netsupport | hxxps://apiverificationcloud[.]com/uniswap/

Analysis

user interaction
yes
max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/08/2026, 22:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://apiverificationcloud.com/uniswap/
Sample260808-2aaplaej5s

Score

10^/10

discovery execution netsupport persistence privilege_escalation ransomware rat

Malware Config

Signatures

Family: NetSupport
NetSupport is a remote access tool sold as a legitimate system administration software.
rat netsupport

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	CScript.exe

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\uclient.lnk	WScript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\uclient.lnk	CScript.exe

Executes dropped EXE 5 IoCs

pid	Process
3976	uclient.exe
3036	uclient.exe
884	uclient.exe
524	uclient.exe
3704	uclient.exe

Loads dropped DLL 21 IoCs

pid	Process
3976	uclient.exe
3976	uclient.exe
3976	uclient.exe
3976	uclient.exe
3976	uclient.exe
3036	uclient.exe
3036	uclient.exe
3036	uclient.exe
3036	uclient.exe
884	uclient.exe
884	uclient.exe
884	uclient.exe
884	uclient.exe
524	uclient.exe
524	uclient.exe
524	uclient.exe
524	uclient.exe
3704	uclient.exe
3704	uclient.exe
3704	uclient.exe
3704	uclient.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uclient.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uclient.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uclient.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uclient.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uclient.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
884	msedge.exe
1880	chrome.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134307013459306173"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-889581200-2041691093-2048517887-1000\{79CAD807-E4C8-4119-9976-E96BF6D8E242}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
1296	Notepad.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

pid	Process
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeSecurityPrivilege	3976	uclient.exe
Token: SeShutdownPrivilege	2848	chrome.exe
Token: SeCreatePagefilePrivilege	2848	chrome.exe
Token: SeShutdownPrivilege	2848	chrome.exe
Token: SeCreatePagefilePrivilege	2848	chrome.exe
Token: SeShutdownPrivilege	2848	chrome.exe
Token: SeCreatePagefilePrivilege	2848	chrome.exe
Token: SeShutdownPrivilege	2848	chrome.exe
Token: SeCreatePagefilePrivilege	2848	chrome.exe
Token: SeShutdownPrivilege	2848	chrome.exe
Token: SeCreatePagefilePrivilege	2848	chrome.exe
Token: SeShutdownPrivilege	2848	chrome.exe
Token: SeCreatePagefilePrivilege	2848	chrome.exe
Token: SeShutdownPrivilege	2848	chrome.exe
Token: SeCreatePagefilePrivilege	2848	chrome.exe
Token: SeShutdownPrivilege	2848	chrome.exe
Token: SeCreatePagefilePrivilege	2848	chrome.exe
Token: SeShutdownPrivilege	2848	chrome.exe
Token: SeCreatePagefilePrivilege	2848	chrome.exe
Token: SeShutdownPrivilege	2848	chrome.exe
Token: SeCreatePagefilePrivilege	2848	chrome.exe
Token: SeShutdownPrivilege	2848	chrome.exe
Token: SeCreatePagefilePrivilege	2848	chrome.exe
Token: SeShutdownPrivilege	2848	chrome.exe
Token: SeCreatePagefilePrivilege	2848	chrome.exe
Token: SeShutdownPrivilege	2848	chrome.exe
Token: SeCreatePagefilePrivilege	2848	chrome.exe
Token: SeShutdownPrivilege	2848	chrome.exe
Token: SeCreatePagefilePrivilege	2848	chrome.exe
Token: SeShutdownPrivilege	2848	chrome.exe
Token: SeCreatePagefilePrivilege	2848	chrome.exe
Token: SeShutdownPrivilege	2848	chrome.exe
Token: SeCreatePagefilePrivilege	2848	chrome.exe
Token: SeShutdownPrivilege	2848	chrome.exe
Token: SeCreatePagefilePrivilege	2848	chrome.exe
Token: SeShutdownPrivilege	2848	chrome.exe
Token: SeCreatePagefilePrivilege	2848	chrome.exe
Token: SeShutdownPrivilege	2848	chrome.exe
Token: SeCreatePagefilePrivilege	2848	chrome.exe
Token: SeShutdownPrivilege	2848	chrome.exe
Token: SeCreatePagefilePrivilege	2848	chrome.exe
Token: SeShutdownPrivilege	2848	chrome.exe
Token: SeCreatePagefilePrivilege	2848	chrome.exe
Token: SeShutdownPrivilege	2848	chrome.exe
Token: SeCreatePagefilePrivilege	2848	chrome.exe
Token: SeShutdownPrivilege	2848	chrome.exe
Token: SeCreatePagefilePrivilege	2848	chrome.exe
Token: SeShutdownPrivilege	2848	chrome.exe
Token: SeCreatePagefilePrivilege	2848	chrome.exe
Token: SeShutdownPrivilege	2848	chrome.exe
Token: SeCreatePagefilePrivilege	2848	chrome.exe
Token: SeShutdownPrivilege	2848	chrome.exe
Token: SeCreatePagefilePrivilege	2848	chrome.exe
Token: SeShutdownPrivilege	2848	chrome.exe
Token: SeCreatePagefilePrivilege	2848	chrome.exe
Token: SeShutdownPrivilege	2848	chrome.exe
Token: SeCreatePagefilePrivilege	2848	chrome.exe
Token: SeShutdownPrivilege	2848	chrome.exe
Token: SeCreatePagefilePrivilege	2848	chrome.exe
Token: SeShutdownPrivilege	2848	chrome.exe
Token: SeCreatePagefilePrivilege	2848	chrome.exe
Token: SeShutdownPrivilege	2848	chrome.exe
Token: SeCreatePagefilePrivilege	2848	chrome.exe
Token: SeShutdownPrivilege	2848	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3976	uclient.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe
2848	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3596 wrote to memory of 4536	3596	msedge.exe	86
PID 3596 wrote to memory of 884	3596	msedge.exe	88
PID 3596 wrote to memory of 1888	3596	msedge.exe	89
PID 3596 wrote to memory of 632	3596	msedge.exe	90
PID 3596 wrote to memory of 1888	3596	msedge.exe	89
PID 3596 wrote to memory of 632	3596	msedge.exe	90
PID 3596 wrote to memory of 632	3596	msedge.exe	90
PID 3596 wrote to memory of 2360	3596	msedge.exe	91
PID 3596 wrote to memory of 3248	3596	msedge.exe	92
PID 3596 wrote to memory of 2360	3596	msedge.exe	91
PID 3596 wrote to memory of 2360	3596	msedge.exe	91
PID 3596 wrote to memory of 3248	3596	msedge.exe	92
PID 3596 wrote to memory of 3248	3596	msedge.exe	92
PID 3596 wrote to memory of 3064	3596	msedge.exe	93
PID 3596 wrote to memory of 3976	3596	msedge.exe	94
PID 3596 wrote to memory of 3064	3596	msedge.exe	93
PID 3596 wrote to memory of 3064	3596	msedge.exe	93
PID 3596 wrote to memory of 3976	3596	msedge.exe	94
PID 3596 wrote to memory of 3976	3596	msedge.exe	94
PID 3596 wrote to memory of 3816	3596	msedge.exe	96
PID 3596 wrote to memory of 3816	3596	msedge.exe	96
PID 3596 wrote to memory of 3816	3596	msedge.exe	96
PID 3596 wrote to memory of 3408	3596	msedge.exe	98
PID 3596 wrote to memory of 5036	3596	msedge.exe	99
PID 3596 wrote to memory of 3408	3596	msedge.exe	98
PID 3596 wrote to memory of 5036	3596	msedge.exe	99
PID 3596 wrote to memory of 1480	3596	msedge.exe	101
PID 3596 wrote to memory of 468	3596	msedge.exe	102
PID 3596 wrote to memory of 468	3596	msedge.exe	102
PID 3596 wrote to memory of 468	3596	msedge.exe	102
PID 3596 wrote to memory of 3960	3596	msedge.exe	104
PID 3596 wrote to memory of 2628	3596	msedge.exe	105
PID 3596 wrote to memory of 3960	3596	msedge.exe	104
PID 3596 wrote to memory of 3960	3596	msedge.exe	104
PID 3596 wrote to memory of 2628	3596	msedge.exe	105
PID 3596 wrote to memory of 2308	3596	msedge.exe	106
PID 3596 wrote to memory of 2308	3596	msedge.exe	106
PID 3596 wrote to memory of 2308	3596	msedge.exe	106
PID 3596 wrote to memory of 4384	3596	msedge.exe	107
PID 4092 wrote to memory of 3976	4092	WScript.exe	117
PID 3932 wrote to memory of 884	3932	CScript.exe	124
PID 2848 wrote to memory of 1544	2848	chrome.exe	134
PID 2848 wrote to memory of 1880	2848	chrome.exe	135
PID 2848 wrote to memory of 3076	2848	chrome.exe	136
PID 2848 wrote to memory of 3076	2848	chrome.exe	136
PID 2848 wrote to memory of 4584	2848	chrome.exe	138
PID 2848 wrote to memory of 4584	2848	chrome.exe	138
PID 2848 wrote to memory of 4156	2848	chrome.exe	139
PID 2848 wrote to memory of 4156	2848	chrome.exe	139
PID 2848 wrote to memory of 1972	2848	chrome.exe	140
PID 2848 wrote to memory of 1972	2848	chrome.exe	140
PID 2848 wrote to memory of 2988	2848	chrome.exe	141
PID 2848 wrote to memory of 2988	2848	chrome.exe	141
PID 2848 wrote to memory of 3532	2848	chrome.exe	143
PID 2848 wrote to memory of 3532	2848	chrome.exe	143
PID 2848 wrote to memory of 3004	2848	chrome.exe	144
PID 2848 wrote to memory of 2368	2848	chrome.exe	146
PID 2848 wrote to memory of 2368	2848	chrome.exe	146
PID 2848 wrote to memory of 3268	2848	chrome.exe	147
PID 2848 wrote to memory of 3268	2848	chrome.exe	147
PID 2848 wrote to memory of 2028	2848	chrome.exe	148
PID 2848 wrote to memory of 2028	2848	chrome.exe	148
PID 2848 wrote to memory of 464	2848	chrome.exe	149
PID 2848 wrote to memory of 464	2848	chrome.exe	149

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://apiverificationcloud.com/uniswap/
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2b8,0x7ffbd8d7c188,0x7ffbd8d7c194,0x7ffbd8d7c1a0
  2⤵
  PID:4536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1992,i,13281978052745152011,1006135026903476743,524288 --field-trial-handle=2456,i,13682504385644575251,5854967204305391112,262144 --variations-seed-version --mojo-platform-channel-handle=2488 /prefetch:3
  2⤵
  - System Time Discovery
  PID:884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2268,i,14552690244849788148,11845191834409460547,524288 --field-trial-handle=2456,i,13682504385644575251,5854967204305391112,262144 --variations-seed-version --mojo-platform-channel-handle=2496 /prefetch:8
  2⤵
  PID:1888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1652,i,2301216462571575217,5293562783919412651,262144 --field-trial-handle=2456,i,13682504385644575251,5854967204305391112,262144 --variations-seed-version --mojo-platform-channel-handle=2452 /prefetch:2
  2⤵
  PID:632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3444,i,6906596276044420245,13831157285697948437,2097152 --field-trial-handle=2456,i,13682504385644575251,5854967204305391112,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:2360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3448,i,10408553963815302626,1242771928604252189,2097152 --field-trial-handle=2456,i,13682504385644575251,5854967204305391112,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:3248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4220,i,7762016678211091849,15668045243862901448,2097152 --field-trial-handle=2456,i,13682504385644575251,5854967204305391112,262144 --variations-seed-version --mojo-platform-channel-handle=4348 /prefetch:1
  2⤵
  PID:3064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4232,i,8204611248967984324,8489990728746824830,2097152 --field-trial-handle=2456,i,13682504385644575251,5854967204305391112,262144 --variations-seed-version --mojo-platform-channel-handle=4352 /prefetch:2
  2⤵
  PID:3976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5100,i,7219651104122359955,4553087509412660276,2097152 --field-trial-handle=2456,i,13682504385644575251,5854967204305391112,262144 --variations-seed-version --mojo-platform-channel-handle=5104 /prefetch:1
  2⤵
  PID:3816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5152,i,18119167450241877994,6074046759003947356,524288 --field-trial-handle=2456,i,13682504385644575251,5854967204305391112,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:8
  2⤵
  PID:3408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5264,i,13566312595909596111,9246046792806151048,524288 --field-trial-handle=2456,i,13682504385644575251,5854967204305391112,262144 --variations-seed-version --mojo-platform-channel-handle=5368 /prefetch:8
  2⤵
  PID:5036
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6056,i,1877225006091772079,4727056329192437323,524288 --field-trial-handle=2456,i,13682504385644575251,5854967204305391112,262144 --variations-seed-version --mojo-platform-channel-handle=6084 /prefetch:8
  2⤵
  PID:824
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6056,i,1877225006091772079,4727056329192437323,524288 --field-trial-handle=2456,i,13682504385644575251,5854967204305391112,262144 --variations-seed-version --mojo-platform-channel-handle=6084 /prefetch:8
  2⤵
  PID:1480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=4208,i,7188343444191144998,12815940211603220241,2097152 --field-trial-handle=2456,i,13682504385644575251,5854967204305391112,262144 --variations-seed-version --mojo-platform-channel-handle=6428 /prefetch:1
  2⤵
  PID:468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=5220,i,15661761348800182419,11568113532559447333,2097152 --field-trial-handle=2456,i,13682504385644575251,5854967204305391112,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:1
  2⤵
  PID:3960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5204,i,4198850291403264425,17089705798898030418,524288 --field-trial-handle=2456,i,13682504385644575251,5854967204305391112,262144 --variations-seed-version --mojo-platform-channel-handle=4464 /prefetch:8
  2⤵
  PID:2628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6844,i,1246117051295607039,17283732581244431199,2097152 --field-trial-handle=2456,i,13682504385644575251,5854967204305391112,262144 --variations-seed-version --mojo-platform-channel-handle=4564 /prefetch:1
  2⤵
  PID:2308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6900,i,7941828657879086559,4255957584229395264,524288 --field-trial-handle=2456,i,13682504385644575251,5854967204305391112,262144 --variations-seed-version --mojo-platform-channel-handle=6908 /prefetch:8
  2⤵
  PID:4384

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5056

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4436

C:\Windows\System32\Notepad.exe
"C:\Windows\System32\Notepad.exe" C:\Users\Admin\Desktop\Uniswap_Setup_Win10_x64_1.js
1⤵
- Opens file in notepad (likely ransom note)
PID:1296

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\Uniswap_Setup_Win10_x64_1.js"
1⤵
- Checks computer location settings
- Creates a file in the Startup directory
- Suspicious use of WriteProcessMemory
PID:4092
- C:\Users\Public\Documents\2226219\uclient.exe
  "C:\Users\Public\Documents\2226219\uclient.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:3976

C:\Windows\System32\CScript.exe
"C:\Windows\System32\CScript.exe" "C:\Users\Admin\Desktop\Uniswap_Setup_Win10_x64_1.js"
1⤵
- Checks computer location settings
- Creates a file in the Startup directory
- Suspicious use of WriteProcessMemory
PID:3932
- C:\Users\Public\Documents\784479\uclient.exe
  "C:\Users\Public\Documents\784479\uclient.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:884

C:\Users\Public\Documents\2226219\uclient.exe
C:\Users\Public\Documents\2226219\uclient.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3036

C:\Users\Public\Documents\784479\uclient.exe
C:\Users\Public\Documents\784479\uclient.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:524

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2848
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffbd758c728,0x7ffbd758c734,0x7ffbd758c740
  2⤵
  PID:1544
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2172,i,2091397491157997322,9923294534115453702,524288 --field-trial-handle=2012,i,7332021477474336464,17989197503227201616,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2196 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1700,i,12363909095400021659,10230687488842086470,262144 --field-trial-handle=2012,i,7332021477474336464,17989197503227201616,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2008 /prefetch:2
  2⤵
  PID:3076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2432,i,14048661654908961221,2238463142792155814,524288 --field-trial-handle=2012,i,7332021477474336464,17989197503227201616,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2532 /prefetch:8
  2⤵
  PID:4584
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3256,i,12283823150301817527,3608676889384141148,2097152 --field-trial-handle=2012,i,7332021477474336464,17989197503227201616,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:4156
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3088,i,6147997177287062109,111267258973693670,2097152 --field-trial-handle=2012,i,7332021477474336464,17989197503227201616,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:1972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4532,i,11413213468781645516,14569836743022206699,2097152 --field-trial-handle=2012,i,7332021477474336464,17989197503227201616,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4568 /prefetch:1
  2⤵
  PID:2988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4716,i,11187910967014945558,1060106004935334667,524288 --field-trial-handle=2012,i,7332021477474336464,17989197503227201616,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4752 /prefetch:8
  2⤵
  PID:3532
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5356,i,12209750304479561462,4790145894531306057,524288 --field-trial-handle=2012,i,7332021477474336464,17989197503227201616,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5372 /prefetch:8
  2⤵
  PID:3004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5436,i,787946457542444203,16826340266381739204,2097152 --field-trial-handle=2012,i,7332021477474336464,17989197503227201616,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5372 /prefetch:1
  2⤵
  PID:2368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=4692,i,4935675344403871875,2643508849182580926,2097152 --field-trial-handle=2012,i,7332021477474336464,17989197503227201616,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5716 /prefetch:1
  2⤵
  PID:3268
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=3276,i,9304001561783152514,13360923056580112993,2097152 --field-trial-handle=2012,i,7332021477474336464,17989197503227201616,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3428 /prefetch:1
  2⤵
  PID:2028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=3536,i,3901276755859019485,17975092518578511719,524288 --field-trial-handle=2012,i,7332021477474336464,17989197503227201616,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3460 /prefetch:8
  2⤵
  PID:464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4584,i,16132536929345705690,14237879258874027411,524288 --field-trial-handle=2012,i,7332021477474336464,17989197503227201616,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4664 /prefetch:8
  2⤵
  PID:2372
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=3476,i,1911230608410356833,17464338643906325588,524288 --field-trial-handle=2012,i,7332021477474336464,17989197503227201616,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4132 /prefetch:8
  2⤵
  PID:4684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4636,i,982230037828124307,4320521713441587461,524288 --field-trial-handle=2012,i,7332021477474336464,17989197503227201616,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3116 /prefetch:8
  2⤵
  PID:4308
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=4664,i,11838388190803920282,3278037626620595350,2097152 --field-trial-handle=2012,i,7332021477474336464,17989197503227201616,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4644 /prefetch:1
  2⤵
  PID:864
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=3256,i,13118183716840006084,12785819351157344076,2097152 --field-trial-handle=2012,i,7332021477474336464,17989197503227201616,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4624 /prefetch:2
  2⤵
  PID:2124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=240,i,1293183068625460463,2452304577325435027,524288 --field-trial-handle=2012,i,7332021477474336464,17989197503227201616,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3432 /prefetch:8
  2⤵
  PID:1412
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6336,i,9156331467383007620,9858660776718952076,524288 --field-trial-handle=2012,i,7332021477474336464,17989197503227201616,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3372 /prefetch:8
  2⤵
  PID:1780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3396,i,9975120315466892610,8872525647905418167,524288 --field-trial-handle=2012,i,7332021477474336464,17989197503227201616,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3368 /prefetch:8
  2⤵
  PID:3192

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3052

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2992

C:\Users\Public\Documents\2226219\uclient.exe
"C:\Users\Public\Documents\2226219\uclient.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3704

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 8f1b4b388cbf53bb9f41b7c1232cb9da3cbfa26c3c59c262992fd26b62e1dd63
MD5 b0898ca01471930578299fff21f2cf7a
SHA1 e584f7fe6120972883efcfa25c450c75427fb50d
SHA512 7772d002a22b0512c71f88d3520acaeaf3b2ff1588aab7b286c6bc2e772cf184c3a9d46e1f0fa16607e7783f7b3629d7217d9a4e01ca94d8f28086f2c42fb150
TLSH
T1AFE0ABB9CC60EC2B28FE071C60504307E640236B2A40494B3A3CA10C8FF0A3A4A46C0C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000007

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000007
Size 127KB
SHA256 28ede68469dd63617234463a868cdaf4c7978ada9f78453c4621926130a89999
MD5 55c8d1d8c5f317295c9ebb6382090f40
SHA1 779d30ff95d4775c1f559fa4067e172a58b7937d
SHA512 67ed5bde0a89420123ede221b3e9e81bd1af357ad7106c525fb9f071741fbfa693d00084e571ff9a5d965753bf20c9c79aa1e3b6b22966cd81b31e0cddc751f4
SSDEEP 3072:DfnEGoSrCbIgbScl6KK6gdodWx5RT6RAaB4NgCSVe68lDfUG:DfEbkgWcoXnRT6RNB4NgCYe6kDf
TLSH
T1C3D3127120324C8B7914A97BF33259DF01A71AD23F38A36D8DC969B7B634B176D88781
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000014

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000014
Size 331KB
SHA256 db4ffbf0ec662620013dc14bc1268bdad6256d19d7d511ec7eff8446887e6900
MD5 05ef8155cf66131654d3bb9c9cba5853
SHA1 e79d53fcb604921222dd1dbc2f1c10c631ff6075
SHA512 ee38793245d91683ddb1f847e5b56a09864fd32ec059055459b3ebe101abed79683ee59c80f30b8f6249d2bbd83fbf7bca83dafb4ef2b634ceff6969c80fed23
SSDEEP 6144:FljUD58FLTW53eaLkNv+Ps0dj1fpqaGjYf0NIcB3bM1rJZ24:FDm5uaLcv+PFj7ajJNImbM1rD
TLSH
T1247423A9B50E3C8AC94F9473827EAFD2A4356FF38D47BAA3634241F401874342E4676D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000017

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000017
Size 52KB
SHA256 0c72ee36fc8f17f1973a2d2cef4805a369b78e7f25cd8276543e59ddb1ad0457
MD5 293c8b9dd1ce5b12ae9cdb2730347f0c
SHA1 9bc0055cf4dd0371390739d151ae6ef5f66098ad
SHA512 eec52a1e161389e5336e604b2a97613a50038b11444c948b59052cbdd51fcc3c300aab7c659fafbe9eb7b223045a1cd43811c65b1df334792ef86baf0c421b49
SSDEEP 1536:jmDhqE+FYOqTbzsx7ehMeGAxHL18DnOBcLysp:j6qEiwTfsx7eh3FynhX
TLSH
T11933F1B5674174BA3AA7F87DADE9CB876F3F3D0F569810ADA056893F18C84C27182091
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.virustotal.com_0.indexeddb.leveldb\000003.log
Size 31KB
SHA256 23b193b7df2780db0c844367c1ce0f57ce1f182c898b8c3cb73d9b8e4708ffec
MD5 485bca08e7b10732271bbfe3f508aff2
SHA1 d7c68e9400bc462adaa8cdf1b2a22861b9dd7424
SHA512 7643c9a5bd977622c9b92df3b38a3800b5fa81c679a5d8073c3b36b8626a7b4de81c98f71693e5e33980724f4f42e45d3e0d8b98f67584000f090f8b4a5b92af
SSDEEP 768:euCBr8LZF3wwkwFdymMYKt5eeJCX5/JEdCShu2K+R:Ur8LZF3wwkwFdymMYKt5eeJCXZJEdCSb
TLSH
T1D4E24628A5F59112E2FBAD3CE9F116D7B9773A677C40CA8E4075234E0826B53DCA160F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.virustotal.com_0.indexeddb.leveldb\LOG
Size 355B
SHA256 f22b55a46908532e9c833abc48b4501f1a829b36d33ad28c2ddba503a549813b
MD5 a88f0e1a92b9f457a87a5d1df9ba4c54
SHA1 a9e32bfa1cb9814af8250cab1aa493edab208bb0
SHA512 2830ce3754680c87cd10be0c628285824cb9d0ef0ee47d2215c5359b9453795013eaafe5b1e6242044f6cf53049c457db0d9f7024e25517efa7e62655a214548
TLSH
T110E0682A64D9E2AF116080A73964F70ECEE3210EDECFA8824F41E45030C604C50F8630
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.virustotal.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 2d83b692d635f54a3eea2adcea0498d7ef2dcf3703272c706c7d3b8bf65788ed
MD5 fb213ed94d0e1339de8f544fc7e25f1d
SHA1 07cfb6c1c7bdb5e3521c4152fa6542f405daf4b3
SHA512 09a1d9720d6126255056b9aeaee262332bc91061b538bae796573db1c62139799d59d51da910ab106df3de26874c1913d84e1520080d89589464ea8debacc414
SSDEEP 192:QRRmH/vWv72vAPRp2/dC9THsb+WNn5WOH382tme+peHVyIsnAUgE:QRRmniC6X5FwUx2wEE
TLSH
T19D42C76EA910697B5CDBD219F9617B2BE7F2103225D42E90EBFC893C15D76CC222700B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 9ce2c314af585346bfb663638db87791f35459fe7d04fa43dede6929d473855a
MD5 195f3a832f98e60e3f5665821d70ec53
SHA1 8b39e318d4bba177790b3a23e8bd86920a73b564
SHA512 9e10638d2190fa8550392d457e51c971b46795a8e20f370c73a57a35a2cbedcde53a1471658f6de1ee7b076070693eac6975bbbb52c4e2dd0372e49e6269348d
SSDEEP 192:QRRmH/vEv72vAPRp2/dC9THsb+WNn5WOH382yme+peYVyIsnAUge:QRRmngC6X5FwUx2Rhe
TLSH
T19542B66EA920697B5CDBC219F9617B2BD7F2103265D42E94EBFC893C14D76CC222740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 a167430dd83daaca3531af05dc0fcf4fe9048f4cff36a89eacb7d0e5c2757e60
MD5 0e203cc3650cb456dbe109cba470ed0f
SHA1 ec9063c5bf1156f5071798c12199c9402d9e7a4b
SHA512 284b39352221137c6c1ca28e07b27cb0d7663368050613d51f61b6027f3622281e92c59b0b78930e2f49e695e890e26cfd90f525e6040f5c0a8ddadac7a6f963
SSDEEP 192:QRRmH/BWv72vAPRp2/d09THsb+WNn5WOyQ8YUme+peHVyIsnAUgE:QRRmZiC6X3FwUZYTEE
TLSH
T12F42C76EA910697B5CDBD219F961772BE7F2103229D42E90EBFC893C15D76CC212700B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 df3f3d7e8eb52eb11376e73179228426d3d2d5efef9c19d4d305887505e18b02
MD5 cf7fedf8f7d2c16e2ee32aeccb0d6abd
SHA1 c0965f169b36b690aaf700b8f80359944a908774
SHA512 0f7e0c7f513e4fbb8754c44a17604a17a368e18bf06088e8c92d246667c4707e4e019b978bfef2975410552144093cebfb7ef11074676b8e4908dde7b23f6a1f
SSDEEP 192:ee14K6IW7KxkXqK4I40pUZNCgVLHrKHfFKslEK2cXzKD/Ty+ErUkKN9H9IB3Wh/+:/1jbW7KxkXqKf/pUZNCgVLH2Hfgslqcx
TLSH
T16F32C727948D9A3F4FECD55CDC526F4F6DB1029272780C2896FB9C0403A97CE115A1AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f1cdccba37924bda_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\f1cdccba37924bda_0
Size 169KB
SHA256 a626b1a75d19dd29acf5dd0c067071e4bf6361b32acc1a12b8c6c79e326c36ca
MD5 3a28677f8ed2bebd2b1aee2410568c49
SHA1 01a5cf80c8dc3db7d824f1f36eca7f9c12ba0f7d
SHA512 e1640786bc8b5e226bd2a22c7852b9e808fd089b19f2cfcf2da602c57c87e778dd99a7748ce297823362140fdd0f217a74f2b03626cc7f0696ab122c6f749148
SSDEEP 3072:+LejzWM9SNxPCD1hFiY5KcukCQG1KUfC14TV:+kzWUF1KjjOdQV
TLSH
T16C043457D1F899636F6B0443E8857E82B32C3147E619DAE1F987BFE0101EA2A70F5835
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f1cdccba37924bda_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\f1cdccba37924bda_1
Size 223KB
SHA256 99977d01c681b5d172ef37e568acf6ccbb7649d1b12104744c263d7d104c576c
MD5 223de510186f6199afe82eedc0f08c72
SHA1 49b7960123265b0225ca82e0940f01097f69b369
SHA512 6ef3484832c278c91ff75ff1ec02f9721e7898b1a1621119e3f9b556a237b7806b5bcb6830acb4b884a704247e0422dd0cf6ae51e1ec94b316a836487a54197a
SSDEEP 3072:JKft7RVaGfkGIZa1CwCRdfxa5U7ksewUqy1mqhSElhX:J0eeiwCwCR1A5UFewjIms/
TLSH
T16B24099A632217BFDF7943B95103BE5113210140EAD3C0C6374A579A242EAD7B6BEE3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 aa81d1b70173a342c5c546978a523b7f404e25faecfbed91fc457512e063070c
MD5 cfbae084b1349203ca7d4581611c9afe
SHA1 66f32525b3d0f68959596422bf58d0c83862a145
SHA512 5a8a5081596f7168a8226a196821f2fed66121ebb154150f99daa7f158b6c478f1497757c9112bd6e4715865f6324a240d58cd9173dfe74cfe0dd99b5344b62d
TLSH
T1E6B0129081475921D84449B0254A14C922409E3180004242DBE0F6E68C470D09114140
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 373b4ed7fa937e056e70980da9dbfb7b82848aec6f6858ef5d562d6fa6885bce
MD5 8efff801926826f4df184f29052cd3b4
SHA1 5f8373bc8918e5e173f9a4cc17288c1f096ea26a
SHA512 06a958423bf31d79e40913c952756997fcc6dc0de0fcafd7b47a328b758487b15e1568fe60c0ee35069bdf30d36c5e32099f51b78e83f550b2c23dda4bca0e42
TLSH
T1EBA0022147C81895CD26527060B109C522514D662591535756A3184CDDAF7D0C181212
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a50e0.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index~RFe5a50e0.TMP
Size 48B
SHA256 d19b8567986fd0c172a6e242a1d05253caacb8febee9416e38aefd117604d1a2
MD5 63baba9f220cb1245ce3e5177af624ae
SHA1 4e75af95584ec4b48eff22e384188c41d5e86cfa
SHA512 8e10bd89bece31dda528228a86816da0295012975f492a1592bfc181666918e66a89079c60c47c6a71901aa1de49fda9f6628b07ca1ae425290b784ce9973b82
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Session Storage\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Session Storage\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 9417ce688b17b235145bb0797d8155b32ebb146fb4b0cef2ca9c6598eb34f4f6
MD5 8216fe7b0515b02cad49c76628d90fbf
SHA1 5c6d1bea0537bd2fec70432bafbb4b72c8f8ec43
SHA512 52fa614ee1241e484fef14471a00c654a22a323848ce9b31554d159ee21f4c7b85693dfe10edba911fb966199c43006b5a300752b4c14d10713361b05f9ecaf8
SSDEEP 3072:uGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMm:pm7Rkm1tYpBeh2BAom
TLSH
T1ABC3123B5E70E9775979B74EB08E0B1F1EF14AA2C930DA52C8D85A0437FA7CC0A45934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 235KB
SHA256 41c4b67e11384d760c04459590c6ddc19c91e942ac65785b477234332e416e49
MD5 32320e306cb515c9498bac67fc2a7468
SHA1 4cc0d414684af741d1e3e66f4e9b5cf0d7831bd2
SHA512 7ad2aa755e31bc636ffa858ead5792a786e2355ebf0234624b335bb9b595a03254c4ce7020a751b42731e6dc1264744cdf9aa3e342e5afaaa2eb97f3e11b90b4
SSDEEP 6144:8/hxNPRW2PYddqmY7U52Flm7Rkm1tYpBeh2BAov:+XPRW4Kq97UAe9oBGcAov
TLSH
T1133423126DB4AA784C5DFE1D318F2D2F2EF28ED494A4BEC2D8D45F0827ABD841952D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 235KB
SHA256 b328a4ba088869986634ef2e76ded9532acbfb086cd3a5ad6fdcfe98a1d6bd6c
MD5 def76c6a6193418a52f2011febf7c0a7
SHA1 d1c171f2010a1aec01f993b93f7f1bd676815fa1
SHA512 0969d74c51fdd36e75d895a3791d11bd49a2a2d1373d84534bd3b7e74e212b71067680aad794834591322e582794ec78f47ee8cfb613986269087051e103315f
SSDEEP 6144:D/hxNPRW2PYddqmY7U52Flm7Rkm1tYpBeh2BAov:9XPRW4Kq97UAe9oBGcAov
TLSH
T1B03423126DB4AA784C5DFE1D318F2D2F2EF28ED494A4BEC2D8D45F0827AB9841952D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 19aa9438089b3683f896e6bfd08347483a9ac878bf68c7afcaa840e20fe1de63
MD5 d5e2ff6dcd89f36f24b555e08505c377
SHA1 8b804395894fbabb582425fea1b51b00a12ee811
SHA512 45052c10b980dbeee6045fe4736d315eed60e756979166e175a660768c91737fd7d38a29bb6e9d1604525a44d54bee1dc312c97716ef00b8329fc62d330595a7
TLSH
T1E1D080307D24F9DBD15620F595104A41153A569721535769B510484EDD78081B2C6997
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 11d3c4c52f9fc9cd2b10a22b48769759f994fd6364f9a0fc145f4cd2c2a22e9d
MD5 4751cf705a737c4226029624bf43b9a8
SHA1 fd8cf726ee3f8f75b97147829de5553530caa82c
SHA512 46e3fedbf7fa14bdc2b3aad129f2879a9d24252f5d7bd9b55766bc32a6b82ea77aaf193bcdbdf4423e3b67ef84955e589b6077609344091ef72204c1d50b0dab
TLSH
T17ED09B307A58A58BD14360F1A4114B4115375557205397757521508E9E98055B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 7c508404765e25dd7670b74e96aa2fe076a68476edd23bd0543e57bb8bb947e2
MD5 558801cdaa7d6bee59c2fcc120bb69a4
SHA1 d832225b776d76170c889355e654121c039911e1
SHA512 97beffe4b4a62db8d448cdb80e33f8a07f39b65e146c3b341d445e7663e7cbad2fe9bbe3a402e400b7a38b9dfbb6e7230f07657d95e455c0891fcdaecbe5dd65
TLSH
T1B341E7F006A35B81DF3016B190F01B00367683DDF9737E18829299BE3A3AF63852647C
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 07464cd3bddde57f592cf50334df172c5db1e62fc0bd580a0c795dac46864649
MD5 afd456a6658594223f601a24246555bf
SHA1 1d729bb0948b7ec34e3d0612f2ec9c3ad47e43b3
SHA512 086dd16252840486a61df151bca9a1f35ad225ce37543800baded0eb9c72f9c5338db3803eca0d0d781e1fbda1a3287e8d3064319a349ac76618cd03e22504fa
TLSH
T1F541F0F6C7E4A52E99230AF06635BF6BCE2D051543283C1BC9C4AF1B93E2475D202A4F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 e6eb54a4d57e48202227a46092b7ad9782ab621c898b908b4531882b562cd78e
MD5 963074161b6b504aaef2baed8f3fc814
SHA1 a606dcafe37074ccf31e394bc0c5d19657d9a89f
SHA512 179f16a9aab2820f72abbf98b88154821f63ca9498a1244c41d52e483d01b1a6d18ef093ad1705b939dc583333e9896d07412eda9b133a5c7ac71b41a8f6b1ad
SSDEEP 192:sxZvR5xD/fDsOA7d5eYoVpIdpEQHW6+WNzutfY9I2+wRYIgrJ:sxZvFD/fDsOQdYYo05Hb0fTf9
TLSH
T19322C8526E38A97B8CC7D21DBA15BF13E6F5503191D11E58EAFC961C04E7ADD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 d6e33cfa950212c10638139cd24c62aa0ebbd43705014959914c2a9e566c62e7
MD5 047c0ca9c73030f4d7759f8db916f03c
SHA1 af25688cb84a1808e231ffc9ab0b60f5ca80a02f
SHA512 ee3907e9a8ff49d2c1ee3e28134bf85c1c0f443e4f21217cda6d815139b215b24840d8ee362c381bab74d1781b947c68f67a8a688ba9c67deaae8fb9fa176cf4
SSDEEP 192:sxZvR5yD/fDsTA7d5eYoVpIdpEQHW6+WNzutfY9I2+wRYIg5SJ:sxZv+D/fDsTQdYYo05Hb0fTf8
TLSH
T14822B7526E38A97B8CCBD21DBA15BF13E6F5503191911E68EAFC961C04E7ADD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 9160fd4f66bf84f89b98b6158558ac6a3bafd70b1fed6d9d2b5b2375d19cd851
MD5 fa4642e8ae79dda46796c3f6d783cf87
SHA1 0a7b8bdbd9b68c617cb7c609294e9522cd4b86ad
SHA512 a53f641ee858d61f8d602f613bbb499b51107be0b1156a15c7c6a289703c4a98e556afd9b764d3f94d30c037f9db046468c5f9c8c8523836b1f366bc53887903
SSDEEP 768:e+yvIZwWvu+Q+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVDFLlwmW7RrombqL:e+yvIZwWvu+Q+u1jamFLeR7qmy
TLSH
T1F5C2F92B640CCB7E5F801A9DDD5A6F9B3EA802CB67588D4047FD994C02C77EA512A4CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 e2c53bb0dec78149fb325f2009a837ddac73f1885d72122ce0e90132580d00c8
MD5 acdf0a60f33e1c0b08058aa8cef28a46
SHA1 78f1b6817be4745444f9c7aeeade95283e4308cb
SHA512 bcd850dae2a2d68fe1609ae7e3475378ce46780750f74739195683c7c9876cd2ca2f44cf800ee53c001ba5ae77c8885b27a2b0b0a12016c58f101d9197233ff6
SSDEEP 96:KaRklRnHnqlPKZThqKLfTzqHxJSrBDaAYKhy+iVoZFf7Xkn76P59kKBB53ktlFa7:mTXjiVoZFf7Xe76B9hB53ulFafj
TLSH
T15B910006B13B029239BF685DA3A599368E4131637914E97F7FB800618B67E115DFC8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e4ccd6c0-374b-47d6-bcfe-e6eb599e8ff9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e4ccd6c0-374b-47d6-bcfe-e6eb599e8ff9.tmp
Size 11KB
SHA256 714761d68082f334b3494f88dacf3f3208b1e77d4381e1f695296c3c40516bee
MD5 5e356ece239ab60d0acc44276f1a3f37
SHA1 2a160d0cc420546c2385112f6c4c54f1fd51884f
SHA512 b73d020ca38e69e1e67d5cdaadaa6a8893f48c7c1a1345fb6cbec63de72f9cc528bda017c57004c1dece5b8a6eccc75fa5ce48beb2639f229e65e5e4b5a40c10
SSDEEP 192:sxZvR5yD/fDsTzWpVF7d5eYoVpIdpEQHW6+WNjxutfY9A6+DtiIgbSJ:sxZvaD/fDsTzWvNdYYo05HbGf/wi
TLSH
T17532B712AE34A97B8CC7D21DFA25BF13D6F9103255D11E68EAFC961C05E7ADD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 745b5e77da1e60bdbb46ca0b745dbf51f3e6e11610b0cb808cb44c81fb33fb6d
MD5 4d0a43dd6731f61aeeba4ea47d54546d
SHA1 c78091fb8acda8bf51ec9204144e07d330aae4d1
SHA512 d8f568c246d0a2cf0d876da8b5d039772cc83e8f60c3dfde430a178974e58433c05557ec0c5a4749cc94d22b2e96646ac820bd4153fe8d6d37f1a8a158c1a9a8
SSDEEP 192:uFLsNdnxpQHDBr+YLeiUQmiU11U64e+CGp+Fdes9omOQNWJiFqNLqyFKZGQ:usNdnPEBrzirAle+CndHeRePIXFa
TLSH
T128424B31AC742D7B9EE36545F44636138FB891A7DAC62F94A6EC9F0C02DFADC1306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 17KB
SHA256 05985d353c1c05f94fcf233dfd4466ca4a37890f8ea3f7162665a25d8d8cf3d7
MD5 40092ccb4bd2d15a363b1fd06047a6a7
SHA1 52552859a6f99304f6e6a55474518ca8b8a9331e
SHA512 8b545a86916406deb48b5eb0bee82413e19bf8d398c5e17b145701b1d82e847c35ba3a4845ba0b6d1e699dc08ba2088a9b195ef457911d57b6d873cd14677a5a
SSDEEP 384:EsNdnPEBrziaLle+CndHeRePH0v6A4BJRGbw9j4XFa:EicBHrUfEg2d4Ew9j4XE
TLSH
T14E8229B0D8A42CE745A2D0C5B582F5576EA855B7C8852F5CD2F8FB3C319FAF82322416
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 227eb6df941947ebcb1ecd102ce12a167b996b6ef3fde814ecdc11da18229239
MD5 faccf905868fb9f6545b68da3a1e203f
SHA1 cc87704c2ec18855a72cbd7b045b2e49d772b991
SHA512 3b012acf73eb9ea8e54bdb8650b9cf2f24236f8ca98d712238664c9d48f190912c9873211120b49a502f2021c64ce99cb6360ad2fc749c38cae6fce57c784c8d
SSDEEP 192:kONY6v+YLxQmiUyJnXh+CGp+Fdes9omOQNVCHFqNU6:kONY6vzz8Xh+CndHeReiIU6
TLSH
T1F4123C35AC382C6B9FE36945F48335175EA89277EA863F80E5EC6F0C02DF69C1306416
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 6521c7de743f48c8960503f459dfdfe3eefdcab641234b266a537afc571650e0
MD5 e4cfb78b9ef7e91f255d7462fac3b10e
SHA1 623e27adb8f231beda6e4edd5807d9198d8d03e1
SHA512 4836503e9c37e6575abbc942ff8e7573f3aeb54b80b0771b8bb00e943841fc0b6413d9d83ceb8a8ec866ccb68d1a5116ffb696d60792931ece968ca85d9311e8
SSDEEP 192:JONii6v+YLNQmiUyOnZh+CGp+Fdes9odusyPU6:JONii6vz/XZh+CndHe9IU6
TLSH
T13902FA35AD382C6B9FF26E45F48736235FE8117BE9952F80D9E81F1C01D765C2302826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 0b36d5c0ea8119cf5e7188f9e5631fcd8e0fb5d472b0f6ef1cdc5849c54d38db
MD5 20ee3e5d0e6bdcc9c02b1f62de4bad14
SHA1 934c3d9e5b8ee98183a6f32b08c73f36b5539398
SHA512 802b0272564be55c591a17c52d67f43c51a6bab8b8bf5314674b171b083b1c9f0c543c95f686c3875941a9df45744066953c7266b05f0fbec3e3fee70ec14072
TLSH
T1A0411AA8B6EA1149B3B37E569FF7A96D447E7C772E07D49E00110D4F0A23A40C961733
MD5 SHA1 SHA512 TLSH

Submit Download

8ab1e132-62be-459f-8a9f-d645ad441820.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2848_839188279\8ab1e132-62be-459f-8a9f-d645ad441820.tmp
Size 242KB
SHA256 81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82
MD5 541f52e24fe1ef9f8e12377a6ccae0c0
SHA1 189898bb2dcae7d5a6057bc2d98b8b450afaebb6
SHA512 d779d78a15c5efca51ebd6b96a7ccb6d718741bdf7d9a37f53b2eb4b98aa1a78bc4cfa57d6e763aab97276c8f9088940ac0476690d4d46023ff4bf52f3326c88
SSDEEP 3072:r+nmRykNgoldZ8GjJCiUXZSk+QSVh85PxEalRVHmcld9R6yYfEp4ABUGDcaKklrv:k3oF4Z4h45P99Fld9RBQYBVcaxlnfL
TLSH
T1F63402BD7D8AE686D006A17676C0B48BE1199F4E41CB7C0F668A89010D70F8C57B9DEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2848_839188279\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

uclient.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\uclient.lnk
Size 880B
SHA256 08481755f5dd841637042cdc33511a593f68acd5164960fe9c40b16b16ba5e0b
MD5 2155513c68ff0fa3c38cf6d0b5908c60
SHA1 39a7a0f0d1ca0a8e28a6c239c74fbafe8022297a
SHA512 0b36b4e0e794c7df03dfdb1dfbc08bcaeb439377c57d1a1dc733e6e57091109b4d733c40595ac1498512770e810e422b344ad1deb9df495d21447476799d02b9
TLSH
T16411F6284C952B31C3E0D6B199F72362DD333C43FFD91F0D00544689216AE122EA9E2B
MD5 SHA1 SHA512 TLSH

Submit Download

HTCTL32.DLL

Path C:\Users\Public\Documents\2226219\HTCTL32.DLL
Size 316KB
SHA256 6562585009f15155eea9a489e474cebc4dd2a01a26d846fdd1b93fdc24b0c269
MD5 051cdb6ac8e168d178e35489b6da4c74
SHA1 38c171457d160f8a6f26baa668f5c302f6c29cd1
SHA512 602ab9999f7164a2d1704f712d8a622d69148eefe9a380c30bc8b310eadedf846ce6ae7940317437d5da59404d141dc2d1e0c3f954ca4ac7ae3497e56fcb4e36
SSDEEP 6144:WyspIr8g8imeKk9Fv8TamdF3xuHGAimnx30aaY5nFJl8NjzGrn0J/d3M1OGg:WyspIr8g8i191uzdwHGAimd0bY5FJl85
TLSH
T105646C21BD80C031F2966175C57EDBBA0D6DA430376860DBBBD909F96F686D3663830B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NSM.LIC

Path C:\Users\Public\Documents\2226219\NSM.LIC
Size 251B
SHA256 53b4a9603905e7838842694a90549362d9ec25b6d22e1c4f3d6c14e040c7a76c
MD5 2ca7ac695c6b75bc547caad20bc74fea
SHA1 bcfef09ce64cfa2085598cf897e362ff4f57dd6c
SHA512 6ac3b8b7ad351c44270e6192dac1edeb585d75abab2ad4800b3920c41bb71482e43a0dab2bb8a9f6df45088acb0c690c12a1eab3b759de0792d4ed93ce600ed2
TLSH
T18ED02BC981236237478201617BA0445E828891658218299CB59D126718B55341E8D06C
MD5 SHA1 SHA512 TLSH

Submit Download

PCICAPI.dll

Path C:\Users\Public\Documents\2226219\PCICAPI.dll
Size 106KB
SHA256 2dfdc169dfc27462adc98dde39306de8d0526dcf4577a1a486c2eef447300689
MD5 67c53a770390e8c038060a1921c20da9
SHA1 49e63af91169c8ce7ef7de3d6a6fb9f8f739fa3a
SHA512 201e07dbccd83480d6c4d8562e6d0a9e4c52ed12895f0b91d875c2bbcc50b3b1802e11e5e829c948be302bf98ebde7fb2a99476065d1709b3bdbcd5d59a1612d
SSDEEP 1536:LnzOfAUs8aONOb2H4NECHnTXg05rQMb2bbaPrw6BkJElFBIboKKGQ1w:LnSfAB8cb2YN7pSy8AuElFBIboKKGSw
TLSH
T1EFB38D01B192C5B2F5CA497806CB6B774F3D76A17E2450D3AB60D9810E7A7B37B1E20B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PCICL32.dll

Path C:\Users\Public\Documents\2226219\PCICL32.dll
Size 3.3MB
SHA256 b6d4ad0231941e0637485ac5833e0fdc75db35289b54e70f3858b70d36d04c80
MD5 e7b92529ea10176fe35ba73fa4edef74
SHA1 fc5b325d433cde797f6ad0d8b1305d6fb16d4e34
SHA512 fb3a70e87772c1fb386ad8def6c7bdf325b8d525355d4386102649eb2d61f09ce101fce37ccc1f44d5878e604e2e426d96618e836367ab460cae01f627833517
SSDEEP 49152:FwWtZSlgPoqxyszApD0Ew0J94KinCgqGBQTdTBOHa3clSToWZiwDA:FwWrSlgHyszApD090mCgqTUSPE9
TLSH
T19EF51832E5048872E1564079DC7D6AEC451A6DA00F1881EF798EF9AD2EF23D533B4F1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

client32.ini

Path C:\Users\Public\Documents\2226219\client32.ini
Size 692B
SHA256 b4cb0da92dd3713bbf0122c337e723ccf54cb19922f4e3e3bac361d544c96c8c
MD5 41682dea24d94617b2f7a408344fb150
SHA1 0581f052d6b71e49b3b08130d499b015b1d21244
SHA512 f01188685c6e63f838f54d2b341fd083e51dcdc3cebdc9c04f95346f8836cf241ced1fa5b35e2d73aba31ccc2c7ed0e825bd47f1cf28f75fff96ca4434965d2d
TLSH
T12201F4011607AD5F128BFBD0A67400943FE30546A50C3A2297C45F1EAF76F5D44EEC99
MD5 SHA1 SHA512 TLSH

Submit Download

msvcr100.dll

Path C:\Users\Public\Documents\2226219\msvcr100.dll
Size 755KB
SHA256 8793353461826fbd48f25ea8b835be204b758ce7510db2af631b28850355bd18
MD5 0e37fbfa79d349d672456923ec5fbbe3
SHA1 4e880fc7625ccf8d9ca799d5b94ce2b1e7597335
SHA512 2bea9bd528513a3c6a54beac25096ee200a4e6ccfc2a308ae9cfd1ad8738e2e2defd477d59db527a048e5e9a4fe1fc1d771701de14ef82b4dbcdc90df0387630
SSDEEP 12288:nMmCy3nAgPAxN9ueqix/HEmxsvGrif8ZSy+rdQw2QRAtd74/vmYK6H3BVoe3z:MmCy3KxW3ixPEmxsvGrm8Z6r+JQPzV7z
TLSH
T1D3F49D11B692C073C1B221300629D7B25D7BB8711035946BBBD59F3E1FB47C1EA277AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pcichek.dll

Path C:\Users\Public\Documents\2226219\pcichek.dll
Size 14KB
SHA256 0cff893b1e7716d09fb74b7a0313b78a09f3f48c586d31fc5f830bd72ce8331f
MD5 3aabcd7c81425b3b9327a2bf643251c6
SHA1 ea841199baa7307280fc9e4688ac75e5624f2181
SHA512 97605b07be34948541462000345f1e8f9a9134d139448d4f331cefeeca6dad51c025fcab09d182b86e5a4a8e2f9412b3745ec86b514b0523497c821cb6b8c592
SSDEEP 192:uuYr6062b6Z1HVF6RRHXPPr+13fnYe+PjPIrI9FlP4r9ZCspE+TMlr78Vkf:uuYe72u6r+5nYPL7NheMr
TLSH
T1D562F7835BB41015EAE38FB15AF7C2565E36B7916FB4D1EF1190418A2E84FE02E2531B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uclient.exe

Path C:\Users\Public\Documents\2226219\uclient.exe
Size 33KB
SHA256 275e5b085534f64313b50cbdcb08ecd59c57d21c96bb937f140ee92a3d27f792
MD5 5a24676210bd317520fe30d048c9a106
SHA1 067ddd3fdd5451c2f5bf43b4b316f2165c6c4470
SHA512 28118405fa8446fd9d8ac37bc5ba26a8696732fa7c19e41aef3da4d049d23b21da1cc0def0a2fb66e2e4fbb0c0147f042ef5492bb537aba7376ba46ebc8f7648
SSDEEP 192:JXvg84ZVe9LQTsZ98A2QakMnCaJbZToyowJL/8Qpkqs1I1jw+ebCfaFagU:FvwamdkjgZMYJLu1SmbCSRU
TLSH
T1FAF2D503A254A4A1D8954B30F4D3D2F2DE35FE01EF95468731E97EAB3F5B7A11B2110A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download