hxxps://xeno[.]getslax[.]com/

Analysis

user interaction
yes
max time kernel
354s
max time network
355s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/06/2026, 05:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://xeno.getslax.com/
Sample260620-gp398sdt5m

Score

7^/10

credential_access discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
808	Вооtstaрреr.exe
3780	Вооtstaрреr.exe

Loads dropped DLL 2 IoCs

pid	Process
808	Вооtstaрреr.exe
3780	Вооtstaрреr.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
808	Вооtstaрреr.exe
3780	Вооtstaрреr.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4396	msedge.exe
4196	chrome.exe

Checks SCSI registry key(s) 3 TTPs 10 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	taskmgr.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Вооtstaрреr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Вооtstaрреr.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134264087948211039"	msedge.exe

Modifies registry class 12 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1074038928-2032447174-945360078-1000\{69C4ABD0-9A61-4AF5-B587-BC9363E566DE}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings	taskmgr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5444	msedge.exe
5444	msedge.exe
808	Вооtstaрреr.exe
808	Вооtstaрреr.exe
808	Вооtstaрреr.exe
808	Вооtstaрреr.exe
808	Вооtstaрреr.exe
808	Вооtstaрреr.exe
808	Вооtstaрреr.exe
5376	chrome.exe
5376	chrome.exe
5500	taskmgr.exe
5500	taskmgr.exe
5500	taskmgr.exe
5500	taskmgr.exe
5500	taskmgr.exe
5500	taskmgr.exe
5500	taskmgr.exe
5500	taskmgr.exe
5500	taskmgr.exe
5500	taskmgr.exe
5500	taskmgr.exe
5500	taskmgr.exe
5500	taskmgr.exe
5500	taskmgr.exe
5500	taskmgr.exe
5500	taskmgr.exe
5500	taskmgr.exe
5500	taskmgr.exe
5500	taskmgr.exe
5500	taskmgr.exe
5500	taskmgr.exe
5500	taskmgr.exe
5500	taskmgr.exe
5500	taskmgr.exe
5500	taskmgr.exe
5500	taskmgr.exe
3780	Вооtstaрреr.exe
3780	Вооtstaрреr.exe
3780	Вооtstaрреr.exe
3780	Вооtstaрреr.exe
3780	Вооtstaрреr.exe
3780	Вооtstaрреr.exe
5604	taskmgr.exe
5604	taskmgr.exe
5604	taskmgr.exe
5604	taskmgr.exe
5604	taskmgr.exe
5604	taskmgr.exe
5604	taskmgr.exe
5376	chrome.exe
5376	chrome.exe
5604	taskmgr.exe
5604	taskmgr.exe
5604	taskmgr.exe
5604	taskmgr.exe
5604	taskmgr.exe
5604	taskmgr.exe
5604	taskmgr.exe
5604	taskmgr.exe
5604	taskmgr.exe
5604	taskmgr.exe
5604	taskmgr.exe
5604	taskmgr.exe

Suspicious behavior: LoadsDriver 3 IoCs

pid	Process
664	Process not Found
664	Process not Found
664	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
5376	chrome.exe
5376	chrome.exe
5376	chrome.exe
5376	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeRestorePrivilege	5640	7zG.exe
Token: 35	5640	7zG.exe
Token: SeSecurityPrivilege	5640	7zG.exe
Token: SeSecurityPrivilege	5640	7zG.exe
Token: SeDebugPrivilege	808	Вооtstaрреr.exe
Token: SeShutdownPrivilege	5376	chrome.exe
Token: SeCreatePagefilePrivilege	5376	chrome.exe
Token: SeShutdownPrivilege	5376	chrome.exe
Token: SeCreatePagefilePrivilege	5376	chrome.exe
Token: SeShutdownPrivilege	5376	chrome.exe
Token: SeCreatePagefilePrivilege	5376	chrome.exe
Token: SeShutdownPrivilege	5376	chrome.exe
Token: SeCreatePagefilePrivilege	5376	chrome.exe
Token: SeShutdownPrivilege	5376	chrome.exe
Token: SeCreatePagefilePrivilege	5376	chrome.exe
Token: SeShutdownPrivilege	5376	chrome.exe
Token: SeCreatePagefilePrivilege	5376	chrome.exe
Token: SeShutdownPrivilege	5376	chrome.exe
Token: SeCreatePagefilePrivilege	5376	chrome.exe
Token: SeShutdownPrivilege	5376	chrome.exe
Token: SeCreatePagefilePrivilege	5376	chrome.exe
Token: SeShutdownPrivilege	5376	chrome.exe
Token: SeCreatePagefilePrivilege	5376	chrome.exe
Token: SeShutdownPrivilege	5376	chrome.exe
Token: SeCreatePagefilePrivilege	5376	chrome.exe
Token: SeShutdownPrivilege	5376	chrome.exe
Token: SeCreatePagefilePrivilege	5376	chrome.exe
Token: SeShutdownPrivilege	5376	chrome.exe
Token: SeCreatePagefilePrivilege	5376	chrome.exe
Token: SeDebugPrivilege	5500	taskmgr.exe
Token: SeSystemProfilePrivilege	5500	taskmgr.exe
Token: SeCreateGlobalPrivilege	5500	taskmgr.exe
Token: SeShutdownPrivilege	5376	chrome.exe
Token: SeCreatePagefilePrivilege	5376	chrome.exe
Token: SeShutdownPrivilege	5376	chrome.exe
Token: SeCreatePagefilePrivilege	5376	chrome.exe
Token: SeShutdownPrivilege	5376	chrome.exe
Token: SeCreatePagefilePrivilege	5376	chrome.exe
Token: SeShutdownPrivilege	5376	chrome.exe
Token: SeCreatePagefilePrivilege	5376	chrome.exe
Token: SeShutdownPrivilege	5376	chrome.exe
Token: SeCreatePagefilePrivilege	5376	chrome.exe
Token: SeShutdownPrivilege	5376	chrome.exe
Token: SeCreatePagefilePrivilege	5376	chrome.exe
Token: SeShutdownPrivilege	5376	chrome.exe
Token: SeCreatePagefilePrivilege	5376	chrome.exe
Token: SeShutdownPrivilege	5376	chrome.exe
Token: SeCreatePagefilePrivilege	5376	chrome.exe
Token: SeShutdownPrivilege	5376	chrome.exe
Token: SeCreatePagefilePrivilege	5376	chrome.exe
Token: SeShutdownPrivilege	5376	chrome.exe
Token: SeCreatePagefilePrivilege	5376	chrome.exe
Token: SeShutdownPrivilege	5376	chrome.exe
Token: SeCreatePagefilePrivilege	5376	chrome.exe
Token: SeShutdownPrivilege	5376	chrome.exe
Token: SeCreatePagefilePrivilege	5376	chrome.exe
Token: SeShutdownPrivilege	5376	chrome.exe
Token: SeCreatePagefilePrivilege	5376	chrome.exe
Token: SeShutdownPrivilege	5376	chrome.exe
Token: SeCreatePagefilePrivilege	5376	chrome.exe
Token: SeShutdownPrivilege	5376	chrome.exe
Token: SeCreatePagefilePrivilege	5376	chrome.exe
Token: SeShutdownPrivilege	5376	chrome.exe
Token: SeCreatePagefilePrivilege	5376	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
5640	7zG.exe
5376	chrome.exe
5376	chrome.exe
5376	chrome.exe
5376	chrome.exe
5376	chrome.exe
5376	chrome.exe
5376	chrome.exe
5376	chrome.exe
5376	chrome.exe
5376	chrome.exe
5376	chrome.exe
5376	chrome.exe
5376	chrome.exe
5376	chrome.exe
5376	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
5376	chrome.exe
5376	chrome.exe
5376	chrome.exe
5376	chrome.exe
5376	chrome.exe
5376	chrome.exe
5376	chrome.exe
5376	chrome.exe
5376	chrome.exe
5376	chrome.exe
5376	chrome.exe
5376	chrome.exe
5376	chrome.exe
5376	chrome.exe
5376	chrome.exe
5376	chrome.exe
5376	chrome.exe
5376	chrome.exe
5376	chrome.exe
5376	chrome.exe
5376	chrome.exe
5376	chrome.exe
5376	chrome.exe
5376	chrome.exe
5376	chrome.exe
5376	chrome.exe
5376	chrome.exe
5376	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3512 wrote to memory of 4744	3512	msedge.exe	85
PID 3512 wrote to memory of 4396	3512	msedge.exe	86
PID 3512 wrote to memory of 4572	3512	msedge.exe	87
PID 3512 wrote to memory of 4572	3512	msedge.exe	87
PID 3512 wrote to memory of 4572	3512	msedge.exe	87
PID 3512 wrote to memory of 3220	3512	msedge.exe	88
PID 3512 wrote to memory of 3220	3512	msedge.exe	88
PID 3512 wrote to memory of 2164	3512	msedge.exe	89
PID 3512 wrote to memory of 2164	3512	msedge.exe	89
PID 3512 wrote to memory of 3860	3512	msedge.exe	90
PID 3512 wrote to memory of 2164	3512	msedge.exe	89
PID 3512 wrote to memory of 3860	3512	msedge.exe	90
PID 3512 wrote to memory of 3860	3512	msedge.exe	90
PID 3512 wrote to memory of 2600	3512	msedge.exe	92
PID 3512 wrote to memory of 2600	3512	msedge.exe	92
PID 3512 wrote to memory of 2600	3512	msedge.exe	92
PID 3512 wrote to memory of 956	3512	msedge.exe	93
PID 3512 wrote to memory of 956	3512	msedge.exe	93
PID 3512 wrote to memory of 956	3512	msedge.exe	93
PID 3512 wrote to memory of 1524	3512	msedge.exe	99
PID 3512 wrote to memory of 1524	3512	msedge.exe	99
PID 3512 wrote to memory of 1524	3512	msedge.exe	99
PID 3512 wrote to memory of 3780	3512	msedge.exe	100
PID 3512 wrote to memory of 3780	3512	msedge.exe	100
PID 3512 wrote to memory of 4496	3512	msedge.exe	101
PID 3512 wrote to memory of 4496	3512	msedge.exe	101
PID 3512 wrote to memory of 2308	3512	msedge.exe	102
PID 3512 wrote to memory of 2308	3512	msedge.exe	102
PID 3512 wrote to memory of 2308	3512	msedge.exe	102
PID 3512 wrote to memory of 3648	3512	msedge.exe	106
PID 3512 wrote to memory of 5532	3512	msedge.exe	116
PID 3512 wrote to memory of 5532	3512	msedge.exe	116
PID 3512 wrote to memory of 5532	3512	msedge.exe	116
PID 3512 wrote to memory of 5676	3512	msedge.exe	117
PID 3512 wrote to memory of 5676	3512	msedge.exe	117
PID 3512 wrote to memory of 5712	3512	msedge.exe	118
PID 3512 wrote to memory of 5720	3512	msedge.exe	119
PID 3512 wrote to memory of 5728	3512	msedge.exe	120
PID 3512 wrote to memory of 5172	3512	msedge.exe	124
PID 3512 wrote to memory of 5172	3512	msedge.exe	124
PID 3512 wrote to memory of 6028	3512	msedge.exe	128
PID 3512 wrote to memory of 6028	3512	msedge.exe	128
PID 3512 wrote to memory of 6028	3512	msedge.exe	128
PID 3512 wrote to memory of 5756	3512	msedge.exe	129
PID 3512 wrote to memory of 5756	3512	msedge.exe	129
PID 3512 wrote to memory of 5756	3512	msedge.exe	129
PID 3512 wrote to memory of 552	3512	msedge.exe	130
PID 3512 wrote to memory of 5444	3512	msedge.exe	131
PID 3512 wrote to memory of 6056	3512	msedge.exe	139
PID 3512 wrote to memory of 6056	3512	msedge.exe	139
PID 3512 wrote to memory of 3904	3512	msedge.exe	140
PID 3512 wrote to memory of 3904	3512	msedge.exe	140
PID 3512 wrote to memory of 5744	3512	msedge.exe	141
PID 3512 wrote to memory of 5744	3512	msedge.exe	141
PID 5376 wrote to memory of 4328	5376	chrome.exe	151
PID 5376 wrote to memory of 5372	5376	chrome.exe	152
PID 5376 wrote to memory of 4196	5376	chrome.exe	153
PID 5376 wrote to memory of 5372	5376	chrome.exe	152
PID 5376 wrote to memory of 5292	5376	chrome.exe	154
PID 5376 wrote to memory of 5292	5376	chrome.exe	154
PID 5376 wrote to memory of 5296	5376	chrome.exe	156
PID 5376 wrote to memory of 3768	5376	chrome.exe	157
PID 5376 wrote to memory of 5296	5376	chrome.exe	156
PID 5376 wrote to memory of 3768	5376	chrome.exe	157

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://xeno.getslax.com/
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x24c,0x7ffef470c188,0x7ffef470c194,0x7ffef470c1a0
  2⤵
  PID:4744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1776,i,7810409220712584995,175711896643858347,524288 --field-trial-handle=2248,i,7713560370659923810,7572684553753034280,262144 --variations-seed-version --mojo-platform-channel-handle=2276 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1648,i,2627474667244364858,8696340972730885418,262144 --field-trial-handle=2248,i,7713560370659923810,7572684553753034280,262144 --variations-seed-version --mojo-platform-channel-handle=2244 /prefetch:2
  2⤵
  PID:4572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2612,i,6023380628089961592,8982357760576384804,524288 --field-trial-handle=2248,i,7713560370659923810,7572684553753034280,262144 --variations-seed-version --mojo-platform-channel-handle=2684 /prefetch:8
  2⤵
  PID:3220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3456,i,663794610170490902,7185135557766919491,2097152 --field-trial-handle=2248,i,7713560370659923810,7572684553753034280,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:2164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3460,i,5371527965386726631,14764327643084998068,2097152 --field-trial-handle=2248,i,7713560370659923810,7572684553753034280,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:3860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4224,i,17360796745802403674,4383986506282150184,2097152 --field-trial-handle=2248,i,7713560370659923810,7572684553753034280,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:1
  2⤵
  PID:2600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4248,i,16063364226740960018,1233158634600971298,2097152 --field-trial-handle=2248,i,7713560370659923810,7572684553753034280,262144 --variations-seed-version --mojo-platform-channel-handle=2624 /prefetch:2
  2⤵
  PID:956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4988,i,5322744581946989761,8213577077902526452,2097152 --field-trial-handle=2248,i,7713560370659923810,7572684553753034280,262144 --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:1
  2⤵
  PID:1524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5268,i,11037617683112552534,3709437902162239327,524288 --field-trial-handle=2248,i,7713560370659923810,7572684553753034280,262144 --variations-seed-version --mojo-platform-channel-handle=5292 /prefetch:8
  2⤵
  PID:3780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5236,i,18048084265667804884,1976522066631139821,524288 --field-trial-handle=2248,i,7713560370659923810,7572684553753034280,262144 --variations-seed-version --mojo-platform-channel-handle=5340 /prefetch:8
  2⤵
  PID:4496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=4984,i,16628041331277336401,15711610229264414632,2097152 --field-trial-handle=2248,i,7713560370659923810,7572684553753034280,262144 --variations-seed-version --mojo-platform-channel-handle=4932 /prefetch:1
  2⤵
  PID:2308
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6364,i,5441551074745447696,11613841648430719489,524288 --field-trial-handle=2248,i,7713560370659923810,7572684553753034280,262144 --variations-seed-version --mojo-platform-channel-handle=6360 /prefetch:8
  2⤵
  PID:4068
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6364,i,5441551074745447696,11613841648430719489,524288 --field-trial-handle=2248,i,7713560370659923810,7572684553753034280,262144 --variations-seed-version --mojo-platform-channel-handle=6360 /prefetch:8
  2⤵
  PID:3648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6540,i,2641595016450524048,14883646472822924822,2097152 --field-trial-handle=2248,i,7713560370659923810,7572684553753034280,262144 --variations-seed-version --mojo-platform-channel-handle=4380 /prefetch:1
  2⤵
  PID:5532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4256,i,18381384692239852783,2041752467956140193,524288 --field-trial-handle=2248,i,7713560370659923810,7572684553753034280,262144 --variations-seed-version --mojo-platform-channel-handle=6356 /prefetch:8
  2⤵
  PID:5676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6560,i,2321295179688990019,13597064946586680232,524288 --field-trial-handle=2248,i,7713560370659923810,7572684553753034280,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:8
  2⤵
  PID:5712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6572,i,13217010120266505638,2174519107100249792,524288 --field-trial-handle=2248,i,7713560370659923810,7572684553753034280,262144 --variations-seed-version --mojo-platform-channel-handle=6608 /prefetch:8
  2⤵
  PID:5720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6552,i,12676000325691955838,3398151766744990278,524288 --field-trial-handle=2248,i,7713560370659923810,7572684553753034280,262144 --variations-seed-version --mojo-platform-channel-handle=6952 /prefetch:8
  2⤵
  PID:5728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5452,i,11540913053314708452,17569526593041693581,524288 --field-trial-handle=2248,i,7713560370659923810,7572684553753034280,262144 --variations-seed-version --mojo-platform-channel-handle=5368 /prefetch:8
  2⤵
  PID:5172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6332,i,10075060114527712570,13837205759172214410,2097152 --field-trial-handle=2248,i,7713560370659923810,7572684553753034280,262144 --variations-seed-version --mojo-platform-channel-handle=5504 /prefetch:1
  2⤵
  PID:6028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6692,i,11196982305295257835,17828035936225115168,2097152 --field-trial-handle=2248,i,7713560370659923810,7572684553753034280,262144 --variations-seed-version --mojo-platform-channel-handle=6776 /prefetch:1
  2⤵
  PID:5756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7096,i,1793491987739401993,2566466702032576928,524288 --field-trial-handle=2248,i,7713560370659923810,7572684553753034280,262144 --variations-seed-version --mojo-platform-channel-handle=4528 /prefetch:8
  2⤵
  PID:552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4248,i,10051701890575283857,16876486255916785423,262144 --field-trial-handle=2248,i,7713560370659923810,7572684553753034280,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=756,i,5788637029578340231,13638321480341289725,524288 --field-trial-handle=2248,i,7713560370659923810,7572684553753034280,262144 --variations-seed-version --mojo-platform-channel-handle=5484 /prefetch:8
  2⤵
  PID:6056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6700,i,6999617734200790188,16472125093283305226,524288 --field-trial-handle=2248,i,7713560370659923810,7572684553753034280,262144 --variations-seed-version --mojo-platform-channel-handle=4500 /prefetch:8
  2⤵
  PID:3904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7136,i,7426452327216133399,15941815532677147131,524288 --field-trial-handle=2248,i,7713560370659923810,7572684553753034280,262144 --variations-seed-version --mojo-platform-channel-handle=5612 /prefetch:8
  2⤵
  PID:5744

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3952

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1872

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Boostrapper_v2.3.1\" -ad -an -ai#7zMap30146:98:7zEvent10996
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5640

C:\Users\Admin\Downloads\Boostrapper_v2.3.1\Bootstrapper_v2.1.7\Вооtstaрреr.exe
"C:\Users\Admin\Downloads\Boostrapper_v2.3.1\Bootstrapper_v2.1.7\Вооtstaрреr.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:808

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffef4aac728,0x7ffef4aac734,0x7ffef4aac740
  2⤵
  PID:4328
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1696,i,7291624865062529879,7244532550809397149,262144 --field-trial-handle=2052,i,16779690086348561545,6606673255554167395,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2012 /prefetch:2
  2⤵
  PID:5372
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1592,i,13143553943115671165,15778081959960475087,524288 --field-trial-handle=2052,i,16779690086348561545,6606673255554167395,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2192 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4196
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2400,i,6360120076926594237,1619988015267215455,524288 --field-trial-handle=2052,i,16779690086348561545,6606673255554167395,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2580 /prefetch:8
  2⤵
  PID:5292
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3224,i,14276455536936668109,2834481007191581908,2097152 --field-trial-handle=2052,i,16779690086348561545,6606673255554167395,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:5296
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3220,i,16036580143806733403,295632036529060542,2097152 --field-trial-handle=2052,i,16779690086348561545,6606673255554167395,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:3768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3204,i,1193693448040850241,11049396485078519480,2097152 --field-trial-handle=2052,i,16779690086348561545,6606673255554167395,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4476 /prefetch:2
  2⤵
  PID:3948
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4676,i,5593457980779717882,14728602296168748045,2097152 --field-trial-handle=2052,i,16779690086348561545,6606673255554167395,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4656 /prefetch:1
  2⤵
  PID:1928
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4900,i,181239747219644677,5792602425730311351,524288 --field-trial-handle=2052,i,16779690086348561545,6606673255554167395,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4904 /prefetch:8
  2⤵
  PID:5340
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5056,i,6220077693138640913,2397459054452861340,524288 --field-trial-handle=2052,i,16779690086348561545,6606673255554167395,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5068 /prefetch:8
  2⤵
  PID:3364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5508,i,13395502581620045130,2945616190916652659,524288 --field-trial-handle=2052,i,16779690086348561545,6606673255554167395,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5548 /prefetch:8
  2⤵
  PID:3680
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5868,i,5892797516320580932,7825636350950068173,524288 --field-trial-handle=2052,i,16779690086348561545,6606673255554167395,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5564 /prefetch:8
  2⤵
  PID:1396
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5548,i,14371951096446516815,16820375067129900071,524288 --field-trial-handle=2052,i,16779690086348561545,6606673255554167395,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5932 /prefetch:8
  2⤵
  PID:3416
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5572,i,5330955831727916916,13764195760889129542,524288 --field-trial-handle=2052,i,16779690086348561545,6606673255554167395,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6044 /prefetch:8
  2⤵
  PID:2592

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5136

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3592

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:5584

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5500

C:\Users\Admin\Downloads\Boostrapper_v2.3.1\Bootstrapper_v2.1.7\Вооtstaрреr.exe
"C:\Users\Admin\Downloads\Boostrapper_v2.3.1\Bootstrapper_v2.1.7\Вооtstaрреr.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:3780

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
PID:5604

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx

Path C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx
Size 64KB
SHA256 b09f68b61d9ff5a7c7c8b10eee9447d4813ee0e866346e629e788cd4adecb66a
MD5 d2fb266b97caff2086bf0fa74eddb6b2
SHA1 2f0061ce9c51b5b4fbab76b37fc6a540be7f805d
SHA512 c3ba95a538c1d266beb83334af755c34ce642a4178ab0f2e5f7822fd6821d3b68862a8b58f167a9294e6d913b08c1054a69b5d7aec2efdb3cf9796ed84de21a8
SSDEEP 3:mnlllGlll/l/lXp9ZjrPBY06llSl/gX/ZP:mll0dPBY0O0uXJ
TLSH
T1D053019562930667C852033848CB0BA63A7A9619979345A282A49270D8A9B6584A2299
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock

Path C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock
Size 4B
SHA256 7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba
MD5 f49655f856acb8884cc0ace29216f511
SHA1 cb0f1f87ec0455ec349aaa950c600475ac7b7b6b
SHA512 599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8
MD5 SHA1 SHA512

Submit Download

F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val

Path C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val
Size 944B
SHA256 878947d0ec814fe7c343cdebc05eebf00eb14f3023bdb3809a559e17f399fe5d
MD5 6bd369f7c74a28194c991ed1404da30f
SHA1 0f8e3f8ab822c9374409fe399b6bfe5d68cbd643
SHA512 8fc5f073dc9fa1e1ae47c60a5f06e0a48709fd6a4302dffaa721858409e7bde64bc6856d3fb28891090516d1a7afc542579de287778b5755eafe75cc67d45d93
TLSH
T18811924A3AC71DB8F37A6D71006991242202B2275CC2D61C4AC4C6A98B35618E476FA8
MD5 SHA1 SHA512 TLSH

Submit Download

47e54e84-3862-41ae-b15e-f71f43ec2b5b.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\47e54e84-3862-41ae-b15e-f71f43ec2b5b.tmp
Size 17KB
SHA256 9a63a02af86b793bc7723ea8579017000fbde21723150ca89cdaa0102d54150d
MD5 3db4d2ed90c53237037f403d9b6c10cf
SHA1 91febd0c861f52fac9b9c081f7e738838423da4a
SHA512 20a5acab3273b075187518ff1d84bdfb24fb19e0881b09c9805647d3b805dc5e2037a9ee22124705cac465e1ac8b91972117ed00cd2d49a563818ec658fd5de0
SSDEEP 384:W4jyR7KxkXqKf/pUZNCgVLH2Hfgsl/97pLuLcSjIpXODyJ+ErU3MrHGRxVJZU:WMyR7KxkXqKf/pUZNCgVLH2HfgsR97p9
TLSH
T183720A676C488E7B0F98CACCD8267B4FADF5024B65E9886453FA582903D5BCF11091FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 dda9598a68043001bbe5cdc7f9e020d260ea504b2dcdd040d4ae07f7b6785757
MD5 020707fb997f3ed6d5f69fc3d4a0b7ef
SHA1 dc62da9249767209e30ec9b59038c05e6ceec8ac
SHA512 76b1f438442765f5f6dc6aca3b75ffbe1db97b5f38aab73ddfe31f420830ef7091d53425c75758913559781d5df4fdd787ec88f18a089f4fd0a0f58a0af5bc59
TLSH
T14EE02BA6C862EC7798FD1B18A0105786D764135B2A408A5B7A3C821C8FB1A364586C1D
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 a0d13f7353dad11b0dc82ef796ee59854e35a0c083a1139bed8d69c88e23ba6e
MD5 2fd77d0e3d3d23b2820f31a5989cde8b
SHA1 432040d38bcb7633ad2d1a79ffca6e6b0884b387
SHA512 a5aa8687469031452ffad84b8518fa61612a06cc7a0ce7968190ba5ef8b81e3742a9354013f82b7c44828c1371f7e0e6dc0b2c2fd9f1da49807f830a4660a2d9
TLSH
T1C75168B793E4CA7DC51156E4AB217E1FDE2A0A14532C3C6689D8AE4B53F2872D30138E
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 bd85b565ed817e86b0f580341775e7a287b538e415cd9b475e0b780d169e1da5
MD5 30a59364bb2357efd2f9f5c41f33df7f
SHA1 4674955bc0608d8e5e47c275cd357c4ea16fea89
SHA512 110f56811aeedacfa1b31846eaee1bee23ab1667b4c1f72a9c761819aceb865de10d9cf962fa087e21ba2f315c154d86ec2eb4134a54ef2b12f88f3ce5524e17
SSDEEP 192:qR67P//02Hnv70pAPRp2dj9+Hsb+WNnCp0rY2KSdvlpVyIsnAUgtaJ:qR67PvgUX68wY0M2KSd98
TLSH
T1AE42A62EAA50697BACDFC229F9117B53D7F6203135952E44DAFC8A1C19E75CC322701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 b28bffce9594f5494674a68888412e90ff2845636702698425b98f5da94a0b03
MD5 8878fe65de227bf7048e1ed45c21b64b
SHA1 ef45dcec65a091cb6fcf181013ce6cd2f6679299
SHA512 d041cc559c54e93eb92baf20fe75905791128ea8149ee04534389584caecfd195d2be20a74c1e491a3e85c4a09fc0878115032600930c522b0412175e859ba4b
TLSH
T13BB0129180819105C00202F8154314E8B134FF20D60B1701C3E46D228826154C018464
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5ce99c.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5ce99c.TMP
Size 96B
SHA256 24628e4b680f5d6060d28891d9ec460e00c4389941df6dedb920fe67d10c681a
MD5 2db64d4126f80f78d4afe4d2c2097ef2
SHA1 0ad7670b2411ba2c4c0414eb9f497b6ce0a4367d
SHA512 7485e1977a18ea162a511aa5bb0c29f9b0a051bba3acb0879eb8422dfc257d283cbaebe048b4a8e4573fd0b13122780ed6df66354b7d52af1ee0ea63b4c5b2dd
TLSH
T1ABB0220CE8232302C00323B028C280C83020EF20C203032283E00F2BEC28A3002300E0
MD5 SHA1 SHA512 TLSH

Submit Download

b92cdb35-15f7-4def-9d5a-f00af08e225c.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\b92cdb35-15f7-4def-9d5a-f00af08e225c.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 235KB
SHA256 e7f96d4b4bd1a2f7b99766aab4f82f36cd092ebee4ed2cea59af590004b934d7
MD5 763511cfb7d6c64b0292bbfe964aac8d
SHA1 12f1bc7ab6cffc450025c6f3e05304f6f27000d4
SHA512 52ec6f1713383142333f96a84ee8406ba62c0e2ca1325a83e9d18f89e38d6ffab87227f67c3e3076c38a8192b0f670a3890f511c6bab2072fce05c58aa011752
SSDEEP 3072:LUpsuEzqa2qOZheOiIP8BMXJkSqAvdX6vAn+yOfBtqfd7NtZL8cHQRZEQ6Sps5:gpsLiqC6IPHXi0X6vK+1vqZ/ZLW3Ex5
TLSH
T147341273FB964F7719C0CB2071670F5F99F944969074D206EAFA3BA36143892804BCAD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 34cc661128a73ce0600801caeb84efd24b3da59632d483a49858418db0892116
MD5 058c9c475b2e80df1095ad99dc7a2670
SHA1 1039c6adab991e98f5840df9752c22bc9b91963e
SHA512 e410c0fd693e811354667216b0846749bbf9c0d81978644fea7db63d35b95fb1c5890f2c20c727e6e4205c644c4591961e237611ffa2425b6c8c4934269bb540
SSDEEP 3072:EMpsuEzqa2qOZheOiIP8BMXJkSqAvdX6vAn+yOfBtqfd7NtZL8cHQRZEQ6Sps5:EMpsLiqC6IPHXi0X6vK+1vqZ/ZLW3Ex5
TLSH
T168341273BA964FB31AD1DB2071671F0E8DF948979070D20AE9FA3B936143952904BCAC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 48bb663808ea770da820c14aa68c7a2e7b71168cbe95cf2fd047040a9c250031
MD5 16eb4df3a6b26d885c4eaab19e0e6efd
SHA1 003feb34ef3bb06ac69e48baed2f06429e0636ff
SHA512 034e572f3e6d74189705d21207c288a8ae292d66179086b093f1c3d8cfc7fde053c83e21143e8f2670599b589b7d5fc3b6acde22a4df981def66c1fe65810e11
SSDEEP 1536:b4LyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbjY:kqfd7NtZL8cHQRZEQ6Sps3
TLSH
T19EC30237EBC21F339D92CF64B9130FD667B644A99030D301AAAD37EB7C93591684249C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 235KB
SHA256 8847c8616411a7ff9f226820cfbc0b1169dd600166dca5e234996e8b96377c5d
MD5 96c217942f32e8b72027da03f194184b
SHA1 e05b157f3ae127d54760340dfa0725726469e57d
SHA512 fe5cc15bf865f242e4883654bd97d2f12ea756de879bb35ef397570d48488936bde1d090df571da2cb914eb77e120cceeb3457e9caf526caf784932764644ede
SSDEEP 3072:EUpsuEzqa2qOZheOiIP8BMXJkSqAvdX6vAn+yOfBtqfd7NtZL8cHQRZEQ6Sps5:VpsLiqC6IPHXi0X6vK+1vqZ/ZLW3Ex5
TLSH
T1B8341277FB964F7719C0CB2071670F5F99F944969070D206EAFA3BA36143892804BCAD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8c5b1a407270ca9ae8bec8f20cc56244f3bde6f042890a4cabcdf4df3d21fdad
MD5 16f782e6f4d4592598936b2f29b6b339
SHA1 5c8c22b7f56af2b2e0d9978418f077cc8fd13c41
SHA512 28b2f7186b910539fa22408b47131fb16874b4c2192a721a69393efd7812da561ea9977b8af678cd3a9e37c23f186f876d7086a20afe28b16659db70955cf16f
TLSH
T15DD09232B7C9E241E14232BAA81447826E2A4A68259AC2176478844CEC6984AA79D28B
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 956293f8e8c5eb8ba6f0e77febf8581463d2cd14ba83174bdc280b1a511f8fa4
MD5 3f7070b09883623beff762ae73426f9c
SHA1 998c831c5f5e14438de14cfb339ec104df3ea46f
SHA512 391d9a94b04356868fbd7aba0f444744e6c41fdcffb7a70ee6094995c2623c354c38706c513b7a16d82ca9fcadddc7312d332861a6603db394339bfdf3c0adf7
TLSH
T18BD023333E45F9C0D035307A942003407E1D031713D1C10B3854440CCC7948067C5EC3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b28cb7be2bb68a6cda7ff7689f0ec4acdf8699e4818545d4dd692148ce1d64d2
MD5 a712889d00fb4f0945d13b925681156a
SHA1 1448cbfbc2c620e016aa5e6fccd0ac75e74ef2d1
SHA512 65f51cf451d5f77c9e695462e66abc873922db3c3999c172526727c2356a5a29052ce4b77ead44b02780ca80f6b290696b7633f537570254f36e7374ce0d04a5
TLSH
T12ED09B3277C5D541D5423276A41447816E164568159AC2175474444CDC69445579D147
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 76726666a4402cd71c2290f1dcf9570f06c7c0feacd8a44ae762e9eaecc5f548
MD5 1e0b6d911f86bc5a21aeafbed1eaaabc
SHA1 64bf3d02422217f383d5b3c03430653109949c2b
SHA512 a2fe088159c782e9324ed534f290e7ad33ef7da757dfbc9415012bd158d0f7cb473055db70350f2721c06e03ab55db99f5c1e8c90fb2a2c41ff1b5afa4f10480
TLSH
T10C71D549234248B5EFE6013CCDE206C17A71B199895B0E6615B09B7E37CC72F4D2448C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe591709.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe591709.TMP
Size 3KB
SHA256 2e7d33dca08e0ca7be13566a5c4ab238265857db7dcf6fb9f934609b2a01f154
MD5 f3d706b03c0e34019085dbd3d5051388
SHA1 b373310d58e5d09c4bd10a461c88680f2ae436f7
SHA512 cbb9601f8042bf4230e6fcf84ef6b9806f7a9f1ce2f2e17b6cc86ffef56a0b72d5064b83f3da72bc3088f937755dc7ad71e87992abcb1cc78c84604bc239cf50
TLSH
T11671F755334248B6EFD6013DCDE206C57AB1B199495B0E6A15B05F7E37CC72F0C2048C
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 204KB
SHA256 35076a2f74793123d60949d72bf3a868427db1346ed030798124f68f7459140d
MD5 e6e4f77d8a32c347bf4775527be7b1f0
SHA1 38650e5cff699a565101135cf3575370da2a8c2d
SHA512 084b9cef7192c8c714748d44387b7e723c1424dccc7f1edc749d0939e74a499d6ac81bedc1aefc71f953a43c3495d95a8dbdb839edeee626224e291ef0ba979c
SSDEEP 192:Stm5sGWuf+G83uy3Ct7XBBKoTCH7DXspU3iD:StMsk/83uICtTBB127DXspU3iD
TLSH
T10914755F5F242712CDBD917669EB44A35C7DF03F8B1366CA6C6114B0CEE2652A02C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log
Size 428B
SHA256 f59873ed52bd7ba425e18a5e2ab8d49d441d25ff638a3d465b8cbbc12ff8cce5
MD5 ac464c997294409e45467b4019105ffa
SHA1 b24ef2ffbc751a3ae12b98ce30376520338c2923
SHA512 6c14abfc035b058015ce5298d8b542f15a53c3338f03441987af64938ffabc2bb3eee76c8b728175d11a3d98c8b3b1ec074838bf0fc518d93960fb24c3f9a24e
TLSH
T186E0ECD759EA9604F63046F06559326DEE51812D4ED4A2D1CF13B61E19A04719004A48
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Size 20KB
SHA256 d3e560a679047e99f4f204bb4f2c92468d480b687658ae4d5b81bfc6626405a5
MD5 5dda629bf88ef615e6716218b9b7082f
SHA1 07c1b235a458c3afaeb9dcc11496780c52d047c2
SHA512 1271fc471f76bd4c326c8ff3116608247459c52e7f74d71ed79f85795b5526a60bcea6d8bc9b0e219d550185813189cc8ec1069c80accf073e4e36019f98d252
SSDEEP 48:TtLopFMatSaw/auUOt8BMbcBWJt+ACRSqp2DTZ+o5wf5mwmAsBWcwH:9eMatUaAKMAi+hRV0Hn8mpA8hA
TLSH
T1FF92834F1F242251D0F09F7ADCD289672E7C241DE76366CD9E6460F2CCA25AFB1060A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 de763a5aaf330ccfdf15bb887732e872689c78343fd16f4199a3ecb7b96afb03
MD5 4f1ab2b47184f2779f2a639cd8270455
SHA1 ba4e141b5b1bf92c6b949e5794814999b410691f
SHA512 c486cc60344160f5d7fc25708eeb0931046e35492dba12999f413fa1f7d4d8310e2ca6412c047d781ba1bb07f73922a42a172acd22b8f32edb17fe5cf2099e87
SSDEEP 96:Du+QxNOuWurnu8saoF1/Foz/uwuuu7uDulw7Ru45uj6hx:D6ij6LsaoF1/Fozv3w2sw7Ru45uj6hx
TLSH
T12AA1C0E7C3E4C66DE80116F06A147E1BCD2D096943293D2B8CE5EF8BD3D1871D11164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 586e49150a1a1bddc4a4488d50a321ff0ef1998455ebbf347bc2156793eb5e2b
MD5 92c569befa3cefff32be4cd4335362a1
SHA1 ac06f046e0043a956b42e38e6671f202c6b54c58
SHA512 a2e52afe93057ff3a99ded5c8401e969925a6b63cfa9a225d2ae2346bb08117fe59ef8a48bd977135704db21b423859504c88587bd35e84b601d5a755a4c2cd9
TLSH
T13D81DFB7C7E4C66DD81116F56A147E1BCE2D092943283D2A8CE9FF8BE3E1471D26064E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 1acea638377856ae45318d4b790cd3a207f9e803834c26a98e8cff13d6b0e630
MD5 a7dc86e375909efadf1519d25ef309b4
SHA1 3e48485d1a8ddd4def1ed4f004d55870416e68a7
SHA512 522bb7cdf04facac117fe22b89a75a7c5423dd34d0d25504f73bde5649fa5e253d1adf9ec4386c4c0733addccfdcf315f0c0e68d171b0a73c075c293ea4bbc35
SSDEEP 96:Du+QxNOuWurnu8saoF1/Foz/uwuuutj6DuDulw7Ru45Cx:D6ij6LsaoF1/Fozv3Sj6D2sw7Ru45Cx
TLSH
T1FDA1C0E7C3E4C66DE80116F06A147E1BCD2D096943293D2B8CE5EF8BD3D1871D11164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 74d7714c3f757768d15a363737ac0ef212db58255351baef51c80be0abdbfc6a
MD5 a29e1a41da96c637fdbba8cb720c4ea8
SHA1 2a9316552c5fbc8247104ae4c39fb30bcc7bb9f6
SHA512 3b4dbadf4b8d409d5a4235b34da3e50d2b8847883e0030fd5b16fd6abe635df58e3ea9214e3378256060649db60f4e57529c910b6e9fa80712d5a0655336c012
SSDEEP 192:sxZTRFyM/jK1Ml8UQM9d/fcsKzdVIdpr1uHW6+WNWTg3crXfXY4186mrIg5wJ:sxZTjqKd/fcsKzgIHbtsXYW
TLSH
T1E952DA127A345ABBCCDBD209FA55BF53D6F51472A2901E44AAFCCA0C05E6BDD220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 cd80420a9767511fe8381a46335957c4232f186f4e9acbdf3c8722826a0b9f78
MD5 84a5a2a318c1d6422840b1bfe765aae4
SHA1 5254de774b3c6f319b7ce04c63105508cb0b605f
SHA512 ac4f7bbbf80cbe491281177d3e5a43e857c1f54949eb9c44e38e968534c3fcf62df40b5dd55e289163a1dbcf75450bcbf35b45e3438d586b1c09b0b7cfe622f4
SSDEEP 192:sxZTRFyM/jK1Ml8M9d/fcsKzdVIdpt1uHW6+WNWTonmXfXY488lmrIg5aJ:sxZTj1d/fcsKzgqHbpKXec
TLSH
T10A52B7127A345ABBCCDFD209FA55BB53D5F51472A2900E44AAFC9A1C05E6BED220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 25fb1d7a4374aa7651818ba5e1caf331397f5db94d4d4c99610809ce1d6b24f4
MD5 77fadcdc0f42a61eef478c8e9a1f3d52
SHA1 521a52ec59a29155c5c81c87d6fbd050db2760b9
SHA512 48902580f47b253e40f771b822aaa3484233773c896ab1c16c813569e68415641e1ab4ee4690118d33eb8ef7e1708098b5ede4ad16388db3f0dd3ee6f008cab3
SSDEEP 192:sxZTRFyM/jK1Ml8UQNjd/fcsuWpVOzmIdpr1uHW6+WNoIT+qGXfXYQDl8oJpIgbU:sxZTjqJd/fcsuWvOzHIHbzqXdrI
TLSH
T17762B7126A345ABBCCDBD20DFA557F53D6F51472A6901E44AAFCCE0C05E6AED220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 441882cad00c02e16beb314c330a3ded35ba75d29ddc004ee829b67940e4e165
MD5 252cb3ba31fe3740ad33fe075682fce9
SHA1 47d21b6a82c1ff31c6b677e3c2623b35815cc910
SHA512 e4d0adfdd23c11f2ab17e33327799763f6ab179b9238b442feeb2f4b43e1ad466073cdbf45bee6ae0e4b384e09a734b6308ec1dd242c986314b395e43def0adc
SSDEEP 192:sxZTRFyM/jK1Ml8Mkd/fcsDS+IdpuuHW6+WNHnmT/Y4RA1mrIgrJ:sxZTjMd/fcsDSvxHbA/59
TLSH
T19042F9127A345ABBCCDBD209FA55BF53D6F51473A2900E44A9FCDA1C05E6AEC220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 29830c07944bd307d73259a25cfecf465b59438715190771bf8fbad7aca96462
MD5 d83d15026c326e6b782ab529352ae624
SHA1 8a779417b3033074cb4ca442e964afc8bed71fc8
SHA512 3dcc43d0fd305391ef4b5af7f7fbc2d844daaead9fbdeb9e00a1546596b572b305443fd6ca3c9968838e59e738d9b98dca15818730a5ab72b07523203c6a7b34
SSDEEP 192:sxZTRFyM/jK1Ml8UQMjd/fcsKzdVIdpr1uHW6+WNWT+qGXfXY4Bl8omrIg5wJ:sxZTjqEd/fcsKzgIHbWqXP2W
TLSH
T1EE62C9126A345A7BCCDBD209FA55BB53D6F51473A2901E44AAFCCA0C05E6AED220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 68586e4314a7b1c5b1885d3964f7e46b9581a530a3b7545e7b1cc68d930f827a
MD5 f5686f190beaf5ab44d0c186941461c4
SHA1 a43e4940eafc73fce23680069f3a84b47e060518
SHA512 29f69c663e198798c116d90f8bd6b574c98ae93ac37193a5ac7490ed4bf00fb9bde5251b2ecde4758f29404da29a868020774cde89a04bacad09e71479bf7368
SSDEEP 768:5R8iJPNWvx78r8F1+UoAYDCx9Tuqh0VfUC9xbog/OVsALl6opdirobkaUn/:5R8iJPNWvx78ru1jahALocd5JU/
TLSH
T11AE2FA3B680CCB7E4F844E9CEC266F966DD801CB6B948D5447FA884C03C76EA51279DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 224KB
SHA256 d9cff5f9da7b8e280aa58e50495303d3cd2e3281feed5a921502c0ac0913ddf3
MD5 878a4034fba07ff99692e8d7ed349eb9
SHA1 4f3eac171cbb37bb8913c4d0616a5ea3c551bc03
SHA512 bea2951bcd4a8a39c76958a008325192dad6f88c9b2c4e88fbc7fb1b177b1ad1eee06168626f283c4e9eaf041a62a0522b47e5a94a960d89186f4fe4000773db
SSDEEP 192:P+xWVZsPfT8w0QQnG2IMW1hPJubRd6vPtcdCewdbsc7V1VJ:mxgcfQ9QQn7IMW1hPJuVd6vPkxW
TLSH
T18024840A7B747001EDE6D9725CB080771E3CB16ECF22A6915DB254698DB2853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5955a8.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5955a8.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1
Size 264KB
SHA256 fe77e1dd3b6649d3f004fd94d95f37d6d2802a304c8abd9006d22df1e6107396
MD5 d9017df8ba00f264839a4612d082fd1b
SHA1 900713ee1074b38aa362678d60e12f54140c0473
SHA512 176f0e98f4308e3cde3b8e29f9a1ccfc93ce1d25441bc7ce7c260eda066a381d353cee60d0856a96f81c217d4a9f6a6cae0a001a7bf404df140fddd2dbdcfed1
SSDEEP 3:MsEllllkEthXllkl2zECllNNY:/M/xT02zhpY
TLSH
T1C044040C7FC00705C51010344015D3D03370DF157D11D7433C5514135CDDD400D01014
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 6d1d3679dbd6eb5192d64078a421ac67e60a18a4149e427e16adeeb08e16f669
MD5 8ec643f6a248481cfed46fb1bf229da5
SHA1 318832804b0f238fc16a6c5bc242c4335e3c4a00
SHA512 cb8d9d4e3668e942859282db9daba8b4e986b9d154cc8ce97c60170c23ea4803ae3731492db45bc37d3e2ef10990d33783b043ade4ce3c5e342fbd8cda4b499a
SSDEEP 384:PiF1tNn/s3n9SKzsNu8TUNTUlIlo24GpdLLUK4kM8YyEXWQZITGT0IvPx9z:aF1j+9lXwg67GHEKtMhZi+0mvz
TLSH
T1EDC229F208D7983ADDAE5747A73D2E124EBCC167F5816A81B7D81A0CCC861BFC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 c5dda9255f4bc8b68a90d0ce5f395d334223c7cf7530ba071a8737b6d641f2e6
MD5 71f0742c15393f2b7ba2f03f06bab1d4
SHA1 cd829a1baa81117d2a7647444adb0c96b8b12a68
SHA512 b2eecdd7fa68607e502e7bd84b51b84fdfc972aaf1d174322ae4a1ed27e8bc7321b6080e41a49e5ef5bd87faad05ab3ada5fad845ee8245733c75851730173db
SSDEEP 384:FtNn/s3n9SfsNe124GpdLL2K4kM8YyEXWRZITGT0IvPx9z:Fj+9UD7GHmKtMqZi+0mvz
TLSH
T16E928E326838AC7F5DE25456B50E32275EF44567E6C53F85DAEC2B1C08CE39C131AD1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 34db67e4072fc6d27720d880507c93cf0ce080d70ad250cc6d5d0cf3a7913751
MD5 44af89172f8a22cbd154493dd38ff53f
SHA1 b6245892d80a9ac0e588579c024da7f55b3054e3
SHA512 d168b525f312687cabd5cd22991228f93c5e95dabeaeae13f8d14cd6aae8d7d2cef1b10eb28491db3a45da4a23bf5f2d8153212510076b05a4e85e6f344e1920
SSDEEP 384:ntNn/s3n9SfsNeo24GpdLL2K4kM8YyEXWRZITGT0IvPx9z:nj+9Uy7GHmKtMqZi+0mvz
TLSH
T111928E326838AD6F4DE26456B50E32275EF4456BE6C53F85DAEC2F1C08CE39C131AD1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 3b5bd6839097b4f7f9b323bdea1c948144fc7baf959f203bb7770da86ff7da50
MD5 9e3baf0be22e01b76ecd3e4d92f526a8
SHA1 c5a2057f04c0d54ca21469d48e8b51e961e73520
SHA512 8e664eba9054248cfd65399ba591d75baa25c4e764f213e15b3c34d14e57dc4a60781813b1c10d5daa7207ea2e5f276f2d5f03067dba0e799af5e09b0958cb22
SSDEEP 192:gONS6kDfQmiUyZVZ903tjzorYbracQiNzU6:gONS6ghmZ9M8YyK5U6
TLSH
T18402D83568782CBB8EE3AE09B54B37275FE4112BEA952F84DAE81B1C04C764C1306826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 4c7f73be05ef86e122b15778facb8c6cb82cb5e85a6ed273d61289e5215f9a85
MD5 6036c0b973e4acd9ec6c0cb25a47e825
SHA1 dd0c61ffe4c162e602c880addac9b00330d5d833
SHA512 0c6646bfce845ec018cd351886ac8f860fd8d354e3315539ff85334feae13aeb31131bdaddff5ed695c28521a5dd6ca4cda26e28d9bbf3b75b69fd1121627549
SSDEEP 192:VONf6kBQmiUyHVZ903tjzorYbraEXH6FJcRUqLU6:VONf6C4Z9M8YyEXWuZU6
TLSH
T113122D3268786C7F9DE3A945B44B32235EA5412BEBC97F90D9EC271C05DF69C1306826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 1bf75c51937c49b19ecc47cbcee1fb08e5c012683bb3183a58ff708c36248aee
MD5 3308f415951d32e01186b3ae645b32a5
SHA1 215908de638e7ecdecf6ffaa7f81c24a322d5825
SHA512 e339124629b11457f705f2910b4189a8eb6f2e0aa8a5fb3405db4c504f09e726a5d775a6dc03bdab2032ce65d98c960749f832a3c7db41c7588e15805ef9feeb
SSDEEP 384:PiFftNn/s3n9SKvsNt8TUNTUlIl024GpdLLUK4kM8YyEXWHZITGT0IvPx9z:aFfj+9ZWwgK7GHEKtMkZi+0mvz
TLSH
T118C219F208D7983ADDAE5747B73D2E164EBCC167F5816A81B7D81A0CCC862BFC206815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

352447a8-9051-43d1-b926-4d9f6132894d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\352447a8-9051-43d1-b926-4d9f6132894d.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 b5847b3188a28264c961fc4689036f9a8c64a258d8a66e138cdfe68e2f313cfc
MD5 e1cf6b857000594a133bee48457126f2
SHA1 31f1a1f7ee89e9bca2f8591c90f3ef8a921ad129
SHA512 5fd13aef74202809266e906cbc7e975e9fe13d206e7d7ccf185fe897153151e1b8de9c44a2b1faf00f9fdf94a75d764925496111f9753a7b8af50efb540d15ea
TLSH
T14741075CBAE91148B3B77F469BF7A8AE487AB8772E07D49D00110E4E0663B00D8B1737
MD5 SHA1 SHA512 TLSH

Submit Download

5b063eb5

Path C:\Users\Admin\AppData\Local\Temp\8000591a\5b063eb5
Size 40KB
SHA256 06aeb2f9c1ee642348c091fb27541c143545354c273055ce30832e0f61aedf81
MD5 ba979c77c714b67908bc582ec373c723
SHA1 ff6b59b47b8d3ad488eaa7a4b0040a9a93eb19fe
SHA512 fc6b860dcb9e00c6ab7aa72555fb17921bbb8b1276acf0ab5fcb20b5f2dbd4bf71946c5c4fcfc46310f8de29491a63e46d43805070d19f290070f60077f80b01
SSDEEP 96:wDaCn8MouB6w9fUP8iZqmvJKLPeymwil:wDaG7Iw9f/iSi
TLSH
T16103440F2E682801C8B94632BCF124E62E7DA03E4F13EED12CB504659D75C52B52E5EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Boostrapper_v2.3.1.zip

Path C:\Users\Admin\Downloads\Boostrapper_v2.3.1.zip
Size 3.2MB
SHA256 4427046d94aca7e2dfc25c2e2ce90495093fac36e64eb17d2b67bf98c46874b7
MD5 e1809b37ab88469b81cf4d0071a9e65d
SHA1 c73f0fbeace5c53f2f74c81f8e34144dfec618f9
SHA512 834578a6a79a135a41e7a0ebf99670f40409f620365ebf5392871b50872d7f634cf5633aed959cde83311d023593545a2e73ecd4f382354863c6363621bf1aa0
SSDEEP 98304:kmONVrkCvbCC49JfD2I/XBY8nyxxOda33WYQ:kmODVvGC49NFvBY8nyz33GYQ
TLSH
T17AE533F099C0F891D6519DFB75837E289C074FE8C4B90E098157F22FA9B1CA277A6C94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mpclient.dll

Path C:\Users\Admin\Downloads\Boostrapper_v2.3.1\Bootstrapper_v2.1.7\mpclient.dll
Size 3.7MB
SHA256 b96858e01667381eb431951beffeaec83e187a97eb2d4c2004294e8802915fc5
MD5 445e396a72314df4a8e161d33303843c
SHA1 a1708b7e42e6a8971647d25122e70c5a232ad775
SHA512 eea8da8944163f19d9dfde63285e3eb7b541b182c2966805cfd41fe2af2dee12e3072e961d212e298dadf56f0f2bd7fa3479f48d89af4de809cd9484f0c3622d
SSDEEP 49152:BulDTtgzWmlUkOjkONF2bwr0YhZDH91CAjPGeLeReR7CNhkm:BkyOtF30YvrKQVqCuhkm
TLSH
T116068D07FDA10C66D595A33189BB5252BB7DB8460B3263C32E50B23A3FBB7E09935714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

writefile.txt

Path C:\Users\Admin\Downloads\Boostrapper_v2.3.1\Bootstrapper_v2.1.7\workspace\.tests\writefile.txt
Size 7B
SHA256 aee408847d35e44e99430f0979c3357b85fe8dbb4535a494301198adbee85f27
MD5 260ca9dd8a4577fc00b7bd5810298076
SHA1 53a5687cb26dc41f2ab4033e97e13adefd3740d6
SHA512 51e85deb51c2b909a21ec5b8e83b1cb28da258b1be227620105a345a2bd4c6aea549cd5429670f2df33324667b9f623a420b3a0bdbbd03ad48602211e75478a7
MD5 SHA1 SHA512

Submit Download

Вооtstaрреr.exe

Path C:\Users\Admin\Downloads\Boostrapper_v2.3.1\Bootstrapper_v2.1.7\Вооtstaрреr.exe
Size 683KB
SHA256 715b4174065916a6412f60b3c10664b323dc737fd717ab09627083be34626fe0
MD5 6669e10c960f6c2297bcd3d5a27412aa
SHA1 73bee544b24312d0057d9ce5e62daa9f73243d00
SHA512 feb1e93aed3f1a0ade6e6ab169af46ddd438aa80f6667fb24421d2f0b7da1c4a4902438421079a75eecfc9a3347c3ebe7f62b88ea9e67a9c951954d8555ea497
SSDEEP 12288:tiGbyLR32C4NHhZoLCZcvDaLgf5pB6Nwi5//E7soazN0uahRg:MGboR3P4NHboLCevWLGL6//E7sTN0hhC
TLSH
T1ECE48E2AB3E401F9D1B7D276C9535A26FB71780A1731CBCF03A046562F276A49E3E712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/808-596-0x00000006B0000000-0x00000006B0222000-memory.dmp

Download

memory/808-546-0x00000006B0000000-0x00000006B0222000-memory.dmp

Download

memory/808-598-0x00000006B0000000-0x00000006B0222000-memory.dmp

Download

memory/808-599-0x00000006B0000000-0x00000006B0222000-memory.dmp

Download

memory/808-561-0x00000006B0000000-0x00000006B0222000-memory.dmp

Download

memory/808-559-0x00000006B0000000-0x00000006B0222000-memory.dmp

Download

memory/808-595-0x00000006B0000000-0x00000006B0222000-memory.dmp

Download

memory/808-624-0x00000006B0000000-0x00000006B0222000-memory.dmp

Download

memory/808-623-0x00000006B0000000-0x00000006B0222000-memory.dmp

Download

memory/808-594-0x00000006B0000000-0x00000006B0222000-memory.dmp

Download

memory/808-593-0x00000006B0000000-0x00000006B0222000-memory.dmp

Download

memory/808-635-0x00000006B0000000-0x00000006B0222000-memory.dmp

Download

memory/808-639-0x00000006B0000000-0x00000006B0222000-memory.dmp

Download

memory/808-651-0x00000006B0000000-0x00000006B0222000-memory.dmp

Download

memory/808-655-0x00000006B0000000-0x00000006B0222000-memory.dmp

Download

memory/808-652-0x00000006B0000000-0x00000006B0222000-memory.dmp

Download

memory/808-650-0x00000006B0000000-0x00000006B0222000-memory.dmp

Download

memory/808-656-0x00000006B0000000-0x00000006B0222000-memory.dmp

Download

memory/808-644-0x00000006B0000000-0x00000006B0222000-memory.dmp

Download

memory/808-642-0x00000006B0000000-0x00000006B0222000-memory.dmp

Download

memory/808-560-0x00000006B0000000-0x00000006B0222000-memory.dmp

Download

memory/808-641-0x00000006B0000000-0x00000006B0222000-memory.dmp

Download

memory/808-638-0x00000006B0000000-0x00000006B0222000-memory.dmp

Download

memory/808-634-0x00000006B0000000-0x00000006B0222000-memory.dmp

Download

memory/808-632-0x00000006B0000000-0x00000006B0222000-memory.dmp

Download

memory/808-631-0x00000006B0000000-0x00000006B0222000-memory.dmp

Download

memory/808-630-0x00000006B0000000-0x00000006B0222000-memory.dmp

Download

memory/808-629-0x00000006B0000000-0x00000006B0222000-memory.dmp

Download

memory/808-627-0x00000006B0000000-0x00000006B0222000-memory.dmp

Download

memory/808-626-0x00000006B0000000-0x00000006B0222000-memory.dmp

Download

memory/808-597-0x00000006B0000000-0x00000006B0222000-memory.dmp

Download

memory/808-587-0x00000006B0000000-0x00000006B0222000-memory.dmp

Download

memory/808-545-0x00000006B0000000-0x00000006B0222000-memory.dmp

Download

memory/808-572-0x00000006B0000000-0x00000006B0222000-memory.dmp

Download

memory/808-663-0x00007FFEF3FB0000-0x00007FFEF437C000-memory.dmp

Download

memory/808-543-0x00000006B0000000-0x00000006B0222000-memory.dmp

Download

memory/808-669-0x00000006B0000000-0x00000006B0222000-memory.dmp

Download

memory/808-670-0x00000006B0000000-0x00000006B0222000-memory.dmp

Download

memory/808-673-0x00000006B0000000-0x00000006B0222000-memory.dmp

Download

memory/808-674-0x00000006B0000000-0x00000006B0222000-memory.dmp

Download

memory/808-675-0x00000006B0000000-0x00000006B0222000-memory.dmp

Download

memory/808-676-0x00000006B0000000-0x00000006B0222000-memory.dmp

Download

memory/808-677-0x00000006B0000000-0x00000006B0222000-memory.dmp

Download

memory/808-678-0x00000006B0000000-0x00000006B0222000-memory.dmp

Download

memory/808-679-0x00000006B0000000-0x00000006B0222000-memory.dmp

Download

memory/808-681-0x00000006B0000000-0x00000006B0222000-memory.dmp

Download

memory/808-542-0x00000006B0000000-0x00000006B0222000-memory.dmp

Download

memory/808-682-0x00000006B0000000-0x00000006B0222000-memory.dmp

Download

memory/808-541-0x00000006B0000000-0x00000006B0222000-memory.dmp

Download

memory/808-540-0x00000006B0000000-0x00000006B0222000-memory.dmp

Download

memory/808-539-0x00000006B0000000-0x00000006B0222000-memory.dmp

Download

memory/808-531-0x00000006B0000000-0x00000006B0222000-memory.dmp

Download

memory/808-532-0x00000006B0000000-0x00000006B0222000-memory.dmp

Download

memory/808-533-0x00000006B0000000-0x00000006B0222000-memory.dmp

Download

memory/808-534-0x00000006B0000000-0x00000006B0222000-memory.dmp

Download

memory/808-536-0x00000006B0000000-0x00000006B0222000-memory.dmp

Download

memory/808-538-0x00000006B0000000-0x00000006B0222000-memory.dmp

Download

memory/808-537-0x00000006B0000000-0x00000006B0222000-memory.dmp

Download

memory/808-535-0x00000006B0000000-0x00000006B0222000-memory.dmp

Download

memory/5500-711-0x000001B2530F0000-0x000001B2530F1000-memory.dmp

Download

memory/5500-712-0x000001B2530F0000-0x000001B2530F1000-memory.dmp

Download

memory/5500-705-0x000001B2530F0000-0x000001B2530F1000-memory.dmp

Download

memory/5500-706-0x000001B2530F0000-0x000001B2530F1000-memory.dmp

Download

memory/5500-707-0x000001B2530F0000-0x000001B2530F1000-memory.dmp

Download