7767c497059054cde7e29d9bfa827e9a6cc065512dcc00c5bd89455a5f0fe282

Analysis

max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
12/09/2026, 12:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Docusign_Secure_Viewer_v1.5.vbs
Size 8KB
Sample260912-pmj3kshj7w
SHA256 7767c497059054cde7e29d9bfa827e9a6cc065512dcc00c5bd89455a5f0fe282
MD5 91ac1dc4acc10f01dfa8d81ca339686a
SHA1 0463c099e4c5ec2bdb2ee66a37e047a6adeff755
SHA512 b75a7f21d41b9c4d8558e452271f51b0b0342fb72a25639ca21e0112e0596b509d5a13ac72f0488a98c1678f317fa9e21bc679b073e72eec9a03f82194dc7d13
SSDEEP 192:ulPjmONo8ZRpyUH7UHcrJM5ttIBf3O1tXc726nuwsB1qy7SZgo6/czufNBA8xTWu:GPaONoIyWmnwM84g0Eo4nHLWWod
TLSH
T19B023D151995BEC8C478A36ACB230F353B3C4E267E26D0DAEDD3E400E9B92674B950E5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution

Malware Config

Signatures

Badlisted process makes network request 5 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	2356	wscript.exe
158	3472	msiexec.exe
172	3472	msiexec.exe
201	3472	msiexec.exe
202	3472	msiexec.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Control Panel\International\Geo\Nation	wscript.exe

Executes dropped EXE 14 IoCs

pid	Process
3924	Bluetrait MSP Agent.exe
4184	Bluetrait MSP Agent.exe
2748	Bluetrait MSP Agent.exe
4024	Bluetrait MSP Agent.exe
5104	Bluetrait MSP Agent.exe
3648	Bluetrait MSP Agent.exe
1108	Bluetrait MSP Agent.exe
2936	Bluetrait MSP Agent.exe
724	Bluetrait MSP Agent.exe
176	Bluetrait MSP Agent.exe
4944	Bluetrait MSP Agent.exe
2968	Bluetrait MSP Agent.exe
3176	Bluetrait MSP Agent.exe
4896	Bluetrait MSP Agent.exe

Loads dropped DLL 4 IoCs

pid	Process
2080	MsiExec.exe
2080	MsiExec.exe
4212	MsiExec.exe
4212	MsiExec.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 2 IoCs

execution

Visual Basic

T1059.005

pid	Process
4132	WScript.exe
2356	wscript.exe

Drops file in Program Files directory 27 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Bluetrait Agent\BluetraitPreUninstall.exe	msiexec.exe
File created	C:\Program Files (x86)\Bluetrait Agent\defaults.json	msiexec.exe
File created	C:\Program Files (x86)\Bluetrait Agent\LibreHardwareMonitorLib.dll	msiexec.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3568_783499460\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3568_1163993831\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3568_403930511\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3568_403930511\smart_switch_list.json	msedge.exe
File created	C:\Program Files (x86)\Bluetrait Agent\Bluetrait MSP Agent.exe	msiexec.exe
File created	C:\Program Files (x86)\Bluetrait Agent\Newtonsoft.Json.dll	msiexec.exe
File created	C:\Program Files (x86)\Bluetrait Agent\Renci.SshNet.dll	msiexec.exe
File created	C:\Program Files (x86)\Bluetrait Agent\SharpSnmpLib.dll	msiexec.exe
File created	C:\Program Files (x86)\Bluetrait Agent\SharpSnmpLib.pdb	msiexec.exe
File created	C:\Program Files (x86)\Bluetrait Agent\System.Data.SQLite.Linq.dll	msiexec.exe
File created	C:\Program Files (x86)\Bluetrait Agent\System.Management.Automation.dll	msiexec.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3568_1969318864\manifest.json	msedge.exe
File created	C:\Program Files (x86)\Bluetrait Agent\Newtonsoft.Json.xml	msiexec.exe
File created	C:\Program Files (x86)\Bluetrait Agent\libraries\paexec.exe	msiexec.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3568_1163993831\nav_config.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3568_403930511\office_endpoints_list.json	msedge.exe
File created	C:\Program Files (x86)\Bluetrait Agent\x64\SQLite.Interop.dll	msiexec.exe
File created	C:\Program Files (x86)\Bluetrait Agent\BluetraitUserAgent.exe	msiexec.exe
File created	C:\Program Files (x86)\Bluetrait Agent\HidSharp.dll	msiexec.exe
File created	C:\Program Files (x86)\Bluetrait Agent\Microsoft.Management.Infrastructure.dll	msiexec.exe
File created	C:\Program Files (x86)\Bluetrait Agent\x86\SQLite.Interop.dll	msiexec.exe
File created	C:\Program Files (x86)\Bluetrait Agent\System.Data.SQLite.dll	msiexec.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3568_783499460\protocols.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3568_403930511\manifest.json	msedge.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\e58daab.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA28.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIAA6.tmp	msiexec.exe
File created	C:\Windows\Installer\e58daab.msi	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{684DED94-F377-4A42-98C3-F39D2A0AA757}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICAA.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE51.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1027.tmp	msiexec.exe
File created	C:\Windows\Installer\wix{684DED94-F377-4A42-98C3-F39D2A0AA757}.SchedServiceConfig.rmi	MsiExec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4732	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 16 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	Bluetrait MSP Agent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	Bluetrait MSP Agent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	Bluetrait MSP Agent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	Bluetrait MSP Agent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	Bluetrait MSP Agent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	Bluetrait MSP Agent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	Bluetrait MSP Agent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	Bluetrait MSP Agent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	Bluetrait MSP Agent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	Bluetrait MSP Agent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	Bluetrait MSP Agent.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134337996506900408"	msedge.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	Bluetrait MSP Agent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	Bluetrait MSP Agent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	Bluetrait MSP Agent.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1846164713-4096795028-774071693-1000\{06BAE66E-CA6F-42B3-A850-99ACA2C3C8A9}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Script User-Agent 1 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	2	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3472	msiexec.exe
3472	msiexec.exe
2080	MsiExec.exe
2080	MsiExec.exe
4212	MsiExec.exe
4212	MsiExec.exe
3108	msedge.exe
3108	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe

Suspicious use of AdjustPrivilegeToken 59 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1304	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1304	msiexec.exe
Token: SeSecurityPrivilege	3472	msiexec.exe
Token: SeCreateTokenPrivilege	1304	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1304	msiexec.exe
Token: SeLockMemoryPrivilege	1304	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1304	msiexec.exe
Token: SeMachineAccountPrivilege	1304	msiexec.exe
Token: SeTcbPrivilege	1304	msiexec.exe
Token: SeSecurityPrivilege	1304	msiexec.exe
Token: SeTakeOwnershipPrivilege	1304	msiexec.exe
Token: SeLoadDriverPrivilege	1304	msiexec.exe
Token: SeSystemProfilePrivilege	1304	msiexec.exe
Token: SeSystemtimePrivilege	1304	msiexec.exe
Token: SeProfSingleProcessPrivilege	1304	msiexec.exe
Token: SeIncBasePriorityPrivilege	1304	msiexec.exe
Token: SeCreatePagefilePrivilege	1304	msiexec.exe
Token: SeCreatePermanentPrivilege	1304	msiexec.exe
Token: SeBackupPrivilege	1304	msiexec.exe
Token: SeRestorePrivilege	1304	msiexec.exe
Token: SeShutdownPrivilege	1304	msiexec.exe
Token: SeDebugPrivilege	1304	msiexec.exe
Token: SeAuditPrivilege	1304	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1304	msiexec.exe
Token: SeChangeNotifyPrivilege	1304	msiexec.exe
Token: SeRemoteShutdownPrivilege	1304	msiexec.exe
Token: SeUndockPrivilege	1304	msiexec.exe
Token: SeSyncAgentPrivilege	1304	msiexec.exe
Token: SeEnableDelegationPrivilege	1304	msiexec.exe
Token: SeManageVolumePrivilege	1304	msiexec.exe
Token: SeImpersonatePrivilege	1304	msiexec.exe
Token: SeCreateGlobalPrivilege	1304	msiexec.exe
Token: SeRestorePrivilege	3472	msiexec.exe
Token: SeTakeOwnershipPrivilege	3472	msiexec.exe
Token: SeRestorePrivilege	3472	msiexec.exe
Token: SeTakeOwnershipPrivilege	3472	msiexec.exe
Token: SeRestorePrivilege	3472	msiexec.exe
Token: SeTakeOwnershipPrivilege	3472	msiexec.exe
Token: SeRestorePrivilege	3472	msiexec.exe
Token: SeTakeOwnershipPrivilege	3472	msiexec.exe
Token: SeRestorePrivilege	3472	msiexec.exe
Token: SeTakeOwnershipPrivilege	3472	msiexec.exe
Token: SeRestorePrivilege	3472	msiexec.exe
Token: SeTakeOwnershipPrivilege	3472	msiexec.exe
Token: SeShutdownPrivilege	4212	MsiExec.exe
Token: SeDebugPrivilege	3924	Bluetrait MSP Agent.exe
Token: SeDebugPrivilege	4184	Bluetrait MSP Agent.exe
Token: SeDebugPrivilege	2748	Bluetrait MSP Agent.exe
Token: SeDebugPrivilege	4024	Bluetrait MSP Agent.exe
Token: SeDebugPrivilege	5104	Bluetrait MSP Agent.exe
Token: SeDebugPrivilege	3648	Bluetrait MSP Agent.exe
Token: SeDebugPrivilege	1108	Bluetrait MSP Agent.exe
Token: SeDebugPrivilege	2936	Bluetrait MSP Agent.exe
Token: SeDebugPrivilege	724	Bluetrait MSP Agent.exe
Token: SeDebugPrivilege	176	Bluetrait MSP Agent.exe
Token: SeDebugPrivilege	4944	Bluetrait MSP Agent.exe
Token: SeDebugPrivilege	2968	Bluetrait MSP Agent.exe
Token: SeDebugPrivilege	3176	Bluetrait MSP Agent.exe
Token: SeDebugPrivilege	4896	Bluetrait MSP Agent.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3568	msedge.exe
3568	msedge.exe

Suspicious use of WriteProcessMemory 63 IoCs

description	pid	Process	procid_target
PID 4132 wrote to memory of 1124	4132	WScript.exe	85
PID 1124 wrote to memory of 3568	1124	msedge.exe	87
PID 4132 wrote to memory of 2356	4132	WScript.exe	88
PID 3568 wrote to memory of 4780	3568	msedge.exe	89
PID 3568 wrote to memory of 4732	3568	msedge.exe	90
PID 3568 wrote to memory of 1980	3568	msedge.exe	91
PID 3568 wrote to memory of 1980	3568	msedge.exe	91
PID 3568 wrote to memory of 1980	3568	msedge.exe	91
PID 3568 wrote to memory of 5092	3568	msedge.exe	92
PID 3568 wrote to memory of 5092	3568	msedge.exe	92
PID 3568 wrote to memory of 3716	3568	msedge.exe	93
PID 3568 wrote to memory of 3716	3568	msedge.exe	93
PID 3568 wrote to memory of 3716	3568	msedge.exe	93
PID 3568 wrote to memory of 3172	3568	msedge.exe	94
PID 3568 wrote to memory of 3172	3568	msedge.exe	94
PID 3568 wrote to memory of 3172	3568	msedge.exe	94
PID 3568 wrote to memory of 2896	3568	msedge.exe	96
PID 3568 wrote to memory of 2392	3568	msedge.exe	97
PID 3568 wrote to memory of 2896	3568	msedge.exe	96
PID 3568 wrote to memory of 2896	3568	msedge.exe	96
PID 3568 wrote to memory of 2392	3568	msedge.exe	97
PID 3568 wrote to memory of 2392	3568	msedge.exe	97
PID 3568 wrote to memory of 3816	3568	msedge.exe	100
PID 3568 wrote to memory of 3816	3568	msedge.exe	100
PID 3568 wrote to memory of 2320	3568	msedge.exe	102
PID 3568 wrote to memory of 2320	3568	msedge.exe	102
PID 3568 wrote to memory of 2320	3568	msedge.exe	102
PID 2356 wrote to memory of 1304	2356	wscript.exe	103
PID 3568 wrote to memory of 2136	3568	msedge.exe	104
PID 3568 wrote to memory of 4536	3568	msedge.exe	105
PID 3568 wrote to memory of 2136	3568	msedge.exe	104
PID 3568 wrote to memory of 4536	3568	msedge.exe	105
PID 3568 wrote to memory of 2936	3568	msedge.exe	106
PID 3568 wrote to memory of 2936	3568	msedge.exe	106
PID 3568 wrote to memory of 4832	3568	msedge.exe	108
PID 3568 wrote to memory of 4832	3568	msedge.exe	108
PID 3568 wrote to memory of 2064	3568	msedge.exe	110
PID 3568 wrote to memory of 5024	3568	msedge.exe	117
PID 3568 wrote to memory of 5024	3568	msedge.exe	117
PID 3568 wrote to memory of 3552	3568	msedge.exe	112
PID 3568 wrote to memory of 3552	3568	msedge.exe	112
PID 3568 wrote to memory of 884	3568	msedge.exe	123
PID 3568 wrote to memory of 884	3568	msedge.exe	123
PID 3568 wrote to memory of 4948	3568	msedge.exe	116
PID 3568 wrote to memory of 4948	3568	msedge.exe	116
PID 3568 wrote to memory of 5024	3568	msedge.exe	117
PID 3568 wrote to memory of 5024	3568	msedge.exe	117
PID 3472 wrote to memory of 2080	3472	msiexec.exe	118
PID 3472 wrote to memory of 4212	3472	msiexec.exe	119
PID 3568 wrote to memory of 2304	3568	msedge.exe	126
PID 3568 wrote to memory of 4740	3568	msedge.exe	127
PID 3568 wrote to memory of 1784	3568	msedge.exe	128
PID 3568 wrote to memory of 1232	3568	msedge.exe	135
PID 3568 wrote to memory of 1232	3568	msedge.exe	135
PID 3568 wrote to memory of 3256	3568	msedge.exe	141
PID 3568 wrote to memory of 3256	3568	msedge.exe	141
PID 3568 wrote to memory of 3184	3568	msedge.exe	148
PID 3568 wrote to memory of 3184	3568	msedge.exe	148
PID 3568 wrote to memory of 4804	3568	msedge.exe	158
PID 3568 wrote to memory of 4804	3568	msedge.exe	158
PID 3568 wrote to memory of 3108	3568	msedge.exe	162
PID 3568 wrote to memory of 3904	3568	msedge.exe	172
PID 3568 wrote to memory of 3904	3568	msedge.exe	172

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Docusign_Secure_Viewer_v1.5.vbs"
1⤵
- Checks computer location settings
- Executes a VBScript file via the Windows Script Host.
- Suspicious use of WriteProcessMemory
PID:4132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.docusign.com/
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1124
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://www.docusign.com/
    3⤵
    - Drops file in Program Files directory
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3568
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x25c,0x7ffb8ef9c188,0x7ffb8ef9c194,0x7ffb8ef9c1a0
      4⤵
      PID:4780
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1836,i,11196123198937162416,17437083788649213424,524288 --field-trial-handle=2268,i,13761593784254162845,3848322657790998032,262144 --variations-seed-version --mojo-platform-channel-handle=2304 /prefetch:3
      4⤵
      System Time Discovery
      PID:4732
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1676,i,16077990007680872507,8450687164834818329,262144 --field-trial-handle=2268,i,13761593784254162845,3848322657790998032,262144 --variations-seed-version --mojo-platform-channel-handle=2264 /prefetch:2
      4⤵
      PID:1980
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2556,i,18355500963325981008,1736663433849597814,524288 --field-trial-handle=2268,i,13761593784254162845,3848322657790998032,262144 --variations-seed-version --mojo-platform-channel-handle=2624 /prefetch:8
      4⤵
      PID:5092
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3492,i,18273600376525562523,2022521950973079703,2097152 --field-trial-handle=2268,i,13761593784254162845,3848322657790998032,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
      4⤵
      PID:3716
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3512,i,2278796526978413627,15152052162949840539,2097152 --field-trial-handle=2268,i,13761593784254162845,3848322657790998032,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:1
      4⤵
      PID:3172
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4284,i,13047558988105418384,8281895356453336746,2097152 --field-trial-handle=2268,i,13761593784254162845,3848322657790998032,262144 --variations-seed-version --mojo-platform-channel-handle=4332 /prefetch:1
      4⤵
      PID:2896
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4296,i,1936978803821296753,14680456777608818460,2097152 --field-trial-handle=2268,i,13761593784254162845,3848322657790998032,262144 --variations-seed-version --mojo-platform-channel-handle=4360 /prefetch:2
      4⤵
      PID:2392
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3656,i,7690043361874931526,13698665662819914971,524288 --field-trial-handle=2268,i,13761593784254162845,3848322657790998032,262144 --variations-seed-version --mojo-platform-channel-handle=5116 /prefetch:8
      4⤵
      PID:3816
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5280,i,7898936813150926810,8248495321717044343,2097152 --field-trial-handle=2268,i,13761593784254162845,3848322657790998032,262144 --variations-seed-version --mojo-platform-channel-handle=5316 /prefetch:1
      4⤵
      PID:2320
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5496,i,5449617168245451991,8501304225619811871,524288 --field-trial-handle=2268,i,13761593784254162845,3848322657790998032,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:8
      4⤵
      PID:2136
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5500,i,18039723037764126940,10318248430087495263,524288 --field-trial-handle=2268,i,13761593784254162845,3848322657790998032,262144 --variations-seed-version --mojo-platform-channel-handle=5548 /prefetch:8
      4⤵
      PID:4536
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6020,i,4987826050844452467,15621379972063096658,524288 --field-trial-handle=2268,i,13761593784254162845,3848322657790998032,262144 --variations-seed-version --mojo-platform-channel-handle=5220 /prefetch:8
      4⤵
      PID:2936
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6268,i,14430357755637954868,547244938616115443,524288 --field-trial-handle=2268,i,13761593784254162845,3848322657790998032,262144 --variations-seed-version --mojo-platform-channel-handle=6292 /prefetch:8
      4⤵
      PID:4832
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6788,i,4689512687298320283,15920489224297008346,524288 --field-trial-handle=2268,i,13761593784254162845,3848322657790998032,262144 --variations-seed-version --mojo-platform-channel-handle=6876 /prefetch:8
      4⤵
      PID:4568
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6788,i,4689512687298320283,15920489224297008346,524288 --field-trial-handle=2268,i,13761593784254162845,3848322657790998032,262144 --variations-seed-version --mojo-platform-channel-handle=6876 /prefetch:8
      4⤵
      PID:2064
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6068,i,12423741783638836485,15574018934449693698,524288 --field-trial-handle=2268,i,13761593784254162845,3848322657790998032,262144 --variations-seed-version --mojo-platform-channel-handle=6040 /prefetch:8
      4⤵
      PID:5024
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6664,i,1494560123387062902,14025532029553601532,524288 --field-trial-handle=2268,i,13761593784254162845,3848322657790998032,262144 --variations-seed-version --mojo-platform-channel-handle=6720 /prefetch:8
      4⤵
      PID:3552
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7092,i,3615637535977208228,9713436954400057772,524288 --field-trial-handle=2268,i,13761593784254162845,3848322657790998032,262144 --variations-seed-version --mojo-platform-channel-handle=6560 /prefetch:8
      4⤵
      PID:884
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6504,i,8084981882126513845,1181924105888544323,524288 --field-trial-handle=2268,i,13761593784254162845,3848322657790998032,262144 --variations-seed-version --mojo-platform-channel-handle=6496 /prefetch:8
      4⤵
      PID:4948
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7056,i,4540019440124339855,878471455530170930,524288 --field-trial-handle=2268,i,13761593784254162845,3848322657790998032,262144 --variations-seed-version --mojo-platform-channel-handle=6520 /prefetch:8
      4⤵
      PID:5024
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6080,i,8544394207261248790,15081199392957311494,524288 --field-trial-handle=2268,i,13761593784254162845,3848322657790998032,262144 --variations-seed-version --mojo-platform-channel-handle=7072 /prefetch:8
      4⤵
      PID:2304
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7060,i,5219051444978687729,16457208412487325166,524288 --field-trial-handle=2268,i,13761593784254162845,3848322657790998032,262144 --variations-seed-version --mojo-platform-channel-handle=5228 /prefetch:8
      4⤵
      PID:4740
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6040,i,10089504843931707106,3365319745007752281,524288 --field-trial-handle=2268,i,13761593784254162845,3848322657790998032,262144 --variations-seed-version --mojo-platform-channel-handle=7132 /prefetch:8
      4⤵
      PID:1784
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5772,i,15195362130759349522,15616086457329418804,524288 --field-trial-handle=2268,i,13761593784254162845,3848322657790998032,262144 --variations-seed-version --mojo-platform-channel-handle=5780 /prefetch:8
      4⤵
      PID:1232
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6984,i,11892658710080210799,16786444102950756717,524288 --field-trial-handle=2268,i,13761593784254162845,3848322657790998032,262144 --variations-seed-version --mojo-platform-channel-handle=6996 /prefetch:8
      4⤵
      PID:3256
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4672,i,5848467585480250949,9429261753210777522,524288 --field-trial-handle=2268,i,13761593784254162845,3848322657790998032,262144 --variations-seed-version --mojo-platform-channel-handle=4636 /prefetch:8
      4⤵
      PID:3184
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4684,i,9462986179389925443,7172733092648201591,524288 --field-trial-handle=2268,i,13761593784254162845,3848322657790998032,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:8
      4⤵
      PID:4804
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7100,i,15610071776748894027,11199494268432265260,262144 --field-trial-handle=2268,i,13761593784254162845,3848322657790998032,262144 --variations-seed-version --mojo-platform-channel-handle=7092 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3108
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5892,i,12009204872262052982,6028900523656708707,524288 --field-trial-handle=2268,i,13761593784254162845,3848322657790998032,262144 --variations-seed-version --mojo-platform-channel-handle=3808 /prefetch:8
      4⤵
      PID:3904
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\Docusign_Secure_Viewer_v1.5.vbs" /x
  2⤵
  - Badlisted process makes network request
  - Checks computer location settings
  - Executes a VBScript file via the Windows Script Host.
  - Suspicious use of WriteProcessMemory
  PID:2356
- - C:\Windows\System32\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\rad64B97.tmp.msi" /qn /norestart
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1304

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3368

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3472
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 88F26A021115D0D1B6E46AA1A64545E9
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2080
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 0E3A9CBE28A9957999E82428C2B42492 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4212

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2868

C:\Program Files (x86)\Bluetrait Agent\Bluetrait MSP Agent.exe
"C:\Program Files (x86)\Bluetrait Agent\Bluetrait MSP Agent.exe"
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3924
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3924 -s 956
  2⤵
  PID:884

C:\Program Files (x86)\Bluetrait Agent\Bluetrait MSP Agent.exe
"C:\Program Files (x86)\Bluetrait Agent\Bluetrait MSP Agent.exe"
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4184

C:\Program Files (x86)\Bluetrait Agent\Bluetrait MSP Agent.exe
"C:\Program Files (x86)\Bluetrait Agent\Bluetrait MSP Agent.exe"
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2748

C:\Program Files (x86)\Bluetrait Agent\Bluetrait MSP Agent.exe
"C:\Program Files (x86)\Bluetrait Agent\Bluetrait MSP Agent.exe"
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4024

C:\Program Files (x86)\Bluetrait Agent\Bluetrait MSP Agent.exe
"C:\Program Files (x86)\Bluetrait Agent\Bluetrait MSP Agent.exe"
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:5104

C:\Program Files (x86)\Bluetrait Agent\Bluetrait MSP Agent.exe
"C:\Program Files (x86)\Bluetrait Agent\Bluetrait MSP Agent.exe"
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3648

C:\Program Files (x86)\Bluetrait Agent\Bluetrait MSP Agent.exe
"C:\Program Files (x86)\Bluetrait Agent\Bluetrait MSP Agent.exe"
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1108

C:\Program Files (x86)\Bluetrait Agent\Bluetrait MSP Agent.exe
"C:\Program Files (x86)\Bluetrait Agent\Bluetrait MSP Agent.exe"
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2936

C:\Program Files (x86)\Bluetrait Agent\Bluetrait MSP Agent.exe
"C:\Program Files (x86)\Bluetrait Agent\Bluetrait MSP Agent.exe"
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:724

C:\Program Files (x86)\Bluetrait Agent\Bluetrait MSP Agent.exe
"C:\Program Files (x86)\Bluetrait Agent\Bluetrait MSP Agent.exe"
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:176

C:\Program Files (x86)\Bluetrait Agent\Bluetrait MSP Agent.exe
"C:\Program Files (x86)\Bluetrait Agent\Bluetrait MSP Agent.exe"
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4944

C:\Program Files (x86)\Bluetrait Agent\Bluetrait MSP Agent.exe
"C:\Program Files (x86)\Bluetrait Agent\Bluetrait MSP Agent.exe"
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2968

C:\Program Files (x86)\Bluetrait Agent\Bluetrait MSP Agent.exe
"C:\Program Files (x86)\Bluetrait Agent\Bluetrait MSP Agent.exe"
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3176

C:\Program Files (x86)\Bluetrait Agent\Bluetrait MSP Agent.exe
"C:\Program Files (x86)\Bluetrait Agent\Bluetrait MSP Agent.exe"
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4896

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Bluetrait MSP Agent.exe

Path C:\Program Files (x86)\Bluetrait Agent\Bluetrait MSP Agent.exe
Size 260KB
SHA256 065937fb350fe7ca5a37aa9ce7f311c384c087d097c2ec21916ede2f4c5bc4c5
MD5 0f87b7872926ca026a03261af7a4572d
SHA1 37b053bee96a2a30c6f1d7d91980a268c62e8bbf
SHA512 451b136a037311e400de823005c798ed8fd784f1acbd755686346eaee8085c178a736c7b58032f7430a1ff3173613e31c81252cdb54fb4c1918439963c99994d
SSDEEP 6144:hKxeAE8dx3c1mRRHjSzvX0OdH6LrUXjbEHpR3J6A9h9j:hKxeA/dx3cIBJUMHpRXt
TLSH
T1CD44F71533E8861AE9BA0F399875801042F3B9476939EB5D0FCD64CE3F637809A25B77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Newtonsoft.Json.dll

Path C:\Program Files (x86)\Bluetrait Agent\Newtonsoft.Json.dll
Size 695KB
SHA256 e1e27af7b07eeedf5ce71a9255f0422816a6fc5849a483c6714e1b472044fa9d
MD5 195ffb7167db3219b217c4fd439eedd6
SHA1 1e76e6099570ede620b76ed47cf8d03a936d49f8
SHA512 56eb7f070929b239642dab729537dde2c2287bdb852ad9e80b5358c74b14bc2b2dded910d0e3b6304ea27eb587e5f19db0a92e1cbae6a70fb20b4ef05057e4ac
SSDEEP 12288:GBja5bBvR8Q0TE2HB0WLmvXbsVG1Gw03RzxNHgKhwFBkjSHXP36RMGy1NqTUO:GBjk38WuBcAbwoA/BkjSHXP36RMG/
TLSH
T166E4394123F98F2BE1AF6B75B4704E1543F9F917A6B5E78F9A04D9A91C43B408E403A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

defaults.json

Path C:\Program Files (x86)\Bluetrait Agent\defaults.json
Size 134B
SHA256 d2952c84b75f8c3c4eee50abbf2645058d20f7491e12448a07fb93db89591ee5
MD5 8510b51c125f003d92f605e2fd0e750f
SHA1 ac702bf1bfeaa3184d529e42a10d2d9a151c2601
SHA512 de112102ee2e3e366ba1270a1c7959e244fce2c1b22da82f3bd9c5050fa482c86b11a71ed8b5251c245a66aeb0b1c9c9ce7cabee4b4c2491923da957265fc393
TLSH
T1A6C09BF13776123349F0435C585558C5A3835C5C2484BFD9735A5069781CCB51270704
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping3568_1163993831\manifest.json
Size 160B
SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
MD5 c3911ceb35539db42e5654bdd60ac956
SHA1 71be0751e5fc583b119730dbceb2c723f2389f6c
SHA512 d8b2c7c5b7105a6f0c4bc9c79c05b1202bc8deb90e60a037fec59429c04fc688a745ee1a0d06a8311466b4d14e2921dfb4476104432178c01df1e99deb48b331
TLSH
T1F1C08C73CC08AE7911B14B371B214642E3B8030B600039093A32084C0BA47B00262328
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping3568_1969318864\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping3568_403930511\manifest.json
Size 165B
SHA256 fc5dd0f6692cb24ec676b53527dabff28114c905dd08f72c97ac54a22c1bffae
MD5 1bfafb8c67c4ae6cf99faf6f1fcbe9e3
SHA1 77fc3483a895f1f429e6c6bb0f294a8fdc69dd08
SHA512 7237c88400ae032f4e745d8f0e5a869c29a76f0151b61ad2aed2ae1be7fd0b759d81c5e6b47535586533c0ab25291a25822174173f1bf6dbaab0298366aaea73
TLSH
T115C012229844793A12A183840A31CA82B2A0020B34E129023A79408C4F350749101619
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping3568_783499460\manifest.json
Size 135B
SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
MD5 616eb6b585f16811dc5db5063e088cd7
SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
TLSH
T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
MD5 SHA1 SHA512 TLSH

Submit Download

protocols.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.12\protocols.json
Size 3KB
SHA256 2edf732da5fd827859e7a1a5b69a4a622cfc416f60a6ae04154d5aad3a1bccec
MD5 5e2067a92dcfcb05537479c384a89725
SHA1 eeed29b07d865ac4d46629fddadad629d0ad4e2b
SHA512 c96c5f9cb7a169ad91b070b567cf9fa8f35951ccc5aa930e97dbeccbeac27f7e9dde1379138c9ba6b0d10339f9cb053ef21f19f06d7560f97d5d23a27c8ed4f6
TLSH
T17D7184B7862088194E360AB4AA0DF10DF93702DF2AF598D3B27D455F1F712BB3946249
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 d11bd63a3c8c3641d5bd4407fbf20115daee67c3050695788e54c8df9585c700
MD5 7aa846396cdcfea376b8811e8e19c8ac
SHA1 ec25e76211c784e758c9892460a28903222a2b23
SHA512 4816b3d9d1883ae78008726282d2a4c42f9b30d81ff004d60af22873868f3ccc332adb8973ee5a1ed3fdec5d56a832c2ead1cfe30616125d07466daec4eaf02f
TLSH
T17DD02203FF038A2CC8C00CB2002EC22C0F8AF8000A00B2C08030328BCC28B00B02EC88
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7481989667805f861819a64a3969aaaf46d409d3cc4fe4b19154b579a00c6e16
MD5 a70a868c80f3eeab924f0b5bd11ac679
SHA1 22ca93079bed2cfcd0fa02ef66751ff5288ac608
SHA512 380ff0ee96c6b0037a0ca6f886ef323cc451588842ad026ea5bd4a5e33587abc8a13aec63444eb9137cad40409498bf6e0730b0a623f020bfebec6de03bf7d19
TLSH
T1C8D01103FB828A2CC8C008B2002C822C0A8AF8000A00A2828030228A8C28A00A02EC88
MD5 SHA1 SHA512 TLSH

Submit Download

f_000080

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000080
Size 31KB
SHA256 5a76d2231ed8f84cb5936f8d3042f6c30b084d46646d9976969ec7939e8f0c54
MD5 701eefeb1fdb0fb7c4c621b5b096c8c6
SHA1 ec61e4d2ffebf7d72bdc430751d1abb87b920833
SHA512 cca1dfe210072cc0bcf4412c5a8da0be2c499bdcc7568ab2a56af98b6f8f0ccbcffc06bd8e3d239f57fa637a8065e97876b6f41c7880d1a88165c9846af7a545
SSDEEP 768:bNUgQpLqffj3oGFgoMiCK33K8MfqojuHuGbC0Og2FkI:bNcAk7k31A1jW2fg2FkI
TLSH
T1B4E2F13327838F5EDE3217B9E602D76F9B0EB363251E415449B0631EAA46450DF62E8F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 50702e77160acfe89e3afe0cbdc2ffcb83c70e19fa2a4856be286b0d98f70882
MD5 2a05f84c064e24271607fe3325e2c1b3
SHA1 617b15a6105ab8fbba70a43aa0e6a6ec380e15da
SHA512 40a4b29ea06cdebbf3a76e034f4ba7f55bfdfbfe73fda8f884267851f2d3492a8d746a974019807a08ee4670af65c1466cb9629f97a8e23ced7ca3f7240a174a
TLSH
T18C81CAD3C4E09AE8FBFC477965C23B43F738B4D279475E2B01A4D27A44463E99982078
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5976dc.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5976dc.TMP
Size 3KB
SHA256 06d0123830a0b1ec7e4adef9a2da23ac820c0949c32f5f38675b6bdb9f30b6c9
MD5 f5f3aac2221af6a6eebee37c39c70a63
SHA1 6c1338b03f8cf01e637e37a3c190a14af9c4d992
SHA512 e785e8e101ce45ce96ef4d012b9254d25630cb8dfe028c84a4ab31a7f853a828e492fd253c17e73eec92d698086be56834b962f396568792291a625e33b243a1
TLSH
T1E06193D2C4E069EDFBFC43B9A5D53B87B73895C2768B5D2300A8D4BA48063D9E682074
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\wasm\index-dir\the-real-index
Size 96B
SHA256 2d12debf7f78706f7aaca073f33c183250aa07e7ffb01372a8d63c4da9988359
MD5 e1b6361e5e4c85ad5160a2dda493ba00
SHA1 a3b40a0d7896f1983fab4ddba0529cbd1179f2c2
SHA512 2ee44acefe4138a54ee3628c5bdcf33c5eb87d7f5227eae308d6e61070dcd7385958a6a10fb7325379cf2029a9b7a79cb2574bab4f0c4865dd1a67b2b0ae69a2
TLSH
T15BB012AC20814802FF8087B060870C40F8254D108213D20B0041C360DB126500143082
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 ad6c44c42ce24cf2ab5551005d82ecdecf31c92bf4c54fbba70fee7052a0025e
MD5 996b64d1543a7121eec56950857ab78a
SHA1 d2e147c5256a91aee8626fab03ab325ea379dd2f
SHA512 92e2f52b74090fd7e3d761841f37f9e3435f6b99ceecd03dc6d7b0105c39aa4425f6651e6cd1cee91ca8e0cbe0c1951696d2a02daca4e4fbc10c4ea8ed6b6a5f
SSDEEP 192:DPARn1v2kWwuX6IWDsDIcXmGD5YDedi0RDagwVaDp5DDDV9:DPARn1v2kWwuX6IWDsDIcXmGD5YDedio
TLSH
T140E15CF3C7F45A2DCD2252F5AB367E2ECE190914632C392AC6E46F1B93E2474E10195E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 af0b4d12a60f535a82ab12b5fa7a20f18248abfe21b73c5cc39f4e2bef35349b
MD5 6c1b45af75653a55cb721f21665d0742
SHA1 09254595da42f0e7dc863409e05b33f71b0f302f
SHA512 d394b6d9634a6451c89ccbe7c5b1c7c50089705986c44085745efabba0659e14515990d54c54534472b550a880b8ff37cfbaf3ef51836b7ebd0bc4c02ccd2554
SSDEEP 192:sxZ5RtsW/fGs/jEdpMdHW6+WNIdV/eS0PGr+4YBHMkIgyJ:sxZ5wW/fGs/wAHbw/ehvxO
TLSH
T111228752AE38697B4CC7E219BB25BF13E6F9103295D01E94EAFC861C05E76DD2207C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 76d935e1f6089a6494810faa45b511642c48f736ad15b91109946d20920d49dd
MD5 5a07a8c9716f345d650736757e87d59b
SHA1 6d43667fc9fd3446b3d3a78ef3162cd4b7396fe8
SHA512 67279fbee3404e2d0b15ac66537d4f60262d6327a9d9cc4d9d8d5a283616cd45dafb0e30494df36ff2209c3879b41b0102004cf1cfe3ec1cdc413accf506cb42
SSDEEP 192:sxZ5RtZW/fGsZ/63IdpMdHW6+WNIdV/eS0PGr+4YBHMkIg5cJ:sxZ5dW/fGsZSYAHbw/ehvxW
TLSH
T12732A752AE28697B4CCBE219BB55BF13E6F9103295D01E94EAFCC61C05E76DD2207C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 c03e71b102b6d5a542ac96d8c0cb860b20d1390e98da560f065382540c16a80b
MD5 686cffa0f74fe97b846c62032fd7f9e7
SHA1 58baa12ec2efd06dc0785d19e131d545fb579018
SHA512 86e4155293dae76dd86b40455ff2cb2e0bc81eeacf32cad7db807814ca18a53e452d6fc22e2c88914954c813daa98b6e401f57954e07db83593af876fa265aaf
SSDEEP 192:sxZ5RtZW/fGsW/63IdpMdHW6+WNIdV/eS0wAPGr+4YBTMkIg5yJ:sxZ5dW/fGsWSYAHbw/ehrvlg
TLSH
T10532C852AE2869774CC7E259BB15BF13E6F9103295D01E94EAFCC61C05E7ADD2207C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 768a0e0c4000ba9d5c4cfecb5d3163efecb8fc84e39e879a25e5b2c036628e20
MD5 16342dddccf915b0d688c2d000f07504
SHA1 7ddd6128a6444c4de4c542efb334aa12df6c072b
SHA512 feca80e9d48f1e48f42cef5dffbc3b78960a4f59558f005e0c75a9539582a420bec230258d057aec00b787043a12d74c4f17b31b973bc4f5c72fbbf09772b246
SSDEEP 768:jkyYRcjWv3NpB8F1+UoAYDCx9Tuqh0VfUC9xbog/OVcCLlGcvXYropi4e:jkyYRcjWv3NpBu1jazCL8OXju
TLSH
T1BBC2E93F640DCB7E4FC01E9DDC5A6F9B2E9802C796548D4047FA954C02C77EA912A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 8f44a952c876277def25c253442595b1195d4d9d1d9fe8982761b751c034facb
MD5 bc52355fd17b396cfb51b563f16ebe97
SHA1 244b8370c83c03953dfb7ab60dbaf5c245228e6e
SHA512 c841afeda19e917397bad37473af5bd7e2fee9c3012cd436e5553ed8d893a1507fc9e5ce3e214ce0e174505defd85a5b108a25b4739f9c869a49dcdf24599dbc
TLSH
T1E7A0025019C9D802CC240B7098862A43B3518CE10205821B44E8D5ACFCD77A9A2D1113
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59360a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59360a.TMP
Size 48B
SHA256 ab69f237a7d0ab0532b0bf349e0c5a1c1826f1220d2630a27d99429073e898ea
MD5 4b9c535b366b1fb1662dd920c0cf9db9
SHA1 e0d8ca45f4038d5d37aa45b8eb86a415020b58a1
SHA512 4ee802b0a832ec8aa24c01eae3b83ac36ff1e5c816a0a04c8b16eccc89bffa82ff49682e3ebec9c0a56b660341612c63ef78397ba8444221c0806ff0c199ba8b
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 7baeda00d2187cb1c99012895a57bcbab55fba480f08325fcbfd43faf1b94103
MD5 b237c4fe8a79f7e9bacf982036c0baca
SHA1 e330ccee4efe31c1c5ff33b0b795923b9f9d3a42
SHA512 0d648cff2d52fccb53a032267363765e8530791c4ad2d1e924fd61f8417f37406a79b36b53bd19fe4e597f5475b733d9f947b7e041a7320235c1e334ea476a67
SSDEEP 96:KwhQwKpq+nvKFxvV1xQRAsyJxKa4yPx+Hf4JkPSKkwt:ITnvKFxvV1+RAFJL4yPoHf4Jng
TLSH
T1D1911002327B125038BD2A4C9570872F428276733119EF2BBFBD52A58E6BE441DFE5D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\07683786-daa8-4f84-bd42-f293587189d5\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\40373ad4-30ce-4883-9e69-f339cc79d8a1\index-dir\the-real-index
Size 14KB
SHA256 77fdb1b557ddfdcb986497f7714eea94320967cd9b80f42c969e5942d049028f
MD5 01d3ed7905921a5a49573620e2a2ca79
SHA1 90e5ef47d68789e8fa032cc44ef60abcc18ec5d8
SHA512 57301e3cc3b0292a90696eb7833d9cf8b7117da30166a0d7458c85fc3e0b76232ca79a6b58e616d6bb4d1017fb04e03d100192036b62491d54b894ee9a50486a
SSDEEP 192:Nz2vUABaMP/YWDo6MzZVCv78wLw+1mS9ya/YrR7m8Wx:F8UYaMPPB0ZwT8V+1rlYryx
TLSH
T1D4522C48E9334B68FBF9263D04D784582B3471557A086EBB135AF0313E9357836829BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe5a7e78.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\40373ad4-30ce-4883-9e69-f339cc79d8a1\index-dir\the-real-index~RFe5a7e78.TMP
Size 48B
SHA256 8c1ee621071df421e5d65bdf80da03eb5b1af930679248ba18e3bf5b74973457
MD5 bdf46b2fe2e0d6939c1e3fbd8d037d4f
SHA1 6235ec0ee6e233104e10fc7a82cb5166e95e78ac
SHA512 e0cebcad1090420d8a3d41e5bed14e4cb4b1ed32a9aaa87cbd2ec9ad38c4e84d06423485711f6604fe307c564a65d42700ce31f0a5bf09602ff39e7eb1dd1363
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\517592cc-b8d2-4cb8-a845-15f5b87f16a4\index-dir\the-real-index
Size 120B
SHA256 08dead4b0ba2f666fa441f7c8e7ca2e5159d1d51269d4403e815cbfc6ddf6d25
MD5 783e710682ee8725284a973facb71391
SHA1 92f92c0afd4cfe8b38042d7c5fe15711e9d1091d
SHA512 60b2f8fbc71e17d26ed8a51506c85065d1f0ac76794aeac12e1da2d2296e77840e3df1e4ff43fe2e5b17ce64304c2277cb10f01d8bb31778813f0e1ff4f58756
TLSH
T1D7B0126900450083E8F0333335C11C04733F1B30830F071540D041304C247804053504
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe594b67.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\517592cc-b8d2-4cb8-a845-15f5b87f16a4\index-dir\the-real-index~RFe594b67.TMP
Size 48B
SHA256 e34b9d28162764b489cea5e6f651794bf505f3afa01d9629e3f89fe23c607ab0
MD5 7c534bda4d0a646b765356ef8c3fb39e
SHA1 ca300a82b54c0038bfb724faedd40ec1d38634dd
SHA512 06a82cb94f63b6ca4c4415db7775d73ce57dc211f9c91db9eb90e99732a47ca999c8aecb14bf0f2e711ef3c11f51d71ef5acbb87151e1beaf88450650c587eff
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 436B
SHA256 4b81f4f20960dc4671912606743a66c92474320a18a45a707afa28eeaa5f29c3
MD5 3e198e525b3cf2975ded1ace7543f634
SHA1 7fed2b573fb2a32207cd282cf18d2b3e4a34eaba
SHA512 2e02212d6aa4334c8965a96779861a19eee29f081620ce31ad976a0aedc971b5bce23e4d0b4e6996149286d83c9949f5be1dcebda7056449b34a11d955413d14
TLSH
T136E0A376915079601271498F30A776C6AC76B6062C80CCCC40B121454AE1A73BA30A2D
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 686B
SHA256 91f4225796ee087763c6a2c78a2dc8ff320ebd08408cafb49bd5db1113be6e64
MD5 e088ddc675edf4de822da8d1866f498e
SHA1 d272173e590ebfa07c480340b232660dbaa0b785
SHA512 167c3c5846d633a12cbd22101ae6b1374908f7f9edcfd0ecf32f791a6aeee9ea16924a07239319cb23d0127c4d4d6adff78f5cd60731481624a3b2370e07ef1e
TLSH
T1E5019E756590B07552729C4F20B776C3BCB5B6173C818CCC40A1220909D2F63BA3092C
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 957B
SHA256 1697f860f3ccc0baaf4eea015dae70a562cbc4f953ee0a6089e9931c1ab68431
MD5 51b30d1a66591f5b4c538d959e815c33
SHA1 a98c803c136d78fa15bb3e61c4052b1b3b61191e
SHA512 91cb7163d198c22d93f8cc90440c49ed82dc8d4df9de87397087aefa86df83bb4dccfec5a7b98047c7726c3a58ec2855aed71e1c3e14a1d7b0c9418e5b340bca
TLSH
T1A3117A7965A0B5756272DD4F61BB7682BCB1B65B2C418C8C00A1221905D2FA3BA30A2D
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 1KB
SHA256 a5a5a5c0d0de20bc9c4f4e006d37ff1404d84574b0d33ff9b2af92335f7d9de8
MD5 0b0bd5afa473fb13238a8d6b20dfc24f
SHA1 f92bd36c48dc70fdce9ace246b16108bb4cde9b4
SHA512 fdf76b7d10125eef32f0c593a57c429d15f2256aa3ed3e9ea5469203b52ff3c3683bbaf071e6788b921b4c05ed39c5c70a78b518543a8259b282870a7c00c452
TLSH
T165217C746AE0B1766176DD0F64BB66C37CB1B65B2C418C8C10A1224905D2FA3BA30E3E
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 1KB
SHA256 655be2246eeb37d0fbb2ca62b81616989ecb6ea46f546199fdb2a3d596a234e4
MD5 d93814272682f7908b9f59a39c9d3aa5
SHA1 7dd368846182325532d1ea5b94cdc07d7d2d87e5
SHA512 5562c9f15fbc4993969c898c290a3d39f90011fb7f626b14d75a308bcedee29de8ccb0aae4524c4e9eb082fbdf410616c629f8932090404f9617caaacd6f31c2
TLSH
T1EE31ABA469E0B1366176DD1B64BB66C37CB1B65B2C42CC8C10A1230909D1F53FE30A3E
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 1KB
SHA256 ad795abd7441452db4d4c2a0f1279b5ea2de3bafced0e6462261aaaefb2786a7
MD5 239f1285e08c9d7b9282763cce39a5e4
SHA1 3273793269a2555c753489853ec5c40166059414
SHA512 a7a83c57bc68258d194615ccddb0883a3a6432c6db32b5a77790d569708a03d6886ba3468c169afe096100f4c9861def95b5b5ad95df7361e616e5ec7508187a
TLSH
T1B9419C64A9D0B176627BDD0B64BB26837CB1B65B2C41CC9C50A1234A09C1F53FD30A2E
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 2KB
SHA256 f7bbd7358959a51047761563c0bf3c7ddf83a63cec6a5b400ffa529303095177
MD5 d59a53c9b46c4fe09a6219698c517e81
SHA1 6979281b438934d39b1070587282600e3718e9d2
SHA512 46856edd55a802d852c9771cc9b403405ed28f05ecd17f0f7b6da66a659d64c41fe3baf2900e75bf7263c66ec1aeaa767ba8af1423429ac637f8a54f86021790
TLSH
T12A41AC64A9D0B1726277DD5B64BB25837CB1B2572C42CC9C50A0224909C2F63BD70A2E
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 2KB
SHA256 5672ce6da1ed70e15b74564b54e3d46982e63945f8d1e5cc1d1ced5b054ec405
MD5 f87502c5e20802df4653e00425c5eb7e
SHA1 cc8b9665be940f573786e9da33a649b1e5edbed4
SHA512 b3e5a990c9c6c9a1bcead8f1cc7bc72322280bf2ed02c2fb7f50932eefc6120577d87009c1caa733e384d038ddc74b6644b13ff5ca967c3c3b39081d1330f2e1
TLSH
T14341BF64A9D0F0716277DD1B68BB25C37CB1B2672C52CD9C50A0224949C2F63BD71E2E
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 2KB
SHA256 5b20314828631c2a224e296f288e001812c0465f8fbc68671e8eca1c0af6b455
MD5 72660a7463d3fa24c2291703ed3bc205
SHA1 a733f8ee6bdc6eba67b446e6c3558fa729893012
SHA512 9caf5c975367a5f0e78cd4a1b1908b749485b97a2c2212434712ed555c68ddfae76f8ed32599f50f050d3c3d81995b86528daf3dda1beb173563b32169011231
TLSH
T15241D0A4A9D0F072627B9D0B38BB35C37CB5B2672C51CD9C5060224949C2F27BD31E2E
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 2KB
SHA256 f1031e53479001524e3aee265623d6f2be9dfd7f979a9b9facf323be3b4f7f43
MD5 0b65a5dbca6d394996309d95f0caf451
SHA1 05662c1cc1a69f100ffe663c3e84c178df47d5b6
SHA512 9ff1b46f3844127500a7b2d206e62472cbfcfee257c6dd99ce454fa728b4d49aa0082a40b36f3c5a8c4f000a10c7cda0cf499863eb52c09da3ed970ff8292809
TLSH
T1EB51ADA8A9D4B07262778D0B28BB2587ACB5B2672C51CD9C50A0534949C2F27BD31E2E
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 2KB
SHA256 04eb3d01fd7dd4d14149810b2a6a6c07632547c6dc9925a8a8f0a7936d5449f6
MD5 0b43a8047a97686b6c28f3677a045819
SHA1 c12a7bc7b900ad3070f72fa9e6afe478956f99a1
SHA512 fbab748902dbe68f2d43e33054b9a5eae20556a9ad44860773ee4593de678dc1ef667431942a1d0bebc42bf226df315c3fcf77a9d6072491499db9828363c0ec
TLSH
T15951DF98A9D4F07262778D0B38BB3587ACB5B2973C52CD9C54A0534949C2F17BD31E2E
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 2KB
SHA256 a89d9d6cee4f70e17774ef939496822633fd65a3313bd91787e63443f99acdb3
MD5 110c9ac84718b445fca224fc20cce510
SHA1 95393ac9c903c4811089f39578a33ea0a2dda665
SHA512 b468a5522f18a85b8e0b8add77bc3a08e2f1f212c3a999dcca7a9837f74bd69e440526b07c63484b4cd67f71592a947e393ea79477195ff78fae17cc00a2c6ce
TLSH
T1FD51CC98A9D4F072627B8D0B28BB3587ACB5B2973C52CD9C506052494DC2F17FD31E2E
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 2KB
SHA256 f8c8e0e840cbf7b115bd3399f57897adffa96ebd75658183d66e30b29c71dc6b
MD5 af72eff6410bdd03cae98699f3cb4b0c
SHA1 6452338d0e6f728988c1a674b8833c6e1b3f82d2
SHA512 608802836443db60e8ed041c7104fa98bd1a74fc9d807709276f834573530195ebce6a5dfc7c6a48f70d164558e3e2a5cfec63b4b3715033cd67c99a52e25239
TLSH
T1AC51CC98A9D4F072727B8E0B28BB3587AC75B2973C51CD9C506012494DC2F16FD31E2E
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 3KB
SHA256 b9ae9df96c929c1b63ca60021183e4d6e09e54b3f198799d5918084f2d23b8d1
MD5 ca9a2c604d98639a3caf1a54738d615b
SHA1 053d1e1938c4e2c0e4ceab9ebdb1201b2ac7562d
SHA512 2aea68796dd61610876811a3e33f3c0607fe7d4b5095ff8f0540de861bb566971e2e9167c78d13525ca465dbd4dffeef796b29914bfdf326a4a2d94d00d8cc58
TLSH
T16A61CD98A9D4F072767B8E0B28BB3587AC75B2977C51CD9C406012498DC2F1AFD31E2D
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 3KB
SHA256 75ef5a41f716480f765e9330d8949a7dac49bfcbc0f5f7e6c58ac69750e46e06
MD5 9319b8c16da2369d8cff89bef1fbb263
SHA1 c0f73e31ffe73025f77101ab36d66a6c443e52b9
SHA512 9142c8c7a3b3c3be254936298db76ea413df8eee74d9460087dd58c71dd7b563ba8dfc031f8ef53914c69b3f058d28323dc3d045b6aca0a4b2e84c07da72e349
TLSH
T15571CD98A8D0F072767B8E0B28BF3587AC75B2967C51CD5C406012498DC2F1AFE31E2D
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 3KB
SHA256 84340858b83e43231045998201db1ddfb5599c4fa2bed39781ea9107e9ca15f4
MD5 23db5228b0c038be56530b00644b5acc
SHA1 1820266c8d6d5ff88db216a1db9db186d8fa9104
SHA512 30df02256193329da93787f3f8449a102d125db62eddf0f3284afe8c8c646cdab0d31ae202f80883651d17556ad8973ea0dc9b7aed0ad0897492b8d25d341212
TLSH
T1F871DD98A9D0F072767B8E0B28BF3497AC75B2967C51CD5C406012498DD2F1AFE31E2E
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 1KB
SHA256 735761f03d20f40431acb575a7a4d6a8b62cfe45a223a4e0bfc79aeef60c29c9
MD5 3a9fa745828a7f285bf63f116f2bcc84
SHA1 c1b3ba34ffc1ee064cbaaf93be2c5cee2c38d957
SHA512 5dc5619a1b9189989faca2ec577fc07660c125e909d9fb9be697bd07a54f0623431f2c18da05a2813efac850c49249ef1bceabdbb6b1a1ce3f2f2e3d48b87cb8
TLSH
T1F8318B78A9E0B1766176DD1B64BB66C37CB1B65B2C41CC9C10A1230905D1F93BE30A3E
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 3KB
SHA256 c0dbc4ee1553d2db059a1bfc6597d6f39af57ed10aee046a755d2aedca772d60
MD5 fc3280a8c87a8b40856ba3ba04f49ec1
SHA1 25be69df65bdb9b6364559751ce2d9ad832eadde
SHA512 a5eb8d0382e80a51502562285ba1c10d6b979b203921a1cc191ae8ffa03b8e20364d8bf7658005ee6f4906e269466b63641f77632573e75eede4ba42ff672535
TLSH
T15161BB98A9D0F072767B8E0B28BF3597AC75B2967C51CD9C406052494DC2F1AFD31E2E
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt.tmp
Size 3KB
SHA256 c87872d836d2f6d62ae170468a63a0a3c8fb8ccbf69309f98d81169b4d8cffa8
MD5 db5b02ba1727911ab0743d8a27cab6fc
SHA1 23102c5df608d8c5b5d93c33bdc030265b14f64e
SHA512 43369a15d7197cfcdb19ceb3f36966c21217cbe7df73fdbe9a758d9bbb351a3ae68f76301900384c8ebb5aa90483e793141a5c243e6086ab686dd2a3f14b3f20
TLSH
T10D71CC98A9E0F072767B8E0B28BF3597AC75B2967C51CD5C406012498DC2F1AFD31E2E
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe58e990.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt~RFe58e990.TMP
Size 190B
SHA256 755c6e367ef70294a2689d332bd1a6fd7d1098b630e7eb2ecca76a28034f022f
MD5 ba78a9ee1b8565fbde0926215f451146
SHA1 b5273d06450bf13e244ad6e6a85f494802d77997
SHA512 ecfad284a081673f4fbf524fb0330bf7b6f03cc89e46bf842d4f9fed82d63286b6b78f59545b6920fd813fb7c47e1b7696e6d32712287c2989f1ddbd48798278
TLSH
T140C012B701202861A7B416DE700776DA85775D085C90DDC4C0A924509FB5A336656F65
MD5 SHA1 SHA512 TLSH

Submit Download

819ac60a-7d5b-4eee-90a4-94ad60310f43.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\819ac60a-7d5b-4eee-90a4-94ad60310f43.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

office_endpoints_list.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Data Protection Lists\2026.6.5.1\office_endpoints_list.json
Size 9KB
SHA256 f0c77aaacfc571e0bc3f51387febe134d991bf3c7f1941af303ed901f288dcd6
MD5 30719122f9edf4e23019a3b74e4f4325
SHA1 6707d64052797b9c5f1a5ccf016e5859c8ef898b
SHA512 ec2e1a33fcd1301f282512ffafb611ea705dc5df09d9aee014276909c1b62b0c73600121d94e9b6d9e160296672b41f2cb8c3ba23f121244ad2ea6521680723c
SSDEEP 96:DdQ/JJvwjyUsrdfsysVsnQfbJNZidYusysXYs2sFsdv12XvlRT07s/DkhcrHPglW:D7d7mfgiIWRcV4sobxezQd1Y
TLSH
T11512BB3BC4B49F229AB060659705E244F13C43BF5600C6FF76B9829C1F366ECA58E1E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 33f7aef53bb387fc68787119a5a868d7cc8e71fc14f90a5137450a1d78e7474d
MD5 5c30d12a73a98ad492c2dab4ac45ffe8
SHA1 eafc7a114ffaff7a16aee15104c7b4795dfc59d2
SHA512 9a986be102a959e18d521ed693c280ef542244681c419e0e717e2a48727f52694bb0047294f255736bc3e21b6a2cb81c438f241acedfb4f2b9c06f50efc2dea9
SSDEEP 384:zEsNwdQJwiWap4QX5+DtT863IAXd3VX3b:gDoprkDLjd3VXL
TLSH
T107422A31B8A8AC7B69A7A495B08732139FB45177D7886F80DAEC1F1C00DE69C530AD17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 14KB
SHA256 45f6e0993b40b776a65081a866f06b2d7e0633d8ac6872850680ed5b2792a08b
MD5 68a0cdda2b662c49d90e234c22dbd5e0
SHA1 8155622ff3a7a56c9bd82fd69e268cb9cfd92684
SHA512 83b052bf569ac9e5d05182276c3dcf62280c520f9d0c5817ffb569b78ea8686c3b3889493acb4a9b72605d37944d71e420f1a17764dbc29d243b8365b931ab8a
SSDEEP 384:nTsNwpQJwiWsp4QX5+DtT863IAXH3Vsa+VYeGN:TfGprkDLjH3VhgLq
TLSH
T15B625C31B9A4BC7B5AA7A595B0473213AFB451B797882F84DAEC5F1C00DE29C130AD17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 14KB
SHA256 571614864794c370594f277c5816da4194412b272e1c3724ad19fcd541b5c9da
MD5 175b54db832bc5d4edae325ec378a61b
SHA1 43887c37bd712848dedfdc3a15b2072ed2b9ac54
SHA512 5e001c6f3210bbec6520ad9d98ac4bd96c6f56ba6dca10b6d32be27f86341932bdba973d050f9d184eec2788ebfd4b5029b1d502fe21a7b66c4fae16ade59b5c
SSDEEP 384:nTsNwpQJwiqsp4QX5+DtT863IAXi3Vsa+VYeGN:TfAprkDLji3VhgLq
TLSH
T1F2625B31B9A8BC7B5AA7A591B0473213AFB451B797883F84DAEC5F1C00CE29C130AD17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 88d0a77c2a8e43107c9cc2ed57a9adfa4c8c0256a2b71470526868ba225238df
MD5 5ca50758eb22a4c3298dd67f2d1a63b0
SHA1 0ac8e60012ed3057cbe6794fb0743df168f67450
SHA512 5b701dbc981e4fe3372cc195f5ff14c7268c315e3733da565b5152ba0298a13d1bf7e187a0ad542aa16fdb8a99632ce0e8f9e0381ece596b9dc098c5eb18c8b7
SSDEEP 384:noZcICsNw8QJwiqsp4QX5+DtT863IAXi3Vsa+VYeGOoY:WC+AprkDLji3VhgLtj
TLSH
T150827C3169A8BC7B59B7A185B58732139FB4907797C86F80DAEC9F1D00DE6981306C27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 c78c3785c279ac64acca55fb80f28e02467ea50ac3eb7a670d5607339ad526af
MD5 612c965f7ccd9f80d41d41198335e741
SHA1 f773a0721b00f788df268039c2b6ecc2d97fbdfd
SHA512 159e375a2299ed70a54f8c088ff8324bb5986d0a42a285a721ec30eef6815d689a928f02240ef1c4272a1750de7265adda48b0a9775bc00283095f1780524f22
SSDEEP 384:nSiFiZcIvQsNw8TUNTUlIl8QJwiqsp41DfY4X5+DtT863IAXA3Vsa+VYeGOoY:ZFQYZwgQApP4kDLjA3VhgLtj
TLSH
T112B21A72D9A4DA7BADF797C1B64672439EF051A386CCAAC4DADC5E0C009B6DD030AC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 c6207524b6705a34cd46f818638e7ddab9bf7cf0ab3c9ba2f66e48405181f232
MD5 c541718943503bef80226ed76c5f5194
SHA1 1518874e0ed79129023e6c2ba708a30578d1daf2
SHA512 3bc7fd284de0cb847d14903c0a7e01ef840736a29f8c18b5961fbaedf4fa38dfb3f6aa19180b5074c5e1577572db98a0b86ced0ad0dc305db6f1526703243e44
SSDEEP 192:EONg6nnHGQmiUytrQYcX5hQDP1Djzor63I3cMcqF+8U6:EONg6nCaQNX5+DtT863IYaU6
TLSH
T19302DB34BCA87CAB8AF7AD45B48733139FA5217BE5946B80DAEC5E1D00D765C2306D23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 3875c7717a1ae26e04c0d5af9836d73c10fec25b26d1c0111b5e1ac70bec9509
MD5 8f604c2fa0708b0f68787ae00acf2c99
SHA1 a7abf565a67f96f2fca11f402938910b34c1eec9
SHA512 6db839d76f709db4e752947932b87cc27657b8d64b8b7a3b562a7b0305a83a014beecd0ee0743a4c31b546e1d2ce1234c070b5e4f3e1a55345966d4c8ea5f1a9
SSDEEP 192:EONZ6nnHsQmiUyermYcX5hQDP1Djzor63I3wXkeMg39/5VU6:EONZ6ncvmNX5+DtT863IAXv3VU6
TLSH
T18112EA35E8A8BC6B5EE36495B08731139EA55177DB487FC0DAEC1E2C01DE66C530AD23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nav_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\WorkspacesNavigationComponent\1.0.0.5\nav_config.json
Size 2KB
SHA256 98252dc9f9e81167e893f2c32f08ee60e9a6c43fadb454400ed3bff3a68fbf0d
MD5 499d9e568b96e759959dc69635470211
SHA1 2462a315342e0c09fd6c5fbd7f1e7ff6914c17e6
SHA512 3a5922697b5356fd29ccf8dcc2e5e0e8c1fd955046a5bacf11b8ac5b7c147625d31ade6ff17be86e79c2c613104b2d2aebb11557399084d422e304f287d8b905
TLSH
T16B51DB73D5988C4B9BF4A29CE919A309F11107CF75D48C0B76BE010C1F7757AB5C6588
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
MD5 c1bec3bc77db46888e279f8b3eeb18fc
SHA1 c2d14f387c796193ddc6378267768745c10dae14
SHA512 8d41fbab8134eec1a95a53d4d56d1d2edb1edced5b2f4987278e5b8f6ac9b169c9928a0c52ebe7a66393caddfa5a29e001890386b54105a8e69958661b40ec35
TLSH
T134F09E808C3E1AC5D6B90F6FE40716FC40D8591670D9287844CEE4A8A47B05B311586D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 dfd849519674e5bb4ad3563f649c70456f17961c00916e6b191cbe51162f0c79
MD5 693135cdf37d786b1401f577922311ef
SHA1 c5ade57e0d05095bfc0f9d75c773930e1c521f30
SHA512 3ff7516b9c4783264ffad22ca6ef91a054eb8f70fc3160a0bcaba1445fa15a8061596cd054d4ffbf4ee7c133ddbec35cedc0bbc5e40dac196b38b39b4071a281
TLSH
T14341D858AAFA1108B3B7AF5A9BF6A96E847A7D771F06D55E00110D4F0A33B40C462737
MD5 SHA1 SHA512 TLSH

Submit Download

3ecdcda9-0bc5-4f4c-996b-3a573c381f9d.tmp

Path C:\Users\Admin\AppData\Local\Temp\3ecdcda9-0bc5-4f4c-996b-3a573c381f9d.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c91f55c0-38ae-4a53-b99a-2ff618f8e4cb.tmp

Path C:\Users\Admin\AppData\Local\Temp\c91f55c0-38ae-4a53-b99a-2ff618f8e4cb.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

rad64B97.tmp.msi

Path C:\Users\Admin\AppData\Local\Temp\rad64B97.tmp.msi
Size 3.7MB
SHA256 65f607b3eaef02b148247c4e18260fd4008d42e5fb592bfc07218bb1c771bc0f
MD5 a21d45f014c3a3dd2767abd3367cbef1
SHA1 bd540a11ec7c03619a66124dec02587a213a95ea
SHA512 b54bd73fa0d7c1865e2160076d9acf1af0970894320b3e1dba524a3fe5be4a103d8853c2aa4b06ef1a375fa11c63124e4575dfedd3284c9599491b82c3109ee1
SSDEEP 98304:iEGnWq+Cbs7bT/q7pQuHjje3yDZmR8434/WvJ:BGn6Gs+7rv1k/
TLSH
T1540633317990453AE2BA1D30863EA571AF7EFE280B58D49DC390B80E1D709C267B775B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

47ab1d3b-d5ed-49f1-98be-f99a98a8007d.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3568_1494467743\47ab1d3b-d5ed-49f1-98be-f99a98a8007d.tmp
Size 157KB
SHA256 e03138d37406c2bedec93e5a7c44a457a6b19cf4fee5dfe5a46450fcea1bf85e
MD5 088d09e1a5cd1db2f55a4f5131b75b3b
SHA1 4e017079555c92f2f9419a53ab89aae7c5425550
SHA512 f8e7a1652d20778af9e0aefef0f24bb477260eefd5c6cecd3b4e17276b7d6c8d79554e850b9a9fdd9c65095ae16dad8868df304ee7a057ec7cea5a35b9e526ad
SSDEEP 3072:sA30KAb7L7nAnBPxnb8b4HpQgHY15vClaH4d6r1tx:sAkKAb7L0Qb4HpQgoq8tx
TLSH
T182F3E1AD2FEE891ACD0B50BD3B04B38BC90A8F07820A655F735F8015997475D17A2DFA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3568_176195493\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIAA6.tmp

Path C:\Windows\Installer\MSIAA6.tmp
Size 234KB
SHA256 78860e15e474cc2af7ad6e499a8971b6b8197afb8e49a1b9eaaa392e4378f3a5
MD5 8edc1557e9fc7f25f89ad384d01bcec4
SHA1 98e64d7f92b8254fe3f258e3238b9e0f033b5a9c
SHA512 d26c9dce3c3d17583ffb5dbcd3989f93b096a7f64a37a2701a474c1bf4b8c8b1e922c352d33f24e411f1c793e1b4af11a3aec1de489087d481b1b636df2050cd
SSDEEP 3072:5XiqyhTO8W0iEa8LW0bEC9hvZpC01v+eUKflQnZl+T+J7g6EsNr7wyy/IP3:5qhy8VKU3hvZUy+ppHEsuB/
TLSH
T159348D217494547EEBFF0832953AD671AE3DF2380B90C96EC384581E6D618C1A7B7B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3924-937-0x000001E8E5990000-0x000001E8E59D4000-memory.dmp

Download

memory/3924-954-0x000001E8E6230000-0x000001E8E6252000-memory.dmp

Download

memory/3924-940-0x000001E8FEAB0000-0x000001E8FEB62000-memory.dmp

Download

memory/4024-1408-0x0000017D61740000-0x0000017D61842000-memory.dmp

Download