hijackloader | ae3ee04fded710b733a8eba2eb8e0aafa1fdb60805c6b48aa4aa56311079b10a

Analysis

max time kernel
150s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
29/05/2026, 12:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
kythy.exe
Size 3.2MB
Sample260529-pedktsbt2x
SHA256 ae3ee04fded710b733a8eba2eb8e0aafa1fdb60805c6b48aa4aa56311079b10a
MD5 65ad0cd29cb98f65c78cd7d732ae3575
SHA1 aa115272bf870525396531665186cc5f6d2dcf18
SHA512 48c34e38d8ad54abd77445073ddcbffde37f94982bb929032b018ceebdfe36d215d5be6715841724504644f6d14461a2b084e14939aed6e57188d2eef0f637ca
SSDEEP 49152:E2ruy20xzPWUd401IJzgG1NWIyuDMXSFH:EVOxgzgG9yuDMi5
TLSH
T1B1F58D5A6CE149FAC09A633289B362917BB4BC450F3223D72E90B63C2FB36E45C75754
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor credential_access discovery hijackloader snappyclient loader spyware stealer

Malware Config

Extracted

Family

hijackloader

Attributes

directory
%APPDATA%\com_pro_edge
inject_dll
%windir%\SysWOW64\input.dll

xor.hex

Extracted

Family

snappyclient

Attributes

additional_fields
false
buildID
main
cache_directory
naijaco
default_directory
%ALLUSERSPROFILE%\Mayanex
directory
Nata
events_db
Jifexabo
keylogger_file
Kapuq
shared_memory
true
software_db
Mitonico
tag
ARARAT

Signatures

Family: HijackLoader, IDAT loader, Ghostulse,
HijackLoader is a multi-stage loader, first seen in 2023.
loader hijackloader
Family: SnappyClient
SnappyClient is a C2 framework with information stealing capabilities, written in C++.
backdoor stealer snappyclient

Detects HijackLoader (aka IDAT Loader) 2 IoCs

resource	yara_rule
behavioral2/files/0x001900000002b58d-66.dat	family_hijackloader
behavioral2/files/0x001900000002b5bc-158.dat	family_hijackloader

Suspicious use of NtCreateProcessExOtherParentProcess 24 IoCs

description	pid	Process	procid_target
PID 4772 created 2120	4772	FusionSha.exe	88
PID 4772 created 2120	4772	FusionSha.exe	88
PID 4772 created 2120	4772	FusionSha.exe	88
PID 4772 created 5064	4772	FusionSha.exe	89
PID 4772 created 4288	4772	FusionSha.exe	90
PID 4772 created 2760	4772	FusionSha.exe	91
PID 4772 created 5368	4772	FusionSha.exe	93
PID 4772 created 4936	4772	FusionSha.exe	94
PID 4772 created 4996	4772	FusionSha.exe	96
PID 4772 created 2328	4772	FusionSha.exe	97
PID 4772 created 4416	4772	FusionSha.exe	99
PID 4772 created 5308	4772	FusionSha.exe	106
PID 4772 created 5308	4772	FusionSha.exe	106
PID 4772 created 3268	4772	FusionSha.exe	115
PID 4772 created 3268	4772	FusionSha.exe	115
PID 4772 created 3268	4772	FusionSha.exe	115
PID 4772 created 5104	4772	FusionSha.exe	116
PID 4772 created 3832	4772	FusionSha.exe	117
PID 4772 created 5136	4772	FusionSha.exe	118
PID 4772 created 3544	4772	FusionSha.exe	119
PID 4772 created 3084	4772	FusionSha.exe	121
PID 4772 created 4864	4772	FusionSha.exe	122
PID 4772 created 4112	4772	FusionSha.exe	125
PID 4772 created 4112	4772	FusionSha.exe	125

Downloads MZ/PE file 2 IoCs

flow	pid	Process
5	4044	kythy.exe
96	4772	FusionSha.exe

Executes dropped EXE 6 IoCs

pid	Process
5880	CvflHu0c96mag4yAZfUd4Ui4.exe
5568	GeneratorB64.exe
5124	GeneratorB64.exe
5436	GeneratorB64.exe
5896	bae0055f.exe
5052	GeneratorB64.exe

Loads dropped DLL 20 IoCs

pid	Process
5568	GeneratorB64.exe
5568	GeneratorB64.exe
5568	GeneratorB64.exe
5568	GeneratorB64.exe
5124	GeneratorB64.exe
5124	GeneratorB64.exe
5124	GeneratorB64.exe
5124	GeneratorB64.exe
5436	GeneratorB64.exe
5436	GeneratorB64.exe
5436	GeneratorB64.exe
5436	GeneratorB64.exe
4144	NexusReg86.exe
4772	FusionSha.exe
4068	Crisp.exe
2828	Crisp.exe
5052	GeneratorB64.exe
5052	GeneratorB64.exe
5052	GeneratorB64.exe
5052	GeneratorB64.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File opened for modification	C:\$Recycle.Bin\S-1-5-21-226940941-599731907-2645636698-1000\desktop.ini	NexusReg86.exe
File opened for modification	C:\Program Files\desktop.ini	NexusReg86.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	api.myip.com
4	api.myip.com

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
4772	FusionSha.exe

Suspicious use of SetThreadContext 9 IoCs

description	pid	Process	procid_target
PID 5436 set thread context of 4144	5436	GeneratorB64.exe	84
PID 5124 set thread context of 4772	5124	GeneratorB64.exe	85
PID 5436 set thread context of 4068	5436	GeneratorB64.exe	86
PID 5124 set thread context of 2828	5124	GeneratorB64.exe	98
PID 4144 set thread context of 2120	4144	NexusReg86.exe	88
PID 4144 set thread context of 3840	4144	NexusReg86.exe	104
PID 4144 set thread context of 2800	4144	NexusReg86.exe	123
PID 4144 set thread context of 4112	4144	NexusReg86.exe	125
PID 4144 set thread context of 2568	4144	NexusReg86.exe	143

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\System.Windows.Input.Manipulations.resources.dll	NexusReg86.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\deploy\messages_it.properties	NexusReg86.exe
File opened for modification	C:\Program Files\Common Files\System\msadc\de-DE\msaddsr.dll.mui	NexusReg86.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Globalization.Calendars.dll	NexusReg86.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\System.Windows.Input.Manipulations.resources.dll	NexusReg86.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\pt-BR_NEUTER.pak	NexusReg86.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-rtlsupport-l1-1-0.dll	NexusReg86.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\cryptix.md	NexusReg86.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Times New Roman-Arial.xml	NexusReg86.exe
File opened for modification	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml	NexusReg86.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\tipresx.dll.mui	NexusReg86.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\UIAutomationProvider.resources.dll	NexusReg86.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\bn_FEMININE.pak	NexusReg86.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\hi_MASCULINE.pak	NexusReg86.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.osmuxmui.msi.16.en-us.xml	NexusReg86.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hr.txt	NexusReg86.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\es-ES\InkObj.dll.mui	NexusReg86.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\cs_NEUTER.pak	NexusReg86.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial5-ul-oob.xrm-ms	NexusReg86.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\ca_MASCULINE.pak	NexusReg86.exe
File opened for modification	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml	NexusReg86.exe
File opened for modification	C:\Program Files\Common Files\System\Ole DB\oledbjvs.inc	NexusReg86.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-processthreads-l1-1-1.dll	NexusReg86.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\keypadbase.xml	NexusReg86.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\de\UIAutomationProvider.resources.dll	NexusReg86.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteVL_KMS_Client-ul.xrm-ms	NexusReg86.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\cldr.md	NexusReg86.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\THIRDPARTYLICENSEREADME.txt	NexusReg86.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\id_MASCULINE.pak	NexusReg86.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\lv_MASCULINE.pak	NexusReg86.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-debug-l1-1-0.dll	NexusReg86.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Trial-pl.xrm-ms	NexusReg86.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.VisualBasic.dll	NexusReg86.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Runtime.InteropServices.RuntimeInformation.dll	NexusReg86.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\es\System.Windows.Controls.Ribbon.resources.dll	NexusReg86.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\LICENSE	NexusReg86.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTest-pl.xrm-ms	NexusReg86.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest5-pl.xrm-ms	NexusReg86.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ka.txt	NexusReg86.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Numerics.dll	NexusReg86.exe
File opened for modification	C:\Program Files\Internet Explorer\de-DE\ieinstal.exe.mui	NexusReg86.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\dom.md	NexusReg86.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_Subscription-ul-oob.xrm-ms	NexusReg86.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremDemoR_BypassTrial365-ul-oob.xrm-ms	NexusReg86.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\hi_FEMININE.pak	NexusReg86.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Green.xml	NexusReg86.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\Microsoft.WindowsDesktop.App.runtimeconfig.json	NexusReg86.exe
File opened for modification	C:\Program Files\Java\jre-1.8\legal\jdk\relaxngom.md	NexusReg86.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTrial2-pl.xrm-ms	NexusReg86.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ipsptb.xml	NexusReg86.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Configuration.dll	NexusReg86.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\legal\javafx\directshow.md	NexusReg86.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Tw Cen MT.xml	NexusReg86.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\uk-UA\TipTsf.dll.mui	NexusReg86.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\UIAutomationProvider.resources.dll	NexusReg86.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Grace-ul-oob.xrm-ms	NexusReg86.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\ClientEventLogMessages.man	NexusReg86.exe
File opened for modification	C:\Program Files\Common Files\System\msadc\msdaremr.dll	NexusReg86.exe
File opened for modification	C:\Program Files\Java\jre-1.8\legal\jdk\santuario.md	NexusReg86.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\UIAutomationProvider.resources.dll	NexusReg86.exe
File opened for modification	C:\Program Files\Internet Explorer\uk-UA\ieinstal.exe.mui	NexusReg86.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Retail-pl.xrm-ms	NexusReg86.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Extensions.dll	NexusReg86.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\api-ms-win-core-processthreads-l1-1-1.dll	NexusReg86.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File created	C:\Windows\Tasks\AnalyzerGraphql_stable.job	Crisp.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CvflHu0c96mag4yAZfUd4Ui4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NexusReg86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Crisp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Crisp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bae0055f.exe

System Time Discovery 1 TTPs 4 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4632	chrome.exe
5136	msedge.exe
1672	msedge.exe
2760	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	FusionSha.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	FusionSha.exe

Enumerates system info in registry 2 TTPs 12 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134245305345980907"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-226940941-599731907-2645636698-1000\{DE007E07-C214-4077-BE7E-2D83187708BD}	msedge.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4144	NexusReg86.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5568	GeneratorB64.exe
5124	GeneratorB64.exe
5124	GeneratorB64.exe
5436	GeneratorB64.exe
5436	GeneratorB64.exe
5436	GeneratorB64.exe
5436	GeneratorB64.exe
5124	GeneratorB64.exe
5124	GeneratorB64.exe
4144	NexusReg86.exe
4144	NexusReg86.exe
4144	NexusReg86.exe
4144	NexusReg86.exe
4144	NexusReg86.exe
4144	NexusReg86.exe
4144	NexusReg86.exe
4144	NexusReg86.exe
4144	NexusReg86.exe
4144	NexusReg86.exe
4144	NexusReg86.exe
4144	NexusReg86.exe
4144	NexusReg86.exe
4144	NexusReg86.exe
4144	NexusReg86.exe
4144	NexusReg86.exe
2120	chrome.exe
2120	chrome.exe
4144	NexusReg86.exe
4144	NexusReg86.exe
4068	Crisp.exe
4068	Crisp.exe
4144	NexusReg86.exe
4144	NexusReg86.exe
4144	NexusReg86.exe
4144	NexusReg86.exe
4144	NexusReg86.exe
4144	NexusReg86.exe
4772	FusionSha.exe
4772	FusionSha.exe
4772	FusionSha.exe
4772	FusionSha.exe
4772	FusionSha.exe
4772	FusionSha.exe
4144	NexusReg86.exe
4144	NexusReg86.exe
4144	NexusReg86.exe
4144	NexusReg86.exe
2828	Crisp.exe
2828	Crisp.exe
2828	Crisp.exe
4772	FusionSha.exe
4772	FusionSha.exe
4772	FusionSha.exe
4772	FusionSha.exe
4772	FusionSha.exe
4772	FusionSha.exe
4772	FusionSha.exe
4772	FusionSha.exe
4772	FusionSha.exe
4144	NexusReg86.exe
4144	NexusReg86.exe
4144	NexusReg86.exe
4144	NexusReg86.exe
4144	NexusReg86.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4144	NexusReg86.exe

Suspicious behavior: MapViewOfSection 4 IoCs

pid	Process
5436	GeneratorB64.exe
5124	GeneratorB64.exe
5436	GeneratorB64.exe
5124	GeneratorB64.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
5308	chrome.exe
5308	chrome.exe
3268	msedge.exe
3268	msedge.exe
4112	msedge.exe
4112	msedge.exe

Suspicious use of AdjustPrivilegeToken 50 IoCs

description	pid	Process
Token: SeDebugPrivilege	4144	NexusReg86.exe
Token: SeShutdownPrivilege	2120	chrome.exe
Token: SeCreatePagefilePrivilege	2120	chrome.exe
Token: SeShutdownPrivilege	2120	chrome.exe
Token: SeCreatePagefilePrivilege	2120	chrome.exe
Token: SeShutdownPrivilege	2120	chrome.exe
Token: SeCreatePagefilePrivilege	2120	chrome.exe
Token: SeShutdownPrivilege	2120	chrome.exe
Token: SeCreatePagefilePrivilege	2120	chrome.exe
Token: SeShutdownPrivilege	2120	chrome.exe
Token: SeCreatePagefilePrivilege	2120	chrome.exe
Token: SeShutdownPrivilege	2120	chrome.exe
Token: SeCreatePagefilePrivilege	2120	chrome.exe
Token: SeShutdownPrivilege	2120	chrome.exe
Token: SeCreatePagefilePrivilege	2120	chrome.exe
Token: SeShutdownPrivilege	2120	chrome.exe
Token: SeCreatePagefilePrivilege	2120	chrome.exe
Token: SeShutdownPrivilege	2120	chrome.exe
Token: SeCreatePagefilePrivilege	2120	chrome.exe
Token: SeShutdownPrivilege	2120	chrome.exe
Token: SeCreatePagefilePrivilege	2120	chrome.exe
Token: SeShutdownPrivilege	2120	chrome.exe
Token: SeCreatePagefilePrivilege	2120	chrome.exe
Token: SeShutdownPrivilege	2120	chrome.exe
Token: SeCreatePagefilePrivilege	2120	chrome.exe
Token: SeShutdownPrivilege	2120	chrome.exe
Token: SeCreatePagefilePrivilege	2120	chrome.exe
Token: SeShutdownPrivilege	2120	chrome.exe
Token: SeCreatePagefilePrivilege	2120	chrome.exe
Token: SeDebugPrivilege	4772	FusionSha.exe
Token: SeShutdownPrivilege	5308	chrome.exe
Token: SeCreatePagefilePrivilege	5308	chrome.exe
Token: SeShutdownPrivilege	5308	chrome.exe
Token: SeCreatePagefilePrivilege	5308	chrome.exe
Token: SeShutdownPrivilege	5308	chrome.exe
Token: SeCreatePagefilePrivilege	5308	chrome.exe
Token: SeShutdownPrivilege	5308	chrome.exe
Token: SeCreatePagefilePrivilege	5308	chrome.exe
Token: SeShutdownPrivilege	5308	chrome.exe
Token: SeCreatePagefilePrivilege	5308	chrome.exe
Token: SeShutdownPrivilege	5308	chrome.exe
Token: SeCreatePagefilePrivilege	5308	chrome.exe
Token: SeShutdownPrivilege	5308	chrome.exe
Token: SeCreatePagefilePrivilege	5308	chrome.exe
Token: SeShutdownPrivilege	5308	chrome.exe
Token: SeCreatePagefilePrivilege	5308	chrome.exe
Token: SeDebugPrivilege	4144	NexusReg86.exe
Token: SeDebugPrivilege	4144	NexusReg86.exe
Token: SeDebugPrivilege	4144	NexusReg86.exe
Token: SeDebugPrivilege	4144	NexusReg86.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
5308	chrome.exe
5308	chrome.exe
5308	chrome.exe
5308	chrome.exe
5308	chrome.exe
5308	chrome.exe
5308	chrome.exe
5308	chrome.exe
5308	chrome.exe
5308	chrome.exe
5308	chrome.exe
5308	chrome.exe
5308	chrome.exe
5308	chrome.exe
5308	chrome.exe
5308	chrome.exe
5308	chrome.exe
5308	chrome.exe
5308	chrome.exe
5308	chrome.exe
5308	chrome.exe
5308	chrome.exe
5308	chrome.exe
5308	chrome.exe
5308	chrome.exe
5308	chrome.exe
5308	chrome.exe
5308	chrome.exe
5308	chrome.exe
5308	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe
2120	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4044 wrote to memory of 5880	4044	kythy.exe	80
PID 5880 wrote to memory of 5568	5880	CvflHu0c96mag4yAZfUd4Ui4.exe	81
PID 5568 wrote to memory of 5124	5568	GeneratorB64.exe	82
PID 5124 wrote to memory of 5436	5124	GeneratorB64.exe	83
PID 5436 wrote to memory of 4144	5436	GeneratorB64.exe	84
PID 5436 wrote to memory of 4144	5436	GeneratorB64.exe	84
PID 5124 wrote to memory of 4772	5124	GeneratorB64.exe	85
PID 5124 wrote to memory of 4772	5124	GeneratorB64.exe	85
PID 5436 wrote to memory of 4068	5436	GeneratorB64.exe	86
PID 5436 wrote to memory of 4068	5436	GeneratorB64.exe	86
PID 2120 wrote to memory of 5064	2120	chrome.exe	89
PID 2120 wrote to memory of 4288	2120	chrome.exe	90
PID 2120 wrote to memory of 2760	2120	chrome.exe	91
PID 2120 wrote to memory of 4288	2120	chrome.exe	90
PID 2120 wrote to memory of 4996	2120	chrome.exe	96
PID 2120 wrote to memory of 4996	2120	chrome.exe	96
PID 2120 wrote to memory of 5368	2120	chrome.exe	93
PID 2120 wrote to memory of 5368	2120	chrome.exe	93
PID 2120 wrote to memory of 4936	2120	chrome.exe	94
PID 2120 wrote to memory of 4936	2120	chrome.exe	94
PID 2120 wrote to memory of 2328	2120	chrome.exe	97
PID 2120 wrote to memory of 2328	2120	chrome.exe	97
PID 5124 wrote to memory of 2828	5124	GeneratorB64.exe	98
PID 2120 wrote to memory of 4416	2120	chrome.exe	99
PID 2120 wrote to memory of 4416	2120	chrome.exe	99
PID 2120 wrote to memory of 2012	2120	chrome.exe	101
PID 5124 wrote to memory of 2828	5124	GeneratorB64.exe	98
PID 4144 wrote to memory of 2120	4144	NexusReg86.exe	88
PID 4144 wrote to memory of 2120	4144	NexusReg86.exe	88
PID 4144 wrote to memory of 2120	4144	NexusReg86.exe	88
PID 4144 wrote to memory of 2120	4144	NexusReg86.exe	88
PID 4144 wrote to memory of 2120	4144	NexusReg86.exe	88
PID 4144 wrote to memory of 3840	4144	NexusReg86.exe	104
PID 4144 wrote to memory of 3840	4144	NexusReg86.exe	104
PID 4144 wrote to memory of 3840	4144	NexusReg86.exe	104
PID 4144 wrote to memory of 3840	4144	NexusReg86.exe	104
PID 4144 wrote to memory of 3840	4144	NexusReg86.exe	104
PID 4144 wrote to memory of 3840	4144	NexusReg86.exe	104
PID 4772 wrote to memory of 5308	4772	FusionSha.exe	106
PID 5308 wrote to memory of 4168	5308	chrome.exe	107
PID 5308 wrote to memory of 4632	5308	chrome.exe	110
PID 5308 wrote to memory of 5492	5308	chrome.exe	108
PID 5308 wrote to memory of 5492	5308	chrome.exe	108
PID 5308 wrote to memory of 648	5308	chrome.exe	111
PID 5308 wrote to memory of 648	5308	chrome.exe	111
PID 5308 wrote to memory of 5164	5308	chrome.exe	112
PID 5308 wrote to memory of 5164	5308	chrome.exe	112
PID 5308 wrote to memory of 6116	5308	chrome.exe	113
PID 5308 wrote to memory of 6116	5308	chrome.exe	113
PID 5308 wrote to memory of 5608	5308	chrome.exe	114
PID 4772 wrote to memory of 3268	4772	FusionSha.exe	115
PID 3268 wrote to memory of 5104	3268	msedge.exe	116
PID 3268 wrote to memory of 3832	3268	msedge.exe	117
PID 3268 wrote to memory of 5136	3268	msedge.exe	118
PID 3268 wrote to memory of 3832	3268	msedge.exe	117
PID 3268 wrote to memory of 3832	3268	msedge.exe	117
PID 3268 wrote to memory of 3544	3268	msedge.exe	119
PID 3268 wrote to memory of 3544	3268	msedge.exe	119
PID 3268 wrote to memory of 3084	3268	msedge.exe	121
PID 3268 wrote to memory of 3084	3268	msedge.exe	121
PID 3268 wrote to memory of 3084	3268	msedge.exe	121
PID 3268 wrote to memory of 4864	3268	msedge.exe	122
PID 3268 wrote to memory of 4864	3268	msedge.exe	122
PID 3268 wrote to memory of 4864	3268	msedge.exe	122

C:\Users\Admin\AppData\Local\Temp\kythy.exe
"C:\Users\Admin\AppData\Local\Temp\kythy.exe"
1⤵
- Downloads MZ/PE file
- Suspicious use of WriteProcessMemory
PID:4044
- C:\Users\Admin\Documents\Screenshot album\CvflHu0c96mag4yAZfUd4Ui4.exe
  "C:\Users\Admin\Documents\Screenshot album\CvflHu0c96mag4yAZfUd4Ui4.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5880
- - C:\Users\Admin\AppData\Local\Temp\GeneratorB64.exe
    "C:\Users\Admin\AppData\Local\Temp\GeneratorB64.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:5568
  - - C:\ProgramData\com_pro_edge\GeneratorB64.exe
      C:\ProgramData\com_pro_edge\GeneratorB64.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of WriteProcessMemory
      PID:5124
    - - C:\Users\Admin\AppData\Roaming\com_pro_edge\OFECSSODJBHIEXNE\GeneratorB64.exe
        
        C:\Users\Admin\AppData\Roaming\com_pro_edge\OFECSSODJBHIEXNE\GeneratorB64.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        Suspicious use of WriteProcessMemory
        
        PID:5436
      - C:\Users\Admin\AppData\Local\Temp\NexusReg86.exe
        
        C:\Users\Admin\AppData\Local\Temp\NexusReg86.exe
        6⤵
        Loads dropped DLL
        Drops desktop.ini file(s)
        Suspicious use of SetThreadContext
        Drops file in Program Files directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: AddClipboardFormatListener
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4144
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        7⤵
        
        PID:3840
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        7⤵
        
        PID:2800
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        7⤵
        
        PID:2568
      - C:\Users\Admin\AppData\Roaming\DOTNETServer_v7_ent\Crisp.exe
        
        C:\Users\Admin\AppData\Roaming\DOTNETServer_v7_ent\Crisp.exe
        6⤵
        Loads dropped DLL
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:4068
    - - C:\Users\Admin\FusionSha.exe
        
        C:\Users\Admin\FusionSha.exe
        5⤵
        Suspicious use of NtCreateProcessExOtherParentProcess
        Downloads MZ/PE file
        Loads dropped DLL
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Checks processor information in registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4772
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --disable-gpu about:blank
        6⤵
        Drops file in Windows directory
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Modifies registry class
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:5308
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff97acec728,0x7ff97acec734,0x7ff97acec740
        7⤵
        
        PID:4168
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1664,i,13576602809082881958,14141004449055129461,262144 --field-trial-handle=1920,i,10004611596646231380,14723253927336605354,262144 --variations-seed-version=20260529-010033.350000-production --mojo-platform-channel-handle=1916 /prefetch:2
        7⤵
        
        PID:5492
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1440,i,2307483735626219612,12929185983492064838,524288 --field-trial-handle=1920,i,10004611596646231380,14723253927336605354,262144 --variations-seed-version=20260529-010033.350000-production --mojo-platform-channel-handle=2004 /prefetch:11
        7⤵
        System Time Discovery
        
        PID:4632
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2140,i,3679804796701562026,4107617265328930293,524288 --field-trial-handle=1920,i,10004611596646231380,14723253927336605354,262144 --variations-seed-version=20260529-010033.350000-production --mojo-platform-channel-handle=2332 /prefetch:13
        7⤵
        
        PID:648
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2864,i,12091099954256439756,2598067799139027338,2097152 --field-trial-handle=1920,i,10004611596646231380,14723253927336605354,262144 --variations-seed-version=20260529-010033.350000-production --mojo-platform-channel-handle=2976 /prefetch:1
        7⤵
        
        PID:5164
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2856,i,2721823801374401484,12606116341751757829,2097152 --field-trial-handle=1920,i,10004611596646231380,14723253927336605354,262144 --variations-seed-version=20260529-010033.350000-production --mojo-platform-channel-handle=2944 /prefetch:1
        7⤵
        
        PID:6116
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5084,i,4333728418835124857,7980982139104973740,524288 --field-trial-handle=1920,i,10004611596646231380,14723253927336605354,262144 --variations-seed-version=20260529-010033.350000-production --mojo-platform-channel-handle=5080 /prefetch:14
        7⤵
        
        PID:5608
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-first-run --disable-gpu about:blank
        6⤵
        Drops file in Windows directory
        Enumerates system info in registry
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of WriteProcessMemory
        
        PID:3268
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x264,0x7ff9659fc188,0x7ff9659fc194,0x7ff9659fc1a0
        7⤵
        
        PID:5104
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --metrics-shmem-handle=1612,i,13560424120340498436,14698183333198918762,262144 --field-trial-handle=2700,i,1461425934387214925,2359622591780921760,262144 --variations-seed-version --mojo-platform-channel-handle=2696 /prefetch:2
        7⤵
        
        PID:3832
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1744,i,6352434886520424008,3795274499579540941,524288 --field-trial-handle=2700,i,1461425934387214925,2359622591780921760,262144 --variations-seed-version --mojo-platform-channel-handle=2736 /prefetch:11
        7⤵
        System Time Discovery
        
        PID:5136
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2028,i,18433451031863405447,6232965502665411752,524288 --field-trial-handle=2700,i,1461425934387214925,2359622591780921760,262144 --variations-seed-version --mojo-platform-channel-handle=2756 /prefetch:13
        7⤵
        
        PID:3544
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3388,i,4391925371374674261,802628004621396927,2097152 --field-trial-handle=2700,i,1461425934387214925,2359622591780921760,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:1
        7⤵
        
        PID:3084
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3392,i,10336913464450072032,1188199000337866556,2097152 --field-trial-handle=2700,i,1461425934387214925,2359622591780921760,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
        7⤵
        
        PID:4864
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-first-run --disable-gpu about:blank
        6⤵
        Drops file in Windows directory
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Modifies registry class
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        
        PID:4112
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x24c,0x7ff97a81c188,0x7ff97a81c194,0x7ff97a81c1a0
        7⤵
        
        PID:3244
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --metrics-shmem-handle=1632,i,7868069102663994989,13327060708936785428,262144 --field-trial-handle=2736,i,18392189120758556889,5841195089990073975,262144 --variations-seed-version --mojo-platform-channel-handle=2732 /prefetch:2
        7⤵
        
        PID:3580
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1796,i,1132111928448345039,1963469921162322664,524288 --field-trial-handle=2736,i,18392189120758556889,5841195089990073975,262144 --variations-seed-version --mojo-platform-channel-handle=2792 /prefetch:11
        7⤵
        System Time Discovery
        
        PID:1672
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2164,i,15007875877882790909,4746621363631772722,524288 --field-trial-handle=2736,i,18392189120758556889,5841195089990073975,262144 --variations-seed-version --mojo-platform-channel-handle=2896 /prefetch:13
        7⤵
        
        PID:4540
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3408,i,14801877427916516939,3668099919944638717,2097152 --field-trial-handle=2736,i,18392189120758556889,5841195089990073975,262144 --variations-seed-version --mojo-platform-channel-handle=3436 /prefetch:1
        7⤵
        
        PID:4600
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3432,i,11626931562565781301,11797133352099606996,2097152 --field-trial-handle=2736,i,18392189120758556889,5841195089990073975,262144 --variations-seed-version --mojo-platform-channel-handle=3448 /prefetch:1
        7⤵
        
        PID:6076
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4828,i,17882919049123652454,10916067796755540139,524288 --field-trial-handle=2736,i,18392189120758556889,5841195089990073975,262144 --variations-seed-version --mojo-platform-channel-handle=4924 /prefetch:14
        7⤵
        
        PID:3304
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4088,i,9278026788860067250,844443932085076800,524288 --field-trial-handle=2736,i,18392189120758556889,5841195089990073975,262144 --variations-seed-version --mojo-platform-channel-handle=4944 /prefetch:14
        7⤵
        
        PID:5484
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5824,i,10358144408128821903,6338895231829468480,524288 --field-trial-handle=2736,i,18392189120758556889,5841195089990073975,262144 --variations-seed-version --mojo-platform-channel-handle=5848 /prefetch:14
        7⤵
        
        PID:5584
        
        C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=1128
        8⤵
        
        PID:1692
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5900,i,14715693669865690857,777608031202629433,524288 --field-trial-handle=2736,i,18392189120758556889,5841195089990073975,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:14
        7⤵
        
        PID:2060
        
        C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=592
        8⤵
        
        PID:616
        
        C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5876,i,1714184392535153139,15648938428073101218,524288 --field-trial-handle=2736,i,18392189120758556889,5841195089990073975,262144 --variations-seed-version --mojo-platform-channel-handle=5860 /prefetch:14
        7⤵
        
        PID:4460
        
        C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5876,i,1714184392535153139,15648938428073101218,524288 --field-trial-handle=2736,i,18392189120758556889,5841195089990073975,262144 --variations-seed-version --mojo-platform-channel-handle=5860 /prefetch:14
        7⤵
        
        PID:5508
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd /c start "" "C:\Users\Admin\AppData\Local\Temp\2055af6c\bae0055f.exe"
        6⤵
        
        PID:5180
        
        C:\Users\Admin\AppData\Local\Temp\2055af6c\bae0055f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2055af6c\bae0055f.exe"
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5896
        
        C:\Users\Admin\AppData\Local\Temp\GeneratorB64.exe
        
        "C:\Users\Admin\AppData\Local\Temp\GeneratorB64.exe"
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5052
    - - C:\Users\Admin\AppData\Roaming\com_pro_edge\Crisp.exe
        
        C:\Users\Admin\AppData\Roaming\com_pro_edge\Crisp.exe
        5⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:2828

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {c08afd90-f2a1-11d1-8455-00a0c91f3880} -Embedding
1⤵
PID:2228

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2120
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff97a83c728,0x7ff97a83c734,0x7ff97a83c740
  2⤵
  PID:5064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1604,i,8132361541663308656,4761233223947065674,262144 --field-trial-handle=1980,i,14281834104549870615,683840175792530689,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=1976 /prefetch:2
  2⤵
  PID:4288
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2100,i,12905838436075492154,5656894296596709691,524288 --field-trial-handle=1980,i,14281834104549870615,683840175792530689,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=2120 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2244,i,2393531277233776236,18105826581514629938,524288 --field-trial-handle=1980,i,14281834104549870615,683840175792530689,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=2596 /prefetch:13
  2⤵
  PID:5368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3128,i,11014763866602426461,11296210928524385257,2097152 --field-trial-handle=1980,i,14281834104549870615,683840175792530689,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=3148 /prefetch:1
  2⤵
  PID:4936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3172,i,6619928929089623643,14905053500513159883,2097152 --field-trial-handle=1980,i,14281834104549870615,683840175792530689,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=3180 /prefetch:1
  2⤵
  PID:4996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4296,i,13095143274640400604,14328418531146869794,2097152 --field-trial-handle=1980,i,14281834104549870615,683840175792530689,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=4308 /prefetch:9
  2⤵
  PID:2328
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4772,i,16250419479057423087,12915234563158467190,2097152 --field-trial-handle=1980,i,14281834104549870615,683840175792530689,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=4748 /prefetch:1
  2⤵
  PID:4416
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5476,i,178273147270107319,4082593754835204130,524288 --field-trial-handle=1980,i,14281834104549870615,683840175792530689,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5436 /prefetch:14
  2⤵
  PID:2012

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5608

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4728

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3160

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5328

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3224

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1600

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:128

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3044

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1184

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:128

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 d65599d6ada1368cfdd37752f9f4ffa701a4bb9094fb2761a55cc5148f0c2ad4
MD5 1a7b496cb37120bca33db2d03f3457ce
SHA1 732c46a5197ff6148c375e1f65cb278e50d8df97
SHA512 41371c2e5141492f47fd6d0a302598986e40fb26f768e9d989d60b9ea0c07c1e497e00d7256c2a8477e8bed1ddfb689f2ba063f9844a336bf610abbe08693733
MD5 SHA1 SHA512

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 602ebeadc86437d4daf6b1fc05e86be9acb67ff63729472c1158dd82fe4109e7
MD5 15c56bddf7b795834a0e40fa4d386aba
SHA1 7f33bfd9e5407e9398ad293ecba0b3fbf2665843
SHA512 fdb16c1ee2efa24cdffdabac7e0d3ca02fda27a1f9e9ba5cd5d34c98c260009e415844d270db7f76c414e916a8e6906fbd5c005d8238d5a10a2f663fb2f1040b
TLSH
T14AF0F4A6C921AC3709FD8B1870A45B4AE780132B2781985F3A3C520C9FF467B8695C2C
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 39e47405ae88c0b4559a586609bd01e293b6dd777aff33cc5bc7f1c54caf21b3
MD5 8455aa8002e4a84dab9cc2e2d3311555
SHA1 639b4e04a2dceeb03ee2e6c133a2fe4c991e0efe
SHA512 08a12445adfe6b3f0075eacad4ef1e27cbf34495fd4135d69aa01c4cf917b25a7bbbf08f37b7792febb4b66f0675f2ba553488a7a5c797869085c0eb8a93d3cb
SSDEEP 192:XRzGZXVpuyHTVqv7lpupAPRp209fHsb+WNnWl0gyhH6akwIKVyIsnAUgtaJ:XRzGlRMZgUXzRwA0jH8
TLSH
T13E42B52EFD14643B9CCBD22EF9667753D7F5112921982E84DAFC8A2C28D7ACC2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 79ea521d9f3df87d24eec0f3607ae01ff8cf6eaeb5c7802f7c4721f58b8ddead
MD5 5d35f09b8c86835fb4877dcd0cc40e4a
SHA1 71d399e3fd153dc456fddb8f9cf7b1d428dcd2c7
SHA512 68050d4d5a4a4f94c2a29dfff1edf5350066ef5a2e47ef11dcbd09970c2009d28d7804e59c25d64e43ef8e1367105d32e929bef6a7a0e31d18837b193891b321
SSDEEP 384:WQjb+7KxkXqKf/pUZNCgVLH2Hfgsl5g7pLuLcSjQRXODaB+ErU39rHGQ3uKHaaK7:WUb+7KxkXqKf/pUZNCgVLH2HfgsLg7pn
TLSH
T1BF72F967BC4C9A370F94C6CDD8267A4FADB5024B65DD886483FA982903D4BCF110A2F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 323bf8ee4d165765ea61bf6e0569117352eb855edd18545bd7b031adf11f24fe
MD5 ab9305fb4a8fe1cc6809e619088ccfab
SHA1 bc71153e7a5768ea48836de5ae35cde95e25e4cc
SHA512 7bf0a5cc9482d93a768cccbef94e56ac5474aceb6873d77a58a277bf8245030ff508fe7d9df75d17db9538f1eb7a2ae7b797da517d087ee909d8ef6414bead40
SSDEEP 1536:nTueL6TFpmkUjlTArhJ+vgVuFM8r51TRB+BsJYuRZa8pSgeDAkwdqf8Wg+95h6mq:iDFpmzNA9J+zfAsJDREge7oWg+95hy
TLSH
T155B30212CAAACE9BE4A45C79A4C413F3BEBE5F9523F1BA424166A4423DCE7042395770
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 232KB
SHA256 06510e67d077b4d19c8bb71da6339b778290da2c09efef713db5e658eb92929a
MD5 a9fe5e18f6c877679d88e90da055912d
SHA1 16cb87b1ef355eab733093eb0c04abc9075ed8d3
SHA512 917770dccef030974f9ff0e17be4d2152aedee2a92603a26bf029d254d34673dc443b4364de061dff002434639abf4e23ad5041eeb414079caaa03dc40fe7d9a
SSDEEP 6144:lOv6dCdmiY+/L+myd+DGDr9f+zfAk3WbhD:0vVmit1G+qX1gfaFD
TLSH
T1293422129D6F8F97D1F0427690CE23E37C7AAF9707A972D16128A60634CF2809B17E34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7b9dac8593d827b7b825086ba5eeec776b808b8429eb90a6b645c319ec8f1435
MD5 c16a98ebe36bda7f5aece00f9ac1d0d0
SHA1 ef2e2a8775d1ebc0124f0ba983b6f20777919000
SHA512 148affd9dbe6aaee9070c22e41bc916df527cec5741753ca2733855f500e4eef0a257445d281d79c2449f8265c41b54dd53ffe57650802594b1211b0db611349
TLSH
T1ADD012273B0DA054E7A9C2729613C7921BB6646174434B01E315C95C99B54D412D6183
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c17dc8315075bb661bddf6b1efa879b9a3c39af13982f986bd287f5bc861cbdf
MD5 9573474710d1de6302a0d98890d2faae
SHA1 618b9f2079a97625be399f6137e46655659ecff9
SHA512 a345b915a4191d30d0da665ea4f78297c0cd671a5767e05c415403efb649110868fb279d22dc496792452c325e19b00f5e579f6e014a4488c9a4d6fac83d1c46
TLSH
T118D012273B0DB054E7A9C2729613C7921BB6646174434B01E315C95C99B54D412D6183
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ea360abfa6d7780a5cf37ae9e1a5ef1ae072a9c1bf9ea4e132cc2c57180bb6e8
MD5 e64bda76976773f0f5391f57b303bf39
SHA1 a0e05b193e0642accd161e17e2b36c8afda3d794
SHA512 b60a511297e9e3653ba355b1de03e90de7a655846efd57c4ae1b701b4358fec1eac25ccef193e7bf1c77f5570fca8597874e7b368c53d953d1a16e0c6fc324be
TLSH
T10ED012676B0D6464EFB8D6776223C6930767647054420B02E349CD5889B858401C11C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 20472a4e361ae0f871c034b3871cc872d00a9e2dfe666c7df8fa0a284959c14e
MD5 354f98795cfe270f9e24c1b056752f14
SHA1 91598a5c0dfb1ffbe64bd96f8176e93dc0fafcb5
SHA512 35e44d643a0327ddae06376e57df635d1b05ff4c30d9d7bfb57dfa4c1173a389401c2c210e4c3cf89f777b7832b8c28396b8b91468185950bbf46e92fccd4ac6
TLSH
T12CD012676B0D5464EFA8D6776263C6930767607154420B02E349CD5899B859401C11C2
MD5 SHA1 SHA512 TLSH

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 350018823991afab80ecd6ba03c9dd206ad3d11b3b4c7dca694017f682bc41b2
MD5 c184622ea25500d7e6e494b9f6714055
SHA1 603742e7610805d4096791e0a0c56f7fef31d74c
SHA512 69b401508170a30ffd89ed5419fbd7df1f668648344a4b87303806e5a4e1804edbb3dcd42ea7cd53b808b41292c46690ca5f97417ca329c6cc43ec97b52703ac
TLSH
T131F0F9A6C921AC3B09FD1B2960A45B4AE745135B2B81494B3A3C820C8FB063B4545D2C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 25KB
SHA256 44a6cf2d7035d6d8cade4d85fd8426baebc07bc2a102647776742769ca1fc2d9
MD5 1bb61934fc312068fa4c456c77ff039b
SHA1 8d86cbfbe56abcd8b539a401efbb19a4d1a52196
SHA512 bcc4baf75bccf810b11a19219a563fc2e3bf61f2f4e3b4b82d908d3b1207dc78c725e39e91b6f814280604a1514c0c38d0e400ac13feeb00dc35b71ade9bcb13
SSDEEP 192:GD9R5VJhn/iVJnZFGVApBPisTE/3oNloNPSF53pVWFQ5xfSsD0PnY9JFlPtv0F5Q:GZLVDJjEDPV0/Zd+huno
TLSH
T165B2481236BA42423C7D690C939687674A42F1633069ED7F7BB900B64E27E215EFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 786467efe8b5f71f60095e1be28e1a6b55073cb79bd159a7c6ea66726c0859d9
MD5 f3359ed5e3c09c2a247eda2743b2af02
SHA1 36c201c70746f6aeeaa8dbd873d5e478b30c66a9
SHA512 88c57d59e577fa61ccf1e2a0313ffc4f4c157c9a881c9f939c576ba22b1a0c3912f3c453dd0d05003855b037703ba771892f951e65718e6d46bccac846e41179
SSDEEP 384:njiF9CcmyWCs38ND8TUNTUlIxBPm3ek32nn9B+Q4s4Jfb8GHg6Woe4KV8p0bWtyi:OFccps3QwgPKekmmnwGHgXoI8p0e
TLSH
T108B25A35EC58C9FBECE64F99B70A7A03DEE01263859C5AD8DAD81D1D009728D174BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

181b-14ae-9bca-3adb.tmp

Path C:\Users\Admin\AppData\Local\Temp\181b-14ae-9bca-3adb.tmp
Size 288KB
SHA256 502ea6026945c8758f9c249d7adac767361b96279389a02112a58bd8a7875b0b
MD5 1e47fcf41b190291f65d27b33fbee14e
SHA1 d3908f491da2ed1208fbb5e984e3646d51cc531b
SHA512 6f7a2d7369d44a12a22e34a4d0bebaf43041d8b4a37f83613e6d4002d45664e909a7c31dfeb678e61dbb1476fedf82791827ebb031e6198e21f043d688e5b332
SSDEEP 192:fva0zkVmvQhyn+Zoz679fqlQbGhMHPaVAL23vIq9+CeB:f1zkVmvQhyn+Zoz67fq9TeB
TLSH
T1D354AA46EDC4F10ADB4A6830C6454DF37911AB0447826E2BDBBC1E3F0EB160DBDAD581
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a420ecbe

Path C:\Users\Admin\AppData\Local\Temp\2055af6c\a420ecbe
Size 40KB
SHA256 06aeb2f9c1ee642348c091fb27541c143545354c273055ce30832e0f61aedf81
MD5 ba979c77c714b67908bc582ec373c723
SHA1 ff6b59b47b8d3ad488eaa7a4b0040a9a93eb19fe
SHA512 fc6b860dcb9e00c6ab7aa72555fb17921bbb8b1276acf0ab5fcb20b5f2dbd4bf71946c5c4fcfc46310f8de29491a63e46d43805070d19f290070f60077f80b01
SSDEEP 96:wDaCn8MouB6w9fUP8iZqmvJKLPeymwil:wDaG7Iw9f/iSi
TLSH
T16103440F2E682801C8B94632BCF124E62E7DA03E4F13EED12CB504659D75C52B52E5EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7589-c3f3-7f9b-8d93.tmp

Path C:\Users\Admin\AppData\Local\Temp\7589-c3f3-7f9b-8d93.tmp
Size 16KB
SHA256 2a900a3f86387ef1a3c7a5d773dc42ffddcac41311e404665b2f3242dbd0c02a
MD5 bf048158bfb92a6901a38260e25100ff
SHA1 35cbd2d9c55acaf23808f5988a4c9b81e1470b68
SHA512 3e2eca5556d82d10215109f69347af49e9a7098b7df5b3da14f8f5a996ddfa416cc1318b1c4896856e3ee231d1366a25eebbbf084bc45df43039c980e670ddb5
SSDEEP 384:pH2McqmzQWV1ildCPAmbSZKw18HoQ/WhHjpOG8:pWMcqK3IzaSMw0Gp8
TLSH
T1F272D0D80B843F970BC63325BE5F777A8A874118560B1F8502F933566DEB3916A50B0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Temp\7RSLlmC\BYPnny0\Default\c4ptFKb5\Cookies
Size 20KB
SHA256 d0facaf8f70a6f736bf5193a78c15e03cdd40beb733aa5203ea50e51185f6489
MD5 51820b9d49898f20be7e08b22004d582
SHA1 94dd2bad703a325cd239d0626970a6d9e94e4273
SHA512 38c7ad3f5f067aeeee43d248e147fa818aae8d4ce8d5512c08b213d04f79aeea2ba22fe36eee5dd89aa2d4967fad6212b24037d376d603b49ef07b4de3170aaa
SSDEEP 24:TLyW91kweka6cLbXYFpFNYba5+6UwcQ8PAl5fBQNd5rHVC861ob0Oj:TeW9aw/aHLopFMavU1iBQNHrZwA
TLSH
T145920ECF2F343610C0F45732DAC205671E7C125CA323AA99EE6454F39CD24ABF5060E2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c4ptFKb5

Path C:\Users\Admin\AppData\Local\Temp\7RSLlmC\TLb6GkcDaN1\pccbfso0.default-release\c4ptFKb5
Size 96KB
SHA256 33a2357af8dc03cc22d2b7ce5c90abf25ac8b40223155a516f1a8df4acbf2a53
MD5 6066c07e98c96795ecd876aa92fe10f8
SHA1 f73cbd7b307c53aaae38677d6513b1baa729ac9f
SHA512 7d76207c1c6334aa98f79c325118adf03a5ba36b1e2412803fd3e654a9d3630c775f32a98855c46342eba00d4a8496a3ded3686e74beaac9c216beee37aa5cb7
SSDEEP 12:DQnD+23Fmdmc/OPVJXfPNn43etRRfYR5O8atLwxeYaNcDakMG/lO:DQnS232mNVpP965RayKN0MG/lO
TLSH
T192A3DD826B781395C44701B2FCB0565E0D3CA23849272B55AC39B0B30CD6A438A329FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Temp\7RSLlmC\sy5HN0wQk0\Default\35mh4cppAO\Login Data
Size 56KB
SHA256 f6dd954d4ffd30161e6ef3c3242d3576a739366f9b73f396e45583af8829d178
MD5 fe8c5fb9ed4218996d10e03d7f45f1ec
SHA1 e394d2de480259243fde14f8ecbf7682f7c845e5
SHA512 66f8bc3f3f092a9395f079ff000acf492ca96d51790c1265ac2e555a771fe2705b20e12a964884f27d333649c6a003a2a473dae74107b51730c0cf2d737dd46e
SSDEEP 96:dpfmG38t8KLPeymO7CGr8M5bn8MouB6w9fUPetSEPfNy:dpD07CGr8MV7Iw9f1N
TLSH
T1DA43771F1B682802CC698632ACB194F36F7CA13F8F539E922CB444359D75862B12D5FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Temp\7RSLlmC\sy5HN0wQk0\Default\35mh4cppAO\Web Data
Size 224KB
SHA256 9b8e825104fea28dc5adfaea6b25c183b5288f49f5a2e339ae17aea17d78c677
MD5 196d95c96714fc34840e7a74ce3d3506
SHA1 188cfa8e897f41c3d2aa678aeabd3658eaaebb5e
SHA512 3a27db93b1d458dc05e7c785995efbede72c7e0f63801180eccd4503d2d1dd9a30c8390dd12980fa3b001ec5ee4f422938bfe5d445919f958b87ebde2230cd73
SSDEEP 192:1LoWahmfT8wRJQnGL11HLfzNSivuvTNN+u/egddCeyv/hVRdbsCEV:WzmfQ0JQn6lLfzAivuvBN+wtP2s
TLSH
T10B24630A7B747001EDE7D9725CB080771A3CB16ECF22A6915DB254698DB2853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Temp\7RSLlmC\sy5HN0wQk0\Default\c4ptFKb5\Cookies
Size 20KB
SHA256 8946bce0e4c6563dee517204529454af0971c070773e66f6b19907ccf780839c
MD5 988a7fadc505c8d65db02f4bcbd6eb30
SHA1 3c4372f752c286d1e48b6cd1f2ab52f01b562ace
SHA512 f1fa1fc862ca63d312b041d409a4698fd3f9344745436ab2202de3c114ebd16ab8879b468620466c833ce9096d195f12b7450a2b366f9bac1874fc022cbe588d
SSDEEP 48:TtLopFMatSaw/auUOt8BMonwDEsddiAwH:9eMatUaAKJOVMAA
TLSH
T14392604E5F346121D2F44BB6DDD084672F7C212CD3B33A99AE1520F3CD9259BF4160AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

81FBA52.tmp

Path C:\Users\Admin\AppData\Local\Temp\81FBA52.tmp
Size 10.6MB
SHA256 246eda1f8b5a72cd35c7c8bb47d4aff0ad2dfd366a27f96d78914c2c21c09287
MD5 b105bd044db533adc6556019a8cb778e
SHA1 1c57df51b8cc847c2d5a914e1fbc24937f61ec17
SHA512 73b8cc7f86210a8a5af2c718cc03adffb0dddd008eaca31721c3523c7a75651a4be1ffa84098c8659bd6b637c71747cb155bdd92d6a30546dbdedcd941e70938
SSDEEP 196608:ZtOjAN0Y2szZQ9Ti2e9aPc8LNMJlbwqq6BN/qv9HJ7lnn3nXfDf7+j41L5cZYVmV:ZtOMKYPQ9Ti2e9ak8LWJbDq1HJR3vDD8
TLSH
T187B633C7CE02A169248B64EAC1D317577DF515402EED690D2A7EFFF688C8D00A60CA7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

857BC94.tmp

Path C:\Users\Admin\AppData\Local\Temp\857BC94.tmp
Size 2.3MB
SHA256 4aa4b4ba2a4f3ab18337936333a7511b13ff2e561420589ea8216d3ea46d1708
MD5 d4fa3c715c23e772b38807ce4bd6f5f4
SHA1 fb707f432db96a5d75aca6ff75939fc6ef2c3f0b
SHA512 26b832f94dd38ecd075dfb12e6ff01d784670ab869fbcd93e3730368318968f58a5b217a62dd917adcb4d45d7ef880d2b9434fa64c27eb7b48c3fb48645e9896
SSDEEP 49152:/9uiTSrjFeYUN3vLLlEXHmaL7d6RKU5TbTPzf9bsQwp2:ltOjAN3TLlEXHmaLIKAT/Tizp2
TLSH
T135B5331AF65193B676FBA069339C241ADCCA0624E8ADE34DD0C4A2F4F7AD112FE1C175
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

857BC94.tmp

Path C:\Users\Admin\AppData\Local\Temp\857BC94.tmp
Size 2.3MB
SHA256 c64d4415277e4e325fbc235a609fc84923896ea4cbb5e8e84d65fae773f08aa8
MD5 2e254f3b42c171e8b2b2eba3146f26b1
SHA1 62c8c3b9693d7fbaa2902ddd09dd835f4f294135
SHA512 79990cb72f43b0b0ed3f19ca5563b0d8e944a2b30b8741dbf6132e4c5c8dd3c239eb68b9ca03feec99985086f46dd12e183152afddec803ba1665197f0d9f9e5
SSDEEP 49152:J9uiTSr8FeYUN3vLLlEXHmaL7d6RKU5TbTPzf9bsQwp2:ntO8AN3TLlEXHmaLIKAT/Tizp2
TLSH
T16AB5331AF65193B676FBA069339C241ADCCA0624E8ADE34DD0C4A2F4F7AD112FE1C175
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

B33DA9E.tmp

Path C:\Users\Admin\AppData\Local\Temp\B33DA9E.tmp
Size 40B
SHA256 5c8b43b5eb3451eb423656f753fe083b7c2455efffc4004cc3ac2ce2319849be
MD5 49bb312920911bebe77fb8cdca0618f5
SHA1 9c96b89efd12a0b0964b295a7c19d7a8582bbbec
SHA512 b447dc45d0b6c601d845f9b7e543bb918a7512f1e1b64110e3512ee697a73ff6a68ed57be37fb9394ce570163f886b33c7d5756fb973b213430491c21ebbf691
MD5 SHA1 SHA512

Submit Download

DF8F79C.tmp

Path C:\Users\Admin\AppData\Local\Temp\DF8F79C.tmp
Size 40B
SHA256 980705bf858aeda532432f3adff09fe8acff0a94747c68b94240f627a9a6674c
MD5 f29d92d1a2b8e92ba5d663828dde1160
SHA1 bc90d2ac1d5472f7516c16cbfe7ed360c4564381
SHA512 27459e357697c4494c92507127bf8d2b794c4090a530a6b25d1650a5796a3eb674ad7af03290c024c582aac599c4a9f78ce00203fa5ffa8492bbd9ba49d58051
MD5 SHA1 SHA512

Submit Download

GeneratorB64.exe

Path C:\Users\Admin\AppData\Local\Temp\GeneratorB64.exe
Size 2.5MB
SHA256 0e87b92e67b8356eb8453b1a1c4fdada8b3c5c8e4372d6305ca14728b6c85137
MD5 ad56e2573dbf8803dbee0d6b0383eefe
SHA1 e54eb90ad489936434d55531e89547a357edf55c
SHA512 e5cf76ecb5aedfe58093e5f103a57822d3e8bd4ba49fa772df966b23a29cfc9fd1f68d82b3b44d7804b28e58ebf2a73004a122a424377d8e305d8ae172f302bd
SSDEEP 49152:HLhpAzncya2aperBTharP1p6A+0EAlNss2K2:H4zncHQXCngU2K2
TLSH
T186C54C07F6B105EAC6D9827CC819E554E771BD821920D71B21A1762E9F32B71AE3CF32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Graph.exe.manifest

Path C:\Users\Admin\AppData\Local\Temp\Graph.exe.manifest
Size 842B
SHA256 c7124bf5f44a11eb27e3002760c08a618844fe8488db8e78dc1528396a61896f
MD5 bb8b0008a1f68254d784c9a99ef0fae5
SHA1 d2d24ec9e23d80caf43495b1ac7d8db3d9d0b343
SHA512 d33e184aa3aecea8892247b7614a8c68d3f15d2cba905ff7cc4216d8a6550e29acbb572c161c513478fab02487584743ba137159f4f72f2f966fb50a82445bd8
TLSH
T19E0112C1E11CA6A5974220933D32E104A53FAF2E1AED45ECC4825ABF6602BD9AB82161
MD5 SHA1 SHA512 TLSH

Submit Download

LYNC.EXE.MANIFEST

Path C:\Users\Admin\AppData\Local\Temp\LYNC.EXE.MANIFEST
Size 3KB
SHA256 aa95b2e0f6e63e415aaf8984e90378ad97422b5db18ab6c94b77f08f8d0ea85c
MD5 dcbc398770211509146af6bd7a8080ad
SHA1 33546c93e57a2d7136224719ddcba5c71bcb844c
SHA512 6333806fe579bc17d9eb8b4a6ce0098337b35a156d5d35dc5b6707c7a2d20e5db88fae8054ab591adfbcafbcf992c60b7ca38c18927a4ac58b7c61c24a5c5fbc
TLSH
T1E7611182D598A0B4567110B336A9E656EF2943FF1A9A45B4708C8B5F7F328D2C3171D1
MD5 SHA1 SHA512 TLSH

Submit Download

MSOCF.DLL

Path C:\Users\Admin\AppData\Local\Temp\MSOCF.DLL
Size 235KB
SHA256 48b77bc84b6a1475fa0740cfab41d5998c0619e90f625f13e07181e08b3c7f4f
MD5 b6dedad5b85e108b7c9565d64495b458
SHA1 fa886315102b5557198528fa0dc08e5c2ad9546e
SHA512 57cd7717f08d33a717d51e7dcd5e214760ac4f9c88687d99ddf63817adeabdacad8e92cbbccaf85bd8ac0d1bf38238d23e03bf56640f890b8337db37f0ac4d9b
SSDEEP 3072:IKMAIWIu0Zs0vEzkMHAKHf8GaVJpRrbJmRTfOEm0Ykl5gZ5bFGE8j:IHdn9i/KG0fwOE35kbAV
TLSH
T1E534294B36A049F3E867913899A3DA52F6B2F8501F60D74B11B2833E5F7B7606D2C712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NexusReg86.exe

Path C:\Users\Admin\AppData\Local\Temp\NexusReg86.exe
Size 94KB
SHA256 b5379a43dbdd7231f7cafb912c1405e4d34f7c1f746db54ef03a3e024a6ee9c3
MD5 32e7be1220df639334f7035c44d1db05
SHA1 e21707e1be4337869d40fd1741372585a80bb2fe
SHA512 0cc76d126cc5c0246f6971449e710a5afd0a13babeaa8cc3a54d994b3a1b32b97e5b2e4b46c7c5ea3d569efe09f49b4f337dc45a5b421c1865f417de87e41ecb
SSDEEP 1536:JflPJ8nDqPZw6hoMnOmrYN4bAW9T9888888888888W88888888888BvqZK:JflPJ8nDTNPmcN4btR9888888888888B
TLSH
T11E93E603B3C30436F9699A38C4B6D014BD273DFC15D260252DB5EB8E49B93D26CBAD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OUTLOOK.EXE.MANIFEST

Path C:\Users\Admin\AppData\Local\Temp\OUTLOOK.EXE.MANIFEST
Size 1KB
SHA256 5821e8d34ecbfa9bce6213d7acf6c2dc43a80f7e6b29c5cfabd93f3ce7a15e90
MD5 138ab9862aa6ab96a5c49a2e2e3243a1
SHA1 ca486df8d61620af17060a83608f8a57c9da3c79
SHA512 f350119c7f001e9497ee38556a24a37508ea0af99a7f12ccde3acd68c525e3b80330fe3dfcf06d06a1a1cdc06fa013283bc9c44fead0eba343fc28b124524069
TLSH
T1C9311EC2B43C72E1970210E736BBF680983F9B7E0ADC81AC408997BBA5025D6D3471A2
MD5 SHA1 SHA512 TLSH

Submit Download

cdlmso.dll

Path C:\Users\Admin\AppData\Local\Temp\cdlmso.dll
Size 527KB
SHA256 6d2fa43545dac5a71f54b05a7ca0f1a4562493ed1b28ddbc3656acd9790c1bda
MD5 5183ece3283d4d076fd6594b2e1b0bf1
SHA1 08f86ff2579caaf04ea3f3dcf94b19ce6ba32fe4
SHA512 c9bb272f48fea0251e4f18f20f6746cdc2dec8087ff38b9addce8aef4b2f4c556ebb18a51d1be67cac6d56abeefeef7b933a271a88a0ac0331a48b165c8f149d
SSDEEP 6144:bugoAFAOGdWrL3ErUtscMK6z1ZTFSI6tRyzhHIwa49vljBmC1ZU8G7VD4/A1Vbrd:HoDWrTErUGcMZzBZh3A5LP
TLSH
T190B4294E7A700AF7C98BE9788E17C952D6F2F8450963870311A2C76F2E63BA19D0DF15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ddeb-b6d1-6d79-ea70.tmp

Path C:\Users\Admin\AppData\Local\Temp\ddeb-b6d1-6d79-ea70.tmp
Size 224KB
SHA256 7fe4a2f15e0582796e2964cede57141389374a3ee1fb022bcfaaa6983014cf1a
MD5 4e19802d3c83e4dcd771f44517162143
SHA1 2323b0978ecbcf19633a4e710e70a07534558024
SHA512 9d5b3bfb0f9afdcaeb972abacc44c183954c3200c3afeadc2691cb5a78662bc5d9a7cb6fbc9b7cfdc8e86e05c91eabf88f7619775160d7477522a1fd40c918b0
SSDEEP 192:jOFva0zkVmvQhyn+Zoz679fqlQbGhMHPaVAL23v:61zkVmvQhyn+Zoz67
TLSH
T16524D086AC04F52ACF4B3430E6834DF37E51520443486A76CABC0E7F1DB520E9B988E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

excel.exe.manifest

Path C:\Users\Admin\AppData\Local\Temp\excel.exe.manifest
Size 1KB
SHA256 18a420ce702345b8b3f8aef09867dbe730ef7da752227ab62ff0188538269751
MD5 fc5f90eb2dff2856b3dd6b6714e85bfd
SHA1 3396ebb2779358a71629e0470dca2338447b4d07
SHA512 479d942fc10f60b8a2f7cb2d6c83411513baa410224dbd87a5970412640d23a9ea91bd4c08aad0b1d2b65f52804f5cd8c4e1b20fc0fb1ed2868b47dfdc2bec46
TLSH
T1C621F4C1B11C7195E74220A33936F240A57F9F7F1DED81BC80C6957B76019DAE783192
MD5 SHA1 SHA512 TLSH

Submit Download

excelcnv.exe.manifest

Path C:\Users\Admin\AppData\Local\Temp\excelcnv.exe.manifest
Size 1KB
SHA256 a702fa4c3b7fff0f7fc9204bf6e23b1d2d423a835bc4f6d5ce485b8592319b32
MD5 5680fb6ff1f8ef8ea586e8f9207b83dc
SHA1 8d3d3798a2cfb5cdf2b3ce1af7485cc9efee09b5
SHA512 f9239311be05347979f9ed04253d88ab21bca30f49f4b1cb74fdd8ed5b334c7e7b4a8459790bda318e1e7f337df915a7a9d358fa48c7fe05dca1089d5f0c2538
TLSH
T1B311F3C1B00C6595A34220632D36F240A57F9F6F1DED41BC8086597F7601AD9E783192
MD5 SHA1 SHA512 TLSH

Submit Download

graph_stub.rc

Path C:\Users\Admin\AppData\Local\Temp\graph_stub.rc
Size 36KB
SHA256 1e7c4de7cd0d0e15d10c4f6fe73cf63e3dd79288fd4cb7b8d433763dee9f0503
MD5 3560dc13aca09f7e403b98cbf8aa06c0
SHA1 f74e6a611eec30d3f0ab76878e4c210b71f3b8d9
SHA512 e0509ee4a14631e63ddc6416e25c5fea2c7357c978e3a6bf0b11e7f2854515fdb84c8368121477d5c5ce4349eced76aab82e266bae377eeb8bcc12bb458befda
SSDEEP 768:bhe4j3g2ewqi0ltr+cA1Ddmsq7YW9iNKcc0DYL9OTv:tQGqXtr+dDhq0TNKcc0DYL4Tv
TLSH
T1EC036CAE9B165B85590AA43D810CB0F3C352F9727D2602B3FEDD046B7C268E5C92DD93
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kernel-layer.xml

Path C:\Users\Admin\AppData\Local\Temp\kernel-layer.xml
Size 7.3MB
SHA256 6966d23a1a388d7f0554f6eeb7294d92dc56570ea3e581521c6bcd411aac191b
MD5 6b6fa95301aa8b183d900277f45b7fc0
SHA1 7e334142ba04eec32458c9bb32e2274a02387807
SHA512 e67c96f102957be9d0cc184a0654ab3e6733bf1389ef5667c40f20f439c05c14725c5d8575224339aec623fc219807424474d9e16922ef8ac3f42b84dec764d4
SSDEEP 196608:JMjUBrVTAIqGvv1PMmW/6MZV2pORRkT1Nxx1LqwyJfXSdGKn:JMjaZTApGhMmW/6MypORM1HKwyiZn
TLSH
T1CD76331FEFDA9964C16523F029B8440A6C9BBBF36779C21043CB9874B2CDB9560DC369
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msaccess.exe.manifest

Path C:\Users\Admin\AppData\Local\Temp\msaccess.exe.manifest
Size 1KB
SHA256 cf7175fcf36f2f51415d009ee9a42c58381a415ee6677cf988486d4755c0c26b
MD5 b3e4e8cd4d9e46b6309106e52af87933
SHA1 94dc061c593c6d25795216c1715f1d946b434562
SHA512 1f32f7f4d012742992ccd0746dc560cf71895c3c439d7cb33d4b6078ccfcff894cf7e6714d101e11b30530686505e049172dbe41bdbc1acc9e989f765b0bedd7
TLSH
T198419C82D014A565FB9310E37FD4B768606D2F6F08CC93B8C8949D7F5206FCAC7464AA
MD5 SHA1 SHA512 TLSH

Submit Download

mspub.exe.manifest

Path C:\Users\Admin\AppData\Local\Temp\mspub.exe.manifest
Size 1KB
SHA256 339dcd06046e021e99e607c4c899be2a1a86a2c488ee9f79099ef5b9505c7405
MD5 260d620973559f71df879fc9ff8675e8
SHA1 3c4974e88de13718e084fa1a76752fb2d4e5a4ed
SHA512 87f5e52fe0520aeceac67feb16696419bac4858c8e11b0e514bf3bc6c330963e8ce70d0b7f7fcb98d075c4c363db6e481db3cc95e38ca0ca0dd5c04a6feb7bca
TLSH
T1EF21D2C1B12C61A5A34220A32936F244A57FAF7F1DED81BC8486967B76015C6E7C3192
MD5 SHA1 SHA512 TLSH

Submit Download

msvcp100.dll

Path C:\Users\Admin\AppData\Local\Temp\msvcp100.dll
Size 594KB
SHA256 c31219a2f67f5c5440349541d089f21f605d437869a1ccf8915ff2c395df1121
MD5 8ee6847bc4c8a36f3c3a6211904282c0
SHA1 982b0f88d2a1dc715f74d501d63a8c31bd77f770
SHA512 d4ffb214ee465834033ec6f7d9e027967542fe9e5837e70ecf105cdb6bcbac3eb46ad1ade8d18b455971b5cd438ec9b0866737b120f0527fde572d6605dfec51
SSDEEP 12288:toBFUsQ1H5FH3YUTd/dfBPA7X7NvEKZm+aWodEE+blHS:+FUsQ1H5FHdvg7NvEKZm+aWodEEwHS
TLSH
T147D41A23FB2906B0E162D37865C6C341D3F13C8A4B22A7C752EBD52D2F676D9563B221
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp_win.dll

Path C:\Users\Admin\AppData\Local\Temp\msvcp_win.dll
Size 621KB
SHA256 2a7825c2925347e0cb767a0dcb611f3eb80d0f71cbec981069b227bdc7cb871a
MD5 ec9f1cdd909f7c0bae4db21dcd2033de
SHA1 4c2a112e048fc75cd4c581836356e881552c9be2
SHA512 924022bb40c542a3ff0d09da35b8156113a83336d57924888d921f070f6192d83fcec6b89bde89957731e55e41118ca2affeb5885541bd345da7857996c22fd5
SSDEEP 12288:KXTCudddboDSf8I+YQtAww7ZQEKZm+jWodEEVM6LZWPn:KXTC/Sf8IdQKQEKZm+jWodEEq6LZWf
TLSH
T1F9D42A26BB4D06B0D166A3BCA1C38706D7F1BC154722A3C7429BE26D1F6B7C56B3B250
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcr100.dll

Path C:\Users\Admin\AppData\Local\Temp\msvcr100.dll
Size 811KB
SHA256 2b7ab898b2f64f4cd1ae651c93d7eb9556208fd8d8d40d425e856c83d86d2346
MD5 f86b5057928fddd315f9a9f46357003e
SHA1 63f5ed1d5ee84c5ca7c229f9f38a51c383d9ba39
SHA512 b4d02af16ff59f4a298c3912d62697154c451829e69a7507b9757d0cdff1717cabc198c7be76a7e62c3d894af2ae4c6d5c860fb3ce72674bb7e4b7129ec806bd
SSDEEP 12288:WOyBSO55w1FEQH/GPU1frjG1xxzGyujE+/+uJ7myyKkNM0oko3:jy955eFEQH/GPIPGrZru9myyKk60zM
TLSH
T132059E9436A907F6D177D53DC996C606E2B2741513359BEB01A04BAF2F23BE09A3F312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powerpnt.exe.manifest

Path C:\Users\Admin\AppData\Local\Temp\powerpnt.exe.manifest
Size 3KB
SHA256 3388af72c33ed3101f375495d3a4f108e33455976cc9f43f82f5ebf63a1d3d42
MD5 bf15694f448017f1026007fab9025975
SHA1 9716a384125470e9cc35d61d8b64edbe448bb21f
SHA512 9e93fa224711611fc125891c5364053143a77340308618ae80838ac143f76df88677e750b3f27d34a191e666548b68ae924540d225dc67552b7867bbcf55fcb6
TLSH
T10871E040C484A2C49DB544817BA4C61CD88B6ADEC48B4DBC30BEDBAFCF78441E9D72D9
MD5 SHA1 SHA512 TLSH

Submit Download

ucrtbase.dll

Path C:\Users\Admin\AppData\Local\Temp\ucrtbase.dll
Size 1021KB
SHA256 3c60056371f82e4744185b6f2fa0c69042b1e78804685944132974dd13f3b6d9
MD5 4e326feeb3ebf1e3eb21eeb224345727
SHA1 f156a272dbc6695cc170b6091ef8cd41db7ba040
SHA512 be9420a85c82eeee685e18913a7ff152fcead72a90ddcc2bcc8ab53a4a1743ae98f49354023c0a32b3a1d919bda64b5d455f6c3a49d4842bbba4aa37c1d05d67
SSDEEP 24576:L1foGwlaDT22+Pk+j2ZXCE6cctEMmxvSZX0ypCD3:JfoBR2+PfXWrT
TLSH
T1F725AF64FA5C0AA5D57BE17CC95B550ED5B2780207708ACF03EA4BBD2E2BBD91637320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Crisp.exe

Path C:\Users\Admin\AppData\Roaming\DOTNETServer_v7_ent\Crisp.exe
Size 334KB
SHA256 c2e62475768c9546efe1da92a55f3bb2a55350eed83241139917aabd1ad25f8a
MD5 5f9f88c9a16b62dc38504549e93d3667
SHA1 587d56031b39e34102bc67b5f7d0338ee41b5328
SHA512 edbb7a8cd75e056d2c47b8af6fbee63726cb3d5f000d5f8bc000f4b16366619c8532e628585cc943f474d2509c63802179d0d22a1d32dd690fb25e00d262af83
SSDEEP 6144:7c2XFRJ3DNuzAOS9FuxIRtiiuhKPTqX4Y42:dFvYzU9kutRuhKPTqo32
TLSH
T125749E11B9D1C4B2C4B2053009E8EBB5697DFD714F61863B33D8772E1F742C1A662AA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kernel-layer.xml

Path C:\Users\Admin\AppData\Roaming\com_pro_edge\OFECSSODJBHIEXNE\kernel-layer.xml
Size 2.2MB
SHA256 18b936a7be280c559cc151d30c7b763c82b766ec9bc1d007855576f5915bbba9
MD5 7cfca71aa034227d62b594e11538c268
SHA1 77d3231e514ed964c31bc9b3991859d4ccb70d01
SHA512 4392af6bb9658cb81e19a11707b571d18d3600e0894f7dcfefb82cefed6fa26263747e58d5b8928e1756514628ec17bd6b12ff6611682d6faf94258cee139ea2
SSDEEP 49152:Jv4yiz0DY+yY7wZgYINiHAYcOOfOvZ+Sk8LsmklVXtZB:JvJiIWXZgdiDcOOfslHoVdZB
TLSH
T156B533E781785BF0E25644724261F064CCA538A5FB5B7C5E428EC8FDEB3C4A67044DE9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CvflHu0c96mag4yAZfUd4Ui4.exe

Path C:\Users\Admin\Documents\Screenshot album\CvflHu0c96mag4yAZfUd4Ui4.exe
Size 8.6MB
SHA256 4a78e2adf2ab7c257c7c5a960a8edeb0d64fa6ac564f4c06060c92adfa12ae76
MD5 c0f28823639c299cb010a1a3a4bf953f
SHA1 4c91506f9625ce8e2ccdf1f859a0cb8975b6d12f
SHA512 4bab462f25246ce5a0edf8eb4682467bdf12f98a513c629c8c2f5418739e9aceed82fe60a26abc2f63706b2b7f7667252458959323854c1160c99033c711629d
SSDEEP 196608:+phwL57sPHkUyUWaBXOBxqfjjfMpXrOwSnIEYaGWt3O:+phI7sPHLyseWf/fMNEYgdO
TLSH
T1EC9633D377C096B5DEE2C17E5F09DB1593B3F385A25309C79A240C6A1EE7AAA01830DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FusionSha.exe

Path C:\Users\Admin\FusionSha.exe
Size 636KB
SHA256 7783faf41c933a01379be18ac070431c244a95a3bf361897ce471eb4040f63e6
MD5 331bc2bf689bedc4496b06b5d7d47bfa
SHA1 c51dd717b5330b8cd5ea6cc0da8aca60ce985bb9
SHA512 ecb21af850002e17393e9a0b46ac5eeb6e2d4403de406bb9fa243b6375f37a075ff47395211335ec1576ccaf41953972afdabf2803d3d4bca57b86c276a69bb0
SSDEEP 12288:WwvXiMGkWpV1j9hcYtHDlUJNlz9PFu9oT/+2I:WwvizD1fcaDqJP9k9j2I
TLSH
T103D47D0BA3A441F9D0BBE178D9075956F7B6B85603B09B9F23E042672F572A09F7E310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2828-263-0x00007FF99BBA0000-0x00007FF99BDA9000-memory.dmp

Download

memory/4044-0-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/4044-180-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/4068-258-0x0000000075310000-0x000000007535F000-memory.dmp

Download

memory/4068-221-0x00007FF99BBA0000-0x00007FF99BDA9000-memory.dmp

Download

memory/4144-616-0x0000000000B60000-0x0000000000F29000-memory.dmp

Download

memory/4144-176-0x00007FF99BBA0000-0x00007FF99BDA9000-memory.dmp

Download

memory/4144-312-0x0000000000B60000-0x0000000000F29000-memory.dmp

Download

memory/4144-205-0x0000000000B60000-0x0000000000F29000-memory.dmp

Download

memory/4144-532-0x0000000000B60000-0x0000000000F29000-memory.dmp

Download

memory/4144-191-0x0000000000B60000-0x0000000000F29000-memory.dmp

Download

memory/4144-262-0x0000000000B60000-0x0000000000F29000-memory.dmp

Download

memory/4144-389-0x0000000000B60000-0x0000000000F29000-memory.dmp

Download

memory/4144-171-0x0000000000B60000-0x0000000000F29000-memory.dmp

Download

memory/4144-618-0x0000000000B60000-0x0000000000F29000-memory.dmp

Download

memory/4772-494-0x00007FF693DF0000-0x00007FF693FD2000-memory.dmp

Download

memory/4772-287-0x00007FF693DF0000-0x00007FF693FD2000-memory.dmp

Download

memory/4772-669-0x00007FF693DF0000-0x00007FF693FD2000-memory.dmp

Download

memory/4772-368-0x00007FF693DF0000-0x00007FF693FD2000-memory.dmp

Download

memory/4772-201-0x00007FF693DF0000-0x00007FF693FD2000-memory.dmp

Download

memory/4772-578-0x00007FF693DF0000-0x00007FF693FD2000-memory.dmp

Download

memory/4772-619-0x00007FF693DF0000-0x00007FF693FD2000-memory.dmp

Download

memory/4772-261-0x00007FF693DF0000-0x00007FF693FD2000-memory.dmp

Download

memory/4772-617-0x00007FF693DF0000-0x00007FF693FD2000-memory.dmp

Download

memory/5052-666-0x00007FF98CE30000-0x00007FF98CE90000-memory.dmp

Download

memory/5052-664-0x00007FF98CE30000-0x00007FF98CE90000-memory.dmp

Download

memory/5124-167-0x000002C55F180000-0x000002C55F333000-memory.dmp

Download

memory/5124-109-0x00007FF98FAD0000-0x00007FF98FB30000-memory.dmp

Download

memory/5124-111-0x00007FF98FAD0000-0x00007FF98FB30000-memory.dmp

Download

memory/5124-163-0x00007FF98FAD0000-0x00007FF98FB30000-memory.dmp

Download

memory/5436-159-0x00007FF98FAD0000-0x00007FF98FB30000-memory.dmp

Download

memory/5436-161-0x00007FF98FAD0000-0x00007FF98FB30000-memory.dmp

Download

memory/5436-184-0x00007FF61CF00000-0x00007FF61D17A000-memory.dmp

Download

memory/5436-168-0x000001ED137E0000-0x000001ED13993000-memory.dmp

Download

memory/5436-169-0x00007FF98FAD0000-0x00007FF98FB30000-memory.dmp

Download

memory/5568-102-0x0000029441F90000-0x0000029442143000-memory.dmp

Download

memory/5568-67-0x00007FF98CDD0000-0x00007FF98CE30000-memory.dmp

Download

memory/5568-65-0x00007FF98FAE1000-0x00007FF98FAE2000-memory.dmp

Download