hijackloader | 9c8a46b954b8a6dbc29d5cf8aca14da6f5687e412dab1bd07881284edb8f3fe5

Analysis

max time kernel
149s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/07/2026, 17:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-01_568c3fbe165163c7f68ace84b2d39269_elex_wannacry.exe
Size 11.4MB
Sample260701-vn28faaz3q
SHA256 9c8a46b954b8a6dbc29d5cf8aca14da6f5687e412dab1bd07881284edb8f3fe5
MD5 568c3fbe165163c7f68ace84b2d39269
SHA1 2e0d15abfaf7f12ff47ea98404a70eb511502e2b
SHA512 80c418ba6804276d94d6df204472b95f68d68785852ce06d7cb5e9eb4a1d9031fec100273c931b04a84e14f9a3b6bfb8ac9fa05137e891a6a0e60fb4c8ee091f
SSDEEP 196608:+p8l7o2ou3wilvdIOpiOkTr1NSWsrvNv3pm8+jk2fSNYpimwgA:+pON3wilvfpidTZNcdMLS/+A
TLSH
T140C633423B191CF0CC64857A9F15D78A6BB2F39636411EC386FC4E796D83AD28A431DE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

credential_access discovery hijackloader loader spyware stealer

Malware Config

Extracted

Family

hijackloader

Attributes

directory
%APPDATA%\intterminal
inject_dll
%windir%\SysWOW64\input.dll

xor.hex

Signatures

Family: HijackLoader, IDAT loader, Ghostulse,
HijackLoader is a multi-stage loader, first seen in 2023.
loader hijackloader

Detects HijackLoader (aka IDAT Loader) 2 IoCs

resource	yara_rule
behavioral2/files/0x000e00000001c515-24.dat	family_hijackloader
behavioral2/files/0x000d00000001c52f-59.dat	family_hijackloader

Suspicious use of NtCreateProcessExOtherParentProcess 24 IoCs

description	pid	Process	procid_target
PID 4124 created 5708	4124	SynthGenerat.exe	99
PID 4124 created 4936	4124	SynthGenerat.exe	100
PID 4124 created 6448	4124	SynthGenerat.exe	101
PID 4124 created 4644	4124	SynthGenerat.exe	102
PID 4124 created 5152	4124	SynthGenerat.exe	103
PID 4124 created 564	4124	SynthGenerat.exe	105
PID 4124 created 440	4124	SynthGenerat.exe	106
PID 4124 created 3916	4124	SynthGenerat.exe	127
PID 4124 created 1968	4124	SynthGenerat.exe	126
PID 4124 created 5708	4124	SynthGenerat.exe	99
PID 4124 created 5708	4124	SynthGenerat.exe	99
PID 4124 created 4644	4124	SynthGenerat.exe	102
PID 4124 created 4644	4124	SynthGenerat.exe	102
PID 4124 created 4712	4124	SynthGenerat.exe	132
PID 4124 created 4900	4124	SynthGenerat.exe	133
PID 4124 created 924	4124	SynthGenerat.exe	134
PID 4124 created 1756	4124	SynthGenerat.exe	135
PID 4124 created 5444	4124	SynthGenerat.exe	136
PID 4124 created 1212	4124	SynthGenerat.exe	138
PID 4124 created 5080	4124	SynthGenerat.exe	139
PID 4124 created 4712	4124	SynthGenerat.exe	132
PID 4124 created 4712	4124	SynthGenerat.exe	132
PID 4124 created 924	4124	SynthGenerat.exe	134
PID 4124 created 924	4124	SynthGenerat.exe	134

Executes dropped EXE 3 IoCs

pid	Process
7148	Cac_Cluste64.exe
2196	Cac_Cluste64.exe
6760	Cac_Cluste64.exe

Loads dropped DLL 10 IoCs

pid	Process
7148	Cac_Cluste64.exe
7148	Cac_Cluste64.exe
2196	Cac_Cluste64.exe
2196	Cac_Cluste64.exe
6760	Cac_Cluste64.exe
6760	Cac_Cluste64.exe
720	RippleEx64.exe
4124	SynthGenerat.exe
1844	Crisp.exe
4508	Crisp.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
4124	SynthGenerat.exe

Suspicious use of SetThreadContext 9 IoCs

description	pid	Process	procid_target
PID 6760 set thread context of 720	6760	Cac_Cluste64.exe	92
PID 2196 set thread context of 4124	2196	Cac_Cluste64.exe	93
PID 6760 set thread context of 1844	6760	Cac_Cluste64.exe	94
PID 2196 set thread context of 4508	2196	Cac_Cluste64.exe	95
PID 720 set thread context of 5708	720	RippleEx64.exe	99
PID 720 set thread context of 4404	720	RippleEx64.exe	129
PID 720 set thread context of 5708	720	RippleEx64.exe	99
PID 720 set thread context of 5596	720	RippleEx64.exe	151
PID 720 set thread context of 2832	720	RippleEx64.exe	154

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\Lang\cs.txt	RippleEx64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\is.txt	RippleEx64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mn.txt	RippleEx64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mr.txt	RippleEx64.exe
File opened for modification	C:\Program Files\Java\jre-1.8\README.txt	RippleEx64.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\LyncBasic_Eula.txt	RippleEx64.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\en-US\about_TestDrive.help.txt	RippleEx64.exe
File opened for modification	C:\Program Files\7-Zip\History.txt	RippleEx64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\eu.txt	RippleEx64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hu.txt	RippleEx64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\yo.txt	RippleEx64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ba.txt	RippleEx64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\bn.txt	RippleEx64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sr-spl.txt	RippleEx64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\zh-cn.txt	RippleEx64.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jvisualvm.txt	RippleEx64.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\LyncVDI_Eula.txt	RippleEx64.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\COPYING.txt	RippleEx64.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\requests\README.txt	RippleEx64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nn.txt	RippleEx64.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientOSub_eula.txt	RippleEx64.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\en-US\about_Pester.help.txt	RippleEx64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kk.txt	RippleEx64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sq.txt	RippleEx64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\zh-tw.txt	RippleEx64.exe
File opened for modification	C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt	RippleEx64.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientVolumeLicense_eula.txt	RippleEx64.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\Xusage.txt	RippleEx64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\an.txt	RippleEx64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\gl.txt	RippleEx64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ka.txt	RippleEx64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tk.txt	RippleEx64.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientPreview_eula.txt	RippleEx64.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\en-US\about_should.help.txt	RippleEx64.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\jvm.hprof.txt	RippleEx64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\it.txt	RippleEx64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ja.txt	RippleEx64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ku.txt	RippleEx64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lij.txt	RippleEx64.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\AccessMessageDismissal.txt	RippleEx64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\be.txt	RippleEx64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fur.txt	RippleEx64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nb.txt	RippleEx64.exe
File opened for modification	C:\Program Files\7-Zip\License.txt	RippleEx64.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\THANKS.txt	RippleEx64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ca.txt	RippleEx64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tt.txt	RippleEx64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uk.txt	RippleEx64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uz-cyrl.txt	RippleEx64.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jmc.txt	RippleEx64.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Configuration\card_expiration_terms_dict.txt	RippleEx64.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Configuration\card_security_terms_dict.txt	RippleEx64.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\notice.txt	RippleEx64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ast.txt	RippleEx64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\el.txt	RippleEx64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\id.txt	RippleEx64.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSIPC\ThirdPartyNotices.txt	RippleEx64.exe
File opened for modification	C:\Program Files\Windows Defender\ThirdPartyNotices.txt	RippleEx64.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\Classification\NOTICE.txt	RippleEx64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\da.txt	RippleEx64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ga.txt	RippleEx64.exe
File opened for modification	C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt	RippleEx64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\az.txt	RippleEx64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kaa.txt	RippleEx64.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\IO_v6_arm_pro.job	Crisp.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Crisp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Crisp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RippleEx64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-01_568c3fbe165163c7f68ace84b2d39269_elex_wannacry.exe

System Time Discovery 1 TTPs 4 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4644	chrome.exe
924	msedge.exe
6968	msedge.exe
4332	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	SynthGenerat.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	SynthGenerat.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 11 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134273993930891284"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-759331733-200834466-1207319849-1000\{A38585EB-1309-414C-9E28-21A474932739}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-759331733-200834466-1207319849-1000\{37665AD9-C308-40A8-BB22-2F87E40915AF}	msedge.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
720	RippleEx64.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
7148	Cac_Cluste64.exe
2196	Cac_Cluste64.exe
2196	Cac_Cluste64.exe
6760	Cac_Cluste64.exe
6760	Cac_Cluste64.exe
6760	Cac_Cluste64.exe
6760	Cac_Cluste64.exe
2196	Cac_Cluste64.exe
2196	Cac_Cluste64.exe
4124	SynthGenerat.exe
4124	SynthGenerat.exe
4124	SynthGenerat.exe
4124	SynthGenerat.exe
4124	SynthGenerat.exe
4124	SynthGenerat.exe
720	RippleEx64.exe
720	RippleEx64.exe
1844	Crisp.exe
1844	Crisp.exe
1844	Crisp.exe
1844	Crisp.exe
1844	Crisp.exe
1844	Crisp.exe
1844	Crisp.exe
1844	Crisp.exe
720	RippleEx64.exe
720	RippleEx64.exe
4508	Crisp.exe
4508	Crisp.exe
4508	Crisp.exe
4508	Crisp.exe
4508	Crisp.exe
4508	Crisp.exe
4508	Crisp.exe
4508	Crisp.exe
720	RippleEx64.exe
720	RippleEx64.exe
720	RippleEx64.exe
720	RippleEx64.exe
720	RippleEx64.exe
720	RippleEx64.exe
5708	chrome.exe
5708	chrome.exe
720	RippleEx64.exe
720	RippleEx64.exe
720	RippleEx64.exe
720	RippleEx64.exe
720	RippleEx64.exe
720	RippleEx64.exe
720	RippleEx64.exe
720	RippleEx64.exe
720	RippleEx64.exe
720	RippleEx64.exe
720	RippleEx64.exe
720	RippleEx64.exe
4124	SynthGenerat.exe
4124	SynthGenerat.exe
4124	SynthGenerat.exe
4124	SynthGenerat.exe
4124	SynthGenerat.exe
4124	SynthGenerat.exe
4124	SynthGenerat.exe
4124	SynthGenerat.exe
4124	SynthGenerat.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
720	RippleEx64.exe

Suspicious behavior: MapViewOfSection 4 IoCs

pid	Process
6760	Cac_Cluste64.exe
2196	Cac_Cluste64.exe
6760	Cac_Cluste64.exe
2196	Cac_Cluste64.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs

pid	Process
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe
4712	msedge.exe
4712	msedge.exe
2832	msedge.exe
2832	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	720	RippleEx64.exe
Token: SeShutdownPrivilege	5708	chrome.exe
Token: SeCreatePagefilePrivilege	5708	chrome.exe
Token: SeShutdownPrivilege	5708	chrome.exe
Token: SeCreatePagefilePrivilege	5708	chrome.exe
Token: SeShutdownPrivilege	5708	chrome.exe
Token: SeCreatePagefilePrivilege	5708	chrome.exe
Token: SeShutdownPrivilege	5708	chrome.exe
Token: SeCreatePagefilePrivilege	5708	chrome.exe
Token: SeShutdownPrivilege	5708	chrome.exe
Token: SeCreatePagefilePrivilege	5708	chrome.exe
Token: SeShutdownPrivilege	5708	chrome.exe
Token: SeCreatePagefilePrivilege	5708	chrome.exe
Token: SeShutdownPrivilege	5708	chrome.exe
Token: SeCreatePagefilePrivilege	5708	chrome.exe
Token: SeShutdownPrivilege	5708	chrome.exe
Token: SeCreatePagefilePrivilege	5708	chrome.exe
Token: SeShutdownPrivilege	5708	chrome.exe
Token: SeCreatePagefilePrivilege	5708	chrome.exe
Token: SeShutdownPrivilege	5708	chrome.exe
Token: SeCreatePagefilePrivilege	5708	chrome.exe
Token: SeShutdownPrivilege	5708	chrome.exe
Token: SeCreatePagefilePrivilege	5708	chrome.exe
Token: SeShutdownPrivilege	5708	chrome.exe
Token: SeCreatePagefilePrivilege	5708	chrome.exe
Token: SeShutdownPrivilege	5708	chrome.exe
Token: SeCreatePagefilePrivilege	5708	chrome.exe
Token: SeShutdownPrivilege	5708	chrome.exe
Token: SeCreatePagefilePrivilege	5708	chrome.exe
Token: SeDebugPrivilege	4124	SynthGenerat.exe
Token: SeShutdownPrivilege	5708	chrome.exe
Token: SeCreatePagefilePrivilege	5708	chrome.exe
Token: SeShutdownPrivilege	5708	chrome.exe
Token: SeCreatePagefilePrivilege	5708	chrome.exe
Token: SeShutdownPrivilege	5708	chrome.exe
Token: SeCreatePagefilePrivilege	5708	chrome.exe
Token: SeShutdownPrivilege	5708	chrome.exe
Token: SeCreatePagefilePrivilege	5708	chrome.exe
Token: SeShutdownPrivilege	5708	chrome.exe
Token: SeCreatePagefilePrivilege	5708	chrome.exe
Token: SeShutdownPrivilege	5708	chrome.exe
Token: SeCreatePagefilePrivilege	5708	chrome.exe
Token: SeShutdownPrivilege	5708	chrome.exe
Token: SeCreatePagefilePrivilege	5708	chrome.exe
Token: SeShutdownPrivilege	5708	chrome.exe
Token: SeCreatePagefilePrivilege	5708	chrome.exe
Token: SeShutdownPrivilege	5708	chrome.exe
Token: SeCreatePagefilePrivilege	5708	chrome.exe
Token: SeShutdownPrivilege	5708	chrome.exe
Token: SeCreatePagefilePrivilege	5708	chrome.exe
Token: SeShutdownPrivilege	5708	chrome.exe
Token: SeCreatePagefilePrivilege	5708	chrome.exe
Token: SeDebugPrivilege	720	RippleEx64.exe
Token: SeDebugPrivilege	720	RippleEx64.exe
Token: SeShutdownPrivilege	5708	chrome.exe
Token: SeCreatePagefilePrivilege	5708	chrome.exe
Token: SeShutdownPrivilege	5708	chrome.exe
Token: SeCreatePagefilePrivilege	5708	chrome.exe
Token: SeShutdownPrivilege	5708	chrome.exe
Token: SeCreatePagefilePrivilege	5708	chrome.exe
Token: SeShutdownPrivilege	5708	chrome.exe
Token: SeCreatePagefilePrivilege	5708	chrome.exe
Token: SeShutdownPrivilege	5708	chrome.exe
Token: SeCreatePagefilePrivilege	5708	chrome.exe

Suspicious use of FindShellTrayWindow 36 IoCs

pid	Process
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe
4712	msedge.exe
2832	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5172 wrote to memory of 7148	5172	2026-07-01_568c3fbe165163c7f68ace84b2d39269_elex_wannacry.exe	89
PID 7148 wrote to memory of 2196	7148	Cac_Cluste64.exe	90
PID 2196 wrote to memory of 6760	2196	Cac_Cluste64.exe	91
PID 6760 wrote to memory of 720	6760	Cac_Cluste64.exe	92
PID 2196 wrote to memory of 4124	2196	Cac_Cluste64.exe	93
PID 6760 wrote to memory of 720	6760	Cac_Cluste64.exe	92
PID 2196 wrote to memory of 4124	2196	Cac_Cluste64.exe	93
PID 6760 wrote to memory of 1844	6760	Cac_Cluste64.exe	94
PID 2196 wrote to memory of 4508	2196	Cac_Cluste64.exe	95
PID 6760 wrote to memory of 1844	6760	Cac_Cluste64.exe	94
PID 2196 wrote to memory of 4508	2196	Cac_Cluste64.exe	95
PID 5708 wrote to memory of 4936	5708	chrome.exe	100
PID 5708 wrote to memory of 6448	5708	chrome.exe	101
PID 5708 wrote to memory of 6448	5708	chrome.exe	101
PID 5708 wrote to memory of 4644	5708	chrome.exe	102
PID 5708 wrote to memory of 5152	5708	chrome.exe	103
PID 5708 wrote to memory of 5152	5708	chrome.exe	103
PID 5708 wrote to memory of 564	5708	chrome.exe	105
PID 5708 wrote to memory of 440	5708	chrome.exe	106
PID 5708 wrote to memory of 564	5708	chrome.exe	105
PID 5708 wrote to memory of 440	5708	chrome.exe	106
PID 5708 wrote to memory of 6544	5708	chrome.exe	107
PID 5708 wrote to memory of 6544	5708	chrome.exe	107
PID 5708 wrote to memory of 7056	5708	chrome.exe	108
PID 5708 wrote to memory of 7056	5708	chrome.exe	108
PID 5708 wrote to memory of 3632	5708	chrome.exe	109
PID 5708 wrote to memory of 3632	5708	chrome.exe	109
PID 5708 wrote to memory of 3588	5708	chrome.exe	110
PID 5708 wrote to memory of 3588	5708	chrome.exe	110
PID 5708 wrote to memory of 2724	5708	chrome.exe	111
PID 5708 wrote to memory of 6948	5708	chrome.exe	113
PID 5708 wrote to memory of 6948	5708	chrome.exe	113
PID 5708 wrote to memory of 6800	5708	chrome.exe	114
PID 5708 wrote to memory of 6800	5708	chrome.exe	114
PID 720 wrote to memory of 5708	720	RippleEx64.exe	99
PID 720 wrote to memory of 5708	720	RippleEx64.exe	99
PID 720 wrote to memory of 5708	720	RippleEx64.exe	99
PID 720 wrote to memory of 5708	720	RippleEx64.exe	99
PID 720 wrote to memory of 5708	720	RippleEx64.exe	99
PID 5708 wrote to memory of 3972	5708	chrome.exe	118
PID 5708 wrote to memory of 6880	5708	chrome.exe	117
PID 5708 wrote to memory of 3192	5708	chrome.exe	119
PID 5708 wrote to memory of 3972	5708	chrome.exe	118
PID 5708 wrote to memory of 6880	5708	chrome.exe	117
PID 5708 wrote to memory of 3192	5708	chrome.exe	119
PID 5708 wrote to memory of 2296	5708	chrome.exe	120
PID 5708 wrote to memory of 3516	5708	chrome.exe	121
PID 5708 wrote to memory of 2296	5708	chrome.exe	120
PID 5708 wrote to memory of 3516	5708	chrome.exe	121
PID 5708 wrote to memory of 5732	5708	chrome.exe	123
PID 5708 wrote to memory of 5244	5708	chrome.exe	122
PID 5708 wrote to memory of 6528	5708	chrome.exe	124
PID 5708 wrote to memory of 5732	5708	chrome.exe	123
PID 5708 wrote to memory of 5244	5708	chrome.exe	122
PID 5708 wrote to memory of 6528	5708	chrome.exe	124
PID 5708 wrote to memory of 5728	5708	chrome.exe	125
PID 5708 wrote to memory of 5728	5708	chrome.exe	125
PID 5708 wrote to memory of 1968	5708	chrome.exe	126
PID 5708 wrote to memory of 1968	5708	chrome.exe	126
PID 5708 wrote to memory of 3916	5708	chrome.exe	127
PID 5708 wrote to memory of 3916	5708	chrome.exe	127
PID 720 wrote to memory of 4404	720	RippleEx64.exe	129
PID 720 wrote to memory of 4404	720	RippleEx64.exe	129
PID 720 wrote to memory of 4404	720	RippleEx64.exe	129

C:\Users\Admin\AppData\Local\Temp\2026-07-01_568c3fbe165163c7f68ace84b2d39269_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-01_568c3fbe165163c7f68ace84b2d39269_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5172
- C:\Users\Admin\AppData\Local\Temp\Cac_Cluste64.exe
  "C:\Users\Admin\AppData\Local\Temp\Cac_Cluste64.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:7148
- - C:\ProgramData\intterminal\Cac_Cluste64.exe
    C:\ProgramData\intterminal\Cac_Cluste64.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:2196
  - - C:\Users\Admin\AppData\Roaming\intterminal\KJOJRRJXUJAN\Cac_Cluste64.exe
      C:\Users\Admin\AppData\Roaming\intterminal\KJOJRRJXUJAN\Cac_Cluste64.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of WriteProcessMemory
      PID:6760
    - - C:\Users\Admin\RippleEx64.exe
        
        C:\Users\Admin\RippleEx64.exe
        5⤵
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Drops file in Program Files directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: AddClipboardFormatListener
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:720
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        6⤵
        
        PID:4404
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        6⤵
        
        PID:5596
    - - C:\Users\Admin\AppData\Roaming\component_ultra\Crisp.exe
        
        C:\Users\Admin\AppData\Roaming\component_ultra\Crisp.exe
        5⤵
        Loads dropped DLL
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:1844
  - - C:\ProgramData\SynthGenerat.exe
      C:\ProgramData\SynthGenerat.exe
      4⤵
      Suspicious use of NtCreateProcessExOtherParentProcess
      Loads dropped DLL
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Checks processor information in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4124
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-first-run --disable-gpu about:blank
        5⤵
        Drops file in Windows directory
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Modifies registry class
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        
        PID:4712
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x264,0x268,0x26c,0x260,0x290,0x7ff98d2cc188,0x7ff98d2cc194,0x7ff98d2cc1a0
        6⤵
        
        PID:4900
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1844,i,2084062480723031346,16829302240037139216,524288 --field-trial-handle=2736,i,15198218212040941569,14302401231035559161,262144 --variations-seed-version --mojo-platform-channel-handle=2768 /prefetch:11
        6⤵
        System Time Discovery
        
        PID:924
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --metrics-shmem-handle=1704,i,9810794635445825607,8891551234293308632,262144 --field-trial-handle=2736,i,15198218212040941569,14302401231035559161,262144 --variations-seed-version --mojo-platform-channel-handle=2732 /prefetch:2
        6⤵
        
        PID:1756
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2284,i,18140043586676438105,13217240876704366449,524288 --field-trial-handle=2736,i,15198218212040941569,14302401231035559161,262144 --variations-seed-version --mojo-platform-channel-handle=2868 /prefetch:13
        6⤵
        
        PID:5444
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3504,i,14079096612539886233,15995953781390986351,2097152 --field-trial-handle=2736,i,15198218212040941569,14302401231035559161,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:1
        6⤵
        
        PID:1212
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3528,i,2891107758567272416,9856474981461501404,2097152 --field-trial-handle=2736,i,15198218212040941569,14302401231035559161,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:1
        6⤵
        
        PID:5080
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5004,i,7218636116999280527,13999528157806235061,524288 --field-trial-handle=2736,i,15198218212040941569,14302401231035559161,262144 --variations-seed-version --mojo-platform-channel-handle=5084 /prefetch:14
        6⤵
        
        PID:2172
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5072,i,3096060703520849215,584858747609040116,524288 --field-trial-handle=2736,i,15198218212040941569,14302401231035559161,262144 --variations-seed-version --mojo-platform-channel-handle=5108 /prefetch:14
        6⤵
        
        PID:2464
      - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5900,i,11464542912864693222,15598922016754554836,524288 --field-trial-handle=2736,i,15198218212040941569,14302401231035559161,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:14
        6⤵
        
        PID:6588
      - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5900,i,11464542912864693222,15598922016754554836,524288 --field-trial-handle=2736,i,15198218212040941569,14302401231035559161,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:14
        6⤵
        
        PID:3448
  - - C:\Users\Admin\AppData\Roaming\intterminal\Crisp.exe
      C:\Users\Admin\AppData\Roaming\intterminal\Crisp.exe
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:4508

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {c08afd90-f2a1-11d1-8455-00a0c91f3880} -Embedding
1⤵
PID:1132

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5708
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ff98a22c728,0x7ff98a22c734,0x7ff98a22c740
  2⤵
  PID:4936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1640,i,13216954548612112122,12786620140186696115,262144 --field-trial-handle=1912,i,14531263942794609834,2826407670954222905,262144 --variations-seed-version --mojo-platform-channel-handle=1908 /prefetch:2
  2⤵
  PID:6448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2160,i,10619992697987356909,15938283265521330662,524288 --field-trial-handle=1912,i,14531263942794609834,2826407670954222905,262144 --variations-seed-version --mojo-platform-channel-handle=2164 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4644
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2288,i,5739744210407704892,2617568426608626599,524288 --field-trial-handle=1912,i,14531263942794609834,2826407670954222905,262144 --variations-seed-version --mojo-platform-channel-handle=2560 /prefetch:13
  2⤵
  PID:5152
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3212,i,17039928302702260902,4978113094666418500,2097152 --field-trial-handle=1912,i,14531263942794609834,2826407670954222905,262144 --variations-seed-version --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3236,i,12419729131615467894,3661467729275903765,2097152 --field-trial-handle=1912,i,14531263942794609834,2826407670954222905,262144 --variations-seed-version --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4664,i,17657572318089925010,1554889887701949919,2097152 --field-trial-handle=1912,i,14531263942794609834,2826407670954222905,262144 --variations-seed-version --mojo-platform-channel-handle=4676 /prefetch:1
  2⤵
  PID:6544
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4840,i,14601052566018621689,4438951192660493912,524288 --field-trial-handle=1912,i,14531263942794609834,2826407670954222905,262144 --variations-seed-version --mojo-platform-channel-handle=4848 /prefetch:14
  2⤵
  PID:7056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5004,i,17172624254014506378,6008160406181172114,524288 --field-trial-handle=1912,i,14531263942794609834,2826407670954222905,262144 --variations-seed-version --mojo-platform-channel-handle=5016 /prefetch:14
  2⤵
  PID:3632
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5040,i,10765170922716411102,16422658540201563986,524288 --field-trial-handle=1912,i,14531263942794609834,2826407670954222905,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:14
  2⤵
  PID:3588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5360,i,5554101484553028259,13648475432001296990,524288 --field-trial-handle=1912,i,14531263942794609834,2826407670954222905,262144 --variations-seed-version --mojo-platform-channel-handle=5356 /prefetch:14
  2⤵
  PID:2724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5444,i,15786823398562131243,6077003678503635687,2097152 --field-trial-handle=1912,i,14531263942794609834,2826407670954222905,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:1
  2⤵
  PID:6948
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5472,i,4903907521710238297,14116791872233374679,2097152 --field-trial-handle=1912,i,14531263942794609834,2826407670954222905,262144 --variations-seed-version --mojo-platform-channel-handle=5476 /prefetch:1
  2⤵
  PID:6800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5436,i,3709845305678644266,7955283793162103213,2097152 --field-trial-handle=1912,i,14531263942794609834,2826407670954222905,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:1
  2⤵
  PID:6880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5528,i,2429690952978324402,8651203100118326297,524288 --field-trial-handle=1912,i,14531263942794609834,2826407670954222905,262144 --variations-seed-version --mojo-platform-channel-handle=5724 /prefetch:14
  2⤵
  PID:3972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5944,i,14019182408912629758,3545194540213896555,2097152 --field-trial-handle=1912,i,14531263942794609834,2826407670954222905,262144 --variations-seed-version --mojo-platform-channel-handle=5472 /prefetch:1
  2⤵
  PID:3192
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5432,i,17003636308907248369,12511331928925914301,2097152 --field-trial-handle=1912,i,14531263942794609834,2826407670954222905,262144 --variations-seed-version --mojo-platform-channel-handle=5968 /prefetch:1
  2⤵
  PID:2296
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6064,i,15247276916296508445,1548544143592728838,2097152 --field-trial-handle=1912,i,14531263942794609834,2826407670954222905,262144 --variations-seed-version --mojo-platform-channel-handle=5944 /prefetch:1
  2⤵
  PID:3516
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=5916,i,4811980730191208548,16827005234045383338,2097152 --field-trial-handle=1912,i,14531263942794609834,2826407670954222905,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:1
  2⤵
  PID:5244
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5704,i,11108714474024750407,17574039496162251742,524288 --field-trial-handle=1912,i,14531263942794609834,2826407670954222905,262144 --variations-seed-version --mojo-platform-channel-handle=5356 /prefetch:14
  2⤵
  PID:5732
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=5600,i,806144759110177770,17489850072651165187,2097152 --field-trial-handle=1912,i,14531263942794609834,2826407670954222905,262144 --variations-seed-version --mojo-platform-channel-handle=6056 /prefetch:1
  2⤵
  PID:6528
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5360,i,7860724395450581537,9160833284660874149,524288 --field-trial-handle=1912,i,14531263942794609834,2826407670954222905,262144 --variations-seed-version --mojo-platform-channel-handle=4696 /prefetch:14
  2⤵
  PID:5728
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=4784,i,13588074534463502114,7815268061671440737,2097152 --field-trial-handle=1912,i,14531263942794609834,2826407670954222905,262144 --variations-seed-version --mojo-platform-channel-handle=5644 /prefetch:9
  2⤵
  PID:1968
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=4780,i,4607533945225211948,17263130405313389572,2097152 --field-trial-handle=1912,i,14531263942794609834,2826407670954222905,262144 --variations-seed-version --mojo-platform-channel-handle=4688 /prefetch:1
  2⤵
  PID:3916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6220,i,1823822943180169424,2650050577220582499,524288 --field-trial-handle=1912,i,14531263942794609834,2826407670954222905,262144 --variations-seed-version --mojo-platform-channel-handle=5604 /prefetch:14
  2⤵
  PID:4208
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6048,i,7205817119012564077,6158654503103846499,524288 --field-trial-handle=1912,i,14531263942794609834,2826407670954222905,262144 --variations-seed-version --mojo-platform-channel-handle=6260 /prefetch:14
  2⤵
  PID:6528
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5568,i,444052148002124487,12182330115643695940,524288 --field-trial-handle=1912,i,14531263942794609834,2826407670954222905,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:14
  2⤵
  PID:3008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5604,i,15314353915958458261,8896886955993532019,524288 --field-trial-handle=1912,i,14531263942794609834,2826407670954222905,262144 --variations-seed-version --mojo-platform-channel-handle=2156 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4332

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:956

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5576

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:1148

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1268

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5188

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3752

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:6240

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5956

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3388

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
PID:2832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x318,0x7ff972b5c188,0x7ff972b5c194,0x7ff972b5c1a0
  2⤵
  PID:1712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1876,i,16298335011821282143,4250921084526154145,524288 --field-trial-handle=2256,i,515929216167087841,4123368759608438779,262144 --variations-seed-version --mojo-platform-channel-handle=2288 /prefetch:11
  2⤵
  - System Time Discovery
  PID:6968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1564,i,7034461443535362740,7102879379927496534,262144 --field-trial-handle=2256,i,515929216167087841,4123368759608438779,262144 --variations-seed-version --mojo-platform-channel-handle=2252 /prefetch:2
  2⤵
  PID:7020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2460,i,7139929509930800435,11139785058877152600,524288 --field-trial-handle=2256,i,515929216167087841,4123368759608438779,262144 --variations-seed-version --mojo-platform-channel-handle=2956 /prefetch:13
  2⤵
  PID:6332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3560,i,5707789217264411772,11518046630543654996,2097152 --field-trial-handle=2256,i,515929216167087841,4123368759608438779,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:1
  2⤵
  PID:3296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3564,i,5713961481483363867,10076818667979996098,2097152 --field-trial-handle=2256,i,515929216167087841,4123368759608438779,262144 --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:1
  2⤵
  PID:2504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5756,i,15084949838728410990,8517752517749098486,524288 --field-trial-handle=2256,i,515929216167087841,4123368759608438779,262144 --variations-seed-version --mojo-platform-channel-handle=5764 /prefetch:14
  2⤵
  PID:2068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5752,i,17670025136777257079,5034301060208629545,524288 --field-trial-handle=2256,i,515929216167087841,4123368759608438779,262144 --variations-seed-version --mojo-platform-channel-handle=5852 /prefetch:14
  2⤵
  PID:3228
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6468,i,8287132590812085249,5633979080294765680,524288 --field-trial-handle=2256,i,515929216167087841,4123368759608438779,262144 --variations-seed-version --mojo-platform-channel-handle=6484 /prefetch:14
  2⤵
  PID:3088
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6468,i,8287132590812085249,5633979080294765680,524288 --field-trial-handle=2256,i,515929216167087841,4123368759608438779,262144 --variations-seed-version --mojo-platform-channel-handle=6484 /prefetch:14
  2⤵
  PID:4568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5148,i,13040096454796045848,9031388707102207397,524288 --field-trial-handle=2256,i,515929216167087841,4123368759608438779,262144 --variations-seed-version --mojo-platform-channel-handle=5544 /prefetch:14
  2⤵
  PID:6768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5260,i,11588556109091247929,12543988943483290409,524288 --field-trial-handle=2256,i,515929216167087841,4123368759608438779,262144 --variations-seed-version --mojo-platform-channel-handle=6468 /prefetch:14
  2⤵
  PID:3348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5332,i,15001422954541218916,1143978133512634421,524288 --field-trial-handle=2256,i,515929216167087841,4123368759608438779,262144 --variations-seed-version --mojo-platform-channel-handle=5524 /prefetch:14
  2⤵
  PID:6724

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1756

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2580

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SynthGenerat.exe

Path C:\ProgramData\SynthGenerat.exe
Size 2.2MB
SHA256 fd0ccd54dc4fb84ec74b741e593d94b859106a2072790a664d973d5ac081e135
MD5 6a1aebbcb0e5f4d278037ccdeae1d182
SHA1 6a53bba0536b25dc27524d804cd41d294803bcb7
SHA512 268299ac836a9230664163370c578a465ad92a3628678092d7366a73e2023e80cae0fa51b4c262318640d376057fd4c77469b34ddf138772b25aca711f91625c
SSDEEP 49152:SqoAB5XnoRBcKYnm2qPHF8/PZbsVuvvjA01Ht5ZR+jXbdbEPLmxkZ:34HF8ZbrvJtR0XbdbCmxkZ
TLSH
T106A58D56E7A400E8EAF7C17CC6465217EBB1B4241770AFDF4AA04AA51F23AE11F3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 2f1750ad9bb06d89fb6073f75f0c5dbe149974f9c812c819b2274a5c912f52fd
MD5 51f5fec92046f14323b58a8dd9261bd1
SHA1 980f549db8fccd7a19bac2495a71f1ff88a3ea77
SHA512 1a1c1065a96c8aea946e1f4cf4fb26913556555de7e1a1566ee90b86d2e9a9bfdef7aebab5af35231b12e7f99958c6ac3fa0f0e58251ecbe57f7ce12923667cc
TLSH
T132516CB7C7D4866D881156F59B216E1BCD2D0A28532C3C56C8D8EF4F53E2872D31178E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 10KB
SHA256 9e43d6dac8338aca129ce383c10c68fcc6b22ea2b0b940647c7267c44a8fd77b
MD5 976e3d8aa280dbcedd1f87c7d168e837
SHA1 66b59723fd818ba0db73ec234dd229d36cfdc4e5
SHA512 ffcfdca7acae3c41897835d158205711b0dc811f938c3b522cd539dd57e2719f3ebb8b79a26e93dc2ffc2a5b7f1e2e88c4fc84c114755e8f55634f9721f8dcb9
SSDEEP 192:3xRVrt6YR6gqmy4atrv7m2APRp2h91Hsb+WNnV390J0mLeK6VyIsnAUge:BRGTvLS3Xy/w30ae
TLSH
T1E432A72EA910657B5CCBC21AF965B757E6F6102321942E44EBFC8A2C13E75CC221702B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 cfb798c3f224f5d4bc4e1f6303e848ccf7bec052b3a4e7a533c1aa38b0a659ba
MD5 38c14f7a52571a7519162e6a4c3c9e51
SHA1 2602e8e0686d26f32480235e6ad61f5d09916a20
SHA512 61d48a3aa8441f25ab291ec8ca2dfd06bf7d91eb52450f38aa229277cad1357c5f86013738f41f335258773c5c17875e0edb7dc5f4af9f25865ad37234d9158d
SSDEEP 192:3xRVrt6YR6gqmy4atrv7m2vlPRpWZh91Hsb+WNnV390JiEmLeX6VyIsnAUgE:BRGTvLSYXo/w30YjE
TLSH
T1A032B82EA910657B6DCBD619F965BB67E7F5202321D02E44EBFC8A2C13E75CC2217027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 11ea37b3874c781890cbe98f9d5e63b7af11e27d336cc6b2116c9af47178a73f
MD5 5d02b2f1c6f19c4bbc05750105534154
SHA1 9727b057feebde820fbe45adff931e17214175dd
SHA512 9201332a66de3a29d3d711c84196a3afa2b4b8d6510cc1f2f7ace21bd1ad5feb68cd5349ab185bb7c1ebe1789e820d269e08251bc9031c0e7e7fa2e7ac42d45e
SSDEEP 384:jBjva7KxkXqKf/pUZNCgVLH2Hfgsl5QXODve+ErU3t1HGq/rxyO0bPOa:jBva7KxkXqKf/pUZNCgVLH2HfgsXaO7i
TLSH
T193520A67648D9A7F0FC8D68CD8177F4FACB602576268092457FB9C0903A57CB124A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 d8c966e0b4b1472f439c00abbba80496a9615d17b1494d6309df217dff332d7a
MD5 b42e41bb07483356e1446ac60f515316
SHA1 c5b39760e81cafcd0214f5c6806853fed7a49b9f
SHA512 dae73f66b800ca158e377c27bbbfacdb07969615c90123a9ecc4267e3bc60b821dedc23a694e3175705393dfbe74aee9f122bb3f898dc6176cdc96c61633694b
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 b3b75318a22f5ad21f7bdd1c9b9647e5eb7f4ad4a5a34f62c5bd9edcd3105347
MD5 4fb4a28d4b51d4197c5b0084dcf01e4c
SHA1 5963ace4af786688d7e74305c5608e9987f7fc0d
SHA512 5dbc7b7055941ff1e11848e0707ce85ed3e6c2251d98ad9ed9173b89267dac737f453ea3c229d859e5d9d9646571a7a8ab97c444d1e18fee9d5b73d9763fa634
TLSH
T128A0029543C42C19FE60727960791756326D492519E3D307A4A6055C8D6F1E89105100
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data
Size 138KB
SHA256 076aa55b230b30e165fcfb9353597e814a7915f29ddf6fc23dbd7a69151ccad0
MD5 6c6af19e38c76e89925e02c0ca30102f
SHA1 336dfed7635508f32d6fdd395c45bf5f1d258f0e
SHA512 0af64c4f0da29b3a07e88da01e2475a7c22037f15c6a28c33f1cb760ac5051cd873a2771828e658faf2ca3c26a4acc8878e4c8e0b32dff2bdd64c62a5a0fe2eb
SSDEEP 192:tB+XuvBnl3JsueMEGvIW1/rcP2OgnpX6iVqmVummwk27:jeuvBnhJsueMEGvIW1DcP2OgBPVummnM
TLSH
T1E1D3764B3A743102EDE59A721CE050BB5E3CB16D4F5595D428B620688EF2963A23E4FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 123KB
SHA256 0250cf35c12715a7d734d754df33aa68d3e8c6035e747b88841c5fb0a2c6204b
MD5 0cbd793b6924f7090954b15d5dc69966
SHA1 1a3cc995bb2049a88ab190cce42d66f7d7a654cc
SHA512 304beff471699dc724e1d9167b9c921f338371575a73c6048500683f18d430a968b0455d7e7edc2f790f8af537f649b38fbfd3cc60ca3d0a053509053234d815
SSDEEP 3072:m1mgCELZtCpXh5qTfATCuIbzQACV1cnJLL5n:smg1kQfATCFbzQACj4
TLSH
T1E6C3127B4DE409FE1712089121422E71AED9A77FDF123F9C935A1BB616C7C8A1387822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 3ee39374aafe73ebf274aabe449839f0b3d9035eb0b6fa9fff9e00789181901a
MD5 de2fac07a7edee24b594287df6a7ba5a
SHA1 0501b7aabab1444f6b53ecf1bdcf5f9b1e59936c
SHA512 74ce6390399a9c2c60add2fa793614819e9dddaae8347e75b36ef3388880aff8a070181a4315a0f29d37d43469b4a335ffd02d87161e42d06d7cf67f26f1351e
SSDEEP 96:VejC6vd+KKiEfYGEgI8WfX+VuCRDotok5Vp7DVFB6oGyvQ2IciJcbHfUv4a:UjCwe0GEg0XQDUDVpV7U5ciJcbe
TLSH
T176A1F632A869497755B2D486B0036F13CFB872BBA5919F98E9DC1F0C61A74EC1346633
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 122KB
SHA256 6411afd98dc29fe6d9d444b73e9fd2a73c0278e99ea8c4e529ea6a8248d61907
MD5 6adac5cf17ae22533af109a174010257
SHA1 240742075d0292e5610514e0026071fc0a96c5d2
SHA512 3daee472eecd2852fdab85e600b41b389e42ffa5f87a4332d6f4521e850c34b36631a33b86f4e19388d2f24e961421803b3fef76c62babfc5d6874e83e1977aa
SSDEEP 3072:E1mgCELZtCpXh5qTfATCuIbzQACV1cnJLL5n:ymg1kQfATCFbzQACj4
TLSH
T11FC3135A8EE409BE1712046261431EB5F3E9A77FCE522FAC936A07F566C7C861387423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 122KB
SHA256 9921bb10d710cf2d71422af77058123c7f3467820aa9b2e7f8bc086a074ce64c
MD5 19e3b1fe0e3b4a13f5fec91992129b09
SHA1 d53f2d0346abbf1b99ce11b99d4bb63fcf199165
SHA512 49a6198e7bc51b6cb586f67558c90df25607b9378550cd91cff754757b4a5c5847a7f787ebd8b8220be98bb957c32cf2a919f9c1001c0af6e98d8089963ade42
SSDEEP 3072:p1mgCELZtCpXh5qTfATCuIbzQACV1cnJLL5n:3mg1kQfATCFbzQACj4
TLSH
T1D5C3135A8AE409BE1712046271431EB5F3E9A77FCE522EAC936A07F566C7C861387423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 d27158eebf482333709292486790045376be986643b5bf9f8e823c47416e03c5
MD5 48cbaca9a0f53de2b3ca305171aaa474
SHA1 d512958b854013e14a6864979ecacbc18a58e543
SHA512 d8e9599cce41df3234ab8a1d0415f89d57aa6a938386a511ded24cbc36c3292b01cf672a4affdf11881d0046bbc056c4079baeeca74b5ccfa649aae23d8c9547
TLSH
T161D0C07437286C02C52231718C20C300B6F980342399C0023201C10C4C7F4829347006
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 78b24b2d65b9be0f6df01dc52b04a154c849f693b62d1b21bab7d0153c5dbf7a
MD5 f6c762ff1fc2835061a946c193b86a58
SHA1 8b6959e685f406f6b5c02e5dbb3e732a4cea1400
SHA512 bce2d2e20b5093d4d770da02bf6da132ba7b6fc1e0faa61640af9880059deb3b22d94646e733851679b4e98ab66ee842b8a2d54e67422bd9b0139ad68dec04f3
TLSH
T190D0807437696C02C56635B59814C700B6F99535239AC5027251D14D5C7F486E747146
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0de0118d3331715b9a512d48a9ad2768955ce6304dde64b6177631f13738a8ad
MD5 187a10f3fe18842aee3719656a2eafec
SHA1 2eef38bdeee8fadca7a030142b93fd629d474990
SHA512 1d3b29280e22eecbf31d1f2581d941beaaf642b7abab15823bb048c3710323c48b2c1205f5e7bc0c32a775a741f7c06c8221cac14f633f46f8b59c5ea490b793
TLSH
T115D080B437696C02C5663575D814C700B6F995352399C5027251C14D5C7F4869747146
MD5 SHA1 SHA512 TLSH

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 2809f8c732b7f48184c5d171d28408d628ba0e9e194334655c70591a3f9478f9
MD5 7aff0d1329f13a53213e958e0c94a29e
SHA1 273c3855b99f11e286d9ef7323f9714c77190ab4
SHA512 db687785780460ff70f4df3663a210280758e369ee79ae2292e7aab608293bd33f0c7823f2117dcedf6c6e60c4bc8a4a4ec14e0a7b0079f54ac01c6cb038e949
TLSH
T1BAE02BAACC21AD2B1DFD175868544746E74513172B808A4F3A3D810DCFF063A458687C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 7ae7a0ed800d53e1c794fa6d45570a96839879256abf0628ac7228389dfb36cb
MD5 a454d78086f3c8e7a6c7044494789b99
SHA1 19776f371f4bb96cacd011dcb79f2a4286b0619b
SHA512 14a4b31c2ac038a6c841d47a17d238ba8432c5ca619975cf2c17d8ba149917808a48b58c3e43b6737efbd8dccc8100f71589b3010cc63fb518786b1da64f6edf
TLSH
T1D781D8EFDBF48F3EDF2A0C7755B11A6427FE841680261B22D105F269ECC76F45152010
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 f8f6b530e88b7efe62401b8c3f8db97dc2779920f61278eba64d1c5b3d8d9e71
MD5 537a51a2e08ea518d3088da974307029
SHA1 e30fd0a1e15644b77e08d2de1a39379c173a562d
SHA512 75a8fc01985bc1ccbf614da2f5c990f066a7b28810c498bfc08e3416ff434cb65fa0ffcbc45545c3c53b48fdbd38e6fd426376e6562b2f14a8a418437fd38780
SSDEEP 384:sxR8K2nPmxdaf/fPgsXG8BaSRiMTT1KJRcsH/506R/X8esXSs/jy:sYK2nPSdK/fPS8EDcT1KJzH/506lX8eF
TLSH
T13A82E8066538593B8CDBD219FA467BA3D7FC1563A2945E44AAFC8B0C05E7ADC211383F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 2c0d51599e844c182b0c01ab3d25c9f6953d4f811764ed8e48af51e951ea53c7
MD5 c976e298beb401278753589ed6387620
SHA1 b6f33b9c9e5031354875b10c330bd382940e2406
SHA512 e06a29bd49efaff78526c736197dbbb6c59082c9ddc3ef6cc689018209221f6a71125edf3e049d3abaaa6487909f9e1b8625d5dd3dbb1f950e54edbb13c4656c
SSDEEP 768:PRbg3u7pLuL75sWgtVfwp8F1+UoAYDCx9Tuqh0VfUC9xbog/OVyokUfYHroQzB2:PRbg3uE75sWgtVfwpu1ja1okoYUQQ
TLSH
T14DE2FD7B680CCB7F4F804E9CEC2ABE9E6DD802CB56D8C95447EA840C03C66EB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\216b2995-8128-4ee2-97b1-1c15f3430966\index-dir\the-real-index
Size 72B
SHA256 d420ce91a7961de1548047f164991246efab371c8a3f4e60bac7cb95bc73a43b
MD5 0790e4fd96b7bfe858fef1780cbbc241
SHA1 70cd7646753d9571712b91426646f0f1426657d1
SHA512 3a83f42eade27e8053605408a4a0677f1c0d77af3f4fe88ad36fef6cc0eef38837c8976c0ebc7eb3486a079433c0a5ed30fb7f7452f85493526f1f8355d50c98
TLSH
T1FBA0022803C08303D24722F5679BC1853690AA200607370DF1D100A8CCA95D5868114D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\216b2995-8128-4ee2-97b1-1c15f3430966\index-dir\the-real-index
Size 72B
SHA256 cfe32cd11dcdc4c74f22ee19b14c672ccbf36b55226c92b093d7e7247ee606ce
MD5 62ba45479fab13981dac778b966ed956
SHA1 8af22a69034d4e06d04a662a944c34727f577ed0
SHA512 5d8acfda58381143cee88f369aacb2ec7a7aaa3ed0f6f25ca8c658037cc840cebe2b7a64a22bfac4a9eb968f485424fe1c1998e7478be3637bf132d281223624
TLSH
T186A0021003D48315C42391B5155AD29532908D545105238E71E25154CCA44D1464101C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\db2eaf4b-e723-4e46-8113-2fa5a4d25beb\index-dir\the-real-index
Size 3KB
SHA256 c74d7fca6250e07b67feafb136b82d52a2eed02e221ea080592c938fc02b182a
MD5 d80e36c3ab8039f036efa1d30f135c8d
SHA1 458110e6ab70fa01d355591c449a83178661cbbf
SHA512 818f408bc4ebc868d1c61afefc278d4dddd3e6d8b56651c0ea6afa1a4bb2ce0ce2a5d394c40ce08c2c033a155260918bd4a34a0625d76459165ef0c82dfb7afa
TLSH
T16C51F81E8C863E4FCD7C19B268B204C837361DDD2A898F0B25BEA335BCC363A2945655
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\db2eaf4b-e723-4e46-8113-2fa5a4d25beb\index-dir\the-real-index
Size 1KB
SHA256 858afcf13c32ae264b30a85fbed32effd08f61959014c73d11830b95c4b7ff47
MD5 dec000d7d1b18cc5b274b83c99ec6812
SHA1 47c6637042016f8ebbc45cb4999ac656489e649b
SHA512 788ed1332955b2191fa5889c617788829b04197911d43ca5115b4ccb98cf6e02bebc8a4748ff5e879db8536b02d074d5d78b2905db37a778b3e2e575d145cc24
TLSH
T10041C829CCC15E0BCC2044B2167A155C237BB6ED2A898707253CF078BCE7736186252C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59f61e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\db2eaf4b-e723-4e46-8113-2fa5a4d25beb\index-dir\the-real-index~RFe59f61e.TMP
Size 1KB
SHA256 4366376e7a6fa55405e19f25a0be70b49343e0d3b584e2d434877ebf1497fac0
MD5 0d0fa1bbace777070cdcbaddcc1f79a3
SHA1 2949f410000d406fe50199f10e08b9ec3abca52d
SHA512 48647253f453dfde6d971194225919707bb93584d57d036a1f86b0561fccfa3954527d265bf074a8e21de54c17cb31e250d4c372443fb6dbcff8f4426f8937e2
TLSH
T19E4151259891AE07EC1045B65A9B844D333FF5B06345EA0B20B8F1786CE3A3869A81AD
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 4bb9c462d7317725ea4a4db3b77857c7cd1936ad5f072d0e04885f06cd37a2a2
MD5 9cc18f9affebd995a54e3c6a8ed48c50
SHA1 f41ed093cb46e05c63b3c9a05a52236820211fbe
SHA512 7b4c0b9d1c5e7120ecb8a5343cde9edf2a3dcc5173692cc3b71f4457296d20397e2021320abf61180909d93131fb907efbee891716b2370738ddeb0504cd027c
TLSH
T139E0C0F73DF72810FE7F87DB18B6509100417928C942BC0F503966C750B1354344DC62
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 a74758a8e68180a587f7c981c6db5a1494823afd66099847655c960b87b26df4
MD5 16ee3f2e0dea447445a987da8b61333b
SHA1 4697d41088a4ac1664c72822c79500b52190da5c
SHA512 9e5865f0b2566715ddf9c9d217cafadb76f2216824f1168d651cc766f481ba6789410f0ff32e6315722d2436a0caf10e4a26f1baa025fbf45346a10bc869a104
TLSH
T13DA002A3D2670D85E1407670F58101C9A221CC104609235783B50064ACAB180D51A114
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a4b14.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5a4b14.TMP
Size 48B
SHA256 54ff0613223ea9c6268bbdcfbf9d5140b0a21750e4e33e6cb2b807f05ef9e2c6
MD5 b8dcc0078438b9ee5dde279132fb0929
SHA1 9f095c91c00d19f6c1f6867f6b5c867008c31114
SHA512 dedf2bcadbd8c0e34bfe448179e3adce7bb9f5a8fb5d3d0a1c5aba43da32af136083e4f3a71d922b9b32ac7f38cdf0a0435d91fe0f1e98a4d378629edca0542f
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 5dd5bc38a067ca0eafcb915e70ba06ad67780a04a03fa4abb3b48f9b3f06e036
MD5 648369181b58142a703788c20ec54e94
SHA1 e8cfd2c112c11ba9940ebb1c1f53833e89dd23cc
SHA512 16658ee80860e5b911ce61f23d86895b2f13d37824dc0b7f3ce170b1e4d152c461f1cd7cfcf3cd88d34ae84dd84ca58c68338dd95d827c4d08f247c0c3b4fd26
SSDEEP 384:9Xu7n9ZdQBcLfDd3Vof/sVnuRMFxn//mv6hRRL3bKlk4aIs/e/n/i/5/5/p/T3/Z:63bU/YVVlTv7Id1gr17Ajd7OLmb2BrBX
TLSH
T126B26B5171BA2701383E240EA2B9841F5A4630A230DEB97B7BA931E56F27F005FFD5D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 256KB
SHA256 769a3eb5e4f91baf54eacfea3aa594d2de7b961d6407012165522c65e4984319
MD5 7905b6971cf61198bbe95dc79cdd5c3c
SHA1 acf6558e10d0cbd5dc41618b784e1aabd29124e8
SHA512 5398f7e446fdc9a685d78a63f9361275c394ac62f781a691c95472931813b62944b8ccd5e47542cfa3f5a783ea346681b06c6b115ca5235e0053866cbf9bde6c
SSDEEP 384:DNrRZyCSDnxTICYMEhIKyll7svbFKfk7:xFZJSDniwyI1l7svbF9
TLSH
T1EC44640A7B747001EDE2D9725CB080771E3CA16E8F22E6815DB654694EB3853A63D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 77850013380174a8355632039c1a2eb8efe66993d86057bb3e827c276cc92f5d
MD5 11973d28741b07284d0b3c3e50ada5e3
SHA1 c99c4195c975c94b40fd3d24e95582abff6e0a42
SHA512 2fb5fd6dc53bbaeb094599ee096f4d39bdb83f77f8cb6b0d7876b2df52c8c981aa17c72f731d7c3709684539d107b3aef0b4d5b6b64aef352ae5bace39f7fd2e
SSDEEP 384:nNiF1tNn/s3n9Sv8NF8TUNTUlIRD0zvWoPcfojR+ATCvfn9jmn15wbAjEJFy48L6:EF1j+9SQwgzcRFTefn9jmn12bfJcu
TLSH
T123C24A36D8A4DEBBADE78FC9B7497746EEE401A3819859D8D9D80D4D01C32DD130BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 020e5821f3821b1092c4bbe7ef1b1f2706d43d8c299312d2360964d104673cd0
MD5 526cdb4a9b4b708ee8772d229874bc97
SHA1 24f45a91092591e3689138f4113d0e3bb105f6d6
SHA512 f13aed18ac7a1c911d5f4c56eba6e00804362ce014b2320031362d15200826c54e140d504386fc42e5f77150d8fa062c9cc159809cf6c59894a3cc0b4cbee83f
SSDEEP 768:NFpj+9t/c6wgf7/J77RFTefnHE1Y7gxr278Kzug/:Q9t/c87/JJFgk1kgd27tzug/
TLSH
T1B4D25B32E8A4DEBB9CE78BC5B7467A47EEE402A385885ED4DAD81D4C01C72DE130B915
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 faed2b49b3c9a7d8bd8b53c6c25f45502e81529ec4c4901536a78ae3a4be295a
MD5 6da50fadcb710dbd597e2e436df56a23
SHA1 46ff54b3780aef98103607342259b6f824ae3fcd
SHA512 7a8812725eee1e8367ba6fb5eae7bd564b1b9d19f203776d05e1858657a1e627d092e67f1ccbbce441564dd32dc4f42fb3ce18e195d3098c576aa26260bff281
SSDEEP 768:mFpj+9t/c6wgf7/J77RFTefnHE1Y7gxr278Kzug/:h9t/c87/JJFgk1kgd27tzug/
TLSH
T1F1D25B32E8A4DEBB9CE78BC5B7067A47EEE402A385885ED4DAD81D4C01C72DE130B915
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

626A870.tmp

Path C:\Users\Admin\AppData\Local\Temp\626A870.tmp
Size 14.2MB
SHA256 1da55a9cab611f00571cdf3b4eb3b71038ec96d569c37dd8a493b01b25ff0237
MD5 b47132e929c01951d26f5ae5053544c3
SHA1 b6d6990a7eedc53adea2cd35be433bf5db34a8ec
SHA512 e8434547b3d4c365a76cff1fef14ed8748eb203fef8e0232efa33b96a6f49e92ea4739c0435b8484cb6f8d99dd5d3ff843f44057117cf2741cd2aecad5a06ea8
SSDEEP 196608:xbobXC09X6uN93TpEKDeeuiLqwdf2XnCpZHED4XHvXC663nofFXsMsd+kEElXbBT:Su+XzeeTLN2XnCeEvy663oS+k7bHBl
TLSH
T1C9E6337A185DE6A364F4CA20E2D21BCE3341C23C696751268A94CCEE377E53D9BE035D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

626A870.tmp

Path C:\Users\Admin\AppData\Local\Temp\626A870.tmp
Size 14.2MB
SHA256 6ce7d56fcb763fd4d66d8e1cdde6a7482c8d555326aae3891e8312f0830bda99
MD5 fc6edc2f1b6e3f2d1bee1beef1aabd57
SHA1 146f6133032a44274f43656e810ddcb0687b2804
SHA512 fdfb65df4323bb086220e54a1efbfeeb4b46a3d16dabac2d879c9f4b4127178a93dfb6b48462c5bca25398324deb08e05a4b76e365f59931df9ed5f36426baed
SSDEEP 196608:ybobXC09X6uN93TpEKDeeuiLqwdf2XnCpZHED4XHvXC663nofFXsMsd+kEElXbBT:lu+XzeeTLN2XnCeEvy663oS+k7bHBl
TLSH
T115E6337A185DE6A364F4CA20E2D21BCE3341C23C696751268A94CCEE377E53D9BE035D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

761B551.tmp

Path C:\Users\Admin\AppData\Local\Temp\761B551.tmp
Size 2.8MB
SHA256 fe327f74d84112551a8fbc5d5864f49c37226967b091e5d30e18c11a65cad21f
MD5 1f95a211f27b170d60a6ddf6f2f15d1a
SHA1 54928faf02913924f258d62778b7d3d901dbbd41
SHA512 e48c4d9fd096e9d690ff110cc9518b8198468268baf068dc8c16efa1ac4d1b5667313218e9b2ebc67a2fe25c22c6383212277ac8c3c0a2ab8adea63a3dcb8633
SSDEEP 49152:vPHeI93IiJ4WlTkRj5bFUKvNu3xZCGMfg0JFDx2efoMi7eo5CRnp+ni76KglI2i9:nnpPIZbhu3xZCGMfFJpxvfof95mKILL
TLSH
T112D533EA8AB273617327CF3F796666C700F8462EE55F7A690107CFC64A316B54B209C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

761B551.tmp

Path C:\Users\Admin\AppData\Local\Temp\761B551.tmp
Size 2.8MB
SHA256 fe18b80cd1ddda2fe6e1fb6af65f4962e0725a226a32f6c76f555905c838703d
MD5 221c50fa44f0e674accd23aec0523f20
SHA1 25a69795741ec7b73800f634e4253c3f21a1a512
SHA512 643fb62dc1b9a78de6340d79588b1ae200db511218ce5d600cba0d45018d586374e55634d329aa65c955f1f2d24bd48f9e6d4d1dff961544f49e22fe42cc15da
SSDEEP 49152:BPHeI9oIiJ4WlTkRj5bFUKvNu3xZCGMfg0JFDx2efoMi7eo5CRnp+ni76KglI2i9:ZnqPIZbhu3xZCGMfFJpxvfof95mKILL
TLSH
T1B8D533EA8AB273616327CF3F796666C700F8462EF55F7AA90107CFC54A316B54B209C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AEAN.7z

Path C:\Users\Admin\AppData\Local\Temp\AEAN.7z
Size 17KB
SHA256 42ab735bc255f13ed6ded15424b8fa93cb024b6dc888157a6e6657ac405f8a98
MD5 855c73d05bc4b84017f94dd86b857400
SHA1 b2bf9be1a19ac954acbf0431a4a4df05bcc6f79f
SHA512 bc8d37f0783a3f21f2e60f7729e092069c029f36eb5e33e3ee5d8f78adb0df3984477d348abf8bb278352311854736e28cdde7f3b7b9bc065ffea4cb717c91e1
SSDEEP 384:j0rt8cLkxX5uxLPDmfT+oe3O4sB0R7jHIfR/SQ:w/LwuxDDy6o6OL0R/IfRqQ
TLSH
T18882CFEDB0BB1F67AA608D735ABDC568386CC584D5604E140C84625B78A07623BAFA06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

B1CDC73.tmp

Path C:\Users\Admin\AppData\Local\Temp\B1CDC73.tmp
Size 40B
SHA256 80043ba44f7a278b283d53f7bc87e9c10e11eb7e6150ab916b136abf52802b0c
MD5 662272abc814bb0030ea508608da025a
SHA1 2ff87963393cbac1ea6ea553d0248866c6023211
SHA512 f14234c80a777afe6980a3b313e8d6f4b1a6e00c87ba309147de754e7332884a9627e406ad9ef146de74f6141355883fa60d2093717c6811c406537499e0664c
MD5 SHA1 SHA512

Submit Download

BCCE3A6.tmp

Path C:\Users\Admin\AppData\Local\Temp\BCCE3A6.tmp
Size 40B
SHA256 140f34542c0f6d8dc30a399dd374e824fa43a85a23447c30a7607d113debd039
MD5 364a671fac1846ca4760c56bd3f82cd0
SHA1 e8f436a96351e8024fadbf39041b3cc63470a2ec
SHA512 edc1a2776d88e6df97734a90366b87d6c577329382b1a291df477085785e9a0c2388161ac55eaa2295bbae56ab32782099dba6bffd48ab5bf31e1680b95e7360
MD5 SHA1 SHA512

Submit Download

Cac_Cluste64.exe

Path C:\Users\Admin\AppData\Local\Temp\Cac_Cluste64.exe
Size 102KB
SHA256 371a329380f120761b46ee10739e61a689b541212e53c7cd85b22a468ac33a88
MD5 011bebb919b250a6841c9162489d1523
SHA1 5985fbf0eec12d25a72917d8642648a83c6c8588
SHA512 03ac0171631f50b675f323f65251721d571073dce3d3b3979298a72f7d9f78ce7e03bac05594ccf312ef2cbb649c25bdec61e80b7b9aeb7c45ee69ade13f40f5
SSDEEP 1536:RZwn7CIxHHWMpdPa5wiE21M8kJIGFvb1CwP/i4s+yt5/9jrfIbHanzb:RZw7BwMpdCq/IM8uIGf1/i4s0Teb
TLSH
T1BDA3E741E62DBDCDE548D4314A75D4F26D24ED327680A51EB7F3BF062831293FA0A93A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\VCRUNTIME140.dll
Size 117KB
SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
MD5 32da96115c9d783a0769312c0482a62d
SHA1 2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
SHA512 616c78b4a24761d4640ae2377b873f7779322ef7bc26f8de7da0d880b227c577ed6f5ed794fc733468477b2fcdb7916def250e5dc63e79257616f99768419087
SSDEEP 1536:Z9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaLjTz164zEd:ZEnsvReGsWyxLizXFkecbd1aPTzW
TLSH
T10DC38C8572A002FBD16AC274C1A36A17FB75B94487B0A7CF03B58A650F53BE09E3D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python314.dll

Path C:\Users\Admin\AppData\Local\Temp\python314.dll
Size 6.4MB
SHA256 d581ca404eda0f9a46674799d87870d25fc9e0092c37a799ed5ce9d7f9d80542
MD5 9f37c5f9b9a07da240dd798dbbc18865
SHA1 6772891ede2f8439b04b3d27663830276c375707
SHA512 64ec6902deeaec4d4f7909fd7e58065a9a25ee38a9e19769a6e8132d96bed31e14578ced8bea86a807eef7047a6587fc7daa57de1fe6a4e1c0c21630320cd886
SSDEEP 98304:kxcTCXWA5Ddpyd7cZ0dYf8fP+Pzt1bMM9ETRv7HDMiECC2:kqTCPDS7cZ0dyIWPzlNiq2
TLSH
T133669D26737811A4D9BB8035C9034647DBB1BC04AB30D34B49A4B6DA3F733635BAEB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sandboxproc.json

Path C:\Users\Admin\AppData\Local\Temp\sandboxproc.json
Size 33KB
SHA256 cb51b83b66573be78260e7a967c295fd9fca74349b9aaec7bea9d492ceb6692a
MD5 90cde8c16ac9c2e7abd9f7c8cb9f8c8c
SHA1 1cce088a77747530fed490cf39148efdf78b37bc
SHA512 c2e5c897870fa1bc9f4851eff9a47e122a9433f23cf2549e8aaa031c21337846ba633de3cf1548fe6ba8595e706e047cab066f250e5fcce9b15ed61e93501808
SSDEEP 768:nVHg/WXH0gsuZ1GIqx2v7UxHn+0iiUjEIgwcmr7:VH3XH0gsuWIqx2kpc8M7
TLSH
T1E0E26C7FAC2E4A55940E5D3EDB28C021D348F0F43B0EB662AAD9245F7575AC8D630DA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5708_1236021089\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

thread_host.meta

Path C:\Users\Admin\AppData\Local\Temp\thread_host.meta
Size 9.8MB
SHA256 514537bd46e7651f6334944db455222fb89ac0aea8de38b731abffb6cf8c2846
MD5 1c9f0c5be3e5545359e71a7638e58a63
SHA1 6a0d011822d0ce3e75b84d2c6ee3160919d3f8db
SHA512 8dd4e9e5f46e65698f1c24854799dec0360f86495a7f3a5e2b16cc1e949cb619569dec2e3dd1db975106fea6973db71d4760766551ccdecc290004d5f5c67b35
SSDEEP 196608:O5u6SHhqFFIZCzHStSz8BkEBw33ztg8bMEug1fZf5:H5HcFqZCzSt8CK3ztg8bp1j
TLSH
T107A62378A08C0661F78B34F1D0B84EE7E957736AA3640B3E429684C17ECF65DD046B7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ucrtbase.dll

Path C:\Users\Admin\AppData\Local\Temp\ucrtbase.dll
Size 1.1MB
SHA256 d93ce42cd625510b2355de086bcd19e2c11307ccade7bad62b09c7f340a866ba
MD5 24ebedc58aa4ff23043bf79b05d267d4
SHA1 c2e7bd18e4091f2a7f7c933a5734b05dd971f24c
SHA512 7f0563e814cc4aaf292683403888340bb5d95e6a7bdd35d81eebbd10bfb8e4e5130d0a626b8fb07ff3cafaae4a2698cf7103aabcae74e5d13449db482ec49bc9
SSDEEP 24576:2RmADWOBBIHv0XESwR5H7iFZBmai0gFcszUmxvSZX0ypm7:WtI045H+ZB7fgDz7
TLSH
T1C835AE28B76C02AAC57BE17DC923550EF972380447709ACB03A74BB93E277E956B7311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Crisp.exe

Path C:\Users\Admin\AppData\Roaming\component_ultra\Crisp.exe
Size 334KB
SHA256 c2e62475768c9546efe1da92a55f3bb2a55350eed83241139917aabd1ad25f8a
MD5 5f9f88c9a16b62dc38504549e93d3667
SHA1 587d56031b39e34102bc67b5f7d0338ee41b5328
SHA512 edbb7a8cd75e056d2c47b8af6fbee63726cb3d5f000d5f8bc000f4b16366619c8532e628585cc943f474d2509c63802179d0d22a1d32dd690fb25e00d262af83
SSDEEP 6144:7c2XFRJ3DNuzAOS9FuxIRtiiuhKPTqX4Y42:dFvYzU9kutRuhKPTqo32
TLSH
T125749E11B9D1C4B2C4B2053009E8EBB5697DFD714F61863B33D8772E1F742C1A662AA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thread_host.meta

Path C:\Users\Admin\AppData\Roaming\intterminal\KJOJRRJXUJAN\thread_host.meta
Size 2.3MB
SHA256 0f45a093f2c6f059a553c65dd3da353b00ad5955331b2fcf63a43a368f62b3c2
MD5 0a2c13f44d0631235c7c5bb23aa5e16e
SHA1 a8634bb75da37c9e220a561b0bd76535454180e0
SHA512 65152f040c7ca6d9d6e0d89b380e9de5fec2cf454a7fcdedaaa9e7f28764d2f524ff05098fb63c2dafdd5738d28512d8a16bea4931cf18a4966374619aaef3bd
SSDEEP 49152:aw/Ml6Q8Rg+4lLwCdKjIwLEKTH7XTraEQlzoFjg5qXP8KZ/y7O:aw/MgW+4lLc8w4e7X/a/zoRg5qXPz
TLSH
T1BAB52311E2ECADB9C4C3B47680C43F0E66CF25B5AF3946E0B465BE8D18956031BB6D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RippleEx64.exe

Path C:\Users\Admin\RippleEx64.exe
Size 546KB
SHA256 1d1d2245651632f1fce464eda9d5c5ea6ca43b4a04424601ce8c890951111028
MD5 c39a4cca58bedd9b3ceda4d0d3e1e94a
SHA1 0ea31e219e83aa4ba169ef2a132af8fb52f54bf4
SHA512 673794aee7f54a6a1191069a1647ff085c8da6c9bdcb8e358e9969c51c9782993c5e73b938bb4388af012a6cb279e1faf324af55c49748a85b8159c170f4252f
SSDEEP 3072:BBPlwpY3YKF0MrrJq+DNBg0DJtOJs9cAg0Fub+A5aiMqKIDqLqprqpB:rc2XFRJ3DNuzAOS9F4DqLqprqpB
TLSH
T199C43821B4C1E47AC862073008E9E6B57579FC215E72863F33F47F2F3B762816565AA2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/720-777-0x0000000000DA0000-0x0000000001149000-memory.dmp

Download

memory/720-79-0x00007FF9AF8C0000-0x00007FF9AFB23000-memory.dmp

Download

memory/720-1414-0x0000000000DA0000-0x0000000001149000-memory.dmp

Download

memory/720-107-0x0000000000DA0000-0x0000000001149000-memory.dmp

Download

memory/720-72-0x0000000000DA0000-0x0000000001149000-memory.dmp

Download

memory/720-788-0x0000000000DA0000-0x0000000001149000-memory.dmp

Download

memory/720-510-0x0000000000DA0000-0x0000000001149000-memory.dmp

Download

memory/720-569-0x0000000000DA0000-0x0000000001149000-memory.dmp

Download

memory/720-857-0x0000000000DA0000-0x0000000001149000-memory.dmp

Download

memory/720-100-0x0000000000DA0000-0x0000000001149000-memory.dmp

Download

memory/720-1298-0x0000000000DA0000-0x0000000001149000-memory.dmp

Download

memory/1844-93-0x00007FF9AF8C0000-0x00007FF9AFB23000-memory.dmp

Download

memory/1844-145-0x0000000074AD0000-0x0000000074B22000-memory.dmp

Download

memory/2196-64-0x00007FF99E070000-0x00007FF99E0D3000-memory.dmp

Download

memory/2196-38-0x00007FF99E070000-0x00007FF99E0D3000-memory.dmp

Download

memory/2196-57-0x00007FF99E08D000-0x00007FF99E08F000-memory.dmp

Download

memory/2196-50-0x00007FF99E070000-0x00007FF99E0D3000-memory.dmp

Download

memory/2196-32-0x00007FF99E08D000-0x00007FF99E08F000-memory.dmp

Download

memory/2196-35-0x00007FF99E070000-0x00007FF99E0D3000-memory.dmp

Download

memory/2196-39-0x00007FF99E070000-0x00007FF99E0D3000-memory.dmp

Download

memory/2196-31-0x00007FF99E070000-0x00007FF99E0D3000-memory.dmp

Download

memory/4124-590-0x00007FF64BB50000-0x00007FF64BD81000-memory.dmp

Download

memory/4124-88-0x00007FF64BB50000-0x00007FF64BD81000-memory.dmp

Download

memory/4124-778-0x00007FF64BB50000-0x00007FF64BD81000-memory.dmp

Download

memory/4124-118-0x00007FF64BB50000-0x00007FF64BD81000-memory.dmp

Download

memory/4124-531-0x00007FF64BB50000-0x00007FF64BD81000-memory.dmp

Download

memory/4124-1425-0x00007FF64BB50000-0x00007FF64BD81000-memory.dmp

Download

memory/4508-98-0x00007FF9AF8C0000-0x00007FF9AFB23000-memory.dmp

Download

memory/6760-62-0x00007FF99E070000-0x00007FF99E0D3000-memory.dmp

Download

memory/6760-60-0x00007FF99E070000-0x00007FF99E0D3000-memory.dmp

Download

memory/6760-70-0x00007FF99E070000-0x00007FF99E0D3000-memory.dmp

Download

memory/6760-80-0x00007FF72B810000-0x00007FF72B82A000-memory.dmp

Download

memory/7148-25-0x00007FF9A7630000-0x00007FF9A7693000-memory.dmp

Download