hijackloader | 3769996f8267fb2ee2a1819ed2cdf1746257283e2dcfb28f71dd9f8b4d994b55

Analysis

max time kernel
300s
max time network
306s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
17/07/2026, 11:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
𝗦𝗘𝗧𝗨𝗣.exe
Size 576KB
Sample260717-nrtbdady4z
SHA256 3769996f8267fb2ee2a1819ed2cdf1746257283e2dcfb28f71dd9f8b4d994b55
MD5 c78fcfeeba6e2ae52f28efd2e054ae89
SHA1 894b2932d7e3cde0a42d2249063c5e058a8b9b38
SHA512 883e8e7cb17596544d7e80415cb9c06484c116d1de71add047084356208ff4529a691b23dbaeacdd770f104ae9a325cff3bbe2b532055749ab8f7aff4ca2e596
SSDEEP 6144:qQ/wOnH9FzvPHuifBbUvqBPfGXO0XnUsFTb90nKg2Gedar:qIJ9FbHuOuXXNT55T1dar
TLSH
T10EC419203715853ACA7252B298A86FBF302DEF144BE44DC7A3D87A2DFA715D35A31607
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

credential_access discovery hijackloader loader spyware stealer

Malware Config

Extracted

Family

hijackloader

Attributes

directory
%APPDATA%\WSL
inject_dll
%windir%\SysWOW64\input.dll

xor.hex

Signatures

Family: HijackLoader, IDAT loader, Ghostulse,
HijackLoader is a multi-stage loader, first seen in 2023.
loader hijackloader

Detects HijackLoader (aka IDAT Loader) 1 IoCs

resource	yara_rule
behavioral2/files/0x0007000000028bd5-43.dat	family_hijackloader

Suspicious use of NtCreateProcessExOtherParentProcess 25 IoCs

description	pid	Process	procid_target
PID 3792 created 4712	3792	WEmulator.exe	97
PID 3792 created 3028	3792	WEmulator.exe	98
PID 3792 created 2572	3792	WEmulator.exe	100
PID 3792 created 3304	3792	WEmulator.exe	101
PID 3792 created 1900	3792	WEmulator.exe	102
PID 3792 created 4556	3792	WEmulator.exe	103
PID 3792 created 3080	3792	WEmulator.exe	104
PID 3792 created 2184	3792	WEmulator.exe	105
PID 3792 created 4712	3792	WEmulator.exe	97
PID 3792 created 4712	3792	WEmulator.exe	97
PID 3792 created 3304	3792	WEmulator.exe	101
PID 3792 created 3304	3792	WEmulator.exe	101
PID 3792 created 3300	3792	WEmulator.exe	108
PID 3792 created 1556	3792	WEmulator.exe	109
PID 3792 created 4500	3792	WEmulator.exe	110
PID 3792 created 2960	3792	WEmulator.exe	111
PID 3792 created 4216	3792	WEmulator.exe	112
PID 3792 created 576	3792	WEmulator.exe	115
PID 3792 created 2708	3792	WEmulator.exe	116
PID 3792 created 3928	3792	WEmulator.exe	117
PID 3792 created 5236	3792	WEmulator.exe	119
PID 3792 created 3300	3792	WEmulator.exe	108
PID 3792 created 3300	3792	WEmulator.exe	108
PID 3792 created 4500	3792	WEmulator.exe	110
PID 3792 created 4500	3792	WEmulator.exe	110

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
3792	WEmulator.exe

Suspicious use of SetThreadContext 8 IoCs

description	pid	Process	procid_target
PID 692 set thread context of 3792	692	𝗦𝗘𝗧𝗨𝗣.exe	91
PID 3852 set thread context of 64	3852	Tech_C.exe	93
PID 692 set thread context of 4908	692	𝗦𝗘𝗧𝗨𝗣.exe	94
PID 3852 set thread context of 4916	3852	Tech_C.exe	95
PID 64 set thread context of 4712	64	ParallelEn.exe	97
PID 64 set thread context of 5148	64	ParallelEn.exe	129
PID 64 set thread context of 2812	64	ParallelEn.exe	134
PID 64 set thread context of 2708	64	ParallelEn.exe	148

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\Lang\fa.txt	ParallelEn.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientARMRefer_eula.txt	ParallelEn.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientLangPack2019_eula.txt	ParallelEn.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientVolumeLicense_eula.txt	ParallelEn.exe
File opened for modification	C:\Program Files\7-Zip\History.txt	ParallelEn.exe
File opened for modification	C:\Program Files\7-Zip\Lang\eo.txt	ParallelEn.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ko.txt	ParallelEn.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ku.txt	ParallelEn.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mk.txt	ParallelEn.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ThirdPartyNotices.MSHWLatin.txt	ParallelEn.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\README.txt	ParallelEn.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\AugLoop\third-party-notices.txt	ParallelEn.exe
File opened for modification	C:\Program Files\7-Zip\Lang\cs.txt	ParallelEn.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ext.txt	ParallelEn.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nn.txt	ParallelEn.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\THIRDPARTYLICENSEREADME.txt	ParallelEn.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Configuration\card_expiration_terms_dict.txt	ParallelEn.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\README.txt	ParallelEn.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\en-US\about_Mocking.help.txt	ParallelEn.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lv.txt	ParallelEn.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientOSub_eula.txt	ParallelEn.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\en-US\about_BeforeEach_AfterEach.help.txt	ParallelEn.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fr.txt	ParallelEn.exe
File opened for modification	C:\Program Files\7-Zip\Lang\zh-tw.txt	ParallelEn.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\THIRDPARTYLICENSEREADME-JAVAFX.txt	ParallelEn.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jvisualvm.txt	ParallelEn.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub2019_eula.txt	ParallelEn.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Configuration\card_security_terms_dict.txt	ParallelEn.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Configuration\card_terms_dict.txt	ParallelEn.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSIPC\ThirdPartyNotices.txt	ParallelEn.exe
File opened for modification	C:\Program Files\7-Zip\Lang\az.txt	ParallelEn.exe
File opened for modification	C:\Program Files\7-Zip\Lang\el.txt	ParallelEn.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sw.txt	ParallelEn.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tg.txt	ParallelEn.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tk.txt	ParallelEn.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientLangPack_eula.txt	ParallelEn.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\SkypeForBusinessVDI2019_eula.txt	ParallelEn.exe
File opened for modification	C:\Program Files\Windows NT\TableTextService\TableTextServiceTigrinya.txt	ParallelEn.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lt.txt	ParallelEn.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mr.txt	ParallelEn.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\WacLangPack2019Eula.txt	ParallelEn.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\WacLangPackEula.txt	ParallelEn.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\THANKS.txt	ParallelEn.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\en-US\about_should.help.txt	ParallelEn.exe
File opened for modification	C:\Program Files\7-Zip\Lang\he.txt	ParallelEn.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ug.txt	ParallelEn.exe
File opened for modification	C:\Program Files\Java\jre-1.8\README.txt	ParallelEn.exe
File opened for modification	C:\Program Files\7-Zip\Lang\be.txt	ParallelEn.exe
File opened for modification	C:\Program Files\7-Zip\Lang\es.txt	ParallelEn.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jmc.txt	ParallelEn.exe
File opened for modification	C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt	ParallelEn.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mn.txt	ParallelEn.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sl.txt	ParallelEn.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sr-spl.txt	ParallelEn.exe
File opened for modification	C:\Program Files\7-Zip\readme.txt	ParallelEn.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ba.txt	ParallelEn.exe
File opened for modification	C:\Program Files\7-Zip\Lang\gu.txt	ParallelEn.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kab.txt	ParallelEn.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pt.txt	ParallelEn.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tt.txt	ParallelEn.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientOSub2019_eula.txt	ParallelEn.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub_eula.txt	ParallelEn.exe
File opened for modification	C:\Program Files\7-Zip\Lang\eu.txt	ParallelEn.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fy.txt	ParallelEn.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\databasehost_32_rc.job	Crisp.exe

Executes dropped EXE 1 IoCs

pid	Process
3852	Tech_C.exe

Loads dropped DLL 9 IoCs

pid	Process
3852	Tech_C.exe
3852	Tech_C.exe
3852	Tech_C.exe
3852	Tech_C.exe
3852	Tech_C.exe
3792	WEmulator.exe
64	ParallelEn.exe
4908	Crisp.exe
4916	Crisp.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	𝗦𝗘𝗧𝗨𝗣.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Tech_C.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ParallelEn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Crisp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Crisp.exe

System Time Discovery 1 TTPs 3 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3304	chrome.exe
4500	msedge.exe
5268	chrome.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	WEmulator.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WEmulator.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134287632492091329"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4146128427-3460078792-3629963422-1000\{E9194B94-2489-4575-878D-EC998131040C}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
64	ParallelEn.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
692	𝗦𝗘𝗧𝗨𝗣.exe
692	𝗦𝗘𝗧𝗨𝗣.exe
692	𝗦𝗘𝗧𝗨𝗣.exe
692	𝗦𝗘𝗧𝗨𝗣.exe
3852	Tech_C.exe
3852	Tech_C.exe
3852	Tech_C.exe
3852	Tech_C.exe
3792	WEmulator.exe
3792	WEmulator.exe
3792	WEmulator.exe
3792	WEmulator.exe
3792	WEmulator.exe
3792	WEmulator.exe
4908	Crisp.exe
4908	Crisp.exe
4908	Crisp.exe
4908	Crisp.exe
4908	Crisp.exe
4908	Crisp.exe
4908	Crisp.exe
4908	Crisp.exe
3792	WEmulator.exe
64	ParallelEn.exe
64	ParallelEn.exe
4916	Crisp.exe
4916	Crisp.exe
4916	Crisp.exe
4916	Crisp.exe
4916	Crisp.exe
4916	Crisp.exe
4916	Crisp.exe
4916	Crisp.exe
3792	WEmulator.exe
3792	WEmulator.exe
3792	WEmulator.exe
3792	WEmulator.exe
4712	chrome.exe
4712	chrome.exe
3792	WEmulator.exe
3792	WEmulator.exe
3792	WEmulator.exe
3792	WEmulator.exe
3792	WEmulator.exe
3792	WEmulator.exe
64	ParallelEn.exe
64	ParallelEn.exe
64	ParallelEn.exe
64	ParallelEn.exe
3792	WEmulator.exe
3792	WEmulator.exe
3792	WEmulator.exe
3792	WEmulator.exe
3792	WEmulator.exe
3792	WEmulator.exe
3792	WEmulator.exe
3792	WEmulator.exe
3792	WEmulator.exe
3792	WEmulator.exe
3792	WEmulator.exe
3792	WEmulator.exe
3792	WEmulator.exe
3792	WEmulator.exe
3792	WEmulator.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
64	ParallelEn.exe

Suspicious behavior: MapViewOfSection 4 IoCs

pid	Process
692	𝗦𝗘𝗧𝗨𝗣.exe
3852	Tech_C.exe
692	𝗦𝗘𝗧𝗨𝗣.exe
3852	Tech_C.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3792	WEmulator.exe
Token: SeDebugPrivilege	64	ParallelEn.exe
Token: SeShutdownPrivilege	4712	chrome.exe
Token: SeCreatePagefilePrivilege	4712	chrome.exe
Token: SeShutdownPrivilege	4712	chrome.exe
Token: SeCreatePagefilePrivilege	4712	chrome.exe
Token: SeShutdownPrivilege	4712	chrome.exe
Token: SeCreatePagefilePrivilege	4712	chrome.exe
Token: SeShutdownPrivilege	4712	chrome.exe
Token: SeCreatePagefilePrivilege	4712	chrome.exe
Token: SeShutdownPrivilege	4712	chrome.exe
Token: SeCreatePagefilePrivilege	4712	chrome.exe
Token: SeDebugPrivilege	64	ParallelEn.exe
Token: SeShutdownPrivilege	2812	chrome.exe
Token: SeCreatePagefilePrivilege	2812	chrome.exe
Token: SeShutdownPrivilege	2812	chrome.exe
Token: SeCreatePagefilePrivilege	2812	chrome.exe
Token: SeShutdownPrivilege	2812	chrome.exe
Token: SeCreatePagefilePrivilege	2812	chrome.exe
Token: SeShutdownPrivilege	2812	chrome.exe
Token: SeCreatePagefilePrivilege	2812	chrome.exe
Token: SeShutdownPrivilege	2812	chrome.exe
Token: SeCreatePagefilePrivilege	2812	chrome.exe
Token: SeShutdownPrivilege	2812	chrome.exe
Token: SeCreatePagefilePrivilege	2812	chrome.exe
Token: SeShutdownPrivilege	2812	chrome.exe
Token: SeCreatePagefilePrivilege	2812	chrome.exe
Token: SeShutdownPrivilege	2812	chrome.exe
Token: SeCreatePagefilePrivilege	2812	chrome.exe
Token: SeShutdownPrivilege	2812	chrome.exe
Token: SeCreatePagefilePrivilege	2812	chrome.exe
Token: SeShutdownPrivilege	2812	chrome.exe
Token: SeCreatePagefilePrivilege	2812	chrome.exe
Token: SeShutdownPrivilege	2812	chrome.exe
Token: SeCreatePagefilePrivilege	2812	chrome.exe
Token: SeShutdownPrivilege	2812	chrome.exe
Token: SeCreatePagefilePrivilege	2812	chrome.exe
Token: SeShutdownPrivilege	2812	chrome.exe
Token: SeCreatePagefilePrivilege	2812	chrome.exe
Token: SeShutdownPrivilege	2812	chrome.exe
Token: SeCreatePagefilePrivilege	2812	chrome.exe
Token: SeShutdownPrivilege	2812	chrome.exe
Token: SeCreatePagefilePrivilege	2812	chrome.exe
Token: SeShutdownPrivilege	2812	chrome.exe
Token: SeCreatePagefilePrivilege	2812	chrome.exe
Token: SeShutdownPrivilege	2812	chrome.exe
Token: SeCreatePagefilePrivilege	2812	chrome.exe
Token: SeShutdownPrivilege	2812	chrome.exe
Token: SeCreatePagefilePrivilege	2812	chrome.exe
Token: SeShutdownPrivilege	2812	chrome.exe
Token: SeCreatePagefilePrivilege	2812	chrome.exe
Token: SeShutdownPrivilege	2812	chrome.exe
Token: SeCreatePagefilePrivilege	2812	chrome.exe
Token: SeShutdownPrivilege	2812	chrome.exe
Token: SeCreatePagefilePrivilege	2812	chrome.exe
Token: SeShutdownPrivilege	2812	chrome.exe
Token: SeCreatePagefilePrivilege	2812	chrome.exe
Token: SeShutdownPrivilege	2812	chrome.exe
Token: SeCreatePagefilePrivilege	2812	chrome.exe
Token: SeShutdownPrivilege	2812	chrome.exe
Token: SeCreatePagefilePrivilege	2812	chrome.exe
Token: SeShutdownPrivilege	2812	chrome.exe
Token: SeCreatePagefilePrivilege	2812	chrome.exe
Token: SeShutdownPrivilege	2812	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
3300	msedge.exe
3300	msedge.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe
2812	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 692 wrote to memory of 3852	692	𝗦𝗘𝗧𝗨𝗣.exe	83
PID 692 wrote to memory of 3792	692	𝗦𝗘𝗧𝗨𝗣.exe	91
PID 692 wrote to memory of 3792	692	𝗦𝗘𝗧𝗨𝗣.exe	91
PID 3852 wrote to memory of 64	3852	Tech_C.exe	93
PID 692 wrote to memory of 4908	692	𝗦𝗘𝗧𝗨𝗣.exe	94
PID 3852 wrote to memory of 64	3852	Tech_C.exe	93
PID 692 wrote to memory of 4908	692	𝗦𝗘𝗧𝗨𝗣.exe	94
PID 3852 wrote to memory of 4916	3852	Tech_C.exe	95
PID 3852 wrote to memory of 4916	3852	Tech_C.exe	95
PID 3792 wrote to memory of 4712	3792	WEmulator.exe	97
PID 4712 wrote to memory of 3028	4712	chrome.exe	98
PID 4712 wrote to memory of 2572	4712	chrome.exe	100
PID 4712 wrote to memory of 2572	4712	chrome.exe	100
PID 4712 wrote to memory of 3304	4712	chrome.exe	101
PID 4712 wrote to memory of 1900	4712	chrome.exe	102
PID 4712 wrote to memory of 1900	4712	chrome.exe	102
PID 4712 wrote to memory of 4556	4712	chrome.exe	103
PID 4712 wrote to memory of 3080	4712	chrome.exe	104
PID 4712 wrote to memory of 4556	4712	chrome.exe	103
PID 4712 wrote to memory of 3080	4712	chrome.exe	104
PID 4712 wrote to memory of 2184	4712	chrome.exe	105
PID 4712 wrote to memory of 2184	4712	chrome.exe	105
PID 64 wrote to memory of 4712	64	ParallelEn.exe	97
PID 64 wrote to memory of 4712	64	ParallelEn.exe	97
PID 64 wrote to memory of 4712	64	ParallelEn.exe	97
PID 64 wrote to memory of 4712	64	ParallelEn.exe	97
PID 64 wrote to memory of 4712	64	ParallelEn.exe	97
PID 3792 wrote to memory of 3300	3792	WEmulator.exe	108
PID 3300 wrote to memory of 1556	3300	msedge.exe	109
PID 3300 wrote to memory of 4500	3300	msedge.exe	110
PID 3300 wrote to memory of 2960	3300	msedge.exe	111
PID 3300 wrote to memory of 2960	3300	msedge.exe	111
PID 3300 wrote to memory of 2960	3300	msedge.exe	111
PID 3300 wrote to memory of 4216	3300	msedge.exe	112
PID 3300 wrote to memory of 4216	3300	msedge.exe	112
PID 3300 wrote to memory of 3712	3300	msedge.exe	114
PID 3300 wrote to memory of 3712	3300	msedge.exe	114
PID 3300 wrote to memory of 3712	3300	msedge.exe	114
PID 3300 wrote to memory of 576	3300	msedge.exe	115
PID 3300 wrote to memory of 576	3300	msedge.exe	115
PID 3300 wrote to memory of 576	3300	msedge.exe	115
PID 3300 wrote to memory of 2708	3300	msedge.exe	116
PID 3300 wrote to memory of 3928	3300	msedge.exe	117
PID 3300 wrote to memory of 2708	3300	msedge.exe	116
PID 3300 wrote to memory of 2708	3300	msedge.exe	116
PID 3300 wrote to memory of 3928	3300	msedge.exe	117
PID 3300 wrote to memory of 3928	3300	msedge.exe	117
PID 3300 wrote to memory of 5236	3300	msedge.exe	119
PID 3300 wrote to memory of 5236	3300	msedge.exe	119
PID 3300 wrote to memory of 5376	3300	msedge.exe	121
PID 3300 wrote to memory of 5376	3300	msedge.exe	121
PID 3300 wrote to memory of 2212	3300	msedge.exe	122
PID 3300 wrote to memory of 1544	3300	msedge.exe	123
PID 3300 wrote to memory of 2212	3300	msedge.exe	122
PID 3300 wrote to memory of 1544	3300	msedge.exe	123
PID 3300 wrote to memory of 3152	3300	msedge.exe	125
PID 3300 wrote to memory of 5900	3300	msedge.exe	126
PID 3300 wrote to memory of 5900	3300	msedge.exe	126
PID 3300 wrote to memory of 5964	3300	msedge.exe	127
PID 3300 wrote to memory of 5964	3300	msedge.exe	127
PID 64 wrote to memory of 5148	64	ParallelEn.exe	129
PID 64 wrote to memory of 5148	64	ParallelEn.exe	129
PID 64 wrote to memory of 5148	64	ParallelEn.exe	129
PID 64 wrote to memory of 5148	64	ParallelEn.exe	129

C:\Users\Admin\AppData\Local\Temp\𝗦𝗘𝗧𝗨𝗣.exe
"C:\Users\Admin\AppData\Local\Temp\𝗦𝗘𝗧𝗨𝗣.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:692
- C:\Users\Admin\AppData\Roaming\web_store_shell_v5\LLUJZCFEHBX\Tech_C.exe
  C:\Users\Admin\AppData\Roaming\web_store_shell_v5\LLUJZCFEHBX\Tech_C.exe
  2⤵
  - Suspicious use of SetThreadContext
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:3852
- - C:\Users\Admin\AppData\Local\ParallelEn.exe
    C:\Users\Admin\AppData\Local\ParallelEn.exe
    3⤵
    - Suspicious use of SetThreadContext
    - Drops file in Program Files directory
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: AddClipboardFormatListener
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:64
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      4⤵
      PID:5148
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      4⤵
      PID:2708
- - C:\Users\Admin\AppData\Roaming\WSL\Crisp.exe
    C:\Users\Admin\AppData\Roaming\WSL\Crisp.exe
    3⤵
    - Drops file in Windows directory
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:4916
- C:\Users\Admin\AppData\Local\Temp\WEmulator.exe
  C:\Users\Admin\AppData\Local\Temp\WEmulator.exe
  2⤵
  - Suspicious use of NtCreateProcessExOtherParentProcess
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Loads dropped DLL
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3792
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --disable-gpu about:blank
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4712
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x21c,0x220,0x224,0x1f8,0x228,0x7ffebbc0c728,0x7ffebbc0c734,0x7ffebbc0c740
      4⤵
      PID:3028
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1720,i,13703120589032578462,7495594095728449985,262144 --field-trial-handle=2052,i,2686433572437600555,5740522825256856575,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=1936 /prefetch:2
      4⤵
      PID:2572
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1608,i,10712450541632940071,6965844968266238560,524288 --field-trial-handle=2052,i,2686433572437600555,5740522825256856575,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=1940 /prefetch:3
      4⤵
      System Time Discovery
      PID:3304
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2328,i,12860675990108559343,7387872766384511876,524288 --field-trial-handle=2052,i,2686433572437600555,5740522825256856575,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=2488 /prefetch:8
      4⤵
      PID:1900
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3052,i,17336719306352330978,15780555948764217302,2097152 --field-trial-handle=2052,i,2686433572437600555,5740522825256856575,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=3168 /prefetch:1
      4⤵
      PID:4556
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3092,i,17068804721432548649,16551274833681801921,2097152 --field-trial-handle=2052,i,2686433572437600555,5740522825256856575,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=3188 /prefetch:1
      4⤵
      PID:3080
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4132,i,6943830760084301693,1257304222996491780,2097152 --field-trial-handle=2052,i,2686433572437600555,5740522825256856575,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=4148 /prefetch:2
      4⤵
      PID:2184
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-first-run --disable-gpu about:blank
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3300
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x308,0x7ffeb7f7c188,0x7ffeb7f7c194,0x7ffeb7f7c1a0
      4⤵
      PID:1556
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1736,i,1454173464586181250,11963396639203793936,524288 --field-trial-handle=2312,i,14808854665456776144,9526344489731706871,262144 --variations-seed-version --mojo-platform-channel-handle=2500 /prefetch:3
      4⤵
      System Time Discovery
      PID:4500
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --metrics-shmem-handle=1640,i,382290254322972281,10457155055948792618,262144 --field-trial-handle=2312,i,14808854665456776144,9526344489731706871,262144 --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:2
      4⤵
      PID:2960
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2268,i,1897982096954144212,1707451328326455792,524288 --field-trial-handle=2312,i,14808854665456776144,9526344489731706871,262144 --variations-seed-version --mojo-platform-channel-handle=2516 /prefetch:8
      4⤵
      PID:4216
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3376,i,16966185335532363328,16714503793366210321,2097152 --field-trial-handle=2312,i,14808854665456776144,9526344489731706871,262144 --variations-seed-version --mojo-platform-channel-handle=3428 /prefetch:1
      4⤵
      PID:3712
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3380,i,16622350822290575262,13841441662662000092,2097152 --field-trial-handle=2312,i,14808854665456776144,9526344489731706871,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
      4⤵
      PID:576
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4100,i,378601766220397413,13394318146257112774,2097152 --field-trial-handle=2312,i,14808854665456776144,9526344489731706871,262144 --variations-seed-version --mojo-platform-channel-handle=4112 /prefetch:1
      4⤵
      PID:2708
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4160,i,3342678557999541390,11393344153580845485,2097152 --field-trial-handle=2312,i,14808854665456776144,9526344489731706871,262144 --variations-seed-version --mojo-platform-channel-handle=4420 /prefetch:2
      4⤵
      PID:3928
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3588,i,2683210827666570924,3134915429627083818,524288 --field-trial-handle=2312,i,14808854665456776144,9526344489731706871,262144 --variations-seed-version --mojo-platform-channel-handle=5044 /prefetch:8
      4⤵
      PID:5236
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5156,i,46602674282756575,6030214877589375309,524288 --field-trial-handle=2312,i,14808854665456776144,9526344489731706871,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:8
      4⤵
      PID:5376
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4544,i,8086492383581648695,15625049722508616662,524288 --field-trial-handle=2312,i,14808854665456776144,9526344489731706871,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:8
      4⤵
      PID:2212
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4984,i,12894351298080509521,11027972627829537913,524288 --field-trial-handle=2312,i,14808854665456776144,9526344489731706871,262144 --variations-seed-version --mojo-platform-channel-handle=5368 /prefetch:8
      4⤵
      PID:1544
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5096,i,17424549287155636980,2467372826742498779,524288 --field-trial-handle=2312,i,14808854665456776144,9526344489731706871,262144 --variations-seed-version --mojo-platform-channel-handle=5072 /prefetch:8
      4⤵
      PID:4932
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5096,i,17424549287155636980,2467372826742498779,524288 --field-trial-handle=2312,i,14808854665456776144,9526344489731706871,262144 --variations-seed-version --mojo-platform-channel-handle=5072 /prefetch:8
      4⤵
      PID:3152
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6044,i,8047549016406631319,18356159552080845474,524288 --field-trial-handle=2312,i,14808854665456776144,9526344489731706871,262144 --variations-seed-version --mojo-platform-channel-handle=6072 /prefetch:8
      4⤵
      PID:5900
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6216,i,5818391159672294464,15127234740494263379,524288 --field-trial-handle=2312,i,14808854665456776144,9526344489731706871,262144 --variations-seed-version --mojo-platform-channel-handle=6220 /prefetch:8
      4⤵
      PID:5964
- C:\Users\Admin\AppData\Roaming\web_store_shell_v5\Crisp.exe
  C:\Users\Admin\AppData\Roaming\web_store_shell_v5\Crisp.exe
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4908

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4804

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4752

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2188

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5044

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {c08afd90-f2a1-11d1-8455-00a0c91f3880} -Embedding
1⤵
PID:5396

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5372

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2812
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x234,0x238,0x23c,0x210,0x240,0x7ffebadcc728,0x7ffebadcc734,0x7ffebadcc740
  2⤵
  PID:5548
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=632,i,6470779058072950944,4946140090507139933,262144 --field-trial-handle=2016,i,11272221430750946884,2299149711059927423,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=2012 /prefetch:2
  2⤵
  PID:3720
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2256,i,18386083994652319247,16948393029871488314,524288 --field-trial-handle=2016,i,11272221430750946884,2299149711059927423,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=2276 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5268
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2396,i,3613639877022138802,5053313597757504405,524288 --field-trial-handle=2016,i,11272221430750946884,2299149711059927423,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=2284 /prefetch:8
  2⤵
  PID:5640
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3224,i,15297161866289584827,14733083324493775779,2097152 --field-trial-handle=2016,i,11272221430750946884,2299149711059927423,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:5820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3240,i,13883869896112900132,5592476971648010224,2097152 --field-trial-handle=2016,i,11272221430750946884,2299149711059927423,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:5828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4436,i,8139030283426771171,2681750884531645131,2097152 --field-trial-handle=2016,i,11272221430750946884,2299149711059927423,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=4400 /prefetch:2
  2⤵
  PID:5892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4584,i,1184431607944272783,17617994674299302210,2097152 --field-trial-handle=2016,i,11272221430750946884,2299149711059927423,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=4676 /prefetch:1
  2⤵
  PID:1112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5420,i,4098297232410890037,7567814951856755684,524288 --field-trial-handle=2016,i,11272221430750946884,2299149711059927423,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=5428 /prefetch:8
  2⤵
  PID:4996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5696,i,16998312770528226701,17866246047687139337,524288 --field-trial-handle=2016,i,11272221430750946884,2299149711059927423,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=5692 /prefetch:8
  2⤵
  PID:5884
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5712,i,14244850599635333924,14370614469889259732,524288 --field-trial-handle=2016,i,11272221430750946884,2299149711059927423,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=5748 /prefetch:8
  2⤵
  PID:5888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5716,i,8950142950843491584,2500948871287580559,524288 --field-trial-handle=2016,i,11272221430750946884,2299149711059927423,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=5864 /prefetch:8
  2⤵
  PID:5880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5356,i,1522215489718352608,3481458848262674735,262144 --field-trial-handle=2016,i,11272221430750946884,2299149711059927423,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=5480 /prefetch:8
  2⤵
  PID:4868
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=4432,i,297399750111736009,2497778796211628802,524288 --field-trial-handle=2016,i,11272221430750946884,2299149711059927423,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=4552 /prefetch:8
  2⤵
  PID:424

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5688

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5516

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5792

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4488

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 9a7e34c14db20fece5c3b37d0db8627e5c14e5db863501fb1a09bd547c64731f
MD5 5a6c8d2411f57117c4e3a72c69ed350b
SHA1 525277dadad08a224d4c3f7dfdaefe1c032e0f2a
SHA512 bc3a9f70d89ad09e4e8ca7b15f8fd22fe07a6d3cb6ce1dfd1985eda0b3a5ea094eb95e35ee01a6fea9d54aeee9211e258503cc5cbdd8bbaefb1e67d0adb835c1
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 4ef0038c93f0146411582ed711fb6370073c04f5c9c5c415a7ac2e64776888fd
MD5 b6b31a89d20a5b8a46395d3084b1de8d
SHA1 85fd1b94e34a8880ea8ad2a51e4ca060e51102da
SHA512 3e169b879bfae4e19b4697b280ab2f3eb4df350c52d56d76f74e1b685c52f838272f25d852192e66df6f7bcb880fed32b1d709954e04c8d13333c4be2c099c24
TLSH
T1CEE0ABABC824EC2708FD172824555646E28013AB2B40890F3A3C920C4FB073A0A42C1C
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG
Size 332B
SHA256 9f5879b9a0dc0c78fe444648c7c4a92c39eec5702457b450abab40c9c3ecf04b
MD5 19bfe5934d6771f1ca1435e9f4541992
SHA1 934f6ed2a9d262bab9df40a48d4a3d6a346488b2
SHA512 3d45ddd01a097689322d8007c7c8efebd284aafe3b1829d7754b179d6bdd1cd0937e47d5869057310b94ec47ca496cce5c3f12acf36475839f2fc43cfd42f17a
TLSH
T1DDE0207315BECADD1185801B8334770DC7F03505D7CE3F050B84A44071CB80863C26C6
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 79ccb4e38b2606b0ad9eab5fa99b2b96f6afdf74e79bd171c452d28a74f6de7d
MD5 913e360f90ac8882a5e16e20d7162444
SHA1 10af037818132e3efed36e2fd42de6c2490d9890
SHA512 bb3d6dab2780540ffef9edf2d0094bd56f42489160a5013900ba1224e37cb1c5aeb1a63592a926a698732d91d1f5d48a801a203faaa40fd3190101480db52427
TLSH
T1BF518CF7D3E4867E8511A6F4DA216E2FCE2D1A18421C3C66C9D4BE5B43E2872D21178E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 90d817d8a995827e6c69a62dbf59baa7cb7aed0815cf03701d37d530628f9e13
MD5 8e3bf22d39054bf26fc41beaaf08998e
SHA1 80a05a5bf3fc788915b9d9acbf71476d3841cc3b
SHA512 799536e6615fcaa0e2db6b4b480422d8a8634ca933d7b30d5e9ac49751cd1789ee724d43b67109075f07bb4ba8f1397c1c26c67465396face6905484c296f7f5
SSDEEP 192:qRNu4rsyhWv7TpAPRp2v99Hsb+WNnhm0GP2MrGVyIsnAUgtaJ:qRNuSNi3UX4jwU0E2MC8
TLSH
T15E42D52EAA14793B5CDAD22AFD627753D7F1103125D46E88EBFC8A2C15E71CC221B017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 347d73ba7d38af83ac3d460ce8c2dd97cabdd4c55b65412cd8b887fb45b65b38
MD5 871109c95d991c94717364d65631baf0
SHA1 fc56f3d2f1b22d07cb19c827684bb9fb264712aa
SHA512 3ade27ac0b79ef313d66bfd054d6fd2751cb9827493acd598ed9e782f0d4fcd111331893c5c70bec25cf3d8785027f9de5a781447cdf6e3bd8e08cdce6002844
SSDEEP 384:IijUn7KxkXqKf/pUZNCgVLH2Hfgslk+n7pLuLcSjijXODUL+ErU3gRnHGmvcrBv0:IiUn7KxkXqKf/pUZNCgVLH2HfgsK+n7D
TLSH
T1A27219776C4C9E370F94C68CD8277B4FADB5025B65E9886843FA982903D5ADF010A1EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\000003.log
Size 4KB
SHA256 6a65eb2c8558e92e466b77543bb3a4fc21bcb7225e23e713c94df5c0717c8622
MD5 531f65893561e0d48111432de03210bf
SHA1 706c700e3562b348c3fc68c001f95f3ce8ea959a
SHA512 0bb51164e269ccec828b5ba20eb8d58d4b643b4d419ed8d355ce7f947d4d5c25e36b8fe73220f65ff4cf3b9edede5af2063cab3381e925e6ba77238c7800258c
SSDEEP 96:F1mKJMFRwcnDh1JSHmvLXbXFXKXTRFXSXTCXFXKXTgxhXsXz0XbXNXKXTJuZXIG1:F13iMmDhaH2L1ajHCjC1ajG8YL9ajS4m
TLSH
T1BDA17D6EB50A185EE4AE4936CD78571B6F69CF0C27FE3367A9DF8A0405B0A5701086F3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\LOG
Size 336B
SHA256 61a9140327c7ebc8a74fb4bff5815fdf26cb8e1574ccae7192e6bd2ff23dc742
MD5 704e6dd814f44ac73d149bf013b8c14e
SHA1 d2978f9fbd00e36481e91f7df1e634728dce478f
SHA512 0e4cb738b51e24633cf228551f9399d36366a970ed55a54c12b74ec6b8b4b3ba28f8f751bf0b1c0963b26a9e2d25cbb0405157f73ebda04ddc3452815d8ee322
TLSH
T1A2E0260226FED6BD10E780034230A34F86E47407E3DC3F062FC0C44012CBC0C7691269
MD5 SHA1 SHA512 TLSH

Submit Download

67a473248953641b_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\67a473248953641b_0
Size 121KB
SHA256 d0c08f31de1f646818f0925112077cd3052b50d4fd18ca75d1d3ec5af9281df8
MD5 842897decb46b70d70b3d543e82db7c1
SHA1 79b8d93aa9c3b6dba587a199ccf489b7527fc859
SHA512 9517543c7f24815d3a2d7e24c09b5a4af11c47509ce2817b89a47c16fbec88a14c92ae38540c23c522bb6259b920fe3709ae50d3689d8c5420b24d00c841daab
SSDEEP 3072:r3zCum5nHBRKbYK2ANj6a/4rxMwDLE2sz:rwB34GASx/DLETz
TLSH
T1B3C3E9CCB7A574664363A5B6002F000FB23AB8AAE44C85A8F188D9E97D7446D4377F7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

67a473248953641b_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\67a473248953641b_1
Size 303KB
SHA256 bd74b6e9475be3f9b474767206fb41d457d596311dd674213ab2bde9462b1a93
MD5 0f448ce34ff78d20906558563b370808
SHA1 e420ab56774ea9ab11efc949838dcca3faef1f30
SHA512 5408ea2fa5ecd9944ca2124a0f624fa807a0ed6184d00d0006156d54dcd2cf310bb1eb1539bffced7ae4b105ca1e7281f891e4a468515da00eabaf1cde911aea
SSDEEP 6144:l8LrkR+b3WNv4Txz3ZF8LQBiWla05uQNCwZ5PFYBInmR4fVvmHipfy7YVLF9qrPL:XYvIvHVBH
TLSH
T1D164084697601667CD7303FB0A238667773982483FC7D31B25E257B96C223F3E98A949
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 21ef62fdbc8ec7c617307578f079e5afa635546f744f2150e52a3b61d309510b
MD5 80b4c16ff59a3219d6361cecae516a89
SHA1 7f7924a60c74b929bfbd2af91765a5ba6e3f9917
SHA512 50918bed71b4dcf5dc35c05da97a01fc9c191963209162d1708aa3f64c147ddb8204729ade4f739f98db7bbea84f00122a7cc4d3a67e855de6f3a16bb53f19da
TLSH
T1A8B01242C0013601C01513F112A7905972704FB4C713135563D0A92788311504112120
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 62dba20ce99e4ad8fcabc5a60e0ca56692591dc121bc821fd9c528f1fbf7e7fa
MD5 8ed98411e94507146ec1c1aaaf7f0002
SHA1 3a40b30e677ec2914db17813c6decc4208da214e
SHA512 a46170aba7d8c9d1fdb6aa26fbf304ca9b06597436d7e01312f36a62d591056ae12c7c123186d2ac584d397bc8c8e438ab0691c2e64c4fc2ac9c18019c51c55d
TLSH
T1BEB02222C0022202C08203F030A0A0E830A0EF20C303032383E00ABBCC2E2300020C20
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe596cca.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe596cca.TMP
Size 96B
SHA256 bea80d7b20c498d25b7dec322e742da9001523cab13d5c97cd6d2043e2f8866a
MD5 0431dcfe828245284a19bba808cbb0c2
SHA1 d49daf517e103d285834173678511940c730eb7c
SHA512 c677b0607ece8761bb37ecc65c87e09b7b62f38bff71b03652e3292d4d16d3231a5a9a9b2c83806bbc608655ee3e5047e5ed14bf5cecf2c71559de5a9fa53954
TLSH
T170B02220C0022203C00203F02E8882C832A0CF22CB030A0A82E00E23CC382208220E30
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG
Size 345B
SHA256 d87ea2891f49b0eef71e785a56a781ca4a893a4fe4f9f8eb89725374e1d41a53
MD5 b7fb40b15b20743a08441b638e333354
SHA1 4c91b0a236871f47094b49cddd1f834ddaf14643
SHA512 cd5283f93a5fd58946c75d5e7eda62bb633a83ea1cbfb02d26d0a8a46bb66edc1eea9cf98c9d94f6d5455c0798a823e19d298ec69adb32ebf75fe666c315547f
TLSH
T145E0D8222AEA8B6F108B90177320F30EC6E27402D6DD9F153B45A080538BC447281261
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG
Size 321B
SHA256 ab70f9d0c9ddabd1becac74f5eebb573d889140ef06c4b25b4d8559c53d6426f
MD5 133347a3972ee477427ba60797749233
SHA1 4686f8e8a1534b1c99c7c776aefb9f9991f3f402
SHA512 1aa28f09212904a50405cc7095f6625fe2cc8821ae9b40b9c7b3add07faa5b59111c15a488616be4e6793585017ed63298eab73e0bd1f874d7d949c60b6196c6
TLSH
T156E0867226FEDB7D1186C0935670B30F86F0790597CD7B8B674464906287D0462B46A5
MD5 SHA1 SHA512 TLSH

Submit Download

QuotaManager-journal

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\QuotaManager-journal
Size 12KB
SHA256 d36e9bdcad5ee4949919dbf0863de5f66ec0080fe4a2c81f8fb49ff48a0ccf36
MD5 0435a590c42eb8d1039fd840154a97e6
SHA1 6f98835285650fe40ed0cfd6ec35fe4600e7d1c0
SHA512 2568afd49a6fac74cf6145dc31b1f414854cc38432e52ef2d94a830c1ac989608c554e09407d616e4f19e1c02da98f49666dfbd2a59dd437551768ef0bd2d326
SSDEEP 12:XqVkBBnitlQRXXwX4aQV0RmLULIiRcqVkBy:XQ8n+QRXXwX4aA0RmLULJRcQ7
TLSH
T1E84222CB78259C5EC8DB093CC6DE98C22826493C3A53352A1CE989566CBD613C809B97
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\000003.log
Size 22KB
SHA256 3305d65f6950333871a7b3d822aa2259370ab56d8093687a51f8fd979a21a545
MD5 6dd5cbf5be095bd6c812c290de66c17b
SHA1 6c54df7a40b58ce4d577a79f9b98b17822940bc5
SHA512 e6e3424158b0db06903b359c27078426a58dda67ec34deecdc7beb8081fcf6f0727a03b981f133f7d429ab5d4748a0ce17b1bb8f590c251101fc330051bcaad3
SSDEEP 384:eNLfsdG+CILQ2IIIBb5MIMIBLUPNsdGOCqS9sdGbgjA2sdGoPR:3CILQxO9PR
TLSH
T168A2D796E7F01B9DCCFF97FBBC558C3E0772FC89445A0002A0D95A6B24B3E1A6981746
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\LOG
Size 317B
SHA256 41c6a15b604ecb6f6c34ead683fb1af9c788dfd10770ad5b4affe20aa4810747
MD5 1c1e87866087eda7728d6e015afca8a0
SHA1 c4adb8ba50f47df7ce99c2aaa9c10e05e5652c32
SHA512 82dc0585923b0e2efc749933a0ee079a8be6380c947e7aa6f56466ccadb610929d4d18ea02e84d19436ac9107cbfb7b3d7badf0949c39d81ab037e74ee8f8605
TLSH
T1F7E0260279FAC7AE60E6C02B1170770D87C1B90AEADC2B8A2F41C044528B808B380642
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 c5776d21bc6d9a88f4066baf776c371650b5a25e2b57f23bfcef77e27c0ea9d6
MD5 f9ec947a737c9e9402cb6ce146fd3bf6
SHA1 7aa455be0ade9d6d0e5a7387b34acdc391d53b1d
SHA512 ae51368a249ad66478167324a24ff65c7ac6e3a9cd48c27a4d049c207ca8076b127f92169bf2ade26ad91e6ed6879e7d342c8abcd6cbf23a6aa87176807342cb
TLSH
T1DB21F555F334C248C24A467A613E5B151334C4668FB8ED1F59BA24683E76A010E472E5
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\LOG
Size 335B
SHA256 9c39ccd13c73aef92d2b292ec763cbe275fc59f28801cc21f7f6c3e7e4b82d10
MD5 2681d0a2a7f87d357908c987b2a69db3
SHA1 27fa318936ebb236623fe392d2affc1a9ce2d3b2
SHA512 eecc97bbf8edef6bd62e6b57b25b4c7bd44376d7c69f5460c6d189a5d8a563e4304bbc365216192465c2788be4682466d53f49fdaa3d7171144e66b846e9d58c
TLSH
T126E0260278BACABF409881134174A34D8AD13E02FADC3F0F4F84EA885A8B804B289642
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version
Size 13B
SHA256 e5efa9eb104cd0b25149c2e789bec8d9aa4ba95678831b657eef7780a281c391
MD5 43ef949d3c6e9956545979ace65d0085
SHA1 63f2b2de8727854597e49a1216e8e74c68117c07
SHA512 313a5ab7ac9b5efd955beba4615784bdc2a9058ddaa804d85fb2d0c651dd3de07e382d61a1bb482499520a80e0b64c004ff2af03459cbc1daef47f540f0a6905
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 232KB
SHA256 2056dd877490959c86df23cd26bc190804e7ec40b8f8c52e4688219ac0dea5c6
MD5 50c75a9ba2519d9bc88f64a758fdf4f3
SHA1 fa1f6fb79729ffedfd8d8d03756cdbecfb36e2f6
SHA512 331c5f37c5eabaa4bdcb39b46b6c1fbd78dc4af68aaf381397c7ffc63f09053c01213a78b27d40672cc8c2c933feea93944590e5853c66f6ae1fe2f010c7f9a8
SSDEEP 6144:yxBZ4YNceHqYhV4QQspKICmFRn+ToZp3LfqBZqenbyyVEd1cB14:yxBZ4Y649hV3K4RnQoZhLCVDuen4
TLSH
T156341232F97AFFA7D26AB31C7D57971D3DE158B714E1CB8800782F0E918D588AE19841
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 233KB
SHA256 72564e40ef600df8a94b9e4c2f251a97cf63561f31c347c00db2c7f1d724bea5
MD5 259199d99bac740de96fb34922aed20f
SHA1 726fa569a2096d6d10e0979a7d43119dd96b97a8
SHA512 79a551c248e4ceae6ed72fb91d87d7b2508a59b2f9f0658ff9d18f401c6f560254cf93df8e94b5256af3e5330229237a8c7f952dc4d16f53e352403f4d3e314a
SSDEEP 6144:mxGZ4YNceHqYhV4QQspKICmFRn+ToZp3LfqBZqenbyyVEd1cB14:mxGZ4Y649hV3K4RnQoZhLCVDuen4
TLSH
T152341232F97AFFA7D23AB31C79579B1D2DE158B754E1CB8C10782F0E918D588AE19801
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 233KB
SHA256 441b22aa19b32c0f09ff8ad491a16eed1935954a00afdd14dcfd8748f5fed30e
MD5 0cef3a54c993fdd92b31d82fe3ec9acf
SHA1 9366efb207ee2ae41559a87585af4dbcdd94b459
SHA512 2a824b8bf20597fdaad55777fcdcbb918f069853562849a827d955e78a8fea158f25114d6d97726740e1dcdc290046a57fb01cde3c9c611aea25d738b3c5c399
SSDEEP 6144:yxkZ4YNceHqYhV4QQspKICmFRn+ToZp3LfqBZqenbyyVEd1cB14:yxkZ4Y649hV3K4RnQoZhLCVDuen4
TLSH
T1F7341232F97AFFA7923AB31C79579B1D2DE158B714E1CB8C10782F0E918D588EE19801
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 52062f754293f8b699b2c5f77652ed325cec3d588df5f90b46ddc71ca64e1aaf
MD5 3224cd332ba7c818a129f4b485bb5025
SHA1 ec5077af8f925240299b834db812bc07a7daabcc
SHA512 57569f0a3b9c0d3d83a6e2ee72fc61cda637dfe87964b78e2a4ed3f921286e3f4bd0b4c836f56f22e41a05069be81d37ff2681fb6a4164b4a88af719806b3cb6
SSDEEP 3072:Ixjw3LffUnBKU/F8enCW3iyVEXGey0cB12:Ix83LfqBZqenbyyVEd1cB12
TLSH
T17EB31221E5A6FF6BA275572AB50F93295CD148BB44E1E788443C2F19E0CA3C8EF98D44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 08f482d03df1024a89ea1cf1c2aa6269aede22a1f829be74f10695ef30479d8a
MD5 e42a6fb82ff586950a8185b0641c0ee5
SHA1 df601d27f6988c00837a75d00406dacf6d8b2dc8
SHA512 f3b2fcaf15966799cf67b7081b9910407c8eacac19f4b839b82682a9eef60f101b5f6f5e218ae0935082d1f946ce178d2edf81e00396abd9fce2cf5706b84b0c
SSDEEP 3072:Ix+w3LffUnBKU/F8enCW3iyVEXGey0cB13:IxN3LfqBZqenbyyVEd1cB13
TLSH
T178B31221E5A6FF7BA275572AB50F93295CD148BB44E1E788443C2F19E0CA3C8EF98D44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 232KB
SHA256 f86eae6bad89e9bf83209df2c849bd5c2a20ca2508d25b844ce5f8970f7f9cb1
MD5 06de6e9ef5dbb60cd60718d446981418
SHA1 f52a8c7319f76f657f6937a0155451d218f437d0
SHA512 ae779b69bb811edc0978cf6b243acc6dbeefe25f49226ed478def58c8ce7a6a1d50229e8b9eb35c4222682c9178c39eff3cb5e28c57ca0ef95ad5cb7b1b257f0
SSDEEP 6144:bxBZ4YNceHqYhV4QQspKICmFRn+ToZp3LfqBZqenbyyVEd1cB14:bxBZ4Y649hV3K4RnQoZhLCVDuen4
TLSH
T1ED341232F97AFFA7D26AB31C7D57971D3DE158B714E1CB8800782F0E918E588AE19841
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Variations
Size 86B
SHA256 2741df9ee9e9d9883397078f94480e9bc1d9c76996eec5cfe4e77929337cbe93
MD5 f732dbed9289177d15e236d0f8f2ddd3
SHA1 53f822af51b014bc3d4b575865d9c3ef0e4debde
SHA512 b64e5021f32e26c752fcba15a139815894309b25644e74ceca46a9aa97070bca3b77ded569a9bfd694193d035ba75b61a8d6262c8e6d5c4d76b452b38f5150a4
TLSH
T168A012078473800AE4184092C45C024114A480460119D0015070931314950CA03A5435
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7a531d1df9cdae01b650e532ebd4a8c9a4289931e89fb896753dce715d03331d
MD5 e993dcf44300205328a008fa868eaab8
SHA1 005ea0762927bd4df122a5932c9a47e268573e57
SHA512 021dc142847ba30397366fece985ced0649c66fc9ddfa58b99261463107dce9ca4fc43a79aa0b2985989883dd5a6644c2fe5b1c87d24a8455123f7d724943ff2
TLSH
T1D6D012232A9DB411FB695274A812CB00173655A024868711E211C49C86741D862D7587
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e51b9bee3c2dbb63afcbacc2cde944a53371e66aaf1c8ba0bf71c7ee6eab83a5
MD5 2857cf1b0f1c8c30a6b756a34a37a836
SHA1 b21564c162ba15d8314ad459931f7f7c36b82ddb
SHA512 9fbd8c2a41b37b8a8425570de1371b59602556a9f89dcecaf471ea286b3538f518e368873fcf7b34ac36d9a7de7577953a1abe80c4995e05e1202c1b270d8dab
TLSH
T1F9D012232A5DB011FB695274A812CB00173655A024868711E211C49C96741D862D7587
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 4d4f9c93416f9dd35c7e5ea420c58967ce34f686685691a6a89b6c8af3aee6b3
MD5 51b0916c23f474e894dd0890d9829c33
SHA1 3214edef1e35a5dccb9c96c67f639493c4a54d03
SHA512 229a1f2ba990dbce6169ac12fea03ba10e9af8c33ece1cb6162fa2b48fb4ac2f0fea1cf770c28ee3e8a3791d934b2b3db4e0fd74d6a6e19c37c00828e53c609e
SSDEEP 96:KUQwKl2CqecKjSWWniKwkH+8KfaqG/iK4Mq:yLvTRHfZP
TLSH
T158E15556717A12A378BE2908A25287374E5171B3311CE7AF7BB840A60E67F112DFC9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 0c8699c2a3bcf20ffcf750ea61aa517355455851af97aa22609ef2476b0b1451
MD5 a635235a85381d88588b5c444486b5bb
SHA1 f6260590e5c328e9263c98d97bb899a76ae341d5
SHA512 6b2dca0417e2eaeca1f5e407eb07e19f34bd971c6482989154dc521d1a88493ea3aed7da6ffa5c736555f6fa8196010eb82b6b62e5a42e207ec5d3fe48bf646d
SSDEEP 192:lONHt6JpdQmiUyn1gcQ4sw2KhaFgsFHPnJU6:lONHt6jAgcQ4sw2KhAgkRU6
TLSH
T15D02E935A8787CBA9EF3AD45F8872B235FE41137E6D16B44DAE81B0C00DB24C1307926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 c696119c793be3792a89a2ae3c4ae1363c9ef20c6c233f5cf8a80321031444f0
MD5 a9ebd5de8897094e6a0ede5c4237e705
SHA1 c2612c20c0018872e09a8e17a935a4e7b914137e
SHA512 6676c1338bdfa0852d22abfed56360d714353f1b1bbaf059e2e02f769e5e073518f483f6b3b034367995ab6e004cbd931ffa38790e0922ecd3cf0f42ec6e1a05
SSDEEP 192:QONg6JpuQmiUyj1acQ4sw2KhaFGZA+2MshseqTKU6:QONg6iOacQ4sw2KhAGZA+2M7yU6
TLSH
T19212F83598787C769EF3AD45F8837A139FE5122BE7C56B54DAE80B0C01DB25C230B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 4889296f09d993b747b6b7e7efd8d1327144ff7007b88bb2f3381496e45ca989
MD5 9e714c56a767aca67453cc1ccc2b4469
SHA1 c9cd3f434bf602c463c0c9b43e2e31927fe43553
SHA512 190ab3738484cfcfdf3dbbc8f7da53e46b22e3f9086695b4b7f05fda97196c822ddb37dab26a0111f7efe5705bea4ab759a51437bc4a2620c7aed28ef3325ac9
TLSH
T18F41045DBAF91148B3F36F16ABF6A96E447FBD372E0AD45D00110E4E0A22A00C861B37
MD5 SHA1 SHA512 TLSH

Submit Download

ParallelEn.exe

Path C:\Users\Admin\AppData\Local\ParallelEn.exe
Size 2.6MB
SHA256 54ee56421a67088a76359c6fab0ff64a5d105666b8e226b0fe2b8759bfbdde10
MD5 74585993ad66f985febcc9bfe0cf699d
SHA1 bf6739a1d3ca31d3c84ff37b78ec26473881c66c
SHA512 5f8ee722948e08f69ca7c4080df8da1aa40c30a2a03834883a4f2dea0bb9092499007acf81cfed543cbf3dcd6ad935cb1df93bf80a6a100eb55494700ce365af
SSDEEP 49152:9/Qp+T+WQLh5tA5pD5mgQUQFqNNHUhhyHiz55Q/FT/pgMXm:9/Qp+TEN5o5QUm2Uqiz5qpM
TLSH
T16AD51832DAF3813BF5B200F6A6E9562A7D159B209704D3C3A184AB585BF0DD36B76307
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1qxCEIt.7z

Path C:\Users\Admin\AppData\Local\Temp\1qxCEIt.7z
Size 17KB
SHA256 24939914c91d524223bbe28cccf9ace5d6ee7f3cc52d9d0b25965de63a59860d
MD5 f04dc254baae6edca822498f3dd693f9
SHA1 e8cdab879af2dfa22c2e6627cd0311b1198ac3b4
SHA512 4522f34e4c4c8abbdaef83a8f09ce7fad8860e238b9a60ed51dda3d7bbba8932dab9e195bd6523253d641843467a7e4cf9ddc4d0577f555f2868b7bce77574f2
SSDEEP 384:4PBWa294U3yvxcVPhKCJ3eY3iQrhjDWpsLCtvCJo:6Wa29kvgwQrAsix
TLSH
T19182D0ADBAB3EFEAE963717945463C60237D9B107D93648F03738B8F5C1401115E2740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

26C48AE.tmp

Path C:\Users\Admin\AppData\Local\Temp\26C48AE.tmp
Size 40B
SHA256 6120f72ade277af0d63ac9dc02d3ba4c818f394e57eb6752f14a64e3ca3856cc
MD5 9f740ce3ffc877d5fdc29e7dff41e400
SHA1 bee43be262a144b93314c1dd53b84738504b82e7
SHA512 4796231f07e02faafd946ec02ed03c6c2e85428b8db8291c80b8ec4ed3bd6023a43f665568bfd3dad4f172741f04a554702e59354f66a390c5725dd9a7fda420
MD5 SHA1 SHA512

Submit Download

370317B.tmp

Path C:\Users\Admin\AppData\Local\Temp\370317B.tmp
Size 4.9MB
SHA256 31bc3e606994d89ffeb82d1c422a9bac6512e1c7b357fe9c8a3fe0fd89e03480
MD5 301254662c6367fdc4178be5c1ef1663
SHA1 cf769de2361a92e9afa2830a98abb07b6edf0375
SHA512 d9feaa38c35d2d4e098f4ef1adc5fe80dc3224dfb1635b5d7ac1e8b4133365ecf49a98b6689cf7151673111b430e0a3127908ef85a9e56e635da7069d6dd0b7c
SSDEEP 98304:TNR5f4BjgTkJTahGjf2N4Y/shM/Z5mhbwYNDHe6CBZeeyjc/DMJwpWaZ6GBQC:REB0TGamW/rZ5iNze6Crkc7OaAlC
TLSH
T13C363337D4FA12B195A94DB6F1C588B2E443A82E97D027D40330099F4C64FB5AE4EEDE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

370317B.tmp

Path C:\Users\Admin\AppData\Local\Temp\370317B.tmp
Size 4.9MB
SHA256 f486d98dfd1bf901f96f0dab4dd05eb58174542cd235cd6618cf1739cac5632b
MD5 78ee4435b567602e158497fed5c2d377
SHA1 1830398a47e1abd84b3bb30cfa9aad07704a5ff5
SHA512 b3b99c09124c78b2fb777545e5740c397556587482752c9c952aa8ee2678b9206f51dc39102ec47b2caba5afc05b66efa5c4aaee9a48d61de0785c8d8088e91d
SSDEEP 98304:yNRsf4BjgTkJTahGjf2N4Y/shM/Z5mhbwYNDHe6CBZeeyjc/DMJwpWaZ6GBQC:2HB0TGamW/rZ5iNze6Crkc7OaAlC
TLSH
T13A363337D4FA12B195A94DB6F1C588B2E443A82E97D027D40330099F4C64FB5AE4EEDE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4f660328-4a95-4db8-a400-683d31f6756f.tmp

Path C:\Users\Admin\AppData\Local\Temp\4f660328-4a95-4db8-a400-683d31f6756f.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

5236520.tmp

Path C:\Users\Admin\AppData\Local\Temp\5236520.tmp
Size 40B
SHA256 1b180a4bfe9142be65e27e2f465bfc438788943c2f85fbaae9b5d91a6a511693
MD5 3c338ed1ad24cee6b7edbce0eab5b3ce
SHA1 60ed36314fa202ec82c049e33c1fe8211d55ad6e
SHA512 876e1c0c6b8c985cfe3501638d9029c8b0c52870ae19b7efd4b84a600e49940d463453e011d46327e76046c40c5e72cf75a4d8161bfbd2a483bcb7baae4849ec
MD5 SHA1 SHA512

Submit Download

CF4F4D.tmp

Path C:\Users\Admin\AppData\Local\Temp\CF4F4D.tmp
Size 14.1MB
SHA256 5a686b0d5105aa4ae57a8f30285c49ac5967d488373e065a9a82e43b3b9ac28b
MD5 3209bad0518a435aaef5db7b7fc6f945
SHA1 79863bb5d3c4fbd5611ffde26ed55b8cb48c8e0c
SHA512 bd95bda180568fadb5433be091384bb20adb71e0cf7ec5c7d791fd71840a66704d333d93e8e14bc6c3956ce0b016ec7e9727d13995875691fca75d753be75005
SSDEEP 393216:uEoXBXUFTk3GB64KYTGysKcfoPcOPlMflZPYGm:JF6GB64KYT1WMcClMtZPm
TLSH
T1B9E633873BB9581FD5BD3A0209294CAC27EF9D8953129DF1F44036A8E75DCA6F4308B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CF4F4D.tmp

Path C:\Users\Admin\AppData\Local\Temp\CF4F4D.tmp
Size 14.1MB
SHA256 d3f1b4751df3156279fc9f7c5a168676614a9c7e4690f6f1ef0716f735ed3084
MD5 003e8af6731a1b760f84a385649eaa69
SHA1 a76fc26ce43d96641e2198b13cd0d1432798429a
SHA512 b1415be7fd54658061f0009d8659755fab4e5d2160bae1ce85ad630965586a839da63e7a09d81d07724fd86fe9a78dace11e811406f5bc75763696aa1bcd70b2
SSDEEP 393216:AEoXBXUFTk3GB64KYTGysKcfoPcOPlMflZPYGm:LF6GB64KYT1WMcClMtZPm
TLSH
T1BCE633873BB9581FD5BD3A0209294CAC27EF9D8953129DF1F44036A8E75DCA6F4308B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WEmulator.exe

Path C:\Users\Admin\AppData\Local\Temp\WEmulator.exe
Size 298KB
SHA256 ae7f750cc8e002804edbf463059b60d9ac9d1c97155f532de4380a81a22a0f39
MD5 16b92c67941b88d3a350b50fac597909
SHA1 b4438fffc5c4cfc2960b28d6353d72814108e971
SHA512 c0427996dc071967f846814ed7459790c1d3d53012e035670fe7f6584dbd57b9038c262378e785ba60c430a2104cfdaea00f974d5ed77a5dbd7d6fe8f7dcfd09
SSDEEP 6144:uIh7SRcY/zlwgqtDBcMqhvxfYZXQmoadW:P7SflVq9BcjoNM
TLSH
T1DC548E2AF3A814F8ECA7C27CC9464916E77278050360CADF17A046663F376E05E7EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Crisp.exe

Path C:\Users\Admin\AppData\Roaming\web_store_shell_v5\Crisp.exe
Size 334KB
SHA256 c2e62475768c9546efe1da92a55f3bb2a55350eed83241139917aabd1ad25f8a
MD5 5f9f88c9a16b62dc38504549e93d3667
SHA1 587d56031b39e34102bc67b5f7d0338ee41b5328
SHA512 edbb7a8cd75e056d2c47b8af6fbee63726cb3d5f000d5f8bc000f4b16366619c8532e628585cc943f474d2509c63802179d0d22a1d32dd690fb25e00d262af83
SSDEEP 6144:7c2XFRJ3DNuzAOS9FuxIRtiiuhKPTqX4Y42:dFvYzU9kutRuhKPTqo32
TLSH
T125749E11B9D1C4B2C4B2053009E8EBB5697DFD714F61863B33D8772E1F742C1A662AA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Eztwain4.dll

Path C:\Users\Admin\AppData\Roaming\web_store_shell_v5\LLUJZCFEHBX\Eztwain4.dll
Size 1006KB
SHA256 3ba8def47d369dfdf0c15cbeaf33baa1677342c57de97d1d659a120b6c64c792
MD5 69ccf0eafa559e506b4e6e2773cbdb48
SHA1 79969ff9b3907bd8ce65c28408d5412d37ef40fc
SHA512 06da3d3b9d2b8d08cd83f63e3027a0b4c6cef0bd0af635f4231cb91301060636043cb3130af63841915a03a9acf389b36e7de05a7cf89675126ba436ef22467b
SSDEEP 12288:rDIQ1WJW6u5JqsaT8GNqHvfKn1QlTtY2X8RuCLITH5a:rDIQ18EHoQonIz0
TLSH
T1FD25070099F0C4A2C8700C7FD5AA96F56D76AC59FB1682E396483D7339F13C01636AEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Tech_C.exe

Path C:\Users\Admin\AppData\Roaming\web_store_shell_v5\LLUJZCFEHBX\Tech_C.exe
Size 576KB
SHA256 3769996f8267fb2ee2a1819ed2cdf1746257283e2dcfb28f71dd9f8b4d994b55
MD5 c78fcfeeba6e2ae52f28efd2e054ae89
SHA1 894b2932d7e3cde0a42d2249063c5e058a8b9b38
SHA512 883e8e7cb17596544d7e80415cb9c06484c116d1de71add047084356208ff4529a691b23dbaeacdd770f104ae9a325cff3bbe2b532055749ab8f7aff4ca2e596
SSDEEP 6144:qQ/wOnH9FzvPHuifBbUvqBPfGXO0XnUsFTb90nKg2Gedar:qIJ9FbHuOuXXNT55T1dar
TLSH
T10EC419203715853ACA7252B298A86FBF302DEF144BE44DC7A3D87A2DFA715D35A31607
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Roaming\web_store_shell_v5\LLUJZCFEHBX\VCRUNTIME140.dll
Size 88KB
SHA256 bf33857f46e56ea7930c1eea25c5f7175a6aaa3df36bf8301a785e6ca726a0b9
MD5 c33386a6e67be415a24d9c431ffd42ac
SHA1 f2f23860916471bdc332b3bd3e88deef64d4432b
SHA512 bc6d5e908bfaa7a35a8f2e01912412b9460604ea19fd27ee5c6f1a05eb0180a07bf7bc26d430326afc9b81d7f19fb1899e6245196a37710c3e5346d0bc2b4c98
SSDEEP 1536:EbiyVUrqIQsn1xtg6RxkkBGCGHDWbWXaecbGasQLvBrzU6LzNa:eiyLyt/xcRjWaXaecbGzurJBa
TLSH
T100937E5235E482B2DDAF04F0D97AEB076A3DA6900FF129F76B949949DE617C0D73020B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bridgefmt.rc

Path C:\Users\Admin\AppData\Roaming\web_store_shell_v5\LLUJZCFEHBX\bridgefmt.rc
Size 18KB
SHA256 0128fae3ce35c1a5a51cc47a1caab3d848df518f4227b32818547dede86b3809
MD5 c27a3cb0761fe426f12a475bd20f0bd6
SHA1 481328e47607e173dad8182cb18336d73ba54dfe
SHA512 61b9387b053a61740dc62a11b9ad75fad07c88e9e60fa528aabe1704f478af2ca39ad12c1c8cc57095fd80d5ca8a9ed81e6e75afd53ebebcfb093c107f39c94e
SSDEEP 384:fWNP9FpeI/ZY9Vp/HZv+eFnyEUKX1woJ13r/3pfCxLR4XNJ3fvkTrY+:faVFMcZsZ5yEUKN1z5fCxLorvvYp
TLSH
T15D828C79CE166B35BC2915BDCA69F1919640B8B16EDF6CF325ED28077C38248C636C13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mfc140u.dll

Path C:\Users\Admin\AppData\Roaming\web_store_shell_v5\LLUJZCFEHBX\mfc140u.dll
Size 4.6MB
SHA256 a7c07cc937b9a58794472010d5c90bc5c3c644b339d42b5917573ecd6bf0615a
MD5 958eea0559ac31d5b97c2454233fbfb1
SHA1 acc8f7a765ccd7a389acd39450a14d4d05a33267
SHA512 d32d28b0a9b876abb63efd1788f0c05caf68e865f482e82d578862af524b6195441b297e71b0af2c02b62087b5a79cce3d4df992905419381fb5f5f9ebc864ad
SSDEEP 98304:Lpv7jCfioUprPFRs+6+23X5nFg/5s1iBWHBvFLOAkGkzdnEVomFHKnP3Rr:xHnrPzs+z2HMCoBWHBvFLOyomFHKnPB
TLSH
T12836AE507D8800B5F98E117A8A6CAEB5E56EAC28133E11D77111B71BE431FE31E393A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140.dll

Path C:\Users\Admin\AppData\Roaming\web_store_shell_v5\LLUJZCFEHBX\msvcp140.dll
Size 439KB
SHA256 2c0a3e328419b3b50b0430f38c6b5882e302177f4b003aba6a0e7e035807043d
MD5 c53b950681b9f07a8d56f2ff272cbf5c
SHA1 0ec5c6084b6ce4e9a0ed3cca02ba464450f19d36
SHA512 a48c886ff9dd34344094c00c8ff18ee91a359f06dac4cd42c2e054857cd0a12121ba4baf8e85d158fad5a62dfe4c694e5d80c4682564fe07205ca69139a364f5
SSDEEP 12288:n82bIggWBCs9B+zJT8N/oaTvlbJLsRXhUgiW6QR7t5s03Ooc8dHkC2esjeX8:nbTgWBCs9B+zJT8yaTvlbJLsR003Ooce
TLSH
T1E1A418227B064DF1E58923B572C6431293F9FC654361E3C3A7DEF0692F662C6A633291
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

registrydef.yaml

Path C:\Users\Admin\AppData\Roaming\web_store_shell_v5\LLUJZCFEHBX\registrydef.yaml
Size 3.6MB
SHA256 3ac184309af366312f26fb69bca016d11840d078446f7354c67ec1c93d105afa
MD5 11dbfcd5a89430c92b0c89fc7b116640
SHA1 89f7700d6f9627374a28676e646c51013cd70a34
SHA512 6f40bc6b5bc24a26596b3034ac6b644d5d03b20a19d65ef4a149759dbb985bfd477e2ad21c51df6a0b85d5c26c8b09cd6fcc122d8ad7ce604a19fc7ebb62ae3a
SSDEEP 49152:Ww/RgtQQFzZineY0JQTL3pIN6PP4FpQjobVJdQlRryTo1dXcnrRLaVm+fhQl7/Ra:DaQQ/m3pIN6IQsClR7DStYh8I
TLSH
T18D06239D4CA895FEE81605B04C62EAAE77BC27F363DD394C2E8E05640989275C1C9F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/64-71-0x00007FFED9AB0000-0x00007FFED9CA8000-memory.dmp

Download

memory/64-433-0x0000000000090000-0x000000000043A000-memory.dmp

Download

memory/64-302-0x0000000000090000-0x000000000043A000-memory.dmp

Download

memory/64-66-0x0000000000090000-0x000000000043A000-memory.dmp

Download

memory/64-305-0x0000000000090000-0x000000000043A000-memory.dmp

Download

memory/64-368-0x0000000000090000-0x000000000043A000-memory.dmp

Download

memory/64-450-0x0000000000090000-0x000000000043A000-memory.dmp

Download

memory/64-129-0x0000000000090000-0x000000000043A000-memory.dmp

Download

memory/64-466-0x0000000000090000-0x000000000043A000-memory.dmp

Download

memory/64-89-0x0000000000090000-0x000000000043A000-memory.dmp

Download

memory/64-526-0x0000000000090000-0x000000000043A000-memory.dmp

Download

memory/64-528-0x0000000000090000-0x000000000043A000-memory.dmp

Download

memory/64-549-0x0000000000090000-0x000000000043A000-memory.dmp

Download

memory/692-6-0x0000000074DE0000-0x0000000074E2F000-memory.dmp

Download

memory/692-5-0x0000000074DE0000-0x0000000074E2F000-memory.dmp

Download

memory/692-1-0x00007FFED9AB0000-0x00007FFED9CA8000-memory.dmp

Download

memory/692-40-0x0000000074DE0000-0x0000000074E2F000-memory.dmp

Download

memory/692-39-0x0000000074E0B000-0x0000000074E0C000-memory.dmp

Download

memory/692-2-0x0000000074E0B000-0x0000000074E0C000-memory.dmp

Download

memory/692-3-0x0000000074DE0000-0x0000000074E2F000-memory.dmp

Download

memory/692-61-0x0000000074DE0000-0x0000000074E2F000-memory.dmp

Download

memory/692-0-0x0000000074DE0000-0x0000000074E2F000-memory.dmp

Download

memory/692-15-0x0000000074DE0000-0x0000000074E2F000-memory.dmp

Download

memory/692-27-0x0000000074DE0000-0x0000000074E2F000-memory.dmp

Download

memory/3152-301-0x000001DF39C00000-0x000001DF39FBB000-memory.dmp

Download

memory/3792-464-0x00007FF6CF440000-0x00007FF6CF674000-memory.dmp

Download

memory/3792-481-0x00007FF6CF440000-0x00007FF6CF674000-memory.dmp

Download

memory/3792-434-0x00007FF6CF440000-0x00007FF6CF674000-memory.dmp

Download

memory/3792-369-0x00007FF6CF440000-0x00007FF6CF674000-memory.dmp

Download

memory/3792-304-0x00007FF6CF440000-0x00007FF6CF674000-memory.dmp

Download

memory/3792-63-0x00007FF6CF440000-0x00007FF6CF674000-memory.dmp

Download

memory/3792-131-0x00007FF6CF440000-0x00007FF6CF674000-memory.dmp

Download

memory/3792-550-0x00007FF6CF440000-0x00007FF6CF674000-memory.dmp

Download

memory/3792-546-0x00007FF6CF440000-0x00007FF6CF674000-memory.dmp

Download

memory/3792-80-0x00007FF6CF440000-0x00007FF6CF674000-memory.dmp

Download

memory/3792-467-0x00007FF6CF440000-0x00007FF6CF674000-memory.dmp

Download

memory/3852-44-0x0000000074DE0000-0x0000000074E2F000-memory.dmp

Download

memory/3852-59-0x0000000074DE0000-0x0000000074E2F000-memory.dmp

Download

memory/3852-48-0x0000000074DE0000-0x0000000074E2F000-memory.dmp

Download

memory/3852-45-0x00007FFED9AB0000-0x00007FFED9CA8000-memory.dmp

Download

memory/3852-64-0x0000000074DE0000-0x0000000074E2F000-memory.dmp

Download

memory/3852-77-0x0000000000F90000-0x0000000001024000-memory.dmp

Download

memory/4908-75-0x00007FFED9AB0000-0x00007FFED9CA8000-memory.dmp

Download

memory/4916-183-0x0000000074DE0000-0x0000000074E2F000-memory.dmp

Download

memory/4916-85-0x00007FFED9AB0000-0x00007FFED9CA8000-memory.dmp

Download