49d93653dd160fc68e85a4d800ad642b12b47ae1482e7124dbe05e9d361d6254

Resubmissions

25/06/2026, 11:20

260625-nff7nsbs2v4

25/06/2026, 11:16

260625-ndlpdabt2r8

25/06/2026, 11:13

260625-nblllaa18v8

Analysis

user interaction
yes
max time kernel
150s
max time network
152s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
25/06/2026, 11:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
download.html
Size 5KB
Sample260625-nblllaa18v
SHA256 49d93653dd160fc68e85a4d800ad642b12b47ae1482e7124dbe05e9d361d6254
MD5 343be0575a1fda14cef42c4fa39c0250
SHA1 a1a1748fe14214ad64a31b18e8c85c464b7b6ed7
SHA512 c5904fa0599d04af917ac5843e35d5a82f11afbd92f40dfde87b22c34ceca89413e30c50c1c4451b62403b167707d6d867644d3c5ea3ed11e2f73c5c520f09e9
SSDEEP 96:PNy/toXZzIEb0EaW87JfM8hEc3ZNuG7+jjpMbvBErHX77Yzueh8pgmw:PNmtkCBhTesZkb/mbvOTX7UyHw
TLSH
T147C12AF3ACF7506393B6AB9574B733544311B02ABB06C094ECB2999EA4DEE5B50094CA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery persistence privilege_escalation spyware trojan

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
321	1972	chrome.exe

Executes dropped EXE 4 IoCs

pid	Process
5712	SteamSetup.exe
5744	steamservice.exe
5840	steamservice.exe
5888	Steam.exe

Loads dropped DLL 7 IoCs

pid	Process
5712	SteamSetup.exe
5712	SteamSetup.exe
5712	SteamSetup.exe
5712	SteamSetup.exe
5712	SteamSetup.exe
5712	SteamSetup.exe
5712	SteamSetup.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000\Software\Microsoft\Windows\CurrentVersion\Run\Steam = "\"C:\\Program Files (x86)\\Steam\\steam.exe\" -silent"	SteamSetup.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Probable phishing domain 1 TTPs 1 IoCs

Phishing

T1566

description	flow	ioc	stream
HTTP URL	196	https://undetek.com/cdn-cgi/challenge-platform/h/b/orchestrate/chl_page/v1?ray=a1138d1dbb92bef5	5

Drops file in Program Files directory 41 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Steam\public\steambootstrapper_schinese.txt	SteamSetup.exe
File created	C:\Program Files (x86)\Steam\public\steambootstrapper_spanish.txt	SteamSetup.exe
File created	C:\Program Files (x86)\Steam\public\steambootstrapper_french.txt	SteamSetup.exe
File created	C:\Program Files (x86)\Steam\public\steambootstrapper_korean.txt	SteamSetup.exe
File opened for modification	C:\Program Files (x86)\Common Files\Steam\steamservice.exe	steamservice.exe
File created	C:\Program Files (x86)\Steam\uninstall.exe	SteamSetup.exe
File created	C:\Program Files (x86)\Steam\public\steambootstrapper_russian.txt	SteamSetup.exe
File created	C:\Program Files (x86)\Steam\public\steambootstrapper_bulgarian.txt	SteamSetup.exe
File created	C:\Program Files (x86)\Steam\public\steambootstrapper_romanian.txt	SteamSetup.exe
File created	C:\Program Files (x86)\Steam\public\steambootstrapper_thai.txt	SteamSetup.exe
File created	C:\Program Files (x86)\Steam\bin\SteamService.exe	SteamSetup.exe
File created	C:\Program Files (x86)\Steam\public\steambootstrapper_english.txt	SteamSetup.exe
File created	C:\Program Files (x86)\Steam\public\steambootstrapper_hungarian.txt	SteamSetup.exe
File created	C:\Program Files (x86)\Steam\public\steambootstrapper_indonesian.txt	SteamSetup.exe
File created	C:\Program Files (x86)\Steam\public\steambootstrapper_italian.txt	SteamSetup.exe
File created	C:\Program Files (x86)\Steam\public\steambootstrapper_japanese.txt	SteamSetup.exe
File created	C:\Program Files (x86)\Steam\public\steambootstrapper_polish.txt	SteamSetup.exe
File created	C:\Program Files (x86)\Steam\public\steambootstrapper_turkish.txt	SteamSetup.exe
File created	C:\Program Files (x86)\Steam\Steam.exe	SteamSetup.exe
File created	C:\Program Files (x86)\Steam\public\steambootstrapper_danish.txt	SteamSetup.exe
File created	C:\Program Files (x86)\Steam\public\steambootstrapper_tchinese.txt	SteamSetup.exe
File opened for modification	C:\Program Files (x86)\Common Files\Steam\service_log.txt	steamservice.exe
File created	C:\Program Files (x86)\Steam\logs\bootstrap_log.txt	Steam.exe
File created	C:\Program Files (x86)\Steam\public\steambootstrapper_czech.txt	SteamSetup.exe
File opened for modification	C:\Program Files (x86)\Steam\logs\bootstrap_log.txt	Steam.exe
File created	C:\Program Files (x86)\Steam\package\resources_hidpi_all.zip.vz.3de815c3117712cb9eeb7ea4c8b275faf481dcfd_56342	Steam.exe
File created	C:\Program Files (x86)\Steam\public\steambootstrapper_swedish.txt	SteamSetup.exe
File created	C:\Program Files (x86)\Steam\public\steambootstrapper_brazilian.txt	SteamSetup.exe
File created	C:\Program Files (x86)\Steam\public\steambootstrapper_dutch.txt	SteamSetup.exe
File created	C:\Program Files (x86)\Steam\public\steambootstrapper_german.txt	SteamSetup.exe
File created	C:\Program Files (x86)\Steam\public\steambootstrapper_greek.txt	SteamSetup.exe
File created	C:\Program Files (x86)\Steam\public\steambootstrapper_latam.txt	SteamSetup.exe
File created	C:\Program Files (x86)\Steam\public\steambootstrapper_norwegian.txt	SteamSetup.exe
File created	C:\Program Files (x86)\Steam\public\steambootstrapper_ukrainian.txt	SteamSetup.exe
File created	C:\Program Files (x86)\Steam\public\steambootstrapper_finnish.txt	SteamSetup.exe
File created	C:\Program Files (x86)\Steam\public\steambootstrapper_koreana.txt	SteamSetup.exe
File created	C:\Program Files (x86)\Steam\public\steambootstrapper_portuguese.txt	SteamSetup.exe
File created	C:\Program Files (x86)\Steam\public\steambootstrapper_vietnamese.txt	SteamSetup.exe
File created	C:\Program Files (x86)\Common Files\Steam\steamservice.exe	steamservice.exe
File created	C:\Program Files (x86)\Steam\.writable	Steam.exe
File opened for modification	C:\Program Files (x86)\Steam\.crash	Steam.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\SteamSetup.exe:Zone.Identifier	chrome.exe

Access Token Manipulation: Create Process with Token 1 TTPs 1 IoCs

defense_evasion privilege_escalation

Create Process with Token

T1134.002

pid	Process
5840	steamservice.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

defense_evasion

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e20000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	Steam.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	Steam.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	steamservice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Steam.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SteamSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	steamservice.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1952	msedge.exe
1972	chrome.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Steam.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Steam.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134268596266667047"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 46 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1679180529-4058988202-686829476-1000\{61D4D9BA-AB09-4EE6-B354-DBE7A2D79B62}	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steam\DefaultIcon\ = "steam.exe"	steamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\steam\Shell\Open\Command	steamservice.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\steam\ = "URL:steam protocol"	steamservice.exe
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\steam\Shell\Open\Command	steamservice.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\steamlink\ = "URL:steamlink protocol"	steamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\steam\Shell	steamservice.exe
Key created	\REGISTRY\MACHINE\Software\Classes\steamlink	steamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\steamlink	steamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steamlink\ = "URL:steamlink protocol"	steamservice.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\steam\URL Protocol	steamservice.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\steam\DefaultIcon\ = "steam.exe"	steamservice.exe
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\steamlink	steamservice.exe
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\steamlink\Shell\Open\Command	steamservice.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1679180529-4058988202-686829476-1000\{AE920DC6-9F81-4651-BCA2-DACADB93412C}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\steam	steamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steam\ = "URL:steam protocol"	steamservice.exe
Key created	\REGISTRY\MACHINE\Software\Classes\steamlink\Shell\Open\Command	steamservice.exe
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\steam\DefaultIcon	steamservice.exe
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\steam\Shell\Open	steamservice.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\steamlink\DefaultIcon\ = "steam.exe"	steamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steamlink\Shell\Open\Command\ = "\"C:\\Program Files (x86)\\Steam\\steam.exe\" -- \"%1\""	steamservice.exe
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\MuiCache	MiniSearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\Software\Classes\steamlink\DefaultIcon	steamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\steamlink\Shell	steamservice.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\steamlink\URL Protocol	steamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\steamlink\Shell\Open\Command	steamservice.exe
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steam\URL Protocol	steamservice.exe
Key created	\REGISTRY\MACHINE\Software\Classes\steam\DefaultIcon	steamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\steam	steamservice.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\steam\Shell\Open\Command\ = "\"C:\\Program Files (x86)\\Steam\\steam.exe\" -- \"%1\""	steamservice.exe
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\steamlink\DefaultIcon	steamservice.exe
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\steamlink\Shell	steamservice.exe
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\steamlink\Shell\Open	steamservice.exe
Key created	\REGISTRY\MACHINE\Software\Classes\steam\Shell\Open\Command	steamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\steam\Shell\Open	steamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steam\Shell\Open\Command\ = "\"C:\\Program Files (x86)\\Steam\\steam.exe\" -- \"%1\""	steamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steamlink\URL Protocol	steamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steamlink\DefaultIcon\ = "steam.exe"	steamservice.exe
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\steam	steamservice.exe
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\steam\Shell	steamservice.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\steamlink\Shell\Open\Command\ = "\"C:\\Program Files (x86)\\Steam\\steam.exe\" -- \"%1\""	steamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\steamlink\Shell\Open	steamservice.exe

Modifies system certificate store 2 TTPs 1 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	Steam.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\undetek-v10.37.zip:Zone.Identifier	chrome.exe
File opened for modification	C:\Users\Admin\Downloads\SteamSetup.exe:Zone.Identifier	chrome.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
4132	chrome.exe
4132	chrome.exe
4132	chrome.exe
4132	chrome.exe
2660	msedge.exe
2660	msedge.exe
5712	SteamSetup.exe
5712	SteamSetup.exe
5712	SteamSetup.exe
5712	SteamSetup.exe
5712	SteamSetup.exe
5712	SteamSetup.exe
5712	SteamSetup.exe
5712	SteamSetup.exe
5712	SteamSetup.exe
5712	SteamSetup.exe
5712	SteamSetup.exe
5712	SteamSetup.exe
5712	SteamSetup.exe
5712	SteamSetup.exe
5712	SteamSetup.exe
5712	SteamSetup.exe
5712	SteamSetup.exe
5712	SteamSetup.exe
5712	SteamSetup.exe
5712	SteamSetup.exe

Suspicious behavior: LoadsDriver 3 IoCs

pid	Process
680	Process not Found
680	Process not Found
680	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 27 IoCs

pid	Process
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4132	chrome.exe
4132	chrome.exe
4132	chrome.exe
4132	chrome.exe
4132	chrome.exe
4132	chrome.exe
4348	msedge.exe
4132	chrome.exe
4132	chrome.exe
4132	chrome.exe
4132	chrome.exe
4132	chrome.exe
4132	chrome.exe
4132	chrome.exe
4132	chrome.exe
4132	chrome.exe
4132	chrome.exe
4132	chrome.exe
4132	chrome.exe
4132	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4132	chrome.exe
Token: SeCreatePagefilePrivilege	4132	chrome.exe
Token: SeShutdownPrivilege	4132	chrome.exe
Token: SeCreatePagefilePrivilege	4132	chrome.exe
Token: SeShutdownPrivilege	4132	chrome.exe
Token: SeCreatePagefilePrivilege	4132	chrome.exe
Token: SeShutdownPrivilege	4132	chrome.exe
Token: SeCreatePagefilePrivilege	4132	chrome.exe
Token: SeShutdownPrivilege	4132	chrome.exe
Token: SeCreatePagefilePrivilege	4132	chrome.exe
Token: SeShutdownPrivilege	4132	chrome.exe
Token: SeCreatePagefilePrivilege	4132	chrome.exe
Token: SeShutdownPrivilege	4132	chrome.exe
Token: SeCreatePagefilePrivilege	4132	chrome.exe
Token: SeShutdownPrivilege	4132	chrome.exe
Token: SeCreatePagefilePrivilege	4132	chrome.exe
Token: SeShutdownPrivilege	4132	chrome.exe
Token: SeCreatePagefilePrivilege	4132	chrome.exe
Token: SeShutdownPrivilege	4132	chrome.exe
Token: SeCreatePagefilePrivilege	4132	chrome.exe
Token: SeShutdownPrivilege	4132	chrome.exe
Token: SeCreatePagefilePrivilege	4132	chrome.exe
Token: SeShutdownPrivilege	4132	chrome.exe
Token: SeCreatePagefilePrivilege	4132	chrome.exe
Token: SeShutdownPrivilege	4132	chrome.exe
Token: SeCreatePagefilePrivilege	4132	chrome.exe
Token: SeShutdownPrivilege	4132	chrome.exe
Token: SeCreatePagefilePrivilege	4132	chrome.exe
Token: SeShutdownPrivilege	4132	chrome.exe
Token: SeCreatePagefilePrivilege	4132	chrome.exe
Token: SeShutdownPrivilege	4132	chrome.exe
Token: SeCreatePagefilePrivilege	4132	chrome.exe
Token: SeShutdownPrivilege	4132	chrome.exe
Token: SeCreatePagefilePrivilege	4132	chrome.exe
Token: SeShutdownPrivilege	4132	chrome.exe
Token: SeCreatePagefilePrivilege	4132	chrome.exe
Token: SeShutdownPrivilege	4132	chrome.exe
Token: SeCreatePagefilePrivilege	4132	chrome.exe
Token: SeShutdownPrivilege	4132	chrome.exe
Token: SeCreatePagefilePrivilege	4132	chrome.exe
Token: SeShutdownPrivilege	4132	chrome.exe
Token: SeCreatePagefilePrivilege	4132	chrome.exe
Token: SeShutdownPrivilege	4132	chrome.exe
Token: SeCreatePagefilePrivilege	4132	chrome.exe
Token: SeShutdownPrivilege	4132	chrome.exe
Token: SeCreatePagefilePrivilege	4132	chrome.exe
Token: SeShutdownPrivilege	4132	chrome.exe
Token: SeCreatePagefilePrivilege	4132	chrome.exe
Token: SeShutdownPrivilege	4132	chrome.exe
Token: SeCreatePagefilePrivilege	4132	chrome.exe
Token: SeShutdownPrivilege	4132	chrome.exe
Token: SeCreatePagefilePrivilege	4132	chrome.exe
Token: SeShutdownPrivilege	4132	chrome.exe
Token: SeCreatePagefilePrivilege	4132	chrome.exe
Token: SeShutdownPrivilege	4132	chrome.exe
Token: SeCreatePagefilePrivilege	4132	chrome.exe
Token: SeShutdownPrivilege	4132	chrome.exe
Token: SeCreatePagefilePrivilege	4132	chrome.exe
Token: SeShutdownPrivilege	4132	chrome.exe
Token: SeCreatePagefilePrivilege	4132	chrome.exe
Token: SeShutdownPrivilege	4132	chrome.exe
Token: SeCreatePagefilePrivilege	4132	chrome.exe
Token: SeShutdownPrivilege	4132	chrome.exe
Token: SeCreatePagefilePrivilege	4132	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4132	chrome.exe
4132	chrome.exe
4132	chrome.exe
4132	chrome.exe
4132	chrome.exe
4132	chrome.exe
4132	chrome.exe
4132	chrome.exe
4132	chrome.exe
4132	chrome.exe
4132	chrome.exe
4132	chrome.exe
4132	chrome.exe
4132	chrome.exe
4132	chrome.exe
4132	chrome.exe
4132	chrome.exe
4132	chrome.exe
4132	chrome.exe
4132	chrome.exe
4132	chrome.exe
4132	chrome.exe
4132	chrome.exe
4132	chrome.exe
4132	chrome.exe
4132	chrome.exe
4132	chrome.exe
4132	chrome.exe
4132	chrome.exe
4132	chrome.exe

Suspicious use of SendNotifyMessage 36 IoCs

pid	Process
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4132	chrome.exe
4132	chrome.exe
4132	chrome.exe
4132	chrome.exe
4132	chrome.exe
4132	chrome.exe
4132	chrome.exe
4132	chrome.exe
4132	chrome.exe
4132	chrome.exe
4132	chrome.exe
4132	chrome.exe
4132	chrome.exe
4132	chrome.exe
4132	chrome.exe
4132	chrome.exe
4132	chrome.exe
4132	chrome.exe
4132	chrome.exe
4132	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4076	MiniSearchHost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4348 wrote to memory of 1848	4348	msedge.exe	81
PID 4348 wrote to memory of 792	4348	msedge.exe	83
PID 4348 wrote to memory of 1952	4348	msedge.exe	82
PID 4348 wrote to memory of 792	4348	msedge.exe	83
PID 4348 wrote to memory of 792	4348	msedge.exe	83
PID 4348 wrote to memory of 2608	4348	msedge.exe	84
PID 4348 wrote to memory of 2608	4348	msedge.exe	84
PID 4348 wrote to memory of 1940	4348	msedge.exe	85
PID 4348 wrote to memory of 3908	4348	msedge.exe	86
PID 4348 wrote to memory of 1940	4348	msedge.exe	85
PID 4348 wrote to memory of 1940	4348	msedge.exe	85
PID 4348 wrote to memory of 3908	4348	msedge.exe	86
PID 4348 wrote to memory of 3908	4348	msedge.exe	86
PID 4348 wrote to memory of 3976	4348	msedge.exe	88
PID 4348 wrote to memory of 3976	4348	msedge.exe	88
PID 4348 wrote to memory of 3976	4348	msedge.exe	88
PID 4348 wrote to memory of 4992	4348	msedge.exe	89
PID 4348 wrote to memory of 4992	4348	msedge.exe	89
PID 4348 wrote to memory of 4992	4348	msedge.exe	89
PID 4348 wrote to memory of 3632	4348	msedge.exe	90
PID 4348 wrote to memory of 4812	4348	msedge.exe	91
PID 4348 wrote to memory of 3632	4348	msedge.exe	90
PID 4348 wrote to memory of 3632	4348	msedge.exe	90
PID 4348 wrote to memory of 4812	4348	msedge.exe	91
PID 4348 wrote to memory of 4812	4348	msedge.exe	91
PID 4348 wrote to memory of 1208	4348	msedge.exe	94
PID 4348 wrote to memory of 1656	4348	msedge.exe	95
PID 4348 wrote to memory of 1208	4348	msedge.exe	94
PID 4348 wrote to memory of 1656	4348	msedge.exe	95
PID 4348 wrote to memory of 664	4348	msedge.exe	96
PID 4348 wrote to memory of 2472	4348	msedge.exe	98
PID 664 wrote to memory of 1544	664	msedge.exe	99
PID 4348 wrote to memory of 3596	4348	msedge.exe	101
PID 4348 wrote to memory of 3596	4348	msedge.exe	101
PID 4348 wrote to memory of 3596	4348	msedge.exe	101
PID 4348 wrote to memory of 3352	4348	msedge.exe	105
PID 4348 wrote to memory of 2020	4348	msedge.exe	106
PID 4348 wrote to memory of 3404	4348	msedge.exe	107
PID 4132 wrote to memory of 1988	4132	chrome.exe	110
PID 4132 wrote to memory of 4812	4132	chrome.exe	111
PID 4132 wrote to memory of 4812	4132	chrome.exe	111
PID 4132 wrote to memory of 1972	4132	chrome.exe	112
PID 4132 wrote to memory of 2196	4132	chrome.exe	113
PID 4132 wrote to memory of 2196	4132	chrome.exe	113
PID 4132 wrote to memory of 5084	4132	chrome.exe	114
PID 4132 wrote to memory of 5084	4132	chrome.exe	114
PID 4132 wrote to memory of 2452	4132	chrome.exe	115
PID 4132 wrote to memory of 2452	4132	chrome.exe	115
PID 4132 wrote to memory of 5172	4132	chrome.exe	117
PID 4132 wrote to memory of 5172	4132	chrome.exe	117
PID 4132 wrote to memory of 5228	4132	chrome.exe	118
PID 4132 wrote to memory of 5228	4132	chrome.exe	118
PID 4132 wrote to memory of 5492	4132	chrome.exe	119
PID 4132 wrote to memory of 5492	4132	chrome.exe	119
PID 4132 wrote to memory of 5528	4132	chrome.exe	120
PID 4132 wrote to memory of 5528	4132	chrome.exe	120
PID 4132 wrote to memory of 5604	4132	chrome.exe	121
PID 4132 wrote to memory of 5792	4132	chrome.exe	123
PID 4132 wrote to memory of 5792	4132	chrome.exe	123
PID 4132 wrote to memory of 6092	4132	chrome.exe	124
PID 4132 wrote to memory of 6092	4132	chrome.exe	124
PID 4132 wrote to memory of 5632	4132	chrome.exe	125
PID 4132 wrote to memory of 5632	4132	chrome.exe	125
PID 4348 wrote to memory of 5628	4348	msedge.exe	126

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\download.html
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2e8,0x7ff9a639c188,0x7ff9a639c194,0x7ff9a639c1a0
  2⤵
  PID:1848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1804,i,11886594166818167038,7722441789277583971,524288 --field-trial-handle=1956,i,4557696908881160972,3428456659527093309,262144 --variations-seed-version --mojo-platform-channel-handle=2112 /prefetch:11
  2⤵
  - System Time Discovery
  PID:1952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1536,i,16911969870256790227,5419389945480456675,262144 --field-trial-handle=1956,i,4557696908881160972,3428456659527093309,262144 --variations-seed-version --mojo-platform-channel-handle=1952 /prefetch:2
  2⤵
  PID:792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2528,i,2186244719843251814,9480134539473023102,524288 --field-trial-handle=1956,i,4557696908881160972,3428456659527093309,262144 --variations-seed-version --mojo-platform-channel-handle=2296 /prefetch:13
  2⤵
  PID:2608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3408,i,1082323787409864313,957652468808751892,2097152 --field-trial-handle=1956,i,4557696908881160972,3428456659527093309,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:1940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3412,i,4794521931555301209,16491222325653503945,2097152 --field-trial-handle=1956,i,4557696908881160972,3428456659527093309,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:3908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4168,i,14044951528307208607,10102889388021782500,2097152 --field-trial-handle=1956,i,4557696908881160972,3428456659527093309,262144 --variations-seed-version --mojo-platform-channel-handle=4172 /prefetch:1
  2⤵
  PID:3976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4244,i,13062884906343405850,1794416528529953066,2097152 --field-trial-handle=1956,i,4557696908881160972,3428456659527093309,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:9
  2⤵
  PID:4992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4268,i,430041722858939528,13730440998459942843,2097152 --field-trial-handle=1956,i,4557696908881160972,3428456659527093309,262144 --variations-seed-version --mojo-platform-channel-handle=4384 /prefetch:1
  2⤵
  PID:3632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4396,i,16885869166859409992,12708824200549085095,2097152 --field-trial-handle=1956,i,4557696908881160972,3428456659527093309,262144 --variations-seed-version --mojo-platform-channel-handle=4420 /prefetch:9
  2⤵
  PID:4812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4196,i,5030608741681258860,9104884523427603982,524288 --field-trial-handle=1956,i,4557696908881160972,3428456659527093309,262144 --variations-seed-version --mojo-platform-channel-handle=5476 /prefetch:14
  2⤵
  PID:1208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3388,i,16841554402366783819,7018019111594441796,524288 --field-trial-handle=1956,i,4557696908881160972,3428456659527093309,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:14
  2⤵
  PID:1656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6168,i,9908882050029203352,8358443456622080270,524288 --field-trial-handle=1956,i,4557696908881160972,3428456659527093309,262144 --variations-seed-version --mojo-platform-channel-handle=6180 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:664
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1132
    3⤵
    PID:1544
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6152,i,9726782629924210370,1577176356934610020,524288 --field-trial-handle=1956,i,4557696908881160972,3428456659527093309,262144 --variations-seed-version --mojo-platform-channel-handle=6172 /prefetch:14
  2⤵
  PID:3464
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6152,i,9726782629924210370,1577176356934610020,524288 --field-trial-handle=1956,i,4557696908881160972,3428456659527093309,262144 --variations-seed-version --mojo-platform-channel-handle=6172 /prefetch:14
  2⤵
  PID:2472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6652,i,3559007721801696298,10149215695218431160,2097152 --field-trial-handle=1956,i,4557696908881160972,3428456659527093309,262144 --variations-seed-version --mojo-platform-channel-handle=6648 /prefetch:1
  2⤵
  PID:3596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=752,i,15812240086631849022,3393037996570485027,524288 --field-trial-handle=1956,i,4557696908881160972,3428456659527093309,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:14
  2⤵
  PID:3352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=748,i,6173448253352234260,608901649731880373,524288 --field-trial-handle=1956,i,4557696908881160972,3428456659527093309,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:14
  2⤵
  PID:2020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4312,i,7705755330194669949,6725727510469864905,524288 --field-trial-handle=1956,i,4557696908881160972,3428456659527093309,262144 --variations-seed-version --mojo-platform-channel-handle=4416 /prefetch:14
  2⤵
  PID:3404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5492,i,16112823218879670002,2075952828423960992,524288 --field-trial-handle=1956,i,4557696908881160972,3428456659527093309,262144 --variations-seed-version --mojo-platform-channel-handle=4640 /prefetch:14
  2⤵
  PID:5628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6236,i,3560344160560594212,5216280005059471599,262144 --field-trial-handle=1956,i,4557696908881160972,3428456659527093309,262144 --variations-seed-version --mojo-platform-channel-handle=6480 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2660

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4396

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4076

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4524

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff99326c728,0x7ff99326c734,0x7ff99326c740
  2⤵
  PID:1988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1596,i,17225456008289531894,4002386603044338634,262144 --field-trial-handle=1904,i,15804144174321914506,4959274989652288230,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1888 /prefetch:2
  2⤵
  PID:4812
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2228,i,9020587079494753564,8913046654272621155,524288 --field-trial-handle=1904,i,15804144174321914506,4959274989652288230,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2260 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:1972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2392,i,16855785812218540922,1163252008560179538,524288 --field-trial-handle=1904,i,15804144174321914506,4959274989652288230,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2552 /prefetch:13
  2⤵
  PID:2196
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3256,i,14564831575794186374,13665465719785916105,2097152 --field-trial-handle=1904,i,15804144174321914506,4959274989652288230,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:5084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3328,i,18039686206168971400,2236581371327790273,2097152 --field-trial-handle=1904,i,15804144174321914506,4959274989652288230,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:2452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4476,i,17768264798463724837,7947773008059207609,2097152 --field-trial-handle=1904,i,15804144174321914506,4959274989652288230,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4480 /prefetch:9
  2⤵
  PID:5172
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4736,i,6977004510537411120,8056710204805833665,2097152 --field-trial-handle=1904,i,15804144174321914506,4959274989652288230,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4760 /prefetch:1
  2⤵
  PID:5228
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=1616,i,419591945669524411,8009996272938581874,524288 --field-trial-handle=1904,i,15804144174321914506,4959274989652288230,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4784 /prefetch:14
  2⤵
  PID:5492
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5068,i,541613128764935290,105436387215467998,524288 --field-trial-handle=1904,i,15804144174321914506,4959274989652288230,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5080 /prefetch:14
  2⤵
  PID:5528
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5508,i,2326504799580182222,10815659946954029231,524288 --field-trial-handle=1904,i,15804144174321914506,4959274989652288230,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5532 /prefetch:14
  2⤵
  PID:5604
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5960,i,13194987975257899053,14548971943150939335,2097152 --field-trial-handle=1904,i,15804144174321914506,4959274989652288230,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5972 /prefetch:1
  2⤵
  PID:5792
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=3524,i,17416619480526503452,15079394856400530408,524288 --field-trial-handle=1904,i,15804144174321914506,4959274989652288230,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3088 /prefetch:12
  2⤵
  PID:6092
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=3492,i,11925315547927974656,9603325831986102499,2097152 --field-trial-handle=1904,i,15804144174321914506,4959274989652288230,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3628 /prefetch:1
  2⤵
  PID:5632
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5876,i,16102374461441765306,16219390272108479512,2097152 --field-trial-handle=1904,i,15804144174321914506,4959274989652288230,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5936 /prefetch:1
  2⤵
  PID:6028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5952,i,6990202408752820326,18261879162434919375,2097152 --field-trial-handle=1904,i,15804144174321914506,4959274989652288230,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5964 /prefetch:1
  2⤵
  PID:5428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5820,i,9376890192913918242,18030278741711365080,2097152 --field-trial-handle=1904,i,15804144174321914506,4959274989652288230,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5536 /prefetch:1
  2⤵
  PID:5152
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6260,i,7929988191661261568,7943404785379244218,2097152 --field-trial-handle=1904,i,15804144174321914506,4959274989652288230,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5804 /prefetch:1
  2⤵
  PID:5868
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=5740,i,6895588072238825008,10683888135601455536,2097152 --field-trial-handle=1904,i,15804144174321914506,4959274989652288230,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3940 /prefetch:1
  2⤵
  PID:5828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6016,i,2883794129199102655,11855475767901688770,2097152 --field-trial-handle=1904,i,15804144174321914506,4959274989652288230,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3552 /prefetch:1
  2⤵
  PID:5132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=6692,i,17682496703820573676,15376439306898283822,2097152 --field-trial-handle=1904,i,15804144174321914506,4959274989652288230,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6564 /prefetch:1
  2⤵
  PID:1648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6392,i,15405266059565003006,2267656217651362497,524288 --field-trial-handle=1904,i,15804144174321914506,4959274989652288230,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5784 /prefetch:14
  2⤵
  PID:5456
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6276,i,6252737690301712519,17610407773294154898,524288 --field-trial-handle=1904,i,15804144174321914506,4959274989652288230,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6720 /prefetch:14
  2⤵
  PID:4396
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6148,i,1266363411907876078,10674435568806021878,524288 --field-trial-handle=1904,i,15804144174321914506,4959274989652288230,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6760 /prefetch:14
  2⤵
  PID:5484
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=6056,i,14207607211347263638,9398283199907347809,2097152 --field-trial-handle=1904,i,15804144174321914506,4959274989652288230,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:5880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4460,i,7289882413923966658,9921812530783918255,524288 --field-trial-handle=1904,i,15804144174321914506,4959274989652288230,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6760 /prefetch:14
  2⤵
  - Modifies registry class
  PID:6072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6816,i,8634315119166590492,12123342565025838210,524288 --field-trial-handle=1904,i,15804144174321914506,4959274989652288230,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4472 /prefetch:14
  2⤵
  - NTFS ADS
  PID:5568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=6640,i,3549270758929470497,15306009623612223184,2097152 --field-trial-handle=1904,i,15804144174321914506,4959274989652288230,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5844 /prefetch:1
  2⤵
  PID:6000
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6896,i,18081634130836363587,12746699169102510481,524288 --field-trial-handle=1904,i,15804144174321914506,4959274989652288230,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4480 /prefetch:14
  2⤵
  PID:5520
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --metrics-shmem-handle=6956,i,5017983633446994366,2995848461668991934,2097152 --field-trial-handle=1904,i,15804144174321914506,4959274989652288230,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6972 /prefetch:1
  2⤵
  PID:2256
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=7096,i,8592497600614598115,1640396131612939437,524288 --field-trial-handle=1904,i,15804144174321914506,4959274989652288230,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7120 /prefetch:14
  2⤵
  PID:2188
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --metrics-shmem-handle=4496,i,17849585076648388832,16513420715931856881,2097152 --field-trial-handle=1904,i,15804144174321914506,4959274989652288230,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6184 /prefetch:1
  2⤵
  PID:4788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --metrics-shmem-handle=6612,i,221730715541529698,6086325544911617338,2097152 --field-trial-handle=1904,i,15804144174321914506,4959274989652288230,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6432 /prefetch:1
  2⤵
  PID:6076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --metrics-shmem-handle=7012,i,1398196006986094487,4271679934478455673,2097152 --field-trial-handle=1904,i,15804144174321914506,4959274989652288230,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7072 /prefetch:1
  2⤵
  PID:5168
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6720,i,11806480153252461016,15114432304228897741,524288 --field-trial-handle=1904,i,15804144174321914506,4959274989652288230,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6776 /prefetch:14
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:5980

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1616

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5720

C:\Users\Admin\Downloads\SteamSetup.exe
"C:\Users\Admin\Downloads\SteamSetup.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:5712
- C:\Program Files (x86)\Steam\bin\steamservice.exe
  "C:\Program Files (x86)\Steam\bin\steamservice.exe" /Install
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:5744

C:\Program Files (x86)\Common Files\Steam\steamservice.exe
"C:\Program Files (x86)\Common Files\Steam\steamservice.exe" /RunAsService
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Access Token Manipulation: Create Process with Token
- System Location Discovery: System Language Discovery
PID:5840

C:\Program Files (x86)\Steam\Steam.exe
"C:\Program Files (x86)\Steam\steam.exe" -silent
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Modifies trusted root certificate store through registry
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies system certificate store
PID:5888

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Phishing

T1566

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Access Token Manipulation

T1134

Create Process with Token

T1134.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Access Token Manipulation

T1134

Create Process with Token

T1134.002

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Steam.exe

Path C:\Program Files (x86)\Steam\Steam.exe
Size 4.2MB
SHA256 12222b0908eb69581985f7e04aa6240e928fb08aa5a3ec36acae3440633c9eb1
MD5 33bcb1c8975a4063a134a72803e0ca16
SHA1 ed7a4e6e66511bb8b3e32cbfb5557ebcb4082b65
SHA512 13f3a7d6215bb4837ea0a1a9c5ba06a985e0c80979c25cfb526a390d71a15d1737c0290a899f4705c2749982c9f6c9007c1751fef1a97b12db529b2f33c97b49
SSDEEP 98304:7JeV/ztZBe91oiImuUiK9N9EGQKF9lSHbr7aw:1S/hwkmg4EpbrOw
TLSH
T1C516BF62BB41C071F9C201B964BE9F7A497DAE204775C0D397D43E6A88311D32B3A79B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SteamService.exe

Path C:\Program Files (x86)\Steam\bin\SteamService.exe
Size 2.5MB
SHA256 ce177dc8cf42513ff819c7b8597c7be290f9e98632a34ecd868dc76003421f0d
MD5 ba0ea9249da4ab8f62432617489ae5a6
SHA1 d8873c5dcb6e128c39cf0c423b502821343659a7
SHA512 52958d55b03e1ddc69afc2f1a02f7813199e4b3bf114514c438ab4d10d5ca83b865ba6090550951c0a43b666c6728304009572212444a27a3f5184663f4b0b8b
SSDEEP 49152:G+v+Y6iR3Gdcw/9I4AEZvvxYtP6iJ6aFmDJRicyM/wHH1sc:G+v+YbGiwV9AEZvW0iJRma
TLSH
T14FC5AE12FA4248BDE9D21578E2EF537B4A396E101335C8C787D03F5568326D2BA3E399
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 853428debdbb1b82cf592b6c9e5f1cfe56fdc84f2e033bfb4c031b99f7b4cf12
MD5 c4137b900dee57aee070532d5c7cb72d
SHA1 b8e67d2385574e36f564386dcfdb022ab1ddaa1a
SHA512 5ff6e0072a6957a5c3ecb607ee3c5025954ceca690df08da4d00ff5fb72cb81f14135bbe43fc7ba80a22207bdd9b3ca0472d682ac3ef158371c41e8454f843b3
TLSH
T1A8E02BBBCA219C2B1CFC075865454A46DA1003672B504D0F3A3D51098FF16364585D5C
MD5 SHA1 SHA512 TLSH

Submit Download

f_00001a

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001a
Size 69KB
SHA256 d6c14b74da370a3b2e70ef6570ca3d3041da81b583a8850c79fe42a915c56ca2
MD5 08110de41d1874c5b82549e466856b9a
SHA1 dc4c53561e296862a1a9d39a13abc71169fbc802
SHA512 27b8ba9929ad87d3dbb974343849640f33f7fa7f8a5bca0ee88568c19d6cb793dfdf571de3b6ed7bb33ca49bc7d14db62c86e940f8d505668edf03d83d282823
SSDEEP 1536:AYM2Phc8T9zeTbD4CGgMdH4AK9CI6OhieAIy0dwL2ou+NX:JM2Phxh+X4DmAg6OYeAhAw9X
TLSH
T13763129DC907D98BA8C1C0609B0B6987DCC6A1D347D2FC3310E53D45FA9278AAF8579E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00002a

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00002a
Size 16KB
SHA256 d1cb2a032c1bb6a96c22b5f16c6256db453f17c8bdfc40f0a97629848ea3b5db
MD5 19ab93d9b448ab4a9747389a1b5cc5a1
SHA1 4409552d0a5a1138e52cb54ecefa44dfff7328e1
SHA512 2d5512cb0691333bb30d54cf4115fc15e7fa899e1373650f7bd3d659771c5f3e152b3bdeb556de1015783064b6790da6f6c640cc8a9204793e1eef4a8ef814df
SSDEEP 384:WWuB124Y3oFuUKyTnPP8Yf/42Mwwwm2zq59a1z4na2Y5acpj3tRn5p:WWg24Y48Idn4jws2zq59uitsznD
TLSH
T16572C0448BC5FC192B6B827010B3FDAA0EAF62D1471904F98B88D70D788A269F2475E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00002c

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00002c
Size 37KB
SHA256 1d9eaa4f5a945ecf13e5764a334ef5a9cea97526f08bd553bc389d25dc4ab44f
MD5 b46f795734798daeb30b06e18551778a
SHA1 4a8a87269e59bb9783c6c85a3e22971d8ad1ecbb
SHA512 6e85a2c927bedf51244f42cb499e6359f976becf8e878466e960a014743e11b523bea9b75680ebc5ed156ea19b1b81418a56310eaff70d6f1ace834abcda2452
SSDEEP 768:mX/5gplcXMolY0gJEGShCT8UvSCTawTUxb3TKAcAJpuWF:SGplR0YuGZvXsvK75u
TLSH
T1E003E0E2DD16D53B721F8CD5200B92B4EBCCCEE40AEC64A58A17EC611A09D71A477CCE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 22cfdc4b0b5601c966ee4cdd3674025a5412eac538a7e4df7fd293da73a6f108
MD5 e3e2cc4b539dfc92d99642cf5a5874c6
SHA1 c03964dee0154b3f5c76c56c27d678dacd027b19
SHA512 f81bca1f29c325592e8b81de987e5f991442085864aadc7323725207683308d96e7d0c6a48f440ce068b0a818255e00ff7005da3fec1041ceca43282b4b78ea0
TLSH
T1CD41FF3968873419FFDC3FB816CB8EF097307267030A27490457DA5626332B33A9D455
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 3eaf4258c063100621037ea84adfc8261073aca415fd1ccacd6b8deedee4d534
MD5 f1a0cd38463ce8f0a18d257cb8c1a5b0
SHA1 6f72463633c6cd9f26cc8a30c452ce57109e479c
SHA512 2cf297394ea3b6366f034ce8336843d21322c0a579d971965b0bea5a35de8efdb4134c5456039d8faac53f9f551ac1287fb3605ce80956818690a294fdaba6b3
TLSH
T18D71FE1864E73839FF682EB811974DE89B77769A0308670B044BD51192A3FF2254E895
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\File System\Origins\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 14KB
SHA256 14d1f8fc00e6621089d809badfeec8c9cc225cc8a432b6b2666a3986c87b8e8d
MD5 6efc84fc9f4ccb0985f780ee9cfc00fd
SHA1 375122daf605a21be7e665cf7ba1b17297051e53
SHA512 1eafbc33875bfbcc011d7133a6486c51a2207c49b911d60bdf4042e8c2a78fb0527c23d7e7598a7059ce1948b245906305bd14903f32d74c8e72e51ec5b69ebe
SSDEEP 384:D5IP3rbJ7mX9Jgxiejrjk/xueHaIadhiGiOIhICaaPnnu+InmKfMwZNLC1qDrGAl:YU56Imn1RN
TLSH
T15C62B0F7C3E8863EC95152F4AB256E1FCE1E0A24431C3D26C8D9AF4B93E1471E255A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 71c529e19537c692a0d80724d7a8710f8dc11915e3b7bcb92cbe19da8ef30dbc
MD5 65eef83020097b314cad4c1fdc953fa6
SHA1 cd1a2d39171edcbfa7c4052ab67caf43a0b17a67
SHA512 96873d68decfa89fed1d51f00efa28245b77f1ac1684c9f173df17e0aefc0a697ee3f303ae7ce440a33ddec2610a16c130475a0377eecbf8a8603630afa71096
SSDEEP 192:cRncBzh1xE05Oufe8v7sBpAPRp2a9a9NHsb+WNnKa4yS25reG1sX2GNaBv+VyIsH:cRnmz3PEBo8UXArwL42rsX2Gi28
TLSH
T10D52E72FAA21A9775CDBC219F9227717E7F1202275D42D84EAFC8A2C15E79CC321740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 42fa896ad16f38f656d6ed0e4e2f54cf482f172123c6920174e4a8b2d20f6de2
MD5 22792e238fef267fbe5f2d0d8f51af60
SHA1 0986b11cd7af457672af862397c454101009edce
SHA512 0310dfb2b7fc8c142606b38046a3ff4eb749eb067f82b80dbfd1ec01177c27e59e87ce22e4e124f9c7a9e677cac81c9c20027f5616c97409e0f6dcc8e950b136
SSDEEP 192:TRIcBzO1xE05Ouf0I8v7BjBpkPRpCuZhxh4WyA9NHsb+WNmAul/EML47AENGreGj:TRImzaPEtIorwXRrwY/zDENisX2GW2e
TLSH
T15762D75FA52099775CDBD269F912B767E7F1202275D02D84EAFC8A1C15E7ACC321340B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 4eeadd1fec4fb2f89807476100a5ded5cd9a5cd4e6652f78e00a8c5bd62ee1be
MD5 0d06015a2086d10a59e6aedb5d816fcb
SHA1 1e21d8bbf993de028817bcb33cd2b0970afbbf34
SHA512 9f4f6f024434e18353839c18a3faba6bf6cd4eb145f605a2a762d5a9b289211b37d2a119979068a897d30e330eada7af5af9a7929901eb81a2c19fe94f37e045
SSDEEP 192:TRncBzO1xE05Ouf0I8v7BjBpkPRpCuZhxh4WyA9NHsb+WNmAulB7AEoGreG1sX2x:TRnmzaPEtIorwXRrwYGEoisX2GW2e
TLSH
T13762D66FA52099775CDBC269F912BB67E7F1202275D02D84EAFC8A1C15E7ACC321740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 19efc1da338b4eeebff0e31478ebef4105b832775c95d3ed24a9c62b61f8212f
MD5 5f4578fa2b06148002f9b72f955707d1
SHA1 f15dedfb7f1718794c2a5af1145ceca015da781f
SHA512 143ae63074e49b6e431f6cf55a32d1e536a340a216ef43594650cc9157298b3bd1bae2f142a11053b5dd0cb50817b47241b30547de5377d0deefad6d10ef1e56
SSDEEP 192:TRncBzx1xE05Ouf0K8v7BjBpkPRpCuZhxhhyA9NHsb+WNVsulB7AEoGreG1sX2Gw:TRnmznPEtKorwXBrwRGEoisX2GW2e
TLSH
T10162D61FA92099775CDBC269F912BB67E7F1202275D02D84EAFC8A1C15E7ACD321740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 9e2333f5c82b38c9644ded2454e5a7317e235c9057167a3c307754ff160bc9e1
MD5 f3a4d0632fa389c0ade9ff4ef6211867
SHA1 63e489d97faa9b80b5ab47ae1739c86739ba33ad
SHA512 48061d3f59961136419369657e4638e3c29e5f6f16409d194e5c0eb8d2d027614c6d7726f7dd7c1148c42bfb95116cbdc5059d0b85cfa536adc1c370b33927c2
SSDEEP 192:cRncBhh1xE05Oufe8v7sBpAPRp2a6V9NHsb+WNnKa4zDeYreG1sX2GNaBv+VyIsH:cRnmh3PEBo8UX+rwLYewsX2Gi28
TLSH
T15052D62FE921A9775CDBD21AF9227717E7F1202275D42D84EAFC8A2C15E79CC221740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 ceb03f9d31bf40bfd7b76245e88a68cd8a2a354e8523064db98606b0cf0c60a0
MD5 00f20f351017a291d3d2f848e6ed88ce
SHA1 f899e5d316314bd3866abe8f4a09e8374773b915
SHA512 42dce00011024b94391355a7b16c341ab4701a7c932457ec92eadf70edb2b6261a2138b4c79bde70f94e23dd156399e03ecf84fecd06c71840108bc7431a6a10
SSDEEP 192:cRIcBhx1xE05Oufe8v7BjBpAPRp2uZhx6nyA9NHsb+WNVsKa4zDeMNreG1sX2GNA:cRImhnPEBorUXgrwWYeMnsX2Gg2e
TLSH
T10452E62FE521A9775CDBD219F912B727E7F1202275D42D80EAFC8A1C15E7ACC221740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 0d2a156654c1c543f684a1b78fc1acde7a605db8760d180da55c6029bd11d4cc
MD5 fca0a080e03e1f9f1f1ec2f425ee2b0e
SHA1 04435d408b3c935d0c54889e9019a986e7e3d26e
SHA512 0133469141ee35d9bb385a53718d74af5f96fe7ea3c4d774df026da6bbcd201abccd4b10b8b4bb6f9e60e57cecfd324ba1f320a5bc5ef4bba05fdb56deff9ffe
SSDEEP 384:7tjtw7KxkXqKf/pUZNCgVLH2HfgslsD7pLuLcSj5EXODtw+ErU3U2HG4B6T6:7ttw7KxkXqKf/pUZNCgVLH2HfgsiD7pa
TLSH
T14572F9A76C4C8E770F94CACCDC16BB4FADB5024B65E9886487FA581903D5BCB110A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 a2532757faceb40fc1873dede948a865df6a15f8d8231c5589ef45aa5aa8dccf
MD5 197314d2723a8c49a2ae2d17792085a9
SHA1 d88deb3034e734c9bbeff34e9702111225ad2b1f
SHA512 289526d92af56c87a3442501f15c6843a230310cb43733e3fe3baf926ffde0f66787a6ab49c66030768d86c35aab7f8874655523dad3fac875bdd7cac2fcc25b
TLSH
T1C6B0121890015142C04302B017875488B1389F109F0A770183E16D23D826161C0141D0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe591718.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe591718.TMP
Size 96B
SHA256 b5c4226e55341bc02a93ec8443617bcb09df62f202e4b894ba3446757d4fa5d5
MD5 5b3d9ffffeea45ece537228728215e5c
SHA1 0dfbfb5980f24832ae7a61405b443764359fca6c
SHA512 cca572939b7e79ed688f2685e21267ad58642f9ad56628047e012e66aeb4f6c8e9919f6ae5f66ae469fd3df8302b735dfc2e771171afbd9ebe292decb373af68
TLSH
T16DB00266C1026253C04303F43DD695EC7170EF65CA03221292E11E6BDC3567285351A0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 e0780936001065fe3f8527d31206cd51a362350fa713baedb86b84e329fab6dd
MD5 d2f4454487bc5fcb58a2aaa94487df91
SHA1 2abe4f035e115c916998a6308a1b93ffae6c26b8
SHA512 8d4bbf4fe5b65e283195c6f620c3fc757b2629e3577edccf5dbaa9d0c4307c77f3e01330a312573a771b0830984f0f4c0bc2173df49e2ba9650911822cca907f
TLSH
T10DA0026802C05846C8115A7013C346C4A3704C1017C1821756D1818AD89A746C959F04
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\CacheStorage\index.txt
Size 150B
SHA256 67c58029510a7060680fde1ec7465c9afa858fcd9b3858e17f19aad2dd3b6181
MD5 9d0bebe49d4238ebc58051e8a306daf3
SHA1 6ec7d267153d1918bdec3ed0de98484bec74f0e1
SHA512 25a4406e3953af387d0dd2449ddb48ee745b92d4b404648d6058b995ecdf1a8395220c3feea0f5efebfa0764e7c52c898ec9693029e398148f194961c69069cb
TLSH
T109C09BF31860CA9F4E34D9DA115C762DD91B418C4CC4CCECA405514A357CE7B5902EB8
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe597517.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\CacheStorage\index.txt~RFe597517.TMP
Size 157B
SHA256 f4d157860ae46acb6c7a7b355af39ffa2bfadd723eb50e5064d75591755426e6
MD5 16766ff5b80ab238506c7e3abce1009a
SHA1 3c895c1e03750c0c71dff9176cf12d81c4749ed5
SHA512 02476a5a8cad3c8ded00a9fe8b5d135384b727104c1376e415e40ff39573ee5be3e076ff26f46e96ef114df01f701c8aa40346dcb395526ac4d86813810e752d
TLSH
T13DC04CE359208A9F4B3095D65168765DD95B4D8C4CC4CCE8A406B10A3578E7B5901D78
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 276KB
SHA256 a40a0343398d5ddf4a836e854d7e81b1e63f03f19e864e4c83dd446fd6a10f4d
MD5 6b386deb3de1fe6a9ce3261515ad11f6
SHA1 31637d23e8b5b6428225ad5bda4d578b3b574cd5
SHA512 6459b969b44eb612524f8163ce9a11ef098236017f159c7e1e233756104e244b66497d2f94c11df5c09c949df82ad8e5c1adfe73ef3ffdd98099e565bb1d4afd
SSDEEP 6144:Gh+GAgZGLOz3nTyxtY0GTjVum7Rkm1tYpBeh2BAof:8xAgZ2xtwpp9oBGcAof
TLSH
T1565423331E767D794DA9271D700E292F1EF26D938C10F9A6DD905F4483EABE60B13A60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 b6839a8af8fecd17a8bdac3444cf942fc4c9d20edc025e76a365c0348e8aa9cc
MD5 2538e2ab173541860fdfd3aec158e394
SHA1 240a5a43933bd4da7226f3191e21d1771a799b4e
SHA512 e6aec405d18a19407bb2ce7774b92b164af784df26e415727cdbd126321cec573a239bd3ba6cbcc434daedb177882360e256600314391a2f3644b60262cf9d10
SSDEEP 3072:3Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrMe:2m7Rkm1tYpBeh2BAoe
TLSH
T14BC3123B5E75A9775DB5AB0EB08E0B1F1EF14EA6C920DE82C8D85B0427E97CC0A44934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 235KB
SHA256 9b0fe9865a712da0a4337b21c9f269952434496093e551f05e2c78040d405d44
MD5 e099b64fb3584e9facef06e48dff999c
SHA1 98fbd0dec84671330a702dcec47b37f99900e875
SHA512 8dcbcb940136b31f29d3138d1e91538a9335279626f771071b5a4349feb330710288096ab72ec430e9e132e5708919c7df1251806b7ab947224d7d08c3b29550
SSDEEP 6144:IgZGLOz3nTyxtY0GTjVum7Rkm1tYpBeh2BAof:IgZ2xtwpp9oBGcAof
TLSH
T1863422331F767EB44EA8776DB00D0A1F1EF10D62D910E5ABDCA15B4942DAFA40B46A38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 bf637ca0b28ebd6e948876848ccfe71d201158d460d4ad944f124f9d17ee5472
MD5 827e00d89fccbbde703c679b5c7ff536
SHA1 6d9e235782beb4e6b38fd4db2946f9bfc725110c
SHA512 1d18100db386f25678d8dabb492ab6e15d08e2c5a7d7e6c76bc253df648e2b5438cbc4fcb5a4033a1e14afbda93b271225eb5f545f12663d6bc35ca51239fcc3
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7X:fwUQC5VwBIiElEd2K57P7X
TLSH
T148B3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 45f521737e34108fcec0f24251f1736a9124dca7794b71ae2966e26d8a05fc0d
MD5 cd7793cdfb9295f447572efb6e70bf81
SHA1 dce217c94f7231f2559527c77b17604e0c11be61
SHA512 14938c84baa985800075d40695a2c29c097db067e02c4e847dadba963bcb208d88cf963091e96a6bfb0bf1ee245e50457f5f714cbd561eed42d6bcb9f59219f5
TLSH
T190D092317F5AB451DA46123A9841872A2DA5444A2AAB9207A261888DFDA50A8A3C60A6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b83d8b3b3bb64ff97dfd21017822c565c50fa4655623c882c9854229a2eb9fc0
MD5 2a1c26025a16af9770d1943aece12b07
SHA1 e99f200ab4b656082ea4283baf673ac37faaae9d
SHA512 c6a6b667c750c33f99946cd667b400c38692f5bf6c8cc28971c0ef5899c7166adba2ea6dda0f083bb68464d66d757a9fa633c1820e825946725f45a260f459cf
TLSH
T15BD09B313F5A7451DA451235584087162D554445155793079151444DED9509493C60A6
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000089

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000089
Size 32KB
SHA256 eff9dfe4ebe815c15fa6087a8b712ccacea7a59dddcb55a5c819293252d73c32
MD5 cba69340542e691fa9e4b30334a07507
SHA1 4af443e83868d3a18fc9ad853e58eaf39bb065f7
SHA512 4f8d78c0ae8e04e27dfbcef602d3d46cdefd8f01085cc549edd35805d775065c4f78b75da617adf5f8f699a9edf7fa69db7c267917e5f9cb967e59563f905227
SSDEEP 768:wOsAPzChBrMSp8DxHnpmf3ILP1KpbjtXPgYVkutZ:lsArKDqtO8KZtXPgYXtZ
TLSH
T17AE202DF0C15679A01C371AE6A7C6024EBB3E07B3035CA1B1E764CD250B6660E5DB8BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008a
Size 96KB
SHA256 11de5a5aa3d08f69e1db14ac9c5347b7d09b8ec8fa89a4dd48a53ac13bfc3af2
MD5 601873d8a87f7b6dc6d2be569d361b63
SHA1 90ddce036c5ac461fc0e2ad6d2549625f35fcad8
SHA512 8d0aa2ed004fd07ff6c8cf0b2f96bf2addadcc481e811d3070d206a2862ebd154f857021dc0186eff184667914b6e23239b3886e18521bbe109e9c70df09ea1e
SSDEEP 3072:TY9ViJr6dK5Zi9YhM9Dic9o4EKgg3Wn41QA2kCISlb5:EeV6dmIx9lSg3c4FCIgl
TLSH
T18DA3020ABF4FE1AE46B742548AB607CE7A906241D0369997871107CEB1F78FE5C183D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 222ab4ebbcfff43d7772135238d98f66be108f8372b507545ca6d832bf601459
MD5 0e4f9a76303817fc587901d78859aea9
SHA1 3b00b8806be3772cb70cad406af5c41512ea1f11
SHA512 f902e3b7040dbe007b29a35cd9849ce949981bcaa348d51627f6c0208738e137244bc0f8592d7d5d3c0e6c5e677ae27639cd6a353df61a52ce9d7821f4f887dc
SSDEEP 96:3DD/DQc0ede/RVsW/aAWHzS/0CM/7O/yS7eF/dDf:33/D2Ge/DB/9WHG/0CM/7O/XKF/dD
TLSH
T1F281A61441957E5BDF344A30E0D0A73E3E718068DE8FAE9A3445B4FD6616BC2E12DC78
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 7dc54c20e1302212deeffd071def7dfdbb5452f12dda9f304e32b375039b014e
MD5 0f04f278fb3b91e03ecc482e38c47ad5
SHA1 adcf2c24d7a775abfe2c644368fbbf44f7a6dbba
SHA512 40e20f630d0501bc7689e90c85496adc8310a6c77af12dc21a607435c169c000bfea29b4a2b7eb5af9e5102d0ef7afdf760afc1c836b00008b1e58bccca73b4a
SSDEEP 96:Th9Nkdp6UsTAiuvNM/t6IiU33va67oDM+25zjdpxfG8:N92p6NEieNM16IiUnn7o525zjdpVj
TLSH
T156C1841141A53A9BFF280A34A0D0AB3E7F71B1588B4B9E163013E5BC9A376F7E11D834
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58a88f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58a88f.TMP
Size 3KB
SHA256 33e463001a28be89903fb4a4039f2ec01f2e983412263ced864a0391bc8ff11d
MD5 866e5ced0fc99030416692caa2a7b330
SHA1 cad34185c582c422e6f2f3ae3223b4f0dcc2068c
SHA512 5d6a0710f336a96116b876bae80decc5ead2959946aefd894d50224000c914739a8b398a25ca447adfae1cb3035fcae710d08020da45d216a48de426e5853be5
TLSH
T1ED613F1502527E9BDB39033194D0A33E3DB181A89D9FDE86354878BD5616BD2E119834
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 b3e2f10d8572af12e7c7b0f7b4fa695ef7ab36b8753ab835427bdbac45e7bbae
MD5 bee936de4af52ba26f1b09853c0c45f0
SHA1 e2f9a7fba7bfbaaeabcdabed78459a5ab09635a8
SHA512 d7049c31a5b5032192039dcd94f1518faba7873ed7bd57ded8a9b2c3aaf2346e1aeb456f7c1cb8e21b36d9fde8c86bea72a7ffc97629ea77694835d9095e70cb
TLSH
T1C841BDF7C3E5866DCA1195F4AA146F1BCE1D0542536C3C0989E4AF4BA7F28A1E111A4F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 478fdfcecb43ea425be9a6e1e030d115385e3b8555bbb2b4ae16d128bfe959aa
MD5 5c59513b8c529154d9101291d034cdc7
SHA1 be4b9892e92e694e53d82108613b0fe840bf4d44
SHA512 a5d29ca9c180401ec5bc816fd942093594db610401dfd89901900ad4d8238d8f5be2a594ee53301a08c9736325cbfaec54a2ac998299e86d3bbf69b6ab835198
SSDEEP 192:sxZ2+RNyM/jK1Ml8MFa1/f6NsntTUHIdpy1/W6+WNGY0aHD/RmIgrJ:sxZZ3d8/fmstTN6/bG5p9
TLSH
T18642E912AA349977CCCBD309FA45BF53D6F95572E2900E44A9FCDA0C04E6AED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 db610442efe0516f227f1b4b2c109d098ba88a99b097ed189422b5f80d0e2125
MD5 2b092f676d7a43585561b7964ead48db
SHA1 2782e0d180be4b67e5e67986ab2d7b9e35356b3d
SHA512 9e6dc4c0f9160bcaa7e899fb3e5885aa17fb37f39efd52cdf1ff1e3effad3efe8ac94a4f35e5e62715f715383130446fbe0b0ada9f2bbc7ba90902c1ffd384b8
SSDEEP 192:sxZ2+RNyM/jK1Ml8UQDLa1/f6NsXtJzHy+byC6dp951/W6+WNBa5/Y0eHy/MmIgT:sxZZ3qP8/fms9JGxNh/b2/51T
TLSH
T1D162E716AA345937DCD7D219F945BF53D6F81463E2901E48AAFCCA0C04E6AED2217C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 8863763fba7337f9b5b8c8871ddf6a51198112d1a3f461743e9530bdf0a17af8
MD5 6b33985e07793c006ac0d4338fd9ef2f
SHA1 be94b6ccfd034a53be0504c52433a5218c34a94c
SHA512 c182eab097fc6c1bf78a09df5939b9f53df1579434de0280138d6a7f0e2db1be8d3b857f908aac6d7c3a5923db2a111b66b117e11d92456a3a66a8a8d1d608b5
SSDEEP 192:sxZ2+RNyM/jK1Ml8MLa1/f6NsXtTzH+wbyndpj11/W6+WNBa5/Y0eHcARmIg5FJ:sxZZ3D8/fms9TqTv/b2/5Td
TLSH
T1E562D716AA345977CCDBC209FA45BB53D6F85463E2901E44AAFCCA0C04E6BED2217C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 31KB
SHA256 847e4b8fecc8e7f636269691dba2d7d940f50109d0e18cb0e15915b21afebb83
MD5 daa8283c4ff942a04e98654c5a12ab3a
SHA1 a3722196ebd6dc76badf9a57461f7dd88ed40b9b
SHA512 d775c729488e900c49db16e25693e9e02543c3650b93617ae075ccd2997069149f143a54d582ecd667d5ada6b2d812edb91e8912c57e20a837afd01d062f5e14
SSDEEP 768:+J/zh8dF2PkWRmEcQXw8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3WjLl/2c0VFero/w:+J/zh8dF2PkWRmEcQXwu1jaKWjLp2tV0
TLSH
T10FE20A2F284CC77E4F844E9CEC266F976EE802CB66684D5447FA894C03C77DB521A49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\2925b63a-8c1f-4b6e-8f49-1b6375c2a060\index-dir\the-real-index
Size 1KB
SHA256 48a01d023d7d30042df302342dc65cd0a902ef60c2b9a49df540b6c8022daeb5
MD5 32556be477def766a4890527f253b65a
SHA1 9a586bf27d58916ed8eea8386695c10b2b590e92
SHA512 a3430f93f197ecada4825b63d8cca90c6c354cb0a77402778b41688fd2460c3afc6fb3ee9377ef59a0ccdc1b54a5d842e8c17717f2e0bfb78abcb171c2e44b59
TLSH
T12031638D9EA0C98FE4A481B21572B5A4777098CD0F15E3135C2C32327E63359364B4DC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\2925b63a-8c1f-4b6e-8f49-1b6375c2a060\index-dir\the-real-index
Size 3KB
SHA256 19d2bed2d8cbc2c7dd012509af6bcb7b3b9db4d2fd16bdbcd923bad8e48f969b
MD5 a986856874bf69e9bbf354cc1ed00360
SHA1 bc9a988a9af86574f9f848e2a63d3b1a29f216e1
SHA512 34a5a3d9302f742b7e6a8131407840271168693ded0ffdf740c29c147ab76049ba4a037eb59a659285a4cc9931fd2af8e60ec58a964f3aa0bef323f5fcc44c9b
TLSH
T1F451B55D4C83670AEC6C667364F604483B39B8EC69888A1371BC9539AC8773A19A979C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe585743.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\2925b63a-8c1f-4b6e-8f49-1b6375c2a060\index-dir\the-real-index~RFe585743.TMP
Size 1KB
SHA256 0c307208a58fb6c9f45012d1fa5a8b91bc9c10449dad8e226595f1f764638f58
MD5 4c72965028e9e01df38fbbcc0e1c1ef0
SHA1 c584a0bf20d7b0002b547c2d7b726901042d6f70
SHA512 b91f44c8516c36b42e87740d97735f9996423760b33a3dff9b4b40a6c584a0a0ef83ea7dbef1b737de7114032497e1b46ce29d9cee6287289b3c67e2b7ad2a9a
TLSH
T11431328A4AD18D0FF8D4517B0E63B8B8733588404311B393A97C623A9D65B8D2E5F0DD
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\45a03993-1152-45b7-83ca-ba4317a4901c\index-dir\the-real-index
Size 72B
SHA256 e2663e2578db6745623e448cb78ac0bd8088b7bab96b74fb1d961686e521fa50
MD5 76a55aa482e89bd404124d9ee7b7c626
SHA1 fdda8eb6c0d9f0ca9fba7c1c1a25af2e78e38d75
SHA512 46d2bd01a427461d26670f2550c10a77156b23de638164d9c9eac1fe49cac5f2668d6b50d3e6d43fdb72c50ecfe7ba6a826c64706ed53db621848cc7256ac904
TLSH
T130A0026803913101E08212B229D61169727069A07A0113294291009CCCE0FD69A8204C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\45a03993-1152-45b7-83ca-ba4317a4901c\index-dir\the-real-index
Size 72B
SHA256 d6cf86fd9eb34721764ed4b04fc05b21f22e10de0370f8097122076be0bd34e9
MD5 011e3cd3a42c01e243e81c52d393e531
SHA1 0d2769c6e71b51e3d7f52cf03fa2156022a7c42f
SHA512 42f604897c1394643720d95b60aa4c54377e067db39384bbae796266445d342be1deb8568d888f013533ccbe0edab8ac5f5569a2c8881f0ec57a33788852a325
TLSH
T188A00210CF901106C05625B2175383C21301CC911B00132740911048CD608414E5110C
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 7f87e5c41150ef85164fff4fa6a6f945c55f12902e8455aff6bc26c5db2fbcce
MD5 9b813a5f85a409630f28f3fb61b55d92
SHA1 8a68c8ece5a7abae43fc9624a406edc81b245287
SHA512 d864541cc796f9ef31133231f5e7094249a75fc2e02b21e8497d6da36bc0d62627d81551a21be6cb2ec11b612af59a0285fd470a4e95c805324945d856fd94ce
TLSH
T193E0C0B71DE72400FE3F9BD4107340D24602741CC9D0AC0E94A9B3D360A0319344FC12
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt.tmp
Size 371B
SHA256 6959c50e7d6b3aea7639717c67c0affd48ecdc418119e3e60f17bac499428427
MD5 bc85ffc50dc56b76adced8ddcee61ca1
SHA1 6e769e5f283c972609fbd9b98e0cbf735b0ca14c
SHA512 8e0fcf93d17e694111fe7f75606cf79fbe4598c15ad8c14ee45d8069a362d49956fad60558acbaf7d2f0957b94c12efa2043bfa9bfe4b32f91c69bff7326eea1
TLSH
T12DE020B72DE72414FD7FABD5507641E24602745CC994FC4E54A9B3D360B1355344FC52
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 3dba62a1a537dc229df99756d633b0275b0f06b8622720b2e28d25fbfb1fb385
MD5 f65ebabd9840f54640efd07cd69aa6a9
SHA1 fd49011a3bfc7cceb0ad4e7235a37f884029b430
SHA512 a24d553502802e4b1ca5bfcfe595f2806fb28c265d1c51ee703ceb9bc2bc30bbdaf69a27ed5d45b6130827e271916393a6c7f3f3ce051b14c1a058292ca2a0c9
TLSH
T1EEA002D1826B0841F00142B5B05A0384B260DD114E46621FC2E69164FC671624133045
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe593147.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe593147.TMP
Size 48B
SHA256 8b865c2ab567aced13d80d07663736bb7490a46b9b32b18af911e1cae1caf894
MD5 253861e1770c9bf6d68a1595130d673a
SHA1 dae64454241f944b1f3936a059f7dbc52db0d25c
SHA512 ae66c413790549b7dc3e2f4cbe41ade85154a354affc81d1a3a517a0fa874bab09c794b8f119b552adc27b249b52324350d73f51fd244e0a25fd8824e1c547a2
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 b191bba97eaa3871fbcd18066f7a809d416daf5c05ba19aab0eb6330540ce6c6
MD5 d73e6d07c10cd876efd7fed2e6901a6b
SHA1 8ea2738b0c4718b3e28a61cd3b8a023815740c31
SHA512 c5edae937d8714d70c362e885f88c218c5de49847a9ac44885b41035894c495fb1ee5e1bc1db7c3b0db6b87b7a7bb5d33bb2d978a2c2301f65e8b7b335afc30c
SSDEEP 48:KEWIHKvDAIfK12cryReIvKfK07yn32jXltt+X9UlIS3+KNLVB+5fucsxtDY/zVZD:KEWgKvDAgK12ayeYKfKKSsgKxmb
TLSH
T12AB14D5231FA06423D3D2B0DA6A4975BBA41B1633255B92B77E801B20E2BE305DFDCCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e7f4dde6-b06d-4250-aeaa-dcfba38f1371.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\e7f4dde6-b06d-4250-aeaa-dcfba38f1371.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 fe38a5400a78320398703ab5f80da94cc374e28bb38940080f8c8fe44ae624de
MD5 5f6711bdeeaa273ac2ed1a8f1375c547
SHA1 e07c2aa29f80f2bbf678a126a28c33ca46dde3d0
SHA512 cf13d7783775006a4abe7c09c0750180c07be15157cdf5e5bf01cad0d2f0a3925223981488ae5913a254cc6528946c1c71fc1b8117404f871b491528ff208ab8
SSDEEP 192:uHK8Nf0fQkoEw12U7QvQmiU1LjiW4nv0W4vS6HtlzYsqE0U8:t8Nf0fnoEw0u85u5ns3vum0U8
TLSH
T186422B766C745C7A4DA3A140B48632139FB8506BEB893F84D9DD6F0C00DF59C634A92B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 3ac01e1da27b2bc89c32920a4d644d8d99f2341f88fa8b7a6991571e27d00ab5
MD5 c2172c804e548eef7459616c05058a83
SHA1 7d894e424768a82b9d8ebdceda71febe2a881fae
SHA512 803671455780573d0d510b51eb4de14a39840db796396ab50301c833a2fbb6e69bb4dc0e2f1fb2c4ec566f65317c1453524de407e119f8bc9ee0e39406901319
SSDEEP 384:NiFctNn/s3n9Su8NB8TUNTUlIlVTjoEw0ui5wC2ns3vTm0mn15wbAjEVH:EFcj+9H4wgBw0CCKsrm0mn12bfVH
TLSH
T107A27C375C688D3B5DA39A84F94A32079FF840B7D6853A90D6DC5E4D00EF6DC230AD29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 b09d7362312d899a33e3ebd2a2eadffd1dc4022542e696c588b40deab3fc32ac
MD5 9b09d5f713899f22e0006bc5d28232d6
SHA1 bad9e9b9b530d614ffe96dc36018bf8173c9c487
SHA512 80cd49010e6fb772200ec18b3113ff38a186a21107d48597bed713c6469c1fdbff47981a86e19b4b66a3d4cec1d8cfd68e74ba086995216a51d817be319896ee
SSDEEP 384:2tNn/s3n9Sz8NfVTjoEw0ui5pC2ns3vum0mn15wbAjEVH:2j+9oMw0vCKsGm0mn12bfVH
TLSH
T16D927C365C794D361DE39548B446320B5FB890ABE7C83E44C9EC5F4D01EF69C231AE2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 e8ab2557d2b811345cd0965800e6b851bad1600fd954026b81f2cd5f18965de8
MD5 bd8f6e632f6b4a51d0c8158eb48ff38e
SHA1 43eb12e87a31233ca43b981a48d106f6037842bc
SHA512 fff122c11ff906718eb3d10ef6b284123a4650aedc9e05ea7986e0d460079b71e484a298eb5320f1342c21dc70409e3c4fa98c0c80499421d768542286e8e424
SSDEEP 192:uHC8NfYVfTskoEw12U7QdQmiU1LCiC8Bnv0W4vS6HtlzYsqE0U8:D8NfwfTjoEw0ui5pC2ns3vum0U8
TLSH
T1A5421B766C745C7A4DA3A144B48632139FB85067EB893F84DAED6F0C00DF69C634B92A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 524c5dc6aa456b0bc5a2b216c85e69cf680d7d08b1609e9a96bf293e326d3e66
MD5 bb971f3c3ca8545186d0f5d7ea52783a
SHA1 e9ae08084db24d46d1dd1849284cb25e829ae447
SHA512 3cbd4beb8679f549eb2dae1101716a384138acee18fe275c9c15e21d5d9f1e3751aa1fc8966c86b45510b497578d994709359bddb730ed0035b65149dfa8a142
SSDEEP 96:8bqGNkzQsjpfN2dYXOR95ih/cIPURHl8h4otop501ISDtBYP6vVjhLcgz00rg6M8:BGNz6P2UOcQmiUysIUzqGv0W4zwSvyU6
TLSH
T1C002FA796C786CBB8EB2AE45B98737135FE8107BDA952B40D9E41F1C00DBA4C3346936
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 ad1d8f04fe18c50bc342a99f96bc38e23d70923347a02f6c9c4454b1d8733616
MD5 fb7235fb0b2afafac536a414ba531ffe
SHA1 f572e8a936b320b8661ebe6b34d11dd9e24d55eb
SHA512 0812f45926bb387bd75907bdd1361668c547055ad3aebde73249a82790467b4fb58c16833995effba00dbfbf9184cf75c9af72e3ea304362f3bfbd41a87d443b
SSDEEP 192:TGN66P2UXQmiUywEz7Gv0W4vS6Htg0BsqE0U6:TGN66eS5A7Gs3vVm0U6
TLSH
T164120B766C785C7B4EA3A540B48632135FB8516BEB897B40D9DC2F1C01DF99C234A927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7c53c6a6-38a9-4ee7-bf39-c7bc8b24e5ce.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\7c53c6a6-38a9-4ee7-bf39-c7bc8b24e5ce.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

SearchHoverUnifiedTileModelCache.dat

Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat
Size 22KB
SHA256 0e798bf483c11301bb376fcf5f4ab7f26b60819dc4786067d2a9004a46df9581
MD5 685f6a20e2fdaf575dc70665b9546d29
SHA1 8b717d10035c79f35fc64e0bfa4e5a6f872766b8
SHA512 ddab76b440ae99d55775e72ea86ae579c2533d1d5773f3eedc51c329a4df11b8da26c4cf7680826d77e3f4e9b54939c815f3e613513eff169b5e907ed6b4e2f0
SSDEEP 384:4JWJRVca12krtuVm+3glBOVjeQ8RJo1gtghcjUudW05P4m5b+GDa50DKaYAV6cqQ:0+RVcWr8l8RJqsg2jUuddhb+GDa50DKg
TLSH
T1F7A24C743AF51719F3F29F749AF1A95A643AB866AC00DB4D0162028D0977D92CDB0F3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsk3442.tmp\System.dll
Size 22KB
SHA256 fa367ae36bfbe7c989c24c7abbb13482fc20bc35e7812dc377aa1c281ee14cc0
MD5 a36fbe922ffac9cd85a845d7a813f391
SHA1 f656a613a723cc1b449034d73551b4fcdf0dcf1a
SHA512 1d1b95a285536ddc2a89a9b3be4bb5151b1d4c018ea8e521de838498f62e8f29bb7b3b0250df73e327e8e65e2c80b4a2d9a781276bf2a51d10e7099bacb2e50b
SSDEEP 384:V8QIl975eXqlWBrz7YLOlE/NyQH38E9VF6IYinAM+oZ5a1TN:VgPgrfYLO+rMEpYinAMxZG
TLSH
T198B29D6346105CB2DD478834B4C9B936AF7536439AE0CAD39396C1119F607C37EBC267
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

modern-wizard.bmp

Path C:\Users\Admin\AppData\Local\Temp\nsk3442.tmp\modern-wizard.bmp
Size 150KB
SHA256 16e0edc9f47e6e95a9bcad15adbdc46be774fbcd045dd526fc16fc38fdc8d49b
MD5 3614a4be6b610f1daf6c801574f161fe
SHA1 6edee98c0084a94caa1fe0124b4c19f42b4e7de6
SHA512 06e0eff28dfd9a428b31147b242f989ce3e92474a3f391ba62ac8d0d05f1a48f4cf82fd27171658acbd667eaffb94cb4e1baf17040dc3b6e8b27f39b843ca281
SSDEEP 48:ZQEM+jeAwtwVUoYxq+HQiNE/7o+f3cbqBtpozK8lHl/GGKOFHNPf33zFYsvwL:ZkWeftwV1enu/7ozCeu8RGGvP/jFYsv
TLSH
T1F8E3E9AEB933693ECD9911B41164A7FD8B306C5C7A40666E411FF8DC0FF31CA3569852
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsDialogs.dll

Path C:\Users\Admin\AppData\Local\Temp\nsk3442.tmp\nsDialogs.dll
Size 20KB
SHA256 91a484dc79be64dd11bf5acb62c893e57505fcd8809483aa92b04f10d81f9de0
MD5 4e5bc4458afa770636f2806ee0a1e999
SHA1 76dcc64af867526f776ab9225e7f4fe076487765
SHA512 b6f529073a943bddbcb30a57d62216c78fcc9a09424b51ac0824ebfb9cac6cae4211bda26522d6923bd228f244ed8c41656c38284c71867f65d425727dd70162
SSDEEP 384:ABSzm+t18pZ0WAg0RhIFgnGNyQH38E9VF6IYinAM+oZfNRoZk:NupZ/Ag0/T8MEpYinAMxZ7oW
TLSH
T11EA26CA385542C33CE874E3635D8653EDBB9731664808CC25326C24197A439B7FB83AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsExec.dll

Path C:\Users\Admin\AppData\Local\Temp\nsk3442.tmp\nsExec.dll
Size 17KB
SHA256 3e2399ae5ce16dd69f7e2c71d928cf54a1024afced8155f1fd663a3e123d9226
MD5 2095af18c696968208315d4328a2b7fe
SHA1 b1b0e70c03724b2941e92c5098cc1fc0f2b51568
SHA512 60105dfb1cd60b4048bd7b367969f36ed6bd29f92488ba8cfa862e31942fd529cbc58e8b0c738d91d8bef07c5902ce334e36c66eae1bfe104b44a159b5615ae5
SSDEEP 384:PbGgezxEqoyGgmkNFNyQH38E9VF6IYinAM+oZhc3iMy8:T31yGLkbMEpYinAMxZAy8
TLSH
T1DE826CB749802C66CD4F8D7039D4A83A5BB9BA531BE0C1D2535BC2518B917C2FFE82A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsProcess.dll

Path C:\Users\Admin\AppData\Local\Temp\nsk3442.tmp\nsProcess.dll
Size 15KB
SHA256 bb6ce83ddaad4f530a66a1048fac868dfc3b86f5e7b8e240d84d1633e385aee8
MD5 08072dc900ca0626e8c079b2c5bcfcf3
SHA1 35f2bfa0b1b2a65b9475fb91af31f7b02aee4e37
SHA512 8981da7f225eb78c414e9fb3c63af0c4daae4a78b4f3033df11cce43c3a22fdbf3853425fe3024f68c73d57ffb128cba4d0db63eda1402212d1c7e0ac022353c
SSDEEP 192:WUl64IGsjDNyQDbnPvy2sE9jBF6IYiYF8pA5K+oZ7W76OCwy9GUe:5ZsNyQH38E9VF6IYinAM+oZYsBe
TLSH
T1E0726BB38A582C21DE4B4D3171D4853AAEB9AA571AC0C1D3634BC1518BC1BC7BBF82F5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SteamSetup.exe

Path C:\Users\Admin\Downloads\SteamSetup.exe
Size 2.3MB
SHA256 7d3654531c32d941b8cae81c4137fc542172bfa9635f169cb392f245a0a12bcb
MD5 1b54b70beef8eb240db31718e8f7eb5d
SHA1 da5995070737ec655824c92622333c489eb6bce4
SHA512 fda935694d0652dab3f1017faaf95781a300b420739e0f9d46b53ce07d592a4cfa536524989e2fc9f83602d315259817638a89c4e27da709aada5d1360b717eb
SSDEEP 49152:UDP/q9MIX/crfcNVBaXp1m0zyVCMwBHgFzoZhRP8:kC9MI8Hm0GCjgFc3Rk
TLSH
T11FB533116FB8D076DAE20F71E0FA86F79536FC15962A4F4B3A807B2F7835110A5047B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SteamSetup.exe:Zone.Identifier

Path C:\Users\Admin\Downloads\SteamSetup.exe:Zone.Identifier
Size 147B
SHA256 51aaa7f351f7c389bb989a1ad21ff64ba36c34e70a6e0e94040b6b05de30c4f2
MD5 96cc35f9c335e5d36087e266e777167b
SHA1 287b2312525e0e481580796145dd09c36470de94
SHA512 df4834206f7e5f834b80997c95bef560745e2113dfb8b8477324d55ba1986ba774c325a09e2fb811d91960ca157a0bd284645ee638789ee7bb0442832ed0a2e4
TLSH
T116C08C9A440484380F4823D828DA855EB84E748A08985590F88163869C01260826D106
MD5 SHA1 SHA512 TLSH

Submit Download

undetek-v10.37.zip:Zone.Identifier

Path C:\Users\Admin\Downloads\undetek-v10.37.zip:Zone.Identifier
Size 136B
SHA256 cd817e06195874113bbc02596e824944e5eec77c4e0a7d5e070f27cc98ea49ce
MD5 116de2b931770d0da920d44b0872c17f
SHA1 13abd25483d9cfdc14f50cea4ec25fbae32160b0
SHA512 3e6029850c5e0d604eeee3c320b9520c6ba99b8ba95295a577f9eb0898635493d15e820dec02e90f36d9c2f10632d9a71097109f61d5c4d88ad8ed4298d40bc6
TLSH
T115C09BEF5410C2580B2426F00D5F601ED54F21160C52D5D0D51044BEFD94459957545B
MD5 SHA1 SHA512 TLSH

Submit Download