b28b5d2ea2b9129a1c62fc7a78a0e13df443c76ae58637eb1342b093946b289c

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
21/08/2026, 23:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-21_fcdf2ce76bcdfabafda1d5624c59c7e3_amadey_coinminer_elex_luca-stealer_njrat_rhadamanthys_stop.exe
Size 4.8MB
Sample260821-3spf5stves
SHA256 b28b5d2ea2b9129a1c62fc7a78a0e13df443c76ae58637eb1342b093946b289c
MD5 fcdf2ce76bcdfabafda1d5624c59c7e3
SHA1 1bf6fca0d338af4437ec45c8c5eb3f963b2dd144
SHA512 146ceab6832423b4688b6e98cee82a83f6f67b4cbb696ba789dc3063eb9f15fd88d5f84d82187ed9c39c7c0d703f6f7b1062161d4be96794aaca4a237a61cb8f
SSDEEP 98304:vcGbZJYuTznVg7MJFx0Jk0/xl2S0IMkItVlOjEwxHn3W0FA/Wmgs1yE/IgQ:v9bZPzngSx07/TMxtV0Ew1GcA/ZgYQ
TLSH
T142362311F9C1C077C53335B147BAE8B6686DAC311F35958B63C82A343F709D1AA3A66B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery persistence privilege_escalation

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File created	C:\Windows\system32\drivers\hhdusbh.sys	setup.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 2 IoCs

pid	Process
2272	setup.exe
5092	Studio.exe

Loads dropped DLL 36 IoCs

pid	Process
2272	setup.exe
2272	setup.exe
2272	setup.exe
2272	setup.exe
2272	setup.exe
2272	setup.exe
2272	setup.exe
2272	setup.exe
2272	setup.exe
2272	setup.exe
2272	setup.exe
2272	setup.exe
2272	setup.exe
2272	setup.exe
2272	setup.exe
2272	setup.exe
2272	setup.exe
2272	setup.exe
5092	Studio.exe
5092	Studio.exe
5092	Studio.exe
5092	Studio.exe
5092	Studio.exe
5092	Studio.exe
5092	Studio.exe
5092	Studio.exe
5092	Studio.exe
5092	Studio.exe
5092	Studio.exe
5092	Studio.exe
5092	Studio.exe
5092	Studio.exe
5092	Studio.exe
5092	Studio.exe
5092	Studio.exe
5092	Studio.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 61 IoCs

description	ioc	Process
File created	C:\Program Files\HHD Software\Device Monitoring Studio\usbcomm.dll	setup.exe
File created	C:\Program Files\HHD Software\Device Monitoring Studio\usbstill.cdm	setup.exe
File created	C:\Program Files\HHD Software\Device Monitoring Studio\usbaudio.dll	setup.exe
File opened for modification	C:\Program Files\HHD Software\Device Monitoring Studio\logit3.dll	setup.exe
File created	C:\Program Files\HHD Software\Device Monitoring Studio\logpanel1.dll	setup.exe
File created	C:\Program Files\HHD Software\Device Monitoring Studio\playback.cdm	setup.exe
File created	C:\Program Files\HHD Software\Device Monitoring Studio\studio.chm	setup.exe
File created	C:\Program Files\HHD Software\Device Monitoring Studio\slcon.dll	setup.exe
File opened for modification	C:\Program Files\HHD Software\Device Monitoring Studio\univis.dll	setup.exe
File created	C:\Program Files\HHD Software\Device Monitoring Studio\usbhid.cdm	setup.exe
File opened for modification	C:\Program Files\HHD Software\Device Monitoring Studio\usbaudio.dll	setup.exe
File created	C:\Program Files\HHD Software\Device Monitoring Studio\logit3.dll	setup.exe
File created	C:\Program Files\HHD Software\Device Monitoring Studio\logpanel1.cdm	setup.exe
File created	C:\Program Files\HHD Software\Device Monitoring Studio\res.cdm	setup.exe
File created	C:\Program Files\HHD Software\Device Monitoring Studio\slcon.cdm	setup.exe
File created	C:\Program Files\HHD Software\Device Monitoring Studio\Microsoft.VC80.CRT\msvcr80.dll	setup.exe
File created	C:\Program Files\HHD Software\Device Monitoring Studio\usbraw.dll	setup.exe
File created	C:\Program Files\HHD Software\Device Monitoring Studio\Microsoft.VC80.CRT\msvcp80.dll	setup.exe
File created	C:\Program Files\HHD Software\Device Monitoring Studio\usbtrial.lic	setup.exe
File created	C:\Program Files\HHD Software\Device Monitoring Studio\usbcomm.cdm	setup.exe
File opened for modification	C:\Program Files\HHD Software\Device Monitoring Studio\logpanel1.dll	setup.exe
File opened for modification	C:\Program Files\HHD Software\Device Monitoring Studio\playback.dll	setup.exe
File created	C:\Program Files\HHD Software\Device Monitoring Studio\host.cdm	setup.exe
File opened for modification	C:\Program Files\HHD Software\Device Monitoring Studio\host.dll	setup.exe
File created	C:\Program Files\HHD Software\Device Monitoring Studio\univis.cdm	setup.exe
File opened for modification	C:\Program Files\HHD Software\Device Monitoring Studio\downloader.dll	setup.exe
File opened for modification	C:\Program Files\HHD Software\Device Monitoring Studio\usbstill.dll	setup.exe
File created	C:\Program Files\HHD Software\Device Monitoring Studio\Setup\uninstUSB.exe	setup.exe
File created	C:\Program Files\HHD Software\Device Monitoring Studio\univis.dll	setup.exe
File created	C:\Program Files\HHD Software\Device Monitoring Studio\usbvis.dll	setup.exe
File created	C:\Program Files\HHD Software\Device Monitoring Studio\host.dll	setup.exe
File created	C:\Program Files\HHD Software\Device Monitoring Studio\res.dll	setup.exe
File created	C:\Program Files\HHD Software\Device Monitoring Studio\usbvis.cdm	setup.exe
File opened for modification	C:\Program Files\HHD Software\Device Monitoring Studio\usbvis.dll	setup.exe
File created	C:\Program Files\HHD Software\Device Monitoring Studio\Microsoft.VC80.CRT\Microsoft.VC80.CRT.manifest	setup.exe
File opened for modification	C:\Program Files\HHD Software\Device Monitoring Studio\usb.dll	setup.exe
File created	C:\Program Files\HHD Software\Device Monitoring Studio\playback.dll	setup.exe
File opened for modification	C:\Program Files\HHD Software\Device Monitoring Studio\res.dll	setup.exe
File created	C:\Program Files\HHD Software\Device Monitoring Studio\usbmass.cdm	setup.exe
File created	C:\Program Files\HHD Software\Device Monitoring Studio\usbvideo.cdm	setup.exe
File created	C:\Program Files\HHD Software\Device Monitoring Studio\usbstill.dll	setup.exe
File created	C:\Program Files\HHD Software\Device Monitoring Studio\Release Notes.html	setup.exe
File opened for modification	C:\Program Files\HHD Software\Device Monitoring Studio\usbvideo.dll	setup.exe
File created	C:\Program Files\HHD Software\Device Monitoring Studio\usb.ids	setup.exe
File created	C:\Program Files\HHD Software\Device Monitoring Studio\usbhid.dll	setup.exe
File created	C:\Program Files\HHD Software\Device Monitoring Studio\usbmass.dll	setup.exe
File created	C:\Program Files\HHD Software\Device Monitoring Studio\usbvideo.dll	setup.exe
File created	C:\Program Files\HHD Software\Device Monitoring Studio\logit3.cdm	setup.exe
File created	C:\Program Files\HHD Software\Device Monitoring Studio\studio.exe	setup.exe
File created	C:\Program Files\HHD Software\Device Monitoring Studio\downloader.cdm	setup.exe
File created	C:\Program Files\HHD Software\Device Monitoring Studio\usbaudio.cdm	setup.exe
File opened for modification	C:\Program Files\HHD Software\Device Monitoring Studio\slcon.dll	setup.exe
File opened for modification	C:\Program Files\HHD Software\Device Monitoring Studio\usbhid.dll	setup.exe
File created	C:\Program Files\HHD Software\Device Monitoring Studio\usbraw.cdm	setup.exe
File opened for modification	C:\Program Files\HHD Software\Device Monitoring Studio\usbraw.dll	setup.exe
File created	C:\Program Files\HHD Software\Device Monitoring Studio\downloader.dll	setup.exe
File created	C:\Program Files\HHD Software\Device Monitoring Studio\usb.dll	setup.exe
File opened for modification	C:\Program Files\HHD Software\Device Monitoring Studio\usbmass.dll	setup.exe
File created	C:\Program Files\HHD Software\Device Monitoring Studio\dbghelp.dll	setup.exe
File created	C:\Program Files\HHD Software\Device Monitoring Studio\usb.cdm	setup.exe
File opened for modification	C:\Program Files\HHD Software\Device Monitoring Studio\usbcomm.dll	setup.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4824_1874420753\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4824_1874420753\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4824_1874420753\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4824_1874420753\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4824_1874420753\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_4824_1361771774\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_109_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4824_1874420753\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4824_1874420753\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4824_1874420753\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4824_1874420753\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4824_1874420753\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4824_1874420753\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4824_1874420753\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4824_1874420753\_locales\mk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4824_1874420753\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4824_1874420753\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4824_341615155\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4824_341615155\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4824_1874420753\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4824_1874420753\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4824_1874420753\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4824_1874420753\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4824_1874420753\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4824_1874420753\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4824_1874420753\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4824_1874420753\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4824_1874420753\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4824_1874420753\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4824_1874420753\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4824_1874420753\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4824_1874420753\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4824_1874420753\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4824_1874420753\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4824_1874420753\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4824_1874420753\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4824_1874420753\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4824_1874420753\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4824_1874420753\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4824_1874420753\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4824_1874420753\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4824_1874420753\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4824_1874420753\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4824_1874420753\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4824_1874420753\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4824_1874420753\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4824_1874420753\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4824_1874420753\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4824_1874420753\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4824_1874420753\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4824_1874420753\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4824_744352842\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4824_1874420753\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4824_1874420753\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4824_1874420753\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4824_1874420753\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4824_1874420753\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4824_1874420753\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4824_1874420753\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4824_1874420753\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4824_1874420753\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4824_1874420753\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4824_1874420753\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4824_1874420753\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4824_1874420753\_locales\sv\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-21_fcdf2ce76bcdfabafda1d5624c59c7e3_amadey_coinminer_elex_luca-stealer_njrat_rhadamanthys_stop.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3112	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134318296570283065"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\HHD Software Device Monitoring Studio Log File\shell	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\res.ResExtension\CLSID\ = "{191F4C36-C825-43AA-8E3E-AE992087B636}"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\usb.UsbSource.1\CLSID\ = "{C5B0A11C-E537-4D33-B9AB-61F185F405AC}"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D0B9994E-0901-43CC-AB56-F53D53F1D7A7}	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{51769C5B-2A82-4D5C-A737-24F5B92C1245}\ProgID\ = "usbraw.RawExtension.1"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A10C2030-5657-4A9E-AFC0-6EB3E2B5C2C4}\VersionIndependentProgID	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DEA34803-966B-4468-B70E-CDB4A6404FCE}\TypeLib	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\usbmass.MassConv\CLSID\ = "{607641D1-B87E-4C70-A60E-94BE6F2ABFC7}"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\usbvideo.VideoConverter.1\CLSID\ = "{25FD8558-251B-4681-A084-170093DB3667}"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\HHD Software Device Monitoring Studio License File\DefaultIcon	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\slcon.SuperLog	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\usbraw.RawProcessor.1\ = "RawProcessor Class"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\logpanel1.LogPanel1Converter.1\ = "LogPanel1Converter Class"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\usb.UsbExtension\CurVer	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\usbcomm.CommConverter\CurVer	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\usbaudio.AudioConverter\CLSID\ = "{84BC2B1C-A997-4AA3-9F2F-E9CBA9875843}"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6CBB4AB7-27BA-4799-872B-5AC4A82F2977}\InprocServer32\ = "C:\\Program Files\\HHD Software\\Device Monitoring Studio\\logit3.dll"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{191F4C36-C825-43AA-8E3E-AE992087B636}\VersionIndependentProgID	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A1D98DFE-83C4-4360-8103-B7567C17F700}\ = "PlotProcessor Class"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\usbaudio.DLL\AppID = "{D12EC3C7-0C18-40ED-A3C9-B6CBAAD737EB}"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6CBB4AB7-27BA-4799-872B-5AC4A82F2977}\ProgID\ = "logit3.Logger.1"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{610EBA5B-2939-4597-9ACA-27E05906BD8C}	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B75E05A8-444F-479C-AF7F-957AB8E800B2}\InprocServer32\ = "C:\\Program Files\\HHD Software\\Device Monitoring Studio\\host.dll"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\univis.PlotVis\ = "PlotVis Class"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\slcon.SLConExtension\CurVer\ = "slcon.SLConExtension.1"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C5B0A11C-E537-4D33-B9AB-61F185F405AC}\ = "UsbSource Class"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\usbcomm.CommExtension\CurVer	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A1D98DFE-83C4-4360-8103-B7567C17F700}\VersionIndependentProgID	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\univis.ConsolVis	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\usb.UsbSource.1\ = "UsbSource Class"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8739E6C7-0FFF-4814-B9B2-4FAB14F2C0FC}	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\usbcomm.CommExtension\CLSID	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{25FD8558-251B-4681-A084-170093DB3667}\VersionIndependentProgID\ = "usbvideo.VideoConverter"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6CBB4AB7-27BA-4799-872B-5AC4A82F2977}\AppID = "{A9B191D7-25F4-4074-9365-3D70C09E3DAE}"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\playback.PlaybackSource\CLSID	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D0B9994E-0901-43CC-AB56-F53D53F1D7A7}\ProgID\ = "usbcomm.CommConverter.1"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{36BA07FD-30CC-4AAC-BEB9-0204A6CB51CA}\AppID = "{61273597-2D96-4D52-A17F-5D7799E79226}"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8A447EB4-B173-46C8-8F9C-2CA43A3C787A}	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{46F15A79-CC86-4657-A940-8444DB34F56D}\ProgID	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F3E5847D-13AD-49E2-B86E-A70342072CBB}\ProgID\ = "usbcomm.CommExtension.1"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A1D98DFE-83C4-4360-8103-B7567C17F700}\VersionIndependentProgID\ = "usbraw.PlotProcessor"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{C37B8C62-1BBF-4C3B-B039-86F6ABB6F481}\ = "usbvideo"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{07E3E044-FE09-42B2-A735-252312ECBD86}\TypeLib\ = "{}"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{820F9B05-795D-48CF-89D5-A96AF01D5E22}\InprocServer32\ = "C:\\Program Files\\HHD Software\\Device Monitoring Studio\\logpanel1.dll"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{191F4C36-C825-43AA-8E3E-AE992087B636}\AppID = "{610EBA5B-2939-4597-9ACA-27E05906BD8C}"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{36BA07FD-30CC-4AAC-BEB9-0204A6CB51CA}\TypeLib	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\usbstill.StillExt\ = "StillExt Class"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{25FD8558-251B-4681-A084-170093DB3667}\TypeLib\ = "{72009876-E960-4254-B89D-A07673C8415C}"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\usbhid.HumanExtension\CLSID	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{289F32D7-643A-4EA4-A53A-B8810A6F9E88}\ = "StillConv Class"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\logit3.LoggerExtension.1\ = "LoggerExtension Class"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\univis.PlotVis\CLSID\ = "{3A1EAAD9-29D9-43D7-A653-4A05D07EE3A9}"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\downloader.DldExtension	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\univis.TableVisualizer.1\ = "TableVisualizer Class"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\usbmass.MassConv\CurVer	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{08594031-1CE1-4963-AB97-3D29064AAD41}\ = "slcon"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\univis.PlotExtension	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{A4C4DE86-61FF-48CE-B174-F2ADE106C7FE}\ = "usbraw"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\usbraw.PlotProcessor\CLSID	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{289F32D7-643A-4EA4-A53A-B8810A6F9E88}\VersionIndependentProgID	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{84BC2B1C-A997-4AA3-9F2F-E9CBA9875843}\InprocServer32\ThreadingModel = "Both"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8543535F-D95E-4128-97DB-A298576199CB}\TypeLib\ = "{482F63D9-90B6-42CA-9B15-91AC264FC7C6}"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\usbhid.DLL	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A1D98DFE-83C4-4360-8103-B7567C17F700}\InprocServer32\ = "C:\\Program Files\\HHD Software\\Device Monitoring Studio\\usbraw.dll"	setup.exe

Runs .reg file with regedit 2 IoCs

pid	Process
3648	regedit.exe
3116	regedit.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5092	Studio.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeLoadDriverPrivilege	2272	setup.exe
Token: SeLoadDriverPrivilege	2272	setup.exe
Token: 33	4440	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4440	AUDIODG.EXE
Token: 33	5092	Studio.exe
Token: SeIncBasePriorityPrivilege	5092	Studio.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4824	msedge.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
5092	Studio.exe
5092	Studio.exe
5092	Studio.exe

Suspicious use of WriteProcessMemory 52 IoCs

description	pid	Process	procid_target
PID 5744 wrote to memory of 2272	5744	2026-08-21_fcdf2ce76bcdfabafda1d5624c59c7e3_amadey_coinminer_elex_luca-stealer_njrat_rhadamanthys_stop.exe	89
PID 2272 wrote to memory of 3648	2272	setup.exe	91
PID 2272 wrote to memory of 3116	2272	setup.exe	92
PID 2272 wrote to memory of 5092	2272	setup.exe	98
PID 2272 wrote to memory of 4824	2272	setup.exe	100
PID 4824 wrote to memory of 5700	4824	msedge.exe	101
PID 4824 wrote to memory of 3664	4824	msedge.exe	103
PID 4824 wrote to memory of 3112	4824	msedge.exe	104
PID 4824 wrote to memory of 3664	4824	msedge.exe	103
PID 4824 wrote to memory of 3664	4824	msedge.exe	103
PID 4824 wrote to memory of 2516	4824	msedge.exe	105
PID 4824 wrote to memory of 2516	4824	msedge.exe	105
PID 4824 wrote to memory of 2208	4824	msedge.exe	117
PID 4824 wrote to memory of 2208	4824	msedge.exe	117
PID 4824 wrote to memory of 2208	4824	msedge.exe	117
PID 4824 wrote to memory of 5904	4824	msedge.exe	108
PID 4824 wrote to memory of 5904	4824	msedge.exe	108
PID 4824 wrote to memory of 5904	4824	msedge.exe	108
PID 4824 wrote to memory of 3228	4824	msedge.exe	109
PID 4824 wrote to memory of 3228	4824	msedge.exe	109
PID 4824 wrote to memory of 3228	4824	msedge.exe	109
PID 4824 wrote to memory of 1500	4824	msedge.exe	110
PID 4824 wrote to memory of 1500	4824	msedge.exe	110
PID 4824 wrote to memory of 1500	4824	msedge.exe	110
PID 4824 wrote to memory of 4964	4824	msedge.exe	111
PID 4824 wrote to memory of 4964	4824	msedge.exe	111
PID 4824 wrote to memory of 5820	4824	msedge.exe	113
PID 4824 wrote to memory of 3372	4824	msedge.exe	114
PID 4824 wrote to memory of 5820	4824	msedge.exe	113
PID 4824 wrote to memory of 3372	4824	msedge.exe	114
PID 4824 wrote to memory of 4840	4824	msedge.exe	116
PID 4824 wrote to memory of 2208	4824	msedge.exe	117
PID 4824 wrote to memory of 2208	4824	msedge.exe	117
PID 4824 wrote to memory of 3852	4824	msedge.exe	118
PID 4824 wrote to memory of 3852	4824	msedge.exe	118
PID 4824 wrote to memory of 2764	4824	msedge.exe	119
PID 4824 wrote to memory of 2764	4824	msedge.exe	119
PID 4824 wrote to memory of 3556	4824	msedge.exe	120
PID 4824 wrote to memory of 3556	4824	msedge.exe	120
PID 4824 wrote to memory of 2476	4824	msedge.exe	124
PID 4824 wrote to memory of 4116	4824	msedge.exe	125
PID 4824 wrote to memory of 5716	4824	msedge.exe	126
PID 4824 wrote to memory of 2284	4824	msedge.exe	127
PID 4824 wrote to memory of 2284	4824	msedge.exe	127
PID 4824 wrote to memory of 2616	4824	msedge.exe	129
PID 4824 wrote to memory of 2616	4824	msedge.exe	129
PID 4824 wrote to memory of 1452	4824	msedge.exe	130
PID 4824 wrote to memory of 1452	4824	msedge.exe	130
PID 4824 wrote to memory of 4992	4824	msedge.exe	131
PID 4824 wrote to memory of 4992	4824	msedge.exe	131
PID 4824 wrote to memory of 3372	4824	msedge.exe	132
PID 4824 wrote to memory of 3372	4824	msedge.exe	132

C:\Users\Admin\AppData\Local\Temp\2026-08-21_fcdf2ce76bcdfabafda1d5624c59c7e3_amadey_coinminer_elex_luca-stealer_njrat_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-21_fcdf2ce76bcdfabafda1d5624c59c7e3_amadey_coinminer_elex_luca-stealer_njrat_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5744
- C:\Users\Admin\AppData\Local\Temp\7zS3B4A.tmp\x64\setup.exe
  .\setup.exe 144
  2⤵
  - Drops file in Drivers directory
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2272
- - C:\Windows\regedit.exe
    regedit.exe /s temp.reg
    3⤵
    - Modifies registry class
    - Runs .reg file with regedit
    PID:3648
- - C:\Windows\regedit.exe
    regedit.exe /s temp.reg
    3⤵
    - Modifies registry class
    - Runs .reg file with regedit
    PID:3116
- - C:\Program Files\HHD Software\Device Monitoring Studio\Studio.exe
    "C:\Program Files\HHD Software\Device Monitoring Studio\Studio.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:5092
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Program Files\HHD Software\Device Monitoring Studio\Release Notes.html
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4824
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2cc,0x354,0x7ffbac75c188,0x7ffbac75c194,0x7ffbac75c1a0
      4⤵
      PID:5700
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1652,i,16607368180495265320,10346777065711972695,262144 --field-trial-handle=2348,i,1716995281336581675,7776097094610493587,262144 --variations-seed-version --mojo-platform-channel-handle=2344 /prefetch:2
      4⤵
      PID:3664
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1840,i,2378506606256345392,17814704044947980537,524288 --field-trial-handle=2348,i,1716995281336581675,7776097094610493587,262144 --variations-seed-version --mojo-platform-channel-handle=2376 /prefetch:11
      4⤵
      System Time Discovery
      PID:3112
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2316,i,17332189982132338925,11870824820881649804,524288 --field-trial-handle=2348,i,1716995281336581675,7776097094610493587,262144 --variations-seed-version --mojo-platform-channel-handle=3128 /prefetch:13
      4⤵
      PID:2516
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3624,i,13292367903199914583,13275289765157883026,2097152 --field-trial-handle=2348,i,1716995281336581675,7776097094610493587,262144 --variations-seed-version --mojo-platform-channel-handle=3680 /prefetch:1
      4⤵
      PID:2208
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3632,i,6884103681522843187,18044478559184671346,2097152 --field-trial-handle=2348,i,1716995281336581675,7776097094610493587,262144 --variations-seed-version --mojo-platform-channel-handle=3684 /prefetch:1
      4⤵
      PID:5904
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4204,i,12212719926816101861,9539278379665840997,2097152 --field-trial-handle=2348,i,1716995281336581675,7776097094610493587,262144 --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:1
      4⤵
      PID:3228
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4276,i,12471832918008074929,8386380862328148372,2097152 --field-trial-handle=2348,i,1716995281336581675,7776097094610493587,262144 --variations-seed-version --mojo-platform-channel-handle=4332 /prefetch:9
      4⤵
      PID:1500
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3792,i,7248687606898277973,11055917128203747816,524288 --field-trial-handle=2348,i,1716995281336581675,7776097094610493587,262144 --variations-seed-version --mojo-platform-channel-handle=3804 /prefetch:14
      4⤵
      PID:4964
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5412,i,3799330519736386986,15309125359111402507,524288 --field-trial-handle=2348,i,1716995281336581675,7776097094610493587,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:14
      4⤵
      PID:5820
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5424,i,5641515704178986612,13652675016657491830,524288 --field-trial-handle=2348,i,1716995281336581675,7776097094610493587,262144 --variations-seed-version --mojo-platform-channel-handle=5492 /prefetch:14
      4⤵
      PID:3372
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6028,i,269932803300428863,5152785430444296997,524288 --field-trial-handle=2348,i,1716995281336581675,7776097094610493587,262144 --variations-seed-version --mojo-platform-channel-handle=6044 /prefetch:14
      4⤵
      PID:5032
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6028,i,269932803300428863,5152785430444296997,524288 --field-trial-handle=2348,i,1716995281336581675,7776097094610493587,262144 --variations-seed-version --mojo-platform-channel-handle=6044 /prefetch:14
      4⤵
      PID:4840
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6192,i,7075903148497926407,10534575174265345843,524288 --field-trial-handle=2348,i,1716995281336581675,7776097094610493587,262144 --variations-seed-version --mojo-platform-channel-handle=6208 /prefetch:14
      4⤵
      PID:2208
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6356,i,236246870186730320,1711784056831562936,524288 --field-trial-handle=2348,i,1716995281336581675,7776097094610493587,262144 --variations-seed-version --mojo-platform-channel-handle=6240 /prefetch:14
      4⤵
      PID:3852
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6404,i,9482625796431878353,6491780371048296872,524288 --field-trial-handle=2348,i,1716995281336581675,7776097094610493587,262144 --variations-seed-version --mojo-platform-channel-handle=6248 /prefetch:14
      4⤵
      PID:2764
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6300,i,17972164553186735250,13458698184260458204,524288 --field-trial-handle=2348,i,1716995281336581675,7776097094610493587,262144 --variations-seed-version --mojo-platform-channel-handle=6172 /prefetch:14
      4⤵
      PID:3556
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6132,i,6367035913100366514,17244537248996834700,524288 --field-trial-handle=2348,i,1716995281336581675,7776097094610493587,262144 --variations-seed-version --mojo-platform-channel-handle=6120 /prefetch:14
      4⤵
      PID:2476
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6136,i,2326151500810601699,13920557281016349141,524288 --field-trial-handle=2348,i,1716995281336581675,7776097094610493587,262144 --variations-seed-version --mojo-platform-channel-handle=6232 /prefetch:14
      4⤵
      PID:4116
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6128,i,9926032126191963836,8064615875394520712,524288 --field-trial-handle=2348,i,1716995281336581675,7776097094610493587,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:14
      4⤵
      PID:5716
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5200,i,3834985331043400582,3943633618972065097,524288 --field-trial-handle=2348,i,1716995281336581675,7776097094610493587,262144 --variations-seed-version --mojo-platform-channel-handle=3676 /prefetch:14
      4⤵
      PID:2284
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5984,i,9713045603375417382,909466882243688046,524288 --field-trial-handle=2348,i,1716995281336581675,7776097094610493587,262144 --variations-seed-version --mojo-platform-channel-handle=5428 /prefetch:14
      4⤵
      PID:2616
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5368,i,2251895678428314374,931837346875941436,524288 --field-trial-handle=2348,i,1716995281336581675,7776097094610493587,262144 --variations-seed-version --mojo-platform-channel-handle=2872 /prefetch:14
      4⤵
      PID:1452
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5132,i,8515742927010464598,11345950659279545712,524288 --field-trial-handle=2348,i,1716995281336581675,7776097094610493587,262144 --variations-seed-version --mojo-platform-channel-handle=5312 /prefetch:14
      4⤵
      PID:4992
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5636,i,15817902472910527330,17257029114380064678,524288 --field-trial-handle=2348,i,1716995281336581675,7776097094610493587,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:14
      4⤵
      PID:3372

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004D8 0x00000000000004D4
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4440

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3504

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3660

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:108

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

downloader.dll

Path C:\Program Files\HHD Software\Device Monitoring Studio\downloader.dll
Size 147KB
SHA256 a00f1d7eff5e75032f44c120449e6dc23691ff52846903a30992fcdb9107805e
MD5 b22f2327857091df92846c836d7a5909
SHA1 f6259cca961cb1ec5931b8a0afc9f7ee5bde48cf
SHA512 e95110b0f217416d666b61f688fda6a7ecc7a812c8b32d4441263ea18641ffcaa21b17c40747ed432cb694c92eef70267121bb001c1023ec66b86338e0215d5a
SSDEEP 3072:ZCfPBDsdECTQ/l1l4jC4inhb+Viy2O0KpKmiqVN7pD89qC:ZCfPpiwr424yhb+Vi20u1iqVN7p
TLSH
T140E3182AB2A840F6E137D17ECAD1460AE77234424B3547CF0265476E1E37FD9AD3A362
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

host.dll

Path C:\Program Files\HHD Software\Device Monitoring Studio\host.dll
Size 163KB
SHA256 141f7f7f2419bb5f0bdf66026d41bfc1ffecb333d6b57d40acf16edd0c2006f9
MD5 19b6972b6b895a99576677692ab5d8f6
SHA1 5967ce577796998523a457fc1fb97d504ad642d1
SHA512 8dd56bc88641c7dadd4262abbbd8ad11dd13389d8436a3fe9916699408b1e8c1e0053307777f3fdd8583e701b724f0d06f390e7bd80ba787a5d084bae7909cce
SSDEEP 3072:7JZ6vMYu66NiwpnUWsWnnfnuH+qIuar33BUQ2fm/dNOlhNrq:6vMk69UWjnnfueqFK33BUhm/dNOlhd
TLSH
T14EF3181AF2A800F9D072D17DCAA39617E67334415B2197DF42508BB91F33BD97A3A362
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

res.dll

Path C:\Program Files\HHD Software\Device Monitoring Studio\res.dll
Size 307KB
SHA256 b12096516ae27a41d3d16fb805aca2db1e8868196748b4befd09888d3b015b01
MD5 5190e3aaec6918d211943807992693dc
SHA1 b4137107e9f59fb63814e376f88b78923fa05990
SHA512 055deb2d9c76688b8af7326421e99d1cd759a63ff172ffe47fc81af70d39e70ea53402730682b0097423c39d3bc6422a9af925c576bb243aeba8fe52ea75c7f5
SSDEEP 6144:kiTC0kHQ8DTG9vwvTBqUl9TBTmLnOltQw5DFLjHqLf5K:kPlT24TsUdhFLjK
TLSH
T14D647B59B6A849B1D133E57ECED38356C5723C019B30CBDF0255876A0E33BE5A939B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

slcon.dll

Path C:\Program Files\HHD Software\Device Monitoring Studio\slcon.dll
Size 82KB
SHA256 3d742a5e7c4588d647ff88497d90e3bc22a77e6897fbf9073561baf2f59104c5
MD5 3f56f561f0650800498840ecd9803825
SHA1 7081cba1ac1f58487f76a4c1ecd26c8f908d25b8
SHA512 6fdd632c0ba95f6934bcb068923e5674dcf13b70cbda1de9fed33df5c089d45ed548284b4732ed5b08bfd6347b0eda6356b3cd22ee84a27d90fb5b5db8ddb0f5
SSDEEP 1536:CykQKvsZT3cFfqaDDks7OYanO3/pBcbOlS1yXlCYpz84:CykQq8BBsCLn+LcbOlS1a7z84
TLSH
T13883199A676C40F6D17B917CCAE3670AC3B178016F2257CF0261478E0E73AD94E3A762
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

univis.dll

Path C:\Program Files\HHD Software\Device Monitoring Studio\univis.dll
Size 318KB
SHA256 c0c6342d7e8e034a3356827274be4de46a511a44bb1d14801a726817c05e33ba
MD5 1146db7679df825c77daed4a59b03141
SHA1 18a4eba6c3e9ee7e5bbf6634282050a0f30148f0
SHA512 01dd98c1933c1334e6f92e3ef246dd62ae69b471cf24a4e653d9a49e2d67a311976282dade24502fe20dc4dcf2b4bbf8d203af5182aef0eae4ca8210afd01960
SSDEEP 6144:o0yMqS2943ClnkNDiak62P/2yHVNcX9HfuWOlrVhyr:o2/29VaNlklJc
TLSH
T1D464395AF6A84CF6E077D07EC693C64AD57238815B2097CF06508B5F2F33AD9993A321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

usb.dll

Path C:\Program Files\HHD Software\Device Monitoring Studio\usb.dll
Size 271KB
SHA256 d500e77feeb4d1e7229da86cbf9df0af56c681356798553c14cb361a02ba1b22
MD5 b51e746687fb04a83cb29481146f0e87
SHA1 0dedd31070ff6c1c4d44ed898bd491d989b0a609
SHA512 6d2004e61ab8268ebdf32a0bee5ef62ff216a32724747902f806c45888eb3550d282c3dba2b86e69823e98a0b538bc10973bde8de51c50194c5c57cc65b59550
SSDEEP 6144:549Oc59p/VnN6qCDPHPNdUPbtOlKS4eAK:4vnNmrr4FK
TLSH
T1D0443A29B7E80CB5E477D17F8AE29616D6B27C815B30C6CF02608B5E0E37ED59935322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

usbcomm.dll

Path C:\Program Files\HHD Software\Device Monitoring Studio\usbcomm.dll
Size 133KB
SHA256 adee88edefac37e06ed002e764ea5668d5ef85ff0f7988951161ab453e2d07a2
MD5 4cacad2abf9460052be2be603d9a8724
SHA1 6c51e57bc8f586a6d1aa3853ce7414c9b03c8929
SHA512 e8a75349948ce3c4fd2402c95bae9a7d98b0c549ad382849e30b796b7e954aac71d6dd2bb3c8fbbbc7404363a4c106b665a01d977977da65c398706f07e09d80
SSDEEP 1536:ESKGlq27JGiorgB5gwEwmyRkwJ1+kknRoDWiWoD46+1WrFHxG8QD13Olscom4dVn:EpGoeJmyeU11KiGItwD13OlsJ
TLSH
T1C2D3F80577E840B8E1B7E2BA9EB68186CB76F9545B21D7DF0211835E1D37AC09C3A732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

usbhid.dll

Path C:\Program Files\HHD Software\Device Monitoring Studio\usbhid.dll
Size 163KB
SHA256 988454171e1bb7cdd48368575b49348be7ab4ac5239030525ee9dfa1a8ad604d
MD5 7de52f430ee41dd1bbd0e1008966a1c1
SHA1 5e1475ef4e81c1cc6fce6069e56fd681b72baca1
SHA512 feb40dc15d80d2315a77ba224b98a2db455fe4d49369e04815f394e2bdc55510b6fc797ec2f4fdade1df1504bc74938b87bba4dee8cabfd873703770c95c6e41
SSDEEP 3072:ZfreljII+eG3fIKjt1XAF+Ola+brrC8ma7O3KbeKK2r:NKII+eGPIKjthAF+Ola+
TLSH
T104F3715167F80064F1B7A6BA9EF21656CBBABCA15B71C7CF1150028E0E32AD59D32333
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

usbmass.dll

Path C:\Program Files\HHD Software\Device Monitoring Studio\usbmass.dll
Size 184KB
SHA256 54c4926d55d5605686ec1f9d42934e6d0fa6561e4851bd02b5a796c27a7307b9
MD5 6bc908a925be517cc62112dce9b576fc
SHA1 b374e69f7e19c44c0b4a9701333a134c72edc8dc
SHA512 c80b3c432da074d42548c6d3131044b59272eae5a6d70f16e151e7fd6e074caf9f9a33354c51b8d0abcb7cca7111be3ac1d5c950528f87dbd704908595c275b4
SSDEEP 3072:5W5NS/lfxVQjkGcWAGG5nAhDluxJEv44CiXDtOlTYE1MN+Zgw:5W5NS/lskG9AGG5AZluqLDtOlTZ7
TLSH
T18104F81677EC40A8E073A5798FE68287D6B6B8405B3087CF0190476E1E77EC5AB36772
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

usbraw.dll

Path C:\Program Files\HHD Software\Device Monitoring Studio\usbraw.dll
Size 161KB
SHA256 736f85f0700d13c6fec3eb07f7d2171ab0a2f3987d1f8493b7619d422f203315
MD5 60fb510c3bd1680610e5ed17482021e7
SHA1 fca3ec3d1233aeb9b06149babcdc3efa4ba3d731
SHA512 654d07046838b99615ccef17ba984c73a3450c74a7f37fdb6113a462c77a5d8be8195c1343db80be0c206553978df0e21390627e755e0df2115aad5b3736f5d4
SSDEEP 3072:B51DHPNCq3QdEpwfQcmKqH59HhfOlqPOyz8jBwREXBQRvH:BLHVCq3iEpkXmKqHrhfOlqG/
TLSH
T1C6F39311B7E841A8F1B7BA788AF68286C77678915B3193CF1250864F1E73ED48D36732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

usbstill.dll

Path C:\Program Files\HHD Software\Device Monitoring Studio\usbstill.dll
Size 175KB
SHA256 1e5b569c4c25cd3e13238bb17b21c6ee9a88913681858331f0cb0be4d2e20af4
MD5 f1410b664c44a43dcf669fc2badfb4d9
SHA1 16861a34d0eb52c518f21ae29e12a834ef5f6fcf
SHA512 536815b6b25fb84fdeb1c2023dbd1bb0d33985617d7c5a25f3032af1dd3addd58f46a5c1c0b5b74f8b650585759be0134fe464eabd97573806af92441fb545d6
SSDEEP 3072:lTnn6/4E6JcVkLNgZPenWWr/cq376igm7Ol1NtF46:lTnncKwPyWgcq376Dm7Ol1t
TLSH
T11C042905B3EC94B9C0779639DEE20197D67A78116B3197DF0340873A0E37AD4A936B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

usbvis.dll

Path C:\Program Files\HHD Software\Device Monitoring Studio\usbvis.dll
Size 191KB
SHA256 464f221171f80aae49abd0646b824326f66ab55618acb42477ac5ed4110e209f
MD5 1c341312ba514474e3e9b75d445f52be
SHA1 3b72a5f327ccfbd5313f39d6e1a3110c4a94c9a8
SHA512 ec0110b36fbcc70c3ec1d4f0a4187598fb4abffcd459298991d163db9332988a1fdb0fdac1b6e9d455a3a29a94995948a17fc2b6a31106575f580579b7f9c1d5
SSDEEP 3072:ela70FwGA87WvbozdhIjpLeqUzmRNEjzhQBxdPOlfTlrr1:eS0eGAIK6qemRSj18dPOlfJr
TLSH
T1FA144A16BBA840E5D167917DCA938757E2B334410B2097DF43508BBA0F37ED9B93A362
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e75f270f1371188bd7f350113eee1f4d141652add7af8e5f7af0ab47dac6d1f2
MD5 e0e7da4c84e8882b494037c575bd294c
SHA1 04d43c383ac5d232ee362aad151519414dc6db2b
SHA512 70d9ca23de3befb782d3d04a586490c626e7c63ad00fac39b0fd9adeae2c1d8413a5d2474e847fabb4f48bbf1384f1fcd10e67765d21ed94ac67795b274b3c2e
TLSH
T122D09294BB60A90CCC81B0322AE66355BA1598A1182D868900A5F07A9CA8AC246179AF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e35119268ad2455b6ec4314361db946ee09b095b28e62d25bbd7542d6be959b9
MD5 5c633da04aeb5bea485c08ea28f57d24
SHA1 1c5287022e764ef0bb6d895cd993be007ab68eba
SHA512 341697613439896bbdc5bae2e067bf2b52fd4ee959460166157f5fcf5f0647d000c9824a7394abad2ea244ee761164649972236a37dd919e413ac011474bb4b7
TLSH
T12DD09B947B50A50CCC41703229E5535579155461581D45450055F0799C646C246175BF
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 50a132717893ec3bfab764cc13988e6ecac1a020716091a9858ee2d762b3073b
MD5 014ae0ee0389e11cf264b94451036208
SHA1 7155a95bf64876d878da31ca14d272e6473c353b
SHA512 3a0ae07d9752bab719604dd6a88f2b15b4171efc0cd61274fecee4edf6086a0f563d76f80bd81d4458b88554f82d198af5aa23a7f55990e216cff8ec176069a8
TLSH
T19E5187566FB8D6E1D338E27163F0574533F9A8A94A079E122052ED32198EF87B0E0253
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a3171.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a3171.TMP
Size 2KB
SHA256 814b07f52741ea6e7e3cab19dae8569624e539f249b9dbbe818b5363900373cf
MD5 7a0fa5f8de2cc9fa07f1859e258f743c
SHA1 7d8e08bd055c2fd4567548beebd4607d3f2b982f
SHA512 147d89d6964639309d34350bc2655bfd72cae2115b9bd2d3dd0b8ca30b5249b20c020797a5f0364fc003d50e96199f752963e14b0ff9c6450f8a1b421e3467a3
TLSH
T1935198566FB8D6E1D338E67163F0574833F9A8A94A079F122052FD32198EF87B4E0253
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 d09970de3616ac84bde74138dc730fc24db64dd13f78f10f803071a1a423383b
MD5 32bcfbd51ca4476b99b3e2cfcade21b0
SHA1 ab5f8d9191bc9830f5ec73ed20d59f5b924b34b0
SHA512 537abe889119297819e04f69c50be30bab91b0e53ac65de37c3ba71897affcf0890df40c4d4625e3136fef73ccaf14d424c00585758e1ca3f9557b86d57d827c
TLSH
T15B41CFF3C3F4857E8A1195F0AA146E2BCE2C0A55432C7C5688E4AE2B93E3471E14199F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 dc2d0b862a53b5bbb31066218674ecdf0219aca5bf2f8e34d0cbee98bb1eb707
MD5 5d46cd0402e623679472fb8df7771249
SHA1 e176464a37c197b522c34e39542b6f12d7aba2c1
SHA512 4da62ee1948d5f4356932c283bb3f5bee9a3c9aa2086ec80ae35a54627f0a26d11170bee6ca9b339949f96d8ba8d33ba6cc56b4ec161d3d0c7c9843b1cb7273d
SSDEEP 192:sxR8RayM/jK1Ml8wCL/f0sBmV3IZMzoA8p4M/g6+WNIYE/egiKaGzkEIgVaimJ:sxR8Y8L/f0sBc329R/5IgcY
TLSH
T1D962EA15AA34997BCCDBD20DFA557F53D6F85523A1901E44AAFCCA0C00E7AED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 b38c4a35d30c66494706483a34889191aaf6a216724dfae3c2cec8a7b8c517c7
MD5 f6ed5ad25a1d217bcda08da718896145
SHA1 d29274621884135e8df0adc3b5b14264fc6e52ac
SHA512 0eab8936e95977819fc42f62dfa9ee78d7c9e327dae43a03abef8ff89993f0558ebf1a47bdd39fa7049c68a5a90350bae5a9805bee9200445e7e5700fba1b63e
SSDEEP 768:0hiiQK7pLuLzlaWgH7f3Q8F1+UoAYDCx9Tuqh0VfUC9xbog/OVECeOV8troQ6H:0hiiQiEzlaWgH7f3Qu1jaLCeI8GZ
TLSH
T178E2EB7B680CCB7E4F404EDCEC29BD9A6DE801CB56D88D9447EA880C03C67EB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 0f64f63a9c207df55d9868ac6f37604aeafb00925fea60862695e522f576bb63
MD5 d631f508a53cf5d81c0635858fb27f78
SHA1 aae8bfc23af1724acb7e3873d5bba6adc5c15b3a
SHA512 fb0e6973bf92759cbf9dc344493f451aa2ba45dda10cdc0b3bca8e816edfab91076c97f736e104ced531ad062f3b065cbbba84fd9318af5c27567e23ad440f91
SSDEEP 96:KReTieYgQGWAltgeGK4DgcGcW+9M+XH7kh1DZpVW9yogdVK4kgzVcbDa9puHYp8j:CeTieYgQxAl+eODgc1W+9M+XH7kh1DZu
TLSH
T1B8911641707B52843C7DAA1D82788C3E92C17872301C786B7BA965E24F66E038DFF9D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a7af5709-dfe6-47e2-8c74-7df3037d9d5d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a7af5709-dfe6-47e2-8c74-7df3037d9d5d.tmp
Size 14KB
SHA256 b36c1b52583aa297cde280d109de66380f4e40114405eb3ea7ec35d2656b0093
MD5 1791655e71a7a959381a26643285b6f5
SHA1 3788c4f931cff539244e63fea18c6e95bf45df86
SHA512 1d691b2a2a82036d51be585e0cd10dfdefe2a336e7440e7131f47b119979ad5e0336b986c4160fe98d423be11cd1a04b12fd54b851b28b2a2ee2aa4c58b82263
SSDEEP 192:sxRnRayM/jK1Ml8wCL/f0sVwmV3IZMzoA8p4M/g6+WNIYE/egiKaGzkEIgDdaimJ:sxRnY8L/f0sVwc329R/5Igck
TLSH
T1C162FB15AA34997BCCDBD21DFA557F53D6FC1523A1901E44AAFC8A0C00E7AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5ace6d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5ace6d.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 68f61487405caf7485865f1b050ea9cd1de166cf592290b0dbb5c0ae0696c7e7
MD5 d365589a02243bfd26ec60523d9cef7d
SHA1 37a49a332ecb480d15c36dd1ff5d638977ebdb82
SHA512 bd591b8229beeefee9756709b7c061caba2c5e5291a8a1b96e0df78a37ed6f67a871977f17655425b9f4a8256c1a0974d6913bcb20c0e655f45742dc4caef244
SSDEEP 768:NFMl3kwgShqGRM2WK48dHeByERRFzjK3Yqf4ltm:Ql3oG7f48dHSyw/Yfgtm
TLSH
T14E038DB5D8A5DDB75CFBC389B716774BEEE0016385CCA994DAC89E0D00861DD070BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 d9b70a73360d0fbc66bccacd76926110f3f9b35acd0bec5219f4ebe1da231161
MD5 2fe4a377feb7f8594b7e5b6144be7cfd
SHA1 f54afe834d52577d57d80d2f9466a776fdc05c05
SHA512 8034f7185c99368efcfbf3c8cfc16097781b525c20f90bf0cb344876aee09e85694bc0961ea07e3ca8d055129fd1dde4b67755f946b1f9fa96198f9f747d6863
SSDEEP 768:OU3dhqGR9D0+K48dHeByERRFzjK3Yqf4ltm:OU3KGb0348dHSyw/Yfgtm
TLSH
T16AF2AEB0ACA5ACB30CFBD28976537757AEF4016384C86A64D5D99B1E04861DD1B0BC2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 679e827557bf0c9fe4d85154c07ca0dfc7a23da4a8f0d2fda9fc70d0fdf12b1c
MD5 33019a4d4e3d7cb954fd384ed6bbd367
SHA1 bb974bddc644ecb313e57e2855f18e96f3e5512b
SHA512 4783ca703f89589dfa18257e06e5c5c839ae54d31137d98757c588aaec6f02d741461d88bbe5c62aba7c930a932d8f53936b224e1cd20bae0d6d7dc643bdad30
SSDEEP 768:Vrv+4UNbdL34hqGR9D0+K48dHeByERRFzjK3YqeVH1SCX:Vbsb53vGb0348dHSyw/YEH11
TLSH
T1F713BE70A8A9AD734CFB92897643B797BFF4016384C40A68C5D99E4E45860DD1B0FE2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 d3a11c95c0896bd0d0a10b921864edfbd7675bc968c64a267e70383203837f6f
MD5 15de89e71bc79f32dfe061cafe0a7acd
SHA1 8bf84f6453712cce7076aed1e68d2068125c76dd
SHA512 5e9d1a75a27b843262c8995ade80b9f37281b06fd5801639e6df92332db36fcfe81f617dde881a1a203795e07a457ccc4ff6f634b05b6c6e43496c7e52829aab
SSDEEP 768:Qrv+4UNbdf3/qGtRD9K48dHeByERRFzjK3Y3eVH1SCj:QbsbJ3yGPU48dHSyw/REH1Z
TLSH
T1A203CE71A8A85E774CE792897643B657BFF4411382D81BA4C5DD6F4E828B0DC130BE2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 b6dca5de6e5d082938d62f928c8a21199e577fd8db75e7224187cc906cdb5547
MD5 9f06f927420eeaad143844636aefde63
SHA1 783c88fc28a57361dd58be0c0c2c92fcf2164101
SHA512 4e17acd442044ccc76483ae4379f99e740b5984a2a7fc84056b81d95eaf9623187ff1195d83819c88cebc336a3418ae36534863a98ce159fb68f2dde09400a68
SSDEEP 768:Xrv+4UNbdq30hqGl9D0hK48dHeByERRFzjK3YqeVH1SCX:Xbsbk3TGv0o48dHSyw/YEH11
TLSH
T1E213BE70A8A8AD734CFB92497643B797BFF4016784C40A68C5D99E4E45860DD1B0FE2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 0509e000537bbf50c6aca111bb71ab4a23104ceeae96a6d90d59d67058e1e12c
MD5 bc4d865ddd46ceb071c54a39295af358
SHA1 a4b56224f6c7630c98040667f970932e3b24320d
SHA512 f42bf55edc03fe83c84a511cef4cbf0714ca6606a7f47e5ed665a04a6e5dc390ce49d05566c94883885a5ea95e63ed09202b89e98e8ee8e5ebc2a2be8544a150
SSDEEP 768:7rv+4UNbdf30qGpDD06K48dHeByERRFzjK3JqeVH1SCj:7bsbJ3dG50z48dHSyw/fEH1Z
TLSH
T1BE03BE70A8A8AD734CEB92897683B797BFF4016385C40B64D5D9AF4E45860CD1B0FD2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

04c48ee7-d41e-4448-952f-005605e431b7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\04c48ee7-d41e-4448-952f-005605e431b7.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
Size 154KB
SHA256 e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
MD5 a922bd2071b7aa9f2154c991d41885c7
SHA1 c88b22d16c951cbb0bfdab367232cf830e0464d1
SHA512 d8ed2d6b1c3a421a9771e3a5109eaea839bf64be7b7e672ed7b8aa47590ff35c6e78aa79712ce37801cedc56db552fc6a7c3ca55004295a438219ce4a8f007a0
SSDEEP 3072:Aj0amyoD1f5NQQHyR5nYbGnkBEGsvsq5UBkUM4RIJ+37HVeCsKkwQuBp/Z:AoHBD15HEYbQkovswoM4RIIzvXkwtBpB
TLSH
T12BF3F11D7EDAC952C40B92BD3C1AB18BC94B8F0A431674CF264D90248EA578E07E5EFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json~RFe5a08ea.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json~RFe5a08ea.TMP
Size 132B
SHA256 a0b1a35a86cbd2e671521525fc6903162d450e3b301948d913d05ef458794c20
MD5 22215f69c4a5231b8c568620e783d7fe
SHA1 c64663b6efe0023ca5978374d785f1202d924d1b
SHA512 9e38513132672de4a65c01a6eca3c8c3a878cc6e11e2c0d2235798b78e3338c9a13a15d261c4b4fc6c60657f42407b98c8435aa4352366d1809843ddda068e22
TLSH
T1A5C02B79481924CC2B00043C6004012B19B0560023C413F48C1B8D80007537CD30817F
MD5 SHA1 SHA512 TLSH

Submit Download

6d6aa776-05db-4da3-b623-84af2b6ce39e.tmp

Path C:\Users\Admin\AppData\Local\Temp\6d6aa776-05db-4da3-b623-84af2b6ce39e.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

Microsoft.VC80.CRT.manifest

Path C:\Users\Admin\AppData\Local\Temp\7zS3B4A.tmp\x64\Components\Microsoft.VC80.CRT\Microsoft.VC80.CRT.manifest
Size 1KB
SHA256 bc6ba66a1e93c8fae1c36a29a8e3b2500f3ee1950a99214f219f6d11058cf55c
MD5 a72dde00d763aeef1eb04534f8672967
SHA1 a5ee1c878a5e7aa10890b48aca5a1d2a49ccea19
SHA512 4f3f3be1c4ded7f930474b16367191b947fcdec55bab23b80049a8e892bac6eb7fcb5cafa3289175139aaffabbd3c8592927515f92e5dc4681d2ff18911c0fd6
TLSH
T13A31AF508C856D16D302D5D4FEF1F96670463F2301BE46AE5CE11DFF6C8248996922F6
MD5 SHA1 SHA512 TLSH

Submit Download

msvcp80.dll

Path C:\Users\Admin\AppData\Local\Temp\7zS3B4A.tmp\x64\Components\Microsoft.VC80.CRT\msvcp80.dll
Size 1.0MB
SHA256 d3ed3fef0f3fd9d547d7ef60d5f532d6aab5bd45966abcb24bdf61dec60c813e
MD5 c332db81197e6e5d4a67d3789dbeb02a
SHA1 d691130e4808910ed5ca0640150b9badc8124243
SHA512 660462070a3a4d4dff52e1d20c22dff1c6caab48f0d039a43e7f322099068ff0eb80dfc6dbb9bea7a2923e8986b36fbe6048ee147ae44be8696d6d93214cc6b9
SSDEEP 24576:ijUopfAPMaZ0eHSQSoSx2+5W1dV/b0rx1wKQhiPBk09I/GF6BiDWXBrT22396jIx:ijUoIZ0eHSQCx2/1dV/b0rnQhiPBk097
TLSH
T11335F952BB2E06A2D191E3FDA2C38311D3F27C568B2567C30297D7191F672C9A27B760
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcr80.dll

Path C:\Users\Admin\AppData\Local\Temp\7zS3B4A.tmp\x64\Components\Microsoft.VC80.CRT\msvcr80.dll
Size 778KB
SHA256 2219e15b66aba301909128e6775e0b4f8b28b529b3ec087161edae55e2676c65
MD5 4d89f6191db56cfa659388378f3dd688
SHA1 c5f28857b4d3a9d182b9c25f3d599bb84ccb8acb
SHA512 7a6b735bb80154e913e2d95e9e475cdfdec84cca410f4c05175aa7cc6d84adcb1726072f4b7b69acb88f9178ae67b9bf0c28d341a9a1dae3d32b4a36762eeb53
SSDEEP 24576:zffRUhGdopm8o5d/HJEoxsvaagwHmqo/mWeAgvzQQmhyBg:VUhtplQ/
TLSH
T13B058D86F3F605E8D47BD2398ED7125AE67174180338A7C746A08E652A337F46A3F712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Release Notes.html

Path C:\Users\Admin\AppData\Local\Temp\7zS3B4A.tmp\x64\Components\Release Notes.html\Release Notes.html
Size 8KB
SHA256 a86f3181772acb2c40f33a1fd23cc11e51850c6afbbc98b42b2671d8de50d0bd
MD5 a2968232adb349083df7395dad2dac6c
SHA1 f419762663701d6880172e4c049ab90b42457c0e
SHA512 38cf9e5c4f4a821cc52744b834357e2955ad8f63a95945f8097f491538b37238bb016ad0d99113441616763bbe19f8b34101b0939caecf4befd5f8d4fc92b99b
SSDEEP 192:F/s+jpo+2vfOaFbNAD1rRLaac+FAwHU4e:Hjpo7vfOC5ALLZFAwHU4e
TLSH
T16802201AA7D8362301331556AF6653E4EF2A816B376807D2B43E910F6FF1590CF6399C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dbghelp.dll

Path C:\Users\Admin\AppData\Local\Temp\7zS3B4A.tmp\x64\Components\dbghelp.dll\dbghelp.dll
Size 1.3MB
SHA256 64cf7a1345ac2ebc9b5b864d374a77ced6c63c779176c497248688ec90778317
MD5 23552f90fa506a87898156f220d65f94
SHA1 2e27c561709379c3eb5c46382eb928b158887036
SHA512 b34ae442df5e94d0e805e044a3d57db1a282b6dffa6a2f1c673d7e75355270f51d981cddaae3f0e146e1bc161802ed37c1ad6564c211a8752e93863ce7d92e10
SSDEEP 24576:UaKOIyAntfhV0UTYfyyKOjHyTffvv6ayge1r:LGyAntfhV0UTYayKOjHyTf4ge
TLSH
T144553B56E6B581F5ECBAC13D86A2A227FD70385D83348BD397458A265F63BF0993D300
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

downloader.cdm

Path C:\Users\Admin\AppData\Local\Temp\7zS3B4A.tmp\x64\Components\downloader.dll\downloader.cdm
Size 73B
SHA256 11820edb846219c3278296b1067ef31fe7ad4975876d86c84a25db8bf8279116
MD5 766bbda2a3f70b2221d0e888c420a0c5
SHA1 11638e8434d6823d9c967961c8884ca9886379ef
SHA512 410e58317d1f633bb8b92864559611fc778851103cb2d1d5be788797a14f8866898cd5da6457aee89996d9c40c4183ede289abd364659b51136ee7fec46a34f1
TLSH
T148A0228880000C0B38F220008F2883E0B0E2A8C0EE2880238B8308B33BC00300B80FFE
MD5 SHA1 SHA512 TLSH

Submit Download

downloader.dll

Path C:\Users\Admin\AppData\Local\Temp\7zS3B4A.tmp\x64\Components\downloader.dll\downloader.dll
Size 147KB
SHA256 d1dbe230686256c2962daf36c54ef46e1a06f8c91d08a154fe5ac21da9343236
MD5 f5ca4c3cb5677d6db0e2265d0b878908
SHA1 763da040e7446f83ab2f57460a9b592273d07da1
SHA512 1285a5efa7d441abfc08ef8bc8ae127031228bad2e8107dcca88880f1e3948e4394bd650b302b3f4b010ae3ef465791933f7125e3f46fed8a88d06791c64a4cc
SSDEEP 3072:lCfPBDsdECTQ/l1l4jC42nhb+Viy2O0Kp8nDqVN7pD89qC:lCfPpiwr424uhb+Vi20uyDqVN7p
TLSH
T1F3E3182AB2A840F6E137D17ECAD1460AE77234425B3547CF0265476E1E37FD8AD3A362
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hhdusbh.sys

Path C:\Users\Admin\AppData\Local\Temp\7zS3B4A.tmp\x64\Components\hhdusbh.sys\hhdusbh.sys
Size 44KB
SHA256 4c93e63432e280de656b85f7b791e63b8720751220269e944f3acf396499551d
MD5 763f7eed3f91c7828f4a9c2e5bbb1019
SHA1 c64fdef50a9fec07bde587df9bc6639008f1da96
SHA512 1ba966eb8ac1724a07275a00db7bbbe55c403380356814dac3cc7ce626095306f43dcecab257a389174e782d26d545da0e2c7955ade80d1458c0a465c2c16092
SSDEEP 768:kmPFo0BFfK7hSTDqPoZET3lEO0o+SgGF1fn3nfLwJiVtYD:JTeNWEjWovfIiV8
TLSH
T19A236C87F7B64098E1B7C171C66A9523FB32F4805B246BDF4650C2792E53BE09A7C31A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

host.cdm

Path C:\Users\Admin\AppData\Local\Temp\7zS3B4A.tmp\x64\Components\host.dll\host.cdm
Size 73B
SHA256 2dd3a3686cb6324d3f394f5c02468ed68ad22e2a328fa43f3eae9ca84a9f7c82
MD5 9aad1e2ea163bdaffd9c612d61c0a61e
SHA1 f800bccb30dc11527c59deae80cbed4a35571326
SHA512 7f5ab11cb2fcd20bfe45fc70cadc1fccf103663db29ad7f58f6c50ade6d74f0c855109674aa089f4e37e4538d193a210c1ddc40a4b9efa30f2260cd44ecc03ed
TLSH
T101A02228C208EF0080C30B30C80C222000000BB0AFA0F3B32038C00883002E0CC80C32
MD5 SHA1 SHA512 TLSH

Submit Download

host.dll

Path C:\Users\Admin\AppData\Local\Temp\7zS3B4A.tmp\x64\Components\host.dll\host.dll
Size 163KB
SHA256 23fc2294de17ea5341b6cc097f276f31cd073d6398d1e38b03a543dfefc51e9b
MD5 c32f6607b3368277386bc7cf697c5c25
SHA1 8193c041139731bfb48367af1a8e7482c66eec95
SHA512 cda5b8ca15b90cfdd6d88fc233ecd5734f8711c9d83e8cd564716484ceb5ece4c7f202211c2040218a59f70a6737ea497953062541bf8db3b64ffdd0fa182df1
SSDEEP 3072:YJZ6vMYu66NiwpnUWsWnnfnuH+qIuarb3BUQ2fReNOlCNrq:lvMk69UWjnnfueqFKb3BUhReNOlCd
TLSH
T150F3181AF2A800F9D077D17DCAA29217F67334455B2196DF42508BB91F33BD97A3A322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

logit3.cdm

Path C:\Users\Admin\AppData\Local\Temp\7zS3B4A.tmp\x64\Components\logit3.dll\logit3.cdm
Size 73B
SHA256 004c486c53f413577872d3d95f3c93858eea2412a29a32bcbc88a1675dde2890
MD5 793b682e2a61c374352276f25b40d5bb
SHA1 af7c3ba9c50c2498667c4976d1f185717d46dc8c
SHA512 00e44ac62a5382016b57d01e0b0aecf738f81382b3661e366a7b6c5f6e1a216329328da10f714ecef50fdf9b21d1a919fa5665f75ab3c4cce36410e497e0737f
TLSH
T1AFA024F0131510D4C4C43C0344C1074C454C007C310105730F4F41134C43C030775F30
MD5 SHA1 SHA512 TLSH

Submit Download

logit3.dll

Path C:\Users\Admin\AppData\Local\Temp\7zS3B4A.tmp\x64\Components\logit3.dll\logit3.dll
Size 91KB
SHA256 e7f750f667b36a02dd01a2a02dd5e9a9c001d757dd4bde8379717dd6f8728707
MD5 4d81d662eae2edb2b6510898984747bd
SHA1 1051f52ef24ebb7ca57553bef2ea1738734f9d48
SHA512 7126ac2e0683795664ef607934002e757c7a30ca891973a96efdc945ed31a306357f1d2981356da608dc73721712f9042705a65f502b4032fecf02f8bb280e20
SSDEEP 1536:snswhi0yyqKNkesjHHpmt4WYslDdt4+16OlDHrmps/37:LwE0tKnp0XEOlD6pKr
TLSH
T19D93F7A8FA6D40FAD027D4BED282874AD67570061F2147CF12758B9E0E37AC94E3A771
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

logpanel1.cdm

Path C:\Users\Admin\AppData\Local\Temp\7zS3B4A.tmp\x64\Components\logpanel1.dll\logpanel1.cdm
Size 97B
SHA256 e8968295c299471073f8730b07b7dc59e727bc2420a090489a87750ba9eec476
MD5 233bbf96956adebc5906895d92276910
SHA1 a86e2dbe9e4d2e7ea7c46324dba3d8a92029928f
SHA512 02ff92f527f1e0a33a7a708d2fed9a009d91eded150416bdc7366212e8ba175a081339b8fa04bfd72aeed7ed9226f68a6390f7dd8f40eb9c4969e81eac0f7021
TLSH
T119B012F09C0611C2E8C619C68C049B0D266DC00B35126650116C817749434D345B600C
MD5 SHA1 SHA512 TLSH

Submit Download

logpanel1.dll

Path C:\Users\Admin\AppData\Local\Temp\7zS3B4A.tmp\x64\Components\logpanel1.dll\logpanel1.dll
Size 143KB
SHA256 8c8313b4a765fc1024fa56662fe0966ae58e64d07531cdd71f8baf6641fdd4f0
MD5 85d1cae987ca23a8c6a9346e7d4b2744
SHA1 5b2e354297abe56e90a0477b164a1c962a27c7c2
SHA512 a857e8b9e19cc8adeacc4236583c2297541d868e12eb69e60ec7a6d9b26a5519d07331ac8ffde307c0df883ef7eef65592b806814ec845d23d30db5ad80d87c8
SSDEEP 3072:+tSH+7tJkksFQHsL7r373Ifc2UVc9GI8EXxchWqOlDn/AI:z0tJfsFPvr7Kc284GI8EmWqOlDn/A
TLSH
T1A6E31816B7AA40D9E26391BCCE918646C7F07D815B3247CF3251AB4E8F339E58D3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

playback.cdm

Path C:\Users\Admin\AppData\Local\Temp\7zS3B4A.tmp\x64\Components\playback.dll\playback.cdm
Size 97B
SHA256 3cf8001646c70d9869a56aa86b55978d70efca24a46fe989c508b68fd3c2bde1
MD5 5587fff322f01bf2fadffe3049fd05f8
SHA1 caf5c552d00d9679ae9f1eb27488b121b289216d
SHA512 3378e123c6418c7feedae893a25ff49b096c242eece6dcca2cefa3319bc9c367c15e09d24d2685eb786a8e547506490cdf8cd3df9e8383c6077401c093ddbed1
TLSH
T159B0120058C30830C959116DCB900159C34296368213E54B5AFD01185523717668BEF1
MD5 SHA1 SHA512 TLSH

Submit Download

playback.dll

Path C:\Users\Admin\AppData\Local\Temp\7zS3B4A.tmp\x64\Components\playback.dll\playback.dll
Size 256KB
SHA256 4fab067332ead76703d77aebebb63f8feab621bfaaa8df7bca3db9a098ecab97
MD5 9e34d9949440127fce7c995e1cb70624
SHA1 51850fe86b720d55a9a53be3e12fe1d765bce713
SHA512 93c4f4cbec13d799cb9e617fcb651b04f2e8280fb88b3b9a37f022f5eb7f4e7e70cde44a12b7df88cb6afcffcb795343b81c98206c0c36e85b3529aa097688d0
SSDEEP 6144:e370qpdC0SIma4khUQOJouAL0Tp7Fp+Ol6XA5:IpcLIF4keQsoTQTh5
TLSH
T1F1442A5AB2A84CF6E033E17EC692C647D6B138815B20D7CF03508B5B5F37AE5A939321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

res.cdm

Path C:\Users\Admin\AppData\Local\Temp\7zS3B4A.tmp\x64\Components\res.dll\res.cdm
Size 177B
SHA256 1a7144f5f0756c47410d7009d7e9836b97fb23d13ae6ed12a913c8386daa12cb
MD5 f87d9a0a8313c4a1af29494cacd070aa
SHA1 856e5c94dc8d0cb589923cb31c7f724b92f4ee29
SHA512 782042a6ba63adb15cadfbe754aaa9b06f039298b3dcc38e751bd37066f4a27ae9ef7574f40d295238e8b1026b10761d648d17461668b962d6979755ee337d6b
TLSH
T1F4C080C7009C4837640FA95D19CF134555A7751E5033DB11ECD2B3545E0C3591052DFF
MD5 SHA1 SHA512 TLSH

Submit Download

res.dll

Path C:\Users\Admin\AppData\Local\Temp\7zS3B4A.tmp\x64\Components\res.dll\res.dll
Size 306KB
SHA256 5cb6b80856cdfc431d50198e5db0fa4ee7994dad970388bf970222fc877b9fcd
MD5 ce15742c4c8154e8c49ae33d06984fb9
SHA1 0aa3e6bdaf4fc053e59974dfa8a614a2903063cd
SHA512 5f87e9294d1bee81261e7461fa2fb7f65e3faf314e041365936d49b2bda0ba32b032543ecd76a70531d061fb0cae60b14a792e64b2cdca962f73bd690a372632
SSDEEP 6144:biTC0kHQ8DTG9vwdTBqUl9TBTrHnOltQw5DFLjHqLf5K:bPlT26TsUwhFLjK
TLSH
T166647B59B6A849B1D133E57ECED38356C5723C019B30CBDF0255876A0E33BE5A939B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

slcon.cdm

Path C:\Users\Admin\AppData\Local\Temp\7zS3B4A.tmp\x64\Components\slcon.dll\slcon.cdm
Size 73B
SHA256 9d6f5343a11147a87d5a60923260f4f9bd3daa9d5cc6542fc6a9741fcc2d569b
MD5 41cb0e0d51d983d00ed849c8a0d9099c
SHA1 f59b1edf77a7a44cde65818a5fe0f92c78556c1b
SHA512 85bab197261ebe4f17dc88ce69fc94c2513cf6080d5891c735751dca5750b86137f1fa86ac4cb9978a73cc0f804e5ca8c8c195625ba3d8a24cf70d11bbefc0fa
TLSH
T121A022A888C30BC000082823002E0C28A00FBB080A8EF80080CA023C008FB882288B2E
MD5 SHA1 SHA512 TLSH

Submit Download

slcon.dll

Path C:\Users\Admin\AppData\Local\Temp\7zS3B4A.tmp\x64\Components\slcon.dll\slcon.dll
Size 82KB
SHA256 0d94ae270091164caa02e907e3668c384f799f1184511d06cde76c1eef34c1a1
MD5 b347e7fa91a3d85872917fe41e58d694
SHA1 966ac7aeae46ca0d138697bb86cedf4e7e75c9d6
SHA512 19fe9702f8c1f67613b350917977d37e619ece727607a60e747ace1f3918c48c9eac4d3923ee0652f9575d7e882adc4fdcf07084d5272e33dafbc620f74e9452
SSDEEP 1536:aykQKvsZT3cFfqaDDks7OYanq5N0lOl51yXlCYpz84:aykQq8BBsCLnHlOl51a7z84
TLSH
T19683089A676C40F6D17B917CCAE2670AC3B178016B2257CF4261478E0F73AD94E3B762
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

studio.chm

Path C:\Users\Admin\AppData\Local\Temp\7zS3B4A.tmp\x64\Components\studio.chm\studio.chm
Size 168KB
SHA256 cd9b5d34dcbeffbd16ff8a7d3dcd19e1a964f5e8dbc8e4760ff097f53dac2274
MD5 a1a6901fde014b95c8ee4e47b5cbcf4a
SHA1 4a375edffdc1dee9a13c11ce8c2e65c8587d9638
SHA512 1b0e4006090ebdaf987de382104ff51ac6081369e4495cba4cdff99a4df292df0cfabd0ae2647af45343deebd0e93ecf3d4993f36e45fbcafff25ee0dca56ee4
SSDEEP 3072:UkBd0cNaeJKIxXmWb+acHEU+ij/raT9rTkT3V8YmNJSWQmgtMz:Fyc0YZcWXU+i7ratkTWLNJWmBz
TLSH
T110F3E00AD2842067D763B0787FEB4B463AF520D9F3B04E2AB43AE48C57563D99365C6C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

studio.exe

Path C:\Users\Admin\AppData\Local\Temp\7zS3B4A.tmp\x64\Components\studio.exe\studio.exe
Size 901KB
SHA256 5ac6a15c197a6d3e21caa763a86fe21d1222b35e0cd199cdbd59ead1dec88bfb
MD5 ad68b2db68f080e0c0194a15b38751ae
SHA1 4f39b951f50d3ee6a00db4e7019f950094e6be8d
SHA512 a33be48eb0e6fbbcb42092f64cf73ac175c4b33daab0cd958acac33134be68b1832eb24019758b14778531dc785c47cc5c3d2a026b326902a55e52ebb0531e9e
SSDEEP 24576:hOGzBw4Ye93pyWiPvwY58jVKp1GTY1UWpezZ1IG:5t9yWiPvl58jVKp0TADe
TLSH
T10A155B5AFBA845E5D2B7D07EC693861BE3B138441B3186CF02509F6E6F33AE54636321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

univis.cdm

Path C:\Users\Admin\AppData\Local\Temp\7zS3B4A.tmp\x64\Components\univis.dll\univis.cdm
Size 73B
SHA256 7e0ee02bf7bb8147b80f09da7e9911d7aaa5042a34fe215211dda1f8d6a5191b
MD5 2d7a817b0d496420f535a6c5422b7380
SHA1 59b459fbac0fb2400e80064302cb7c4e034f10d5
SHA512 aa933084e1f95cc69188dc7a3acd1e8add03fca4323dd71b2cde6043df931b406742e87d6bc69e3d780a6b8c242ad58e53af1180f6bed33c7e85fa0a5d5d7d2f
TLSH
T1D4A022888228083B0C820E00CABBC0228008A38BC8830BAE08338CE000C28080B03820
MD5 SHA1 SHA512 TLSH

Submit Download

univis.dll

Path C:\Users\Admin\AppData\Local\Temp\7zS3B4A.tmp\x64\Components\univis.dll\univis.dll
Size 318KB
SHA256 70863de70bf1f954e028f2534dc76d67bda6234bc289a5fda1c9891e445417e9
MD5 945ffd10b7ebee2eb9e28083b8f0fcc0
SHA1 dbf8fdec39376a0799ada181c15ad30d7d296702
SHA512 bd53f5d0b4e3a5da2dd6f7e5eadadb34cadf5d307882def245e5a6cb9880155becf598e5e0fe2227dda0854ed339a3a1a6ec4c302d8f665f86d08252033b7fcb
SSDEEP 6144:e0yMqS2943ClnkNDiak62P/2ykVNcX9FLuWOlNVhyr:e2/29VaNlklyc
TLSH
T1CE64395AF6A84CF6E077D07EC693C64AD57238815B2097CF06508B5F2F33AD9993A321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

usb.cdm

Path C:\Users\Admin\AppData\Local\Temp\7zS3B4A.tmp\x64\Components\usb.dll\usb.cdm
Size 97B
SHA256 eb895a9100d360cb4c3749c548bf4261ccbcbb8b9f7a5804f0e57fe9ac56de30
MD5 f7d4ac18eb866fdb59a8c4648e68cee6
SHA1 434988cb8f1e622f278843855a8289561efd8565
SHA512 293c3d68b5f8b8b3efdceb0e58e203a8a4b02d0029f727480ae05bc541c1f09db58d7713d34e41c9d2e6ac69f253d396846b4f87b45371bdb1a5680c1060888c
TLSH
T186B0129C1E93266650032956C15A101C204CD7C096CC3562142146B40082D68C50AA44
MD5 SHA1 SHA512 TLSH

Submit Download

usb.dll

Path C:\Users\Admin\AppData\Local\Temp\7zS3B4A.tmp\x64\Components\usb.dll\usb.dll
Size 271KB
SHA256 f19b63f67d2f5ef543d5c280e2df90761bac4a317ceb01c5f4974eeaa8f0cde1
MD5 bb88e4706e913ad6109b3323a104392f
SHA1 314abc18a84c10a3c3920463280b493ca26762da
SHA512 0d6b1d42ee77d2238611e5545f24df8c3f6694a9bec4a593255711956afe30d2cae5b15b15aeb46681c654079dd6a4e1842db9939b2d0fd4509a307aa2f719c4
SSDEEP 6144:A49Oc59p/VnN6qPDPHPNdIvStOl6S4eAK:PvnNHr24FK
TLSH
T191443A29B7E80CB5E577D17F8AE28216D6B27C815B30C6CF0260875E0E37ED59936322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

usb.ids

Path C:\Users\Admin\AppData\Local\Temp\7zS3B4A.tmp\x64\Components\usb.ids\usb.ids
Size 172KB
SHA256 7ee55e33cad5694c0145e15a0c20d2b333020779deae92831b6bce7c91c9f56b
MD5 358d2c76c9779cc12a1050e5942f4e40
SHA1 852bfe5be2c237164c3208cf73671793cd508ac7
SHA512 a560d542d1a36a1951d083875f5d966512f92a06605eca521f6a4c082f76928f94b4efe91a305d331a62cf57e59a9897733bf197e3dbb001a6b551e016fa15e7
SSDEEP 3072:9AnTYiJjo/Zr7KlQPRU/ThiEa+8R5hdI5ocUPvnANuWQcOMeL0EcuWV:9ANJjar77e/diSgahuVFJEPV
TLSH
T19B040815AE8E34620F55B29979F31D8FA02C3AC5749B13173738879A71D60886FDFE88
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

usbaudio.cdm

Path C:\Users\Admin\AppData\Local\Temp\7zS3B4A.tmp\x64\Components\usbaudio.dll\usbaudio.cdm
Size 97B
SHA256 0f012763de977bd7a8caca1623734c49be3ad3197a7aedd83c259f9589564581
MD5 c8f9be2573425e6f6751dc15fa0562cf
SHA1 3ff4072d65883d74e188f4cd792cf6d4ffb3aead
SHA512 0728236bf8f477bdb57c0bbb7cd36f57383b3b85f9d2c7d5cd732429002630cb992f451fa3a7dbe0bccb45124e147f464d425aa1188bdda4dc6f9e1b488a1fd7
TLSH
T1BCB012891984106001D142844D1344CCDF13358144D812D3720384B7377F752C8B4AFB
MD5 SHA1 SHA512 TLSH

Submit Download

usbaudio.dll

Path C:\Users\Admin\AppData\Local\Temp\7zS3B4A.tmp\x64\Components\usbaudio.dll\usbaudio.dll
Size 124KB
SHA256 69b7ea4436b5a5ff6a04ff558e011f9e0d5084d43e5ce635155ef57f1e630d30
MD5 56624571791f42a921142714326c9311
SHA1 b78075ccfa7e2416b79275b7b88be7e2fd70e882
SHA512 5160e3fe6fe0ff99ce4f8fdfcbe31d0eed5fab8cb8390d8a93632ef3743fece583eb1a780d4ae9ee212b069a83d9b8f658da9277157acdfa108135c3ca487551
SSDEEP 3072:FOQYJ3+IPYZ3dhziz1p7ykOlPygl8NoUrLV1:CtYZthzif7ykOlPygo/
TLSH
T14BC3071A77F840B5E1779579CAE24A46CBB278911F3197CF2164838E0E37ED89D36322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

usbcomm.cdm

Path C:\Users\Admin\AppData\Local\Temp\7zS3B4A.tmp\x64\Components\usbcomm.dll\usbcomm.cdm
Size 97B
SHA256 7670abd86ec202d65a5f06bc21ec6a885ed527b7c08fbffaf651e45fa14d5192
MD5 5518e35a78e6281abc4e324489f4ef48
SHA1 4bac7c17ea094ee323ad512144a47a32bcc879e6
SHA512 c3a9772ed1071c2251381897834da8bf10f8278b884f70cb8ae0498448faf5be0aa568ae9cf6e587265f5b0cbd317a7a27e7faf08536acab6b17686649517f45
TLSH
T1A1B0128541051CE940219890B497848C4951008567BC5585814B0B93065336269FCC67
MD5 SHA1 SHA512 TLSH

Submit Download

usbcomm.dll

Path C:\Users\Admin\AppData\Local\Temp\7zS3B4A.tmp\x64\Components\usbcomm.dll\usbcomm.dll
Size 133KB
SHA256 fc4941f94d04f4ae3c3e7afad84ce016965ba48ccc59de601630085a8d9cfc90
MD5 52b7441a9c2d67c0b5e6fc2e64cb363f
SHA1 29370121b5d45ef8c2f64f3fd79fd0a9b5694505
SHA512 44fe21b2452afc57dfe2e8d0cc7458fb6fe5c4e1ad7d78c52572923805b67b860092b9050a3677ae98336ce6a9f11f57c2c700a7f2a325813f8ce0ebafb6167f
SSDEEP 1536:OSKGlq27JGiorgB5gwEwmyRkwJ1+kknRoDWiWoD46+0WrFHxG8Qi03Olscom4dVn:OpGoeJmyeU11KiGntwi03OlsJ
TLSH
T1B2D3F80577E840B8E1B7E2BA9EB68186CB76F9545B21D7DF0211835E1D37AC09C3A732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

usbhid.cdm

Path C:\Users\Admin\AppData\Local\Temp\7zS3B4A.tmp\x64\Components\usbhid.dll\usbhid.cdm
Size 97B
SHA256 e8a8750384750bcc290f95952dba2bc3bcbfb2a874a2b0787b5fa925d5c47c16
MD5 111398ae126f7d997be12e7161289012
SHA1 d6496bb9c16f06a45c63c026b0258197c55a10a1
SHA512 cbfe7ee05cefb75d33918c5b7e6edd4fbbeecd88fad146b320090347388dbd281b2450b566040f8e03db678802d2c938546fc579a8dd6118e0f7bfc5d3a67318
TLSH
T130B012B094102D2516240D69864545B12ED2BA0C04F15F33F7D4989598F00268DA0805
MD5 SHA1 SHA512 TLSH

Submit Download

usbhid.dll

Path C:\Users\Admin\AppData\Local\Temp\7zS3B4A.tmp\x64\Components\usbhid.dll\usbhid.dll
Size 163KB
SHA256 8bad43ce044e0ff1a86ba0720c251da2c4f50eddd7c845e96d63a79eec7e63d7
MD5 b6c8dcebd7f7b2c925d577db19cab536
SHA1 a04378b4dac8dba47a694a466cff56deb531e5e1
SHA512 178f23ebd02456c90ae39de4ca89ccc7548acc72dd5fdcb349b8432125348d1a8d2d655cb36e7508208536f31e7f61b44ee8f39254a9e874c897365df56d14e3
SSDEEP 3072:xfreljII+eG3fIKjt18jM+Ola+brrC8ma7O3KbeKK2r:VKII+eGPIKjt6jM+Ola+
TLSH
T18FF3715167F80168F1B7A6BA9EF21656CBB6BCA15B71C7CF1150028E0E32AD59D32333
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

usbmass.cdm

Path C:\Users\Admin\AppData\Local\Temp\7zS3B4A.tmp\x64\Components\usbmass.dll\usbmass.cdm
Size 97B
SHA256 26cd9c1956e29f6f306faac0ed4770caac795296d3b27e4963125c65776a2863
MD5 a9716f1d08b1ba673a4a4c23040e3cd4
SHA1 23647fd0fdf40075005a8d2a5ca1c304265ccde7
SHA512 cded968cdc17f17c477ae273f6b98835195e038d762e7df670dfdea65dd0a522f335b221edabeb948773b9ff89a2248e0fcee43094dbbf15a0414814c5f1a9d1
TLSH
T1DFB0129945002C95A964C42E832F404117C44C3E85517F3441186450DC2057D4410983
MD5 SHA1 SHA512 TLSH

Submit Download

usbmass.dll

Path C:\Users\Admin\AppData\Local\Temp\7zS3B4A.tmp\x64\Components\usbmass.dll\usbmass.dll
Size 184KB
SHA256 fef8976e859026cc5ebccb03dea4cd6a07a7b27800637ce6c8362031c52487ce
MD5 3cc27d86d7a6acc579d59d89bfd41338
SHA1 c10bc58174e7858f479623118e0080b6693f51da
SHA512 8a1b2d414b7d901fd40f0b4f89576628b564a62db1d8a60d42685dca08f47a17a13c6bc26fb5fdcfe38d30c4d9b8cb9567d67c51b258404dc8520b95af4a0083
SSDEEP 3072:YW5NS/lfxVQjkGcWAGG5nAhDOuxJEv44Cii0tOlZYE1MN+Zgw:YW5NS/lskG9AGG5AZOuqG0tOlZZ7
TLSH
T15204F81677EC40A8E073A5798FE68287D6B6B8405B3087CF0190476E1E77EC5AB36772
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

usbraw.cdm

Path C:\Users\Admin\AppData\Local\Temp\7zS3B4A.tmp\x64\Components\usbraw.dll\usbraw.cdm
Size 137B
SHA256 bd68b62dd6341b70170cdd46ece80d83d9946b5340a66a6d743d9256180dafa6
MD5 a20037c9a5b56e20624db174ea9e648d
SHA1 959af51d343cd6f44df71ae03604fcbb59b63b58
SHA512 e2306e7613b688d9011538d411beb5662dbf9f3693545bb0f7440af40da66a4ffcd484a495532d735dc39dd98a07a3c3deaa4d9460f84a302bb86803daa4cf46
TLSH
T131C02B1C3759CC480540CF2ED418990AAC1421F130E356D504028C301109E2722D03F0
MD5 SHA1 SHA512 TLSH

Submit Download

usbraw.dll

Path C:\Users\Admin\AppData\Local\Temp\7zS3B4A.tmp\x64\Components\usbraw.dll\usbraw.dll
Size 161KB
SHA256 72757285c0d77119f732cfa0c9032e504feff2a2efdeeca6dcd3f39698e2cf32
MD5 04e96e5d7e7aee4fecd2da42913fa57e
SHA1 90336b260e449e3d210278296498c713c72d6f27
SHA512 0f39cb67fcd26b742ca6fd8e99a59cfdd53690c25c623d39bf1f6731d42302fe19f6ee6997fc841e323c47ec6ded4aac1bd4fdb349ff1288843548060ea5d387
SSDEEP 3072:p51DHPNCq3QdEpwfo/mKqH1XVfOlqPOyz8jBwREXBQRvH:pLHVCq3iEpkUmKqHNVfOlqG/
TLSH
T155F39311B7E841A8F1B7BA788AF68286C77678915B3193CF1250864F1E73ED48D36732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

usbstill.cdm

Path C:\Users\Admin\AppData\Local\Temp\7zS3B4A.tmp\x64\Components\usbstill.dll\usbstill.cdm
Size 97B
SHA256 7d4142bee24080df3f1a61278b7fa4b93e1e505214cd1adb970169cf7676b882
MD5 f7e76eb7450560d2e05918c3a58348ec
SHA1 1eee819425757e9c92514ccd6648a0de11d413c3
SHA512 12953ba5656da87fc5054d6a576eaaa62b0f7ed5d91dcd0398cc5fd1bb80cb7970075a18770ca046905b42c84b74e4b0226a94c43af16ec4f5eb937ed5cd2ea2
TLSH
T17CB012052010325451CD11AB35B00F0C215BA3028C0C29960902988400152158724187
MD5 SHA1 SHA512 TLSH

Submit Download

usbstill.dll

Path C:\Users\Admin\AppData\Local\Temp\7zS3B4A.tmp\x64\Components\usbstill.dll\usbstill.dll
Size 175KB
SHA256 5efbc5b31c203ea1349e6b76055c106322325898007ea887bf3ce410188c67df
MD5 de6f09d565c921e8204b21beaccf3aa8
SHA1 4d7329cb31612d010b73ae40df4ae2e6fefd1635
SHA512 26d0894c5c47dad1dd246cd2a809d21edcca6a1190060c1c3d90ef70fe8cd3d6b5e6306442267493f88f370eb87e4a51489672cd75a81c7c96e15207c29ea558
SSDEEP 3072:YTnn6/4E6JcVkLNgZPenWWr/cw376od57Ol1NtF46:YTnncKwPyWgcw376857Ol1t
TLSH
T1C8042A05B3EC94B9C0779639DEE20197D67A78116B3197DF0340873A0E37AD4A936B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

usbtrial.lic

Path C:\Users\Admin\AppData\Local\Temp\7zS3B4A.tmp\x64\Components\usbtrial.lic\usbtrial.lic
Size 378B
SHA256 0aa2b96030e1585280ef8e7b7725915e2d6e0054d1777a65efac6c4ad82e9958
MD5 0d92768b0af84b64fbcf100ce765d47a
SHA1 e17ddac5b37077e58349a2e17f66951420a849d8
SHA512 1f6a488e692781228289689cdda0c7cdc103c7c6073567ee4321dba75b05a57bbef4314d12d17b67f5b516173a923147f0b251b443bca36281a5c064b691756e
TLSH
T1C6E060320A130EC8489FEE0091080B8990A04DF09A84D8886CEC4A788B7E320A25078B
MD5 SHA1 SHA512 TLSH

Submit Download

usbvideo.cdm

Path C:\Users\Admin\AppData\Local\Temp\7zS3B4A.tmp\x64\Components\usbvideo.dll\usbvideo.cdm
Size 97B
SHA256 18042c3a1df27909de34256201c626468f8b2bd754b57d4dc81861fd46db1aec
MD5 ea09b49fe1f77c6a3379e40d7eb90f46
SHA1 5ba89f64e0f766e2bcef944643ab16869089c1c0
SHA512 69c6053ffca92cca6a8bb2725aa706610baed36ad7eb81173d492e7b682345fd226560e5942d6111d01bf44564bcff70a2c95fd250087b2e73e717fbd336094f
TLSH
T171B012C51304D674058154932D4817118EC21F506EEB1467881AC51F50642025E66F67
MD5 SHA1 SHA512 TLSH

Submit Download

usbvideo.dll

Path C:\Users\Admin\AppData\Local\Temp\7zS3B4A.tmp\x64\Components\usbvideo.dll\usbvideo.dll
Size 134KB
SHA256 90dcea2ff929274b682440253e9f2a03b2834db91b17ec2d6f38bd7705d5fe1b
MD5 a80d8d9c844e5f9f882f99ae3af289ea
SHA1 066b7ffc073e33c5332a801a2f3491c0b346772b
SHA512 bc15cad5f1013f3396e13f828f7cb0bee7ddcf010f2791a3c0034a05f201943d708e0c2c2064f26e3a55bc9bfe34d66f61ee0c082c7eac7212cc310ad5e4ff1a
SSDEEP 3072:JZyHRG2ndnmK5GxpvcZb5KAwOlJ3V2AK+XQt:KndmJzEqAwOlJ3X
TLSH
T1A4D3F715BBF800B5E0BB9A799AF29686C7B278810F71C7CF0155479E0E33AD49D36722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

usbvis.cdm

Path C:\Users\Admin\AppData\Local\Temp\7zS3B4A.tmp\x64\Components\usbvis.dll\usbvis.cdm
Size 73B
SHA256 d5b46e84554bd8226996a3a97a99577b3bbe8ba61bf86339b9fc8f341cfef1fa
MD5 2686cce4eb2d8f41d68bffbee0991543
SHA1 fdd7995bd3ba41ef2289d8a1641b0cec6869c647
SHA512 bc6b63920d2e91c5a9b358761d572002b2881ab9c691e432ed59e45e5bf8b722b54914960dcb5246c44e07a8f72329c2cfd7a62953d236d3541c5a6ff7d01b8b
TLSH
T11BA02447300000D11134D7473571001F14C0F13457045C5734331D4D071013F0C430C3
MD5 SHA1 SHA512 TLSH

Submit Download

usbvis.dll

Path C:\Users\Admin\AppData\Local\Temp\7zS3B4A.tmp\x64\Components\usbvis.dll\usbvis.dll
Size 191KB
SHA256 ec3ce30e742b774aa1967c2e37c22fb1607e814defa0fe888d22a45ac2c2bf2d
MD5 5fc4b88665b49f9cbe9edc52bcde09fb
SHA1 b7eef1c2a551f723c0a0c5f3d755b90c79ae72b0
SHA512 4fc25e228aff9be2ff0be91b2d5b0a791eeeb96ef73cb350976283bfc3371b94bf43185c148fef9b45faeeade751f9b6be433f365d2765294a495962513b7ddb
SSDEEP 3072:lla70FwGA87WvbozdhIjpLeqUzmRNEjOhQBxe5OltTlrr1:lS0eGAIK6qemRSjU8e5OltJr
TLSH
T193144A16BBA840E5D167917DCA938757E2B334010B2097DF43508BBA0F37ED9B93A361
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Install Log File Association.reg

Path C:\Users\Admin\AppData\Local\Temp\7zS3B4A.tmp\x64\Install Log File Association.reg
Size 461B
SHA256 5d3ea26a08bef4cb4019b3ae717d0e1a861983b2fc7d0f724a82a29466e623bc
MD5 c8cfac66b99b82198b69ee935fb69e50
SHA1 52926885c310df239e7017cd73f663b1182e40d8
SHA512 3aa30a67e9c3a13f271e14671be011b3957200f36bb91ce3efc70cecb4246dad6248400162a8275a9a70d6c9547b4f465cceae5d2944001899d7ecedbffca49e
TLSH
T17DF03754F8171307956337787B326A60283B759CE7176CF05230A10F2AD1A85D5BDD59
MD5 SHA1 SHA512 TLSH

Submit Download

Install Studio File Association.reg

Path C:\Users\Admin\AppData\Local\Temp\7zS3B4A.tmp\x64\Install Studio File Association.reg
Size 1KB
SHA256 7d6040e7c56a88a15f349e756b8cf3f034e064743f8f20b67477388124c14943
MD5 39a5ce2362c4fd8f2292c4912a6e48d9
SHA1 865914f4fa80abb700e65c8d582e1ec093c6dc83
SHA512 b835a72d4ed7f8ef73ee9d7859d3c4e53bf6599047c53899f659d5b1a85760e2dcfb6236467114d727a5e1b25f765ee2f9af480eb41ce419a117b0b572fbcde2
TLSH
T19321A290F817274B956333296B336A702833A29CA30B2DE19134E10F2AD1BC5D6FCD5D
MD5 SHA1 SHA512 TLSH

Submit Download

Uninstall Log File Association.reg

Path C:\Users\Admin\AppData\Local\Temp\7zS3B4A.tmp\x64\Uninstall Log File Association.reg
Size 115B
SHA256 8e9c9df39718fcaeb0aff544028671f3760af624372bedf471811ac7ea646424
MD5 ab27274c7bc500a12adcdaa36a4cfa64
SHA1 c1239d6e1d3b30d1d96290045ea3cddfda8722ce
SHA512 d90ca8d5692e452f561a0a5d9b5739857bae0f62c6c0ed2b5c4a2fc51680b1801aa0808c8f4be9311beba1467d947d5e7d978c186b10952c594734d8448412bc
TLSH
T1D0B09292AC062107E0122322BA2265E038376648B31ABCE01024620A19C1AC2C5AC92D
MD5 SHA1 SHA512 TLSH

Submit Download

Uninstall Studio File Association.reg

Path C:\Users\Admin\AppData\Local\Temp\7zS3B4A.tmp\x64\Uninstall Studio File Association.reg
Size 342B
SHA256 92ec9063fbcc5e058458bca97ea2b4c01c2f079fa797be475eab4298dabaa8ea
MD5 4ef538a4bd9bd0b748dc2eeb34efea30
SHA1 607a346c3a4501d789ae14be8138a82c398cf4e8
SHA512 a3459b448637d0cca0156ab775c9df5b9cf7b4d1ec825490f3cd21cd2c4b968e2d6a051d355fcbb7b109da72a7b7134921b70db6759cd61f33f2f9c609606b81
TLSH
T128E09283AC412547D1122322AA2365E42833964C730FBDE04028B20A1AC1BD6DAECD2E
MD5 SHA1 SHA512 TLSH

Submit Download

Uninstaller.exe

Path C:\Users\Admin\AppData\Local\Temp\7zS3B4A.tmp\x64\Uninstaller.exe
Size 2KB
SHA256 0177fb0591533c8b325d1914e33e26af7c059dbdb1f4f5965d01061018895659
MD5 2c62215ce89d108021e81eb530dc805c
SHA1 3e594f734ff4660c4ad6c119ca54cbcd0dcb42f7
SHA512 d20e43f913d4e95acec4c73d9acaed76c1da97a6691dc26d12fab83ab1e2bb0675f9ab58b3b6785ac1310dfd67ec21c46597d74339e590d79268b7a2a57548ec
TLSH
T1A641DC9767B8C9AAE5690F33418780D930728231336E265F4D7105596C3072F126DE26
MD5 SHA1 SHA512 TLSH

Submit Download

config.ini

Path C:\Users\Admin\AppData\Local\Temp\7zS3B4A.tmp\x64\config.ini
Size 8KB
SHA256 f82594f739e5bc694e34747b1613563d37d51465a2f078c03f056f307d60a95e
MD5 ebc208f62dfce2d9c247bf9f50faa529
SHA1 58539a2ba09c911c2234b21e858c17ffa9d335ec
SHA512 6bbeb4ee17af3506318483cb9f4d16b429a2624d63398423853b3802942bd8a7947cc56cf0b662ef2c61fc09cc94138f728aedbe0b7865d7e4f3f91284b93374
SSDEEP 192:3hNcBWWc8Pl0CZh9hJuWBHMOHrlkiqHj442:3hmBWw0CZh/JuWBHMOHrlJqD4B
TLSH
T15E02849FC485C05321474A8ADB365E8F9BFB518797B36E1881F1E1CE1393A5F860D8B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eula.rtf

Path C:\Users\Admin\AppData\Local\Temp\7zS3B4A.tmp\x64\eula.rtf
Size 24KB
SHA256 34df7a04d8df2615992253fd2491f5b0397b4672981cc389430a470531a2662b
MD5 164d0384a2d685c1052c16c52151b6a0
SHA1 6f42009773645563509a0cb9df5234202f601c3b
SHA512 0fc7c4ba86844bbff081e44a506144c59d0a6d1749bae94cdf5d300b4019b1a21836294a6b7c5633a19eb0884636551da0f53b8a86eacb64a2ef94eef8a54853
SSDEEP 768:C4Sphv8IvUW4UB5AK78KzmrlDMuqcOQRPOcy7ad:heG
TLSH
T150B253BCD44AEB56C706AF889CF5BCDDB5250E51232E7CABD35F81FE252489091BE048
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Users\Admin\AppData\Local\Temp\7zS3B4A.tmp\x64\setup.exe
Size 470KB
SHA256 8e1568568d8c96bed4e01ce67e1ff9ec50f05b9dd0cd02baea66d8d1490197a5
MD5 95f5cd1e513bc58ffd9034f092ea9e04
SHA1 106542917f4db42538169b47ea7722b2c6a15321
SHA512 e3ddb1e8ef1a7ab7388d0424c4ab9f46d5e4bed256ca9f1e5ca2e2d689992c4db8a388dcae74e58adda0c65e875bb0708da02656a32770d6a3165a122066f6a1
SSDEEP 6144:IPAUf3VJncB7XTY0OZO2lhZC4JH77N0PkNtbsQYrvk9V:IPAYJgM0OHC4JH77N0PkXag
TLSH
T13FA4498A7390C8D7E9728531499155C5C3AAFD22573ACB9F0B20BDC95B73263AC2CF52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp.reg

Path C:\Users\Admin\AppData\Local\Temp\7zS3B4A.tmp\x64\temp.reg
Size 1KB
SHA256 eb0bf1b1880425ba8dba2770ada8037c36ac1aaa0a900d87bf500809c7b5ba34
MD5 493f33fee1623920e964721f63b6b1c2
SHA1 70154a795f868f190f251f4e88717e1d3fa3580a
SHA512 7f00aceb8edc5905fc68d7472c36ffc6ad7a36c9ab17bcc7b5ffa19e65d84526c2cbdb7585359b84d5f2a63dd3668444fbb18fec1188bc9bc0b5ab9742bf27ae
TLSH
T14A31B991F4076707666376547B232A702823E1DCE30B6DE1D234D20E2AC2F84D5BCD5D
MD5 SHA1 SHA512 TLSH

Submit Download

temp.reg

Path C:\Users\Admin\AppData\Local\Temp\7zS3B4A.tmp\x64\temp.reg
Size 549B
SHA256 901bf37f5a0672d7b767b89fbfe811b58aa0fd7b1ffdc825f1a25c080610ef69
MD5 9bc833d0f6e13ffb067f8b6daab9676c
SHA1 0413afae58d6c8f64960bdebcbb9af0f36a0b6cd
SHA512 792d9fa2e71f33fdc406fd83b639c63be2442607c2920c11a5c1d45efe0156cd2964cafaeb1ee9f76669656025d68d6e8005f8545e054ac66b2a83d11cf644a4
TLSH
T145F09694F4069307662376547B222A602827B1DCE3175DF0A234920E2AC2B44D5BCD59
MD5 SHA1 SHA512 TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4824_1742676927\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2272-259-0x0000000000910000-0x0000000000911000-memory.dmp

Download

memory/2272-261-0x0000000000910000-0x0000000000911000-memory.dmp

Download

memory/5092-737-0x00000000035B0000-0x00000000035D7000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads