Overview
overview
5Static
static
5FSViewerSetup81.exe
windows10-2004-x64
4FSViewerSetup81.exe
windows11-ltsc_2024-x64
4$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...ns.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows11-ltsc_2024-x64
3EmailZipEXE.exe
windows10-2004-x64
3EmailZipEXE.exe
windows11-ltsc_2024-x64
3FSIcons.dll
windows10-2004-x64
3FSIcons.dll
windows11-ltsc_2024-x64
3FSViewer.exe
windows10-2004-x64
3FSViewer.exe
windows11-ltsc_2024-x64
3FSViewerHelp.chm
windows10-2004-x64
1FSViewerHelp.chm
windows11-ltsc_2024-x64
1Languages/...10.chm
windows10-2004-x64
1Languages/...10.chm
windows11-ltsc_2024-x64
1Languages/...11.chm
windows10-2004-x64
1Languages/...11.chm
windows11-ltsc_2024-x64
1Languages/...13.chm
windows10-2004-x64
1Languages/...13.chm
windows11-ltsc_2024-x64
1Languages/...15.chm
windows10-2004-x64
1Languages/...15.chm
windows11-ltsc_2024-x64
1Languages/...17.chm
windows10-2004-x64
1Languages/...17.chm
windows11-ltsc_2024-x64
1Languages/...18.chm
windows10-2004-x64
1Languages/...18.chm
windows11-ltsc_2024-x64
1Languages/...21.chm
windows10-2004-x64
1Languages/...21.chm
windows11-ltsc_2024-x64
1Languages/..._4.chm
windows10-2004-x64
1Languages/..._4.chm
windows11-ltsc_2024-x64
1Languages/..._5.chm
windows10-2004-x64
1Languages/..._5.chm
windows11-ltsc_2024-x64
1Analysis
- max time kernel
150s - max time network
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
15/08/2026, 00:22
Behavioral task
behavioral1
Sample
FSViewerSetup81.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
FSViewerSetup81.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
15 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral7
Sample
EmailZipEXE.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral8
Sample
EmailZipEXE.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral9
Sample
FSIcons.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral10
Sample
FSIcons.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral11
Sample
FSViewer.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral12
Sample
FSViewer.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
Behavioral task
behavioral13
Sample
FSViewerHelp.chm
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral14
Sample
FSViewerHelp.chm
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral15
Sample
Languages/FSViewerHelp_10.chm
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral16
Sample
Languages/FSViewerHelp_10.chm
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral17
Sample
Languages/FSViewerHelp_11.chm
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral18
Sample
Languages/FSViewerHelp_11.chm
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral19
Sample
Languages/FSViewerHelp_13.chm
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral20
Sample
Languages/FSViewerHelp_13.chm
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral21
Sample
Languages/FSViewerHelp_15.chm
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral22
Sample
Languages/FSViewerHelp_15.chm
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral23
Sample
Languages/FSViewerHelp_17.chm
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral24
Sample
Languages/FSViewerHelp_17.chm
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral25
Sample
Languages/FSViewerHelp_18.chm
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral26
Sample
Languages/FSViewerHelp_18.chm
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral27
Sample
Languages/FSViewerHelp_21.chm
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral28
Sample
Languages/FSViewerHelp_21.chm
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral29
Sample
Languages/FSViewerHelp_4.chm
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral30
Sample
Languages/FSViewerHelp_4.chm
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral31
Sample
Languages/FSViewerHelp_5.chm
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral32
Sample
Languages/FSViewerHelp_5.chm
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
General
- Target FSViewerSetup81.exe
- Size 8.4MB
- Sample260815-apavcswtaw
- SHA256 f4f804b3b645f3510ba29d57ee3e26fd7a032022f54c39eceaee42b4f4072113
- MD5 e60e087adccb9d0041a4356176be4a32
- SHA1 92cae57f5c334eff38150489699df7203665dd7a
- SHA512 6cb36e5ec4966017bb295ef123280d6b23436784cc5781853d4eb5f519f9068273381b6688223bb15ca40ffce4ed0094e57eea50af1c48b64ef7620c9fd950b3
- SSDEEP 196608:Bo/Ggc/C4W3yGumQt8P7hs+7/fP+rjK52O3CbACs32+J4uOvSeoV:BXPWCGum3hsafNcU32+J4qX
- TLSH T19A96336FE04C8A52F4A3D5F75CD747C219F4BC0A67248BD69A0D7D892C03B4AB54E2A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
4/10
Malware Config
Signatures
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\FastStone Image Viewer\Mask\Mask45.jpg FSViewerSetup81.exe File created C:\Program Files (x86)\FastStone Image Viewer\Mask\Mask71.jpg FSViewerSetup81.exe File created C:\Program Files (x86)\FastStone Image Viewer\Mask\Mask84.jpg FSViewerSetup81.exe File created C:\Program Files (x86)\FastStone Image Viewer\FSMenuIcons4.db FSViewerSetup81.exe File created C:\Program Files (x86)\FastStone Image Viewer\fsim.db FSViewerSetup81.exe File created C:\Program Files (x86)\FastStone Image Viewer\Languages\FSIV08.fslang FSViewerSetup81.exe File created C:\Program Files (x86)\FastStone Image Viewer\Languages\FSIV16.fslang FSViewerSetup81.exe File created C:\Program Files (x86)\FastStone Image Viewer\Callout\FSCallout_32_20079593.png FSViewerSetup81.exe File created C:\Program Files (x86)\FastStone Image Viewer\Mask\Mask14.jpg FSViewerSetup81.exe File created C:\Program Files (x86)\FastStone Image Viewer\Mask\Mask68.jpg FSViewerSetup81.exe File created C:\Program Files (x86)\FastStone Image Viewer\Mask\Mask73.jpg FSViewerSetup81.exe File created C:\Program Files (x86)\FastStone Image Viewer\Callout\FSCallout_14_16168477.png FSViewerSetup81.exe File created C:\Program Files (x86)\FastStone Image Viewer\Mask\Mask09.jpg FSViewerSetup81.exe File created C:\Program Files (x86)\FastStone Image Viewer\Mask\Mask15.jpg FSViewerSetup81.exe File created C:\Program Files (x86)\FastStone Image Viewer\Mask\Mask17.jpg FSViewerSetup81.exe File created C:\Program Files (x86)\FastStone Image Viewer\Mask\Mask75.jpg FSViewerSetup81.exe File created C:\Program Files (x86)\FastStone Image Viewer\Mask\Mask94.jpg FSViewerSetup81.exe File created C:\Program Files (x86)\FastStone Image Viewer\fsplugin07.dll FSViewerSetup81.exe File created C:\Program Files (x86)\FastStone Image Viewer\Languages\FSIV02.fslang FSViewerSetup81.exe File created C:\Program Files (x86)\FastStone Image Viewer\Languages\FSViewerHelp_10.chm FSViewerSetup81.exe File created C:\Program Files (x86)\FastStone Image Viewer\Mask\Mask89.jpg FSViewerSetup81.exe File created C:\Program Files (x86)\FastStone Image Viewer\Mask\Mask90.jpg FSViewerSetup81.exe File created C:\Program Files (x86)\FastStone Image Viewer\Languages\FSIV19.fslang FSViewerSetup81.exe File created C:\Program Files (x86)\FastStone Image Viewer\Mask\Mask08.jpg FSViewerSetup81.exe File created C:\Program Files (x86)\FastStone Image Viewer\Mask\Mask87.jpg FSViewerSetup81.exe File created C:\Program Files (x86)\FastStone Image Viewer\Callout\FSCallout_16_16228485.png FSViewerSetup81.exe File created C:\Program Files (x86)\FastStone Image Viewer\Callout\FSCallout_25_05069573.png FSViewerSetup81.exe File created C:\Program Files (x86)\FastStone Image Viewer\Callout\FSCallout_31_05078093.png FSViewerSetup81.exe File created C:\Program Files (x86)\FastStone Image Viewer\Mask\Mask19.jpg FSViewerSetup81.exe File created C:\Program Files (x86)\FastStone Image Viewer\Mask\Mask30.jpg FSViewerSetup81.exe File created C:\Program Files (x86)\FastStone Image Viewer\Mask\Mask60.jpg FSViewerSetup81.exe File created C:\Program Files (x86)\FastStone Image Viewer\Mask\Mask66.jpg FSViewerSetup81.exe File created C:\Program Files (x86)\FastStone Image Viewer\Mask\Mask69.jpg FSViewerSetup81.exe File created C:\Program Files (x86)\FastStone Image Viewer\Languages\FSIV12.fslang FSViewerSetup81.exe File created C:\Program Files (x86)\FastStone Image Viewer\Mask\Mask35.jpg FSViewerSetup81.exe File created C:\Program Files (x86)\FastStone Image Viewer\Mask\Mask42.jpg FSViewerSetup81.exe File created C:\Program Files (x86)\FastStone Image Viewer\Mask\Mask55.jpg FSViewerSetup81.exe File created C:\Program Files (x86)\FastStone Image Viewer\Mask\Mask67.jpg FSViewerSetup81.exe File created C:\Program Files (x86)\FastStone Image Viewer\Mask\Mask74.jpg FSViewerSetup81.exe File created C:\Program Files (x86)\FastStone Image Viewer\Mask\Mask83.jpg FSViewerSetup81.exe File created C:\Program Files (x86)\FastStone Image Viewer\FSMenuIcons0.db FSViewerSetup81.exe File created C:\Program Files (x86)\FastStone Image Viewer\fsplugin02.dll FSViewerSetup81.exe File created C:\Program Files (x86)\FastStone Image Viewer\libsharpyuv.dll FSViewerSetup81.exe File created C:\Program Files (x86)\FastStone Image Viewer\Callout\FSCallout_01_16168059.png FSViewerSetup81.exe File created C:\Program Files (x86)\FastStone Image Viewer\Callout\FSCallout_05_16148476.png FSViewerSetup81.exe File created C:\Program Files (x86)\FastStone Image Viewer\Mask\Mask04.jpg FSViewerSetup81.exe File created C:\Program Files (x86)\FastStone Image Viewer\Mask\Mask50.jpg FSViewerSetup81.exe File created C:\Program Files (x86)\FastStone Image Viewer\Mask\Mask72.jpg FSViewerSetup81.exe File created C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe FSViewerSetup81.exe File created C:\Program Files (x86)\FastStone Image Viewer\Callout\FSCallout_18_20228065.png FSViewerSetup81.exe File created C:\Program Files (x86)\FastStone Image Viewer\Mask\Mask23.jpg FSViewerSetup81.exe File created C:\Program Files (x86)\FastStone Image Viewer\Mask\Mask43.jpg FSViewerSetup81.exe File created C:\Program Files (x86)\FastStone Image Viewer\Mask\Mask91.jpg FSViewerSetup81.exe File created C:\Program Files (x86)\FastStone Image Viewer\Languages\FSIV09.fslang FSViewerSetup81.exe File created C:\Program Files (x86)\FastStone Image Viewer\Callout\FSCallout_19_25307573.png FSViewerSetup81.exe File created C:\Program Files (x86)\FastStone Image Viewer\Callout\FSCallout_34_05079593.png FSViewerSetup81.exe File created C:\Program Files (x86)\FastStone Image Viewer\Mask\Mask20.jpg FSViewerSetup81.exe File created C:\Program Files (x86)\FastStone Image Viewer\Mask\Mask25.jpg FSViewerSetup81.exe File created C:\Program Files (x86)\FastStone Image Viewer\Mask\Mask77.jpg FSViewerSetup81.exe File created C:\Program Files (x86)\FastStone Image Viewer\Mask\Mask02.jpg FSViewerSetup81.exe File created C:\Program Files (x86)\FastStone Image Viewer\Mask\Mask16.jpg FSViewerSetup81.exe File created C:\Program Files (x86)\FastStone Image Viewer\FSMenuIcons1.db FSViewerSetup81.exe File created C:\Program Files (x86)\FastStone Image Viewer\Callout\FSCallout_17_16188482.png FSViewerSetup81.exe File created C:\Program Files (x86)\FastStone Image Viewer\Callout\FSCallout_26_05289594.png FSViewerSetup81.exe - Drops file in Windows directory 5 IoCs
description ioc Process File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6120_1205880280\protocols.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6120_1007490391\manifest.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6120_1007490391\nav_config.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6120_1693210134\manifest.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6120_1205880280\manifest.json msedge.exe - Loads dropped DLL 64 IoCs
pid Process 4892 FSViewerSetup81.exe 4892 FSViewerSetup81.exe 4892 FSViewerSetup81.exe 4892 FSViewerSetup81.exe 4892 FSViewerSetup81.exe 4892 FSViewerSetup81.exe 4892 FSViewerSetup81.exe 4892 FSViewerSetup81.exe 4892 FSViewerSetup81.exe 4892 FSViewerSetup81.exe 4892 FSViewerSetup81.exe 4892 FSViewerSetup81.exe 4892 FSViewerSetup81.exe 4892 FSViewerSetup81.exe 4892 FSViewerSetup81.exe 4892 FSViewerSetup81.exe 4892 FSViewerSetup81.exe 4892 FSViewerSetup81.exe 4892 FSViewerSetup81.exe 4892 FSViewerSetup81.exe 4892 FSViewerSetup81.exe 4892 FSViewerSetup81.exe 4892 FSViewerSetup81.exe 4892 FSViewerSetup81.exe 4892 FSViewerSetup81.exe 4892 FSViewerSetup81.exe 4892 FSViewerSetup81.exe 4892 FSViewerSetup81.exe 4892 FSViewerSetup81.exe 4892 FSViewerSetup81.exe 4892 FSViewerSetup81.exe 4892 FSViewerSetup81.exe 4892 FSViewerSetup81.exe 4892 FSViewerSetup81.exe 4892 FSViewerSetup81.exe 4892 FSViewerSetup81.exe 4892 FSViewerSetup81.exe 4892 FSViewerSetup81.exe 4892 FSViewerSetup81.exe 4892 FSViewerSetup81.exe 4892 FSViewerSetup81.exe 4892 FSViewerSetup81.exe 4892 FSViewerSetup81.exe 4892 FSViewerSetup81.exe 4892 FSViewerSetup81.exe 4892 FSViewerSetup81.exe 4892 FSViewerSetup81.exe 4892 FSViewerSetup81.exe 4892 FSViewerSetup81.exe 4892 FSViewerSetup81.exe 4892 FSViewerSetup81.exe 4892 FSViewerSetup81.exe 4892 FSViewerSetup81.exe 4892 FSViewerSetup81.exe 4892 FSViewerSetup81.exe 4892 FSViewerSetup81.exe 4892 FSViewerSetup81.exe 4892 FSViewerSetup81.exe 4892 FSViewerSetup81.exe 4892 FSViewerSetup81.exe 4892 FSViewerSetup81.exe 4892 FSViewerSetup81.exe 4892 FSViewerSetup81.exe 4892 FSViewerSetup81.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FSViewerSetup81.exe - System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 3716 msedge.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134312270290433715" msedge.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry msedge.exe - Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.jpeg\OpenWithProgids\FastStone.jpeg FSViewerSetup81.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FastStone.pcx\ = "FastStone PCX File" FSViewerSetup81.exe Key created \REGISTRY\MACHINE\Software\Classes\FastStone.psd\shell FSViewerSetup81.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FastStone.mrw\shell\open\command\ = "\"C:\\Program Files (x86)\\FastStone Image Viewer\\FSViewer.exe\" \"%1\"" FSViewerSetup81.exe Key created \REGISTRY\MACHINE\Software\Classes\FastStone.pef FSViewerSetup81.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FastStone.srf\shell\ FSViewerSetup81.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FastStone.arw\DefaultIcon\ = "C:\\Program Files (x86)\\FastStone Image Viewer\\FSIcons.db,18" FSViewerSetup81.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FastStone.jpeg\shell\ FSViewerSetup81.exe Key created \REGISTRY\MACHINE\Software\Classes\FastStone.png FSViewerSetup81.exe Key created \REGISTRY\MACHINE\Software\Classes\FastStone.cr2 FSViewerSetup81.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FastStone.fax\shell\open\ FSViewerSetup81.exe Key created \REGISTRY\MACHINE\Software\Classes\FastStone.nef\shell FSViewerSetup81.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FastStone.mrw\ = "FastStone MRW File" FSViewerSetup81.exe Key created \REGISTRY\MACHINE\Software\Classes\.jpg\OpenWithProgids FSViewerSetup81.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FastStone.wmf\shell\open\ FSViewerSetup81.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FastStone.wmf\shell\open\command\ = "\"C:\\Program Files (x86)\\FastStone Image Viewer\\FSViewer.exe\" \"%1\"" FSViewerSetup81.exe Key created \REGISTRY\MACHINE\Software\Classes\FastStone.cr2\shell FSViewerSetup81.exe Key created \REGISTRY\MACHINE\Software\Classes\FastStone.arw\DefaultIcon FSViewerSetup81.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FastStone.rw2\shell\open\ FSViewerSetup81.exe Key created \REGISTRY\MACHINE\Software\Classes\FastStone.mrw\DefaultIcon FSViewerSetup81.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.fax\OpenWithProgids FSViewerSetup81.exe Key created \REGISTRY\MACHINE\Software\Classes\FastStone.crw\shell\open\command FSViewerSetup81.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FastStone-Image-Viewer\shell\open\command FSViewerSetup81.exe Key created \REGISTRY\MACHINE\Software\Classes\.fax\OpenWithProgids FSViewerSetup81.exe Key created \REGISTRY\MACHINE\Software\Classes\FastStone.cr3\DefaultIcon FSViewerSetup81.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FastStone.orf\shell\ FSViewerSetup81.exe Key created \REGISTRY\MACHINE\Software\Classes\FastStone.wmf\shell\open FSViewerSetup81.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FastStone.tga\ = "FastStone TGA File" FSViewerSetup81.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FastStone.pef\shell\open\ FSViewerSetup81.exe Key created \REGISTRY\MACHINE\Software\Classes\FastStone.jpg\DefaultIcon FSViewerSetup81.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FastStone.jpg\DefaultIcon\ = "C:\\Program Files (x86)\\FastStone Image Viewer\\FSIcons.db,4" FSViewerSetup81.exe Key created \REGISTRY\MACHINE\Software\Classes\FastStone.bmp\shell\open\command FSViewerSetup81.exe Key created \REGISTRY\MACHINE\Software\Classes\FastStone.tiff\shell FSViewerSetup81.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.fax FSViewerSetup81.exe Key created \REGISTRY\MACHINE\Software\Classes\FastStone.tga\shell FSViewerSetup81.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FastStone.nef\shell\ FSViewerSetup81.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FastStone.raf\DefaultIcon\ = "C:\\Program Files (x86)\\FastStone Image Viewer\\FSIcons.db,13" FSViewerSetup81.exe Key created \REGISTRY\MACHINE\Software\Classes\.gif\OpenWithProgids FSViewerSetup81.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FastStone.cr2\shell\open\ FSViewerSetup81.exe Key created \REGISTRY\MACHINE\Software\Classes\FastStone.orf\shell FSViewerSetup81.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FastStone.mrw\DefaultIcon\ = "C:\\Program Files (x86)\\FastStone Image Viewer\\FSIcons.db,15" FSViewerSetup81.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FastStone.pcx\shell\ FSViewerSetup81.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FastStone.orf\shell\open\command\ = "\"C:\\Program Files (x86)\\FastStone Image Viewer\\FSViewer.exe\" \"%1\"" FSViewerSetup81.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FastStone.dng\shell\open\command\ = "\"C:\\Program Files (x86)\\FastStone Image Viewer\\FSViewer.exe\" \"%1\"" FSViewerSetup81.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FastStone.webp\ = "FastStone WEBP File" FSViewerSetup81.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FastStone.gif\shell\open\command\ = "\"C:\\Program Files (x86)\\FastStone Image Viewer\\FSViewer.exe\" \"%1\"" FSViewerSetup81.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FastStone.fax\shell\ FSViewerSetup81.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FastStone.png\shell\open\ FSViewerSetup81.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FastStone.cr2\shell\ FSViewerSetup81.exe Key created \REGISTRY\MACHINE\Software\Classes\FastStone.cr2\shell\open FSViewerSetup81.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FastStone.webp\shell\open\ FSViewerSetup81.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FastStone.psd\DefaultIcon\ = "C:\\Program Files (x86)\\FastStone Image Viewer\\FSIcons.db,8" FSViewerSetup81.exe Key created \REGISTRY\MACHINE\Software\Classes\FastStone.orf\shell\open FSViewerSetup81.exe Key created \REGISTRY\MACHINE\Software\Classes\FastStone.raf\DefaultIcon FSViewerSetup81.exe Key created \REGISTRY\MACHINE\Software\Classes\FastStone-Image-Viewer\DefaultIcon FSViewerSetup81.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FastStone.tif\DefaultIcon\ = "C:\\Program Files (x86)\\FastStone Image Viewer\\FSIcons.db,10" FSViewerSetup81.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FastStone.tif\shell\open\ FSViewerSetup81.exe Key created \REGISTRY\MACHINE\Software\Classes\FastStone.tga FSViewerSetup81.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FastStone.cr3\shell\ FSViewerSetup81.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FastStone.cr3\shell\open\ FSViewerSetup81.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FastStone.orf\ = "FastStone ORF File" FSViewerSetup81.exe Key created \REGISTRY\MACHINE\Software\Classes\FastStone.raf\shell FSViewerSetup81.exe Key created \REGISTRY\MACHINE\Software\Classes\FastStone.heic\DefaultIcon FSViewerSetup81.exe Key created \REGISTRY\MACHINE\Software\Classes\FastStone.tif FSViewerSetup81.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3360 msedge.exe 3360 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 6120 msedge.exe 6120 msedge.exe 6120 msedge.exe 6120 msedge.exe 6120 msedge.exe 6120 msedge.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 4892 FSViewerSetup81.exe 6120 msedge.exe - Suspicious use of WriteProcessMemory 46 IoCs
description pid Process procid_target PID 4892 wrote to memory of 6120 4892 FSViewerSetup81.exe 90 PID 6120 wrote to memory of 4764 6120 msedge.exe 91 PID 6120 wrote to memory of 2612 6120 msedge.exe 94 PID 6120 wrote to memory of 3716 6120 msedge.exe 95 PID 6120 wrote to memory of 2612 6120 msedge.exe 94 PID 6120 wrote to memory of 2612 6120 msedge.exe 94 PID 6120 wrote to memory of 5876 6120 msedge.exe 96 PID 6120 wrote to memory of 5876 6120 msedge.exe 96 PID 6120 wrote to memory of 1524 6120 msedge.exe 111 PID 6120 wrote to memory of 1524 6120 msedge.exe 111 PID 6120 wrote to memory of 1524 6120 msedge.exe 111 PID 6120 wrote to memory of 3924 6120 msedge.exe 98 PID 6120 wrote to memory of 3924 6120 msedge.exe 98 PID 6120 wrote to memory of 3924 6120 msedge.exe 98 PID 6120 wrote to memory of 3812 6120 msedge.exe 99 PID 6120 wrote to memory of 3812 6120 msedge.exe 99 PID 6120 wrote to memory of 4164 6120 msedge.exe 100 PID 6120 wrote to memory of 3812 6120 msedge.exe 99 PID 6120 wrote to memory of 4164 6120 msedge.exe 100 PID 6120 wrote to memory of 4164 6120 msedge.exe 100 PID 6120 wrote to memory of 608 6120 msedge.exe 102 PID 6120 wrote to memory of 608 6120 msedge.exe 102 PID 6120 wrote to memory of 4464 6120 msedge.exe 103 PID 6120 wrote to memory of 4464 6120 msedge.exe 103 PID 6120 wrote to memory of 4464 6120 msedge.exe 103 PID 6120 wrote to memory of 5192 6120 msedge.exe 104 PID 6120 wrote to memory of 5004 6120 msedge.exe 105 PID 6120 wrote to memory of 5192 6120 msedge.exe 104 PID 6120 wrote to memory of 5004 6120 msedge.exe 105 PID 6120 wrote to memory of 3396 6120 msedge.exe 107 PID 6120 wrote to memory of 5900 6120 msedge.exe 108 PID 6120 wrote to memory of 5900 6120 msedge.exe 108 PID 6120 wrote to memory of 3676 6120 msedge.exe 109 PID 6120 wrote to memory of 3676 6120 msedge.exe 109 PID 6120 wrote to memory of 3356 6120 msedge.exe 113 PID 6120 wrote to memory of 2636 6120 msedge.exe 114 PID 6120 wrote to memory of 5800 6120 msedge.exe 115 PID 6120 wrote to memory of 4996 6120 msedge.exe 116 PID 6120 wrote to memory of 4996 6120 msedge.exe 116 PID 6120 wrote to memory of 2912 6120 msedge.exe 120 PID 6120 wrote to memory of 2912 6120 msedge.exe 120 PID 6120 wrote to memory of 2076 6120 msedge.exe 121 PID 6120 wrote to memory of 2076 6120 msedge.exe 121 PID 6120 wrote to memory of 5400 6120 msedge.exe 122 PID 6120 wrote to memory of 5400 6120 msedge.exe 122 PID 6120 wrote to memory of 3360 6120 msedge.exe 123
Processes
-
C:\Users\Admin\AppData\Local\Temp\FSViewerSetup81.exe"C:\Users\Admin\AppData\Local\Temp\FSViewerSetup81.exe"1⤵
- Drops file in Program Files directory
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4892 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.faststone.org/ThankYou.htm2⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:6120 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x318,0x7ff8b912c188,0x7ff8b912c194,0x7ff8b912c1a03⤵PID:4764
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1628,i,6249478464572025287,7277205785179485322,262144 --field-trial-handle=2684,i,10396883703738532569,5441812753246349993,262144 --variations-seed-version --mojo-platform-channel-handle=2680 /prefetch:23⤵PID:2612
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1816,i,5881579259018927192,13591610644541643683,524288 --field-trial-handle=2684,i,10396883703738532569,5441812753246349993,262144 --variations-seed-version --mojo-platform-channel-handle=2800 /prefetch:113⤵
- System Time Discovery
PID:3716
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2348,i,2528363296887999695,934936897898862986,524288 --field-trial-handle=2684,i,10396883703738532569,5441812753246349993,262144 --variations-seed-version --mojo-platform-channel-handle=3336 /prefetch:133⤵PID:5876
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3604,i,12279237936198155113,2556879347281708582,2097152 --field-trial-handle=2684,i,10396883703738532569,5441812753246349993,262144 --variations-seed-version --mojo-platform-channel-handle=3660 /prefetch:13⤵PID:1524
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3612,i,3818933772173636282,8946749916911163697,2097152 --field-trial-handle=2684,i,10396883703738532569,5441812753246349993,262144 --variations-seed-version --mojo-platform-channel-handle=3728 /prefetch:13⤵PID:3924
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4168,i,10453055860327845894,13565166132999417585,2097152 --field-trial-handle=2684,i,10396883703738532569,5441812753246349993,262144 --variations-seed-version --mojo-platform-channel-handle=4752 /prefetch:13⤵PID:3812
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4180,i,3904416325124453186,15310288979002974862,2097152 --field-trial-handle=2684,i,10396883703738532569,5441812753246349993,262144 --variations-seed-version --mojo-platform-channel-handle=4756 /prefetch:93⤵PID:4164
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5288,i,11856462402975201751,14618268490938961070,524288 --field-trial-handle=2684,i,10396883703738532569,5441812753246349993,262144 --variations-seed-version --mojo-platform-channel-handle=5276 /prefetch:143⤵PID:608
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5248,i,11411569365569718567,14641094855072457397,2097152 --field-trial-handle=2684,i,10396883703738532569,5441812753246349993,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:13⤵PID:4464
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3700,i,2309713340237989054,8865567359696070129,524288 --field-trial-handle=2684,i,10396883703738532569,5441812753246349993,262144 --variations-seed-version --mojo-platform-channel-handle=5548 /prefetch:143⤵PID:5192
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4120,i,6073521470644588126,15789464418277589860,524288 --field-trial-handle=2684,i,10396883703738532569,5441812753246349993,262144 --variations-seed-version --mojo-platform-channel-handle=3680 /prefetch:143⤵PID:5004
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6076,i,8544944595146299458,16402517060437503536,524288 --field-trial-handle=2684,i,10396883703738532569,5441812753246349993,262144 --variations-seed-version --mojo-platform-channel-handle=6092 /prefetch:143⤵PID:5360
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6076,i,8544944595146299458,16402517060437503536,524288 --field-trial-handle=2684,i,10396883703738532569,5441812753246349993,262144 --variations-seed-version --mojo-platform-channel-handle=6092 /prefetch:143⤵PID:3396
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6252,i,16454422356485122879,12266573024480218076,524288 --field-trial-handle=2684,i,10396883703738532569,5441812753246349993,262144 --variations-seed-version --mojo-platform-channel-handle=6232 /prefetch:143⤵PID:5900
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6412,i,4461756389806916771,6164735656165836755,524288 --field-trial-handle=2684,i,10396883703738532569,5441812753246349993,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:143⤵PID:3676
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=744,i,16090537765435607822,4092133203260716912,524288 --field-trial-handle=2684,i,10396883703738532569,5441812753246349993,262144 --variations-seed-version --mojo-platform-channel-handle=5116 /prefetch:143⤵PID:3356
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4772,i,3893290891337188842,14731485590876156151,524288 --field-trial-handle=2684,i,10396883703738532569,5441812753246349993,262144 --variations-seed-version --mojo-platform-channel-handle=4944 /prefetch:143⤵PID:2636
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4816,i,10778274251884034004,15193434932650377686,524288 --field-trial-handle=2684,i,10396883703738532569,5441812753246349993,262144 --variations-seed-version --mojo-platform-channel-handle=4948 /prefetch:143⤵PID:5800
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4932,i,14276838638769990583,946838091341037192,524288 --field-trial-handle=2684,i,10396883703738532569,5441812753246349993,262144 --variations-seed-version --mojo-platform-channel-handle=4944 /prefetch:143⤵PID:4996
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4908,i,1602578952561485166,14730311933076242298,524288 --field-trial-handle=2684,i,10396883703738532569,5441812753246349993,262144 --variations-seed-version --mojo-platform-channel-handle=4976 /prefetch:143⤵PID:2912
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6088,i,4410368310768312492,12271445663741265280,524288 --field-trial-handle=2684,i,10396883703738532569,5441812753246349993,262144 --variations-seed-version --mojo-platform-channel-handle=5776 /prefetch:143⤵PID:2076
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6540,i,2446277476203468305,13135921600830457711,524288 --field-trial-handle=2684,i,10396883703738532569,5441812753246349993,262144 --variations-seed-version --mojo-platform-channel-handle=5616 /prefetch:143⤵PID:5400
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6536,i,3324044653230676281,6203937557451064779,262144 --field-trial-handle=2684,i,10396883703738532569,5441812753246349993,262144 --variations-seed-version --mojo-platform-channel-handle=2920 /prefetch:103⤵
- Suspicious behavior: EnumeratesProcesses
PID:3360
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵PID:2380
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:4520
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵PID:1524
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵PID:1228
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 280B
- SHA256 c95a47aec5edba88214fad580cb869417b6620a91d8ee97e2d0b7801d3372be5
- MD5 aad5f2ca0dd16bb2ea6c7757ea569c50
- SHA1 5228b0b132542be004ea1bb32f3748964d065af5
- SHA512 9d59c0291d741bd9d6cf50c22972d4baef00e7c1a48d6a3311a6cc82c04ceeba6e2be9458334cb954878915cc9eb91a8fd8bc4a47c966d57a2a05d6ee8211640
- TLSH T1D4D09BE177A19D18C545353567D1522591416D31451927194241E13D9D7E2C3455F0AA
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 280B
- SHA256 ac1b1f93ff87eb876027f4166d705375c0f5d3d22dcb03f6a66f6100e88dd10f
- MD5 b99f03c5cfe71b03836f8b5fcf09425b
- SHA1 8a5078499c0b5ea40183efb77f9c1028c196409c
- SHA512 6b9feec4ead7bf05f67d0d480907e21a3b770d8d12dedd2b0d785904186eac7448583e61abacb23582948de55c8ea2043bfd6908efd7faecdd82cee91404cfe6
- TLSH T16DD02BE037909D18C440353163D0122091006C30880923090100A02C8D3E2C3054F0BE
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 2KB
- SHA256 3d734c6cbe04abcd2d85ffce7c05094c30fc5df6b24de7354a9f6b9b71db861b
- MD5 6872304954dfc17691dab2b959bdbbff
- SHA1 8b3d721a3c200ed1006edae4c343dcb28e4aa6c4
- SHA512 937fda59522d49f268cebbe6c5a1b966e15bf5f07cb7c06cb6e725b5987da98828c2df006be3eb59db6d65d5825ce355bcc7cfe34a19a74b6e1b18621d980d8a
- TLSH T1315170612B2D29E3D7B640B370E1185A36FFC40902AF2E20A0D45C745E22F0FACE3867
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a1fbe.TMP
- Size 2KB
- SHA256 9eb2c1b59de4d72c97fb7fa38eea092b7514b1ee9dc305f942356220c42802cf
- MD5 2fa5462db793b66aa3de5c11ca2eaef0
- SHA1 1f51a4e6a82eed8879b1380e24af27630f81865f
- SHA512 c2ef2ca4001e1285847943357f656b6e710e638c655ff94501692b98875a5459325930e13f04958422bb2824e3ae01cdc75570988bc615a731317e59dcc9cd66
- TLSH T17A5162612B2D29E3D7B6407370E5195936FFC44942AF1E20A0D45D745E22F0FACE3867
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
- Size 2B
- SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
- MD5 99914b932bd37a50b983c5e7c90ae93b
- SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
- SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
- Size 70KB
- SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
- MD5 efe54a870e0f5ff28d7e00036b861065
- SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
- SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
- SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
- TLSH T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
- Size 2KB
- SHA256 5c7d4c87a035a03fe2e3d3605760f69a0dd489075b0669dab66d13cf47ce9c9c
- MD5 a0d7bebe0a166a2e6bc2d29ba108018f
- SHA1 79aa5c1f0689016f2a7bb9e2940da531dc64b740
- SHA512 be46fb2323664e5a4dea519b39a0d3db3d1337fc9c77a8bf7fb734541ebb879b780f82f93fa527fc08c5d1124ada1fea2e908ea45144c7c0ff0a7dc4f9600974
- TLSH T1C241ADF7C3F4856E891156F0AA18AE1FCE2C0515432C7C5AC9E4AF6B93E3471E141A5F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
- Size 40B
- SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
- MD5 20d4b8fa017a12a108c87f540836e250
- SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
- SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 12KB
- SHA256 1449b1063db390c2c4c1d09c4aacb6c89cea25763e1aa769578dd9e183a75fb1
- MD5 07a44c94dd022a5d37c6bd8cb505e483
- SHA1 0893b7d57842a8297e3f651bc328c3272dedc10d
- SHA512 deb80952f41618a402cb4581a800c3b7892a1dd934acf37a1553c91d4f87aed99876fb3f1bddd874572e705e2b918a735c0f0a3d1ad437c99e526d77e3e65ea1
- SSDEEP 192:sxRMRgCv/fDslcMgZ8mkzoA8pZi/g6+WNwf0/YoeZCYdGK0IgDzVJ:sxRMFv/fDslcM+8YA/5D/j24X
- TLSH T10242B916AD68693B4CC7E219BB65BF93D3F9513250941F48ABFC871C00E7ADD221741B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 12KB
- SHA256 74b36e6700f2c4c99ced04499b644a3ecd50a14232ca7745db12c61f6040e4f1
- MD5 b0fdf49f5102ef665acc6b9c69fcbab7
- SHA1 f606db3a996b22dbc7822e23f1d2ca7fa849e40c
- SHA512 e67e28a0cc94de287f35952ac3911214559fcebe6a97c7514734d4baae71e61fa5766ccac41c4d3ac38d951bae5f5cb3b52de96307012c8e0d5e2bd9094c4a7c
- SSDEEP 192:sxRMRgCv/fDslFMgZ8mkzoA8pZi/g6+WNwf0/YoQNCYdGK0IgDZVJ:sxRMFv/fDslFM+8YA/5D/f24x
- TLSH T14A42B9166E68A93B4CC7E21DBB65BB93D3F9113260D05F48AAFC871C04E7ADD221740B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 11KB
- SHA256 d09908b027b1b3fe8e9a70500708bf9f8d6ad500628693343d60f94efe4f2e4a
- MD5 a9e901f1902711b95221020ef1b91921
- SHA1 e4465420194cdaf16be306854d79f61209aac4d5
- SHA512 f19e7a40d08ae9a68c458066e5da156df45976cec5cbe8959bf45ba4f08f27ade3c6accd5d486a6255953eb89c9df0fdefbf0299576b369e8d23b393e3aed89b
- SSDEEP 192:sxRjRgCv/fDsQFMgZ8mkzoA8pZi/g6+WNwf0/YoQNCYdGK0IgVVJ:sxRjFv/fDsQFM+8YA/5D/f24B
- TLSH T15242B9166E68A93B4CC7E21DBA65BF93D3F9113260D45F48AAFC871C04E7ADD221740B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
- Size 29KB
- SHA256 6bcffcf741fedbf7628ce4df161a933e99ab0d943d0227b2831e29a4a3607feb
- MD5 4dace405bdbd17c7366c173df2a16775
- SHA1 5f876533e3fdd48a8a5265ba39609b20b1c86aa0
- SHA512 eda43d5a5f1b76342720816bd73a9ff7a6319e8f7ffe149a9e519bdf9d69a15bdbea7721b514fbd91aee50e5e366ef282cb5a1424336e0e8216c9e6d8e44539e
- SSDEEP 768:j26Hyo7pLuL7MRWgs2f028F1+UoAYDCx9Tuqh0VfUC9xbog/OVBmBVuw1ro9de0B:j26HyUE7MRWgs2f02u1jaKmB4wOAO
- TLSH T1E1D2DB7B640DCA7F4F800ADDEC297E9F6D6802CB9698CD8047FE951C02C6BEA51164DA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\0acc917b-31f9-4fcc-92ae-c6f2ffb2ae6e.tmp
- Size 22KB
- SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
- MD5 f768bcb451a187c18099961c484eef8b
- SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
- SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
- SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
- TLSH T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 38KB
- SHA256 28a337c3c6d884904d9ed3c45377f4671cd38a62e2c4463b2605bcf65a1b5e7d
- MD5 58c8f14a52b9c52bbc107bb5f849e6da
- SHA1 d9b06a72fef6b3c10305c6e43c6b2eed2011e7bd
- SHA512 8037fdc86b07c954dc157e8ea2579749a14d155c384255b58b306d47cfc4d3e9b795e9e4daae2c28522a4b1a26a92ace3b160d0f20507a3637aba9143df9d56c
- SSDEEP 768:hrv+4UNbdz3yt/TBOWT1jONXyer1IRCzniBBeVH1SK7:hbsbV3wjjSIqneEH1l
- TLSH T16D03BF36E5A89E338CE2A3C5B04776437FB86057C6840790DDDE2F4E069B59D230B957
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 35KB
- SHA256 e08473f3d91f3849d1895b9ebd94680e6c4bc8e151de5dce31f944c73b6620a3
- MD5 f373a628be6e2e004aa5c34b26f18eba
- SHA1 2307946efe7103e968faf70e6d9724ebdc881dac
- SHA512 936108e6c64df5097651f187ad33f5049940486e82d5a0f72aee8346cdd61a4e767149ac44d3ad38d12e192470ea9ae8723d5d172eacb0e099a32f8e0e4f2d18
- SSDEEP 768:NM36dND/TBOWT1a5SONXyer1IRCzni9xPi9PJ:NM3c5j6SSIqnSPu
- TLSH T1F7F2AE30E5A9EE234CE9E3C5B14763C3AFF82177D5C44694EADA5F0E058365D130B81A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 44KB
- SHA256 a72fe55a3b7d0cd25c180e380da2d40f08a484d8680677ff022a6755c0de9996
- MD5 180e25f31f90247a594d6bf093b0d3c1
- SHA1 26fefc8b4194d352213d342a9077ccd4f7577d3a
- SHA512 b46d95801126b8555ae09d7b59766ac96c659155b43e86b298dde14003ea94f22a65431d8b1ca1150ed3b8920a1e6e25ee7eeaaad9ec7575be77692b946da469
- SSDEEP 768:yFQy3awgqdtUpsOWT1a5tONXyer1IRCzni9xPi9PJ:Jy3H+C6tSIqnSPu
- TLSH T1E51328F594D79A37D8AD5783A33D6E829EBCD163B4884594BBC94E0DCC821BFC30A815
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 35KB
- SHA256 9549af5c81b09359ababdea5df6b771f3f49831663be289866b65ab6bc1c9a73
- MD5 296b778b67cccb3844ce64b6fe025309
- SHA1 7a57794be55e6dca43e841d3630a0030744a2250
- SHA512 30b98002dc5f11a9873fffa0612393dd293f92bff157fd38e0b9aeb96bde29c9f6444cdc49a0a5ff9d5af4387e8b631ad83bfda7d79d29b5829c92c9f8f8db18
- SSDEEP 768:UM3vdND/TBOWT1a5SONXyer1IRCzni9xPi9PJ:UM315j6SSIqnSPu
- TLSH T1DAF2AE30E5A9EE234CE9F3C5B14663C3AFF82177D5C44A94EADA5F0E058365D234B81A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 39KB
- SHA256 651681b9ee514a2e7e08b37ee314c964c8628724a8e4c0f1af3a1107461ea331
- MD5 d2c4941cfe4e7c7e74ff59abe2bb6b56
- SHA1 8d55b3c71f46ff46f1b70b68e7694107d3f90ba4
- SHA512 b0eb91a762044f9fffef0fec637b0f52f85a044f48c72096b8fa9e35c554d54eec073fa68dc85e516c2ea09126ddbbaf199457c3f2c76e3a6cf2f388f66a56a2
- SSDEEP 768:Zrv+4UNbdz3eIR/TBOWT1a57ONXyer1IRCzniwxeVH1SK7:ZbsbV3e+j67SIqn9EH1l
- TLSH T1E503BF31E5A8DE334DE6A3D5B047A3877FB8206B85800B90EDDA1F4E059759E230F91B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
- Size 252B
- SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
- MD5 880fe67d2d8def8a73d1f09d09f8f2ff
- SHA1 adad7fdd0652919461f89bfe36b449081489052b
- SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
- TLSH T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
- Size 132B
- SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
- MD5 f5a3b29f9a977e23d6ca4eb728238f9f
- SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
- SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
- TLSH T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\a000a317-8a60-4cbb-911f-d3053620e519.tmp
- Size 13B
- SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
- MD5 2aa9e263ee3796d9ce358460a2451b4c
- SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
- SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\nsv5DE7.tmp\InstallOptions.dll
- Size 15KB
- SHA256 c7fef6457989d97fecc0616a69947927da9d8c493f7905dc8475c748f044f3cf
- MD5 ece25721125d55aa26cdfe019c871476
- SHA1 b87685ae482553823bf95e73e790de48dc0c11ba
- SHA512 4e384735d03c943f5eb3396bb3a9cb42c9d8a5479fe2871de5b8bc18db4bbd6e2c5f8fd71b6840512a7249e12a1c63e0e760417e4baa3dc30f51375588410480
- SSDEEP 384:EXsC43tPegZ3eBaRwCPOYY7nNYXC06/Yosa:EXJTgZ3eBTCmrnNA5p
- TLSH T1E1624D1137C558B3E2D62A797EE3B7138FA5F722A4438E0BC7332E06281A5956E7C311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsv5DE7.tmp\System.dll
- Size 12KB
- SHA256 8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
- MD5 cff85c549d536f651d4fb8387f1976f2
- SHA1 d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
- SHA512 531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88
- SSDEEP 192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
- TLSH T126426B129BB089F2F591583814667F2A6FBE9C5D27F50563CFE304D63D212CB983A283
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsv5DE7.tmp\ioSpecial.ini
- Size 1KB
- SHA256 593499b363b636f187b50a821108128f73551535ec3a55a9b5b5217050c1be4d
- MD5 8b49c34ea475d4a6f785d38427506b68
- SHA1 43819052d52898e5cc202d6404f708b2b39b70c6
- SHA512 dda20aa24ca32fe677fb01ba9ffedb4884bfb30cd892fb5d321c6e43c148e692e211e524db90061b27fe68c6fe8962c8f20fe57d982fc037edd4196eeac60abb
- TLSH T1D9215E133EFD5524E2BBBB18FFB9807597397851982DC51E91C10A0E44E6A808963BEF
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsv5DE7.tmp\ioSpecial.ini
- Size 1KB
- SHA256 074e4fbfe0a68478a8974459b8b5f47aed1ffc7cc208801e2117dc35e3e5f255
- MD5 244286d45eada9eddaf2151804844662
- SHA1 e6352678699562a804b878e742790eef408bea2e
- SHA512 1da81409a9f716bd7eb5b671689ebe9a19886c8ef459579304df6ea8d0a72054f96a8b751d5e600be92a333435171acdf044e6d0bf8f4915c76f6c544bb9d9ce
- TLSH T1B931A1037AFD1618F2BBBB14FFB541758B3A7C55983DD60D41C10A4E48E6E808963BAB
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsv5DE7.tmp\ioSpecial.ini
- Size 1KB
- SHA256 b10190935a6d13dda49c1f5755d696a1b2d8894407f49e29c37d1ce93b8e611b
- MD5 ece3c8d95bd602bd9099f8c5bbd774c4
- SHA1 9bbc9de881a090064884e77ed82cc39c34bd009f
- SHA512 d44aa100592509f580b6a659341dd1981ae1ac1221c5e4768fb5bcd67994f1eee44c923de2bd161f39464d43a7f14ae53b8d7d913d6226eaf626f7a4f24ec10b
- TLSH T13E2181033EFD4124E2BBFA18FFF9807597397851982DD50E81C10A0E44E6A808963BEF
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\scoped_dir6120_774845615\CRX_INSTALL\content_new.js
- Size 10KB
- SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
- MD5 3de1e7d989c232fc1b58f4e32de15d64
- SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
- SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
- SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
- TLSH T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
- MD5 SHA1 SHA512 SSDEEP TLSH