hxxps://en[.]exloader[.]net/

Analysis

user interaction
yes
max time kernel
254s
max time network
258s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
09/08/2026, 11:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://en.exloader.net/
Sample260809-ny3hmazycx

Score

8^/10

bootkit defense_evasion discovery persistence spyware stealer

Malware Config

Signatures

Downloads MZ/PE file 2 IoCs

flow	pid	Process
298	1004	msedge.exe
374	4840	avast_free_antivirus_setup_online.exe

Executes dropped EXE 10 IoCs

pid	Process
5740	ExLoader.exe
5604	OperaSetup.exe
4940	installer.exe
2072	installer.exe
2924	installer.exe
4840	avast_free_antivirus_setup_online.exe
2196	installer.exe
6072	installer.exe
2684	avast_free_antivirus_online_setup.exe
5716	icarus.exe

Loads dropped DLL 9 IoCs

pid	Process
5740	ExLoader.exe
5740	ExLoader.exe
5740	ExLoader.exe
5740	ExLoader.exe
5740	ExLoader.exe
5740	ExLoader.exe
5740	ExLoader.exe
4840	avast_free_antivirus_setup_online.exe
2684	avast_free_antivirus_online_setup.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Checks for any installed AV software in registry 1 TTPs 4 IoCs

Security Software Discovery

T1518.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\AVAST Software\Avast\Version	ExLoader_Installer.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVAST Software\Avast\Version	ExLoader_Installer.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\AVG\AV\Dir	ExLoader_Installer.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVG\AV\Dir	ExLoader_Installer.exe

Enumerates connected drives 3 TTPs 4 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\D:	installer.exe
File opened (read-only)	\??\F:	installer.exe
File opened (read-only)	\??\D:	installer.exe
File opened (read-only)	\??\F:	installer.exe

Looks up external IP address via web service 1 TTPs 10 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
342	ipapi.co
357	api.ipify.org
358	ipapi.co
69	ipapi.co
82	ipapi.co
339	api.ipify.org
340	api.ipify.org
70	ipapi.co
241	ipapi.co
341	ipapi.co

Writes to the Master Boot Record (MBR) 1 TTPs 3 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	avast_free_antivirus_setup_online.exe
File opened for modification	\??\PhysicalDrive0	avast_free_antivirus_online_setup.exe
File opened for modification	\??\PhysicalDrive0	icarus.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\ExLoader\data\flutter_assets\AssetManifest.bin	ExLoader_Installer.exe
File opened for modification	C:\Program Files\ExLoader\data\flutter_assets\resources\audio\Fortnite_hover.wav	ExLoader_Installer.exe
File opened for modification	C:\Program Files\ExLoader\data\flutter_assets\resources\images\bios.png	ExLoader_Installer.exe
File opened for modification	C:\Program Files\ExLoader\data\flutter_assets\resources\images\debug.png	ExLoader_Installer.exe
File opened for modification	C:\Program Files\ExLoader\data\flutter_assets\resources\images\font.png	ExLoader_Installer.exe
File opened for modification	C:\Program Files\ExLoader\data\flutter_assets\resources\images\trash.png	ExLoader_Installer.exe
File opened for modification	C:\Program Files\ExLoader\data\flutter_assets\resources\backgrounds\Halloween.jpg	ExLoader_Installer.exe
File opened for modification	C:\Program Files\ExLoader\data\flutter_assets\resources\backgrounds\SpaceDay.jpg	ExLoader_Installer.exe
File opened for modification	C:\Program Files\ExLoader\data\flutter_assets\resources\images\grain.png	ExLoader_Installer.exe
File opened for modification	C:\Program Files\ExLoader\data\flutter_assets\resources\images\monitor.png	ExLoader_Installer.exe
File opened for modification	C:\Program Files\ExLoader\data\flutter_assets\resources\images\rocket.png	ExLoader_Installer.exe
File opened for modification	C:\Program Files\ExLoader\data\flutter_assets\resources\shaders\winter.frag	ExLoader_Installer.exe
File opened for modification	C:\Program Files\ExLoader\data\flutter_assets\resources\audio\Csgo_hover.wav	ExLoader_Installer.exe
File opened for modification	C:\Program Files\ExLoader\data\flutter_assets\resources\backgrounds\FishingDay.jpg	ExLoader_Installer.exe
File opened for modification	C:\Program Files\ExLoader\data\flutter_assets\resources\backgrounds\SummerStart.jpg	ExLoader_Installer.exe
File opened for modification	C:\Program Files\ExLoader\data\flutter_assets\resources\flags\mn.png	ExLoader_Installer.exe
File opened for modification	C:\Program Files\ExLoader\data\flutter_assets\resources\flags\uk.png	ExLoader_Installer.exe
File opened for modification	C:\Program Files\ExLoader\data\flutter_assets\resources\images\fps.png	ExLoader_Installer.exe
File opened for modification	C:\Program Files\ExLoader\data\flutter_assets\resources\images\shortcut.png	ExLoader_Installer.exe
File opened for modification	C:\Program Files\ExLoader\data\flutter_assets\resources\shaders\modification_card_image.frag	ExLoader_Installer.exe
File opened for modification	C:\Program Files\ExLoader\data\flutter_assets\resources\images\celebrate.png	ExLoader_Installer.exe
File opened for modification	C:\Program Files\ExLoader\data\flutter_assets\resources\flags\hi.png	ExLoader_Installer.exe
File opened for modification	C:\Program Files\ExLoader\data\flutter_assets\resources\flags\id.png	ExLoader_Installer.exe
File opened for modification	C:\Program Files\ExLoader\data\flutter_assets\resources\audio\Steam_press.wav	ExLoader_Installer.exe
File opened for modification	C:\Program Files\ExLoader\data\flutter_assets\resources\backgrounds\Easter.jpg	ExLoader_Installer.exe
File opened for modification	C:\Program Files\ExLoader\data\flutter_assets\resources\backgrounds\God%20of%20War.jpg	ExLoader_Installer.exe
File opened for modification	C:\Program Files\ExLoader\data\icudtl.dat	ExLoader_Installer.exe
File opened for modification	C:\Program Files\ExLoader\data\flutter_assets\resources\audio\Standard_press.wav	ExLoader_Installer.exe
File opened for modification	C:\Program Files\ExLoader\data\flutter_assets\resources\audio\Steam_hover.wav	ExLoader_Installer.exe
File opened for modification	C:\Program Files\ExLoader\data\flutter_assets\resources\flags\uz.png	ExLoader_Installer.exe
File opened for modification	C:\Program Files\ExLoader\data\flutter_assets\resources\fonts\NoirPro-Light.otf	ExLoader_Installer.exe
File opened for modification	C:\Program Files\ExLoader\data\flutter_assets\resources\images\fun.png	ExLoader_Installer.exe
File opened for modification	C:\Program Files\ExLoader\data\flutter_assets\resources\images\snowflake.webp	ExLoader_Installer.exe
File opened for modification	C:\Program Files\ExLoader\data\flutter_assets\FontManifest.json	ExLoader_Installer.exe
File opened for modification	C:\Program Files\ExLoader\data\flutter_assets\resources\audio\AbominationPissed_EN.wav	ExLoader_Installer.exe
File opened for modification	C:\Program Files\ExLoader\data\flutter_assets\resources\backgrounds\JokeDay.jpg	ExLoader_Installer.exe
File opened for modification	C:\Program Files\ExLoader\data\flutter_assets\resources\flags\es.png	ExLoader_Installer.exe
File opened for modification	C:\Program Files\ExLoader\data\flutter_assets\resources\flags\ru.png	ExLoader_Installer.exe
File opened for modification	C:\Program Files\ExLoader\data\flutter_assets\resources\flags\tr.png	ExLoader_Installer.exe
File opened for modification	C:\Program Files\ExLoader\data\flutter_assets\resources\images\fullscreen.png	ExLoader_Installer.exe
File opened for modification	C:\Program Files\ExLoader\data\flutter_assets\resources\images\opacity.png	ExLoader_Installer.exe
File created	C:\Program Files\ExLoader\ExLoader.zip	ExLoader_Installer.exe
File opened for modification	C:\Program Files\ExLoader\url_launcher_windows_plugin.dll	ExLoader_Installer.exe
File opened for modification	C:\Program Files\ExLoader\data\flutter_assets\resources\flags\ar.png	ExLoader_Installer.exe
File opened for modification	C:\Program Files\ExLoader\data\flutter_assets\resources\flags\pt.png	ExLoader_Installer.exe
File opened for modification	C:\Program Files\ExLoader\data\flutter_assets\resources\images\crash.png	ExLoader_Installer.exe
File opened for modification	C:\Program Files\ExLoader\data\flutter_assets\resources\images\offline.png	ExLoader_Installer.exe
File opened for modification	C:\Program Files\ExLoader\data\flutter_assets\resources\images\updates.png	ExLoader_Installer.exe
File opened for modification	C:\Program Files\ExLoader\audioplayers_windows_plugin.dll	ExLoader_Installer.exe
File opened for modification	C:\Program Files\ExLoader\permission_handler_windows_plugin.dll	ExLoader_Installer.exe
File opened for modification	C:\Program Files\ExLoader\vcruntime140_1.dll	ExLoader_Installer.exe
File opened for modification	C:\Program Files\ExLoader\data\flutter_assets\resources\backgrounds\Halo.jpg	ExLoader_Installer.exe
File opened for modification	C:\Program Files\ExLoader\data\flutter_assets\resources\backgrounds\NewYear.jpg	ExLoader_Installer.exe
File opened for modification	C:\Program Files\ExLoader\data\flutter_assets\resources\backgrounds\TastyFoodDay.jpg	ExLoader_Installer.exe
File opened for modification	C:\Program Files\ExLoader\data\flutter_assets\resources\images\hitbox.png	ExLoader_Installer.exe
File opened for modification	C:\Program Files\ExLoader\data\flutter_assets\resources\images\ping.png	ExLoader_Installer.exe
File opened for modification	C:\Program Files\ExLoader\data\flutter_assets\resources\images\translate.png	ExLoader_Installer.exe
File opened for modification	C:\Program Files\ExLoader\data\flutter_assets\resources\flags\kk.png	ExLoader_Installer.exe
File opened for modification	C:\Program Files\ExLoader\data\flutter_assets\resources\images\platform.png	ExLoader_Installer.exe
File opened for modification	C:\Program Files\ExLoader\data\flutter_assets\resources\images\wall.png	ExLoader_Installer.exe
File opened for modification	C:\Program Files\ExLoader\data\flutter_assets\resources\audio\AbominationPissed_RU.wav	ExLoader_Installer.exe
File opened for modification	C:\Program Files\ExLoader\data\flutter_assets\resources\images\bin.png	ExLoader_Installer.exe
File opened for modification	C:\Program Files\ExLoader\data\flutter_assets\resources\images\magnifier.png	ExLoader_Installer.exe
File opened for modification	C:\Program Files\ExLoader\data\flutter_assets\resources\images\privacy.png	ExLoader_Installer.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\OperaGXSetup.exe:Zone.Identifier	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	avast_free_antivirus_online_setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OperaSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	avast_free_antivirus_setup_online.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1004	msedge.exe

Enumerates system info in registry 2 TTPs 7 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	installer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	installer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	installer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	installer.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134307497611291588"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 15 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\C06AEB9D-8774-46E7-8160-8321BCD14D9F\56C7A9DA-4B11-406A-8B1A-EFF157C294D6 = "bba97b37-3fe3-499e-be74-dd0e6e19967a"	avast_free_antivirus_online_setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1679180529-4058988202-686829476-1000\{75FBEE77-3FE6-4D78-9688-AD808B92E5BE}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\C06AEB9D-8774-46E7-8160-8321BCD14D9F	avast_free_antivirus_online_setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\C06AEB9D-8774-46E7-8160-8321BCD14D9F\7CCD586D-2ABC-42FF-A23B-3731F4F183D9 = "0EC03442A4E93B807782D73BF46C389D"	avast_free_antivirus_online_setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\C06AEB9D-8774-46E7-8160-8321BCD14D9F\5E1D6A55-0134-486E-A166-38C2E4919BB1 = "AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAlDVHcVYQiEuV13er4rcTqwQAAAACAAAAAAAQZgAAAAEAACAAAADL2PHoMHyMaAMVmRTZ7AIYSJFh9NC+Te84VXrNBhk5UwAAAAAOgAAAAAIAACAAAADDpU76I5dmlKl13nIrgr4u9BTmUlF2fk7F17vEpFuNOoAAAADYYdyI1oX67elbFpgt3QcNt89aqZbcsY/OMsVhPh+V02MuLHE7ntNXcdsugpM5ToRsOikSyz+hakQjhvrfT9ICA+y3sOcEH8foCRjUYAMKDWIJ/N5xNC1anOOTpEdKzLGNuhNz4i4YwVLfmKxcp2yX0XMnzfjpSHV1Gn3hv3hhykAAAACinuSAbgCm7dEXWQ1zKlJq0miWferrgyjsvU+MDK8tfs6VGF/y18v0eYqAqBOj8Cyh2wHbuZkp7/0xAehOHzOP"	avast_free_antivirus_online_setup.exe

NTFS ADS 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\ExLoader_Installer.zip:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\ExLoader_Installer (1).zip:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\OperaGXSetup.exe:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1856	msedge.exe
1856	msedge.exe
3608	ExLoader_Installer.exe
3608	ExLoader_Installer.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 22 IoCs

pid	Process
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeRestorePrivilege	5716	icarus.exe
Token: SeTakeOwnershipPrivilege	5716	icarus.exe
Token: SeRestorePrivilege	5716	icarus.exe
Token: SeTakeOwnershipPrivilege	5716	icarus.exe
Token: SeRestorePrivilege	5716	icarus.exe
Token: SeTakeOwnershipPrivilege	5716	icarus.exe
Token: SeRestorePrivilege	5716	icarus.exe
Token: SeTakeOwnershipPrivilege	5716	icarus.exe
Token: SeDebugPrivilege	5716	icarus.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3608	ExLoader_Installer.exe
3608	ExLoader_Installer.exe
5740	ExLoader.exe
5740	ExLoader.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5144 wrote to memory of 3196	5144	msedge.exe	81
PID 5144 wrote to memory of 1004	5144	msedge.exe	82
PID 5144 wrote to memory of 1648	5144	msedge.exe	83
PID 5144 wrote to memory of 1648	5144	msedge.exe	83
PID 5144 wrote to memory of 1648	5144	msedge.exe	83
PID 5144 wrote to memory of 340	5144	msedge.exe	84
PID 5144 wrote to memory of 340	5144	msedge.exe	84
PID 5144 wrote to memory of 3068	5144	msedge.exe	86
PID 5144 wrote to memory of 3068	5144	msedge.exe	86
PID 5144 wrote to memory of 3068	5144	msedge.exe	86
PID 5144 wrote to memory of 2316	5144	msedge.exe	87
PID 5144 wrote to memory of 2316	5144	msedge.exe	87
PID 5144 wrote to memory of 2316	5144	msedge.exe	87
PID 5144 wrote to memory of 1292	5144	msedge.exe	89
PID 5144 wrote to memory of 3964	5144	msedge.exe	90
PID 5144 wrote to memory of 2804	5144	msedge.exe	91
PID 5144 wrote to memory of 664	5144	msedge.exe	92
PID 5144 wrote to memory of 1292	5144	msedge.exe	89
PID 5144 wrote to memory of 1292	5144	msedge.exe	89
PID 5144 wrote to memory of 3964	5144	msedge.exe	90
PID 5144 wrote to memory of 3964	5144	msedge.exe	90
PID 5144 wrote to memory of 2804	5144	msedge.exe	91
PID 5144 wrote to memory of 2804	5144	msedge.exe	91
PID 5144 wrote to memory of 664	5144	msedge.exe	92
PID 5144 wrote to memory of 664	5144	msedge.exe	92
PID 5144 wrote to memory of 5208	5144	msedge.exe	94
PID 5144 wrote to memory of 5396	5144	msedge.exe	95
PID 5144 wrote to memory of 5208	5144	msedge.exe	94
PID 5144 wrote to memory of 5396	5144	msedge.exe	95
PID 5144 wrote to memory of 5508	5144	msedge.exe	96
PID 5508 wrote to memory of 5492	5508	msedge.exe	97
PID 5144 wrote to memory of 3948	5144	msedge.exe	99
PID 5144 wrote to memory of 428	5144	msedge.exe	100
PID 5144 wrote to memory of 428	5144	msedge.exe	100
PID 5144 wrote to memory of 5752	5144	msedge.exe	101
PID 5144 wrote to memory of 5752	5144	msedge.exe	101
PID 5144 wrote to memory of 5752	5144	msedge.exe	101
PID 5144 wrote to memory of 2580	5144	msedge.exe	102
PID 5144 wrote to memory of 2580	5144	msedge.exe	102
PID 5144 wrote to memory of 2580	5144	msedge.exe	102
PID 5144 wrote to memory of 4872	5144	msedge.exe	103
PID 5144 wrote to memory of 4872	5144	msedge.exe	103
PID 5144 wrote to memory of 4872	5144	msedge.exe	103
PID 5144 wrote to memory of 4124	5144	msedge.exe	104
PID 5144 wrote to memory of 4124	5144	msedge.exe	104
PID 5144 wrote to memory of 4124	5144	msedge.exe	104
PID 5144 wrote to memory of 2616	5144	msedge.exe	105
PID 5144 wrote to memory of 2616	5144	msedge.exe	105
PID 5144 wrote to memory of 2616	5144	msedge.exe	105
PID 5144 wrote to memory of 2344	5144	msedge.exe	106
PID 5144 wrote to memory of 3952	5144	msedge.exe	107
PID 5144 wrote to memory of 1660	5144	msedge.exe	108
PID 5144 wrote to memory of 1556	5144	msedge.exe	110
PID 5144 wrote to memory of 3436	5144	msedge.exe	111
PID 5144 wrote to memory of 3436	5144	msedge.exe	111
PID 5144 wrote to memory of 3436	5144	msedge.exe	111
PID 5144 wrote to memory of 5640	5144	msedge.exe	112
PID 5144 wrote to memory of 5640	5144	msedge.exe	112
PID 5144 wrote to memory of 4852	5144	msedge.exe	114
PID 5144 wrote to memory of 4852	5144	msedge.exe	114
PID 5144 wrote to memory of 4852	5144	msedge.exe	114
PID 5144 wrote to memory of 2952	5144	msedge.exe	115
PID 5144 wrote to memory of 2952	5144	msedge.exe	115
PID 5144 wrote to memory of 2952	5144	msedge.exe	115

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://en.exloader.net/
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2a8,0x7ff840dfc188,0x7ff840dfc194,0x7ff840dfc1a0
  2⤵
  PID:3196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1808,i,5995734149680986206,6662391110231423678,524288 --field-trial-handle=2240,i,2625795157992945049,15237603111314484115,262144 --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:1004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1628,i,9560511004484723376,9766838505302589931,262144 --field-trial-handle=2240,i,2625795157992945049,15237603111314484115,262144 --variations-seed-version --mojo-platform-channel-handle=2236 /prefetch:2
  2⤵
  PID:1648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2340,i,240060795060165922,7566420199206152078,524288 --field-trial-handle=2240,i,2625795157992945049,15237603111314484115,262144 --variations-seed-version --mojo-platform-channel-handle=2604 /prefetch:13
  2⤵
  PID:340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3504,i,169051364202713257,5901854467461219699,2097152 --field-trial-handle=2240,i,2625795157992945049,15237603111314484115,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
  2⤵
  PID:3068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3508,i,18055425741421359828,16159173175586310473,2097152 --field-trial-handle=2240,i,2625795157992945049,15237603111314484115,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:1
  2⤵
  PID:2316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4212,i,14533781800327956948,8319924216450945961,2097152 --field-trial-handle=2240,i,2625795157992945049,15237603111314484115,262144 --variations-seed-version --mojo-platform-channel-handle=4380 /prefetch:1
  2⤵
  PID:1292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4224,i,12075901620482662508,14733704018931055931,2097152 --field-trial-handle=2240,i,2625795157992945049,15237603111314484115,262144 --variations-seed-version --mojo-platform-channel-handle=4408 /prefetch:9
  2⤵
  PID:3964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4236,i,1302018273615662100,17783943298596030019,2097152 --field-trial-handle=2240,i,2625795157992945049,15237603111314484115,262144 --variations-seed-version --mojo-platform-channel-handle=4440 /prefetch:1
  2⤵
  PID:2804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4248,i,14093194255701696423,17373096622245843576,2097152 --field-trial-handle=2240,i,2625795157992945049,15237603111314484115,262144 --variations-seed-version --mojo-platform-channel-handle=4488 /prefetch:9
  2⤵
  PID:664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4836,i,542610778819216172,4818171406367079215,524288 --field-trial-handle=2240,i,2625795157992945049,15237603111314484115,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:14
  2⤵
  PID:5208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4820,i,10243309613528969460,10056418318885706190,524288 --field-trial-handle=2240,i,2625795157992945049,15237603111314484115,262144 --variations-seed-version --mojo-platform-channel-handle=4828 /prefetch:14
  2⤵
  PID:5396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5872,i,17352651330183352794,11888587305890581530,524288 --field-trial-handle=2240,i,2625795157992945049,15237603111314484115,262144 --variations-seed-version --mojo-platform-channel-handle=5832 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5508
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1140
    3⤵
    PID:5492
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6076,i,10994342377045103559,3778268755650440447,524288 --field-trial-handle=2240,i,2625795157992945049,15237603111314484115,262144 --variations-seed-version --mojo-platform-channel-handle=6092 /prefetch:14
  2⤵
  PID:5488
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6076,i,10994342377045103559,3778268755650440447,524288 --field-trial-handle=2240,i,2625795157992945049,15237603111314484115,262144 --variations-seed-version --mojo-platform-channel-handle=6092 /prefetch:14
  2⤵
  PID:3948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6548,i,719517003916899560,7427478394349410083,524288 --field-trial-handle=2240,i,2625795157992945049,15237603111314484115,262144 --variations-seed-version --mojo-platform-channel-handle=6532 /prefetch:14
  2⤵
  PID:428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6656,i,17538919881171020609,1545604752159366178,2097152 --field-trial-handle=2240,i,2625795157992945049,15237603111314484115,262144 --variations-seed-version --mojo-platform-channel-handle=4972 /prefetch:1
  2⤵
  PID:5752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=5080,i,4164642322100948337,7475992435272925699,2097152 --field-trial-handle=2240,i,2625795157992945049,15237603111314484115,262144 --variations-seed-version --mojo-platform-channel-handle=5108 /prefetch:1
  2⤵
  PID:2580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6820,i,7924354807382444469,10652748401133538618,2097152 --field-trial-handle=2240,i,2625795157992945049,15237603111314484115,262144 --variations-seed-version --mojo-platform-channel-handle=6848 /prefetch:1
  2⤵
  PID:4872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6964,i,14539830454632304241,3210881581992395681,2097152 --field-trial-handle=2240,i,2625795157992945049,15237603111314484115,262144 --variations-seed-version --mojo-platform-channel-handle=6992 /prefetch:1
  2⤵
  PID:4124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=4912,i,8575814077174650348,5647239924183669444,2097152 --field-trial-handle=2240,i,2625795157992945049,15237603111314484115,262144 --variations-seed-version --mojo-platform-channel-handle=4924 /prefetch:1
  2⤵
  PID:2616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5072,i,14796756137494776276,2295877210240635319,524288 --field-trial-handle=2240,i,2625795157992945049,15237603111314484115,262144 --variations-seed-version --mojo-platform-channel-handle=564 /prefetch:14
  2⤵
  PID:2344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6136,i,12701997380716340934,15223902263806609462,524288 --field-trial-handle=2240,i,2625795157992945049,15237603111314484115,262144 --variations-seed-version --mojo-platform-channel-handle=6808 /prefetch:14
  2⤵
  PID:3952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6632,i,15731878024886852885,8837460555412418021,524288 --field-trial-handle=2240,i,2625795157992945049,15237603111314484115,262144 --variations-seed-version --mojo-platform-channel-handle=6920 /prefetch:14
  2⤵
  PID:1660
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6568,i,543523994450533450,18038432242643469575,524288 --field-trial-handle=2240,i,2625795157992945049,15237603111314484115,262144 --variations-seed-version --mojo-platform-channel-handle=6572 /prefetch:14
  2⤵
  PID:4744
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6568,i,543523994450533450,18038432242643469575,524288 --field-trial-handle=2240,i,2625795157992945049,15237603111314484115,262144 --variations-seed-version --mojo-platform-channel-handle=6572 /prefetch:14
  2⤵
  PID:1556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=7080,i,5679546828939600400,17262818239163062603,2097152 --field-trial-handle=2240,i,2625795157992945049,15237603111314484115,262144 --variations-seed-version --mojo-platform-channel-handle=7100 /prefetch:1
  2⤵
  PID:3436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4960,i,17339057639039767178,2232611015669741063,524288 --field-trial-handle=2240,i,2625795157992945049,15237603111314484115,262144 --variations-seed-version --mojo-platform-channel-handle=4232 /prefetch:14
  2⤵
  PID:5640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=4504,i,8880443309009111997,399619506099776262,2097152 --field-trial-handle=2240,i,2625795157992945049,15237603111314484115,262144 --variations-seed-version --mojo-platform-channel-handle=3088 /prefetch:1
  2⤵
  PID:4852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=6648,i,3765734130698501774,16575297363822482957,2097152 --field-trial-handle=2240,i,2625795157992945049,15237603111314484115,262144 --variations-seed-version --mojo-platform-channel-handle=4476 /prefetch:1
  2⤵
  PID:2952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=6800,i,8660150904912763694,1760069844014291346,2097152 --field-trial-handle=2240,i,2625795157992945049,15237603111314484115,262144 --variations-seed-version --mojo-platform-channel-handle=6892 /prefetch:1
  2⤵
  PID:4496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=7264,i,12960687183254966001,14714619658988074323,2097152 --field-trial-handle=2240,i,2625795157992945049,15237603111314484115,262144 --variations-seed-version --mojo-platform-channel-handle=7100 /prefetch:1
  2⤵
  PID:1568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=6712,i,5578528056145258967,6317277489724393101,2097152 --field-trial-handle=2240,i,2625795157992945049,15237603111314484115,262144 --variations-seed-version --mojo-platform-channel-handle=5124 /prefetch:1
  2⤵
  PID:5952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6632,i,1218139913569921922,11440053885601327634,524288 --field-trial-handle=2240,i,2625795157992945049,15237603111314484115,262144 --variations-seed-version --mojo-platform-channel-handle=4812 /prefetch:14
  2⤵
  PID:4840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=6920,i,6031248676279176638,3383964567679960901,2097152 --field-trial-handle=2240,i,2625795157992945049,15237603111314484115,262144 --variations-seed-version --mojo-platform-channel-handle=7132 /prefetch:1
  2⤵
  PID:5868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7324,i,15580850548125879305,1785321154794182864,524288 --field-trial-handle=2240,i,2625795157992945049,15237603111314484115,262144 --variations-seed-version --mojo-platform-channel-handle=6596 /prefetch:14
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:3804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=7644,i,9816160944960110255,10930022709847574880,2097152 --field-trial-handle=2240,i,2625795157992945049,15237603111314484115,262144 --variations-seed-version --mojo-platform-channel-handle=7656 /prefetch:1
  2⤵
  PID:1676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=8676,i,15523185205514762495,11084623778007373096,2097152 --field-trial-handle=2240,i,2625795157992945049,15237603111314484115,262144 --variations-seed-version --mojo-platform-channel-handle=8672 /prefetch:1
  2⤵
  PID:2716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8388,i,822264120810834826,7664997594869156699,524288 --field-trial-handle=2240,i,2625795157992945049,15237603111314484115,262144 --variations-seed-version --mojo-platform-channel-handle=8372 /prefetch:14
  2⤵
  - NTFS ADS
  PID:1624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=4000,i,14234207245168298801,8936025140077525277,2097152 --field-trial-handle=2240,i,2625795157992945049,15237603111314484115,262144 --variations-seed-version --mojo-platform-channel-handle=5324 /prefetch:1
  2⤵
  PID:2956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8364,i,15828753811177757722,18112257132221936623,524288 --field-trial-handle=2240,i,2625795157992945049,15237603111314484115,262144 --variations-seed-version --mojo-platform-channel-handle=7452 /prefetch:14
  2⤵
  - NTFS ADS
  PID:6072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=8440,i,17774933121085598094,13853618538619399718,262144 --field-trial-handle=2240,i,2625795157992945049,15237603111314484115,262144 --variations-seed-version --mojo-platform-channel-handle=7560 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6392,i,8002040889220771257,16125155055219783318,524288 --field-trial-handle=2240,i,2625795157992945049,15237603111314484115,262144 --variations-seed-version --mojo-platform-channel-handle=2472 /prefetch:14
  2⤵
  PID:4920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6388,i,5119961536894860622,12629932009469768582,524288 --field-trial-handle=2240,i,2625795157992945049,15237603111314484115,262144 --variations-seed-version --mojo-platform-channel-handle=7316 /prefetch:14
  2⤵
  PID:3596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7640,i,6035471703273826585,16563282571844757041,524288 --field-trial-handle=2240,i,2625795157992945049,15237603111314484115,262144 --variations-seed-version --mojo-platform-channel-handle=5440 /prefetch:14
  2⤵
  PID:4484

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4412

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5820

C:\Users\Admin\Downloads\ExLoader_Installer (1)\ExLoader_Installer.exe
"C:\Users\Admin\Downloads\ExLoader_Installer (1)\ExLoader_Installer.exe"
1⤵
- Checks for any installed AV software in registry
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3608
- C:\Program Files\ExLoader\ExLoader.exe
  "C:\Program Files\ExLoader\ExLoader.exe" -randomizeAppFolderAndAppTitleNames ExLoader
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:5740
- - C:\Program Files\ExLoader\openyear.exe
    "C:\Program Files\ExLoader\openyear.exe"
    3⤵
    PID:688
- C:\Users\Admin\AppData\Local\Temp\OperaSetup.exe
  "C:\Users\Admin\AppData\Local\Temp\OperaSetup.exe" --silent --allusers=0
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5604
- - C:\Users\Admin\AppData\Local\Temp\7zS4E52B68A\installer.exe
    C:\Users\Admin\AppData\Local\Temp\7zS4E52B68A\installer.exe --silent --allusers=0 --server-tracking-blob=ODE0Mzk5MWU4NDMyOGIzYjAyMmYyMzQ2YzBiMmIxZjIzNzY5MmU5ODJmMzE3ZjBjNDdmNGI1MWZjYTc1NTY3NDp7ImNvdW50cnkiOiJHQiIsImZhc3Rfb25ib2FyZGluZyI6e30sImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijoib3BlcmEiLCJxdWVyeSI6Ii9vcGVyYS9zdGFibGU/dXRtX21lZGl1bT1hcGImdXRtX3NvdXJjZT1PRlQmdXRtX2NhbXBhaWduPU5FV19fMTgyMjZhIiwidGltZXN0YW1wIjoiMTc4NjI3NjMzMS43MzMyIiwidXNlcmFnZW50IjoiRGFydC8zLjEyIChkYXJ0OmlvKSIsInV0bSI6eyJjYW1wYWlnbiI6Ik5FV19fMTgyMjZhIiwibWVkaXVtIjoiYXBiIiwic291cmNlIjoiT0ZUIn0sInV1aWQiOiJhMjE3ZWYzZS1lZjdiLTQwZTYtYTc1Yi02ZDFmNDAyZTJlNTcifQ==
    3⤵
    - Executes dropped EXE
    - Enumerates connected drives
    - Enumerates system info in registry
    PID:4940
  - - C:\Users\Admin\AppData\Local\Temp\7zS4E52B68A\installer.exe
      C:\Users\Admin\AppData\Local\Temp\7zS4E52B68A\installer.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=134.0.5954.46 --initial-client-data=0x288,0x28c,0x290,0x264,0x294,0x7ff6a1ecad88,0x7ff6a1ecad94,0x7ff6a1ecada0
      4⤵
      Executes dropped EXE
      PID:2072
  - - C:\Users\Admin\AppData\Local\Temp\.opera\8e2bef45-850f-4369-bf4f-418e76d8beec Opera Installer Temp\installer.exe
      "C:\Users\Admin\AppData\Local\Temp\.opera\8e2bef45-850f-4369-bf4f-418e76d8beec Opera Installer Temp\installer.exe" --version
      4⤵
      Executes dropped EXE
      PID:2924
  - - C:\Users\Admin\AppData\Local\Temp\7zS4E52B68A\installer.exe
      "C:\Users\Admin\AppData\Local\Temp\7zS4E52B68A\installer.exe" --backend --install --import-browser-data=0 --enable-crash-reporting=1 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --showunbox=0 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=0 --pintotaskbar=1 --pintostartmenu=0 --run-at-startup=1 --show-intro-overlay --server-tracking-data=server_tracking_data --initial-pid=4940 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\8e2bef45-850f-4369-bf4f-418e76d8beec Opera Installer Temp\opera_package_20260809125211" --session-guid=31bd5bc5-5635-4445-a0a7-8ef69498af40 --server-tracking-blob=YThhZmVkY2E5ZjVmODk0NmYyY2I4ZTE2Zjg3OWNiZTQ2MTMyMmIzODJjZGI1NWVhODc3MDZkNTFiYTQxMDAyMzp7ImNvdW50cnkiOiJHQiIsImZhc3Rfb25ib2FyZGluZyI6e30sImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGU/dXRtX21lZGl1bT1hcGImdXRtX3NvdXJjZT1PRlQmdXRtX2NhbXBhaWduPU5FV19fMTgyMjZhIiwic3lzdGVtIjp7InBsYXRmb3JtIjp7ImFyY2giOiJ4ODZfNjQiLCJvcHN5cyI6IldpbmRvd3MiLCJvcHN5cy12ZXJzaW9uIjoiMTEiLCJwYWNrYWdlIjoiRVhFIn19LCJ0aW1lc3RhbXAiOiIxNzg2Mjc2MzMxLjczMzIiLCJ1c2VyYWdlbnQiOiJEYXJ0LzMuMTIgKGRhcnQ6aW8pIiwidXRtIjp7ImNhbXBhaWduIjoiTkVXX18xODIyNmEiLCJtZWRpdW0iOiJhcGIiLCJzb3VyY2UiOiJPRlQifSwidXVpZCI6ImEyMTdlZjNlLWVmN2ItNDBlNi1hNzViLTZkMWY0MDJlMmU1NyJ9 --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=B008000000000000
      4⤵
      Executes dropped EXE
      Enumerates connected drives
      Enumerates system info in registry
      PID:2196
    - - C:\Users\Admin\AppData\Local\Temp\7zS4E52B68A\installer.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS4E52B68A\installer.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=134.0.5954.46 --initial-client-data=0x294,0x298,0x29c,0x264,0x2a0,0x7ff6a1ecad88,0x7ff6a1ecad94,0x7ff6a1ecada0
        5⤵
        Executes dropped EXE
        
        PID:6072
    - - C:\Users\Admin\AppData\Local\Programs\Opera\134.0.5954.46\installer.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\134.0.5954.46\installer.exe" --backend --initial-pid=4940 --install --import-browser-data=0 --enable-crash-reporting=1 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --showunbox=0 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=0 --pintotaskbar=1 --pintostartmenu=0 --run-at-startup=1 --server-tracking-data=server_tracking_data --show-intro-overlay --package-dir="C:\Users\Admin\AppData\Local\Temp\.opera\8e2bef45-850f-4369-bf4f-418e76d8beec Opera Installer Temp\opera_package_202608091252111" --session-guid=31bd5bc5-5635-4445-a0a7-8ef69498af40 --server-tracking-blob=YThhZmVkY2E5ZjVmODk0NmYyY2I4ZTE2Zjg3OWNiZTQ2MTMyMmIzODJjZGI1NWVhODc3MDZkNTFiYTQxMDAyMzp7ImNvdW50cnkiOiJHQiIsImZhc3Rfb25ib2FyZGluZyI6e30sImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGU/dXRtX21lZGl1bT1hcGImdXRtX3NvdXJjZT1PRlQmdXRtX2NhbXBhaWduPU5FV19fMTgyMjZhIiwic3lzdGVtIjp7InBsYXRmb3JtIjp7ImFyY2giOiJ4ODZfNjQiLCJvcHN5cyI6IldpbmRvd3MiLCJvcHN5cy12ZXJzaW9uIjoiMTEiLCJwYWNrYWdlIjoiRVhFIn19LCJ0aW1lc3RhbXAiOiIxNzg2Mjc2MzMxLjczMzIiLCJ1c2VyYWdlbnQiOiJEYXJ0LzMuMTIgKGRhcnQ6aW8pIiwidXRtIjp7ImNhbXBhaWduIjoiTkVXX18xODIyNmEiLCJtZWRpdW0iOiJhcGIiLCJzb3VyY2UiOiJPRlQifSwidXVpZCI6ImEyMTdlZjNlLWVmN2ItNDBlNi1hNzViLTZkMWY0MDJlMmU1NyJ9 --silent --desktopshortcut=1 --install-subfolder=134.0.5954.46
        5⤵
        
        PID:6160
      - C:\Users\Admin\AppData\Local\Programs\Opera\134.0.5954.46\installer.exe
        
        C:\Users\Admin\AppData\Local\Programs\Opera\134.0.5954.46\installer.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=134.0.5954.46 --initial-client-data=0x2a0,0x2a4,0x2a8,0x270,0x2ac,0x7ff770aead88,0x7ff770aead94,0x7ff770aeada0
        6⤵
        
        PID:6204
      - C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --ran-launcher --install-extension="C:\Users\Admin\AppData\Local\Temp\.opera\8e2bef45-850f-4369-bf4f-418e76d8beec Opera Installer Temp\opera_package_202608091252111\de932af914ba00303d4a2778a383ac9c831101e2.crx"
        6⤵
        
        PID:5384
        
        C:\Users\Admin\AppData\Local\Programs\Opera\134.0.5954.46\opera_crashreporter.exe
        
        C:\Users\Admin\AppData\Local\Programs\Opera\134.0.5954.46\opera_crashreporter.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=134.0.5954.46 --initial-client-data=0x274,0x278,0x27c,0x270,0x280,0x7ff81860f0d0,0x7ff81860f0e0,0x7ff81860f0f0
        7⤵
        
        PID:6732
  - - C:\Users\Admin\AppData\Local\Temp\.opera\8e2bef45-850f-4369-bf4f-418e76d8beec Opera Installer Temp\opera_package_202608091252111\assistant\Assistant_130.0.5847.41_Setup.exe_sfx.exe
      "C:\Users\Admin\AppData\Local\Temp\.opera\8e2bef45-850f-4369-bf4f-418e76d8beec Opera Installer Temp\opera_package_202608091252111\assistant\Assistant_130.0.5847.41_Setup.exe_sfx.exe"
      4⤵
      PID:5848
  - - C:\Users\Admin\AppData\Local\Temp\.opera\8e2bef45-850f-4369-bf4f-418e76d8beec Opera Installer Temp\opera_package_202608091252111\assistant\assistant_installer.exe
      "C:\Users\Admin\AppData\Local\Temp\.opera\8e2bef45-850f-4369-bf4f-418e76d8beec Opera Installer Temp\opera_package_202608091252111\assistant\assistant_installer.exe" --version
      4⤵
      PID:6248
    - - C:\Users\Admin\AppData\Local\Temp\.opera\8e2bef45-850f-4369-bf4f-418e76d8beec Opera Installer Temp\opera_package_202608091252111\assistant\assistant_installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\.opera\8e2bef45-850f-4369-bf4f-418e76d8beec Opera Installer Temp\opera_package_202608091252111\assistant\assistant_installer.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=130.0.5847.41 --initial-client-data=0x234,0x238,0x23c,0x210,0x240,0xd84040,0xd8404c,0xd84058
        5⤵
        
        PID:6272
- C:\Users\Admin\AppData\Local\Temp\avast_free_antivirus_setup_online.exe
  "C:\Users\Admin\AppData\Local\Temp\avast_free_antivirus_setup_online.exe" /silent
  2⤵
  - Downloads MZ/PE file
  - Executes dropped EXE
  - Loads dropped DLL
  - Writes to the Master Boot Record (MBR)
  - System Location Discovery: System Language Discovery
  PID:4840
- - C:\Windows\Temp\asw.a0064b38d836346d\avast_free_antivirus_online_setup.exe
    "C:\Windows\Temp\asw.a0064b38d836346d\avast_free_antivirus_online_setup.exe" /silent /cookie:mmm_ofg_ppi_008_368_m /ga_clientid:9e77c686-b539-4484-b851-da0a6279d451 /edat_dir:C:\Windows\Temp\asw.a0064b38d836346d /geo:GB
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Writes to the Master Boot Record (MBR)
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:2684
  - - C:\Windows\Temp\asw-9e77c686-b539-4484-b851-da0a6279d451\common\icarus.exe
      C:\Windows\Temp\asw-9e77c686-b539-4484-b851-da0a6279d451\common\icarus.exe /icarus-info-path:C:\Windows\Temp\asw-9e77c686-b539-4484-b851-da0a6279d451\icarus-info.xml /install /silent /cookie:mmm_ofg_ppi_008_368_m /edat_dir:C:\Windows\Temp\asw.a0064b38d836346d /geo:GB /track-guid:9e77c686-b539-4484-b851-da0a6279d451
      4⤵
      Executes dropped EXE
      Writes to the Master Boot Record (MBR)
      Suspicious use of AdjustPrivilegeToken
      PID:5716
    - - C:\Windows\Temp\asw-9e77c686-b539-4484-b851-da0a6279d451\avast-av-vps\icarus.exe
        
        C:\Windows\Temp\asw-9e77c686-b539-4484-b851-da0a6279d451\avast-av-vps\icarus.exe /silent /cookie:mmm_ofg_ppi_008_368_m /edat_dir:C:\Windows\Temp\asw.a0064b38d836346d /geo:GB /track-guid:9e77c686-b539-4484-b851-da0a6279d451 /er_master:master_ep_eb39c0d0-58c8-4d4e-aafc-3e8a3a0f4223 /er_slave:avast-av-vps_slave_ep_72af9e53-ff4f-4aef-93f5-4a0b9cb83589 /slave:avast-av-vps
        5⤵
        
        PID:1744
    - - C:\Windows\Temp\asw-9e77c686-b539-4484-b851-da0a6279d451\avast-av\icarus.exe
        
        C:\Windows\Temp\asw-9e77c686-b539-4484-b851-da0a6279d451\avast-av\icarus.exe /silent /cookie:mmm_ofg_ppi_008_368_m /edat_dir:C:\Windows\Temp\asw.a0064b38d836346d /geo:GB /track-guid:9e77c686-b539-4484-b851-da0a6279d451 /er_master:master_ep_eb39c0d0-58c8-4d4e-aafc-3e8a3a0f4223 /er_slave:avast-av_slave_ep_0f4c50dc-a49e-47be-aa2d-b9b7b09ff3c7 /slave:avast-av
        5⤵
        
        PID:2776

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

Software Discovery

T1518

Security Software Discovery

T1518.001

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BrowserCleanup.ini

Path C:\Program Files\Avast Software\Avast\BrowserCleanup.ini
Size 42B
SHA256 59727f7a256b7a70971f2e62b43b0a923937f85689fc3aa4ae50e4fbfbf83499
MD5 4957ed73d5e5e303e351c8f8b7b53e1c
SHA1 e61238f49e44237c56d4d5b41aeb150160880b74
SHA512 db4854667285bb1cd8d07ab189607ec5bc489afb2d0a5b5a3388f91cefd012feca689787452901e0eb1de6e8792e69c0097c38b89bba0d977d0b29e5e5ef2feb
MD5 SHA1 SHA512

Submit Download

LZMA.txt

Path C:\Program Files\Avast Software\Avast\Licenses\LZMA.txt
Size 600B
SHA256 6182268f7c8c37fef81e83f722d1ac9bd1ea4307f16005a6900bc1aa473828e0
MD5 d774c7a88d7b41d7c73490067b54e3a4
SHA1 661206b3d45d9f6836915cb266f8536ef8ed39d9
SHA512 7f9bc6a96e2cd7a1b8522edbcb72be141a5136dda654e0e8ab5ccf39a216b23478c64bb4fc68a71ee303237e6e9e063adb84873bb786e235e9a039d914e7b762
TLSH
T1D7F0ACAB1E0C03B92AF281DC1216E1C9B32B95585D1E2EC05C50434EAF2D719D96EA2D
MD5 SHA1 SHA512 TLSH

Submit Download

OpenSSL.txt

Path C:\Program Files\Avast Software\Avast\Licenses\OpenSSL.txt
Size 10KB
SHA256 ed72ce2b51ee58f117e5a021e2e04af158857f40269fbc03491f0b2a99dbcc96
MD5 97aa3aafa51953d4ad591398b916595e
SHA1 a849084b5239438f44c43b52576171f660576e2f
SHA512 0b54f6b692ee9c92e0a867361b1601459cf6bcbd653b902e1dafacf3ec445af11023e8a5f7485e4513d351ec662ba39dfd52a9e84858128e512e68ace970c18b
SSDEEP 192:qf9fG4QSAVOSbwF1wOFXuFJyQtxmG3ep/7rlzKfHbxc+Xq0rhR:k1u9b01DY/rGBt+dc+acR
TLSH
T14522626BB60903771AF20162AB4764CAF31EA03F3B591529315CC1281F7B96093FB69E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libPNG.txt

Path C:\Program Files\Avast Software\Avast\Licenses\libPNG.txt
Size 5KB
SHA256 0ad3bfee8be10e5519949e7af492e36bc349376b75fbeb412229a5967e3e9434
MD5 9c08c5872a3314661e37289d53a846e4
SHA1 ddad81444c937f22e749ab9518058682953b1cdb
SHA512 dda85f29349e7222a6487f91e42e798c6d93a091fb01ed08d7caff5b906a2732788fea763d3e8fd10084361af8531ba2059e2410e845390c937aff659cd0fa36
SSDEEP 96:Q9IzL5TPtwjzgkC3OOobgrRoy1mcy8dElpFoLMt6DQWJbz1HYK:GIzL5rOjzgH3OhUr7rMQMt6MWRR
TLSH
T1D4B1C717BD4F03717AF2C68B590E9996F20D647A370B5655B418524C1F3BB3243FE298
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mbedTLS.txt

Path C:\Program Files\Avast Software\Avast\Licenses\mbedTLS.txt
Size 11KB
SHA256 1eb85fc97224598dad1852b5d6483bbcf0aa8608790dcc657a5a2a761ae9c8c6
MD5 d229da563da18fe5d58cd95a6467d584
SHA1 b314c7ebb7d599944981908b7f3ed33a30e78f3a
SHA512 e2f81cb44129e1bc58941e7b3db1ffba40357889bace4fd65fd254d0be1bb757625bdf36bf46d555eb3ca4b130dcd1c05225caec28d8472dccf52a63dbd6e185
SSDEEP 192:ff9qG4QSAVOSbwF1wOFXuFJyQtxmG3ep/7rlzKfHbxc+Xq0rhlkT8SHfH2:9Ou9b01DY/rGBt+dc+aclkT8SH+
TLSH
T1A832832BBA4903771AF20122AB4764CEF31EA03F37591525315CC1682F7B96583FB69E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mhook.txt

Path C:\Program Files\Avast Software\Avast\Licenses\mhook.txt
Size 11KB
SHA256 3ddf9be5c28fe27dad143a5dc76eea25222ad1dd68934a047064e56ed2fa40c5
MD5 d273d63619c9aeaf15cdaf76422c4f87
SHA1 47b573e3824cd5e02a1a3ae99e2735b49e0256e4
SHA512 4cc5a12bfe984c0a50bf7943e2d70a948d520ef423677c77629707aace3a95aa378d205de929105d644680679e70ef2449479b360ad44896b75bafed66613272
SSDEEP 192:qf9qG4QSAVOSbwF1wOFXuFJyQtxmG3ep/7rlzKfHbxc+Xq0rhlkT8SHfH2:kOu9b01DY/rGBt+dc+aclkT8SH+
TLSH
T1B832832BBA4903771AF20122AB4764CEF31EA03F37591525315CC1682F7B96583FB69E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nghttp2.txt

Path C:\Program Files\Avast Software\Avast\Licenses\nghttp2.txt
Size 1KB
SHA256 d0a9c5d1e40d1179f0669bd93e079a518b3067fad240410804170f05d1ba04b6
MD5 ae3f3d4fd356269cb456df973156650f
SHA1 4f58ec889575f422dfe25fe14f22eeb5d009a4c9
SHA512 ac1c0e7d7020f7ae091bb53e4b5d1afa8e9a669bbed4f7a418b8cb9975eace1c8c6eaa840f1248ea4f607f87ba8765d61ea0f05fc0e586ee21275633c8f1c3c8
TLSH
T1F621775EB2551332097513D06AA5EC86F116B10B7DAF3644305DF344231F458F6F7800
MD5 SHA1 SHA512 TLSH

Submit Download

protobuf.txt

Path C:\Program Files\Avast Software\Avast\Licenses\protobuf.txt
Size 1KB
SHA256 f4df8b2457697851385d9ebb93267832c1dfa24e0e61881952f6b0c452663dc9
MD5 ce79a5e699943b3a132c0deba1777ac6
SHA1 57919d5bf210193d05ba496a870832582f475559
SHA512 82cda6f61e3dff94228d3eefe4e1f65dc483aca9c8597e482c1d6584d2f70ab7327af6461080447649dc4986b9932025dbcae5c078a2dbcca82c3a985d118f4c
TLSH
T11831616713885BB31AF25A903269E9C4F18DD02C3F3B6A00286AA249677743ED5B3590
MD5 SHA1 SHA512 TLSH

Submit Download

i-s-715.svg.ipending.1f3b1bb0

Path C:\Program Files\Avast Software\Avast\gui_resources\default_av\assets\illustrations\dark\i-s-715.svg.ipending.1f3b1bb0
Size 22KB
SHA256 d42b5020579ab72e953791f3142f340d29e6f95aa4574189c44d1347d79a22dd
MD5 d0eb120cd11d17bbbfa8a9138f5685b7
SHA1 4f5ff2c79251a6b563d97f4741acc39279c6f766
SHA512 69892d50521b0f3a9f5852985a0bc93c9cc3bfa59ea11b1ba7630727d1dd9997d292f1dc8429b5222fbde4d268265700b65b11279cdd06a592b92e89b401a274
SSDEEP 384:yquCiHimeYAyqdIvX76w5niWtDoCNDjZPdA/3a7nB8OWzTozHdo7baw+xwV3GQU3:ylCkOdI5nnXZPqa7B8QzHqJVdUhLam
TLSH
T118A2D9534A1FB6965D243EBB83DA3C4EA508F2C28E8393CCE1E71DE8D0DE759490426D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i-l-069.svg

Path C:\Program Files\Avast Software\Avast\gui_resources\default_av\assets\illustrations\light\i-l-069.svg
Size 33KB
SHA256 f58882834effc7d74906f51c25a63c162ba4b69d74f0fb17509a10df5268b73c
MD5 482578c8cc19457ba33cf65c5da65679
SHA1 87ba7222638a197aa63e9e8b751deb8c230c6fde
SHA512 68214f07b913e9b915efdba2440a2630bf83f1804356be9dce2159ee676a3f94ad7ef5f8e8dab44e5752776da9a6b3ea9590d4f80ff0da4bdc77233cd493eebf
SSDEEP 384:uHYMH5EBaWVSVE7TqbK9ya4ZcoI0G1v7PxvSF/Iz3uYlvJwNxBwGBvXZhdLbgKMR:uHYgEaWVS67faZcDrjxFVJwNcGzaL
TLSH
T1E2E284ED3F7408E8DD958BEBFF0560BD702795FB59818710C5289B28389182D9D6AEC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i-s-715.svg.ipending.1f3b1bb0

Path C:\Program Files\Avast Software\Avast\gui_resources\default_av\assets\illustrations\light\i-s-715.svg.ipending.1f3b1bb0
Size 22KB
SHA256 34d703d5589d20ea30b73122551c7aa16d8571d792121177020aac3d2923a8e1
MD5 23d69b624339729d8798a8ed9ae64223
SHA1 a8994318fe476b77e93455860cafd854db858437
SHA512 692dc7cea82a74870deead332f4e21d4d9f90fe954ab87647660ca81698706b8666f2a7c29a3df1f21005eb0c9b96f8a51fbb06f2d449fccefa78998b2726184
SSDEEP 384:BQ96aKmZHOUzFXZFMVpKiLELw5DCohz4DNLEeliFdb3DuiEqcrs5Uatb8FtWOD:BQ96xmZOU9MVp35DttOiEq2kgCOD
TLSH
T14BA2B963490F76964D643EB786DA3C8DA50CF1C28E9393C8E1EA0DECD09E7594A443BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

locale-cs.json.ipending.1f3b1bb0

Path C:\Program Files\Avast Software\Avast\gui_resources\default_av\locale-cs.json.ipending.1f3b1bb0
Size 632KB
SHA256 aaaa02996bd5dd6c057c2d8d671703a50021d4315fbb43455c70011006723a3a
MD5 9da30da7890f1181ffb9e492d20550b3
SHA1 006530a7efb5fd9f736c41b583c267166b9f7334
SHA512 1f5931da2f200d64f5cd242661a91adb2bcbeb813259813099cdadfc6a8042eaf871549dd9b48c1c2984e30ea041c12c2dcf1070724334a4bb89f7297f8766ef
SSDEEP 12288:ytHLMc40KsnB6d4FIrcILsP+TLZF8ZE+dwu0t8X8O7BxO8Dz:ILMc40KsnO4FI4ITTLZF8ZE+dwu0t7vi
TLSH
T131D41B0FA572BC7B1FC502D93DED1740B8AD020415AA54FC9EDFC46422BDA9BB5FA818
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ras.js

Path C:\Program Files\Avast Software\Avast\gui_resources\default_av\ras.js
Size 23KB
SHA256 3392fbd89a8298b6fa22692d0fcb63a0dcfe0b1c906d3c58f4eda4f71b3c4322
MD5 8c6f3b34c54dcc404447f7cffa80d143
SHA1 4c4648595860ae134df4e2579addad6bc4530ec6
SHA512 5dae997c452194c3c70225b9a436246c999953575dcc6ecc3a0f7e177a11ac38fff6b7d12c972710d0f9aac21818f4fba3c9b0b0f9538db15d44cb73e972cde9
SSDEEP 384:nC8wDMmr1e1Y5udgy+ioUKNF4oV/3herPMkEvQ1uWB5LIIhIv:CjMmr1e1Y4pkUKNF4uhaPMkEvQ1uILI1
TLSH
T1EFB2F98372A4B265A603166CC49AB011B6344DC4441EE264FB37DF683FDC4CA62A7EF7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libwaheap.dll

Path C:\Program Files\Avast Software\Avast\libwaheap.dll
Size 102KB
SHA256 fbc24b23fd3b1306ee05e15f3e6034da69934c956c24b8de5b4ba776aad048e3
MD5 01bc6fbbfe7c9eaaec00aa73474bca4e
SHA1 56dac73335426e87303b7d5fcea5ab14590e180e
SHA512 dd99ab01a5a7d4e9d1dbf6f98e1f2931466ef722c56e6b54bebd7bacca9aabfe8da61170bd52805231524e527d4af074143cd91259999deb9957b1acf6e82737
SSDEEP 3072:7sEMdY59enGtW/zc7fKJP5MsEhJnq2DxZCqHKc:W4iGtAz0fUvExoqHKc
TLSH
T1ADA35B4776A500BBE577863488A30E15DBB2B9511B61CBBF02A0425E2F773D15E3AF32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libwaresource.dll

Path C:\Program Files\Avast Software\Avast\libwaresource.dll
Size 512KB
SHA256 4a7705edd593c85a8587c7a72dca006611a37bab839be545f12df03d15bbf61b
MD5 0b48d676033e665ae1b1aa320b3ad4ec
SHA1 70c8aa313dab13ad3b64acf93b79f4968647e3d8
SHA512 69fe81ad84039642cfb0264a88140a14c76546535d1d801273bf47fdbe0dac498d729fb560c9b458344a6b684da9d07d3fa4bae25206092c7d68dab126dba41d
SSDEEP 12288:3YwkI+qHS1kJEOxFyK6iVpErnmrUR8x4TNIavTtIHT:3QqHSjsFyYErmrI8x8DI
TLSH
T12EB42332F8C2CEF5D56A60B37063A7475E3A69907305C3E1CF48564CB1997B6EE40AB2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libwautils.dll

Path C:\Program Files\Avast Software\Avast\libwautils.dll
Size 704KB
SHA256 7a3ba2a3f6a41840e3c34c4bcc9ede8921e7cbdd8a169c05992afc4ab9f2778b
MD5 e102aa3536b7128b9ddd3410929a4c9d
SHA1 5973672969979509128bd326f45c8918d3596101
SHA512 ec691430a4e539aa7e30efd4321c9c2dd46e001494b1bbb37905c85a462169538845bcdedccca69a235411b3724bedbd66c48de0338a5e1d24ee35aa9673ae05
SSDEEP 12288:+lkiAY/dJSws+x6A/w+azkT2OnVdW/6QYYOvO45kPCSrvUB/GIr4:ezA8dJE+xl/w+az+2RXDOvT5kPfzu/d4
TLSH
T1C5E47C5AA3E801B9D5BBD294CA455647E7F1781A233483DB50F08EDA2F27AF1173E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140.dll

Path C:\Program Files\Avast Software\Avast\local.crt\vcruntime140.dll
Size 121KB
SHA256 60b813f8b87ff4fa344f081c163c1a2234b5e3e41f748721c28fbdecbcfecb8a
MD5 ec0117040bd1e880088753d9b8467234
SHA1 ccadc48b2df78c1622073200aaf1d4f1624c8f84
SHA512 fb169c2395438d5ae491ea8b0fde1e6ff94616c19dd427566feb6cece678a0a990514dbc208ed6fc0010068b342eaab89756baf266daaa4abf776db84fe0b0c5
SSDEEP 1536:rbmQhxfqEu7IrHwOsEDzvvGfWJhEMjaecbWIG9lM5zM6dgzHv:r+EFrHw43GfWJhE8aecbWIG8UL
TLSH
T188C36B42B2B802FBD12BC174C2A2DA23FBB5B4454B605BDF07AA9A640F53BD06D3D745
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

config.def

Path C:\Program Files\Avast Software\Avast\setup\config.def
Size 42KB
SHA256 7b3136d60a4e109870da23786dd6555c3fb3a21a739f8c75240ad01c8c60ba15
MD5 5699c6792b0aa4ccd73d4d3d6ca1889e
SHA1 322ac43e835f6f08e7acdd91dba6d351ff6c26c6
SHA512 2fd05cad25e2ef61f0de5e82094de3f3a20de8d6522e5744470ab72eb368a34acb117530ef6590b3c667388608164cf3a192a657a1634c2459d7271e5b339d28
SSDEEP 768:fll1bebRvKto72DSrbxJu/kdYfbqo1IzJc/E6v59GwPPHoNG:9l1SbRStoS2ydIzJcM6v59hPPP
TLSH
T16A136BE347510A6C9DD6C2EA9DA6F2511CB774CA98C0C4A1C7C0DCDAAE74793708E36B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

su_common.dll

Path C:\Program Files\Avast Software\Avast\su_common.dll
Size 280KB
SHA256 eb6e459b6fa4013d641b99125148257627e2a53ab32ed738852e419c54b211ae
MD5 13b6878e3c8ca93b7289d345d3ef2c13
SHA1 d26eeeb9e4ecaa5313a0ed72febb528c6fd3db5b
SHA512 ae46c5b21b817d8ca2711b5af6b29e0e670f752c3d05e2a76a766378e4c16c3102a897d03e97cc3315f3ff37dba9f47f07574f8411aa00bf77f5550a705d02b0
SSDEEP 6144:P99aAav+7UlQRQph0lhSMXlBXBWnB7iPcM8Ao9:KAaqNQph0lhSMXliB2Pcl9
TLSH
T16154CF17B7949CA9F40D817948AB0B4AEB3378504742D3DF27A4D6162F637E22E3E706
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

su_worker.exe

Path C:\Program Files\Avast Software\Avast\su_worker.exe
Size 576KB
SHA256 9239eb8f2c3d42fc4a379d4844a0c98a07df0168c4a76745b22a3714d84629f1
MD5 fb404f5e3707a264635a77f1d5b2fe0b
SHA1 0dd2ff0c413ffcf19de7bc3283b7def29941a522
SHA512 0b359957df6f04f07de10bb07e00d377931870a65b50ac6c0d704b4e0c13d7f245cc25d7356c5c1e01a333c3e40c0a5a0b9114ac718f454d33b43382a742f190
SSDEEP 12288:R2deHAZl4FGLI+91RRc/RHJOrudLGTFPc5kxMY8jcIjQw:R2deHQl42j13c/xNdLGT5cGxMY8QIjQw
TLSH
T1D6C46C2A66AC41E5C0BFD0B9C646D80BFAB03C598335A6DB1AF09D560F53EF0693E741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

product-info.xml

Path C:\Program Files\Common Files\Avast Software\Icarus\avast-av\product-info.xml
Size 12KB
SHA256 3ffeca9a97e3a0652fab8efb88683fbb3b813b00bb1d16a2af24defca967b4ab
MD5 6091e2b638cf99169aa8faee9861ac51
SHA1 387888b84c1e7ebfaac1109aa8ac3c4df291da78
SHA512 92e0449ae98989280fea0bc4d05a6ddd20bbab405d7db56194c0463775baefbfb1ff4356b65762567f9232e6e94a0903e94c817b1bdb241803b0bab984a5faf4
SSDEEP 192:mxki4KAfEYLMMHmNpB/O1fxqIpQLMU8wcOHFNN3cLkE3vj/vYKPwY/WDVajsWcNS:jKSBwImNjG1d888eZoCWJaICsB0b/
TLSH
T15D424236211CFF2B721F94E7A1D57581229FFC2D8FE80C5BE1273180626F969A906D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ExLoader.exe

Path C:\Program Files\ExLoader\ExLoader.exe
Size 201KB
SHA256 f66c1efad95e723ecb9f1d35846aa46b6ebfc5a74b4293dd95e268ac07c6c196
MD5 02fa1f7d2b3568975512b054c32d6dc9
SHA1 c19bb7b4df37e03770b9babeedebcffd79903ee1
SHA512 aab32df022da3c506373e7f13caac74c922b285d0d66c087605bb31b5ce84ff1b8c801ff8838c9c26f64f742a18462f77871b0dbc20b4e3fe86ec4d71778302f
SSDEEP 3072:eM+Ytzin7g4OU+O1NQtLbU/5YZjtHx6hVzZuZqv8PwKreqbpmiY0UG:eM+6in7jOU+O1NQ1AuAhVIZxwKreqB
TLSH
T1FA14D015FF16008BD2094E74D8538E09EA72F88E5BF196CBB7405EDA6E375C4AF3A601
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ExLoader.zip

Path C:\Program Files\ExLoader\ExLoader.zip
Size 23.8MB
SHA256 47a9bc0e5e2c3140aaf9af80706dc464caca5891843c242326fc22b5838e3932
MD5 d3ad20628ff4bb4b346636af14b40043
SHA1 fe314d1e8fa2728f1dfa1a644bbc5bb44a16d462
SHA512 6221be82a9f3760352228f5c38deabc8e7e5e021083efea6ed7acfd0a10e3f5ebff831750d9ac133e05e404f7532b16b6b8c8e21b03f34f83185c1425c00452b
SSDEEP 393216:MnyXIaf2kQEyava/LzNn+TfIYVjjgP6GVeon1ozBG5IG+Vj61mGnM7HjCQo6CwxA:Mny4L2+LZ+HpcP6iQzBG5IG+V61mG6+f
TLSH
T1DB473315F389306BFC35C27FD6B77560CA84025AA2BBA1A50288C295FDF76843B54BC7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

audioplayers_windows_plugin.dll

Path C:\Program Files\ExLoader\audioplayers_windows_plugin.dll
Size 203KB
SHA256 5fa39a7b18abe91c9ae6b7a2ea0ce6725d314ac2f779c775c44af3a6e504df61
MD5 01f022c50d3fc56c9ce16b58215898b9
SHA1 612c1d0fe17666f4587522c1d43e7f3168f36751
SHA512 03d1a19e3d629775bbe7de6cb2e9e70dd4fab0840047cbf0552e3c87bca02bbd11a98184a130624d2e0a9df39472031f164f7e4c433b045701fea5b28499c919
SSDEEP 6144:8UMgkmu6KQ6Sa+iLIVklaRP5v7tZxYgz6Be/0:8UMSoYiLkRP5vjxYgz6B
TLSH
T181143B2EB669409AE227D07CCD470A4AF77378950761A7CB679007BE1F17BE89E3D600
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

app.so

Path C:\Program Files\ExLoader\data\app.so
Size 21.7MB
SHA256 a003241b79f84ca687c52bf524b639a1478e2eaf59da3d7f063df460ea3ad52c
MD5 7654c43a63f124a58c47bdff48ece907
SHA1 db8ace9fda099f28c9c91cb1ea6284fa3175a1aa
SHA512 95569b0e3f3d06031c33c72db60ef6636408e679e8c17032404fd50ac2e06085315fd06ca7a9b79a521cd708184815e3671334ef17f07cca3cc949d5eeb89f30
SSDEEP 196608:eP4EmvR/PNwRCTcyp51xDJRX2fRYWAspPwfZkFQbk9xTdQltM4:eP4p12EoiW4k
TLSH
T1C8371947D1A44320F4B3E735B77F7A924A543DF85A30E6CA06C6161A3A87DB0578BB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FontManifest.json

Path C:\Program Files\ExLoader\data\flutter_assets\FontManifest.json
Size 332B
SHA256 9e0903a9ceb64e32f7a139a143324252aae77dc58dbefb1f211fe03aa33460db
MD5 abfb6c8e4501348bbd701d03698e9b3e
SHA1 242fd377e9edfb075022ceb8e4c7079fc8360c99
SHA512 52ee71f765f130849464ca9b03bc993894400d8fc8237761f73a32205a811bc86282f0dad99e7635aa450a3a60c8f7bc66ea4ac2886a6be55ead904656a17a89
TLSH
T1C7E04F1395007578C778945BE52217551D587388721DC45ED31D1662E1F626430B27A7
MD5 SHA1 SHA512 TLSH

Submit Download

NativeAssetsManifest.json

Path C:\Program Files\ExLoader\data\flutter_assets\NativeAssetsManifest.json
Size 45B
SHA256 9548a31e4a048135c1d94f919328bfb62ae2c7bb3cab96557c7941daa97776cb
MD5 f3a664e105b4f792c6c7fe4e4d22c398
SHA1 adee29ec4f2b3cb2ec37ec3368f37ff805695d36
SHA512 b7df555970e20c6a50f650cd0df6ab782fba7004782b3f7921ccfd314db53bfb61523986628d2e05d085f4c2263dfcf54000ffdfc946b0158c5766fc6f1d0a86
MD5 SHA1 SHA512

Submit Download

icudtl.dat

Path C:\Program Files\ExLoader\data\icudtl.dat
Size 842KB
SHA256 998367809a821d595928089c197b3f7959f0420f81f79d4d0daee53378492ed5
MD5 018361032ba13dfeab636138ab6b9831
SHA1 8f9c259d3a330786ab8bbd49e7e79abfa1d552ed
SHA512 d7d3fffb41576cf2c90cd260727cc0ea23c5a4c458f84b01426c2a4578004b94168047c7282222e9ffade2f082e189cf167146cc3303bd7dbbb252a593236967
SSDEEP 12288:8Mlhw771h0jM7ykPG07rr4c8w0P4N48Rkjt3dPHz982VYhq:Zhw3zVtjLbGu4RjTPHzMhq
TLSH
T199056A17B0435E6FE0C48277C652E7B65637838DEB3317EAB698B5593E8A1C20241BCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

flutter_windows.dll

Path C:\Program Files\ExLoader\flutter_windows.dll
Size 20.3MB
SHA256 a5c880a4218a04cfb3e58b103160334658122c5e43d3b818b3d9af5ab3e1fc0e
MD5 0c8c6ad1f023a515e37ab2bce12b4512
SHA1 d97f4ef98acc752a2ca6cd7fa89b605205f9cb24
SHA512 18445153a65b0641d85676cff4a17d736065822bd56a9bc712b3e61d96201cbc10e46f2e4fcf2568f7f29bd22ec15bce75bd7897c90773bf3cceb42d20c7c33f
SSDEEP 98304:B24Wmz6AP8+AmlPps4yoz95mYjH1x0q1KiROOUsMuZSxAwg5mByfcdrNh7k/WV4h:Bt8omoxj1IWEjEw9+BZ5vStib5HHe
TLSH
T1E2276C03E29640EDC059E179971BAA27F670B8490B20BADF3B5C47213F66BE05B3E754
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140.dll

Path C:\Program Files\ExLoader\msvcp140.dll
Size 540KB
SHA256 def46aa6a8f72f27bafac0c43334419486a4d1dcdb6c479a8ef7034b3e1fa4cb
MD5 4e3fa9bd90ef020c14359639dc19312b
SHA1 a51032ec39a292afda65b0e3053d4ff3e3241512
SHA512 3e3c62fe860199953cc87e0516b77f6a039f2563cb6b5cc48edc51f243e5ea8fd9b2e3239a089966c403f17a8b3766090bc7b827399cceb00a37bac970855e15
SSDEEP 12288:M0MrE03u1mHWV/I3z+bQEKZm+jWodEEV7X:M0p1F/IiQEKZm+jWodEENX
TLSH
T180C42A23F75906E0E195E3B8A1838702D7F17C5A8322E3C742EB955E2F577D0A63B690
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140.dll

Path C:\Program Files\ExLoader\vcruntime140.dll
Size 120KB
SHA256 184146852727a9db4eea06178716bec3cdbb1015c911f6b0f915b184ad7775b2
MD5 0d35c5e99871b4f02c490b9fd9dace34
SHA1 c2280e6285147cd8010becc0cd3a120fca0088e0
SHA512 114bc156655e0d3249b6f94af1da80528b6695630f548ab596dfb406f6ffcc65276c9f900b637ba9c244ba5a4331aa15d2de0672f6dcbd38cb49a206c100698b
SSDEEP 1536:a9pCUgtBAVcxStMXcfG8VwfmpcGLOI5Sv+vecbeQ6N7l9gEeza/yLzt:qyA+3EOfmpcGSdOecbeQ6Nx9Mqsp
TLSH
T1B9C37B4272B802FBC16BD274C292AE27FBB6B50687605BDF07AA86650F537D06D3C341
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140_1.dll

Path C:\Program Files\ExLoader\vcruntime140_1.dll
Size 46KB
SHA256 e6bfb3662ab4b1969a73441dbe35c96d51441b6bff8cf1fe7430bd5b246ca605
MD5 03b43160d21c08de07a79d0a1c5ee81d
SHA1 0a449093006af667432b83303614b53b62fc0d05
SHA512 8b835205bf037b78144f0a4a78618a4e74ba087ac9916c83cb25aff266ddcf5c1b859a6e7c6fec2b57ffeee94fa2f52dd7f6e98c387a4ea7a3143fef6a9570b0
SSDEEP 768:BezSkbhNfI4fWLZyS/dPWxngU907N9z7RV80X9z+:2YZyuPWxn3Ivz7bDz+
TLSH
T1FC237E9293BC4086E89B8970C1DBDE57BD38B7D2576093CB1BA5E54C1E537C0E63832A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icarus.ini

Path C:\ProgramData\Avast Software\Icarus\avast-av\icarus.ini
Size 248B
SHA256 c4a4a5b13c62da69abbd93f1460b8992b997e00e8e616852d559bdafbc153acd
MD5 3d8648be6f767304d5ad68fc9952ebfa
SHA1 76c563ffc2cc2c4abce68e39463781b1fa3501b5
SHA512 f91b6fb1939732aba319517801cb0bdb0fdcd439ec3042650dfd9c4f7adf695f00761a531c2a74b66797c527277dfeeaf10d097e7e3d098a1ff184f24bbaa4e6
TLSH
T1C4D02E25E1B083D9203A9BB0033004F03FA5368BAE6601C133CAB73832C7B061309228
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 45f521737e34108fcec0f24251f1736a9124dca7794b71ae2966e26d8a05fc0d
MD5 cd7793cdfb9295f447572efb6e70bf81
SHA1 dce217c94f7231f2559527c77b17604e0c11be61
SHA512 14938c84baa985800075d40695a2c29c097db067e02c4e847dadba963bcb208d88cf963091e96a6bfb0bf1ee245e50457f5f714cbd561eed42d6bcb9f59219f5
TLSH
T190D092317F5AB451DA46123A9841872A2DA5444A2AAB9207A261888DFDA50A8A3C60A6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b83d8b3b3bb64ff97dfd21017822c565c50fa4655623c882c9854229a2eb9fc0
MD5 2a1c26025a16af9770d1943aece12b07
SHA1 e99f200ab4b656082ea4283baf673ac37faaae9d
SHA512 c6a6b667c750c33f99946cd667b400c38692f5bf6c8cc28971c0ef5899c7166adba2ea6dda0f083bb68464d66d757a9fa633c1820e825946725f45a260f459cf
TLSH
T15BD09B313F5A7451DA451235584087162D554445155793079151444DED9509493C60A6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 be8b26be52010f4440dec4e07ded55d1469ffe8584e2b0638164f11ecca4f9ad
MD5 858fe2602ef1c8b54552e64492bbf738
SHA1 0c76604af96b21c631154e1dfda7210256212c33
SHA512 26ee2bb3d6a488783a62b79dfe86b29f03cec52d7f474ef1ade2a8df78f2264267e2d55faaf0b93ffc3d6f137c469ac9acdc7ef3700f3b3d3c668473612cd69a
TLSH
T1AED023717D3B65E0DA19013C446056123965016327DB535791514C4DEDF0084D2D79F5
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_00008d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008d
Size 89KB
SHA256 e748806bedc7514c5a8f2684169732fb327900036e0f92fdd8295ace4c8faed1
MD5 c73a7bc71507aabb260f46fee6063e5e
SHA1 c6b871f5d24496a1d929d81aded01442a86c2ba8
SHA512 e1ef8c53d9ab8850cfea0a7d4fa52d3841695835edb244d3b34f52f54dfe87c060458445d225ce881d0c46b1edfc3ab4fb1de3e2121eabcf89fe2e74e42e2a69
SSDEEP 1536:RU6eXV3Ikp2B+/m9cmnMvQTkg1AFMGT93Q0P3exQGi2hh/gVAWjMWU:+Mkp2QuznMvOkg1AFMOQiiNxhNYrW
TLSH
T17C9302B573C40064CBADD1A6BA0335BF1695C8B1B4A1E438CCA75D95BB825F70438BB5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000a5

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a5
Size 115KB
SHA256 49ee696e8430681f15c5f230df65233b22a6d3d4dc7e8fa9f605a0bd162ae7dc
MD5 82c4308ff4c222bc7155331e39cac83c
SHA1 ed01de0bc2cf1754cc3f1fd61696223a93857b1b
SHA512 b76941b90bdb587cdf0f4cafee4fe00e380c9fafac57d3462d7e1177e97121c1d426d69f6c17d6f691ba79a0dbc1a5f90a61f05f0c8be3dc3ffd0b2d99231009
SSDEEP 3072:Ot0S+i7Ydxn71gFCWeK2qKb0xD8GBGifw2zhF2z6R3BJ0n:Of77YdngFD2qKwl8aGC33J0n
TLSH
T117B31320AFA27961C36AFC5992E8374A8396A4A0EF04510E6751F33DBFD90554E33AF1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000ae

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000ae
Size 3.9MB
SHA256 2bc50aba8fb7cd21cd0d6111c78a9adf532371ec9e39551f5779158908103ccf
MD5 331d88035156c9831d4360611b1ce18a
SHA1 4c8392efc019faa4b4a7dee43f318cce3c546ca2
SHA512 37dc1eb53c217ecb74977cd4e61536287a266f50cc33cb66d32a4233e093e6a86ac25b873d66bace1556c8d30bc7bd65aff01c00c891a37a36fbcf2701a6bb89
SSDEEP 98304:MAb040qivICiDQ9ZE17YyTl38lMEXxuKGDe5+alZIG:d7ivIrk9ZE+yB38lMNDJal3
TLSH
T185163332BB81D4B2E67322320FA9F22956BDF5604E3A019F23D44F5E8E70691E634F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 1c5b2a08018bab6288f351813beb5d68d980558a196af0ad4de371bba3869590
MD5 092fa5b6efa7d919cc99bf104fc1826b
SHA1 966ca86945e68312ff5a1694ae1286c3d6cf2ab4
SHA512 30ce2288e77e871a41099078e187411e382e86fb0259c50b52609793dd4467753c033aaa220e5d632150a97a9292440110d723aa1dce18105982aac12eadeee3
SSDEEP 96:yuMoB0dvnsZpNHqLFZmcKP2T4ezJYANWj:1UOwecKPzezemWj
TLSH
T153A193080A8105D9DBA0E1B1E6D3B9AD3B3DCEAFC807EF6683546C7C711A7914F93126
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 572c0669a7c62ef40ba5efbc1b49203386cd79b256e9a1f8be57b93444d3317a
MD5 34220ecc364bf1e5a15472cd757fb844
SHA1 019a979b952e3a90f1d1df4dcbe33122abd75886
SHA512 8fe8d4a8b83b663c77f6b47c2ecc8acbd4912a199a6991a43aa1c5f71b2e6808b35354f4b7cda8c5fe52f96f4c3d6dc8a61255e2b7fba37f702c3aba162109c5
SSDEEP 96:VL5uMoSgl8Pdvn1ZvygH9z7ZmcuIUBEbRbKQTo1R2Nht:pgl8F6uocRUBQKQ4qht
TLSH
T1AEC1A6040A510596DBA0D6B0EAE3B99D3B3DCAAFC907EE55C390AC7CB11B7910F93136
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\000\t\Paths\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 11KB
SHA256 6def017abed98caf273cb134c798113f0e8f21f6e2c870fd5760a7f0b413b891
MD5 dc5b728150a716c2f950aca27e47973c
SHA1 e76a360f278a6849cbb1fe9cd7447852ef21caa6
SHA512 38771073ef50ca56ad28caf9d57fe07d931a4f57f0de0d299e58bfb987f8bdf6e0156cdb9a629da2c4c8c81b2a662ed6bc778272b0199275f9d132565c9218d5
SSDEEP 192:DdJzJwJ/OvJPsJb9Zfeza9efOktVnF/tO5hxPyhdOfaQqIns09AuhfTc6Zif9f9a:DrFwJ/OvJPIb9Zfeza9efOktVn9s5hxR
TLSH
T1E8326DF7D3E8962D8C2252F2A7246E1FCD1E192883587D2EC9D59F0BE3D2461E24164F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 15KB
SHA256 20cb79c692808bfc5fc5e447f62a28ef47092773098251648d5602e73292133d
MD5 19ed94d4d2982caf7cbfade9cf66a33e
SHA1 5474fa9b2102aba381101ba1da41e42e5f8e5d95
SHA512 e5fb80ae7db51d02117c53bfb5bac8ae0a9963f39de103b7b27022bd819fa397b4bf08eb8b8e01b733b773e401d48dbfc21b456cccc4f80d744f70e0390a67d5
SSDEEP 384:DrFwJ/OvJPIb9Zfeza9ehhP0S4eRFeu9e50vtVn9s5hxs1tIDGIZ/+DuLKtHZ5QD:OCKIKMdScs9B
TLSH
T1B2624BF7D3E8962D8C2256F2A6246E1FCD1E192883287D2EC9D59F0BD3D2461E24174F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 19f3b46fc1419c1d219dc677abd1020dd36d9bc8b165c93816c901d9e024dc47
MD5 0cedb803218f733e8af25323a8e86816
SHA1 9170db6fc5a102b01640a2ca5925bd3f19b76af4
SHA512 27adbf58d5fdc73de75abf5b463998dcb049c37d58160a425c61a2e274279b9e0064dd6f42af2052e26c7c355e8a37fa511b860d34648b1724130450e8d1a124
SSDEEP 192:sxZOR2yM/jK1Ml8MFc/fGsKZ0/IdpM/W6+WNGY0ajpNjmIgrJ:sxZOYdc/fGsKZ0wM/bG5F9
TLSH
T1B742E7116B346977CCCBD309FA45BB53D6F91873A2900D44AAFCDA1C04E6AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 58105fbc7a0b9129d5d36c8ad8114ec26c59af9227eda4d4dfc0ec22a354c37c
MD5 5eccb3b32c07c44ada64caa113384b1e
SHA1 8f8b707f6bfb80c2ba85032dbbbee2c9c0d064a9
SHA512 381d7f9de695454646ff93e0c8c5e710bccfd8b29b51835999767bf87111c7e8804eeeee737279193fc7d2dac15fd149e9c708371e489517c37eb7fe929a0a53
SSDEEP 192:sxZOR2yM/jK1Ml8UQ8E6c/fGsWZ+kzdp0R+Vxbayw/W6+WNjkmNhylY0ajjJpZrH:sxZO4q6c/fGsWZ++nq/bIl5qeQ
TLSH
T19162F712A6745977CCDBD209F945BB53D6F82472A2910E84AAFCDE1C00E7BED220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 2a2ead3081be7d08f9ce98348ecafbf0966bf509006e0ceca56618921aad5faa
MD5 80d92f72a106051e044c2312bd5dd1c0
SHA1 0a4e77a6c8c8a5550d67afb5f906a81eebed0fd6
SHA512 53107e203bc8de2ac12fd81d125b117f9b0efbbd6c858bb66241dee3b12f974f779987af4771eeb7c2bbab8864118084cda30dfd9423bf8a75c3140704eea7e9
SSDEEP 192:sxZOR2yM/jK1Ml8Mjc/fGsWZ+vIdpafoS0kyC/W6+WNAfY0ajNphjmIg5CJ:sxZO4Lc/fGsWZ+A0/be5U2Q
TLSH
T18E52E612AB7469B7CCDBD209F644BF53D6F9146392910E54AAFCDA1C00E7AED220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 ba73312204cc94323b086f6d1afdeff6fe3a17af2399cd07b6e94cde7ba33e88
MD5 b48c57861b77561e6e51c328fb093332
SHA1 5d30f38d37237bc1fcb5b43db671230b1eb1cdba
SHA512 7a5080875982498968cfa49facdf4e447baff4ffd7b8bef700bfbed0465284d352220b2abf7f5d4e38000008ac8188b9c702610f04c2fe3bd44ffd627656ffb9
SSDEEP 192:sxZOR2yM/jK1Ml8Moc/fGsWZ0aIdpNR/W6+WNGY0ajLNjmIg5QJ:sxZOYQc/fGsWZ0z7/bG5pS
TLSH
T1A452E711AB34A977CCCBD209FA45BF53D6F91462A2910D54AAFC991C04E66ED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 3ff55c89c5b1f6883ed10484ba197011359f9910209e97b64ab74e7288101aff
MD5 e4c5e99e867f490b3d2eeca0e9e1cb20
SHA1 8f9a01931856e47af37d0999071f479fae9a7145
SHA512 6ddc30517785fe3367d9cdb470e7fa09078b18fb0664a2ca3aff893178793dbd13c4f8bd784d4e335e101c6742bb6f365ee199f8225c7c9a192f50b5340f7801
SSDEEP 192:sxZOR2yM/jK1Ml8MEkc/fGsWZ+iIdpafoS0kyC/W6+WNAomNlr/Y0aj4phjmIg5e:sxZO4Hc/fGsWZ+L0/bc/5X2Q
TLSH
T1DD62E612AA745AB7CCDBD209F945BB53D6F9146292910D94AAFCDA1C00E6BED220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 eea24ff4ba9bffaeaaa37c8203934db01d25ea7bce89f9ff96299ffb0ee9764c
MD5 131333b08cc100bc660654bff5270dbc
SHA1 a3103ca9a8c163898db0bd704a55dca6d8dffe70
SHA512 61d81d09d5ef2e6939bbd9e0455d426c51123bdfdde6cd98c063177cbc55f61f0545b35784220e88542139b45673af13d74e8acf6eef1aa2191f6e7ee62cbbfe
SSDEEP 192:sxZOR2yM/jK1Ml8MEPc/fGsWZ+iIdpafoS0kyC/W6+WNAomNX9/Y0aj6phjmIg5e:sxZO4Gc/fGsWZ+L0/bo/5F2Q
TLSH
T10C62E612AB7459B7CCDBD209F945BF53D6F9146292910E94AAFCDA1C00E6BED2203C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 2a3c45d55b54ee5818dc7223ea004a13cdeab13ed94620bc07a98e56464898ac
MD5 bb31aea5b0cc4875f5e6c8380f3eb477
SHA1 c9fa7588f31027b4db2c4a31f06194d046553e6f
SHA512 a2de5177b77099c1b7f7c9a18822741d21b2235c82a07bd14ff890d27078365c5e4dd9c5be0157fffd81be49195cbd7ad2e1c92a8257213f868dd13636ad16c1
SSDEEP 192:sxZOR2yM/jK1Ml8ME6c/fGsWZ+Czdp0R+Vxbayw/W6+WNjkmNlr/Y0ajvJpSrmIR:sxZO4Nc/fGsWZ+0nq/bR/56PQ
TLSH
T13162F612A6745AB7CCDBD209F945BF53D6F8147292910E94AAFCDA1C00E7BED220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 31KB
SHA256 3e98ed52abad4d4d34e6acac2eacc7ba36a0e5f4f2828d2a70ada6b82d00f0b5
MD5 d5f9b4f6500304973cfb4e93e8f4f3b9
SHA1 180b1a5a3f513208fd1661795313f66322217a6b
SHA512 d0ec7bc34000c1bdaf5206407fcd0d2127f8a0d1b94deef6f8448c590cb2ad61dd651979f2325f40af4e45ba2f93922983e4de7c31b0c69dfa5e7ab0ffec9d92
SSDEEP 768:6t/zh8dF2PkWRmEcQXw8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3WjLl/2c0V9Vrowp:6t/zh8dF2PkWRmEcQXwu1jaKWjLp2tVH
TLSH
T13EE20A3F280CC7BE4F844E9CEC266F976EE801CB66684D5447EA894C03C76DB521A59F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 a48b9954a51635234519e7e25ba27ee1958bb6664423a1ca7303a4f2715102e8
MD5 26977b904bf7978429d8bc6dfcea55c0
SHA1 e841bab98d44aae73be4ae23abb2a363e5218fec
SHA512 8243e5d4dfd07bd6acbe3cfa035d9c77be7a10de4c31e678399810163955add83a4d7b3fda7accbdcdfc17fc5e1ff55c0256db34a06d4674d6e9cbe938307385
SSDEEP 48:KEWIHKv3XIZKsQELypAIzK1a87yZuIXKjaMl:KEWgKv3XaKsQiKAQK1a66uIKjaS
TLSH
T1E0B1374671BB92413C7E250CA3A4C7575B42F2A37024A82B7BE800755E27E385EFD4DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4136cd48-e31d-4ee6-a4b5-28d9630e32be.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\4136cd48-e31d-4ee6-a4b5-28d9630e32be.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 118c9d2967951b28549854d3b32dd0d1a7ca7bd8eba320b2292c36dac245d510
MD5 bbd7c3932700c3338692d721bea7e081
SHA1 6823146b8320ea3a36edbb73bb621c3a4c81e851
SHA512 e5847b4ffe6c8e5be7e3f3eb4cc90840c860bd408b3909d3e00a451ec11583b8cfa8616997a4cc0ab885f1a87814ea62efdf050aa3a2c786390c3fd073464eec
SSDEEP 192:uqL8NT5QQ0NV2U7xEQmiU1XjrX14nv0R+FdKsDz+VGzYHqaU8:n8NT5/0+uuFPXqnsudK3V7hU8
TLSH
T1CD32193568B86C7B4EA3A545F48736038FF84067EE8A3F94D2DC5E0C01EF65C6316926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 1509eb5df03f98cb927322bd85481e5cbf5b2eca263c5529483b215a3e82ce1a
MD5 3496b60387efbe6b318ca4ca18672bf6
SHA1 238f8118b788e3ad3cf0b15e2eb0efcb3b5c0ec3
SHA512 6cb646ca6aa040eb15ee88cd542f213ec3faa7c7e48b8c5cddf3bbbc1aa4b0b2c35458873a5dabd7cbe4f68d7c04e79388cd4ddb09887b4aeca4cc796cecae63
SSDEEP 384:NiFuZcIZ8Na8TUNTUlIlI/0+ukj8Xr+nsudK3VvhnTKwBODNZOCA5A:EFMZFwgb+iXrysuChnewBKZOHA
TLSH
T11DD23AF248EB583AD9AE9747AB7D2E034EBCC063F9952954B3985A0CCC561BFD306C11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 44eaac438386dcab77448947e0f807214bdebeacc2c51da50d8118dd794b7f8b
MD5 73f9c624cd3fc33275fb07c3aa1ca60b
SHA1 726f20c7881c0ecdd5a2508f466b21f89f3e9508
SHA512 e26114043a990b705aaf968d9933f034c03b45e3c1505a4af15095a8ced4bc9f133f55316cf8d9944671c4d99e1aa5d5a095907df90b6842ea52acb3e770af21
SSDEEP 384:uZcI38NTw/0+uOjFqXgnsudK3V7hnTKwBODNZOCA5A:M3s+3oXIsuahnewBKZOHA
TLSH
T15C928D715C782D7B5EE7B545F88632074EF89067EADA2E54E2ECAF0D00AB5582307D22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 06871f85dd3aace8ec994bed6d5bd401d71dfed3fdadca0e8ea64932ff2bda1a
MD5 0e10451c707ded2e7fde2aed2b377a09
SHA1 bf62142c63ca1202f9166512644c1150edf41324
SHA512 311c051e04d641b7e6640729de2a32677b1989cf03f48e333f60b77097b5c59c7c7b72cd9e2ee920cd12095cb7626e9a6796b55d7ae317c807315aa27b225240
SSDEEP 384:NiFPZcI68Na8TUNTUlIlI/0+uzFwXgnsudK3VvhnTKwBODNZOCA5A:EFH6Fwgb+NXIsuChnewBKZOHA
TLSH
T14BB27E724CA89D7B9EE7AA45F84A32078EF841B7D9D57E64E3DC9E0C009759C1307D21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 a938c65b1c89066592c5be75d051598aa255374b29224700473c8b5b342d9e1c
MD5 3b6bf8f9f540f64c75e20560480b54ab
SHA1 b740a56f7b11e3d42df9301fd48d4c36dd33b3f5
SHA512 258905e2024a4f9b94d0a640e5a19734309786366d697461a931b5b848eb35da22bf4e9222a5dbad331873bee59007e07f7dd7177b72fb28b1d29afacc8a7314
SSDEEP 192:IGNG6P2U4QmiUyoECX2Gv0R+FdKsDz+VY0BHqaU6:IGNG6e/BNX2GsudK3VphU6
TLSH
T19112F93668A46C7B5E93A945F88736038FF85167EE8A3B94D5DC1E0C01EF95C2307927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 1d0ddd1c96aaf096ab3099b2841639cd29237923e8eb0af5efcba7f3f9aafacb
MD5 3b8a72574c50ce05fbe8402c4889f552
SHA1 1c527cf5d698d256277f78695e727bc6d208159f
SHA512 e70bfec0afe1f7144cebc0d4aaae51bb00981cbdff8095004590eaec0e03a907a1c2e678d861978e746add5b09934332e3974265e1ea6465e843cbbbcf48b002
SSDEEP 384:NiFiZcII8Nt8TUNTUlIlk/0+ufFwXgnsudK3VwhnTKwBODNZOCA5A:EFQIIwgr+NXIsu7hnewBKZOHA
TLSH
T11BA27E724CA89D7B9EE7AA45F84A32078EF840B7D9D67A64E3DC9E0C009759C1307D21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 06cc3fe18a2d5e9acb54b7ff4aef9dd4600876b117cdd9bc40a4a0ddfded75b4
MD5 a8e30284dff99fae66e1f69f5c1236d3
SHA1 08d2dc89af1f877a89c4aaf09391ae5e0177a4e0
SHA512 5c95079d78a788ad508bcc69d4738481f2e429f52953782b693bc98e8af359108e21a9b7b0eb2f1a14716e1a29856687779fd3922e4528a1458c494fe7f5b520
SSDEEP 384:uZcIJ8NTw/0+u9PFoXgnsudK3VThnTKwBODNZOCA5A:MJs+xXIsuKhnewBKZOHA
TLSH
T158928D715C7C2D775EE7B545F88632074EF89067EADA2E54D2ECAF0D00AB5582307D22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 ed7aa65573ec03eac3c1c46e5c2afab0e8d8047fa7a0df3733c1928dd6f3b662
MD5 880d5a898199e0dc84970cb386de4e51
SHA1 05130ae754373bb4dfaae2fa785e0e527bb41fe4
SHA512 db7542ab713df48e9b63df7f51f04a20d7a6f2b03e8d217e2db1b64fd971892ae4ca666ce21889ad72a9ef9db036c81a67c8234dff620cd41d8bb954c2737fd4
SSDEEP 192:BGNS6P2UOcQmiUy9IUCqGv0R+FdKsswSaThU6:BGNS6eXsOIdqGsudK18U6
TLSH
T19D02C8796C786CBB8FA2AD45B88777135FE8206BEA962B84D6D41F0C00D765C2303937
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 32f29c342461ab7527c8c921a581291996f5730f281bbfdbec93f8793fa0d013
MD5 f58b1f20d6e194eae1aa44268735bb42
SHA1 e98329cce1c11b7d03d02350b140fecddb875011
SHA512 e462ec276b55e991e4a4702db65679d1f08b7237a0aefec59da455bf3dfd9d1106de6cfa337ab9c6cb1e43412a5fb39f9fe04bd64d31fc09c516b823054229a1
TLSH
T114E00116970404ABC068033404E31B603FB2C02003A7430B8A2541786C777807E60A80
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 7536590f6829a3b5ce74d363aba7b14208ea96c6b82df7a77863ee3fd3cfa2ef
MD5 443a0d307b695989d951705e5e1a09cd
SHA1 d0b09fc1d1010d53df0753195adea528ec21ea56
SHA512 9fc18a76de0a77c42d2a61aa1b05232ccdb725b65e8e7587da3d0f13afde496bb60e90bbc59144e4d76de4580cb2a3123911213e39afd7001f8e8b0c64363de8
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter~RFe591737.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe591737.TMP
Size 392B
SHA256 a5d88d80dea11915ad4e83654e9745be835414ada6388f3fe6e92c6ebb9dabd2
MD5 d5c635b75d8a3e13f41b096f743707aa
SHA1 e7dabe0e1b101eacf35b2ff24df3f4166d9138bd
SHA512 4602aec7db4fcef64e689b433328915dc9ec6003f69ce0c4f596c199679077567fb31810969862fd04e3004a4b59e53992d5fa6eaad40cb9b02b675174e502d6
MD5 SHA1 SHA512

Submit Download

0e968995-65c4-4dd5-8c2f-2e629396193b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\0e968995-65c4-4dd5-8c2f-2e629396193b.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

installer_prefs.json.backup

Path C:\Users\Admin\AppData\Local\Programs\Opera\installer_prefs.json.backup
Size 1KB
SHA256 6bf38758911231b7d88a1375235f1e3c273c2b3af3815abe2d7923abf7a224fa
MD5 1ab39e795cb4aea2e050d8d862c5a8e9
SHA1 88dd4060224984fadd7d698a0a62c0ee8dabd594
SHA512 c059156f7adae59a39d0c2c6eb691e0eada791550b06af60cc2a35003f08918b7b7d3f2db3d08ad28388e89db07548b8c5bba759d045534d0d60a169dbdcae8d
TLSH
T15331C8A0800660377F31C3AFC9932F8965131503E01834D4ABEB4E1968EBD9B1BE791B
MD5 SHA1 SHA512 TLSH

Submit Download

opera.exe

Path C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe
Size 2.9MB
SHA256 debc271b27c10ccd526fb75adfd75d800450cc6cc7626a54828f4ce595d0efdb
MD5 9faf7ed1b3fa8cda2ca7a4be8b0d640b
SHA1 0f0f2ee4d8d9467027b23335ba817e491335da5f
SHA512 8d024d8e07418ce84abeab08b144c218ed5ba8ccfae8dd644059f58efc6fe027231f455c9e957de331b97773cf0bf3dd927aa267072042b6ac4eab6b92d6c7d8
SSDEEP 49152:aK5OHHkVsGDgBEQC4er0+Wk9jhKGaVBWG+YUZMwONVOUZ+c8V:aKwHkVJOEco/83VXI
TLSH
T196E57C53F2D511D8C019D1788B9A9233FA62BC454B31B6DF0AA0B7561F7AEE46B3D320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Opera Browser.lnk

Path C:\Users\Admin\AppData\Local\Temp\.opera\8e2bef45-850f-4369-bf4f-418e76d8beec Opera Installer Temp\opera_package_202608091252111\Opera Browser.lnk
Size 1KB
SHA256 809427dde96a71518c42085a872369922790e9e494f845bf486fd33452832ca1
MD5 9c6f9b7fbb552f0a9de92d2988e9b386
SHA1 716c422e0cb6eb4a3a16f3a99b761d306f9ac5e5
SHA512 621ddf748be1e687d753c93432ed7240e59695eb26f822f2327306bcd7ad51551c7047265eebdfb8637dc11ac1396c31c9eebcb4fc57db09625d839277ba1ab8
TLSH
T1AD2154052FD92B22F1FF853040762B75A2B9BC90EB4B5E0CB05043451D72546A91CF3F
MD5 SHA1 SHA512 TLSH

Submit Download

Assistant_130.0.5847.41_Setup.exe_sfx.exe

Path C:\Users\Admin\AppData\Local\Temp\.opera\8e2bef45-850f-4369-bf4f-418e76d8beec Opera Installer Temp\opera_package_202608091252111\assistant\Assistant_130.0.5847.41_Setup.exe_sfx.exe
Size 2.8MB
SHA256 71a4cc628fd1716fd994689c4808d2ebbc00e8bd2ecb7600b9921baa8916c752
MD5 3b028b1188ac321e66add16f8ebadbec
SHA1 086bcb2b1c0d300be15c1390841aadadcec4eac7
SHA512 17c390e0df8e29ff9ad43e581db298ada2d8378fbb890dc5f4b17df8fbe21134f99ab203ea4752a419215d289c128a1d8bc14721bde80042e5bb4c3901dffb72
SSDEEP 49152:+kinoIZOrzV7AlDfo7eT/uAtH00raHx774jx4aGhcr0glyGIGE1HVyVNW272DS/Z:+kiocQzV89Tmeradk2ha0gdIT11yVQ2w
TLSH
T167D5233275A48C34D62312321CE0FAEDA5BE72701E6347DB73A42B1F9EB01979A1D562
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

installer_prefs_include.json

Path C:\Users\Admin\AppData\Local\Temp\.opera\8e2bef45-850f-4369-bf4f-418e76d8beec Opera Installer Temp\opera_package_202608091252111\installer_prefs_include.json
Size 229B
SHA256 acae565711e33dbdbf587ee34a17a58915dc8293ab58345c88045ba7df035539
MD5 6b69980bddc1a00fb5fd6724d96d779c
SHA1 3f1cebc34458cc926eac39862b0c2784e17c311f
SHA512 c42f1301877cb3e54ffbbcc5025ad8c903a673c49128732147a37f3581b174e815e590d5539646bfbd080f27dbba077d107f874720b23809f5403a979ece0e4b
TLSH
T166D0970A803BC0A189B4028B343533C882332B438064BECCB6C28574873C1A331E6F28
MD5 SHA1 SHA512 TLSH

Submit Download

installer_prefs_include.json

Path C:\Users\Admin\AppData\Local\Temp\.opera\8e2bef45-850f-4369-bf4f-418e76d8beec Opera Installer Temp\opera_package_202608091252111\installer_prefs_include.json
Size 1KB
SHA256 126d61f645d0809142eeaa363690b79de3a0fd0ec8730a4d7200dac4aeac2e51
MD5 8eb41692f995b60199c21e59f4abf462
SHA1 4348f5fcb00abd4706f8b36c1dabb8334e56415b
SHA512 d70dd5764b9a44ffbd16bde07eee3930a438c770975f94e2b9f0d3b8b29aac99c8ce97468333d5bd0e4993e25e011908672912a7e4712ae34df2b21f575603ef
TLSH
T1DB11B6E01002B0226BB6C35FC9972FC6C5031703946839D975C64C5C98FFD620EE6A2C
MD5 SHA1 SHA512 TLSH

Submit Download

installer_prefs_include.json.backup

Path C:\Users\Admin\AppData\Local\Temp\.opera\8e2bef45-850f-4369-bf4f-418e76d8beec Opera Installer Temp\opera_package_202608091252111\installer_prefs_include.json.backup
Size 214B
SHA256 cee5b71f1821ac6012a9731256cf5acc5e560f8d8f8d8258056a96b22d4888ca
MD5 33ebbe49835cf978d386cd049f866b8e
SHA1 37d705a3f74d9596a9a14e145fe6fbf27322794d
SHA512 3f95e8c3455a5c494229380f517237e047c426ee7dea355d61533ef602cf2741d635760a11f7e4e7b104cb309826ee2465cc2ed6b7393f368d491abb93e55751
TLSH
T10FD0A756802BC0A159B44197343532C882336A578464BE8CB6C68574863D56331E6F29
MD5 SHA1 SHA512 TLSH

Submit Download

installer.exe

Path C:\Users\Admin\AppData\Local\Temp\7zS4E52B68A\installer.exe
Size 8.3MB
SHA256 c2a6825b895b245bab9774e69a450a11a4352eafa8d4da5fdad0e81341d4e67e
MD5 9dbf6590b693218b7ef20ae8de7eef6f
SHA1 6d8a4f3e48bbeab782da7166a8700bc35ad39416
SHA512 ebe898c89ec43db14a2744078941647737350cc27bb515fa83713e372576c0ce77e5ede72b227d2dfc369bca1c6244b3ceca5ee443259023c05d636ba81f8147
SSDEEP 98304:2h6i+ubH0SElWmLmgm3yrglOgw+Mne2ZQYNY8AFH:Ti+ubH0SElWEZmXFH
TLSH
T1EF967C53F2A601E8D06FCA748B7A523299757C464B31A3EF0A943A251E75FD46F3CB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperaSetup.exe

Path C:\Users\Admin\AppData\Local\Temp\OperaSetup.exe
Size 3.1MB
SHA256 822901b3d81a70f5d148e5f9566cf126bf64de63bd284a3ee5a908c793c6d4a8
MD5 39881f17e4b1fa2c96b0efb20f9c974f
SHA1 f538335eed32b53de855d2635ac97356ab1a73af
SHA512 c24f34d6fb23332524a383bcbf313f55c457eeaea3dc3a38a31b26862030c8a367b122570c414663c1573f73ffea46777c0585bc062fccff75e64367ae88644d
SSDEEP 49152:wVAbwXR+eb2jcWlFwfYud53AgGKP9u1ce+UhAOlY+FGXVRrmUFLr:cAO6IWzwQuddo11ce+UnlpFGh
TLSH
T1AFE523127A81C835C5B311334F89F659A17DF9621F32D6CB37981A6F8EB06C09929F4B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

avast_free_antivirus_setup_online.exe

Path C:\Users\Admin\AppData\Local\Temp\avast_free_antivirus_setup_online.exe
Size 245KB
SHA256 2c2f0687dc64cc693df010a83bef0091572558e9b12aa894e590a3f5513bea24
MD5 af13a871c3d9af4f1bb75c864eb0e257
SHA1 e832169848648ad4e801a42c048901c1e1c8cb5a
SHA512 b8c35cf99bbc597c7658331fe0256eb5bcfbdd102c3028c03f845e94acebac79a28df812e51ab1fad5cd988fac366c678efca8c8916af5e21a161b06dfe9cd2e
SSDEEP 6144:krRG+16NMD16oK3bbLuaTBmmKQMeQazVl5vf:krRxD1rK3fL/m/yJfv
TLSH
T184347C2275D18032F5B31A3019F88BB6983EBDB14F3484DF93945B6D1E30AD1AA35B67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports\settings.dat
Size 40B
SHA256 341360284da9ca058dc9419ff9e916089a75b27cb9fc3b9614924ee01bb41ae2
MD5 f3a80ccd508e87a1c179a4cb15f15d3a
SHA1 615b968497c9177325865519898a59926a25e17d
SHA512 786387df32bb515e492e4488e85c864c1aba62c6ea978211d455ff248b8315b3cc0f5895d222b05f1715c40980ef242256bf3dc489144fa107addc0b12aa6eed
MD5 SHA1 SHA512

Submit Download

game_icons.zip

Path C:\Users\Admin\AppData\Roaming\com.swiftsoft\ExLoader\games\game_icons.zip
Size 165KB
SHA256 47a1e15d8d1393f349be9a84e1fb9ae3a692a86559ca5db0cd6e4fd6b4b05681
MD5 4db746978aa5730f74b7fb66ab94b190
SHA1 4a7e9bd9407af7358cd319a23ae249e8e73a6776
SHA512 2b1cf3c6a3d64a0cd9249ad95b37039b5de15f60baa1fd38b2378e855599f53885776d74d9e46b0a25eb36316f8b0ad783144c196821eb2f09755e7726f9fbe2
SSDEEP 3072:N2O5Wemvcm5WMW1PyMTQ+NYQ6NvhnO1bO30P8oGL0rky8whuP:75WDKPvT/NKNZ8QaoL0IyDh6
TLSH
T16BF302971CE2CA04D12DD97E4703419F09CC0A899760A99F9602D93D8FA4BBC5F4EDBA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

shared_preferences.json

Path C:\Users\Admin\AppData\Roaming\com.swiftsoft\ExLoader\shared_preferences.json
Size 235B
SHA256 263ba1a7c5a1e21d0a9b6d39f573e375d3fdb27254c5498d0a9af7fbf8ff211c
MD5 56e447d005441f653d6d07475467cac4
SHA1 6a8a7ec6aa80a252d58f293356180986ae48200d
SHA512 188f7c0292d6980f4418956bf1f960c638181c8e79b3036b3402717b346a6e4743bf4b57324c2f32cd5f4a2a73d4b4a7ae3426046fc6d817570459ad6e9c5a99
TLSH
T1C5D05EA6CBD000923D82DE52097DECF290455D09C497840E0A28106CC39361AE6EF912
MD5 SHA1 SHA512 TLSH

Submit Download

shared_preferences.json

Path C:\Users\Admin\AppData\Roaming\com.swiftsoft\ExLoader\shared_preferences.json
Size 531B
SHA256 2a71096e2bf4f1e7aa2f2faf04de022b23674da7fc3053f69fbe1aebbe8a4e3e
MD5 fdb87b9d450a2d7691ea5698c157e033
SHA1 adcda357efd48aeb8964f31240ee838a440b8adc
SHA512 5ee80efaca5009a5648b006aaf8f851333fcfcfca08f2a9c843a35f0377773adec2b6cda922013548cef18a4bc1ea8929577edccc1ef33baffa996081785bfee
TLSH
T11CF096A6DBD405B23C5ADC94117EEEF254424D19D49B480A562F008CC39371AF5DF54A
MD5 SHA1 SHA512 TLSH

Submit Download

shared_preferences.json

Path C:\Users\Admin\AppData\Roaming\com.swiftsoft\ExLoader\shared_preferences.json
Size 792B
SHA256 c89f9257b83a9f86a91a60bd8214037ceda1a1b4b4c2129e5e02301a14ec7bf6
MD5 982ba27011c6e6a5459b9db6bb21e78b
SHA1 d7d6f64f066c13883a47ff66ff5dd7dc7a33fd5b
SHA512 52e0a00d3e397d5a1ddb255c3e53c34d58f7773b47d0b85bb1ed085ad24e4087e4d9f414dd426508432e40c5e575de64069828b22c10db1a86c364dcc11c0d84
TLSH
T16A01E1A6EBD004B23C59DDA4167EFBF284438D19D4AB480A665F008CC793726F1DF846
MD5 SHA1 SHA512 TLSH

Submit Download

locations_v2.csv

Path C:\Users\Admin\AppData\Roaming\com.swiftsoft\ExLoader_Installer\network_fallback\locations_v2.csv
Size 6.6MB
SHA256 6ec302d994767f7e13c9bec094a7019e98e3b753675b1876ecddc265ad82d197
MD5 a4b295d3d86ee320a7888f47d06aba24
SHA1 e6c2df997465afcd632b2ace46904d113235c7b5
SHA512 1ef1025a32a0d36f8f5538ad77154854e1699082598dc5ca6277225d55fe0a82b871e98fbbda57c34e3a4a096004081b67a1bf727fedf1d32022314f59b0e6ec
SSDEEP 49152:JaUcDR1+RPokC3NskEQFyalFk4avLWkt/Pxmh75ra+i2MAifUlZIIGT3Ylt3QbBL:N
TLSH
T14566E8D05760ACDBF2EAC747C5621C1D522BE01B222616B0F5CBF5AE8C2BBD19470D9B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

weather_now.json

Path C:\Users\Admin\AppData\Roaming\com.swiftsoft\ExLoader_Installer\network_fallback\weather_now.json
Size 38KB
SHA256 e899322c1a6d8174a8f3bb517660387730dd14f4ef9705aae246e4688b3b9a43
MD5 e6540b7b29a930d9a707aafd75af53d2
SHA1 d3b816c6b63a054a615169e9faa7a4e264c3890d
SHA512 c4cd191af118e0a8c35e01fdf9e9cb91499d270f90c5b49bc7d7e496c8348a1c0cce2aea13680bc243d7dcdd60f4f478067302f2f1623ff77c211facbdab1fff
SSDEEP 384:YXkVnd/hB1jIgKA3PCyQ/FZ11PsFpswtHtBfqNPr1B:WSJh/Igj/8dZ/PsFKwhtBfqNPhB
TLSH
T15E033520E231CD676519237B2869306219C58A2F8EC43E49778DCD0C9F8DA5F67FAE1D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

shared_preferences.json

Path C:\Users\Admin\AppData\Roaming\com.swiftsoft\ExLoader_Installer\shared_preferences.json
Size 144B
SHA256 ca27d5525613c9f5b6f3dd85c2e7ea8ea3f0cf9268e0b1306f118ab823d798e8
MD5 4cd7a6c27ce79b616d0966f6c0acd551
SHA1 854bca21f5300afd6e2b882b0c7817a9fca6f04b
SHA512 c1263ab94ab7a18c592cd5957e55a25a0fb66eb214f6e4825eefcdb121b9e3d8fc181305029122ce4708ca1b4fd91c2a0db2512e8472991aa50127c444313f80
TLSH
T1B8C04CCA8B8401E13D91CA4155BDF4F595605A05C49248090929015CC74361FEBDFD12
MD5 SHA1 SHA512 TLSH

Submit Download

ExLoader_Installer.zip.crdownload

Path C:\Users\Admin\Downloads\ExLoader_Installer.zip.crdownload
Size 23.7MB
SHA256 ed76f841d866a82c26d0f5b59a41ea89deef85d5819f3ba9e7dcb0212c073e0d
MD5 a2a1f6f0c76f692a721292df8e6f779d
SHA1 d38d053bb541abdc1fbc5531d8c66aeb430b3d32
SHA512 748ce3e79b7c69b6d04360853739ce47823a0aab221ddff5edad50baaa12d048b3f12395d223b72ba9a95c1a9292d6a713cbff89203c862d8f2bc0ce031b0434
SSDEEP 393216:kN6+R5xTUGIk2iG0Y9mpiRwWvPUJ2bQ1GEfruhFIpmEsUX35pt8xtyPHjCQo6Cw8:kN7RFIkYmiwWvC20buTmm+Wxy+QumW5n
TLSH
T1D94733C1DB9160A7CD36A7B3857CB0B2D308229F62F35634859CC3606E4BEA8D615FD8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ExLoader_Installer.zip:Zone.Identifier

Path C:\Users\Admin\Downloads\ExLoader_Installer.zip:Zone.Identifier
Size 122B
SHA256 a97dc0a92d8aa6df1452fd690a912c0cb496839d9347cedcded866d291a66ef5
MD5 8858fd4e25a11c6d4c815f556331d4c2
SHA1 ee205aa735a7777296b949c2a39c030141348625
SHA512 bea907b0bb2dfe6533303bdb1bba11e2dcd8f2adb6702b82836bd72be256f093acc0870ebc0ad8e94c774a161dccd5a73caf7b11e04b2f0e4d03d352a9fa27ee
TLSH
T10DB02B670540C0241300A1C0037CCC1C510A7403CC13C961F7C3048EF8E0050D0F8803
MD5 SHA1 SHA512 TLSH

Submit Download

OperaGXSetup.exe:Zone.Identifier

Path C:\Users\Admin\Downloads\OperaGXSetup.exe:Zone.Identifier
Size 559B
SHA256 1337a10aa3f28756f9064ee3df7d0570cd943e04153d59ec5dd7d71dd10ef136
MD5 f7fbb8e8d7d6e3cb7dd23663463a5a46
SHA1 ce4db2e08d8ca54b409956597dc40be09102d451
SHA512 007f43eef995dbf858d4f038d99e20560a6e28687165c4990bdd38c5223d42bc2fca9b404530e6f3ac99e37d70367a911cbabaf6ca55c9f073df1513f3a65d1a
TLSH
T1F6F0EB81810F881293A1C2A472F227DC404B26268DB58C9CF3D3417398EA99BE5D6F0C
MD5 SHA1 SHA512 TLSH

Submit Download

icarus_rvrt.exe

Path C:\Windows\System32\icarus_rvrt.exe
Size 54KB
SHA256 097709779bf6e7a3f93b65510c1df2a6d28c2c8052874b39d560addfccc44493
MD5 9509e1083e6c87ed87fea572faf4707c
SHA1 d1edbd6a19219182d44daee650d7ccdb5f577073
SHA512 881d3ebc9da69fa08346a288b47381437c9325800b42f1034980fdd765cdb25a758f7985f4114bc9f6cf19eecff97834ec237fbf7b67d65d6adc16b5e7932fb1
SSDEEP 768:Skew5tXCQd8uLs7c9kyrHFLEPZqnF6AmbL/hamzxOW9zRrA:Sk75so8uLs7MDBEPZCF6VBamzUizZA
TLSH
T14F435B1323A850C0E67E8478A3F49923AEB236D617206A5F3164D46829A5FD1F73D36E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bug_report.exe

Path C:\Windows\Temp\asw-9e77c686-b539-4484-b851-da0a6279d451\avast-av-vps\bug_report.exe
Size 6.2MB
SHA256 2bcfac6660a5c8717133a8d0a1b522561de6e79cf657c7c08a526b33cd5336df
MD5 167357221e0e2be05e0fdb9e8245287e
SHA1 9bfd53e084d7b229b4b16830eb3a4b47e25c8e79
SHA512 005d0f92db24824d32ed2adfd073b9d507d39c8b8373c377fa4556446fc0407b7dbaf1e9d671ca3a95a5531251e3d7acc6cf9c10807635cdbb24ed5bc61eda6d
SSDEEP 49152:c2dhHhl4AZ7xDDsQ6bNGJinG18ZFzkgMTltczBhkhNFjTruz8oBe6dszQ56zba9Q:bpD7gzwtGRNjw/ECDbROcfCHb7Wy3o
TLSH
T115668D1E7A5E00E9C1BFE1788A47950BEAB13896033597DB66E18E560F13AF45F3E700
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dump_process.exe

Path C:\Windows\Temp\asw-9e77c686-b539-4484-b851-da0a6279d451\avast-av-vps\dump_process.exe
Size 3.9MB
SHA256 b47018484a97224db990f0c11ebd37d791da7eea304a8cb6b5816dd3fcf833e2
MD5 486b4576f6c385a55de9ab7c9225f01a
SHA1 766183a741dbbb8631ef8203452531481d8f7c89
SHA512 818397d7b3403cc1a5441f63f30bc5014aaeca89449e738989254b33ad43cc2d0c9b87d23f29e695c9182e8ca14f131607cfea243dc554fc634d6d614fd0b475
SSDEEP 49152:BV+gV7rwT6AgjJBDVsFUtRz5Z/baR1exF/LCoBs1GnttNtMteAndJkcKyr0MJUXP:eNGBTZHBsK
TLSH
T126166B0EBA1D00E9C1FEE17D8A87550BEA713C96433557CB66E0AE590F23AE15E7E700
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icarus.exe

Path C:\Windows\Temp\asw-9e77c686-b539-4484-b851-da0a6279d451\avast-av-vps\icarus.exe
Size 9.3MB
SHA256 48bd9a443922dbb3115b502e274d04a52093452ae1893b994d2f069b75a4b8e3
MD5 e9de3472b63f6b1feebdc0158d785368
SHA1 c7a09f82285ee44837ae4d1fc2d315bb4f8997f1
SHA512 1aae253e12e0723291f4070d5638fd992927da72423cc5c9f99d56495b132c179bae7930376dc80265636ba22d71cb3bc4b109afd5a33e370dd9dab572cbb496
SSDEEP 98304:v/GbIjdIM5fQyjRVa0dHGnkpIw7N23YhHtXM:v/GkjdIWfFPPHGnkpIw7N23YhHtXM
TLSH
T1A8A66C1EBA6D01E5C1FEE1788A47641BEE717C95033996DB66E08D461F23AF09E3E700
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icarus_ui.exe

Path C:\Windows\Temp\asw-9e77c686-b539-4484-b851-da0a6279d451\avast-av\icarus_ui.exe
Size 12.4MB
SHA256 27b182eb25547cc7f92a3de5c4150df04c2daf90459f50d64b39d7dfacb9b4fc
MD5 e1f4f2fa8dd23ec4b104946a3f979648
SHA1 2416d67d417fef74c4af162c96033a1607c9c57c
SHA512 a8443b44ef2d77117a67f4e86adfd38388f2eccc0e277547b1bd11c4034a786acd249b728ae8fa2035b49860aa24b8069913fe0ba092e668ba91347411bb2c50
SSDEEP 196608:MNuXe89UFCVd3TZGhRLwOWe1rqNxBy2l:9xdDZ259N1rqNxBy2
TLSH
T127D68D6A76A480D4C0BEC0788A5B950BEBB37C95133497CF16E15B5A1F23AF49E7E310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

product-def.xml

Path C:\Windows\Temp\asw-9e77c686-b539-4484-b851-da0a6279d451\avast-av\product-def.xml
Size 2.0MB
SHA256 92e78b09373de33f959cf3724d803d302df0fd175fc4a773806d729606b51de5
MD5 3c7e5452241a5f34a05cff640a378517
SHA1 934835d0d3d5d6b7f56960fb79722b70e72f29f8
SHA512 3b522e8c5514481c78bcd7246a35d326ba667818f37e934b83bd102ccbbd1fc9fd39042b3f22bc0a2cc2d7c3bd3eb8c520b538c7c8528b0a731a6512c86a0934
SSDEEP 24576:viXwMNQZij0tf1Ow2r9qWJ3qgyzTmvju3hR8:vigMlYfH+2pH8
TLSH
T16EA54D7A355E7DBB704B50E7B480BC81629FDD7889E00C97F1B33140A653EB29A72A74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setupui.cont

Path C:\Windows\Temp\asw-9e77c686-b539-4484-b851-da0a6279d451\avast-av\setupui.cont
Size 607KB
SHA256 0125fea5182467cc636bec13ad9128f28e57cbe5e9770a5f8987ee27661871ce
MD5 01e6eec3ce2af3d448cf97b6f8870441
SHA1 a61f44a9c3673d6a08487db24a217b4a1958940d
SHA512 572331fd0801fc05bbd3870ecb15adfcb4e1a4407f9c53a221d3ebb01594b450bb66cfe2a7248e033ddb2adc8279998449d47e84c1dfe3b9a33a13694ec16e7b
SSDEEP 12288:Zs3OmpImPpng+7TCC2XrCHJoey5XD92rVMqTasOH2w+CFY43Fj+8f2LTO:Z+tImxg+6HWFy2rVZTlOH22lVj+8fh
TLSH
T1A8D42373D50F0122979B1635CA783EC2C8E2785EF1B5A85528904F84795BB2FB11F8EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/688-2296-0x000001CCCA700000-0x000001CCCA780000-memory.dmp

Download

memory/688-2297-0x000001CCCA700000-0x000001CCCA780000-memory.dmp

Download

memory/3608-846-0x000001D53ED50000-0x000001D5402E5000-memory.dmp

Download

memory/3608-844-0x000001D53E940000-0x000001D53E941000-memory.dmp

Download

memory/3608-869-0x000001D540F00000-0x000001D540F06000-memory.dmp

Download

memory/3608-845-0x000001D53ED50000-0x000001D5402E5000-memory.dmp

Download

memory/3608-850-0x000001D53E980000-0x000001D53EA00000-memory.dmp

Download

memory/3608-851-0x000001D53E980000-0x000001D53EA00000-memory.dmp

Download

memory/3608-847-0x000001D53ED50000-0x000001D5402E5000-memory.dmp

Download

memory/3608-848-0x000001D53E950000-0x000001D53E951000-memory.dmp

Download

memory/5740-1056-0x0000029AEF0F0000-0x0000029AEF0F1000-memory.dmp

Download

memory/5740-1053-0x0000029AEF7E0000-0x0000029AF0D8D000-memory.dmp

Download

memory/5740-1052-0x0000029AEF0E0000-0x0000029AEF0E1000-memory.dmp

Download

memory/5740-1055-0x0000029AEF7E0000-0x0000029AF0D8D000-memory.dmp

Download

memory/5740-1070-0x0000029AF0E00000-0x0000029AF0E80000-memory.dmp

Download

memory/5740-1069-0x0000029AF0E00000-0x0000029AF0E80000-memory.dmp

Download

memory/5740-1054-0x0000029AEF7E0000-0x0000029AF0D8D000-memory.dmp

Download