hijackloader | 1f44284c85be477e6969685c02f302366f22fb8f2c2a3ac0b2dd9c99e1c4e67e

Analysis

max time kernel
299s
max time network
301s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
25/08/2026, 19:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
UTODYIBG.msi
Size 8.8MB
Sample260825-x77ndadq6x
SHA256 1f44284c85be477e6969685c02f302366f22fb8f2c2a3ac0b2dd9c99e1c4e67e
MD5 c46e2ae5a068439e70a857f942baa604
SHA1 e703e1b8c2da14ca54ed0343a8a8db80688f9057
SHA512 78823c7d6f99e47b7485ee30bfa8d2b39adb3cffb0534951e718fcceed33da6a5165a3a0b14ee3d812ca7e49be09b115fbbbed9de02f9eab362f89dc5f29723c
SSDEEP 196608:V9LuzXp14IgOL43JUeh9Ey/KnzAQZwYaaBIuLIUZkHfvOxDEsIf8BvM:VcjravUehT/KnzFuYDBzRLgf8K
TLSH
T19D9633B473605384E71FACF264681168A1E8CE667971505B6F0AB8B2F773E736910BF0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

credential_access discovery hijackloader loader persistence privilege_escalation ransomware spyware stealer

Malware Config

Extracted

Family

hijackloader

Attributes

directory
%APPDATA%\TreigenAutomation
inject_dll
%windir%\SysWOW64\rasapi32.dll

xor.hex

Signatures

Family: HijackLoader, IDAT loader, Ghostulse,
HijackLoader is a multi-stage loader, first seen in 2023.
loader hijackloader

Detects HijackLoader (aka IDAT Loader) 1 IoCs

resource	yara_rule
behavioral3/files/0x001900000002b544-40.dat	family_hijackloader

Executes dropped EXE 2 IoCs

pid	Process
3312	Encrypted-Injector.exe
5764	Encrypted-Injector.exe

Loads dropped DLL 11 IoCs

pid	Process
3312	Encrypted-Injector.exe
3312	Encrypted-Injector.exe
3312	Encrypted-Injector.exe
3312	Encrypted-Injector.exe
5764	Encrypted-Injector.exe
5764	Encrypted-Injector.exe
5764	Encrypted-Injector.exe
5764	Encrypted-Injector.exe
3044	SpectruArray.exe
5352	memu.exe
2744	msedge.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe

Suspicious use of SetThreadContext 7 IoCs

description	pid	Process	procid_target
PID 5764 set thread context of 3044	5764	Encrypted-Injector.exe	88
PID 5764 set thread context of 5352	5764	Encrypted-Injector.exe	89
PID 3044 set thread context of 5956	3044	SpectruArray.exe	92
PID 3044 set thread context of 4236	3044	SpectruArray.exe	106
PID 3044 set thread context of 5956	3044	SpectruArray.exe	92
PID 3044 set thread context of 3460	3044	SpectruArray.exe	112
PID 3044 set thread context of 2744	3044	SpectruArray.exe	114

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\Lang\az.txt	SpectruArray.exe
File opened for modification	C:\Program Files\7-Zip\Lang\da.txt	SpectruArray.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mr.txt	SpectruArray.exe
File opened for modification	C:\Program Files\7-Zip\License.txt	SpectruArray.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\AccessRuntime2019_eula.txt	SpectruArray.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\WacLangPackEula.txt	SpectruArray.exe
File opened for modification	C:\Program Files\7-Zip\Lang\el.txt	SpectruArray.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sw.txt	SpectruArray.exe
File opened for modification	C:\Program Files\7-Zip\Lang\th.txt	SpectruArray.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\README.txt	SpectruArray.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.41182.0_x64__8wekyb3d8bbwe\Third Party Notices.txt	SpectruArray.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\en-US\about_BeforeEach_AfterEach.help.txt	SpectruArray.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\en-US\about_Pester.help.txt	SpectruArray.exe
File opened for modification	C:\Program Files\7-Zip\Lang\zh-tw.txt	SpectruArray.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\server\Xusage.txt	SpectruArray.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\THIRDPARTYLICENSEREADME.txt	SpectruArray.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lv.txt	SpectruArray.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ba.txt	SpectruArray.exe
File opened for modification	C:\Program Files\7-Zip\Lang\bn.txt	SpectruArray.exe
File opened for modification	C:\Program Files\7-Zip\Lang\eu.txt	SpectruArray.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ta.txt	SpectruArray.exe
File opened for modification	C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt	SpectruArray.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fur.txt	SpectruArray.exe
File opened for modification	C:\Program Files\7-Zip\Lang\id.txt	SpectruArray.exe
File opened for modification	C:\Program Files\7-Zip\Lang\it.txt	SpectruArray.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ne.txt	SpectruArray.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ug.txt	SpectruArray.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uz-cyrl.txt	SpectruArray.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub_M365_eula.txt	SpectruArray.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hi.txt	SpectruArray.exe
File opened for modification	C:\Program Files\7-Zip\Lang\io.txt	SpectruArray.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ka.txt	SpectruArray.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ms.txt	SpectruArray.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nn.txt	SpectruArray.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jmc.txt	SpectruArray.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientLangPack2019_eula.txt	SpectruArray.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\AccessMessageDismissal.txt	SpectruArray.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fy.txt	SpectruArray.exe
File opened for modification	C:\Program Files\7-Zip\Lang\si.txt	SpectruArray.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jvisualvm.txt	SpectruArray.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\COPYING.txt	SpectruArray.exe
File opened for modification	C:\Program Files\Windows NT\TableTextService\TableTextServiceTigrinya.txt	SpectruArray.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\en-US\about_Mocking.help.txt	SpectruArray.exe
File opened for modification	C:\Program Files\7-Zip\Lang\bg.txt	SpectruArray.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ku.txt	SpectruArray.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sv.txt	SpectruArray.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Configuration\card_terms_dict.txt	SpectruArray.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\ExcelMessageDismissal.txt	SpectruArray.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\en-US\about_TestDrive.help.txt	SpectruArray.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ast.txt	SpectruArray.exe
File opened for modification	C:\Program Files\7-Zip\Lang\cy.txt	SpectruArray.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ga.txt	SpectruArray.exe
File opened for modification	C:\Program Files\7-Zip\Lang\is.txt	SpectruArray.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lij.txt	SpectruArray.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uz.txt	SpectruArray.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\README.txt	SpectruArray.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\WacLangPack2019Eula.txt	SpectruArray.exe
File opened for modification	C:\Program Files\7-Zip\Lang\he.txt	SpectruArray.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sq.txt	SpectruArray.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\TPN.txt	SpectruArray.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lt.txt	SpectruArray.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientLangPack_eula.txt	SpectruArray.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Configuration\card_expiration_terms_dict.txt	SpectruArray.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ca.txt	SpectruArray.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2744_1325501665\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2744_1103316483\domain_actions.dll	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2744_1200623612\Mu\Advertising	msedge.exe
File opened for modification	C:\Windows\Installer\e5809fe.msi	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2744_1325501665\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\~DF4EE4D5ED193B69D9.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2744_1325501665\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2744_1325501665\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2744_1325501665\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2744_1325501665\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2744_1325501665\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2744_1325501665\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2744_1200623612\Sigma\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2744_1325501665\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2744_1325501665\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2744_1325501665\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2744_1200623612\Sigma\Advertising	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2744_547574526\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2744_1325501665\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2744_1325501665\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2744_1325501665\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\~DF9B56B311ABFE432E.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2744_1200623612\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2744_1200623612\Mu\LICENSE	msedge.exe
File created	C:\Windows\Installer\e5809fe.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2744_1325501665\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2744_1325501665\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2744_1325501665\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2744_1325501665\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2744_1325501665\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2744_1325501665\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2744_1325501665\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2744_1325501665\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2744_1325501665\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2744_1325501665\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2744_547574526\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2744_1200623612\Mu\Fingerprinting	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2744_1200623612\Sigma\Cryptomining	msedge.exe
File created	C:\Windows\SystemTemp\~DF882DE38201FA208C.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2744_1325501665\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2744_1200623612\Sigma\Analytics	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2744_1325501665\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2744_1325501665\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2744_1325501665\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2744_1325501665\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2744_878998283\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2744_1325501665\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2744_1325501665\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2744_1325501665\_locales\pl\messages.json	msedge.exe
File opened for modification	C:\Windows\Installer\MSIB75.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2744_1325501665\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2744_1325501665\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2744_1200623612\Sigma\Entities	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2744_1325501665\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2744_1325501665\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2744_1325501665\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2744_878998283\keys.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2744_1200623612\Mu\Analytics	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2744_1200623612\Mu\Content	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2744_1200623612\Mu\TransparentAdvertisers	msedge.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2744_1325501665\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2744_1325501665\_locales\pt_PT\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
4524	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Encrypted-Injector.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Encrypted-Injector.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SpectruArray.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	memu.exe

System Time Discovery 1 TTPs 4 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5688	msedge.exe
1532	chrome.exe
4692	msedge.exe
5000	chrome.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000ab511af7d208ca820000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000ab511af70000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900ab511af7000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1aab511af7000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1dab511af7000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134321599832544494"	chrome.exe

Modifies registry class 8 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-226940941-599731907-2645636698-1000\{0DDEAC46-9284-45E1-AA6D-61920FD398E2}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
3044	SpectruArray.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
800	msiexec.exe
800	msiexec.exe
3312	Encrypted-Injector.exe
5764	Encrypted-Injector.exe
5764	Encrypted-Injector.exe
5764	Encrypted-Injector.exe
3044	SpectruArray.exe
3044	SpectruArray.exe
3044	SpectruArray.exe
3044	SpectruArray.exe
5352	memu.exe
3044	SpectruArray.exe
3044	SpectruArray.exe
3044	SpectruArray.exe
3044	SpectruArray.exe
3044	SpectruArray.exe
3044	SpectruArray.exe
3044	SpectruArray.exe
3044	SpectruArray.exe
5956	chrome.exe
5956	chrome.exe
3044	SpectruArray.exe
3044	SpectruArray.exe
3044	SpectruArray.exe
3044	SpectruArray.exe
3044	SpectruArray.exe
3044	SpectruArray.exe
3044	SpectruArray.exe
3044	SpectruArray.exe
3044	SpectruArray.exe
3044	SpectruArray.exe
3044	SpectruArray.exe
3044	SpectruArray.exe
3044	SpectruArray.exe
3044	SpectruArray.exe
3044	SpectruArray.exe
3044	SpectruArray.exe
3044	SpectruArray.exe
3044	SpectruArray.exe
3044	SpectruArray.exe
3044	SpectruArray.exe
3044	SpectruArray.exe
3044	SpectruArray.exe
3044	SpectruArray.exe
3044	SpectruArray.exe
3044	SpectruArray.exe
3044	SpectruArray.exe
3044	SpectruArray.exe
3044	SpectruArray.exe
3044	SpectruArray.exe
3044	SpectruArray.exe
3044	SpectruArray.exe
3044	SpectruArray.exe
3044	SpectruArray.exe
3044	SpectruArray.exe
3044	SpectruArray.exe
3044	SpectruArray.exe
3044	SpectruArray.exe
3044	SpectruArray.exe
3044	SpectruArray.exe
3044	SpectruArray.exe
3044	SpectruArray.exe
3044	SpectruArray.exe
3044	SpectruArray.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3044	SpectruArray.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
5764	Encrypted-Injector.exe
5764	Encrypted-Injector.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4524	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4524	msiexec.exe
Token: SeSecurityPrivilege	800	msiexec.exe
Token: SeCreateTokenPrivilege	4524	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4524	msiexec.exe
Token: SeLockMemoryPrivilege	4524	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4524	msiexec.exe
Token: SeMachineAccountPrivilege	4524	msiexec.exe
Token: SeTcbPrivilege	4524	msiexec.exe
Token: SeSecurityPrivilege	4524	msiexec.exe
Token: SeTakeOwnershipPrivilege	4524	msiexec.exe
Token: SeLoadDriverPrivilege	4524	msiexec.exe
Token: SeSystemProfilePrivilege	4524	msiexec.exe
Token: SeSystemtimePrivilege	4524	msiexec.exe
Token: SeProfSingleProcessPrivilege	4524	msiexec.exe
Token: SeIncBasePriorityPrivilege	4524	msiexec.exe
Token: SeCreatePagefilePrivilege	4524	msiexec.exe
Token: SeCreatePermanentPrivilege	4524	msiexec.exe
Token: SeBackupPrivilege	4524	msiexec.exe
Token: SeRestorePrivilege	4524	msiexec.exe
Token: SeShutdownPrivilege	4524	msiexec.exe
Token: SeDebugPrivilege	4524	msiexec.exe
Token: SeAuditPrivilege	4524	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4524	msiexec.exe
Token: SeChangeNotifyPrivilege	4524	msiexec.exe
Token: SeRemoteShutdownPrivilege	4524	msiexec.exe
Token: SeUndockPrivilege	4524	msiexec.exe
Token: SeSyncAgentPrivilege	4524	msiexec.exe
Token: SeEnableDelegationPrivilege	4524	msiexec.exe
Token: SeManageVolumePrivilege	4524	msiexec.exe
Token: SeImpersonatePrivilege	4524	msiexec.exe
Token: SeCreateGlobalPrivilege	4524	msiexec.exe
Token: SeBackupPrivilege	1232	vssvc.exe
Token: SeRestorePrivilege	1232	vssvc.exe
Token: SeAuditPrivilege	1232	vssvc.exe
Token: SeBackupPrivilege	800	msiexec.exe
Token: SeRestorePrivilege	800	msiexec.exe
Token: SeRestorePrivilege	800	msiexec.exe
Token: SeTakeOwnershipPrivilege	800	msiexec.exe
Token: SeRestorePrivilege	800	msiexec.exe
Token: SeTakeOwnershipPrivilege	800	msiexec.exe
Token: SeRestorePrivilege	800	msiexec.exe
Token: SeTakeOwnershipPrivilege	800	msiexec.exe
Token: SeRestorePrivilege	800	msiexec.exe
Token: SeTakeOwnershipPrivilege	800	msiexec.exe
Token: SeRestorePrivilege	800	msiexec.exe
Token: SeTakeOwnershipPrivilege	800	msiexec.exe
Token: SeRestorePrivilege	800	msiexec.exe
Token: SeTakeOwnershipPrivilege	800	msiexec.exe
Token: SeRestorePrivilege	800	msiexec.exe
Token: SeTakeOwnershipPrivilege	800	msiexec.exe
Token: SeRestorePrivilege	800	msiexec.exe
Token: SeTakeOwnershipPrivilege	800	msiexec.exe
Token: SeRestorePrivilege	800	msiexec.exe
Token: SeTakeOwnershipPrivilege	800	msiexec.exe
Token: SeRestorePrivilege	800	msiexec.exe
Token: SeTakeOwnershipPrivilege	800	msiexec.exe
Token: SeRestorePrivilege	800	msiexec.exe
Token: SeTakeOwnershipPrivilege	800	msiexec.exe
Token: SeRestorePrivilege	800	msiexec.exe
Token: SeTakeOwnershipPrivilege	800	msiexec.exe
Token: SeRestorePrivilege	800	msiexec.exe
Token: SeTakeOwnershipPrivilege	800	msiexec.exe
Token: SeRestorePrivilege	800	msiexec.exe

Suspicious use of FindShellTrayWindow 37 IoCs

pid	Process
4524	msiexec.exe
4524	msiexec.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
2744	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 800 wrote to memory of 1804	800	msiexec.exe	84
PID 800 wrote to memory of 3312	800	msiexec.exe	86
PID 3312 wrote to memory of 5764	3312	Encrypted-Injector.exe	87
PID 5764 wrote to memory of 3044	5764	Encrypted-Injector.exe	88
PID 5764 wrote to memory of 3044	5764	Encrypted-Injector.exe	88
PID 5764 wrote to memory of 5352	5764	Encrypted-Injector.exe	89
PID 5764 wrote to memory of 5352	5764	Encrypted-Injector.exe	89
PID 5956 wrote to memory of 3236	5956	chrome.exe	93
PID 5956 wrote to memory of 5076	5956	chrome.exe	94
PID 5956 wrote to memory of 5076	5956	chrome.exe	94
PID 5956 wrote to memory of 1532	5956	chrome.exe	95
PID 5956 wrote to memory of 6028	5956	chrome.exe	96
PID 5956 wrote to memory of 6028	5956	chrome.exe	96
PID 5956 wrote to memory of 2904	5956	chrome.exe	98
PID 5956 wrote to memory of 4264	5956	chrome.exe	99
PID 5956 wrote to memory of 2904	5956	chrome.exe	98
PID 5956 wrote to memory of 4264	5956	chrome.exe	99
PID 5956 wrote to memory of 4968	5956	chrome.exe	100
PID 5956 wrote to memory of 4968	5956	chrome.exe	100
PID 5956 wrote to memory of 3300	5956	chrome.exe	102
PID 5956 wrote to memory of 3300	5956	chrome.exe	102
PID 5956 wrote to memory of 4248	5956	chrome.exe	103
PID 3044 wrote to memory of 5956	3044	SpectruArray.exe	92
PID 3044 wrote to memory of 5956	3044	SpectruArray.exe	92
PID 3044 wrote to memory of 5956	3044	SpectruArray.exe	92
PID 3044 wrote to memory of 5956	3044	SpectruArray.exe	92
PID 3044 wrote to memory of 5956	3044	SpectruArray.exe	92
PID 3044 wrote to memory of 4236	3044	SpectruArray.exe	106
PID 3044 wrote to memory of 4236	3044	SpectruArray.exe	106
PID 3044 wrote to memory of 4236	3044	SpectruArray.exe	106
PID 3044 wrote to memory of 4236	3044	SpectruArray.exe	106
PID 3044 wrote to memory of 4236	3044	SpectruArray.exe	106
PID 3044 wrote to memory of 4236	3044	SpectruArray.exe	106
PID 3044 wrote to memory of 5956	3044	SpectruArray.exe	92
PID 3044 wrote to memory of 5956	3044	SpectruArray.exe	92
PID 3044 wrote to memory of 5956	3044	SpectruArray.exe	92
PID 3044 wrote to memory of 5956	3044	SpectruArray.exe	92
PID 3044 wrote to memory of 5956	3044	SpectruArray.exe	92
PID 5956 wrote to memory of 3224	5956	chrome.exe	109
PID 5956 wrote to memory of 1384	5956	chrome.exe	110
PID 5956 wrote to memory of 3612	5956	chrome.exe	111
PID 3044 wrote to memory of 3460	3044	SpectruArray.exe	112
PID 3044 wrote to memory of 3460	3044	SpectruArray.exe	112
PID 3044 wrote to memory of 3460	3044	SpectruArray.exe	112
PID 3044 wrote to memory of 3460	3044	SpectruArray.exe	112
PID 3044 wrote to memory of 3460	3044	SpectruArray.exe	112
PID 3044 wrote to memory of 3460	3044	SpectruArray.exe	112
PID 2744 wrote to memory of 4656	2744	msedge.exe	115
PID 2744 wrote to memory of 4692	2744	msedge.exe	116
PID 2744 wrote to memory of 2708	2744	msedge.exe	117
PID 2744 wrote to memory of 2708	2744	msedge.exe	117
PID 2744 wrote to memory of 2708	2744	msedge.exe	117
PID 2744 wrote to memory of 3232	2744	msedge.exe	118
PID 2744 wrote to memory of 3232	2744	msedge.exe	118
PID 2744 wrote to memory of 4448	2744	msedge.exe	119
PID 2744 wrote to memory of 2104	2744	msedge.exe	120
PID 2744 wrote to memory of 4448	2744	msedge.exe	119
PID 2744 wrote to memory of 4448	2744	msedge.exe	119
PID 2744 wrote to memory of 2104	2744	msedge.exe	120
PID 2744 wrote to memory of 2104	2744	msedge.exe	120
PID 3044 wrote to memory of 2744	3044	SpectruArray.exe	114
PID 3044 wrote to memory of 2744	3044	SpectruArray.exe	114
PID 3044 wrote to memory of 2744	3044	SpectruArray.exe	114
PID 3044 wrote to memory of 2744	3044	SpectruArray.exe	114

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\UTODYIBG.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4524

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:800
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:1804
- C:\Users\Admin\AppData\Local\Stoneboat\Encrypted-Injector.exe
  "C:\Users\Admin\AppData\Local\Stoneboat\Encrypted-Injector.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3312
- - C:\ProgramData\TreigenAutomation\Encrypted-Injector.exe
    C:\ProgramData\TreigenAutomation\Encrypted-Injector.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:5764
  - - C:\ProgramData\SpectruArray.exe
      C:\ProgramData\SpectruArray.exe
      4⤵
      Loads dropped DLL
      Suspicious use of SetThreadContext
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: AddClipboardFormatListener
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of WriteProcessMemory
      PID:3044
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        5⤵
        
        PID:4236
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        5⤵
        
        PID:3460
  - - C:\Users\Admin\AppData\Roaming\TreigenAutomation\memu.exe
      C:\Users\Admin\AppData\Roaming\TreigenAutomation\memu.exe
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:5352

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:1232

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {c08afd90-f2a1-11d1-8455-00a0c91f3880} -Embedding
1⤵
PID:1788

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5956
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcab2fc728,0x7ffcab2fc734,0x7ffcab2fc740
  2⤵
  PID:3236
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1580,i,5692511603945866392,10239655154120614975,262144 --field-trial-handle=1960,i,3321420329530448527,14936441742464655527,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=1956 /prefetch:2
  2⤵
  PID:5076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1444,i,3330678351796604079,6099764225456932176,524288 --field-trial-handle=1960,i,3321420329530448527,14936441742464655527,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=2308 /prefetch:11
  2⤵
  - System Time Discovery
  PID:1532
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2340,i,4560430290116891726,3259316332943327427,524288 --field-trial-handle=1960,i,3321420329530448527,14936441742464655527,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=2500 /prefetch:13
  2⤵
  PID:6028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2780,i,11622805482123329264,3896216990427532883,2097152 --field-trial-handle=1960,i,3321420329530448527,14936441742464655527,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:2904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3280,i,18272203631011493925,6464158452487583586,2097152 --field-trial-handle=1960,i,3321420329530448527,14936441742464655527,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:4264
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4340,i,11711375836700981121,9732969543497820348,2097152 --field-trial-handle=1960,i,3321420329530448527,14936441742464655527,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=4316 /prefetch:9
  2⤵
  PID:4968
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4676,i,5413863791065738123,1901257588466953244,2097152 --field-trial-handle=1960,i,3321420329530448527,14936441742464655527,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=4636 /prefetch:1
  2⤵
  PID:3300
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5556,i,10755206405717487687,12957306372785938816,524288 --field-trial-handle=1960,i,3321420329530448527,14936441742464655527,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5536 /prefetch:14
  2⤵
  PID:4248
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5884,i,7054977751238538726,9101093547024988649,524288 --field-trial-handle=1960,i,3321420329530448527,14936441742464655527,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5896 /prefetch:14
  2⤵
  PID:3224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5888,i,8220872394019675002,6831941999033529522,524288 --field-trial-handle=1960,i,3321420329530448527,14936441742464655527,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5996 /prefetch:14
  2⤵
  PID:1384
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5892,i,7681065013849349771,1549685946861171263,524288 --field-trial-handle=1960,i,3321420329530448527,14936441742464655527,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=6036 /prefetch:14
  2⤵
  PID:3612
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6104,i,8616994462289008338,13112580394331112514,524288 --field-trial-handle=1960,i,3321420329530448527,14936441742464655527,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=1444 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5000
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1196,i,18414688087265787564,17183301409429049624,262144 --field-trial-handle=1960,i,3321420329530448527,14936441742464655527,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=872 /prefetch:10
  2⤵
  PID:5868
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=5740,i,8371464788278690448,7152953033051381135,524288 --field-trial-handle=1960,i,3321420329530448527,14936441742464655527,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=4464 /prefetch:14
  2⤵
  PID:4084

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5116

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2168

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4748

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2976

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2552

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4044

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x2f0,0x7ffca673c188,0x7ffca673c194,0x7ffca673c1a0
  2⤵
  PID:4656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1820,i,16117798670496675466,4485617369391073607,524288 --field-trial-handle=2172,i,12557743840874349701,1742335039822575628,262144 --variations-seed-version --mojo-platform-channel-handle=2216 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1636,i,2393799712490807003,4936620643632855284,262144 --field-trial-handle=2172,i,12557743840874349701,1742335039822575628,262144 --variations-seed-version --mojo-platform-channel-handle=2168 /prefetch:2
  2⤵
  PID:2708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2484,i,1892555400721450601,3336819285599242966,524288 --field-trial-handle=2172,i,12557743840874349701,1742335039822575628,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:13
  2⤵
  PID:3232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3492,i,4073511927359796833,15023763426108140317,2097152 --field-trial-handle=2172,i,12557743840874349701,1742335039822575628,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:1
  2⤵
  PID:4448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3496,i,238844751744099610,5127468371694322752,2097152 --field-trial-handle=2172,i,12557743840874349701,1742335039822575628,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:1
  2⤵
  PID:2104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5200,i,4566075777164441626,17287218880383847061,524288 --field-trial-handle=2172,i,12557743840874349701,1742335039822575628,262144 --variations-seed-version --mojo-platform-channel-handle=5228 /prefetch:14
  2⤵
  PID:3892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5168,i,15004185327017864317,9062409993942111220,524288 --field-trial-handle=2172,i,12557743840874349701,1742335039822575628,262144 --variations-seed-version --mojo-platform-channel-handle=5264 /prefetch:14
  2⤵
  PID:3884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6108,i,17639865593556222455,8218036363354808777,524288 --field-trial-handle=2172,i,12557743840874349701,1742335039822575628,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:14
  2⤵
  PID:4796
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1132
    3⤵
    PID:5516
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6168,i,17906431809033862434,11852099202108848205,524288 --field-trial-handle=2172,i,12557743840874349701,1742335039822575628,262144 --variations-seed-version --mojo-platform-channel-handle=6188 /prefetch:14
  2⤵
  PID:1956
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6168,i,17906431809033862434,11852099202108848205,524288 --field-trial-handle=2172,i,12557743840874349701,1742335039822575628,262144 --variations-seed-version --mojo-platform-channel-handle=6188 /prefetch:14
  2⤵
  PID:2492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6696,i,5586875615842094211,1709452140199283928,524288 --field-trial-handle=2172,i,12557743840874349701,1742335039822575628,262144 --variations-seed-version --mojo-platform-channel-handle=6704 /prefetch:14
  2⤵
  PID:2988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5044,i,50791831047517390,7586077792506086024,524288 --field-trial-handle=2172,i,12557743840874349701,1742335039822575628,262144 --variations-seed-version --mojo-platform-channel-handle=6244 /prefetch:14
  2⤵
  PID:4992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6724,i,17560090929049257422,4157260885151962052,524288 --field-trial-handle=2172,i,12557743840874349701,1742335039822575628,262144 --variations-seed-version --mojo-platform-channel-handle=6716 /prefetch:14
  2⤵
  PID:2880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6724,i,3039577921378934913,11230459495099263724,524288 --field-trial-handle=2172,i,12557743840874349701,1742335039822575628,262144 --variations-seed-version --mojo-platform-channel-handle=6588 /prefetch:14
  2⤵
  PID:2464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6108,i,12297614444467030935,11510683072103015271,524288 --field-trial-handle=2172,i,12557743840874349701,1742335039822575628,262144 --variations-seed-version --mojo-platform-channel-handle=6412 /prefetch:14
  2⤵
  PID:1940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5496,i,8993065112887814923,6003201324828710249,524288 --field-trial-handle=2172,i,12557743840874349701,1742335039822575628,262144 --variations-seed-version --mojo-platform-channel-handle=6600 /prefetch:14
  2⤵
  PID:4468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6648,i,3285948315519745520,10396576341341822977,524288 --field-trial-handle=2172,i,12557743840874349701,1742335039822575628,262144 --variations-seed-version --mojo-platform-channel-handle=2200 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6312,i,18374810761070303370,10633460161126784177,524288 --field-trial-handle=2172,i,12557743840874349701,1742335039822575628,262144 --variations-seed-version --mojo-platform-channel-handle=6300 /prefetch:14
  2⤵
  PID:2612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6464,i,18188037740028075188,6811319573225221587,524288 --field-trial-handle=2172,i,12557743840874349701,1742335039822575628,262144 --variations-seed-version --mojo-platform-channel-handle=6608 /prefetch:14
  2⤵
  PID:3288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5244,i,3434496493434040758,7991204915540983292,524288 --field-trial-handle=2172,i,12557743840874349701,1742335039822575628,262144 --variations-seed-version --mojo-platform-channel-handle=6604 /prefetch:14
  2⤵
  PID:1880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=880,i,3607682222285109944,15737922603794868114,524288 --field-trial-handle=2172,i,12557743840874349701,1742335039822575628,262144 --variations-seed-version --mojo-platform-channel-handle=6592 /prefetch:14
  2⤵
  PID:852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6624,i,4640835963832240182,10599699017089039876,262144 --field-trial-handle=2172,i,12557743840874349701,1742335039822575628,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:10
  2⤵
  PID:5184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6080,i,2243063674872639458,515643024132977404,524288 --field-trial-handle=2172,i,12557743840874349701,1742335039822575628,262144 --variations-seed-version --mojo-platform-channel-handle=6060 /prefetch:14
  2⤵
  PID:3308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5276,i,1624538088186650300,15158855877885040330,524288 --field-trial-handle=2172,i,12557743840874349701,1742335039822575628,262144 --variations-seed-version --mojo-platform-channel-handle=2692 /prefetch:14
  2⤵
  PID:2988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4832,i,5866370674972946683,17542189211651396512,524288 --field-trial-handle=2172,i,12557743840874349701,1742335039822575628,262144 --variations-seed-version --mojo-platform-channel-handle=2092 /prefetch:14
  2⤵
  PID:1784

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3732

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2736

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4908

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e5809ff.rbs

Path C:\Config.Msi\e5809ff.rbs
Size 9KB
SHA256 ba0fb5b5f960c6c0b89f2f4571f38af35d68dc07368ace1275ccf3774811eb57
MD5 923f959525808c77a615eae1e9b9abc6
SHA1 bb24247302bfd20270d529830bcc1599b947d4f9
SHA512 3064d351c6e91e5342c2edbbee603cf1c39fe7cb32db86d858832c88a60d58b26247949bf27a2890ddd2ad0a44a987fb46e40546e05b08027a5226aef7202240
SSDEEP 192:TR/XCGtduqqiI/qqiaZqVkTbDPD28UK3pbiqwJgL8SO:TRjtIqqtqqtZEkTbDPD28UIiqwJgL8SO
TLSH
T18E126311B690C0E2F8E90771C3172B583BEBD7E9E631631B196D8578AE07359CB98683
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SpectruArray.exe

Path C:\ProgramData\SpectruArray.exe
Size 258KB
SHA256 3837645e4ccc1e6b60c984d9516030da3168aa8f2a9bf7d52ebab8017c3a9f24
MD5 7793c30e1ca6670a558fc38338cd7b76
SHA1 64fe73b543d62147c4b44db121a1cbb05285684d
SHA512 4969b0430cb97b8caf8d1ea7cad04b7fbffd0382895f93f8951924aa76b0f1d8635dfd8ebb168dc277d6da232e2f235b111e74a24904d25d8c2a40a5ad17e886
SSDEEP 3072:hENRC6vGYOvcY7we7UYuqnDz+1CxDistQNw+:hEycpYs2/hDiH
TLSH
T1D4445ADEA18B84E1D1C1FE34C2A3B303672A6E1F0AFF54562B977509F8BD29E3511606
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\CrashpadMetrics-active.pma
Size 1024KB
SHA256 67ee11b51cd6f637795e31ab501f135ed595c8459bce885735f08b0418513a17
MD5 34c29bdb9e41b1f47f2d2786762c12ec
SHA1 4075131b18c3487e3e848361e112009c897629c7
SHA512 ca3a978798e77b2ced27b379f38e935ef18beaa7ea23e34270a9af20b37e1b1c5edf9478606311cf1acabd83992766cb3da8444de9394c674d5955bdbc53c0d0
SSDEEP 12:bHCskaXhVMMBKEKSCemJKlkQfIYVhYJ0X:bi0ROMMBS+MkEPYW
TLSH
T151259286B34455BBC54189B188AA17606274F9E89F82179A3B18E60F1E661DC0F51964
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 f137b10bcf1a316652a9157166ab2a21317a25cad4f0e185b27b3347712e669b
MD5 c54bd636a3966023f452dceaff409f5d
SHA1 b34bc5abad7ddc66a106fbedc5d15ffec5cc5f53
SHA512 69a95bda3f994e536ce1b5daefd50d2cfab437e7aa3950c59be99ac6a912a3e1324ce576949270d9f9c1a6fc5aba2507ad4264dc0d7bec9abcf023f0ea491cf1
TLSH
T1B2E0ABA5CD31AC2708FC471860140606F740134B3A81486F363C491C8FF46375159C1C
MD5 SHA1 SHA512 TLSH

Submit Download

DIPS-wal

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DIPS-wal
Size 8KB
SHA256 d0825c80bd1e2465d60012bb1e38297640eb47c3839d51c2cfc15c3d783bd056
MD5 6573f4ac3b24ceed8c411bf9ea7d132e
SHA1 c454f3a9ba9af75b991e5f21ce28ba9862355a3f
SHA512 bae5baabde8565690f8ed45244ebc8b8d81bb750c449d48f1023a9c695b7cb22fc549498da446cbe6820ace6847820a935110f7db09a70ddaf782212d51d9d64
SSDEEP 3:OlH/lbj2MqkMjTXbgA2MqBUF21XayTpU1k3r9svqK1caa+:Kd2mKUA28WP21+re
TLSH
T174028C47600638D0C3C6F57ACB428AC01702DAE24377BE13920AD0B000203602AFD4C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension State\LOG
Size 317B
SHA256 bc3626168a0be1ac2a5bd0ca2792ee4564e2e0aee55451885c367a5dd78a2f16
MD5 f12f8136a32af8714ac5844b6abaa84a
SHA1 56ecefaa5acecffaedd6e1ac0aa4a32738af37e0
SHA512 49cf35b34c31855709305f3b162aada2700b538f9650eddd7fab1bea6ebbdd1a337a1ec78e1fc8d8ed22428a0632cb4816b3efa2ee8e06c461873fe009bbc83b
TLSH
T178E086582589C76FDCA5C763A269A34CCAD03544B6C9F812170E988436D5514B9A0274
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\000003.log
Size 3KB
SHA256 a7efa860fd5226dd12d663f118d6fce8bae700103c1894afa8cebc8156ac027e
MD5 b44daeebb05b33c1a6e4e2738fd8e031
SHA1 7e82093c93c3c4f67cf3669ca037c89166a9f752
SHA512 44654825198c1a42bd28adaa292eddb2df542ffb97901276b0e72a39974d631a07668a923d23b6bbe93d4e615ac27cfe7ed27abfdd436bab910dea71c44f0761
TLSH
T1F761EDB573913B8BEA69687A795D83037B3190458692D83206E970E80E51B162E190CB
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\LOG
Size 305B
SHA256 5335a5e4e79d9c902bd6de97b9af807deced1687759d548f58fff56e1de18ff4
MD5 80f373223b4678ad243411e7ee1ee675
SHA1 edb9b7f063f4cc4318a6898c29234b71b1765a78
SHA512 f2533013997a35ba3a270924bfaba19e01113ee54b558eaf12f2b82f50207c34431923e3525c37188ebc877197ad2b10af8f130099c8df8a5ae3ad108ad3b180
TLSH
T149E0CD9934DAC7AE58C4826713E1B30CC7D43C05EFDE94D65704588172C5C0CE1D92B1
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 bd144ac336a179ab9f4e08229235d1e6c2bdc04ecf7fe8a7c7aa121e3e4f2d11
MD5 82cdcc73c2179fab39a309c2feebf3b6
SHA1 c4f762039b3228969d4bff6cc47b1cb101959038
SHA512 58717fa85baa9108bc8cd33a47b1cb16af485d33533e02f279e8bf99aad96c60ea65e26dafa75f6bafff3aed0d632a454268a386095e8fd3cee86bf9fb858780
TLSH
T16C5197F7D3E4866D851192F89A206E1FDE2D0A28132C3C66C8D4AE5B53F2872D21078E
MD5 SHA1 SHA512 TLSH

Submit Download

Reporting and NEL

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Reporting and NEL
Size 36KB
SHA256 b4dbcadcad40984a427928e7aa479d78a48567e430fefd65a35d471f1e76a420
MD5 58af786a42359a359d1e2f4aed32fa50
SHA1 ae14fd4f381e623408239cd2eac3598acb9ebcdd
SHA512 5831c8a9336ca5a0b423411388509b28b9fdf7e3c8c2b328672590af7f170c80b19d0b6354e1cb5b5a0fa41e73610bda7b3f1a583090a44812f997aed879fa57
SSDEEP 48:T6IopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSBoOE:OIEumQv8m1ccnvS6uOG
TLSH
T16AF2E1FF07197601C0E49674D6810ECFFD6D051D4B9BBEC09AAC09F3AB865B3A538259
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 81baabbb7a4d5c1b59c3f864290af6cc7ab3644468b40f8a5ae7f76d0b9854b4
MD5 b0b3d9e2158e354b2b66f74d05a3dd8d
SHA1 251fa47be795f54a6a6cc274fc0f91819eb69829
SHA512 eb9714b0e6169e5f4bb3aeab66536fe44a016df4bffc38ae243285a787f1558cb568ff7b3d5ef86457b35b9e89a59688f3ed27d11975883bbafe90057eed516e
SSDEEP 192:AR/c+6/RGTOLv7lpupAPRp209fHsb+WNnzA0nQCkw3iVyIsnAUgtaJ:AR/c0OzZgUXzRws0QCy8
TLSH
T19542C52EF910653B9CCBD32AFA617B43D7F5202521952D84EBFC8A2C28DB6CD2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 7b2a85b975215e1afd5cd953bc50db811241beff87c4d7d13b68d9a876a89ae9
MD5 96854fb63c8fe62ed1a4b5c668c87c7f
SHA1 b5f2a72813546bb95c6131e9bd3e358e301987c2
SHA512 5afa3f7321db7689e24a5dfe975a6f3d77816fcdc580e542078c949d2f18c4456ede8a463edc702104cf519fa1c343c56daa2c829bed198b6b2a4c86397cd619
SSDEEP 192:AR/c+6/RGTOLv7lpupAPRp209fHsb+WNnzA0JQCkw3AVyIsnAUgraJ:AR/c0OzZgUXzRws0+CUe
TLSH
T16B42D52EF910653B9CCBD32AFA517B43D7F5202521952E84EBFC8A2C29DB6CD2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 79ea521d9f3df87d24eec0f3607ae01ff8cf6eaeb5c7802f7c4721f58b8ddead
MD5 5d35f09b8c86835fb4877dcd0cc40e4a
SHA1 71d399e3fd153dc456fddb8f9cf7b1d428dcd2c7
SHA512 68050d4d5a4a4f94c2a29dfff1edf5350066ef5a2e47ef11dcbd09970c2009d28d7804e59c25d64e43ef8e1367105d32e929bef6a7a0e31d18837b193891b321
SSDEEP 384:WQjb+7KxkXqKf/pUZNCgVLH2Hfgsl5g7pLuLcSjQRXODaB+ErU39rHGQ3uKHaaK7:WUb+7KxkXqKf/pUZNCgVLH2HfgsLg7pn
TLSH
T1BF72F967BC4C9A370F94C6CDD8267A4FADB5024B65DD886483FA982903D4BCF110A2F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 f861e67ea2fb61281b555f6bc32b8117d0a3920be5bc9d01662550b6701f7606
MD5 758cefbe14da7e3e3c7c9c1dd52a798c
SHA1 bdc68b780f28a3638d9e918201e73074109c5e37
SHA512 93b98afdc192bb4e3038e22ae644e7dba99f65a1c6a68ac6b9ce4f7ab8023ca83e0481ccb418c71e8d52b5294c4692783723ce22076f510ff75ef62ecd46211a
TLSH
T18DB01251C4125101C40643F415C228887314EF24DB0B170393F1697288255508414051
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe594ef1.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe594ef1.TMP
Size 96B
SHA256 18f189b50fa2a20cee23dfa59d92393fc414ac475dfe2fd329d6c08f7368620f
MD5 5852df5858d2d1420500a78a5fc6359b
SHA1 a8fac978c9279bc34e7a2a7958e23dbf398e5934
SHA512 c5d884286b0913dbef6d0af0e9a33cbb25e2f87f0ee59c5d1edcad21917130c405d1c8c72d934ecb04e365d32f5e999394728b008f8c3aef96c6f25a97ad4fd1
TLSH
T1B9B02200C80F2303C00203B0288888E83330CF28CE03032AA2E03EA2CC382200822020
MD5 SHA1 SHA512 TLSH

Submit Download

Last Browser

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Browser
Size 106B
SHA256 3615498fbef408a96bf30e01c318dac2d5451b054998119080e7faac5995f590
MD5 de9ef0c5bcc012a3a1131988dee272d8
SHA1 fa9ccbdc969ac9e1474fce773234b28d50951cd8
SHA512 cea946ebeadfe6be65e33edff6c68953a84ec2e2410884e12f406cac1e6c8a0793180433a7ef7ce097b24ea78a1fdbb4e3b3d9cdf1a827ab6ff5605da3691724
TLSH
T1AAB0112033FC0228F3F38200AE333BA00F3FF8230000022CA008228808B38288880FB3
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version
Size 13B
SHA256 e5efa9eb104cd0b25149c2e789bec8d9aa4ba95678831b657eef7780a281c391
MD5 43ef949d3c6e9956545979ace65d0085
SHA1 63f2b2de8727854597e49a1216e8e74c68117c07
SHA512 313a5ab7ac9b5efd955beba4615784bdc2a9058ddaa804d85fb2d0c651dd3de07e382d61a1bb482499520a80e0b64c004ff2af03459cbc1daef47f540f0a6905
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 239KB
SHA256 efed6f14b6d4eb8c26f0453d6ac62109ca91195e5facfdcccfd03574e2966548
MD5 dd334e9f816ba3a2a2fc3342e2eb7b0e
SHA1 0591672f2c28af9ef5c71a8eb81b8dc9bb295193
SHA512 0eea7f73c96af71ea812eb302e27a526eac63e0891d73f0671664e45852953b9761e34ec29b4391fbf8443bc5f293b8c1266523360e93b696068f61ae4925d3a
SSDEEP 3072:UjjPHDQG8r0QcrvkJaiyrwNaaCJxl2ZgCVIdXwGryiDFpmzNA9J+zfAsJDREge7A:sLf8dcrHLFygCAXvrTf+zfAk3Wbhm
TLSH
T1A8341362DD775EEA11681D39604613E3B77EDEB543EAB68741907C5A3EEEB401308E30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 240KB
SHA256 53cc1dd3d0f0cca7091ca6f527882b1230bdd6684ee2353ec84001525db1c70e
MD5 3ff8f5aec8b24e219bb5fc0d999a8d9f
SHA1 4b3431b3e5645c6870e2939c14f165e1ce327c2d
SHA512 6f62101c2ff35439deda04ae622f19c4af039ff06f9c88091d8d8cbf4755903bcce3bd59a8a527f763eb8ebe081f5fc4c952029337a64b84c10a0066dd4ece56
SSDEEP 3072:XODKjPHDQG8r0QcrvkJaiyrwNaaCJxl2ZgCVIdXwGryiDFpmzNA9J+zfAsJDREg7:XOmLf8dcrHLFygCAXvrTf+zfAk3Wbhm
TLSH
T136342372DC775EEA15781D29604623A37F7EDEB643E9B68751807C4A3EAEB401708E30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 c7d6faaa230acd417e8fb1844b28cbec292a1bd9f45196de749cd50d296b4104
MD5 6d443df60102ea42c22eefe23c183162
SHA1 3191d1bd02931ced98ef16642ea3ff1883770f74
SHA512 6ad75ed88aa385c59be23fdc92cf5f83ae26c84bdb5b58ec80701c75757b74906450ed81acd8b510b99edd1ee5888511d09b3b67396ad03c1abd185153a32e78
SSDEEP 1536:nLueL6TFpmkUjlTArhJ+vgVuFM8r51TRB+BsJYuRZa8pSgeDAkwdqf8Wg+95h6mq:KDFpmzNA9J+zfAsJDREge7oWg+95hy
TLSH
T156B30212CAAACE9BE5A49C79E4C413F3BEBE5F9523F1B9424166E4023DCE7042395770
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 240KB
SHA256 d4ce2ca969bfabe473840c47a9b19c86e42cf43da231dd3c5e0a567c458a8cd7
MD5 66186a12f8ff690fad479193499061e4
SHA1 505cd9be91090240ee17463dd86d0eb6bcb65a32
SHA512 a7d5e3759acc0573e087cc62f64f9e0aeea342ba8a1a0951eda1fac29c0ff16784c73a76746dd9ce5d61ceed57552667025929901fdc8b5651712937132efd78
SSDEEP 3072:jODKjPHDQG8r0QcrvkJaiyrwNaaCJxl2ZgCVIdXwGryiDFpmzNA9J+zfAsJDREg7:jOmLf8dcrHLFygCAXvrTf+zfAk3Wbhm
TLSH
T1FE342372DC775EEA15781D29604623A37F7EDEB643A9B68751807C4A3EEEB401708E30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 239KB
SHA256 0299596253a126879457bd4f556788926105e85fa6367d45392aced1e8d7161e
MD5 f1c3139c98b5e2d8e49a132ca9ea9330
SHA1 125d426abfe1a9b6534e217c788ea0ba02ce818e
SHA512 807498baa20cfe606d324732fb4e01179e78283cf7a4c6b54bdee2c09f8fa93c3d51d9d4b173644de20b264aab8b3fd226429ab2becb5083f5d536e2743cb09c
SSDEEP 3072:jjjPHDQG8r0QcrvkJaiyrwNaaCJxl2ZgCVIdXwGryiDFpmzNA9J+zfAsJDREge7A:3Lf8dcrHLFygCAXvrTf+zfAk3Wbhm
TLSH
T1CE341362DD775EEA11681D39A04613E3B77EDEB543EAB68741907C5A3EEEB401308E30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Variations
Size 86B
SHA256 2741df9ee9e9d9883397078f94480e9bc1d9c76996eec5cfe4e77929337cbe93
MD5 f732dbed9289177d15e236d0f8f2ddd3
SHA1 53f822af51b014bc3d4b575865d9c3ef0e4debde
SHA512 b64e5021f32e26c752fcba15a139815894309b25644e74ceca46a9aa97070bca3b77ded569a9bfd694193d035ba75b61a8d6262c8e6d5c4d76b452b38f5150a4
TLSH
T168A012078473800AE4184092C45C024114A480460119D0015070931314950CA03A5435
MD5 SHA1 SHA512 TLSH

Submit Download

first_party_sets.db

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\first_party_sets.db
Size 48KB
SHA256 0c2a7d9a05ecc2cc77765a0a5d71529f2237755fe60ac3d742d6c07805f80d14
MD5 e045e65cd8ef3d083617318874fb79ea
SHA1 c2fa643f68ddf8df9e99d41cecc7525e5a2c08c3
SHA512 23c380211a66716c26bb85d47c8d82531cd1ed92636bb91e281a4abb9e2e2123967e8b4761d830c99c8fabdd7d6e7526165d78111e0ffae97194ce7a1195dcb6
SSDEEP 24:TL74/arHRH34kQrq+i7ZYZY5J+Qnj3k0rJXAeL3mkAD6W6Ivrr6UwgfL:TY/IHRH34kWqB1kQnjhHmr6ITmU9L
TLSH
T1C223886EDA2CB9A1FEE40B3DD7D1D0127735AA0EC2E4D9F1099B406746C540405EB63E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.12\manifest.json
Size 135B
SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
MD5 616eb6b585f16811dc5db5063e088cd7
SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
TLSH
T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
MD5 SHA1 SHA512 TLSH

Submit Download

protocols.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.12\protocols.json
Size 3KB
SHA256 2edf732da5fd827859e7a1a5b69a4a622cfc416f60a6ae04154d5aad3a1bccec
MD5 5e2067a92dcfcb05537479c384a89725
SHA1 eeed29b07d865ac4d46629fddadad629d0ad4e2b
SHA512 c96c5f9cb7a169ad91b070b567cf9fa8f35951ccc5aa930e97dbeccbeac27f7e9dde1379138c9ba6b0d10339f9cb053ef21f19f06d7560f97d5d23a27c8ed4f6
TLSH
T17D7184B7862088194E360AB4AA0DF10DF93702DF2AF598D3B27D455F1F712BB3946249
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7b9dac8593d827b7b825086ba5eeec776b808b8429eb90a6b645c319ec8f1435
MD5 c16a98ebe36bda7f5aece00f9ac1d0d0
SHA1 ef2e2a8775d1ebc0124f0ba983b6f20777919000
SHA512 148affd9dbe6aaee9070c22e41bc916df527cec5741753ca2733855f500e4eef0a257445d281d79c2449f8265c41b54dd53ffe57650802594b1211b0db611349
TLSH
T1ADD012273B0DA054E7A9C2729613C7921BB6646174434B01E315C95C99B54D412D6183
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c17dc8315075bb661bddf6b1efa879b9a3c39af13982f986bd287f5bc861cbdf
MD5 9573474710d1de6302a0d98890d2faae
SHA1 618b9f2079a97625be399f6137e46655659ecff9
SHA512 a345b915a4191d30d0da665ea4f78297c0cd671a5767e05c415403efb649110868fb279d22dc496792452c325e19b00f5e579f6e014a4488c9a4d6fac83d1c46
TLSH
T118D012273B0DB054E7A9C2729613C7921BB6646174434B01E315C95C99B54D412D6183
MD5 SHA1 SHA512 TLSH

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 bee9fa2cd086301c8bf601004ce6c1bbc78083574aa3e3c8e0a06d0eb4522112
MD5 35c030ae9f987ba340885658ca82d6e7
SHA1 6742d95f2731f2564bed3972f7fa9cd686e3eb72
SHA512 68cf640efce0196f2d651b66bf8c36d1f011ba7fce0f31c089624e2d3afaafc8f06e680bfd0bc86a00b8df0528044cc4991c1ab43fc495dbde49c95e0636ee85
TLSH
T12AE02BE5CC21B93B18FE2B18D0665787E70523571B41495F3A3CC20C8FB263E554985C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 969a48e04ea310f90eff4872173ee54ee62cd3c9fde5c4fb861f6dce339fbbf4
MD5 a2136244e94e546dddb77af668358266
SHA1 184c1a1f05a0d74450105ceb524132aa87c318d6
SHA512 e39dd6dba187eaf609949073ef21f9e9003b921721e487fd69231589ea808965856359714803a09041fe6146936eac0479348727387bb38dc6c6de35fd0697aa
SSDEEP 96:D+Nkc6B5hAEZlykbR5Abt1htLrD27ajr5Htb9L:D+pGEE7jcnhA7+5HtbJ
TLSH
T1A1C1B73DC9A32B45DB720CF297E98F42BA74B196B91F4E07295B4837263E3DA34D4424
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe5a2193.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a2193.TMP
Size 3KB
SHA256 ca52836b8baa9c6aa2a961c594df1380045a17822f1452001501d71177200e14
MD5 d5913913b9c2c1a3c33ddc604b84b410
SHA1 dc23ca7eab909f211189c4327c02eaea72b5a83a
SHA512 7356baa6be2ac8f6c08593193858a5814418914618d40463a50a78b8f0a3716472931704eacc784cd94ebc99af007f5fb95bdfc90c4f502adef35b8b79e334ea
TLSH
T11C711A3DC2524B42D3710DF3ABD9970332B079A7CA2F1E4B5998857B690DBE039E9038
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 2027fec285a80d70822af356065e1e0216e99e35fccf03f66ac17058773866ee
MD5 84c95930c1c8ef9e2bc13186e552bdb2
SHA1 267d12c9daa8c8c66c85a617a41ac930ca28b966
SHA512 1315a6c5251512153aef5ec2458b01c9b4eb1e107a5c095d88149c29d673f5ab5ca2decaceab6a2d62e7577a1f4db1e4a4149365c845d3521fc8c33cc5f325ae
SSDEEP 192:sxZ2RNyMqZjK1Ml8UQVHEH/fTsL/AKTG5GN2Gwt23ubprodp9x/W6+WNB86/Y0hZ:sxZ22qJy/fTsLoUei2R0b/bb/5dXCg
TLSH
T1838218056A64597BDCDBD219FA55BB93D6F91573D1804E48AAFCCE0C04E6BEC220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 77f1e6b8d7c368737f4d4190a748ec4c6573db523a8719b498590b80cc915b54
MD5 997248de94e082e6c805cadd89e52730
SHA1 635d37352bd202db591c94e4da14dd99acb305b0
SHA512 11a550a3a94eae3067d66c50a64d28fc50c3954df265331926554df1cc533e72d1a5fae870e69a337ee4c13938958b98f7807548f32a5e474fedb7d8246c13c3
SSDEEP 192:sxZ2RNyMqZjK1Ml8MHEH/fTsa/sKTG5GN2Gwt23ubprodp9x/W6+WNB86/Y0hJSd:sxZ22/y/fTsaEUei2R0b/bb/5Dj+T
TLSH
T1C37208056A64597B9CEBD219FA557B93E6F91573D1804E48A6FCCA0C04E6BEC2203C3F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 98500491e72ac24eee8088fb1dd1fa57bfdd691cd78b96957018de7470dab7d0
MD5 f34959cfbcf82bc9dfd957f89a447ca5
SHA1 8bdbcf624def465f581a9174653d5d82f84fbb21
SHA512 b32c49a3dce825066fc1f6341f343b6ccac734c3ae043843fd59b6892ce528ed311bbda2d960e6d23358f7c296f3bb174db12de408d104c9c0bb6d2ce87d87d2
SSDEEP 768:wQAKq8y02yS7pLuLnjbWRmj1QWT8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3+zx4Llv:wQAKq8y02yqEnjbWRmj1QWTu1jaK+zxo
TLSH
T164030A3B680CCB7E4FC04E9CED267E8A6DE8028BA698CD5447FA444C03C66EF55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\2c60ff2a-c337-4df0-aaba-fe27b78528c8\index-dir\the-real-index
Size 72B
SHA256 38cc5b21bfcf5916e15dc3fa7c6b5575af359ad410403740f6da9cee342a1bfe
MD5 50009eeda9c877555ea0127aa0e499ef
SHA1 f43ef9a2922a108550d7cc20ad275f52f5798fcd
SHA512 abf438c9a93cc5fa5c5d151bf625e543e6e5714858e31be0fe9bf65d2d9c42c465e0f909de6b52c7935f02312d98a490e7058a25888922997207435f4b5fb36f
TLSH
T134A00413CFC14545C51331F3155303451301DCD0151C5F0740F700D5CC5CC545D4300C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\2c60ff2a-c337-4df0-aaba-fe27b78528c8\index-dir\the-real-index
Size 72B
SHA256 b0651bdb1ff893c21ceabd03bcb34628f8d8a25259d5be62fbd260a329407af8
MD5 212d239504179378c23c906aa71d4800
SHA1 1a99434e26dac7df72b4ad82c173db259d1b776a
SHA512 0b727d0d74e18e813d39957fc69d76756f305c132e9494905033dce64b72dd075ec9d5c6b643fd5cb6b53074a41d515a759bdba0737f616431cf8904e47e96e7
TLSH
T1BDA002580A8B0002C40652B46EB725656713C9105645270B5593685CCD7755A8D4141D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\84929e18-7031-4aed-9651-196b2ec11ecb\index-dir\the-real-index
Size 3KB
SHA256 6307ed81d2ffd42fb94550c8ed9bf1e0892ff6db2eac694ac75a42945ee6b17a
MD5 f18317a3d2e03a1607b71d9f956aaaa1
SHA1 2ced15b7b80e05ce4c8b7da9b16fdada850493f9
SHA512 390e9bec503022cad9001ca43773765ee410478002c4f861161ac03f84ae1e993461c153ab52d90aea147934441752479697f1f25559d0563c82e64bedc4815b
TLSH
T13051A74F8E4A2D5AC9AC02F318FA041133B565EE2784CB4369DCB075B8C766A5C1E635
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\84929e18-7031-4aed-9651-196b2ec11ecb\index-dir\the-real-index
Size 2KB
SHA256 aa3cb178ec12dae53ecd25240480f93e9ac5a02b03fbaabad3eeede219642b66
MD5 44212034873a9132ff44a4bac9678bef
SHA1 364cf7621337ba5b1e940549baf2696abb56caff
SHA512 659db69038d82fa52cab56f80793860a39067171cadc1f05240430bb7568c84e550f28c90afc20b36aaed072184c9cfeeb4ff6179ed16772b0ec991156d3c502
TLSH
T13C41A7094DA589AFE864407305B26CA83370D9EC5B916B275CBC03357D0372E698B5BC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59b1d2.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\84929e18-7031-4aed-9651-196b2ec11ecb\index-dir\the-real-index~RFe59b1d2.TMP
Size 2KB
SHA256 168d5ae701b5cdfc03e6ede2a02899b5fa668effc3cffc744efbc36fb3b7b8a1
MD5 7509562ebfdbc63c8be6ee5197f379d4
SHA1 e81cfffff534409e27c877f8dcc1f4b1c9d366c8
SHA512 68dd644df4ec948001d0e35bb1307f60b55f2bd153cbe38240eee6ab5b9301ec54167f2afabd7e86e3cc7017b9c54d3af7ea2a19d1163e5610b2c7d866fec199
TLSH
T1CA41DB864E818A1FE88040770EE3B8F87339580087117F4774BC5636B9617FE2E4E0D9
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 ac17dba1921dc0ead87a0669ec04ea8b56a5f2bcdf58268b07f5f0844c41961d
MD5 c6e305fbc5d02919c52d583b61519d1c
SHA1 4d626d0253b863b3708c3c4e4dad22d2b524dcea
SHA512 393336f19879d74c2690d9e0d2557aab7cfac258d45d1efde87d071da573c5db95c3bc05ac3964b2680a617c2cf05c690fda189d87da10f02c1bcc127d1de7a9
TLSH
T10CE068FB2CA72824F86B83D61831806101023C54C544BCCF60AEB59360A13543599C22
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 c45b4e55ecd184f7fd3c91358067477111a57f300531d485f68769f360bc7a6f
MD5 2be1ad972f015301d75c9f76dcd9cfb7
SHA1 268f3b88973c4bf878bc90aa65a83a6d6975a929
SHA512 6f7e56ee92a1b2f6e9157312a1731f5d497557a074b05186015db149077071d7946a5b8eed56d7811cb37bcfa5af7d077f3614e26d6b076ca2c4a8848ac556e3
TLSH
T13BA002228A4AA002E45546B0906665C9B3554CE91145174588AAA4FC9CB559165CD142
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a08db.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5a08db.TMP
Size 48B
SHA256 37fce9e4e796e6d2ff95bd5af1696940d632f73d75bb0afa3c78e31c0b096cc1
MD5 aaca88148eef142901ab2bbef122fcf4
SHA1 2cd71daa2b8ab836f287cbb17d8a8b03032abf16
SHA512 1f879e176d6c84f1cbc709686f1e7c8295495c4fb37eaf72c62ef2e97bd7725a596d6838b47b28518bc17776ff9c452d0b91a01d34a4767d74748caa82da48ab
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 22KB
SHA256 fe4a7106db84f7ff55c6372b31d0781881fb461b9db210679c2764fa64bfc894
MD5 7b47067706385598bd910031a961dfe7
SHA1 e0f7bfa231c0c06b5464f4fbdfd8e9ebcdafe74c
SHA512 d83b6e5bcd46833add630b07627aab4ab6ca3e23e8b147f3b06edbbbf98492b6f3b302a085732178f6582612ac3e863771ea7adb2c3f383dd0a02c4e3920aec3
SSDEEP 192:GD9R5VJhn/iVJnZFGVApBPisTE/3oNloNPSF53pVWFQ5xfSsD0PnY9JFlPtv0F5o:GZLVDJjEDPV0/ZdwPD
TLSH
T1E9A2681232BA02023C7D391C92969B274A82F563306DED7F7BA900B54E67E125DFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

domain_actions.dll

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Domain Actions\3.0.0.20\domain_actions.dll
Size 82KB
SHA256 e5c9378b540360fb4ab0b16bf40ed18bd99cf4a8a5a6923f4f240d373fb441cb
MD5 aeb538c29f46cf0e19827ce47594488b
SHA1 db32b33a5811c303b1e37e1ab956df20ba44b355
SHA512 38488a42e5c532442a65fd4edab683f1f63eea71bae3ba2f801693647f633af9d836171dc751b342dc2e0e7784266eb9a40f677c0d3c9f651e7374f1af707852
SSDEEP 1536:NocewxXknaFpdgxBf8paY3JQzQik428fKagFVbydki806yav7Sz:NZvx3bgrfrPza428fIe76yaDS
TLSH
T1F783F1C0DA6C0117EE6B4D75D17959CA6BB9D6B50BA0B3EB2372845A0E02FC5EF36700
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\EADPData Component\4.0.4.21\data.txt
Size 150KB
SHA256 a387f2eec4175eaec10e8de166dd4c16ed6cd20a29a0b0787067b29c1fa4866b
MD5 93bbac1bf250528b208c200d6e9f889b
SHA1 e93ab1b1e8273c76df7927257e3cb82090cc2c07
SHA512 6df30f17a2905235839a610ceb0b0c68cb846a41b5d64c298cfcedd0ecd4a8673e990c46c61c71e7f115fb5b2f3ba1c7bc4a4eea135c779b6bdab2f418290062
SSDEEP 3072:MHPAgDcCHaLHl65aynyosxb3+B1xh0OrlwYEBJ2fpXvHIcau:MvX1aI5aZoKzMJ07NSBXzau
TLSH
T1D5E30110CBC41F9CDAA8261CA0FE1F0D63E0C59D852A658DAB63FD0B6FA7508571B5D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

office_endpoints_list.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Data Protection Lists\2026.6.5.1\office_endpoints_list.json
Size 9KB
SHA256 f0c77aaacfc571e0bc3f51387febe134d991bf3c7f1941af303ed901f288dcd6
MD5 30719122f9edf4e23019a3b74e4f4325
SHA1 6707d64052797b9c5f1a5ccf016e5859c8ef898b
SHA512 ec2e1a33fcd1301f282512ffafb611ea705dc5df09d9aee014276909c1b62b0c73600121d94e9b6d9e160296672b41f2cb8c3ba23f121244ad2ea6521680723c
SSDEEP 96:DdQ/JJvwjyUsrdfsysVsnQfbJNZidYusysXYs2sFsdv12XvlRT07s/DkhcrHPglW:D7d7mfgiIWRcV4sobxezQd1Y
TLSH
T11512BB3BC4B49F229AB060659705E244F13C43BF5600C6FF76B9829C1F366ECA58E1E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 af9dc8b94f8e900d19acf3bccc08dd510d9f2086438b13906191b9bd06605faf
MD5 75e9b3166828c08a252055def064e51d
SHA1 bb54472dab8d9ff1e6a5be4fa681cbb7fd580076
SHA512 58b58251079761ed18bdc6b791f4858c9a91bc9c19ae9ac6a0a9565fb3fc1779bc029b92c421279bc9c9ce46c1b80e650e01cc7d446201cc95ce185ecc1f83e8
SSDEEP 384:nXiF9CcmyWCs38NB8TUNTUlIxBPm3ek32nn9rih4JfbgGGkp3sUqsjn2NF9e4KV8:SFccps3ewgPKekms7GLVDcF9I8p0o
TLSH
T1BFC25A35E858CEBBACD64E99F38E7683DDE0116399888ED4DAD84D5C00971DD174F823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 e2913032456d3eca7aff8626e2fd0f18115466c96e431c2a58e185f4f61f556c
MD5 5fc171263844bbdc9cd7e390487b0b13
SHA1 535fcc6b5ada49c44f6a8a7f75b4a4bb3243bacc
SHA512 ccbb88a974d5ab636fdc12e9ec48ab06f88531b53fa523d3c799bbe13fdd26235b49b9565320b2c261205facc75e5d569c5955d474221b1f975ef157d389978f
SSDEEP 384:nZiFvZcIM38NN8TUNTUlIRJTpm3ek32nn9zvwU4nfbgGGkp3sUqsjn2pqF9+HBbd:wFnM3OwgxKekm6WGLVDoqF9gQ2z
TLSH
T1D5D25B76E854DDB7ACEA8A89F75A7653DEE00063D98C8EC4E9D84D2C00871DE270BD17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 af627867863ee680560d1c8c256a293bf95f970338b7b8db7a4999f1c7594812
MD5 beeafad56e60edcb36cd34b8a71e46f5
SHA1 042f127bd16c724a47ccce1220155384f22d3d3e
SHA512 18da8059117d35a424937611d1146f2df87c90656596cc41873dded9a7afa4957f238c117dd15ae0ac1e0b81f1fae606a9d4218dc803bc145263c839a0674aab
SSDEEP 384:nMiF9CcmyWCs38NF8TUNTUlIxBPm3ek32nn9B0Q2s4JfbgGGkp3sUqsj/HMe4KV8:3Fccps3WwgPKekmsZsGLVDNHMI8p0o
TLSH
T151C26B36E868CABBECE64FD9E74E7602DEE01267958889D8DED81D0D00971DC134B823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 1a3d6b7a99fc51224db99663104d7dbf7436411c5b0eece20d9e9e0a7afa89e5
MD5 17c2a4b66d4565c6256c91b1fcd8eff6
SHA1 6bf80f4d6d05ef2766be5c5cdc8d9bef9ce1aa9a
SHA512 7542ea682c4c628a9cd15523fd24ca907c9819392905693d062c6bb3b5ba10386f54a96daf13ee791e635a9f5a881088c9440747f2e6e4adf3f65da9ab60e466
SSDEEP 384:nDiFvZcIJ38NN8TUNTUlIRlTpm3ek32nn9zvwU4JfbgGGkp3sUqsjn2RF9+HBbsi:uFnJ3OwgxKekm60GLVDGF9gQ2z
TLSH
T17FC26B72E854DDBBACEA8A89F35A7653DEE00163D98C8EC4E9D84D2C00971DE170BD17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 96ccb2f301acb4a9a6ba9a7c43c2ca02cb1e9ea6b0f473fe0020047edb4f99cd
MD5 e514beee753ffe3752f049dbf3b2bdf5
SHA1 a9ed4b9ba28661d9f58fa0b97067d8b10dc61c0b
SHA512 fb1a104f9ff59fef0f9f165fa5e2f664e01f2131d27304af712abe2b36be03f86954e3336742e4fc2b01d4f14dbf1fa669ec78630b9e2b51dadfe18f8ded5b00
SSDEEP 384:nYiFvZcIJ38NN8TUNTUlIRJTpm3ek32nn9zvwU4JfbgGGkp3sUqsjn2RF9+HBbsi:jFnJ3OwgxKekm60GLVDGF9gQ2z
TLSH
T19CC26B72E854DDBBACEA8A89F35A7653DEE00063D98C8EC4E9D84D2C00971DE170BD17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Advertising

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.38\Mu\Advertising
Size 19KB
SHA256 231be4e0be45f588b161634c816b9a5a49f530c0dcb55461d37715a94482dca1
MD5 897eefe311c18078a34e06f3cf624a6a
SHA1 98246e769fb513b8aead588024d1ceadc65422d9
SHA512 0fad93ec06d6cadb4c2e72b3355b509d5b9995706d6b7e9e69df21d9907dd3d4156eaba62a6c64ed34a6747046ffff841cc79020aff0a29690258ab487bbd6cd
SSDEEP 384:/j+Vafk2xyJEYoAYiQZU8rYvepdFhQXVVRwjSTV2quzxmVUiKF4EysZ4y5:zfEHoAYiQHriepdFWlVmjSTV2qwFOs1
TLSH
T16A926151887035622F2F50CDE0583F8E1199667540AEE6DE9FE48666F28C0F37894EFA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analytics

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.38\Mu\Analytics
Size 3KB
SHA256 bba2063d20d70f4ab06dc2ae04c2564cc2b8c631b6dab68248957dbdf107fdd2
MD5 b55f84fa839160086b8b337b59f80ded
SHA1 0fde6cb65ef56264517aab0eb5ea93667f5985c2
SHA512 6750626e0efca608abafe63926229887a68c9f3e657cb78921daf9c6b3ce11d6bfe1ba83fac775a8d1b6b69cbc00dc193fcb818c70ded3ea159b6241fd2823ce
TLSH
T1CF815415A4A014433E2E5668E03C76B912E8253880E9FBD9EFB19965F30C0D778E597E
MD5 SHA1 SHA512 TLSH

Submit Download

CompatExceptions

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.38\Mu\CompatExceptions
Size 689B
SHA256 5b462316a51c918d0bae95959bf827cb9c72bbd84ffb0e43b750aa91fbf3ba53
MD5 108de320dc5348d3b6af1f06a4374407
SHA1 90aa226d3c9d50cf4435ecdd2b8b0086d8edeb8b
SHA512 70f30c45e20b7cddd0cba6476af9338975cec8e40b8b19603af5fa859a34c6eb2138957daaa263633fe65213e2186402d05d9d29ad53e8f311335555116314c2
TLSH
T1E101E6F18EBD58313C74967C876C0E8FB9A5636F2898F2E96502CC87E3C054761A6C78
MD5 SHA1 SHA512 TLSH

Submit Download

Content

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.38\Mu\Content
Size 4KB
SHA256 9a63f38e22b8573cbd47a4ef7b67ccb0934b87239e075c5cfafc7a1014e340c6
MD5 0e3ce75aaf5e674dcd7508251bb839c5
SHA1 35d4a84a8d946263e6b1d06fadc31c5753a946f0
SHA512 80d49bfdbcce2ac21c5c39c6c538135a9768b5fadd73137f6b5916fe6740827fda06c154508c0f9810723c397a22f3d93542f3e972ed3b736f7478ea2e6dc0a9
SSDEEP 48:lAHJBLfUUIAPMsb2zIEcySe00woiyKIdw5uZWhDNB+jS+3NrSA6CdM+3+1oH:lApdOAP7bercySB/1ylw5usB+WB8x+yH
TLSH
T13991B7037E4409276E95D105C0ED209E2C71ABB0C85DEDC99B964B7FBBC8C8BA4961FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Cryptomining

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.38\Mu\Cryptomining
Size 552B
SHA256 bdee796bf07922c152d770cd5928955f1b12c12515c4db6fc0ab8d2ad0c44c4e
MD5 39461c6ea4ff09d663a65d133eb47c98
SHA1 c41f5b5ac9a202ec7dd12122e64b858379a9a815
SHA512 a8e195fb9bfa68dbb064a0f8a41cd86aef5fca43349388294d364b5fd556f0a01674bffcbb5eb2a36e3fea9c64bf575b5e7ed674661dcb7544ed7a961686d4f8
TLSH
T14AF0C0E5C82197766FD544A1E05E7389F4844BB26094F3D50B56321996E8A432684DEC
MD5 SHA1 SHA512 TLSH

Submit Download

Entities

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.38\Mu\Entities
Size 68KB
SHA256 f6e93c83d9e3cfdff064535647cee76fc85aa1c86fd22a93dcf3d2c377346d94
MD5 478a605d5578236f2d1ddc93c2f22456
SHA1 917f05453d497b3e3de684a905e141972c34a267
SHA512 26d75309976fac0bd03ffe7596209c50ead7518584dd9f27d12a86d80ecec0889bb58da1b8dc8cdb38fc6bfdca7928a54c5a15903c4b8d293633d4d58ec147b5
SSDEEP 1536:Wz20p1W8VMVLwecMFUh+oP9jt1PNEOjy+in:W2W1WUMzUT1jpw
TLSH
T152630877BC500D3384FB804BB09D2D6C21249FE5D8ABFED89BB1516612839C4B5D86FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Fingerprinting

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.38\Mu\Fingerprinting
Size 1KB
SHA256 05b29240a28bb75b4535d558edc510eb92df0ac27e9502498b99cdbc576b8298
MD5 f665b35df3c2a7b4efd9dc396f2af9bf
SHA1 2833c37d7d92a4cd1e413eba0d6717e90e69f973
SHA512 e7930341af55bae220962d79ce9aa056bbd1c9fe3cfaf0fd4181d9aa4257b5679648e4aa19561c2f9b5c8fcc6e6757d3616726eb28e77a2b899fa25f7d1b6706
TLSH
T1DF211F8295D038716E6E1488D55C3F9C129A2B7001E6F5DCCEF486A1B61489F7180C67
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.38\Mu\LICENSE
Size 34KB
SHA256 8ceb4b9ee5adedde47b31e975c1d90c73ad27b6b165a1dcd80c7c545eb65b903
MD5 d32239bcb673463ab874e80d47fae504
SHA1 8624bcdae55baeef00cd11d5dfcfa60f68710a02
SHA512 7633623b66b5e686bb94dd96a7cdb5a7e5ee00e87004fab416a5610d59c62badaf512a2e26e34e2455b7ed6b76690d2cd47464836d7d85d78b51d50f7e933d5c
SSDEEP 768:Mo1acy3LTB2VsrHG/OfvMmnBCtLmJ9A7D:Mhcycsrfrnoue
TLSH
T1B6F2735FB74413B2018206A26A9F68DEE319D07A73664095785DC15C27B3E3483BFBED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Social

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.38\Mu\Social
Size 754B
SHA256 4955c3e7f56641a4ae0ce9c79b4ceee4b21733b0f6dedc980bf8d822a792eba2
MD5 1d06d58fe9131c14ba5ba5ff740b020f
SHA1 e6ed812e23e201b20170e928686a5d612165df85
SHA512 2854c73c6ef4d271d0e992113732ad65e406d6310711551952b4d451e2c577a2c3dcb06052e3ab30003b01619a39e87e5dd28d54f459f94efe879d1a79039b8f
TLSH
T14E0126DB1A1450027FAAC495E4458B6948B00630445DFDE582B8D27BA08EC97F39F7B9
MD5 SHA1 SHA512 TLSH

Submit Download

Staging

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.38\Mu\Staging
Size 36B
SHA256 411a706def2e70f96a507208bf80bceb93e950c4c2d671cd1ddb4134ce54b2a9
MD5 0163de1b14421d4eee3757ff76fd81e4
SHA1 96c75c4fe1e3f33a367f45293bd1bd8bff1c06f4
SHA512 80114d59db8f3654dd6821589e5ad03daa923a35610a372756a8865b3e769621e32ef2aed92c2494de2b9fc06d9796b12f1e3bb75873ed794e8c9ae8a0d5e965
MD5 SHA1 SHA512

Submit Download

TransparentAdvertisers

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.38\Mu\TransparentAdvertisers
Size 105B
SHA256 d2cd0bef5f45daf490c53e705d6f67dfe12390c72a00efa6f5117432bd8edb8c
MD5 57d5a3548911886de2f3bd3172e808ed
SHA1 ca932af3b25f245ce931fbc6cf10299e5fbe35a7
SHA512 933194509d305b2a60b38c149ba1d74e142ef15647242b287844d263006d33ffa38b6ea263c89cb821a9277d41f0cfda95a0eda830f3a5ef8df5ba80d3bbc818
TLSH
T1FEB00170D480008ADF4062C1D032DD98E08D5377A138C4CAAAF80C66F2433CAD1A38F9
MD5 SHA1 SHA512 TLSH

Submit Download

Advertising

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.38\Sigma\Advertising
Size 21KB
SHA256 5c62ee354070033dba1bad40dcde115a81db45943b2274fae7059a5aa5c61d33
MD5 452f3e9d40539cd65cafbd008308b5b8
SHA1 34203b4a803009ff56bb28d3a14305348082990f
SHA512 08504c06b603db3cb12f0ed6e30e733c2a2c830cad1124771c64b0e7b8480113383440325c56116fb57bde458b393ce182a3af75f0cef146ad6a8872ab9a964b
SSDEEP 384:oQh4q3kwr8CPLo3AptN7NoTn5LTDq3ZXmRHAez/GRQMKWxV1R:wqRr82LKAptNJoTNT2JXm1AezO2MKWx5
TLSH
T16CA2B361996025513E6F009DF1993FCD5AA8233080E9FAE9CFA0C676B35D4D335948FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analytics

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.38\Sigma\Analytics
Size 3KB
SHA256 d303be86132f8d7131941d41736694c2e29647ebaeccb38c0976fe66616ec8af
MD5 c4c782264f4a6a6ba84801c8c148afdd
SHA1 f138b8f526133c5dd612f79825f4706569fd18b2
SHA512 e1d3b123a7eabfe72d4df981e1015ca616c51fe7d94de91223e9c7f4eb98ed7d3ebcf7b5c7e08579db502c7b3529e095d314dc71b8cf5e79081c678e73aa646e
TLSH
T1F261C814312434212E1A126ED55E3E8E6AF8223904FCF7E14FF18A71B2194DB38E873B
MD5 SHA1 SHA512 TLSH

Submit Download

Content

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.38\Sigma\Content
Size 5KB
SHA256 70c295600066e9d3feeacd6bfc735bbcac6243694e4259477822d3db252729e1
MD5 7c5f5e42e885211f783a06b1317ba145
SHA1 079ab890b012120b89f776e4bfe67f3789f67096
SHA512 ec581f41917ee010d71a021cf16648fa757327198113dc3daff3adb33ee739da3f40d87a6f3e49004106770ea705e6b800fe263d21eccd33d7883fd1ed8c82eb
SSDEEP 96:02KCCvwLR/tE1LYSeyTPXD7fOiCrC400uvuJEjchVEy8Upy4uILrqNaRq3:02KCMwtWLYSe8miZHvui68kRBg3
TLSH
T169C183B2495079522F3E01C6F9E6265488E483715CBEEBC787E0C62CDD0E9E335A835B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Cryptomining

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.38\Sigma\Cryptomining
Size 32B
SHA256 696e930706b5d391eb8778f73b0627ffc2be7f6c9a3e7659170d9d37fc4a97b5
MD5 4ec1eda0e8a06238ff5bf88569964d59
SHA1 a2e78944fcac34d89385487ccbbfa4d8f078d612
SHA512 c9b1ed7b61f26d94d7f5eded2d42d40f3e4300eee2319fe28e04b25cdb6dd92daf67828bff453bf5fc8d7b6ceb58cab319fc0daac9b0050e27a89efe74d2734e
MD5 SHA1 SHA512

Submit Download

Entities

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.38\Sigma\Entities
Size 128KB
SHA256 a5409d2c6a8cbd9339a95a5e09fcaedd4546a49d47fc4ebeda2d8749cfc66987
MD5 87b4b75312dedc7106ac746153153c1a
SHA1 54fd4b67eb16620ce0dafe8eb641f6a256dfc4f0
SHA512 f594a5039c73db236f97dd50c3eb007f2fa2ff44d558222cf983dcd703d89f9b1e832bd3c249a20bfa592656e9c2e61a41f90df1b927fdd8f490d36734f92d30
SSDEEP 1536:e9nKLDxqghS81HcmcgqPvD2E/FwoqtK1Gmbpq6CXkkqGqnuP7Sr:GnANN1Pt3/oqtKAWvCJqGqnuPK
TLSH
T1A8D30938FE60C8185CEB041B91296DDC5B801BDA5AA6FDC9EF7F78190242DDD33285B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Fingerprinting

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.38\Sigma\Fingerprinting
Size 2KB
SHA256 5306139881e81eebffd97de016130fdbb04e3ae976d94ad7a74e5dee63fbafcd
MD5 427724f72baa3d5c91671853a89245e5
SHA1 a33deaa88143c298e0732ecb233663c372cb0e2b
SHA512 bd0027e9bd25fa3426dfe85f67bac14bc3124bbbd6493c1d1aafc33343dcb008a8a418134deda235b71377ff970fcdc45ce4e6b1eae79fd3adf1bc3ba2e2103e
TLSH
T19441552354202051BEBD498CF59A3F4D29E5623984DDF6D5DFE08936721A8E734908A7
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.38\Sigma\LICENSE
Size 66B
SHA256 44071e0fcffb9a9a32e8fa7010bb18dbc41afd0b176f81bf700b15b638a88a51
MD5 5b7baf861a48c045d997992424b5877b
SHA1 2b2bd9a13afe49748abf39faf9eb29ed658f066e
SHA512 4820b41aa5ff4d934a583e1f0b93b1512631102bb2dfdb74792a2f0dcf9907da7680c02a5ddd2492a1e6d58cdada3453d9e38bb8deab6ce831ff36a7f8de016c
TLSH
T1A8A0025216021A6312E295EA5E589B4FA50A1AD5255C0341164904D898B01D995E87AE
MD5 SHA1 SHA512 TLSH

Submit Download

Social

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.38\Sigma\Social
Size 3KB
SHA256 28ac79097cf67587a228fdfe4746a1a9b31dae94d5a63bb3fcaa82443d69e7af
MD5 af4c6f2598c45087a32c4f410f242553
SHA1 cad2a50e20ee6f699e21e78c58991a6a25a55ec0
SHA512 7d378b90e3cb7feac3580bc7858b6d8a4967c77196be5b7d94ef076a7e1e8166156e62954998fa6931593db5c8a8dcaacdfe3421bd39e6517f6c6094caf4f4a1
TLSH
T17B61DC32C550A9932E5D0C81EDC55E704DD8067ECCA6F4E287B082F8F0AD8977D90BAB
MD5 SHA1 SHA512 TLSH

Submit Download

Staging

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.38\Sigma\Staging
Size 1KB
SHA256 f90f4cb0976a046e93978971b58fba24bc93b0129e8612fdd0e5646a1bebed22
MD5 5d7f5a0c242d9d1290c8ad0bd57be3e7
SHA1 d454811443284aeaa0294d30caf65e624182b150
SHA512 5d36ffb2ec4d162c49e5dd1207bee8b51f36d91ab38d23ff85d4467ced3a7e0f4f639b230623804260d8b03e49ef124e6ae9714f63c896c024215bfbd13dbc88
TLSH
T1A621E2194E908CB11E596745D20A535ABDEA617D38E7F4CB8EA8DE7FC2CE85702344A0
MD5 SHA1 SHA512 TLSH

Submit Download

keys.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\TrustTokenKeyCommitments\2026.8.3.1\keys.json
Size 8KB
SHA256 3d6c659801f1686ff3ac64bc3b24b1d0ae76ffdd5f0e9c399ba37d1354a15ab4
MD5 ee666d1b2290efa6cdbc89ea3d317333
SHA1 a8bdd2c1d7e76fef48a735a80524243cd453e0bc
SHA512 7b2b577c9a168f626a687ee158cc20fa0ad0f816fb0583abfe45f89222d1762eb4fc619e029856618479fb6096a02eb2f9934cb46334fa781cea5cbcec992ee9
SSDEEP 192:uNtGbR0m0GflPAyR9Pm4lOvMwkoR9PuGMXcy:O7mZpKjA
TLSH
T17F02B6BF14A41182CE7FC16D9F0774B78FB03C066BCA3A83925BEA49484196D173B5B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 a247597502d7975c5070503b6b5396e54734d1cb0fa1e55d7da5c492d55f50f1
MD5 dd2b21377bbc7eac2c18384ac9b0b75a
SHA1 5147d1c6f6bce2be4153afae2b966dd0fa4b4ad6
SHA512 7e5533c73137895112390667a94bfb504ce8df4bbcfd68502ee062b718235b287194df0cc1f631c0d9200ca115121f898a84ec1c4982a9f411a9cdb8dbece18e
TLSH
T1255141E04C785AD1D5BE0E7FB0C739FC81EC9625F4A0343D6898E9995A7E61D608083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 3da7b1cc122e38b313c6d52e9d2b57d0373f600e252a671175c95c2a0d01960e
MD5 d4e41af4630a6e11322a86e73baecd2f
SHA1 5c077b9aadac705dc9e2979ed8e64264d49656bb
SHA512 69db95caa3591c81e29943dc840dae154f8ecbb2a018775fe73b222ab3a0984ff9b73502e96875dee23c1a3605867e472e80a581cfb5b2de61c619fbd5610133
TLSH
T12C512FD04C381AD1D5BD0A6E748B38FC81ECD725B5A0347D6898E9994A7A65D248483F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 00d76ccf96299991ade32b0b51dfd9729352e1815d1a7f42301644dae8fa535d
MD5 be76ec72b4c4910b31cef6abfca3cc30
SHA1 d7f3395018365e47aa93b69229f1bcfba69fed7b
SHA512 f68d3b9f762a008a83db45f8c57c4393587b1c6e7f9fd60db634e24f6b941ad4ffaad8588223e0d906dcac1ad868a6074e2b8dab8505be36ade08e3df3abdc71
TLSH
T115512FD04C380AD1D5BD0E6EB48B38FC81EC9B21F4A0343C6898E9994A7A61D248483F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 4b4bc7b583d4fd5c934b37e89cafde8b2ad2deb1463c6673e1a53c1490d16e8f
MD5 035255b9ff6f38430f3caa6068081bf8
SHA1 3a7a7b2a3dc257a29607a70b9646be65b4d75b89
SHA512 ff261ffa1b9c27ae63e3377646d2daca2c9c19b609c2eabd4dcd50bdb5e1c3dfe432a3d3884b073c157115c537ac5ebb206b86e85fcd61aa365fcfeb520ea441
TLSH
T1345130D04C781AD1D1BD0E7E708B39FC81EC9B25F4A0347D6898E9994A7E61D748483F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 b3b422bec6d157be35f5dbba8373199c83d1228c07cb8114f81e42d882e995c1
MD5 fd17ec7a694e753cc0ec21e1e1eb9a66
SHA1 c00e5a8a5ab1603529e2739e17314e63bf7197e7
SHA512 abde5c2428c34b65275c47a1ea7880de45c6b820397f1413b86099e6b837f2027c6bc452222f1ca0a215347988c8afec1413b3e4dcde792a9e03d1f1a668df2f
TLSH
T18A514EE04C381AD1D5BD0A6EB48B38FC81ECC726F5A4347D6C98E9994A7E65D348483F
MD5 SHA1 SHA512 TLSH

Submit Download

e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
Size 154KB
SHA256 e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
MD5 a922bd2071b7aa9f2154c991d41885c7
SHA1 c88b22d16c951cbb0bfdab367232cf830e0464d1
SHA512 d8ed2d6b1c3a421a9771e3a5109eaea839bf64be7b7e672ed7b8aa47590ff35c6e78aa79712ce37801cedc56db552fc6a7c3ca55004295a438219ce4a8f007a0
SSDEEP 3072:Aj0amyoD1f5NQQHyR5nYbGnkBEGsvsq5UBkUM4RIJ+37HVeCsKkwQuBp/Z:AoHBD15HEYbQkovswoM4RIIzvXkwtBpB
TLSH
T12BF3F11D7EDAC952C40B92BD3C1AB18BC94B8F0A431674CF264D90248EA578E07E5EFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 a0b1a35a86cbd2e671521525fc6903162d450e3b301948d913d05ef458794c20
MD5 22215f69c4a5231b8c568620e783d7fe
SHA1 c64663b6efe0023ca5978374d785f1202d924d1b
SHA512 9e38513132672de4a65c01a6eca3c8c3a878cc6e11e2c0d2235798b78e3338c9a13a15d261c4b4fc6c60657f42407b98c8435aa4352366d1809843ddda068e22
TLSH
T1A5C02B79481924CC2B00043C6004012B19B0560023C413F48C1B8D80007537CD30817F
MD5 SHA1 SHA512 TLSH

Submit Download

Encrypted-Injector.exe

Path C:\Users\Admin\AppData\Local\Stoneboat\Encrypted-Injector.exe
Size 480KB
SHA256 565a8a17e3c4c6ac8ace2bb3df5aae9b3bbde1e6889f04f031b564602f498b99
MD5 d937fc0dd514edf6d8c32e89afcc5588
SHA1 2c2725926beb60b043af56104fde11c88bf2ca88
SHA512 f1c1b8cdc1360d7556e21cf76475f1b5dff15bbb87571456b1607234d7569af8f7da2e564f730e964651b85864909161bb1b35102a9a0444e9df9c8dc87d6df9
SSDEEP 6144:YUutHVXYYRTUZabgJJ2ogelPiqNtibgqlAf0vj7uSO+un4kst:A9mst
TLSH
T18CA4404AABA5CC1DF6F70A3AEE7A445408BEBEC40E3E959E4640378D8535EC59C10B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QtCore4.dll

Path C:\Users\Admin\AppData\Local\Stoneboat\QtCore4.dll
Size 2.6MB
SHA256 46f24b0b8a53e2502037c2f47e46efc04c111fce8ebc7b23c068a20a2ec35a00
MD5 52dd3ecdd390bfe88d488c7f3003b7c3
SHA1 9376bd43bbb5bb830f4140d27470b36c12a6d315
SHA512 7e8c9902cb56a25f0ce5c956035fb348999fb35b0ea1397bb4a782b2d520d7c4e8c916d067c18a492b79c1bd6bb5dd4e8cb7561cd08af1fbbfe482aff0339111
SSDEEP 49152:wpnyb0Z+zbpGbmiL465pJ6e6GJsv6tWKFdu9CFTSuPFMr:wNyxG1tXs+Jsv6tWKFdu9CH
TLSH
T15FC56D90BFEBC1F6EAD3A2B6446F921E41369A1647208ADBC10C6B074C756D17D3738B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QtGui4.dll

Path C:\Users\Admin\AppData\Local\Stoneboat\QtGui4.dll
Size 9.0MB
SHA256 1be9a3031f8e488cd5839a7b74641d6e758fbde4d28eb09bc4cf892e2edd0a38
MD5 886cefa51c9671be520a6a60544e4d7f
SHA1 a69731c6f635fc1ae50d6d21b360834b8ff67aa5
SHA512 b635a41b6957c07404b4ced039d5f0cf80bb344b9d006b8bf4abe7af61b83885d9dd53dac8c1cc0ecae4f4f6bd77dc9af9a35220d112d2b8dbc94266b0809b56
SSDEEP 98304:1xvQeZgQinV7IgyL9d/loEDLGDCNfG/9WJghBeZJ9xDKcrSF/n8CWyE5Vafed:1xlZFRlDKDCNfU9WJJHKc2wa
TLSH
T170968D12FFCEC1F1CE86B178145EAB1A466BF6C5CB108ED3E1895E5B78202D12CB9257
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cache-gen.so

Path C:\Users\Admin\AppData\Local\Stoneboat\cache-gen.so
Size 31KB
SHA256 7500d562fdeb021e3d282decd92bb2343abc70a404c85daf8ecbd22e090c49ef
MD5 041ed6e844bb5c948aa64069e06d6da1
SHA1 68177ccb010472eb1becd9f6d4216a4537318624
SHA512 40978c71c99575158c861753cd1127c6084ea62d83cd26a392ff51bdeb3a0162a0ba8db58dd1e0ddd08f2abed50da8b47142d8eefe4d53d64049a60ec737b330
SSDEEP 768:diyo2dsJ+U8b03QRyMoNt3G303ObtfsyiukT68NXEiY:diM5UFARBsGBg/dEr
TLSH
T1C9E28D5B866A5E62EC0E387F5C18E4D3C255F576794B08B2F2AA0D1F391ADACD420CD3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp100.dll

Path C:\Users\Admin\AppData\Local\Stoneboat\msvcp100.dll
Size 411KB
SHA256 b2ad109c15eaa92079582787b7772ba0a2f034f7d075907ff87028df0eaea671
MD5 bc83108b18756547013ed443b8cdb31b
SHA1 79bcaad3714433e01c7f153b05b781f8d7cb318d
SHA512 6e72b2d40e47567b3e506be474dafa7cacd0b53cd2c2d160c3b5384f2f461fc91bb5fdb614a351f628d4e516b3bbdabc2cc6d4cb4710970146d2938a687dd011
SSDEEP 12288:Seb8zxr1aWPaHX7dGP5frhUgiW6QR7t5qv3Ooc8UHkC2e7wx:Seb8Fpa6aHX7dGP5Gv3Ooc8UHkC2ekx
TLSH
T1559428237A4649F5E1D223F46289932143F9FCA40721B3C3A2EFE1A99F583D56A33951
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp_win.dll

Path C:\Users\Admin\AppData\Local\Stoneboat\msvcp_win.dll
Size 493KB
SHA256 9276e394bc5fa9a08b5fc84305d32544ff9f0421d0870c6d76c63a82f1955559
MD5 7762c51ea02eb943183d597ea0ee5530
SHA1 0b8c307eba01d0679a2669210862d0afa888c40f
SHA512 14c955e8acb03e86cd11cb992a69fa6681769b2bb7ebdd3a587b36a519f4084be3dd42825b3c91c0d4e325a2869e96acfc88c3ca05bc59352bf0657e7c4ec758
SSDEEP 12288:beMcMmVRYcFERWKn9g82vWirmibAhUgiW6QR7t5s03Ooc8dHkC2esJ2Sub:beMKYXQKn9g82vtnbf03Ooc8dHkC2ecC
TLSH
T142B44C332A4509F1E48A23B4618D936283FDEC650361A3C357EEF9AD6F6D2C06A771C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcr100.dll

Path C:\Users\Admin\AppData\Local\Stoneboat\msvcr100.dll
Size 755KB
SHA256 8793353461826fbd48f25ea8b835be204b758ce7510db2af631b28850355bd18
MD5 0e37fbfa79d349d672456923ec5fbbe3
SHA1 4e880fc7625ccf8d9ca799d5b94ce2b1e7597335
SHA512 2bea9bd528513a3c6a54beac25096ee200a4e6ccfc2a308ae9cfd1ad8738e2e2defd477d59db527a048e5e9a4fe1fc1d771701de14ef82b4dbcdc90df0387630
SSDEEP 12288:nMmCy3nAgPAxN9ueqix/HEmxsvGrif8ZSy+rdQw2QRAtd74/vmYK6H3BVoe3z:MmCy3KxW3ixPEmxsvGrm8Z6r+JQPzV7z
TLSH
T1D3F49D11B692C073C1B221300629D7B25D7BB8711035946BBBD59F3E1FB47C1EA277AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

service-sys.lock

Path C:\Users\Admin\AppData\Local\Stoneboat\service-sys.lock
Size 4.3MB
SHA256 a53b6423631234feb7bfd2b88e367a72c87fa2c831d08eba0fda67b6c3c3f7bd
MD5 6c203c13b7375af9120e53ab674fae2c
SHA1 cf2f054f3f683ec621157c0458c793487f10f920
SHA512 f9a23afcb19da3bd36b195809718c3475f5358f86a0a425df7479686374a6fad6250bde58a9dbfc090795bf4cb50eb00b82904f624ed80c2cb3fe19e12dc2ba4
SSDEEP 98304:zcsJtPXT7QBatxxo/ZNmxlIEdUagLWdXqMFgOdEg3O7i:4KQBGo3mxlIEbgaXqEb3ai
TLSH
T1F026238EDC1D8A2E55E6873C1045588BF0B562DE3B67983E5F74E2F8063CB2A47D82C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ucrtbase.dll

Path C:\Users\Admin\AppData\Local\Stoneboat\ucrtbase.dll
Size 1.1MB
SHA256 0f4ec73cf4f64d4b89f3c87a127bc7c46c052a4226f9876a3a75015b716d9228
MD5 c4a25dce665733663284750666684703
SHA1 368f3c3497c1b0121409216282803bcf1b64f35f
SHA512 768af35c80d0423e72fdc8178b57d4be583569c1e96cac8c00808d07aed988bc614618f7b2077617498079b6ec0faa2d2d48cc314cc34faf11f56b6b7146201f
SSDEEP 24576:FQeBoON4h/4z/G1YknUkY3Ub6lymKmcvIZPoy4yuhpBR7j:qeBoONs42nUv3UbfjpBlj
TLSH
T1D2358C107895C2A4CCAD30F51A8EFA36466DB5904F24A8C377D41BFFCC690D0A9F769A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1EF751B.tmp

Path C:\Users\Admin\AppData\Local\Temp\1EF751B.tmp
Size 4.8MB
SHA256 e730348124b3a45920f99ca9498e87a9b7255f8539e8db32b1f2b45c2f16892c
MD5 a3cc0a560ec83c3ae1cc8329c81fb6e3
SHA1 c412472594623317e6afd2b12e5af8032221e6ed
SHA512 04706b4252e40e4730c86dc2112ff4a786e88230739cda04fb235450a772df68d0656fb691954ec4f849f10118468e439c579a70832916b1ee7e5dcbdae67771
SSDEEP 98304:eF5D/LPwHDA7pV/15/qfw/g4sm8N99aQVpzpD7slCYbSJwDTZ:wDPwkdV/15/qfw/gE62Q76lCCSJMTZ
TLSH
T1283633BD268739E798B337683F3185A2614C45DD39D9193DAC02CA26BA1D3F5C3D48B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1EF751B.tmp

Path C:\Users\Admin\AppData\Local\Temp\1EF751B.tmp
Size 4.8MB
SHA256 aa99986f9cd63cfe2e9f199958552b10922dc9f895fc6f326171d9c3e3a2f522
MD5 6a38672c0c49171721c77afaed3fc7ad
SHA1 d1d3e7f3b32486451a996dc5218c8a300bc6f7cd
SHA512 9b315da521e5d2165041b99970fde01d4251d93111123ad00de0b823a13f44d1fd63a7230f7d82a897bd5a41a15db7ee9acdc4a1adbb3fd8ebd036706baa66b1
SSDEEP 98304:cF5D/RPwHDA7pV/15/qfw/g4sm8N99aQVpzpD7slCYbSJwDTZ:KpPwkdV/15/qfw/gE62Q76lCCSJMTZ
TLSH
T1943633BD268739E798B337683F3185A2614C45DD39D9193DAC02CA26BA1D3F5C3D48B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4EC946D.tmp

Path C:\Users\Admin\AppData\Local\Temp\4EC946D.tmp
Size 40B
SHA256 1197887b4f6adcfb206e7521cf3db1cf1a415a872bd35ec59ac76ea1f1c1efb2
MD5 0ebe86181e09397f2007f5d85c693e85
SHA1 fec96dc0cf2ceac467e896044ae600054e538628
SHA512 2f95d0d3c052535a1f498089fa8d7d1f200582f0a8453eaadc2396edb01281099c11a48c425f30994ba11bf8987e74a4c7c88a2c47ea2c9c6145aac95a98b9e3
MD5 SHA1 SHA512

Submit Download

d5a6-d185-31bb-0dd6.tmp

Path C:\Users\Admin\AppData\Local\Temp\d5a6-d185-31bb-0dd6.tmp
Size 15KB
SHA256 4d21ff370b1050a81fb3314654f3a365dfa8dee0e4c856069fd29bfc964a7088
MD5 4c232091c0cfb56da926ad12bc33b516
SHA1 5307bc3d5dc4245d035ec7da77aa2afb6d2c90ad
SHA512 abada65acffe0a7a9bf7f5da8385c4900aa7bad93db3720ce37114c5142ca1d4a2d3dcb7509b378e559622da96086f34233b1b1ac26d053da30a623572bd3295
SSDEEP 384:mO30tvOOXTpdD26peHmWTHRnd1kCAkFBeS2:bEtvOOjTDJWTHRnd12WBeS2
TLSH
T1AC72E1215813A27152E0FF63E60B28B06884EC1EC6D196797F06D528B5EBD1ED04BE5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memu.exe

Path C:\Users\Admin\AppData\Roaming\TreigenAutomation\memu.exe
Size 323KB
SHA256 6df5e87bfe261f38a5810313c8221c39b5b15206ce672e1a87167edcf82f43ba
MD5 22db418ed5bac1716f440c1e89e9216b
SHA1 d5b0a386edd880c6663fe1cbc0a70af04b1e830b
SHA512 5bcc3c25a46e8ef11383f2a1ac42ce60ddbf6efd7bd702d064dc01e7838b622e64916c01de7b1cab5aab6c10d56ffe9bdb5e37029ac8697d160fecffce08935f
SSDEEP 6144:mOtgZjM7oB12to2h2MWla+TQe9UP6b+X1zX0A:ntgZ4KS2L0q5UPcU1r7
TLSH
T166641BB2E9CC48A8DEA10EF9377CCDA0656ABA70CEB084DB630451751D2B7B0C571D9B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5809fe.msi

Path C:\Windows\Installer\e5809fe.msi
Size 8.8MB
SHA256 1f44284c85be477e6969685c02f302366f22fb8f2c2a3ac0b2dd9c99e1c4e67e
MD5 c46e2ae5a068439e70a857f942baa604
SHA1 e703e1b8c2da14ca54ed0343a8a8db80688f9057
SHA512 78823c7d6f99e47b7485ee30bfa8d2b39adb3cffb0534951e718fcceed33da6a5165a3a0b14ee3d812ca7e49be09b115fbbbed9de02f9eab362f89dc5f29723c
SSDEEP 196608:V9LuzXp14IgOL43JUeh9Ey/KnzAQZwYaaBIuLIUZkHfvOxDEsIf8BvM:VcjravUehT/KnzFuYDBzRLgf8K
TLSH
T19D9633B473605384E71FACF264681168A1E8CE667971505B6F0AB8B2F773E736910BF0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2744_1103316483\manifest.json
Size 165B
SHA256 880b2b81f96f7ec0799e2939e82955327f65a8e4edadfdd89cfebb70d8fb6f2e
MD5 3ef32f0bc4059ed77b8df1ddc1bd32d6
SHA1 180f08a503c8145e50e715a1dbe202b491de0011
SHA512 036d08f722ca62b9f5a21d79d9d6d0585f7255ff736ce717f72aff31ef0e194adb3481da6c690be7306818947efcdf1e6745d0d14de0c32bd088a5f93415805b
TLSH
T1EEC080029400197419CE47150D5CF388A722D7152D80B0165BD7C218DC3DC8B68F3B4D
MD5 SHA1 SHA512 TLSH

Submit Download

Other

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2744_1200623612\Sigma\Other
Size 34B
SHA256 2b4a47b82cbe70e34407c7df126a24007aff8b45d5716db384d27cc1f3b30707
MD5 cd0395742b85e2b669eaec1d5f15b65b
SHA1 43c81d1c62fc7ff94f9364639c9a46a0747d122e
SHA512 4df2ce734e2f7bc5f02bb7845ea801b57dcf649565dd94b1b71f578b453ba0a17c61ccee73e7cff8f23cdd6aa37e55be5cb15f4767ff88a9a06de3623604fbf0
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2744_1200623612\manifest.json
Size 132B
SHA256 de864bf0ab8abacfba536d4e9764eca658f903bd2457f955e128c4ee181c7e58
MD5 c9209ab189a035569ba3c65d7375d220
SHA1 1987aaec8f436325415fe36c168c9a37829523f9
SHA512 60495e096f78de05c6025a9d7b69aef9dce0d08ec1abbd4ccba206827a8c25d8449f54f93637599649762ec09a034d32fc8afc06199b1b57cd010ff1a0c850c0
TLSH
T17FC092615802797A14DEB7F00D29CB926AB3CB2E18A4650546F5C228ED2DCDFB5B330B
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2744_547574526\manifest.json
Size 165B
SHA256 fc5dd0f6692cb24ec676b53527dabff28114c905dd08f72c97ac54a22c1bffae
MD5 1bfafb8c67c4ae6cf99faf6f1fcbe9e3
SHA1 77fc3483a895f1f429e6c6bb0f294a8fdc69dd08
SHA512 7237c88400ae032f4e745d8f0e5a869c29a76f0151b61ad2aed2ae1be7fd0b759d81c5e6b47535586533c0ab25291a25822174173f1bf6dbaab0298366aaea73
TLSH
T115C012229844793A12A183840A31CA82B2A0020B34E129023A79408C4F350749101619
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2744_615352237\manifest.json
Size 53B
SHA256 5d7dbf6016a45872058051411fd7bc3ca1cd3294a1cedbab2b1165f5cfd38cce
MD5 9b673791fa0e25cb0081840b4d0ca435
SHA1 393094427e915bdc04a0393dddaba329750e0276
SHA512 a3c90c821e04a18b78192dc99bca2a33f46572d1e757c48f35cd69bf3b2ac55e8af685d41d27d39c5341eddaa4ae58f93c4a5c9ba3b61e867b092287b14b42d0
TLSH
T11D900260041492175AC10E546570B881A391661959850D1D0449165802A586CE050298
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2744_878998283\manifest.json
Size 78B
SHA256 c7e506687caffcf3906916ad3fc190a19212d67a2535479241096bd0d4418b03
MD5 259f068207f60fb9d4448c02c27b74ba
SHA1 99131d95cce94750a928738a99caa5c710bbc924
SHA512 fa41eac9d1ca244d06083e3d4230dd94700861155359722c1d815d0d9933dcd39c113b6f0f6ea02ff7ee1acd2fbc6ed40267d557afde16f417e80b678e8136bd
TLSH
T173A02230AC02E23320C803B002B083C383A02C02302A388C0B0320A232C823BE2F323C
MD5 SHA1 SHA512 TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.6MB
SHA256 7f8994111ff781bfdde28c16468b7e0e4550ee10c2448618dab61b2ff68505fd
MD5 2d9da0ed1a673e402beb7d229be94d01
SHA1 d64ba2548841449598afc38b29d1e04e4a15d65f
SHA512 178646e5c25a5a3a3bcdb08dbbc7bd1a139957fa7015a4dce4bc55a049ce388fcc6f031b65b72b76a64ee36d1d1e96c39c8de16f0d802509d8fa446fc24bc4d1
SSDEEP 24576:p2gmSp1IdoO/vvTLjWouhknavK5jQI8iGmrtX50ohTa40UM9oDJfrFyvR:Y
TLSH
T1FB47E32432F92210E7F79E3C68F06A67493E7D5B9C15DE8D05421F4E0A61BB0E872F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{1173cb3a-736d-45dd-953a-1ded8ffe6421}_OnDiskSnapshotProp

Path \??\Volume{f71a51ab-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{1173cb3a-736d-45dd-953a-1ded8ffe6421}_OnDiskSnapshotProp
Size 6KB
SHA256 0a1a72832eac058a1fc5f1fbaa0fa7f3a0c31754c75bb90cb9f9fdaaaa55a701
MD5 6ea8f19ac029525eade9527f455a2d60
SHA1 51dec335bcba70cae3e705f94405fe973177cd01
SHA512 b922f32f48dc258b5185167ec85ccfae30f4e83fc97350c16955fa79e20339dbecfe01addcd39ee7b9ecba970705e4624514b3b9e194d4f0f6eab00a86e2c96d
SSDEEP 96:FYdsrvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpuN:ayb++ZVmN
TLSH
T1CBD199085AF54311E2B3AB3229F18557A477B911EF33CB8E0298678E6670910F875F6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/800-36-0x0000021623780000-0x0000021624242000-memory.dmp

Download

memory/3044-99-0x00000000008E0000-0x0000000000C9B000-memory.dmp

Download

memory/3044-100-0x00000000008E0000-0x0000000000C9B000-memory.dmp

Download

memory/3044-104-0x00000000008E0000-0x0000000000C9B000-memory.dmp

Download

memory/3044-79-0x00000000008E0000-0x0000000000C9B000-memory.dmp

Download

memory/3044-84-0x00007FFCCDD00000-0x00007FFCCDF09000-memory.dmp

Download

memory/3044-87-0x00000000008E0000-0x0000000000C9B000-memory.dmp

Download

memory/3312-41-0x0000000074580000-0x0000000074670000-memory.dmp

Download

memory/3312-42-0x00007FFCCDD00000-0x00007FFCCDF09000-memory.dmp

Download

memory/5352-97-0x00007FFCCDD00000-0x00007FFCCDF09000-memory.dmp

Download

memory/5352-129-0x00000000753D0000-0x00000000754C0000-memory.dmp

Download

memory/5764-68-0x00000000753D0000-0x00000000754C0000-memory.dmp

Download

memory/5764-69-0x00007FFCCDD00000-0x00007FFCCDF09000-memory.dmp

Download

memory/5764-71-0x00000000753D0000-0x00000000754C0000-memory.dmp

Download

memory/5764-77-0x00000000753D0000-0x00000000754C0000-memory.dmp

Download

memory/5764-86-0x0000000000610000-0x0000000000689000-memory.dmp

Download