dfdd66db2c1896dc7e52095078c25a1060ab48dc3fe2c61376ff213050e178c1

Analysis

user interaction
yes
max time kernel
1050s
max time network
1053s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/07/2026, 12:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
link.txt
Size 395B
Sample260731-pytfdsgl8t
SHA256 dfdd66db2c1896dc7e52095078c25a1060ab48dc3fe2c61376ff213050e178c1
MD5 01304bb23bed459ba4519635257113dd
SHA1 8c1681d3ace8606bba770b4b33662d27bf0c175a
SHA512 525b0e5d27b6edefaaed33dc00346e00f7701ed16fa2754b164fd1d7392422e2f5c3d814cd5cb5486980970e0dcd892e21efaac9be1278d6c808cfd79f41380b
TLSH
T1BCE068E3DC038196560F5ECC24C229AAC61E1B8ED4F25E40A42881E86154B53A98BCAA
MD5 SHA1 SHA512 TLSH

Score

8^/10

discovery persistence ransomware

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
117	4176	msedge.exe

Executes dropped EXE 7 IoCs

pid	Process
4128	windowsdesktop-runtime-10.0.10-win-x64.exe
2516	wixstdba.exe
2004	windowsdesktop-runtime-10.0.10-win-x64.exe
5864	windowsdesktop-runtime-10.0.10-win-x64.exe
5556	windowsdesktop-runtime-10.0.10-win-x64.exe
6460	wixstdba.exe
7000	windowsdesktop-runtime-10.0.10-win-x64.exe

Loads dropped DLL 37 IoCs

pid	Process
4108	MsiExec.exe
4108	MsiExec.exe
3004	MsiExec.exe
3004	MsiExec.exe
4972	MsiExec.exe
4972	MsiExec.exe
6720	MsiExec.exe
6720	MsiExec.exe
6760	MsiExec.exe
6760	MsiExec.exe
6928	MsiExec.exe
6928	MsiExec.exe
2244	ObfuscatorGUI.exe
2244	ObfuscatorGUI.exe
2244	ObfuscatorGUI.exe
2244	ObfuscatorGUI.exe
2244	ObfuscatorGUI.exe
2244	ObfuscatorGUI.exe
2244	ObfuscatorGUI.exe
2244	ObfuscatorGUI.exe
2244	ObfuscatorGUI.exe
2244	ObfuscatorGUI.exe
2244	ObfuscatorGUI.exe
2244	ObfuscatorGUI.exe
2244	ObfuscatorGUI.exe
2244	ObfuscatorGUI.exe
2244	ObfuscatorGUI.exe
2244	ObfuscatorGUI.exe
2244	ObfuscatorGUI.exe
2244	ObfuscatorGUI.exe
2244	ObfuscatorGUI.exe
2244	ObfuscatorGUI.exe
2244	ObfuscatorGUI.exe
2244	ObfuscatorGUI.exe
2244	ObfuscatorGUI.exe
2244	ObfuscatorGUI.exe
6236	msedge.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{866BECDA-F284-473A-9E84-0CCE816BF06F} = "\"C:\\ProgramData\\Package Cache\\{866BECDA-F284-473A-9E84-0CCE816BF06F}\\windowsdesktop-runtime-10.0.10-win-x64.exe\" /burn.runonce"	windowsdesktop-runtime-10.0.10-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{866BECDA-F284-473A-9E84-0CCE816BF06F} = "\"C:\\ProgramData\\Package Cache\\{866BECDA-F284-473A-9E84-0CCE816BF06F}\\windowsdesktop-runtime-10.0.10-win-x64.exe\" /burn.runonce"	windowsdesktop-runtime-10.0.10-win-x64.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\ja\PresentationCore.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\zh-Hans\UIAutomationProvider.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.Security.SecureString.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\hostpolicy.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\swidtag\Microsoft Windows Desktop Runtime 10.0.10 (x64).swidtag	windowsdesktop-runtime-10.0.10-win-x64.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\it\WindowsBase.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\ja\System.Xaml.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.Resources.ResourceManager.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\Accessibility.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\de\WindowsFormsIntegration.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\ja\PresentationUI.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\zh-Hans\UIAutomationClient.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.IO.Pipelines.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.Net.Http.Json.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.Text.Encoding.Extensions.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\it\PresentationCore.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\zh-Hant\PresentationCore.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.Collections.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.ComponentModel.Annotations.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.Data.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.IO.Pipes.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\System.Security.Cryptography.Xml.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\es\UIAutomationClient.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\zh-Hans\UIAutomationClientSideProviders.resources.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\ThirdPartyNotices.txt	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\PresentationFramework-SystemCore.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.IO.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\ko\ReachFramework.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.Xml.XDocument.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\cs\PresentationUI.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\cs\System.Windows.Input.Manipulations.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\de\System.Windows.Controls.Ribbon.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\ko\System.Windows.Forms.Primitives.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\ru\Microsoft.VisualBasic.Forms.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\tr\UIAutomationTypes.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.Reflection.TypeExtensions.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.Threading.Thread.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\es\PresentationCore.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\es\UIAutomationProvider.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.Private.Uri.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\cs\WindowsBase.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\ru\PresentationFramework.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.AppContext.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.Console.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.Drawing.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\zh-Hant\System.Windows.Controls.Ribbon.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.IO.FileSystem.Watcher.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\System.Drawing.Design.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\System.Windows.Forms.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.Net.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.Xml.XmlSerializer.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\clretwrc.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\PresentationFramework.Luna.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\pl\UIAutomationClientSideProviders.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.Threading.Tasks.Dataflow.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.Threading.Timer.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\zh-Hant\System.Windows.Input.Manipulations.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.Reflection.Emit.Lightweight.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.Runtime.Intrinsics.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\msquic.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\System.Windows.Presentation.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\zh-Hans\WindowsFormsIntegration.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.Diagnostics.Process.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.dll	msiexec.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4824_699293186\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4824_699293186\_locales\or\messages.json	msedge.exe
File opened for modification	C:\Windows\Installer\e5c09c8.msi	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6236_192050827\LICENSE	msedge.exe
File opened for modification	C:\Windows\Installer\MSI5AE5.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6236_2133066952\domain_actions.dll	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6236_1864558004\Mu\Content	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4824_699293186\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6236_1864558004\Mu\Analytics	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4824_699293186\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4824_699293186\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6236_1864558004\Sigma\Entities	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4824_699293186\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\~DF94F96F66E71A550A.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4824_699293186\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6236_1139416068\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4824_699293186\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4824_699293186\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4824_699293186\_locales\mk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6236_1274555929\travel-facilitated-booking-bing.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4824_699293186\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4824_699293186\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4824_699293186\128.png	msedge.exe
File created	C:\Windows\SystemTemp\~DF0FADF3509B8AB288.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4824_699293186\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4824_699293186\_locales\vi\messages.json	msedge.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\91F309C43C4BC0D4C89C4D445C11FAC1\64.60.31149\fileCoreHostExe	msiexec.exe
File created	C:\Windows\SystemTemp\~DF724E085B0B9FB5AE.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFABC58289B9109639.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6236_1864558004\Mu\Entities	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4824_699293186\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4824_699293186\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\~DF8F5CE7A8E56F9C35.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6236_192050827\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6236_1109571391\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4824_699293186\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\~DF26D6880898007999.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5E81.tmp	msiexec.exe
File created	C:\Windows\Installer\e5c09c3.msi	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4824_699293186\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4824_699293186\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4824_699293186\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4824_699293186\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4824_699293186\offscreendocument.html	msedge.exe
File opened for modification	C:\Windows\Installer\MSIC4C.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1885.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6236_1274555929\classification.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6236_1864558004\Mu\Other	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6236_898527573\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4824_699293186\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6236_1512849358\regex_patterns.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4824_699293186\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6236_1864558004\Mu\Staging	msedge.exe
File created	C:\Windows\Installer\e5c09cc.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF0DFDE6FC97C6FB1A.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6236_1864558004\Mu\Fingerprinting	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4824_699293186\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4824_699293186\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6236_476619516\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6236_1512849358\v1FieldTypes.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4824_699293186\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4824_699293186\page_embed_script.js	msedge.exe
File opened for modification	C:\Windows\Installer\MSI3D86.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI45B5.tmp	msiexec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wixstdba.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-10.0.10-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-10.0.10-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wixstdba.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-10.0.10-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-10.0.10-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-10.0.10-win-x64.exe

System Time Discovery 1 TTPs 3 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4176	msedge.exe
6504	msedge.exe
1400	chrome.exe

Checks processor information in registry 2 TTPs 23 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 24 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2c	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2C	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2A	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\29	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2d	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2B	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134299757151460153"	msedge.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{866BECDA-F284-473A-9E84-0CCE816BF06F}\Version = "10.0.10.50000"	windowsdesktop-runtime-10.0.10-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\F94CC8A8E1D7CD547B5B53FF162A2CE5\MainFeature	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F94CC8A8E1D7CD547B5B53FF162A2CE5\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\dotnet_runtime_80.40.55332_x64	windowsdesktop-runtime-10.0.10-win-x64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E2BFCB0F8784E6F4DBD5A3FB2F4628E9\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4	ObfuscatorGUI.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2FA394AD12A558D4BB7557D75752BE37\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{DA493AF2-5A21-4D85-BB57-757D7525EB73}v80.40.55332\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_80.40.55332_x64\Dependents	windowsdesktop-runtime-10.0.10-win-x64.exe
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2FA394AD12A558D4BB7557D75752BE37	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1"	ObfuscatorGUI.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616257"	ObfuscatorGUI.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\SniffedFolderType = "Downloads"	ObfuscatorGUI.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F94CC8A8E1D7CD547B5B53FF162A2CE5\SourceList\PackageName = "dotnet-host-10.0.10-win-x64.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\{866BECDA-F284-473A-9E84-0CCE816BF06F}	windowsdesktop-runtime-10.0.10-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\2FA394AD12A558D4BB7557D75752BE37\Provider	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2FA394AD12A558D4BB7557D75752BE37\ProductName = "Microsoft .NET Host FX Resolver - 10.0.10 (x64)"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_80.40.55332_x64\DisplayName = "Microsoft .NET Runtime - 10.0.10 (x64)"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{866BECDA-F284-473A-9E84-0CCE816BF06F}\ = "{866BECDA-F284-473A-9E84-0CCE816BF06F}"	windowsdesktop-runtime-10.0.10-win-x64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\Shell\SniffedFolderType = "Documents"	ObfuscatorGUI.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4"	ObfuscatorGUI.exe
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E2BFCB0F8784E6F4DBD5A3FB2F4628E9\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{F0BCFB2E-4878-4F6E-BD5D-3ABFF264829E}v80.40.55332\\"	msiexec.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	ObfuscatorGUI.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F94CC8A8E1D7CD547B5B53FF162A2CE5\PackageCode = "BB5A5A59AE909304FB0B47459E96A72D"	msiexec.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\1\0 = 7200310000000000ff5c056610005241535042417e312e4441420000560009000400efbeff5c0566ff5c05662e000000a3c5010000000c00000000000000000000000000000036317a0072006100730070002e0062006100740020002e002000640061006200650061006e00730000001c000000	ObfuscatorGUI.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{866BECDA-F284-473A-9E84-0CCE816BF06F}\Dependents	windowsdesktop-runtime-10.0.10-win-x64.exe
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\3	ObfuscatorGUI.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\3\NodeSlot = "7"	ObfuscatorGUI.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295"	ObfuscatorGUI.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_80.40.55332_x64\Dependents\{866BECDA-F284-473A-9E84-0CCE816BF06F}	windowsdesktop-runtime-10.0.10-win-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\5D9ADA2B34E5318566B5BBB43BFD9EF6	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	ObfuscatorGUI.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1"	ObfuscatorGUI.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0"	ObfuscatorGUI.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\1\0\MRUListEx = ffffffff	ObfuscatorGUI.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295"	ObfuscatorGUI.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Version = "1"	ObfuscatorGUI.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_10.0_x64\Dependents\{866BECDA-F284-473A-9E84-0CCE816BF06F}	windowsdesktop-runtime-10.0.10-win-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2FA394AD12A558D4BB7557D75752BE37\SourceList\Net	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4"	ObfuscatorGUI.exe
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2FA394AD12A558D4BB7557D75752BE37\PackageCode = "BA29397271C91884FB92390B1C9257AB"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_10.0_x64\ = "{8A8CC49F-7D1E-45DC-B7B5-35FF61A2C25E}"	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295"	ObfuscatorGUI.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616257"	ObfuscatorGUI.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{866BECDA-F284-473A-9E84-0CCE816BF06F}\Version = "10.0.10.50000"	windowsdesktop-runtime-10.0.10-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2FA394AD12A558D4BB7557D75752BE37\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0BDCF144A30A03141A5DFF8D5CC3FFB6	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	ObfuscatorGUI.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616257"	ObfuscatorGUI.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	ObfuscatorGUI.exe
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg	ObfuscatorGUI.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	msedge.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2FA394AD12A558D4BB7557D75752BE37\Clients = 3a0000000000	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14"	ObfuscatorGUI.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_80.40.55332_x64\DisplayName = "Microsoft .NET Host FX Resolver - 10.0.10 (x64)"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\0BDCF144A30A03141A5DFF8D5CC3FFB6\Provider	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E2BFCB0F8784E6F4DBD5A3FB2F4628E9\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\A8A84F1AA6E5EFD5BE00C8237B84D6D4	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F94CC8A8E1D7CD547B5B53FF162A2CE5\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{8A8CC49F-7D1E-45DC-B7B5-35FF61A2C25E}v80.40.55332\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0BDCF144A30A03141A5DFF8D5CC3FFB6\PackageCode = "69DC61D230D275C4FAFCB32DD99348DD"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0BDCF144A30A03141A5DFF8D5CC3FFB6\SourceList	msiexec.exe

NTFS ADS 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\Obfuscator.zip:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\rasp.bat . dabeans (2).zip:Zone.Identifier	firefox.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
2596	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
2160	msiexec.exe
2160	msiexec.exe
2160	msiexec.exe
2160	msiexec.exe
2160	msiexec.exe
2160	msiexec.exe
2160	msiexec.exe
2160	msiexec.exe
2160	msiexec.exe
2160	msiexec.exe
2160	msiexec.exe
2160	msiexec.exe
6236	msedge.exe
6236	msedge.exe
2228	msedge.exe
2228	msedge.exe
6412	chrome.exe
6412	chrome.exe
6412	chrome.exe
6412	chrome.exe
3732	chrome.exe
3732	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2244	ObfuscatorGUI.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 23 IoCs

pid	Process
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
6412	chrome.exe
6412	chrome.exe
6412	chrome.exe
6412	chrome.exe
6412	chrome.exe
6412	chrome.exe
6412	chrome.exe
6412	chrome.exe
6412	chrome.exe
6412	chrome.exe
6412	chrome.exe
6412	chrome.exe
6412	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2276	firefox.exe
Token: SeDebugPrivilege	2276	firefox.exe
Token: SeDebugPrivilege	2276	firefox.exe
Token: SeDebugPrivilege	2276	firefox.exe
Token: SeShutdownPrivilege	2004	windowsdesktop-runtime-10.0.10-win-x64.exe
Token: SeIncreaseQuotaPrivilege	2004	windowsdesktop-runtime-10.0.10-win-x64.exe
Token: SeSecurityPrivilege	2160	msiexec.exe
Token: SeCreateTokenPrivilege	2004	windowsdesktop-runtime-10.0.10-win-x64.exe
Token: SeAssignPrimaryTokenPrivilege	2004	windowsdesktop-runtime-10.0.10-win-x64.exe
Token: SeLockMemoryPrivilege	2004	windowsdesktop-runtime-10.0.10-win-x64.exe
Token: SeIncreaseQuotaPrivilege	2004	windowsdesktop-runtime-10.0.10-win-x64.exe
Token: SeMachineAccountPrivilege	2004	windowsdesktop-runtime-10.0.10-win-x64.exe
Token: SeTcbPrivilege	2004	windowsdesktop-runtime-10.0.10-win-x64.exe
Token: SeSecurityPrivilege	2004	windowsdesktop-runtime-10.0.10-win-x64.exe
Token: SeTakeOwnershipPrivilege	2004	windowsdesktop-runtime-10.0.10-win-x64.exe
Token: SeLoadDriverPrivilege	2004	windowsdesktop-runtime-10.0.10-win-x64.exe
Token: SeSystemProfilePrivilege	2004	windowsdesktop-runtime-10.0.10-win-x64.exe
Token: SeSystemtimePrivilege	2004	windowsdesktop-runtime-10.0.10-win-x64.exe
Token: SeProfSingleProcessPrivilege	2004	windowsdesktop-runtime-10.0.10-win-x64.exe
Token: SeIncBasePriorityPrivilege	2004	windowsdesktop-runtime-10.0.10-win-x64.exe
Token: SeCreatePagefilePrivilege	2004	windowsdesktop-runtime-10.0.10-win-x64.exe
Token: SeCreatePermanentPrivilege	2004	windowsdesktop-runtime-10.0.10-win-x64.exe
Token: SeBackupPrivilege	2004	windowsdesktop-runtime-10.0.10-win-x64.exe
Token: SeRestorePrivilege	2004	windowsdesktop-runtime-10.0.10-win-x64.exe
Token: SeShutdownPrivilege	2004	windowsdesktop-runtime-10.0.10-win-x64.exe
Token: SeDebugPrivilege	2004	windowsdesktop-runtime-10.0.10-win-x64.exe
Token: SeAuditPrivilege	2004	windowsdesktop-runtime-10.0.10-win-x64.exe
Token: SeSystemEnvironmentPrivilege	2004	windowsdesktop-runtime-10.0.10-win-x64.exe
Token: SeChangeNotifyPrivilege	2004	windowsdesktop-runtime-10.0.10-win-x64.exe
Token: SeRemoteShutdownPrivilege	2004	windowsdesktop-runtime-10.0.10-win-x64.exe
Token: SeUndockPrivilege	2004	windowsdesktop-runtime-10.0.10-win-x64.exe
Token: SeSyncAgentPrivilege	2004	windowsdesktop-runtime-10.0.10-win-x64.exe
Token: SeEnableDelegationPrivilege	2004	windowsdesktop-runtime-10.0.10-win-x64.exe
Token: SeManageVolumePrivilege	2004	windowsdesktop-runtime-10.0.10-win-x64.exe
Token: SeImpersonatePrivilege	2004	windowsdesktop-runtime-10.0.10-win-x64.exe
Token: SeCreateGlobalPrivilege	2004	windowsdesktop-runtime-10.0.10-win-x64.exe
Token: SeRestorePrivilege	2160	msiexec.exe
Token: SeTakeOwnershipPrivilege	2160	msiexec.exe
Token: SeRestorePrivilege	2160	msiexec.exe
Token: SeTakeOwnershipPrivilege	2160	msiexec.exe
Token: SeRestorePrivilege	2160	msiexec.exe
Token: SeTakeOwnershipPrivilege	2160	msiexec.exe
Token: SeRestorePrivilege	2160	msiexec.exe
Token: SeTakeOwnershipPrivilege	2160	msiexec.exe
Token: SeRestorePrivilege	2160	msiexec.exe
Token: SeTakeOwnershipPrivilege	2160	msiexec.exe
Token: SeRestorePrivilege	2160	msiexec.exe
Token: SeTakeOwnershipPrivilege	2160	msiexec.exe
Token: SeRestorePrivilege	2160	msiexec.exe
Token: SeTakeOwnershipPrivilege	2160	msiexec.exe
Token: SeRestorePrivilege	2160	msiexec.exe
Token: SeTakeOwnershipPrivilege	2160	msiexec.exe
Token: SeRestorePrivilege	2160	msiexec.exe
Token: SeTakeOwnershipPrivilege	2160	msiexec.exe
Token: SeRestorePrivilege	2160	msiexec.exe
Token: SeTakeOwnershipPrivilege	2160	msiexec.exe
Token: SeRestorePrivilege	2160	msiexec.exe
Token: SeTakeOwnershipPrivilege	2160	msiexec.exe
Token: SeRestorePrivilege	2160	msiexec.exe
Token: SeTakeOwnershipPrivilege	2160	msiexec.exe
Token: SeRestorePrivilege	2160	msiexec.exe
Token: SeTakeOwnershipPrivilege	2160	msiexec.exe
Token: SeRestorePrivilege	2160	msiexec.exe
Token: SeTakeOwnershipPrivilege	2160	msiexec.exe

Suspicious use of FindShellTrayWindow 54 IoCs

pid	Process
2276	firefox.exe
2276	firefox.exe
2276	firefox.exe
2276	firefox.exe
2276	firefox.exe
2276	firefox.exe
2276	firefox.exe
2276	firefox.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
2516	wixstdba.exe
6460	wixstdba.exe
4824	msedge.exe
6412	chrome.exe
6412	chrome.exe
6412	chrome.exe
6412	chrome.exe
6412	chrome.exe
6412	chrome.exe
6412	chrome.exe
6412	chrome.exe
6412	chrome.exe
6412	chrome.exe
6412	chrome.exe
6412	chrome.exe
6412	chrome.exe
6412	chrome.exe
6412	chrome.exe
6412	chrome.exe
6412	chrome.exe
6412	chrome.exe
6412	chrome.exe
6412	chrome.exe
6412	chrome.exe
6412	chrome.exe
6412	chrome.exe
6412	chrome.exe
6412	chrome.exe
6412	chrome.exe
6412	chrome.exe
6412	chrome.exe
6412	chrome.exe
6412	chrome.exe
6412	chrome.exe
6412	chrome.exe
6412	chrome.exe
6412	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
6412	chrome.exe
6412	chrome.exe
6412	chrome.exe
6412	chrome.exe
6412	chrome.exe
6412	chrome.exe
6412	chrome.exe
6412	chrome.exe
6412	chrome.exe
6412	chrome.exe
6412	chrome.exe
6412	chrome.exe
6412	chrome.exe
6412	chrome.exe
6412	chrome.exe
6412	chrome.exe

Suspicious use of SetWindowsHookEx 19 IoCs

pid	Process
2276	firefox.exe
2276	firefox.exe
2276	firefox.exe
2276	firefox.exe
2276	firefox.exe
2276	firefox.exe
2276	firefox.exe
2276	firefox.exe
2276	firefox.exe
2276	firefox.exe
4488	OpenWith.exe
2160	msiexec.exe
4108	MsiExec.exe
3004	MsiExec.exe
4972	MsiExec.exe
6720	MsiExec.exe
6760	MsiExec.exe
6928	MsiExec.exe
2244	ObfuscatorGUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4452 wrote to memory of 2276	4452	firefox.exe	90
PID 4452 wrote to memory of 2276	4452	firefox.exe	90
PID 2276 wrote to memory of 4828	2276	firefox.exe	91
PID 2276 wrote to memory of 4828	2276	firefox.exe	91
PID 2276 wrote to memory of 4828	2276	firefox.exe	91
PID 2276 wrote to memory of 5844	2276	firefox.exe	92
PID 2276 wrote to memory of 5844	2276	firefox.exe	92
PID 2276 wrote to memory of 5844	2276	firefox.exe	92
PID 2276 wrote to memory of 5844	2276	firefox.exe	92
PID 2276 wrote to memory of 1264	2276	firefox.exe	93
PID 2276 wrote to memory of 1264	2276	firefox.exe	93
PID 2276 wrote to memory of 1264	2276	firefox.exe	93
PID 2276 wrote to memory of 1264	2276	firefox.exe	93
PID 2276 wrote to memory of 2076	2276	firefox.exe	94
PID 2276 wrote to memory of 2076	2276	firefox.exe	94
PID 2276 wrote to memory of 2076	2276	firefox.exe	94
PID 2276 wrote to memory of 5944	2276	firefox.exe	95
PID 2276 wrote to memory of 5944	2276	firefox.exe	95
PID 2276 wrote to memory of 5944	2276	firefox.exe	95
PID 2276 wrote to memory of 5944	2276	firefox.exe	95
PID 2276 wrote to memory of 3636	2276	firefox.exe	96
PID 2276 wrote to memory of 3636	2276	firefox.exe	96
PID 2276 wrote to memory of 3636	2276	firefox.exe	96
PID 2276 wrote to memory of 3636	2276	firefox.exe	96
PID 2276 wrote to memory of 6068	2276	firefox.exe	97
PID 2276 wrote to memory of 6068	2276	firefox.exe	97
PID 2276 wrote to memory of 6068	2276	firefox.exe	97
PID 2276 wrote to memory of 6068	2276	firefox.exe	97
PID 2276 wrote to memory of 4488	2276	firefox.exe	98
PID 2276 wrote to memory of 4488	2276	firefox.exe	98
PID 2276 wrote to memory of 4488	2276	firefox.exe	98
PID 2276 wrote to memory of 4488	2276	firefox.exe	98
PID 2276 wrote to memory of 2084	2276	firefox.exe	99
PID 2276 wrote to memory of 2084	2276	firefox.exe	99
PID 2276 wrote to memory of 2084	2276	firefox.exe	99
PID 2276 wrote to memory of 2084	2276	firefox.exe	99
PID 2864 wrote to memory of 4824	2864	ObfuscatorGUI.exe	109
PID 4824 wrote to memory of 5932	4824	msedge.exe	110
PID 4824 wrote to memory of 2196	4824	msedge.exe	112
PID 4824 wrote to memory of 4176	4824	msedge.exe	113
PID 4824 wrote to memory of 2196	4824	msedge.exe	112
PID 4824 wrote to memory of 2196	4824	msedge.exe	112
PID 4824 wrote to memory of 2712	4824	msedge.exe	114
PID 4824 wrote to memory of 2712	4824	msedge.exe	114
PID 4824 wrote to memory of 756	4824	msedge.exe	115
PID 4824 wrote to memory of 756	4824	msedge.exe	115
PID 4824 wrote to memory of 756	4824	msedge.exe	115
PID 4824 wrote to memory of 1648	4824	msedge.exe	116
PID 4824 wrote to memory of 1648	4824	msedge.exe	116
PID 4824 wrote to memory of 1648	4824	msedge.exe	116
PID 4824 wrote to memory of 4492	4824	msedge.exe	117
PID 4824 wrote to memory of 4492	4824	msedge.exe	117
PID 4824 wrote to memory of 4492	4824	msedge.exe	117
PID 4824 wrote to memory of 4804	4824	msedge.exe	118
PID 4824 wrote to memory of 4804	4824	msedge.exe	118
PID 4824 wrote to memory of 4804	4824	msedge.exe	118
PID 4824 wrote to memory of 2556	4824	msedge.exe	120
PID 4824 wrote to memory of 2556	4824	msedge.exe	120
PID 4824 wrote to memory of 3940	4824	msedge.exe	121
PID 4824 wrote to memory of 3940	4824	msedge.exe	121
PID 4824 wrote to memory of 3940	4824	msedge.exe	121
PID 4824 wrote to memory of 1324	4824	msedge.exe	122
PID 4824 wrote to memory of 2352	4824	msedge.exe	123
PID 4824 wrote to memory of 1324	4824	msedge.exe	122

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\NOTEPAD.EXE
C:\Windows\system32\NOTEPAD.EXE C:\Users\Admin\AppData\Local\Temp\link.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:2596

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4452
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2276
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1968 -prefsLen 27098 -prefMapHandle 1972 -prefMapSize 270279 -ipcHandle 1924 -initialChannelId {0df8130f-81b2-447e-b388-4df9796aa532} -parentPid 2276 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2276" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:4828
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2420 -prefsLen 27134 -prefMapHandle 2424 -prefMapSize 270279 -ipcHandle 2432 -initialChannelId {144ae076-3c7b-4d1f-b2c1-0aeb359c86ff} -parentPid 2276 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2276" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    - Checks processor information in registry
    PID:5844
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3928 -prefsLen 27274 -prefMapHandle 3932 -prefMapSize 270279 -jsInitHandle 3936 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3944 -initialChannelId {f24f3477-7b99-4ac0-8d63-3067cbb6ea94} -parentPid 2276 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2276" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:1264
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4080 -prefsLen 27274 -prefMapHandle 4084 -prefMapSize 270279 -ipcHandle 4184 -initialChannelId {d4cafeea-71e0-4fea-825e-b0316ef3d19b} -parentPid 2276 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2276" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:2076
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4488 -prefsLen 34773 -prefMapHandle 4492 -prefMapSize 270279 -jsInitHandle 4496 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4504 -initialChannelId {a6d64286-c75e-4f51-8bb8-90f6c80379d4} -parentPid 2276 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2276" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:5944
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5032 -prefsLen 35010 -prefMapHandle 5036 -prefMapSize 270279 -ipcHandle 2592 -initialChannelId {89d932bf-f086-497a-b530-bea648760232} -parentPid 2276 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2276" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:3636
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5248 -prefsLen 32952 -prefMapHandle 5252 -prefMapSize 270279 -jsInitHandle 5256 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5232 -initialChannelId {850cc6ab-1d18-4211-96cf-b4115a96cd6e} -parentPid 2276 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2276" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:6068
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5448 -prefsLen 32952 -prefMapHandle 5452 -prefMapSize 270279 -jsInitHandle 5456 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5464 -initialChannelId {d1638edb-98d3-48fe-8b1b-d4a3f28c4294} -parentPid 2276 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2276" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:4488
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5636 -prefsLen 32952 -prefMapHandle 5640 -prefMapSize 270279 -jsInitHandle 5644 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5656 -initialChannelId {5306186c-769c-41d1-8c23-9f4c26e9d3f3} -parentPid 2276 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2276" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:2084

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:956

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1880

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4488

C:\Users\Admin\Downloads\Obfuscator\Obfuscator\bin\ObfuscatorGUI.exe
"C:\Users\Admin\Downloads\Obfuscator\Obfuscator\bin\ObfuscatorGUI.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://aka.ms/dotnet-core-applaunch?framework=Microsoft.NETCore.App&framework_version=10.0.0&arch=x64&rid=win-x64&os=win10&gui=true
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4824
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x394,0x7ff92d78c188,0x7ff92d78c194,0x7ff92d78c1a0
    3⤵
    PID:5932
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1680,i,17142549368069798357,2199749014830941976,262144 --field-trial-handle=2432,i,6243238363458835514,4376038485804708323,262144 --variations-seed-version --mojo-platform-channel-handle=2412 /prefetch:2
    3⤵
    PID:2196
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1904,i,8110628812792544452,6745260248559901393,524288 --field-trial-handle=2432,i,6243238363458835514,4376038485804708323,262144 --variations-seed-version --mojo-platform-channel-handle=2552 /prefetch:11
    3⤵
    - Downloads MZ/PE file
    - System Time Discovery
    PID:4176
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2604,i,14985874686796363490,962613793292590475,524288 --field-trial-handle=2432,i,6243238363458835514,4376038485804708323,262144 --variations-seed-version --mojo-platform-channel-handle=2932 /prefetch:13
    3⤵
    PID:2712
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3596,i,4206042190092738334,6618954553674301595,2097152 --field-trial-handle=2432,i,6243238363458835514,4376038485804708323,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:1
    3⤵
    PID:756
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3616,i,3800572506042976348,16474723033000286617,2097152 --field-trial-handle=2432,i,6243238363458835514,4376038485804708323,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:1
    3⤵
    PID:1648
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4248,i,9340773194375708835,4500435671239888095,2097152 --field-trial-handle=2432,i,6243238363458835514,4376038485804708323,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:1
    3⤵
    PID:4492
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4268,i,10829099579434324880,393797514594218916,2097152 --field-trial-handle=2432,i,6243238363458835514,4376038485804708323,262144 --variations-seed-version --mojo-platform-channel-handle=4408 /prefetch:9
    3⤵
    PID:4804
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3764,i,15670107317424012899,18334769505021002820,524288 --field-trial-handle=2432,i,6243238363458835514,4376038485804708323,262144 --variations-seed-version --mojo-platform-channel-handle=3724 /prefetch:14
    3⤵
    PID:2556
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5244,i,8085083123758790360,7003124469538974960,2097152 --field-trial-handle=2432,i,6243238363458835514,4376038485804708323,262144 --variations-seed-version --mojo-platform-channel-handle=5236 /prefetch:1
    3⤵
    PID:3940
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3688,i,5508400738768736488,4694540109148641929,524288 --field-trial-handle=2432,i,6243238363458835514,4376038485804708323,262144 --variations-seed-version --mojo-platform-channel-handle=3876 /prefetch:14
    3⤵
    PID:1324
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3704,i,6823549203278688114,17300888459083097555,524288 --field-trial-handle=2432,i,6243238363458835514,4376038485804708323,262144 --variations-seed-version --mojo-platform-channel-handle=3856 /prefetch:14
    3⤵
    PID:2352
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5992,i,11208697926155703189,13097729777093101525,524288 --field-trial-handle=2432,i,6243238363458835514,4376038485804708323,262144 --variations-seed-version --mojo-platform-channel-handle=6072 /prefetch:14
    3⤵
    PID:2172
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5992,i,11208697926155703189,13097729777093101525,524288 --field-trial-handle=2432,i,6243238363458835514,4376038485804708323,262144 --variations-seed-version --mojo-platform-channel-handle=6072 /prefetch:14
    3⤵
    PID:5588
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3808,i,13852657095240287948,3824143602703001752,524288 --field-trial-handle=2432,i,6243238363458835514,4376038485804708323,262144 --variations-seed-version --mojo-platform-channel-handle=6252 /prefetch:14
    3⤵
    PID:4224
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6244,i,7100088986650902283,3010376238337681263,524288 --field-trial-handle=2432,i,6243238363458835514,4376038485804708323,262144 --variations-seed-version --mojo-platform-channel-handle=6556 /prefetch:14
    3⤵
    PID:5752
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6488,i,4048687934195524880,9924711473381199108,524288 --field-trial-handle=2432,i,6243238363458835514,4376038485804708323,262144 --variations-seed-version --mojo-platform-channel-handle=6516 /prefetch:14
    3⤵
    PID:1560
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6540,i,3936599882942063755,13414142435207229607,524288 --field-trial-handle=2432,i,6243238363458835514,4376038485804708323,262144 --variations-seed-version --mojo-platform-channel-handle=6548 /prefetch:14
    3⤵
    PID:5844
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6852,i,6229185319771972886,7435536491692560994,524288 --field-trial-handle=2432,i,6243238363458835514,4376038485804708323,262144 --variations-seed-version --mojo-platform-channel-handle=6940 /prefetch:14
    3⤵
    PID:4964
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6904,i,14056344768150870593,15808537112012726561,2097152 --field-trial-handle=2432,i,6243238363458835514,4376038485804708323,262144 --variations-seed-version --mojo-platform-channel-handle=6960 /prefetch:1
    3⤵
    PID:2268
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7412,i,5986379364798670663,9738400771596038832,524288 --field-trial-handle=2432,i,6243238363458835514,4376038485804708323,262144 --variations-seed-version --mojo-platform-channel-handle=7440 /prefetch:14
    3⤵
    PID:4944
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=5244,i,15477011643073555965,12112005580984447120,2097152 --field-trial-handle=2432,i,6243238363458835514,4376038485804708323,262144 --variations-seed-version --mojo-platform-channel-handle=3812 /prefetch:1
    3⤵
    PID:3504
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=7552,i,15356697340789126069,8309115394095189292,2097152 --field-trial-handle=2432,i,6243238363458835514,4376038485804708323,262144 --variations-seed-version --mojo-platform-channel-handle=7612 /prefetch:1
    3⤵
    PID:564
- - C:\Users\Admin\Downloads\windowsdesktop-runtime-10.0.10-win-x64.exe
    "C:\Users\Admin\Downloads\windowsdesktop-runtime-10.0.10-win-x64.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4128
  - - C:\Windows\TEMP\{6780CACD-DE61-43E0-997F-6386D6B30ADE}\.ba\wixstdba.exe
      "C:\Windows\TEMP\{6780CACD-DE61-43E0-997F-6386D6B30ADE}\.ba\wixstdba.exe" -burn.ba.apiver 569705357157400576 -burn.ba.pipe BurnPipe.{3DEF1A7A-8E39-448D-86DF-7131E18BD3A0} {7B01E673-EA46-47A8-AD97-74EDD9AF108D}
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of FindShellTrayWindow
      PID:2516
  - - C:\Windows\TEMP\{6780CACD-DE61-43E0-997F-6386D6B30ADE}\.be\windowsdesktop-runtime-10.0.10-win-x64.exe
      "C:\Windows\TEMP\{6780CACD-DE61-43E0-997F-6386D6B30ADE}\.be\windowsdesktop-runtime-10.0.10-win-x64.exe" -q -burn.elevated BurnPipe.{748B5A82-5318-4A15-B0EF-F27EEB18EE04} {834BBCF9-40A3-483E-BBFF-C10ACD09D1A7} 4128
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of AdjustPrivilegeToken
      PID:2004
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6248,i,17437015774270668347,3661482633430042687,524288 --field-trial-handle=2432,i,6243238363458835514,4376038485804708323,262144 --variations-seed-version --mojo-platform-channel-handle=6924 /prefetch:14
    3⤵
    PID:5104
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7000,i,17166008018158887063,2660797763532172104,524288 --field-trial-handle=2432,i,6243238363458835514,4376038485804708323,262144 --variations-seed-version --mojo-platform-channel-handle=6972 /prefetch:14
    3⤵
    PID:4500
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7188,i,2990744817817349208,16536591493220316913,524288 --field-trial-handle=2432,i,6243238363458835514,4376038485804708323,262144 --variations-seed-version --mojo-platform-channel-handle=6404 /prefetch:14
    3⤵
    PID:3796
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7268,i,5301013727819649965,11001983762903310653,524288 --field-trial-handle=2432,i,6243238363458835514,4376038485804708323,262144 --variations-seed-version --mojo-platform-channel-handle=6604 /prefetch:14
    3⤵
    PID:3800
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=2572,i,13407715618759184232,1821887001612752450,2097152 --field-trial-handle=2432,i,6243238363458835514,4376038485804708323,262144 --variations-seed-version --mojo-platform-channel-handle=2632 /prefetch:1
    3⤵
    PID:6532
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=7708,i,16228431000925861792,10620293177702047893,2097152 --field-trial-handle=2432,i,6243238363458835514,4376038485804708323,262144 --variations-seed-version --mojo-platform-channel-handle=7180 /prefetch:1
    3⤵
    PID:1560
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    PID:6236
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2b4,0x7ff92d78c188,0x7ff92d78c194,0x7ff92d78c1a0
      4⤵
      PID:6300
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1868,i,16231338690602951565,4729671538010547962,262144 --field-trial-handle=2244,i,4726572276301921407,6116333421382402039,262144 --variations-seed-version --mojo-platform-channel-handle=2096 /prefetch:2
      4⤵
      PID:6516
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2016,i,12677234317606027843,3196465885701766786,524288 --field-trial-handle=2244,i,4726572276301921407,6116333421382402039,262144 --variations-seed-version --mojo-platform-channel-handle=2512 /prefetch:11
      4⤵
      System Time Discovery
      PID:6504
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2676,i,6163146783234268052,13474828612318256951,524288 --field-trial-handle=2244,i,4726572276301921407,6116333421382402039,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:13
      4⤵
      PID:6556
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4288,i,16931830769060623674,5155506618473706825,524288 --field-trial-handle=2244,i,4726572276301921407,6116333421382402039,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:14
      4⤵
      PID:2636
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4288,i,16931830769060623674,5155506618473706825,524288 --field-trial-handle=2244,i,4726572276301921407,6116333421382402039,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:14
      4⤵
      PID:4472
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1232,i,18326804570341947601,1474692966385702761,524288 --field-trial-handle=2244,i,4726572276301921407,6116333421382402039,262144 --variations-seed-version --mojo-platform-channel-handle=1376 /prefetch:14
      4⤵
      PID:1468
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1236,i,6379338273670936343,7711068378905992801,524288 --field-trial-handle=2244,i,4726572276301921407,6116333421382402039,262144 --variations-seed-version --mojo-platform-channel-handle=4872 /prefetch:14
      4⤵
      PID:4660
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1248,i,15447495520215426176,15899672775982864001,524288 --field-trial-handle=2244,i,4726572276301921407,6116333421382402039,262144 --variations-seed-version --mojo-platform-channel-handle=4332 /prefetch:14
      4⤵
      PID:1640
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1444,i,13400434865350437401,13607800379694525429,524288 --field-trial-handle=2244,i,4726572276301921407,6116333421382402039,262144 --variations-seed-version --mojo-platform-channel-handle=5008 /prefetch:14
      4⤵
      PID:4756
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4936,i,16373155283704282994,16783490247669516745,524288 --field-trial-handle=2244,i,4726572276301921407,6116333421382402039,262144 --variations-seed-version --mojo-platform-channel-handle=4928 /prefetch:14
      4⤵
      PID:5456
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=816,i,8882812104525851206,5084898503671179745,524288 --field-trial-handle=2244,i,4726572276301921407,6116333421382402039,262144 --variations-seed-version --mojo-platform-channel-handle=5052 /prefetch:14
      4⤵
      PID:3104
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=816,i,6668241333424727487,13009510693017717926,524288 --field-trial-handle=2244,i,4726572276301921407,6116333421382402039,262144 --variations-seed-version --mojo-platform-channel-handle=5092 /prefetch:14
      4⤵
      PID:4148
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4996,i,13378941282252048709,12687578095485008083,262144 --field-trial-handle=2244,i,4726572276301921407,6116333421382402039,262144 --variations-seed-version --mojo-platform-channel-handle=5084 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2228
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4688,i,12715650334174813462,17004975339942172195,524288 --field-trial-handle=2244,i,4726572276301921407,6116333421382402039,262144 --variations-seed-version --mojo-platform-channel-handle=3904 /prefetch:14
      4⤵
      PID:7016
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3908,i,4352335716937324000,13894956604866945968,524288 --field-trial-handle=2244,i,4726572276301921407,6116333421382402039,262144 --variations-seed-version --mojo-platform-channel-handle=4128 /prefetch:14
      4⤵
      PID:4832
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3028,i,429495209184390866,11062345193106286135,524288 --field-trial-handle=2244,i,4726572276301921407,6116333421382402039,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:14
      4⤵
      PID:4444
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5100,i,7887381128887114891,3149603907106013896,524288 --field-trial-handle=2244,i,4726572276301921407,6116333421382402039,262144 --variations-seed-version --mojo-platform-channel-handle=4232 /prefetch:14
      4⤵
      PID:5976
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5128,i,11384157783246289933,4499654528388887990,524288 --field-trial-handle=2244,i,4726572276301921407,6116333421382402039,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:14
      4⤵
      PID:1960
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5280,i,15744088280961933676,6885272573037014111,524288 --field-trial-handle=2244,i,4726572276301921407,6116333421382402039,262144 --variations-seed-version --mojo-platform-channel-handle=5288 /prefetch:14
      4⤵
      PID:2060
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5012,i,2575744446376079545,13419197289178972816,524288 --field-trial-handle=2244,i,4726572276301921407,6116333421382402039,262144 --variations-seed-version --mojo-platform-channel-handle=5132 /prefetch:14
      4⤵
      PID:6024
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4132,i,7124079683281034796,6772154449621003077,524288 --field-trial-handle=2244,i,4726572276301921407,6116333421382402039,262144 --variations-seed-version --mojo-platform-channel-handle=5124 /prefetch:14
      4⤵
      PID:5020
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4036,i,3884160899286384181,2556796671457921539,524288 --field-trial-handle=2244,i,4726572276301921407,6116333421382402039,262144 --variations-seed-version --mojo-platform-channel-handle=1088 /prefetch:14
      4⤵
      PID:5124
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1088,i,4099486557079581784,16196977633135854128,524288 --field-trial-handle=2244,i,4726572276301921407,6116333421382402039,262144 --variations-seed-version --mojo-platform-channel-handle=5124 /prefetch:14
      4⤵
      PID:5604
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2996,i,7616244921804189575,11271317327189904873,524288 --field-trial-handle=2244,i,4726572276301921407,6116333421382402039,262144 --variations-seed-version --mojo-platform-channel-handle=5480 /prefetch:14
      4⤵
      PID:436
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5424,i,13659524819993305619,4111083061127862371,524288 --field-trial-handle=2244,i,4726572276301921407,6116333421382402039,262144 --variations-seed-version --mojo-platform-channel-handle=5480 /prefetch:14
      4⤵
      PID:5212
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5492,i,10229097348315364631,15245504010239758408,524288 --field-trial-handle=2244,i,4726572276301921407,6116333421382402039,262144 --variations-seed-version --mojo-platform-channel-handle=5396 /prefetch:14
      4⤵
      PID:6912
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5480,i,3267422789062589870,7984190308200674746,524288 --field-trial-handle=2244,i,4726572276301921407,6116333421382402039,262144 --variations-seed-version --mojo-platform-channel-handle=1280 /prefetch:14
      4⤵
      PID:5700
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5492,i,18184984971211101316,9247710142625685967,524288 --field-trial-handle=2244,i,4726572276301921407,6116333421382402039,262144 --variations-seed-version --mojo-platform-channel-handle=5388 /prefetch:14
      4⤵
      PID:4260
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5320,i,11167881727608333076,9836325084938834410,524288 --field-trial-handle=2244,i,4726572276301921407,6116333421382402039,262144 --variations-seed-version --mojo-platform-channel-handle=5432 /prefetch:14
      4⤵
      PID:6864
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3928,i,12971993756360046359,4231849989562947958,524288 --field-trial-handle=2244,i,4726572276301921407,6116333421382402039,262144 --variations-seed-version --mojo-platform-channel-handle=3856 /prefetch:14
      4⤵
      PID:2228
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5068,i,2560486102688756579,2586884236325076162,524288 --field-trial-handle=2244,i,4726572276301921407,6116333421382402039,262144 --variations-seed-version --mojo-platform-channel-handle=5012 /prefetch:14
      4⤵
      PID:2120

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4224

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2796

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2160
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding C007E31D9B29610BE21297BF405A5DCF
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:4108
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 0D742322F8BECF843877F8BE9F55C817
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:3004
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 1A75BD9BDC6163B3C1AB69490D24E6A1
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:4972
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding BCD93A763CC4413B4F3296F7F684E313
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:6720
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 237812497CED02BE616C1E4DCED0407E
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:6760
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 4F09F5C446F234564D2F184C05BB8358
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:6928

C:\ProgramData\Package Cache\{866BECDA-F284-473A-9E84-0CCE816BF06F}\windowsdesktop-runtime-10.0.10-win-x64.exe
"C:\ProgramData\Package Cache\{866BECDA-F284-473A-9E84-0CCE816BF06F}\windowsdesktop-runtime-10.0.10-win-x64.exe" /burn.runonce
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5864
- C:\ProgramData\Package Cache\{866BECDA-F284-473A-9E84-0CCE816BF06F}\windowsdesktop-runtime-10.0.10-win-x64.exe
  "C:\ProgramData\Package Cache\{866BECDA-F284-473A-9E84-0CCE816BF06F}\windowsdesktop-runtime-10.0.10-win-x64.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_10.0.10_(x64)_20260731134850.log"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5556
- - C:\Windows\TEMP\{C54C34D6-4574-441F-B964-6E9100774E3F}\.ba\wixstdba.exe
    "C:\Windows\TEMP\{C54C34D6-4574-441F-B964-6E9100774E3F}\.ba\wixstdba.exe" -burn.ba.apiver 569705357157400576 -burn.ba.pipe BurnPipe.{71BB5CCA-DFF4-4170-8D60-11031ED7107B} {797929E3-2960-4172-B354-BBC9F648887B}
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    PID:6460
- - C:\ProgramData\Package Cache\{866BECDA-F284-473A-9E84-0CCE816BF06F}\windowsdesktop-runtime-10.0.10-win-x64.exe
    "C:\ProgramData\Package Cache\{866BECDA-F284-473A-9E84-0CCE816BF06F}\windowsdesktop-runtime-10.0.10-win-x64.exe" -q -burn.elevated BurnPipe.{65719B24-E5AF-49AB-BCE3-59FE45CFD4CA} {1640CE83-BCD7-4A33-8FA7-570597E29B6B} 5556
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:7000

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3816

C:\Users\Admin\Downloads\Obfuscator\Obfuscator\bin\ObfuscatorGUI.exe
"C:\Users\Admin\Downloads\Obfuscator\Obfuscator\bin\ObfuscatorGUI.exe"
1⤵
- Loads dropped DLL
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2244

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:6412
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ff9232bc728,0x7ff9232bc734,0x7ff9232bc740
  2⤵
  PID:1004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1704,i,11753487981690570322,8863157481637740079,262144 --field-trial-handle=1840,i,734118530246947460,261589465237296820,262144 --variations-seed-version --mojo-platform-channel-handle=1836 /prefetch:2
  2⤵
  PID:1500
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2192,i,7261211598839399534,14328127821158249597,524288 --field-trial-handle=1840,i,734118530246947460,261589465237296820,262144 --variations-seed-version --mojo-platform-channel-handle=2232 /prefetch:11
  2⤵
  - System Time Discovery
  PID:1400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2348,i,6982484271665256972,8618754868702441371,524288 --field-trial-handle=1840,i,734118530246947460,261589465237296820,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:13
  2⤵
  PID:1076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3288,i,8336879174732056143,14056797198714961851,2097152 --field-trial-handle=1840,i,734118530246947460,261589465237296820,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:5708
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3320,i,12989294183783965538,13858118068106672366,2097152 --field-trial-handle=1840,i,734118530246947460,261589465237296820,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:3376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3960,i,5089471658489514429,5049553188282265138,2097152 --field-trial-handle=1840,i,734118530246947460,261589465237296820,262144 --variations-seed-version --mojo-platform-channel-handle=4744 /prefetch:1
  2⤵
  PID:1060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4880,i,17031369846600387020,14003035909605287292,524288 --field-trial-handle=1840,i,734118530246947460,261589465237296820,262144 --variations-seed-version --mojo-platform-channel-handle=4884 /prefetch:14
  2⤵
  PID:6036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5376,i,15321083909289048546,725365147180679920,524288 --field-trial-handle=1840,i,734118530246947460,261589465237296820,262144 --variations-seed-version --mojo-platform-channel-handle=5388 /prefetch:14
  2⤵
  PID:2788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5480,i,10293563658166441923,13381739746629197496,2097152 --field-trial-handle=1840,i,734118530246947460,261589465237296820,262144 --variations-seed-version --mojo-platform-channel-handle=5520 /prefetch:1
  2⤵
  PID:2196
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5492,i,5324361361738577124,10056859814564374624,2097152 --field-trial-handle=1840,i,734118530246947460,261589465237296820,262144 --variations-seed-version --mojo-platform-channel-handle=5540 /prefetch:1
  2⤵
  PID:6688
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5496,i,9050187846509849159,2078916933624003113,2097152 --field-trial-handle=1840,i,734118530246947460,261589465237296820,262144 --variations-seed-version --mojo-platform-channel-handle=5428 /prefetch:1
  2⤵
  PID:6760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5768,i,18264213100854421087,16793342003950850791,524288 --field-trial-handle=1840,i,734118530246947460,261589465237296820,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:14
  2⤵
  PID:6864
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5776,i,8008479148752193094,12150137696270550789,2097152 --field-trial-handle=1840,i,734118530246947460,261589465237296820,262144 --variations-seed-version --mojo-platform-channel-handle=5492 /prefetch:1
  2⤵
  PID:7032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6184,i,13248067579791719952,3277130108003300712,2097152 --field-trial-handle=1840,i,734118530246947460,261589465237296820,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:1
  2⤵
  PID:1684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5820,i,13469291554017643182,12256925352371642161,524288 --field-trial-handle=1840,i,734118530246947460,261589465237296820,262144 --variations-seed-version --mojo-platform-channel-handle=6328 /prefetch:14
  2⤵
  PID:7012
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5724,i,12659045691842199721,4712598500678570945,2097152 --field-trial-handle=1840,i,734118530246947460,261589465237296820,262144 --variations-seed-version --mojo-platform-channel-handle=6032 /prefetch:1
  2⤵
  PID:6048
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6344,i,1398432876088385149,15307716746542140208,524288 --field-trial-handle=1840,i,734118530246947460,261589465237296820,262144 --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:14
  2⤵
  PID:5564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6512,i,11230130839747441373,4592345477606931790,2097152 --field-trial-handle=1840,i,734118530246947460,261589465237296820,262144 --variations-seed-version --mojo-platform-channel-handle=6184 /prefetch:1
  2⤵
  PID:1472
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6132,i,3867430121175122704,11334149706414046651,2097152 --field-trial-handle=1840,i,734118530246947460,261589465237296820,262144 --variations-seed-version --mojo-platform-channel-handle=6040 /prefetch:1
  2⤵
  PID:5176
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=6320,i,6822441637793089960,2711704346354657555,2097152 --field-trial-handle=1840,i,734118530246947460,261589465237296820,262144 --variations-seed-version --mojo-platform-channel-handle=6432 /prefetch:1
  2⤵
  PID:6588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=5628,i,13597151626430611944,272317510403264407,2097152 --field-trial-handle=1840,i,734118530246947460,261589465237296820,262144 --variations-seed-version --mojo-platform-channel-handle=6396 /prefetch:9
  2⤵
  PID:936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5624,i,10725067120249048819,14954315475332839939,524288 --field-trial-handle=1840,i,734118530246947460,261589465237296820,262144 --variations-seed-version --mojo-platform-channel-handle=6020 /prefetch:14
  2⤵
  PID:5704
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4924,i,6988697898928724219,4680719290215062751,524288 --field-trial-handle=1840,i,734118530246947460,261589465237296820,262144 --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:14
  2⤵
  PID:4848
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5588,i,6427214891952328789,3794519994414339794,524288 --field-trial-handle=1840,i,734118530246947460,261589465237296820,262144 --variations-seed-version --mojo-platform-channel-handle=4756 /prefetch:14
  2⤵
  PID:6092
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6460,i,2405613139368256664,8228484761943371613,262144 --field-trial-handle=1840,i,734118530246947460,261589465237296820,262144 --variations-seed-version --mojo-platform-channel-handle=256 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3732
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=4644,i,2678801489568437481,15460033810847531399,524288 --field-trial-handle=1840,i,734118530246947460,261589465237296820,262144 --variations-seed-version --mojo-platform-channel-handle=256 /prefetch:14
  2⤵
  PID:2432

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:968

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2528

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:1228

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:3632

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e5c09bf.rbs

Path C:\Config.Msi\e5c09bf.rbs
Size 11KB
SHA256 1386853459a7e70202d2ec3f08651d2f190a7fcd1047bb68219b2101770c3b2b
MD5 2e2bbf778a8046111a2e9086a8919c39
SHA1 d9a3e03e8f3275a1ddce82802bdcd538b0b5fc19
SHA512 14d1406680628c136582e7adc3cb7e6a7264ad422f0b95ef5576a7cee83d1137faef79a6b421467b3978ea97926b7f64f39912fbe247f43752dbbd2ad619a654
SSDEEP 192:qrHHCR6CTtt5HdAQ9CqxwRI1wRlHE+o5Ca35pbM:qrHHCR6CTtt5HmwwowzaM
TLSH
T13D3252427604D2D7E9DB2B38D71727703B73D3A99314664F05CCC62C4F8BB885A64EAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5c09c6.rbs

Path C:\Config.Msi\e5c09c6.rbs
Size 9KB
SHA256 9b260faafaa1e02a095866ff701dcd80a8e45c7884398334c9c8c2873a44f9a6
MD5 6d6d30fa9125df689fd39362668abafc
SHA1 ed81ae8d77809985a737122404a4a69a75fe0c35
SHA512 abb20080fa28c6d35b607e92f0eef122c93a9a93c59f5a254c345f9d061c4a282dbc8bbbce8d0310fe3001ac80daf8439588dd421423a39bc5057545a82818cd
SSDEEP 96:MmSDTaA3rWS2CjjFeUjeD2AyCsTlyyUjeD2AyC6jMlN8gnuTlyfnyP7E5d7P/53k:JCmOEC1x4RII4RP0F7EbnKCCi5pu3
TLSH
T1B9121012750041A2ED921B39C7133B223BBAD3D9A315665F48CDE9F41E03BD52FA91DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5c09cb.rbs

Path C:\Config.Msi\e5c09cb.rbs
Size 49KB
SHA256 cf0dcc46c8320cb64d66bdef5e4e6620402153ff4cffe164d628f698dab2636c
MD5 d4509f57d455318f23604c9c24ed069c
SHA1 750e58b98f7a292e3df662da3a899b5b31bde623
SHA512 9503af62b33cdfa8de5086b3998dc15bb92544e121f42c929d34e10f19f8e50ad6bd909fb7538f909aaebb8d41d162e01dd4a11d960bcfacf442492fd63d569a
SSDEEP 1536:tHZgOohW4wN5RaHB/LyM/ajqmuUHr92ha8u3tn2N8zRM9Wc/hihbZGXEpp4IQPDd:8NgeE+5D
TLSH
T15F335461DB08C0F2F9333DA26770F8847719C99AE34095AD1AD60144CE96EEEDEBD1E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5c09d0.rbs

Path C:\Config.Msi\e5c09d0.rbs
Size 71KB
SHA256 9c5d5a1d995f21803ae4120e207467cf59c7e190dfccd5d5e2e6cc5312593c11
MD5 ae1f755c4133ffce990e8dd400ef87df
SHA1 4157f1cfb346457a40fd81c33a663551510e3c11
SHA512 5eecc975c753cc8707848247ae042ea9c07c1f918f53bd5e27f4d58f474e7127af5eb596a8637c0ac4c1990366d8a2cd8a1e4c51f85bc7f3665cadc853a48fad
SSDEEP 1536:xlTX+EvElgJPlhUR+6svby5ybcmb/WrPMmq0mgG2WdDfbH9cMWmHDCaJVZ/KoLHc:9u2T+LmEEiycECCoeWZ
TLSH
T1196325BA7A14D1C1BC732DD457BBE916AD054C7393608D2E63CC4129CDD2A86EFB86E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5c09d4.rbs

Path C:\Config.Msi\e5c09d4.rbs
Size 3KB
SHA256 328b1c7e40b5dea369345cbdeb31616623cf74e7bc01bd6673f8bbe97a378b71
MD5 3f6957ea64ffb0d8132eb3a3223c0211
SHA1 bb61a67bc80f8cb0db3b0afa4802ee21dc320fc9
SHA512 75c3953b7cff166a104f35f293474b030f0c4f8cf1245c03597db9bfadf7f825c16873e07c4c3b9f3fad26fc8df38f62ad6c9ad352ed20108a476f602606119e
TLSH
T155716903D604D6D3EDA22B31DD271B5037BBD6DAD325438B04CC91701E57BC6AEEA28A
MD5 SHA1 SHA512 TLSH

Submit Download

e5c09d7.rbs

Path C:\Config.Msi\e5c09d7.rbs
Size 3KB
SHA256 6cdb858a8e56e0d6cba77a9f89c1088c7ab82a1896482dd2c8cee7877bfcd9ec
MD5 fad3d236fc5bef0d1b5c81d1544378c6
SHA1 e4574a6252965149421adf64f42efbbfab3a13d0
SHA512 fb1649b4a0061877160ff8c08e7e1e50822d930fbd53b6e760c9048c37c4dec451d7c62200b62c30fe78d6fd2a0d8507d9be79afcd628eca97a6c829c7d9c01a
TLSH
T167819D03AA04E6D3ECE22B30CD1B17233777C6E69361874B45CC81741E87B89AED9689
MD5 SHA1 SHA512 TLSH

Submit Download

ThirdPartyNotices.txt

Path C:\Program Files\dotnet\ThirdPartyNotices.txt
Size 77KB
SHA256 deb4427a295e1ed474b0d81c5a0d972c1b550b9a715cda939cdfa9236b1b418f
MD5 0d8867a25ba926e6e40cd52ab3536b5c
SHA1 89390dc8b8318d0bfef1c6a2fb4783537e28a465
SHA512 317ca335405274f4f91b173651ca2826760acb5ba5cf41aff51adc55c2cda9059fb268333665f13f62fa48119e55a303720a780dd58d28dd9967db4c88407d61
SSDEEP 1536:HA9jHwsGfgg39/zwgAVkguQxrDjugtSEGepkWvrpX7anuqdLSVnfiStPq+3LefrL:HA97w/ogz1AVxuMjHtSFULryLOgrGWm+
TLSH
T17773A45F7E45077319E2C3916569A8C5F22FA02E3B6B2A44346EF248133B42DD6FF858
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 163KB
SHA256 4377f10c78400f0370b88156773de9843c07f14e65b3232005ec3179ef38d463
MD5 363603c51aa522bf21b2e8320a51c54e
SHA1 b4dba9e0d47c9fd4636549d5a23fe1a96faf9b1f
SHA512 b2b045ad8538416bd81753359ca86ba956f2ac99befeb89c7c03993741411703e03f4373d11cb94992cb93ed569d6741954111f4ad519daebcb18138800877ce
SSDEEP 3072:oGgPYwruvTSBbQ/fp4SbDqIG/vk7l55wK9vLPg:oG4rubgbQpDvqIbt10
TLSH
T1A6F3F61AD65811AAD06E9575CB428941BB337C668BE0E3CB53C0F9BE0F726905EF9703
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

state.rsm

Path C:\ProgramData\Package Cache\{866BECDA-F284-473A-9E84-0CCE816BF06F}\state.rsm
Size 1KB
SHA256 b6e130620798f7bd39306cfbc54f351c279631f45fbd737ce808a23cae1ed732
MD5 4cc167ee5e80c908f3cec20447c9e1c6
SHA1 da9a58fa7558f93c2d9a332255b892eabbf1d56f
SHA512 24ad1747636e8100341677bdd1dc3cc29a3722aa47797be0284996f908f4c7e83255d72063dee7528eae646fb148d4b9b6fc5194212c6bd600ff7a418a8b6984
TLSH
T18321D1515BF6092CF3F6AB3469F96665443BBC121C24C26E0001318A9E32BD0CCB0B37
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 47e98d06bd6245bb16aa8e5b4f7c4ac9654cd726078b4c9435fdd5f262205039
MD5 82feac8c5d44283e5103198b44bb7f5f
SHA1 9842308be41ed66f219479d9f71c73d85f6e65cf
SHA512 14643ae29c9f4bacfa5a3ec0eaff26d7b38609e834d2489ac3195967b6416f182f534d952e74c6af9eb8196c6eb9cf65347d7b5a5bdac94c2d02b131ea8507dc
TLSH
T108517AB3C7D48A6DC85156F4DB257E1FCD3D0A28522C3C26C9D8AE5B53E2972E21138E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 8389f4ef45cd6a5a8acc1ac33fc61e091ce23530d9d032e12c359910ab9832f1
MD5 2b400e823dd5cc71922b127909533ad4
SHA1 f19c47b9ef7792bfd457a7b02476b88ec14a8484
SHA512 5e672cc744ea70b4e630f433a6293ab572a169d6f384f6212039ec901499ada3184addeb9e5a29ba5863e6c568c75fa3c4beacfee950c6f4536e35753d8ea0fd
TLSH
T105519CB7D3D48A6DC90156F4DB25AE1FCD3D0A28522C3C62C8D4AE5B93E2973E21134E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 45b38b6e16f18acdba18fdd5275433de5822d0649943e901c31d6510b5efe1e5
MD5 6282d3f51d98faec1b9e5ffd43494db4
SHA1 1e0558188d5942f2bafa25dc473c2e19a7f536cf
SHA512 688f9ac9b27e72ec3dfa825b8a4182d22f3534cf53d7f0cb151ac8bd3d3501a04446d31f63f93127f6e782ae440a363c0ca90fc96fa74a0fe721106e66af1422
TLSH
T17F517BB3C7D48A6D885152F4DB217E1FCD3D0A18522C3C26C9D4AE5B53E2972E21138E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 44ec2f0347217fa1146393940bf605dc0ba95347fbe19dbf57ded9ce5818ee98
MD5 afe3ea0d566c80b3a7159f030c11a857
SHA1 a5c572dd08913ef32b694ce95792539ff99fc72b
SHA512 bd6e14d66a055af5d329e7dbe3f9ad6e2e0f6e4165db2c13ff1cfa8a6876412df5db7cc93f0faa87bda87e1e1f8b402e7a1e82601ea161375036128b3a5db5a1
TLSH
T116519DF7C3D4867DC50156F4DB15AE1FCD390A28422C3C6288D4AE1B93E2572E21138E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 5d940d553e128e553a7c9e1fec5cd067f59aca88ab634a73c7c021261267e734
MD5 95589296395f9041f4c5f0cb07a70f94
SHA1 fcf87eea0052c431283a7ee518beecb0e0cdbadb
SHA512 c77dcfd9cc1cb6540d18506ecdc123e351569a25f55d69ed13712d603d0500615703bfd6be7240b16838206ff3934f470dfd3b4ac0985be389c5af3e58f039de
TLSH
T1D0618AB3C3D48A6DC85152F4DB257E1FCD3D0A28522C3D26C8D8AE4B93E2972E21135E
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 523B
SHA256 b15bb939b876b987777fab446ecf5a75ddc92fe5af648c31b0d3a649f7aae7f6
MD5 071ee4b553d976e7abfe2ad5bd1801fd
SHA1 3be61cb9ced2e34ef91d8fbaa456f94a2d43d47b
SHA512 702ccf0193c6db20c3eb977e3716c5e9242ca8a6e24b5a8e6b8c08fdfeced9e74f9b88acc210baa637ed3b4b132aeaa83afc10ac9367f66dafb32996c434856e
TLSH
T189F050A79AAF78571169C5BB4D547C055876A437024168F4CF9A827EE0954E70B02023
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 531f637df2379ecf298bafd726706a02184e708334f64105cf4fd996aa424dca
MD5 268a7541433fd651b0cd9d7a9b3d3a25
SHA1 ab11645432f8afc8ee25aa08d407e1e0f955d599
SHA512 8302303f5a5a1648939e1888e6f98b12dfa4a54812458454a3663d647700c99b967af918e32119536e28afedd7eb36eceb19c1a0d7935e086598cf6781902038
SSDEEP 192:YR3QGC7cgv7+TAPRp2O9pHsb+WNnI4dPiBYkwpJVyIsnAUge:YRA7Q83XtTwfdJJve
TLSH
T1B232B66FA910663B5DCFD22AFE667B53E3F5102172942E84E6FC8A1C11E79CC221B417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 0c5def30e3630e29867a9227ab606ede97b83cee664bdd11dfadff38c2813d60
MD5 13b91d94ad209c09a9a617519f880c85
SHA1 21759c124f972e0f2fb062d573b4b494d6069ec3
SHA512 fbd1cad98068e2dff66efe6aeee7359cf1dd1a8055a273edd32e5a59274c334ab29ff3e8fae3deb44e18bd62a05ef6790b7ba6fe79dd64521dfd7229f922c130
SSDEEP 192:YR3QGC7cWv7+TAPRp2O9pHsb+WNnI4dQiBYkw19JVyIsnAUgE:YRA7Qi3XtTwfd4V9vE
TLSH
T19E32A66FA9106A3B5DCFD21AF9267B53E3F5102172942E84E7FC8A1C11E79CC221B417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 6fbdac550055d53f732ea881f1d3bf8d5c1fd5fed6bf2710c61ca90d7efc496d
MD5 879c6ef1c46451017f81c00535ea2647
SHA1 9d5fca13fd097defa96b37037e4f7b20e28cf252
SHA512 3c438683894709b536a3da0fb45b6f68b369b33aa8b18abc939d1d9c9058b89b95642035f053dc3f1a4e649e5a9306ce7bb417710186242f7409b31530851266
SSDEEP 192:YR3QGC7cWv7+TbPRpTO9pHsb+WNnI4dYiiBYkwH9JVyIsnAUgE:YRA7QiKXSTwfdrn9vE
TLSH
T1F742B66FA9106A3B5DCFD22AF9657B53E2F4102172942E88E7FC8A1C11E79CC231B417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 04066da138c864044888e9c6e552431b0c923177c03c3b3d89746403a1b08c0e
MD5 264d863383ae71f792c7bd494d6a9106
SHA1 b7244956cbea6945f5c23d10155c837e95fb91f5
SHA512 0bc698c3f08e974f8512906107fb0fc4cc8c9c38e2516ca24002daebef3c87267b5a2ae1b6547872e989aecc0b180d2c1d26ccbe74bebd129d64f72970338c28
SSDEEP 192:YR3QGCXcWv7+TbPRpTO9pHsb+WNnI4dYiiBYkwH9JVyIsnAUgE:YRA7siKXSTwfdrn9vE
TLSH
T1D442A66FA9106A3B5DCFD22AF9657B53E3F4102162942E88E7FC8A1C11E79CC221B417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 9a96c446e7184ec3da19494940afa4ae316c1a484625277e2e6f71639098ff5a
MD5 b1fb7da2536da531fba1d020bd4bfea3
SHA1 2c936e2dea377291d7f750abe328ee8cc576fa28
SHA512 de53e39880ef8b93d1efb21df28b64de1b0349464813ec1bdf27f85551d7e3a2ea795a18baf51be61e6b3fe77668db0754ad6392d7c4b7ca8a7ba0dc80d190cf
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 174eb78e4afbf4a438f993d71a0224e4115f20d78a1974f1bb7fce1677707226
MD5 d16cb364f0f5c48e3888fbb8c42d8766
SHA1 f4b406fe91e67fb8c79d6a24d4885dcf95ab9786
SHA512 3df5b34e87d4bba4c32d194b15c75e3895cce2f1e5a7eb7b3ff1e11ec3e435b7e84ea2a579e317860d3a75db8d9e1ae21e3669af39a4bf377fce4eea4f44bdf2
TLSH
T1B0A0021262C96D51DD10A2B170A24542335549163551C33354951C948C9F2C04567300
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

d5cac7e1-34b3-4e38-b214-715941ca54d6.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\d5cac7e1-34b3-4e38-b214-715941ca54d6.tmp
Size 13KB
SHA256 d98d8631970ccdcbdeee16149104a56636a809973fe970cd02cd9353e9b08059
MD5 2e314d640ab56d6629230cd174b58828
SHA1 87182f206bf8a43b5234eef461b5a163449bd2a0
SHA512 727ba12ec3d9d3214a7e006201fad6084b31ead34e9cb15eec1fac41203d0189b6732f20e33435844156393a2ec620479c8bea83c015868752719527e4ccf9d5
SSDEEP 384:uEjEn7KxkXqKf/pUZNCgVLH2HfgslLtXODEL+ErU34KHGqnSxyVc:uIEn7KxkXqKf/pUZNCgVLH2Hfgs9JOw3
TLSH
T16452F967684D9A7F0FC8D55CDC577F4FACB5015B62B8086897FA9C0803A57CB120A2E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 126KB
SHA256 e70a554dbdfc3496cf4d290b52083ab7f7acfd75b5003c4e93b59f2191168b02
MD5 f387d922ad77e4783bd9f2e94c9bfefd
SHA1 a1b763122cc09a7e9ce79e28938c8600dcfa9c57
SHA512 4dd0149fc9a4a62315e59a75809755eca47fdedcf3922d056c8c6085835f24c5b9d6c8a293c59d65a2650cb83e2104521f26acbcc5e7c74f4b14fcd2fc06b4cd
SSDEEP 3072:VGxyMTHfDL0Qs395M1FrbbNEzHj7AaHE7cWuK05W7p:4xtHfDL0L3IFrHNE37LHWuP8
TLSH
T1D0C312BC3C705CAEDE68E91AF111382B8CC4F147918C6D7C6D9468894DDFAAC462FD0A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 125KB
SHA256 08d5775a27553720c0cd0027ad63cb8310a56ae38673dcf80dd27a0799023c29
MD5 fd10f86b2060419363545fe3bdecd4cb
SHA1 400b55377aae71ca2ed9fae655e900a8834a7377
SHA512 e168905ea0801ec6fbd82042bef68e339c4d787463f09c352f2d10c92b5d05a5e7355234cd172221108ebaf7b546655adacb0862fcefb7142a585e5d52fcc134
SSDEEP 3072:9dyMTHfDL0Qs395M1FrbbNEzHj7AaHE7cWuK05W7p:PtHfDL0L3IFrHNE37LHWuP8
TLSH
T189C312983D70ACAFEA68E612F111392F98C4F047918D5A784D9058894DDFB9D432FD1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 125KB
SHA256 a9c6fef96354adb7f1506553d47e29ecd396b77a415459e0f21365db85e49a79
MD5 e260f646218ab90219478e5c8c6ac679
SHA1 536a1abce840a4404721a7c4afedf7928a000bc6
SHA512 292806b1e0c0f4c87eb4b338864d51962c36ae7d0db9d5054d5ee8e544deaef7de6c903c550697a5659ea7cbf9d6551a5d42374425fdcf0ba90c6a212fe42642
SSDEEP 3072:mdyMTHfDL0Qs395M1FrbbNEzHj7AaHE7cWuK05W7p:GtHfDL0L3IFrHNE37LHWuP8
TLSH
T181C312983D70ACAFEA68E612F111392F98C4F047918D5A784D9058894DDFB9D432FD1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 126KB
SHA256 345a0e284118e0144919124456cf1343125a9b5b97095d94f38ad1a87a40d309
MD5 c1cd1ac48182e1975c93ec673e64c4b9
SHA1 848fb582bbe0b335435384f6d0ee4127288c8298
SHA512 f3ec79092ff927c23bab4b3c3728e4d8d5c2c957c58e7392e08474e7a2b4c98942b95ff3b97f543ea2a50b596295ab43a6a4cf812a0df85c385cf9d81d415c89
SSDEEP 3072:9GxyMTHfDL0Qs395M1FrbbNEzHj7AaHE7cWuK05W7p:AxtHfDL0L3IFrHNE37LHWuP8
TLSH
T1B0C312BC3C706C9EDE68E91AF101382B8CC4F547918C6D7C6D9468894DDFAAC462FD0A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 2065832443c90cad692011b79cc9d641bb0fedd04dd0bd01762c964b4acf8b1e
MD5 3bad70d65cc593ff6d0aceac7d1699a6
SHA1 e8434a6133a1263a2744b2ab5e723f79add3744c
SHA512 2bc37da68c8d05255213af04bbcb856ffde23502af4b5e729eedc308e7e198903845ca8cb77ebbe15cbfad79c3bb2104122fc29a08ca2ecb9adb5c81769c1f93
SSDEEP 96:mC0d+Ar2aetJRxW2rgj0+f+U+/EfezeRDotok5sVDbB6JGyvTNm6zjN+PEhiv4a:mC0Nr7OJRPrL9/EtDUDml9ImgjN+shM
TLSH
T157A10972647E5CB749B38545F5563B07CFA4B17BAA21BF8499DD2B0C10A70DC1382A23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9bb02e5c3df0fe5da83794bd9fdfc835234bd8051ebd671dc536fc72b521c60f
MD5 1518285c968ab72392c86c75a8ac2a2a
SHA1 8fc3874d30c34841870f1b306694e5b4ff0ac295
SHA512 908df4f740c1becb3f92cf0fc9a04e433e63c9c814f694281b9aec9b65eb60564d14d427617215ecd3564122c459cc98464217d15b9dd5cbf115803275a43a97
TLSH
T12DD023B07529EB80CB0D003540245A00322A82323CC7032399917C0CCD7D800D3DBBF7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b5b369bc5b1f0e5824a13ba2eb0e1fbad23bc2955074bfae65fd624e5741ca27
MD5 adccf9fdd0a90036d28cbd2af59d8799
SHA1 d5ed64b41be7f0ef983466e210499c6b3782c7be
SHA512 e586880eb5a7e33a92a27b5fd690ac4d3b9889bf2fb1ab933f8a011dd0f06234889156192348a5729b8009027649db6295f4f2d470a1ce1a9a246d783d4f0583
TLSH
T117D0A7B476299901CB0B11315514D661335683647C8B967385A1740D9D7A850D69E1A6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 22c1d58ffa7df77a7e0440ce3b2c474b1e03f30b60355bbf5dd6392fefb641fd
MD5 b9f45a900b1f64efbf90731f41c6ad44
SHA1 0c28e85e464e328fbbc07373b05113d39f83bdcc
SHA512 132313545c55ea809da0e811d6d5d324ecf5b6cfaefadb3fa4a29df5e6266dfeca7cffa4daf21754b4b37771504d3692189b5660a468784b5eaf80bf92f59ae0
TLSH
T11ED02BA033044C0CCE40203215B9A210720484204849031A8E41F02C8C6FD4387161F7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ee3af991fa1719733ca1e3ac746d5b605f4205e269bf244bd9ae780ceadb9bd8
MD5 a044f6413820c4c3fbd300ee9b379ebc
SHA1 94fc91536a25274f06d3a6e89322dec7fde7912e
SHA512 ced4374c54d7b4ea2b76afe4ca5d8841dfb55d8cb5db96de4ed49e64bd3850a817db5301787c268756641c94c0bf85eb4ee188f04fc891fa2e45ad48284985a5
TLSH
T13AD02BA433044D0CCE40203215B8A210720484209C49031A8D41B01C8C6FD4387171FB
MD5 SHA1 SHA512 TLSH

Submit Download

58f077e1-597a-4c74-bcbb-0d7605bf5882.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\58f077e1-597a-4c74-bcbb-0d7605bf5882.tmp
Size 414B
SHA256 1d55e3bea5a63bba100a421f8cdbf8f108339dde45a057451311afdf23c5b313
MD5 ca27202803e3ee8f266d252f80aed005
SHA1 45afe7f82dff12830da16ddce928bdb49e943d91
SHA512 739938b041196dca9ef18fdd52d87641d71fb3610166e7a2f9be98ed323c7f2f2eb55a29b41a2afdbe4727b7e6196b3a47ce8089d46a952bf93bf54275ba160e
TLSH
T144E02BE6CC229C6709FC1B6D54644A46E74513572A8055AB3A3C810D8FB4A7E0146C5C
MD5 SHA1 SHA512 TLSH

Submit Download

64ac41e2-833d-4d06-ba04-1b9471dc9b48.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\64ac41e2-833d-4d06-ba04-1b9471dc9b48.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 1fc98c1eff63ae029681eb760bd1fc7aa221f017cc80a2a7aab869bc7aa58a6c
MD5 159560404c7717d916b04733f1a1c50e
SHA1 3b15d396a516de4850dee52d106b6dbd5e2307c0
SHA512 ad3028ba2e7984067e2c713a40ecb4364aa5ab6f3ab0a81c70ee995e5c70050dbce1b2cd2a01a483a908b58bbc94d2bfaab1af11ce6b8ce433333c0e1434854b
TLSH
T15AE0268844CCCB2EA340A48B436CB78C8280F60BAEC8A95F27048D8C7005240E7AA6D8
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 f2d0f05ceaa55f8ad0935df5fc5c9e6c8e1323f692affd7907ea69b36c950dee
MD5 d81c16b8096478f733161528010f4e3c
SHA1 8228b389a6dd01d3a058e34efc98f5f0a5daf7b3
SHA512 bf8fa7cb740042a4479d7d3aa39966d393a021c68807e552c5a47c4bd7c2b32f7f3ceeaa64a4cbd0fd9b5595f4f3c57c15898f85cfd1a89de9bc37daf8678af8
TLSH
T1FAE0208454CDC33D53A8A487427CA74CC680774BAEC4694F2700859970419506387554
MD5 SHA1 SHA512 TLSH

Submit Download

f_00006c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006c
Size 67KB
SHA256 e63b097507f78ef90f95ee1f76e2cb5d07c70a40b2fb9459f193bc608b76b5d1
MD5 3ea326e420616471cf297c0ab8e0fc8d
SHA1 50c96adfcde7f631c4b24a54633bc5c02fe43e89
SHA512 edf402a35056dafc99ddd9c81961a6b4490148411e93f3553dcf30a301708b56a5fdea4b3c948d3078c29c2e8b58a0fed3f847dd4782214fa79ed93df41eb0ec
SSDEEP 1536:iZ2VMIyrXS6OSxlXl6ycPm1auPOyKCWv3xI71IuZdda:iZ2WBaSp6De1aujuhI71Iubo
TLSH
T13963025F696E64B0214139A619DB09C37D1AF2009E92FDFB7757DD752DD28002C7B183
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00006d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006d
Size 405KB
SHA256 6a16e34a33351bace9d24a9d726078da11975989eacbe4dbd74d565789c5c343
MD5 4691050af1f41bcdd1199697cf5e16d7
SHA1 a282b89d4bf59a101b4764d5a16d20d975957a7b
SHA512 d986c7a8931ed2f06b415a13b407050ec7060d55d7364044179985174aeef1ccef447bcbe1d903003625826cfe4aef5cc6619498b8b27e73f84c646828f224c6
SSDEEP 12288:alIo9G6XegdmPoVPH45aR7LxHZllllVQH/DLW4jDHbF:YIelmUPaapxPlVQH/D66d
TLSH
T1A494239529221629189D9246FBE02E45ECEFB835D85DEE74F04C88FD04FB35A319D732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 6KB
SHA256 804d227a5002dc938f8aec1e8b853aa23a63ca42aab3e29e03541d4a577a8965
MD5 64fee1cb12370d17b5230d7e54ba7d1a
SHA1 1df862d68eb0dcb25411b4ebb2a2a6ec73703549
SHA512 cba30aa2467221681c21eceb78b8c80915f44a7136838b831becb539456d8b7b76aacc4e7d133c81417295a4bf3594ee29edd04171ad6493e2e6e8ded7808de0
SSDEEP 96:dKoPvcSO/Vms/tHhkXXJr/AwO6nneLz4NhIrVXWPe6rVCbxHm:dK8vjONmWHWXh06CUaMlodG
TLSH
T19EE1ADC0C19BA264DF195AB034B88C9631B5838739CF7FB3505C3E775AAFF8811515A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe5c76ed.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5c76ed.TMP
Size 3KB
SHA256 c1606fa1d802bd5c60b0f567a011cdc38043b921612b21a883df9ab7f43b2617
MD5 578e6f78df2ac9e5af327b721f30edf4
SHA1 1a585e880a44be9a3405d11997463647cfe161ec
SHA512 dac9b4bb4f7471740c2e14b83c73a597ba976d33db823d190edbda108fc631733855ec80baa12867a491e3f59b8b07b8112135ce6646674bae27bd0a4741c383
TLSH
T1E651D9D44323EBF1DB67A9F169E5D4CC3670889A00CF7E0BF144693B5D9E78134A1624
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 948946afeddd5c193c02d52e4a9486dfe29dd42886627a83e4cbc7a8e5b09c02
MD5 d1ae57004c153229ff544e44ef245a44
SHA1 9910d78503ff74351efa8f325a514605a82e7667
SHA512 57554bb5cf35499befed7439ad536168f6972ffa8c69493c2aabbed2e47c51e778431670df313c1fca867bb1cba9e643ead2fa407f58bf95d7e77df374834ed3
SSDEEP 192:DKC3gL4ksarjVaVIEYa5eKfbMidlG303t57iQ/tWsibgLv8x:DKC3gL4J6xaVIEYa5eKfbMidA303t57U
TLSH
T135E1AAF383E5862EDD1196F0AA18AF2FCE2C0551436C3D5A85E4AE1B93F2471E141B9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 1afe5476558d6ca8ba1704e65db6f6c53816b5acdfcd65a7a07d748f5b84080e
MD5 849377525d771b2e588f4a5a63ca8484
SHA1 158e6b19405d8787aa08b1cc269e5f6951989a5a
SHA512 5ecd4abee83249f788cef5396724023186d0d3aeb1924aca5e303ed7ad74e57e9efe739558452ddb0bd9309614cce34959e6e6dbb31ab952f5f0ea92a5b217f7
TLSH
T1B0D022631240B1BAA96C7E95816AECCFC33A10200883EDD821D0DCD8153247C090B2A0
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 911ad5495ae03acdc37dd34519c5e422de68aed92fb7e9c1be35cb42c02efd9d
MD5 83336436b06468223de1206cae52545c
SHA1 43ebb03e71561a088beba4d087b51ea59aee3239
SHA512 2b147f336070a9aae0b5db29cea2337fa080f00ac9fb9455d70bd225f1e79830bc4cbb81c98fc4a87e6dfc96d9276fbfeda8aa3f7c5a51c93fbabca16aefb840
SSDEEP 192:sxRbRWTc/fKsd5wxZ+IZwzoD8p9el/g6+WNZtpB/AS3GskkoGiIgVNtMJ:sxRbyc/fKsd5wfDwI/5//lOC
TLSH
T1A542A756AA28993B4CCBD21DFA55BF63D6F95032A1D41E48A7FC8A0C04EB6DD520780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 21KB
SHA256 b0eb68c4bba0ffe84a16c23a6c0993de89e3783d251ffa07d416d726f02108c7
MD5 ed2110b6d2216318ccb5cd6b5302ecd5
SHA1 a3281978c8be51d71ede14172d0165bedfc9b02b
SHA512 9f6eb8926d94124be5b6c475bc1358118c04ad92dac72d6a713234072e1ed320a4762c89bcc53ee63309a3d7af92da7988d36f06d16959473c9b366e925e7eb0
SSDEEP 384:sxRTnd7Fm4c/fKsyWvL5tfJWu7b/5fkN/gcRNGB/mN/:sPd7Fm4c/f0YLvEi/5gge49mV
TLSH
T11FA2B456A520887B8CC7D619FD357F66D6F81423AE925E5CAAFCC90C04EE2ED2206C07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 19KB
SHA256 addd32f9ca5709ee4ead7f4969e567927017ee2fa6e4473cf54fd42530b957fd
MD5 abce85738e6909ab5db910943010c303
SHA1 4c8dfa69788e9a88f36be27f7ab11e3c11f38e37
SHA512 5b178d27063e3f38aded33e00f06b6a2465ee0405875086a5308ca9d5d3967b252b7d0e505d6bc4cf00088c20bf9939a1b1d6331e682f1004b2a3d9149c9502a
SSDEEP 384:sxRTndTm4c/fKsD5tfkWu7b/5ukN/7ORNGB/mN/:sPdTm4c/fNv1i/5p7U49mV
TLSH
T10992C657A92488778CC7D519FD367F62D6F81023AE961E5CA6FCC90C04EE2ED2206C17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 7eaa7cba198f25227c8bf062ff8694015480d9b28a1006c7bd4a06304e47b793
MD5 d7ab64e05574bb6635cda074ae89491f
SHA1 31de79df706a5ef129303c5db88e3019c49f6215
SHA512 1a2f44e1b33289c1960cb7c3aea6f05f2de30c180cf8f297f3ff201ed00cc6b0322edf73b3e31414b5d4ac1b2fddab12ed85bcaa030127680beacb9aa2cdf055
SSDEEP 192:sxR/QUnCRWEc/fKsD5wxZ+IZ/6IbpeoD8pJ7el/g6+WNZXlSuk/AS3GX+koGiIgz:sxRTnCnc/fKsD5wfD58A/5/k/WOz
TLSH
T18762D716A924593B9CC7D21AFA16BF63D6FC5022A5D45E48E7FC8A0C04EA6DD1307C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 21KB
SHA256 aaa31b5761b7b4dbc58b1aa1133fa6aea2410e92b88728e99a7e35b52c64158d
MD5 f36720cfab6478d1fe1a812b442efa9a
SHA1 74af53d372937667fcaa0deab18d84f98320e62d
SHA512 a5bef74d2c3ba20c9198ae75b7d426c22b829fa79b80de2e1d0122f4ba692f60f70713113aa3ba30adca0011e32a3193d4e85153354618b6a1fd1fd272b81358
SSDEEP 384:sxRTnd7Fm4c/fKsFWvm57fM4ZWu7b/5fkN/g1RNGB/mN/:sPd7Fm4c/fPYmxPci/5ggD49mV
TLSH
T130A2B446A524887B8CC7D619FD367F62D7F81423DE915E5CAAECCA0C04EE6ED2206C17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 5bc94ad58e4b64c486d101c88384df90e5226f2a92f08791fe4fab6106e9351e
MD5 cdaac5aec1513c751707b5c63cf0660e
SHA1 f36e94cc958ca9edff10f0628b2eeeabf622209b
SHA512 5e6e1924d75da96aac212d55ba254df548ab7b58dbb6c87176d3fd8049dd71ac38f6633bccfaa42239954071abcb22acb8d77c343374433c35607e556da5fc5a
SSDEEP 768:UQYi1I7pLuLfONWgv7fxJ8F1+UoAYDCx9Tuqh0VfUC9xbog/OV545pNK3roM:UQYi10EfONWgv7fxJu1jam45fKkM
TLSH
T1ACD2DB7B640CCA7E4F804A9DE9197E9F6DA802CB96D8CD8047FE941C02C6BFB51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0f852e19-6e20-47ec-b52f-395d3bcecb0e\index-dir\the-real-index
Size 360B
SHA256 f8d5b46cc0533353f643b3223a63f86ad2a449b41fee2206f0f491a573379cee
MD5 92f5c9fb2cfcc552eee7e41cbe40d3ba
SHA1 558b40775ea5abfbab12618e8fcc4eadef70b30c
SHA512 1783ad5771076d5f9dee589dbe281ef6ee11444161a30b6303eeaf58b9eb0006441f5d7d4897b08545c1ae58cb0851d1bffad3ba59202edc618154354bab7fb2
TLSH
T103E02B8F8C935587CA362C770573612E333B07FE2641EA6B50AD2019BA96B3C9A01706
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0f852e19-6e20-47ec-b52f-395d3bcecb0e\index-dir\the-real-index
Size 3KB
SHA256 1150d4f365635c2dd56ec646eb51de76eee6a4f2873c58896c193c9b2fee2161
MD5 38bd1f0b2ed968ad1aae44601e19432f
SHA1 13b4cdb4e59faaecbd6268732dfbca690bf2b6db
SHA512 30122f3bd3662104b75deb3edf7a16757002a72c3965a4c786cb999589b85a9fa3b82c0c938696db4c6c1fc742e8053510ff969c3f45881cfd2138bbf0198e15
TLSH
T178511A0F8D4A29AFDDBD19B26CFA208533756CEE4744D90B669DA1303DC333A1E18149
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5befea.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0f852e19-6e20-47ec-b52f-395d3bcecb0e\index-dir\the-real-index~RFe5befea.TMP
Size 360B
SHA256 861577526c8f81fc9c951b3c0d81e48e86cb5b51c5b969cf81a563c373b38970
MD5 cd697067476fc2ac6791aa54cb93128c
SHA1 e4cbff3b9aa8b2b88a5f0c49be1d24ab27f4f021
SHA512 3aee0b62435bd983efc714ff092d337b01f3d624185aade9427ca06450a514bf76280afac3fc7cfc8d519e4ffe7285165d413ef5429d014a8fd467e9e02a87f1
TLSH
T182E095CF40D15E62CD265D361543612F333F0C343545E75B10DF949F19717BC8545609
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\779a0135-369e-459f-9393-d86c8097e454\index-dir\the-real-index
Size 72B
SHA256 ee0d678a3120b5c4bb8b63a032d9abd25a7970a521e547876b59ff56d3f45425
MD5 d42ff9ea57a7d3d56daf68a182d29978
SHA1 cfee5b0cca422fb17be7d506a3a208551f22b014
SHA512 eb166e1b3e89a7642d4c8a145003e17e5d845f71f9f22fddf62a3dae739f5a92dd694b737db847ff4f3a44600a0570d508681903ce24bd24fd434417391c5334
TLSH
T120A002A646C48629D41222B43DB641813213CE282201131541E5D454C8B5A8A4FA144C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\779a0135-369e-459f-9393-d86c8097e454\index-dir\the-real-index
Size 72B
SHA256 895a321558573b790279ebbce7ced58a7cedb36a796e5877b5477f788fca01c0
MD5 f6502e92296d40ad69be8d0998c70551
SHA1 5120eca39355e6278c0341384e9dd7e24648f93f
SHA512 182de1dad0842924c25825885fe6220d4a118a3faf2bb187957cc2bd1a670783af426e37fc488f29f326b519a0bf8857febb453f3202592c8631134c5854d787
TLSH
T1F2A002120381000EC51751B1169202411312C9181941230A41A18668CD948404D6111C
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 140d0d11b39621c8cc450a4be2e0c11e6f31a04ced183a385b429860cd06c45a
MD5 1320429bcb545d0b6995a22cd3c80e47
SHA1 7a7d9ac9c5efb926a5d049c84d745c513fefd53a
SHA512 e56f9ed395c6a886b114e1da1cb135f5a106e7cb84951d56659b1e686949625192939c45e6434366e1f1810e1eb220edaaa7017d08b34c66b3c97956cd707bb9
TLSH
T120E068F33CA62824EE5FD7C2243180B04442F849C881ED1F186A55E390F03583855C22
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 5b3e51df3c2fac76b959a14f7325d0e276a43af7b69ec096c282294fdf194872
MD5 86b7169315ad5c0ab82d85d620d4f556
SHA1 c9482e2280291481aaf31968539767e3e96111cb
SHA512 5e5bac147893a220b59f60bc412bbc32e30eb09c05e75e157487dd408472dc5c81a3574b16a61f574d1d9bda8b7c5f30052ae59db1387ac3ed1fe5b22db49a87
TLSH
T13AA002308B8D9589D40A06746175564077505D9E7119230148DFA7AC8DB66D091CD101
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5c4500.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5c4500.TMP
Size 48B
SHA256 0df2cb4c436179967b3a5c41288dc74e78f08f7bef093f04dd1178c8b3c3cbd2
MD5 6bb5b92d98f084ae146ae710c2440b49
SHA1 4b860382682fb784c2bc59c2da5e58309f4ae6fc
SHA512 552404a08405129c9296bd802024bf96001f34d096de760f642102a49061eefb472e81d9a0fdf3aa64deb069e529f05c4d44be6f8374fb1686924f2bab9e0934
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 b775b21ae5d4973cf8bfb1953acce6bbf24aec92cde0f9062a242155c7c4b681
MD5 5ed2426f69a8eff44c75527a6cd28421
SHA1 e4997d9f8eff07eb85d495c28007b6f09e54a76a
SHA512 782d74d584dba99e4cb223542592e4f5a60696072d377171823ff81d6b40b0ee85eb712b535372acc9b72d888a5b22fd5c6d6b43669fad2be54510298fe1e9c1
SSDEEP 96:KRm7KmgIIOW4tVgGOK47g0OcOGlDziKAgKSsoKpiaV:Cm7KmgIIJ4tWGm7g09OGlCJPv
TLSH
T14691E91A723E4A40383E7D0C99A5942FC6C570E2341AF62B7FB910664F6AE064DFF4C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5d66fa.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5d66fa.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 4f6ce6a83471b90cb708088871db062b73736a8d96515d52b6bbddccf9e2ada7
MD5 64a4a3d83624f1b118249e0b7f63a1f6
SHA1 cf98026b8408b24c347ca85565e20ec46b571074
SHA512 9268ac7704fa2843b712e9d56e95a8c26929ad1b6526f3dfed4886367cd05d2f3b3026eb9175e77b1c6184cf945a05617249aa24e4451f9059de70994843dcf7
SSDEEP 768:7Hp3WUvlYy1HI7Hucys6BRvi82oP4/z6himoxoe93Z9M0/:7Hp3fN3imOz6ImoeaZ+0/
TLSH
T1AD03BF38AC108D7ACCEFA74A714D3E662EE41237D2EC5D98D3E95B0D456399DA306C23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 c023b422c062c3ad7e1fc7d6e1bcf05d55249ea425729b4056045e949af6d052
MD5 74c4a8335ffc0f88867e192d56093261
SHA1 baad969d19d6a2b0875491f88917d8e47bf3ace0
SHA512 429148bf98a28ba9881f7036d1d6cca8fb8ce6efdc86e75e7cfe30481734d4cf5bca59365092ef70c91fa7fefe7ec52bf61185e62531e991ad4d054758365664
SSDEEP 768:r6U3WIUvlYy1HR7Hucys6BRvi82oP4/z6himo6Ab9M01:r6U3WhQ3imOz6Imovb+01
TLSH
T1CCF2B035EC518D72DCEBC29AB5863B926EE4127396CC5E44E5EA9F0D0583A6D130BC23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 cf98fb38564e965c17dd736107690d28ed0ac313e3aaba9ea5030642457406cd
MD5 cb01c5fe52ed3cc87a6c474134dfb3de
SHA1 3cae409996cdf138963af08cf643e5a7175c90a3
SHA512 a9320ea628aac4f088ac9b5a1474ec030e2c2a6e889ca8e43c0f6cea4b17483f8cb0a3cfd7146cfd32f59f4bc5c3b1caa456b3452e9c6fabc73389c3f5a97985
SSDEEP 768:z3U37UvlYy1Hd7Hucys6BRvi82oP4/z6himo6Ab9M01:z3U3k03imOz6Imovb+01
TLSH
T105F2B035EC518D72DCEBD29AB1863B926EE4127396CC5E84E5E99F0D0583A6D130BC23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 36a89dc1be2a55cbce9b5e1a7510962812a3170c150e838705b22fa7ed869b47
MD5 11648578a80d3ad602ca9ba51f76cbda
SHA1 a7ac947cb279998a74b14bfb1a71fad13302844d
SHA512 06c04d6bfe6b3b19ea38b222d8389b7bc96b2d78671d056e6905452ae766698547c2a1852ff766584fb6fe9d151e45d020bfa8d2700ee9a51b261c72bca9c75f
SSDEEP 768:fkrv+4UNbdS30wlYy1HT7Hucys6BRvi82oP4/z6himo6Abp:fkbsbw39a3imOz6Imovl
TLSH
T1C403AF31E824CD72DCFBD289B14A3A937EF4126395C85D94D9E99F0D0287A9E131F823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 b8849f5f9723047829621f29dff50752ed2d08ff7d765ca87c186fd9becfb964
MD5 3f61d9773d421de443b48623f30cbfc1
SHA1 b3e6ded4d0a9dc27837638c66986c941fc8a7acc
SHA512 04ef065623c626fb677f409ac8af9206e1d5d484d3396b2ffa09fa84279d5335d706a273a74b2f6554376b9581a1107b56f8922101afd4935f0d309d03adc9bc
SSDEEP 768:xGrv+4UNbdS3AgLlYy1HC7Hucys6BRvi82oP4/z6himo+y2bwn+h:xGbsbw3A833imOz6Imod0w+
TLSH
T1D803BF36E4548973ECE7C288714A7A933FF4526386C91A80E5DE5B0E429BD5E630BC63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 ae31d87dd90662a01f69271950265c726a5956ef47dc04b34b9f9ecf9cd8b228
MD5 270dc0c6fead2daed0e5004c142ae239
SHA1 643750f654c04fca0b812a0f906edc1d1678b7e3
SHA512 e4b07053328a25958339853be2a6c9a1379b08a29ea47aa1d521c9772ad3dbac165fc22b828203c63baee350a2459912819e59981ddeb6134321a2f747baa0f6
SSDEEP 768:z/p3NUvlYy1HV7Hucys6BRvi82oP4/z6himo6vIl93vb9M01:z/p3G83imOz6ImoKKvb+01
TLSH
T131138D3C9C108D3EC8AFB349614D2A766DE81237D1F84998E3D99B0DC57396DF71A822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 6c464a92a44ac302eb78421dae796ecc263764bdf8dadd81474fcc41d459f867
MD5 b566e84c579e4953d9d633fc255fd3f6
SHA1 9aaf9ef1fd850018c43e4dbae3ebfe6626e4f506
SHA512 b0c07391254ca4fcc129a63ed7438436cf85e1e3671afd77e1965a66f6dc19705193a0c631b7338b68a60b51a9525a012910357840cb0320e262d419a9b5e44d
SSDEEP 768:rAc3RwlYy1HR7Hucys6BRvi82oP4/z6himo6Ab9M01:rAc3yQ3imOz6Imovb+01
TLSH
T13DF2B035EC118D72DCEBD29AB58A3B926EE5127395CC5E44E5EE9F0D0583A6D030BC23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 61KB
SHA256 994915b825dae2c9e1268b5198c41e195ca967ad63aa8fd25aeaa83fc5727fc2
MD5 cd61674fdc51fb1ec7d906ddb1294ab6
SHA1 e9f273631dd48237e7b02d4163669a83eef9f926
SHA512 a4aa81cc430b6ec7018534224a5e3dae8236e6e8097c99e88956d26c19bb0fd61c76419fe6b050ab8844f45167378ffbe7f64f7c4c39b338c100100ec898ca26
SSDEEP 1536:7Gp3l3imOz6ImoYVgEXRYIiHphf7x/mnaz+0/:7G5ltvi5fJ7mnYv/
TLSH
T177537BF998D3893AD8AE5787633D6E565AFCC223B0989884F7D51E0CCC525BFC309821
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 cb544c9cb14e6132d5cc453080cca83c90652b2804a0eb23ab08b155269ea7e9
MD5 bf627d393a5f6b49ec064d639d3e32a0
SHA1 4e4577e9e1a55e21d0faf744c8a6acec029302b5
SHA512 acc85874045592e6c0068fab7f140375df12fd6dbf87cce9d022ae17e427b19397b31c232d2782948f66275eeb7de43aa3b3ae118437ccee3338e22e514e6540
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter~RFe5c3c93.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5c3c93.TMP
Size 392B
SHA256 12b144e61aa175c0d2a0a4c8e83f59bf4ea51e7e4836dfebc9b9aeaf8125a21d
MD5 d82d1dc308d9e6b3631cacf78ce79aca
SHA1 4dc2124fa3e30166bc143b5101fef5442cae763c
SHA512 3e93c5ca7d3b48761003a73f784f035e006a2587ed50aa5122889eb0f05cf97e49302e7d9bf0b0b2785c57cb17e1b5b38d04a81955ea4f418c304906964c86c2
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 b2964313f3d8b81df176f47c783998dcb304c263c89b6bb9d30dc8adf480a0f8
MD5 85caa489123f8d12a0998266f83d92e4
SHA1 c4528bc5878b27a63ce4b6047946a73545e58f78
SHA512 82df41ec142fe15c20558bed2f933678ace282568bb9b1cea8a71dbbf7ced1a92c8244a14edff0b582dd8acefee862f7727b8c30430b8a1041db0c7dd8109854
SSDEEP 3:MsEllllkEthXllkl2zEelV:/M/xT02zN
TLSH
T1C044040C7FC41405C55510304133C3504370DD135F155F5334513C73DCD75400D00000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 852B
SHA256 51fa2add3b372e4d932d6926ca9be223a98d6ad3b63fcf099338f199d0a4ad28
MD5 0bc15719fed893a50e7e1a0840cebcc2
SHA1 b6b38e62996bd5e878b8bdb423c8908c2c7952d9
SHA512 e8025d1cc226ac64ba4fa534aa9a692475cc6f90a825329d6a12e01c23821f5e08fbdc188e3ec58612b5fc7bedb6f5a7f294d0f22467098763b8949281bee090
TLSH
T1D9011ED158391AC6CA7E0EAFA0472BEC44C8952AB2D834B908CDE8A4957985E304183E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 732B
SHA256 cf5e5467ab3de71fcb419acbbb754c3effd5e787864ffa7c767f24ff9bbe5ae3
MD5 87299a8105078d6252386ba9d333ff05
SHA1 c43e027b4174d2ae2c7f138de07b18ac0407148a
SHA512 f6678cce079ae97838bf5aebf3c195a2c82d27dd6546fd7e5428396130ca4bd2c809f2d2edca4f130da479624c3418beffe998ae1a032451706b9a47bad62885
TLSH
T1670110D14C3E1AC3C6B90EAFE04717EC40C89512B0D8387818CDF8A4917A41E345182E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 756ef3483952cd4f6f9b80821083dfbdf9bccdec392e28a2854f00ab9fd415ee
MD5 a5d8f3ba10a699f2b50cc8c1ed38bf37
SHA1 6d425c4f51f9dad92dae1d394bd3ee6fc81d3e6f
SHA512 8f5ea964e29453421e34eba8b37e4acc6dc0b4b7c5f89b5fb9aebe6b034a36a6e8a0373193f023de0a7f66ab8862ad8ffd7ce6177cf2d479f623e035d2160c44
TLSH
T1512111E1183A1EC2D5BE0EAFA0872AED50D8D216F1E434791888FD54963E55E215187F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 e56e2e8c12c30aeb3647379105e6cc00fb874ae60db91a7e65912c81acd272cb
MD5 4fd39e59059f75a9ced12b25de6be901
SHA1 d942bc4fe9fe1f73e1bbe6647bfa093ce7449556
SHA512 23ee132546b4ee2a51fa5a3c985b815d25beaa211114e7bf11bd3d405e3225c8d2f048f8c898338119b29d18f39f785fc26810ae2e4fc11137d14bf0526a1121
TLSH
T12C3122E1583D1EC2D57E0DEFB44B2AEC90E89216F5D434382898FCA4567E51D254087F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 972B
SHA256 6bbc409c6c8e5287723de210e3463bc9873d0adfd3542a753ad8169fa6342edd
MD5 a4942446efe6c44ae76e03f049f85743
SHA1 501f2a79ecaee0f14e1e17bbd93516fc73cb8cf7
SHA512 b8cb3908d88cca44b260e44c81f0a093cb6b4c92d9225a93390f336b886fd571202edb51f98654dcb7c80c411f600f090de5af458ffd3adcea3b636210b7b69f
TLSH
T18F1150D14C3A1AC2D67E0EAF60472AEC40C89626F2E434B808C9E854517945E314183E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 7f131d386f527dab6f8a4235038935e733d69317d35dc5eb69c52d96bf5b75d0
MD5 dd06dac0059d3cf25ad6de81afc96289
SHA1 38918b3e27aaa6d6adbeb99998847d2ea5649c09
SHA512 2cfd11f573eb223b18eb9882182d481ed6dbf7ec2357286c8210d4285f689d38e1e6cdce4e81f7880da9e59d1f0a7873374a7a32a0d86f20fb288f86fad7ac5e
TLSH
T1DA2142E0183E1EC2D17E0DEFB0472AEC90D88216F5D434792898FC64963E51D214087F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 612B
SHA256 918167fab0fb4435546513252415c1a2e44b6e8e60caf6f31d07587ba0a71ab0
MD5 5ca920f0e1c81dfb329b916e242a4065
SHA1 1d068ad79883fd23c27647c98e761858e46f48cd
SHA512 2b99239123f922883dea3137835bb8b74713799981e5aa1434ea70db85e7666f2372db684f94bb599ecff70c8c31d02286b0587ffe620333eb1d4bbc7feb84b8
TLSH
T11DF002D04C3E19C3D5B90E6EA40717EC50D45517B0D8383804CDE894D07A05E315183E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
MD5 c1bec3bc77db46888e279f8b3eeb18fc
SHA1 c2d14f387c796193ddc6378267768745c10dae14
SHA512 8d41fbab8134eec1a95a53d4d56d1d2edb1edced5b2f4987278e5b8f6ac9b169c9928a0c52ebe7a66393caddfa5a29e001890386b54105a8e69958661b40ec35
TLSH
T134F09E808C3E1AC5D6B90F6FE40716FC40D8591670D9287844CEE4A8A47B05B311586D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 8bbdde884f76a239161544bdc5dd38be45fcd38b4172bbe8630dd3f69056c302
MD5 bc4b668c701adc7329247ed782c1bd46
SHA1 ebe3892787b431850782dd1a2d4b5638859a4845
SHA512 23913959b3ba221f4eb9dd87ce08a8dd49eff4e204107e1b5ec8a1119d6c33a533fdece0909b21f80ec9f35299d0ceaa0c3f040332f3101b6a955189a380ac25
TLSH
T179311DE058391AC2D4BE0DAFB48B39FC84D8D326F5A430386898E968563E65E354083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 f02a7bd3b771879961428f883cc74267f62795d12233237f35bfd3c4c48dce64
MD5 720cbaa1daf0bfa34c779a917c251458
SHA1 9a1b20164d36666ec94e22b20126dd9575b62556
SHA512 0164a6059883ed2f1bbf4e316e5808af07034fa8105cecf6f0e3fcc82f35ae4b4d501b06f2759e8b2f3529eead2bd23618f463372eb60c33d1e955e2903b6780
TLSH
T16B4141E04C391EC1D4BD0DAFB48B39FC84D8C726F5A4307868A8EA58563D65E354083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 15d589c36d26b879ab9b6778f60b9708da588ead5d56887eea839678186b9c93
MD5 4f07be8d4ba4d971cab71ddafcbe2b70
SHA1 6b8f42628a5a5c3db81fa91582701e76515de3b8
SHA512 2c411a14d28fec7bc9545e9221d04287e99da7781dcb97ca1dcf40a8ebba498aeb75f2232eeee0851cdc4a254934c31244648cd3f0051c71edfeffe0192349b2
TLSH
T1D2411EE058391AC1D4BD0DAFB48B39FC84D8D726F590307828A8E958967D65E254483F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 4064f883ab03274d942d9669bcd8d2fb6cdbe53cae07e7c3c45eedb4fa0ce127
MD5 3d7f13d024e13960d589424710ae35af
SHA1 84cec1f45f7181378af3169fa664f2ef1630e695
SHA512 7fc51183bc0811cce4f00965b6c8a3874b0fc32432865df5d92b419cc72889a834c7d01b69720d627448553d9bf07e1f20998b00e93d2170e102da3db578bf2f
TLSH
T1443120E158391EC1D47E0DEFB05B29FC84E8C226F5A434392898ED98567E55E254087F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 0f4851d2d08fedaaf8104a0fbdc543c6f5a7c82fd67345db7d671b449362cfbb
MD5 77f71a1a262c4e86361de3a90207fc3b
SHA1 1c96628f1863ecce746b8e03e244004ff89393c0
SHA512 d32e215753da8220e7f2c1bd8d9b9f882706314869fa45afae698cfc032947bf8759f3f403076a1d8f69bb591edca53da629484ac186d9fd0c6d98d19b36c6c4
TLSH
T19A111FD1183A1EC2D5BE0EAFA0873AFD40D8D626F2E430B918C8ED54567955E215187F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 3a81a4eee729978393cff7718a9d8a74fd3f6f122297e9c12a11b4658834411e
MD5 fa6015a8dc98e735976dc38a0990672b
SHA1 5f2e6427fd32691058b5ae21d18f6695efe6fe87
SHA512 d3f3db3b730235d6df3b555174dbedf1b51d5b0f5b0dba88e7a6cd2e8de59ade2baabb191a30d0a6b914411256972c8663b48057a0b017df2de09a08c241d930
TLSH
T1FD313EE158391EC2C4BE0DAFB04B2AFC84E8C326F5A434382898ED58563E55E214083F
MD5 SHA1 SHA512 TLSH

Submit Download

299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

metadata.json~RFe5be3f4.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json~RFe5be3f4.TMP
Size 132B
SHA256 ea13d57b11af249f90704dbcafd354c5e80b10358db7edb9eaf8f6fd597eb1d4
MD5 ae3a19c226264ff6cb64877f1e7e7243
SHA1 f993431dbd09200fd92b7a04ee6711a54ad95cc9
SHA512 97e5dbf0663585afbb5e0f2b5a36192624eb2c898462abef65225987df632d30f74f05ac5a71175c4c59f75d9ae6d2e640d168e479cb26b9a6857c71efda029a
TLSH
T1C1C02B85CB1E0C854E78153D48420B2727819F0030508534445A490C41741CE00888CF
MD5 SHA1 SHA512 TLSH

Submit Download

4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\x9aidq83.default-release\cache2\entries\4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF
Size 16KB
SHA256 cebf5b78c2028d9ef9c3471fcd92f87ed673888b2c6f3fabd5020e7572e0c414
MD5 16b0e7e8bde0ad9e61ccb457d288d312
SHA1 95c3de9051296aef66530da419567224e74846cf
SHA512 a1356fa9331449e6677074d582772e026f0ce20419ed965c1591afef0a644db740a9f65f279df09c48146f649b95992643900e886653c5f45c14cd4ee2c3564f
SSDEEP 384:HwCe7iO024YXDL84KKDL849B7SOEAd9KVRaAcP+AWRMAkzvoH:QqZYXDL8lKDL8CB7S/AmVAf+hRMLgH
TLSH
T13A728D3A9F413CAC1597C0E8C5B9529A8C18B6A7CFF6806D21683D0DC794A6AB1F548F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_10.0.10_(x64)_20260731134850_000_DotNetHost.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_10.0.10_(x64)_20260731134850_000_DotNetHost.log
Size 2KB
SHA256 27e4090515608798b1140fe904260b37f4600bfcd1c5c8ee38026d9ac7933025
MD5 a980816585b6f51a021569f42370050b
SHA1 4a7ada460a072fca6a7d4fc8b8f9500720ead0cb
SHA512 e33276c1df8a4c2bddcee9e5578fdfbd376c308c9cc828ac14322adb9c7f4f238d1d3f9484667ba82a6777f5bb0afa4f9fb2eadca1469912815c010cde193225
TLSH
T11341E3141EE90925F1B61B47AEF3D0529B33BCD36934CF4C1285825A066FD0598BDBAF
MD5 SHA1 SHA512 TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_10.0.10_(x64)_20260731134850_001_DotNetHostFxr.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_10.0.10_(x64)_20260731134850_001_DotNetHostFxr.log
Size 4KB
SHA256 0403d69ff96ddbd602912d06e181abd65485580937400e0516557613b0fe4d89
MD5 86952a5977786c9db1da677fbca581a5
SHA1 e4bf407f5efb1174a076605e13b0f238e2579fc3
SHA512 8ec04c7d97762a06b55c06451c2180084d3b9a53244cd953472d7fc2f774f31ee7049391dc01aef982a06af8d3e43613a6743a2207f0f58fa66a5dbfb53ee104
SSDEEP 96:YO+VdQR9+pJOh/arf6iR9+pVxsd8gR9+pmdWTKFMH:Tl9WOh/a19V9WKFa
TLSH
T12B81E0695ED90945F2B71607DEF3D052AA33FCC3A935CF4C1346821A056BD0598BCBAE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_10.0.10_(x64)_20260731134850_002_DotNetRuntime.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_10.0.10_(x64)_20260731134850_002_DotNetRuntime.log
Size 3KB
SHA256 3e5cb8ed841d982e7df2005b137b5dcff0eafbc949a6eb5f3caf34c48dfdf8da
MD5 005d60c518e7ed6b84aeeea5b89594a6
SHA1 06b57fed5dcde72ba2b28a9ee22dd5b6f411d822
SHA512 98dab7fa45fa1b8f46ff1c6cd8985f3d7d55316bcf14f0ca53e8c96247b1243d9c0c15edc97b56355481e5256a7c2bab4e22ad3e2c8c08db2488d36727871b89
TLSH
T18B81D6151AE90946B2B75B4BDEF3D053AA73FCD39834CF4C2245431A056BC0698BDBAE
MD5 SHA1 SHA512 TLSH

Submit Download

d930c8f3-1d9f-42f7-bf2e-533ee6bc68b3.tmp

Path C:\Users\Admin\AppData\Local\Temp\d930c8f3-1d9f-42f7-bf2e-533ee6bc68b3.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4824_171985190\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir6412_1826152440\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DotNetHost

Path C:\Users\Admin\AppData\Local\Temp\{6780CACD-DE61-43E0-997F-6386D6B30ADE}\DotNetHost
Size 1012KB
SHA256 03eb33e8eb7746542febda19278dde1c7bd496396a69a9d625a05f9506a1c3ee
MD5 667bbe018d9a8052f0ed4d4b44a02ec8
SHA1 9af6e69d606a4741ada8a58f36b9c06c9cf22626
SHA512 5e07d476569a3c7bf938278adb2b710be015698e5c3f01a5aab2db319d07b8ea675758aeb201577d3d51394550c313dc4bf401397c44f846154fcec9a445c073
SSDEEP 12288:SN2etgX0xsm7HrObWMInYLE/BbdJ0zErWolCJ9TeWxqYZfDvXNM:i26gG74W6WBbdJwEqECJ9Te7YxDXN
TLSH
T1A2256A1BBFA404A9D8B24E75C5B78321EE357C482320969F43A47229DEFB7D0647A7C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DotNetHostFxr

Path C:\Users\Admin\AppData\Local\Temp\{6780CACD-DE61-43E0-997F-6386D6B30ADE}\DotNetHostFxr
Size 1.1MB
SHA256 da12be59d35710ff0082f3506e84d741c00816290ac1d3093078e7c7b4ec2d51
MD5 ecd6f2e85cdb3623db79832c198448b2
SHA1 48580a0e26d28d8c3ec0c0418e1896eb70448285
SHA512 4764485b64fb4bb7e3c4e28678e172c84cf9f67a23a905a0cca8f9c4522cf404be3a5dd6cc23d3dd6fb96ea2bd7dae425ca36adb80324ec795ce560806575fa7
SSDEEP 24576:626gG74W6WBbdJwEqECJ9Te7YxM6fA9Ac:626748BnwEpI9T6Yu6lc
TLSH
T134357B1BBFA404A9D8A24EB5C5B78321FE357C082320959F43A47229DEFB7D0647A7C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DotNetRuntime

Path C:\Users\Admin\AppData\Local\Temp\{6780CACD-DE61-43E0-997F-6386D6B30ADE}\DotNetRuntime
Size 28.2MB
SHA256 4af98ab9168f319b9d026e01bd6e9df577799a222b04454579053a5a00abd555
MD5 8fe07617a818797bf2170e4ca5f4bb95
SHA1 126523726901f0a1129d9066c369f963f1ef5854
SHA512 75544a3a9bff83e7fed005ecfd0847ce32442e82c53879097518fd03ef4f6d8364bd5400912613d1eb33f6ae1e262bd1a61087960fbc6655ecd03260072bdaea
SSDEEP 786432:Tg+OS4VhnxfDEAOZGc3PHDOsz1tHDypQp:TF43nxfYnvDOsqu
TLSH
T12A573397BFA408A9D4A24E71C5B78325EF313C182721C59B42607669EFFB3D464BA7C0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsDesktopRuntime

Path C:\Users\Admin\AppData\Local\Temp\{6780CACD-DE61-43E0-997F-6386D6B30ADE}\WindowsDesktopRuntime
Size 28.8MB
SHA256 024753cf71ec777cf38c82c29bfaae467ab554086d1cf6b34f5d850f61a16c28
MD5 b76d067851e1d31cc6c6f00bd68d078b
SHA1 1a83f1fca787b802f03b12c60cea0306b64eda1e
SHA512 c1551bc40c04b552b6925675180fdb69bd00e4282bbe5c3ac6db13fa49a2786f430171ed7379f7bbdfbecb998297fff54ecb77db6c58feb9f8a1196d112d155a
SSDEEP 786432:Kl8TBZmSPFbeIQhCxCLWcSEDm03uCoE7WOF:KlGZmiFbVQsECcSEdfS
TLSH
T19B673367BF9018A9D87B4E78C4B783649E317C192320AAAB47607619DEF73D451BB3C0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

compatibility.ini

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\compatibility.ini
Size 198B
SHA256 252b7fff962848c61092e82a3d87adca163849767713a93ab533bb397f1f53bb
MD5 ce9ef13caa8a74c25157b184aa038475
SHA1 db03a9935d8bb3ce6b120aca98feade536805160
SHA512 0f6f5053e78167ef5cc5fa70ed3a87dd116df0671a590299277a197341bed983e3d77e37ad2c33cd4afe880fab9ed1c7f7502210040617a01f97a81c1e1d4f29
TLSH
T1C1D022818BC7848C9D4AA8E4537C38086BF2EE0E0604492A32827F0B4164F09023C3F9
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 be5c6a97d747488b444deb1002b7434f92628d673069c2590233ea77239848ae
MD5 12ef15150a60d8208247c87fefe33a86
SHA1 b8b98951abae1fac6a4f6371f621bedfd500ec4e
SHA512 9b55274c7fd072f5a41571453773c447c1cd2969da994664645599b6e57d52f864d5af0bef13d044667b429c4c9fd5015dfb8a96487daba1a85753f434dbe8c5
SSDEEP 192:511d66JoztdzgCl6mc0dRtOv5zbo7z9CQyjjCw:Bd66Joz/zgC1jDCboP9CQyjB
TLSH
T166F12FA8E628463FC408027BCCA61F444F35389AAC4E3F1935AD655C2D5B2DE76CE17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 d71d8af7fcfe706c7854979b4e1e8a646d83076a7eee9415825a7ba098163b43
MD5 1730e6ec605e43044f6c9fb5eeb231c5
SHA1 1a1a55378959720601fec92e2d5fbe1dce2378f0
SHA512 6c1197d67ca1c3f19bde01d0f242e8232cee01d65ca75c62939d4c3afd437de85139122c8324757dfd03201aff4df56a3bbec036b784800484836d1023d4bd41
SSDEEP 192:AtOv5zbo0ZCQyjjCFl1d66JoztdzgCl6mc0dz:ACbo0ZCQyjOd66Joz/zgC1jd
TLSH
T103E120A4E628463FC408027BCCA61F440F35388AAC4E3F1935AD655C2D5B2CE76CE17D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\datareporting\glean\events\events
Size 1KB
SHA256 b2a140b53d7ec9eac6222b542bf37c43c875c778d4bfa9b7927b044f17140a5d
MD5 c6da65a06d41ebfffab088e094b9830a
SHA1 3e3c4983f37adbcb0ceaef4cbbb1bd446cf571a4
SHA512 2bf11235269b98ea4249c6c84120bc627590972a2d46e913c4a1265984d13471ded1c09729d71d6eebb705bec41ff82a800e2f287ace80aef45d62c298139e5f
TLSH
T135213A9C39FA4D6AACC7E398B451028E53254E0744871D476D03FF8CCEA5ADB31AE939
MD5 SHA1 SHA512 TLSH

Submit Download

2738464f-2cd2-4b24-bd65-4e080f06c61a

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\datareporting\glean\pending_pings\2738464f-2cd2-4b24-bd65-4e080f06c61a
Size 883B
SHA256 e6ca18486cf11be878c42d8e8d308bd3115a6b92bf80c7a7c8d037aaa9dece66
MD5 99d3e112cbe32bb8b9a7b6f26f8a6c4c
SHA1 d652661e587ce84718dfce8c2afd0538fb69c482
SHA512 6b400e56ae0baa428c09165df080906803ff0d40aed3a8d4138468e950792b4ebcd5a9a9359c1bb8c80b014e1feec98e865209214f2303e03404e14f58ea1c84
TLSH
T136110091972579B2CC7C924F84963B469BE4A51390CA44082DF14E184F7E61FA3EA707
MD5 SHA1 SHA512 TLSH

Submit Download

6d789739-1c33-4e42-83bf-ad9715efe30d

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\datareporting\glean\pending_pings\6d789739-1c33-4e42-83bf-ad9715efe30d
Size 235B
SHA256 0d97f22f3de13ebf969c7c998a8ac292a949f4dc98ef66f1f2a96b7e9ad2b3a9
MD5 056b922a347247ef696cc8da1be98ad3
SHA1 07a6de7548ba72d4a2a280c2d967db5935d4ccfa
SHA512 617267d77cef6ac730f05dea1ab412084202f2ca16415c4c786a63513b227a4cf43463d4ba17ba42f070f368da98f11aa22aec03e6dca9e1387280398c51d5b3
TLSH
T1A1D0A780689867DD48191F57F0E46ACE70944C3764F49C20EAD14674DAFDEC85292D17
MD5 SHA1 SHA512 TLSH

Submit Download

a69782ed-b9aa-4281-9397-3cd0135ea2ff

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\datareporting\glean\pending_pings\a69782ed-b9aa-4281-9397-3cd0135ea2ff
Size 235B
SHA256 d255ebc1f718924d38acd385be618af5946551e305eb89d393f46a302fae8cef
MD5 4785edf969fe7854de5cb6806182d97f
SHA1 7b958df791375439651b6969ef25126cfc30844e
SHA512 3f85291da8a7695293e12751a2e1b0077c521de5dd7d184b824fcb6dc6dde5c9631301b42caad91d321b755cb459208e9570beda9741dd7288fe4bbec4f790a1
TLSH
T1FDD097902898673C08204F27F0B03DD630C98C3790A0D8208990463ACDB8EC8412280A
MD5 SHA1 SHA512 TLSH

Submit Download

b5463d16-8823-4729-b20f-117b1bafcf64

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\datareporting\glean\pending_pings\b5463d16-8823-4729-b20f-117b1bafcf64
Size 15KB
SHA256 116972f953cc5109603544a45fd590e6d009b5cfe2387e8c16cb537250ca8dc1
MD5 b856122fba690cf9ea18002fb408c46e
SHA1 735e016d1e6e653b521793adbfa43af32fcb402b
SHA512 168fb24f4f43c695097a83201605bf34ec25ec5ad4f9e179d69b008665aef91972c6fb40a89ff9557029fb662762c36d35d448f77822dc091787d9d7f5a29f2d
SSDEEP 192:KFL/2DEJKbjzljpmuujyAbk7cIRXokaAV8zl5aiVyu3J61l0oBoGu2R0eeyyD4b:rbH56ItaAV8x5aiVf38Nu80e1I4b
TLSH
T1E762E9566420597B8551E36898EC7FC3F5F508CB4C029FC99BE4BE0869EA09E1127C47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bac2c494-9d82-4135-b512-938ffaacf816

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\datareporting\glean\pending_pings\bac2c494-9d82-4135-b512-938ffaacf816
Size 2KB
SHA256 ac5ef2bd3c708804169536092a6c1b88263c629a40a246c4572e9819d059e254
MD5 8037d5f3edad83b00c889ce18ecc437d
SHA1 70628503f104a3c418e4c176f618720f97603bfa
SHA512 fd6b37d21c9c7fe7e04cfbc5e44ee2acb484edc3450136016d3db5d6d488f5b9c9a733a7b07df7818509906bb61839c35638ee0e10f8e292f8fc5bf481e5b6e9
TLSH
T17741656835785D769CCEE65F809233CE93A18A0390C618836D51DF0CCEE779F63AA517
MD5 SHA1 SHA512 TLSH

Submit Download

fb7a5428-358e-4387-9b7c-3b76f2b99c20

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\datareporting\glean\pending_pings\fb7a5428-358e-4387-9b7c-3b76f2b99c20
Size 886B
SHA256 cb1ab9db65e4d3d61a01e7c8be47043233c7b2cea767c7afa3e66c23c349f380
MD5 46f046a2ba4485a3b38bbb97421d9bbd
SHA1 12feaa9cdc44326fe70f063b1f45d013433e666c
SHA512 0162ba1f14c931b593f6a98b65009043c228f1b84761e4e48a5173fd53bafb948c5ef1d19f56d496d06be19bbf71a6d43635c4bfb59ce8cb3d5b6d6a3355868d
TLSH
T13C1127A14634B9B2CCBC928B45D0374A9AD0B413D0C618087DB14F184FAF51FA3A7307
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\extensions.json
Size 16KB
SHA256 e0b8b58d99aa58d3f200e5787d1527af143475d20c9a66a0fabeb7ae0a217532
MD5 d38fbf1151da68f4b455b891664509aa
SHA1 ae26bffdab322be30e84b99517fea2210d60c03f
SHA512 833bd1d363bb6de02dd21e47eba8569ef942e75e44b81cf69bfe706cf3a1fd48d9c7b06729b3134f6b2bfd83c444b2289d4c7b9fc1f487f267d40a579ac55c77
SSDEEP 384:LkI4vUUmldvS8dhWp94z7j96ohiL4HsL4PoL4HFL4HwL4HAo4hz:4I4cRfHXY4Z6N4G4y4F4S4p4J
TLSH
T12272521545049EB8298FA79AAA367E01C37D433B70845C78F4DD8FC802FA5B902FB61B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\prefs-1.js
Size 8KB
SHA256 ff13ec6598d90d93a751cbcd85ea96661255d27c3210367c0b64713f18ea2abd
MD5 f7ff592a82906ebd0869d90e0b3f5788
SHA1 02b8a72e58c554420d7039c34987ef3e940a530b
SHA512 43fc3b2a8903518af14942eec4adf8449a4cb79e5dd1683aedf6c0a04a2877f67da36f505673b9586e84a2e91d2116b125fab8f3664d52177344e897fb2a900c
SSDEEP 96:xHGqpTUmKTPqGqGf8PDObzS62BSSlQdv9jhnoRWRYJtHBw88L8e8L4cnSqoLxGS:oqvKTCRGf8PDo2BSSd8RgHBw88oS
TLSH
T11302FC785004DF7F68B2367CAC2849715A72023BBBBF68D650B958C4451CF3941FAAEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\prefs-1.js
Size 6KB
SHA256 a7937ab166db47d00274e43e9e901c977231efd177416b04b5b5db68c9b5ae3f
MD5 e42b388bdff587e74abb7f72d27cc890
SHA1 13dcc64a83aed83acc3687404a341c670ef720cd
SHA512 b5a82c64f8fd42af65a7076c50d491093cc4d0468547d9aefaee603190d5afdbdfa436768a404e18ce52bbce5e7cfeae68759250740638e7407657cb187afeb3
SSDEEP 96:xHGqUTUmK4qGqvfsPD1zS62BSSlQdv9jhnoRHmBw88u8L4cnSqoLxGS:oqWKTRvfsPDX2BSSd9mBw88nS
TLSH
T18DE10F7851188F6F74B677ACAC6888316A72023B7BBF68D710B554C4451CF3482F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\sessionCheckpoints.json
Size 259B
SHA256 4f5d849bdf4a5eeeb5da8836589e064e31c8e94129d4e55b1c69a6f98fb9f9ea
MD5 700fe59d2eb10b8cd28525fcc46bc0cc
SHA1 339badf0e1eba5332bff317d7cf8a41d5860390d
SHA512 3fa1b3fd4277d5900140e013b1035cb4c72065afcc6b6a8595b43101cfe7d09e75554a877e4a01bb80b0d7a58cdcfe553c4a9ef308c5695c5e77cb0ea99bada4
TLSH
T15DD02E83C209507ACE836E68B39CBB508E3F00F372240202B2AC888C183F023418F803
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 320530682ff98d789155be1329ade326361aceccb16bafa0a6eed3c3b8ed20d8
MD5 ab0d8760e1334af21c65bd365b0d9063
SHA1 65d03ddb8f6583bc0174dee9cec5172dea101e8e
SHA512 51b490cddb7610179b42fd86e9b5ef166ad36355aae9914433fb2d702b04842f4a345fd01a057528176a05404f232f745ebd714a299e2e0a15c14b99a6fa777d
TLSH
T194212B939C171AF2B352E195A48B5FF5C776303249F614F0C04A86002169D4B7789A19
MD5 SHA1 SHA512 TLSH

Submit Download

Obfuscator.bhXByQ9_.zip.part

Path C:\Users\Admin\Downloads\Obfuscator.bhXByQ9_.zip.part
Size 274KB
SHA256 34a3a30d4425942aab3e9054c0050593ea75f466ff383782592643c9e7a6b87e
MD5 fbbba329c27b046be15ce090b7b0de64
SHA1 46d1222be911cdfb377da4fea283c08a14a68b0e
SHA512 eec1a27af38cdc4cb11d6708d5be9998eaece2e8b7406f54ea64dcf3d3ffa64d1d422f60626b66706eb6e95e8003ee03ad984098dc74784d70784db0017f68ca
SSDEEP 6144:73amJm0/Zo4GYMlLSN8Cdt+yVrLpXlO2+mn+yk357+a6:73tX/ZQYMlLA8CdwwpXA2N+FF+n
TLSH
T1E25413C69F4AE65FE04CF630549AD70512A38F863BA134497F34AC797C794922362BCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rasp._5gHQAlg.bat . dabeans (2).zip.part

Path C:\Users\Admin\Downloads\rasp._5gHQAlg.bat . dabeans (2).zip.part
Size 9.6MB
SHA256 15cd082343c97023905ebc9cfdad3a42505d6964fa0d8f2d76b227ffe5567a95
MD5 2de1bcccccb413e2356c15d5dfc00ea6
SHA1 bb5103b7e436280429afdd10921c39b39118aac2
SHA512 3a37c370b717104462f05a8caa02797c9722fd807c40fe0f3aaae08479323ec95962a9d966ee895f6d7e02093e168ab61bf949b4345bd1be86c11906db31f358
SSDEEP 196608:Mbkmr/gZxqitxzDjlgoLbQAPDAD7lCOFet9Nug+2faHxmJhkl:MwmOjlR44u70HFfml
TLSH
T152A633BBE7B96F98EE5FB138A8279E5285DC445C4D7010A86E844EDF261B4D013B01EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIC4C.tmp

Path C:\Windows\Installer\MSIC4C.tmp
Size 392KB
SHA256 a28ed81b8594774c7e1e82f9bbe858c3b36f0d7a93067001387a5a872288231a
MD5 f1fafe5c54813a5d7b60d08b859bd58b
SHA1 95e6598ce1c02220d68edab5474980b7f0f0a12c
SHA512 6dbc8b10277c6fae8d7ba961a843810df0bb11c9c6e3ba54eea1b24e13b1069e454ef5d76d345839a32f94871855928578a15948ba242d03c990b21d8f845df9
SSDEEP 6144:u/VbdUw0z9ursTolCJSqJiIUk8AeWNxFqYrtUc06N:u/VbdJ0zErWolCJ9TeWxqYZfN
TLSH
T1CC846A29F7E418EDD4B782B6C5A68030FF75754D332095AF8BA845291F3BAA470BB701
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Staging

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6236_1864558004\Mu\Staging
Size 36B
SHA256 411a706def2e70f96a507208bf80bceb93e950c4c2d671cd1ddb4134ce54b2a9
MD5 0163de1b14421d4eee3757ff76fd81e4
SHA1 96c75c4fe1e3f33a367f45293bd1bd8bff1c06f4
SHA512 80114d59db8f3654dd6821589e5ad03daa923a35610a372756a8865b3e769621e32ef2aed92c2494de2b9fc06d9796b12f1e3bb75873ed794e8c9ae8a0d5e965
MD5 SHA1 SHA512

Submit Download

LICENSE

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6236_192050827\LICENSE
Size 1KB
SHA256 3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b
MD5 ee002cb9e51bb8dfa89640a406a1090a
SHA1 49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2
SHA512 d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c
TLSH
T17D31535723840B9306DA2B4566AEBDC4B0DDC02D7F27AE05186EF394537B52ED8B3443
MD5 SHA1 SHA512 TLSH

Submit Download

BootstrapperApplicationData.xml

Path C:\Windows\TEMP\{6780CACD-DE61-43E0-997F-6386D6B30ADE}\.ba\BootstrapperApplicationData.xml
Size 9KB
SHA256 b1eda1e98d843eef81232344754cdc0973d9dda1c1790a91a352c167c9a64ca5
MD5 5b54f26d64fb1f7e82bec5b4ff190ba2
SHA1 11d8be75fdb2bded9b835a2d0f6e5bf1848e0ce6
SHA512 3418f51296007c704600edc69c91e26c23e8e159e0a20aadeae06d010c80cb85cb4d86517d9fcf6ec5b150578311cb57592eb220ba0f93c7512d812e29b83fb6
SSDEEP 192:2/zaT1c/ovY9qnpijXjamaD0QP7XsCsysz:9sCsysz
TLSH
T1A912D4112BFD0218F0F3AE48EFF6A4555A3ABD552E39C92D01301D0F49B2E819962FB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DotNetLogo_256x.png

Path C:\Windows\TEMP\{6780CACD-DE61-43E0-997F-6386D6B30ADE}\.ba\DotNetLogo_256x.png
Size 2KB
SHA256 0f571f95d8eab48dbc81b0ec5e9f7225e349e26ef50868bfaab556f3c2443b01
MD5 39aa52615723b782c92dec710caaec7f
SHA1 760b49e256a7979fe50a56a2b1be3688a474b886
SHA512 89d1baa3820154667747b25e9e2fd321bfb2ec71dc309915b0a28dacdc80822a4943b639ebb37c37bd2559d5a4306d2096119cd970c84a0d331f6c68b0456dc9
TLSH
T1534195CF1BFD78D7E6E557918E1A8DD232738483B4B3A42CCE7B10B8274A5642B87940
MD5 SHA1 SHA512 TLSH

Submit Download

dotnet.ico

Path C:\Windows\TEMP\{6780CACD-DE61-43E0-997F-6386D6B30ADE}\.ba\dotnet.ico
Size 44KB
SHA256 61a2cbd12868cb9b359e0c78961d409b7875f072eb8e53ea88d3e6bfe2961a18
MD5 b8096652d9ec286709a2c863b244b110
SHA1 b3b7f0f4d608fad7cb59ba499d4d17c2b873a7af
SHA512 492a5aa83220bb77c178b7c5b50bf44968c0427e9e45bb97a33df14d7fb4c667ca7adde0ebb3874c7b6011057b01144e4e6651fbad62c6bcf5e0b93586c4bc7a
SSDEEP 96:r+gfbzo+wHK9NbwOY4tIWQeVlV1W9+H+guapUjFamINUItzf1dBNaIZ:ro5HuNcH4tIzeVlV1WEOFDgUWzf1PIm
TLSH
T1E913EF6DE68547C1C10C2032DB4AC792B5233C72E4DAE0C4F9D4FA7E177906965C6E6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Windows\TEMP\{6780CACD-DE61-43E0-997F-6386D6B30ADE}\.ba\thm.wxl
Size 7KB
SHA256 b00edd703dd8a475119d0e4dd70a3aaa47f0e95361af290e76d367a8edef3432
MD5 8b2c667a8bbad3153068c0ed90df7ec4
SHA1 c9e04a3a37e5e6262ab9bfecf78280171b8f7b74
SHA512 5269f00d474acccb4c48cb7bcfdf19e63557a388572d3a6335aa39191319691d924e27f70da3f3495387c319396476c63a8fd7b35835cca0901220e39783847b
SSDEEP 96:HiTgM1+XSNEzA0HtYQstYCpCwZQpCeyk5HQJM9ouvj9urz8:Ew9EmtYQstYCPC9e8
TLSH
T191E1026F68DFDEE03A732651B2B3698D6919C29A136F1CF0F869084B47635016377A03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.xml

Path C:\Windows\TEMP\{6780CACD-DE61-43E0-997F-6386D6B30ADE}\.ba\thm.xml
Size 11KB
SHA256 dfee8e2d075087227f19c835c145c5bb8e72a46880ea24080bb2472fd3a521be
MD5 4329e418dc56b1386d7ea29a0dcfab5b
SHA1 58387f92e89ca21b4179fb697c7de9675c59142f
SHA512 6934873d27e6efbb94da4f13ee8369b29995490051016fdf82800256b924902306d328bf1d4ebbf266d1a53eb24adb6478d1a67de4ecc3e3bcbe561968f24922
SSDEEP 96:HgvPkoeWEH3IWTaQfSJgHzth5mFahbuB8pR5+Vpwe+UIJLg1gEp+6F5pQnxc:AvoWydmQfVHMyyj5Z
TLSH
T14B42FC6851DC7811C532D702AB9371D3FF12BDA6C6C85A58B48E256B1FF262028B739C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wixstdba.exe

Path C:\Windows\Temp\{6780CACD-DE61-43E0-997F-6386D6B30ADE}\.ba\wixstdba.exe
Size 431KB
SHA256 2b1cee5e3e24593247854eb7a7c4308937b9c607754ed2fb83520a8706c26f1e
MD5 0e88ffd2e737ac9b9a4241616838bc23
SHA1 3c8beb465d20bcef0cd6ceca9c60286d1d15cebd
SHA512 169b9e08518834c9bc5adfe4ab7b79e07685b72f30ede1c1a386229668bde8c15da378e1274e4013ad7b84d6f7a5acc64ef0806e3b8a66322861efaa7e26b620
SSDEEP 6144:X9vfS1NP+c3ytxmg4Stlqe3B9m2LSLTwGw7C3ZLaov5xZvSdF:X9v+GIyugllqe3wwGfX5/SdF
TLSH
T129943B3165F04037C6F90572AE14FA31BF69F208231095EBA3C0DD293968AE5BBB7657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

windowsdesktop-runtime-10.0.10-win-x64.exe

Path C:\Windows\Temp\{6780CACD-DE61-43E0-997F-6386D6B30ADE}\.be\windowsdesktop-runtime-10.0.10-win-x64.exe
Size 967KB
SHA256 47b74e25c31fceb862dcc4496af4dcce01823094997aba1e88eb936013ffc2f8
MD5 0f57602b1b78b077a5b0e996ef306a7d
SHA1 4c86ca072878cf03f66be4dc721a02d5c6fe76d2
SHA512 b28e50f9ef8debb5e25af797cc9a7ed6882f08425c595ce36eb6d48e0b703c17f619151d84a6d1b8dd8b5f7affc231c19790c46d6224b94279de5a5c568aa1a2
SSDEEP 12288:OVGWl6qCmyZeU6lqlDjC+fScn6X8GwMgJEkqd68Wr//f0ZoiDqIMjFqs:OVGWl6qCmyt6UdmcpMzrI58lDqPxr
TLSH
T1B4257D31A166242BD6F50973F914D2307E28D7082B5C99B6C6C0DD0D39689FA6FFB24B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2004-2973-0x00000000007B0000-0x0000000000876000-memory.dmp

Download