41d69d866f72e7575fba2e3975c2881a575b49ed76bc11daabcf2449097ae89c

Analysis

user interaction
yes
max time kernel
48s
max time network
68s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 18:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
LuaTools-win-Setup.exe
Size 11.0MB
Sample260802-wtaaaavtay
SHA256 41d69d866f72e7575fba2e3975c2881a575b49ed76bc11daabcf2449097ae89c
MD5 eecd712bfbd6e6dd94b9700c0ed41ec1
SHA1 c39c8722a8a94babff4df6af03a9a7fedad5acdb
SHA512 c3913dd8f042bfc4e1e47b00bcc99ad19e21c7f0bf300274cf7444817f590c01427cc0bad58a76a0bf66e14e9c9e9c904109b0643a48e1c0c1abc00f405ab781
SSDEEP 196608:K4MyY/DTgGnG6XAGw0040yF5NFdjPnN4Sw6qHn3ILn03t+6E4U7BtjuX:iJ/ngOwh60ojFdjfN4SwVI70bUTjuX
TLSH
T1DBC60162FF02D0BBD48A01B5D43EB73DBA369E95872A85C34A993C5CA8F1270585335F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
240	LuaTools.exe
2872	LuaTools.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Contacts third-party web service commonly abused for C2 1 TTPs 1 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
4	raw.githubusercontent.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LuaTools-win-Setup.exe

System Time Discovery 1 TTPs 3 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
6056	chrome.exe
4852	msedge.exe
3240	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134301679915040324"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\luatools	LuaTools.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\luatools\shell	LuaTools.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\luatools\shell\open	LuaTools.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\luatools\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\LuaTools\\current\\LuaTools.exe\" \"%1\""	LuaTools.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\luatools\ = "URL:LuaTools Protocol"	LuaTools.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\luatools\URL Protocol	LuaTools.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1738198120-2966725515-3980530802-1000\{9EC01510-935F-4515-9830-B4907ED33C07}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\luatools\shell\open\command	LuaTools.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
5260	LuaTools-win-Setup.exe
5260	LuaTools-win-Setup.exe
4480	chrome.exe
4480	chrome.exe
2872	LuaTools.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 21 IoCs

pid	Process
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
5436	msedge.exe
5436	msedge.exe
5436	msedge.exe
5436	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	240	LuaTools.exe
Token: SeDebugPrivilege	2872	LuaTools.exe
Token: SeShutdownPrivilege	4480	chrome.exe
Token: SeCreatePagefilePrivilege	4480	chrome.exe
Token: SeShutdownPrivilege	4480	chrome.exe
Token: SeCreatePagefilePrivilege	4480	chrome.exe
Token: SeShutdownPrivilege	4480	chrome.exe
Token: SeCreatePagefilePrivilege	4480	chrome.exe
Token: SeShutdownPrivilege	4480	chrome.exe
Token: SeCreatePagefilePrivilege	4480	chrome.exe
Token: SeShutdownPrivilege	4480	chrome.exe
Token: SeCreatePagefilePrivilege	4480	chrome.exe
Token: SeShutdownPrivilege	4480	chrome.exe
Token: SeCreatePagefilePrivilege	4480	chrome.exe
Token: SeShutdownPrivilege	4480	chrome.exe
Token: SeCreatePagefilePrivilege	4480	chrome.exe
Token: SeShutdownPrivilege	4480	chrome.exe
Token: SeCreatePagefilePrivilege	4480	chrome.exe
Token: SeShutdownPrivilege	4480	chrome.exe
Token: SeCreatePagefilePrivilege	4480	chrome.exe
Token: SeShutdownPrivilege	4480	chrome.exe
Token: SeCreatePagefilePrivilege	4480	chrome.exe
Token: SeShutdownPrivilege	4480	chrome.exe
Token: SeCreatePagefilePrivilege	4480	chrome.exe
Token: SeShutdownPrivilege	4480	chrome.exe
Token: SeCreatePagefilePrivilege	4480	chrome.exe
Token: SeShutdownPrivilege	4480	chrome.exe
Token: SeCreatePagefilePrivilege	4480	chrome.exe
Token: SeShutdownPrivilege	4480	chrome.exe
Token: SeCreatePagefilePrivilege	4480	chrome.exe
Token: SeShutdownPrivilege	4480	chrome.exe
Token: SeCreatePagefilePrivilege	4480	chrome.exe
Token: SeShutdownPrivilege	4480	chrome.exe
Token: SeCreatePagefilePrivilege	4480	chrome.exe
Token: SeShutdownPrivilege	4480	chrome.exe
Token: SeCreatePagefilePrivilege	4480	chrome.exe
Token: SeShutdownPrivilege	4480	chrome.exe
Token: SeCreatePagefilePrivilege	4480	chrome.exe
Token: SeShutdownPrivilege	4480	chrome.exe
Token: SeCreatePagefilePrivilege	4480	chrome.exe
Token: SeShutdownPrivilege	4480	chrome.exe
Token: SeCreatePagefilePrivilege	4480	chrome.exe
Token: SeShutdownPrivilege	4480	chrome.exe
Token: SeCreatePagefilePrivilege	4480	chrome.exe
Token: SeShutdownPrivilege	4480	chrome.exe
Token: SeCreatePagefilePrivilege	4480	chrome.exe
Token: SeShutdownPrivilege	4480	chrome.exe
Token: SeCreatePagefilePrivilege	4480	chrome.exe
Token: SeShutdownPrivilege	4480	chrome.exe
Token: SeCreatePagefilePrivilege	4480	chrome.exe
Token: SeShutdownPrivilege	4480	chrome.exe
Token: SeCreatePagefilePrivilege	4480	chrome.exe
Token: SeShutdownPrivilege	4480	chrome.exe
Token: SeCreatePagefilePrivilege	4480	chrome.exe
Token: SeShutdownPrivilege	4480	chrome.exe
Token: SeCreatePagefilePrivilege	4480	chrome.exe
Token: SeShutdownPrivilege	4480	chrome.exe
Token: SeCreatePagefilePrivilege	4480	chrome.exe
Token: SeShutdownPrivilege	4480	chrome.exe
Token: SeCreatePagefilePrivilege	4480	chrome.exe
Token: SeShutdownPrivilege	4480	chrome.exe
Token: SeCreatePagefilePrivilege	4480	chrome.exe
Token: SeShutdownPrivilege	4480	chrome.exe
Token: SeCreatePagefilePrivilege	4480	chrome.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
5436	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5260 wrote to memory of 240	5260	LuaTools-win-Setup.exe	89
PID 5260 wrote to memory of 2872	5260	LuaTools-win-Setup.exe	91
PID 4480 wrote to memory of 5272	4480	chrome.exe	93
PID 4480 wrote to memory of 708	4480	chrome.exe	94
PID 4480 wrote to memory of 708	4480	chrome.exe	94
PID 4480 wrote to memory of 6056	4480	chrome.exe	95
PID 4480 wrote to memory of 2628	4480	chrome.exe	97
PID 4480 wrote to memory of 2628	4480	chrome.exe	97
PID 4480 wrote to memory of 4212	4480	chrome.exe	98
PID 4480 wrote to memory of 4212	4480	chrome.exe	98
PID 4480 wrote to memory of 5764	4480	chrome.exe	99
PID 4480 wrote to memory of 5764	4480	chrome.exe	99
PID 4480 wrote to memory of 2180	4480	chrome.exe	100
PID 4480 wrote to memory of 2180	4480	chrome.exe	100
PID 4480 wrote to memory of 476	4480	chrome.exe	101
PID 4480 wrote to memory of 2496	4480	chrome.exe	103
PID 4480 wrote to memory of 2496	4480	chrome.exe	103
PID 4480 wrote to memory of 5228	4480	chrome.exe	104
PID 4480 wrote to memory of 5228	4480	chrome.exe	104
PID 4480 wrote to memory of 4384	4480	chrome.exe	105
PID 4480 wrote to memory of 4384	4480	chrome.exe	105
PID 4480 wrote to memory of 5996	4480	chrome.exe	106
PID 4480 wrote to memory of 5996	4480	chrome.exe	106
PID 4480 wrote to memory of 4916	4480	chrome.exe	107
PID 4480 wrote to memory of 4916	4480	chrome.exe	107
PID 4480 wrote to memory of 3808	4480	chrome.exe	108
PID 4480 wrote to memory of 3808	4480	chrome.exe	108
PID 4480 wrote to memory of 4188	4480	chrome.exe	109
PID 4480 wrote to memory of 4188	4480	chrome.exe	109
PID 4480 wrote to memory of 3080	4480	chrome.exe	110
PID 4480 wrote to memory of 3080	4480	chrome.exe	110
PID 4480 wrote to memory of 2344	4480	chrome.exe	111
PID 4480 wrote to memory of 2344	4480	chrome.exe	111
PID 4480 wrote to memory of 3648	4480	chrome.exe	112
PID 4480 wrote to memory of 3648	4480	chrome.exe	112
PID 4480 wrote to memory of 4100	4480	chrome.exe	113
PID 4480 wrote to memory of 4100	4480	chrome.exe	113
PID 4480 wrote to memory of 292	4480	chrome.exe	114
PID 4480 wrote to memory of 292	4480	chrome.exe	114
PID 4480 wrote to memory of 4820	4480	chrome.exe	115
PID 4480 wrote to memory of 4820	4480	chrome.exe	115
PID 4480 wrote to memory of 5472	4480	chrome.exe	116
PID 4480 wrote to memory of 5472	4480	chrome.exe	116
PID 4480 wrote to memory of 4616	4480	chrome.exe	117
PID 4480 wrote to memory of 4616	4480	chrome.exe	117
PID 4480 wrote to memory of 1260	4480	chrome.exe	121
PID 4480 wrote to memory of 3584	4480	chrome.exe	122
PID 4480 wrote to memory of 2396	4480	chrome.exe	123
PID 2872 wrote to memory of 5436	2872	LuaTools.exe	124
PID 5436 wrote to memory of 204	5436	msedge.exe	125
PID 5436 wrote to memory of 1116	5436	msedge.exe	127
PID 5436 wrote to memory of 4852	5436	msedge.exe	128
PID 5436 wrote to memory of 1116	5436	msedge.exe	127
PID 5436 wrote to memory of 1116	5436	msedge.exe	127
PID 5436 wrote to memory of 612	5436	msedge.exe	129
PID 5436 wrote to memory of 612	5436	msedge.exe	129
PID 5436 wrote to memory of 5804	5436	msedge.exe	130
PID 5436 wrote to memory of 5804	5436	msedge.exe	130
PID 5436 wrote to memory of 5804	5436	msedge.exe	130
PID 5436 wrote to memory of 5424	5436	msedge.exe	131
PID 5436 wrote to memory of 5424	5436	msedge.exe	131
PID 5436 wrote to memory of 5424	5436	msedge.exe	131
PID 5436 wrote to memory of 2708	5436	msedge.exe	132
PID 5436 wrote to memory of 2708	5436	msedge.exe	132

C:\Users\Admin\AppData\Local\Temp\LuaTools-win-Setup.exe
"C:\Users\Admin\AppData\Local\Temp\LuaTools-win-Setup.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5260
- C:\Users\Admin\AppData\Local\LuaTools\current\LuaTools.exe
  "C:\Users\Admin\AppData\Local\LuaTools\current\LuaTools.exe" --veloapp-install 1.2.6
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:240
- C:\Users\Admin\AppData\Local\LuaTools\current\LuaTools.exe
  "C:\Users\Admin\AppData\Local\LuaTools\current\LuaTools.exe"
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2872
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://db.lua.tools/auth/v1/authorize?provider=discord&redirect_to=http%3A%2F%2Flocalhost%3A53789%2Fcallback&code_challenge=ZIswE-4Vt1WGgukIDw2cdOqnkvfnmZKKDQ5M2Y2qx0s&code_challenge_method=s256
    3⤵
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5436
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e8,0x2ec,0x2f0,0x2e4,0x404,0x7ffcdec2c188,0x7ffcdec2c194,0x7ffcdec2c1a0
      4⤵
      PID:204
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1032,i,14543899539032313604,4726040620293978018,262144 --field-trial-handle=2688,i,18169976703506303877,15257053367447309775,262144 --variations-seed-version --mojo-platform-channel-handle=2684 /prefetch:2
      4⤵
      PID:1116
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1656,i,6305241442249172573,10576558607126162279,524288 --field-trial-handle=2688,i,18169976703506303877,15257053367447309775,262144 --variations-seed-version --mojo-platform-channel-handle=2716 /prefetch:11
      4⤵
      System Time Discovery
      PID:4852
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2196,i,7185860018162408535,8335487899099745720,524288 --field-trial-handle=2688,i,18169976703506303877,15257053367447309775,262144 --variations-seed-version --mojo-platform-channel-handle=3324 /prefetch:13
      4⤵
      PID:612
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3236,i,1173532241947210956,17991581156631776086,2097152 --field-trial-handle=2688,i,18169976703506303877,15257053367447309775,262144 --variations-seed-version --mojo-platform-channel-handle=3448 /prefetch:1
      4⤵
      PID:5804
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3240,i,4275390437346587375,12646694238756628225,2097152 --field-trial-handle=2688,i,18169976703506303877,15257053367447309775,262144 --variations-seed-version --mojo-platform-channel-handle=3440 /prefetch:1
      4⤵
      PID:5424
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4088,i,10912034319701850295,12116206932796106107,2097152 --field-trial-handle=2688,i,18169976703506303877,15257053367447309775,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:9
      4⤵
      PID:2708
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4076,i,15332465136049563304,14598073039461258630,2097152 --field-trial-handle=2688,i,18169976703506303877,15257053367447309775,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:1
      4⤵
      PID:5880
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5136,i,8327732476880961051,928165712426206359,524288 --field-trial-handle=2688,i,18169976703506303877,15257053367447309775,262144 --variations-seed-version --mojo-platform-channel-handle=5124 /prefetch:14
      4⤵
      PID:4308
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5128,i,4564387669788732767,14950359471122375816,524288 --field-trial-handle=2688,i,18169976703506303877,15257053367447309775,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:14
      4⤵
      PID:2736
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5140,i,8046041431630331684,14073512879633642060,524288 --field-trial-handle=2688,i,18169976703506303877,15257053367447309775,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:14
      4⤵
      PID:1892
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5872,i,6758176127853103143,313639293558883836,524288 --field-trial-handle=2688,i,18169976703506303877,15257053367447309775,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:14
      4⤵
      PID:2040
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5872,i,6758176127853103143,313639293558883836,524288 --field-trial-handle=2688,i,18169976703506303877,15257053367447309775,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:14
      4⤵
      PID:1616
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6308,i,15843480269607654618,17533996071616733877,524288 --field-trial-handle=2688,i,18169976703506303877,15257053367447309775,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:14
      4⤵
      PID:5564
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6760,i,3261476372198944430,18094801415449541155,524288 --field-trial-handle=2688,i,18169976703506303877,15257053367447309775,262144 --variations-seed-version --mojo-platform-channel-handle=6772 /prefetch:14
      4⤵
      PID:3168
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
      4⤵
      PID:6584
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x274,0x7ffcdec2c188,0x7ffcdec2c194,0x7ffcdec2c1a0
        5⤵
        
        PID:6640
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1972,i,16192722855707577005,16729278778175508675,262144 --field-trial-handle=2512,i,3463145128896463314,8777298011706669589,262144 --variations-seed-version --mojo-platform-channel-handle=2508 /prefetch:2
        5⤵
        
        PID:4236
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2160,i,15036365462170595787,5083361588504167498,524288 --field-trial-handle=2512,i,3463145128896463314,8777298011706669589,262144 --variations-seed-version --mojo-platform-channel-handle=2540 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:3240
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2644,i,6011315881268647952,14737018524792779271,524288 --field-trial-handle=2512,i,3463145128896463314,8777298011706669589,262144 --variations-seed-version --mojo-platform-channel-handle=3120 /prefetch:13
        5⤵
        
        PID:5432
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4248,i,3680166392170940227,5540442382652637082,524288 --field-trial-handle=2512,i,3463145128896463314,8777298011706669589,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:14
        5⤵
        
        PID:4584
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4248,i,3680166392170940227,5540442382652637082,524288 --field-trial-handle=2512,i,3463145128896463314,8777298011706669589,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:14
        5⤵
        
        PID:4960

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4480
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffcf301c728,0x7ffcf301c734,0x7ffcf301c740
  2⤵
  PID:5272
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1636,i,18105023984505975623,11385385305635978543,262144 --field-trial-handle=1876,i,14022398975574662788,13292695963717212022,262144 --variations-seed-version --mojo-platform-channel-handle=1872 /prefetch:2
  2⤵
  PID:708
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2196,i,1370293583020433227,15210795812901154838,524288 --field-trial-handle=1876,i,14022398975574662788,13292695963717212022,262144 --variations-seed-version --mojo-platform-channel-handle=2220 /prefetch:11
  2⤵
  - System Time Discovery
  PID:6056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2328,i,13849251340752808714,16188313534895394260,524288 --field-trial-handle=1876,i,14022398975574662788,13292695963717212022,262144 --variations-seed-version --mojo-platform-channel-handle=2472 /prefetch:13
  2⤵
  PID:2628
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3344,i,16283042701833401408,6170335899515264586,2097152 --field-trial-handle=1876,i,14022398975574662788,13292695963717212022,262144 --variations-seed-version --mojo-platform-channel-handle=3380 /prefetch:1
  2⤵
  PID:4212
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3356,i,13131373630032381206,9142599271374359432,2097152 --field-trial-handle=1876,i,14022398975574662788,13292695963717212022,262144 --variations-seed-version --mojo-platform-channel-handle=3432 /prefetch:1
  2⤵
  PID:5764
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4684,i,11033767790468573779,1979825964788053317,2097152 --field-trial-handle=1876,i,14022398975574662788,13292695963717212022,262144 --variations-seed-version --mojo-platform-channel-handle=4716 /prefetch:1
  2⤵
  PID:2180
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5428,i,5972822253698607685,6466829683402444390,524288 --field-trial-handle=1876,i,14022398975574662788,13292695963717212022,262144 --variations-seed-version --mojo-platform-channel-handle=5400 /prefetch:14
  2⤵
  PID:476
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5740,i,6414936882874999797,2298313322467611634,524288 --field-trial-handle=1876,i,14022398975574662788,13292695963717212022,262144 --variations-seed-version --mojo-platform-channel-handle=5752 /prefetch:14
  2⤵
  PID:2496
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5940,i,13661847256714450177,4850922086262541337,2097152 --field-trial-handle=1876,i,14022398975574662788,13292695963717212022,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:1
  2⤵
  PID:5228
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=6240,i,8876309776029095084,11246879807051678608,2097152 --field-trial-handle=1876,i,14022398975574662788,13292695963717212022,262144 --variations-seed-version --mojo-platform-channel-handle=6216 /prefetch:1
  2⤵
  PID:4384
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=6392,i,3115696123902328214,15438896508715317962,2097152 --field-trial-handle=1876,i,14022398975574662788,13292695963717212022,262144 --variations-seed-version --mojo-platform-channel-handle=3852 /prefetch:1
  2⤵
  PID:5996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=6372,i,3495674667069560560,6292036373205502148,2097152 --field-trial-handle=1876,i,14022398975574662788,13292695963717212022,262144 --variations-seed-version --mojo-platform-channel-handle=6496 /prefetch:1
  2⤵
  PID:4916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6480,i,16385783186346463339,4243133274427029674,2097152 --field-trial-handle=1876,i,14022398975574662788,13292695963717212022,262144 --variations-seed-version --mojo-platform-channel-handle=6620 /prefetch:1
  2⤵
  PID:3808
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5748,i,11461340862404326184,3857878937029196179,2097152 --field-trial-handle=1876,i,14022398975574662788,13292695963717212022,262144 --variations-seed-version --mojo-platform-channel-handle=5756 /prefetch:1
  2⤵
  PID:4188
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5852,i,2434771501885852627,5120992757844174125,2097152 --field-trial-handle=1876,i,14022398975574662788,13292695963717212022,262144 --variations-seed-version --mojo-platform-channel-handle=6604 /prefetch:1
  2⤵
  PID:3080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6896,i,15937980311633829322,2408315476579424326,2097152 --field-trial-handle=1876,i,14022398975574662788,13292695963717212022,262144 --variations-seed-version --mojo-platform-channel-handle=5840 /prefetch:1
  2⤵
  PID:2344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6864,i,6770258046344196464,194759768053720326,2097152 --field-trial-handle=1876,i,14022398975574662788,13292695963717212022,262144 --variations-seed-version --mojo-platform-channel-handle=6992 /prefetch:1
  2⤵
  PID:3648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=7136,i,6910578425670849126,5049412838256176117,2097152 --field-trial-handle=1876,i,14022398975574662788,13292695963717212022,262144 --variations-seed-version --mojo-platform-channel-handle=7152 /prefetch:1
  2⤵
  PID:4100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=7180,i,11128595478715096161,6412769185832313565,2097152 --field-trial-handle=1876,i,14022398975574662788,13292695963717212022,262144 --variations-seed-version --mojo-platform-channel-handle=6896 /prefetch:1
  2⤵
  PID:292
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=7448,i,14463264391301947619,8868120632968214199,2097152 --field-trial-handle=1876,i,14022398975574662788,13292695963717212022,262144 --variations-seed-version --mojo-platform-channel-handle=7136 /prefetch:1
  2⤵
  PID:4820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=6984,i,7481492431641416825,12868103404322929218,2097152 --field-trial-handle=1876,i,14022398975574662788,13292695963717212022,262144 --variations-seed-version --mojo-platform-channel-handle=7180 /prefetch:1
  2⤵
  PID:5472
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=6340,i,13999839370524958318,6808267712040026282,2097152 --field-trial-handle=1876,i,14022398975574662788,13292695963717212022,262144 --variations-seed-version --mojo-platform-channel-handle=7448 /prefetch:1
  2⤵
  PID:4616
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=256,i,9036224512268608417,5501888331226213623,524288 --field-trial-handle=1876,i,14022398975574662788,13292695963717212022,262144 --variations-seed-version --mojo-platform-channel-handle=6740 /prefetch:14
  2⤵
  PID:1260
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6748,i,18366900437560721747,5180913944298295993,524288 --field-trial-handle=1876,i,14022398975574662788,13292695963717212022,262144 --variations-seed-version --mojo-platform-channel-handle=6712 /prefetch:14
  2⤵
  PID:3584
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6736,i,4482388820553073374,15857827765557383158,524288 --field-trial-handle=1876,i,14022398975574662788,13292695963717212022,262144 --variations-seed-version --mojo-platform-channel-handle=5840 /prefetch:14
  2⤵
  PID:2396
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6064,i,5065578009116717265,1454242351427499986,524288 --field-trial-handle=1876,i,14022398975574662788,13292695963717212022,262144 --variations-seed-version --mojo-platform-channel-handle=7296 /prefetch:14
  2⤵
  PID:2648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5920,i,15573827516108462447,4833231506363565217,524288 --field-trial-handle=1876,i,14022398975574662788,13292695963717212022,262144 --variations-seed-version --mojo-platform-channel-handle=7264 /prefetch:14
  2⤵
  PID:4528
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=3472,i,2958292613710432030,5281689951969306969,524288 --field-trial-handle=1876,i,14022398975574662788,13292695963717212022,262144 --variations-seed-version --mojo-platform-channel-handle=5972 /prefetch:14
  2⤵
  PID:3280
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --metrics-shmem-handle=5688,i,7368814091246556430,16965911591364351202,2097152 --field-trial-handle=1876,i,14022398975574662788,13292695963717212022,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:6420
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --metrics-shmem-handle=5968,i,12562357005161173177,17266358316831257689,2097152 --field-trial-handle=1876,i,14022398975574662788,13292695963717212022,262144 --variations-seed-version --mojo-platform-channel-handle=6484 /prefetch:9
  2⤵
  PID:6468

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:876

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1844

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:5956

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5200

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5508

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5056

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1392

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 96B
SHA256 c17166abad761f15d3b084fe1d8171f821118ae346d2e8efbb64f5976058caa6
MD5 4dcb2ce17d83b6c68cb2b181d0c71864
SHA1 2b53ff53458862c5c07af52a38b65e01224d8140
SHA512 41d63172c541367ba0e1b051290f861b59f8ef16e973db4805fc11dffcc1137f6d0214ffaf5b19cf73f42f938693b27e0c0c220d2bf1190c5431f9fa9e4d2e9c
TLSH
T1A1B0220280C8800BC30003B00CE00C00F0B00EB80A23A38B82CCA0ECCCBBBFBC80000B
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 9292eddb49f159516ba10a48a68699d988d542ddc9df6269fd8f62d3a050a29f
MD5 a845515c3e2b2f0d57b9a551201da5ba
SHA1 d75521558a2d06313f37d789f913464496fa149d
SHA512 80800fd2b9d8897eb02de09a143382cdd8cb4ee8c6fa180ba25f5ae0aa830ad45d093176cebc0dfca139ce715397d2c324211c508730354add6c896406f60e67
TLSH
T1EF517BF7D7D4C66DC45152E4DB217E2FCD2E0A28521D3C2688D8AE5B53E2472D21138E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 523B
SHA256 6ad070e53c4d10bb8c735079be66658dfa6063634f3e61b7134a0b9125a15d27
MD5 dc49af65e825e7d16ddde93215e64a5a
SHA1 2e6cfaf64b04dc25d770dd1bcc03e075e855a391
SHA512 5b78bd37717445a6bb39c7de4ad76b6bcf58901cdfb23fd19a4a8125350a3473307dbd2cdbd973730ccfcc1820cb67b0d8c170b88e9b4ff94d7ff5e840a8d093
TLSH
T15DF050A7A6F9B453107A45BF5F04B8096871E439464158F8CE5B812CD0866E31B12463
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 7c7edc8d749c24640ec9afba6f32945d312d4e15ca6d14a562d85837e37aeefb
MD5 bb91ad30c3944b22fa395cf7fe0de37f
SHA1 b73b1780a5554747259995eb3d015b7a2d4a3ac9
SHA512 e578d3e523602ec9441b120b34396151b8df7993b5f200cc7bc590bef8ae45395d058585bdc58e966c8233337df193e73ee31b28161f3f0f87b2b40075d53c4b
SSDEEP 192:BRcSNanpv7pAPRp26x9XxHXJtb+WNn1q0kt231WkwyE+VyIsnAUgR:BRcSNYpAXvfXNE042FW92R
TLSH
T19632852EBD15793B6DCAC22DF9627793D7F5102235A42E44E6F88A3C11D75CC6227017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 99c85f0a9bb47cb2e1ba2f8fcedc3ea55a8f9faa1eb71e723ddf04ce937ead0c
MD5 2eaae4d0c0f558c8198cd0184718eb1c
SHA1 b427ddf9c558b6cec6d4b404715d15a24e50acfe
SHA512 c9f5f4213eb3d3fd9c0036801b1cb22dede7eebc8160488edfcab964f75f2a3abaf36b9ca014bd95cd8ada02cca74bd83589f7e099ef6623593f18f36bb9c942
SSDEEP 192:BRcSNa9/v7pAPRp2tHOAc9XxHXJJb+WNn1qA/8+Hvrw2PWt231WkwyE+VyIsnAUp:BRcSNiXAXmOfXBEzAjw2Pi2FW92e
TLSH
T1B342A52ABD10793B6DCAC229F962B797D7F5102235E42E94EAFC893C11EB5CD6217007
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 85e93e7c7421935f0911b856282522aa7697c7f7f3e4e91fe9b68bdb1dee2254
MD5 17b14bf97159ca9e7782c9d7e031bfcd
SHA1 5412ddbb770ca1e448ec81ffd24d22720b4873e0
SHA512 fa87b1df3588a9d8536d2ca0322b2c03b19cf27561fcd164ff9c5ff208fc0e27dc790a5315f566f02886adf9352dd827c1148a40ca6a9d5dc8c58be7d73dfc76
SSDEEP 192:e294K6vX7KxkXqK4I40pUZNCgVLHrKHfFKslEClTXzKD/cb+ErUkKN9G6jBTK8/T:/9j0X7KxkXqKf/pUZNCgVLH2HfgslNT+
TLSH
T1B332D827A48D9A3F4FD8D519DC036F8B6DF5019272780C24A7FF5D0403A978E115A2EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 b3c381f4c049dfa9f147f4ec032e9c307472283f188b1b0ceb800ded380da6dd
MD5 7b04fa86a97c8e7c7e1523170550b0ea
SHA1 fad37bcf8f32ede785cfc4eb9b84ca98fd1500c9
SHA512 72ab77a31ecb17fdf1a69f13d5b7f261d5954aa11726470f5cffcc61b4db5d2b705967be157cb2181e21169131778d56242f4624e6cd9721927c742b474cf98c
TLSH
T1AEA0025041C12951CD39817470354DC767428C5F186443035E9148B48D5F0C04143348
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a50b1.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index~RFe5a50b1.TMP
Size 48B
SHA256 6f83b5d4bf0f83d41b9be15ddaa35eab00d7ce50f529e5b1c4071b6968f94837
MD5 014cf6aabb870beafc961d4a30acd4f1
SHA1 340bcf41a06e3adbf1dd8774057adb90dade9d64
SHA512 ee432a955073412aadd8d204906977d04862d18eedb7f7d362e793019c0e0c18d3f3335f857ede2c5950e50dff6ba5d48516edd8a2e2c6cd6df4ba3d5483a6a8
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnGraphiteCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnGraphiteCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnGraphiteCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5a514e.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network\Network Persistent State~RFe5a514e.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 20666d855e620fb9be8a1bb19560ffb71eafce73107b983ad73f0769c3f763c1
MD5 ebba2e51a4adbb6e1a6075b717139e00
SHA1 d713e98662308d6ae1a47dcb982091e9459c6991
SHA512 52c086f46c766a40ba971ac5af5c8097d103524925651f2643f162197004fdda31e612350c7aaad7735e366ad1de2a7696bf4a019f9342fcfecfac741cf111ef
SSDEEP 96:xC0d+r2io+TJ/E0f6m934zM4RDotok5WsmDbB6nGyvn0b4T8jybJv4a:xC0ITo+TQ0InDUDglPPb4T8jybl
TLSH
T1E4A10835A0285D775476D446B1622A43CFB97067E972AFE0EAD90E0D14F71EC1342A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 5bcc467130aad31195c6a0215318df4bad8e5a656c059314003b09aef5974d19
MD5 b7538e9b772940a9dcceb0700823d88e
SHA1 79b1fff111c1b7abc242fdde0e9cb99e9541a69e
SHA512 3d1b1a41387b86c18a28a611bb8095f03b99b8f1af1549ef92f1ec762584b5ed9d008b099c4d00ccb33a0ed1b1af95e3c63bc46972ddfbc7fc473d861184f467
SSDEEP 96:RC6FXd+r2io+TJ/E0f6m934pEiMNSl8h4otop5WsicDbB6IGyvn0SvQxwzQifhjb:RCUXITo+TQ0IutiU25lcPSIxUhjm+9jX
TLSH
T175C13A32A46C2C7315E7E546B1233A53CEB4201BEA51AFB4EAD50F1D01E75EC2342522
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 124KB
SHA256 21c590790b4cd235a1f20a5582e4cbe352d0dee353a3c4be8c700d1756a1f914
MD5 96d39f4bbfbf52fb2c23eedad9432ce0
SHA1 6de8e8fdaad10efec58a6418537da6fb0237281a
SHA512 8eee42e195839d04b688bab065dcd063a4606f4ea64f61ed8e2fe31d0918380b9c9ca75d39a1d6fb4e449ce957ac5edb13b6ca13706d215e715da233f1bce4d7
SSDEEP 3072:FFdLTq/HYb50P4w9J4aDvC3QXhbx+WIzZ2l+1hbA5:FF8i0Aw9NDv+qw5ZtA5
TLSH
T179C313355F12CC7747C96466642FDB4F8EC8B82ED685DFF668C47B2E425A8ED202B110
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 124KB
SHA256 37d77c7c093e2b6b5308b82336bd3e53dd023628e2224d4779704c11ca0a5af4
MD5 8cf4e294ab656d7b4eb6a3108df1d439
SHA1 f0497280986441aff79431a89d107ee0ddf45320
SHA512 9150c5bbbf8f151be60d8267059e44e89784f45bea4a16594ed194b70f9fce95fee8796a0b2fe695ed8ee4dccdcbb67c97a7acb5a59a8d35749f2fcb56b4f1c9
SSDEEP 3072:52dLTq/HYb50P4w9J4aDvC3QXhbx+WIzZ2l+1hbA5:528i0Aw9NDv+qw5ZtA5
TLSH
T12AC313356F12CC774BC96466642FDB4F8EC4B82ED685DFF668C47B2E425A8ED202B110
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CommunityToolkit.Mvvm.dll

Path C:\Users\Admin\AppData\Local\LuaTools\current\CommunityToolkit.Mvvm.dll
Size 143KB
SHA256 19b2144fed9600d58a742a5a4a5fd7b10d4d0d2c2e79f5d8019307cf5657044f
MD5 c5aba3e739e682a6727f33e7c89f1f3b
SHA1 2c656c3c24e66aea61bda770f146d8ccff5c868f
SHA512 fd7269021e7064742b1bd2b361d90ba5f848ba9f275f1b1b7a1459b231d4f012fa1bfe37cb0c01f524356e6bbc8a91f7eaddc91202b7fd498b6fa016b3a8659c
SSDEEP 3072:TSieaCkJBmT1YhqlgBE6KZogn10iAj+QPuzO/:TRVxmYe6+n10iV2
TLSH
T1AFE39E1273E85A33E6FF1B75B4F0808A8F72D707ED26E34D958D82920963BC059517BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LuaTools.deps.json

Path C:\Users\Admin\AppData\Local\LuaTools\current\LuaTools.deps.json
Size 36KB
SHA256 dca361faf2171fabeda958de0a9f8d1424d941bffe43170f430e03354c1544d7
MD5 17620ca040796f80861c7268068e0ebf
SHA1 7e92aaa2a3adcd0716a034a77944eb2c9eb5a409
SHA512 7e9e704cb7b2ab22b01eecf63daa319e4517ee5c3441ace24e63ece93dac2c36c258ecae22b2ed1a7096370309e631b6b77344292a63519944be69eff819c428
SSDEEP 192:CQrWrHwIIqoZoqsZuNTj6uTVZECYIh23RCzU4oFby98ZWjdIyfnNfekS3:CQcHwIIq/MpRYIh23RCI4oFbyfxIyf3S
TLSH
T116F29A26E8585E234976B7A6FD784991FA35432F3004684A7CFC294CCF76BAA5093F34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LuaTools.dll

Path C:\Users\Admin\AppData\Local\LuaTools\current\LuaTools.dll
Size 964KB
SHA256 1dde93641eb58416412214f4fcfe5d1d8d669a0fd14985ef895d1c4940802483
MD5 ecc28c00a2f066763a520b320c99efcb
SHA1 2420a94ee8792c9ac951d64d38aa2b0829bff623
SHA512 a7763a74d9c41cfb14f1aa63a99efe8bb1676b76a18e8638a51edf7812db584e7698509cc9ec498de99d5129bd22dc79ee0013a0a3c854bdb3fc4184e11a76a7
SSDEEP 12288:A6EJrtCcRc7EDwbvQcB9Vx1cKnW3xl3ZfyxyM5IWVxsBoBrOcG:raccrBeVHvW3AIWfsixz
TLSH
T10D254B2122A14635E8EF76F5B12504589BB5EF52B556E33E0D5BB8FCDCFA3028C81263
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LuaTools.exe

Path C:\Users\Admin\AppData\Local\LuaTools\current\LuaTools.exe
Size 254KB
SHA256 4f7f624e021fa172f14dba9c19a5a745b7b2635fece2b2e5834a1f50effbfa6d
MD5 bc2f2cdbd9353b810de4bf380cb799ff
SHA1 722d1853c989dc1ec6146d22df60670283e118cb
SHA512 36b599c0f9e47fd85f6daa09b250217a3109051ac1759fb6d47f497eeb4957f12447684ecc84a020c133e8412d53322c52c6f52b8c807a1ca49b20f18f55813e
SSDEEP 3072:FqeXA/4yIg9vkNPNu6H6xCYOiVUE265RJ6nIyBO:FvgvkNFNaxmNExJ6Ig
TLSH
T106442A37928541B9F097F1B4CA610845EBF17F605322A3FB1E0379BFCAF92819A69741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LuaTools.runtimeconfig.json

Path C:\Users\Admin\AppData\Local\LuaTools\current\LuaTools.runtimeconfig.json
Size 496B
SHA256 b7ab6a0ad18cf1280ad75c8e6d0df62d06c84d62dc69351e49c04afd3e218eb2
MD5 eb7751b6da413a72fe18d187b6b88daa
SHA1 0ab1171970e84ab0e4c9b6807a3700744052aab2
SHA512 d7db1f44c4f706c50755c07501f26620f51c9efb707853432b0ea1a15ffc7e3f9fba919cbbfc3540aec68035132f8ccdf3b5abc0882b67529f8ef5c0b509214c
TLSH
T160F05539C9141DB708F43BADD12AC087FA30136B01040D5A75FC180C2F766A26010E88
MD5 SHA1 SHA512 TLSH

Submit Download

Microsoft.Extensions.Configuration.Abstractions.dll

Path C:\Users\Admin\AppData\Local\LuaTools\current\Microsoft.Extensions.Configuration.Abstractions.dll
Size 26KB
SHA256 3700bf75d75ceef47ebd6df7df9bafb9f7b7dcf22fc537f227db72ccf74c476d
MD5 6f48fbe8c1d66121fb930d01cee4cc95
SHA1 1cc8d8afaec01f6e967818a484fd7aa509624ecd
SHA512 3fe0dba909f19ea448ccf6e3874db0b6709737b215107f7b86fe35c3b911b200ca37dde2f1377f258fd265caa09f93af49ea5b239b05db5c3442f48c5571942d
SSDEEP 384:o9WZMDYtid3v9TaTG/FwEzRjz6rMwTbFmDWsjINWJlNgoR9zFiXS:0WZMDYk5pdO/09zl
TLSH
T19BC25B1653AC9333DDFB2F71F9A1C4952E3997E6A801DA19689E700809777C09B3372E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Extensions.Configuration.Binder.dll

Path C:\Users\Admin\AppData\Local\LuaTools\current\Microsoft.Extensions.Configuration.Binder.dll
Size 41KB
SHA256 efc13893ebfa02cc7e49ac13cfef68517c4441a33210d67956e7488b8e6b277d
MD5 2290f7d234bcbf93459adb8bb0745275
SHA1 e5f4067e40be7685d35d7cad76ef7768e53b078d
SHA512 7ffbedde32c75599a7c9f5ffda297f5a7f58699b05f7b42248ef28b0bafbf33ec9bd4fa27afbd6dc8f97b7d4ad61fb43cacc19e96fdc536429efd0a494c01baa
SSDEEP 768:DsjeqKLvg51cjLTwE6ry/v1rt4m37oX9z/5Y8:DsqxL451qUE6ry1Wm37+zhY8
TLSH
T1B1134C1793EC872AE9FF0B707471A4224FB6BB917926D6195C89A05C1D377C08A3236F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Extensions.Configuration.CommandLine.dll

Path C:\Users\Admin\AppData\Local\LuaTools\current\Microsoft.Extensions.Configuration.CommandLine.dll
Size 23KB
SHA256 a1c8c9728b0dc64dcd975f82d013a1b7bc0c0133e46a94f29044f16cad6072b6
MD5 584eda713ab7795fac1645ef6f3352dc
SHA1 231d179d15e5caac7de89cb8ad71b9d0db1f82f5
SHA512 07f7baa9912b3e17239a601e33d40b329788c3cfc47d03626a0ea0c4f1766a3a9184f4c354715136878ea444287d1ffa6ff97e5cdb11020019babfb5dd9e1db2
SSDEEP 384:/fym2RBaP8ckJt+KAW9BmnWElNhtIscmeR9zlQQR:/amEEYRAvtI7N9zh
TLSH
T110B24B6693FC8317FDFB0E71A6F1D5512E39ABD76811E62A145EA0080D737C08B72729
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Extensions.Configuration.EnvironmentVariables.dll

Path C:\Users\Admin\AppData\Local\LuaTools\current\Microsoft.Extensions.Configuration.EnvironmentVariables.dll
Size 21KB
SHA256 bbb26aacd4ba67351d3740106bbcc5544827d98d91b48109362988147ae7963e
MD5 177dcffd43ac45b58a0c42b2c7b99c0c
SHA1 f61334d03d1050174a90c300c19fa29c39517e64
SHA512 3ef3aac0bdd86d7401d363f8d4d4771e79402c1459c9c5e5f1f178b4300cc9fc67b18d8af2c2d1f742f3a22f556efe5f554336db2e6126ab536344d1cbe65581
SSDEEP 384:v/dUEK0NrbQObCWU+JeWDlNBki+R9zd17/:v/UmfNxE9zj7/
TLSH
T181A24B8197FCD106F9F77FB4D9F9C9662C35F7D21862953A006DA00B0867B848B91B3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Extensions.Configuration.FileExtensions.dll

Path C:\Users\Admin\AppData\Local\LuaTools\current\Microsoft.Extensions.Configuration.FileExtensions.dll
Size 26KB
SHA256 1830c601c1b155c54fbd3a6844453dae87af14eafe763942939d06905035130f
MD5 ee6d71766d2811851d8dd808384b5d83
SHA1 dc1a15ffbe9e406484572c21a2e94052099b1461
SHA512 bbf23f5c8c1059d48e04b965fba41921fb5346117c46792b218e07ed123be5ff1397781a8ddc68bfac44a0a9333442015dec3e67385a9a65633a6fb93f207dfb
SSDEEP 384:SNHfs86q0/ALi2iTFwLsdYyOiaXAzpkLqWqKl6WYlNorgFbR9zBTV9:Sk92/VyOOpkL3/A9zD9
TLSH
T1E5C25C62C7BC4213C9BB1E71A9F0E5022E35A7975C10E66B59DDE00D1DB73C08E62B6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Extensions.Configuration.Json.dll

Path C:\Users\Admin\AppData\Local\LuaTools\current\Microsoft.Extensions.Configuration.Json.dll
Size 25KB
SHA256 e106f8bc13df7168294b95a6cdbceaba47b8eb7e562940eb4ef038db6fb1f2d0
MD5 e0a403e5af381beb4a47945fb5155ca7
SHA1 31b3051b7622207f803333e799461f9182319fb3
SHA512 0828841a0305e043f2df522b8d34c822d13964d870f08e1af0c461dd22a957088b0c44e2a24e877e87aff91a3dcf09f71b225e3e83982fcd0c80473606babaac
SSDEEP 384:5iemM0/vv+cFsbTRo9ge1lgzWkWR2W4lN4eFbR9zBOViT:5iMCzFsjfGG9zCW
TLSH
T117C25B6257FC4213E9BF1F319AF5C9412E39E796A811E71E15ADB00808B77C48E7272A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Extensions.Configuration.UserSecrets.dll

Path C:\Users\Admin\AppData\Local\LuaTools\current\Microsoft.Extensions.Configuration.UserSecrets.dll
Size 24KB
SHA256 a310bcdd868dafc0efce5b03a68cd7af5d4fa0d06509ed4b5c51ddc1758e9791
MD5 249b5a3d38956616eb522a7c7214d0cc
SHA1 1b39211cf7978386ce9589eb88983deee137c3e4
SHA512 03d7b1eceadca05b35a14a3183ddb406d971fe61c217ffddd9d2ac9c187f9ad2cc6cece04c9332096b1396397e0b2398002ea4d3e8d0ec26e8e6a4d5246b3bf0
SSDEEP 384:o88CyOBc4Rm15FApdE1wEDW9ytCWjlNy2jR9zGGhyL:o8ByURi40uw9zwL
TLSH
T1C4B24C52D7FC4332FABA0E73F9B5E4452E38BBD65C11A61D109DA009187BBC48B32769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Extensions.Configuration.dll

Path C:\Users\Admin\AppData\Local\LuaTools\current\Microsoft.Extensions.Configuration.dll
Size 42KB
SHA256 7a883c57d00808ca9b5d11bfaa2c5d21f714ed7560e781d7313d65b09b88b6c9
MD5 3970d9bf37ecb6cff7a394bdd25ee78f
SHA1 054b4622b962ae25446888ddf5ec823e340ff662
SHA512 950d50379cf9fe0fc8216a1f786b4c0322eecdeb390098e8bf855dc40c6901de1da110ddd48650ade001f009a815e8151ba72872381a16c6b2e96167d7fc427e
SSDEEP 768:LnxYrISYXrpu4dAn9RY5Pd9Lgg4vScADpDgOlfe9zb:LnxYrISQpu4v5/cANDKzb
TLSH
T153135B52536C8B17D6BE1B73F8E4992A2F71D2476815F30D9C9EB09908AB7C04B12737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Extensions.DependencyInjection.Abstractions.dll

Path C:\Users\Admin\AppData\Local\LuaTools\current\Microsoft.Extensions.DependencyInjection.Abstractions.dll
Size 63KB
SHA256 c2a34d5259e6d6c0af43d9b926454105e80e7657dfed901d845100db254de89b
MD5 8db369e1139ba14a6208ea8df983ad0a
SHA1 62e77416f1f25a91c3a5140e3635414af1b8202e
SHA512 ef872d41c7775a81bb2dcbde47637cca29b4b810f2671826de042129e9907aeb2dff02a1ab684425cfaf7b2f48abc6e9a4f2261a4bb4c15bab70eba556f93633
SSDEEP 768:z0dv145TiKK8sfK8wUcrioA085JW14e2KSpYzRTzPdH9zJ:z0P45TiK3sfK81c52W+eHSpYztzldzJ
TLSH
T127533CDD37FCD373FBAE5B722A7390C09A35BA531401E70EA98550EA0892BC88551DB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Extensions.DependencyInjection.dll

Path C:\Users\Admin\AppData\Local\LuaTools\current\Microsoft.Extensions.DependencyInjection.dll
Size 92KB
SHA256 4d7fb7b6a171047984a8316b1a355c65e33350c343f4e0ea2f1233be457eb7e5
MD5 7835c72d7fd691ebda152797eaf1bcec
SHA1 8816449c02b9424b7058842f161772fc489cbd86
SHA512 aad53dfdc5ee860b2a6d23c961005609f2ebb02fe3913750a08f31c81d9526e2dead96d4f233c12764e8bf51b6449ada833bca9129e6b77b3cdae6c3b6f86fd7
SSDEEP 1536:hrzFViiQfeQJFi5+2H2SOETeFRdRV6ZTzzIYn1Y6zQ:xFUiQfeQe/9eT6Tzzx+6U
TLSH
T159935C3963FC8F21EAFF1A75947141054BB6AB4A3403E31E1E94A0AD1AE3FC547713A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Extensions.Diagnostics.Abstractions.dll

Path C:\Users\Admin\AppData\Local\LuaTools\current\Microsoft.Extensions.Diagnostics.Abstractions.dll
Size 29KB
SHA256 0a9e51f2d4861367908fa058da82b4a0deb6f85f6ba11d3c90b01c848b1fcdac
MD5 436f31765e8a25707ef3770a4880cd5e
SHA1 a0d63c5d8cc9f1644d85667136c73d7c337872b1
SHA512 9d5c163d8453e5784a79f8708d67f9304f0183a61b7ec2e54e0d4d772aa79c5f7afc726dfadec753e24be4a7743380a4bdfb39f01ad1f2a22edce64386c34243
SSDEEP 384:MLdH4vpxJv3H1yPNdc+bXimUVG+KWOXcRWVlNq1wGjR9zGGW:4dH4v9/yVurn159z2
TLSH
T132D26D41A7BC9325DEBB1E31BAA1C4023B36C3576811E7664EC8910D1977BD49A33B3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Extensions.Diagnostics.dll

Path C:\Users\Admin\AppData\Local\LuaTools\current\Microsoft.Extensions.Diagnostics.dll
Size 34KB
SHA256 0842e20c25240aca53809e005776eb88f53a61128c632c4c6fa8685b9f66c4b7
MD5 f14e4787e1accf6c01d433eaa0e30dfd
SHA1 3cc40e3e4c0645cbc8fec59e9bf59673f458029b
SHA512 f0d6cc32446f4cda8cbec48e8e5413ed3b8ec7bcdb8fb710013993feade52317438c44cb180394a6f71eb6164b9cbe170d6d284ae61a71a1d5da3ab5ec50b373
SSDEEP 768:lY4wbeDJl88xZZcfqnfBTdqdgWO7N9zal:lsClF/e+yOWyvzal
TLSH
T15CF24A56A7EC9322D9BF1E75AEF086061F39C7836411FB692DEC90990D777C08722329
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Extensions.FileProviders.Abstractions.dll

Path C:\Users\Admin\AppData\Local\LuaTools\current\Microsoft.Extensions.FileProviders.Abstractions.dll
Size 21KB
SHA256 02f38beb848fa01fcc55f0cf3982ca01e1a5aeba95933131a197ef602a130763
MD5 3aa27844975c473aa34256bf9bcc8b6d
SHA1 16f9a31d79dd248c034ed092d40dc6c385ebee65
SHA512 95ae823dd74af65dd3c9ba60e676d8110a6293297a0a6cf53aeafc5faeb12431538d83d46adb0abab8833b12458eca29f3dd9a3314d72c3a72f99928bdb9f442
SSDEEP 384:N3tt2JeSlo+MVdUJtFEWsHMhWGalNFGoR9zFiJn/oq:Ne5GQfr09zQ/1
TLSH
T164A27D26D7BC8363CEFA5E3069A4C9476D3DD3DB4C05E51A1589E1081AF3BC48732B6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Extensions.FileProviders.Physical.dll

Path C:\Users\Admin\AppData\Local\LuaTools\current\Microsoft.Extensions.FileProviders.Physical.dll
Size 43KB
SHA256 e6073f96262a3c468c5024564fa02df0f36234242b392c8b658b81bb1b9d968a
MD5 887259a796ae6590749fa3f0d78b0cd9
SHA1 6ab7d026ff5fc8fc0d92b51f29e492d8b33f8c5c
SHA512 41e7ba5f26060b03430f3da154ca8cd691bb287008e78661706cb449bfa3d3310342dd6e408a213df7c1366ecf89e8d0598d4dbfcd8c1d54039957e8a5c2edaa
SSDEEP 768:+kjPlCVm7Ej8zP5usGppdtUqISA3SngVE419z4Qt:+kJCVm7EihusMpdtUxSqSgVE4Hz4+
TLSH
T181137D2193BC4307CDEE4BB16DF0E4460734F3D72502F75A0D98B19A29A77C84B626BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Extensions.FileSystemGlobbing.dll

Path C:\Users\Admin\AppData\Local\LuaTools\current\Microsoft.Extensions.FileSystemGlobbing.dll
Size 45KB
SHA256 965a5347b125d232361dd08027ab263ed1d042b0240ec4a4f29b7a0bfd74bb28
MD5 39743aeab0c21850ec0a8e7830ad4370
SHA1 c897d4dcf3bf039cf766f940f117701a0c5b1eab
SHA512 a79f377a64bea1c532aed4ce33abe17af9e888a4c89434a2310af7e6e3845333fd5116f0b1475db06f9c09d243f09b50ac5245d10dcac0e99a56a48a68f832a5
SSDEEP 768:7rw185npIg65BZLzI1Vp3aPolwgYakfn8OmVSfem0TgvJKMd9zH:7r/pkB58LaP4wgYaOYVSWpgvJKM/zH
TLSH
T108234A8066AC8223CABE17B8B8F4D4524B75C6B7B412FB474ECDA9481CB37C41A61777
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Extensions.Hosting.Abstractions.dll

Path C:\Users\Admin\AppData\Local\LuaTools\current\Microsoft.Extensions.Hosting.Abstractions.dll
Size 51KB
SHA256 57c2528e1f2b3872976661686af9bcbd0612de7ee6b4ef4cfe92b746b27aa1b7
MD5 c32f6f4402d1c5a9fcd2fff1e20a859b
SHA1 3732c98212eec17ff92759599fe91cafd1a8d711
SHA512 4bd18b34de2e0135a8e00616384033609fbb25804457cbd6cf3d363d7f2e3c7d4aec0e9f99e4a75b3abc87b8dde5ee0e6903dcf3afab80d962cfef02c7532a32
SSDEEP 768:3dfIvk8cUbjKbhY6Om4e+X9CzJ65Mo7tKoV2nwsyQQZt164yCmi3FbFi/Up2cK5J:5+k7UbjKbhY1TbUcKo+bozqrH
TLSH
T12933B14163F81615FAFB3F34ADF891258A3ABE66B834F62C064945DD09B2B80C971737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Extensions.Hosting.dll

Path C:\Users\Admin\AppData\Local\LuaTools\current\Microsoft.Extensions.Hosting.dll
Size 69KB
SHA256 ca135e4b48abc2effdb6fdf085837966c35f3a8a305744429009dde946d633c8
MD5 14ffa2d36a6d50f71e904f5d0deef146
SHA1 63c60db8fd1a63be05ecafe119d61fe6d86bcb1f
SHA512 09d1ca0be3b43235f97f5739bb5e443adb04c0d34ad6499f7c50dbc64eff351e0b803ab0f8968bbe9589a88eb41765597b9b9b3fa623f6841ab98b6e4d66f9ab
SSDEEP 768:mHcMciLWJeEHq8SMj9db9KKjoDpxdDozzCF95dnbOCify7MYzWUAKCf9zPcx:mHTfEKjkdbMK6PM8nbOKVWUAKozPQ
TLSH
T15A634B8363AC4713DAEF1AB9E8B465691A35DB576414F70E5C8CB0D90CE3BC44E2272B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Extensions.Logging.Abstractions.dll

Path C:\Users\Admin\AppData\Local\LuaTools\current\Microsoft.Extensions.Logging.Abstractions.dll
Size 64KB
SHA256 4ad4a3b2bed7f5f293f83cc2c46169b93a9863b89428f693a4f17863704f47aa
MD5 a5cab35625e1f365a9181f4e059023b5
SHA1 1f8fcaaf8a0c512e3d33aa7caa0b452227459eed
SHA512 1fb963e563d774df6ad87fe5b7a09fcf0eae1413c270d4b01022e94a00057fc917919b3f4f6e03bb45ac47286dafe763d40ecd50d3ecc2ae91ba122c5579531a
SSDEEP 768:vRU98PjrdTukvp6wV1XxMyVYB0wwbru2OkJB7ix+WTqoU8/Aj29zg4Q:JTTxvcwTWBkbru2b7OZTNU8/2Cz9Q
TLSH
T1C4537D05ABEC4377CBBE4EB9F89096410F35C2472547E79B2CCCD125A92BBD44E213A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Extensions.Logging.Configuration.dll

Path C:\Users\Admin\AppData\Local\LuaTools\current\Microsoft.Extensions.Logging.Configuration.dll
Size 26KB
SHA256 ed0a70f939dc8779ee85802e926f138e284828ac14d44831ca68fdcd14450b5b
MD5 477d8b5d7ab4c9b2bc918ef5daa8b45e
SHA1 7486ff87665335aa215bd589d19b98f546215eb4
SHA512 2ece4726195ea57acef015ee2b10435a50af5eb39d7d2af01d13f74cb9c6b6d1ceef4a232f81914bcb115ef52bb47641e833aabe4d19c8933cc286f2312f0883
SSDEEP 384:SPntTUFG4562BbpdL62S5p2X/ckWxsmzU7RWJlNdki+R9zdq:YtTJQj220gkU7H9zU
TLSH
T13CC25C6697A88326E9FB0F71EDF0D9453E35D7925811FB1D189EB00804BB3C4872273A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Extensions.Logging.Console.dll

Path C:\Users\Admin\AppData\Local\LuaTools\current\Microsoft.Extensions.Logging.Console.dll
Size 73KB
SHA256 84ca5528a45074f18ae4234956de55d238a65be39f914f88293732dfd3889a35
MD5 cace87a409706f20b3ee8060cb9f0a16
SHA1 e7c60278a72a6ad5cfdd80191c09d91abeaadbbf
SHA512 ed21c6547c2df2cdf61c3070254bd6439a30d5674523823d303a0a96e40cdb64a91c887ab4133ead3d8a48716f7679bb6b2c67b22461d9ffef48249a5e5e0019
SSDEEP 1536:31SU9VTLpoGSWZdHPIcKPmUwzF9U8o/T//+Fv/HENqyvzM:lSU9VfpoX+JFKPmUZT/WFv/kkso
TLSH
T135736B1A5BEC831AD9BF5FB8FC7091015B35EB53B803EBAB5D88A0AC08677C54512763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Extensions.Logging.Debug.dll

Path C:\Users\Admin\AppData\Local\LuaTools\current\Microsoft.Extensions.Logging.Debug.dll
Size 19KB
SHA256 ec47584ec7344dbe9b3ec5740cf493a8dbf346e467d6855e24be33555db11983
MD5 b1d351bf2b284e0969f1bcf9d6be1b58
SHA1 64fab26c768c8b610df90baad8e03e7759309f6e
SHA512 98df861cf32cf09a00688626d706b36ea9a4c3b5bcf76f3675039e43268a82cb6632c05066b361440c5f88806cfad0955af1bd4f9d0373dd796b369084a6c385
SSDEEP 192:zVfPfwSGE5QJusuqgQJ9j578mDAqWJIxVMW0WF+GBTBWseaAWDiz5j4HsX01k9zM:Rfafu42mDAqWJIxVMWJlNVIR9zeZ
TLSH
T149924D528BB84206DDAA5F30EFA5DA42793DD3979511DA2B05D8D1090C93BC4973262E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Extensions.Logging.EventLog.dll

Path C:\Users\Admin\AppData\Local\LuaTools\current\Microsoft.Extensions.Logging.EventLog.dll
Size 24KB
SHA256 f70b8392447817a4d44acd5785e0bc029a2844d5445e05b98d95b237443339db
MD5 8210308568d5ef15f758ad21fee0517e
SHA1 e0fdd76a63aff7195b38976882e88701bb6fda57
SHA512 5decf964bfe472c2083bf093709da87a4577fffa9a22f9db757a9c3beaa83005a26599cf2297c9619522b3b7682af8a279dd5dcd5168808722b3d78c71814644
SSDEEP 384:0cqdNcIPJ51NsMsOBZgmVfVej+yUvW2rgFW0lN4tR9zj4O:VqPPUEZ9kUEAP9zMO
TLSH
T19EB25E429A6C431BDCAD4A71EFB5CD42397CE7C76812DA260E9CF1490C637D48B21B6E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Extensions.Logging.EventSource.dll

Path C:\Users\Admin\AppData\Local\LuaTools\current\Microsoft.Extensions.Logging.EventSource.dll
Size 33KB
SHA256 665d5316f601ed6dd9daa6d7534610ca3a7aa40e4d117c079ffb118ea2179b2d
MD5 b251f77d47b8ae95b7e6c48caec4921d
SHA1 e04dfe931564d2b0bd967dcadb4d0f807743775f
SHA512 a1e85b95d9e65f4274a6b6dee8c5fac60a0890f8b521c271458c515d0860e48dc96a91bde318e0c89a080e12a29d690ee7ab99c8a3242dd3ed6b10b7c5b1bd43
SSDEEP 384:YJ3OpOC26rT++tIwa7Pmq8JKUNFUDeHQiXA40zKeGIGJyF7fg12Pahfv0mvoW3gU:YIV2mqJUNFoOXpycpvmQlfe9zq
TLSH
T128F25C71D39C830BDCDD1E34A6B8D982153BC79B7921EB4E5E88E0880973785972376E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Extensions.Logging.dll

Path C:\Users\Admin\AppData\Local\LuaTools\current\Microsoft.Extensions.Logging.dll
Size 49KB
SHA256 48bd4a0d323e0ae85fa0469779bb13e92c4600b0a49dad6bcb891047c5e17caf
MD5 eaf823ed830e1f448cbe8e1ad95a76e1
SHA1 6539c17f608ad3691e96c23bbc3bb3b55ae34b37
SHA512 67a3d77da957aaa0fe4f4434c054f51886528640603d4e027d5f298e322964ca1061d40f99ac9169df45f9a4f656d050f4d3dd2c0b0c4a7ffb5d20d84bda2735
SSDEEP 1536:uwkwf/Pqv0KvNDmBRZlDl9PQ8izqu0PpKzZ:Dkg/WCXiz0BKF
TLSH
T1D9335C6147EC8763DAAE0E38F5E4D5545B76D76B6012EB536ECCB0A90C7378087202BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Extensions.Options.ConfigurationExtensions.dll

Path C:\Users\Admin\AppData\Local\LuaTools\current\Microsoft.Extensions.Options.ConfigurationExtensions.dll
Size 21KB
SHA256 3057894505e37852ac77ba70007a6b075980be4da9c3afcdb7a37e62750bda1b
MD5 8ed48fb1ee04b8180c8a021b8c9289d8
SHA1 4e4be474d90b13edf1365307809edab6ddfb066d
SHA512 ec0f2d7c3b75698fea8bbfb3c38771a358934a69aa25739ffe52939ecc25309c741aceade75c3b96eca4f778c7edaa33bda4180de993f3dc99b5ebef27548273
SSDEEP 384:ty1JDVIqRW7eGpX7SOxYWV4lEdzWzAr0WClNetR9zjrT:tnBR4lEdv1P9zfT
TLSH
T14CA23A528B5C4223DDFB5E71DEE585923D34E78A5911DE2A02DEE1480CA3BC8DE3172E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Extensions.Options.dll

Path C:\Users\Admin\AppData\Local\LuaTools\current\Microsoft.Extensions.Options.dll
Size 62KB
SHA256 4e767f3c0bf37199a83b8697fc9431d907fe39b5f2763f83381865c89ea6545d
MD5 6d0db347c73a12d13b4207aeef1bad55
SHA1 7d8afb9e7aee839f6c03d6a8ef6ef6791523e741
SHA512 e1db3fb8a552c64c2030e3724c39930c1f9ff749817fcb2aa2286217a13b333bd73c55dda764fbbfcb2076b473b7aaa93f6e56b30fa704b400b689e73c76f3c2
SSDEEP 768:WpWO5uXespQkuvhuVyI4vrKilRrtsyQYGiuxseJyvmpqsS7WdP7NszuatX9z/p:WAGghwMII4TpsyVOuvBBSBouczx
TLSH
T169536A2297CC9712CAFF9671B4ADA4520E35C35A3A03B79B52CDF0D81C773A18A65633
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Extensions.Primitives.dll

Path C:\Users\Admin\AppData\Local\LuaTools\current\Microsoft.Extensions.Primitives.dll
Size 42KB
SHA256 b5e8630df19605fec639873b86bdff6f9d424db88d181bb36a0bd641558c18ca
MD5 b252147211deb74a9d91401c4387b6dc
SHA1 e237368996fdb43315f2360d1f374cfe9a0d54f9
SHA512 05ae2266296a182ee4fa267e947f4a7cd1d4d6787c4b4c1fbc3ead253ad6dfbfc2d26409fed457186579fc9540e83f2d1ccc15c78c3cff1af2deb3a88d54e137
SSDEEP 768:6PNon+YcgKF/1WfRzT3YWkLzZuORP6eNbOP7yW5yKyqLuiM+30XuIh7N9zu1X:6Gvcg61WfkFuoPzNbOP7yVKHLuiM+3Jl
TLSH
T1E3135B05B39C8333CFFE9E75B5A1C4152638D3A6B522EB6B60C8A0741D637C4477266B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Diagnostics.DiagnosticSource.dll

Path C:\Users\Admin\AppData\Local\LuaTools\current\System.Diagnostics.DiagnosticSource.dll
Size 187KB
SHA256 d28e247dc8b6af02968b65fe6aae25c2ee689d2007268375d63347aeac0bea6b
MD5 f287490a129140fa1bd94a7247f49b37
SHA1 9892801cd4b7fda18461cab464a1b00e18f52217
SHA512 a467c7855af63771138b95a62e9b541f81de9e1d44519dd68a1c894167cdbb5566392d196f75ebc88c4e9b4c0587ab280d4a1ff44309d7522efa6738f60e3d13
SSDEEP 3072:TRQdeGkopxoribSSiKQ7Rt2wS6XkzvYaLKlllWFBx21nRlviQYVPXx:eeGkopx0igKQlty6XlabBxq7vzYV5
TLSH
T184148D2073EC4B26DFEF1B39F470C45607F2DA4BB54BEB886A85A4EC1853BD1460126B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.IO.Pipelines.dll

Path C:\Users\Admin\AppData\Local\LuaTools\current\System.IO.Pipelines.dll
Size 75KB
SHA256 a3c80d0bb52e0f5afc73638cfe5dc25e3470e5fdc0311745aebc8a4d4cfcba35
MD5 726b6639602ff3b58d037f99b3aa7279
SHA1 ac1b1635a3219b436b094ba633743fa32339a974
SHA512 12d4b0930694d5e13edd1c715891b931f2e9e692e48bdfac35675cc3d589fe58704e6f4b66fffef0615a4204b67b009671523f810a81bcf5a6a1c167c5b38134
SSDEEP 1536:LvXUpt0U320mvAnfAWF/G4bgN0xmR9ewEcXYzIkCRwy4PzJ7:90monoWNG4bgN0xmR9ewEcXmIkCCy4Pp
TLSH
T1DC735C6843EC8717EBCE1ABDA17145230FF2DA666A13F74A944CA89924D77C006263F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Security.Cryptography.ProtectedData.dll

Path C:\Users\Admin\AppData\Local\LuaTools\current\System.Security.Cryptography.ProtectedData.dll
Size 37KB
SHA256 ce7f4b80de12f227ac637915470c5b6b6a5d716456835caaa0b1600c3cbdcb6c
MD5 1f39c7f724597435feed4c6e8207b235
SHA1 cbe9a23badf76bad2ef913cdfe31d86c954d19d6
SHA512 f9b33dc2d34b5a1f5dbe1840685f85104a3e2be109c270314cbecd6d0c6a4e3f84a5be5ec8ec417f27ec7b571515bc578380bf8de4172790ddc7ddc8117c29ba
SSDEEP 768:y8I8P2QLEx7FiC7YccT3zoCaw2Lw09zaJ:yiP2DF1SjoS2LwczaJ
TLSH
T194036C21A7A8937BDE5B4974B931E00A783C8E498012BB3DD5C9614815F2BC59F32FB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Text.Encodings.Web.dll

Path C:\Users\Admin\AppData\Local\LuaTools\current\System.Text.Encodings.Web.dll
Size 64KB
SHA256 8839f3cdeabd22f5952c4673367ea41c921aeb0ea26e18fb23906e2cac08298b
MD5 6c8c3061f7f55a28ff30bcf3ee7da75b
SHA1 90e54da4dd85e168d294d61b1e42480e9280bbb0
SHA512 9b715a5594d298e68bbb5db933bf2719b0b4b7ec2807e256981dec73339fe4d7c2e416b9aa856035f61209b2a83e9b6f0903ec28b15a4837f43866f3ab908d62
SSDEEP 1536:0jLlBxsNNJM4PMZSFdmTa7/hQ98av9Yzm:mBudv3/211Y6
TLSH
T1DB535B11B7C8E51ED75D06306CE080B0A7F4AFDB5126E6C71C957A0E27B3BC86B1929B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Text.Json.dll

Path C:\Users\Admin\AppData\Local\LuaTools\current\System.Text.Json.dll
Size 660KB
SHA256 bb53577c13ab01f397585e4bb642a1a89f1af91b70eb385c7c05b82b9b912605
MD5 e1134858b6a45565531cb3c3a1a26df4
SHA1 8c7986c744b9bb668f1bbb37934528ac38dd0bd0
SHA512 dd4c350ab441df58e08bfd208cfad384f47a676300f9b5811bb7be14b81bea9ce18debceefcc4ae68aa488551348f20feb8ae09b4d2220dc84a401e1e4f21e5d
SSDEEP 12288:jC7e+aoa/8Jbxfap97o6WEuy68/aUI5ABlr9ZHqdKC7vZzhYQ:xoa/8Jbxfaf7o6WEupX5ABlnK8Q
TLSH
T134E45C10B3E84B2FDADF433AF0F040058BBAE46AA75AD74B150854E92CC3BD19E556B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Velopack.dll

Path C:\Users\Admin\AppData\Local\LuaTools\current\Velopack.dll
Size 261KB
SHA256 b35698f5f66978d7bfd0ab12a2a2899f05912d9a1890d5e64c2dce9bacf2662f
MD5 2c29bf1bcfe53f779a9f7d785601dc8a
SHA1 21d134bb5661ebbb4819500aaf829ccfa024a9b4
SHA512 3acfa65169390a7f9af8ac66dfa9684405bcfcc4e61fc04df80ee3bfa25bea4bc8a41defd7fb9290890285172a97f663d95774a59e274fbcd1f8b5f44d533692
SSDEEP 6144:qo0g6Hxg1smn4oGalxcB+KQwCyknZylyZ8Sru:qLgAiWHoq9CykclyZz
TLSH
T17A445B0037F48716E2FF6F79FCB0600686B5FA07B8AAE75D0A8458ED1D633509950BA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Wpf.Ui.Abstractions.dll

Path C:\Users\Admin\AppData\Local\LuaTools\current\Wpf.Ui.Abstractions.dll
Size 7KB
SHA256 f504e30e37a74936ac14f14de4ac43c291cb3964eda71cdcdd61f27cf15cb9cf
MD5 eca262214bd112cc4a0a225df5f43210
SHA1 275987463805d018677c1e093d072a05ffda92a3
SHA512 099fc0c607af839d933b0007b37739897b67adb07ce309f5926da845b857b36b640c1d60ac002a405db73fbaaa793ecb0f54fd1e647c838d3188d80f51d0b843
SSDEEP 96:vClxi89zX2ekdeDm4mgWoQdBTHUhMDADUlYpijY39SOkX1hHN:vClFDc05mgWoQH0hMDADcke09KXDH
TLSH
T1F5E19221F3A88332CDF74777E8BA52845730F652EA578A3F199A510E5C2A0591E32B61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Wpf.Ui.dll

Path C:\Users\Admin\AppData\Local\LuaTools\current\Wpf.Ui.dll
Size 6.3MB
SHA256 3466432f74d1d1224a55f71b8dec7b2913039e01ee32b7304fd9668fb76b797d
MD5 17b530002d305ce72b8c40a1c6ecd70c
SHA1 0be2703f9866699c4e7497f62141abc1b31ff57e
SHA512 3dea4eafa04fd6a9381921eb98526386319906153007e6b159e7437a32d6fb235ddd5d0434d13b58bc41a6f535aa718d29bcd43d101701b810c793b2358e1d4d
SSDEEP 98304:89xe/+FOvSmaRf+UcDN9NppBLxAHDfyLrZl:89xz8N9Npp
TLSH
T131666C5E17ED0D36C3B3837A8DB073222DA9196A1142AB834F4EDF2D446A2C4CDF559B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Diagnostics.EventLog.dll

Path C:\Users\Admin\AppData\Local\LuaTools\current\runtimes\win\lib\net8.0\System.Diagnostics.EventLog.dll
Size 171KB
SHA256 59fb8f95e34b4dbc41422e801ca9456da5ab70508d773e42e2ce1c60de38a88f
MD5 6781d2fc53d3682151ccf369d797d673
SHA1 7862a6bc28ee617abeb8d70c00da380ef914072b
SHA512 fc6070ad003a38c69944990b26507821a8c867f5a4683a0464e47a9efb201fcf5b0afb1ec60359b32e412edf521771ca4829b19e7a2b3d75d1d3082a5521bcfc
SSDEEP 3072:RfT/zCfxCsREbOAvoFY8ZHPfu65kt+EIx/LJQYyaQUoj9:p7zXsRIOAwhHPfF5ktyrfy
TLSH
T139045C7573EC4B1EE7FE1B38F4B011258736B996A93BE72D458448ED09637C08A207A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sq.version

Path C:\Users\Admin\AppData\Local\LuaTools\current\sq.version
Size 534B
SHA256 78dcc56ba53ee63fc4964a292b130912a0d2954b30d04d620ba035f913d5abbe
MD5 04596f069c5a7130f9a3bcdc416b1e23
SHA1 05f951ecb135f39b1236955ba6012ceeabf006e1
SHA512 e5f462411de136882cd191e265dfa0b288a2c85612e699027d277583b082b41f04db4516de84e34e8956eaf56cbb0eedb3687dedde0a35b020952fa4c03200b9
TLSH
T178F02B85A542DA4645931E5565E54104B3EB7E6F34C848D0E8C88CE8238D2EEDC2FD55
MD5 SHA1 SHA512 TLSH

Submit Download

LuaTools-1.2.6-full.nupkg

Path C:\Users\Admin\AppData\Local\LuaTools\packages\LuaTools-1.2.6-full.nupkg
Size 6.7MB
SHA256 6b182fd5243818cd5dd01f4638ea0c95f66c50cb863e6030de75506d4a97fc93
MD5 2cedeb9a3250e81abe9cb99a9b663741
SHA1 17e2160f951300c3de35958a19d15f233dbe8c26
SHA512 69658232ef0bf3798e23662e3502f9b3b954350756218a4cacfdc50ea766a794f612cda0991a9bc76ee018070e3353c83889d512500f46a8ac4c5f1da051fa92
SSDEEP 196608:EG6XAGw0040yF5NFdjPnN4Sw6qHn3ILn03t+6E4U7BtjuX:awh60ojFdjfN4SwVI70bUTjuX
TLSH
T1D566330E036C5676C21BDBB0913C09AB8782767FA3D13769412833D7EECA6FD9758285
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c95a47aec5edba88214fad580cb869417b6620a91d8ee97e2d0b7801d3372be5
MD5 aad5f2ca0dd16bb2ea6c7757ea569c50
SHA1 5228b0b132542be004ea1bb32f3748964d065af5
SHA512 9d59c0291d741bd9d6cf50c22972d4baef00e7c1a48d6a3311a6cc82c04ceeba6e2be9458334cb954878915cc9eb91a8fd8bc4a47c966d57a2a05d6ee8211640
TLSH
T1D4D09BE177A19D18C545353567D1522591416D31451927194241E13D9D7E2C3455F0AA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ac1b1f93ff87eb876027f4166d705375c0f5d3d22dcb03f6a66f6100e88dd10f
MD5 b99f03c5cfe71b03836f8b5fcf09425b
SHA1 8a5078499c0b5ea40183efb77f9c1028c196409c
SHA512 6b9feec4ead7bf05f67d0d480907e21a3b770d8d12dedd2b0d785904186eac7448583e61abacb23582948de55c8ea2043bfd6908efd7faecdd82cee91404cfe6
TLSH
T16DD02BE037909D18C440353163D0122091006C30880923090100A02C8D3E2C3054F0BE
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 29f70f739647817f7f5478533968094fe3d4a46f458df7447ae4697d1b670699
MD5 174cb875d1c3cca46f044fdc3eb8a003
SHA1 291013c82596f04d2119a6d8af3ac46aa2125c49
SHA512 5f26bc6a70271ebf1a4babffa358b3981bb36f84606beeac8b78832c138cb4f1894329569425f224ab00c60eb145b3222c61d263cc7930875643c6736a8e8200
TLSH
T191D080B03B95F915C5452531E6905321A1515D71685B670A5110D01DDD3E1C357DF0AF
MD5 SHA1 SHA512 TLSH

Submit Download

7ecf00d3-6783-4888-bd7d-2d18d06103fe.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7ecf00d3-6783-4888-bd7d-2d18d06103fe.tmp
Size 414B
SHA256 346b569bed53a751915101917c1ca4844be528e1d190c0ee8f50f69e85fbdd03
MD5 a5269b4ed64aac69055862b09ffc46a7
SHA1 d159f8bc2014a6516c6528ee006bc047b5cd7725
SHA512 2601c6e9efa4f81b0a43df246f2d9780d6e6066b3c4c492b87d9c80035142b70117976ca9c49204311de10c8a328584e84043ef1db107daa5f86d82a39b1e8a2
TLSH
T173E02B69C926ACA758FD1B1D50144B46EB51135B3B414D6F773D9508CFB173A428781C
MD5 SHA1 SHA512 TLSH

Submit Download

94dadad4-f9ca-4e23-bc55-ecf693dfb77c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\94dadad4-f9ca-4e23-bc55-ecf693dfb77c.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 1fd60895c99e9e6896556e1acbddcdcbd6638a72984e2f083ca01a74754b3d3d
MD5 078ed6e615ddb9047482121151602c59
SHA1 bd0e0d33aa7f7c6d390ffd544dbbbb1eda16b52e
SHA512 a9bf89ed2ab138ebcadee16e69a4ea0e256380acd0c6925de11fee88764be1cfa0b6038b0481d312f1c64da2766de149d250f0e672f5098e782ccea4e5ad6919
TLSH
T1845118B023B2D9D3D765877357E26A8E36F0946B260B2E5980643D758906F2CECF102F
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_1
Size 264KB
SHA256 5c6ba6f225f6a570bb6179a6efa8d00dcc4f025a649eb8a1ad4b50c16506a371
MD5 5eb1bf0ee7616a0c9c6476f94236d6a9
SHA1 cff2ee9097bc05f1605451b4e0b3ee945e48b11f
SHA512 bad3de0f272542e28dda93183976f56b0dd9b3ec9ac3624f9e8192f3e2252d182557de965fc66d244e35c8ceb860a24b1ce43f94dcacc5b723f19be503023a36
SSDEEP 3:MsEllllkEthXllkl2zEflRtq//:/M/xT02ziI
TLSH
T1844404047FC0050DC5001130C053D3F13770D41505715F4334D10433DDC75401C10004
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 86ec6f96df0c7e879e6cc713c774c78428132d4e9ed84708e7ec98a5182b4f6f
MD5 76deb31dd9ac0be5c168643e31493d4e
SHA1 ccb080554e129086efc4440e015115c0a46e20b8
SHA512 36f3eb218f481d01e825bb80cdc7396dc0e65d474fb9b0719389f5f234655f13f2aa9dea55981c5710b3cf63a5b9cdc10ba3c44eb6d799c52102e00daa3bdb09
TLSH
T1AE41CEF7C3E8866E890156F0AB186E1BCE1D0915432C3D5AC9E4AE6B93F3472E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 b942244b9034e1f93f6f3c6633128dcbdc80526afd08538d53a0720fbaa3e676
MD5 7ae758c19aff2ee18e3e129c0be57bc2
SHA1 c9d827e347236028b2c9b0638b939031efb3497b
SHA512 1fed8037ef9d5f9a4fced5cf6efd37bc8972e0880c9eb88f6554b35590c7a02daf2ba8b89a7e761ec38cd9351d43d8077c47718c68a5005301660e0481418aa8
SSDEEP 192:sxRSRHC1/fums4WpVFlmZdzoA8pi/g6+WNIYoEOY2gWIgD/NJ:sxRSQ1/f/s4WvFlQQi/5I9jr
TLSH
T14842C515AD28A93B9CC7D21DFF6A7F53D2F91032A1D02E58A6FC961C04E7ADD520780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 b0a90de48cd8f5c8006a2cc1e5ca3085bfb324b9a5f6719121daa3d27595d33b
MD5 37602dcceacc3d0f8cdf89912f69f4ee
SHA1 490074baf0c845a15bb310c7c47dd1520a9c6f98
SHA512 143c2cb97ef7c00776e69ce35eb938a114ed7dde30ff01ba5e714e57417417d6e926fde98c9337888670a4bc89bc5c571edcc5a193dec3f99bca9c1f46e21b66
SSDEEP 192:sxRFRxC1/fumsUlmZdzoA8pi/g6+WNIYorOYfGWIgVNJ:sxRF61/f/sUlQQi/5ICU1
TLSH
T14C32B6156D28A93B9CC7D21DBB56BF53D2F91033A1D02A58B6FC961C04E6ADD520780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 93f04fe2fc4ea1a8570c28bee5d862d7140edb319215e75ae86f6ae047b0abcc
MD5 604ee27ca3330429eef92c75be9f1805
SHA1 1676a1def110d7050e4fdd3a4ae34cc5d81bbfeb
SHA512 25d3431a1116a7dd4e1edf24666efcfbc1deba0ffce99ada801dd28b0eb787afcd1beac93d2d79de941740efa65a88f8af6236fe8224af29e5f83cbabf6662b0
SSDEEP 768:j26HRo7pLuL7MRWgs2f028F1+UoAYDCx9Tuqh0VfUC9xbog/OVmYBVuwBro9we0x:j26HRUE7MRWgs2f02u1ja9YB4w6XY1
TLSH
T1B5D2DB7B640DCABE4F800ADDED197E9F6D6802CB9698CD8047FE941C02C6BEA51164DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 f046d7f01d33b91e3546839f3a40a7f76bda77b565004cdb51497c412411a22d
MD5 77dc57c6b3badaf13c16d0b3e02c0bac
SHA1 04550a5850189da0219d30c7fd40a5c6caacab91
SHA512 878efaa3d093dc975dca3a4c1e27d39addf9b933beba9324730928918ac3c2dca89a24a8af64512981c33995fa02b07b7e23b237156ae47dae9dd08ea0205739
SSDEEP 96:KR3gFB31lpWRekgJpK4ggHpcvHG5FaHoZs4q26gWeDzgggK41gCgcwgziPHyKsIw:C3gFB31lERe1JDggH2vHG5FaHoZs4q2s
TLSH
T155911141717A12443C3F7A1E81E89D1ED6D174B27115A52FBBA801A64FABE424DFCCCE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 7df0d3388106979c241dfea0dbacf1bf1be6f9b637c28ea07af5acde2556362b
MD5 0eb588416383794bb720239760bc2868
SHA1 694256feaa13019a77b4dbd1727a869d411d70ca
SHA512 e94e0b26f9b204bee7cd15e602d8f9baa0fe4698dda1c3955e51bcf9c248076800114d2a35f1af497b9d8037f2d147640ebe5fada68c5981a998c8d39649f344
SSDEEP 768:Mrv+4UNbdz3TXrF/TBOW8FsmQONXyer1IRCzni9ZeVH1SK3:MbsbV3TBadQSIqnmEH1R
TLSH
T10A13BF31A1A8DE234DE6A3C5B14773437FB8206B89840BA4E9EA1F8E059759E130F917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 45KB
SHA256 a106e40ed1e7017e630c8efd9e9efe5d5b0710e18487f777afd71358068fb8b3
MD5 409cbba145a8eb4b86c4d34ff1e8c3d0
SHA1 df52061efd94f01f9cb94222ea5d5bb0150fc788
SHA512 5cf983db9f75767b1ef34baa89d249962e7ae28252f994ca7e462cd19dbfff5d77921c96909dc133dafec44bfff6932a37572b76e770e1d658d1f8484f08a73e
SSDEEP 768:Urv+4UNbd/3TXDF/TBOW8FsmnONXyer1IRCzni94Z9QreVH1SK3:UbsbV3TZadnSIqnJkrEH1R
TLSH
T1A223AD3CAD649E3F4CEEB385710E62532EB8103BD5A00AA4DBD50B4D857799DF30B916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 af752dd31efdca756a990d0b8e2af04ffeb162ba8f5f4885178b5b59ce1081ec
MD5 5cadd4db0b9f828ff9597a6835c655c6
SHA1 3da654eb0100b44b45b5024b521a11f19fd2f3bc
SHA512 92681804b5cdf7f18d484a5e829803442da94b30c75eda8defc80536dacfed587989078e8c4b2bc1d425b4ee0be7cfb8f6b2a1e8a2cacb0965c4477abbfdd606
SSDEEP 768:hrv+4UNbdz329/TBOW8FxONXyer1IRCzniBPeVH1SK7:hbsbV3kaxSIqnwEH1l
TLSH
T1F703BF36E4A8DE334DE2A3C5B14772037FB86057D6840BA0D9DE1F4E069B59D130B957
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8b80269e-d16f-40de-9cda-eeb7fb679be3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\8b80269e-d16f-40de-9cda-eeb7fb679be3.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4480_226354549\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5436_1614004595\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

velopack_LuaTools.log

Path C:\Users\Admin\AppData\Local\velopack\velopack_LuaTools.log
Size 1KB
SHA256 ed80083edeb860b06f901c5481699aa9211fea2dc1ccb77cd49166878846eec9
MD5 2ddc41252f1861f155a2eded7f29953a
SHA1 6306e73f08e771444f54e9c2f5f9f5c36c03141c
SHA512 5fde2b84b4720c2659980c64e9097f4366a3f51b1a6068f62ba484264fbf51b95394a6df65fbe491b15102f1179803e69528a11218fb06754268c68bb3d409cf
TLSH
T14B31558CE754E2E7F5474793A1F3F19002A91B853B83A98B0C128244E5A9A7C2BDE313
MD5 SHA1 SHA512 TLSH

Submit Download

memory/240-97-0x000001DC071B0000-0x000001DC0768D000-memory.dmp

Download

memory/2872-167-0x000001881AE30000-0x000001881B30D000-memory.dmp

Download

memory/2872-340-0x000001881AE30000-0x000001881B30D000-memory.dmp

Download

memory/2872-852-0x000001881AE30000-0x000001881B30D000-memory.dmp

Download

memory/2872-355-0x000001881AE30000-0x000001881B30D000-memory.dmp

Download

memory/2872-412-0x000001881AE30000-0x000001881B30D000-memory.dmp

Download

memory/2872-851-0x000001881AE30000-0x000001881B30D000-memory.dmp

Download