThirdPartyNotices.MSHWLatin.txt usr_router_task.exe File opened for modification C:\Windows\SystemTemp chrome.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\CP1257.TXT usr_router_task.exe File opened for modification C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\cache\Desktop\5.txt usr_router_task.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_10.0.22000.1_en-us_17f5effda636b056\default.help.txt usr_router_task.exe File opened for modification C:\Windows\WinSxS\amd64_windows-defender-service_31bf3856ad364e35_10.0.22000.1_none_1be9c0745b95a762\ThirdPartyNotices.txt usr_router_task.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft.powershell.pester_31bf3856ad364e35_10.0.22000.1_none_34cab29cacfab0ca\about_Mocking.help.txt usr_router_task.exe File opened for modification C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_windows-shield-provider_31bf3856ad364e35_10.0.22000.100_none_a1709384527830fe\f\ThirdPartyNoticesBySHS.txt usr_router_task.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_10.0.22000.1_es-es_17c14ce1a65da1fb\default.help.txt usr_router_task.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-t..extservice-tigrinya_31bf3856ad364e35_10.0.22000.1_none_d30b0dc0851656df\TableTextServiceTigrinya.txt usr_router_task.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft.powershell.pester_31bf3856ad364e35_10.0.22000.1_none_34cab29cacfab0ca\about_BeforeEach_AfterEach.help.txt usr_router_task.exe File opened for modification C:\Windows\WinSxS\amd64_hyperv-vmfirmware_31bf3856ad364e35_10.0.22000.100_none_82dd06fb5f4c9900\VmFirmware Third-Party Notices.txt usr_router_task.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..e.desktop.searchapp_31bf3856ad364e35_10.0.22000.1_none_e4512f709bf99514\4.txt usr_router_task.exe File opened for modification C:\Windows\SystemTemp msedge.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft.powershell.pester_31bf3856ad364e35_10.0.22000.1_none_2a76084a7899eecf\about_should.help.txt usr_router_task.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_10.0.22000.1_es-es_2215f733dabe63f6\default.help.txt usr_router_task.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\CP1258.TXT usr_router_task.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\ROMANIAN.TXT usr_router_task.exe File opened for modification C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\cache\Desktop\8.txt usr_router_task.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft.powershell.pester_31bf3856ad364e35_10.0.22000.1_none_2a76084a7899eecf\about_TestDrive.help.txt usr_router_task.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-windowscodecraw_31bf3856ad364e35_10.0.22000.132_none_9aa67d897151144d\WindowsCodecsRaw.txt usr_router_task.exe File opened for modification C:\Windows\WinSxS\wow64_multimedia-generalmididata_31bf3856ad364e35_10.0.22000.1_none_e95593c38f8ce8cf\gmreadme.txt usr_router_task.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\CYRILLIC.TXT usr_router_task.exe File opened for modification C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-windowscodecraw_31bf3856ad364e35_10.0.22000.132_none_9051d3373cf05252\f\WindowsCodecsRaw.txt usr_router_task.exe File opened for modification C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\cache\Desktop\16.txt usr_router_task.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tmph6bxoily.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tmph6bxoily.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language usr_router_task.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Crisp.exe - System Time Discovery 1 TTPs 3 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 5020 chrome.exe 2376 msedge.exe 3280 chrome.exe - Inno Setup is an open-source installation builder for Windows applications. 3 IoCs
Inno Setup installer
resource yara_rule behavioral3/memory/1760-0-0x0000000000400000-0x0000000000428000-memory.dmp innosetup behavioral3/memory/1760-43-0x0000000000400000-0x0000000000428000-memory.dmp innosetup behavioral3/memory/1760-87-0x0000000000400000-0x0000000000428000-memory.dmp innosetup - Enumerates system info in registry 2 TTPs 6 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe - Modifies data under HKEY_USERS 3 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry msedge.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134239836768673558" chrome.exe - Modifies registry class 4 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ chrome.exe Key created \REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ msedge.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msedge.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-226940941-599731907-2645636698-1000\{F14AB9F1-FEE3-4310-AF22-56E866855A65} msedge.exe - Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 5872 usr_router_task.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4556 D-Transmit.exe 1436 D-Transmit.exe 1436 D-Transmit.exe 1436 D-Transmit.exe 5872 usr_router_task.exe 5872 usr_router_task.exe 5872 usr_router_task.exe 5872 usr_router_task.exe 5872 usr_router_task.exe 5872 usr_router_task.exe 5872 usr_router_task.exe 5872 usr_router_task.exe 5872 usr_router_task.exe 5872 usr_router_task.exe 5872 usr_router_task.exe 5872 usr_router_task.exe 5872 usr_router_task.exe 5872 usr_router_task.exe 5872 usr_router_task.exe 5872 usr_router_task.exe 3372 chrome.exe 3372 chrome.exe 5872 usr_router_task.exe 5872 usr_router_task.exe 5872 usr_router_task.exe 5872 usr_router_task.exe 5872 usr_router_task.exe 5872 usr_router_task.exe 5872 usr_router_task.exe 5872 usr_router_task.exe 5872 usr_router_task.exe 5872 usr_router_task.exe 1508 Crisp.exe 1508 Crisp.exe 5872 usr_router_task.exe 5872 usr_router_task.exe 5872 usr_router_task.exe 5872 usr_router_task.exe 5872 usr_router_task.exe 5872 usr_router_task.exe 5872 usr_router_task.exe 5872 usr_router_task.exe 5872 usr_router_task.exe 5872 usr_router_task.exe 5872 usr_router_task.exe 5872 usr_router_task.exe 5872 usr_router_task.exe 5872 usr_router_task.exe 5872 usr_router_task.exe 5872 usr_router_task.exe 5872 usr_router_task.exe 5872 usr_router_task.exe 5872 usr_router_task.exe 5872 usr_router_task.exe 5872 usr_router_task.exe 5872 usr_router_task.exe 5872 usr_router_task.exe 5872 usr_router_task.exe 5872 usr_router_task.exe 5872 usr_router_task.exe 5872 usr_router_task.exe 5872 usr_router_task.exe 5872 usr_router_task.exe 5872 usr_router_task.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 5872 usr_router_task.exe - Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 1436 D-Transmit.exe 1436 D-Transmit.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 3372 chrome.exe 3372 chrome.exe 3372 chrome.exe 3372 chrome.exe 4644 msedge.exe 4644 msedge.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 5872 usr_router_task.exe Token: SeShutdownPrivilege 3372 chrome.exe Token: SeCreatePagefilePrivilege 3372 chrome.exe Token: SeShutdownPrivilege 3372 chrome.exe Token: SeCreatePagefilePrivilege 3372 chrome.exe Token: SeShutdownPrivilege 3372 chrome.exe Token: SeCreatePagefilePrivilege 3372 chrome.exe Token: SeShutdownPrivilege 3372 chrome.exe Token: SeCreatePagefilePrivilege 3372 chrome.exe Token: SeShutdownPrivilege 3372 chrome.exe Token: SeCreatePagefilePrivilege 3372 chrome.exe Token: SeShutdownPrivilege 3372 chrome.exe Token: SeCreatePagefilePrivilege 3372 chrome.exe Token: SeShutdownPrivilege 3372 chrome.exe Token: SeCreatePagefilePrivilege 3372 chrome.exe Token: SeShutdownPrivilege 3372 chrome.exe Token: SeCreatePagefilePrivilege 3372 chrome.exe Token: SeShutdownPrivilege 3372 chrome.exe Token: SeCreatePagefilePrivilege 3372 chrome.exe Token: SeShutdownPrivilege 3372 chrome.exe Token: SeCreatePagefilePrivilege 3372 chrome.exe Token: SeShutdownPrivilege 3372 chrome.exe Token: SeCreatePagefilePrivilege 3372 chrome.exe Token: SeShutdownPrivilege 3372 chrome.exe Token: SeCreatePagefilePrivilege 3372 chrome.exe Token: SeShutdownPrivilege 3372 chrome.exe Token: SeCreatePagefilePrivilege 3372 chrome.exe Token: SeShutdownPrivilege 3372 chrome.exe Token: SeCreatePagefilePrivilege 3372 chrome.exe Token: SeShutdownPrivilege 3372 chrome.exe Token: SeCreatePagefilePrivilege 3372 chrome.exe Token: SeShutdownPrivilege 3372 chrome.exe Token: SeCreatePagefilePrivilege 3372 chrome.exe Token: SeShutdownPrivilege 3372 chrome.exe Token: SeCreatePagefilePrivilege 3372 chrome.exe Token: SeShutdownPrivilege 3372 chrome.exe Token: SeCreatePagefilePrivilege 3372 chrome.exe Token: SeShutdownPrivilege 3372 chrome.exe Token: SeCreatePagefilePrivilege 3372 chrome.exe Token: SeShutdownPrivilege 3372 chrome.exe Token: SeCreatePagefilePrivilege 3372 chrome.exe Token: SeShutdownPrivilege 3372 chrome.exe Token: SeCreatePagefilePrivilege 3372 chrome.exe Token: SeShutdownPrivilege 3372 chrome.exe Token: SeCreatePagefilePrivilege 3372 chrome.exe Token: SeShutdownPrivilege 3372 chrome.exe Token: SeCreatePagefilePrivilege 3372 chrome.exe Token: SeShutdownPrivilege 3372 chrome.exe Token: SeCreatePagefilePrivilege 3372 chrome.exe Token: SeShutdownPrivilege 3372 chrome.exe Token: SeCreatePagefilePrivilege 3372 chrome.exe Token: SeDebugPrivilege 5872 usr_router_task.exe Token: SeDebugPrivilege 5872 usr_router_task.exe Token: SeShutdownPrivilege 3372 chrome.exe Token: SeCreatePagefilePrivilege 3372 chrome.exe Token: SeShutdownPrivilege 3372 chrome.exe Token: SeCreatePagefilePrivilege 3372 chrome.exe Token: SeShutdownPrivilege 3372 chrome.exe Token: SeCreatePagefilePrivilege 3372 chrome.exe Token: SeShutdownPrivilege 3372 chrome.exe Token: SeCreatePagefilePrivilege 3372 chrome.exe Token: SeShutdownPrivilege 3372 chrome.exe Token: SeCreatePagefilePrivilege 3372 chrome.exe Token: SeShutdownPrivilege 3372 chrome.exe - Suspicious use of FindShellTrayWindow 35 IoCs
pid Process 3372 chrome.exe 3372 chrome.exe 3372 chrome.exe 3372 chrome.exe 3372 chrome.exe 3372 chrome.exe 3372 chrome.exe 3372 chrome.exe 3372 chrome.exe 3372 chrome.exe 3372 chrome.exe 3372 chrome.exe 3372 chrome.exe 3372 chrome.exe 3372 chrome.exe 3372 chrome.exe 3372 chrome.exe 3372 chrome.exe 3372 chrome.exe 3372 chrome.exe 3372 chrome.exe 3372 chrome.exe 3372 chrome.exe 3372 chrome.exe 3372 chrome.exe 3372 chrome.exe 3372 chrome.exe 3372 chrome.exe 3372 chrome.exe 3372 chrome.exe 3372 chrome.exe 3372 chrome.exe 3372 chrome.exe 3372 chrome.exe 4644 msedge.exe - Suspicious use of SendNotifyMessage 16 IoCs
pid Process 3372 chrome.exe 3372 chrome.exe 3372 chrome.exe 3372 chrome.exe 3372 chrome.exe 3372 chrome.exe 3372 chrome.exe 3372 chrome.exe 3372 chrome.exe 3372 chrome.exe 3372 chrome.exe 3372 chrome.exe 3372 chrome.exe 3372 chrome.exe 3372 chrome.exe 3372 chrome.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1760 wrote to memory of 4636 1760 tmph6bxoily.exe 80 PID 4636 wrote to memory of 4556 4636 tmph6bxoily.tmp 81 PID 4556 wrote to memory of 1436 4556 D-Transmit.exe 82 PID 1436 wrote to memory of 5872 1436 D-Transmit.exe 83 PID 1436 wrote to memory of 5872 1436 D-Transmit.exe 83 PID 1436 wrote to memory of 5872 1436 D-Transmit.exe 83 PID 3372 wrote to memory of 2152 3372 chrome.exe 86 PID 3372 wrote to memory of 1900 3372 chrome.exe 87 PID 3372 wrote to memory of 1900 3372 chrome.exe 87 PID 3372 wrote to memory of 5020 3372 chrome.exe 88 PID 3372 wrote to memory of 5480 3372 chrome.exe 90 PID 3372 wrote to memory of 5480 3372 chrome.exe 90 PID 3372 wrote to memory of 408 3372 chrome.exe 92 PID 3372 wrote to memory of 1856 3372 chrome.exe 93 PID 3372 wrote to memory of 408 3372 chrome.exe 92 PID 3372 wrote to memory of 1856 3372 chrome.exe 93 PID 3372 wrote to memory of 2140 3372 chrome.exe 94 PID 3372 wrote to memory of 2140 3372 chrome.exe 94 PID 3372 wrote to memory of 4308 3372 chrome.exe 95 PID 3372 wrote to memory of 4308 3372 chrome.exe 95 PID 1436 wrote to memory of 1508 1436 D-Transmit.exe 96 PID 3372 wrote to memory of 1720 3372 chrome.exe 97 PID 5872 wrote to memory of 3372 5872 usr_router_task.exe 85 PID 5872 wrote to memory of 3372 5872 usr_router_task.exe 85 PID 5872 wrote to memory of 3372 5872 usr_router_task.exe 85 PID 5872 wrote to memory of 3372 5872 usr_router_task.exe 85 PID 5872 wrote to memory of 3372 5872 usr_router_task.exe 85 PID 1436 wrote to memory of 1508 1436 D-Transmit.exe 96 PID 5872 wrote to memory of 4848 5872 usr_router_task.exe 101 PID 5872 wrote to memory of 4848 5872 usr_router_task.exe 101 PID 5872 wrote to memory of 4848 5872 usr_router_task.exe 101 PID 5872 wrote to memory of 4848 5872 usr_router_task.exe 101 PID 5872 wrote to memory of 4848 5872 usr_router_task.exe 101 PID 5872 wrote to memory of 4848 5872 usr_router_task.exe 101 PID 5872 wrote to memory of 3372 5872 usr_router_task.exe 85 PID 5872 wrote to memory of 3372 5872 usr_router_task.exe 85 PID 5872 wrote to memory of 3372 5872 usr_router_task.exe 85 PID 5872 wrote to memory of 3372 5872 usr_router_task.exe 85 PID 5872 wrote to memory of 3372 5872 usr_router_task.exe 85 PID 3372 wrote to memory of 4008 3372 chrome.exe 104 PID 3372 wrote to memory of 6052 3372 chrome.exe 105 PID 3372 wrote to memory of 5848 3372 chrome.exe 106 PID 5872 wrote to memory of 2072 5872 usr_router_task.exe 107 PID 5872 wrote to memory of 2072 5872 usr_router_task.exe 107 PID 5872 wrote to memory of 2072 5872 usr_router_task.exe 107 PID 5872 wrote to memory of 2072 5872 usr_router_task.exe 107 PID 5872 wrote to memory of 2072 5872 usr_router_task.exe 107 PID 5872 wrote to memory of 2072 5872 usr_router_task.exe 107 PID 4644 wrote to memory of 1040 4644 msedge.exe 110 PID 4644 wrote to memory of 2376 4644 msedge.exe 111 PID 4644 wrote to memory of 5620 4644 msedge.exe 112 PID 4644 wrote to memory of 5620 4644 msedge.exe 112 PID 4644 wrote to memory of 5620 4644 msedge.exe 112 PID 4644 wrote to memory of 3584 4644 msedge.exe 113 PID 4644 wrote to memory of 3584 4644 msedge.exe 113 PID 4644 wrote to memory of 5740 4644 msedge.exe 115 PID 4644 wrote to memory of 5740 4644 msedge.exe 115 PID 4644 wrote to memory of 5740 4644 msedge.exe 115 PID 4644 wrote to memory of 3392 4644 msedge.exe 116 PID 4644 wrote to memory of 3392 4644 msedge.exe 116 PID 4644 wrote to memory of 3392 4644 msedge.exe 116 PID 5872 wrote to memory of 4644 5872 usr_router_task.exe 109 PID 5872 wrote to memory of 4644 5872 usr_router_task.exe 109 PID 5872 wrote to memory of 4644 5872 usr_router_task.exe 109
Processes
-
C:\Users\Admin\AppData\Local\Temp\tmph6bxoily.exe"C:\Users\Admin\AppData\Local\Temp\tmph6bxoily.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1760 -
C:\Users\Admin\AppData\Local\Temp\is-NVA35.tmp\tmph6bxoily.tmp"C:\Users\Admin\AppData\Local\Temp\is-NVA35.tmp\tmph6bxoily.tmp" /SL5="$5030A,4788852,121344,C:\Users\Admin\AppData\Local\Temp\tmph6bxoily.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4636 -
C:\Users\Admin\AppData\Local\Temp\is-3SCVJ.tmp\D-Transmit.exe"C:\Users\Admin\AppData\Local\Temp\is-3SCVJ.tmp\D-Transmit.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4556 -
C:\ProgramData\utilityhost_v7_arm64_prod%APPDATA%\D-Transmit.exeC:\ProgramData\utilityhost_v7_arm64_prod%APPDATA%\D-Transmit.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1436 -
C:\Users\Admin\AppData\Local\Temp\usr_router_task.exeC:\Users\Admin\AppData\Local\Temp\usr_router_task.exe5⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5872 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"6⤵PID:4848
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"6⤵PID:2072
-
-
-
C:\Users\Admin\AppData\Roaming\utilityhost_v7_arm64_prod%APPDATA%\Crisp.exeC:\Users\Admin\AppData\Roaming\utilityhost_v7_arm64_prod%APPDATA%\Crisp.exe5⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1508
-
-
-
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {c08afd90-f2a1-11d1-8455-00a0c91f3880} -Embedding1⤵PID:5708
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3372 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x108,0x10c,0x110,0x94,0x114,0x7ff89b16c728,0x7ff89b16c734,0x7ff89b16c7402⤵PID:2152
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1624,i,6079264104060196838,15111054344493688025,262144 --field-trial-handle=1920,i,10087404180366242720,5407630023949906195,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=1908 /prefetch:22⤵PID:1900
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2220,i,15789500849908026067,11589051453660339822,524288 --field-trial-handle=1920,i,10087404180366242720,5407630023949906195,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=2228 /prefetch:112⤵
- System Time Discovery
PID:5020
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2352,i,2715046103884338186,14536654722119395034,524288 --field-trial-handle=1920,i,10087404180366242720,5407630023949906195,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=2364 /prefetch:132⤵PID:5480
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3224,i,7933798987166704886,1753541764684587685,2097152 --field-trial-handle=1920,i,10087404180366242720,5407630023949906195,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=3232 /prefetch:12⤵PID:408
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3240,i,9430101136368037143,4268952051855851684,2097152 --field-trial-handle=1920,i,10087404180366242720,5407630023949906195,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=3272 /prefetch:12⤵PID:1856
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4416,i,3275733040135931242,305888770142736999,2097152 --field-trial-handle=1920,i,10087404180366242720,5407630023949906195,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=4428 /prefetch:92⤵PID:2140
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4724,i,1813982139136263038,16952824061968364494,2097152 --field-trial-handle=1920,i,10087404180366242720,5407630023949906195,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=4748 /prefetch:12⤵PID:4308
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5512,i,18027611400829335525,3557146899763181784,524288 --field-trial-handle=1920,i,10087404180366242720,5407630023949906195,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5508 /prefetch:142⤵PID:1720
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5972,i,6681611234567203807,14622333478710514081,524288 --field-trial-handle=1920,i,10087404180366242720,5407630023949906195,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5792 /prefetch:142⤵PID:4008
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5968,i,7603582976358609182,2271031326734678470,524288 --field-trial-handle=1920,i,10087404180366242720,5407630023949906195,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5980 /prefetch:142⤵PID:6052
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5976,i,8811091320572417583,8242581726152266012,524288 --field-trial-handle=1920,i,10087404180366242720,5407630023949906195,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5644 /prefetch:142⤵PID:5848
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2224,i,2266388186061802245,15460334261889235349,524288 --field-trial-handle=1920,i,10087404180366242720,5407630023949906195,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5380 /prefetch:112⤵
- System Time Discovery
PID:3280
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:4172
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:4244
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:1124
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:5188
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:4672
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:5824
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4644 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x2f4,0x7ff8865bc188,0x7ff8865bc194,0x7ff8865bc1a02⤵PID:1040
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1852,i,782003816689600098,7135121594653001737,524288 --field-trial-handle=2164,i,25873124715238944,13724024549439884086,262144 --variations-seed-version --mojo-platform-channel-handle=2192 /prefetch:112⤵
- System Time Discovery
PID:2376
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1596,i,1998432162863577080,2940327841631370451,262144 --field-trial-handle=2164,i,25873124715238944,13724024549439884086,262144 --variations-seed-version --mojo-platform-channel-handle=2160 /prefetch:22⤵PID:5620
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2372,i,4154711916312367916,1113257759453086804,524288 --field-trial-handle=2164,i,25873124715238944,13724024549439884086,262144 --variations-seed-version --mojo-platform-channel-handle=2380 /prefetch:132⤵PID:3584
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3444,i,10859799330141715556,433323779675621313,2097152 --field-trial-handle=2164,i,25873124715238944,13724024549439884086,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:12⤵PID:5740
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3464,i,7017891144696539680,9730961973379413403,2097152 --field-trial-handle=2164,i,25873124715238944,13724024549439884086,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:12⤵PID:3392
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5164,i,3701277041610787833,18088302494126776741,524288 --field-trial-handle=2164,i,25873124715238944,13724024549439884086,262144 --variations-seed-version --mojo-platform-channel-handle=5252 /prefetch:142⤵PID:5088
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5188,i,2504113914254189655,5366525999651772146,524288 --field-trial-handle=2164,i,25873124715238944,13724024549439884086,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:142⤵PID:2168
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6180,i,3898472200779683091,8670399015011022165,524288 --field-trial-handle=2164,i,25873124715238944,13724024549439884086,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:142⤵PID:1876
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6180,i,3898472200779683091,8670399015011022165,524288 --field-trial-handle=2164,i,25873124715238944,13724024549439884086,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:142⤵PID:4516
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6204,i,17990190424951473888,18162584364479986925,524288 --field-trial-handle=2164,i,25873124715238944,13724024549439884086,262144 --variations-seed-version --mojo-platform-channel-handle=6200 /prefetch:142⤵PID:5196
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.execookie_exporter.exe --cookie-json=11403⤵PID:5828
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6192,i,7420131976343002226,4837529402298963691,524288 --field-trial-handle=2164,i,25873124715238944,13724024549439884086,262144 --variations-seed-version --mojo-platform-channel-handle=6208 /prefetch:142⤵PID:4972
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6180,i,11895916520436027750,313718696813413932,524288 --field-trial-handle=2164,i,25873124715238944,13724024549439884086,262144 --variations-seed-version --mojo-platform-channel-handle=6580 /prefetch:142⤵PID:5724
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6280,i,4959098735904161297,16730493295968724909,524288 --field-trial-handle=2164,i,25873124715238944,13724024549439884086,262144 --variations-seed-version --mojo-platform-channel-handle=6624 /prefetch:142⤵PID:912
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵PID:4444
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵PID:3568
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵PID:920
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
3Credentials In Files
3Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\42b6e080-3d37-493f-b852-bafe42b23742.tmp
- Size 231KB
- SHA256 ba1b7bd6087d6068d1952594199fa9c6ebd82041c680fdcc73e735157f6d4fc9
- MD5 b4e8fc671f94c1462e829b985c20090d
- SHA1 729f986b39726ece99a5785be36d3cf1dde88888
- SHA512 f76fc4fda67d1c4f042d26f6157bc822922671c74ad632a81dc74b6347e1797eec5f6d86984ad8ad10d3afdf3882f525a95c0a720ea51f3c0dcd7e555e09a74d
- SSDEEP 6144:WLWhtQp2WBhKyZPhp32IZ8+f+zfAk3WbhL:7h0BHPhRlZZgfaFL
- TLSH T13D342211CD712E9EF860BD3AA5C45767AF591F662FF1FEA24258E5033DCAA190312B30
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
- Size 649B
- SHA256 273638b31b7b4da60934e4ec455f3cc9fb3ced514d7d614de4a0b71e924430c0
- MD5 6e129cde3b8014d21730d0068f95738d
- SHA1 592f2df2fdb9aafd61842900f1447f988e14dd35
- SHA512 06cde5718cda11c8e8b9d779425c17c1e70800928462c744bf66f938adb386bc05f1a462b4c76312ca63c68f39f7036e7f17ff7eebc4616c968a444ec3f00d84
- TLSH T165F0F4AAC921AC2B48FD5B1870A44B47E794132B3781985B3A3C520C8FF867B4695C2C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 3KB
- SHA256 6b06a93c732efc235ab71b6ef1c18e54b3ec2c2688ded62145be6ed14b2d364a
- MD5 dee93d33f10eb3aa2b94da24902b1003
- SHA1 55f5b0310a8c501c563b415b3c0c3c80045fd29b
- SHA512 7af473c39153174f3e431a60e9d8b21d80daee09122a71d2c8896a3c41d12e4c9139b25c2a3f6f54bdbb0dccd6e8742c681b08a75d5dc144bb4d4f08740d5246
- TLSH T1C3617BF7C7D8866DC51296F4AB256E2BCD2D0914532D3C66C8D4AF4B53E68B2D20028E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 a2623332667fdf55098c29cad2d741084ce8ea89b3b7b253883c0f3a45318279
- MD5 7a46ef06f63fa29c69c8a0b5ba58bc36
- SHA1 34d6c3555070c868c1a1b08d531b5ff4477d4a3a
- SHA512 2cd9b8a0c9b6beadb856baeb41a1fbadd9c330a8a193aa60f990b32e984a3de97817c23918482193b3d647efc6527613f4b1e17c6c51d99366fa89bcadd40379
- SSDEEP 192:JR+oxby64Z8Lv7lpupAPRp209fHsb+WNnav01M/IkwX+VyIsnAUgtaJ:JR+oE6FzZgUXzRww0n328
- TLSH T19242B42EBE14753B5CCBD62EF9627743D7F5112521942E44EBF88A1C28D76CC221B827
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 16e42a06d3a56893cb95c5ddb5a44bd66b9e696103cc80fe1ff5320216467004
- MD5 5d05a3f1691a619179797edaff43a95f
- SHA1 f109947cf1ad80623439388daa76c10d73931b73
- SHA512 1d710ba0ef74135aeb801a929e2b9b3a066df343c9124a7dc5dca46ccf1c0c52c5e99e8e86cccd2d84f3d9451db2a91464f27c808339bb53fa0b448efaa6b98e
- SSDEEP 192:JR+oZby64Z8Lv7lpupAPRp209fHsb+WNnav0QM/Ikwt+VyIsnAUgraJ:JR+o86FzZgUXzRww0IN2e
- TLSH T14142B42EBE14753B5CCBD62EF9627743D7F5112521942E44DAFC8A1C28E7ACC221B827
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 17KB
- SHA256 79ea521d9f3df87d24eec0f3607ae01ff8cf6eaeb5c7802f7c4721f58b8ddead
- MD5 5d35f09b8c86835fb4877dcd0cc40e4a
- SHA1 71d399e3fd153dc456fddb8f9cf7b1d428dcd2c7
- SHA512 68050d4d5a4a4f94c2a29dfff1edf5350066ef5a2e47ef11dcbd09970c2009d28d7804e59c25d64e43ef8e1367105d32e929bef6a7a0e31d18837b193891b321
- SSDEEP 384:WQjb+7KxkXqKf/pUZNCgVLH2Hfgsl5g7pLuLcSjQRXODaB+ErU39rHGQ3uKHaaK7:WUb+7KxkXqKf/pUZNCgVLH2HfgsLg7pn
- TLSH T1BF72F967BC4C9A370F94C6CDD8267A4FADB5024B65DD886483FA982903D4BCF110A2F7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
- Size 120B
- SHA256 2cc3b41c61fff8e2fe79a270ee42205dc2597c5dcbfc38ef076ba147d9a92fa8
- MD5 79d5ff896265252c50b00c26ca26f65d
- SHA1 09d08ccbc972567cee6d53c185f3817f3474c2db
- SHA512 63c507d1f43a67eea44582c898b8afdb769f8ec2a5db04b91b1b0c4d5b66ea72f5f5965b8aedb1acce92e075682f19697d771d5f57d5e0f2978161be817ef397
- TLSH T116B0125080436501C04642F432526C897118EF20960A171593E06A6688291518618051
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe592ed6.TMP
- Size 96B
- SHA256 2f32dcd680c8e4134da6e17129ebbab9a7bd0a5575c2aa456a9b28772c05d9be
- MD5 7cd4e657af107d4529d21a6d4d144ed2
- SHA1 31ae87b89078c49af6923fdcd2a48b02b5bbf3c9
- SHA512 b3d7751da3d1ad5380fa963eef71311124af27eeadfe768c4920056a47e6995ea539354b966251178590894e16af26bd5826a555468de702b1b1edcefa011792
- TLSH T117B02280C0822222C80203F838A282C83820CF28CA03820A83E00B22EC322300228030
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 231KB
- SHA256 7a0cd57f131df24ec4d011f601019e939ccda379f6cdfd489174c1ca2b1a3d7f
- MD5 9672c3718f24820c6b610da60ce538aa
- SHA1 03f9273cfda19e621ab8ff858af42e0cd85d1afd
- SHA512 32061ef2aa81d77586f7b78e88f2e235558b96ba8f4b2a0ec5887e4e4a755146f42d0774194444c1b96cdd9b601cb711b97e9c08966901e3e001daaacb55e6a9
- SSDEEP 6144:DLWhtQp2WBhKyZPhp32IZ8+f+zfAk3WbhL:Oh0BHPhRlZZgfaFL
- TLSH T1C6342211CD712E9EF860BD3AA5C45767AF591F652FF1FEA24258E5033DCAA190312B30
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 232KB
- SHA256 840ce12c8e36e23dce5ecf67c7b5e852f10ee75c46ce2728c89415fadb6a2f61
- MD5 0b082b8534c013d5d96265e891515e8d
- SHA1 a99e602a03fc050a84ab3d192691d16722207242
- SHA512 450b3236e0619059a3840e5544c52f5b6d73bd2e5f379f722d405ef55345289a902ba4b056eb07e147a29ed2c0d887567295edb082b456c90b646b2b48744afe
- SSDEEP 6144:eHLWhtQp2WBhKyZPhp32IZ8+f+zfAk3WbhL:Hh0BHPhRlZZgfaFL
- TLSH T168342221CD702E9EF860BD7AA5846B67AE591F672FB1FE614158F5033CCAA590312F30
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 115KB
- SHA256 72fccef7dfecb60752b6ad88135f4be0decdd7ff133af7004047fc6ebd77a28d
- MD5 493d86634c90c7da526185561e549877
- SHA1 74822553751fb8fbe985b675eee49924086cdef2
- SHA512 054b07eb8498667c377ddb5733f472cf634476f62e4bb427778b28f19733cac63750355390bc86b41af22f1b59bf1b2124c6f9b100ab647f6fb884ad718d423c
- SSDEEP 1536:nmueL6TFpmkUjlTArhJ+vgVuFM8r51TRB+BsJYuRZa8pSgeDAkwdqf8Wg+95h6mq:JDFpmzNA9J+zfAsJDREge7oWg+95hy
- TLSH T177B30212CAAACE9BE4A45C79E4C413F3BEBD5F9523F1BA424166E4023DDE7042395770
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 231KB
- SHA256 efad26fe3381f874c60498059baa0fc145c66795b045bbfa075b5dcd68aa8e79
- MD5 5804766104c80d522c9bf34bbfb5a880
- SHA1 c03202bb940f32cdd1b63e7a7500c07351f2b414
- SHA512 d2ed32752d97a3bfff8d31e551ea0ecf6e11c1d2655f6ddb1d24c8a4d50c4208d7d0c75c653c15cd61ee2e7aaad3f3d406e0d1b2d7d03ac4b2a2313527fbe07b
- SSDEEP 6144:RmLWhtQp2WBhKyZPhp32IZ8+f+zfAk3WbhL:hh0BHPhRlZZgfaFL
- TLSH T106342221CD702E9EF960BD7AA5846B67AE591F672FB0FE614158F5033CCAA590312F30
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 280B
- SHA256 7b9dac8593d827b7b825086ba5eeec776b808b8429eb90a6b645c319ec8f1435
- MD5 c16a98ebe36bda7f5aece00f9ac1d0d0
- SHA1 ef2e2a8775d1ebc0124f0ba983b6f20777919000
- SHA512 148affd9dbe6aaee9070c22e41bc916df527cec5741753ca2733855f500e4eef0a257445d281d79c2449f8265c41b54dd53ffe57650802594b1211b0db611349
- TLSH T1ADD012273B0DA054E7A9C2729613C7921BB6646174434B01E315C95C99B54D412D6183
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 280B
- SHA256 c17dc8315075bb661bddf6b1efa879b9a3c39af13982f986bd287f5bc861cbdf
- MD5 9573474710d1de6302a0d98890d2faae
- SHA1 618b9f2079a97625be399f6137e46655659ecff9
- SHA512 a345b915a4191d30d0da665ea4f78297c0cd671a5767e05c415403efb649110868fb279d22dc496792452c325e19b00f5e579f6e014a4488c9a4d6fac83d1c46
- TLSH T118D012273B0DB054E7A9C2729613C7921BB6646174434B01E315C95C99B54D412D6183
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
- Size 649B
- SHA256 e778acf91d64519646a7e8fdf6644c247c57b0a5bb9cb0419d943722f53b0a31
- MD5 4d9961951961c5ab3ee55b1f65bb544e
- SHA1 191c1d02582f9e565282664604fd256dc1366f63
- SHA512 475a80dccac78fd382c149421ece77376b63ce72ef330a5aa474a9a3ee62ccc8169e3e3fa5ac11ec5877c9a2f86f5c6991a34120f3a2c199b6c722b47da53540
- TLSH T12CF0F9A6C821AC3B08FD1B1960A55B46E744136B2B81894B3B3C820C8FB563F4945C2C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 4KB
- SHA256 dd6bf665ea2969294c37f0fb675932220366e2bd07ad541f6cf3d3e745b8c929
- MD5 98ae7752a3bf4ef4153b7f42466cbea8
- SHA1 386e2300016618130e708867114818ca5074b219
- SHA512 9f601b49b1fbbe477c3ee22009d7ad7dd5b2732ed656448fc8d910981637ad4c8689292f26884068455eed72248e17c5d29d2e531a4e6b8eaffbe7276583e1af
- SSDEEP 96:s1Peja/1gLwUeYenjlv6lAW3b/Zlrpn2umapOyV9Z8LR:AejvwUeglAk/ZlF2ifZ8R
- TLSH T12591853788811071FB5C0DF1B48F0817E1B324E62CA61E3A3BC468E7A603F9969DD08B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a12ce.TMP
- Size 2KB
- SHA256 897045419325f42ca894f229922df19d9c573d036604a1bd4e5755e6a781b5eb
- MD5 630d45abb22c2883a3a1c6030d72a686
- SHA1 9eac953092c2ce7f53cce44892399865d4c40357
- SHA512 aa199b08ad9f312412025d0dbc0f1b76f97ad8ce8a1e8bf45115156eab2f1ae05b2f6187003a7b339f6cc16c36acec21378b87b4b6f33a47196511775bcc05cb
- TLSH T113511D7A4A4601B6F34C0EF3F1C08417F1A34DE9189B9D713DE485BBA151F3A89E600C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
- Size 2B
- SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
- MD5 99914b932bd37a50b983c5e7c90ae93b
- SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
- SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
- Size 106KB
- SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
- MD5 25dca813dd764f2197142ef84bc5ce66
- SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
- SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
- SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
- TLSH T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
- Size 40B
- SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
- MD5 20d4b8fa017a12a108c87f540836e250
- SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
- SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 17KB
- SHA256 0f842d821c5dcfc98f10c87e88a1f199f8b9b223adab6e9fac16e0c4bf4b7371
- MD5 bb3ffa5bab6d17fc08dea9ead12f155c
- SHA1 3bac4903f63c647b7a10566df984626072e2459f
- SHA512 c38a03a16f0d43ef655910cec7fb31ebe4bf0d00821ec1421f04b9c887e055fe4c1f82f9ee6f94bc8a571af36472682b9c85c4c6cef8a11993a8fa7c686c3d3e
- SSDEEP 384:sxZJfnyn/c/fesgXUei2+6ykf/bJ/5dX+F:s9y/c/fiXUR3Q/bt5G
- TLSH T1B582F8066934497BCCEBD22AFA467B63D7F9157292904E4896FCCA0C04E66DD2213C3F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 17KB
- SHA256 1d8881c9e2d39ff27e3e79f535a46db430c331d9e182673bfb7122cb1e388d22
- MD5 5a11de7c24ff1c144a2b14f23ddc09a1
- SHA1 5c6c2d07e6feee6ea8a9674807a9c06f629908bf
- SHA512 b891880a0635a2ae4324091d77e95b9f0fd522c9d7f9f6b095b545e0fde809befffea2f9c6bd35b0237ec60a8369c12e667a907ddb4d41ba55c445b2eb93b7fc
- SSDEEP 384:sxZJfn6n/c/fesdXUei2o6ykf/bJ/5Ej+F:s96/c/fDXUF3Q/bt5n
- TLSH T12282F8066A34497B8CDBD22AF9467B53D7F91572D6904E48A6FCCA0C04E66DD2213C3F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
- Size 36KB
- SHA256 f9dd164637773dfbf561ad0ddb71e865f9e4297e3d60d8b17fb5e49e7abc490e
- MD5 3e09ff3f7a5553c4161f0e9a1492b6d8
- SHA1 4b1fe3eccbc278fad609fba5870d3ea00e9d4861
- SHA512 4a9db0024467a606fea941ea719d0e4420d9aee4d32d61e7ad988173091086c9f557e9dfe8c8ea259b4d0dfbd5a2829fc9aa291c10c14c021096f212d4549244
- SSDEEP 768:wQAKq8y02yS7pLuLnjbWRmj1QWT8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3Izx4Ll5:wQAKq8y02yqEnjbWRmj1QWTu1jaKIzxS
- TLSH T16403FA3B6C0CCB7E4FC04E9CED267E8A6DE8028BA698C95447FA444C03C66EF55165DB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\2c60ff2a-c337-4df0-aaba-fe27b78528c8\index-dir\the-real-index
- Size 72B
- SHA256 6d9c5bdc26f84d44c4b2bfbc97f07a697e3e347a83078e00c7703144ba9eb650
- MD5 15209eef5dc42ba762f2812912039a84
- SHA1 0400461d7651c21790aa914e7866feaa3d6fe1e0
- SHA512 a5c155f4e0fa652c857218acde7ff5caa3b772c0dee7fc638704c0bf09740b7d3c2a3dc818968235bb98505221561f786230dae6b4cd6f40ed546588a9420386
- TLSH T1C8A0027003C2AA02C00326B079A3CE8272E058100706D31D75E26084D9E55C0968502D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\2c60ff2a-c337-4df0-aaba-fe27b78528c8\index-dir\the-real-index~RFe59eca8.TMP
- Size 72B
- SHA256 ba82f71dd136e60a64f1abd439272a665decb166063b672edeca83f1e68ab06a
- MD5 92f390ce2d2e280ae8dee971bd37d03c
- SHA1 a308dbcb961d3f900a85512b7447ab92588ca114
- SHA512 8e038757a6afbffad13a733c48a40bd60b80d28e984660be63d08a65f6ea9cfa68dbd74d8977b3a23de47a1363fd5b50c81c0c0e4419b46c9b7174456fa88e66
- TLSH T141A002600390804BDC1261B5195302852310CB111101934BC0E54484DD624C24D6500C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\673ba0b2-ba38-4e02-b05c-f1c84ab818bc\index-dir\the-real-index
- Size 72B
- SHA256 3b6db7b195b2cd2aabf824227500e7a955015280081e3bd928b407832749e448
- MD5 76068ad2443ebdc752a18af3a3e1e3ba
- SHA1 3e4b1d265265289cd6deac5a386fdde19953a290
- SHA512 2f8a31562689e79dc95473566161619b0a520bf450935a6acb222ae7ef3d8209bab7035cf9495aff574769dfef1cee723f1dad64a39dc3e9fe454e95ab46dae9
- TLSH T1DEA0026156F49F91C00507F66552C550B3D89C370591C78D60D004598C511D8571E154
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\673ba0b2-ba38-4e02-b05c-f1c84ab818bc\index-dir\the-real-index~RFe59e47a.TMP
- Size 72B
- SHA256 f01f31e2cad238422e7bfb6705b04ec58439c5aa1f968acbd2991c182c68ecd4
- MD5 6eec44593d04b411398463d94b616187
- SHA1 817d8e34f8743ba02d11a310625c08adb54211f9
- SHA512 98008ab990548da232531712deb02412d896dd56f8edf84621f08c9f1667dac3fd292f5fbdf3a5a06d2c2c34439aa56055dc82d9642f7593e4612f0d2b870de4
- TLSH T162A002245655485DD90045B0960513506714DE111802C30B55E118658C577DC8D09058
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\84929e18-7031-4aed-9651-196b2ec11ecb\index-dir\the-real-index
- Size 3KB
- SHA256 809c9539247e680e39aac5e4bb5a3c2507c131020fac81fa3f0b82e44633c5bb
- MD5 1f2c17f75b29caaa3ce7d7dd581ec9e2
- SHA1 1e178cec4793f868583b3b141306e75f92904976
- SHA512 4a4e1f58fb3e16b2d63a4ee711eb8b9f5396ec246f364b5362dbbd8ed4efdf26b7397364973fce13c94abcd86443732af104c30f2054bcdb48d5970d00dd8aeb
- TLSH T1AB511A8F8E451921EEBC02F318B2045573B949CD2B80CE0794EC9078F9C36EE2CE4329
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\d9643bd4-31b9-4b5c-98c5-bbec2d1a1e64\index-dir\the-real-index
- Size 72B
- SHA256 5ae76e1244c3da2529f058ed0f91fb2ac71dc1fd11381ea730d23ad108c94f1b
- MD5 1b899c8b471cb278fd3dfd2111737419
- SHA1 a524ac76ada5c9ea23d85f5c3c393d03625146da
- SHA512 1d9b6ca66e3227f8690159958c5e0058967d20d1e91eb4af96fc7ba2a1c02f106af5bac69130f7b084504867f3c5a6bd27f54a015198ac43ec5991ab39fede4b
- TLSH T168A0025F39564F8AC82013F2705611612375CA160525C24A40DA10AD8D941C447AA882
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
- Size 476B
- SHA256 32a4948381b106ced169669593694bb9b60664eea90e9b50e193b50c30c26ce0
- MD5 9bdf21e1f9061f1dfa3b180ee622a787
- SHA1 4df7501ad388068da1e76c15733e7023179df581
- SHA512 4ff190ee91f3ab9e5f86f9a5048d099984fdb8fd90638c1ce91efda9bd34b3436bf2d71c5b3477fb319c9a333cb452e7b9397361683431b62dddd95782d251b7
- TLSH T149F027B62EF73818F867D3E21872946601453C54C554BC9F306EB6D7A0B521926ADC61
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
- Size 72B
- SHA256 6343df3588d83eab1c32f3e8726368b1fcd72f9d5699e594261afbb9aeb29eb1
- MD5 93950a3eb47d871926242ca01de0d680
- SHA1 554231b83b6515e52b51349e79bbef4e7102e52d
- SHA512 dea1c04b2949f79f1bf3511486a0f433c1208e2507801bf1f8ae4028553beb947e9c09f0bc9a2876af02fdc94bffdd9eed3ac09c2ce3dd7baa10b4d8d8671247
- TLSH T12DA00223C7596D8FC400177A745996C07392C8654915175294D4E098AC951406667356
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
- Size 24KB
- SHA256 b537adb6945d30ee774413a4a7b54d0104c589b3c3a6025de761223d856838a5
- MD5 1e3931843fae59a774130d77a1285d44
- SHA1 f5e7c6734c840b4adc502baa33f58f4996c50e24
- SHA512 aa3a3c36d0c104853930fc6b7e4a31cb0c8f374f7d7bcbfff779ed79956d3a6854b1590f52b134ad28133a7770e59b6ff6c9280975f4996e15578237e145612e
- SSDEEP 192:GD9R5VJhn/iVJnZFGVApBPisTE/3oNloNPSF53pVWFQ5xfSsD0PnY9JFlPtv0F5m:GZLVDJjEDPV0/ZdvLQhf
- TLSH T198B2575232BB02423C7E290C939687274A42F2633459ED7F7BA940B54E27E225DFD8CD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 28KB
- SHA256 2c8ecba26d159e9c7074133ffe92dbe38f6cc2159b65eababe3adcf561bf2138
- MD5 d03feb5276fbc4eb4111a766ed253a9e
- SHA1 cf7d7874bb979ffd0bab53ec65a78249e9285c6c
- SHA512 20d0ac50aeb90c566c850cd9b2e4bc0589cbe6893d4e4369a5847bc79387ab2fdad165da8367efd9936cd48532c0d4487b85c8456c65dfaca418ae72506a596b
- SSDEEP 384:nWiFKtNnNnb9P38ND8TUNTUlIRVT1m3ek32nn9WhKU4JfbgGwE0uTGvDOV0fjFc4:9FKjZb93cwgRKekm8c0Gevy0bFcTgAGl
- TLSH T1D2D25B36E864DDABEDEB4F9AB74A3243AFE00163888C5DD8DAD85D1C00871DD174BC26
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 28KB
- SHA256 7f5cd6bb6253b4524a3ae85b7af8923e3986e8ade92293c468c1e62107e889d8
- MD5 89234821f82c1a6a60fcf5bd674f631d
- SHA1 2a2c98b625f339524f9a9d8e5b847b0b4a1b064b
- SHA512 4dca7fd0e3cf830aa5f794871dd2463869b128515810d9697960d23b711be464d60a67a3f2d0d1d954a5f68be05cdff12a507e9aa2dc6610daa0a77e1464f376
- SSDEEP 384:nDiFKtNnNnb9P38ND8TUNTUlIRVT1m3ek32nn9WhKU4JfbgGwE0uTGvDOV0fjFc4:uFKjZb93cwgRKekm8c0Gevy0bFcTgAGl
- TLSH T1C9D25B36E865DDABEDEB4F9AB74A3243AFE00163888C5DD8DAD85D1C00871DD174BC26
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 25KB
- SHA256 9b0f3ec41aa8545f7107450cdc8aa8c31025396582c51285b63ac67d9348b799
- MD5 396e20701089d4a9c254c7796eef84f1
- SHA1 a25b5e64a22c2f79c02f4c6e4f9ca77fce84e01b
- SHA512 1511312ab17febb57d673dbe2a0600bacd8241e001b79d865b1e73a6ce45175809fcc732d362b856124733b1cabb95e11e82d4ab434c011f0d76b941779aa450
- SSDEEP 384:nDiF9CcmyWCs38Ni8TUNTUlIxBPm3ek32nn9BMQIs4JfbgGwE0uTGvTye4KV8p0R:uFccps3VwgPKekm0/sGevTyI8p0qM
- TLSH T19BC25B35EC68C9BBEDEA4F8AFB4E6603DEE01227859C49E4DAD81D1C108719D174BC23
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 25KB
- SHA256 afe1f0c2376903aef5e1a03800c0f925a0e2a31afd6d1b3da3c1c66ec9c1c552
- MD5 0a1ca5e9a0d9663f7ba1af8ecff64729
- SHA1 ef7d76fcf43c33531451a590f21b5da988daf3fb
- SHA512 51c9b05bf95850e6f7b67d94cdd6bdb94e58d50a6f4ce36132814c53ccfc14e7613149afbc3758b3d044ceb5e4c507620bae7f97de9fc098ff4909df80bf65a6
- SSDEEP 384:nWiFWCcmyWCo38ND8TUNTUlIRNT1m3ek32nn9yhnU4JfbgGwE0uTGvDO00Zty/7a:9FVcpo3cwgtKekmc90Gevp0f
- TLSH T17BC23A35DC68DDABEDEA4E9AF78A3643DEE00163898C4AD8DAD84D1C00871DD174BC27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 25KB
- SHA256 bf6e529fcdd5795280d4b4b31790adb8fb41352af652a90d3b80378dca3ed4c6
- MD5 c7a919ca35f00c1220e285c33a65257a
- SHA1 dd7192374252bcb2546b850f0a1f92eca4016a0f
- SHA512 ef5241c06f00caf04fd9375d608351a8264e811e02e0814e5a8a3b157a0477ddeaa343227327521a0b74adffe15b96fa37cf4224d294f1cbd7e5c2abaf22bf8a
- SSDEEP 384:nWiF9CcmyWCo38ND8TUNTUlIRhT1m3ek32nn9yhnU4JfbgGwE0uTGvDO00Zty/7a:9Fccpo3cwgFKekmc90Gevp0f
- TLSH T1A3C23A35DC64DDABE8EA4F9AF78A3643DEE00163898C8AD4DAD85D1C00971DD174BC27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\1A15176.tmp
- Size 2.3MB
- SHA256 879b8cb08df9a4e0eceec81c0605ed01a9d6921a3c92d9cb8dd86fcedc923782
- MD5 c09090ed51535c97ef7f3e57dc16b503
- SHA1 d88755df097f49197748dc37a4efac767c70b8be
- SHA512 75771c7897abd3595d69f158574eb4095b2ca4eb1693ae283ab3ad6000bd3038d9d797835d1fa400c903e33b114196e3058ee5373beda33b23618077a4bfb448
- SSDEEP 49152:5c9uiTSrokGchUo1HYP0vX4YmpD0Tx/bu0/57u212ynfKg:5ctOJKP0vXF+09/bu+7ung
- TLSH T118B53393125D423A9FF7E82E095119EB9C9D2E3194E4C66EF64D18F033AA4D02AFE345
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\1A15176.tmp
- Size 2.3MB
- SHA256 d0d581951599b4f0a6130dff2fdf21b9a537cc1d1667d09af20615a0b97499ee
- MD5 ebec590d10e7989caad95031f739f9b8
- SHA1 f0bd615cfa57eb23b8b56643a4b23f52e10e24a0
- SHA512 f5b8ad2c1a75d6478294ae635bd6389b6dca04618c1ec4dc840049facc0d9ad228f6f2f101c87778de1c362aa7377e4917fb9366f19eaa170683672f46f1dfb3
- SSDEEP 49152:Xc9uiTSr1kGchUo1HYP0vX4YmpD0Tx/bu0/57u212ynfKg:XctOSKP0vXF+09/bu+7ung
- TLSH T1AAB53393125D423A9FF7E82E095119EB9C8D2E3194F4C66EF64D18F033AA4D02AFE345
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\cf8f-236d-d71c-ddf9.tmp
- Size 8KB
- SHA256 fda90a9ff459d1f9f873660e151c92384b8412898ae7572c39129809b09ec461
- MD5 3366088aaf938568629aa8c6478ecedd
- SHA1 351ce14dce987b98a698f9007d65ddc78e10141e
- SHA512 b27498ad8f204d4d510b33ca7983b94d2f95e8013db6ed029152b7a68ecb5615500d54ec95ee073cbdba8a8f3ef14e711639811edfab95430bd48f545df27fde
- SSDEEP 192:cYCfPrBtMtRrlRhRKGc6m3dU/hVu+e4QvZ9BzWfqjalhA:sYtRhR+GvmeHdeFx9BzWfBK
- TLSH T16102BFB75DEDCE2BA05830372340E66F4CB662EA4B6C763909887B318629F10C866C04
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\is-3SCVJ.tmp\D-Transmit.exe
- Size 864KB
- SHA256 b87ebd3fcebd30a113ed0672e7b960feb2bf1918987d93c3f9942276ae9314fa
- MD5 03606c35456430789af96c919c5695ba
- SHA1 6bde4262e365f99d89c07ba66fa33ac0f763a8bb
- SHA512 4c2602552308ee25aa2aedeba046cb5ac0969448de70e7fcca9a985a46d685dc764b7136962039ddf3a248d96f07cbda468b361ce913376b5876175b13bff6b4
- SSDEEP 12288:R3Cig87yiDOkNjU7wDSxnY/duXadvu7wpDJd/zp:Ih873DOeDSxYFuKdvkADn/zp
- TLSH T1BC154D1A66A812F5D0F6D2B8CE974413E673B8565B32CACF02A1455F2F376E08E3B711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\is-3SCVJ.tmp\FileSyncEvents.dll
- Size 133KB
- SHA256 4bb4a6bde44f555bbc497bcb207abb8d1b8d2cd5bd001e07effa91c40dee83f8
- MD5 1795b1977fcdf5b00fb32ade97138f4c
- SHA1 9473a9a26b7ca71ba028c32b34866751d61c339b
- SHA512 5ce5af881527380e80d2fd704d69658dc747ed0df1c755112a47cffef43f77b19ea7f684936d56d062c8b49bf44a6525f2613e0c97b6537d9b63f983e74aa422
- SSDEEP 3072:J0ifDUehodGNITnblgW1UZ8u7h1P3P13CmTJXpmK:UIs+WeTl3CewK
- TLSH T14CD34A5B735C008AE519D1BA8AA7C807FB33BCA7072297CF13A5D31A0FA36E45D79614
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\is-3SCVJ.tmp\FileSyncFS.dll
- Size 1.0MB
- SHA256 29963d22067d02fd98ea93cb7a8b893e7fa12c3723bf89524d74e96fc2e0661d
- MD5 9774d60174faac68b55a54e4e7c9e59c
- SHA1 4b06b5c1e65ef34e230ea2f5f935f940217eb1fc
- SHA512 f77cf3fbb10e8a6c8576e3a908a6dce295b7a74ee0c938714e967f3147d8facc3073e16460ab9e035cb8ec39391f5739c53c45aaaa1c129e9075def53efdbddc
- SSDEEP 12288:Dvw3bD2C8Q/3xQKxcCoB7UeF0lJ4Vrh4C268goXnsvF1SEpzvDG6+83:DIrZB/hQK87HF0z4Ag6noF1DZG583
- TLSH T1E7357E1B666C416BD4AAE1FDCEA78917E7B2B84A433296CF03A4924D1F277E0453F710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\is-3SCVJ.tmp\FileSyncHost.dll
- Size 517KB
- SHA256 cdeecdd37c82dbe21a702c850b51c147ef961bd1ed12acbaf74d145859f79b04
- MD5 1f6530dcaf2e9add93d501e4e593be7e
- SHA1 da42be439e1730b24774e1213f7740c262a53155
- SHA512 5c0a0816de36f01f8170a483372f5ddf2df343a33d4ecdc8253c92f21949f84685df15505a47344e9dea9e36e11ac577e7dba5ae852a84ae0bc49b019448c4db
- SSDEEP 12288:Ewgyb9SSosddQYbScfAwGjUhQ7zNR3GU4z:Ewgw9CY2cFG2QnNY7z
- TLSH T163B44B59A2A803B9D1FAD1B88E638417E673BC19472286CF13E1E56D1F37BD0953B720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\is-3SCVJ.tmp\LoggingPlatform.DLL
- Size 693KB
- SHA256 4de36f8ac27f1f97d52b456d48f262202a5854e644561e3ad6a066ef3617d63d
- MD5 a32aebcc07025cee4987bff195b07f72
- SHA1 88a441015f95734952b6d0107b0ccde85bfbcd99
- SHA512 f0c96bad61c691256f5aef7f5a8b0a0d7b2c9607304f85f4893a58461a80dc74d5db0b5f1e8b29ff6f0ba19f428c113fec36da46a006b7315f3d49462bf6146b
- SSDEEP 12288:piDFPh/Fdt4UebGClX2t2lNTx+9E4oFvBJxjCnGcZmJcxcln:piDX/Fdt4jbGF2QE4sBTunGtJcxq
- TLSH T16CE45C1AA6A801A9D0FAD1B98E538427EB73BC054732D7CB0391C65E5F277D48B3B711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\is-3SCVJ.tmp\Telemetry.dll
- Size 1.0MB
- SHA256 f31a8953531ffb5c14e2d8347e283e1f8f3c732a5a9a68f611c96f4730e8a7dc
- MD5 b6a201726b44106a7dbe93a480b38420
- SHA1 10dfd71cf61ea3c1621a5b0c08c3b034773fb84b
- SHA512 6904d7c7e6d38ff983d25718d8ac4ed4161da8fac7e49274e135a7892a731eb11f99041eed4789c4d5b3c75ccf57a71bb70317d26e03520a4525018430406b03
- SSDEEP 12288:FPBiUxML1tCIS190GrCsXL2Ux4tMt+P7A+tz1ydyrgtD9KMB8:yUiL7iPBCs72ERt+TA+tzUAmBKMB8
- TLSH T1B235490677A47FB4E29BD0BDE6324403E5F2F4385322A5FF45DA59280E27AC05935BB2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\is-3SCVJ.tmp\UpdateRingSettings.dll
- Size 704KB
- SHA256 ffba487d0c0c1930ab99a23969ef010b49b9100c14c194841dc0d3fb27705504
- MD5 d0dbc08305de0948279a793b279cf1a0
- SHA1 a7a3c9b21c180e7eff9919d160dd8fb7bba8d3d7
- SHA512 e82f964edd631e7dffc06ad32b716fcda4a8cb69f21c2df5df9c42578789a162cbe2319a66c8e6a44d1d4b00d333567f80969264b3f21e4853dfc0c45ba7706c
- SSDEEP 12288:BqBEBmcaovtfVSMSmvKh3/WrAfzfJ1x1GgKNDNBus8x:82Bmc3vxUX/WmV1x1YBuTx
- TLSH T131E44B1AAAE802A9D0FBD1B98DE74417E773BC155732D6CF0291866E0F27BD0853B721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\is-3SCVJ.tmp\daemonproc.toml
- Size 18KB
- SHA256 165a08fd077f8be029bfaf7ae4f61591fc4088df6dbb94297369dbec1a4690ec
- MD5 b7839332de4b3efb75a3f6673ced50fe
- SHA1 52cfe9ca4b0af5b55578b71a2ad2bd394d205119
- SHA512 589738f9ac0cffb7c9cae441a7fc7a7b3672f14106c03e1e0aef1d70b741b4afd832bd790ccccaa693cd6d13980b7ac4cbe53fe5feabd2fb32f007d922424f09
- SSDEEP 384:ACqV1qTG4AhwiqTFrRYl66bMGaaaUibrLf2/GLDYj7h:ACqVsXQGYl66taUmr72/EDg7h
- TLSH T1FC825AB95A317FBA4D39699ADEA7E0D0C1C0EB1D194F5B73E8DA7466B01C8BC4450C03
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\is-3SCVJ.tmp\kernel_dump.lib
- Size 2.2MB
- SHA256 631d485a3c68aa3d028b03bd9c6c203505f9b394f9815c4b5c39766c34853570
- MD5 adc90c6a8a9c114b25411c237021866a
- SHA1 b4940a06b19adc14ac034b9b78afc41af990bdb6
- SHA512 f8b03b923c22e0efbadaa9a768833ade5ff0a5243a2621d9b568f27c0bb4e481ccc70d27c59abe464c9bbcc9147be945eccf02b040e11fefa3b6907e4532ff8a
- SSDEEP 49152:FcBdVnxtwRYTLWAA5l60mmEDUWoAXQHCV7P62A:e7hbyY2A4mVg4XQm7P6T
- TLSH T15BB5332ADF8A0CF7E537D833A6655CDBAFC62A580A25A0117DCCC4E5B96C11F10C1BE9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\is-3SCVJ.tmp\msvcp140.dll
- Size 530KB
- SHA256 fbc76265fe94360770149b2ee010a083bd41610092a48d331e4a50ade40b2972
- MD5 ac8c6c8f84a01c45a02cc59075cc8636
- SHA1 314a46d95c284b3ec16d63011a155ef14f8da5a7
- SHA512 a363468558d25c36cee103a4dc60a34a07336752777cb37b2322b2b9c26505619b6dd9aa724b8fcdedb2b0023bb5d37911d6159a6b14649e6dd4ebb375fbea58
- SSDEEP 12288:P0MrE03u1mHWV/I3HVbQEKZm+jWodEEV7Ki:P0p1F/IpQEKZm+jWodEENKi
- TLSH T1F4C41A23F75906A0E195E3B8A1838702D7F1BC598323E3C742EB955E2F577D0A63B690
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\is-3SCVJ.tmp\msvcp_win.dll
- Size 626KB
- SHA256 777d112d7e01a6b7d65f01e74bbd76dd4042614b2ba65a03ba12a661fe753481
- MD5 182d64877ec6ac8f0dcca0554f782e08
- SHA1 4c7002a605fcfb6dfe18ffd81a9958daac33c0bf
- SHA512 73e1bb8d43b6dc30846ebaf045abdcdbbf818bc098fd6dc80886c1f69bfbbee121c327ab1063704e7a69f2c543ae0afe09c4ad7179611825619d8adc29c3cd8b
- SSDEEP 12288:w+TTIwt0B5483RXXoTk3iUKQEKZm+jWodEEVUsS80v:58wdKnIk2QEKZm+jWodEEmsSN
- TLSH T1CFD41827BB5906A1D16693BCA5C74306E3F1BC054721A3C742EBE26D2F2B7C8673B650
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\is-3SCVJ.tmp\ucrtbase.dll
- Size 1.3MB
- SHA256 491a68206038a66c97e5e98094923cc0e7529504e506c13d6996c2b57cae3d3b
- MD5 4be2b1c8948f2d8e479b859ea027fd86
- SHA1 710b2438fd71e50569e12af4a0bba3e2d38b8dad
- SHA512 d778c2c9826698fa8e7484010b26ef4dd77f1bc20f0599fb95f703fe3f3696135548d924694b0f703b424973f10520ec69673cb7e25fda843067e227ad635fab
- SSDEEP 24576:QM6VUOfZDUVOb+uifkfEee3siuEWBlwmN1v2PI/BoEzJszW75mxvSZX0ypOpTq1:QM622DUVOb+uiMfE+nzTv2ApvzHWpI
- TLSH T1AA55AE6576AD01E9C1BFD139C64B4A06E5B27C1503708ACB03E94E792E3BBE9177B321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\is-3SCVJ.tmp\vcruntime140.dll
- Size 110KB
- SHA256 911e0d4a1754b1d9f8f7a577729d2ba74dd405b8027fcf4df5841626f270d19d
- MD5 1756e382708d39ad4c216b468f91db11
- SHA1 762b45db20290a54e83861456d3e40ac6c9601b9
- SHA512 202af6629bf2ded92ebbff28b6dd8df477338bfc2a7f3ccead44fe1f0f2e9514842c8faf136828833fb1614c135bcbc84342921030ac87133b33f2bdd88f4c90
- SSDEEP 1536:59pCUgtBAVcxStMXcfG8VwfmpcGLOI5EvMvecbeQ6N7vCyhz3:dyA+3EOfmpcGSL8ecbeQ6NTCyhz
- TLSH T1F7B36A0272B802FBD16AD278C1929E67E7B6F40587649BDF07EA46660F23BE05D3D341
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\is-3SCVJ.tmp\vcruntime140_1.dll
- Size 36KB
- SHA256 6ce58e7b441fb7adc7fffeb14c73502365ea13905eb2dce2520154d45e58f570
- MD5 70dcbda25747dc5a10efb5465de4e9ed
- SHA1 8f80898d75e7c84977bbfde2d4ee5cce284d0ce0
- SHA512 4da86078af85bbd169dde505265c34548d1c04de10b2e8d91eaee527e58856b43e5b002ad90b1303d6d17b601ed16ed8541209128c70e992a93ff0b293963b87
- SSDEEP 768:XezSkbhNfI4fWLZySXdPWD/0bO0UlU+9zZXM:0YZyqPWD/0y016zu
- TLSH T153F25B52A3784096E8ABC5B0C4A79F17FA39F69197A083CF1FA4954C1E577D0A33D322
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\is-NVA35.tmp\tmph6bxoily.tmp
- Size 1.1MB
- SHA256 8f0beb5863d190b7b2cfe7f506f3b721ab6b9e892337a133364f2ba710931b25
- MD5 be3cc5717f5951662adb399d613f20cc
- SHA1 f776bc4344ad59fbd6950d24d3aa6dddb3df215a
- SHA512 fbe0aab2194e4f09cbdbed770d862a4f9f2672a5c8346ee7e392341973c75cfc0b8c66a132e5a2bb22fb6e265cb40b45dfb05fb076c74914faed35e1e476a2cd
- SSDEEP 24576:wnbbPImgK4brDi4IxgRqzwqNb+Yz71P2EN29cnDdqxyt:GHeKh4nqzF1Px2io
- TLSH T10C453A22A3D28437D5732E759D6BD2946C367E202EB4E44A7EF89E0C0E35B41BD35392
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\usr_router_task.exe
- Size 132KB
- SHA256 f41bfa204e937824bbc509ec0716df5df62e174b73070d1fd80d3fb67a23b669
- MD5 3e963e13c6ab3091e0384dcf4539a03d
- SHA1 ca2c41403d392950eca218c5b3a8829d1f842c70
- SHA512 2b7bfb9dc0890c815042b03e2f202fe38106d0faa850caf9fc0f813e5a60cb5cdeae5868875d803350aa04cebd073f9ecd1563443e7a7db6029dc1812d674a59
- SSDEEP 3072:EkC27/AQ8nV9IL4lTV7O9TQPdnujXBuwcoLNjhpuxnTxkbDFv:EkC27/AQ8nW9sP2uwpRca
- TLSH T13AD39E12BB45C032F9920431A2AADB67193CF5302B6D49D7E3A05A76B8707D26B3D377
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\utilityhost_v7_arm64_prod%APPDATA%\Crisp.exe
- Size 334KB
- SHA256 c2e62475768c9546efe1da92a55f3bb2a55350eed83241139917aabd1ad25f8a
- MD5 5f9f88c9a16b62dc38504549e93d3667
- SHA1 587d56031b39e34102bc67b5f7d0338ee41b5328
- SHA512 edbb7a8cd75e056d2c47b8af6fbee63726cb3d5f000d5f8bc000f4b16366619c8532e628585cc943f474d2509c63802179d0d22a1d32dd690fb25e00d262af83
- SSDEEP 6144:7c2XFRJ3DNuzAOS9FuxIRtiiuhKPTqX4Y42:dFvYzU9kutRuhKPTqo32
- TLSH T125749E11B9D1C4B2C4B2053009E8EBB5697DFD714F61863B33D8772E1F742C1A662AA7
- MD5 SHA1 SHA512 SSDEEP TLSH